last executing test programs: 9m11.685238745s ago: executing program 2 (id=284): setns(0xc9, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x9}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) 9m11.4709655s ago: executing program 2 (id=287): r0 = gettid() sigaltstack(&(0x7f0000000180)={&(0x7f0000002500)=""/4141, 0x1, 0x102d}, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) rt_sigqueueinfo(r0, 0x21, &(0x7f0000000100)={0x1f}) 9m11.289861593s ago: executing program 2 (id=289): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x2}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x2, {{0x43, 0x1}, 0x2}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10) 9m10.918037578s ago: executing program 2 (id=292): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) umount2(&(0x7f0000000040)='./file0/../file0\x00', 0xc) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) 9m10.593592138s ago: executing program 2 (id=296): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c00028005000100000000001800028014000180080001"], 0x50}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a1b000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 9m9.011467691s ago: executing program 2 (id=314): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x6, 0xfd, 0xee, 0x16}]}) write$ppp(r0, &(0x7f0000000240)="0f29", 0x2) 9m8.669423715s ago: executing program 32 (id=314): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x6, 0xfd, 0xee, 0x16}]}) write$ppp(r0, &(0x7f0000000240)="0f29", 0x2) 7m28.868276727s ago: executing program 3 (id=1318): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000e40)={0x30, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}]}, 0x30}}, 0x0) 7m28.511200606s ago: executing program 3 (id=1321): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x1a8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 7m28.119411353s ago: executing program 3 (id=1324): r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) read(r0, &(0x7f0000000240)=""/123, 0x7b) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x100000001, 0x2, 0x3, 0x0, 0x3}) 7m27.694557097s ago: executing program 3 (id=1327): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x200) 7m27.574850729s ago: executing program 3 (id=1330): syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x28}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}]) io_cancel(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0xf, 0xffffffffffffffff, 0x0, 0x0, 0x547459c7, 0x0, 0x1}, 0x0) 7m26.083875787s ago: executing program 3 (id=1345): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x6, &(0x7f0000000140)=0x9, 0x4) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet6_tcp_int(r0, 0x6, 0x6, 0x0, &(0x7f0000000280)) 7m25.750149119s ago: executing program 33 (id=1345): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x6, &(0x7f0000000140)=0x9, 0x4) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet6_tcp_int(r0, 0x6, 0x6, 0x0, &(0x7f0000000280)) 2m19.949620211s ago: executing program 4 (id=4407): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x60442, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) read$rfkill(r0, &(0x7f0000000040), 0x8) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x8, 0x88f80) read(r1, 0x0, 0x0) 2m19.804832664s ago: executing program 4 (id=4408): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@private2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x24}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000a40)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in=@loopback, @in6=@loopback, 0xfffe, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in=@broadcast, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0x0, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) 2m19.622267168s ago: executing program 4 (id=4412): mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x8, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) syz_clone(0x120e1100, 0x0, 0x13, 0x0, 0x0, 0x0) 2m19.430200339s ago: executing program 4 (id=4417): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x200) 2m19.312719654s ago: executing program 4 (id=4419): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000680)={0x20}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 2m17.859782358s ago: executing program 4 (id=4430): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "1a88ef816c4b42ed", "a5fdeb69a751e94df50ad7e9fb434d1665e9298b01e49419567b44380100", '\x00\t\x00', "0000000022000400"}, 0x38) sendto(r0, &(0x7f0000000240)="c9ae4cd136a712f8b9f70a1f9d67ae0c2363490b98eba3436e56f64b428d4f5d84fd01d695d3b2677475028dafe03b0e5966ec32b7da58e28c60484d24537e7a", 0x40, 0x80, 0x0, 0x0) 2m17.572602364s ago: executing program 34 (id=4430): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "1a88ef816c4b42ed", "a5fdeb69a751e94df50ad7e9fb434d1665e9298b01e49419567b44380100", '\x00\t\x00', "0000000022000400"}, 0x38) sendto(r0, &(0x7f0000000240)="c9ae4cd136a712f8b9f70a1f9d67ae0c2363490b98eba3436e56f64b428d4f5d84fd01d695d3b2677475028dafe03b0e5966ec32b7da58e28c60484d24537e7a", 0x40, 0x80, 0x0, 0x0) 6.049071079s ago: executing program 1 (id=5475): r0 = inotify_init() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xffffffff, 0x1e5}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r1, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, {0x3}}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x3, 0x0, 0x0, 0x10}}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.880857945s ago: executing program 1 (id=5470): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040)=0x10001, 0x4) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 5.620655856s ago: executing program 0 (id=5471): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000200)=@IORING_OP_BIND=@ipv4={0x38, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x2, 0x300, 0xfffffffe, 0x257, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 5.39592872s ago: executing program 1 (id=5472): capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a98000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 5.254522878s ago: executing program 1 (id=5473): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x1, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}}}, 0x32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cde701004002000050000000600010005000000080009000200000008000b000000000008000c"], 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 5.174420322s ago: executing program 0 (id=5476): r0 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x82) r2 = openat$cgroup_procs(r1, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) pread64(r2, &(0x7f0000000240)=""/91, 0x5b, 0x7) pread64(r2, &(0x7f00000002c0)=""/245, 0xf5, 0x80387) 5.036756057s ago: executing program 1 (id=5477): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) syz_pidfd_open(0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001000700000005000400030000000900020073797a310000000011000300686173683a6e65742c6e6574"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="50000000090601020000000000000000030000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0c00148008000140ac1414bb0c0002800800014064"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) 4.833834163s ago: executing program 0 (id=5478): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000500)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./file0/ref_tracker\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/1000, 0x3e8) r1 = openat(r0, &(0x7f0000000143), 0x0, 0x0) read(r1, &(0x7f0000000580)=""/65, 0x41) 4.83267642s ago: executing program 6 (id=5486): r0 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x82) r2 = openat$cgroup_procs(r1, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) pread64(r2, &(0x7f0000000240)=""/91, 0x5b, 0x7) pread64(r2, &(0x7f00000002c0)=""/245, 0xf5, 0x80387) 4.340937847s ago: executing program 0 (id=5488): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}, 0x8001}], 0x1, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x10, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) 4.340222622s ago: executing program 6 (id=5480): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) 4.16993769s ago: executing program 5 (id=5481): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040)=0x10001, 0x4) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 3.889616302s ago: executing program 5 (id=5482): r0 = inotify_init() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xffffffff, 0x1e5}, &(0x7f00000001c0)=0x0, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r1, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, {0x3}}) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x3, 0x0, 0x0, 0x10}}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.888707586s ago: executing program 6 (id=5492): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000300)={0x2, 0x4e20, @loopback}, 0x10) close(r0) 3.743811753s ago: executing program 5 (id=5483): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000040)='.\x00', 0x10000a3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x91000a7a) fcntl$notify(r1, 0x402, 0x8000000f) 3.346247984s ago: executing program 0 (id=5484): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$inet_sctp(0x2, 0x0, 0x84) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000080)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x6, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x8, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local, {[@cipso={0x86, 0x9, 0x3, [{0x1, 0x3, "ff"}]}]}}, {{0x4e21, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0x1, 0x4, 0x0, 0x1c, {[@timestamp={0x5, 0xa}]}}}}}}, 0x4e) 3.346054273s ago: executing program 5 (id=5485): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000200)=@IORING_OP_BIND=@ipv4={0x38, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x2, 0x300, 0xfffffffe, 0x257, 0x0, r2}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 3.344794435s ago: executing program 6 (id=5496): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r1, &(0x7f00000005c0)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x8, r3, 0x14}, 0x80, &(0x7f0000004c40)=[{&(0x7f0000000300)='C', 0x1}], 0x1}}], 0x1, 0x20000081) 2.96943348s ago: executing program 5 (id=5487): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x14, 0x2, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0xa}}, 0x14}}, 0x800) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={0x0, 0x1, 0x6, @local}, 0x10) setsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000080)="5ec78db485c534bdf7a2172f3f1f30da", 0x10) 2.909310288s ago: executing program 6 (id=5489): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) timer_create(0x0, &(0x7f0000000180)={0x0, 0x11, 0x2}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000364000/0x1000)=nil, 0x400000, 0x2, 0x2}) 3.579876ms ago: executing program 1 (id=5490): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000500)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./file0/ref_tracker\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000100)=""/1000, 0x3e8) r1 = openat(r0, &(0x7f0000000143), 0x0, 0x0) read(r1, &(0x7f0000000580)=""/65, 0x41) 3.436555ms ago: executing program 6 (id=5491): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000600), 0xfec8) recvmmsg(r1, &(0x7f0000002540)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000300)=""/225, 0xfec8}], 0x1, 0x0, 0x0, 0x2000000}}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f00000027c0)=""/4096, 0x1000}], 0x1}, 0x1}], 0x2, 0xcb, 0x0) 3.383685ms ago: executing program 5 (id=5493): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x5) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x4) lseek(r2, 0x0, 0x1) 0s ago: executing program 0 (id=5494): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) r2 = syz_clone(0x95008100, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) wait4(r2, 0x0, 0x80000000, 0x0) kernel console output (not intermixed with test programs): pecified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 246.987739][ T8723] CIFS: Attempting to mount //127.0.0.1/share [ 247.401375][ T8723] CIFS: VFS: Error connecting to socket. Aborting operation. [ 247.401716][ T8723] CIFS: VFS: cifs_mount failed w/return code = -111 [ 248.376583][ T8770] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1236'. [ 248.634538][ T8779] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1242'. [ 248.790797][ T8785] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.1243'. [ 248.794333][ T8782] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.1243'. [ 248.795873][ T8782] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.1243'. [ 249.140544][ T8793] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1248'. [ 250.006686][ T8829] netlink: 'syz.3.1265': attribute type 29 has an invalid length. [ 250.007979][ T8829] netlink: 'syz.3.1265': attribute type 29 has an invalid length. [ 250.032600][ T8829] netlink: 'syz.3.1265': attribute type 29 has an invalid length. [ 252.121851][ T8886] HELLO WORLD FROM SYZ [ 252.697041][ T8906] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1298'. [ 252.841592][ T8909] netlink: 4608 bytes leftover after parsing attributes in process `syz.4.1300'. [ 252.841614][ T8909] netlink: 4608 bytes leftover after parsing attributes in process `syz.4.1300'. [ 253.593119][ T8929] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1308'. [ 253.635400][ T5690] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 253.761692][ T825] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 253.828563][ T5690] usb 2-1: Using ep0 maxpacket: 32 [ 253.837954][ T5690] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 253.837992][ T5690] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.964615][ T825] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 253.985853][ T5690] usb 2-1: config 0 descriptor?? [ 254.264456][ T5690] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 254.297338][ T8937] fido_id[8937]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 255.080676][ T5690] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 255.096195][ T5690] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 255.096556][ T5690] usb 2-1: media controller created [ 255.501041][ T5690] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 255.742493][ T5690] az6027: usb out operation failed. (-71) [ 255.746199][ T5690] az6027: usb out operation failed. (-71) [ 255.746221][ T5690] stb0899_attach: Driver disabled by Kconfig [ 255.746231][ T5690] az6027: no front-end attached [ 255.746231][ T5690] [ 255.746672][ T5690] az6027: usb out operation failed. (-71) [ 255.746687][ T5690] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 255.796973][ T5690] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input14 [ 255.820183][ T5690] dvb-usb: schedule remote query interval to 400 msecs. [ 255.820210][ T5690] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 255.830981][ T5690] usb 2-1: USB disconnect, device number 11 [ 256.103107][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.103221][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.267444][ T5598] do_umount: task=syz-executor[5598] propagate_mount_busy()!=0 [ 256.267688][ T5598] do_umount: task=syz-executor[5598] propagate_mount_busy()!=0 [ 256.551096][ T5690] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 257.378817][ T8993] netlink: 758 bytes leftover after parsing attributes in process `syz.0.1338'. [ 258.594225][ T5609] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 258.633900][ T5609] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 258.638217][ T5609] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 258.656764][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 258.725037][ T5609] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 258.949824][ T1509] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.881354][ T9024] ftl_cs: FTL header not found. [ 260.246294][ T1509] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 260.784707][ T9024] block2mtd: mtd1: [/dev/loop0] erase_size = 4KiB [4096] [ 260.830575][ T60] Bluetooth: hci3: command tx timeout [ 261.133572][ T1509] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 261.786665][ T1509] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 261.841561][ T1509] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 262.910460][ T60] Bluetooth: hci3: command tx timeout [ 264.564345][ T1509] bridge_slave_1: left allmulticast mode [ 264.564411][ T1509] bridge_slave_1: left promiscuous mode [ 264.603380][ T1509] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.783262][ T1509] bridge_slave_0: left allmulticast mode [ 264.783307][ T1509] bridge_slave_0: left promiscuous mode [ 264.851044][ T1509] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.978507][ T60] Bluetooth: hci3: command tx timeout [ 264.981255][ T9188] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 265.105773][ T38] audit: type=1326 audit(1786551716.186:42): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9189 comm="syz.0.1411" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 266.002226][ T9192] ceph: No mds server is up or the cluster is laggy [ 266.761654][ T1509] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 266.798530][ T1509] bond_slave_0: left promiscuous mode [ 266.872639][ T1509] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 266.929751][ T1509] bond_slave_1: left promiscuous mode [ 266.945917][ T1509] bond0 (unregistering): Released all slaves [ 266.989293][ T9015] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.989986][ T9015] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.990263][ T9015] bridge_slave_0: entered allmulticast mode [ 266.993842][ T9015] bridge_slave_0: entered promiscuous mode [ 267.053427][ T5255] 8021q: adding VLAN 0 to HW filter on device eth5 [ 267.058449][ T60] Bluetooth: hci3: command tx timeout [ 267.075232][ T9015] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.153092][ T9015] bridge0: port 2(bridge_slave_1) entered disabled state [ 267.153335][ T9015] bridge_slave_1: entered allmulticast mode [ 267.205701][ T9015] bridge_slave_1: entered promiscuous mode [ 267.224667][ T1509] tipc: Left network mode [ 267.483083][ T9015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 267.536585][ T9015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 267.670896][ T9220] mmap: syz.0.1423 (9220) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 267.986371][ T9015] team0: Port device team_slave_0 added [ 268.015656][ T9015] team0: Port device team_slave_1 added [ 268.346790][ T9015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.346807][ T9015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.346829][ T9015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.413647][ T9015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.413666][ T9015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.413697][ T9015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 268.943656][ T9015] hsr_slave_0: entered promiscuous mode [ 268.946348][ T9015] hsr_slave_1: entered promiscuous mode [ 268.960301][ T9015] debugfs: 'hsr0' already exists in 'hsr' [ 268.960334][ T9015] Cannot create hsr debugfs directory [ 270.121579][ T5255] 8021q: adding VLAN 0 to HW filter on device eth6 [ 270.175050][ T9262] vxcan0: tx address claim with different name [ 270.257956][ T9264] fuse: Bad value for 'fd' [ 270.734846][ T38] audit: type=1326 audit(1786551721.816:43): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=9280 comm="syz.4.1445" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff6aa27e0d9 code=0x0 [ 272.321792][ T1509] hsr_slave_0: left promiscuous mode [ 272.395315][ T1509] hsr_slave_1: left promiscuous mode [ 272.396674][ T1509] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 272.396695][ T1509] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 272.544705][ T1509] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 272.544731][ T1509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 273.076734][ T1509] veth1_macvtap: left promiscuous mode [ 273.076858][ T1509] veth0_macvtap: left promiscuous mode [ 273.091538][ T1509] veth1_vlan: left promiscuous mode [ 273.091649][ T1509] veth0_vlan: left promiscuous mode [ 275.108966][ T1509] team0 (unregistering): Port device team_slave_1 removed [ 275.169805][ T1509] team0 (unregistering): Port device team_slave_0 removed [ 275.537665][ T5255] 8021q: adding VLAN 0 to HW filter on device eth7 [ 277.316490][ T9378] netlink: 428 bytes leftover after parsing attributes in process `syz.0.1475'. [ 277.461257][ T9378] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1475'. [ 277.952549][ T9015] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 278.121022][ T9393] netlink: 656 bytes leftover after parsing attributes in process `syz.0.1481'. [ 278.121050][ T9393] netlink: 656 bytes leftover after parsing attributes in process `syz.0.1481'. [ 278.235171][ T9015] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 278.236561][ T9015] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 278.322254][ T9015] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 278.389572][ T5255] 8021q: adding VLAN 0 to HW filter on device eth8 [ 278.561351][ T9015] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 278.627101][ T9015] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 278.641726][ T9015] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 278.680934][ T9015] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 279.569418][ T9015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.414896][ T9015] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.501491][ T1511] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.501666][ T1511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.586978][ T9449] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1500'. [ 280.637290][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.637407][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 280.883432][ T9454] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1501'. [ 281.278468][ T9465] netlink: 'syz.4.1506': attribute type 4 has an invalid length. [ 282.374905][ T60] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 282.521838][ T9496] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 282.522170][ T9496] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 282.522298][ T9496] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 282.637212][ T9015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.889434][ T9496] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 283.501176][ T9015] veth0_vlan: entered promiscuous mode [ 283.557225][ T9015] veth1_vlan: entered promiscuous mode [ 283.681753][ T9015] veth0_macvtap: entered promiscuous mode [ 283.702341][ T9015] veth1_macvtap: entered promiscuous mode [ 283.801558][ T9015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 283.827509][ T9015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 283.952234][ T1027] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.953477][ T1027] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.979982][ T1027] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.982119][ T1027] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 284.021441][ T9534] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1527'. [ 284.021472][ T9534] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1527'. [ 284.578958][ T60] Bluetooth: hci3: command 0x0c1a tx timeout [ 284.579124][ T60] Bluetooth: hci2: command 0x0406 tx timeout [ 285.308203][ T163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.308225][ T163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 285.819390][ T163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 285.819413][ T163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 286.035863][ T9566] tipc: Cannot configure node identity twice [ 286.305208][ T9577] bridge0: port 3(syz_tun) entered blocking state [ 286.420683][ T9577] bridge0: port 3(syz_tun) entered disabled state [ 286.423877][ T9577] syz_tun: entered allmulticast mode [ 286.461859][ T9577] syz_tun: entered promiscuous mode [ 286.490823][ T9577] bridge0: port 3(syz_tun) entered blocking state [ 286.497488][ T9577] bridge0: port 3(syz_tun) entered forwarding state [ 286.658276][ T5609] Bluetooth: hci3: command 0x0c1a tx timeout [ 287.354033][ T9601] input: syz1 as /devices/virtual/input/input15 [ 287.354078][ T9601] input: failed to attach handler leds to device input15, error: -6 [ 287.640958][ T9606] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 288.077029][ T9614] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1558'. [ 288.077061][ T9614] netlink: 35 bytes leftover after parsing attributes in process `syz.0.1558'. [ 288.077080][ T9614] netlink: 'syz.0.1558': attribute type 6 has an invalid length. [ 288.077095][ T9614] netlink: 'syz.0.1558': attribute type 4 has an invalid length. [ 288.763217][ T5609] Bluetooth: hci3: command 0x0c1a tx timeout [ 290.925858][ T9695] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 290.925858][ T9695] The task syz.1.1587 (9695) triggered the difference, watch for misbehavior. [ 291.314736][ T9707] tipc: Started in network mode [ 291.314763][ T9707] tipc: Node identity e0, cluster identity 4711 [ 291.314778][ T9707] tipc: Node number set to 224 [ 292.713253][ T9741] Flush: task=syz.1.1604[9741] dev=loop5 state=2 [ 292.823944][ T9741] Teardown: task=syz.1.1604[9741] dev=loop5 state=2 [ 293.127740][ T9770] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1613'. [ 293.878822][ T9791] CIFS: Attempting to mount //::1/share [ 294.824162][ T9791] CIFS: VFS: Error connecting to socket. Aborting operation. [ 294.824228][ T9791] CIFS: VFS: cifs_mount failed w/return code = -4 [ 295.755593][ T9853] ima: policy update failed [ 295.755837][ T38] audit: type=1802 audit(1786551746.836:44): pid=9853 uid=0 auid=4294967295 ses=4294967295 op=policy_update cause=failed comm="syz.1.1639" res=0 errno=0 [ 296.576393][ T9880] netlink: 'syz.5.1647': attribute type 201 has an invalid length. [ 296.576419][ T9880] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1647'. [ 297.622450][ T9909] process '/newroot/557/file0' started with executable stack [ 298.310855][ T9938] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 298.311477][ T9938] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 299.355836][ T9981] netlink: 'syz.1.1691': attribute type 1 has an invalid length. [ 299.355861][ T9981] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.1691'. [ 299.518269][ T5605] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 299.546131][ T9989] netlink: 'syz.0.1693': attribute type 201 has an invalid length. [ 299.546158][ T9989] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1693'. [ 299.680607][ T5605] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 299.680643][ T5605] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.680670][ T5605] usb 6-1: Product: syz [ 299.680681][ T5605] usb 6-1: Manufacturer: syz [ 299.680691][ T5605] usb 6-1: SerialNumber: syz [ 299.744413][ T5605] usb 6-1: config 0 descriptor?? [ 299.961845][ T5605] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 300.338252][ T5609] Bluetooth: hci3: command 0x0c1a tx timeout [ 300.338301][ T5609] Bluetooth: hci2: command 0x0406 tx timeout [ 300.797900][ T5605] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 300.886840][ T5605] usb 6-1: USB disconnect, device number 2 [ 301.445105][T10022] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. [ 302.494350][T10059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1724'. [ 302.494383][T10059] block nbd0: Unsupported socket: should be TCP or UNIX. [ 302.804644][T10072] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1732'. [ 302.820544][T10072] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1732'. [ 302.823551][T10072] netlink: 500 bytes leftover after parsing attributes in process `syz.0.1732'. [ 303.984742][T10112] netlink: 'syz.5.1748': attribute type 2 has an invalid length. [ 304.099636][T10118] syzkaller1: entered promiscuous mode [ 304.099661][T10118] syzkaller1: entered allmulticast mode [ 304.805239][T10131] serio: Serial port ptm0 [ 305.256743][T10149] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 305.502113][T10157] ublk_ctrl_add_dev: dev id not match 4294967295 2 [ 305.668525][ T32] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 305.671330][T10159] syzkaller1: entered promiscuous mode [ 305.671359][T10159] syzkaller1: entered allmulticast mode [ 305.839659][ T32] usb 6-1: unable to get BOS descriptor or descriptor too short [ 305.841469][ T32] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 305.844735][ T32] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 305.844764][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.844784][ T32] usb 6-1: Product: syz [ 305.844806][ T32] usb 6-1: Manufacturer: syz [ 305.844822][ T32] usb 6-1: SerialNumber: syz [ 306.131563][ T32] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 306.951117][ T32] usb 6-1: failed to enable PITCH for EP 0x82 [ 306.951783][ T32] usb 6-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 306.951810][ T32] usb 6-1: clock source 0 is not valid, cannot use [ 306.954740][ T32] usb 6-1: 2:1: cannot get freq (v2/v3): err -71 [ 306.955598][ T32] usb 6-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 307.155957][T10191] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 307.287342][T10194] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1783'. [ 307.843746][ T32] usb 6-1: USB disconnect, device number 3 [ 308.650024][ T60] Bluetooth: hci3: unexpected event for opcode 0x0c5b [ 309.090997][T10228] udevd[10228]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 309.343742][T10237] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1799'. [ 309.343775][T10237] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1799'. [ 309.375541][T10237] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1799'. [ 309.375573][T10237] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1799'. [ 310.980690][T10280] 9p: Unknown uid 00000000004294967295 [ 311.904180][T10312] fuse: fd is not a fuse device [ 313.613240][T10380] syzkaller1: entered promiscuous mode [ 313.613262][T10380] syzkaller1: entered allmulticast mode [ 315.162899][T10427] veth1_to_bond: entered allmulticast mode [ 315.163405][T10427] veth1_to_bond: left allmulticast mode [ 315.943278][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 315.970325][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 315.970513][T10438] ceph: No mds server is up or the cluster is laggy [ 315.974057][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 315.974318][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 316.231877][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 316.232108][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 317.546930][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.547034][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.855606][T10480] bridge0: entered promiscuous mode [ 317.896213][T10479] bridge0: left promiscuous mode [ 318.188795][T10492] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1912'. [ 318.415013][T10499] netlink: 'syz.5.1915': attribute type 11 has an invalid length. [ 318.415037][T10499] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1915'. [ 320.326717][T10544] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1935'. [ 320.858649][T10563] loop5: detected capacity change from 0 to 6 [ 321.006157][T10563] Dev loop5: unable to read RDB block 6 [ 321.006208][T10563] loop5: unable to read partition table [ 321.006442][T10563] loop5: partition table beyond EOD, truncated [ 321.006487][T10563] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 321.056874][ T9350] Flush: task=udevd[9350] dev=loop5 state=2 [ 321.188623][ T9350] Teardown: task=udevd[9350] dev=loop5 state=2 [ 321.544555][T10585] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1951'. [ 322.648976][ T5703] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 322.818367][ T5703] usb 2-1: Using ep0 maxpacket: 32 [ 322.826601][ T5703] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 322.826651][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.826674][ T5703] usb 2-1: Product: syz [ 322.826690][ T5703] usb 2-1: Manufacturer: syz [ 322.826705][ T5703] usb 2-1: SerialNumber: syz [ 322.894914][ T5703] usb 2-1: config 0 descriptor?? [ 322.924076][ T5703] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 322.924154][ T5703] dvb-usb: bulk message failed: -22 (4/0) [ 322.924167][ T5703] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 322.924256][ T5703] dvb-usb: bulk message failed: -22 (5/0) [ 322.924266][ T5703] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 323.080821][ T5703] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 323.091477][ T5703] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 323.091651][ T5703] usb 2-1: media controller created [ 323.254805][T10618] dvb-usb: bulk message failed: -22 (7/0) [ 323.254825][T10618] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 323.254877][T10618] ttusb2: i2c transfer failed. [ 323.293498][ T5703] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 323.637808][T10645] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1975'. [ 323.748956][ T5703] usb 2-1: selecting invalid altsetting 3 [ 323.748979][ T5703] ttusb2: set interface to alts=3 failed [ 323.843709][T10642] syzkaller1: entered promiscuous mode [ 323.843736][T10642] syzkaller1: entered allmulticast mode [ 323.874394][ T5703] DVB: Unable to find symbol tda10086_attach() [ 323.874407][ T5703] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 323.875132][ T5703] dvb-usb: bulk message failed: -22 (4/0) [ 323.875147][ T5703] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 323.875234][ T5703] dvb-usb: bulk message failed: -22 (5/0) [ 323.875244][ T5703] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 323.875303][ T5703] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 324.000844][ T5703] usb 2-1: USB disconnect, device number 12 [ 324.161435][ T5703] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 324.971407][T10676] netlink: 'syz.0.1987': attribute type 26 has an invalid length. [ 325.788938][T10703] netlink: 'syz.1.1997': attribute type 4 has an invalid length. [ 328.627619][T10782] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2032'. [ 328.627868][T10782] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2032'. [ 329.500964][T10745] kexec: Could not allocate control_code_buffer [ 329.848316][ T5703] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 329.998253][ T5703] usb 6-1: Using ep0 maxpacket: 8 [ 330.000982][ T5703] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 330.001053][ T5703] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 330.001080][ T5703] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 330.001108][ T5703] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 330.001136][ T5703] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 330.001248][ T5703] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 330.001274][ T5703] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.279842][ T5703] usb 6-1: usb_control_msg returned -32 [ 330.279897][ T5703] usbtmc 6-1:16.0: can't read capabilities [ 330.417455][T10816] netlink: 'syz.0.2045': attribute type 1 has an invalid length. [ 330.417480][T10816] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2045'. [ 330.544033][T10820] 9pnet: p9_errstr2errno: server reported unknown error  [ 330.659815][T10824] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 330.666728][ T5703] usb 6-1: USB disconnect, device number 4 [ 331.333639][ T38] audit: type=1800 audit(1786551782.366:45): pid=10830 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.4.2051" name="file1" dev="tmpfs" ino=1710 res=0 errno=0 [ 331.664756][ T5581] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 331.822942][ T5581] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 331.842032][ T5581] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 331.842074][ T5581] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.842096][ T5581] usb 6-1: Product: syz [ 331.842111][ T5581] usb 6-1: Manufacturer: syz [ 331.842126][ T5581] usb 6-1: SerialNumber: syz [ 332.982438][ T5581] cdc_ncm 6-1:1.0: bind() failure [ 332.996642][ T5581] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 332.996691][ T5581] cdc_ncm 6-1:1.1: bind() failure [ 333.032546][ T5581] usb 6-1: USB disconnect, device number 5 [ 333.733959][ C1] vcan0: j1939_tp_rxtimer: 0xffff888035566800: rx timeout, send abort [ 333.751305][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888035566800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 334.087181][T10907] input: syz1 as /devices/virtual/input/input16 [ 334.628507][T10921] netlink: 172 bytes leftover after parsing attributes in process `syz.4.2089'. [ 334.628539][T10921] netlink: 172 bytes leftover after parsing attributes in process `syz.4.2089'. [ 335.481251][ T60] Bluetooth: hci3: unexpected event for opcode 0x2007 [ 335.893441][T10968] batadv_slave_1: entered promiscuous mode [ 335.895195][T10967] batadv_slave_1: left promiscuous mode [ 336.202214][T10972] overlayfs: failed to clone lowerpath [ 336.457859][ T5581] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 336.499138][ T5581] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 336.790205][T10987] netlink: 'syz.0.2121': attribute type 4 has an invalid length. [ 336.790233][T10987] netlink: 'syz.0.2121': attribute type 5 has an invalid length. [ 336.790251][T10987] netlink: 'syz.0.2121': attribute type 27 has an invalid length. [ 337.371899][ T60] Bluetooth: hci3: unexpected event for opcode 0x100c [ 337.567772][T11009] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2125'. [ 338.818304][ T5605] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 339.028355][ T5605] usb 6-1: Using ep0 maxpacket: 16 [ 339.036190][ T5605] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.036256][ T5605] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 339.036283][ T5605] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.113102][ T5605] usb 6-1: config 0 descriptor?? [ 339.215524][T11056] dummy0: entered allmulticast mode [ 339.333538][T11055] dummy0: left allmulticast mode [ 339.336231][T11058] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2145'. [ 339.368951][ T60] Bluetooth: hci3: adv larger than maximum supported [ 339.368982][ T60] Bluetooth: hci3: Malformed LE Event: 0x0d [ 339.376671][ T5703] usb 6-1: USB disconnect, device number 6 [ 339.676283][T11065] sd 0:0:1:0: PR command failed: 1026 [ 339.676332][T11065] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 339.676377][T11065] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 340.340500][T11080] kvm: apic: phys broadcast and lowest prio [ 340.662878][T11095] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 340.663485][T11095] batadv_slave_0: entered promiscuous mode [ 340.663509][T11095] batadv_slave_0: entered allmulticast mode [ 340.901774][T11099] jffs2: notice: (11099) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 340.991836][T11100] overlayfs: failed to clone upperpath [ 341.348842][T11113] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2166'. [ 341.378410][ T60] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 341.404744][ T60] Bluetooth: hci3: Injecting HCI hardware error event [ 341.415970][ T60] Bluetooth: hci3: hardware error 0x00 [ 341.691107][ T5703] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 341.869351][ T5703] usb 2-1: Using ep0 maxpacket: 8 [ 341.873690][ T5703] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 341.873755][ T5703] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 341.873791][ T5703] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 341.873840][ T5703] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 341.873869][ T5703] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 341.873918][ T5703] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 341.873944][ T5703] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.257037][ T5703] usb 2-1: usb_control_msg returned -32 [ 342.257090][ T5703] usbtmc 2-1:16.0: can't read capabilities [ 342.355713][T11134] netlink: 766 bytes leftover after parsing attributes in process `syz.0.2176'. [ 342.625378][T11139] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 342.656954][ T5605] usb 2-1: USB disconnect, device number 13 [ 342.972103][T11141] openvswitch: netlink: Missing key (keys=40, expected=100) [ 343.538652][ T60] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 343.904441][T11172] block nbd1: NBD_DISCONNECT [ 344.873033][T11207] netlink: 197276 bytes leftover after parsing attributes in process `syz.5.2209'. [ 344.873072][T11207] ksmbd: Daemon and kernel module version mismatch. ksmbd: 36, kernel module: 1. User-space ksmbd should terminate. [ 346.459633][T11263] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2232'. [ 347.378512][T11291] input: syz1 as /devices/virtual/input/input17 [ 347.817819][T11305] overlayfs: maximum fs stacking depth exceeded [ 348.956919][ T5605] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 348.976922][ T60] block nbd1: Receive control failed (result -32) [ 348.993317][ T5605] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 349.046101][T11315] block nbd1: shutting down sockets [ 349.275101][ T5605] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 349.703716][T11340] ceph: No mds server is up or the cluster is laggy [ 349.795836][ T5605] libceph: mon0 (2)127.0.0.1:6789 socket error on write [ 351.319799][T11389] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2286'. [ 351.411836][T11392] loop7: detected capacity change from 0 to 7 [ 351.500399][ C1] blk_print_req_error: 11 callbacks suppressed [ 351.500506][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.500597][ C1] buffer_io_error: 10 callbacks suppressed [ 351.500648][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.504019][T11395] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 351.507310][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.507452][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.507624][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.507686][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.507742][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.507802][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.507874][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.507936][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.509287][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.509389][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.509486][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.509587][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.509612][T11392] ldm_validate_partition_table(): Disk read failed. [ 351.509686][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.509776][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.515840][T11392] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 351.516069][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.516490][T11392] Buffer I/O error on dev loop7, logical block 0, async page read [ 351.516909][T11392] Dev loop7: unable to read RDB block 0 [ 351.546361][T11392] loop7: unable to read partition table [ 351.547087][T11392] loop7: partition table beyond EOD, truncated [ 351.547247][T11392] loop_reread_partitions: partition scan of loop7 () failed (rc=-5) [ 351.653278][T11390] Flush: task=syz.5.2287[11390] dev=loop7 state=2 [ 351.895442][T11390] Teardown: task=syz.5.2287[11390] dev=loop7 state=2 [ 352.228254][T11405] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 352.429915][ T37] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 352.578329][ T37] usb 2-1: Using ep0 maxpacket: 16 [ 352.580435][ T37] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 352.580495][ T37] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 352.580513][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.585477][ T37] usb 2-1: config 0 descriptor?? [ 352.658221][ T5609] Bluetooth: hci2: command 0x0406 tx timeout [ 352.813763][ T60] Bluetooth: hci2: adv larger than maximum supported [ 352.813788][ T60] Bluetooth: hci2: Malformed LE Event: 0x0d [ 352.920324][ T5703] usb 2-1: USB disconnect, device number 14 [ 354.771487][T11423] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2299'. [ 355.054985][T11429] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2303'. [ 355.284697][T11438] netlink: NAT attribute type 0 has unexpected length (1 != 0) [ 355.284747][T11438] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 355.608739][T11449] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 356.387705][T11477] 9pnet: p9_errstr2errno: server reported unknown error [ 356.676002][T11493] zero sized request [ 356.694853][ T38] audit: type=1326 audit(1786551807.776:46): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=11494 comm="syz.0.2330" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 358.676199][T11548] jffs2: notice: (11548) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 362.346415][T11624] netlink: 'syz.0.2385': attribute type 12 has an invalid length. [ 363.008202][ T5605] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 363.067402][T11639] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2393'. [ 363.168215][ T5605] usb 6-1: Using ep0 maxpacket: 16 [ 363.171709][ T5605] usb 6-1: config 1 has an invalid interface number: 105 but max is 0 [ 363.171743][ T5605] usb 6-1: config 1 has no interface number 0 [ 363.171793][ T5605] usb 6-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 363.171822][ T5605] usb 6-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 363.171850][ T5605] usb 6-1: config 1 interface 105 has no altsetting 0 [ 363.177163][ T5605] usb 6-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 363.177197][ T5605] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 363.177219][ T5605] usb 6-1: Product: syz [ 363.177234][ T5605] usb 6-1: Manufacturer: syz [ 363.177249][ T5605] usb 6-1: SerialNumber: syz [ 363.282417][T11631] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 363.282556][T11631] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 363.531666][T11646] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 363.701557][T11631] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 363.701892][T11631] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 363.825189][T11654] syzkaller1: entered promiscuous mode [ 363.825224][T11654] syzkaller1: entered allmulticast mode [ 364.398504][ T5605] aqc111 6-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 364.400493][ T5605] aqc111 6-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 364.520977][ T5605] aqc111 6-1:1.105 eth9: register 'aqc111' at usb-dummy_hcd.5-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 32:9e:40:58:c4:fc [ 364.546820][ T5605] usb 6-1: USB disconnect, device number 7 [ 364.560898][ T5605] aqc111 6-1:1.105 eth9: unregister 'aqc111' usb-dummy_hcd.5-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 364.770974][ T5605] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 364.771133][ T5605] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 364.771276][ T5605] aqc111 6-1:1.105 eth9 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 365.024459][T11673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 365.164740][T11677] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2410'. [ 365.308404][T11680] netlink: 'syz.0.2411': attribute type 4 has an invalid length. [ 365.440855][T11683] netlink: 'syz.5.2412': attribute type 39 has an invalid length. [ 366.058247][ T5703] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 366.219206][ T5703] usb 2-1: Using ep0 maxpacket: 32 [ 366.221867][ T5703] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 366.221898][ T5703] usb 2-1: config 0 has no interface number 0 [ 366.225078][ T5703] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 366.225111][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.225133][ T5703] usb 2-1: Product: syz [ 366.225149][ T5703] usb 2-1: Manufacturer: syz [ 366.225165][ T5703] usb 2-1: SerialNumber: syz [ 366.306676][ T5703] usb 2-1: config 0 descriptor?? [ 366.993348][ T5703] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 366.993391][ T5703] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 366.993998][ T5703] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 366.994349][ T5703] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 367.050417][ T5703] usb 2-1: USB disconnect, device number 15 [ 368.034482][T11737] input: syz1 as /devices/virtual/input/input18 [ 368.872592][T11762] netlink: 'syz.1.2446': attribute type 4 has an invalid length. [ 368.872708][T11762] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2446'. [ 368.985168][T11767] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2448'. [ 369.473489][T11785] device-mapper: ioctl: Invalid ioctl structure: name t, dev f801 [ 372.320009][T11855] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2485'. [ 372.809758][T11878] MTRR 1 not used [ 373.123683][T11887] sctp: [Deprecated]: syz.0.2501 (pid 11887) Use of struct sctp_assoc_value in delayed_ack socket option. [ 373.123683][T11887] Use struct sctp_sack_info instead [ 375.395989][ T5831] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 375.562360][ T5831] usb 6-1: config index 0 descriptor too short (expected 45, got 28) [ 375.562396][ T5831] usb 6-1: config 1 descriptor has 1 excess byte, ignoring [ 375.562448][ T5831] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 375.565695][ T5831] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 375.565728][ T5831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.565753][ T5831] usb 6-1: Product: syz [ 375.565764][ T5831] usb 6-1: Manufacturer: syz [ 375.565775][ T5831] usb 6-1: SerialNumber: syz [ 375.713932][ T5831] rtl8150 6-1:1.0: couldn't find required endpoints [ 375.716120][ T5831] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 375.840056][ T5831] usb 6-1: USB disconnect, device number 8 [ 376.579462][T11974] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2541'. [ 376.596057][T11974] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2541'. [ 376.596102][T11974] openvswitch: netlink: Missing key (keys=c0, expected=40280) [ 376.934478][T11986] netlink: 703 bytes leftover after parsing attributes in process `syz.5.2544'. [ 377.463518][ T1027] af_packet: tpacket_rcv: packet too big, clamped from 52 to 4294967272. macoff=96 [ 378.041433][T12017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2557'. [ 378.199238][T12025] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 378.370959][T12025] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 378.746682][T12032] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 378.994631][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.994745][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.262529][T12045] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2569'. [ 379.281323][T12045] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2569'. [ 379.282891][T12045] netlink: 508 bytes leftover after parsing attributes in process `syz.5.2569'. [ 380.193453][T12068] netlink: 'syz.5.2578': attribute type 23 has an invalid length. [ 380.939740][T12086] CIFS: Attempting to mount //127.0.0.1/share [ 381.008826][T12086] CIFS: VFS: Error connecting to socket. Aborting operation. [ 381.009003][T12086] CIFS: VFS: cifs_mount failed w/return code = -101 [ 381.224599][T12096] netlink: 16402 bytes leftover after parsing attributes in process `syz.5.2589'. [ 381.605141][T12113] tipc: Started in network mode [ 381.605198][T12113] tipc: Node identity 01000001, cluster identity 4711 [ 381.619240][T12113] tipc: Enabling of bearer rejected, failed to enable media [ 382.597372][T12142] block nbd1: shutting down sockets [ 382.931189][T12164] jffs2: notice: (12164) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 383.767270][T12193] loop8: detected capacity change from 0 to 8 [ 383.905500][T12193] Dev loop8: unable to read RDB block 8 [ 383.905555][T12193] loop8: unable to read partition table [ 383.907732][T12193] loop8: partition table beyond EOD, truncated [ 383.907797][T12193] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 384.078380][T11955] Flush: task=udevd[11955] dev=loop8 state=2 [ 384.305203][T11955] Teardown: task=udevd[11955] dev=loop8 state=2 [ 385.956356][T12260] netlink: 'syz.0.2666': attribute type 23 has an invalid length. [ 386.266895][ T37] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 386.423380][ T37] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 386.423439][ T37] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 386.423457][ T37] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.438792][ T37] usb 6-1: config 0 descriptor?? [ 386.492798][ T37] pwc: Askey VC010 type 2 USB webcam detected. [ 386.589972][T12280] Invalid argument reading file caps for ./file0 [ 386.853780][ T37] pwc: recv_control_msg error -32 req 02 val 2b00 [ 386.870141][ T37] pwc: recv_control_msg error -32 req 02 val 2700 [ 387.074608][ T37] pwc: recv_control_msg error -71 req 04 val 1000 [ 387.097924][ T37] pwc: recv_control_msg error -71 req 04 val 1300 [ 387.098410][ T37] pwc: recv_control_msg error -71 req 04 val 1400 [ 387.098982][ T37] pwc: recv_control_msg error -71 req 02 val 2000 [ 387.099576][ T37] pwc: recv_control_msg error -71 req 02 val 2100 [ 387.100228][ T37] pwc: recv_control_msg error -71 req 04 val 1500 [ 387.141867][ T37] pwc: recv_control_msg error -71 req 02 val 2500 [ 387.142397][ T37] pwc: recv_control_msg error -71 req 02 val 2400 [ 387.142872][ T37] pwc: recv_control_msg error -71 req 02 val 2600 [ 387.143368][ T37] pwc: recv_control_msg error -71 req 02 val 2900 [ 387.145059][ T37] pwc: recv_control_msg error -71 req 02 val 2800 [ 387.149965][ T37] pwc: recv_control_msg error -71 req 04 val 1100 [ 387.173378][ T37] pwc: recv_control_msg error -71 req 04 val 1200 [ 387.257516][ T37] pwc: Registered as video103. [ 387.283145][ T37] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input19 [ 387.463091][ T37] usb 6-1: USB disconnect, device number 9 [ 387.879980][T12296] sock: sock_set_timeout: `syz.5.2678' (pid 12296) tries to set negative timeout [ 388.257349][T12305] loop5: detected capacity change from 0 to 7 [ 388.327882][T12305] Dev loop5: unable to read RDB block 7 [ 388.327921][T12305] loop5: unable to read partition table [ 388.328086][T12305] loop5: partition table beyond EOD, truncated [ 388.328137][T12305] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 388.446566][T11955] Flush: task=udevd[11955] dev=loop5 state=2 [ 388.465746][T12312] netlink: 116 bytes leftover after parsing attributes in process `syz.5.2685'. [ 388.522645][T11955] Teardown: task=udevd[11955] dev=loop5 state=2 [ 388.555458][T12316] netlink: 'syz.5.2687': attribute type 180 has an invalid length. [ 388.555501][T12316] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2687'. [ 388.792666][T12322] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.2690'. [ 388.792703][T12322] openvswitch: netlink: Message has 512 unknown bytes. [ 389.184538][T12334] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2696'. [ 389.581377][ T38] audit: type=1326 audit(1786552096.740:47): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12348 comm="syz.4.2703" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff6aa27e0d9 code=0x0 [ 390.633336][T12390] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2722'. [ 390.667905][T12391] syzkaller1: entered promiscuous mode [ 390.667934][T12391] syzkaller1: entered allmulticast mode [ 391.843644][T12426] netlink: 730 bytes leftover after parsing attributes in process `syz.5.2737'. [ 392.013745][T12431] input: syz1 as /devices/virtual/input/input20 [ 392.974261][T12460] Invalid argument reading file caps for ./file0 [ 392.981214][T12459] loop8: detected capacity change from 0 to 8 [ 393.017814][T12459] Dev loop8: unable to read RDB block 8 [ 393.017865][T12459] loop8: unable to read partition table [ 393.018083][T12459] loop8: partition table beyond EOD, truncated [ 393.018119][T12459] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 393.160395][T11955] Flush: task=udevd[11955] dev=loop8 state=2 [ 393.296086][T11955] Teardown: task=udevd[11955] dev=loop8 state=2 [ 394.620495][T12518] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2766'. [ 395.904491][T12564] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2787'. [ 396.038429][T12569] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2789'. [ 396.659440][T12585] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2796'. [ 397.257459][T12591] syzkaller1: entered promiscuous mode [ 397.257498][T12591] syzkaller1: entered allmulticast mode [ 398.500431][T12617] device-mapper: ioctl: Invalid data size in the ioctl structure: 2037539694 [ 399.188104][ T37] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 399.355235][ T37] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 399.355319][ T37] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 399.355348][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.377011][ T37] usb 2-1: config 0 descriptor?? [ 399.430689][ T37] pwc: Askey VC010 type 2 USB webcam detected. [ 399.866072][ T37] pwc: recv_control_msg error -32 req 02 val 2b00 [ 399.867489][ T37] pwc: recv_control_msg error -32 req 02 val 2700 [ 400.146949][ T37] pwc: recv_control_msg error -71 req 04 val 1000 [ 400.165379][ T37] pwc: recv_control_msg error -71 req 04 val 1300 [ 400.166080][ T37] pwc: recv_control_msg error -71 req 04 val 1400 [ 400.169030][ T37] pwc: recv_control_msg error -71 req 02 val 2000 [ 400.198273][ T37] pwc: recv_control_msg error -71 req 02 val 2100 [ 400.208592][ T37] pwc: recv_control_msg error -71 req 04 val 1500 [ 400.209140][ T37] pwc: recv_control_msg error -71 req 02 val 2500 [ 400.225291][ T37] pwc: recv_control_msg error -71 req 02 val 2400 [ 400.225832][ T37] pwc: recv_control_msg error -71 req 02 val 2600 [ 400.227126][ T37] pwc: recv_control_msg error -71 req 02 val 2900 [ 400.229043][ T37] pwc: recv_control_msg error -71 req 02 val 2800 [ 400.259088][ T37] pwc: recv_control_msg error -71 req 04 val 1100 [ 400.275906][ T37] pwc: recv_control_msg error -71 req 04 val 1200 [ 400.458935][ T37] pwc: Registered as video103. [ 400.478111][ T37] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input21 [ 400.509201][ T37] usb 2-1: USB disconnect, device number 16 [ 401.431538][T12658] KVM: debugfs: duplicate directory 12658-4 [ 402.043491][T12675] netlink: 57 bytes leftover after parsing attributes in process `syz.0.2833'. [ 402.049445][T12675] netlink: 57 bytes leftover after parsing attributes in process `syz.0.2833'. [ 402.149958][ T37] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 402.314844][ T37] usb 2-1: Using ep0 maxpacket: 32 [ 402.323411][ T37] usb 2-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 402.323451][ T37] usb 2-1: config 0 interface 0 has no altsetting 0 [ 402.323491][ T37] usb 2-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.00 [ 402.323517][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 402.371392][ T37] usb 2-1: config 0 descriptor?? [ 402.757841][ T5605] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 402.784258][ T37] apple 0003:05AC:025B.0008: unknown main item tag 0x4 [ 402.784300][ T37] apple 0003:05AC:025B.0008: report_id 0 is invalid [ 402.784325][ T37] apple 0003:05AC:025B.0008: item 0 0 1 8 parsing failed [ 402.785096][ T37] apple 0003:05AC:025B.0008: parse failed [ 402.785251][ T37] apple 0003:05AC:025B.0008: probe with driver apple failed with error -22 [ 402.968124][ T5605] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 402.968162][ T5605] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 402.969605][ T5605] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 402.969637][ T5605] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 402.969652][ T5605] usb 6-1: SerialNumber: syz [ 403.027105][ T5831] usb 2-1: USB disconnect, device number 17 [ 403.245866][ T5605] usb 6-1: 0:2 : does not exist [ 403.378748][ T5605] usb 6-1: USB disconnect, device number 10 [ 403.483455][T11955] udevd[11955]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 403.518169][T12702] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2844'. [ 403.554689][T12702] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2844'. [ 403.554727][T12702] openvswitch: netlink: Missing key (keys=c0, expected=40280) [ 403.702860][T12708] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 403.702860][T12708] [ 403.703140][T12708] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 403.703232][T12708] CIFS: Attempting to mount //127.0.0.1/share [ 403.704288][T12708] CIFS: VFS: Error connecting to socket. Aborting operation. [ 403.704336][T12708] CIFS: VFS: cifs_mount failed w/return code = -101 [ 404.569498][T12734] fuse: fd is not a fuse device [ 405.231217][ T60] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 405.247607][ T60] Bluetooth: hci2: adv larger than maximum supported [ 406.077139][ T38] audit: type=1326 audit(1786552369.331:48): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12753 comm="syz.0.2867" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 406.861879][T12767] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2870'. [ 406.875401][T12767] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2870'. [ 406.876871][T12767] netlink: 508 bytes leftover after parsing attributes in process `syz.0.2870'. [ 407.157616][T12776] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 407.863110][T12789] xt_hashlimit: max too large, truncated to 1048576 [ 409.412607][T12825] netlink: 408 bytes leftover after parsing attributes in process `syz.4.2895'. [ 411.742625][T12892] netlink: 'syz.5.2924': attribute type 11 has an invalid length. [ 411.852078][ T5831] IPVS: starting estimator thread 0... [ 411.951820][T12896] sock: sock_set_timeout: `syz.5.2925' (pid 12896) tries to set negative timeout [ 412.038755][T12894] IPVS: using max 11 ests per chain, 26400 per kthread [ 412.376736][T12913] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.2933'. [ 412.525141][T12918] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2934'. [ 412.529641][T12920] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2935'. [ 413.231323][T12943] netlink: 'syz.1.2947': attribute type 1 has an invalid length. [ 413.613542][ T37] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 413.783225][ T37] usb 6-1: Using ep0 maxpacket: 8 [ 413.786209][ T37] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 413.786250][ T37] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 413.786269][ T37] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.791570][ T37] usb 6-1: config 0 descriptor?? [ 413.973125][T12967] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2957'. [ 414.108843][ T37] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 414.444711][ T60] block nbd0: Receive control failed (result -107) [ 414.497794][ T37] usb 6-1: USB disconnect, device number 11 [ 414.527903][T12948] iowarrior 6-1:0.0: Error -2 while submitting URB [ 418.278377][ T5581] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 418.443397][ T5581] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 418.443429][ T5581] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 418.443446][ T5581] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 418.443501][ T5581] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 418.476989][ T5581] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 418.477026][ T5581] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 418.477050][ T5581] usb 6-1: Product: syz [ 418.477067][ T5581] usb 6-1: Manufacturer: syz [ 418.566910][ T5581] cdc_wdm 6-1:1.0: skipping garbage [ 418.576518][ T5581] cdc_wdm 6-1:1.0: skipping garbage [ 418.606493][ T5581] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 418.606596][ T5581] cdc_wdm 6-1:1.0: Unknown control protocol [ 418.963521][T13089] syzkaller1: entered promiscuous mode [ 418.963548][T13089] syzkaller1: entered allmulticast mode [ 419.392475][ T5831] usb 6-1: USB disconnect, device number 12 [ 419.997576][T13120] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3026'. [ 420.003746][T13122] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3025'. [ 420.124271][T13126] Invalid argument reading file caps for ./file0 [ 420.501301][T13136] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3033'. [ 421.120797][T13160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 421.720502][T13174] netlink: 'syz.0.3048': attribute type 27 has an invalid length. [ 422.081304][T13174] batadv_slave_0: left promiscuous mode [ 422.081333][T13174] batadv_slave_0: left allmulticast mode [ 422.110747][T13174] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 422.303563][ T825] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 422.442457][T13174] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 422.504290][ T825] usb 6-1: Using ep0 maxpacket: 32 [ 422.522104][ T825] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 422.522138][ T825] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.635416][ T825] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 422.772376][T13184] input: syz0 as /devices/virtual/input/input22 [ 423.676722][ T825] gspca_nw80x: reg_w err -71 [ 423.677019][ T825] nw80x 6-1:3.0: probe with driver nw80x failed with error -71 [ 423.691077][ T825] usb 6-1: USB disconnect, device number 13 [ 424.150602][T13205] syzkaller1: entered promiscuous mode [ 424.150635][T13205] syzkaller1: entered allmulticast mode [ 425.684400][T13242] jffs2: notice: (13242) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 426.624766][T13262] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3081'. [ 426.984265][T13271] gadgetfs: bound to dummy_udc driver [ 427.405186][ T5703] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 427.405692][ C0] gadgetfs: connected [ 427.409822][ T5703] gadgetfs: disconnected [ 427.558954][ C0] gadgetfs: connected [ 427.562294][ T5703] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 427.562340][ T5703] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 427.562369][ T5703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.617182][ C0] gadgetfs: configuration #1 [ 427.652969][T13291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3093'. [ 427.707605][T13271] gadgetfs: suspended from state 3 [ 427.712259][ T5703] usb 1-1: USB disconnect, device number 5 [ 427.736571][T13271] gadgetfs: disconnected [ 428.106029][T13303] overlayfs: failed to clone upperpath [ 428.387016][T13314] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3103'. [ 428.683336][ T38] audit: type=1326 audit(1786552648.099:49): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13316 comm="syz.5.3106" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7fc00000 [ 429.378519][ T38] audit: type=1326 audit(1786552648.803:50): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13316 comm="syz.5.3106" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f74cfe7e0d9 code=0x7fc00000 [ 430.273618][T13360] device-mapper: ioctl: Invalid ioctl structure: name my, dev f802 [ 430.652437][T13376] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3127'. [ 431.141723][T13393] gadgetfs: bound to dummy_udc driver [ 431.659314][T13404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3141'. [ 431.659460][T13404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3141'. [ 432.547358][T13427] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3150'. [ 433.058053][T13441] loop3: detected capacity change from 0 to 7 [ 433.165648][T13441] Dev loop3: unable to read RDB block 7 [ 433.165699][T13441] loop3: unable to read partition table [ 433.165914][T13441] loop3: partition table beyond EOD, truncated [ 433.165962][T13441] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 433.258421][T11955] Flush: task=udevd[11955] dev=loop3 state=2 [ 433.418650][T11955] Teardown: task=udevd[11955] dev=loop3 state=2 [ 434.123026][T13467] batadv_slave_1: entered promiscuous mode [ 434.504674][T13466] batadv_slave_1: left promiscuous mode [ 434.769101][T13481] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 435.654088][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 435.739383][ T5609] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 435.804983][ T5609] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 435.859360][ T5609] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 435.881452][ T5609] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 436.132591][ T154] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.338165][T13490] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3180'. [ 437.097016][ T154] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.738280][ T154] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.000705][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888059318c00: rx timeout, send abort [ 438.006955][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff888059318c00: 0x0f001: (3) A timeout occurred and this is the connection abort to close the session. [ 438.030892][ T60] Bluetooth: hci2: command tx timeout [ 438.279209][ T38] audit: type=1326 audit(1786552657.755:51): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13544 comm="syz.0.3202" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 438.641517][ T154] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.917137][T13552] Flush: task=syz.5.3204[13552] dev=loop4 state=2 [ 439.086557][T13552] Teardown: task=syz.5.3204[13552] dev=loop4 state=2 [ 439.089574][T13552] Flush: task=syz.5.3204[13552] dev=loop6 state=2 [ 439.237649][T13552] Teardown: task=syz.5.3204[13552] dev=loop6 state=2 [ 440.021770][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.021867][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.097286][ T60] Bluetooth: hci2: command tx timeout [ 440.938905][ T154] bridge_slave_1: left allmulticast mode [ 440.938944][ T154] bridge_slave_1: left promiscuous mode [ 440.939249][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.112385][ T154] bridge_slave_0: left allmulticast mode [ 441.112427][ T154] bridge_slave_0: left promiscuous mode [ 441.112756][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.161586][ T60] Bluetooth: hci2: command tx timeout [ 442.481147][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 442.574674][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 442.652033][ T154] bond0 (unregistering): Released all slaves [ 442.670532][ T38] audit: type=1326 audit(1786552662.178:52): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13624 comm="syz.4.3225" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff6aa27e0d9 code=0x0 [ 442.883306][ T5255] 8021q: adding VLAN 0 to HW filter on device eth9 [ 442.993585][T13493] bridge0: port 1(bridge_slave_0) entered blocking state [ 442.994897][T13493] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.995196][T13493] bridge_slave_0: entered allmulticast mode [ 443.051339][T13493] bridge_slave_0: entered promiscuous mode [ 443.110628][T13493] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.111020][T13493] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.111371][T13493] bridge_slave_1: entered allmulticast mode [ 443.230818][T13493] bridge_slave_1: entered promiscuous mode [ 443.793519][T13493] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.868189][T13493] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 444.232567][ T60] Bluetooth: hci2: command tx timeout [ 444.259357][T13493] team0: Port device team_slave_0 added [ 444.381921][T13493] team0: Port device team_slave_1 added [ 445.646215][T13493] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 445.646238][T13493] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 445.646265][T13493] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 445.664953][T13493] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 445.664977][T13493] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 445.665011][T13493] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 446.585492][T13688] GUP no longer grows the stack in syz.5.3243 (13688): 200000004000-20000000a000 (200000002000) [ 446.585556][T13688] CPU: 1 UID: 0 PID: 13688 Comm: syz.5.3243 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 446.585588][T13688] Tainted: [L]=SOFTLOCKUP [ 446.585596][T13688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 446.585620][T13688] Call Trace: [ 446.585710][T13688] [ 446.585782][T13688] dump_stack_lvl+0xe8/0x150 [ 446.585880][T13688] __get_user_pages+0x22b5/0x2650 [ 446.585947][T13688] get_user_pages_remote+0x307/0xb10 [ 446.585978][T13688] ? __pfx_mtree_load+0x10/0x10 [ 446.586043][T13688] ? __pfx_get_user_pages_remote+0x10/0x10 [ 446.586077][T13688] ? __access_remote_vm+0x42c/0x6f0 [ 446.586116][T13688] __access_remote_vm+0x222/0x6f0 [ 446.586160][T13688] ? __pfx___access_remote_vm+0x10/0x10 [ 446.586190][T13688] ? __kmalloc_cache_noprof+0x3cd/0x670 [ 446.586224][T13688] ? proc_pid_cmdline_read+0x41f/0x900 [ 446.586260][T13688] ? proc_pid_cmdline_read+0x41f/0x900 [ 446.586305][T13688] proc_pid_cmdline_read+0x46e/0x900 [ 446.586350][T13688] ? __asan_memset+0x22/0x50 [ 446.586383][T13688] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 446.586416][T13688] ? rw_verify_area+0x250/0x4d0 [ 446.586441][T13688] vfs_readv+0x588/0x850 [ 446.586471][T13688] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 446.586505][T13688] ? __pfx_vfs_readv+0x10/0x10 [ 446.586543][T13688] ? __fget_files+0x2a/0x420 [ 446.586566][T13688] ? __fget_files+0x3a8/0x420 [ 446.586586][T13688] ? __fget_files+0x2a/0x420 [ 446.586612][T13688] __x64_sys_preadv+0x19f/0x2c0 [ 446.586641][T13688] ? __pfx___x64_sys_preadv+0x10/0x10 [ 446.586673][T13688] do_syscall_64+0x17b/0x530 [ 446.586694][T13688] ? irqentry_exit+0x10f/0x8f0 [ 446.586714][T13688] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.586736][T13688] ? clear_bhb_loop+0x40/0x90 [ 446.586762][T13688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.586792][T13688] RIP: 0033:0x7f74cfe7e0d9 [ 446.586857][T13688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 446.586905][T13688] RSP: 002b:00007f74ce0d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 446.586958][T13688] RAX: ffffffffffffffda RBX: 00007f74d0105fa0 RCX: 00007f74cfe7e0d9 [ 446.586973][T13688] RDX: 0000000000000001 RSI: 0000200000000680 RDI: 0000000000000003 [ 446.586987][T13688] RBP: 00007f74cff15024 R08: 00000000fffffff9 R09: 0000000000000000 [ 446.587001][T13688] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 446.587014][T13688] R13: 00007f74d0106038 R14: 00007f74d0105fa0 R15: 00007fff91728aa8 [ 446.587046][T13688] [ 447.506181][ T5255] 8021q: adding VLAN 0 to HW filter on device eth10 [ 447.957151][T13493] hsr_slave_0: entered promiscuous mode [ 447.959514][T13493] hsr_slave_1: entered promiscuous mode [ 448.009065][T13493] debugfs: 'hsr0' already exists in 'hsr' [ 448.009105][T13493] Cannot create hsr debugfs directory [ 449.829463][ T154] hsr_slave_0: left promiscuous mode [ 449.864245][ T154] hsr_slave_1: left promiscuous mode [ 449.993378][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.993413][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 450.039903][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 450.039934][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.333652][ T154] veth1_macvtap: left promiscuous mode [ 450.333782][ T154] veth0_macvtap: left promiscuous mode [ 450.334151][ T154] veth1_vlan: left promiscuous mode [ 450.334404][ T154] veth0_vlan: left promiscuous mode [ 451.927678][ T154] team0 (unregistering): Port device team_slave_1 removed [ 451.997856][ T154] team0 (unregistering): Port device team_slave_0 removed [ 452.242697][ T5255] 8021q: adding VLAN 0 to HW filter on device eth11 [ 453.586349][T13823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3292'. [ 454.010952][T13830] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.277106][ T38] audit: type=1326 audit(1786552931.743:53): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13857 comm="syz.5.3302" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7fc00000 [ 457.113555][T13892] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3316'. [ 458.973315][T13948] overlayfs: failed to clone upperpath [ 458.989426][T13945] 9pnet: p9_errstr2errno: server reported unknown error 0x000 [ 459.212401][T13956] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3338'. [ 460.011881][T13980] vcan0: tx drop: invalid da for name 0xfffffffffffffffc [ 461.889341][ T37] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 462.515054][ T37] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 464.102354][T14069] 9p: Bad value for 'rfdno' [ 464.117976][T13493] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 464.171615][T13493] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 464.173697][T13493] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 464.490853][T13493] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 464.519329][T14078] 9pnet_fd: p9_fd_create_tcp (14078): problem connecting socket to 127.0.0.1 [ 464.580640][T13493] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 464.643014][T13493] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 464.644191][T13493] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 464.851127][T13493] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 465.885909][T13493] 8021q: adding VLAN 0 to HW filter on device bond0 [ 466.002713][T13493] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.119363][ T1516] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.119566][ T1516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 466.230589][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.230745][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.312625][T14124] gadgetfs: bound to dummy_udc driver [ 467.857158][T14145] netlink: 'syz.4.3388': attribute type 4 has an invalid length. [ 468.929946][T14164] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3394'. [ 469.396579][T14177] netlink: 72 bytes leftover after parsing attributes in process `syz.5.3399'. [ 469.728386][T14184] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3401'. [ 470.044205][T14194] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3405'. [ 470.184090][T13493] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 470.858891][T13493] veth0_vlan: entered promiscuous mode [ 470.929127][T14213] netlink: 'syz.5.3413': attribute type 10 has an invalid length. [ 471.391436][T13493] veth1_vlan: entered promiscuous mode [ 471.818622][T13493] veth0_macvtap: entered promiscuous mode [ 471.850787][T13493] veth1_macvtap: entered promiscuous mode [ 471.970187][T13493] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 472.064513][T13493] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 472.135593][ T41] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.140942][ T41] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.148385][ T154] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.148460][ T154] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.182960][T14263] netlink: 'syz.0.3434': attribute type 12 has an invalid length. [ 474.794076][ T5581] libceph: connect (2)127.0.0.1:6789 error -101 [ 474.794273][ T5581] libceph: ceph_tcp_connect failed: -101 [ 474.794999][ T5581] libceph: mon0 (2)127.0.0.1:6789 connect error [ 474.855934][ T5581] libceph: connect (2)127.0.0.1:6789 error -101 [ 474.856138][ T5581] libceph: ceph_tcp_connect failed: -101 [ 474.856157][ T5581] libceph: mon0 (2)127.0.0.1:6789 connect error [ 475.011319][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.011356][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.080345][T14271] ceph: No mds server is up or the cluster is laggy [ 475.249822][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.249849][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.343925][ T5831] libceph: connect (2)127.0.0.1:6789 error -101 [ 475.344137][ T5831] libceph: ceph_tcp_connect failed: -101 [ 475.344156][ T5831] libceph: mon0 (2)127.0.0.1:6789 connect error [ 476.985400][T14327] tipc: New replicast peer: 127.0.0.1 [ 477.036046][T14327] tipc: Enabled bearer , priority 10 [ 477.036223][T14330] netlink: 64 bytes leftover after parsing attributes in process `syz.5.3457'. [ 478.488275][ T5831] libceph: connect (1)0.0.0.0:6789 error -22 [ 478.488494][ T5831] libceph: mon0 (1)0.0.0.0:6789 connect error [ 478.747293][ T5581] libceph: connect (1)0.0.0.0:6789 error -22 [ 478.747516][ T5581] libceph: mon0 (1)0.0.0.0:6789 connect error [ 479.257364][ T10] libceph: connect (1)0.0.0.0:6789 error -22 [ 479.257562][ T10] libceph: mon0 (1)0.0.0.0:6789 connect error [ 479.302966][ T38] audit: type=1326 audit(1786552954.843:54): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14402 comm="syz.1.3491" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fea3ce3e0d9 code=0x0 [ 479.561495][T14371] ceph: No mds server is up or the cluster is laggy [ 480.773999][ T38] audit: type=1326 audit(1786552956.313:55): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14427 comm="syz.0.3501" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 481.217913][T14440] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 483.011734][T14497] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3527'. [ 483.028603][T14497] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3527'. [ 483.032343][T14497] netlink: 500 bytes leftover after parsing attributes in process `syz.1.3527'. [ 483.793406][T14526] fuse: Bad value for 'fd' [ 483.994142][T14534] 9pnet: p9_errstr2errno: server reported unknown error [ 484.981903][T14577] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3563'. [ 486.073206][T14625] sd 0:0:1:0: PR command failed: 1026 [ 486.073297][T14625] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 486.073394][T14625] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 486.672886][T14641] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3591'. [ 487.646296][T14678] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3608'. [ 487.831068][T14686] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 488.328913][T14702] input: syz0 as /devices/virtual/input/input23 [ 489.270781][T14716] PID 14716 killed due to inadequate hugepage pool [ 489.822684][T14735] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3631'. [ 490.616993][ T10] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 490.766789][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 490.790978][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.791041][ T10] usb 2-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 490.791068][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.831879][ T10] usb 2-1: config 0 descriptor?? [ 491.057536][ T32] usb 2-1: USB disconnect, device number 18 [ 493.212748][T14814] input: syz0 as /devices/virtual/input/input24 [ 493.953417][T14833] gadgetfs: bound to dummy_udc driver [ 494.195399][ T32] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 494.195789][ C1] gadgetfs: connected [ 494.235057][ T32] gadgetfs: disconnected [ 495.108578][T14861] netlink: 'syz.5.3684': attribute type 4 has an invalid length. [ 495.410903][T14869] binder: 14867:14869 ioctl c0306201 200000000180 returned -22 [ 496.316487][T14894] vxcan1: tx drop: invalid sa for name 0x0000000004000000 [ 497.749500][T14932] input: syz1 as /devices/virtual/input/input25 [ 499.278894][T14961] netlink: 'syz.5.3724': attribute type 9 has an invalid length. [ 499.883786][T14266] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 500.052187][T14266] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 500.052244][T14266] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 500.052267][T14266] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 500.052294][T14266] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 500.052336][T14266] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 500.052360][T14266] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.032320][T14992] sg_write: data in/out 469212/136 bytes for SCSI command 0x0-- guessing data in; [ 501.032320][T14992] program syz.4.3738 not setting count and/or reply_len properly [ 501.263383][T14266] gud 2-1:1.0: HDMI-A-1: Failed to add properties (ret=-71) [ 501.263439][T14266] gud 2-1:1.0: Failed to get connectors (error=-71) [ 501.263477][T14266] gud 2-1:1.0: probe with driver gud failed with error -71 [ 501.406238][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.406368][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.572905][T14266] usb 2-1: USB disconnect, device number 19 [ 502.070950][T15024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3753'. [ 502.073176][T15024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3753'. [ 502.080439][T15024] netlink: 'syz.1.3753': attribute type 32 has an invalid length. [ 502.080462][T15024] netlink: 500 bytes leftover after parsing attributes in process `syz.1.3753'. [ 502.915591][T15058] netlink: 'syz.1.3767': attribute type 2 has an invalid length. [ 502.915615][T15058] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3767'. [ 503.822425][T15058] : entered promiscuous mode [ 503.932394][T15072] netlink: 'syz.1.3773': attribute type 11 has an invalid length. [ 504.446128][T15093] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3780'. [ 504.774319][T15101] ubi0: attaching mtd0 [ 504.903128][T15101] ubi0: scanning is finished [ 504.903205][T15101] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 505.314545][T15116] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3791'. [ 505.615588][T15101] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 507.299741][T15178] overlayfs: failed to clone upperpath [ 507.497495][T15180] IPv4: Oversized IP packet from 127.202.26.0 [ 509.050170][T15236] overlayfs: failed to clone upperpath [ 509.167126][T15239] netlink: 'syz.5.3838': attribute type 49 has an invalid length. [ 509.265031][T15242] fuse: fd is not a fuse device [ 509.798025][T15239] ip6gretap0: entered promiscuous mode [ 509.798046][T15239] ip6gretap0: entered allmulticast mode [ 512.764317][T15346] misc userio: Can't change port id on an already running userio instance [ 513.093978][T15355] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3873'. [ 513.113203][T15355] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3873'. [ 513.123943][T15355] netlink: 500 bytes leftover after parsing attributes in process `syz.5.3873'. [ 513.291714][T15363] netlink: 9 bytes leftover after parsing attributes in process `syz.5.3875'. [ 513.339809][T15363] gretap0: entered promiscuous mode [ 513.423291][T15363] netlink: 5 bytes leftover after parsing attributes in process `syz.5.3875'. [ 513.626093][T15363] 0{X: renamed from gretap0 [ 513.669948][T15363] 0{X: left promiscuous mode [ 513.669983][T15363] 0{X: entered allmulticast mode [ 513.787751][T15363] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 514.904716][T15405] device-mapper: ioctl: populate_table: target parameters not NUL-terminated [ 515.399710][T15420] 9pnet: p9_errstr2errno: server reported unknown error [ 515.657284][T15432] netlink: 'syz.0.3910': attribute type 2 has an invalid length. [ 515.657309][T15432] netlink: 'syz.0.3910': attribute type 1 has an invalid length. [ 516.230618][T15451] fuse: fd is not a fuse device [ 516.292796][T15452] 9pnet: p9_errstr2errno: server reported unknown error [ 516.399408][ T38] audit: type=1326 audit(1786552991.943:56): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15457 comm="syz.0.3914" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 517.137802][T15478] syzkaller1: entered promiscuous mode [ 517.137836][T15478] syzkaller1: entered allmulticast mode [ 517.462101][T15486] MTD: Couldn't look up './dev/mtdblock0': -2 [ 518.462996][T15516] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 疽m%AƴI %s [ 518.735256][ T38] audit: type=1326 audit(1786552994.273:57): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15495 comm="syz.0.3928" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7fc00000 [ 519.289423][T14266] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 519.490002][T14266] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 519.490043][T14266] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 519.490088][T14266] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 519.490116][T14266] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.539730][T14266] usb 2-1: config 0 descriptor?? [ 520.149871][T14266] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 520.149915][T14266] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 520.149955][T14266] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 520.149983][T14266] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 520.150010][T14266] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 520.251365][T14266] hid-steam 0003:28DE:1142.000A: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 521.798226][ T1027] wlan1: Trigger new scan to find an IBSS to join [ 522.121314][ T7019] usb 2-1: USB disconnect, device number 20 [ 522.505004][T15619] fuse: fd is not a fuse device [ 522.513526][T15621] jffs2: notice: (15621) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 523.373035][ T7019] libceph: connect (1)[c::]:6789 error -101 [ 523.373268][ T7019] libceph: mon0 (1)[c::]:6789 connect error [ 523.405318][ T7019] libceph: connect (1)[c::]:6789 error -101 [ 523.427387][ T7019] libceph: mon0 (1)[c::]:6789 connect error [ 523.473884][T15642] ceph: No mds server is up or the cluster is laggy [ 523.774931][ T7019] libceph: connect (1)[c::]:6789 error -101 [ 523.775178][ T7019] libceph: mon0 (1)[c::]:6789 connect error [ 525.030810][T15678] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4003'. [ 525.913170][T15706] fuse: fd is not a fuse device [ 526.839108][ T154] wlan1: Trigger new scan to find an IBSS to join [ 527.885838][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 528.562115][T15799] netlink: 'syz.0.4036': attribute type 4 has an invalid length. [ 528.724336][T15802] could not open pipe file descriptor [ 529.525219][T15826] fuse: fd is not a fuse device [ 530.295501][T15848] could not open pipe file descriptor [ 530.936913][T14266] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 531.158714][T14266] usb 2-1: unable to get BOS descriptor or descriptor too short [ 531.165971][T14266] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 531.166029][T14266] usb 2-1: can't read configurations, error -71 [ 533.307946][ T38] audit: type=1326 audit(1786553008.853:58): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.309768][ T38] audit: type=1326 audit(1786553008.853:59): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.311507][ T38] audit: type=1326 audit(1786553008.853:60): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.311991][ T38] audit: type=1326 audit(1786553008.853:61): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=270 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.312534][ T38] audit: type=1326 audit(1786553008.853:62): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.312586][ T38] audit: type=1326 audit(1786553008.853:63): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.313596][ T38] audit: type=1326 audit(1786553008.853:65): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.313659][ T38] audit: type=1326 audit(1786553008.853:64): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 533.741275][ T38] audit: type=1326 audit(1786553009.283:66): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=15921 comm="syz.0.4083" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x7ffc0000 [ 535.055829][ C1] vcan0: j1939_tp_rxtimer: 0xffff88803c165000: rx timeout, send abort [ 535.119310][ T5831] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 535.296356][ T5831] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 535.296393][ T5831] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 535.296435][ T5831] usb 2-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 535.296462][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.438607][ T5831] spcp8x5 2-1:1.0: SPCP8x5 converter detected [ 535.510957][ T5831] usb 2-1: SPCP8x5 converter now attached to ttyUSB0 [ 535.564688][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805c404c00: rx timeout, send abort [ 536.003495][T15945] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 536.064789][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805c404c00: abort rx timeout. Force session deactivation [ 536.499485][T15945] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 536.661288][T15945] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 536.893159][T15943] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 536.976921][T15981] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 537.111461][ T5831] usb 2-1: USB disconnect, device number 23 [ 537.174615][T15984] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4110'. [ 537.195306][T15984] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4110'. [ 537.239394][T15984] netlink: 'syz.5.4110': attribute type 32 has an invalid length. [ 537.239423][T15984] netlink: 500 bytes leftover after parsing attributes in process `syz.5.4110'. [ 537.337420][ T5831] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 537.485314][ T5831] spcp8x5 2-1:1.0: device disconnected [ 537.667608][T15996] netlink: 'syz.4.4111': attribute type 11 has an invalid length. [ 538.301647][T16013] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4124'. [ 539.699393][T16067] fuse: fd is not a fuse device [ 540.610935][T16099] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4159'. [ 541.136306][T16114] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4164'. [ 541.333229][T16124] netlink: 'syz.1.4167': attribute type 2 has an invalid length. [ 541.333255][T16124] netlink: 'syz.1.4167': attribute type 1 has an invalid length. [ 541.333267][T16124] netlink: 'syz.1.4167': attribute type 8 has an invalid length. [ 541.333279][T16124] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4167'. [ 542.778872][T16159] netlink: 'syz.5.4182': attribute type 2 has an invalid length. [ 542.778894][T16159] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4182'. [ 543.230336][T16159] : entered promiscuous mode [ 543.258432][ T7019] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 543.416890][ T7019] usb 2-1: Using ep0 maxpacket: 32 [ 543.419157][ T7019] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 543.419190][ T7019] usb 2-1: config 0 has no interface number 0 [ 543.419244][ T7019] usb 2-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 543.419265][ T7019] usb 2-1: config 0 interface 184 has no altsetting 0 [ 543.468403][ T7019] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 543.468443][ T7019] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.468466][ T7019] usb 2-1: Product: syz [ 543.468482][ T7019] usb 2-1: Manufacturer: syz [ 543.468499][ T7019] usb 2-1: SerialNumber: syz [ 543.497886][ T7019] usb 2-1: config 0 descriptor?? [ 543.502060][T16163] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 543.599892][T16175] vxcan1: tx drop: invalid sa for name 0x0000000004000000 [ 543.730326][T16163] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 544.814084][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 544.814121][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 544.815240][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 544.815270][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 544.815289][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 544.815308][ T7019] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 544.816389][ T7019] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 544.986073][ T7019] usb 2-1: USB disconnect, device number 24 [ 545.667891][T16211] fuse: fd is not a fuse device [ 546.060371][T16226] overlayfs: failed to clone upperpath [ 546.524820][T16238] input: syz1 as /devices/virtual/input/input27 [ 551.761218][T16371] 9pnet: p9_errstr2errno: server reported unknown error [ 551.804787][T16365] netlink: 176 bytes leftover after parsing attributes in process `syz.5.4267'. [ 553.465138][T16442] input: syz1 as /devices/virtual/input/input28 [ 555.557480][T16509] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4322'. [ 556.695996][ T38] audit: type=1326 audit(1786553032.233:67): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16529 comm="syz.5.4331" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f74cfe7e0d9 code=0x0 [ 557.008957][ T38] audit: type=1326 audit(1786553032.553:68): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16535 comm="syz.0.4333" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7f55dde0d9 code=0x0 [ 557.635334][T16545] jffs2: notice: (16545) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 557.955964][T16554] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4339'. [ 559.798868][T16550] Bluetooth: hci2: command 0x0406 tx timeout [ 559.829859][T16600] netlink: 'syz.5.4357': attribute type 12 has an invalid length. [ 560.277018][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 561.795526][ T38] audit: type=1326 audit(1786553037.333:69): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16647 comm="syz.1.4378" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fea3ce3e0d9 code=0x0 [ 562.361744][T16673] syz.0.4388(16673): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 562.853813][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.853930][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.796957][ T12] wlan1: Trigger new scan to find an IBSS to join [ 564.527375][ T6527] do_umount: task=syz-executor[6527] propagate_mount_busy()!=0 [ 564.527763][ T6527] do_umount: task=syz-executor[6527] propagate_mount_busy()!=0 [ 565.506490][T16296] bridge0: port 3(syz_tun) entered disabled state [ 565.661513][T16296] syz_tun (unregistering): left allmulticast mode [ 565.661541][T16296] syz_tun (unregistering): left promiscuous mode [ 565.662675][T16296] bridge0: port 3(syz_tun) entered disabled state [ 565.901139][T16770] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 566.034201][T16776] overlayfs: failed to clone upperpath [ 566.555262][T16550] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 566.636923][T16550] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 566.654135][T16550] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 566.685913][T16550] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 566.698219][T16550] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 568.113682][T16830] fuse: fd is not a fuse device [ 568.837517][ T69] wlan1: Trigger new scan to find an IBSS to join [ 568.876822][ T5831] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 568.916911][ T60] Bluetooth: hci1: command tx timeout [ 569.121423][ T5831] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 569.121465][ T5831] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 569.121516][ T5831] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 569.121544][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.235857][T16854] Process accounting resumed [ 569.571801][ T5831] usb 2-1: usb_control_msg returned -32 [ 569.571853][ T5831] usbtmc 2-1:16.0: can't read capabilities [ 569.917500][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.035170][T16870] fuse: fd is not a fuse device [ 570.177885][ T5831] usb 2-1: USB disconnect, device number 25 [ 570.365931][T16785] bridge0: port 1(bridge_slave_0) entered blocking state [ 570.366288][T16785] bridge0: port 1(bridge_slave_0) entered disabled state [ 570.366538][T16785] bridge_slave_0: entered allmulticast mode [ 570.391109][T16785] bridge_slave_0: entered promiscuous mode [ 570.394651][T16785] bridge0: port 2(bridge_slave_1) entered blocking state [ 570.395079][T16785] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.395325][T16785] bridge_slave_1: entered allmulticast mode [ 570.427590][T16785] bridge_slave_1: entered promiscuous mode [ 570.487317][T16785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 570.508688][T16785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 570.573064][T16785] team0: Port device team_slave_0 added [ 570.585102][T16785] team0: Port device team_slave_1 added [ 570.640101][T16785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 570.640118][T16785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 570.640139][T16785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 570.644014][T16785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 570.644031][T16785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 570.644054][T16785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 570.997275][ T60] Bluetooth: hci1: command tx timeout [ 571.181136][T16785] hsr_slave_0: entered promiscuous mode [ 571.183839][T16785] hsr_slave_1: entered promiscuous mode [ 571.185926][T16785] debugfs: 'hsr0' already exists in 'hsr' [ 571.185966][T16785] Cannot create hsr debugfs directory [ 572.686798][ T5831] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 572.857109][ T5831] usb 2-1: Using ep0 maxpacket: 16 [ 572.858433][ T5831] usb 2-1: too many configurations: 123, using maximum allowed: 8 [ 572.861732][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.863400][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.865463][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.978451][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.981786][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.983234][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.984758][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.986260][ T5831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 573.045333][ T5831] usb 2-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 573.045368][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 573.045391][ T5831] usb 2-1: SerialNumber: syz [ 573.080303][ T60] Bluetooth: hci1: command tx timeout [ 573.132567][ T5831] usb 2-1: config 0 descriptor?? [ 573.161300][ T5831] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input29 [ 573.469802][ T4945] bcm5974 2-1:0.0: could not read from device [ 573.617455][T16931] bridge0: port 3(erspan0) entered blocking state [ 573.617896][T16931] bridge0: port 3(erspan0) entered disabled state [ 573.618155][T16931] erspan0: entered allmulticast mode [ 573.664366][ T5831] usb 2-1: USB disconnect, device number 26 [ 573.704956][T16931] erspan0: entered promiscuous mode [ 573.705680][T16931] bridge0: port 3(erspan0) entered blocking state [ 573.705790][T16931] bridge0: port 3(erspan0) entered forwarding state [ 573.745779][T16924] bcm5974 2-1:0.0: could not read from device [ 573.765625][T16847] bcm5974 2-1:0.0: could not read from device [ 573.790855][T16933] erspan0: left allmulticast mode [ 573.790893][T16933] erspan0: left promiscuous mode [ 573.814321][T16933] bridge0: port 3(erspan0) entered disabled state [ 573.979343][T16785] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 574.091915][T16785] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 574.094559][T16785] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 574.265023][T16785] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 574.272817][T16785] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 574.295651][T16942] 9p: Bad value for 'rfdno' [ 574.371667][T16785] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 574.468747][T16785] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 574.518488][T16785] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 575.165652][ T60] Bluetooth: hci1: command tx timeout [ 575.708671][T16976] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4513'. [ 575.898636][T16785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 576.302895][T16785] 8021q: adding VLAN 0 to HW filter on device team0 [ 576.369192][ T1027] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.369373][ T1027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 576.454649][ T1027] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.454796][ T1027] bridge0: port 2(bridge_slave_1) entered forwarding state [ 576.831283][T16998] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4514'. [ 576.831324][T16998] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4514'. [ 578.845315][T17030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4525'. [ 579.609086][T16785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.742327][T16785] veth0_vlan: entered promiscuous mode [ 580.974372][T16785] veth1_vlan: entered promiscuous mode [ 581.310514][T16785] veth0_macvtap: entered promiscuous mode [ 581.390285][T16785] veth1_macvtap: entered promiscuous mode [ 581.529915][T16785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.617504][T16785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.914320][ T103] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.980752][ T1027] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.984727][ T1027] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.984790][ T1027] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 583.678253][ T1516] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 583.678277][ T1516] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.232849][ T1516] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.232973][ T1516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 585.866174][T17147] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4563'. [ 587.912200][T17210] gadgetfs: bound to dummy_udc driver [ 588.840247][T17244] overlayfs: failed to resolve './cgroup': -2 [ 589.366738][T17254] 9pnet: p9_errstr2errno: server reported unknown error 0x00000 [ 591.383191][T17311] syzkaller1: entered promiscuous mode [ 591.383214][T17311] syzkaller1: entered allmulticast mode [ 592.283584][ T8111] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 594.677248][T17362] ceph: No mds server is up or the cluster is laggy [ 594.697829][T17365] ceph: No mds server is up or the cluster is laggy [ 595.314674][T17402] 9pnet: p9_errstr2errno: server reported unknown error 0x0 [ 595.614803][T17409] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 595.736433][T17415] fuse: fd is not a fuse device [ 596.708003][T14266] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 596.777984][T14266] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 597.051301][T17445] 9p: Bad value for 'source' [ 598.322115][T17487] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4693'. [ 600.970215][T17533] : renamed from vlan0 (while UP) [ 601.532504][T17551] netlink: 'syz.6.4711': attribute type 1 has an invalid length. [ 601.532530][T17551] netlink: 'syz.6.4711': attribute type 4 has an invalid length. [ 601.532546][T17551] netlink: 9462 bytes leftover after parsing attributes in process `syz.6.4711'. [ 601.770138][T17556] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4714'. [ 602.673062][T17581] MTD: Couldn't look up './dev/mtdblock0': -2 [ 603.736827][ T37] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 603.896941][ T37] usb 2-1: Using ep0 maxpacket: 16 [ 603.901346][ T37] usb 2-1: config 1 has an invalid descriptor of length 114, skipping remainder of the config [ 603.901381][ T37] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 603.932975][ T37] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 603.933011][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.933033][ T37] usb 2-1: Product: syz [ 603.933049][ T37] usb 2-1: Manufacturer: syz [ 603.933066][ T37] usb 2-1: SerialNumber: syz [ 604.377667][ T37] usb 2-1: 0:2 : does not exist [ 604.377772][ T37] usb 2-1: unit 127 not found! [ 605.790528][ T37] usb 2-1: USB disconnect, device number 27 [ 606.248225][T17108] udevd[17108]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 610.462461][T17713] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4771'. [ 613.915732][ C1] [drm:vkms_crtc_handle_vblank_timeout] *ERROR* vkms failure on handling vblank [ 614.616508][T17765] 9p: Bad value for 'rfdno' [ 615.250164][ T10] libceph: connect (1)[c::]:6789 error -101 [ 615.250402][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 615.251665][ T10] libceph: connect (1)[c::]:6789 error -101 [ 615.251851][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 615.251963][T17769] ceph: No mds server is up or the cluster is laggy [ 615.525191][ T10] libceph: connect (1)[c::]:6789 error -101 [ 615.545283][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 616.998668][T17799] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4808'. [ 618.714201][T17841] netlink: 104 bytes leftover after parsing attributes in process `syz.5.4826'. [ 621.885713][T17727] Set syz1 is full, maxelem 65536 reached [ 624.283640][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.283764][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.296671][ T69] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 633.599330][T18133] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 633.599330][T18133] [ 633.599364][T18133] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 633.599445][T18133] CIFS: Attempting to mount //127.0.0.1/share [ 634.794404][T18133] CIFS: VFS: cifs_mount failed w/return code = -112 [ 635.985114][ T38] audit: type=1800 audit(1786553111.523:70): pid=18179 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.1.4960" name="size" dev="configfs" ino=56988 res=0 errno=0 [ 636.006435][ T38] audit: type=1800 audit(1786553111.523:71): pid=18179 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.1.4960" name="power" dev="configfs" ino=56989 res=0 errno=0 [ 636.369784][T18185] fuse: fd is not a fuse device [ 637.198731][T18179] null_blk: disk nullb1 created [ 638.246798][ T5831] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 638.409516][ T5831] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 638.409550][ T5831] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 638.411774][ T5831] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 638.411809][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 638.411832][ T5831] usb 2-1: SerialNumber: syz [ 638.753906][ T5831] usb 2-1: 0:2 : does not exist [ 638.991173][ T5831] usb 2-1: USB disconnect, device number 28 [ 639.232211][T17985] udevd[17985]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 640.184565][T18276] 9pnet: p9_errstr2errno: server reported unknown error 0x000 [ 640.341270][T18282] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 640.342938][T18282] IPVS: nq: FWM 3 0x00000003 - no destination available [ 640.397197][ T10] IPVS: starting estimator thread 0... [ 640.586818][T18285] IPVS: using max 9 ests per chain, 21600 per kthread [ 640.708571][T18294] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 641.040864][T18301] fuse: fd is not a fuse device [ 641.525239][T18317] sctp: [Deprecated]: syz.6.5016 (pid 18317) Use of struct sctp_assoc_value in delayed_ack socket option. [ 641.525239][T18317] Use struct sctp_sack_info instead [ 641.856825][ T10] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 642.038003][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 642.038044][ T10] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 41552, setting to 1024 [ 642.042228][ T10] usb 7-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice= 1.00 [ 642.042265][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.042289][ T10] usb 7-1: Product: syz [ 642.042307][ T10] usb 7-1: Manufacturer: syz [ 642.042324][ T10] usb 7-1: SerialNumber: syz [ 642.121281][ T10] symbolserial 7-1:1.0: symbol converter detected [ 642.129190][ T10] usb 7-1: symbol converter now attached to ttyUSB0 [ 642.360727][ T10] usb 7-1: USB disconnect, device number 2 [ 642.360819][ C0] symbol ttyUSB0: symbol_int_callback - failed resubmitting read urb, error -19 [ 642.541657][ T10] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 642.544069][ T10] symbolserial 7-1:1.0: device disconnected [ 642.742084][T18343] overlayfs: failed to clone lowerpath [ 643.357669][ T38] audit: type=1326 audit(1786553118.903:72): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.357858][ T38] audit: type=1326 audit(1786553118.903:73): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.593567][ T38] audit: type=1326 audit(1786553119.123:74): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.593717][ T38] audit: type=1326 audit(1786553119.123:75): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.593766][ T38] audit: type=1326 audit(1786553119.123:76): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.593830][ T38] audit: type=1326 audit(1786553119.123:77): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.593878][ T38] audit: type=1326 audit(1786553119.133:78): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.595421][ T38] audit: type=1326 audit(1786553119.133:79): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.595473][ T38] audit: type=1326 audit(1786553119.133:80): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.595519][ T38] audit: type=1326 audit(1786553119.133:81): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=18360 comm="syz.5.5033" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cfe7e0d9 code=0x7ffc0000 [ 643.868263][T18370] overlayfs: failed to clone upperpath [ 645.380867][T18409] overlayfs: failed to resolve './cgroup': -2 [ 645.834369][T18425] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5057'. [ 646.661057][ T5831] IPVS: starting estimator thread 0... [ 646.776867][T18450] IPVS: using max 11 ests per chain, 26400 per kthread [ 647.290130][T18461] gadgetfs: bound to dummy_udc driver [ 650.008167][T18464] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5075'. [ 651.302094][T18469] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5075'. [ 651.302135][T18469] nbd: nbd64 already in use [ 651.506944][ T10] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 651.674590][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 651.685274][ T10] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 651.685308][ T10] usb 2-1: config 0 has no interface number 0 [ 651.685359][ T10] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 651.685390][ T10] usb 2-1: config 0 interface 85 has no altsetting 0 [ 651.697269][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 651.697304][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.697327][ T10] usb 2-1: Product: syz [ 651.697343][ T10] usb 2-1: Manufacturer: syz [ 651.697359][ T10] usb 2-1: SerialNumber: syz [ 651.900198][ T10] usb 2-1: config 0 descriptor?? [ 652.526098][ T10] appletouch 2-1:0.85: Geyser mode initialized. [ 652.569343][ T10] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input30 [ 653.257952][ T10] usb 2-1: USB disconnect, device number 29 [ 653.257952][ C1] appletouch 2-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 653.818248][T18519] netlink: 134 bytes leftover after parsing attributes in process `syz.1.5092'. [ 653.818732][T18519] netlink: 134 bytes leftover after parsing attributes in process `syz.1.5092'. [ 654.300998][ T10] appletouch 2-1:0.85: input: appletouch disconnected [ 655.912275][T18551] overlayfs: failed to clone upperpath [ 656.281204][ T8111] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 657.561420][T18577] syzkaller1: entered promiscuous mode [ 657.561452][T18577] syzkaller1: entered allmulticast mode [ 657.965641][T18599] overlayfs: failed to clone upperpath [ 658.376394][T18605] 9pnet: p9_errstr2errno: server reported unknown error 0x0 [ 659.475801][ T37] libceph: connect (1)[c::]:6789 error -101 [ 659.476023][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 659.497130][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 659.497355][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 659.498837][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 659.499032][ T37] libceph: connect (1)[c::]:6789 error -101 [ 659.500384][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 659.541780][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 659.758645][ T37] libceph: connect (1)[c::]:6789 error -101 [ 659.758864][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 659.803059][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 659.803283][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 660.096098][T18655] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5149'. [ 660.195369][T18629] ceph: No mds server is up or the cluster is laggy [ 660.195369][T18632] ceph: No mds server is up or the cluster is laggy [ 660.342613][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 660.342848][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 660.395077][ T37] libceph: connect (1)[c::]:6789 error -101 [ 660.395316][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 661.433474][T18678] syzkaller1: entered promiscuous mode [ 661.433511][T18678] syzkaller1: entered allmulticast mode [ 661.693866][T18684] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5161'. [ 662.189775][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 662.209697][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 662.211041][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 662.211260][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 662.242303][ T37] libceph: connect (1)[c::]:6789 error -101 [ 662.242522][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 662.245100][ T37] libceph: connect (1)[c::]:6789 error -101 [ 662.245361][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 662.468226][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 662.502806][ T37] libceph: connect (1)[c::]:6789 error -101 [ 662.513436][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 662.541964][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 662.854058][T18694] ceph: No mds server is up or the cluster is laggy [ 662.854313][T18690] ceph: No mds server is up or the cluster is laggy [ 662.993381][T18716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5165'. [ 663.035912][ T37] libceph: connect (1)[c::]:6789 error -101 [ 663.036129][ T37] libceph: mon0 (1)[c::]:6789 connect error [ 663.124458][ T5703] libceph: connect (1)[c::]:6789 error -101 [ 663.175644][ T5703] libceph: mon0 (1)[c::]:6789 connect error [ 665.754202][T18763] gadgetfs: bound to dummy_udc driver [ 666.871510][T18813] netlink: 'syz.0.5190': attribute type 12 has an invalid length. [ 667.039522][T18820] netlink: 'syz.1.5200': attribute type 1 has an invalid length. [ 667.039548][T18820] netlink: 'syz.1.5200': attribute type 4 has an invalid length. [ 667.039564][T18820] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.5200'. [ 668.637625][T18862] netlink: 'syz.5.5202': attribute type 1 has an invalid length. [ 668.637656][T18862] netlink: 'syz.5.5202': attribute type 4 has an invalid length. [ 668.637672][T18862] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.5202'. [ 669.400498][T18887] : renamed from vlan0 (while UP) [ 673.664783][T19036] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5278'. [ 675.782216][T19100] blktrace: Concurrent blktraces are not allowed on loop2 [ 678.162896][T19167] 9p: Bad value for 'rfdno' [ 678.887598][ T5605] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 679.036807][ T5605] usb 2-1: Using ep0 maxpacket: 32 [ 679.040539][ T5605] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 679.040573][ T5605] usb 2-1: config 0 has no interface number 0 [ 679.040626][ T5605] usb 2-1: config 0 interface 12 has no altsetting 0 [ 679.043530][ T5605] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 679.043562][ T5605] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 679.043585][ T5605] usb 2-1: Product: syz [ 679.043601][ T5605] usb 2-1: Manufacturer: syz [ 679.043617][ T5605] usb 2-1: SerialNumber: syz [ 679.070525][ T5605] usb 2-1: config 0 descriptor?? [ 680.055793][ T37] kernel read not supported for file /kmsg (pid: 37 comm: kworker/1:1) [ 680.417292][ T5605] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 680.417446][ T5605] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 680.417476][ T5605] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 680.417578][ T5605] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 680.550448][ T5605] usb 2-1: USB disconnect, device number 30 [ 681.425959][ T10] libceph: connect (1)[c::]:6789 error -101 [ 681.426307][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 681.516438][T19220] ceph: No mds server is up or the cluster is laggy [ 681.712319][ T5831] libceph: connect (1)[c::]:6789 error -101 [ 681.712537][ T5831] libceph: mon0 (1)[c::]:6789 connect error [ 683.891746][T19266] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5359'. [ 685.281710][T19309] netlink: 104 bytes leftover after parsing attributes in process `syz.6.5371'. [ 685.755251][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.755394][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.279457][ T69] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 689.501213][T19403] fuse: fd is not a fuse device [ 690.425051][T19420] gadgetfs: bound to dummy_udc driver [ 692.938190][T16550] Bluetooth: hci1: command 0x0406 tx timeout [ 695.016882][ T10] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 695.216820][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 695.219006][ T10] usb 7-1: config 0 has an invalid interface number: 12 but max is 0 [ 695.219040][ T10] usb 7-1: config 0 has no interface number 0 [ 695.219088][ T10] usb 7-1: config 0 interface 12 has no altsetting 0 [ 695.268500][ T10] usb 7-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 695.268539][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.268560][ T10] usb 7-1: Product: syz [ 695.268577][ T10] usb 7-1: Manufacturer: syz [ 695.268594][ T10] usb 7-1: SerialNumber: syz [ 695.276172][ T10] usb 7-1: config 0 descriptor?? [ 696.555020][ T10] f81534 7-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 696.555086][ T10] f81534 7-1:0.12: f81534_find_config_idx: read failed: -71 [ 696.555106][ T10] f81534 7-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 696.555212][ T10] f81534 7-1:0.12: probe with driver f81534 failed with error -71 [ 696.609463][ T10] usb 7-1: USB disconnect, device number 3 [ 697.564184][T19415] Set syz1 is full, maxelem 65536 reached [ 703.778398][T19577] Set syz1 is full, maxelem 65536 reached [ 703.935550][T19626] ================================================================== [ 703.935584][T19626] BUG: KASAN: slab-use-after-free in rt_spin_lock+0x83/0x400 [ 703.935636][T19626] Read of size 1 at addr ffff88805e9a2fd8 by task syz.1.5490/19626 [ 703.935656][T19626] [ 703.935681][T19626] CPU: 0 UID: 0 PID: 19626 Comm: syz.1.5490 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 703.935728][T19626] Tainted: [L]=SOFTLOCKUP [ 703.935738][T19626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 703.935754][T19626] Call Trace: [ 703.935770][T19626] [ 703.935782][T19626] dump_stack_lvl+0xe8/0x150 [ 703.935816][T19626] print_address_description+0x55/0x1e0 [ 703.935853][T19626] ? rt_spin_lock+0x83/0x400 [ 703.935882][T19626] print_report+0x58/0x70 [ 703.935915][T19626] kasan_report+0x117/0x150 [ 703.935938][T19626] ? rt_spin_lock+0x83/0x400 [ 703.935972][T19626] __kasan_check_byte+0x2a/0x40 [ 703.936010][T19626] lock_acquire+0x7d/0x350 [ 703.936053][T19626] rt_spin_lock+0x83/0x400 [ 703.936081][T19626] ? ref_tracker_debugfs_show+0x106/0x1c0 [ 703.936116][T19626] ? __pfx_rt_spin_lock+0x10/0x10 [ 703.936151][T19626] ref_tracker_debugfs_show+0x106/0x1c0 [ 703.936184][T19626] ? __pfx_ref_tracker_debugfs_show+0x10/0x10 [ 703.936217][T19626] ? seq_read_iter+0x1eb/0xcb0 [ 703.936249][T19626] ? __kvmalloc_node_noprof+0x5cc/0x880 [ 703.936285][T19626] ? seq_read_iter+0x1eb/0xcb0 [ 703.936320][T19626] seq_read_iter+0x464/0xcb0 [ 703.936360][T19626] seq_read+0x36a/0x490 [ 703.936395][T19626] ? __pfx_seq_read+0x10/0x10 [ 703.936426][T19626] ? __debugfs_file_get+0x5d5/0x710 [ 703.936461][T19626] ? __pfx___debugfs_file_get+0x10/0x10 [ 703.936500][T19626] full_proxy_read+0x127/0x1f0 [ 703.936535][T19626] ? __pfx_full_proxy_read+0x10/0x10 [ 703.936568][T19626] vfs_read+0x219/0xa90 [ 703.936597][T19626] ? __pfx_vfs_read+0x10/0x10 [ 703.936620][T19626] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 703.936641][T19626] ? lockdep_hardirqs_on+0x7a/0x110 [ 703.936661][T19626] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 703.936681][T19626] ? mutex_lock_nested+0x152/0x1d0 [ 703.936715][T19626] ? fdget_pos+0x252/0x320 [ 703.936744][T19626] ksys_read+0x156/0x270 [ 703.936773][T19626] ? __pfx_ksys_read+0x10/0x10 [ 703.936805][T19626] do_syscall_64+0x17b/0x530 [ 703.936828][T19626] ? irqentry_exit+0x10f/0x8f0 [ 703.936850][T19626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.936874][T19626] ? clear_bhb_loop+0x40/0x90 [ 703.936899][T19626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.936923][T19626] RIP: 0033:0x7fea3ce3e0d9 [ 703.936946][T19626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.936965][T19626] RSP: 002b:00007fea3b096028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 703.936991][T19626] RAX: ffffffffffffffda RBX: 00007fea3d0c5fa0 RCX: 00007fea3ce3e0d9 [ 703.937009][T19626] RDX: 0000000000000041 RSI: 0000200000000580 RDI: 0000000000000004 [ 703.937026][T19626] RBP: 00007fea3ced5024 R08: 0000000000000000 R09: 0000000000000000 [ 703.937041][T19626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 703.937056][T19626] R13: 00007fea3d0c6038 R14: 00007fea3d0c5fa0 R15: 00007ffc7c10ab18 [ 703.937084][T19626] [ 703.937092][T19626] [ 703.937107][T19626] Allocated by task 19197: [ 703.937193][T19626] kasan_save_track+0x3e/0x80 [ 703.937227][T19626] __kasan_slab_alloc+0x6c/0x80 [ 703.937259][T19626] kmem_cache_alloc_noprof+0x358/0x680 [ 703.937289][T19626] copy_net_ns+0x1e0/0x720 [ 703.937315][T19626] create_new_namespaces+0x3f0/0x6b0 [ 703.937333][T19626] copy_namespaces+0x432/0x4b0 [ 703.937349][T19626] copy_process+0x1ec8/0x43f0 [ 703.937367][T19626] kernel_clone+0x2d7/0x940 [ 703.937386][T19626] __x64_sys_clone+0x1b6/0x230 [ 703.937406][T19626] do_syscall_64+0x17b/0x530 [ 703.937422][T19626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.937439][T19626] [ 703.937443][T19626] Freed by task 1516: [ 703.937451][T19626] kasan_save_track+0x3e/0x80 [ 703.937475][T19626] kasan_save_free_info+0x40/0x50 [ 703.937494][T19626] __kasan_slab_free+0x5c/0x80 [ 703.937518][T19626] kmem_cache_free+0x187/0x6c0 [ 703.937543][T19626] cleanup_net+0x5e0/0x810 [ 703.937564][T19626] process_one_work+0xaaf/0x1480 [ 703.937581][T19626] worker_thread+0xb05/0x10d0 [ 703.937598][T19626] kthread+0x388/0x470 [ 703.937621][T19626] ret_from_fork+0x514/0xb70 [ 703.937644][T19626] ret_from_fork_asm+0x1a/0x30 [ 703.937669][T19626] [ 703.937673][T19626] The buggy address belongs to the object at ffff88805e9a2c40 [ 703.937673][T19626] which belongs to the cache net_namespace of size 11072 [ 703.937736][T19626] The buggy address is located 920 bytes inside of [ 703.937736][T19626] freed 11072-byte region [ffff88805e9a2c40, ffff88805e9a5780) [ 703.937756][T19626] [ 703.937762][T19626] The buggy address belongs to the physical page: [ 703.937809][T19626] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805e9a0000 pfn:0x5e9a0 [ 703.937830][T19626] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 703.937845][T19626] memcg:ffff88805e9a5881 [ 703.937853][T19626] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 703.937872][T19626] page_type: f5(slab) [ 703.937872][T19626] page_type: f5(slab) [ 703.937889][T19626] raw: 0080000000000240 ffff88801c6af280 ffffea00017b9810 ffffea0000e1da10 [ 703.937908][T19626] raw: ffff88805e9a0000 0000000800020000 00000000f5000000 ffff88805e9a5881 [ 703.937926][T19626] head: 0080000000000240 ffff88801c6af280 ffffea00017b9810 ffffea0000e1da10 [ 703.937943][T19626] head: ffff88805e9a0000 0000000800020000 00000000f5000000 ffff88805e9a5881 [ 703.937959][T19626] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 703.937975][T19626] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 703.937984][T19626] page dumped because: kasan: bad access detected [ 703.937999][T19626] page_owner tracks the page as allocated [ 703.938006][T19626] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6527, tgid 6527 (syz-executor), ts 158539246635 [ 703.938036][T19626] post_alloc_hook+0x1f9/0x250 [ 703.938060][T19626] get_page_from_freelist+0x264c/0x26c0 [ 703.938090][T19626] __alloc_frozen_pages_noprof+0x222/0x5b0 [ 703.938119][T19626] allocate_slab+0x7c/0x5e0 [ 703.938138][T19626] refill_objects+0x2d8/0x350 [ 703.938157][T19626] __pcs_replace_empty_main+0x330/0x690 [ 703.938176][T19626] kmem_cache_alloc_noprof+0x455/0x680 [ 703.938200][T19626] copy_net_ns+0x1e0/0x720 [ 703.938219][T19626] create_new_namespaces+0x3f0/0x6b0 [ 703.938235][T19626] unshare_nsproxy_namespaces+0x149/0x190 [ 703.938252][T19626] ksys_unshare+0x5a7/0x950 [ 703.938271][T19626] __x64_sys_unshare+0x38/0x50 [ 703.938295][T19626] do_syscall_64+0x17b/0x530 [ 703.938311][T19626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.938327][T19626] page last free pid 5813 tgid 5813 ts 158260252363 stack trace: [ 703.938339][T19626] __free_frozen_pages+0x1185/0x1270 [ 703.938363][T19626] __slab_free+0x252/0x2a0 [ 703.938387][T19626] qlist_free_all+0x99/0x100 [ 703.938409][T19626] kasan_quarantine_reduce+0x148/0x160 [ 703.938433][T19626] __kasan_slab_alloc+0x22/0x80 [ 703.938460][T19626] kmem_cache_alloc_noprof+0x358/0x680 [ 703.938484][T19626] vm_area_dup+0x28/0x670 [ 703.938511][T19626] __split_vma+0x1f3/0xbd0 [ 703.938529][T19626] vms_gather_munmap_vmas+0x4e3/0x1370 [ 703.938546][T19626] do_vmi_align_munmap+0x2c7/0x4d0 [ 703.938561][T19626] do_vmi_munmap+0x252/0x2d0 [ 703.938577][T19626] __vm_munmap+0x241/0x3e0 [ 703.938594][T19626] __x64_sys_munmap+0x60/0x70 [ 703.938617][T19626] do_syscall_64+0x17b/0x530 [ 703.938632][T19626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.938649][T19626] [ 703.938653][T19626] Memory state around the buggy address: [ 703.938663][T19626] ffff88805e9a2e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 703.938675][T19626] ffff88805e9a2f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 703.938688][T19626] >ffff88805e9a2f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 703.938697][T19626] ^ [ 703.938713][T19626] ffff88805e9a3000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 703.938726][T19626] ffff88805e9a3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 703.938735][T19626] ================================================================== [ 704.482308][T19626] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 704.482340][T19626] CPU: 0 UID: 0 PID: 19626 Comm: syz.1.5490 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 704.482373][T19626] Tainted: [L]=SOFTLOCKUP [ 704.482380][T19626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 704.482395][T19626] Call Trace: [ 704.482406][T19626] [ 704.482417][T19626] vpanic+0x56c/0xa60 [ 704.482448][T19626] ? __pfx_vpanic+0x10/0x10 [ 704.482468][T19626] ? __pfx___schedule+0x10/0x10 [ 704.482500][T19626] panic+0xc5/0xd0 [ 704.482519][T19626] ? __pfx_panic+0x10/0x10 [ 704.482538][T19626] ? preempt_schedule_thunk+0x16/0x40 [ 704.482564][T19626] ? rt_spin_lock+0x83/0x400 [ 704.482589][T19626] check_panic_on_warn+0x89/0xb0 [ 704.482616][T19626] ? rt_spin_lock+0x83/0x400 [ 704.482639][T19626] end_report+0x73/0x170 [ 704.482666][T19626] ? rt_spin_lock+0x83/0x400 [ 704.482690][T19626] kasan_report+0x128/0x150 [ 704.482710][T19626] ? rt_spin_lock+0x83/0x400 [ 704.482739][T19626] __kasan_check_byte+0x2a/0x40 [ 704.482768][T19626] lock_acquire+0x7d/0x350 [ 704.482803][T19626] rt_spin_lock+0x83/0x400 [ 704.482826][T19626] ? ref_tracker_debugfs_show+0x106/0x1c0 [ 704.482856][T19626] ? __pfx_rt_spin_lock+0x10/0x10 [ 704.482884][T19626] ref_tracker_debugfs_show+0x106/0x1c0 [ 704.482910][T19626] ? __pfx_ref_tracker_debugfs_show+0x10/0x10 [ 704.482937][T19626] ? seq_read_iter+0x1eb/0xcb0 [ 704.482963][T19626] ? __kvmalloc_node_noprof+0x5cc/0x880 [ 704.482993][T19626] ? seq_read_iter+0x1eb/0xcb0 [ 704.483020][T19626] seq_read_iter+0x464/0xcb0 [ 704.483053][T19626] seq_read+0x36a/0x490 [ 704.483080][T19626] ? __pfx_seq_read+0x10/0x10 [ 704.483105][T19626] ? __debugfs_file_get+0x5d5/0x710 [ 704.483135][T19626] ? __pfx___debugfs_file_get+0x10/0x10 [ 704.483171][T19626] full_proxy_read+0x127/0x1f0 [ 704.483200][T19626] ? __pfx_full_proxy_read+0x10/0x10 [ 704.483226][T19626] vfs_read+0x219/0xa90 [ 704.483250][T19626] ? __pfx_vfs_read+0x10/0x10 [ 704.483271][T19626] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 704.483297][T19626] ? lockdep_hardirqs_on+0x7a/0x110 [ 704.483317][T19626] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 704.483337][T19626] ? mutex_lock_nested+0x152/0x1d0 [ 704.483361][T19626] ? fdget_pos+0x252/0x320 [ 704.483385][T19626] ksys_read+0x156/0x270 [ 704.483407][T19626] ? __pfx_ksys_read+0x10/0x10 [ 704.483432][T19626] do_syscall_64+0x17b/0x530 [ 704.483451][T19626] ? irqentry_exit+0x10f/0x8f0 [ 704.483470][T19626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.483491][T19626] ? clear_bhb_loop+0x40/0x90 [ 704.483514][T19626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.483536][T19626] RIP: 0033:0x7fea3ce3e0d9 [ 704.483556][T19626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 704.483575][T19626] RSP: 002b:00007fea3b096028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 704.483598][T19626] RAX: ffffffffffffffda RBX: 00007fea3d0c5fa0 RCX: 00007fea3ce3e0d9 [ 704.483613][T19626] RDX: 0000000000000041 RSI: 0000200000000580 RDI: 0000000000000004 [ 704.483626][T19626] RBP: 00007fea3ced5024 R08: 0000000000000000 R09: 0000000000000000 [ 704.483640][T19626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 704.483661][T19626] R13: 00007fea3d0c6038 R14: 00007fea3d0c5fa0 R15: 00007ffc7c10ab18 [ 704.483686][T19626] [ 704.487913][T19626] Kernel Offset: disabled