last executing test programs: 2m30.780069538s ago: executing program 1 (id=169): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x81) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000240)=0x6) socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r2, &(0x7f000000bc00)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000300)={0x40000000, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000003c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000440)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r3, &(0x7f0000000540), 0x800001d, 0x1c) 2m29.223019086s ago: executing program 1 (id=175): r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f0000000540)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000640)={{0x2, 0x4e22, @empty}, {0x20000010304, @local}, 0x0, {0x2, 0x4e28, @dev={0xac, 0x14, 0x14, 0x10}}}) 2m28.943911243s ago: executing program 1 (id=177): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x0', 0x3) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0xa4a7\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000900)='./dev\x00', &(0x7f0000000940)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/ttyGS0\x00', 0x2, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) write(r2, &(0x7f0000000a00)='test\x00', 0x5) close(r2) 2m27.655458345s ago: executing program 1 (id=189): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sec\x00', &(0x7f0000000180)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0) syz_fuse_handle_req(r0, &(0x7f0000001540)="217e85b50586813ca8a29f0bdf5bb78bdd034138e14fa3a60caaf3caa33ef3ac5446d296c0b5a5b2157c895e6457352b974be5d8495b0cfa2fd9e415a7463985c43b2564de27eef8faa79255da6af97b1e19a8e727bb964a9a3fb93940601c7dc725320e1de1a10f8992426b7f0d0ff3673cc472b2abfdb32c6cbf971b5f7cdea13c5291cfc5287ce6a6cd32a5a8ca4ab7cc4f3a1fc30c0cb02053cdd7fc9d102abf87d5e1cef13cf43dcd650235f0026b894b6bb5294daaf514e9617d38da63fde1dcc8d40e1ca0493e90b7e0f0398d649e8f69684bcc313fc26d49911b0ffaaf4a7ab1086dcaf191ab50b635a0342f36c4831e232edc85015f78357bdc17ada03b92b7fdc851b4659fe1d258e3109eba19622fbebb132ecfcd1aa0081bede5ecb8787200fedd2661e5e0bdbce9b19452db8d2d986a97ab8d2ea573820b4d951ad616aac4eff6830600000000000000af7e7b0a87b09fb022b4ef85c199e9a99e79a4eb37fd58266f679ded3c0ea8dfc64ba57c3d319a4d9787a189de901bb28cd022c44a2024a617f7deee79cbfde0c0eeac0f18baace936480d489c0ddb1350bc5594a5182438e1278095a249aabcfe98de26fab3871d83fe674eb12a2538737fe416fe75473b6253dbbd23559b0be2131fdf644171f4684500f1bc0ebf91a8010f3853123a5e2357bb5fac0e3cc74ad6d7a3b2a4972481ca3ba3c1af3c18387849af8f21f3d81f0770fa667a9e07c1210106e9c81cfedadc39dc4d5668be6a0ac01f957a3bf8ae9de500201bb288888ac969660c05bf71dfcdff1098b5a134affd08d5316d0c4e99df5751e2cab9444b7655d37ff65fc0c1de768f4ebf01aa3533809108ed4853c2c0cfe07824c6ade0b1863bdaa464d06332402b30bbfc2599e16531e3e3afc90be506e114bbb3fd72a86b1f571a5380fb0c8635b350c11ce5538b3706b2a690c89de7b39588f92cf9a47d4f3b63bf789a61c1f5bec772e131a6fc079bc311b0c56ae75bc01d8c7437f296c2fb2974a822ead41c9f333d4834a4d6a58dbe579b3577a5998659765ef83b2efb601eeb7e7725925c4a1f6786d1abb971a3e18b624e303dd9b1b2a7a284e4ffd9ddcbe9ed0968ed3241dd9be99de9d6140668663c6a931bcd86e4cc5df973296b62ac7bba1ce6761c2f1562d3033cd1d731fe976ac29503a044c7eb66b8cd2037b2b66f6cc7cf5a33698f6bf4d602741d25345bfea19336599fec791a0c64f13ba537bc156e62c8eace5e117f2652b2851800064ab021ee2addc40ed8b3c67ad0c98f71de6e7e68112fa9d689141c6d5a15da4e472176e77315df003f97f0db3bd6b7d55b804e5f809c3f2773d1e4db7ba762d22715889dd09e9d8ebd87ade42da1e85a98524f48777773a95c97fc3cb6e7a2416b871164a01a7ff32bf444bd905176f5a0a87d13b37499aa33b38ce14720980012fe0dc7dc07061eff65f7a66df8c16489c99de167feea2527869be27520192e3ca6c78b43ce4dbfae087d4e1785fbd0ab3d5c4f2a8c178dce6c32c73ba6c0d0d2767b938559f66038aaa6ee766e568062a56556b2dc5d0064af675d422b8bd676ddc236d4d271518cf5ddec3c3a230e38377ee08dc25d5784db2cfa6c779de55afb6f82e49d56e79c488fb9bf8ad771e518b03187e07ef8bdd5bc9bab3dd6dd0bbdc5d04adbe8ee210069f0ec51759b102597063532168935731781e3281e0a971b502fd8a563ec0724571fb61f0c32355956b3cd8b9bc3279eecdfc81151b2657e58305d332a711c05031b93d03a233d770d4717f0dc9bd97f807bc343f806be3e9030a83b6dc6a3d731dc1daae0109b73c00386a379e84fa661ff41300a712af3b1f9a2858a5f5d191c5dde9f95c250277be32b760b95f453de22dbd6dd970622e3f5d6830375850a9b2e275a913e48f808d8dda5c07d32e464179257fab8ce92e33f086484ff8448ae413a0e1478dfdecbf477b26d5aee75cbf1f2a5a06079cb534b67718ebb51f704985c19f2580241728bb2faff29ebd81a67f6f44e61ad42a5da18f939da47ddc52474871521ac733da45cf1a521ab3196996553261ae53478fae33afd36b7e2125ad7dc38b62657e35748809191997377ed18bca857822f21e4e66960060ab48539725e316e1f8244b35e805cf6f01b32c95abb527a1954870d9d11cde762e19788b2ac837f7d0726231090a22431366ffd8b8fa12a8aa3c3793c2970152fe7f75955d34580e00049628b1bfeab69378a38106f7451cc7e3f8336966a6f2e362912ebe34fbf5aa33d56bfe5dfe4c3c0e2298ad11053bb83816c744b3df38aab86202a2362543c511ea66a0ec3c4711c626cc4e377ee764c9dd51b7dd77fff5c2783bf403e1ceac5ce7dd5f8e4a95a38d491c690d6403e83e899d2ce2dd44f309418e8381fd93823206811edcbab2bd3d3a210b1c1392fe4abbb85eab303792f0dc393d2cac4003f30e77cc8d7541e532ba11397670f280b6f9388cf61108a56483488c3fa7e358eede7b5314549f52bb4ef295fafa6092fa8dbba94b27380258f4a4b3ee37185b16fd73c75b730d46a05efa868cc90b2b3617cd7de1b3de758d55cdc53a1f2ddf0211caa9a5d9a864becfa74e9a47fa31d7856a9a30bda4743b60ab4d4b36d588abcd0b4dfd2d835d10d5bef098e2fd0f617fd59468859cd13664329cc011ac4e677336516d1c853e8c5a37e09c2f7168d78998a9584ce5a666f418f9fba55857c6e80caf101daf48566c3b1e69bcf5b32bdd756b39da5268c1c38a859e8d0f80d16cbd8db33b1d3d4784259234733511701eb5c889f39051a499f9403566199a8b0fe06ec5c41beca27115befebbd1c0281a3722fc2d77d092c4509fe5589525c868be4ff1e2df53be13e28d725a7c1da6905e1ee0b8c26ba5029763e805c1946d404cc60b65ea516bff59d7258c8a5fdab53123aac6e12e6c4ddcbe01ff2e7950aaafd6970b5b05f45ed1985aa2322fed508850aa0674e0c855f58a557c301e8d1d7d60599fcf67a0d10c5064fcdc1df9759cd81c734b9cc5ac00773890c37f719288efb6ab9903d11f9d3caf78cbd885fb45cd52c00b04a421a76c38aa3f75fef04b48840ee05e49f80b104f086d3c5ffa517356030101e9752a600a6f67399897dbc3698616508b6a70ab8aca3547a798a1716cebe5d5af4a366bc77848470be6bf91f4c115568870d830cf1ccae377dcb7cdd6b5b9ee64de6529a0cd683ea80569b57d81c0f529bf3d6df3e930d3af6585911d46d5d8954c97747b05ecae1437af3ac9a3760fa5d60da3778b040c40259ee7f632f8db2da53c703365908d6e4281bea8ecbc13d88d87533f048fd5629937a5e79fa0bf993ceb11304dfb210e68a39cb53969203fbaebe084c61f3a9c38b6b89791a2285c4584ea977d47e31b7d4cf98b19b9fbfbb0229d3033bbf9973f106a93952126599ee4574bdd47cdfa5094eb970b24b9d44b7041a422ec06fb698a7c0638731bcef5354657248119095b484e90d96021e79875c353076ec8b96e2c3448f6575cb4cdf730cd37189ccaedea1e8de21a722fd72ad28b38d11fd0a49007eeea677c5aa16ad3e4577481cb848bc7eb860e005a9ffccee69670941c1d70971d6000000000000beaf37a02306ce348dc2a841d6cbaeecbe7a0276cccd9f0292e59f51aa99f16430991258f1c208454ac122f9b5c43642b326535c8a795757ddc10cd4ed8391d6cabc42a584e10d93988b6e36ed37bba5d7bbc6ba1b15c77945587a50e22d71ed3f6465a8c7ae90eb21e71f31c80e8dfea7711dd12984ca0e7c07c481639d87e249c6ebd1ca43715a775ee9b15752b273ef98e0d352e72a13ef21bfbed0fc9d5d5bde441692478d9e40bd59013fcdb55aa3323328a9ea77354b1ec7635cde81fae541676d06b324de2efe1fa286bd1faa6b9890fae9800ab4cde88e6be93c733537ccaaed0101bfd2416cf48b17455c1a9dc5353c48c2d07e1daec97f785850ff72e4dd0092bf7d0da19a61075fd395fcf86203b119ae1de4024c2002367a316a6443ff723437c6bf4ea33b07d8b81dfd56fd4749d6bc3fe6b1a65f09479b17d04f89a93ddde114ae2ffad05e6fe15a70145dca7c9bdd3b1f6706e9f78ab7af02553586a7fd950974137cb974ad4307a965efa529aa219d0f4f5075d10b3442cb02017af4b6519fb49d47c9020a3b12bbd391c442fa5ebdd0d3716ae2442604c678ce4af0b9dc21f66685b4c3ba7fbba6a9bcd2eeda1eb216185bdfdfc6971c5ed277b165e07dba10e7e7bd861f5e0755fe200000e1f7bace178011853c740294683f15709ff2cfc42580342bb0a1408e78658d1aa49aa87f35c89eb17a6b99c18ce6d6c6d2fc46b98cb4b0ce4f8a22852fe9d068977582c29d070f2d533f47a1d069eccf5ff85006c324f342ffa8275a1df254fc7c7e3844aef51b00b2ef655b5fcd4664021f79bd9f118665b24668053ab692ebffb4ea4daa2ea4fce9b32d18204bfdee826a11c9e10f48bfc338a46e7d58ab52749d979b5ab2ce630e9fa73842774896ecb367e8d1724a2a964177f5f2555e046d0da97d75aa1cb7869b11dc781537482408f1565c41a7581a00cbdb823e8865068056664ee1d696f02b6dfa0a0e659a9d6a0ad4fe378cc15a2963c4d0f049dae9aa8c3617ab692124a741511be9f1cb445351312d013168d7eee8f12d48126757ca06bee5e43f05284efe9c6cbd7b1f623139e93d8fcadd7e2fc53cf4c00f7fb0493292d753170cc67af99ac69757d71cbc54b1c1bdaa96eb73eab23a6163d5506aac1def5190dd7f73de5e27c8df56fe3b5079b1a28032450e09022095098f26d29d976b6891febd0346dbe917b725aa7dc28ce70c3503cf7fb0257a23fd179da04e141502117e39f5a208b17dcae08a3b5ce63f95baa61b2b9dfd358ac11e532b9a188e317b91c6ad11c67f9c933be582bcd87846088c98e00c26394292d2265f27595c45393210ca03211108e686fb0ff569e3085584daf7d4d2eab0380fbb3a7a5a25730997f59cf465c64ae4002c895e2a7de0ad735c366214e3df2bec29012324a298e4768fdcb560c07839cb4479c06d4499a7f984e3f4a8593fab553d144851441c6e91759b8e97b4a625effd6a5a197995da366bcdcff8bac79838ced68b6c31d242e60bed0853f150d103c81f2fd19e247d407ec00156c4b4e384f1a6bb86424f53fb9dded096e9f75bdc8c6d8c2a4b1c4f8afd728976c5ba804f9a2d3f5f94f73988431621808f67f35d0feda71238084411276150c0fb067a475ec2800bdb5b966c968187fccb7cefc43ecce8392a14962ed82eb34b7d118792efd0cf67061c43f240c5f82d723730153d38290968a405fd6ab4388079bc5b5b2392ab4f1cb16b6323822f174a324624c322224bcc709d9fd96d91e6bb244f510ed507d4d49a97330f6e12da2a1a274ff41b587f664af0ff775ab7379e49dd3f4c9ae00f4e1b309724f1defeb6bed948c047e94688d0ddc8bad8605e88fe810f9a89a072c4e2b6feddad1feae1ac92dc8b1f07b86d623b1ad4f3df359b03b829cdcede14b6dd29a58e7c5c6e1340d345b62a8ff8150d2dd22a631bc557f8760c26be00647d62291504f70c4f0d1c919d0beede001d3e8d24fc2ec95be1f33c44c7bb0b9764c9e5c38405bf7788da5c7883af3c31ad5c8ddb7b9f84a792d50b1597dc6454a2bc1254321f0a9d633437310fb25db7733c201371f0eb73506f4ecdb58b4c3e0b7a223ff20dbdeafd449de5968078eae4d758878fc18065a20c519a505d3bb07c4801634dea3410824e5f35d4caae801bdd2630141b944c1cbced4eaf1c74b4c59f7d00c97a7cc94084cfd84e4104c317a39f0b8ff9c4c8afefcd94833aa10fba9268d364af3e26a96cfead99f9b31e53725613343fc102c90d99bcdeaf43aa5052d9caf68953a0add5cffca28d3b23ae5dd6ae898325b6adbf95105afe7bd415839ea26db9fbd06b7de8747780d779f9589994e3d4efc717a5556073965b0fd35f2499120481baacb3f60563f68da9bbe1096484855b842b6b5f4d1e3f357e8001572bba4b366d9eeeb197832306af70f24610c6bb95cf58e484d25f4f11f2afadc5642a92717bda44cc5dba5d9e85474f8b49a042ceb8f0788bfca8168b54457a44ee0816bd4be191d18f67389766c41377da920036b1220ae14f05a332b59c5ecf66f50c4906834cd12a86d925dd58cb9ce7b502faf6859bdff36bf99020748307c38dbf110ffaf61491b7a5866e7f57314140f696fa4af9be0d83a1ce88b9eaa66581471aeb1cf15d8dd7362fa9f540515025aec1f2e98b141c97829d8a3edff5fb9f6881dc7486085658434504a5f24c597bcd1783ceec8c82fd17f29c5cb056764102bfd174aa82e17f7a4fc8720e7af98cf23a1dbe64dcc3d3420b4386e58798e0e0f46fc4feb11578ae384a8badd3828fd5118d6615fad7558387841199084b08d20ba3ebea818fc13d502f303dd2c192f3ee536e17889419c6f4024e2d130f4f60b956934df00fabe44739b1d356bf8e8cbe4f20eda6686bcbb4000000000000009e99e65a3bf002635ba5f1bd724057e1809976d11a87b6d31731577b0a8ff572ecf83a23807673e4e475f7cc0a96840e25b31c4b9064eef35502b681bb7f2c74071848aa2e92d73221e965df1aba81169436a809400caa4beaf44972411bcaa1770177b964635e9b45b42ddeea85f5643031cb421b8b90f95200960dc6b008baf4c1efcd9a267cb136450fb3c38bb6030589de0d666090c2259f1b4cd97083e092e8f28e617e510f66baa15d93111b0696a12e590f0b14f3834dce2a50413b8aa67c0a4e8971572dfd81dcaa2dec1ff79a2248404af4261c4d238e55d6e5c613ad9a06651cec8aa76fb0e458919795aae4e5c2f29b0f4ee062c83a09ff100bc4f95d3dd1852a8b727afc2b69e82d648f6bf67e6a2c9b3f13550a53b6219cd3c95c5bde422fd5e554585f81e3c5abd2c32bdc70c61f298cff392af03bbb12ac42590744eddbf79d85591a152d5b4d8062262a222afa343609e7bd48344610c7ca1d17837a33c6e5cf2843bfe65af61dc597fd9c56add05defbcba3735a2784506742b27dfd3d2301667d257c84f06a79eb43fbaadda1ec74a39ef30b51945d3d0ef217a3b9b3d96bf6c1ae06d9cfe1f44d37c7306aaf801ee99a599975833799de20b2837b0684f5af828401a83cc0f530e746997d187894ac95a3133216fefdec90ecdca21c96f76e5bf32094e62d700306cffe229f02f96eaf6956bf07278891aa8e4740813be862bee76607238a9daad12f68c9633b4f000703256e0fffaedd88f4386472578b38fc11dcb7367d7489bda56a78c94f3140c8b1abf2960d5ca0dd438eafd47fb499f6a9279f4eb5546c229bf7cf27cd655e91efc0c845e1afc9791afd87bba759ef1486493e99d01e99afd017fbfca764f690abdd2201dcd21b44164b38742cb27866aba9077b744c2c686191e5313477b7baeb7fdeae840b250e8339fcf4b709a5b6706972bbb48458881b4b68c228867a096454a36d869089446a3c784841d4e97aacead4d43c24062a15a8f3506ca8c860314fe4103bd4d39c090d80df4bfd773f468a71b332bb18c9416000b0b79d14369e922fa5f617aff95508c53287d0c780f2b4902f47f1c0741d4f919c64fc8198c995caefca90008ab94d337c41fd4e89a937a972bf4210925b3d2db1e0b3ec73d5b24308f5361ef0a8a3aff1e2c88bff171ddb2c57023ab709c73f3fd58060d99c7d04b7915e1b83c26ebe5dbaa3be454157b77b0f95a10ed9c028f9c5748684da343d61972e73ef35d82638476481395e62e9840465a20ed6b55ef42557869e071fe7e52aee1481fa12f4baf60c7dea1d8da27e51c76bb37a67cd3165c3865797f8a125e822e15b0c5749de618a62c3894e1a1e3a8c7f75001dbfc26fd62540bd5f58d2116f357ca73b157850d722b3b43ceac1b22849773b0c08e263993a86215e2e3b670c271f9aff66da80a991516e65d29a5586269993aea24ac5bf6aa5a1a5480b25cce76ff6914139d925f1b270102f38084334bd105c50658330eb3b1a96045b8f46397eee5e5db2980e23ff7aa59075a8083f8da0120a6f090a512d9995551bad82eaad75e12817f8b3e235ff93a08f454c3f3afc9bd1e99cbaaab16abf57a729ed2ea5374e328074fe709861916aaad610dc1949ae917569982d42d54108f6d0a532e59d7699cea8bf4e3fc5a66e9d399700b079c94ac22044ae6dbae5d3942e1b4076b10213749b54d80ca0d682713481c2c1630853e133682b0ea0bb4ff6e045d085c03881ec84e83cc0f9c4cacd1e3dc7a71e8c7c49e008820e2382db7eccd726dcb12800cffc195faaffa409e2cfcf94425af3b19f60fab2f5b601c3593aeeca90d60bf6f41fbf3a07808689842f3be70d08e9f1ade2a196330264206b1cdbdf3dbaa13bac630a6021b59c593716a80f8adeff1f155fbc44c281aa4b968d480184967554923fd08b43e239c49d0d7df6f7ed078d9d147a5cbbcbca837b2f55d6e888200813e6eb4453e9142206f93a7f89d264f013345162564aa49a6fe0f51184ccf9a0743df5873450b06d5ff90b6c3cbcccb66f4f1998eabcca5e0ffb452ad32f2816f575de99ffb56260d339cf2a2a36e9fbd8e911e9b240de3819afa860f8998940ab55c49189718a3f445c8254a74b2f3ca7340b7643e0d1a9f5bb22bfc1ba134762566df2af9bd5f12d36289aa1348e6966837260e79390c9f205b11a909994d21329c3ce4c33d0100de5aa63caae95de56ca34fff766e9589ae364b88e482e62428505554a6ffd25e28356531a39c393af359d80918fe3d7c0333db79a7a45d9afcee10da3285434a11cb3e1953348c02a41aa763cf92a34fa69f4ddfd992e3156c3163cdccbfaf28bce5412e744d8859b44d2166ee9ed7fb15d22a96de8301798216850ecfbeb2a32781082c1a6c758b98e8f2320d9b5cc1ae2d3b8d22de4e4bf23314f987e5d59a34c2a80177ef111b3b0109ff4af1d198ac058746168796a60d769ba4b53bb791e3a8bc1baa73b0eaa33830776ca8a810ff99f67f22de4fdd566823b4bea4f7ee38ccbe3298b04d567a6f4cbad957f6a2f4886af4ba357f2f4cb6b8f01be26120e83c8728da8ed86057b44d27705e9bc31b676c8bb0bd70ab478525b071388cd4b6be2c9ba3314323a938fc89548703599c6a78fd770129e3bd53a9a71e6b3b4fbbd7f8fd744c7a12a3cdfd98ba206b372ae643640f1e6e78adc23f859493f30fc560f67ad91cd988074f8a5b503cc0b332486696cbd786cf7556744762ad2874771a78a79a51946fb59989a19d3056aae52d988e9db95e9bb7209398ffd1b5301d88909131308377705089ef4747918d12402b54fe246c6589caec249bff4ffee2b6a135c108ea457bf3cafcac7582737ea7a1b65dc24bee4544cff0f6ce806384f6a28b7af0251a1fa5b4630e4710ff652a3ee72b0e6259f30ec16a52dcfeff64fb1b6f4c10c06e998ebda1cce43f926d82382a86d7b533fd7a65eb54ae6cb66276199888cc5ea4216ceb04db6bf5ece68a20b645b7792aba12702397cec110f9bdc58aa6819b7605eff0e68ce2a83d4f99319e391f35d7f810714d97318e01c0d91d8fecf3a1549cd51295da3b92c56eee965cab7db912c3fba86365693bfd2f357c4210737ce3697145852195336cbe89e6b7c0ee8620715ab330046cc2faf98bcce66d764b42b02451f665cb906558da6ed1c0a67e0cd1259dab5536e66988271256eadca86edf0ce071326abe01a20937aa62db7460d013dcbc2fb911de352cd5dc4480a09a393777e3ea7eb456feb9b94b8cf1df36355aa6bd635939e1981130c52d4195f90000845c0e0717b69148a3d78af78370593cc6ed18398ce7a36d1b2fa9a9b6041054e2899f135263a49b43d7cb207cacfb9cdc38beb4c2ec8edb128bab00ecf95906c82814b3b02230e1f94cb2811073d75da43d0d7c5ae5ad54d594a27a513cfd2c01e2ab33f4a9682d64cd4c5d9ee9d9c18684cd670f49849b8a3a8eefa0624bbf84fcea69c2d768a832f4433a563936131963f15de4ee43b6865a033b0129ee6ef26e5070a3ede03cefdb05dceef804f0aae68a59db56c64f5447ed9a2e865b5b81eee816ea18b1efbede2e71ac1dc45353431f5bdf361c1bb0d2fcf74b2af95ab47aec8563f60cceba7295a21b58baccd076b49faed2de8e4beb7c10694f86bf4aee05f5e64b21c4652eea9aa71fc3ec25205b5d06fa6c327e64df753cfe64233972639aad0a8f452379f1f598fb49e044d9572076d75a4726bdc8f03a9c51b000ea80cfb42716cdc23d990e5adf071a711b0512b2151d4c51465d73f0a90194fe71214d0ec867e67e5c6c57ad4fb76217559018e9572082c6ec99ab02c056c5c561efc254f6d3a551cff108195b74bbe21ccaab79bc942d32d976deb15b2926faa5459a9a34887555c0793912f93a60bb8a9fdf7164c6fecbdccfa6318bce178584221d1f4a445dab00c4a7acf28104bee65723141a4e2e31ce51aa54158e0ad875d852c89dbf02d371c08217bc84ac8ab8e6af7f5d81d8b428e8e1e4cb7c0cc33642440506ac4c5f0c91fa1d3a75246aa024ec5e6f72341a500b9308862ba45d588b1a5fa903a4dde04054d50d1241e0682c7479e237642168f9918fd133c0c32e570b7775901492b3aea72770f6f86e6443b9b04c384693ef7f2f085ae08c767f231dc8435ec123db3de1e44ae6c88216aaae35b23583152806225cbea39aecb768e37c8ef2635a910d1657fe5c32fd8415b1afe3d1e530fdcfde0173623de4f6cf7bceaa9e8e7ae95b865289b8cd640721a07f48895e0af73acb7610253b4267be9488d9922bcb183a6e8f0b4d549b53ec3166a3e5ce9739ef650af8b10600a94f1afb7cc281227408a7e48b29a86dc9d2bd410c54465dd7acc1ac062b761bdb298a9d609a71b4b905d7dae8bc27f24d8f1e9acb5501934da6c0807996f61252b60e04105e311248c1b7b0cdda7ee77db36a507bc4b476d9d88b7ece67c6bbccee8f6a85b0f1d7b70a14ea4a9e033778ce05de5503dcff0ec317f7ad2f40e773592e04d2109d757e8a274ecc4605acd2dd29173476dc2603507ae0486e1f3ae5b057b9c4f759fc071d9e1da59ee87343d8dfbad6d51920228148b2a9ae5d1d7e53cad8c5b09423c90c2abd098ed359e9098291ebf7efd5d7584c30541eb63e85553068e62e07bb764fe81b2d723d90d280a7eba95c581865c33d2ee5d112b58a1640283948379e894109c07eb39422cb55c9d690a9f55b9853ba030db2234eb3636cf2c981a907d710bfbbe666e701baba9aee635e664e83603662a8ff41ac146aae68df29010158f453b2027d54dc6976ca29533f8fff64f316cd3fd7b2f3bfcf7c07107d9725375bef48027bf27fa17c6eedec5e651abf98efdf675761397abdd30c8aa263e89008e0516cd199e10b60b800", 0x2000, &(0x7f0000003540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m25.868001698s ago: executing program 1 (id=194): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x28, r1, 0x201, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000844}, 0x40800) 2m24.745498846s ago: executing program 1 (id=196): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145) symlinkat(&(0x7f0000000100)='.\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r2 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000400)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108) r5 = eventfd(0x5f0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x200400c5}, 0x4000800) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f00000005c0)={r3, &(0x7f0000000600)='%\x00', 0x0, &(0x7f0000000640)={@align=0x7fffffffffffffff, {0x6, 0x8e70, 0x9, 0x4}}, 0x2c, &(0x7f0000000680)={@_ha_fsid}, &(0x7f00000006c0)=0x3}) ioctl$TIOCSETD(r6, 0x5423, 0x0) capset(0x0, &(0x7f0000000700)={0x200000, 0x200000}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x40a0ae49, &(0x7f0000000740)={0x7ff, 0x0, 0x0, r5}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000780)={0x0, 0x300000, 0x8}) socket$inet_tcp(0x2, 0x1, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) sendto(r7, &(0x7f00000087c0)="05000000010000", 0x7, 0x0, 0x0, 0x0) 2m9.581914466s ago: executing program 32 (id=196): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x145) symlinkat(&(0x7f0000000100)='.\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000bfd2b357620012", 0x32}], 0x1}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) r2 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000400)=@broute={'broute\x00', 0x20, 0xfffff9, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x108) r5 = eventfd(0x5f0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6d9d000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x200400c5}, 0x4000800) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f00000005c0)={r3, &(0x7f0000000600)='%\x00', 0x0, &(0x7f0000000640)={@align=0x7fffffffffffffff, {0x6, 0x8e70, 0x9, 0x4}}, 0x2c, &(0x7f0000000680)={@_ha_fsid}, &(0x7f00000006c0)=0x3}) ioctl$TIOCSETD(r6, 0x5423, 0x0) capset(0x0, &(0x7f0000000700)={0x200000, 0x200000}) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x40a0ae49, &(0x7f0000000740)={0x7ff, 0x0, 0x0, r5}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r3, 0x4020aed2, &(0x7f0000000780)={0x0, 0x300000, 0x8}) socket$inet_tcp(0x2, 0x1, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) sendto(r7, &(0x7f00000087c0)="05000000010000", 0x7, 0x0, 0x0, 0x0) 8.417344653s ago: executing program 5 (id=815): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280), 0x41, 0x0) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000340)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) r1 = syz_open_pts(r0, 0x20000) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000380)=0x17) 7.384047029s ago: executing program 0 (id=821): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000100)={0x0, 0x1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) timer_create(0x3, 0x0, &(0x7f0000000040)) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) 6.484005581s ago: executing program 5 (id=824): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, 0x0, &(0x7f0000000240)) 6.481933891s ago: executing program 0 (id=825): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0500000001800100a003000002"], 0x50) 6.13883867s ago: executing program 5 (id=826): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fffffff}, [@generic={0xdc, 0x0, 0x0, 0x0, 0x40}]}, &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x5}, 0x94) 6.085258601s ago: executing program 0 (id=827): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000100)={0x18, 0x0, {0x4, @multicast, 'ip_vti0\x00'}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x40084) ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0285628, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) connect$pppoe(r1, &(0x7f0000000240)={0x18, 0x0, {0x412, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, 'geneve1\x00'}}, 0x1e) 5.996346263s ago: executing program 5 (id=829): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0xc) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000200000010ef0ec47200000000000109022400010000c70009040005020300030009210000090122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000700)={0x24, 0x0, 0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_open_dev$hiddev(0x0, 0xa, 0x62080) 5.812056148s ago: executing program 0 (id=832): syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') r0 = syz_open_dev$dri(&(0x7f000001ba80), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f000001bac0)={0x9, 0x5, 0x20ffd, 0x0, 0x0}) mmap(&(0x7f000002c000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f000001bb00)={r1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) 4.304047065s ago: executing program 3 (id=835): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000b00), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000b40)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000b80)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000bc0)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07, 0xffc1}, @generic={0x0, 0x2, "d588380003c1"}]}}}}}}, 0xfd6c) 4.242479126s ago: executing program 0 (id=836): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000002100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x9a, &(0x7f0000002140)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6a0000000064110000000000000000000000ffff00000000fe8000000000000000000000000000aa4e1d4e20006490"], 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x2409c8c1, &(0x7f0000002180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000021c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x1003, r2}, 0x38) 3.309481769s ago: executing program 0 (id=839): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/integrity/ima/ascii_runtime_measurements\x00', 0x0, 0x0) epoll_create(0x101) r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000180)={0x0, 0x1, 0x4}) 3.196014242s ago: executing program 3 (id=841): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(r0, 0x0, &(0x7f0000000240)={0x0, 0x80}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 3.195917512s ago: executing program 4 (id=842): r0 = openat(0xffffffffffffff9c, &(0x7f0000000e40)='.\x00', 0x0, 0x0) fcntl$notify(r0, 0x402, 0x4) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000e80)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x30) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000f00)='.\x00', 0x40000, 0x0) fcntl$notify(r2, 0x402, 0x40000029) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000ac0)='./file0\x00', 0x6000, 0x1) 3.098119064s ago: executing program 2 (id=843): syz_emit_vhci(0x0, 0x0) syz_emit_vhci(&(0x7f0000000300)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_features={{0xb, 0xb}, {0x1, 0xc8}}}, 0xe) 3.087609425s ago: executing program 4 (id=844): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'veth1_virt_wifi\x00', &(0x7f00000024c0)=@ethtool_per_queue_op={0x4b, 0x1b, [0x7, 0xd0, 0x1, 0x1, 0x2, 0xa, 0x3ff, 0x1, 0x2, 0x0, 0xffff, 0x80, 0x7315, 0xfffffffa, 0x6, 0x7, 0x80000001, 0x800, 0x0, 0x80000001, 0xd, 0x7, 0x3ff, 0x8, 0x7fffffff, 0x6, 0x8, 0xfff, 0x1, 0x1e3c, 0x5, 0x6, 0x10000, 0x0, 0x3ff, 0x7, 0x7b670f18, 0x8, 0x0, 0xff, 0xe, 0x5, 0x9, 0x3, 0x100000, 0x7, 0x75c, 0x4, 0x7fff, 0x3, 0xc, 0x3, 0x8, 0x6, 0x8, 0xb, 0x1ff, 0x419c, 0x3, 0x4, 0x0, 0xaf, 0x7, 0x4, 0xfffffff7, 0x7f, 0xd5c, 0x4, 0x7fff, 0x401, 0x1ff, 0xf, 0x2, 0xb, 0x6, 0x1f, 0x7, 0xa1, 0x9, 0x2, 0xc9a, 0xffff, 0x7, 0x5, 0x805b, 0x1, 0x7, 0x7, 0x6ce, 0x100, 0x9, 0x3f, 0x200, 0x1, 0xac6, 0x7, 0x91c, 0x101, 0x0, 0x4, 0xfff, 0xc2, 0x6, 0x3, 0x3, 0x2, 0x7, 0x7, 0xc6, 0x148, 0x8, 0x101, 0xde3, 0xfff, 0x91, 0x5, 0x10001, 0x9, 0x5, 0x3, 0xfffffff7, 0x4, 0xf9ff, 0x8, 0x5, 0x0, 0x2]}}) 2.194775826s ago: executing program 3 (id=845): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$packet_rx_ring(r0, 0x107, 0x5, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4044000) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x10448) r1 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, 0x0, &(0x7f0000000080)) 2.131179628s ago: executing program 4 (id=846): mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) socket(0x2, 0x80805, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000500)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x8) connect$inet(r1, &(0x7f0000000580)={0x2, 0x4e20, @loopback}, 0x10) r2 = accept$inet(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x10, 0x9, &(0x7f0000000700)=ANY=[@ANYBLOB="bf16000000000000b702000064000000bf6100000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000b704000001000000850000003c00000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000800)={r3, &(0x7f0000000840), &(0x7f0000000880)=@tcp=r2}, 0x20) sendto(r2, &(0x7f00000008c0)='a', 0x1, 0x0, 0x0, 0x0) 2.07579649s ago: executing program 5 (id=847): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x8, 0x3ff, 0x3, 0x0, 0x5, 0xfffffffb}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x2}, @TCA_NETEM_JITTER64={0xc}]}}}]}, 0x64}}, 0x4c840) 1.948143963s ago: executing program 5 (id=848): syz_usb_connect(0x3, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="120150029f1b9140cd0c3800b886a49203010902240001ff0dc0080904"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) 1.843919775s ago: executing program 3 (id=849): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000380)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) mkdir(&(0x7f0000000440)='./tracefs\x00', 0x1ff) pipe2(&(0x7f0000000480)={0xffffffffffffffff}, 0x800) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000004c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000500)=0xa7) write$cgroup_devices(r2, 0x0, 0xffdd) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000580)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000005c0)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000600), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000640), 0x2, 0x141102) writev(r4, &(0x7f0000000680)=[{&(0x7f00000006c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$netlink(0x10, 0x3, 0x7) sendmsg$nl_route(r5, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x800) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), r6) sendmsg$IEEE802154_LLSEC_LIST_DEV(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x14, r7, 0xb11, 0x70bd28, 0x25dfd3ff}, 0x14}, 0x1, 0x0, 0x0, 0x4000044}, 0x24040880) openat$urandom(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) recvmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000940)=@ll, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000a00)=""/113, 0x71}], 0x1}, 0xd06}, {{&(0x7f0000000a80)=@tipc, 0x80, 0x0, 0x0, &(0x7f0000000f00)=""/10, 0xa}, 0xec6}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000f80)=""/128, 0x80}, {&(0x7f0000000000)=""/44, 0x2c}], 0x2, &(0x7f0000002040)=""/28, 0x1c}, 0x1000}], 0x3, 0xfc0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000002080)=0x1, 0x4) mount(0x0, &(0x7f0000002140)='./tracefs\x00', &(0x7f0000002180)='tracefs\x00', 0x0, 0x0) chmod(&(0x7f00000021c0)='./tracefs/events/xhci-hcd/xhci_portsc_writel/format\x00', 0x0) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000003c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x1, @empty, 0x80}, r1}}, 0x30) 376.067602ms ago: executing program 4 (id=850): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="a00000001000010427bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000008000128009000100626f6e64000000007000028005001100010000000800030004"], 0xa0}}, 0x0) 375.991562ms ago: executing program 2 (id=851): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020) 364.480671ms ago: executing program 3 (id=852): connect$pptp(0xffffffffffffffff, 0x0, 0x0) sync() r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x4038, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r2, 0x1, 0xc, &(0x7f0000000440)=""/118, &(0x7f00000004c0)=0x76) bind$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r5, &(0x7f0000000200)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000000)=ANY=[], 0x98) sendmsg$can_j1939(r5, &(0x7f0000000240)={&(0x7f0000000280), 0x18, &(0x7f00000002c0)={&(0x7f0000000300)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r3, &(0x7f0000000380)={0x0, 0x52, &(0x7f00000003c0)={&(0x7f0000000400)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r4, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 353.197792ms ago: executing program 2 (id=853): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000008c0)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x20008004}, 0x8040) landlock_create_ruleset(&(0x7f0000000400)={0x7f2e}, 0x91, 0x0) 279.896504ms ago: executing program 4 (id=854): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) futex(0x0, 0x80000000000b, 0x0, 0x0, 0x0, 0x300) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0={0xfc, 0x0, '\x00', 0x9}, 0x4, 0x6, 0x3, 0x100, 0x3df4, 0x180107, r2}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x43d, 0x3, 0x0, {0x0, 0x0, 0x0, r7, {0x7, 0xffff}, {0x4, 0xfff3}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x0) 279.794744ms ago: executing program 2 (id=855): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000001000000000000000000000071123a000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 159.673227ms ago: executing program 2 (id=856): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x41) ppoll(&(0x7f00000002c0)=[{r0}], 0x1, &(0x7f0000000300)={0x0, 0x3938700}, 0x0, 0x0) 106.342358ms ago: executing program 3 (id=857): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r0 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x2, 0x9, 0xffffffffffffffff, 0x2, 0x2, 0x0, 0x4002004c1, 0x1001, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xffffffff, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 105.470188ms ago: executing program 4 (id=858): fsopen(0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) listen(r0, 0xc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) 0s ago: executing program 2 (id=859): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000680), 0x40e02, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000740), 0xc) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) sync_file_range(r0, 0x40, 0x39, 0x4) bind$bt_hci(r2, &(0x7f0000000780)={0x1f, 0x0, 0x1}, 0x6) write$rfkill(r1, &(0x7f0000000900)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) kernel console output (not intermixed with test programs): d+0x427/0x10c0 [ 85.077606][ T4730] __inet6_bind+0x646/0x10c0 [ 85.082188][ T4730] ? inet6_bind+0xc8/0xf0 [ 85.086516][ T4730] __sys_bind+0x2e9/0x3e0 [ 85.090834][ T4730] ? __ia32_sys_socketpair+0xb0/0xb0 [ 85.096128][ T4730] __x64_sys_bind+0x76/0x80 [ 85.100679][ T4730] do_syscall_64+0x4c/0xa0 [ 85.105087][ T4730] ? clear_bhb_loop+0x30/0x80 [ 85.109757][ T4730] ? clear_bhb_loop+0x30/0x80 [ 85.114435][ T4730] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 85.120315][ T4730] RIP: 0033:0x7f757ee141d9 [ 85.124720][ T4730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.144320][ T4730] RSP: 002b:00007f757d06c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 85.152725][ T4730] RAX: ffffffffffffffda RBX: 00007f757f09bfa0 RCX: 00007f757ee141d9 [ 85.160682][ T4730] RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000005 [ 85.168638][ T4730] RBP: 00007f757eeab888 R08: 0000000000000000 R09: 0000000000000000 [ 85.176596][ T4730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.184554][ T4730] R13: 00007f757f09c038 R14: 00007f757f09bfa0 R15: 00007ffca83ba028 [ 85.192524][ T4730] [ 85.217090][ T4736] 9pnet_virtio: no channels available for device syz [ 85.754766][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.044765][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.134777][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.144763][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.194786][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.204778][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.214776][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.224787][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 86.389861][ T4745] Process accounting resumed [ 86.444993][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 90.301957][ T4785] using random self ethernet address [ 90.312935][ T4785] using random host ethernet address [ 90.432656][ T4791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.134'. [ 90.456163][ T4791] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 90.534006][ T4798] Invalid ELF header magic: != ELF [ 90.634438][ T4798] ======================================================= [ 90.634438][ T4798] WARNING: The mand mount option has been deprecated and [ 90.634438][ T4798] and is ignored by this kernel. Remove the mand [ 90.634438][ T4798] option from the mount to silence this warning. [ 90.634438][ T4798] ======================================================= [ 90.702667][ T4798] overlayfs: unrecognized mount option "/" or missing value [ 90.953046][ T4791] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 91.171905][ T4810] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 91.178813][ T4810] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 91.207299][ T4818] CIFS: Attempting to mount \\127.0.0.1\share [ 91.213610][ T4810] vhci_hcd vhci_hcd.0: Device attached [ 91.220372][ T4809] netlink: 28 bytes leftover after parsing attributes in process `syz.3.139'. [ 91.239264][ T4809] netlink: 28 bytes leftover after parsing attributes in process `syz.3.139'. [ 91.260498][ T4809] netlink: 8 bytes leftover after parsing attributes in process `syz.3.139'. [ 91.278175][ T4811] vhci_hcd: connection closed [ 91.379372][ T4637] vhci_hcd: stop threads [ 91.422543][ T4637] vhci_hcd: release socket [ 91.447068][ T4637] vhci_hcd: disconnect device [ 91.508212][ T4832] Invalid ELF header magic: != ELF [ 91.535994][ T4832] overlayfs: unrecognized mount option "/" or missing value [ 92.133605][ T4818] CIFS: VFS: cifs_mount failed w/return code = -112 [ 92.877333][ T4852] Invalid ELF header magic: != ELF [ 93.057346][ T4844] overlayfs: unrecognized mount option "/" or missing value [ 93.143130][ T4857] FAULT_INJECTION: forcing a failure. [ 93.143130][ T4857] name failslab, interval 1, probability 0, space 0, times 0 [ 93.190059][ T4860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.154'. [ 93.199608][ T4860] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.273710][ T4857] CPU: 0 PID: 4857 Comm: syz.4.153 Not tainted syzkaller #0 [ 93.281044][ T4857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 93.291114][ T4857] Call Trace: [ 93.294409][ T4857] [ 93.297348][ T4857] dump_stack_lvl+0x188/0x250 [ 93.302047][ T4857] ? show_regs_print_info+0x20/0x20 [ 93.307269][ T4857] ? load_image+0x410/0x410 [ 93.311796][ T4857] ? __might_sleep+0xf0/0xf0 [ 93.316402][ T4857] ? __lock_acquire+0x7d40/0x7d40 [ 93.321444][ T4857] ? mark_lock+0x94/0x320 [ 93.325794][ T4857] should_fail+0x383/0x4b0 [ 93.330236][ T4857] should_failslab+0x5/0x20 [ 93.334758][ T4857] slab_pre_alloc_hook+0x51/0xc0 [ 93.339713][ T4857] __kmalloc+0x6b/0x340 [ 93.343885][ T4857] ? tomoyo_realpath_from_path+0xed/0x5e0 [ 93.349634][ T4857] tomoyo_realpath_from_path+0xed/0x5e0 [ 93.355220][ T4857] tomoyo_path_number_perm+0x251/0x6b0 [ 93.360701][ T4857] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 93.366185][ T4857] ? make_qualifier+0x3b0/0x3b0 [ 93.371101][ T4857] security_file_ioctl+0x6c/0xa0 [ 93.376063][ T4857] __se_sys_ioctl+0x48/0x170 [ 93.380677][ T4857] do_syscall_64+0x4c/0xa0 [ 93.385113][ T4857] ? clear_bhb_loop+0x30/0x80 [ 93.389806][ T4857] ? clear_bhb_loop+0x30/0x80 [ 93.394503][ T4857] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 93.400419][ T4857] RIP: 0033:0x7f48680a7e6b [ 93.404856][ T4857] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 93.419817][ T21] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 93.424474][ T4857] RSP: 002b:00007f48662fdf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.424513][ T4857] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f48680a7e6b [ 93.424525][ T4857] RDX: 00007f48662fefd0 RSI: 0000000080085502 RDI: 0000000000000004 [ 93.424536][ T4857] RBP: 00007f48662fefd0 R08: 0000000000000001 R09: 00000000ffffffff [ 93.464296][ T4857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502 [ 93.472288][ T4857] R13: 0000000800000000 R14: 0000000000000000 R15: 00007f486815e286 [ 93.480308][ T4857] [ 93.500639][ T4857] ERROR: Out of memory at tomoyo_realpath_from_path. [ 93.530180][ T4860] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.744965][ T21] usb 5-1: device descriptor read/64, error -71 [ 94.604950][ T21] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 94.804906][ T21] usb 5-1: device descriptor read/64, error -71 [ 94.935007][ T21] usb usb5-port1: attempt power cycle [ 95.812210][ T4927] batman_adv: batadv0: Adding interface: syzkaller0 [ 95.836960][ T4927] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.903318][ T4927] batman_adv: batadv0: Interface activated: syzkaller0 [ 95.919435][ T25] audit: type=1800 audit(1791751197.511:26): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="no_out_endpoint" dev="configfs" ino=35191 res=0 errno=0 [ 95.940842][ T4926] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 95.960554][ T25] audit: type=1800 audit(1791751197.511:27): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="subclass" dev="configfs" ino=35192 res=0 errno=0 [ 96.018101][ T25] audit: type=1800 audit(1791751197.511:28): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="protocol" dev="configfs" ino=35193 res=0 errno=0 [ 96.084329][ T25] audit: type=1800 audit(1791751197.511:29): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="report_length" dev="configfs" ino=35194 res=0 errno=0 [ 96.112875][ T25] audit: type=1800 audit(1791751197.511:30): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="report_desc" dev="configfs" ino=35195 res=0 errno=0 [ 96.142077][ T25] audit: type=1800 audit(1791751197.511:31): pid=4935 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.163" name="UDC" dev="configfs" ino=34466 res=0 errno=0 [ 96.718356][ T4926] batman_adv: batadv0: Removing interface: syzkaller0 [ 98.472837][ T5001] netlink: 'syz.1.175': attribute type 12 has an invalid length. [ 98.645857][ T5007] ieee802154 phy0 wpan0: encryption failed: -22 [ 98.748191][ T25] audit: type=1800 audit(1791751200.341:32): pid=5014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.179" name="no_out_endpoint" dev="configfs" ino=34527 res=0 errno=0 [ 98.769002][ C0] vkms_vblank_simulate: vblank timer overrun [ 98.800939][ T25] audit: type=1800 audit(1791751200.381:33): pid=5014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.179" name="subclass" dev="configfs" ino=34535 res=0 errno=0 [ 98.825561][ T5021] batman_adv: batadv0: Adding interface: syzkaller0 [ 98.834269][ T5021] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.842012][ T25] audit: type=1800 audit(1791751200.411:34): pid=5014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.179" name="protocol" dev="configfs" ino=34546 res=0 errno=0 [ 98.901467][ T25] audit: type=1800 audit(1791751200.421:35): pid=5014 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.179" name="report_length" dev="configfs" ino=34547 res=0 errno=0 [ 98.922401][ T5021] batman_adv: batadv0: Interface activated: syzkaller0 [ 98.951263][ T5017] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 98.982555][ T5017] batman_adv: batadv0: Removing interface: syzkaller0 [ 98.997299][ T5024] device syzkaller0 entered promiscuous mode [ 101.007564][ T5056] FAULT_INJECTION: forcing a failure. [ 101.007564][ T5056] name failslab, interval 1, probability 0, space 0, times 0 [ 101.161300][ T5056] CPU: 1 PID: 5056 Comm: syz.4.192 Not tainted syzkaller #0 [ 101.168628][ T5056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 101.178700][ T5056] Call Trace: [ 101.181991][ T5056] [ 101.184934][ T5056] dump_stack_lvl+0x188/0x250 [ 101.189626][ T5056] ? show_regs_print_info+0x20/0x20 [ 101.194832][ T5056] ? load_image+0x410/0x410 [ 101.199359][ T5056] ? __might_sleep+0xf0/0xf0 [ 101.203966][ T5056] ? __lock_acquire+0x7d40/0x7d40 [ 101.209002][ T5056] should_fail+0x383/0x4b0 [ 101.213434][ T5056] should_failslab+0x5/0x20 [ 101.217948][ T5056] slab_pre_alloc_hook+0x51/0xc0 [ 101.222912][ T5056] kmem_cache_alloc_trace+0x47/0x290 [ 101.228206][ T5056] ? __list_lru_init+0x535/0xac0 [ 101.233162][ T5056] __list_lru_init+0x535/0xac0 [ 101.237950][ T5056] alloc_super+0x787/0x970 [ 101.242380][ T5056] ? kernfs_get_tree+0x6b0/0x6b0 [ 101.247327][ T5056] sget_fc+0x2d4/0x6f0 [ 101.251404][ T5056] ? kernfs_test_super+0x100/0x100 [ 101.256527][ T5056] kernfs_get_tree+0x15c/0x6b0 [ 101.261302][ T5056] ? apparmor_capable+0x12c/0x190 [ 101.266350][ T5056] sysfs_get_tree+0x42/0x110 [ 101.270957][ T5056] vfs_get_tree+0x88/0x270 [ 101.275385][ T5056] vfs_fsconfig_locked+0x22f/0x400 [ 101.280508][ T5056] __se_sys_fsconfig+0x69e/0x7e0 [ 101.285458][ T5056] ? __x64_sys_fsconfig+0xc0/0xc0 [ 101.290499][ T5056] ? lockdep_hardirqs_on+0x94/0x140 [ 101.295706][ T5056] ? __x64_sys_fsconfig+0x1c/0xc0 [ 101.300747][ T5056] do_syscall_64+0x4c/0xa0 [ 101.305172][ T5056] ? clear_bhb_loop+0x30/0x80 [ 101.309856][ T5056] ? clear_bhb_loop+0x30/0x80 [ 101.314551][ T5056] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 101.320551][ T5056] RIP: 0033:0x7f48680a81d9 [ 101.324982][ T5056] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.344593][ T5056] RSP: 002b:00007f4866300028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 101.353019][ T5056] RAX: ffffffffffffffda RBX: 00007f486832ffa0 RCX: 00007f48680a81d9 [ 101.361001][ T5056] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 101.368981][ T5056] RBP: 00007f486813f888 R08: 0000000000000000 R09: 0000000000000000 [ 101.376951][ T5056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.384957][ T5056] R13: 00007f4868330038 R14: 00007f486832ffa0 R15: 00007ffdaf9bb698 [ 101.392953][ T5056] [ 101.396472][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 103.036611][ T5076] netlink: 'syz.1.196': attribute type 10 has an invalid length. [ 103.131566][ T25] kauditd_printk_skb: 2 callbacks suppressed [ 103.131580][ T25] audit: type=1800 audit(1791751204.721:38): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="no_out_endpoint" dev="configfs" ino=34670 res=0 errno=0 [ 103.399745][ T25] audit: type=1800 audit(1791751204.741:39): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="subclass" dev="configfs" ino=34671 res=0 errno=0 [ 103.427159][ T5076] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 103.454543][ T25] audit: type=1800 audit(1791751204.741:40): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="protocol" dev="configfs" ino=34672 res=0 errno=0 [ 103.541911][ T5114] netlink: 44 bytes leftover after parsing attributes in process `syz.4.195'. [ 103.673694][ T25] audit: type=1800 audit(1791751204.761:41): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="report_length" dev="configfs" ino=34673 res=0 errno=0 [ 103.924425][ T5093] netlink: 14 bytes leftover after parsing attributes in process `syz.1.196'. [ 104.002709][ T25] audit: type=1800 audit(1791751204.771:42): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="report_desc" dev="configfs" ino=34674 res=0 errno=0 [ 104.269071][ T25] audit: type=1800 audit(1791751204.771:43): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.198" name="UDC" dev="configfs" ino=34675 res=0 errno=0 [ 104.461957][ T5093] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 104.549405][ T5093] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 104.632765][ T5093] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 104.684578][ T5093] bond0 (unregistering): Released all slaves [ 104.849473][ T5147] process 'syz.2.215' launched '/dev/fd/4/./mnt' with NULL argv: empty string added [ 104.871083][ T25] audit: type=1800 audit(1791751206.461:44): pid=5149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.214" name="no_out_endpoint" dev="configfs" ino=35471 res=0 errno=0 [ 105.009861][ T25] audit: type=1800 audit(1791751206.491:45): pid=5149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.214" name="subclass" dev="configfs" ino=35472 res=0 errno=0 [ 105.394208][ T25] audit: type=1800 audit(1791751206.491:46): pid=5149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.214" name="protocol" dev="configfs" ino=35473 res=0 errno=0 [ 105.689143][ T25] audit: type=1800 audit(1791751206.491:47): pid=5149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.214" name="report_length" dev="configfs" ino=35474 res=0 errno=0 [ 105.766912][ T5156] smpboot: CPU 1 is now offline [ 106.476457][ T5165] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 106.519250][ T5165] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 106.685336][ T4233] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 106.954799][ T4233] usb 4-1: Using ep0 maxpacket: 16 [ 108.424989][ T4233] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 108.494095][ T4233] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.537588][ T4233] usb 4-1: Product: syz [ 108.567464][ T4233] usb 4-1: Manufacturer: syz [ 108.604250][ T4233] usb 4-1: SerialNumber: syz [ 108.997082][ T4233] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 109.080475][ T4233] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 110.062227][ T4233] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 110.488798][ T4233] usb 4-1: media controller created [ 110.514087][ T4233] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 110.595339][ T25] kauditd_printk_skb: 8 callbacks suppressed [ 110.595348][ T25] audit: type=1800 audit(1791751212.191:56): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="no_out_endpoint" dev="configfs" ino=35707 res=0 errno=0 [ 110.681629][ T4233] zl10353_read_register: readreg error (reg=127, ret==-71) [ 110.830442][ T25] audit: type=1800 audit(1791751212.221:57): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="subclass" dev="configfs" ino=35708 res=0 errno=0 [ 110.904057][ T4233] dvb_usb_gl861: probe of 4-1:157.0 failed with error -5 [ 110.965724][ T4233] usb 4-1: USB disconnect, device number 3 [ 110.973199][ T25] audit: type=1800 audit(1791751212.221:58): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="protocol" dev="configfs" ino=35709 res=0 errno=0 [ 111.106637][ T25] audit: type=1800 audit(1791751212.231:59): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="report_length" dev="configfs" ino=35710 res=0 errno=0 [ 111.347913][ T25] audit: type=1800 audit(1791751212.241:60): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="report_desc" dev="configfs" ino=35711 res=0 errno=0 [ 111.519562][ T25] audit: type=1800 audit(1791751212.241:61): pid=5210 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.241" name="UDC" dev="configfs" ino=35712 res=0 errno=0 [ 111.630816][ T5228] capability: warning: `syz.2.247' uses deprecated v2 capabilities in a way that may be insecure [ 111.768166][ T4233] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 112.184849][ T4233] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.345083][ T4233] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 113.396999][ T4233] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 113.574937][ T4233] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 113.634809][ T4233] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 113.654114][ T25] audit: type=1800 audit(1791751215.241:62): pid=5245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.254" name="no_out_endpoint" dev="configfs" ino=35901 res=0 errno=0 [ 113.697505][ T4233] usb 5-1: Product: syz [ 113.701690][ T4233] usb 5-1: Manufacturer: syz [ 113.765064][ T5231] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 113.773520][ T25] audit: type=1800 audit(1791751215.271:63): pid=5245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.254" name="subclass" dev="configfs" ino=35902 res=0 errno=0 [ 113.826176][ T4233] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 113.861427][ T5248] FAULT_INJECTION: forcing a failure. [ 113.861427][ T5248] name failslab, interval 1, probability 0, space 0, times 0 [ 113.892338][ T4233] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 113.906567][ T25] audit: type=1800 audit(1791751215.271:64): pid=5245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.254" name="protocol" dev="configfs" ino=35903 res=0 errno=0 [ 113.974349][ T5248] CPU: 0 PID: 5248 Comm: syz.2.255 Not tainted syzkaller #0 [ 113.981646][ T5248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 113.991685][ T5248] Call Trace: [ 113.994950][ T5248] [ 113.997864][ T5248] dump_stack_lvl+0x188/0x250 [ 114.002539][ T5248] ? show_regs_print_info+0x20/0x20 [ 114.007719][ T5248] ? load_image+0x410/0x410 [ 114.012200][ T5248] ? __lock_acquire+0x7d40/0x7d40 [ 114.017225][ T5248] should_fail+0x383/0x4b0 [ 114.021629][ T5248] should_failslab+0x5/0x20 [ 114.026112][ T5248] slab_pre_alloc_hook+0x51/0xc0 [ 114.031148][ T5248] kmem_cache_alloc_trace+0x47/0x290 [ 114.036412][ T5248] ? x509_cert_parse+0x158/0x7a0 [ 114.041331][ T5248] x509_cert_parse+0x158/0x7a0 [ 114.046076][ T5248] x509_key_preparse+0x60/0x5d0 [ 114.050924][ T5248] ? down_read+0x1aa/0x2e0 [ 114.055324][ T5248] asymmetric_key_preparse+0xa5/0x140 [ 114.060675][ T5248] key_create_or_update+0x432/0xa40 [ 114.065848][ T5248] ? security_key_permission+0x7c/0xa0 [ 114.071290][ T5248] ? key_type_put+0x20/0x20 [ 114.075776][ T5248] ? lookup_user_key_possessed+0x40/0x40 [ 114.081394][ T5248] ? __might_fault+0xb3/0x110 [ 114.086051][ T5248] __se_sys_add_key+0x34b/0x410 [ 114.090902][ T5248] ? __x64_sys_add_key+0xc0/0xc0 [ 114.095840][ T5248] ? lockdep_hardirqs_on+0x94/0x140 [ 114.101025][ T5248] ? __x64_sys_add_key+0x1c/0xc0 [ 114.105959][ T5248] do_syscall_64+0x4c/0xa0 [ 114.110355][ T5248] ? clear_bhb_loop+0x30/0x80 [ 114.115011][ T5248] ? clear_bhb_loop+0x30/0x80 [ 114.119684][ T5248] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 114.125671][ T5248] RIP: 0033:0x7fa9757501d9 [ 114.130096][ T5248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.149715][ T5248] RSP: 002b:00007fa9739a8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 114.158129][ T5248] RAX: ffffffffffffffda RBX: 00007fa9759d7fa0 RCX: 00007fa9757501d9 [ 114.166178][ T5248] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 114.174139][ T5248] RBP: 00007fa9757e7888 R08: ffffffffffffffff R09: 0000000000000000 [ 114.182111][ T5248] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 114.190064][ T5248] R13: 00007fa9759d8038 R14: 00007fa9759d7fa0 R15: 00007fff576e8858 [ 114.198023][ T5248] [ 114.221478][ T7] usb 5-1: USB disconnect, device number 5 [ 114.259376][ T25] audit: type=1800 audit(1791751215.271:65): pid=5245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.254" name="report_length" dev="configfs" ino=35904 res=0 errno=0 [ 114.283510][ T7] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 114.314367][ T7] garmin_gps 5-1:1.0: device disconnected [ 115.598833][ T5259] netlink: 17 bytes leftover after parsing attributes in process `syz.0.261'. [ 117.135167][ T25] kauditd_printk_skb: 2 callbacks suppressed [ 117.135176][ T25] audit: type=1326 audit(1791751218.731:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5268 comm="syz.4.265" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f48680a81d9 code=0x0 [ 117.311726][ T25] audit: type=1800 audit(1791751218.901:69): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="no_out_endpoint" dev="configfs" ino=36012 res=0 errno=0 [ 117.368277][ T25] audit: type=1800 audit(1791751218.931:70): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="subclass" dev="configfs" ino=36013 res=0 errno=0 [ 117.443938][ T25] audit: type=1800 audit(1791751218.931:71): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="protocol" dev="configfs" ino=36014 res=0 errno=0 [ 117.508659][ T25] audit: type=1800 audit(1791751218.931:72): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="report_length" dev="configfs" ino=36015 res=0 errno=0 [ 117.535924][ T7] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 117.566260][ T5283] netlink: 12 bytes leftover after parsing attributes in process `syz.2.269'. [ 117.594693][ T25] audit: type=1800 audit(1791751218.941:73): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="report_desc" dev="configfs" ino=36016 res=0 errno=0 [ 117.661434][ T25] audit: type=1800 audit(1791751218.941:74): pid=5278 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.267" name="UDC" dev="configfs" ino=36017 res=0 errno=0 [ 117.824798][ T7] usb 4-1: Using ep0 maxpacket: 16 [ 118.225911][ T7] usb 4-1: config 0 interface 0 altsetting 246 endpoint 0x81 has an invalid bInterval 0, changing to 1 [ 118.263077][ T7] usb 4-1: config 0 interface 0 altsetting 246 endpoint 0x81 has invalid wMaxPacketSize 0 [ 118.286914][ T7] usb 4-1: config 0 interface 0 altsetting 246 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 118.320355][ T7] usb 4-1: config 0 interface 0 has no altsetting 0 [ 118.334258][ T7] usb 4-1: New USB device found, idVendor=1532, idProduct=0116, bcdDevice= 0.00 [ 118.356704][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.414374][ T7] usb 4-1: config 0 descriptor?? [ 118.835011][ T7] usbhid 4-1:0.0: can't add hid device: -71 [ 118.841022][ T7] usbhid: probe of 4-1:0.0 failed with error -71 [ 119.970762][ T7] usb 4-1: USB disconnect, device number 4 [ 120.028983][ T5290] chnl_net:caif_netlink_parms(): no params data found [ 121.069469][ T2236] Bluetooth: hci1: command 0x0406 tx timeout [ 121.121539][ T4233] Bluetooth: hci5: command 0x0409 tx timeout [ 121.141628][ T5313] scsi_strcpy_devinfo: vendor string '‰˜b~žs–bÉñ%`Q¤ÿìÊ® õ~…G|©\»D½5©X¡Â™ú2õËa¹ÐE' is too long [ 121.381595][ T25] audit: type=1800 audit(1791751222.971:75): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.283" name="no_out_endpoint" dev="configfs" ino=36259 res=0 errno=0 [ 121.419342][ T5290] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.489101][ T5290] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.537489][ T5290] device bridge_slave_0 entered promiscuous mode [ 121.549906][ T25] audit: type=1800 audit(1791751223.001:76): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.283" name="subclass" dev="configfs" ino=36260 res=0 errno=0 [ 121.614641][ T5290] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.669735][ T5290] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.704256][ T25] audit: type=1800 audit(1791751223.021:77): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.283" name="protocol" dev="configfs" ino=36263 res=0 errno=0 [ 121.750370][ T5290] device bridge_slave_1 entered promiscuous mode [ 121.779858][ T2236] nvmet: connect request for invalid subsystem testsub! [ 121.794847][ T7] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 121.819824][ T5332] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsub" [ 121.868977][ T5290] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.615490][ T5290] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.730428][ T5290] team0: Port device team_slave_0 added [ 122.763235][ T5290] team0: Port device team_slave_1 added [ 122.795102][ T7] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 122.855619][ T5290] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.862758][ T7] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 1024 [ 122.904603][ T5290] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.940758][ T7] usb 5-1: config 1 interface 1 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 122.973257][ T7] usb 5-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 123.015568][ T7] usb 5-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice= 1.00 [ 123.047566][ T5290] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 123.071441][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.096322][ T5290] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 123.134982][ T5327] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 123.147719][ T5290] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 123.235105][ T2390] Bluetooth: hci5: command 0x041b tx timeout [ 123.274200][ T5290] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.354884][ T4233] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 123.378700][ T5290] device hsr_slave_0 entered promiscuous mode [ 123.410769][ T5290] device hsr_slave_1 entered promiscuous mode [ 123.428488][ T7] ims_pcu 5-1:1.0: Failed to set line coding, error: -71 [ 123.448528][ T5290] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 123.468254][ T7] ims_pcu: probe of 5-1:1.0 failed with error -71 [ 123.518710][ T7] usb 5-1: USB disconnect, device number 6 [ 123.524653][ T5290] Cannot create hsr debugfs directory [ 123.604898][ T4233] usb 4-1: Using ep0 maxpacket: 32 [ 123.735057][ T4233] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 123.780697][ T4233] usb 4-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 123.851329][ T4233] usb 4-1: config 0 interface 0 has no altsetting 0 [ 123.900285][ T5290] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 123.938606][ T5290] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 124.023832][ T5290] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 124.034987][ T4233] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 124.076617][ T4233] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.136823][ T4233] usb 4-1: Product: syz [ 125.141042][ T4233] usb 4-1: Manufacturer: syz [ 125.177235][ T4233] usb 4-1: SerialNumber: syz [ 125.385232][ T4233] usb 4-1: config 0 descriptor?? [ 125.397645][ T2390] Bluetooth: hci5: command 0x040f tx timeout [ 125.409659][ T5290] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 125.502159][ T25] kauditd_printk_skb: 3 callbacks suppressed [ 125.502169][ T25] audit: type=1800 audit(1791751227.091:81): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="no_out_endpoint" dev="configfs" ino=36587 res=0 errno=0 [ 125.655647][ T25] audit: type=1800 audit(1791751227.131:82): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="subclass" dev="configfs" ino=36594 res=0 errno=0 [ 125.689743][ T5290] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.734280][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 125.759748][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 125.769554][ T25] audit: type=1800 audit(1791751227.131:83): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="protocol" dev="configfs" ino=36595 res=0 errno=0 [ 125.814246][ T5290] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.851520][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 125.882997][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 125.893621][ T25] audit: type=1800 audit(1791751227.131:84): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="report_length" dev="configfs" ino=36596 res=0 errno=0 [ 125.914941][ T7] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 125.960835][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.967987][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.029551][ T25] audit: type=1800 audit(1791751227.131:85): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="report_desc" dev="configfs" ino=36597 res=0 errno=0 [ 126.075803][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 126.114575][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 126.151415][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 126.171778][ T25] audit: type=1800 audit(1791751227.161:86): pid=5366 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.299" name="UDC" dev="configfs" ino=36601 res=0 errno=0 [ 126.191999][ T7] usb 5-1: Using ep0 maxpacket: 32 [ 126.222640][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.229902][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.269439][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 126.308182][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 126.335475][ T7] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 126.364287][ T7] usb 5-1: config 0 has no interface number 0 [ 126.384051][ T7] usb 5-1: config 0 interface 12 has no altsetting 0 [ 126.458997][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 126.480001][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 126.494285][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 126.513305][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 126.532555][ T25] audit: type=1326 audit(1791751228.121:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5380 comm="syz.2.302" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa9757501d9 code=0x0 [ 126.561206][ T7] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 126.585621][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 126.598208][ T7] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.621411][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 126.629607][ T7] usb 5-1: Product: syz [ 126.652252][ T7] usb 5-1: Manufacturer: syz [ 126.673727][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 126.688767][ T7] usb 5-1: SerialNumber: syz [ 126.720520][ T7] usb 5-1: config 0 descriptor?? [ 126.733553][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 126.753331][ T2390] usb 4-1: USB disconnect, device number 5 [ 126.769655][ T5290] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 126.820649][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 126.949058][ T4306] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.476243][ T13] Bluetooth: hci5: command 0x0419 tx timeout [ 128.363370][ T13] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 128.398679][ T25] audit: type=1800 audit(1791751229.991:88): pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.310" name="no_out_endpoint" dev="configfs" ino=36757 res=0 errno=0 [ 128.420022][ T13] Bluetooth: hci2: Injecting HCI hardware error event [ 128.441093][ T4202] Bluetooth: hci2: hardware error 0x00 [ 128.476929][ T4306] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.490702][ T25] audit: type=1800 audit(1791751230.021:89): pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.310" name="subclass" dev="configfs" ino=36758 res=0 errno=0 [ 128.532314][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 128.547545][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 128.559344][ T25] audit: type=1800 audit(1791751230.031:90): pid=5407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.310" name="protocol" dev="configfs" ino=36759 res=0 errno=0 [ 128.606452][ T4306] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.632117][ T5290] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.649995][ T4306] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.737050][ T4233] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 128.777251][ T7] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 128.806155][ T7] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 128.854466][ T7] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 128.923758][ T7] f81534: probe of 5-1:0.12 failed with error -71 [ 128.987162][ T7] usb 5-1: USB disconnect, device number 7 [ 129.125263][ T4233] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 129.176084][ T4233] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.207621][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 129.249936][ T4233] usb 4-1: config 0 descriptor?? [ 129.271914][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 129.336013][ T4233] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 129.364317][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 129.397956][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 129.437422][ T5290] device veth0_vlan entered promiscuous mode [ 129.506980][ T5449] udc-core: couldn't find an available UDC or it's busy [ 129.534232][ T5449] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 129.554126][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 129.577708][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 129.610182][ T5290] device veth1_vlan entered promiscuous mode [ 129.624527][ T4233] usb 4-1: USB disconnect, device number 6 [ 129.647293][ T5428] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 129.703800][ T5290] device veth0_macvtap entered promiscuous mode [ 129.738205][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 129.767073][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 129.808836][ T5290] device veth1_macvtap entered promiscuous mode [ 129.844032][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 129.859512][ T4637] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 129.892084][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.909713][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.920358][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.934270][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.944519][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.958898][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.969046][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 129.983247][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 129.994565][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 130.011259][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 130.022673][ T5290] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 130.048051][ T5428] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 130.081439][ T5428] usb 5-1: config 0 has no interface number 0 [ 130.099734][ T5428] usb 5-1: config 0 interface 8 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 131.316988][ T1418] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.323800][ T1418] ieee802154 phy1 wpan1: encryption failed: -22 [ 131.434639][ T7] Bluetooth: hci5: command 0x0405 tx timeout [ 131.461930][ T4639] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 131.484195][ T4639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 131.539439][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 131.550197][ T5428] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 131.581193][ T25] kauditd_printk_skb: 3 callbacks suppressed [ 131.581203][ T25] audit: type=1800 audit(1791751233.171:94): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="no_out_endpoint" dev="configfs" ino=37072 res=0 errno=0 [ 131.618224][ T5428] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 131.633960][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 131.674512][ T5428] usb 5-1: Product: syz [ 131.692382][ T5428] usb 5-1: SerialNumber: syz [ 131.700330][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 131.719437][ T5477] device-mapper: table: 248:0: multipath: Unknown 'queue_mode' requested [ 131.740986][ T5475] sctp: [Deprecated]: syz.3.324 (pid 5475) Use of int in maxseg socket option. [ 131.740986][ T5475] Use struct sctp_assoc_value instead [ 131.759100][ T5428] usb 5-1: config 0 descriptor?? [ 131.774037][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 131.791086][ T25] audit: type=1800 audit(1791751233.221:95): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="subclass" dev="configfs" ino=37073 res=0 errno=0 [ 131.811657][ T5438] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 131.829150][ T5477] device-mapper: ioctl: error adding target to table [ 131.847149][ T5428] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 131.857506][ T5290] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 131.911292][ T5290] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 131.925865][ T25] audit: type=1800 audit(1791751233.221:96): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="protocol" dev="configfs" ino=37074 res=0 errno=0 [ 131.993632][ T5290] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 132.039184][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 132.058539][ T25] audit: type=1800 audit(1791751233.241:97): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="report_length" dev="configfs" ino=37075 res=0 errno=0 [ 132.099467][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 132.130826][ T5290] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.159522][ T25] audit: type=1800 audit(1791751233.241:98): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="report_desc" dev="configfs" ino=37076 res=0 errno=0 [ 132.183571][ T5290] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.206215][ T5290] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.228691][ T5290] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.240960][ T25] audit: type=1800 audit(1791751233.251:99): pid=5471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.322" name="UDC" dev="configfs" ino=37086 res=0 errno=0 [ 132.635720][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 132.695312][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.127071][ T4233] usb 5-1: USB disconnect, device number 8 [ 134.347917][ T4898] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 134.520137][ T4272] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 134.558628][ T4272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 134.608512][ T4306] device hsr_slave_0 left promiscuous mode [ 134.656087][ T4306] device hsr_slave_1 left promiscuous mode [ 134.716660][ T4306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 134.736560][ T4306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 134.771212][ T25] audit: type=1800 audit(1791751236.361:100): pid=5541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.339" name="no_out_endpoint" dev="configfs" ino=37442 res=0 errno=0 [ 134.796523][ T4306] device bridge_slave_1 left promiscuous mode [ 134.813940][ T4306] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.858068][ T4306] device bridge_slave_0 left promiscuous mode [ 134.867832][ T25] audit: type=1800 audit(1791751236.401:101): pid=5541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.339" name="subclass" dev="configfs" ino=37443 res=0 errno=0 [ 134.902727][ T4306] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.946295][ T25] audit: type=1800 audit(1791751236.401:102): pid=5541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.339" name="protocol" dev="configfs" ino=37444 res=0 errno=0 [ 134.993005][ T4306] device veth1_macvtap left promiscuous mode [ 135.011531][ T5546] FAULT_INJECTION: forcing a failure. [ 135.011531][ T5546] name failslab, interval 1, probability 0, space 0, times 0 [ 135.033360][ T4306] device veth0_macvtap left promiscuous mode [ 135.049479][ T25] audit: type=1800 audit(1791751236.401:103): pid=5541 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.339" name="report_length" dev="configfs" ino=37445 res=0 errno=0 [ 135.071561][ T4306] device veth1_vlan left promiscuous mode [ 135.083096][ T5546] CPU: 0 PID: 5546 Comm: syz.4.341 Not tainted syzkaller #0 [ 135.090399][ T5546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 135.100448][ T5546] Call Trace: [ 135.103712][ T5546] [ 135.106623][ T5546] dump_stack_lvl+0x188/0x250 [ 135.111287][ T5546] ? show_regs_print_info+0x20/0x20 [ 135.116467][ T5546] ? load_image+0x410/0x410 [ 135.120948][ T5546] ? __might_sleep+0xf0/0xf0 [ 135.125518][ T5546] ? __lock_acquire+0x7d40/0x7d40 [ 135.130528][ T5546] should_fail+0x383/0x4b0 [ 135.134935][ T5546] should_failslab+0x5/0x20 [ 135.139443][ T5546] slab_pre_alloc_hook+0x51/0xc0 [ 135.144370][ T5546] kmem_cache_alloc_trace+0x47/0x290 [ 135.149632][ T5546] ? call_usermodehelper_setup+0x8a/0x260 [ 135.155334][ T5546] call_usermodehelper_setup+0x8a/0x260 [ 135.160854][ T5546] ? __request_module+0x980/0x980 [ 135.165858][ T5546] __request_module+0x3ea/0x980 [ 135.170694][ T5546] ? umd_cleanup+0x110/0x110 [ 135.175261][ T5546] ? new_inode_pseudo+0xe2/0x210 [ 135.180184][ T5546] ? __rwlock_init+0x140/0x140 [ 135.185014][ T5546] ? bpf_lsm_inode_alloc_security+0x5/0x10 [ 135.190807][ T5546] ? do_raw_spin_unlock+0x11d/0x230 [ 135.195994][ T5546] __sock_create+0x31e/0x910 [ 135.200578][ T5546] __sys_socket+0xe2/0x170 [ 135.204985][ T5546] __x64_sys_socket+0x76/0x80 [ 135.209649][ T5546] do_syscall_64+0x4c/0xa0 [ 135.214072][ T5546] ? clear_bhb_loop+0x30/0x80 [ 135.218729][ T5546] ? clear_bhb_loop+0x30/0x80 [ 135.223386][ T5546] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 135.229257][ T5546] RIP: 0033:0x7f48680a81d9 [ 135.233686][ T5546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.253271][ T5546] RSP: 002b:00007f4866300028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 135.261668][ T5546] RAX: ffffffffffffffda RBX: 00007f486832ffa0 RCX: 00007f48680a81d9 [ 135.269638][ T5546] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000002d [ 135.277587][ T5546] RBP: 00007f486813f888 R08: 0000000000000000 R09: 0000000000000000 [ 135.285542][ T5546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.293493][ T5546] R13: 00007f4868330038 R14: 00007f486832ffa0 R15: 00007ffdaf9bb698 [ 135.301451][ T5546] [ 135.327384][ T4306] device veth0_vlan left promiscuous mode [ 135.501993][ T4306] team0 (unregistering): Port device team_slave_1 removed [ 135.519777][ T4306] team0 (unregistering): Port device team_slave_0 removed [ 135.628066][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 135.897351][ T5562] Disabled LAPIC found during irq injection [ 135.958592][ T5554] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 138.507821][ T5554] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 138.773792][ T25] kauditd_printk_skb: 1 callbacks suppressed [ 138.773801][ T25] audit: type=1800 audit(1791751240.361:105): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="no_out_endpoint" dev="configfs" ino=37711 res=0 errno=0 [ 138.863309][ T5594] netlink: 4 bytes leftover after parsing attributes in process `syz.3.354'. [ 138.908816][ T5594] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 138.945828][ T25] audit: type=1800 audit(1791751240.401:106): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="subclass" dev="configfs" ino=37712 res=0 errno=0 [ 139.051754][ T5594] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 139.069667][ T25] audit: type=1800 audit(1791751240.411:107): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="protocol" dev="configfs" ino=37713 res=0 errno=0 [ 139.198273][ T25] audit: type=1800 audit(1791751240.431:108): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="report_length" dev="configfs" ino=37714 res=0 errno=0 [ 140.395006][ T25] audit: type=1800 audit(1791751240.431:109): pid=5590 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.352" name="report_desc" dev="configfs" ino=37716 res=0 errno=0 [ 142.034905][ C0] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 143.281432][ T5641] netlink: 16 bytes leftover after parsing attributes in process `syz.4.367'. [ 143.357502][ T25] audit: type=1800 audit(1791751244.951:110): pid=5649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.370" name="no_out_endpoint" dev="configfs" ino=37932 res=0 errno=0 [ 143.461209][ T25] audit: type=1800 audit(1791751244.981:111): pid=5649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.370" name="subclass" dev="configfs" ino=37935 res=0 errno=0 [ 143.571412][ T25] audit: type=1800 audit(1791751244.981:112): pid=5649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.370" name="protocol" dev="configfs" ino=37936 res=0 errno=0 [ 143.654826][ T2236] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 143.679967][ T25] audit: type=1800 audit(1791751245.001:113): pid=5649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.370" name="report_length" dev="configfs" ino=37937 res=0 errno=0 [ 144.066099][ T25] audit: type=1800 audit(1791751245.001:114): pid=5649 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.370" name="report_desc" dev="configfs" ino=37938 res=0 errno=0 [ 144.234961][ T2236] usb 6-1: config 0 has an invalid interface number: 50 but max is 0 [ 144.266111][ T2236] usb 6-1: config 0 has no interface number 0 [ 144.302852][ T2236] usb 6-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 144.515159][ T2236] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 144.548171][ T2236] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.574598][ T5679] FAULT_INJECTION: forcing a failure. [ 144.574598][ T5679] name failslab, interval 1, probability 0, space 0, times 0 [ 144.621366][ T2236] usb 6-1: Product: syz [ 145.851999][ T2236] usb 6-1: Manufacturer: syz [ 145.937744][ T5679] CPU: 0 PID: 5679 Comm: syz.3.379 Not tainted syzkaller #0 [ 145.945043][ T5679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 145.955083][ T5679] Call Trace: [ 145.958353][ T5679] [ 145.961308][ T5679] dump_stack_lvl+0x188/0x250 [ 145.965976][ T5679] ? show_regs_print_info+0x20/0x20 [ 145.971155][ T5679] ? load_image+0x410/0x410 [ 145.975752][ T5679] ? __might_sleep+0xf0/0xf0 [ 145.980360][ T5679] ? __lock_acquire+0x7d40/0x7d40 [ 145.985500][ T5679] should_fail+0x383/0x4b0 [ 145.989912][ T5679] should_failslab+0x5/0x20 [ 145.994489][ T5679] slab_pre_alloc_hook+0x51/0xc0 [ 145.999410][ T5679] kmem_cache_alloc_trace+0x47/0x290 [ 146.004672][ T5679] ? sctp_endpoint_new+0x82/0xa00 [ 146.009691][ T5679] sctp_endpoint_new+0x82/0xa00 [ 146.014525][ T5679] ? __raw_spin_lock_init+0x41/0x100 [ 146.019797][ T5679] sctp_init_sock+0x95b/0x11c0 [ 146.024563][ T5679] inet_create+0xbde/0xee0 [ 146.028967][ T5679] __sock_create+0x473/0x910 [ 146.033539][ T5679] __sys_socket+0xe2/0x170 [ 146.037936][ T5679] __x64_sys_socket+0x76/0x80 [ 146.042592][ T5679] do_syscall_64+0x4c/0xa0 [ 146.046989][ T5679] ? clear_bhb_loop+0x30/0x80 [ 146.051645][ T5679] ? clear_bhb_loop+0x30/0x80 [ 146.056308][ T5679] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 146.062184][ T5679] RIP: 0033:0x7ffad98821d9 [ 146.066583][ T5679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.086188][ T5679] RSP: 002b:00007ffad7ada028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 146.094594][ T5679] RAX: ffffffffffffffda RBX: 00007ffad9b09fa0 RCX: 00007ffad98821d9 [ 146.102577][ T5679] RDX: 0000000000000084 RSI: 0000000000000005 RDI: 0000000000000002 [ 146.110539][ T5679] RBP: 00007ffad9919888 R08: 0000000000000000 R09: 0000000000000000 [ 146.118518][ T5679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 146.126522][ T5679] R13: 00007ffad9b0a038 R14: 00007ffad9b09fa0 R15: 00007ffc2da7c088 [ 146.134515][ T5679] [ 146.150712][ T2236] usb 6-1: SerialNumber: syz [ 146.188704][ T2236] usb 6-1: config 0 descriptor?? [ 146.259115][ T2236] yurex 6-1:0.50: USB YUREX device now attached to Yurex #0 [ 146.397336][ T2236] usb 6-1: USB disconnect, device number 2 [ 146.454428][ T2236] yurex 6-1:0.50: USB YUREX #0 now disconnected [ 146.581605][ T5688] binder: BINDER_SET_CONTEXT_MGR already set [ 146.607024][ T5688] binder: 5687:5688 ioctl 4018620d 200000000640 returned -16 [ 146.739941][ T5670] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.748179][ T5670] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.280640][ T5670] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 147.294858][ T7] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 147.389304][ T5670] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.674968][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 147.699237][ T7] usb 4-1: config 0 has no interfaces? [ 147.715508][ T7] usb 4-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 147.737267][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.762027][ T7] usb 4-1: config 0 descriptor?? [ 148.051723][ T4233] usb 4-1: USB disconnect, device number 7 [ 148.073404][ T5670] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.088206][ T5670] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.097604][ T5670] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.109603][ T5670] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.411902][ T25] audit: type=1800 audit(1791751250.001:115): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="no_out_endpoint" dev="configfs" ino=38204 res=0 errno=0 [ 148.502974][ T5715] FAULT_INJECTION: forcing a failure. [ 148.502974][ T5715] name failslab, interval 1, probability 0, space 0, times 0 [ 148.584838][ T25] audit: type=1800 audit(1791751250.031:116): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="subclass" dev="configfs" ino=38208 res=0 errno=0 [ 148.637923][ T5715] CPU: 0 PID: 5715 Comm: syz.5.389 Not tainted syzkaller #0 [ 148.645233][ T5715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 148.655475][ T5715] Call Trace: [ 148.658837][ T5715] [ 148.661751][ T5715] dump_stack_lvl+0x188/0x250 [ 148.666418][ T5715] ? show_regs_print_info+0x20/0x20 [ 148.671620][ T5715] ? load_image+0x410/0x410 [ 148.676142][ T5715] ? __might_sleep+0xf0/0xf0 [ 148.680724][ T5715] ? __lock_acquire+0x7d40/0x7d40 [ 148.685743][ T5715] should_fail+0x383/0x4b0 [ 148.690152][ T5715] should_failslab+0x5/0x20 [ 148.694638][ T5715] slab_pre_alloc_hook+0x51/0xc0 [ 148.699581][ T5715] kmem_cache_alloc_trace+0x47/0x290 [ 148.704844][ T5715] ? binder_open+0xf8/0xbe0 [ 148.709352][ T5715] binder_open+0xf8/0xbe0 [ 148.713752][ T5715] ? apparmor_inode_getattr+0x20/0x20 [ 148.719117][ T5715] ? binder_mmap+0x350/0x350 [ 148.723707][ T5715] ? fsnotify_perm+0x254/0x560 [ 148.728479][ T5715] ? binder_mmap+0x350/0x350 [ 148.733069][ T5715] do_dentry_open+0x7f7/0xf90 [ 148.737745][ T5715] ? vfs_open+0x2b/0x80 [ 148.741883][ T5715] path_openat+0x2718/0x2fb0 [ 148.746462][ T5715] ? __kasan_slab_alloc+0xa9/0xc0 [ 148.751470][ T5715] ? do_filp_open+0x400/0x400 [ 148.756135][ T5715] do_filp_open+0x1df/0x400 [ 148.760623][ T5715] ? vfs_tmpfile+0x300/0x300 [ 148.765199][ T5715] ? _raw_spin_unlock+0x24/0x40 [ 148.770023][ T5715] ? alloc_fd+0x59e/0x650 [ 148.774332][ T5715] do_sys_openat2+0x14b/0x500 [ 148.778993][ T5715] ? __lock_acquire+0x7d40/0x7d40 [ 148.783996][ T5715] ? do_sys_open+0xe0/0xe0 [ 148.788404][ T5715] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 148.794379][ T5715] ? lock_chain_count+0x20/0x20 [ 148.799212][ T5715] __x64_sys_openat+0x135/0x160 [ 148.804070][ T5715] do_syscall_64+0x4c/0xa0 [ 148.808485][ T5715] ? clear_bhb_loop+0x30/0x80 [ 148.813156][ T5715] ? clear_bhb_loop+0x30/0x80 [ 148.817848][ T5715] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 148.824703][ T5715] RIP: 0033:0x7f339c9a61d9 [ 148.829128][ T5715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.848838][ T5715] RSP: 002b:00007f339abfe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 148.857244][ T5715] RAX: ffffffffffffffda RBX: 00007f339cc2dfa0 RCX: 00007f339c9a61d9 [ 148.865220][ T5715] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: ffffffffffffff9c [ 148.873172][ T5715] RBP: 00007f339ca3d888 R08: 0000000000000000 R09: 0000000000000000 [ 148.881127][ T5715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 148.889077][ T5715] R13: 00007f339cc2e038 R14: 00007f339cc2dfa0 R15: 00007ffc1736fff8 [ 148.897063][ T5715] [ 149.011308][ T25] audit: type=1800 audit(1791751250.061:117): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="protocol" dev="configfs" ino=38213 res=0 errno=0 [ 149.144074][ T25] audit: type=1800 audit(1791751250.061:118): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="report_length" dev="configfs" ino=38214 res=0 errno=0 [ 149.200584][ T5727] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 149.287959][ T5727] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 149.324564][ T25] audit: type=1800 audit(1791751250.061:119): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="report_desc" dev="configfs" ino=38215 res=0 errno=0 [ 149.472608][ T25] audit: type=1800 audit(1791751250.071:120): pid=5710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.388" name="UDC" dev="configfs" ino=38216 res=0 errno=0 [ 150.725585][ T2236] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 151.745032][ T2236] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 151.781980][ T2236] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 151.830335][ T2236] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 151.888686][ T2236] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 151.928575][ T2236] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 151.979292][ T2236] usb 5-1: config 0 descriptor?? [ 152.251552][ T2236] usb 5-1: USB disconnect, device number 9 [ 152.318380][ T25] audit: type=1800 audit(1791751253.911:121): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="no_out_endpoint" dev="configfs" ino=38483 res=0 errno=0 [ 152.425303][ T25] audit: type=1800 audit(1791751253.941:122): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="subclass" dev="configfs" ino=38486 res=0 errno=0 [ 152.527525][ T25] audit: type=1800 audit(1791751253.941:123): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="protocol" dev="configfs" ino=38487 res=0 errno=0 [ 152.597439][ T25] audit: type=1800 audit(1791751253.941:124): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="report_length" dev="configfs" ino=38489 res=0 errno=0 [ 152.664417][ T25] audit: type=1800 audit(1791751253.951:125): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="report_desc" dev="configfs" ino=38490 res=0 errno=0 [ 152.749603][ T25] audit: type=1800 audit(1791751253.951:126): pid=5784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.404" name="UDC" dev="configfs" ino=38491 res=0 errno=0 [ 152.778824][ T4232] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 154.194924][ T4232] usb 4-1: config index 0 descriptor too short (expected 65069, got 45) [ 154.218899][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 154.238770][ T4232] usb 4-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 154.341841][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 154.361594][ T4232] usb 4-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 255 [ 154.384341][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 154.399855][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 154.409547][ T4232] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 154.426242][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 154.440388][ T4232] usb 4-1: config 0 has no interfaces? [ 154.448514][ T5829] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 154.459176][ T4232] usb 4-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 154.470216][ T5829] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 154.493409][ T4232] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.513188][ T4232] usb 4-1: config 0 descriptor?? [ 155.317411][ T4232] usb 4-1: USB disconnect, device number 8 [ 155.621674][ T25] audit: type=1800 audit(1791751257.211:127): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="no_out_endpoint" dev="configfs" ino=38738 res=0 errno=0 [ 155.738431][ T25] audit: type=1800 audit(1791751257.251:128): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="subclass" dev="configfs" ino=38740 res=0 errno=0 [ 155.878253][ T25] audit: type=1800 audit(1791751257.251:129): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="protocol" dev="configfs" ino=38741 res=0 errno=0 [ 156.033214][ T25] audit: type=1800 audit(1791751257.251:130): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="report_length" dev="configfs" ino=38744 res=0 errno=0 [ 156.854576][ T25] audit: type=1800 audit(1791751257.251:131): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="report_desc" dev="configfs" ino=38745 res=0 errno=0 [ 156.854601][ T25] audit: type=1800 audit(1791751257.271:132): pid=5860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.424" name="UDC" dev="configfs" ino=38746 res=0 errno=0 [ 157.208029][ T5903] netlink: 4 bytes leftover after parsing attributes in process `syz.2.437'. [ 160.593610][ T25] audit: type=1800 audit(1791751262.181:133): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="no_out_endpoint" dev="configfs" ino=39030 res=0 errno=0 [ 160.614512][ C0] vkms_vblank_simulate: vblank timer overrun [ 160.752136][ T25] audit: type=1800 audit(1791751262.221:134): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="subclass" dev="configfs" ino=39031 res=0 errno=0 [ 161.149603][ T25] audit: type=1800 audit(1791751262.221:135): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="protocol" dev="configfs" ino=39032 res=0 errno=0 [ 161.253992][ T25] audit: type=1800 audit(1791751262.251:136): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="report_length" dev="configfs" ino=39037 res=0 errno=0 [ 161.387452][ T25] audit: type=1800 audit(1791751262.251:137): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="report_desc" dev="configfs" ino=39038 res=0 errno=0 [ 161.519830][ T25] audit: type=1800 audit(1791751262.271:138): pid=5931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.444" name="UDC" dev="configfs" ino=39040 res=0 errno=0 [ 161.567705][ T5967] netlink: 4 bytes leftover after parsing attributes in process `syz.5.455'. [ 161.608859][ T5967] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 163.138364][ T5967] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.233589][ T5994] device bridge0 entered promiscuous mode [ 163.298976][ T5994] device macvlan2 entered promiscuous mode [ 163.489257][ T25] audit: type=1800 audit(1791751265.081:139): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.464" name="no_out_endpoint" dev="configfs" ino=39249 res=0 errno=0 [ 163.528723][ T6014] tmpfs: Unknown parameter 'grpquota' [ 163.648778][ T25] audit: type=1800 audit(1791751265.111:140): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.464" name="subclass" dev="configfs" ino=39250 res=0 errno=0 [ 163.844035][ T6020] x_tables: duplicate entry at hook 1 [ 163.913006][ T25] audit: type=1800 audit(1791751265.111:141): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.464" name="protocol" dev="configfs" ino=39251 res=0 errno=0 [ 163.933251][ C0] vkms_vblank_simulate: vblank timer overrun [ 163.988137][ T6029] user requested TSC rate below hardware speed [ 163.999659][ T25] audit: type=1800 audit(1791751265.111:142): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.464" name="report_length" dev="configfs" ino=39252 res=0 errno=0 [ 164.058802][ T25] audit: type=1800 audit(1791751265.111:143): pid=6011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.464" name="report_desc" dev="configfs" ino=39253 res=0 errno=0 [ 164.186710][ T6040] netlink: 4 bytes leftover after parsing attributes in process `syz.5.471'. [ 164.568182][ T6052] fuse: Bad value for 'fd' [ 165.276941][ T6080] netlink: 4 bytes leftover after parsing attributes in process `syz.3.484'. [ 165.521593][ T6106] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 166.149097][ T4265] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 166.214553][ T6118] jffs2: notice: (6118) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 167.214974][ T4265] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.744307][ T6151] CIFS: bad ip= option (127®0.0.1) [ 167.793795][ T6151] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 167.819904][ C0] vkms_vblank_simulate: vblank timer overrun [ 167.954847][ T4265] usb 4-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 167.963964][ T4265] usb 4-1: New USB device strings: Mfr=22, Product=149, SerialNumber=35 [ 169.411467][ T4265] usb 4-1: Product: syz [ 169.442939][ T4265] usb 4-1: Manufacturer: syz [ 169.460584][ T4265] usb 4-1: SerialNumber: syz [ 169.503893][ T4265] usb 4-1: config 0 descriptor?? [ 169.548929][ T4265] usb 4-1: can't set config #0, error -71 [ 169.594213][ T4265] usb 4-1: USB disconnect, device number 9 [ 169.604916][ T6151] CIFS: Attempting to mount \\127.0.0.1\share [ 169.661138][ T6151] FAULT_INJECTION: forcing a failure. [ 169.661138][ T6151] name failslab, interval 1, probability 0, space 0, times 0 [ 169.720114][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 169.730161][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 169.740191][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 169.749466][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 169.759327][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 169.768080][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 169.776889][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 169.808908][ T6151] CPU: 0 PID: 6151 Comm: syz.0.507 Not tainted syzkaller #0 [ 169.816222][ T6151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 169.826259][ T6151] Call Trace: [ 169.829523][ T6151] [ 169.832450][ T6151] dump_stack_lvl+0x188/0x250 [ 169.837128][ T6151] ? show_regs_print_info+0x20/0x20 [ 169.842309][ T6151] ? load_image+0x410/0x410 [ 169.846797][ T6151] ? __might_sleep+0xf0/0xf0 [ 169.851370][ T6151] ? __lock_acquire+0x7d40/0x7d40 [ 169.856412][ T6151] should_fail+0x383/0x4b0 [ 169.860827][ T6151] should_failslab+0x5/0x20 [ 169.865316][ T6151] slab_pre_alloc_hook+0x51/0xc0 [ 169.870239][ T6151] kmem_cache_alloc_trace+0x47/0x290 [ 169.875505][ T6151] ? cifs_smb3_do_mount+0x132/0x760 [ 169.880683][ T6151] cifs_smb3_do_mount+0x132/0x760 [ 169.885687][ T6151] ? cifs_sb_deactive+0x80/0x80 [ 169.890520][ T6151] ? kasan_quarantine_put+0xd4/0x210 [ 169.895788][ T6151] smb3_get_tree+0x59a/0xa80 [ 169.900370][ T6151] vfs_get_tree+0x88/0x270 [ 169.904767][ T6151] vfs_fsconfig_locked+0x22f/0x400 [ 169.909857][ T6151] __se_sys_fsconfig+0x69e/0x7e0 [ 169.914783][ T6151] ? __x64_sys_fsconfig+0xc0/0xc0 [ 169.919789][ T6151] ? lockdep_hardirqs_on+0x94/0x140 [ 169.925068][ T6151] ? __x64_sys_fsconfig+0x1c/0xc0 [ 169.930107][ T6151] do_syscall_64+0x4c/0xa0 [ 169.934514][ T6151] ? clear_bhb_loop+0x30/0x80 [ 169.939176][ T6151] ? clear_bhb_loop+0x30/0x80 [ 169.943833][ T6151] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 169.949717][ T6151] RIP: 0033:0x7f757ee141d9 [ 169.954127][ T6151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 169.973719][ T6151] RSP: 002b:00007f757d06c028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 169.982117][ T6151] RAX: ffffffffffffffda RBX: 00007f757f09bfa0 RCX: 00007f757ee141d9 [ 169.990069][ T6151] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 169.998039][ T6151] RBP: 00007f757eeab888 R08: 0000000000000000 R09: 0000000000000000 [ 170.006002][ T6151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.013964][ T6151] R13: 00007f757f09c038 R14: 00007f757f09bfa0 R15: 00007ffca83ba028 [ 170.021925][ T6151] [ 170.208195][ T6156] sctp_transport_update_pmtu: 49 callbacks suppressed [ 170.208208][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 170.321194][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 170.380584][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 170.401872][ T6166] FAULT_INJECTION: forcing a failure. [ 170.401872][ T6166] name fail_futex, interval 1, probability 0, space 0, times 0 [ 170.472939][ T6166] CPU: 0 PID: 6166 Comm: syz.3.512 Not tainted syzkaller #0 [ 170.480247][ T6166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 170.490302][ T6166] Call Trace: [ 170.493564][ T6166] [ 170.496476][ T6166] dump_stack_lvl+0x188/0x250 [ 170.501136][ T6166] ? show_regs_print_info+0x20/0x20 [ 170.506307][ T6166] ? load_image+0x410/0x410 [ 170.510784][ T6166] ? __lock_acquire+0x12df/0x7d40 [ 170.515807][ T6166] ? mark_lock+0x94/0x320 [ 170.520133][ T6166] should_fail+0x383/0x4b0 [ 170.524538][ T6166] get_futex_key+0x1a1/0x12d0 [ 170.529220][ T6166] ? futex_wait_restart+0x250/0x250 [ 170.534401][ T6166] futex_wake+0x101/0x540 [ 170.538708][ T6166] ? verify_lock_unused+0x140/0x140 [ 170.543884][ T6166] ? verify_lock_unused+0x140/0x140 [ 170.549077][ T6166] ? futex_wait+0x680/0x680 [ 170.553568][ T6166] do_futex+0xd83/0x12b0 [ 170.557791][ T6166] ? __might_sleep+0xf0/0xf0 [ 170.562370][ T6166] ? __might_fault+0xb7/0x110 [ 170.567044][ T6166] ? futex_exit_release+0x1c0/0x1c0 [ 170.572228][ T6166] ? __lock_acquire+0x7d40/0x7d40 [ 170.577244][ T6166] mm_release+0x278/0x3c0 [ 170.581558][ T6166] ? exit_mm_release+0x30/0x30 [ 170.586298][ T6166] ? lockdep_hardirqs_on+0x94/0x140 [ 170.591479][ T6166] exit_mm+0xaf/0x7b0 [ 170.595439][ T6166] ? perf_pmu_migrate_context+0xb70/0xb70 [ 170.601138][ T6166] ? do_exit+0x2110/0x2110 [ 170.605545][ T6166] ? rcu_is_watching+0x11/0xa0 [ 170.610305][ T6166] ? mm_trace_rss_stat+0x81/0x1c0 [ 170.615326][ T6166] ? sync_mm_rss+0x211/0x350 [ 170.619926][ T6166] do_exit+0x5b8/0x2110 [ 170.624070][ T6166] ? put_task_struct+0x80/0x80 [ 170.628847][ T6166] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 170.634815][ T6166] ? _raw_spin_lock_irq+0xb7/0xf0 [ 170.639841][ T6166] do_group_exit+0x12c/0x2f0 [ 170.644417][ T6166] ? lockdep_hardirqs_on+0x94/0x140 [ 170.649595][ T6166] get_signal+0x7eb/0x12e0 [ 170.654083][ T6166] arch_do_signal_or_restart+0xe6/0x12a0 [ 170.659696][ T6166] ? lookup_ioctx+0x5f0/0x5f0 [ 170.664351][ T6166] ? rcu_lock_release+0x5/0x20 [ 170.669090][ T6166] ? __lock_acquire+0x7d40/0x7d40 [ 170.674093][ T6166] ? get_sigframe_size+0x10/0x10 [ 170.679016][ T6166] ? __x64_sys_io_submit+0x80/0x80 [ 170.684192][ T6166] ? exit_to_user_mode_loop+0x3b/0x130 [ 170.689651][ T6166] exit_to_user_mode_loop+0x9e/0x130 [ 170.694914][ T6166] exit_to_user_mode_prepare+0xee/0x180 [ 170.700436][ T6166] syscall_exit_to_user_mode+0x16/0x40 [ 170.705872][ T6166] do_syscall_64+0x58/0xa0 [ 170.710267][ T6166] ? clear_bhb_loop+0x30/0x80 [ 170.714921][ T6166] ? clear_bhb_loop+0x30/0x80 [ 170.719595][ T6166] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 170.725468][ T6166] RIP: 0033:0x7ffad98821d9 [ 170.729863][ T6166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.749446][ T6166] RSP: 002b:00007ffad7ada028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 170.757835][ T6166] RAX: 0000000000000001 RBX: 00007ffad9b09fa0 RCX: 00007ffad98821d9 [ 170.765800][ T6166] RDX: 0000200000000180 RSI: 0000000000000001 RDI: 00007ffad9ae3000 [ 170.773749][ T6166] RBP: 00007ffad9919888 R08: 0000000000000000 R09: 0000000000000000 [ 170.781702][ T6166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.789652][ T6166] R13: 00007ffad9b0a038 R14: 00007ffad9b09fa0 R15: 00007ffc2da7c088 [ 170.797610][ T6166] [ 170.828871][ T6183] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 170.863285][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 170.881512][ T25] kauditd_printk_skb: 7 callbacks suppressed [ 170.881521][ T25] audit: type=1800 audit(1791751272.471:151): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="no_out_endpoint" dev="configfs" ino=39727 res=0 errno=0 [ 170.934362][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 170.980034][ T25] audit: type=1800 audit(1791751272.501:152): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="subclass" dev="configfs" ino=39729 res=0 errno=0 [ 171.009259][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 171.069105][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 171.090811][ T25] audit: type=1800 audit(1791751272.511:153): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="protocol" dev="configfs" ino=39730 res=0 errno=0 [ 171.133803][ T6197] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 171.153455][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 171.182686][ T25] audit: type=1800 audit(1791751272.511:154): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="report_length" dev="configfs" ino=39731 res=0 errno=0 [ 171.218157][ T6197] overlayfs: failed to look up (tracing) for ino (-66) [ 171.231806][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 171.261524][ T6197] netlink: 12 bytes leftover after parsing attributes in process `syz.5.515'. [ 171.281045][ T25] audit: type=1800 audit(1791751272.511:155): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="report_desc" dev="configfs" ino=39732 res=0 errno=0 [ 171.308412][ T6156] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 171.371445][ T25] audit: type=1800 audit(1791751272.511:156): pid=6187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.509" name="UDC" dev="configfs" ino=39733 res=0 errno=0 [ 172.613240][ T6236] FAULT_INJECTION: forcing a failure. [ 172.613240][ T6236] name failslab, interval 1, probability 0, space 0, times 0 [ 172.692220][ T6236] CPU: 0 PID: 6236 Comm: syz.2.526 Not tainted syzkaller #0 [ 172.699550][ T6236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 172.709599][ T6236] Call Trace: [ 172.712883][ T6236] [ 172.715798][ T6236] dump_stack_lvl+0x188/0x250 [ 172.720464][ T6236] ? show_regs_print_info+0x20/0x20 [ 172.725729][ T6236] ? load_image+0x410/0x410 [ 172.730230][ T6236] ? __might_sleep+0xf0/0xf0 [ 172.734796][ T6236] ? __lock_acquire+0x7d40/0x7d40 [ 172.739801][ T6236] should_fail+0x383/0x4b0 [ 172.744204][ T6236] should_failslab+0x5/0x20 [ 172.748685][ T6236] slab_pre_alloc_hook+0x51/0xc0 [ 172.753598][ T6236] ? __kernfs_new_node+0xa8/0x6b0 [ 172.758608][ T6236] __kmalloc_track_caller+0x69/0x330 [ 172.763877][ T6236] ? __kernfs_new_node+0xa8/0x6b0 [ 172.768879][ T6236] kstrdup_const+0x51/0x90 [ 172.773280][ T6236] __kernfs_new_node+0xa8/0x6b0 [ 172.778154][ T6236] ? kernfs_new_node+0x250/0x250 [ 172.783094][ T6236] ? sysfs_do_create_link_sd+0x75/0x110 [ 172.788623][ T6236] kernfs_new_node+0x148/0x250 [ 172.793374][ T6236] kernfs_create_link+0xa3/0x200 [ 172.798289][ T6236] sysfs_do_create_link_sd+0x83/0x110 [ 172.803647][ T6236] device_add+0x83b/0x1050 [ 172.808045][ T6236] netdev_register_kobject+0x184/0x320 [ 172.813527][ T6236] register_netdevice+0x10e8/0x1720 [ 172.818729][ T6236] ? netif_stacked_transfer_operstate+0x200/0x200 [ 172.825140][ T6236] ? memset+0x1e/0x40 [ 172.829108][ T6236] ? alloc_netdev_mqs+0x9da/0xc40 [ 172.834128][ T6236] mif6_add+0x450/0xc40 [ 172.838279][ T6236] ? ip6_mroute_setsockopt+0xde4/0x1380 [ 172.843824][ T6236] ? __might_fault+0xb7/0x110 [ 172.848485][ T6236] ? ip6_mroute_setsockopt+0x1380/0x1380 [ 172.854103][ T6236] ip6_mroute_setsockopt+0x1118/0x1380 [ 172.859542][ T6236] ? ip6mr_fib_lookup+0x1e0/0x1e0 [ 172.864555][ T6236] ? __might_fault+0xb3/0x110 [ 172.869214][ T6236] ? _copy_from_user+0x111/0x170 [ 172.874128][ T6236] ipv6_setsockopt+0x4c0/0x3cc0 [ 172.878985][ T6236] ? ipv6_update_options+0x400/0x400 [ 172.884257][ T6236] ? futex_wait_queue_me+0x16e/0x440 [ 172.889532][ T6236] ? __might_sleep+0xf0/0xf0 [ 172.894134][ T6236] ? __lock_acquire+0x7d40/0x7d40 [ 172.899156][ T6236] ? mark_lock+0x94/0x320 [ 172.903478][ T6236] ? __lock_acquire+0x12df/0x7d40 [ 172.908497][ T6236] ? __lock_acquire+0x13b3/0x7d40 [ 172.913505][ T6236] ? verify_lock_unused+0x140/0x140 [ 172.918684][ T6236] ? aa_label_sk_perm+0x3e6/0x540 [ 172.923713][ T6236] ? aa_sk_perm+0x910/0x910 [ 172.928202][ T6236] ? __might_sleep+0xf0/0xf0 [ 172.932780][ T6236] ? rcu_lock_release+0x9/0x20 [ 172.937532][ T6236] ? __lock_acquire+0x7d40/0x7d40 [ 172.942541][ T6236] ? aa_sk_perm+0x7dc/0x910 [ 172.947026][ T6236] rawv6_setsockopt+0x29e/0x660 [ 172.951854][ T6236] ? __fget_files+0x402/0x470 [ 172.956522][ T6236] ? raw6_destroy+0x30/0x30 [ 172.961005][ T6236] ? aa_sock_opt_perm+0x74/0x100 [ 172.965919][ T6236] ? sock_common_setsockopt+0x32/0xb0 [ 172.971279][ T6236] ? sock_common_recvmsg+0x1c0/0x1c0 [ 172.976548][ T6236] __sys_setsockopt+0x2bf/0x3d0 [ 172.981381][ T6236] __x64_sys_setsockopt+0xb1/0xc0 [ 172.986390][ T6236] do_syscall_64+0x4c/0xa0 [ 172.990786][ T6236] ? clear_bhb_loop+0x30/0x80 [ 172.995443][ T6236] ? clear_bhb_loop+0x30/0x80 [ 173.000094][ T6236] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 173.005962][ T6236] RIP: 0033:0x7fa9757501d9 [ 173.010369][ T6236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.029947][ T6236] RSP: 002b:00007fa9739a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 173.038348][ T6236] RAX: ffffffffffffffda RBX: 00007fa9759d7fa0 RCX: 00007fa9757501d9 [ 173.046299][ T6236] RDX: 00000000000000ca RSI: 0000000000000029 RDI: 0000000000000004 [ 173.054274][ T6236] RBP: 00007fa9757e7888 R08: 000000000000000c R09: 0000000000000000 [ 173.062224][ T6236] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000000 [ 173.070186][ T6236] R13: 00007fa9759d8038 R14: 00007fa9759d7fa0 R15: 00007fff576e8858 [ 173.078160][ T6236] [ 173.318179][ T25] audit: type=1800 audit(1791751274.911:157): pid=6250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.529" name="no_out_endpoint" dev="configfs" ino=39872 res=0 errno=0 [ 173.392966][ T25] audit: type=1800 audit(1791751274.941:158): pid=6250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.529" name="subclass" dev="configfs" ino=39873 res=0 errno=0 [ 174.182422][ T25] audit: type=1800 audit(1791751274.941:159): pid=6250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.529" name="protocol" dev="configfs" ino=39874 res=0 errno=0 [ 175.377241][ T6266] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 175.397298][ T6267] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 175.747418][ T25] audit: type=1800 audit(1791751274.941:160): pid=6250 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.529" name="report_length" dev="configfs" ino=39875 res=0 errno=0 [ 175.781104][ T6267] overlayfs: failed to look up (tracing) for ino (-66) [ 175.809058][ T6268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.533'. [ 176.114950][ T4232] Bluetooth: hci1: command 0x0406 tx timeout [ 176.534127][ T6294] netlink: 4 bytes leftover after parsing attributes in process `syz.5.538'. [ 176.639522][ T6302] jffs2: notice: (6302) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 176.693725][ T25] kauditd_printk_skb: 2 callbacks suppressed [ 176.693734][ T25] audit: type=1800 audit(1791751278.281:163): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="no_out_endpoint" dev="configfs" ino=40049 res=0 errno=0 [ 176.821063][ T25] audit: type=1800 audit(1791751278.321:164): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="subclass" dev="configfs" ino=40050 res=0 errno=0 [ 176.922528][ T25] audit: type=1800 audit(1791751278.321:165): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="protocol" dev="configfs" ino=40051 res=0 errno=0 [ 178.388685][ T25] audit: type=1800 audit(1791751278.321:166): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="report_length" dev="configfs" ino=40052 res=0 errno=0 [ 179.955568][ T6318] ODEBUG: Out of memory. ODEBUG disabled [ 180.101665][ T25] audit: type=1800 audit(1791751278.321:167): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="report_desc" dev="configfs" ino=40053 res=0 errno=0 [ 180.266926][ T25] audit: type=1800 audit(1791751278.331:168): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.542" name="UDC" dev="configfs" ino=40054 res=0 errno=0 [ 180.331654][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 180.340837][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 180.350276][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 180.359227][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 180.368068][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 180.377678][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 180.386327][ T6326] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 180.596154][ T6330] sctp_transport_update_pmtu: 48 callbacks suppressed [ 180.596167][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 180.738958][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 180.833882][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 180.890689][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 180.979066][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.258032][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.320465][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.384290][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.445646][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.506374][ T6330] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 181.593348][ T25] audit: type=1800 audit(1791751283.181:169): pid=6380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.556" name="no_out_endpoint" dev="configfs" ino=40186 res=0 errno=0 [ 181.707254][ T25] audit: type=1800 audit(1791751283.211:170): pid=6380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.556" name="subclass" dev="configfs" ino=40187 res=0 errno=0 [ 181.836069][ T25] audit: type=1800 audit(1791751283.211:171): pid=6380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.556" name="protocol" dev="configfs" ino=40188 res=0 errno=0 [ 181.974340][ T25] audit: type=1800 audit(1791751283.211:172): pid=6380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.556" name="report_length" dev="configfs" ino=40189 res=0 errno=0 [ 182.122953][ T25] audit: type=1800 audit(1791751283.221:173): pid=6380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.556" name="UDC" dev="configfs" ino=40190 res=0 errno=0 [ 182.883068][ T6416] netlink: 12 bytes leftover after parsing attributes in process `syz.5.566'. [ 183.084887][ T4232] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 183.453262][ T6443] /dev/sg0: Can't open blockdev [ 183.505003][ T4232] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 183.547717][ T4232] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 183.608133][ T4232] usb 3-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 183.650199][ T4232] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.829894][ T6452] device-mapper: table: 248:0: : unknown target type [ 183.886122][ T6452] device-mapper: ioctl: error adding target to table [ 184.177951][ T4232] dvb_ttusb_budget: cmd xter failed, receive error -22 [ 184.202023][ T4232] dvb_ttusb_budget: ttusb_init_controller: error [ 184.230243][ T4232] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 184.388300][ T4232] DVB: Unable to find symbol stv0299_attach() [ 184.472480][ T4232] DVB: Unable to find symbol tda8083_attach() [ 184.491215][ T4232] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 185.712500][ T6490] netlink: 84 bytes leftover after parsing attributes in process `syz.4.589'. [ 185.788926][ T4265] usb 3-1: USB disconnect, device number 3 [ 185.912410][ T6493] loop5: detected capacity change from 0 to 7 [ 185.967267][ T6454] Dev loop5: unable to read RDB block 7 [ 185.990142][ T6454] loop5: unable to read partition table [ 186.128281][ T6454] loop5: partition table beyond EOD, truncated [ 186.192148][ T6493] Dev loop5: unable to read RDB block 7 [ 186.228623][ T6493] loop5: unable to read partition table [ 186.904783][ T4232] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 186.942160][ T6493] loop5: partition table beyond EOD, truncated [ 187.004499][ T6493] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 187.022957][ T25] audit: type=1400 audit(1791751288.611:174): apparmor="STATUS" info="profile missing flags" error=-71 profile="unconfined" name="p" pid=6509 comm="syz.5.597" name="p" offset=33 [ 187.120195][ T6513] netlink: 16 bytes leftover after parsing attributes in process `syz.5.597'. [ 187.194568][ T6517] fuse: Bad value for 'fd' [ 187.276527][ T4232] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 187.303844][ T4232] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.349656][ T4232] usb 5-1: config 0 descriptor?? [ 188.477915][ T4232] cp210x 5-1:0.0: cp210x converter detected [ 189.532180][ T2236] Bluetooth: hci5: command 0x0411 tx timeout [ 189.854956][ T4232] cp210x 5-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 191.004461][ T4232] cp210x 5-1:0.0: querying part number failed [ 191.044260][ T4232] usb 5-1: cp210x converter now attached to ttyUSB0 [ 191.102207][ T4232] usb 5-1: USB disconnect, device number 10 [ 191.127344][ T6542] netlink: 4 bytes leftover after parsing attributes in process `syz.4.606'. [ 191.169497][ T4232] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 191.324019][ T4232] cp210x 5-1:0.0: device disconnected [ 191.740165][ T6560] fuse: Bad value for 'fd' [ 191.787517][ T4233] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 192.068087][ T6586] netlink: 4 bytes leftover after parsing attributes in process `syz.4.620'. [ 192.175792][ T4233] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 192.198906][ T4233] usb 3-1: config 0 has no interface number 0 [ 192.223573][ T4233] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 192.404923][ T4233] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 192.441101][ T4233] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.634788][ T4233] usb 3-1: Product: syz [ 193.639015][ T4233] usb 3-1: Manufacturer: syz [ 193.668519][ T4233] usb 3-1: SerialNumber: syz [ 193.693878][ T4233] usb 3-1: config 0 descriptor?? [ 193.761286][ T4233] yurex 3-1:0.50: USB YUREX device now attached to Yurex #0 [ 193.878816][ T6607] netlink: 8 bytes leftover after parsing attributes in process `syz.3.629'. [ 194.038557][ T1418] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.158672][ T1418] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.034886][ T2236] usb 3-1: USB disconnect, device number 4 [ 195.058234][ T6624] netlink: 4 bytes leftover after parsing attributes in process `syz.3.633'. [ 195.099293][ T2236] yurex 3-1:0.50: USB YUREX #0 now disconnected [ 195.687790][ T6652] device-mapper: table: 248:0: multipath: Unknown 'queue_mode' requested [ 195.727498][ T6652] device-mapper: ioctl: error adding target to table [ 197.317450][ T4265] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 197.334613][ T6673] netlink: 4 bytes leftover after parsing attributes in process `syz.0.650'. [ 198.514368][ T6673] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 198.709013][ T6691] loop0: detected capacity change from 0 to 4096 [ 198.715667][ T4265] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.747392][ T4265] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.428631][ T6695] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 199.467364][ T4265] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 199.467383][ T4265] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 199.491292][ T6695] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 199.491315][ T6695] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 199.491323][ T6695] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 199.491330][ T6695] ldm_validate_privheads(): Primary and backup PRIVHEADs don't match. [ 199.491358][ T6695] loop0: [ 199.795201][ T4265] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 200.834089][ T4265] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.878029][ T4265] usb 4-1: Product: syz [ 200.920087][ T4265] usb 4-1: Manufacturer: syz [ 200.936588][ T4265] usb 4-1: SerialNumber: syz [ 200.994259][ T4265] usb 4-1: can't set config #1, error -71 [ 201.042843][ T4265] usb 4-1: USB disconnect, device number 10 [ 201.069014][ T25] audit: type=1800 audit(1791751302.661:175): pid=6710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.663" name="enable" dev="configfs" ino=41391 res=0 errno=0 [ 201.892339][ T6724] netlink: 4 bytes leftover after parsing attributes in process `syz.3.666'. [ 202.942261][ T6755] FAULT_INJECTION: forcing a failure. [ 202.942261][ T6755] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 202.956783][ T6755] CPU: 0 PID: 6755 Comm: syz.0.677 Not tainted syzkaller #0 [ 202.964060][ T6755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 202.974105][ T6755] Call Trace: [ 202.977372][ T6755] [ 202.980284][ T6755] dump_stack_lvl+0x188/0x250 [ 202.984957][ T6755] ? show_regs_print_info+0x20/0x20 [ 202.990129][ T6755] ? load_image+0x410/0x410 [ 202.994614][ T6755] ? uncharge_page+0x490/0x490 [ 202.999367][ T6755] should_fail+0x383/0x4b0 [ 203.003762][ T6755] prepare_alloc_pages+0x1e3/0x5b0 [ 203.008863][ T6755] __alloc_pages+0x11b/0x480 [ 203.013430][ T6755] ? zone_statistics+0x170/0x170 [ 203.018357][ T6755] ? rcu_lock_acquire+0x30/0x30 [ 203.023194][ T6755] ? alloc_pages+0x452/0x560 [ 203.027760][ T6755] __get_free_pages+0x8/0x30 [ 203.032329][ T6755] __tlb_remove_page_size+0x1f2/0x3f0 [ 203.037847][ T6755] unmap_page_range+0xfcf/0x2410 [ 203.042793][ T6755] unmap_vmas+0x131/0x250 [ 203.047104][ T6755] ? unmap_page_range+0x2410/0x2410 [ 203.052288][ T6755] ? __mutex_lock_common+0x435/0x2400 [ 203.057671][ T6755] ? exit_mm_release+0x16/0x30 [ 203.062422][ T6755] exit_mmap+0x3b9/0x640 [ 203.066645][ T6755] ? vm_brk+0x20/0x20 [ 203.070610][ T6755] ? uprobe_clear_state+0x2f6/0x460 [ 203.075789][ T6755] __mmput+0x115/0x390 [ 203.079840][ T6755] exit_mm+0x632/0x7b0 [ 203.083886][ T6755] ? perf_pmu_migrate_context+0xb70/0xb70 [ 203.089588][ T6755] ? do_exit+0x2110/0x2110 [ 203.093978][ T6755] ? __ia32_sys_timer_delete+0x40/0x40 [ 203.099417][ T6755] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 203.104855][ T6755] ? tty_audit_exit+0x149/0x1f0 [ 203.109683][ T6755] do_exit+0x5b8/0x2110 [ 203.113818][ T6755] ? put_task_struct+0x80/0x80 [ 203.118560][ T6755] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 203.124519][ T6755] ? _raw_spin_lock_irq+0xb7/0xf0 [ 203.129521][ T6755] do_group_exit+0x12c/0x2f0 [ 203.134088][ T6755] ? lockdep_hardirqs_on+0x94/0x140 [ 203.139269][ T6755] get_signal+0x7eb/0x12e0 [ 203.143670][ T6755] arch_do_signal_or_restart+0xe6/0x12a0 [ 203.149301][ T6755] ? futex_exit_release+0x1c0/0x1c0 [ 203.154476][ T6755] ? get_sigframe_size+0x10/0x10 [ 203.159411][ T6755] ? __context_tracking_exit+0x4c/0x80 [ 203.164855][ T6755] ? exit_to_user_mode_loop+0x3b/0x130 [ 203.170309][ T6755] exit_to_user_mode_loop+0x9e/0x130 [ 203.175570][ T6755] exit_to_user_mode_prepare+0xee/0x180 [ 203.181091][ T6755] syscall_exit_to_user_mode+0x16/0x40 [ 203.186529][ T6755] do_syscall_64+0x58/0xa0 [ 203.190921][ T6755] ? clear_bhb_loop+0x30/0x80 [ 203.195576][ T6755] ? clear_bhb_loop+0x30/0x80 [ 203.200231][ T6755] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 203.206101][ T6755] RIP: 0033:0x7f757ee141d9 [ 203.210520][ T6755] Code: Unable to access opcode bytes at RIP 0x7f757ee141af. [ 203.217873][ T6755] RSP: 002b:00007f757d06c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 203.226273][ T6755] RAX: 0000000000000001 RBX: 00007f757f09bfa8 RCX: 00007f757ee141d9 [ 203.234244][ T6755] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f757f09bfac [ 203.242195][ T6755] RBP: 00007f757f09bfa0 R08: 003618439d8d2caa R09: 0000000000000000 [ 203.250161][ T6755] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 203.258109][ T6755] R13: 00007f757f09c038 R14: 00007ffca83b9f40 R15: 00007ffca83ba028 [ 203.266070][ T6755] [ 203.269085][ C0] vkms_vblank_simulate: vblank timer overrun [ 204.309065][ T7] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 204.569907][ T6762] netlink: 4 bytes leftover after parsing attributes in process `syz.5.680'. [ 204.774881][ T7] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 205.788147][ T2236] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 205.854839][ T7] usb 4-1: string descriptor 0 read error: -71 [ 206.274871][ T2236] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 207.047668][ T7] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 207.077158][ T2236] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.102881][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 207.129828][ T2236] usb 5-1: config 0 descriptor?? [ 207.152915][ T4265] Bluetooth: hci4: command 0x0406 tx timeout [ 207.165049][ T7] usb 4-1: can't set config #1, error -71 [ 207.182055][ T7] usb 4-1: USB disconnect, device number 11 [ 207.191441][ T2236] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 207.244601][ T6784] FAULT_INJECTION: forcing a failure. [ 207.244601][ T6784] name failslab, interval 1, probability 0, space 0, times 0 [ 207.297382][ T6784] CPU: 0 PID: 6784 Comm: syz.3.685 Not tainted syzkaller #0 [ 207.304684][ T6784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 207.314724][ T6784] Call Trace: [ 207.317988][ T6784] [ 207.320904][ T6784] dump_stack_lvl+0x188/0x250 [ 207.325563][ T6784] ? show_regs_print_info+0x20/0x20 [ 207.330747][ T6784] ? load_image+0x410/0x410 [ 207.335230][ T6784] should_fail+0x383/0x4b0 [ 207.339627][ T6784] should_failslab+0x5/0x20 [ 207.344104][ T6784] slab_pre_alloc_hook+0x51/0xc0 [ 207.349021][ T6784] ? skb_clone+0x1bd/0x350 [ 207.353429][ T6784] kmem_cache_alloc+0x3d/0x280 [ 207.358173][ T6784] skb_clone+0x1bd/0x350 [ 207.362406][ T6784] __netlink_deliver_tap+0x3cb/0x7c0 [ 207.367675][ T6784] netlink_deliver_tap+0x16c/0x180 [ 207.372767][ T6784] netlink_unicast+0x759/0x940 [ 207.377514][ T6784] netlink_sendmsg+0x8ba/0xbe0 [ 207.382254][ T6784] ? netlink_getsockopt+0x570/0x570 [ 207.387427][ T6784] ? aa_sock_msg_perm+0x94/0x150 [ 207.392356][ T6784] ? apparmor_socket_sendmsg+0x88/0x230 [ 207.397880][ T6784] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 207.403155][ T6784] ? security_socket_sendmsg+0x7c/0xa0 [ 207.408597][ T6784] ? netlink_getsockopt+0x570/0x570 [ 207.413792][ T6784] ____sys_sendmsg+0x5be/0x8f0 [ 207.418573][ T6784] ? __sys_sendmsg_sock+0x30/0x30 [ 207.423607][ T6784] ? import_iovec+0x6f/0xa0 [ 207.428098][ T6784] ___sys_sendmsg+0x236/0x2e0 [ 207.432767][ T6784] ? __sys_sendmsg+0x290/0x290 [ 207.437534][ T6784] __se_sys_sendmsg+0x1b7/0x2a0 [ 207.442383][ T6784] ? __x64_sys_sendmsg+0x80/0x80 [ 207.447300][ T6784] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 207.453269][ T6784] ? lockdep_hardirqs_on+0x94/0x140 [ 207.458521][ T6784] do_syscall_64+0x4c/0xa0 [ 207.462936][ T6784] ? clear_bhb_loop+0x30/0x80 [ 207.467608][ T6784] ? clear_bhb_loop+0x30/0x80 [ 207.472274][ T6784] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 207.478149][ T6784] RIP: 0033:0x7ffad98821d9 [ 207.482544][ T6784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.502139][ T6784] RSP: 002b:00007ffad7ada028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 207.510536][ T6784] RAX: ffffffffffffffda RBX: 00007ffad9b09fa0 RCX: 00007ffad98821d9 [ 207.518504][ T6784] RDX: 0000000000000000 RSI: 00002000000009c0 RDI: 0000000000000003 [ 207.526457][ T6784] RBP: 00007ffad9919888 R08: 0000000000000000 R09: 0000000000000000 [ 207.534420][ T6784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 207.542367][ T6784] R13: 00007ffad9b0a038 R14: 00007ffad9b09fa0 R15: 00007ffc2da7c088 [ 207.550323][ T6784] [ 207.587426][ T2236] gp8psk: usb in 128 operation failed. [ 207.623994][ T2236] gp8psk: usb in 137 operation failed. [ 207.649299][ T2236] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 207.684244][ T2236] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 207.721710][ T2236] usb 5-1: USB disconnect, device number 11 [ 207.796854][ T4265] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 208.719009][ T6798] udc-core: couldn't find an available UDC or it's busy [ 208.766989][ T6798] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 208.776660][ T4265] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 209.918948][ T4265] usb 6-1: config 0 has no interfaces? [ 209.958153][ T4265] usb 6-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 210.005384][ T4265] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.054456][ T4265] usb 6-1: config 0 descriptor?? [ 210.151073][ T7] usb 6-1: USB disconnect, device number 3 [ 211.501296][ T25] audit: type=1326 audit(1791751313.091:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6810 comm="syz.3.696" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffad98821d9 code=0x7fc00000 [ 211.615485][ T4265] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 211.936848][ T4265] usb 6-1: Using ep0 maxpacket: 16 [ 212.215698][ T4265] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 212.247273][ T4265] usb 6-1: New USB device found, idVendor=0c70, idProduct=f00d, bcdDevice= 0.00 [ 212.279921][ T4265] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.301930][ T4265] usb 6-1: config 0 descriptor?? [ 212.326430][ T6817] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 215.214880][ T4265] usbhid 6-1:0.0: can't add hid device: -71 [ 215.834612][ T6871] Can't find ip_set type hash:net, [ 215.840394][ T6854] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 215.857216][ T4265] usbhid: probe of 6-1:0.0 failed with error -71 [ 215.868919][ T6877] FAULT_INJECTION: forcing a failure. [ 215.868919][ T6877] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 215.918802][ T4265] usb 6-1: USB disconnect, device number 4 [ 215.991392][ T6877] CPU: 0 PID: 6877 Comm: syz.0.715 Not tainted syzkaller #0 [ 215.998699][ T6877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 216.008738][ T6877] Call Trace: [ 216.011999][ T6877] [ 216.014911][ T6877] dump_stack_lvl+0x188/0x250 [ 216.019581][ T6877] ? show_regs_print_info+0x20/0x20 [ 216.024759][ T6877] ? load_image+0x410/0x410 [ 216.029236][ T6877] ? __lock_acquire+0x7d40/0x7d40 [ 216.034244][ T6877] should_fail+0x383/0x4b0 [ 216.038642][ T6877] prepare_alloc_pages+0x1e3/0x5b0 [ 216.043734][ T6877] __alloc_pages+0x11b/0x480 [ 216.048303][ T6877] ? zone_statistics+0x170/0x170 [ 216.053220][ T6877] ? alloc_pages+0x452/0x560 [ 216.057791][ T6877] kmalloc_order+0x40/0x150 [ 216.062275][ T6877] kmalloc_order_trace+0x14/0xf0 [ 216.067195][ T6877] vhost_dev_set_owner+0x32e/0xa60 [ 216.072295][ T6877] ? vhost_dev_has_owner+0x40/0x40 [ 216.077397][ T6877] ? vhost_set_backend_features+0x1b0/0x1b0 [ 216.083273][ T6877] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 216.088712][ T6877] vhost_dev_ioctl+0xa5/0xeb0 [ 216.093370][ T6877] ? mutex_lock_io_nested+0x60/0x60 [ 216.098552][ T6877] ? vhost_init_device_iotlb+0x200/0x200 [ 216.104167][ T6877] vhost_vsock_dev_ioctl+0x239/0xe70 [ 216.109429][ T6877] ? vhost_vsock_chr_poll+0x50/0x50 [ 216.114627][ T6877] ? bpf_lsm_file_ioctl+0x5/0x10 [ 216.119546][ T6877] ? security_file_ioctl+0x7c/0xa0 [ 216.124634][ T6877] ? vhost_vsock_chr_poll+0x50/0x50 [ 216.129810][ T6877] __se_sys_ioctl+0xfa/0x170 [ 216.134395][ T6877] do_syscall_64+0x4c/0xa0 [ 216.138802][ T6877] ? clear_bhb_loop+0x30/0x80 [ 216.143455][ T6877] ? clear_bhb_loop+0x30/0x80 [ 216.148125][ T6877] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 216.153999][ T6877] RIP: 0033:0x7f757ee141d9 [ 216.158413][ T6877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.178014][ T6877] RSP: 002b:00007f757d06c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 216.186406][ T6877] RAX: ffffffffffffffda RBX: 00007f757f09bfa0 RCX: 00007f757ee141d9 [ 216.194358][ T6877] RDX: 0000000000000000 RSI: 000000000000af01 RDI: 0000000000000004 [ 216.202306][ T6877] RBP: 00007f757eeab888 R08: 0000000000000000 R09: 0000000000000000 [ 216.210258][ T6877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.218208][ T6877] R13: 00007f757f09c038 R14: 00007f757f09bfa0 R15: 00007ffca83ba028 [ 216.226519][ T6877] [ 216.397468][ T6895] netlink: 4 bytes leftover after parsing attributes in process `syz.5.721'. [ 218.663584][ T6925] netlink: 120 bytes leftover after parsing attributes in process `syz.5.732'. [ 218.700633][ T6925] netlink: 16 bytes leftover after parsing attributes in process `syz.5.732'. [ 218.934285][ T6940] netlink: 4 bytes leftover after parsing attributes in process `syz.0.738'. [ 219.026457][ T4233] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 222.578671][ T6960] loop0: detected capacity change from 0 to 4096 [ 222.758547][ T6966] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 223.475387][ T6968] IPv6: ADDRCONF(NETDEV_CHANGE): eql: link becomes ready [ 223.483967][ T6968] IPv6: ADDRCONF(NETDEV_CHANGE): wpan0: link becomes ready [ 223.491334][ T6968] IPv6: ADDRCONF(NETDEV_CHANGE): wpan1: link becomes ready [ 223.498640][ T6968] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 223.625326][ T6968] netlink: 64 bytes leftover after parsing attributes in process `syz.5.745'. [ 223.634806][ T6968] netlink: 64 bytes leftover after parsing attributes in process `syz.5.745'. [ 223.643762][ T6968] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Mapping Error Msg ret = -22) [ 223.882419][ T6966] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 223.934336][ T6966] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 223.967657][ T6966] ldm_validate_privheads(): Cannot find PRIVHEAD 2. [ 223.982398][ T6966] loop0: [ 224.115447][ T4233] usb 4-1: unable to get BOS descriptor or descriptor too short [ 224.204817][ T4233] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 224.212449][ T4233] usb 4-1: can't read configurations, error -71 [ 224.324728][ T4265] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 225.508394][ T7001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.757'. [ 225.525765][ T6991] kvm [6985]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 225.568996][ T6991] kvm [6985]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 225.599709][ T7007] loop0: detected capacity change from 0 to 4096 [ 225.610461][ T6991] kvm [6985]: vcpu0, guest rIP: 0x1b8 disabled perfctr wrmsr: 0xc1 data 0x0 [ 225.647245][ T4185] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 225.677797][ T4185] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 225.698426][ T4265] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 225.718922][ T4265] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 225.730864][ T4185] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 225.751818][ T4265] usb 6-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 225.769842][ T4185] ldm_validate_privheads(): Cannot find PRIVHEAD 2. [ 225.782325][ T4265] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.800608][ T4185] loop0: [ 225.822694][ T7007] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 225.845602][ T4265] spcp8x5 6-1:1.0: SPCP8x5 converter detected [ 225.869695][ T4265] usb 6-1: SPCP8x5 converter now attached to ttyUSB0 [ 225.883404][ T7007] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 225.933571][ T7007] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 225.961133][ T7007] ldm_validate_privheads(): Cannot find PRIVHEAD 2. [ 225.978042][ T7007] loop0: [ 226.246359][ T6972] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 226.284864][ T6972] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 226.324858][ T6972] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 226.490281][ T6971] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 227.611103][ T4233] usb 6-1: USB disconnect, device number 5 [ 228.260158][ T4233] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 228.355781][ T4233] spcp8x5 6-1:1.0: device disconnected [ 229.001382][ T7078] netlink: 'syz.4.779': attribute type 12 has an invalid length. [ 232.677451][ T7111] netlink: 3560 bytes leftover after parsing attributes in process `syz.3.788'. [ 232.738691][ T7115] netlink: 3568 bytes leftover after parsing attributes in process `syz.3.788'. [ 233.532931][ T7141] loop0: detected capacity change from 0 to 4096 [ 233.596523][ T7144] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 233.669496][ T7144] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 233.867277][ T7144] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 233.940745][ T7144] ldm_validate_privheads(): Cannot find PRIVHEAD 2. [ 233.993496][ T7144] loop0: [ 235.374024][ T7168] FAULT_INJECTION: forcing a failure. [ 235.374024][ T7168] name failslab, interval 1, probability 0, space 0, times 0 [ 235.509688][ T7175] netlink: 48 bytes leftover after parsing attributes in process `syz.0.799'. [ 235.556219][ T7168] CPU: 0 PID: 7168 Comm: syz.2.796 Not tainted syzkaller #0 [ 235.563521][ T7168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 235.573564][ T7168] Call Trace: [ 235.576838][ T7168] [ 235.579752][ T7168] dump_stack_lvl+0x188/0x250 [ 235.584423][ T7168] ? show_regs_print_info+0x20/0x20 [ 235.589661][ T7168] ? load_image+0x410/0x410 [ 235.594177][ T7168] ? __might_sleep+0xf0/0xf0 [ 235.598759][ T7168] ? __lock_acquire+0x7d40/0x7d40 [ 235.603779][ T7168] ? do_futex+0xdc2/0x12b0 [ 235.608201][ T7168] should_fail+0x383/0x4b0 [ 235.612622][ T7168] should_failslab+0x5/0x20 [ 235.617111][ T7168] slab_pre_alloc_hook+0x51/0xc0 [ 235.622036][ T7168] ? copy_fs_struct+0x4b/0x270 [ 235.626781][ T7168] kmem_cache_alloc+0x3d/0x280 [ 235.631527][ T7168] copy_fs_struct+0x4b/0x270 [ 235.636094][ T7168] ksys_unshare+0x397/0x8e0 [ 235.640586][ T7168] ? __lock_acquire+0x7d40/0x7d40 [ 235.645594][ T7168] ? sighand_ctor+0x40/0x40 [ 235.650077][ T7168] ? lock_chain_count+0x20/0x20 [ 235.654910][ T7168] ? syscall_enter_from_user_mode+0x21/0x70 [ 235.660791][ T7168] __x64_sys_unshare+0x34/0x40 [ 235.665533][ T7168] do_syscall_64+0x4c/0xa0 [ 235.669941][ T7168] ? clear_bhb_loop+0x30/0x80 [ 235.674597][ T7168] ? clear_bhb_loop+0x30/0x80 [ 235.679254][ T7168] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 235.685124][ T7168] RIP: 0033:0x7fa9757501d9 [ 235.689521][ T7168] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 235.709120][ T7168] RSP: 002b:00007fa9739a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 235.717526][ T7168] RAX: ffffffffffffffda RBX: 00007fa9759d7fa0 RCX: 00007fa9757501d9 [ 235.725485][ T7168] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000022020600 [ 235.733443][ T7168] RBP: 00007fa9757e7888 R08: 0000000000000000 R09: 0000000000000000 [ 235.741392][ T7168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.749351][ T7168] R13: 00007fa9759d8038 R14: 00007fa9759d7fa0 R15: 00007fff576e8858 [ 235.757315][ T7168] [ 236.867901][ T7199] dns_resolver: Unsupported content type (6) [ 237.128209][ T7211] netlink: 4 bytes leftover after parsing attributes in process `syz.3.808'. [ 238.054793][ T7219] netlink: 'syz.3.809': attribute type 3 has an invalid length. [ 238.479795][ T7223] gadgetfs: bound to dummy_udc driver [ 238.571240][ T7228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.813'. [ 239.568323][ T7243] loop0: detected capacity change from 0 to 3904 [ 239.838033][ T7244] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 239.882604][ T7244] ldm_validate_privheads(): Disk read failed. [ 239.918919][ T7244] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 239.956236][ T7244] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 239.988340][ T7244] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 2. [ 240.014447][ T7244] ldm_validate_tocblocks(): Disk read failed for TOCBLOCK 3. [ 240.039474][ T7244] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 240.063541][ T7244] loop0: [ 240.074804][ T7244] loop0: partition table partially beyond EOD, truncated [ 240.391622][ T7259] netlink: 4 bytes leftover after parsing attributes in process `syz.3.820'. [ 240.670619][ T7260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.821'. [ 240.704927][ T7262] FAULT_INJECTION: forcing a failure. [ 240.704927][ T7262] name failslab, interval 1, probability 0, space 0, times 0 [ 240.793913][ T7262] CPU: 0 PID: 7262 Comm: syz.4.822 Not tainted syzkaller #0 [ 240.801218][ T7262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 240.811260][ T7262] Call Trace: [ 240.814525][ T7262] [ 240.817441][ T7262] dump_stack_lvl+0x188/0x250 [ 240.822118][ T7262] ? show_regs_print_info+0x20/0x20 [ 240.827296][ T7262] ? load_image+0x410/0x410 [ 240.831779][ T7262] ? __might_sleep+0xf0/0xf0 [ 240.836348][ T7262] ? __lock_acquire+0x7d40/0x7d40 [ 240.841355][ T7262] should_fail+0x383/0x4b0 [ 240.845753][ T7262] should_failslab+0x5/0x20 [ 240.850237][ T7262] slab_pre_alloc_hook+0x51/0xc0 [ 240.855153][ T7262] kmem_cache_alloc_trace+0x47/0x290 [ 240.860413][ T7262] ? assoc_array_insert+0x3da/0x2e70 [ 240.865679][ T7262] assoc_array_insert+0x3da/0x2e70 [ 240.870768][ T7262] ? __key_link_lock+0x97/0xb0 [ 240.875519][ T7262] ? mutex_lock_io_nested+0x60/0x60 [ 240.880815][ T7262] ? clear_nonspinnable+0x60/0x60 [ 240.885830][ T7262] __key_link_begin+0xd2/0x1e0 [ 240.890583][ T7262] key_instantiate_and_link+0x21f/0x4b0 [ 240.896109][ T7262] ? key_payload_reserve+0x3b0/0x3b0 [ 240.901371][ T7262] ? do_raw_spin_unlock+0x11d/0x230 [ 240.906558][ T7262] ? clear_nonspinnable+0x60/0x60 [ 240.911566][ T7262] keyring_alloc+0x6b/0xa0 [ 240.915961][ T7262] keyctl_get_persistent+0x595/0x780 [ 240.921247][ T7262] ? proc_key_users_show+0x310/0x310 [ 240.926513][ T7262] ? verify_lock_unused+0x140/0x140 [ 240.931695][ T7262] ? do_futex+0xd83/0x12b0 [ 240.936094][ T7262] ? vfs_write+0xaa6/0xd70 [ 240.940492][ T7262] __se_sys_keyctl+0x61e/0xa20 [ 240.945235][ T7262] ? __x64_sys_keyctl+0xc0/0xc0 [ 240.950067][ T7262] ? __context_tracking_exit+0x4c/0x80 [ 240.955503][ T7262] ? __lock_acquire+0x7d40/0x7d40 [ 240.960509][ T7262] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 240.966471][ T7262] ? lock_chain_count+0x20/0x20 [ 240.971320][ T7262] ? lockdep_hardirqs_on+0x94/0x140 [ 240.976497][ T7262] ? __x64_sys_keyctl+0x1c/0xc0 [ 240.981328][ T7262] do_syscall_64+0x4c/0xa0 [ 240.985731][ T7262] ? clear_bhb_loop+0x30/0x80 [ 240.990392][ T7262] ? clear_bhb_loop+0x30/0x80 [ 240.995050][ T7262] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 241.000922][ T7262] RIP: 0033:0x7f48680a81d9 [ 241.005318][ T7262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.024918][ T7262] RSP: 002b:00007f4866300028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 241.033320][ T7262] RAX: ffffffffffffffda RBX: 00007f486832ffa0 RCX: 00007f48680a81d9 [ 241.041273][ T7262] RDX: 000000000d0421c6 RSI: 0000000000000000 RDI: 0000000000000016 [ 241.049221][ T7262] RBP: 00007f486813f888 R08: 0000000000000000 R09: 0000000000000000 [ 241.057168][ T7262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 241.065117][ T7262] R13: 00007f4868330038 R14: 00007f486832ffa0 R15: 00007ffdaf9bb698 [ 241.073075][ T7262] [ 241.468563][ T7268] syz.3.823 (7268): drop_caches: 2 [ 241.808172][ T7275] syz.0.827 (7275) used greatest stack depth: 19632 bytes left [ 241.817816][ T7283] loop0: detected capacity change from 0 to 4096 [ 241.870417][ T7283] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 241.910629][ T7283] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 241.947238][ T4233] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 241.955901][ T7283] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 241.979178][ T7283] ldm_validate_privheads(): Cannot find PRIVHEAD 2. [ 242.001364][ T7283] loop0: [ 243.164088][ T7287] sched: RT throttling activated [ 243.235575][ T4233] usb 6-1: Using ep0 maxpacket: 16 [ 243.388772][ T7294] netlink: 4 bytes leftover after parsing attributes in process `syz.2.834'. [ 243.416576][ T7294] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 243.429105][ T4233] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 243.468891][ T4233] usb 6-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.079077][ T7296] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 244.107716][ T4233] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 244.133004][ T4233] usb 6-1: config 0 interface 0 has no altsetting 0 [ 244.148043][ T4233] usb 6-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 244.178373][ T4233] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.203612][ T4233] usb 6-1: config 0 descriptor?? [ 244.336411][ T7294] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.442241][ T4233] hid-multitouch 0003:0EEF:72C4.0002: No inputs registered, leaving [ 245.532927][ T4233] hid-multitouch 0003:0EEF:72C4.0002: hiddev0,hidraw0: USB HID v0.00 Device [HID 0eef:72c4] on usb-dummy_hcd.5-1/input0 [ 245.616571][ T4233] usb 6-1: USB disconnect, device number 6 [ 245.780363][ T7325] fido_id[7325]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 246.104720][ T4233] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 247.223150][ T7336] netlink: 92 bytes leftover after parsing attributes in process `syz.4.850'. [ 247.371282][ T7346] netlink: 4 bytes leftover after parsing attributes in process `syz.3.852'. [ 247.447618][ T7352] netlink: 4 bytes leftover after parsing attributes in process `syz.4.854'. [ 247.564940][ T4233] usb 6-1: unable to get BOS descriptor or descriptor too short [ 247.663898][ T7364] [ 247.666234][ T7364] ====================================================== [ 247.673224][ T7364] WARNING: possible circular locking dependency detected [ 247.680224][ T7364] syzkaller #0 Not tainted [ 247.684607][ T7364] ------------------------------------------------------ [ 247.691594][ T7364] syz.2.859/7364 is trying to acquire lock: [ 247.697456][ T7364] ffff888062d21028 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}, at: __flush_work+0xfa/0x210 [ 247.708467][ T7364] [ 247.708467][ T7364] but task is already holding lock: [ 247.715800][ T7364] ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 247.725422][ T7364] [ 247.725422][ T7364] which lock already depends on the new lock. [ 247.725422][ T7364] [ 247.735802][ T7364] [ 247.735802][ T7364] the existing dependency chain (in reverse order) is: [ 247.744797][ T7364] [ 247.744797][ T7364] -> #4 (rfkill_global_mutex){+.+.}-{3:3}: [ 247.752778][ T7364] __mutex_lock_common+0x1e5/0x2400 [ 247.758481][ T7364] mutex_lock_nested+0x17/0x20 [ 247.763742][ T7364] rfkill_register+0x2f/0x970 [ 247.768913][ T7364] hci_register_dev+0x459/0x980 [ 247.774270][ T7364] vhci_create_device+0x32e/0x5c0 [ 247.779813][ T7364] vhci_write+0x389/0x440 [ 247.784641][ T7364] vfs_write+0x748/0xd70 [ 247.789385][ T7364] ksys_write+0x153/0x260 [ 247.794234][ T7364] do_syscall_64+0x4c/0xa0 [ 247.799152][ T7364] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 247.805611][ T7364] [ 247.805611][ T7364] -> #3 (&data->open_mutex){+.+.}-{3:3}: [ 247.813414][ T7364] __mutex_lock_common+0x1e5/0x2400 [ 247.819121][ T7364] mutex_lock_nested+0x17/0x20 [ 247.824386][ T7364] vhci_send_frame+0x88/0x100 [ 247.829563][ T7364] hci_send_frame+0x1a9/0x2e0 [ 247.834740][ T7364] hci_tx_work+0x9b5/0x16d0 [ 247.839741][ T7364] process_one_work+0x867/0xff0 [ 247.845089][ T7364] worker_thread+0xad7/0x12a0 [ 247.850264][ T7364] kthread+0x42e/0x520 [ 247.854845][ T7364] ret_from_fork+0x1f/0x30 [ 247.859775][ T7364] [ 247.859775][ T7364] -> #2 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}: [ 247.868958][ T7364] __flush_work+0x116/0x210 [ 247.873959][ T7364] hci_dev_do_open+0xc77/0x12a0 [ 247.879303][ T7364] hci_power_on+0x1a7/0x5f0 [ 247.884308][ T7364] process_one_work+0x867/0xff0 [ 247.889661][ T7364] worker_thread+0xad7/0x12a0 [ 247.894834][ T7364] kthread+0x42e/0x520 [ 247.899452][ T7364] ret_from_fork+0x1f/0x30 [ 247.904366][ T7364] [ 247.904366][ T7364] -> #1 (&hdev->req_lock){+.+.}-{3:3}: [ 247.911982][ T7364] __mutex_lock_common+0x1e5/0x2400 [ 247.917691][ T7364] mutex_lock_nested+0x17/0x20 [ 247.922952][ T7364] bg_scan_update+0x44/0x3b0 [ 247.928040][ T7364] process_one_work+0x867/0xff0 [ 247.933389][ T7364] worker_thread+0xad7/0x12a0 [ 247.938566][ T7364] kthread+0x42e/0x520 [ 247.943153][ T7364] ret_from_fork+0x1f/0x30 [ 247.948064][ T7364] [ 247.948064][ T7364] -> #0 ((work_completion)(&hdev->bg_scan_update)){+.+.}-{0:0}: [ 247.957849][ T7364] __lock_acquire+0x38f7/0x7d40 [ 247.963200][ T7364] lock_acquire+0x19f/0x400 [ 247.968215][ T7364] __flush_work+0x116/0x210 [ 247.973217][ T7364] __cancel_work_timer+0x3f4/0x560 [ 247.978847][ T7364] hci_request_cancel_all+0xcc/0x300 [ 247.984746][ T7364] hci_dev_do_close+0x4e/0x1020 [ 247.990106][ T7364] hci_rfkill_set_block+0x101/0x180 [ 247.995816][ T7364] rfkill_set_block+0x1c1/0x3c0 [ 248.001174][ T7364] rfkill_fop_write+0x453/0x560 [ 248.006529][ T7364] vfs_write+0x304/0xd70 [ 248.011270][ T7364] ksys_write+0x153/0x260 [ 248.016094][ T7364] do_syscall_64+0x4c/0xa0 [ 248.021007][ T7364] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 248.027405][ T7364] [ 248.027405][ T7364] other info that might help us debug this: [ 248.027405][ T7364] [ 248.037606][ T7364] Chain exists of: [ 248.037606][ T7364] (work_completion)(&hdev->bg_scan_update) --> &data->open_mutex --> rfkill_global_mutex [ 248.037606][ T7364] [ 248.053306][ T7364] Possible unsafe locking scenario: [ 248.053306][ T7364] [ 248.060739][ T7364] CPU0 CPU1 [ 248.066086][ T7364] ---- ---- [ 248.071437][ T7364] lock(rfkill_global_mutex); [ 248.076178][ T7364] lock(&data->open_mutex); [ 248.083258][ T7364] lock(rfkill_global_mutex); [ 248.090512][ T7364] lock((work_completion)(&hdev->bg_scan_update)); [ 248.097074][ T7364] [ 248.097074][ T7364] *** DEADLOCK *** [ 248.097074][ T7364] [ 248.105192][ T7364] 1 lock held by syz.2.859/7364: [ 248.110162][ T7364] #0: ffffffff8e4d7308 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_write+0x1ae/0x560 [ 248.120345][ T7364] [ 248.120345][ T7364] stack backtrace: [ 248.126220][ T7364] CPU: 0 PID: 7364 Comm: syz.2.859 Not tainted syzkaller #0 [ 248.133495][ T7364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 248.143545][ T7364] Call Trace: [ 248.147592][ T7364] [ 248.150507][ T7364] dump_stack_lvl+0x188/0x250 [ 248.155162][ T7364] ? load_image+0x410/0x410 [ 248.159638][ T7364] ? show_regs_print_info+0x20/0x20 [ 248.164812][ T7364] ? print_circular_bug+0x12b/0x1a0 [ 248.170003][ T7364] check_noncircular+0x2f8/0x400 [ 248.174916][ T7364] ? look_up_lock_class+0x71/0x110 [ 248.180011][ T7364] ? print_deadlock_bug+0x5d0/0x5d0 [ 248.185180][ T7364] ? lockdep_lock+0xf1/0x1f0 [ 248.189749][ T7364] ? __lock_acquire+0x12df/0x7d40 [ 248.194751][ T7364] ? mark_lock+0x94/0x320 [ 248.199054][ T7364] ? _find_first_zero_bit+0xd1/0xf0 [ 248.204232][ T7364] __lock_acquire+0x38f7/0x7d40 [ 248.209066][ T7364] ? verify_lock_unused+0x140/0x140 [ 248.214242][ T7364] ? verify_lock_unused+0x140/0x140 [ 248.219418][ T7364] lock_acquire+0x19f/0x400 [ 248.223899][ T7364] ? __flush_work+0xfa/0x210 [ 248.228478][ T7364] ? __lock_acquire+0x7d40/0x7d40 [ 248.233487][ T7364] ? read_lock_is_recursive+0x10/0x10 [ 248.238838][ T7364] ? start_flush_work+0x784/0x830 [ 248.243975][ T7364] ? finish_lock_switch+0x12d/0x290 [ 248.249169][ T7364] __flush_work+0x116/0x210 [ 248.253685][ T7364] ? __flush_work+0xfa/0x210 [ 248.258251][ T7364] ? flush_work+0x20/0x20 [ 248.262563][ T7364] ? try_to_grab_pending+0xfb/0x820 [ 248.267743][ T7364] ? mark_lock+0x94/0x320 [ 248.272054][ T7364] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 248.278015][ T7364] ? lock_chain_count+0x20/0x20 [ 248.282845][ T7364] ? mark_lock+0x94/0x320 [ 248.287150][ T7364] ? __cancel_work_timer+0x36a/0x560 [ 248.292416][ T7364] __cancel_work_timer+0x3f4/0x560 [ 248.297502][ T7364] ? cancel_work_sync+0x20/0x20 [ 248.302328][ T7364] ? __cancel_work+0x1f9/0x2e0 [ 248.307066][ T7364] ? lockdep_hardirqs_on+0x94/0x140 [ 248.312240][ T7364] ? __cancel_work+0x27b/0x2e0 [ 248.316979][ T7364] ? cancel_work+0x20/0x20 [ 248.321368][ T7364] hci_request_cancel_all+0xcc/0x300 [ 248.326631][ T7364] hci_dev_do_close+0x4e/0x1020 [ 248.331457][ T7364] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 248.337410][ T7364] ? _raw_spin_unlock+0x40/0x40 [ 248.342236][ T7364] hci_rfkill_set_block+0x101/0x180 [ 248.347410][ T7364] ? rcu_lock_release+0x20/0x20 [ 248.352254][ T7364] rfkill_set_block+0x1c1/0x3c0 [ 248.357085][ T7364] rfkill_fop_write+0x453/0x560 [ 248.361940][ T7364] ? rfkill_fop_read+0x560/0x560 [ 248.366849][ T7364] ? common_file_perm+0x160/0x1c0 [ 248.371876][ T7364] ? fsnotify_perm+0x5d/0x560 [ 248.376527][ T7364] ? security_file_permission+0x75/0xa0 [ 248.382065][ T7364] ? rfkill_fop_read+0x560/0x560 [ 248.386986][ T7364] vfs_write+0x304/0xd70 [ 248.391211][ T7364] ? file_end_write+0x250/0x250 [ 248.396057][ T7364] ? __fget_files+0x402/0x470 [ 248.400725][ T7364] ? __fdget_pos+0x1e2/0x370 [ 248.405290][ T7364] ? ksys_write+0x70/0x260 [ 248.409679][ T7364] ksys_write+0x153/0x260 [ 248.413991][ T7364] ? __ia32_sys_read+0x80/0x80 [ 248.418727][ T7364] ? lockdep_hardirqs_on+0x94/0x140 [ 248.423906][ T7364] do_syscall_64+0x4c/0xa0 [ 248.428316][ T7364] ? clear_bhb_loop+0x30/0x80 [ 248.432969][ T7364] ? clear_bhb_loop+0x30/0x80 [ 248.437623][ T7364] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 248.443504][ T7364] RIP: 0033:0x7fa9757501d9 [ 248.447921][ T7364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.467502][ T7364] RSP: 002b:00007fa9739a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 248.475896][ T7364] RAX: ffffffffffffffda RBX: 00007fa9759d7fa0 RCX: 00007fa9757501d9 [ 248.483846][ T7364] RDX: 0000000000000008 RSI: 0000200000000900 RDI: 0000000000000004 [ 248.491799][ T7364] RBP: 00007fa9757e7888 R08: 0000000000000000 R09: 0000000000000000 [ 248.499758][ T7364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 248.507705][ T7364] R13: 00007fa9759d8038 R14: 00007fa9759d7fa0 R15: 00007fff576e8858 [ 248.515656][ T7364] [ 248.526597][ T4233] usb 6-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 248.704842][ T4233] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=86.b8 [ 248.714072][ T4233] usb 6-1: New USB device strings: Mfr=164, Product=146, SerialNumber=3 [ 248.723407][ T4233] usb 6-1: Product: syz [ 248.730868][ T4233] usb 6-1: Manufacturer: syz [ 248.740686][ T4233] usb 6-1: SerialNumber: syz [ 248.764955][ T4233] usb 6-1: can't set config #255, error -71 [ 248.774641][ T4233] usb 6-1: USB disconnect, device number 7 [ 255.476630][ T1418] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.482903][ T1418] ieee802154 phy1 wpan1: encryption failed: -22