last executing test programs: 5.18252727s ago: executing program 0 (id=1054): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r3, &(0x7f0000000400)='./fi', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='tcp\n', 0x4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r6, &(0x7f00000005c0)='ipv4\n', 0x5) r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa) r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r8, &(0x7f00000006c0)='4420', 0x4) r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0) write(r9, &(0x7f0000000740)='1024\n', 0x5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') 4.209743744s ago: executing program 0 (id=1062): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000001b40)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x54, [0x39, 0x2, 0x4000401, 0x8, 0xe, 0x0, 0x10000, 0x0, 0x3, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x7fffffff, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0xb7b6, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x9ffffffc, 0x3, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x4, 0x0, 0x2, 0x400, 0x0, 0x0, 0x8, 0x40000, 0x0, 0xc0800000, 0x100, 0x0, 0x1a0fadaf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, 0x6, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0x2, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0x0, 0x881, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x20, 0x0, 0x5, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0x6, 0x80000000, 0x0, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x3, 0x0, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0xfffffffc, 0x4, 0xf88], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffefffe, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x5, 0x3, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x1000000, 0x0, 0x1, 0x0, 0x4, 0x10, 0x5, 0xfffffffe, 0xfff, 0x1, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x2, 0x0, 0x20, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) read$FUSE(0xffffffffffffffff, &(0x7f00000028c0)={0x2020}, 0x2020) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xd82, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000200)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r2, &(0x7f00000002c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000340)='./my_debugfs\x00', &(0x7f0000000380)='debugfs\x00', 0x0, 0x0) r4 = memfd_create(&(0x7f00000003c0)='\xff\x00l\x1e\xa0,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[\x93\xfe{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG', 0x6) fallocate(r4, 0x3, 0x1, 0xfffffffb) ioctl$UI_DEV_CREATE(r0, 0x5501) read$usbmon(0xffffffffffffffff, &(0x7f0000000140)=""/47, 0x2f) 4.064804508s ago: executing program 4 (id=1065): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000340), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x2) recvmmsg(r1, &(0x7f00000003c0), 0x10106, 0x2, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mkdir(&(0x7f00000004c0)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='dir0\x00', &(0x7f0000000640)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000680)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x800, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 2.824771139s ago: executing program 4 (id=1067): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_dev$dvb_demux(&(0x7f0000000200), 0x0, 0x41) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000480)='.\x00', &(0x7f00000004c0), 0x6, &(0x7f0000000500)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 2.761347181s ago: executing program 0 (id=1068): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc0002060, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'veth0_vlan\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1c, 0x40, 0x7, 0x9, 0xa400, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5}, 0x50) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) statfs(&(0x7f0000000040)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) 2.185097205s ago: executing program 2 (id=1074): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000400)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000700)={0x97, 0xfd, 0x8, 0xfb, 0x5, 0x2, 0x0, 0x8, 0x5, 0x1, 0xd, 0xfd, 0x0, 0xac}, 0xe) sendmsg$inet6(r0, &(0x7f0000000740)={&(0x7f0000000780)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000800)="88", 0x1}], 0x1}, 0x4048043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000840)='team_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000880)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2, 0xfffc, 0xe652, 0x2, 0x85, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0xff80, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) 2.136878466s ago: executing program 2 (id=1075): r0 = socket(0xa, 0x5, 0x0) listen(r0, 0x100) sendmsg$inet_sctp(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="18"], 0x18, 0x40}, 0x20048844) 2.060575198s ago: executing program 1 (id=1076): r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000001b40)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x54, [0x39, 0x2, 0x4000401, 0x8, 0xe, 0x0, 0x10000, 0x0, 0x3, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x7fffffff, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0xb7b6, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x9ffffffc, 0x3, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x4, 0x0, 0x2, 0x400, 0x0, 0x0, 0x8, 0x40000, 0x0, 0xc0800000, 0x100, 0x0, 0x1a0fadaf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, 0x6, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0x2, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0x0, 0x881, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x20, 0x0, 0x5, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0x6, 0x80000000, 0x0, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x3, 0x0, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0xfffffffc, 0x4, 0xf88], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffefffe, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x5, 0x3, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x1000000, 0x0, 0x1, 0x0, 0x4, 0x10, 0x5, 0xfffffffe, 0xfff, 0x1, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x2, 0x0, 0x20, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_DEV_CREATE(r0, 0x5501) 2.032836269s ago: executing program 1 (id=1077): mkdirat(0xffffffffffffff9c, &(0x7f0000000dc0)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000e00)='./trace\x00', &(0x7f0000000e40)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./trace/set_event\x00', 0x2, 0x0) pread64(r0, &(0x7f0000000ec0)=""/79, 0x4f, 0x1b) 1.952471551s ago: executing program 1 (id=1079): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dce, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0x8000, 0x6, 0xfc000004, 0x403, 0xbbf, 0x800003, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0xa, 0x4, 0x100002, 0xc3, 0x5d6, 0x80, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x6, 0x15, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x0, 0x9, 0xffffffff, 0x5, 0x81, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x4, 0x5, 0x491, 0x9, 0x8, 0x1, 0x400, 0x102, 0x1, 0x41, 0x5, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x7, 0x7ff, 0xff, 0x1001, 0x10000001, 0x7, 0x21, 0x9, 0x80, 0x7, 0x1000, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xb, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$KVM_CAP_MAX_VCPU_ID(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0x80, 0x0, 0x1}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, &(0x7f00000001c0)=0x7f, 0x4) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000240)=@target={'target ', {'PCI:', '5', ':', 'b', ':', 'd', '.', '1e'}}, 0x14) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000340)={0x53, 0xfffffffffffffffe, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0xfffffff9, 0x0, 0x3, 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.952329061s ago: executing program 2 (id=1080): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x5, 0x4, 0x1, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x16, 0xb, &(0x7f0000000bc0)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x0, 0xe, 0x0, &(0x7f0000000d00)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.856361014s ago: executing program 3 (id=1082): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001440), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001a80)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001b00)={&(0x7f00000031c0)=ANY=[@ANYBLOB="e0100000", @ANYRES16=r2, @ANYBLOB="0500000003000000000001000000060006004e240000901008809005002024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b24000100000000000000000000000000000000000000000000000000000000000000000024000200fcbefe9641719404cc5c9ab2766dd4793e367b0ea55e65e2e3416ac9d4e68841240002001171ee8da334a5099295af229a5d237a7f4102f01f28b34347d6cbbe135d83ec24000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691cb40409807c000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200ff0100000000000000000000000000010500030001000000060001000200000008000200e00000010500030000000000f4000080060001000a00000014000200fc0000000000000000000000000000000500030001000000060001000a00000014000200fc0200000000000000000000000000010500030000000000060001000200000008000200e00000020500030003000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414bb0500030001000000060001000200000008000200ac1414bb0500030000000000060001000a00000014000200000000000000000000000000000000010500030002000000060001000a00000014000200fc0200000000000000000000000000000500030003000000340000800600010002000000080002000a0101010500030004000000060001000200000008000200ac1414aa050003000300000064000080060001000a00000014000200200100000000000000000000000000000500030002000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200ff010000000000000000000000000001050003000200000094000080060001000200000008000200ac1e00010500030002000000060001000200000008000200e00000010500030002000000060001000a00000014000200fc0000000000000000000000000000000500030002000000060001000200000008000200000000000500030003000000060001000a00000014000200fe80000000000000000000000000000e050003000000000040000080060001000a00000014000200fc0200000000000000000000000000000500030002000000060001000200000008000200ac1414aa050003000000000064000080060001000a00000014000200200100000000000000000000000000020500030001000000060001000a00000014000200fc02000000000000000000000000000105000300020000000600010002000000080002000a010100050003000200000070000080060001000a00000014000200ff0200000000000000000000000000010500030000000000060001000a00000014000200000000000000000000000000000000000500030002000000060001000a0000001400020000000000000000000000000000000001050003000000000000010080060001000a00000014000200ff0200000000000000000000000000010500030000000000060001000200000008000200000000000500030003000000060001000200000008000200640101000500030002000000060001000200000008000200640101010500030001000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fe8000000000000000000000000000bb05000300020000000600010002000000080002007f0000010500030002000000060001000a00000014000200fc0200000000000000000000000000010500030003000000060001000200000008000200640101010500030001000000240002005da952055e5857d673cddd36909746c80efa3ff95c317de1063db32bc80a0b3e1803008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39220600050005000000e802098058000080060001000200000008000200ac1e00010500030001000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200ffffffff05000300010000007c000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a000000140002000000000000000000000000000000000105000300020000000600010002000000080002000a0101010500030003000000f4000080060001000a0000001400020000000000000000000000ffffac1414aa0500030003000000060001000200000008000200ac1414aa05000300000000000600010002000000080002000a01010205000300020000000600010002000000080002007f00000105000300000000000600010002000000080002000a0101010500030003000000060001000200000008000200e00000010500030003000000060001000a00000014000200fc01000000000000000000000000000005000300010000000600010002000000080002000a0101000500030000000000060001000200000008000200ac1e0101050003000200000094000080060001000a00000014000200fc0200000000000000000000000000010500030002000000060001000a00000014000200ff0100000000000000000000000000010500030001000000060001000200000008000200e00000010500030002000000060001000200000008000200ac1414bb0500030001000000060001000200000008000200ffffffff050003000200000088000080060001000a00000014000200fe8000000000000000000000000000aa0500030001000000060001000200000008000200ac1414aa0500030002000000060001000a00000014000200fe8800000000000000000000000001010500030002000000060001000a00000014000200ff02000000000000000000000000000105000300020000007c000080200004000a004e2100000006fc0100000000000000000000000000010400000008000a000100000024000100f44da367a88ee6564f020211456727082f5debee8b1bf5eb7337341b459b3922080003000300000024000200379aa288b2244a5b504ba04bea45625d328fb93b62e607a1b2e4da2f7f76a549780000800800030001000000080003000400000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e22000000000000000000000000e4060080dc020980f4000080060001000a00000014000200000000000000000000000000000000000500030002000000060001000a00000014000200fc0000000000000000000000000000000500030001000000060001000200000008000200ffffffff0500030001000000060001000200000008000200ac1e00010500030001000000060001000200000008000200e000000105000300020000000600010002000000080002007f0000010500030002000000060001000a00000014000200000000000000000000000000000000010500030001000000060001000a00000014000200fc010000000000000000000000000001050003000300000034000080060001000200000008000200640101000500030001000000060001000200000008000200ac1414bb050003000200000000010080060001000a00000014000200200100000000000000000000000000010500030000000000060001000200000008000200e000000205000300020000000600010002000000080002006401010005000300020000000600010002000000080002007f00000105000300010000000600010002000000080002007f0000010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff0500030000000000060001000200000008000200e00000010500030003000000060001000a00000014000200fc0100000000000000000000000000010500030000000000940000800600010002000000080002006401010005000300010000000600010002000000080002006401010205000300000000000600010002000000080002007f0000010500030003000000060001000200000008000200e00000020500030003000000060001000200000008000200ac1414120500030002000000060001000200000008000200ac14142d05000300020000001c000080060001000200000008000200ffffffff05000300030000000800030002000000200004000a004e2000000005fc010000000000000000000000000001000000009403098094000080060001000a0000001400020000000000000000000000ffffac1414bb0500030003000000060001000a00000014000200fe8800000000000000000000000000010500030002000000060001000a00000014000200ff0100000000000000000000000000010500030003000000060001000a00000014000200fe880000000000000000000000000101050003000100000064000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414bb0500030001000000060001000a0000001400020000000000000000000000ffffe00000020500030003000000f4000080060001000200000008000200000000000500030001000000060001000a00000014000200000000000000000000000000000000010500030003000000060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fe80000000000000000000000000003e05000300010000000600010002000000080002007f0000010500030001000000060001000a00000014000200ff0200000000000000000000000000010500030001000000060001000a00000014000200000000000000000000000000000000010500030000000000060001000200000008000200e0000001050003000000000058000080060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ac1414410500030010000000060001000200000008000200ac1e00010500030001000000f4000080060001000200000008000200640101000500030002000000060001000a00000014000200200100000000000000000000000000000500030000000000060001000a00000014000200fc0200000000000000000000000000010500030003000000060001000a00000014000200fe8000000000000000000000000000aa0500030003000000060001000200000008000200ac1414aa0500030000000000060001000200000008000200000000000500030000000000060001000200000008000200ac1414270500030000000000060001000a0000001400020020010000000000000000000000000002050003000100000058000080060001000200000008000200ac1414aa0500030001000000060001000a00000014000200fe8000000000000000000000000000140500030000000000060001000200000008000200e0000001050003000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240002000f1b8b82264208ab1a2dce776c03b9f348f500ef8e7606466943f5ba2ae2881e0c0000800800030006000000060006004e24000008000100", @ANYRES32=r3, @ANYBLOB="240003"], 0x10e0}}, 0x0) 1.842009234s ago: executing program 2 (id=1083): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1\n', 0x2) write(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='tcp\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='ipv4\n', 0x5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='127.0.0.1\n', 0xa) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r7, &(0x7f00000006c0)='4420', 0x4) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0) write(r8, &(0x7f0000000740)='1024\n', 0x5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') 1.784798995s ago: executing program 3 (id=1084): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r3, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='tcp\n', 0x4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r6, &(0x7f00000005c0)='ipv4\n', 0x5) r7 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r7, &(0x7f0000000640)='127.0.0.1\n', 0xa) r8 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r8, &(0x7f00000006c0)='4420', 0x4) r9 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0) write(r9, &(0x7f0000000740)='1024\n', 0x5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') 1.779279006s ago: executing program 1 (id=1085): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x31, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x8000, 0x8f, 0x0, 0x7}, 0xe3, 0x1, 0x1, 0x7, 0xff7, 0xc, 0x1, 0x10, 0x7, 0x7, {0x6, 0xfff, 0x10, 0xfffc, 0x69f, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) socket$kcm(0x11, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x0, 0x8, 0x4, 0x40}, 0x1000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000005c0), 0x801, 0x0) write$rfkill(r6, &(0x7f0000000600)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) 1.772545726s ago: executing program 0 (id=1086): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000400)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000700)={0x97, 0xfd, 0x8, 0xfb, 0x5, 0x2, 0x0, 0x8, 0x5, 0x1, 0xd, 0xfd, 0x0, 0xac}, 0xe) sendmsg$inet6(r0, &(0x7f0000000740)={&(0x7f0000000780)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000800)="88", 0x1}], 0x1}, 0x4048043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000840)='team_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000880)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2, 0xfffc, 0xe652, 0x2, 0x85, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000980)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0xff80, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) 1.667412168s ago: executing program 3 (id=1087): r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000001b40)={'syz0\x00', {0x0, 0x0, 0x0, 0x2}, 0x54, [0x39, 0x2, 0x4000401, 0x8, 0xe, 0x0, 0x10000, 0x0, 0x3, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2a, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xfffffffd, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x7fffffff, 0xfffffffc, 0x5, 0xfffffff6, 0x0, 0x8, 0xb7b6, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x20000, 0x2000000, 0xedc0, 0x0, 0x5ee, 0x5, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x9ffffffc, 0x3, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0xfffffff8, 0x4, 0x0, 0x2, 0x400, 0x0, 0x0, 0x8, 0x40000, 0x0, 0xc0800000, 0x100, 0x0, 0x1a0fadaf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, 0x6, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0x2, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x80, 0x0, 0x881, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x20, 0x0, 0x5, 0x4000, 0x6, 0x0, 0x0, 0x200, 0x2, 0x6, 0x80000000, 0x0, 0x47fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x3, 0x0, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0xfffffffc, 0x4, 0xf88], [0xfffffffe, 0x0, 0x4, 0x0, 0xfffefffe, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x5, 0x3, 0xfffffffc, 0x4, 0x803, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x1000000, 0x0, 0x1, 0x0, 0x4, 0x10, 0x5, 0xfffffffe, 0xfff, 0x1, 0x4, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x2, 0x0, 0x20, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) ioctl$UI_DEV_CREATE(r0, 0x5501) 1.666217838s ago: executing program 0 (id=1088): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r6 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r6, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f00000001c0)={0x8, "b546baa5cc590d30d4d8b40d29968173b959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f0000000780)={"b93b0500000000000000c1fb10628c8ebb0ddd5f497e5600", r8, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r9, 0x40103e05, &(0x7f00000000c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.60464503s ago: executing program 4 (id=1089): r0 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000200)=0x80, 0x4) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000400)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x80c) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000640)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000c00)=ANY=[@ANYBLOB="5bf7bbea5ed8174fce27a9fd9b6b84cbc79ee51534a449dc5a98bd162de2e52ea4d3865332e3d1e6c802325fc015cd636691e177df49bb6685559b87a329128c42fd0983ba181b152ae7874d55232727a6e8bc05118c02acef5cc00f8f822c16b426f74f10ad66c546a31d68c22e016818a4", @ANYRES16, @ANYRES16=0x0, @ANYRES16], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800) listen(r2, 0xfffffffc) 1.495446773s ago: executing program 2 (id=1090): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 1.495245253s ago: executing program 3 (id=1091): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x34, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) symlink(0x0, &(0x7f0000000300)='./file0/file0\x00') r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r4, &(0x7f0000001180)={0x2020}, 0x2020) rename(&(0x7f0000000580)='./file0\x00', 0x0) symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') r5 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r5, &(0x7f00000005c0), 0x10) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, &(0x7f0000000640), 0xf00) close(r5) mount$nfs(&(0x7f0000000340)=')./.,\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0), 0x80000, 0x0) 1.459702503s ago: executing program 4 (id=1092): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x4e20, 0x0, 'lblc\x00', 0x1, 0x12c, 0xffffffff}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000140)={{0x6, @local, 0x4e20, 0x0, 'rr\x00', 0x1, 0x12c, 0xffffffff}, {@remote, 0x4e20, 0x0, 0x1}}, 0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'bridge0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="3c0000001000030500000400fddbdf250000", @ANYRES32=0x0, @ANYBLOB="61000100000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r5 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r5, 0x10f, 0x81, &(0x7f00000005c0), 0x4) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000900)={'bridge0\x00', &(0x7f0000000940)=@ethtool_rxfh={0x1}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x1e, 0x4, &(0x7f0000000c40)=ANY=[@ANYBLOB="18000000000000000000000000000000711824000000000095"], &(0x7f0000000c80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x24}, 0x94) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x4e20, @local}, 0x10) 1.168092911s ago: executing program 4 (id=1093): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000bc0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000c40)={[0x60000000004, 0x1000000000, 0x80000000000005, 0x41, 0x2000000, 0x0, 0x2004cb, 0xffffffffeffffffe, 0xa1d, 0x9, 0x5, 0x0, 0x3, 0x2, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000d00)=@x86={0x33, 0x9, 0x6, 0x0, 0x2, 0x1, 0x10, 0x0, 0x81, 0x81, 0x6e, 0x7, 0x0, 0x8, 0x8, 0xfd, 0x6d, 0x10, 0x9, '\x00', 0x8, 0x3}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000d40)={{0x0, 0xeeee0000, 0x0, 0x0, 0x8, 0x0, 0x7, 0x2, 0x0, 0x8, 0x9, 0x10}, {0x2, 0x200000, 0xb, 0xff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7}, {0x2000, 0x5000, 0xc, 0xff, 0x4, 0x4, 0x0, 0x0, 0x3, 0xf6, 0x0, 0xfc}, {0x3000, 0xd000, 0x0, 0x0, 0x0, 0xf9, 0xff, 0x0, 0x8, 0x0, 0x89, 0xfc}, {0xeeee8000, 0xffff1000, 0x9, 0xff, 0xfc, 0x8, 0x0, 0x0, 0x0, 0x2, 0x0, 0x11}, {0x1000, 0x0, 0xd, 0x0, 0x8, 0xfd, 0x42, 0x0, 0xff, 0x0, 0x5}, {0xdddd1000, 0xeeef0000, 0x3, 0xfe, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x4}, {0x100000, 0x1, 0x0, 0x0, 0x4, 0x1, 0x0, 0x8, 0x26}, {0x1, 0x7}, {0xd000}, 0xddf8ffdb, 0x0, 0x10000, 0x50, 0x10000, 0x0, 0x0, [0x0, 0x20000000, 0x1, 0x40]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 640.578464ms ago: executing program 0 (id=1094): openat(0xffffffffffffff9c, 0x0, 0x20842, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) bind$can_raw(r4, &(0x7f0000000180), 0x10) sendmsg$can_raw(r4, &(0x7f00000024c0)={&(0x7f0000002500), 0x10, &(0x7f0000002540)={&(0x7f0000002580)=@can={{0x1, 0x0, 0x1, 0x1}, 0x7, 0x2, 0x0, 0x0, "00119a7d1a39f603"}, 0x10}}, 0x4000040) mount(&(0x7f0000000500)=@filename='127.0.0.1:/\x00', &(0x7f0000000540)='./file2\x00', &(0x7f0000000580)='nfs\x00', 0x0, &(0x7f00000005c0)='addr=127.0.0.1,vers=3,proto=udp\x00') sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) socket$nl_netfilter(0x10, 0x3, 0xc) semop(0x0, &(0x7f0000000080)=[{0x3, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) 401.0178ms ago: executing program 1 (id=1095): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dce, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0x8000, 0x6, 0xfc000004, 0x403, 0xbbf, 0x800003, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0xa, 0x4, 0x100002, 0xc3, 0x5d6, 0x80, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x6, 0x15, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x0, 0x9, 0xffffffff, 0x5, 0x81, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x4, 0x5, 0x491, 0x9, 0x8, 0x1, 0x400, 0x102, 0x1, 0x41, 0x5, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x7, 0x7ff, 0xff, 0x1001, 0x10000001, 0x7, 0x21, 0x9, 0x80, 0x7, 0x1000, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xb, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$KVM_CAP_MAX_VCPU_ID(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0x80, 0x0, 0x1}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, &(0x7f00000001c0)=0x7f, 0x4) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000240)=@target={'target ', {'PCI:', '5', ':', 'b', ':', 'd', '.', '1e'}}, 0x14) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000340)={0x53, 0xfffffffffffffffe, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0xfffffff9, 0x0, 0x3, 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 374.666501ms ago: executing program 2 (id=1096): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x250, 0xfd, 0x51, 0x5c, 0x8, 0x2013, 0x25c, 0xa4f9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xc, 0x5, 0x20, 0xb, "", [{{0x9, 0x4, 0x7e, 0x9, 0x0, 0xf0, 0x9e, 0x6a, 0x5}}]}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000300)={0x2c, &(0x7f0000000340)={0x0, 0x31, 0x1, "ad"}, 0x0, 0x0, 0x0, 0x0}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000001580)={0x2c, &(0x7f0000001380)={0x0, 0x10, 0x9, "ae1d21c922be2cb763"}, 0x0, 0x0, 0x0, 0x0}) 148.581356ms ago: executing program 3 (id=1097): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000500)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000640)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000680)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x8, 0x0, &(0x7f0000000700)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000740)={0x4c, 0x0, &(0x7f0000000780)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000800)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000880)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000980)={0x44, 0x0, &(0x7f00000001c0)=[@transaction={0x40406300, {0x3, 0x0, 0x3, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x100, 0x3}, @flat=@handle={0x73682a85, 0x100, 0x0, 0x2}, @flat=@handle={0x73682a85, 0x1000, 0x3, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 113.257767ms ago: executing program 4 (id=1098): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0xc0002060, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'veth0_vlan\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1c, 0x40, 0x7, 0x9, 0xa400, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5}, 0x50) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) statfs(&(0x7f0000000040)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) umount2(&(0x7f0000000040)='.\x00', 0x2) 96.169968ms ago: executing program 3 (id=1099): socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x8001, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0x7}, {0x0, 0x0, 0xe6}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@remote, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}, 0xe4) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fedbdf25fc00000000000000e9ffffffffffffffe000000100000000000000000000000000000004000000000a006080"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) 0s ago: executing program 1 (id=1100): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1\n', 0x2) write(0xffffffffffffffff, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='tcp\n', 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='ipv4\n', 0x5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='127.0.0.1\n', 0xa) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0) write(r7, &(0x7f00000006c0)='4420', 0x4) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/param_inline_data_size\x00', 0x1, 0x0) write(r8, &(0x7f0000000740)='1024\n', 0x5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') kernel console output (not intermixed with test programs): from 0 to 8192 [ 114.360213][ T5022] loop1: detected capacity change from 0 to 4096 [ 114.469804][ T5028] FAULT_INJECTION: forcing a failure. [ 114.469804][ T5028] name fail_futex, interval 1, probability 0, space 0, times 0 [ 114.517661][ T5022] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 114.566773][ T5022] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 4096) [ 114.599552][ T4324] Bluetooth: hci3: command 0x0401 tx timeout [ 114.650368][ T5028] CPU: 1 PID: 5028 Comm: syz.4.246 Not tainted syzkaller #0 [ 114.657723][ T5028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.667814][ T5028] Call Trace: [ 114.671128][ T5028] [ 114.674089][ T5028] dump_stack_lvl+0x188/0x250 [ 114.678806][ T5028] ? show_regs_print_info+0x20/0x20 [ 114.684050][ T5028] ? load_image+0x410/0x410 [ 114.688586][ T5028] ? mark_lock+0x94/0x320 [ 114.692965][ T5028] ? __lock_acquire+0x12df/0x7d40 [ 114.698047][ T5028] should_fail+0x383/0x4b0 [ 114.702509][ T5028] get_futex_key+0x1a1/0x12d0 [ 114.707260][ T5028] ? __lock_acquire+0x13b3/0x7d40 [ 114.712322][ T5028] ? futex_wait_restart+0x250/0x250 [ 114.717569][ T5028] futex_wake+0x101/0x540 [ 114.721949][ T5028] ? futex_wait+0x680/0x680 [ 114.726497][ T5028] ? verify_lock_unused+0x140/0x140 [ 114.731737][ T5028] ? verify_lock_unused+0x140/0x140 [ 114.736986][ T5028] do_futex+0xd83/0x12b0 [ 114.741276][ T5028] ? __lock_acquire+0x7d40/0x7d40 [ 114.746350][ T5028] ? futex_exit_release+0x1c0/0x1c0 [ 114.751589][ T5028] ? __context_tracking_exit+0x4c/0x80 [ 114.757090][ T5028] __se_sys_futex+0x389/0x420 [ 114.761817][ T5028] ? __x64_sys_futex+0xf0/0xf0 [ 114.766625][ T5028] ? __x64_sys_futex+0x1d/0xf0 [ 114.771425][ T5028] do_syscall_64+0x4c/0xa0 [ 114.775884][ T5028] ? clear_bhb_loop+0x30/0x80 [ 114.780599][ T5028] ? clear_bhb_loop+0x30/0x80 [ 114.785317][ T5028] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 114.791283][ T5028] RIP: 0033:0x7f555ffa6559 [ 114.795737][ T5028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.815373][ T5028] RSP: 002b:00007f555e1dd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.823821][ T5028] RAX: ffffffffffffffda RBX: 00007f556022e098 RCX: 00007f555ffa6559 [ 114.831837][ T5028] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f556022e09c [ 114.839845][ T5028] RBP: 00007f556022e090 R08: 0018076bd3df8ce0 R09: 0000000000000000 [ 114.847860][ T5028] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 114.855863][ T5028] R13: 00007f556022e128 R14: 00007ffdc47de800 R15: 00007ffdc47de8e8 [ 114.863887][ T5028] [ 114.975238][ T5022] NILFS (loop1): mounting unchecked fs [ 115.287193][ T5022] NILFS (loop1): invalid segment: Checksum error in segment payload [ 115.350691][ T4314] udevd[4314]: incorrect nilfs2 checksum on /dev/loop1 [ 115.385356][ T5022] NILFS (loop1): unable to fall back to spare super block [ 115.410459][ T5022] NILFS (loop1): error -22 while searching super root [ 115.583863][ T5035] ip_tables: iptables: counters copy to user failed while replacing table [ 115.635096][ T4314] udevd[4314]: incorrect nilfs2 checksum on /dev/loop1 [ 116.198319][ T5015] loop2: detected capacity change from 0 to 32768 [ 116.350829][ T5015] (syz.2.241,5015,1):ocfs2_initialize_super:2311 ERROR: status = -12 [ 116.412050][ T5015] (syz.2.241,5015,1):ocfs2_fill_super:1177 ERROR: status = -12 [ 117.472810][ T5069] ip_tables: iptables: counters copy to user failed while replacing table [ 117.479078][ T5066] EXT4-fs warning (device sda1): ext4_resize_fs:1981: can't read last block, resize aborted [ 118.689911][ T5098] ip_tables: iptables: counters copy to user failed while replacing table [ 118.733926][ T5099] jffs2: notice: (5099) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 118.831691][ T5102] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 118.868443][ T5085] loop1: detected capacity change from 0 to 32768 [ 118.913713][ T5102] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 119.543418][ T5085] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 120.705820][ T5133] FAULT_INJECTION: forcing a failure. [ 120.705820][ T5133] name fail_futex, interval 1, probability 0, space 0, times 0 [ 120.719991][ T5133] CPU: 0 PID: 5133 Comm: syz.2.287 Not tainted syzkaller #0 [ 120.727326][ T5133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.737519][ T5133] Call Trace: [ 120.741108][ T5133] [ 120.744393][ T5133] dump_stack_lvl+0x188/0x250 [ 120.749212][ T5133] ? show_regs_print_info+0x20/0x20 [ 120.755079][ T5133] ? load_image+0x410/0x410 [ 120.759622][ T5133] ? mark_lock+0x94/0x320 [ 120.764024][ T5133] ? __lock_acquire+0x12df/0x7d40 [ 120.769097][ T5133] should_fail+0x383/0x4b0 [ 120.773563][ T5133] get_futex_key+0x1a1/0x12d0 [ 120.778290][ T5133] ? __lock_acquire+0x13b3/0x7d40 [ 120.783366][ T5133] ? futex_wait_restart+0x250/0x250 [ 120.788887][ T5133] futex_wake+0x101/0x540 [ 120.793266][ T5133] ? futex_wait+0x680/0x680 [ 120.797963][ T5133] ? verify_lock_unused+0x140/0x140 [ 120.803212][ T5133] ? verify_lock_unused+0x140/0x140 [ 120.808514][ T5133] do_futex+0xd83/0x12b0 [ 120.812808][ T5133] ? __lock_acquire+0x7d40/0x7d40 [ 120.817868][ T5133] ? __schedule+0x11cb/0x4350 [ 120.822594][ T5133] ? futex_exit_release+0x1c0/0x1c0 [ 120.828603][ T5133] ? __context_tracking_exit+0x4c/0x80 [ 120.834252][ T5133] __se_sys_futex+0x389/0x420 [ 120.839042][ T5133] ? __x64_sys_futex+0xf0/0xf0 [ 120.844130][ T5133] ? __x64_sys_futex+0x1d/0xf0 [ 120.849189][ T5133] do_syscall_64+0x4c/0xa0 [ 120.853937][ T5133] ? clear_bhb_loop+0x30/0x80 [ 120.858671][ T5133] ? clear_bhb_loop+0x30/0x80 [ 120.863404][ T5133] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 120.870496][ T5133] RIP: 0033:0x7f5dca0c8559 [ 120.875000][ T5133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.896015][ T5133] RSP: 002b:00007f5dc82ff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 120.904753][ T5133] RAX: ffffffffffffffda RBX: 00007f5dca350098 RCX: 00007f5dca0c8559 [ 120.912784][ T5133] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5dca35009c [ 120.920797][ T5133] RBP: 00007f5dca350090 R08: 0025bcf1c7335bba R09: 0000000000000000 [ 120.929262][ T5133] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 120.938016][ T5133] R13: 00007f5dca350128 R14: 00007fff2be290d0 R15: 00007fff2be291b8 [ 120.946201][ T5133] [ 120.949332][ C0] vkms_vblank_simulate: vblank timer overrun [ 121.581729][ T4190] ocfs2: Unmounting device (7,1) on (node local) [ 122.076213][ T5159] Line length is too long: Should be less than 4094 [ 123.674013][ T5185] FAULT_INJECTION: forcing a failure. [ 123.674013][ T5185] name failslab, interval 1, probability 0, space 0, times 0 [ 123.686886][ T5185] CPU: 1 PID: 5185 Comm: syz.4.303 Not tainted syzkaller #0 [ 123.694182][ T5185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.704246][ T5185] Call Trace: [ 123.707533][ T5185] [ 123.710468][ T5185] dump_stack_lvl+0x188/0x250 [ 123.715199][ T5185] ? show_regs_print_info+0x20/0x20 [ 123.720436][ T5185] ? load_image+0x410/0x410 [ 123.724963][ T5185] ? __lock_acquire+0x7d40/0x7d40 [ 123.730042][ T5185] should_fail+0x383/0x4b0 [ 123.734493][ T5185] should_failslab+0x5/0x20 [ 123.739007][ T5185] slab_pre_alloc_hook+0x51/0xc0 [ 123.743963][ T5185] __kmalloc+0x6b/0x340 [ 123.748187][ T5185] ? security_prepare_creds+0x47/0x130 [ 123.753697][ T5185] ? prepare_creds+0x3c/0x610 [ 123.758409][ T5185] security_prepare_creds+0x47/0x130 [ 123.763712][ T5185] prepare_creds+0x450/0x610 [ 123.768422][ T5185] __se_sys_setgroups+0x347/0x4f0 [ 123.773561][ T5185] do_syscall_64+0x4c/0xa0 [ 123.778007][ T5185] ? clear_bhb_loop+0x30/0x80 [ 123.782720][ T5185] ? clear_bhb_loop+0x30/0x80 [ 123.787435][ T5185] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 123.793355][ T5185] RIP: 0033:0x7f555ffa6559 [ 123.797783][ T5185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.817675][ T5185] RSP: 002b:00007f555e1fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000074 [ 123.826298][ T5185] RAX: ffffffffffffffda RBX: 00007f556022dfa0 RCX: 00007f555ffa6559 [ 123.834306][ T5185] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 123.842297][ T5185] RBP: 00007f556003d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 123.850320][ T5185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.858310][ T5185] R13: 00007f556022e038 R14: 00007f556022dfa0 R15: 00007ffdc47de8e8 [ 123.866326][ T5185] [ 124.733048][ T5205] Line length is too long: Should be less than 4094 [ 125.030853][ T5187] loop2: detected capacity change from 0 to 8192 [ 126.450081][ T5195] loop3: detected capacity change from 0 to 32768 [ 126.542088][ T5236] Line length is too long: Should be less than 4094 [ 127.292693][ T5195] (syz.3.306,5195,0):ocfs2_initialize_super:2311 ERROR: status = -12 [ 127.317973][ T5195] (syz.3.306,5195,1):ocfs2_fill_super:1177 ERROR: status = -12 [ 127.692910][ T5242] loop3: detected capacity change from 0 to 8192 [ 128.453941][ T5252] loop4: detected capacity change from 0 to 4096 [ 128.525327][ T5252] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 128.570764][ T5252] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 4096) [ 128.633309][ T5252] NILFS (loop4): mounting unchecked fs [ 128.640919][ T4345] udevd[4345]: incorrect nilfs2 checksum on /dev/loop4 [ 128.677582][ T5252] NILFS (loop4): invalid segment: Checksum error in segment payload [ 128.685699][ T5252] NILFS (loop4): unable to fall back to spare super block [ 128.724166][ T5252] NILFS (loop4): error -22 while searching super root [ 129.189838][ T5273] Line length is too long: Should be less than 4094 [ 131.288296][ T5275] loop4: detected capacity change from 0 to 32768 [ 131.309063][ T5286] nvmet: adding nsid 1 to subsystem testsubsys [ 131.378360][ T5286] nvmet: failed to open block device (null): (-22) [ 131.497042][ T5286] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 131.537563][ T5275] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 131.943304][ T5292] loop3: detected capacity change from 0 to 8192 [ 132.256199][ T4187] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 132.345195][ T5300] loop1: detected capacity change from 0 to 4096 [ 132.398289][ T5300] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 132.456521][ T5300] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 4096) [ 132.476281][ T5300] NILFS (loop1): mounting unchecked fs [ 132.483745][ T5300] NILFS (loop1): invalid segment: Checksum error in segment payload [ 132.536368][ T4187] usb 1-1: Using ep0 maxpacket: 16 [ 132.559321][ T5300] NILFS (loop1): unable to fall back to spare super block [ 132.586885][ T5300] NILFS (loop1): error -22 while searching super root [ 132.601436][ T4314] udevd[4314]: incorrect nilfs2 checksum on /dev/loop1 [ 132.689426][ T4187] usb 1-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.706815][ T4187] usb 1-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.747903][ T4187] usb 1-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 132.799040][ T4187] usb 1-1: config 0 interface 0 has no altsetting 0 [ 132.805828][ T4187] usb 1-1: New USB device found, idVendor=046d, idProduct=c215, bcdDevice= 0.00 [ 132.823521][ T4187] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.854063][ T4187] usb 1-1: config 0 descriptor?? [ 133.015577][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.023077][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.928832][ T5320] nvmet: failed to open block device (null): (-22) [ 134.027902][ T5320] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 134.068336][ T5320] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 134.106928][ T5320] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 134.116482][ T4187] input: HID 046d:c215 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:046D:C215.0002/input/input8 [ 134.147398][ T5320] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 134.173245][ T5320] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 134.384163][ T4187] logitech 0003:046D:C215.0002: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 046d:c215] on usb-dummy_hcd.0-1/input0 [ 134.401923][ T4187] usb 1-1: USB disconnect, device number 2 [ 135.396498][ T5334] fido_id[5334]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 135.506039][ T5337] loop1: detected capacity change from 0 to 8192 [ 135.739979][ T4195] ocfs2: Unmounting device (7,4) on (node local) [ 136.726619][ T5344] Line length is too long: Should be less than 4094 [ 139.052904][ T5366] nvmet: failed to open block device (null): (-22) [ 139.283377][ T5366] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 139.554575][ T5366] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 139.564839][ T5366] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 139.575790][ T5366] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 139.585576][ T5366] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 139.824080][ T5382] loop1: detected capacity change from 0 to 4096 [ 139.967199][ T5382] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024) [ 140.034564][ T5382] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 4096) [ 140.093168][ T5382] NILFS (loop1): mounting unchecked fs [ 140.131775][ T5384] udevd[5384]: incorrect nilfs2 checksum on /dev/loop1 [ 140.165156][ T5382] NILFS (loop1): invalid segment: Checksum error in segment payload [ 140.232686][ T5382] NILFS (loop1): unable to fall back to spare super block [ 140.288120][ T5382] NILFS (loop1): error -22 while searching super root [ 140.391808][ T5384] udevd[5384]: incorrect nilfs2 checksum on /dev/loop1 [ 140.690696][ T5385] loop3: detected capacity change from 0 to 8192 [ 142.017546][ T1109] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 142.266285][ T1109] usb 5-1: Using ep0 maxpacket: 32 [ 142.494017][ T1109] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 142.742007][ T1109] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 143.006332][ T1109] usb 5-1: string descriptor 0 read error: -22 [ 143.012631][ T1109] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 143.110418][ T5403] Line length is too long: Should be less than 4094 [ 143.118404][ T1109] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.196766][ T5392] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 143.242036][ T1109] usb 5-1: MIDIStreaming interface descriptor not found [ 144.240119][ T5417] nvmet: failed to open block device (null): (-22) [ 144.274221][ T5417] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 144.378965][ T5417] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 144.414388][ T1109] usb 5-1: USB disconnect, device number 2 [ 144.442948][ T5424] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 144.483183][ T5417] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 144.515828][ T5417] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 144.799045][ T5422] udevd[5422]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 147.141628][ T5457] nvmet: failed to open block device (null): (-22) [ 147.155013][ T5457] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 147.185887][ T5457] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 147.515185][ T5442] loop2: detected capacity change from 0 to 32768 [ 147.723637][ T5457] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 147.745031][ T5442] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 147.777531][ T5463] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 148.184941][ T5489] nvmet: failed to open block device ./fi: (-2) [ 148.215272][ T5489] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 148.276450][ T5489] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 148.357994][ T5489] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 148.428738][ T5484] loop3: detected capacity change from 0 to 4096 [ 148.449176][ T5492] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 148.536474][ T5484] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 148.567620][ T5495] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 148.595498][ T5484] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 4096) [ 148.676696][ T5484] NILFS (loop3): mounting unchecked fs [ 148.725135][ T5384] udevd[5384]: incorrect nilfs2 checksum on /dev/loop3 [ 148.803383][ T5484] NILFS (loop3): invalid segment: Checksum error in segment payload [ 148.941849][ T5484] NILFS (loop3): unable to fall back to spare super block [ 149.065070][ T5384] udevd[5384]: incorrect nilfs2 checksum on /dev/loop3 [ 149.076891][ T5484] NILFS (loop3): error -22 while searching super root [ 149.768342][ T5508] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 150.197537][ T5511] FAULT_INJECTION: forcing a failure. [ 150.197537][ T5511] name fail_futex, interval 1, probability 0, space 0, times 0 [ 150.210543][ T5511] CPU: 0 PID: 5511 Comm: syz.3.407 Not tainted syzkaller #0 [ 150.217880][ T5511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.228065][ T5511] Call Trace: [ 150.231527][ T5511] [ 150.234501][ T5511] dump_stack_lvl+0x188/0x250 [ 150.239221][ T5511] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 150.244901][ T5511] ? show_regs_print_info+0x20/0x20 [ 150.250143][ T5511] ? load_image+0x410/0x410 [ 150.254687][ T5511] ? mark_lock+0x94/0x320 [ 150.259066][ T5511] ? __lock_acquire+0x12df/0x7d40 [ 150.264148][ T5511] should_fail+0x383/0x4b0 [ 150.268612][ T5511] get_futex_key+0x1a1/0x12d0 [ 150.273339][ T5511] ? __lock_acquire+0x13b3/0x7d40 [ 150.278517][ T5511] ? futex_wait_restart+0x250/0x250 [ 150.283782][ T5511] futex_wake+0x101/0x540 [ 150.288176][ T5511] ? futex_wait+0x680/0x680 [ 150.292719][ T5511] ? verify_lock_unused+0x140/0x140 [ 150.297955][ T5511] ? verify_lock_unused+0x140/0x140 [ 150.303205][ T5511] do_futex+0xd83/0x12b0 [ 150.307499][ T5511] ? __lock_acquire+0x7d40/0x7d40 [ 150.312578][ T5511] ? futex_exit_release+0x1c0/0x1c0 [ 150.317823][ T5511] ? __context_tracking_exit+0x4c/0x80 [ 150.323333][ T5511] __se_sys_futex+0x389/0x420 [ 150.328171][ T5511] ? __x64_sys_futex+0xf0/0xf0 [ 150.332989][ T5511] ? __x64_sys_futex+0x1d/0xf0 [ 150.337791][ T5511] do_syscall_64+0x4c/0xa0 [ 150.342369][ T5511] ? clear_bhb_loop+0x30/0x80 [ 150.347098][ T5511] ? clear_bhb_loop+0x30/0x80 [ 150.351827][ T5511] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 150.357767][ T5511] RIP: 0033:0x7fb164ae6559 [ 150.362256][ T5511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.382124][ T5511] RSP: 002b:00007fb162d1d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 150.390580][ T5511] RAX: ffffffffffffffda RBX: 00007fb164d6e098 RCX: 00007fb164ae6559 [ 150.398590][ T5511] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb164d6e09c [ 150.406597][ T5511] RBP: 00007fb164d6e090 R08: 0007ef8ee94b175e R09: 0000000000000000 [ 150.414603][ T5511] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 150.422605][ T5511] R13: 00007fb164d6e128 R14: 00007ffcce619fd0 R15: 00007ffcce61a0b8 [ 150.430627][ T5511] [ 150.433763][ C0] vkms_vblank_simulate: vblank timer overrun [ 151.935381][ T5513] binder: 5512:5513 ioctl 4018620d 0 returned -22 [ 152.350077][ T4191] ocfs2: Unmounting device (7,2) on (node local) [ 152.588752][ T5525] nvmet: failed to open block device ./fi: (-2) [ 152.618266][ T5525] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 152.638447][ T5525] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 152.679286][ T5525] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 152.719979][ T5525] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 152.865054][ T5525] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 153.676357][ T5527] loop4: detected capacity change from 0 to 8192 [ 154.028610][ T5548] FAULT_INJECTION: forcing a failure. [ 154.028610][ T5548] name fail_futex, interval 1, probability 0, space 0, times 0 [ 154.041627][ T5548] CPU: 1 PID: 5548 Comm: syz.2.419 Not tainted syzkaller #0 [ 154.048956][ T5548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 154.059043][ T5548] Call Trace: [ 154.062353][ T5548] [ 154.065314][ T5548] dump_stack_lvl+0x188/0x250 [ 154.070032][ T5548] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 154.075707][ T5548] ? show_regs_print_info+0x20/0x20 [ 154.080962][ T5548] ? load_image+0x410/0x410 [ 154.085498][ T5548] ? mark_lock+0x94/0x320 [ 154.089871][ T5548] ? __lock_acquire+0x12df/0x7d40 [ 154.094941][ T5548] should_fail+0x383/0x4b0 [ 154.099415][ T5548] get_futex_key+0x1a1/0x12d0 [ 154.104137][ T5548] ? __lock_acquire+0x13b3/0x7d40 [ 154.109196][ T5548] ? futex_wait_restart+0x250/0x250 [ 154.114442][ T5548] futex_wake+0x101/0x540 [ 154.118817][ T5548] ? futex_wait+0x680/0x680 [ 154.123359][ T5548] ? verify_lock_unused+0x140/0x140 [ 154.128602][ T5548] ? verify_lock_unused+0x140/0x140 [ 154.133847][ T5548] do_futex+0xd83/0x12b0 [ 154.138136][ T5548] ? __lock_acquire+0x7d40/0x7d40 [ 154.143206][ T5548] ? futex_exit_release+0x1c0/0x1c0 [ 154.148447][ T5548] ? __context_tracking_exit+0x4c/0x80 [ 154.153949][ T5548] __se_sys_futex+0x389/0x420 [ 154.158664][ T5548] ? __x64_sys_futex+0xf0/0xf0 [ 154.163467][ T5548] ? __x64_sys_futex+0x1d/0xf0 [ 154.168285][ T5548] do_syscall_64+0x4c/0xa0 [ 154.172736][ T5548] ? clear_bhb_loop+0x30/0x80 [ 154.177452][ T5548] ? clear_bhb_loop+0x30/0x80 [ 154.182168][ T5548] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 154.188093][ T5548] RIP: 0033:0x7f5dca0c8559 [ 154.192545][ T5548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.212218][ T5548] RSP: 002b:00007f5dc82ff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 154.220796][ T5548] RAX: ffffffffffffffda RBX: 00007f5dca350098 RCX: 00007f5dca0c8559 [ 154.228804][ T5548] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5dca35009c [ 154.236806][ T5548] RBP: 00007f5dca350090 R08: 0039685ab0315c98 R09: 0000000000000000 [ 154.244832][ T5548] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 154.252841][ T5548] R13: 00007f5dca350128 R14: 00007fff2be290d0 R15: 00007fff2be291b8 [ 154.260886][ T5548] [ 155.014070][ T5556] device syzkaller0 entered promiscuous mode [ 155.265461][ T5560] binder: BINDER_SET_CONTEXT_MGR already set [ 155.292064][ T5560] binder: 5559:5560 ioctl 4018620d 200000001840 returned -16 [ 156.159936][ T5549] loop1: detected capacity change from 0 to 32768 [ 156.433459][ T5569] nvmet: failed to open block device ./fi: (-2) [ 156.441384][ T5569] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 156.451220][ T5569] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 156.460911][ T5569] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 156.486881][ T5569] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 156.509804][ T5569] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 156.513590][ T5549] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 157.947788][ T4190] ocfs2: Unmounting device (7,1) on (node local) [ 158.150064][ T5600] device syzkaller0 entered promiscuous mode [ 158.634713][ T5611] FAULT_INJECTION: forcing a failure. [ 158.634713][ T5611] name fail_futex, interval 1, probability 0, space 0, times 0 [ 158.647817][ T5611] CPU: 1 PID: 5611 Comm: syz.1.434 Not tainted syzkaller #0 [ 158.655147][ T5611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.665235][ T5611] Call Trace: [ 158.668557][ T5611] [ 158.671522][ T5611] dump_stack_lvl+0x188/0x250 [ 158.676273][ T5611] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 158.681959][ T5611] ? show_regs_print_info+0x20/0x20 [ 158.687201][ T5611] ? load_image+0x410/0x410 [ 158.691749][ T5611] ? mark_lock+0x94/0x320 [ 158.696118][ T5611] ? __lock_acquire+0x12df/0x7d40 [ 158.701189][ T5611] should_fail+0x383/0x4b0 [ 158.705674][ T5611] get_futex_key+0x1a1/0x12d0 [ 158.710394][ T5611] ? __lock_acquire+0x13b3/0x7d40 [ 158.715469][ T5611] ? futex_wait_restart+0x250/0x250 [ 158.720721][ T5611] futex_wake+0x101/0x540 [ 158.725110][ T5611] ? futex_wait+0x680/0x680 [ 158.729652][ T5611] ? verify_lock_unused+0x140/0x140 [ 158.734890][ T5611] ? verify_lock_unused+0x140/0x140 [ 158.740132][ T5611] do_futex+0xd83/0x12b0 [ 158.744434][ T5611] ? __lock_acquire+0x7d40/0x7d40 [ 158.749510][ T5611] ? futex_exit_release+0x1c0/0x1c0 [ 158.754755][ T5611] ? __context_tracking_exit+0x4c/0x80 [ 158.760258][ T5611] __se_sys_futex+0x389/0x420 [ 158.764987][ T5611] ? __x64_sys_futex+0xf0/0xf0 [ 158.769794][ T5611] ? __x64_sys_futex+0x1d/0xf0 [ 158.774598][ T5611] do_syscall_64+0x4c/0xa0 [ 158.779078][ T5611] ? clear_bhb_loop+0x30/0x80 [ 158.783798][ T5611] ? clear_bhb_loop+0x30/0x80 [ 158.788518][ T5611] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 158.794447][ T5611] RIP: 0033:0x7f8af1224559 [ 158.798898][ T5611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.818535][ T5611] RSP: 002b:00007f8aef45b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 158.826991][ T5611] RAX: ffffffffffffffda RBX: 00007f8af14ac098 RCX: 00007f8af1224559 [ 158.834998][ T5611] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8af14ac09c [ 158.843029][ T5611] RBP: 00007f8af14ac090 R08: 002190d70558a460 R09: 0000000000000000 [ 158.851033][ T5611] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 158.859044][ T5611] R13: 00007f8af14ac128 R14: 00007ffe61565090 R15: 00007ffe61565178 [ 158.867069][ T5611] [ 159.605375][ T5615] nvmet: failed to open block device ./fi: (-2) [ 159.634177][ T5615] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 159.696355][ T5619] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 159.756851][ T5615] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 159.777755][ T5615] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 159.803152][ T5615] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 159.935591][ T5628] binder: BINDER_SET_CONTEXT_MGR already set [ 159.952040][ T5628] binder: 5625:5628 ioctl 4018620d 200000001840 returned -16 [ 160.142123][ T5631] loop1: detected capacity change from 0 to 8192 [ 160.530651][ T5648] device syzkaller0 entered promiscuous mode [ 162.063965][ T5626] loop2: detected capacity change from 0 to 32768 [ 162.692427][ T5626] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 162.929810][ T5676] nvmet: failed to open block device ./fi: (-2) [ 163.000174][ T5676] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 163.507077][ T5677] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 163.552310][ T5677] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 163.582671][ T5676] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 163.727636][ T5680] Line length is too long: Should be less than 4094 [ 163.886140][ T5684] netlink: 'syz.0.457': attribute type 19 has an invalid length. [ 164.487884][ T4191] ocfs2: Unmounting device (7,2) on (node local) [ 164.892590][ T5690] loop1: detected capacity change from 0 to 512 [ 164.973587][ T5685] loop4: detected capacity change from 0 to 4096 [ 165.217601][ T5685] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 165.334715][ T5691] Line length is too long: Should be less than 4094 [ 165.359841][ T5690] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 165.549229][ T5690] ext4 filesystem being mounted at /81/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 165.642910][ T5518] udevd[5518]: incorrect nilfs2 checksum on /dev/loop4 [ 165.741245][ T5685] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 4096) [ 165.751457][ T5698] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 168.132444][ T5685] NILFS (loop4): mounting unchecked fs [ 168.193540][ T5685] NILFS (loop4): invalid segment: Checksum error in segment payload [ 168.208342][ T5685] NILFS (loop4): unable to fall back to spare super block [ 168.215514][ T5685] NILFS (loop4): error -22 while searching super root [ 170.519084][ T5722] loop3: detected capacity change from 0 to 8192 [ 170.925598][ T5732] device syzkaller0 entered promiscuous mode [ 171.799114][ T5741] FAULT_INJECTION: forcing a failure. [ 171.799114][ T5741] name fail_futex, interval 1, probability 0, space 0, times 0 [ 171.812441][ T5741] CPU: 0 PID: 5741 Comm: syz.3.472 Not tainted syzkaller #0 [ 171.819762][ T5741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 171.829876][ T5741] Call Trace: [ 171.833183][ T5741] [ 171.836150][ T5741] dump_stack_lvl+0x188/0x250 [ 171.840873][ T5741] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 171.846559][ T5741] ? show_regs_print_info+0x20/0x20 [ 171.851798][ T5741] ? load_image+0x410/0x410 [ 171.856351][ T5741] should_fail+0x383/0x4b0 [ 171.860807][ T5741] get_futex_key+0x1a1/0x12d0 [ 171.865527][ T5741] ? futex_wait_restart+0x250/0x250 [ 171.870758][ T5741] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 171.876794][ T5741] futex_wake+0x101/0x540 [ 171.881168][ T5741] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 171.886850][ T5741] ? futex_wait+0x680/0x680 [ 171.891394][ T5741] ? do_futex+0xea/0x12b0 [ 171.895767][ T5741] do_futex+0xd83/0x12b0 [ 171.900059][ T5741] ? __lock_acquire+0x7d40/0x7d40 [ 171.905134][ T5741] ? futex_exit_release+0x1c0/0x1c0 [ 171.910373][ T5741] ? __context_tracking_exit+0x4c/0x80 [ 171.915875][ T5741] __se_sys_futex+0x389/0x420 [ 171.920601][ T5741] ? __x64_sys_futex+0xf0/0xf0 [ 171.925409][ T5741] ? __x64_sys_futex+0x1d/0xf0 [ 171.930219][ T5741] do_syscall_64+0x4c/0xa0 [ 171.934679][ T5741] ? clear_bhb_loop+0x30/0x80 [ 171.939397][ T5741] ? clear_bhb_loop+0x30/0x80 [ 171.944116][ T5741] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 171.950142][ T5741] RIP: 0033:0x7fb164ae6559 [ 171.954593][ T5741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 171.974249][ T5741] RSP: 002b:00007fb162d1d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 171.982712][ T5741] RAX: ffffffffffffffda RBX: 00007fb164d6e098 RCX: 00007fb164ae6559 [ 171.990725][ T5741] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb164d6e09c [ 171.998765][ T5741] RBP: 00007fb164d6e090 R08: 002bb2d67924edfe R09: 0000000000000000 [ 172.006778][ T5741] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 172.014786][ T5741] R13: 00007fb164d6e128 R14: 00007ffcce619fd0 R15: 00007ffcce61a0b8 [ 172.022827][ T5741] [ 172.785163][ T5738] loop1: detected capacity change from 0 to 32768 [ 172.934208][ T5749] Line length is too long: Should be less than 4094 [ 172.994189][ T5738] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 173.536850][ T5753] loop2: detected capacity change from 0 to 4096 [ 173.796567][ T5753] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 1024) [ 173.844619][ T5753] NILFS (loop2): broken superblock, retrying with spare superblock (blocksize = 4096) [ 174.176468][ T5753] NILFS (loop2): mounting unchecked fs [ 174.222224][ T5753] NILFS (loop2): invalid segment: Checksum error in segment payload [ 174.245864][ T5669] udevd[5669]: incorrect nilfs2 checksum on /dev/loop2 [ 174.263350][ T5753] NILFS (loop2): unable to fall back to spare super block [ 174.286214][ T5753] NILFS (loop2): error -22 while searching super root [ 174.582261][ T5669] udevd[5669]: incorrect nilfs2 checksum on /dev/loop2 [ 176.671502][ T4190] ocfs2: Unmounting device (7,1) on (node local) [ 178.648045][ T5781] FAULT_INJECTION: forcing a failure. [ 178.648045][ T5781] name fail_futex, interval 1, probability 0, space 0, times 0 [ 178.666277][ T5781] CPU: 0 PID: 5781 Comm: syz.4.483 Not tainted syzkaller #0 [ 178.673635][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 178.683733][ T5781] Call Trace: [ 178.687045][ T5781] [ 178.690004][ T5781] dump_stack_lvl+0x188/0x250 [ 178.694918][ T5781] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 178.700591][ T5781] ? show_regs_print_info+0x20/0x20 [ 178.705822][ T5781] ? load_image+0x410/0x410 [ 178.710441][ T5781] ? mark_lock+0x94/0x320 [ 178.714814][ T5781] ? __lock_acquire+0x12df/0x7d40 [ 178.719884][ T5781] should_fail+0x383/0x4b0 [ 178.724354][ T5781] get_futex_key+0x1a1/0x12d0 [ 178.729083][ T5781] ? __lock_acquire+0x13b3/0x7d40 [ 178.734158][ T5781] ? futex_wait_restart+0x250/0x250 [ 178.739409][ T5781] futex_wake+0x101/0x540 [ 178.743781][ T5781] ? futex_wait+0x680/0x680 [ 178.748324][ T5781] ? verify_lock_unused+0x140/0x140 [ 178.753565][ T5781] ? verify_lock_unused+0x140/0x140 [ 178.758808][ T5781] do_futex+0xd83/0x12b0 [ 178.763096][ T5781] ? __lock_acquire+0x7d40/0x7d40 [ 178.768162][ T5781] ? futex_exit_release+0x1c0/0x1c0 [ 178.773408][ T5781] ? __context_tracking_exit+0x4c/0x80 [ 178.778908][ T5781] __se_sys_futex+0x389/0x420 [ 178.783655][ T5781] ? __x64_sys_futex+0xf0/0xf0 [ 178.788457][ T5781] ? __x64_sys_futex+0x1d/0xf0 [ 178.793263][ T5781] do_syscall_64+0x4c/0xa0 [ 178.797715][ T5781] ? clear_bhb_loop+0x30/0x80 [ 178.802429][ T5781] ? clear_bhb_loop+0x30/0x80 [ 178.807147][ T5781] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 178.813083][ T5781] RIP: 0033:0x7f555ffa6559 [ 178.817532][ T5781] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.837168][ T5781] RSP: 002b:00007f555e1dd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 178.845665][ T5781] RAX: ffffffffffffffda RBX: 00007f556022e098 RCX: 00007f555ffa6559 [ 178.853671][ T5781] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f556022e09c [ 178.861670][ T5781] RBP: 00007f556022e090 R08: 0022c20577f2e6cc R09: 0000000000000000 [ 178.869670][ T5781] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 178.877675][ T5781] R13: 00007f556022e128 R14: 00007ffdc47de800 R15: 00007ffdc47de8e8 [ 178.885695][ T5781] [ 179.570295][ T5792] Line length is too long: Should be less than 4094 [ 179.651963][ T5790] loop1: detected capacity change from 0 to 8192 [ 180.706172][ T4267] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 180.976243][ T4267] usb 2-1: Using ep0 maxpacket: 8 [ 181.136492][ T4267] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 181.166567][ T4267] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 181.196648][ T5806] loop4: detected capacity change from 0 to 4096 [ 181.219507][ T4267] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 181.249827][ T5806] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 181.286423][ T4267] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 181.318374][ T5806] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 4096) [ 181.336462][ T4267] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 181.361876][ T5806] NILFS (loop4): mounting unchecked fs [ 181.379691][ T4267] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.405734][ T5806] NILFS (loop4): invalid segment: Checksum error in segment payload [ 181.445193][ T5806] NILFS (loop4): unable to fall back to spare super block [ 181.481890][ T5806] NILFS (loop4): error -22 while searching super root [ 181.497986][ T5669] udevd[5669]: incorrect nilfs2 checksum on /dev/loop4 [ 181.706371][ T4267] usb 2-1: GET_CAPABILITIES returned 0 [ 181.712029][ T4267] usbtmc 2-1:16.0: can't read capabilities [ 182.698276][ T4267] usb 2-1: USB disconnect, device number 7 [ 182.923794][ T5814] loop4: detected capacity change from 0 to 32768 [ 183.139170][ T5814] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 184.291019][ T5837] FAULT_INJECTION: forcing a failure. [ 184.291019][ T5837] name fail_futex, interval 1, probability 0, space 0, times 0 [ 184.304002][ T5837] CPU: 0 PID: 5837 Comm: syz.0.495 Not tainted syzkaller #0 [ 184.311317][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 184.321397][ T5837] Call Trace: [ 184.324754][ T5837] [ 184.327723][ T5837] dump_stack_lvl+0x188/0x250 [ 184.332443][ T5837] ? psi_task_switch+0x4c3/0x810 [ 184.337419][ T5837] ? show_regs_print_info+0x20/0x20 [ 184.342655][ T5837] ? load_image+0x410/0x410 [ 184.347205][ T5837] should_fail+0x383/0x4b0 [ 184.351695][ T5837] get_futex_key+0x1a1/0x12d0 [ 184.356422][ T5837] ? futex_wait_restart+0x250/0x250 [ 184.361660][ T5837] ? finish_lock_switch+0x12d/0x290 [ 184.366893][ T5837] futex_wake+0x101/0x540 [ 184.371271][ T5837] ? __schedule+0x11cb/0x4350 [ 184.375986][ T5837] ? futex_wait+0x680/0x680 [ 184.380529][ T5837] do_futex+0xd83/0x12b0 [ 184.384811][ T5837] ? release_firmware_map_entry+0x190/0x190 [ 184.390742][ T5837] ? preempt_schedule_irq+0xe6/0x160 [ 184.396067][ T5837] ? futex_exit_release+0x1c0/0x1c0 [ 184.401297][ T5837] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 184.407317][ T5837] ? lock_chain_count+0x20/0x20 [ 184.412213][ T5837] __se_sys_futex+0x389/0x420 [ 184.416938][ T5837] ? lockdep_hardirqs_on+0x94/0x140 [ 184.422173][ T5837] ? __x64_sys_futex+0xf0/0xf0 [ 184.426977][ T5837] ? __x64_sys_futex+0x1d/0xf0 [ 184.431785][ T5837] do_syscall_64+0x4c/0xa0 [ 184.436233][ T5837] ? clear_bhb_loop+0x30/0x80 [ 184.440941][ T5837] ? clear_bhb_loop+0x30/0x80 [ 184.445661][ T5837] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 184.451595][ T5837] RIP: 0033:0x7fadf003f559 [ 184.456048][ T5837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 184.475692][ T5837] RSP: 002b:00007fadee2760e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 184.484140][ T5837] RAX: ffffffffffffffda RBX: 00007fadf02c7098 RCX: 00007fadf003f559 [ 184.492143][ T5837] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fadf02c709c [ 184.500143][ T5837] RBP: 00007fadf02c7090 R08: 000d4cdbe05ab704 R09: 0000000000000000 [ 184.508142][ T5837] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 184.516146][ T5837] R13: 00007fadf02c7128 R14: 00007ffe428d9700 R15: 00007ffe428d97e8 [ 184.524172][ T5837] [ 185.755038][ T5840] Line length is too long: Should be less than 4094 [ 185.805968][ T5846] Line length is too long: Should be less than 4094 [ 186.606215][ T23] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 186.818387][ T4195] ocfs2: Unmounting device (7,4) on (node local) [ 186.976619][ T23] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 187.006341][ T23] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 187.047369][ T23] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 187.101052][ T23] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 187.124579][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.954111][ T23] cxacru 4-1:1.0: send of cm 0x91 failed (-71) [ 187.986989][ T23] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 188.038546][ T23] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 188.084724][ T23] cxacru: probe of 4-1:1.0 failed with error -71 [ 188.156372][ T23] usb 4-1: USB disconnect, device number 4 [ 188.298087][ T5897] loop4: detected capacity change from 0 to 4096 [ 188.330806][ T5900] device syzkaller0 entered promiscuous mode [ 188.361054][ T5897] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 1024) [ 188.391532][ T5897] NILFS (loop4): broken superblock, retrying with spare superblock (blocksize = 4096) [ 188.419562][ T5897] NILFS (loop4): mounting unchecked fs [ 188.466874][ T5897] NILFS (loop4): invalid segment: Checksum error in segment payload [ 188.505386][ T5897] NILFS (loop4): unable to fall back to spare super block [ 188.515963][ T5810] udevd[5810]: incorrect nilfs2 checksum on /dev/loop4 [ 188.535733][ T5897] NILFS (loop4): error -22 while searching super root [ 188.611706][ T5909] FAULT_INJECTION: forcing a failure. [ 188.611706][ T5909] name fail_futex, interval 1, probability 0, space 0, times 0 [ 188.625408][ T5909] CPU: 0 PID: 5909 Comm: syz.3.509 Not tainted syzkaller #0 [ 188.632849][ T5909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 188.642940][ T5909] Call Trace: [ 188.646252][ T5909] [ 188.649267][ T5909] dump_stack_lvl+0x188/0x250 [ 188.653985][ T5909] ? psi_task_switch+0x4c3/0x810 [ 188.658959][ T5909] ? show_regs_print_info+0x20/0x20 [ 188.664190][ T5909] ? load_image+0x410/0x410 [ 188.668747][ T5909] should_fail+0x383/0x4b0 [ 188.673232][ T5909] get_futex_key+0x1a1/0x12d0 [ 188.677993][ T5909] ? futex_wait_restart+0x250/0x250 [ 188.683231][ T5909] ? finish_lock_switch+0x12d/0x290 [ 188.688476][ T5909] futex_wake+0x101/0x540 [ 188.692850][ T5909] ? __schedule+0x11cb/0x4350 [ 188.697569][ T5909] ? futex_wait+0x680/0x680 [ 188.702122][ T5909] do_futex+0xd83/0x12b0 [ 188.706412][ T5909] ? release_firmware_map_entry+0x190/0x190 [ 188.712367][ T5909] ? preempt_schedule_irq+0xe6/0x160 [ 188.717699][ T5909] ? futex_exit_release+0x1c0/0x1c0 [ 188.722956][ T5909] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 188.728983][ T5909] ? lock_chain_count+0x20/0x20 [ 188.733880][ T5909] __se_sys_futex+0x389/0x420 [ 188.738590][ T5909] ? lockdep_hardirqs_on+0x94/0x140 [ 188.743832][ T5909] ? __x64_sys_futex+0xf0/0xf0 [ 188.748635][ T5909] ? __x64_sys_futex+0x1d/0xf0 [ 188.753432][ T5909] do_syscall_64+0x4c/0xa0 [ 188.757882][ T5909] ? clear_bhb_loop+0x30/0x80 [ 188.762593][ T5909] ? clear_bhb_loop+0x30/0x80 [ 188.767316][ T5909] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 188.773257][ T5909] RIP: 0033:0x7fb164ae6559 [ 188.777699][ T5909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.797340][ T5909] RSP: 002b:00007fb162d1d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 188.805799][ T5909] RAX: ffffffffffffffda RBX: 00007fb164d6e098 RCX: 00007fb164ae6559 [ 188.814064][ T5909] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb164d6e09c [ 188.822073][ T5909] RBP: 00007fb164d6e090 R08: 00205fac30531524 R09: 0000000000000000 [ 188.830079][ T5909] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 188.838080][ T5909] R13: 00007fb164d6e128 R14: 00007ffcce619fd0 R15: 00007ffcce61a0b8 [ 188.846098][ T5909] [ 189.516953][ T5911] Line length is too long: Should be less than 4094 [ 189.660295][ T5914] Line length is too long: Should be less than 4094 [ 191.396576][ T23] Bluetooth: hci0: command 0x0406 tx timeout [ 191.417963][ T23] Bluetooth: hci2: command 0x0406 tx timeout [ 191.441942][ T23] Bluetooth: hci1: command 0x0406 tx timeout [ 191.478378][ T23] Bluetooth: hci3: command 0x0406 tx timeout [ 191.636539][ T5924] loop4: detected capacity change from 0 to 32768 [ 191.762323][ T5924] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 191.927960][ T5925] loop1: detected capacity change from 0 to 8192 [ 194.020774][ T5948] device syzkaller0 entered promiscuous mode [ 194.144956][ T5953] netlink: 'syz.1.521': attribute type 19 has an invalid length. [ 194.451186][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.457783][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.999162][ T5956] Line length is too long: Should be less than 4094 [ 196.115835][ T5967] FAULT_INJECTION: forcing a failure. [ 196.115835][ T5967] name fail_futex, interval 1, probability 0, space 0, times 0 [ 196.129346][ T5967] CPU: 0 PID: 5967 Comm: syz.1.525 Not tainted syzkaller #0 [ 196.136677][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.146766][ T5967] Call Trace: [ 196.150076][ T5967] [ 196.153035][ T5967] dump_stack_lvl+0x188/0x250 [ 196.157749][ T5967] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 196.163416][ T5967] ? show_regs_print_info+0x20/0x20 [ 196.168665][ T5967] ? load_image+0x410/0x410 [ 196.173200][ T5967] ? mark_lock+0x94/0x320 [ 196.177568][ T5967] ? __lock_acquire+0x12df/0x7d40 [ 196.182646][ T5967] should_fail+0x383/0x4b0 [ 196.187107][ T5967] get_futex_key+0x1a1/0x12d0 [ 196.191829][ T5967] ? __lock_acquire+0x13b3/0x7d40 [ 196.196887][ T5967] ? futex_wait_restart+0x250/0x250 [ 196.202134][ T5967] futex_wake+0x101/0x540 [ 196.206520][ T5967] ? futex_wait+0x680/0x680 [ 196.211050][ T5967] ? preempt_schedule_irq+0xe6/0x160 [ 196.216366][ T5967] ? verify_lock_unused+0x140/0x140 [ 196.221610][ T5967] ? verify_lock_unused+0x140/0x140 [ 196.226842][ T5967] do_futex+0xd83/0x12b0 [ 196.231159][ T5967] ? __lock_acquire+0x7d40/0x7d40 [ 196.236230][ T5967] ? futex_exit_release+0x1c0/0x1c0 [ 196.241458][ T5967] ? __context_tracking_exit+0x4c/0x80 [ 196.246962][ T5967] __se_sys_futex+0x389/0x420 [ 196.251682][ T5967] ? __x64_sys_futex+0xf0/0xf0 [ 196.256479][ T5967] ? __x64_sys_futex+0x1d/0xf0 [ 196.261281][ T5967] do_syscall_64+0x4c/0xa0 [ 196.265728][ T5967] ? clear_bhb_loop+0x30/0x80 [ 196.270435][ T5967] ? clear_bhb_loop+0x30/0x80 [ 196.275151][ T5967] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 196.281084][ T5967] RIP: 0033:0x7f8af1224559 [ 196.285532][ T5967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.305170][ T5967] RSP: 002b:00007f8aef45b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 196.313623][ T5967] RAX: ffffffffffffffda RBX: 00007f8af14ac098 RCX: 00007f8af1224559 [ 196.321625][ T5967] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f8af14ac09c [ 196.329626][ T5967] RBP: 00007f8af14ac090 R08: 00029247bb296338 R09: 0000000000000000 [ 196.337624][ T5967] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 196.345624][ T5967] R13: 00007f8af14ac128 R14: 00007ffe61565090 R15: 00007ffe61565178 [ 196.353652][ T5967] [ 196.900489][ T5968] Line length is too long: Should be less than 4094 [ 198.034661][ T5976] loop2: detected capacity change from 0 to 128 [ 198.287974][ T5976] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 198.303051][ T5976] ext4 filesystem being mounted at /92/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 198.325641][ T5976] EXT4-fs warning (device loop2): __ext4_ioctl:888: Setting inode version is not supported with metadata_csum enabled. [ 199.930991][ T4195] ocfs2: Unmounting device (7,4) on (node local) [ 200.509840][ T5994] loop2: detected capacity change from 0 to 8192 [ 200.936286][ T6000] device syzkaller0 entered promiscuous mode [ 201.112681][ T6007] netlink: 'syz.2.535': attribute type 19 has an invalid length. [ 202.002788][ T6010] Line length is too long: Should be less than 4094 [ 203.151015][ T6017] FAULT_INJECTION: forcing a failure. [ 203.151015][ T6017] name fail_futex, interval 1, probability 0, space 0, times 0 [ 203.164005][ T6017] CPU: 1 PID: 6017 Comm: syz.0.538 Not tainted syzkaller #0 [ 203.171326][ T6017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 203.181410][ T6017] Call Trace: [ 203.184717][ T6017] [ 203.187706][ T6017] dump_stack_lvl+0x188/0x250 [ 203.192418][ T6017] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 203.198093][ T6017] ? show_regs_print_info+0x20/0x20 [ 203.203354][ T6017] ? load_image+0x410/0x410 [ 203.207915][ T6017] ? mark_lock+0x94/0x320 [ 203.212310][ T6017] ? __lock_acquire+0x12df/0x7d40 [ 203.217612][ T6017] should_fail+0x383/0x4b0 [ 203.222071][ T6017] get_futex_key+0x1a1/0x12d0 [ 203.226785][ T6017] ? __lock_acquire+0x13b3/0x7d40 [ 203.231850][ T6017] ? futex_wait_restart+0x250/0x250 [ 203.237094][ T6017] futex_wake+0x101/0x540 [ 203.241464][ T6017] ? futex_wait+0x680/0x680 [ 203.246008][ T6017] ? preempt_schedule_irq+0xe6/0x160 [ 203.251356][ T6017] ? verify_lock_unused+0x140/0x140 [ 203.256590][ T6017] ? verify_lock_unused+0x140/0x140 [ 203.261828][ T6017] do_futex+0xd83/0x12b0 [ 203.266113][ T6017] ? __lock_acquire+0x7d40/0x7d40 [ 203.271182][ T6017] ? futex_exit_release+0x1c0/0x1c0 [ 203.276422][ T6017] ? __context_tracking_exit+0x4c/0x80 [ 203.281918][ T6017] __se_sys_futex+0x389/0x420 [ 203.286636][ T6017] ? __x64_sys_futex+0xf0/0xf0 [ 203.291437][ T6017] ? __x64_sys_futex+0x1d/0xf0 [ 203.296243][ T6017] do_syscall_64+0x4c/0xa0 [ 203.300694][ T6017] ? clear_bhb_loop+0x30/0x80 [ 203.305402][ T6017] ? clear_bhb_loop+0x30/0x80 [ 203.310121][ T6017] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 203.316051][ T6017] RIP: 0033:0x7fadf003f559 [ 203.320508][ T6017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 203.340264][ T6017] RSP: 002b:00007fadee2760e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 203.348716][ T6017] RAX: ffffffffffffffda RBX: 00007fadf02c7098 RCX: 00007fadf003f559 [ 203.356744][ T6017] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fadf02c709c [ 203.364748][ T6017] RBP: 00007fadf02c7090 R08: 0004f4a23d7bc3b8 R09: 0000000000000000 [ 203.372752][ T6017] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 203.380761][ T6017] R13: 00007fadf02c7128 R14: 00007ffe428d9700 R15: 00007ffe428d97e8 [ 203.388792][ T6017] [ 203.541495][ T6016] Line length is too long: Should be less than 4094 [ 203.715835][ T6024] loop2: detected capacity change from 0 to 128 [ 205.036285][ T6024] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 205.047509][ T6024] ext4 filesystem being mounted at /98/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 205.070135][ T6024] EXT4-fs warning (device loop2): __ext4_ioctl:888: Setting inode version is not supported with metadata_csum enabled. [ 206.462010][ T6052] netlink: 'syz.0.546': attribute type 19 has an invalid length. [ 207.226097][ C1] sched: RT throttling activated [ 207.736028][ T6061] binder: 6060:6061 ioctl c0306201 0 returned -14 [ 208.878910][ T4324] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 208.983375][ T6073] FAULT_INJECTION: forcing a failure. [ 208.983375][ T6073] name fail_futex, interval 1, probability 0, space 0, times 0 [ 208.996810][ T6073] CPU: 0 PID: 6073 Comm: syz.0.551 Not tainted syzkaller #0 [ 209.004143][ T6073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.014268][ T6073] Call Trace: [ 209.017618][ T6073] [ 209.020596][ T6073] dump_stack_lvl+0x188/0x250 [ 209.025323][ T6073] ? psi_task_switch+0x4c3/0x810 [ 209.030327][ T6073] ? show_regs_print_info+0x20/0x20 [ 209.035568][ T6073] ? load_image+0x410/0x410 [ 209.040158][ T6073] should_fail+0x383/0x4b0 [ 209.044652][ T6073] get_futex_key+0x1a1/0x12d0 [ 209.049442][ T6073] ? futex_wait_restart+0x250/0x250 [ 209.054805][ T6073] ? finish_lock_switch+0x12d/0x290 [ 209.060048][ T6073] futex_wake+0x101/0x540 [ 209.064442][ T6073] ? __schedule+0x11cb/0x4350 [ 209.069185][ T6073] ? futex_wait+0x680/0x680 [ 209.073743][ T6073] do_futex+0xd83/0x12b0 [ 209.078148][ T6073] ? release_firmware_map_entry+0x190/0x190 [ 209.084144][ T6073] ? preempt_schedule_irq+0xe6/0x160 [ 209.089465][ T6073] ? futex_exit_release+0x1c0/0x1c0 [ 209.094703][ T6073] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 209.100731][ T6073] ? lock_chain_count+0x20/0x20 [ 209.105634][ T6073] __se_sys_futex+0x389/0x420 [ 209.110463][ T6073] ? lockdep_hardirqs_on+0x94/0x140 [ 209.115728][ T6073] ? __x64_sys_futex+0xf0/0xf0 [ 209.120537][ T6073] ? __x64_sys_futex+0x1d/0xf0 [ 209.125341][ T6073] do_syscall_64+0x4c/0xa0 [ 209.129904][ T6073] ? clear_bhb_loop+0x30/0x80 [ 209.134650][ T6073] ? clear_bhb_loop+0x30/0x80 [ 209.139389][ T6073] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 209.145366][ T6073] RIP: 0033:0x7fadf003f559 [ 209.149812][ T6073] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.169458][ T6073] RSP: 002b:00007fadee2760e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 209.178022][ T6073] RAX: ffffffffffffffda RBX: 00007fadf02c7098 RCX: 00007fadf003f559 [ 209.186025][ T6073] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fadf02c709c [ 209.194032][ T6073] RBP: 00007fadf02c7090 R08: 00366d6e2967fba2 R09: 0000000000000000 [ 209.202040][ T6073] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 209.210059][ T6073] R13: 00007fadf02c7128 R14: 00007ffe428d9700 R15: 00007ffe428d97e8 [ 209.218089][ T6073] [ 209.901370][ T6057] loop4: detected capacity change from 0 to 8192 [ 210.047545][ T6076] Line length is too long: Should be less than 4094 [ 210.346203][ T6082] loop2: detected capacity change from 0 to 32768 [ 210.353067][ T4324] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x3 has invalid wMaxPacketSize 0 [ 210.374045][ T4324] usb 4-1: config 0 interface 0 has no altsetting 0 [ 210.506535][ T6082] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 210.976375][ T4324] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 210.985694][ T4324] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 211.040044][ T4324] usb 4-1: Product: syz [ 211.044312][ T4324] usb 4-1: Manufacturer: syz [ 211.063986][ T4191] ocfs2: Unmounting device (7,2) on (node local) [ 211.069820][ T4324] usb 4-1: config 0 descriptor?? [ 211.106340][ T4324] usb 4-1: can't set config #0, error -71 [ 211.122938][ T4324] usb 4-1: USB disconnect, device number 5 [ 211.909675][ T6099] netlink: 'syz.3.558': attribute type 19 has an invalid length. [ 212.910774][ T6103] binder: 6102:6103 ioctl c0306201 0 returned -14 [ 213.536030][ T6113] device syzkaller0 entered promiscuous mode [ 213.678901][ T6115] Line length is too long: Should be less than 4094 [ 214.543213][ T6133] loop4: detected capacity change from 0 to 512 [ 215.234668][ T6140] netlink: 'syz.2.570': attribute type 19 has an invalid length. [ 216.122126][ T6130] loop3: detected capacity change from 0 to 8192 [ 216.172066][ T6150] binder: 6149:6150 ioctl c0306201 0 returned -14 [ 217.062274][ T6154] Line length is too long: Should be less than 4094 [ 217.123110][ T6133] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 217.178087][ T6133] ext4 filesystem being mounted at /117/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 217.197846][ T6163] device syzkaller0 entered promiscuous mode [ 217.354029][ T6173] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 218.931360][ T6207] netlink: 'syz.4.584': attribute type 19 has an invalid length. [ 219.767719][ T6204] Line length is too long: Should be less than 4094 [ 220.027475][ T6199] loop1: detected capacity change from 0 to 8192 [ 220.114980][ T6217] device syzkaller0 entered promiscuous mode [ 220.487916][ T6229] loop1: detected capacity change from 0 to 512 [ 220.714757][ T6229] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 220.786272][ T6229] ext4 filesystem being mounted at /104/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 221.589273][ T6241] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 221.887629][ T6243] Line length is too long: Should be less than 4094 [ 222.043339][ T6249] nvmet: failed to open block device ./fi: (-2) [ 222.087814][ T6249] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 222.117116][ T6249] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 222.199530][ T6249] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 222.290209][ T6249] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 222.357214][ T6253] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 222.518803][ T6259] device syzkaller0 entered promiscuous mode [ 222.699228][ T6269] netlink: 'syz.1.603': attribute type 19 has an invalid length. [ 223.639680][ T6268] binder: BINDER_SET_CONTEXT_MGR already set [ 223.645912][ T6268] binder: 6267:6268 ioctl 4018620d 200000001840 returned -16 [ 224.744414][ T6282] Line length is too long: Should be less than 4094 [ 224.843184][ T6286] Line length is too long: Should be less than 4094 [ 224.981329][ T6295] nvmet: failed to open block device ./fi: (-2) [ 225.007430][ T6295] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 225.041242][ T6295] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 225.092645][ T6295] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 225.202932][ T6303] netlink: 'syz.2.622': attribute type 19 has an invalid length. [ 226.076006][ T6304] FAULT_INJECTION: forcing a failure. [ 226.076006][ T6304] name fail_futex, interval 1, probability 0, space 0, times 0 [ 226.089081][ T6304] CPU: 0 PID: 6304 Comm: syz.3.621 Not tainted syzkaller #0 [ 226.096411][ T6304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.106605][ T6304] Call Trace: [ 226.109941][ T6304] [ 226.112961][ T6304] dump_stack_lvl+0x188/0x250 [ 226.117676][ T6304] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 226.123494][ T6304] ? show_regs_print_info+0x20/0x20 [ 226.128852][ T6304] ? load_image+0x410/0x410 [ 226.133417][ T6304] ? mark_lock+0x94/0x320 [ 226.137786][ T6304] ? __lock_acquire+0x12df/0x7d40 [ 226.142856][ T6304] should_fail+0x383/0x4b0 [ 226.147319][ T6304] get_futex_key+0x1a1/0x12d0 [ 226.152162][ T6304] ? __lock_acquire+0x13b3/0x7d40 [ 226.157231][ T6304] ? futex_wait_restart+0x250/0x250 [ 226.162482][ T6304] futex_wake+0x101/0x540 [ 226.166871][ T6304] ? futex_wait+0x680/0x680 [ 226.171417][ T6304] ? verify_lock_unused+0x140/0x140 [ 226.176647][ T6304] ? verify_lock_unused+0x140/0x140 [ 226.181891][ T6304] do_futex+0xd83/0x12b0 [ 226.186176][ T6304] ? __lock_acquire+0x7d40/0x7d40 [ 226.191244][ T6304] ? futex_exit_release+0x1c0/0x1c0 [ 226.196493][ T6304] ? __context_tracking_exit+0x4c/0x80 [ 226.202013][ T6304] __se_sys_futex+0x389/0x420 [ 226.206747][ T6304] ? __x64_sys_futex+0xf0/0xf0 [ 226.211565][ T6304] ? __x64_sys_futex+0x1d/0xf0 [ 226.216378][ T6304] do_syscall_64+0x4c/0xa0 [ 226.220857][ T6304] ? clear_bhb_loop+0x30/0x80 [ 226.225589][ T6304] ? clear_bhb_loop+0x30/0x80 [ 226.230324][ T6304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 226.236471][ T6304] RIP: 0033:0x7fb164ae6559 [ 226.240947][ T6304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.260940][ T6304] RSP: 002b:00007fb162d1d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 226.269416][ T6304] RAX: ffffffffffffffda RBX: 00007fb164d6e098 RCX: 00007fb164ae6559 [ 226.277427][ T6304] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb164d6e09c [ 226.285466][ T6304] RBP: 00007fb164d6e090 R08: 00002fefe5c50c70 R09: 0000000000000000 [ 226.293472][ T6304] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 226.301650][ T6304] R13: 00007fb164d6e128 R14: 00007ffcce619fd0 R15: 00007ffcce61a0b8 [ 226.309693][ T6304] [ 226.376527][ T6295] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 226.472994][ T6295] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 226.751085][ T6315] binder: BINDER_SET_CONTEXT_MGR already set [ 226.884228][ T6315] binder: 6309:6315 ioctl 4018620d 200000001700 returned -16 [ 227.833991][ T6329] Line length is too long: Should be less than 4094 [ 227.943265][ T6331] Line length is too long: Should be less than 4094 [ 227.980308][ T6322] loop1: detected capacity change from 0 to 8192 [ 228.216818][ T6344] netlink: 'syz.4.634': attribute type 19 has an invalid length. [ 229.174415][ T6345] FAULT_INJECTION: forcing a failure. [ 229.174415][ T6345] name fail_futex, interval 1, probability 0, space 0, times 0 [ 229.188101][ T6345] CPU: 0 PID: 6345 Comm: syz.2.635 Not tainted syzkaller #0 [ 229.195441][ T6345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 229.205532][ T6345] Call Trace: [ 229.208842][ T6345] [ 229.211859][ T6345] dump_stack_lvl+0x188/0x250 [ 229.216591][ T6345] ? psi_task_switch+0x4c3/0x810 [ 229.221570][ T6345] ? show_regs_print_info+0x20/0x20 [ 229.226810][ T6345] ? load_image+0x410/0x410 [ 229.231368][ T6345] ? __pv_queued_spin_lock_slowpath+0x7de/0x9b0 [ 229.237667][ T6345] should_fail+0x383/0x4b0 [ 229.242363][ T6345] get_futex_key+0x1a1/0x12d0 [ 229.249343][ T6345] ? futex_wait_restart+0x250/0x250 [ 229.254624][ T6345] ? finish_lock_switch+0x12d/0x290 [ 229.259895][ T6345] futex_wake+0x101/0x540 [ 229.264316][ T6345] ? __schedule+0x11cb/0x4350 [ 229.269042][ T6345] ? futex_wait+0x680/0x680 [ 229.273610][ T6345] ? preempt_schedule_irq+0xe6/0x160 [ 229.280138][ T6345] do_futex+0xd83/0x12b0 [ 229.284812][ T6345] ? release_firmware_map_entry+0x190/0x190 [ 229.290766][ T6345] ? preempt_schedule_irq+0xe6/0x160 [ 229.296100][ T6345] ? futex_exit_release+0x1c0/0x1c0 [ 229.301345][ T6345] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 229.307635][ T6345] ? lock_chain_count+0x20/0x20 [ 229.312620][ T6345] __se_sys_futex+0x389/0x420 [ 229.317355][ T6345] ? lockdep_hardirqs_on+0x94/0x140 [ 229.322625][ T6345] ? __x64_sys_futex+0xf0/0xf0 [ 229.327620][ T6345] ? __x64_sys_futex+0x1d/0xf0 [ 229.332431][ T6345] do_syscall_64+0x4c/0xa0 [ 229.336904][ T6345] ? clear_bhb_loop+0x30/0x80 [ 229.341658][ T6345] ? clear_bhb_loop+0x30/0x80 [ 229.346407][ T6345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 229.352348][ T6345] RIP: 0033:0x7f5dca0c8559 [ 229.356812][ T6345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 229.376844][ T6345] RSP: 002b:00007f5dc82ff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 229.385405][ T6345] RAX: ffffffffffffffda RBX: 00007f5dca350098 RCX: 00007f5dca0c8559 [ 229.393440][ T6345] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5dca35009c [ 229.401661][ T6345] RBP: 00007f5dca350090 R08: 000625d11f27de34 R09: 0000000000000000 [ 229.409673][ T6345] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 229.417686][ T6345] R13: 00007f5dca350128 R14: 00007fff2be290d0 R15: 00007fff2be291b8 [ 229.425797][ T6345] [ 229.624911][ T6347] nvmet: failed to open block device ./fi: (-2) [ 229.688893][ T6347] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 229.752369][ T6352] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 229.859447][ T6347] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 229.942348][ T6352] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 230.806466][ T6369] Line length is too long: Should be less than 4094 [ 232.298484][ T6371] Line length is too long: Should be less than 4094 [ 232.401182][ T6375] loop4: detected capacity change from 0 to 512 [ 232.787092][ T6380] FAULT_INJECTION: forcing a failure. [ 232.787092][ T6380] name fail_futex, interval 1, probability 0, space 0, times 0 [ 232.800151][ T6380] CPU: 1 PID: 6380 Comm: syz.2.648 Not tainted syzkaller #0 [ 232.807505][ T6380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.817628][ T6380] Call Trace: [ 232.820959][ T6380] [ 232.823930][ T6380] dump_stack_lvl+0x188/0x250 [ 232.828710][ T6380] ? show_regs_print_info+0x20/0x20 [ 232.833967][ T6380] ? load_image+0x410/0x410 [ 232.838521][ T6380] ? mark_lock+0x94/0x320 [ 232.842906][ T6380] ? __lock_acquire+0x12df/0x7d40 [ 232.847992][ T6380] should_fail+0x383/0x4b0 [ 232.852474][ T6380] get_futex_key+0x1a1/0x12d0 [ 232.857238][ T6380] ? __lock_acquire+0x13b3/0x7d40 [ 232.862479][ T6380] ? futex_wait_restart+0x250/0x250 [ 232.867733][ T6380] futex_wake+0x101/0x540 [ 232.872145][ T6380] ? futex_wait+0x680/0x680 [ 232.876693][ T6380] ? preempt_schedule_irq+0xe6/0x160 [ 232.882017][ T6380] ? verify_lock_unused+0x140/0x140 [ 232.887273][ T6380] ? verify_lock_unused+0x140/0x140 [ 232.892527][ T6380] do_futex+0xd83/0x12b0 [ 232.896932][ T6380] ? __lock_acquire+0x7d40/0x7d40 [ 232.902015][ T6380] ? futex_exit_release+0x1c0/0x1c0 [ 232.907261][ T6380] ? __context_tracking_exit+0x4c/0x80 [ 232.912762][ T6380] __se_sys_futex+0x389/0x420 [ 232.917486][ T6380] ? __x64_sys_futex+0xf0/0xf0 [ 232.922294][ T6380] ? __x64_sys_futex+0x1d/0xf0 [ 232.927103][ T6380] do_syscall_64+0x4c/0xa0 [ 232.931559][ T6380] ? clear_bhb_loop+0x30/0x80 [ 232.936277][ T6380] ? clear_bhb_loop+0x30/0x80 [ 232.940994][ T6380] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 232.946943][ T6380] RIP: 0033:0x7f5dca0c8559 [ 232.951393][ T6380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.971039][ T6380] RSP: 002b:00007f5dc82ff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 232.979502][ T6380] RAX: ffffffffffffffda RBX: 00007f5dca350098 RCX: 00007f5dca0c8559 [ 232.987520][ T6380] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5dca35009c [ 232.995546][ T6380] RBP: 00007f5dca350090 R08: 002b1a44622af430 R09: 0000000000000000 [ 233.003550][ T6380] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 233.011575][ T6380] R13: 00007f5dca350128 R14: 00007fff2be290d0 R15: 00007fff2be291b8 [ 233.019619][ T6380] [ 233.022686][ C1] vkms_vblank_simulate: vblank timer overrun [ 233.378721][ T6375] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 233.412767][ T6375] ext4 filesystem being mounted at /136/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 234.318518][ T6394] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 234.504484][ T6381] loop1: detected capacity change from 0 to 8192 [ 235.089457][ T6403] nvmet: failed to open block device ./fi: (-2) [ 235.197046][ T6403] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 235.243740][ T6403] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 235.304341][ T6404] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 235.363924][ T6403] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 235.418216][ T6404] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 236.062503][ T6414] Line length is too long: Should be less than 4094 [ 236.157525][ T6423] Line length is too long: Should be less than 4094 [ 236.214422][ T6427] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 236.339392][ T6431] FAULT_INJECTION: forcing a failure. [ 236.339392][ T6431] name fail_futex, interval 1, probability 0, space 0, times 0 [ 236.353006][ T6431] CPU: 0 PID: 6431 Comm: syz.4.662 Not tainted syzkaller #0 [ 236.360339][ T6431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.370431][ T6431] Call Trace: [ 236.373739][ T6431] [ 236.376699][ T6431] dump_stack_lvl+0x188/0x250 [ 236.381409][ T6431] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 236.387080][ T6431] ? show_regs_print_info+0x20/0x20 [ 236.392318][ T6431] ? load_image+0x410/0x410 [ 236.396854][ T6431] ? mark_lock+0x94/0x320 [ 236.401217][ T6431] ? __lock_acquire+0x12df/0x7d40 [ 236.406284][ T6431] should_fail+0x383/0x4b0 [ 236.410745][ T6431] get_futex_key+0x1a1/0x12d0 [ 236.415460][ T6431] ? __lock_acquire+0x13b3/0x7d40 [ 236.420526][ T6431] ? futex_wait_restart+0x250/0x250 [ 236.425769][ T6431] futex_wake+0x101/0x540 [ 236.430142][ T6431] ? futex_wait+0x680/0x680 [ 236.434683][ T6431] ? verify_lock_unused+0x140/0x140 [ 236.439922][ T6431] ? verify_lock_unused+0x140/0x140 [ 236.445163][ T6431] do_futex+0xd83/0x12b0 [ 236.449571][ T6431] ? __lock_acquire+0x7d40/0x7d40 [ 236.454655][ T6431] ? futex_exit_release+0x1c0/0x1c0 [ 236.459902][ T6431] ? __context_tracking_exit+0x4c/0x80 [ 236.465409][ T6431] __se_sys_futex+0x389/0x420 [ 236.470136][ T6431] ? __x64_sys_futex+0xf0/0xf0 [ 236.474946][ T6431] ? __x64_sys_futex+0x1d/0xf0 [ 236.479751][ T6431] do_syscall_64+0x4c/0xa0 [ 236.484216][ T6431] ? clear_bhb_loop+0x30/0x80 [ 236.488931][ T6431] ? clear_bhb_loop+0x30/0x80 [ 236.493651][ T6431] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 236.499615][ T6431] RIP: 0033:0x7f555ffa6559 [ 236.504068][ T6431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.523706][ T6431] RSP: 002b:00007f555e1dd0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 236.532164][ T6431] RAX: ffffffffffffffda RBX: 00007f556022e098 RCX: 00007f555ffa6559 [ 236.540168][ T6431] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f556022e09c [ 236.548172][ T6431] RBP: 00007f556022e090 R08: 001047d023e24fc2 R09: 0000000000000000 [ 236.556178][ T6431] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 236.564184][ T6431] R13: 00007f556022e128 R14: 00007ffdc47de800 R15: 00007ffdc47de8e8 [ 236.572209][ T6431] [ 238.581071][ T6459] nvmet: failed to open block device ./fi: (-2) [ 238.635156][ T6459] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 238.663168][ T6459] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 238.697973][ T6459] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 238.731393][ T6459] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 238.813465][ T6474] netlink: 20 bytes leftover after parsing attributes in process `syz.4.676'. [ 238.826348][ T6459] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 238.842830][ T6474] FAULT_INJECTION: forcing a failure. [ 238.842830][ T6474] name failslab, interval 1, probability 0, space 0, times 0 [ 238.861931][ T6474] CPU: 1 PID: 6474 Comm: syz.4.676 Not tainted syzkaller #0 [ 238.869414][ T6474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 238.879655][ T6474] Call Trace: [ 238.882987][ T6474] [ 238.885954][ T6474] dump_stack_lvl+0x188/0x250 [ 238.890679][ T6474] ? show_regs_print_info+0x20/0x20 [ 238.895933][ T6474] ? load_image+0x410/0x410 [ 238.900495][ T6474] should_fail+0x383/0x4b0 [ 238.904957][ T6474] should_failslab+0x5/0x20 [ 238.909494][ T6474] slab_pre_alloc_hook+0x51/0xc0 [ 238.914486][ T6474] ? skb_clone+0x1bd/0x350 [ 238.918960][ T6474] kmem_cache_alloc+0x3d/0x280 [ 238.923896][ T6474] skb_clone+0x1bd/0x350 [ 238.928201][ T6474] __netlink_deliver_tap+0x3cb/0x7c0 [ 238.933560][ T6474] netlink_deliver_tap+0x16c/0x180 [ 238.938736][ T6474] netlink_sendskb+0x64/0x130 [ 238.943486][ T6474] seg6_genl_get_tunsrc+0x4c4/0x580 [ 238.948750][ T6474] genl_rcv_msg+0xd0b/0xfa0 [ 238.953327][ T6474] ? genl_bind+0x370/0x370 [ 238.957827][ T6474] ? __dev_queue_xmit+0x1b64/0x2e50 [ 238.963069][ T6474] ? verify_lock_unused+0x140/0x140 [ 238.968331][ T6474] ? dev_queue_xmit+0x20/0x20 [ 238.973055][ T6474] ? seg6_genl_set_tunsrc+0x140/0x140 [ 238.978506][ T6474] netlink_rcv_skb+0x1e9/0x430 [ 238.983308][ T6474] ? genl_bind+0x370/0x370 [ 238.987771][ T6474] ? netlink_ack+0xb10/0xb10 [ 238.992413][ T6474] ? down_read+0x1aa/0x2e0 [ 238.996880][ T6474] genl_rcv+0x24/0x40 [ 239.000901][ T6474] netlink_unicast+0x78f/0x940 [ 239.005721][ T6474] netlink_sendmsg+0x8ba/0xbe0 [ 239.010539][ T6474] ? netlink_getsockopt+0x570/0x570 [ 239.015778][ T6474] ? aa_sock_msg_perm+0x94/0x150 [ 239.020780][ T6474] ? apparmor_socket_sendmsg+0x88/0x230 [ 239.026366][ T6474] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 239.031693][ T6474] ? security_socket_sendmsg+0x7c/0xa0 [ 239.037203][ T6474] ? netlink_getsockopt+0x570/0x570 [ 239.042443][ T6474] ____sys_sendmsg+0x5be/0x8f0 [ 239.047258][ T6474] ? __sys_sendmsg_sock+0x30/0x30 [ 239.052341][ T6474] ? import_iovec+0x6f/0xa0 [ 239.056929][ T6474] ___sys_sendmsg+0x236/0x2e0 [ 239.061663][ T6474] ? __sys_sendmsg+0x290/0x290 [ 239.066517][ T6474] __se_sys_sendmsg+0x1b7/0x2a0 [ 239.071410][ T6474] ? __x64_sys_sendmsg+0x80/0x80 [ 239.076391][ T6474] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 239.082433][ T6474] ? lockdep_hardirqs_on+0x94/0x140 [ 239.087764][ T6474] do_syscall_64+0x4c/0xa0 [ 239.092224][ T6474] ? clear_bhb_loop+0x30/0x80 [ 239.096968][ T6474] ? clear_bhb_loop+0x30/0x80 [ 239.101688][ T6474] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 239.107638][ T6474] RIP: 0033:0x7f555ffa6559 [ 239.112091][ T6474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 239.131745][ T6474] RSP: 002b:00007f555e1fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 239.140225][ T6474] RAX: ffffffffffffffda RBX: 00007f556022dfa0 RCX: 00007f555ffa6559 [ 239.148249][ T6474] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000005 [ 239.156272][ T6474] RBP: 00007f556003d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 239.164289][ T6474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 239.172303][ T6474] R13: 00007f556022e038 R14: 00007f556022dfa0 R15: 00007ffdc47de8e8 [ 239.180334][ T6474] [ 239.183507][ C1] vkms_vblank_simulate: vblank timer overrun [ 240.431769][ T6504] device syzkaller0 entered promiscuous mode [ 240.523062][ T6503] FAULT_INJECTION: forcing a failure. [ 240.523062][ T6503] name failslab, interval 1, probability 0, space 0, times 0 [ 240.576385][ T6503] CPU: 1 PID: 6503 Comm: syz.1.686 Not tainted syzkaller #0 [ 240.583750][ T6503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.593829][ T6503] Call Trace: [ 240.597118][ T6503] [ 240.600078][ T6503] dump_stack_lvl+0x188/0x250 [ 240.604791][ T6503] ? show_regs_print_info+0x20/0x20 [ 240.609996][ T6503] ? load_image+0x410/0x410 [ 240.614531][ T6503] ? __might_sleep+0xf0/0xf0 [ 240.619153][ T6503] ? __lock_acquire+0x7d40/0x7d40 [ 240.624226][ T6503] should_fail+0x383/0x4b0 [ 240.628679][ T6503] should_failslab+0x5/0x20 [ 240.633215][ T6503] slab_pre_alloc_hook+0x51/0xc0 [ 240.638181][ T6503] ? create_new_namespaces+0x34/0x700 [ 240.643585][ T6503] kmem_cache_alloc+0x3d/0x280 [ 240.648391][ T6503] create_new_namespaces+0x34/0x700 [ 240.653623][ T6503] ? apparmor_capable+0x12c/0x190 [ 240.658675][ T6503] ? bpf_lsm_capable+0x5/0x10 [ 240.663383][ T6503] ? security_capable+0x85/0xb0 [ 240.668272][ T6503] unshare_nsproxy_namespaces+0x116/0x160 [ 240.674041][ T6503] ksys_unshare+0x4f6/0x8e0 [ 240.678581][ T6503] ? __lock_acquire+0x7d40/0x7d40 [ 240.683652][ T6503] ? sighand_ctor+0x40/0x40 [ 240.688200][ T6503] ? lock_chain_count+0x20/0x20 [ 240.693095][ T6503] ? syscall_enter_from_user_mode+0x21/0x70 [ 240.699043][ T6503] __x64_sys_unshare+0x34/0x40 [ 240.703881][ T6503] do_syscall_64+0x4c/0xa0 [ 240.708334][ T6503] ? clear_bhb_loop+0x30/0x80 [ 240.713056][ T6503] ? clear_bhb_loop+0x30/0x80 [ 240.717774][ T6503] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 240.723717][ T6503] RIP: 0033:0x7f8af1224559 [ 240.728174][ T6503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.747833][ T6503] RSP: 002b:00007f8aef47c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 240.756309][ T6503] RAX: ffffffffffffffda RBX: 00007f8af14abfa0 RCX: 00007f8af1224559 [ 240.764316][ T6503] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 240.772324][ T6503] RBP: 00007f8af12bb8b0 R08: 0000000000000000 R09: 0000000000000000 [ 240.780333][ T6503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.788344][ T6503] R13: 00007f8af14ac038 R14: 00007f8af14abfa0 R15: 00007ffe61565178 [ 240.796366][ T6503] [ 240.799530][ C1] vkms_vblank_simulate: vblank timer overrun [ 241.429901][ T6521] batman_adv: batadv0: Adding interface: syz_tun [ 241.430390][ T6520] nvmet: failed to open block device ./fi: (-2) [ 241.436983][ T6521] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 241.495322][ T6520] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 241.512936][ T6520] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 241.545253][ T6520] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 241.570357][ T6520] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 241.586336][ T6521] batman_adv: batadv0: Interface activated: syz_tun [ 241.595599][ T6520] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 241.787255][ T6526] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 241.962690][ T6507] loop4: detected capacity change from 0 to 32768 [ 242.062877][ T6544] device syzkaller0 entered promiscuous mode [ 242.268949][ T6507] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 242.731167][ T4266] Bluetooth: hci4: command 0x0406 tx timeout [ 243.215938][ T6565] nvmet: failed to open block device ./fi: (-2) [ 243.224767][ T6551] loop3: detected capacity change from 0 to 8192 [ 243.239502][ T6565] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 243.276809][ T6565] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 243.311262][ T6565] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 243.335615][ T6561] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 243.370954][ T6561] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 244.046290][ T4268] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 244.194629][ T4195] ocfs2: Unmounting device (7,4) on (node local) [ 244.375319][ T6590] device syzkaller0 entered promiscuous mode [ 244.457706][ T4268] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.482902][ T4268] usb 1-1: config 0 has no interfaces? [ 244.502504][ T4268] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 244.522866][ T4268] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.550987][ T4268] usb 1-1: config 0 descriptor?? [ 246.225111][ T6619] loop4: detected capacity change from 0 to 32768 [ 246.234179][ T6613] usb 1-1: USB disconnect, device number 3 [ 246.387668][ T4263] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 246.519018][ T6619] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 246.828974][ T4263] usb 3-1: Using ep0 maxpacket: 8 [ 247.291298][ T4195] ocfs2: Unmounting device (7,4) on (node local) [ 247.346443][ T4263] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 247.368173][ T4263] usb 3-1: config 179 has no interface number 0 [ 247.389910][ T4263] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 247.436180][ T4263] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 247.492774][ T4263] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 247.507512][ T6641] nvmet: failed to open block device ./fi: (-2) [ 247.527844][ T6641] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 247.546291][ T4263] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 247.564348][ T6621] loop3: detected capacity change from 0 to 8192 [ 247.576463][ T6641] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 247.593852][ T4263] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 247.608064][ T6637] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 247.617698][ T4263] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.627930][ T6637] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 247.656491][ T6618] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 247.675466][ T6637] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 247.911653][ T6613] usb 3-1: USB disconnect, device number 3 [ 248.492497][ T6674] loop1: detected capacity change from 0 to 512 [ 248.570052][ T6665] loop3: detected capacity change from 0 to 32768 [ 248.938299][ T6683] nvmet: failed to open block device ./fi: (-2) [ 248.996546][ T6674] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 249.016482][ T6674] ext4 filesystem being mounted at /137/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 249.027903][ T6665] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 249.038525][ T6683] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 249.208139][ T6683] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 249.800946][ T6674] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 250.079964][ T6683] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 250.090968][ T6683] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 250.106511][ T6683] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 250.132875][ T4201] ocfs2: Unmounting device (7,3) on (node local) [ 250.661050][ T4200] Bluetooth: hci3: unexpected event for opcode 0x1001 [ 250.796592][ T6736] netlink: 'syz.2.754': attribute type 19 has an invalid length. [ 250.813494][ T6733] nvmet: failed to open block device ./fi: (-2) [ 250.844873][ T6733] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 250.894446][ T6733] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 250.952821][ T6733] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 251.011181][ T6740] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 251.074063][ T6733] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 251.288532][ T6746] loop4: detected capacity change from 0 to 512 [ 251.342605][ T6746] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 251.676295][ T6746] ext4 filesystem being mounted at /157/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 252.227959][ T6757] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 253.005168][ T6784] nvmet: failed to open block device ./fi: (-2) [ 253.022793][ T6784] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 253.054958][ T6784] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 253.085876][ T6784] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 253.149716][ T6793] netlink: 'syz.1.770': attribute type 19 has an invalid length. [ 253.189394][ T6791] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 253.230800][ T6784] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 253.458608][ T6797] loop2: detected capacity change from 0 to 512 [ 253.629611][ T6797] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 253.667722][ T6797] ext4 filesystem being mounted at /149/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 253.838072][ T6801] fs-verity (loop2, inode 15): Unrecognized descriptor size: 0 bytes [ 254.746974][ T6811] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.021415][ T6812] loop4: detected capacity change from 0 to 8192 [ 255.295351][ T6839] nvmet: failed to open block device ./fi: (-2) [ 255.334931][ T6839] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 255.362674][ T6839] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 255.417659][ T6839] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 255.446981][ T6839] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 255.486488][ T6839] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 255.607157][ T6850] nvmet: Invalid value ' [ 255.607157][ T6850] /D°ç7؉Èh‘B420ãزØAò¡eÕ]ѧ1Jçå8E' for trsvcid [ 255.805257][ T6857] netlink: 'syz.3.785': attribute type 19 has an invalid length. [ 255.878558][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.885320][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.422884][ T6872] loop4: detected capacity change from 0 to 512 [ 256.544105][ T6872] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 256.563407][ T6872] ext4 filesystem being mounted at /162/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 256.654258][ T6886] fs-verity (loop4, inode 15): Unrecognized descriptor size: 0 bytes [ 256.996198][ T6613] Bluetooth: hci4: command 0x0405 tx timeout [ 257.497373][ T6898] input: syz0 as /devices/virtual/input/input9 [ 257.552874][ T6903] CIFS: Attempting to mount \\127.0.0.1\share [ 257.561361][ T6905] netlink: 8 bytes leftover after parsing attributes in process `syz.4.798'. [ 257.578373][ T6903] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 257.618893][ T6907] CIFS: VFS: \\127.0.0.1 SMB response too short (0 bytes) [ 257.786045][ T6916] FAULT_INJECTION: forcing a failure. [ 257.786045][ T6916] name failslab, interval 1, probability 0, space 0, times 0 [ 257.809213][ T6916] CPU: 1 PID: 6916 Comm: syz.0.800 Not tainted syzkaller #0 [ 257.816575][ T6916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 257.826679][ T6916] Call Trace: [ 257.829994][ T6916] [ 257.832967][ T6916] dump_stack_lvl+0x188/0x250 [ 257.837695][ T6916] ? show_regs_print_info+0x20/0x20 [ 257.842941][ T6916] ? load_image+0x410/0x410 [ 257.847491][ T6916] ? __might_sleep+0xf0/0xf0 [ 257.852128][ T6916] ? __lock_acquire+0x7d40/0x7d40 [ 257.857203][ T6916] ? lockdep_hardirqs_on+0x94/0x140 [ 257.862458][ T6916] should_fail+0x383/0x4b0 [ 257.866932][ T6916] should_failslab+0x5/0x20 [ 257.871543][ T6916] slab_pre_alloc_hook+0x51/0xc0 [ 257.876538][ T6916] kmem_cache_alloc_trace+0x47/0x290 [ 257.881883][ T6916] ? x509_key_preparse+0x30d/0x5d0 [ 257.887057][ T6916] x509_key_preparse+0x30d/0x5d0 [ 257.892056][ T6916] asymmetric_key_preparse+0xa5/0x140 [ 257.897661][ T6916] key_create_or_update+0x432/0xa40 [ 257.902912][ T6916] ? security_key_permission+0x7c/0xa0 [ 257.908424][ T6916] ? key_type_put+0x20/0x20 [ 257.912995][ T6916] ? lookup_user_key_possessed+0x40/0x40 [ 257.918704][ T6916] ? __might_fault+0xb3/0x110 [ 257.923436][ T6916] __se_sys_add_key+0x34b/0x410 [ 257.928341][ T6916] ? __x64_sys_add_key+0xc0/0xc0 [ 257.933340][ T6916] ? lockdep_hardirqs_on+0x94/0x140 [ 257.938592][ T6916] ? __x64_sys_add_key+0x1c/0xc0 [ 257.943592][ T6916] do_syscall_64+0x4c/0xa0 [ 257.948095][ T6916] ? clear_bhb_loop+0x30/0x80 [ 257.952812][ T6916] ? clear_bhb_loop+0x30/0x80 [ 257.957558][ T6916] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 257.963522][ T6916] RIP: 0033:0x7fadf003f559 [ 257.967983][ T6916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.974635][ T6903] CIFS: VFS: cifs_mount failed w/return code = -112 [ 257.987629][ T6916] RSP: 002b:00007fadee297028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 257.987678][ T6916] RAX: ffffffffffffffda RBX: 00007fadf02c6fa0 RCX: 00007fadf003f559 [ 257.987695][ T6916] RDX: 0000200000000580 RSI: 0000000000000000 RDI: 0000200000000540 [ 257.987710][ T6916] RBP: 00007fadf00d68b0 R08: fffffffffffffffe R09: 0000000000000000 [ 257.987726][ T6916] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 257.987740][ T6916] R13: 00007fadf02c7038 R14: 00007fadf02c6fa0 R15: 00007ffe428d97e8 [ 258.042775][ T6916] [ 258.045927][ C1] vkms_vblank_simulate: vblank timer overrun [ 258.463331][ T6929] FAULT_INJECTION: forcing a failure. [ 258.463331][ T6929] name fail_futex, interval 1, probability 0, space 0, times 0 [ 258.476474][ T6929] CPU: 0 PID: 6929 Comm: syz.2.804 Not tainted syzkaller #0 [ 258.483808][ T6929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.493901][ T6929] Call Trace: [ 258.497214][ T6929] [ 258.500177][ T6929] dump_stack_lvl+0x188/0x250 [ 258.504901][ T6929] ? show_regs_print_info+0x20/0x20 [ 258.510133][ T6929] ? load_image+0x410/0x410 [ 258.514670][ T6929] ? mark_lock+0x94/0x320 [ 258.519036][ T6929] ? __lock_acquire+0x12df/0x7d40 [ 258.524113][ T6929] should_fail+0x383/0x4b0 [ 258.528614][ T6929] get_futex_key+0x1a1/0x12d0 [ 258.533344][ T6929] ? __lock_acquire+0x13b3/0x7d40 [ 258.538411][ T6929] ? futex_wait_restart+0x250/0x250 [ 258.543673][ T6929] futex_wake+0x101/0x540 [ 258.548056][ T6929] ? futex_wait+0x680/0x680 [ 258.552622][ T6929] ? verify_lock_unused+0x140/0x140 [ 258.557872][ T6929] ? verify_lock_unused+0x140/0x140 [ 258.563125][ T6929] do_futex+0xd83/0x12b0 [ 258.567410][ T6929] ? __lock_acquire+0x7d40/0x7d40 [ 258.572480][ T6929] ? futex_exit_release+0x1c0/0x1c0 [ 258.577725][ T6929] ? __context_tracking_exit+0x4c/0x80 [ 258.583268][ T6929] __se_sys_futex+0x389/0x420 [ 258.587987][ T6929] ? __x64_sys_futex+0xf0/0xf0 [ 258.592795][ T6929] ? __x64_sys_futex+0x1d/0xf0 [ 258.597641][ T6929] do_syscall_64+0x4c/0xa0 [ 258.602102][ T6929] ? clear_bhb_loop+0x30/0x80 [ 258.606812][ T6929] ? clear_bhb_loop+0x30/0x80 [ 258.611564][ T6929] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 258.617499][ T6929] RIP: 0033:0x7f5dca0c8559 [ 258.621970][ T6929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.641613][ T6929] RSP: 002b:00007f5dc82ff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 258.650064][ T6929] RAX: ffffffffffffffda RBX: 00007f5dca350098 RCX: 00007f5dca0c8559 [ 258.658072][ T6929] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5dca35009c [ 258.666079][ T6929] RBP: 00007f5dca350090 R08: 00176edfbd5c6a9a R09: 0000000000000000 [ 258.674171][ T6929] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 258.682172][ T6929] R13: 00007f5dca350128 R14: 00007fff2be290d0 R15: 00007fff2be291b8 [ 258.690190][ T6929] [ 259.307776][ T6936] jffs2: notice: (6936) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 261.221735][ T6987] device syzkaller0 entered promiscuous mode [ 261.489553][ T6996] binder: 6994:6996 ioctl c0306201 0 returned -14 [ 261.504772][ T6996] binder_alloc: 6994: binder_alloc_buf size 12344 failed, no address space [ 261.535220][ T6996] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 261.638096][ T7001] nvmet: failed to open block device ./fi: (-2) [ 261.662022][ T7001] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 261.680759][ T7004] netlink: 'syz.4.828': attribute type 19 has an invalid length. [ 261.689416][ T7001] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 261.713821][ T7001] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 261.747830][ T7001] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 261.778171][ T7001] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 262.736839][ T7027] FAULT_INJECTION: forcing a failure. [ 262.736839][ T7027] name failslab, interval 1, probability 0, space 0, times 0 [ 262.770358][ T7027] CPU: 0 PID: 7027 Comm: syz.3.834 Not tainted syzkaller #0 [ 262.777717][ T7027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.787815][ T7027] Call Trace: [ 262.791133][ T7027] [ 262.794097][ T7027] dump_stack_lvl+0x188/0x250 [ 262.798831][ T7027] ? show_regs_print_info+0x20/0x20 [ 262.804079][ T7027] ? load_image+0x410/0x410 [ 262.808634][ T7027] ? __might_sleep+0xf0/0xf0 [ 262.813269][ T7027] ? __lock_acquire+0x7d40/0x7d40 [ 262.818341][ T7027] should_fail+0x383/0x4b0 [ 262.822805][ T7027] should_failslab+0x5/0x20 [ 262.827353][ T7027] slab_pre_alloc_hook+0x51/0xc0 [ 262.832333][ T7027] kmem_cache_alloc_trace+0x47/0x290 [ 262.837657][ T7027] ? nfs_alloc_fhandle+0x46/0x90 [ 262.842647][ T7027] nfs_alloc_fhandle+0x46/0x90 [ 262.847547][ T7027] nfs_init_fs_context+0x65/0xe80 [ 262.852628][ T7027] alloc_fs_context+0x628/0x7d0 [ 262.857541][ T7027] __se_sys_fsopen+0x111/0x320 [ 262.862358][ T7027] do_syscall_64+0x4c/0xa0 [ 262.866821][ T7027] ? clear_bhb_loop+0x30/0x80 [ 262.871558][ T7027] ? clear_bhb_loop+0x30/0x80 [ 262.876283][ T7027] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 262.882221][ T7027] RIP: 0033:0x7fb164ae6559 [ 262.886677][ T7027] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.906325][ T7027] RSP: 002b:00007fb162d3e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 262.914791][ T7027] RAX: ffffffffffffffda RBX: 00007fb164d6dfa0 RCX: 00007fb164ae6559 [ 262.922811][ T7027] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000001240 [ 262.930830][ T7027] RBP: 00007fb164b7d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 262.938843][ T7027] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 262.947025][ T7027] R13: 00007fb164d6e038 R14: 00007fb164d6dfa0 R15: 00007ffcce61a0b8 [ 262.955054][ T7027] [ 264.241925][ T7054] loop3: detected capacity change from 0 to 512 [ 264.267073][ T7051] binder: 7050:7051 ioctl c0306201 0 returned -14 [ 264.280474][ T7051] binder_alloc: 7050: binder_alloc_buf size 12344 failed, no address space [ 264.309703][ T7051] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 264.372517][ T7054] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 264.404918][ T7054] ext4 filesystem being mounted at /179/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 264.486011][ T7066] nvmet: failed to open block device ./fi: (-2) [ 264.845889][ T7066] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 265.047303][ T7066] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 265.062172][ T7066] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 265.072042][ T7066] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 265.082044][ T7066] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 265.228595][ T4265] wiimote 0005:057E:0330.0003: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 265.269544][ T4265] wiimote 0005:057E:0330.0003: New device registered [ 265.293045][ T7079] wiimote 0005:057E:0330.0003: Device removed [ 265.720297][ T7083] fido_id[7083]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 265.861896][ T7090] device syzkaller0 entered promiscuous mode [ 266.195599][ T7100] FAULT_INJECTION: forcing a failure. [ 266.195599][ T7100] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 266.275866][ T7100] CPU: 0 PID: 7100 Comm: syz.3.849 Not tainted syzkaller #0 [ 266.283221][ T7100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.293329][ T7100] Call Trace: [ 266.296646][ T7100] [ 266.299607][ T7100] dump_stack_lvl+0x188/0x250 [ 266.304339][ T7100] ? show_regs_print_info+0x20/0x20 [ 266.309577][ T7100] ? load_image+0x410/0x410 [ 266.314120][ T7100] ? __lock_acquire+0x7d40/0x7d40 [ 266.319191][ T7100] ? vb2_core_reqbufs+0x8e4/0xf30 [ 266.324260][ T7100] ? v4l2_m2m_ioctl_reqbufs+0xd9/0x1c0 [ 266.329766][ T7100] should_fail+0x383/0x4b0 [ 266.334206][ T7100] prepare_alloc_pages+0x1e3/0x5b0 [ 266.339346][ T7100] __alloc_pages+0x11b/0x480 [ 266.343958][ T7100] ? zone_statistics+0x170/0x170 [ 266.348929][ T7100] __vmalloc_node_range+0x4b1/0x8b0 [ 266.354170][ T7100] vmalloc_user+0x70/0x80 [ 266.358523][ T7100] ? vb2_vmalloc_alloc+0xec/0x330 [ 266.363559][ T7100] vb2_vmalloc_alloc+0xec/0x330 [ 266.368431][ T7100] ? vb2_common_vm_close+0x140/0x140 [ 266.373761][ T7100] __vb2_queue_alloc+0x737/0x1390 [ 266.378879][ T7100] vb2_core_reqbufs+0x8e4/0xf30 [ 266.383772][ T7100] ? vb2_verify_memory_type+0x570/0x570 [ 266.389377][ T7100] ? vb2_reqbufs+0x2fc/0x520 [ 266.394021][ T7100] v4l2_m2m_ioctl_reqbufs+0xd9/0x1c0 [ 266.399356][ T7100] __video_do_ioctl+0xa10/0xe40 [ 266.404240][ T7100] ? __lock_acquire+0x7d40/0x7d40 [ 266.409309][ T7100] ? video_ioctl2+0x30/0x30 [ 266.413876][ T7100] ? __might_fault+0xb3/0x110 [ 266.418573][ T7100] ? _copy_from_user+0x111/0x170 [ 266.423581][ T7100] video_usercopy+0x930/0xf10 [ 266.428342][ T7100] ? video_ioctl2+0x30/0x30 [ 266.432887][ T7100] ? v4l_printk_ioctl+0x130/0x130 [ 266.437972][ T7100] v4l2_ioctl+0x183/0x1d0 [ 266.442343][ T7100] ? v4l2_poll+0x2b0/0x2b0 [ 266.446796][ T7100] __se_sys_ioctl+0xfa/0x170 [ 266.451453][ T7100] do_syscall_64+0x4c/0xa0 [ 266.455919][ T7100] ? clear_bhb_loop+0x30/0x80 [ 266.460640][ T7100] ? clear_bhb_loop+0x30/0x80 [ 266.465365][ T7100] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 266.471298][ T7100] RIP: 0033:0x7fb164ae6559 [ 266.475755][ T7100] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.495403][ T7100] RSP: 002b:00007fb162d3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 266.503866][ T7100] RAX: ffffffffffffffda RBX: 00007fb164d6dfa0 RCX: 00007fb164ae6559 [ 266.512328][ T7100] RDX: 00002000000002c0 RSI: 00000000c0145608 RDI: 0000000000000004 [ 266.520352][ T7100] RBP: 00007fb164b7d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 266.528361][ T7100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 266.536372][ T7100] R13: 00007fb164d6e038 R14: 00007fb164d6dfa0 R15: 00007ffcce61a0b8 [ 266.544407][ T7100] [ 266.556159][ T4265] wiimote 0005:057E:0330.0003: detected device: Nintendo Wii Remote Plus (Gen 2) [ 266.604225][ T4265] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0003/input/input11 [ 266.642653][ T4265] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0003/input/input12 [ 266.687776][ T4265] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0003/input/input10 [ 266.724921][ T7106] FAULT_INJECTION: forcing a failure. [ 266.724921][ T7106] name failslab, interval 1, probability 0, space 0, times 0 [ 266.751902][ T7106] CPU: 0 PID: 7106 Comm: syz.2.851 Not tainted syzkaller #0 [ 266.759261][ T7106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 266.769362][ T7106] Call Trace: [ 266.772678][ T7106] [ 266.775649][ T7106] dump_stack_lvl+0x188/0x250 [ 266.780380][ T7106] ? show_regs_print_info+0x20/0x20 [ 266.785622][ T7106] ? load_image+0x410/0x410 [ 266.790179][ T7106] ? __might_sleep+0xf0/0xf0 [ 266.794806][ T7106] ? __lock_acquire+0x7d40/0x7d40 [ 266.799884][ T7106] should_fail+0x383/0x4b0 [ 266.804365][ T7106] should_failslab+0x5/0x20 [ 266.808912][ T7106] slab_pre_alloc_hook+0x51/0xc0 [ 266.813896][ T7106] kmem_cache_alloc_trace+0x47/0x290 [ 266.819221][ T7106] ? percpu_ref_init+0xc0/0x340 [ 266.824121][ T7106] ? rcu_lock_release+0x20/0x20 [ 266.829007][ T7106] percpu_ref_init+0xc0/0x340 [ 266.833730][ T7106] blkg_alloc+0xc6/0x640 [ 266.838017][ T7106] blkcg_init_queue+0x26/0x430 [ 266.842821][ T7106] blk_alloc_queue+0x427/0x580 [ 266.847631][ T7106] __blk_mq_alloc_disk+0x43/0x150 [ 266.852701][ T7106] ? loop_add+0x263/0x890 [ 266.857070][ T7106] loop_add+0x288/0x890 [ 266.861279][ T7106] loop_control_ioctl+0x124/0x550 [ 266.866350][ T7106] ? xor_init+0x60/0x60 [ 266.870569][ T7106] ? bpf_lsm_file_ioctl+0x5/0x10 [ 266.875550][ T7106] ? security_file_ioctl+0x7c/0xa0 [ 266.880731][ T7106] ? xor_init+0x60/0x60 [ 266.885017][ T7106] __se_sys_ioctl+0xfa/0x170 [ 266.889696][ T7106] do_syscall_64+0x4c/0xa0 [ 266.894152][ T7106] ? clear_bhb_loop+0x30/0x80 [ 266.898869][ T7106] ? clear_bhb_loop+0x30/0x80 [ 266.903582][ T7106] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 266.909514][ T7106] RIP: 0033:0x7f5dca0c8559 [ 266.913963][ T7106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.933709][ T7106] RSP: 002b:00007f5dc8320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 266.942168][ T7106] RAX: ffffffffffffffda RBX: 00007f5dca34ffa0 RCX: 00007f5dca0c8559 [ 266.950187][ T7106] RDX: ffffffffff60003f RSI: 0000000000004c80 RDI: 0000000000000004 [ 266.958210][ T7106] RBP: 00007f5dca15f8b0 R08: 0000000000000000 R09: 0000000000000000 [ 266.966224][ T7106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 266.974406][ T7106] R13: 00007f5dca350038 R14: 00007f5dca34ffa0 R15: 00007fff2be291b8 [ 266.982427][ T7106] [ 267.602625][ T7143] loop3: detected capacity change from 0 to 512 [ 267.691669][ T7143] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 267.706390][ T7143] ext4 filesystem being mounted at /184/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 268.388606][ T7150] fs-verity (loop3, inode 15): Unrecognized descriptor size: 0 bytes [ 268.852023][ T7176] batman_adv: batadv0: Adding interface: dummy0 [ 268.862051][ T7176] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.887683][ C1] vkms_vblank_simulate: vblank timer overrun [ 268.894896][ T7176] batman_adv: batadv0: Interface activated: dummy0 [ 268.940952][ T7176] batadv0: mtu less than device minimum [ 268.972748][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 268.984857][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 268.996996][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.009452][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.021316][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.033124][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.044963][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.056869][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 269.068603][ T7176] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 270.393631][ T7218] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 270.577391][ T7213] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 270.585975][ T7213] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 271.949382][ T7241] jffs2: notice: (7241) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 274.581142][ T21] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 275.020881][ T21] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 276.626258][ T21] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 276.636535][ T21] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 276.649482][ T21] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 276.659106][ T21] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.707445][ T7257] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 276.714578][ T7257] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 276.847454][ T21] pl2303 5-1:1.0: pl2303 converter detected [ 276.874144][ T21] usb 5-1: pl2303 converter now attached to ttyUSB0 [ 277.542567][ T21] usb 5-1: USB disconnect, device number 3 [ 277.581324][ T21] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 277.615327][ T21] pl2303 5-1:1.0: device disconnected [ 277.870181][ T7296] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 279.648660][ T7294] binder: 7293:7294 ioctl 40046205 0 returned -22 [ 281.486281][ T23] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 281.756267][ T23] usb 4-1: Using ep0 maxpacket: 16 [ 281.856400][ T6613] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 281.886733][ T23] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 281.905930][ T23] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 282.121929][ T23] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 282.143804][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.155594][ T23] usb 4-1: Product: syz [ 282.165207][ T23] usb 4-1: Manufacturer: syz [ 282.171837][ T23] usb 4-1: SerialNumber: syz [ 282.266384][ T6613] usb 3-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 282.281184][ T6613] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.303489][ T6613] usb 3-1: config 0 descriptor?? [ 282.348552][ T6613] pwc: Samsung MPC-C10 USB webcam detected. [ 282.576477][ T6613] pwc: send_video_command error -71 [ 282.582039][ T6613] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 282.595615][ T6613] Philips webcam: probe of 3-1:0.0 failed with error -71 [ 282.610056][ T6613] usb 3-1: USB disconnect, device number 4 [ 282.616378][ T23] usb 4-1: 0:2 : does not exist [ 282.711616][ T7345] netlink: 72 bytes leftover after parsing attributes in process `syz.1.918'. [ 282.721430][ T7345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.918'. [ 282.730745][ T7345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.918'. [ 283.316610][ T21] Bluetooth: hci0: command 0x0406 tx timeout [ 283.386994][ T7349] netlink: 16 bytes leftover after parsing attributes in process `syz.4.919'. [ 283.567136][ T7347] loop3: detected capacity change from 0 to 32768 [ 283.579732][ T7353] input: syz0 as /devices/virtual/input/input13 [ 283.587231][ T7354] netlink: 'syz.0.921': attribute type 19 has an invalid length. [ 283.598557][ T23] usb 4-1: USB disconnect, device number 6 [ 283.662429][ T7347] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 284.120564][ T6613] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 284.129283][ T6088] udevd[6088]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 284.417685][ T4201] ocfs2: Unmounting device (7,3) on (node local) [ 284.706243][ T6613] usb 3-1: device descriptor read/all, error -71 [ 286.812880][ T7382] process 'syz.2.929' launched '/dev/fd/3/./proc/thread-self/fail-nth/file0' with NULL argv: empty string added [ 286.863036][ T7382] FAULT_INJECTION: forcing a failure. [ 286.863036][ T7382] name failslab, interval 1, probability 0, space 0, times 0 [ 286.876832][ T7382] CPU: 1 PID: 7382 Comm: syz.2.929 Not tainted syzkaller #0 [ 286.884176][ T7382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 286.894269][ T7382] Call Trace: [ 286.897578][ T7382] [ 286.900535][ T7382] dump_stack_lvl+0x188/0x250 [ 286.905249][ T7382] ? show_regs_print_info+0x20/0x20 [ 286.910474][ T7382] ? load_image+0x410/0x410 [ 286.915095][ T7382] ? __might_sleep+0xf0/0xf0 [ 286.919709][ T7382] ? __lock_acquire+0x7d40/0x7d40 [ 286.924760][ T7382] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 286.930758][ T7382] should_fail+0x383/0x4b0 [ 286.935206][ T7382] should_failslab+0x5/0x20 [ 286.939716][ T7382] slab_pre_alloc_hook+0x51/0xc0 [ 286.944659][ T7382] ? __d_alloc+0x27/0x6d0 [ 286.948996][ T7382] kmem_cache_alloc+0x3d/0x280 [ 286.953771][ T7382] __d_alloc+0x27/0x6d0 [ 286.957934][ T7382] ? d_alloc_pseudo+0xe/0x70 [ 286.962556][ T7382] d_alloc_pseudo+0x19/0x70 [ 286.967068][ T7382] alloc_file_pseudo+0xe0/0x200 [ 286.971932][ T7382] ? alloc_empty_file_noaccount+0x80/0x80 [ 286.977666][ T7382] ? alloc_fd+0x59e/0x650 [ 286.982005][ T7382] sock_alloc_file+0xb3/0x240 [ 286.986690][ T7382] __sys_socket+0x11d/0x170 [ 286.991201][ T7382] __x64_sys_socket+0x76/0x80 [ 286.995882][ T7382] do_syscall_64+0x4c/0xa0 [ 287.000306][ T7382] ? clear_bhb_loop+0x30/0x80 [ 287.004991][ T7382] ? clear_bhb_loop+0x30/0x80 [ 287.009685][ T7382] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 287.015607][ T7382] RIP: 0033:0x7f5dca0c8559 [ 287.020029][ T7382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 287.039680][ T7382] RSP: 002b:00007f5dc8320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 287.048106][ T7382] RAX: ffffffffffffffda RBX: 00007f5dca34ffa0 RCX: 00007f5dca0c8559 [ 287.056092][ T7382] RDX: 0000000000000002 RSI: 0000000000000003 RDI: 0000000000000002 [ 287.064104][ T7382] RBP: 00007f5dca15f8b0 R08: 0000000000000000 R09: 0000000000000000 [ 287.072083][ T7382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 287.080080][ T7382] R13: 00007f5dca350038 R14: 00007f5dca34ffa0 R15: 00007fff2be291b8 [ 287.088068][ T7382] [ 287.091144][ C1] vkms_vblank_simulate: vblank timer overrun [ 287.178768][ T7387] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 287.208175][ T7393] batman_adv: batadv0: Interface deactivated: syz_tun [ 287.234912][ T7387] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 287.288573][ T7393] batman_adv: batadv0: Removing interface: syz_tun [ 287.325443][ T7398] netlink: 'syz.3.935': attribute type 19 has an invalid length. [ 287.362564][ T7387] siw: device registration error -19 [ 287.543608][ T7404] device syzkaller0 entered promiscuous mode [ 289.091755][ T7421] loop2: detected capacity change from 0 to 8192 [ 289.561450][ T7452] netlink: 4 bytes leftover after parsing attributes in process `syz.3.947'. [ 289.913060][ T7463] device syzkaller0 entered promiscuous mode [ 291.717802][ T7484] jffs2: notice: (7484) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 293.546553][ T7507] nvmet: failed to open block device ./fi: (-2) [ 293.559183][ T7504] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 293.570820][ T7506] netlink: 4 bytes leftover after parsing attributes in process `syz.2.963'. [ 293.596725][ T7504] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 293.616551][ T7504] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 293.653452][ T7504] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 293.675176][ T7504] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 293.783192][ T7520] input: syz0 as /devices/virtual/input/input14 [ 294.483953][ T7523] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.946587][ T7545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.976'. [ 295.126746][ T7551] nvmet: failed to open block device ./fi: (-2) [ 295.133863][ T7551] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 295.143539][ T7551] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 295.153189][ T7551] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 295.162839][ T7551] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 295.297389][ T7551] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 299.389082][ T7588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.989'. [ 303.471051][ T7625] nvmet: failed to open block device ./fi: (-2) [ 303.501972][ T7625] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 303.544863][ T7625] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 303.586900][ T7625] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 303.630897][ T7625] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 303.693092][ T7625] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 303.744622][ T7628] nvmet: failed to open block device ./fi: (-2) [ 303.751907][ T7628] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 303.761966][ T7628] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 303.771508][ T7628] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 303.781368][ T7628] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 303.791003][ T7628] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 305.598042][ T6613] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 305.876164][ T6613] usb 2-1: Using ep0 maxpacket: 16 [ 305.906256][ T13] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 306.016363][ T6613] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 306.031489][ T7662] nvmet: failed to open block device ./fi: (-2) [ 306.039026][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 306.048956][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 306.058787][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 306.066229][ T6613] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 306.070458][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 306.110196][ T7662] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 306.156325][ T13] usb 3-1: Using ep0 maxpacket: 8 [ 306.376281][ T6613] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 306.388791][ T6613] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.397865][ T6613] usb 2-1: Product: syz [ 306.402036][ T6613] usb 2-1: Manufacturer: syz [ 306.410134][ T6613] usb 2-1: SerialNumber: syz [ 306.947399][ T6613] usb 2-1: 0:2 : does not exist [ 307.262331][ T13] usb 3-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 307.271493][ T13] usb 3-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 307.296845][ T13] usb 3-1: Product: syz [ 307.322220][ T13] usb 3-1: Manufacturer: syz [ 307.336331][ T13] usb 3-1: SerialNumber: syz [ 307.398231][ T13] usb 3-1: config 0 descriptor?? [ 307.427253][ T6613] usb 2-1: USB disconnect, device number 8 [ 307.448604][ T13] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 308.366328][ T13] gspca_zc3xx: reg_w_i err -110 [ 308.371308][ T13] gspca_zc3xx: probe of 3-1:0.0 failed with error -110 [ 308.463326][ T7691] nvmet: failed to open block device ./fi: (-2) [ 308.477351][ T7691] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 308.482624][ T7639] udevd[7639]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 308.498220][ T7691] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 308.536629][ T7691] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 308.552836][ T7691] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 308.565141][ T7693] nvmet: failed to open block device ./fi: (-2) [ 308.582426][ T7693] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 308.597257][ T7691] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 308.608222][ T7693] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 308.627733][ T7693] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 308.647691][ T7693] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 308.668514][ T7693] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 308.686407][ T7697] batman_adv: batadv0: Interface deactivated: dummy0 [ 308.727274][ T7697] batman_adv: batadv0: Removing interface: dummy0 [ 309.982541][ T7721] jffs2: notice: (7721) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 310.051436][ T13] usb 3-1: USB disconnect, device number 7 [ 310.130212][ T7729] nvmet: failed to open block device ./fi: (-2) [ 310.172488][ T7729] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 310.202482][ T7729] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 310.233332][ T7729] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 310.288687][ T7729] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 310.329949][ T7729] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 310.546293][ T4266] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 311.646108][ T4266] usb 2-1: Using ep0 maxpacket: 32 [ 311.766345][ T4266] usb 2-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 311.787827][ T4266] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.958276][ T4266] usb 2-1: config 0 descriptor?? [ 313.446292][ T4266] usb 2-1: can't set config #0, error -71 [ 313.460159][ T4266] usb 2-1: USB disconnect, device number 9 [ 313.470314][ T7766] nvmet: failed to open block device ./fi: (-2) [ 313.520622][ T7766] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 313.570922][ T7766] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 313.581212][ T7769] loop1: detected capacity change from 0 to 512 [ 313.597841][ T7766] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 313.672422][ T7774] nvmet: failed to open block device ./fi: (-2) [ 313.685079][ T7774] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 313.695430][ T7774] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 313.695778][ T7769] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 313.707068][ T7774] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 313.725802][ T7774] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 313.736529][ T7774] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 313.737059][ T7766] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 313.773495][ T7769] ext4 filesystem being mounted at /191/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 313.864232][ T7781] fs-verity (loop1, inode 15): Unrecognized descriptor size: 0 bytes [ 313.918776][ T7766] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 314.902740][ T7799] input: syz0 as /devices/virtual/input/input17 [ 316.155020][ T7817] nvmet: failed to open block device ./fi: (-2) [ 316.185813][ T7817] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 316.211072][ T7817] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 316.230005][ T7821] nvmet: failed to open block device ./fi: (-2) [ 316.243172][ T7817] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 316.253941][ T7821] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 316.270341][ T7817] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 316.284524][ T7821] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 316.300041][ T7817] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 316.313964][ T7821] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 316.327949][ T7821] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 316.350416][ T7821] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 316.848517][ T7850] nvmet: failed to open block device ./fi: (-2) [ 316.862409][ T7850] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 316.875987][ T7850] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 316.897085][ T7850] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 316.959386][ T7850] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 316.984093][ T7850] nvmet: Disable port '1' before changing attribute in nvmet_param_inline_data_size_store [ 317.204165][ T7871] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1092'. [ 317.219926][ T7871] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 317.702862][ T1423] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.709732][ T1423] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.314510][ T7880] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 318.534810][ T7892] ================================================================== [ 318.543249][ T7892] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 318.552498][ T7892] Read of size 1 at addr ffff8880783fb608 by task syz.3.1099/7892 [ 318.560338][ T7892] [ 318.562689][ T7892] CPU: 0 PID: 7892 Comm: syz.3.1099 Not tainted syzkaller #0 [ 318.566249][ T4236] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 318.570085][ T7892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.587657][ T7892] Call Trace: [ 318.590967][ T7892] [ 318.593943][ T7892] dump_stack_lvl+0x188/0x250 [ 318.598858][ T7892] ? show_regs_print_info+0x20/0x20 [ 318.604107][ T7892] ? load_image+0x410/0x410 [ 318.608648][ T7892] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 318.614170][ T7892] print_address_description+0x60/0x2d0 [ 318.619794][ T7892] ? xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 318.626362][ T7892] kasan_report+0xdf/0x130 [ 318.630820][ T7892] ? xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 318.637376][ T7892] xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 318.643787][ T7892] xfrm_policy_inexact_insert_node+0x95f/0xb70 [ 318.650034][ T7892] xfrm_policy_inexact_alloc_chain+0x7a2/0xe70 [ 318.656235][ T7892] ? xfrm_policy_inexact_insert+0xd7/0x12d0 [ 318.662171][ T7892] xfrm_policy_inexact_insert+0xd7/0x12d0 [ 318.667967][ T7892] ? policy_hash_bysel+0x139/0x750 [ 318.673130][ T7892] xfrm_policy_insert+0x10f/0x940 [ 318.678208][ T7892] xfrm_add_policy+0x4ef/0x8b0 [ 318.683014][ T7892] ? xfrm_dump_sa_done+0xc0/0xc0 [ 318.688078][ T7892] ? apparmor_capable+0x12c/0x190 [ 318.693145][ T7892] ? __nla_parse+0x3c/0x50 [ 318.697606][ T7892] xfrm_user_rcv_msg+0x7fc/0xaa0 [ 318.702610][ T7892] ? xfrm_netlink_rcv+0x90/0x90 [ 318.707545][ T7892] ? __mutex_lock_common+0x435/0x2400 [ 318.712961][ T7892] netlink_rcv_skb+0x1e9/0x430 [ 318.717757][ T7892] ? xfrm_netlink_rcv+0x66/0x90 [ 318.722641][ T7892] ? xfrm_netlink_rcv+0x90/0x90 [ 318.727566][ T7892] ? netlink_ack+0xb10/0xb10 [ 318.732193][ T7892] ? __lock_acquire+0x7d40/0x7d40 [ 318.737269][ T7892] xfrm_netlink_rcv+0x75/0x90 [ 318.742680][ T7892] netlink_unicast+0x78f/0x940 [ 318.747528][ T7892] netlink_sendmsg+0x8ba/0xbe0 [ 318.752341][ T7892] ? netlink_getsockopt+0x570/0x570 [ 318.757581][ T7892] ? aa_sock_msg_perm+0x94/0x150 [ 318.762557][ T7892] ? apparmor_socket_sendmsg+0x88/0x230 [ 318.768139][ T7892] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 318.773463][ T7892] ? security_socket_sendmsg+0x7c/0xa0 [ 318.778974][ T7892] ? netlink_getsockopt+0x570/0x570 [ 318.784217][ T7892] ____sys_sendmsg+0x5be/0x8f0 [ 318.789038][ T7892] ? __sys_sendmsg_sock+0x30/0x30 [ 318.794426][ T7892] ? import_iovec+0x6f/0xa0 [ 318.798982][ T7892] ___sys_sendmsg+0x236/0x2e0 [ 318.803716][ T7892] ? __sys_sendmsg+0x290/0x290 [ 318.808575][ T7892] __se_sys_sendmsg+0x1b7/0x2a0 [ 318.813471][ T7892] ? __x64_sys_sendmsg+0x80/0x80 [ 318.818451][ T7892] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 318.824489][ T7892] ? lockdep_hardirqs_on+0x94/0x140 [ 318.829737][ T7892] do_syscall_64+0x4c/0xa0 [ 318.834196][ T7892] ? clear_bhb_loop+0x30/0x80 [ 318.838923][ T7892] ? clear_bhb_loop+0x30/0x80 [ 318.843645][ T7892] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.849581][ T7892] RIP: 0033:0x7fb164ae6559 [ 318.854037][ T7892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.873691][ T7892] RSP: 002b:00007fb162d3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 318.882149][ T7892] RAX: ffffffffffffffda RBX: 00007fb164d6dfa0 RCX: 00007fb164ae6559 [ 318.890248][ T7892] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 318.898259][ T7892] RBP: 00007fb164b7d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 318.906271][ T7892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.914279][ T7892] R13: 00007fb164d6e038 R14: 00007fb164d6dfa0 R15: 00007ffcce61a0b8 [ 318.922316][ T7892] [ 318.925378][ T7892] [ 318.927776][ T7892] Allocated by task 7892: [ 318.932141][ T7892] __kasan_kmalloc+0xaf/0xe0 [ 318.936777][ T7892] sk_prot_alloc+0xe7/0x210 [ 318.941314][ T7892] sk_alloc+0x2f/0x310 [ 318.945417][ T7892] pfkey_create+0xd8/0x560 [ 318.949904][ T7892] __sock_create+0x473/0x910 [ 318.954539][ T7892] __sys_socket+0xe2/0x170 [ 318.958991][ T7892] __x64_sys_socket+0x76/0x80 [ 318.963712][ T7892] do_syscall_64+0x4c/0xa0 [ 318.968202][ T7892] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 318.974171][ T7892] [ 318.976525][ T7892] Last potentially related work creation: [ 318.982265][ T7892] kasan_save_stack+0x35/0x60 [ 318.986985][ T7892] kasan_record_aux_stack+0xb8/0x100 [ 318.992319][ T7892] call_rcu+0x189/0x900 [ 318.996521][ T7892] netlink_release+0x134c/0x1790 [ 318.997904][ T4236] usb 3-1: unable to get BOS descriptor or descriptor too short [ 319.001493][ T7892] sock_close+0xbf/0x210 [ 319.001520][ T7892] __fput+0x212/0x8c0 [ 319.017419][ T7892] task_work_run+0x125/0x1a0 [ 319.022046][ T7892] exit_to_user_mode_loop+0x10f/0x130 [ 319.027458][ T7892] exit_to_user_mode_prepare+0xee/0x180 [ 319.033035][ T7892] syscall_exit_to_user_mode+0x16/0x40 [ 319.038531][ T7892] do_syscall_64+0x58/0xa0 [ 319.042979][ T7892] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 319.049012][ T7892] [ 319.051366][ T7892] The buggy address belongs to the object at ffff8880783fb000 [ 319.051366][ T7892] which belongs to the cache kmalloc-2k of size 2048 [ 319.065466][ T7892] The buggy address is located 1544 bytes inside of [ 319.065466][ T7892] 2048-byte region [ffff8880783fb000, ffff8880783fb800) [ 319.067033][ T4236] usb 3-1: not running at top speed; connect to a high speed hub [ 319.078953][ T7892] The buggy address belongs to the page: [ 319.078975][ T7892] page:ffffea0001e0fe00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880783fd000 pfn:0x783f8 [ 319.079008][ T7892] head:ffffea0001e0fe00 order:3 compound_mapcount:0 compound_pincount:0 [ 319.079025][ T7892] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 319.079068][ T7892] raw: 00fff00000010200 ffffea00017ee808 ffffea0000b0e208 ffff888017842000 [ 319.079087][ T7892] raw: ffff8880783fd000 0000000000080006 00000001ffffffff 0000000000000000 [ 319.137437][ T7892] page dumped because: kasan: bad access detected [ 319.143891][ T7892] page_owner tracks the page as allocated [ 319.149634][ T7892] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4190, ts 73890528963, free_ts 73795094519 [ 319.169726][ T7892] get_page_from_freelist+0x24f6/0x2670 [ 319.175320][ T7892] __alloc_pages+0x1ee/0x480 [ 319.179950][ T7892] new_slab+0xc0/0x4b0 [ 319.184060][ T7892] ___slab_alloc+0x807/0xdd0 [ 319.188688][ T7892] __kmalloc_node_track_caller+0x13d/0x3a0 [ 319.194535][ T7892] pskb_expand_head+0x128/0x1100 [ 319.199511][ T7892] netlink_trim+0x180/0x220 [ 319.204159][ T7892] netlink_broadcast_filtered+0x69/0x1170 [ 319.209921][ T7892] nlmsg_notify+0xdf/0x190 [ 319.214403][ T7892] rtnetlink_event+0x13a/0x1a0 [ 319.219210][ T7892] raw_notifier_call_chain+0xcb/0x160 [ 319.224615][ T7892] dev_set_mac_address+0x2ed/0x400 [ 319.229765][ T7892] dev_set_mac_address_user+0x2d/0x50 [ 319.235171][ T7892] do_setlink+0x842/0x29d0 [ 319.239629][ T7892] rtnl_newlink+0x15bb/0x1920 [ 319.244347][ T7892] rtnetlink_rcv_msg+0x7f1/0xf10 [ 319.249323][ T7892] page last free stack trace: [ 319.254022][ T7892] free_unref_page_prepare+0x637/0x6c0 [ 319.256941][ T4236] usb 3-1: config 12 has an invalid interface number: 126 but max is 0 [ 319.259521][ T7892] free_unref_page+0x8f/0x2a0 [ 319.259549][ T7892] __unfreeze_partials+0x188/0x1e0 [ 319.277618][ T7892] put_cpu_partial+0x12d/0x190 [ 319.282423][ T7892] qlist_free_all+0x35/0x90 [ 319.286957][ T7892] kasan_quarantine_reduce+0x150/0x160 [ 319.292453][ T7892] __kasan_slab_alloc+0x2f/0xc0 [ 319.292919][ T4236] usb 3-1: config 12 has no interface number 0 [ 319.297332][ T7892] slab_post_alloc_hook+0x4c/0x380 [ 319.297355][ T7892] kmem_cache_alloc_node+0x184/0x2c0 [ 319.297375][ T7892] __alloc_skb+0xf4/0x750 [ 319.297395][ T7892] netlink_ack+0x35c/0xb10 [ 319.297412][ T7892] netlink_rcv_skb+0x267/0x430 [ 319.297429][ T7892] netlink_unicast+0x78f/0x940 [ 319.297451][ T7892] netlink_sendmsg+0x8ba/0xbe0 [ 319.297468][ T7892] __sys_sendto+0x46d/0x620 [ 319.297488][ T7892] __x64_sys_sendto+0xda/0xf0 [ 319.297509][ T7892] [ 319.297515][ T7892] Memory state around the buggy address: [ 319.297527][ T7892] ffff8880783fb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 319.297543][ T7892] ffff8880783fb580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 319.297565][ T7892] >ffff8880783fb600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 319.297575][ T7892] ^ [ 319.297585][ T7892] ffff8880783fb680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 319.357027][ T4236] usb 3-1: config 12 interface 126 has no altsetting 0 [ 319.362550][ T7892] ffff8880783fb700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 319.362575][ T7892] ================================================================== [ 319.362585][ T7892] Disabling lock debugging due to kernel taint [ 319.362778][ T7892] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 319.427445][ T7892] CPU: 0 PID: 7892 Comm: syz.3.1099 Tainted: G B syzkaller #0 [ 319.436237][ T7892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 319.446322][ T7892] Call Trace: [ 319.449629][ T7892] [ 319.452589][ T7892] dump_stack_lvl+0x188/0x250 [ 319.457311][ T7892] ? show_regs_print_info+0x20/0x20 [ 319.462552][ T7892] ? load_image+0x410/0x410 [ 319.467092][ T7892] panic+0x2f8/0x850 [ 319.471016][ T7892] ? bpf_jit_dump+0xd0/0xd0 [ 319.475558][ T7892] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 319.481485][ T7892] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 319.487412][ T7892] ? _raw_spin_unlock+0x40/0x40 [ 319.492305][ T7892] ? xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 319.498852][ T7892] check_panic_on_warn+0x80/0xa0 [ 319.503825][ T7892] ? xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 319.510357][ T7892] end_report+0x6d/0xf0 [ 319.514557][ T7892] kasan_report+0x102/0x130 [ 319.519097][ T7892] ? xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 319.525634][ T7892] xfrm_policy_inexact_list_reinsert+0x5a3/0x650 [ 319.531995][ T7892] xfrm_policy_inexact_insert_node+0x95f/0xb70 [ 319.538190][ T7892] xfrm_policy_inexact_alloc_chain+0x7a2/0xe70 [ 319.544381][ T7892] ? xfrm_policy_inexact_insert+0xd7/0x12d0 [ 319.550304][ T7892] xfrm_policy_inexact_insert+0xd7/0x12d0 [ 319.556061][ T7892] ? policy_hash_bysel+0x139/0x750 [ 319.561211][ T7892] xfrm_policy_insert+0x10f/0x940 [ 319.566270][ T7892] xfrm_add_policy+0x4ef/0x8b0 [ 319.571064][ T7892] ? xfrm_dump_sa_done+0xc0/0xc0 [ 319.576029][ T7892] ? apparmor_capable+0x12c/0x190 [ 319.581084][ T7892] ? __nla_parse+0x3c/0x50 [ 319.585540][ T7892] xfrm_user_rcv_msg+0x7fc/0xaa0 [ 319.590509][ T7892] ? xfrm_netlink_rcv+0x90/0x90 [ 319.595408][ T7892] ? __mutex_lock_common+0x435/0x2400 [ 319.600822][ T7892] netlink_rcv_skb+0x1e9/0x430 [ 319.605621][ T7892] ? xfrm_netlink_rcv+0x66/0x90 [ 319.610502][ T7892] ? xfrm_netlink_rcv+0x90/0x90 [ 319.615394][ T7892] ? netlink_ack+0xb10/0xb10 [ 319.620021][ T7892] ? __lock_acquire+0x7d40/0x7d40 [ 319.625086][ T7892] xfrm_netlink_rcv+0x75/0x90 [ 319.629797][ T7892] netlink_unicast+0x78f/0x940 [ 319.634610][ T7892] netlink_sendmsg+0x8ba/0xbe0 [ 319.639413][ T7892] ? netlink_getsockopt+0x570/0x570 [ 319.644644][ T7892] ? aa_sock_msg_perm+0x94/0x150 [ 319.649619][ T7892] ? apparmor_socket_sendmsg+0x88/0x230 [ 319.655202][ T7892] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 319.658884][ T4236] usb 3-1: string descriptor 0 read error: -22 [ 319.660520][ T7892] ? security_socket_sendmsg+0x7c/0xa0 [ 319.672149][ T7892] ? netlink_getsockopt+0x570/0x570 [ 319.674295][ T4236] usb 3-1: New USB device found, idVendor=2013, idProduct=025c, bcdDevice=a4.f9 [ 319.677376][ T7892] ____sys_sendmsg+0x5be/0x8f0 [ 319.677408][ T7892] ? __sys_sendmsg_sock+0x30/0x30 [ 319.677436][ T7892] ? import_iovec+0x6f/0xa0 [ 319.700777][ T7892] ___sys_sendmsg+0x236/0x2e0 [ 319.705494][ T7892] ? __sys_sendmsg+0x290/0x290 [ 319.710315][ T7892] __se_sys_sendmsg+0x1b7/0x2a0 [ 319.715204][ T7892] ? __x64_sys_sendmsg+0x80/0x80 [ 319.720179][ T7892] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 319.726204][ T7892] ? lockdep_hardirqs_on+0x94/0x140 [ 319.731445][ T7892] do_syscall_64+0x4c/0xa0 [ 319.735894][ T7892] ? clear_bhb_loop+0x30/0x80 [ 319.740611][ T7892] ? clear_bhb_loop+0x30/0x80 [ 319.745328][ T7892] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 319.751259][ T7892] RIP: 0033:0x7fb164ae6559 [ 319.755705][ T7892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.756469][ T4236] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.775346][ T7892] RSP: 002b:00007fb162d3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.775374][ T7892] RAX: ffffffffffffffda RBX: 00007fb164d6dfa0 RCX: 00007fb164ae6559 [ 319.775389][ T7892] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 319.775402][ T7892] RBP: 00007fb164b7d8b0 R08: 0000000000000000 R09: 0000000000000000 [ 319.775415][ T7892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 319.775427][ T7892] R13: 00007fb164d6e038 R14: 00007fb164d6dfa0 R15: 00007ffcce61a0b8 [ 319.775449][ T7892] [ 319.783654][ T7892] Kernel Offset: disabled [ 319.851375][ T7892] Rebooting in 86400 seconds..