last executing test programs: 3m55.516695644s ago: executing program 32 (id=157): r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) listen(r0, 0x2) accept4(r0, 0x0, 0x0, 0x80800) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x4000, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) 3m35.08123061s ago: executing program 1 (id=287): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x28fb87, 0x800, 0x1, 0x3a}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x59e6, 0x80, 0x1, 0x15e, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x1, 0x3, 0x0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9621, 0x40, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x3e, {0x0, 0x1, 0x0, 0x4, 0x5}}) 3m34.523255865s ago: executing program 1 (id=294): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000640)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000900), r1) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000940)={0x24, r4, 0x511, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0xa800) 3m34.341601299s ago: executing program 1 (id=297): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, &(0x7f0000000140)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d80672e65a6a0a72e19c2b60bd6276fd8bb6366e9d1ed9a60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d10d1f600"}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff00", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90be8b1c5500000000004000f0f9ffff0000000000ffff00", [0x80000000006, 0x6]}}) 3m34.172555852s ago: executing program 1 (id=299): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) sendto$inet6(r0, &(0x7f00000005c0)="f5", 0x1, 0x4c810, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) 3m34.052949596s ago: executing program 1 (id=302): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5005, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf0, 0x7e, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x4, &(0x7f0000000040)=ANY=[@ANYRES16]) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000040)=""/95) 3m32.167830477s ago: executing program 1 (id=316): syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt_nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./mnt_nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt_nfsd/portlist\x00', 0x2, 0x10) write(r0, &(0x7f0000000340)='4', 0x1) 3m18.53132076s ago: executing program 33 (id=402): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b3, 0x0, 0x1, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x1fffd, 0x0, 0x3, 0x2000000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x33e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x10, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, r4, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x2d, {0x9, 0x0, 0x200001, 0x0, 0x0, 0x400}}) 3m17.014913217s ago: executing program 34 (id=316): syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt_nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./mnt_nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt_nfsd/portlist\x00', 0x2, 0x10) write(r0, &(0x7f0000000340)='4', 0x1) 2m58.716659734s ago: executing program 5 (id=506): syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000080)=ANY=[@ANYBLOB="1201010200000040b42181004000"], 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='io.stat\x00', 0x26e1, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x8901, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c23003f) write$cgroup_devices(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="80fd"], 0xa) 2m57.687921122s ago: executing program 5 (id=512): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x10507e, 0xa6) read$FUSE(r0, 0x0, 0x0) 2m57.600343056s ago: executing program 5 (id=514): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000440)="2e66f2406d2e400f20da66450f388078800f01dfc4a36d5f19b2b9800000c00f3235000800000f30b9ca0200000f320fc72a0f01c3c7442400a5000000c744240207000000ff1c24", 0x48}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2m57.389045561s ago: executing program 5 (id=515): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0xb89046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) 2m57.318262909s ago: executing program 5 (id=516): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0xf39, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000480)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x5, 0x1, 0x3, 0x111}, 0x0, 0x1, 0x0, 0x0) syz_ublk_process_io(0x0, 0x0, 0x9, 0x0, 0x0) 2m56.925449755s ago: executing program 5 (id=518): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ff4ae0086d04dd08f4ff080203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x800000000000002, 0x0) sendmsg$IPSET_CMD_LIST(r1, 0x0, 0x48000) 2m56.466874712s ago: executing program 35 (id=518): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000ff4ae0086d04dd08f4ff080203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x800000000000002, 0x0) sendmsg$IPSET_CMD_LIST(r1, 0x0, 0x48000) 2m36.185504627s ago: executing program 3 (id=639): r0 = syz_open_dev$loop(&(0x7f0000000200), 0x5, 0x801) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) setsockopt(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)="02", 0x1) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000207, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000200f97a640d35a7386700", "28094cf00000000000004ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac000000000000000000080000000000000000001900", "90be8b1c55080021000c547d03daa0f4bd00", [0x7f, 0x9]}}) 2m35.997658143s ago: executing program 3 (id=641): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000900)="580000001400192340834b80040d8c560a066e0202ff000000000300000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200060c10000000010000000000", 0x58}], 0x1) 2m35.879595466s ago: executing program 3 (id=643): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xea8}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xf8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 2m35.46748751s ago: executing program 3 (id=645): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040)=0x10001, 0x4) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 2m35.233281628s ago: executing program 3 (id=646): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/filehandle\x00', 0x2, 0x0) write(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$binfmt_register(r0, 0x0, 0x0) 2m34.938646517s ago: executing program 3 (id=649): pipe2(&(0x7f0000000340)={0x0, 0x0}, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) tee(r1, r0, 0xff, 0x8) r3 = landlock_create_ruleset(&(0x7f0000000100)={0x4424, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0xa) vmsplice(r2, &(0x7f0000000300)=[{&(0x7f0000000a40)="8b", 0x1}], 0x1, 0x0) 2m19.792636098s ago: executing program 36 (id=649): pipe2(&(0x7f0000000340)={0x0, 0x0}, 0x0) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) tee(r1, r0, 0xff, 0x8) r3 = landlock_create_ruleset(&(0x7f0000000100)={0x4424, 0x2}, 0x18, 0x0) landlock_restrict_self(r3, 0xa) vmsplice(r2, &(0x7f0000000300)=[{&(0x7f0000000a40)="8b", 0x1}], 0x1, 0x0) 1m53.514573689s ago: executing program 7 (id=945): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_link_key_notify={{0x18, 0x17}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, "0102030405060708090a0b0c0d0e0f10", 0x8}}}, 0x1a) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x0, 0xc8}}}, 0x6) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000100)={0x2}, 0x2) connect$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000100)={0x3}, 0x2) 1m52.045450113s ago: executing program 7 (id=966): r0 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x0) fchdir(r1) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file3\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x0) 1m51.924153012s ago: executing program 7 (id=960): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100001000000000000e900000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x48ecedaa7bbd76df}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000002180)={&(0x7f0000002500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_KEY_END={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1m51.924021856s ago: executing program 2 (id=961): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000200)={@val={0xa, 0x10}, @void, @eth={@broadcast, @random="d5cf54bba91a", @void, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x0, 0x2, 0x14, 0x68, 0x0, 0x4, 0x6, 0x0, @local, @local}, @payload_mcast={{{{{{0x2c, 0x0, 0x1, 0x1, 0x1, 0xb, 0x1, 0x2, 0x4c12, 0x0, 0x1, 0x8, 0x3, 0x1, 0x5f4, 0x6, 0xfffffffd, 0x4e20, 0x4e20}, 0x1, 0x4}, 0x3, 0x1}, 0x2}}}}}}}}, 0x52) 1m51.823434194s ago: executing program 7 (id=964): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00') 1m51.753783041s ago: executing program 7 (id=965): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xd4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x1, 0x0, 0x0, {0xa}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0xa}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x0, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x0, 0x0, 0x2}]}, 0x38}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000000200)="11223344", 0x4, 0x0, &(0x7f0000000300)={0xa, 0x4d2, 0x0, @remote}, 0x1c) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)={0x28, 0x1, 0x3, 0x1, 0x0, 0x0, {0xa}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x1, 0x1}}, @NFQA_PAYLOAD={0x8, 0xa, '\x00\x00\x00\x00'}]}, 0x28}}, 0x0) 1m51.605414381s ago: executing program 2 (id=969): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r2, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r4, &(0x7f00000001c0)=[{0x1, 0x2}], 0xdeadbeef, 0x8, 0x1}) 1m51.449896267s ago: executing program 7 (id=970): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1df) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) write(r0, &(0x7f0000000000)="0d9ccf1cb8d871123f1c06000000000000009a42ffffff7f0000000057a02c6bb4a8afdd55b057d1b81536fbdd13d4c4fc4e6e", 0x33) r1 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r1, &(0x7f00000091c0)=""/16384, 0x4000) 1m51.373782096s ago: executing program 2 (id=971): mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') fchownat(r0, 0x0, 0x0, 0x0, 0x5b134cc06e37116a) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f0000000080)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) unlink(&(0x7f00000004c0)='./file0\x00') 1m50.997439184s ago: executing program 37 (id=970): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1df) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) write(r0, &(0x7f0000000000)="0d9ccf1cb8d871123f1c06000000000000009a42ffffff7f0000000057a02c6bb4a8afdd55b057d1b81536fbdd13d4c4fc4e6e", 0x33) r1 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r1, &(0x7f00000091c0)=""/16384, 0x4000) 1m50.990089131s ago: executing program 2 (id=974): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00') 1m50.844513973s ago: executing program 2 (id=975): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/lo/address\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/64, 0x40) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/net/lo/broadcast\x00', 0x0, 0x0) read(r1, &(0x7f0000000400)=""/64, 0x40) 1m50.547989569s ago: executing program 2 (id=976): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, '\x00', 0x17}, 0x3}}, 0x0, 0x0, 0x1e, 0x0, "3f9c4c403fb2292c42675dd3a9fe9379c36b8e76c2fa00005088ebe5facc1a8517e6a5e4128f79dd1a59cca90ce3e1b85253f099e56bc82c2c0e2a62b1a005de77ce420e56a79695134f51a32b379cd2"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x7, @loopback, 0xc88}}, 0x0, 0x0, 0xa, 0x0, "25c633e7eb9cc056ed394ba71b6e5d7bf4d988ea7c340885973233ddc0946fbd53f014e2854b661b3f9f55a7e67ba35c3537ea83c3817a08930cf99a34dfc5e167b887734921da2397b9cc8b1e235b95"}, 0xd8) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffd, @loopback, 0x3681}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) 1m50.083387576s ago: executing program 38 (id=976): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, '\x00', 0x17}, 0x3}}, 0x0, 0x0, 0x1e, 0x0, "3f9c4c403fb2292c42675dd3a9fe9379c36b8e76c2fa00005088ebe5facc1a8517e6a5e4128f79dd1a59cca90ce3e1b85253f099e56bc82c2c0e2a62b1a005de77ce420e56a79695134f51a32b379cd2"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x7, @loopback, 0xc88}}, 0x0, 0x0, 0xa, 0x0, "25c633e7eb9cc056ed394ba71b6e5d7bf4d988ea7c340885973233ddc0946fbd53f014e2854b661b3f9f55a7e67ba35c3537ea83c3817a08930cf99a34dfc5e167b887734921da2397b9cc8b1e235b95"}, 0xd8) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffd, @loopback, 0x3681}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) 1m21.847035953s ago: executing program 9 (id=1116): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x304}, "150000000200", "5579000000000000001000", "d28d34eb", "cb9d8450ab655ddc"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) 1m21.677476999s ago: executing program 9 (id=1119): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000240)=0x1) ioctl$int_in(r2, 0x5452, &(0x7f00000001c0)=0xffff) write(r0, 0x0, 0x0) 1m21.228388176s ago: executing program 9 (id=1120): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x22d4, 0x1503, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x50, 0x9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x2, 0x0, {0x9, 0x21, 0xff7f, 0x79, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3, 0x9, 0xf9}}}}}]}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000400)={0x24, 0x0, 0x0, &(0x7f0000000440), 0x0}, 0x0) 1m19.34631684s ago: executing program 9 (id=1130): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) ioprio_set$uid(0x3, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x8, 0x0, 0x2, r0, 0x0, 0x0, 0x4}]) 1m19.165939876s ago: executing program 9 (id=1132): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)={0x114, r1, 0xe701ac47a3d23ecd, 0x0, 0x2, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x02\v\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93UK\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~=\xe5\xdc\x90\a\xe7M\x9c<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private1}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x114}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$NLBL_CALIPSO_C_REMOVE(r2, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x8080) 1m19.055686086s ago: executing program 9 (id=1135): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='udp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001a0)='./nfsd/max_block_size\x00', 0x1, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x9) 1m3.903140544s ago: executing program 39 (id=1135): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='udp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000001a0)='./nfsd/max_block_size\x00', 0x1, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYRESDEC], 0x9) 19.325979312s ago: executing program 8 (id=1538): r0 = fsopen(&(0x7f0000000080)='tmpfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xf) close(r1) fsconfig$FSCONFIG_SET_FLAG(r0, 0x0, &(0x7f0000000040)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 19.252045108s ago: executing program 8 (id=1540): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) lseek(r0, 0x101, 0x1) getdents64(r0, 0xfffffffffffffffe, 0x29) 19.193221941s ago: executing program 8 (id=1541): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000100)="2f0000001100010102030405060708090a0b0c0d0e0f10", 0x17) write(r0, &(0x7f0000000200)="05000000010001", 0x7) write(r0, &(0x7f0000000300)="23000000010002", 0x7) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 19.03343055s ago: executing program 8 (id=1542): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f00000000c0)={0x1, 0x3, 0x5, 0x8}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dri/0/name\x00', 0x0, 0x0) read(r1, &(0x7f0000000100)=""/256, 0x100) 18.978148618s ago: executing program 8 (id=1543): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000000203030000000000000000000000b3660800010001"], 0x1c}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/netfilter/nfnetlink_queue\x00', 0x0, 0x0) read(r1, &(0x7f0000000400), 0x1000) 18.918052983s ago: executing program 8 (id=1545): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) quotactl$Q_QUOTAON(0xffffffff80000102, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x4804, 0x3}, 0x30, 0x0) landlock_restrict_self(r1, 0xa) 3.608557684s ago: executing program 40 (id=1545): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) quotactl$Q_QUOTAON(0xffffffff80000102, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x4804, 0x3}, 0x30, 0x0) landlock_restrict_self(r1, 0xa) 3.557852227s ago: executing program 6 (id=1642): write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x2000a, 0xa, 0x1}}, 0x30) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r0, 0x5393, &(0x7f0000000100)=0x3) 3.284785882s ago: executing program 6 (id=1643): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f240902020000000001"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000440)={0x0, 0x17, 0x21, "e971e87b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000940)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000a40)={0x0, 0xc, 0x1, "ba"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000c80)={0x40, 0x7, 0x2, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.080113978s ago: executing program 0 (id=1647): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000000d000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x67, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x485, 0x0, 0x4}]}) 1.876226782s ago: executing program 0 (id=1648): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) close(0xffffffffffffffff) r1 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x8be, 0x400, 0x1024002, 0x8004d}, &(0x7f0000000380)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000980)=@IORING_OP_SHUTDOWN={0x22, 0x8, 0x0, r0}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000001c0)={0x2e, 0x4d, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x9ad, 0x0, 0x0, 0x1000, 0x803, 0x0, 0x0, 0x162}}}, 0x0) 1.774043647s ago: executing program 0 (id=1649): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat$ppp(0xffffffffffffff9c, 0x0, 0x88802, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x61) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000040)={0x2a0a00300, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) 1.366586446s ago: executing program 4 (id=1651): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f00000005c0)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x2, @remote, 0x7}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000080)={0x67}, 0x8) sendmmsg$inet(r0, &(0x7f0000001940)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="01", 0x1}], 0x1}}], 0x1, 0xc0) 1.352371982s ago: executing program 0 (id=1652): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)={0x48, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0xffffffffffffffff}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 1.171730863s ago: executing program 4 (id=1653): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x20000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x1c, r2, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010087779e8afddbdf2503000000060001004e200000080006000a"], 0x24}, 0x1, 0x0, 0x0, 0x20008001}, 0x840) 1.012867429s ago: executing program 4 (id=1654): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000780)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000200)={0x28, 0x5, r1, 0x0, &(0x7f0000000a40)="7f", 0x1, 0xfffffffffffff0e9}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000180)={0x28, 0x3, r1, 0x0, &(0x7f0000000740)='\"', 0x1}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r1, 0x0, &(0x7f0000002500)="94", 0x1, 0x1000000007}) ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000300)={0x28, 0x2, r1, 0x0, &(0x7f0000000280)="1368d4a464", 0x5, 0x7}) 948.674931ms ago: executing program 0 (id=1655): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x801, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000380)={{0x1, 0x7ff, 0x4b, 0x8009}, 'syz0\x00', 0x8}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffe, 0x2) r2 = dup3(r1, r0, 0x80000) ioctl$HIDIOCGPHYS(r2, 0x8028c003, 0x0) 787.796641ms ago: executing program 4 (id=1656): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast1}, 0x9}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 726.912598ms ago: executing program 6 (id=1657): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000440)={0x1, 0x0, [{0x1, 0xfff, 0x4, 0xffffffff, 0x3}]}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0x12, 0x5}) 535.435424ms ago: executing program 0 (id=1658): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000300)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x21, 0x9, {0x9, 0x21, 0xff01, 0x7f, 0x1, {0x22, 0xa95}}}}, &(0x7f00000005c0)={0x2c, &(0x7f0000000340)={0x40, 0xa, 0x22, "957749900089ecb6e5033898187ea5929a6aa2531e54f1cc473942fa2d851653ec81"}, 0x0, 0x0, 0x0, 0x0}) 445.103743ms ago: executing program 4 (id=1659): madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x6, 0x0, 0x0, 0x0, 0x0, 0x42, 0x0, 0x22}) 390.567695ms ago: executing program 6 (id=1660): mkdir(&(0x7f0000000300)='./bus\x00', 0x63) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000200)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) lsetxattr$security_capability(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) 107.511253ms ago: executing program 4 (id=1661): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 107.339222ms ago: executing program 6 (id=1662): ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0xb) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000380)={'nat\x00', 0x2, [{}, {}]}, 0x48) 0s ago: executing program 6 (id=1663): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x3, 0x0, [{0x1b, 0x0, 0xfee00c00}, {0x832, 0x0, 0x40000}, {0x6e0, 0x0, 0x80000100000}]}) kernel console output (not intermixed with test programs): put/input30 [ 275.879673][ T46] usb 1-1: USB disconnect, device number 13 [ 275.879786][ C1] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 276.518666][ T27] [drm] Initialized gud 1.0.0 for 7-1:1.0 on minor 1 [ 276.916266][ T27] Console: switching to colour frame buffer device 128x48 [ 276.933821][ T27] gud 7-1:1.0: [drm] fb0: guddrmfb frame buffer device [ 276.952139][ T27] usb 7-1: USB disconnect, device number 33 [ 276.987846][ T27] Console: switching to colour VGA+ 80x25 [ 277.417051][ T9997] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1210'. [ 277.775051][T10010] xs_local_setup_socket: unhandled error (13) connecting to /var/run/gssproxy.sock [ 278.178114][T10024] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 278.520792][ T5716] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 278.672332][ T5716] usb 1-1: Using ep0 maxpacket: 16 [ 278.673527][ T5716] usb 1-1: New USB device found: idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 278.677162][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.677190][ T5716] usb 1-1: Product: syz [ 278.677207][ T5716] usb 1-1: Manufacturer: syz [ 278.677223][ T5716] usb 1-1: SerialNumber: syz [ 278.716112][ T5716] usb 1-1: config 0 descriptor?? [ 278.716309][T10043] netlink: 'syz.6.1219': attribute type 19 has an invalid length. [ 278.741216][ T5716] usb 1-1: selecting invalid altsetting 1 [ 278.741240][ T5716] technisat-usb2: could not set alternate setting to 0 [ 278.945519][ T5716] technisat-usb2: firmware version: 0.0 [ 278.945566][ T5716] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 279.120236][ T191] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 279.290196][ T191] usb 7-1: Using ep0 maxpacket: 32 [ 279.291247][ T191] usb 7-1: New USB device found: idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 279.292654][ T191] usb 7-1: config 0 has an invalid interface number: 12 but max is 0 [ 279.292681][ T191] usb 7-1: config 0 has no interface number 0 [ 279.292752][ T191] usb 7-1: config 0 interface 12 has no altsetting 0 [ 279.295432][ T191] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.295456][ T191] usb 7-1: Product: syz [ 279.295500][ T191] usb 7-1: Manufacturer: syz [ 279.295523][ T191] usb 7-1: SerialNumber: syz [ 279.305446][ T191] usb 7-1: config 0 descriptor?? [ 279.378820][ T5716] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 279.379646][ T5716] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 279.379708][ T5716] usb 1-1: media controller created [ 279.379794][ T5716] technisat-usb2: i2c-error: out failed 53 = -22 [ 279.379883][ T5716] dvb-usb: MAC address reading failed. [ 279.429292][ T5716] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 279.535872][ T5716] DVB: Unable to find symbol stv090x_attach() [ 280.043408][ T5716] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 280.058890][T10029] technisat-usb2: i2c-error: out failed 00 = -22 [ 280.150576][ T5716] rc_core: IR keymap rc-technisat-usb2 not found [ 280.150596][ T5716] Registered IR keymap rc-empty [ 280.153316][ T5716] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 280.157284][ T5716] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input31 [ 280.175944][ T5716] dvb-usb: schedule remote query interval to 100 msecs. [ 280.180756][ T5716] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 280.217707][ T5716] usb 1-1: USB disconnect, device number 14 [ 280.347781][ T5716] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 280.548715][ T191] f81534 7-1:0.12: f81534_set_register: reg: 1003 data: 40 failed: -71 [ 280.548778][ T191] f81534 7-1:0.12: f81534_find_config_idx: read failed: -71 [ 280.548798][ T191] f81534 7-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 280.548881][ T191] f81534 7-1:0.12: probe with driver f81534 failed with error -71 [ 280.562228][ T191] usb 7-1: USB disconnect, device number 34 [ 280.752495][T10094] syzkaller1: entered promiscuous mode [ 280.752521][T10094] syzkaller1: entered allmulticast mode [ 281.048975][T10105] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1225'. [ 281.130863][ T5621] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 281.148509][ T5621] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 281.159148][ T5621] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 281.168117][ T5621] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 281.169982][ T5621] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 281.441006][T10121] FAULT_INJECTION: forcing a failure. [ 281.441006][T10121] name failslab, interval 1, probability 0, space 0, times 0 [ 281.441063][T10121] CPU: 0 UID: 0 PID: 10121 Comm: syz.0.1229 Tainted: G L syzkaller #0 PREEMPT(full) [ 281.441099][T10121] Tainted: [L]=SOFTLOCKUP [ 281.441108][T10121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 281.441122][T10121] Call Trace: [ 281.441131][T10121] [ 281.441141][T10121] dump_stack_lvl+0xe8/0x150 [ 281.441179][T10121] should_fail_ex+0x3eb/0x540 [ 281.441209][T10121] should_failslab+0xa8/0x100 [ 281.441241][T10121] ? ptlock_alloc+0x20/0x70 [ 281.441275][T10121] kmem_cache_alloc_noprof+0x9c/0x600 [ 281.441302][T10121] ? ptlock_alloc+0x20/0x70 [ 281.441343][T10121] ptlock_alloc+0x20/0x70 [ 281.441378][T10121] pte_alloc_one+0x7a/0x370 [ 281.441405][T10121] __pte_alloc+0x25/0x1a0 [ 281.441434][T10121] walk_pgd_range+0xfd5/0x1dc0 [ 281.441487][T10121] ? __pfx_guard_install_set_pte+0x10/0x10 [ 281.441520][T10121] ? __pfx_guard_install_set_pte+0x10/0x10 [ 281.441557][T10121] ? __pfx_guard_install_set_pte+0x10/0x10 [ 281.441592][T10121] ? __pfx_guard_install_set_pte+0x10/0x10 [ 281.441629][T10121] ? __pfx_guard_install_pte_entry+0x10/0x10 [ 281.441663][T10121] ? __pfx_walk_pgd_range+0x10/0x10 [ 281.441706][T10121] __walk_page_range+0x16d/0x720 [ 281.441739][T10121] ? tlb_flush_mmu+0x8ef/0xa30 [ 281.441781][T10121] walk_page_range_vma_unsafe+0x309/0x410 [ 281.441814][T10121] ? __pfx_zap_vma_range+0x10/0x10 [ 281.441844][T10121] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 281.441896][T10121] madvise_vma_behavior+0x44de/0x5180 [ 281.441936][T10121] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 281.441975][T10121] ? do_raw_spin_lock+0x12b/0x2f0 [ 281.442018][T10121] ? rcu_is_watching+0x16/0xb0 [ 281.442050][T10121] ? trace_hrtimer_start+0x82/0x200 [ 281.442080][T10121] ? __pfx_guard_install_pud_entry+0x10/0x10 [ 281.442110][T10121] ? __pfx_guard_install_pmd_entry+0x10/0x10 [ 281.442141][T10121] ? __pfx_guard_install_pte_entry+0x10/0x10 [ 281.442180][T10121] ? __pfx_guard_install_set_pte+0x10/0x10 [ 281.442219][T10121] ? finish_task_switch+0x40e/0xc60 [ 281.442249][T10121] ? lockdep_hardirqs_on+0x7b/0x110 [ 281.442280][T10121] ? rcu_is_watching+0x16/0xb0 [ 281.442315][T10121] ? __lock_acquire+0x747/0x2de0 [ 281.442366][T10121] ? reacquire_held_locks+0x117/0x1a0 [ 281.442397][T10121] ? lock_vma_under_rcu+0x1d1/0x500 [ 281.442439][T10121] ? lock_vma_under_rcu+0x116/0x500 [ 281.442476][T10121] ? lock_vma_under_rcu+0x116/0x500 [ 281.442509][T10121] ? lock_vma_under_rcu+0x45a/0x500 [ 281.442553][T10121] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 281.442604][T10121] ? vma_assert_stabilised+0x87/0x1f0 [ 281.442637][T10121] madvise_walk_vmas+0x97c/0xb70 [ 281.442680][T10121] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 281.442716][T10121] ? blk_start_plug+0x6e/0x1b0 [ 281.442753][T10121] madvise_do_behavior+0x385/0x540 [ 281.442784][T10121] ? __pfx_futex_wait+0x10/0x10 [ 281.442814][T10121] ? __pfx_madvise_do_behavior+0x10/0x10 [ 281.442864][T10121] do_madvise+0x26f/0x330 [ 281.442902][T10121] ? __pfx_do_madvise+0x10/0x10 [ 281.442942][T10121] ? rcu_is_watching+0x16/0xb0 [ 281.442981][T10121] __x64_sys_madvise+0xa6/0xc0 [ 281.443011][T10121] do_syscall_64+0x166/0x520 [ 281.443039][T10121] ? trace_irq_disable+0x3b/0x140 [ 281.443067][T10121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.443091][T10121] ? clear_bhb_loop+0x70/0xc0 [ 281.443120][T10121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.443143][T10121] RIP: 0033:0x7fb44c79e159 [ 281.443167][T10121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.443188][T10121] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 281.443215][T10121] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 281.443233][T10121] RDX: 0000000000000066 RSI: 0000000000600722 RDI: 0000200000000000 [ 281.443248][T10121] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 281.443264][T10121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 281.443279][T10121] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 281.443315][T10121] [ 281.621060][ T5761] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 281.683611][ T191] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 281.801341][ T5761] usb 7-1: Using ep0 maxpacket: 32 [ 281.804458][ T5761] usb 7-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 281.825748][ T5761] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.825849][ T5761] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.825964][ T5761] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.864209][ T191] usb 9-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 281.883712][ T5761] usb 7-1: config 0 descriptor?? [ 281.950848][ T191] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.950879][ T191] usb 9-1: Product: syz [ 281.950896][ T191] usb 9-1: Manufacturer: syz [ 281.950913][ T191] usb 9-1: SerialNumber: syz [ 281.956179][ T5761] hub 7-1:0.0: USB hub found [ 282.172953][T10130] syzkaller1: entered promiscuous mode [ 282.172986][T10130] syzkaller1: entered allmulticast mode [ 282.179218][ T5761] hub 7-1:0.0: 1 port detected [ 282.422010][ T191] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 282.422116][ T191] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 282.505630][T10140] FAULT_INJECTION: forcing a failure. [ 282.505630][T10140] name failslab, interval 1, probability 0, space 0, times 0 [ 282.505665][T10140] CPU: 0 UID: 0 PID: 10140 Comm: syz.0.1233 Tainted: G L syzkaller #0 PREEMPT(full) [ 282.505699][T10140] Tainted: [L]=SOFTLOCKUP [ 282.505707][T10140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 282.505722][T10140] Call Trace: [ 282.505731][T10140] [ 282.505741][T10140] dump_stack_lvl+0xe8/0x150 [ 282.505777][T10140] should_fail_ex+0x3eb/0x540 [ 282.505807][T10140] should_failslab+0xa8/0x100 [ 282.505841][T10140] __kmalloc_noprof+0xf9/0x710 [ 282.505866][T10140] ? prepare_creds+0x30/0x820 [ 282.505893][T10140] ? security_prepare_creds+0x52/0x360 [ 282.505925][T10140] ? security_prepare_creds+0x52/0x360 [ 282.505966][T10140] ? kmem_cache_alloc_noprof+0x151/0x600 [ 282.505993][T10140] security_prepare_creds+0x52/0x360 [ 282.506030][T10140] prepare_creds+0x57d/0x820 [ 282.506060][T10140] __sys_setregid+0xf5/0x650 [ 282.506091][T10140] do_syscall_64+0x166/0x520 [ 282.506119][T10140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.506144][T10140] ? clear_bhb_loop+0x70/0xc0 [ 282.506173][T10140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.506197][T10140] RIP: 0033:0x7fb44c79e159 [ 282.506218][T10140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.506238][T10140] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000072 [ 282.506264][T10140] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 282.506282][T10140] RDX: 0000000000000000 RSI: 000000000000ee00 RDI: 0000000000000000 [ 282.506296][T10140] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 282.506312][T10140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 282.506327][T10140] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 282.506362][T10140] [ 282.889139][ T5761] hub 7-1:0.0: activate --> -90 [ 283.066967][ T191] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 283.067059][ T191] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 283.105965][ T191] lan78xx 9-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 283.145764][ T191] lan78xx 9-1:1.0: probe with driver lan78xx failed with error -71 [ 283.186401][ T191] usb 9-1: USB disconnect, device number 20 [ 283.240159][ T5621] Bluetooth: hci6: command tx timeout [ 283.365091][ T9] usb 7-1: USB disconnect, device number 35 [ 283.752264][T10107] bridge0: port 1(bridge_slave_0) entered blocking state [ 283.752471][T10107] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.752649][T10107] bridge_slave_0: entered allmulticast mode [ 283.757027][T10107] bridge_slave_0: entered promiscuous mode [ 283.768200][T10107] bridge0: port 2(bridge_slave_1) entered blocking state [ 283.768366][T10107] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.768523][T10107] bridge_slave_1: entered allmulticast mode [ 283.785805][T10107] bridge_slave_1: entered promiscuous mode [ 283.936526][T10107] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 283.962482][T10107] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 284.044844][T10107] team0: Port device team_slave_0 added [ 284.047503][T10107] team0: Port device team_slave_1 added [ 284.132884][T10107] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 284.132901][T10107] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 284.132926][T10107] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 284.186850][T10107] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 284.186868][T10107] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 284.186901][T10107] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 284.397767][T10184] netlink: 64 bytes leftover after parsing attributes in process `syz.6.1241'. [ 284.399428][T10107] hsr_slave_0: entered promiscuous mode [ 284.407625][T10107] hsr_slave_1: entered promiscuous mode [ 284.555805][T10187] FAULT_INJECTION: forcing a failure. [ 284.555805][T10187] name failslab, interval 1, probability 0, space 0, times 0 [ 284.555844][T10187] CPU: 0 UID: 0 PID: 10187 Comm: syz.8.1242 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.555881][T10187] Tainted: [L]=SOFTLOCKUP [ 284.555890][T10187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 284.555904][T10187] Call Trace: [ 284.555914][T10187] [ 284.555924][T10187] dump_stack_lvl+0xe8/0x150 [ 284.555960][T10187] should_fail_ex+0x3eb/0x540 [ 284.555990][T10187] should_failslab+0xa8/0x100 [ 284.556022][T10187] __kmalloc_cache_noprof+0x9e/0x600 [ 284.556051][T10187] ? io_ring_ctx_alloc+0x54/0xb80 [ 284.556073][T10187] ? io_ring_ctx_alloc+0x54/0xb80 [ 284.556103][T10187] io_ring_ctx_alloc+0x54/0xb80 [ 284.556127][T10187] ? io_prepare_config+0x906/0xc70 [ 284.556164][T10187] io_uring_create+0x50/0x980 [ 284.556210][T10187] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 284.556247][T10187] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 284.556294][T10187] ? rcu_is_watching+0x16/0xb0 [ 284.556346][T10187] do_syscall_64+0x166/0x520 [ 284.556373][T10187] ? trace_irq_disable+0x3b/0x140 [ 284.556401][T10187] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.556424][T10187] ? clear_bhb_loop+0x70/0xc0 [ 284.556452][T10187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.556475][T10187] RIP: 0033:0x7f7e1c39e159 [ 284.556497][T10187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.556518][T10187] RSP: 002b:00007f7e1d343fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 284.556545][T10187] RAX: ffffffffffffffda RBX: 0000200000000400 RCX: 00007f7e1c39e159 [ 284.556563][T10187] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000f03 [ 284.556578][T10187] RBP: 00007f7e1c43506b R08: 0000000000000000 R09: 0000000000000000 [ 284.556593][T10187] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 284.556608][T10187] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffd747cf888 [ 284.556641][T10187] [ 284.851027][ T27] libceph: connect (1)[c::]:6789 error -101 [ 284.851183][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 284.973338][T10190] ceph: No mds server is up or the cluster is laggy [ 285.324206][ T5621] Bluetooth: hci6: command tx timeout [ 285.510141][ T5716] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 285.661938][ T5716] usb 1-1: New USB device found: idVendor=0506, idProduct=4601, bcdDevice=1.00 [ 285.684107][ T5716] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 285.684146][ T5716] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 285.684172][ T5716] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 285.684199][ T5716] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 285.684241][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.741690][T10208] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 285.741844][T10208] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 285.945106][T10107] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 285.961337][T10107] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 285.963728][T10107] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 285.987914][T10107] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 285.998194][T10107] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 286.009516][T10107] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 286.017861][T10107] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 286.031853][T10107] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 286.216597][T10107] 8021q: adding VLAN 0 to HW filter on device bond0 [ 286.259516][T10107] 8021q: adding VLAN 0 to HW filter on device team0 [ 286.279247][ T1178] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.279357][ T1178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 286.316671][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.316782][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.007674][ T5716] pegasus 1-1:1.0: can't reset MAC [ 287.007963][ T5716] pegasus 1-1:1.0: probe with driver pegasus failed with error -5 [ 287.046936][ T5716] usb 1-1: USB disconnect, device number 15 [ 287.318401][ T5707] kernel read not supported for file /tomoyo/domain_policy (pid: 5707 comm: kworker/1:6) [ 287.400767][ T5621] Bluetooth: hci6: command tx timeout [ 287.438120][T10107] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 287.547410][T10284] kvm: user requested TSC rate below hardware speed [ 287.927846][T10298] syzkaller1: entered promiscuous mode [ 287.927872][T10298] syzkaller1: entered allmulticast mode [ 288.016524][ T5621] Bluetooth: hci0: Zero size dump init pkt [ 288.276766][T10107] veth0_vlan: entered promiscuous mode [ 288.311692][T10107] veth1_vlan: entered promiscuous mode [ 288.456090][T10107] veth0_macvtap: entered promiscuous mode [ 288.468003][T10107] veth1_macvtap: entered promiscuous mode [ 288.523363][T10107] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 288.546490][T10107] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 288.666552][ T1178] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.666608][ T1178] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.666648][ T1178] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.666687][ T1178] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.777370][ T1178] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 288.777394][ T1178] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 288.899966][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 288.908047][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.145748][T10330] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 289.199514][T10339] syzkaller1: entered promiscuous mode [ 289.199540][T10339] syzkaller1: entered allmulticast mode [ 289.480277][ T5621] Bluetooth: hci6: command tx timeout [ 289.580663][ T5716] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 289.744280][ T5716] usb 5-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 289.746782][ T5716] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 289.746815][ T5716] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.746859][ T5716] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.002965][ T5716] usb 5-1: usb_control_msg returned -32 [ 290.003025][ T5716] usbtmc 5-1:16.0: can't read capabilities [ 290.451590][ T27] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 290.527597][T10392] overlayfs: failed to verify upper (72/file1, ino=390, err=-116) [ 290.527658][T10392] overlayfs: failed to verify index dir 'upper' xattr [ 290.527668][T10392] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 290.600266][ T27] usb 7-1: Using ep0 maxpacket: 8 [ 290.601085][ T27] usb 7-1: New USB device found: idVendor=0582, idProduct=0025, bcdDevice=0.40 [ 290.602531][ T27] usb 7-1: config 1 has an invalid descriptor of length 173, skipping remainder of the config [ 290.602559][ T27] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 290.602581][ T27] usb 7-1: config 1 has no interface number 0 [ 290.602621][ T27] usb 7-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 290.602649][ T27] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x8C has an invalid bInterval 93, changing to 7 [ 290.602677][ T27] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x8C has invalid maxpacket 9440, setting to 1024 [ 290.607893][ T27] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.607921][ T27] usb 7-1: Product: syz [ 290.607938][ T27] usb 7-1: Manufacturer: syz [ 290.607954][ T27] usb 7-1: SerialNumber: syz [ 290.769178][T10396] syzkaller1: entered promiscuous mode [ 290.769203][T10396] syzkaller1: entered allmulticast mode [ 290.990272][ T46] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 291.150867][ T46] usb 9-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 291.152253][ T46] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 291.152283][ T46] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.152331][ T46] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 291.152373][ T46] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.158145][ T46] usb 9-1: config 0 descriptor?? [ 291.398011][ T27] usb 7-1: USB disconnect, device number 36 [ 291.471419][ T6711] udevd[6711]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 291.626294][ T46] plantronics 0003:047F:FFFF.0018: reserved main item tag 0xd [ 291.664395][ T46] plantronics 0003:047F:FFFF.0018: hiddev1,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 291.849056][ T46] usb 9-1: USB disconnect, device number 21 [ 292.164532][T10424] FAULT_INJECTION: forcing a failure. [ 292.164532][T10424] name failslab, interval 1, probability 0, space 0, times 0 [ 292.164572][T10424] CPU: 0 UID: 0 PID: 10424 Comm: syz.6.1292 Tainted: G L syzkaller #0 PREEMPT(full) [ 292.164605][T10424] Tainted: [L]=SOFTLOCKUP [ 292.164614][T10424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 292.164629][T10424] Call Trace: [ 292.164638][T10424] [ 292.164650][T10424] dump_stack_lvl+0xe8/0x150 [ 292.164688][T10424] should_fail_ex+0x3eb/0x540 [ 292.164719][T10424] should_failslab+0xa8/0x100 [ 292.164754][T10424] __kvmalloc_node_noprof+0x171/0x820 [ 292.164784][T10424] ? __kmalloc_cache_noprof+0x31c/0x600 [ 292.164811][T10424] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 292.164833][T10424] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 292.164863][T10424] io_ring_ctx_alloc+0x1ad/0xb80 [ 292.164887][T10424] ? io_prepare_config+0x8c8/0xc70 [ 292.164925][T10424] io_uring_create+0x50/0x980 [ 292.164953][T10424] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 292.164990][T10424] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 292.165040][T10424] ? rcu_is_watching+0x16/0xb0 [ 292.165085][T10424] do_syscall_64+0x166/0x520 [ 292.165112][T10424] ? trace_irq_disable+0x3b/0x140 [ 292.165139][T10424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.165163][T10424] ? clear_bhb_loop+0x70/0xc0 [ 292.165192][T10424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.165215][T10424] RIP: 0033:0x7f169a99e159 [ 292.165236][T10424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.165257][T10424] RSP: 002b:00007f169b8bafb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 292.165284][T10424] RAX: ffffffffffffffda RBX: 0000200000000500 RCX: 00007f169a99e159 [ 292.165302][T10424] RDX: 0000200000000040 RSI: 0000200000000500 RDI: 0000000000000022 [ 292.165318][T10424] RBP: 00007f169aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 292.165332][T10424] R10: 0000200000000080 R11: 0000000000000206 R12: 0000200000000040 [ 292.165348][T10424] R13: 0000200000000080 R14: 0000200000000400 R15: 00007ffe039496e8 [ 292.165384][T10424] [ 292.484329][ T9] usb 5-1: USB disconnect, device number 7 [ 292.552840][T10427] IPVS: rr: UDP [::1]:8080 - no destination available [ 292.649445][ T5761] hid_parser_main: 4017 callbacks suppressed [ 292.649472][ T5761] hid-generic 0000:0000:0000.0019: unknown main item tag 0x0 [ 292.717383][ T5761] hid-generic 0000:0000:0000.0019: hidraw0: HID v0.00 Device [syz1] on syz0 [ 292.785876][T10441] FAULT_INJECTION: forcing a failure. [ 292.785876][T10441] name failslab, interval 1, probability 0, space 0, times 0 [ 292.785926][T10441] CPU: 0 UID: 0 PID: 10441 Comm: syz.6.1297 Tainted: G L syzkaller #0 PREEMPT(full) [ 292.785958][T10441] Tainted: [L]=SOFTLOCKUP [ 292.785967][T10441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 292.785981][T10441] Call Trace: [ 292.785990][T10441] [ 292.786000][T10441] dump_stack_lvl+0xe8/0x150 [ 292.786037][T10441] should_fail_ex+0x3eb/0x540 [ 292.786073][T10441] should_failslab+0xa8/0x100 [ 292.786105][T10441] ? skb_clone+0x212/0x3a0 [ 292.786133][T10441] kmem_cache_alloc_noprof+0x9c/0x600 [ 292.786156][T10441] ? __pfx__copy_from_iter+0x10/0x10 [ 292.786182][T10441] ? skb_clone+0x212/0x3a0 [ 292.786217][T10441] skb_clone+0x212/0x3a0 [ 292.786249][T10441] pfkey_sendmsg+0x4d6/0x11d0 [ 292.786282][T10441] ? __lock_acquire+0x747/0x2de0 [ 292.786315][T10441] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 292.786366][T10441] ? aa_sock_msg_perm+0x144/0x210 [ 292.786395][T10441] ? apparmor_socket_sendmsg+0x98/0x360 [ 292.786429][T10441] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 292.786456][T10441] sock_sendmsg_nosec+0x13a/0x180 [ 292.786491][T10441] ____sys_sendmsg+0x54e/0x850 [ 292.786523][T10441] ? __pfx_____sys_sendmsg+0x10/0x10 [ 292.786560][T10441] ? import_iovec+0x73/0xa0 [ 292.786592][T10441] ___sys_sendmsg+0x2a5/0x360 [ 292.786616][T10441] ? __lock_acquire+0x747/0x2de0 [ 292.786645][T10441] ? __pfx____sys_sendmsg+0x10/0x10 [ 292.786674][T10441] ? futex_wait+0x2a2/0x390 [ 292.786729][T10441] ? __fget_files+0x3a2/0x420 [ 292.786753][T10441] ? __fget_files+0x2a/0x420 [ 292.786788][T10441] __x64_sys_sendmsg+0x1b1/0x290 [ 292.786818][T10441] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 292.786868][T10441] do_syscall_64+0x166/0x520 [ 292.786894][T10441] ? trace_irq_disable+0x3b/0x140 [ 292.786930][T10441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.786955][T10441] ? clear_bhb_loop+0x70/0xc0 [ 292.786984][T10441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.787008][T10441] RIP: 0033:0x7f169a99e159 [ 292.787030][T10441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.787050][T10441] RSP: 002b:00007f169b8bb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 292.787076][T10441] RAX: ffffffffffffffda RBX: 00007f169ac25fa0 RCX: 00007f169a99e159 [ 292.787095][T10441] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 292.787110][T10441] RBP: 00007f169aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 292.787125][T10441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 292.787139][T10441] R13: 00007f169ac26038 R14: 00007f169ac25fa0 R15: 00007ffe039496e8 [ 292.787176][T10441] [ 292.821064][ T5716] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 293.022460][ T5716] usb 9-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 293.029922][ T5716] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 293.043298][ T5716] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 293.043400][ T5716] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 293.043536][ T5716] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.132652][ T5716] usb 9-1: config 0 descriptor?? [ 293.178893][T10444] FAULT_INJECTION: forcing a failure. [ 293.178893][T10444] name failslab, interval 1, probability 0, space 0, times 0 [ 293.178936][T10444] CPU: 0 UID: 0 PID: 10444 Comm: syz.0.1298 Tainted: G L syzkaller #0 PREEMPT(full) [ 293.178972][T10444] Tainted: [L]=SOFTLOCKUP [ 293.178981][T10444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 293.178996][T10444] Call Trace: [ 293.179005][T10444] [ 293.179015][T10444] dump_stack_lvl+0xe8/0x150 [ 293.179059][T10444] should_fail_ex+0x3eb/0x540 [ 293.179090][T10444] should_failslab+0xa8/0x100 [ 293.179123][T10444] ? alloc_empty_file+0x5b/0x1d0 [ 293.179159][T10444] kmem_cache_alloc_noprof+0x9c/0x600 [ 293.179186][T10444] ? alloc_empty_file+0x5b/0x1d0 [ 293.179229][T10444] alloc_empty_file+0x5b/0x1d0 [ 293.179267][T10444] dentry_open+0x44/0xa0 [ 293.179301][T10444] pidfs_alloc_file+0x188/0x280 [ 293.179330][T10444] ? __pfx_pidfs_alloc_file+0x10/0x10 [ 293.179366][T10444] pidfd_prepare+0xfd/0x170 [ 293.179398][T10444] __se_sys_pidfd_open+0xd5/0x260 [ 293.179423][T10444] ? __pfx___se_sys_pidfd_open+0x10/0x10 [ 293.179460][T10444] do_syscall_64+0x166/0x520 [ 293.179488][T10444] ? trace_irq_disable+0x3b/0x140 [ 293.179516][T10444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.179541][T10444] ? clear_bhb_loop+0x70/0xc0 [ 293.179569][T10444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.179592][T10444] RIP: 0033:0x7fb44c79e159 [ 293.179614][T10444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.179634][T10444] RSP: 002b:00007fb44d64f018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 293.179660][T10444] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 293.179678][T10444] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000b0 [ 293.179692][T10444] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 293.179707][T10444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 293.179721][T10444] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 293.179757][T10444] [ 293.680923][ T5716] plantronics 0003:047F:FFFF.001A: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 293.912496][ T27] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 294.061199][ T27] usb 1-1: New USB device found: idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 294.065346][ T27] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 294.065381][ T27] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 294.068117][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.068145][ T27] usb 1-1: Product: syz [ 294.068161][ T27] usb 1-1: Manufacturer: syz [ 294.068177][ T27] usb 1-1: SerialNumber: syz [ 294.133965][ T27] usb 1-1: config 0 descriptor?? [ 294.140393][T10456] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 294.140543][T10456] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 294.190157][ T5716] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 294.354154][ T5716] usb 7-1: Using ep0 maxpacket: 32 [ 294.356148][ T5716] usb 7-1: New USB device found: idVendor=03f0, idProduct=6c17, bcdDevice=0.40 [ 294.363552][ T5716] usb 7-1: config index 0 descriptor too short (expected 29220, got 36) [ 294.363690][ T5716] usb 7-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 294.363753][ T5716] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 294.363965][ T5716] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 294.364097][ T5716] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 294.364169][ T5716] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 294.364354][ T5716] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.449719][ T5716] usb 7-1: config 0 descriptor?? [ 294.473663][T10456] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 294.473816][T10456] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 294.687713][ T5716] usblp 7-1:0.0: usblp1: USB Bidirectional printer dev 37 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 294.917821][T10483] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1305'. [ 295.026598][ T5716] usb 9-1: USB disconnect, device number 22 [ 295.095241][ T46] usb 7-1: USB disconnect, device number 37 [ 295.154709][ T46] usblp1: removed [ 295.299575][ T27] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): MDIO read error: -71 [ 295.325944][ T27] dm9601 1-1:0.0 eth2: register 'dm9601' at usb-dummy_hcd.0-1, Davicom DM96xx USB 10/100 Ethernet, 28:da:91:db:87:5c [ 295.329149][ T27] usb 1-1: USB disconnect, device number 16 [ 295.344958][ T27] dm9601 1-1:0.0 eth2: unregister 'dm9601' usb-dummy_hcd.0-1, Davicom DM96xx USB 10/100 Ethernet [ 295.500438][ T46] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 295.651528][ T46] usb 5-1: New USB device found: idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 295.652582][ T46] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 295.656101][ T46] usb 5-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 295.656128][ T46] usb 5-1: Product: syz [ 295.656143][ T46] usb 5-1: Manufacturer: syz [ 295.656159][ T46] usb 5-1: SerialNumber: syz [ 295.698066][ T46] usb 5-1: config 0 descriptor?? [ 295.721619][ T46] keyspan 5-1:0.0: Keyspan 4 port adapter converter detected [ 295.721980][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 81 [ 295.722058][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 88 [ 295.728735][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 1 [ 295.761234][ T46] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 295.765524][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 2 [ 295.781318][ T46] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 295.797859][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 4 [ 295.809309][ T46] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 295.829593][ T46] keyspan 5-1:0.0: found no endpoint descriptor for endpoint 6 [ 295.851631][ T46] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 295.915678][T10508] ceph: No source [ 296.194894][ T8481] usb 5-1: USB disconnect, device number 8 [ 296.218097][ T8481] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 296.245411][ T8481] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 296.310535][ T8481] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 296.331318][ T8481] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 296.332234][ T8481] keyspan 5-1:0.0: device disconnected [ 296.925199][T10535] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1316'. [ 296.948765][T10535] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1316'. [ 297.000444][ T8481] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 297.150092][ T8481] usb 7-1: Using ep0 maxpacket: 16 [ 297.150952][ T8481] usb 7-1: New USB device found: idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 297.152444][ T8481] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 297.152471][ T8481] usb 7-1: config 0 has no interface number 0 [ 297.156129][ T8481] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.156157][ T8481] usb 7-1: Product: syz [ 297.156173][ T8481] usb 7-1: Manufacturer: syz [ 297.156189][ T8481] usb 7-1: SerialNumber: syz [ 297.185067][ T8481] usb 7-1: config 0 descriptor?? [ 297.224220][ T8481] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 297.547408][T10547] fsa4480 0-0042: error -ENODEV: FSA4480 not found [ 297.575002][T10547] i2c i2c-0: new_device: Instantiated device fsa4480 at 0x42 [ 298.049719][T10556] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 298.052157][T10556] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 298.139445][T10556] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 298.151311][T10556] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 298.151428][T10556] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 298.173873][T10556] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 298.192893][T10556] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 298.194799][T10556] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 298.221306][T10556] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 298.227040][T10556] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 298.227166][T10556] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 298.253742][T10556] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 298.262301][T10556] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 298.264703][T10556] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 298.314142][T10556] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 298.331920][T10567] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 298.496004][ T8481] gspca_spca1528: reg_w err -71 [ 298.496093][ T8481] spca1528 7-1:0.1: probe with driver spca1528 failed with error -71 [ 298.515808][ T8481] usb 7-1: USB disconnect, device number 38 [ 298.566327][T10567] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 298.758136][T10567] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 298.841342][ T5716] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 298.876366][T10567] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 298.991705][ T5716] usb 9-1: Using ep0 maxpacket: 16 [ 298.992948][ T5716] usb 9-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 298.995484][ T5716] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 298.998449][ T5716] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.998485][ T5716] usb 9-1: Product: syz [ 298.998502][ T5716] usb 9-1: Manufacturer: syz [ 298.998519][ T5716] usb 9-1: SerialNumber: syz [ 299.101405][ T977] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.201458][ T977] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.202379][ T977] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.331099][ T977] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.040448][ T5621] Bluetooth: hci1: command 0x0406 tx timeout [ 300.100848][ T5716] cdc_ncm 9-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 300.100897][ T5716] cdc_ncm 9-1:1.0: dwNtbInMaxSize=17 is too small. Using 2048 [ 300.100919][ T5716] cdc_ncm 9-1:1.0: setting rx_max = 2048 [ 300.202120][ T5622] Bluetooth: hci5: command 0x0c1a tx timeout [ 300.202189][ T5622] Bluetooth: hci0: command 0x0406 tx timeout [ 300.202291][ T5621] Bluetooth: hci2: command 0x0c1a tx timeout [ 300.280399][ T5612] Bluetooth: hci3: command 0x0c1a tx timeout [ 300.280512][ T5621] Bluetooth: hci6: command 0x0c1a tx timeout [ 300.304742][ T5716] cdc_ncm 9-1:1.0: setting tx_max = 88 [ 300.365241][ T5716] cdc_ncm 9-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.8-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 300.381707][ T9] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 300.385749][ T5716] usb 9-1: USB disconnect, device number 23 [ 300.389781][ T5716] cdc_ncm 9-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.8-1, CDC NCM (NO ZLP) [ 300.531858][ T9] usb 1-1: New USB device found: idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 300.533046][ T9] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 300.533094][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.533124][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 300.533150][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 300.534444][ T9] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 300.534471][ T9] usb 1-1: Manufacturer: syz [ 300.539832][ T9] usb 1-1: config 0 descriptor?? [ 300.660265][ T27] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 300.811169][ T27] usb 5-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 300.812343][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 300.812379][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 300.812396][ T27] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 300.812428][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.815715][ T27] usb 5-1: config 0 descriptor?? [ 301.031000][ T5716] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 301.100150][T10647] smpboot: CPU 1 is now offline [ 301.104271][ T9] appleir 0003:05AC:8243.001B: unknown main item tag 0x0 [ 301.131466][ T9] appleir 0003:05AC:8243.001B: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 301.186326][ T5716] usb 7-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 301.189467][ T5716] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 301.189488][ T5716] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 301.189502][ T5716] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 301.189533][ T5716] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 301.249718][ T5716] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 301.249739][ T5716] usb 7-1: Product: syz [ 301.249749][ T5716] usb 7-1: Manufacturer: syz [ 301.287722][ T5716] cdc_wdm 7-1:1.0: skipping garbage [ 301.287738][ T5716] cdc_wdm 7-1:1.0: skipping garbage [ 301.309110][ T5716] cdc_wdm 7-1:1.0: cdc-wdm1: USB WDM device [ 301.309128][ T5716] cdc_wdm 7-1:1.0: Unknown control protocol [ 301.355261][ T27] plantronics 0003:047F:FFFF.001C: hiddev2,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 301.539433][ T5761] usb 5-1: USB disconnect, device number 9 [ 301.594920][ T5716] usb 7-1: USB disconnect, device number 39 [ 301.651784][T10650] fido_id[10650]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 301.734823][ T9] usb 1-1: USB disconnect, device number 17 [ 301.804372][T10648] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 302.120473][ T5621] Bluetooth: hci1: command 0x0406 tx timeout [ 302.280647][ T5612] Bluetooth: hci2: command 0x0c1a tx timeout [ 302.280752][ T5621] Bluetooth: hci5: command 0x0c1a tx timeout [ 302.360959][ T5612] Bluetooth: hci6: command 0x0c1a tx timeout [ 302.361055][ T5621] Bluetooth: hci3: command 0x0c1a tx timeout [ 303.186787][T10688] Process accounting resumed [ 303.391904][ T1581] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 303.540906][ T1581] usb 9-1: Using ep0 maxpacket: 16 [ 303.542368][ T1581] usb 9-1: New USB device found: idVendor=05ac, idProduct=0244, bcdDevice=0.00 [ 303.542412][ T1581] usb 9-1: too many configurations: 123, using maximum allowed: 8 [ 303.543594][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.549821][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.576089][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.614173][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.615243][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.617840][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.624001][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.671424][ T1581] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 303.674433][ T1581] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 303.674462][ T1581] usb 9-1: SerialNumber: syz [ 303.693514][ T1581] usb 9-1: config 0 descriptor?? [ 303.730172][ T9] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 303.731208][ T1581] input: bcm5974 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input33 [ 303.881575][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 303.882333][ T9] usb 1-1: New USB device found: idVendor=1e7d, idProduct=2d51, bcdDevice=0.40 [ 303.884923][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 303.916233][ T9] usb 1-1: string descriptor 0 read error: -22 [ 303.916981][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.009027][ T4962] bcm5974 9-1:0.0: could not read from device [ 304.018938][ T4962] bcm5974 9-1:0.0: could not read from device [ 304.047163][ T4962] bcm5974 9-1:0.0: could not read from device [ 304.049340][ T1581] usb 9-1: USB disconnect, device number 24 [ 304.077105][ T4962] bcm5974 9-1:0.0: could not read from device [ 304.361070][ T5622] Bluetooth: hci2: command 0x0c1a tx timeout [ 304.361181][ T5612] Bluetooth: hci5: command 0x0c1a tx timeout [ 304.422008][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422045][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422069][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422092][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422115][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422140][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422165][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422190][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.422213][ T9] koneplus 0003:1E7D:2D51.001D: unknown main item tag 0x0 [ 304.447773][ T5622] Bluetooth: hci6: command 0x0c1a tx timeout [ 304.447834][ T5612] Bluetooth: hci3: command 0x0c1a tx timeout [ 304.537072][ T9] koneplus 0003:1E7D:2D51.001D: hidraw0: USB HID v0.fd Device [HID 1e7d:2d51] on usb-dummy_hcd.0-1/input0 [ 304.658528][ T46] usb 1-1: USB disconnect, device number 18 [ 304.691877][T10723] fido_id[10723]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 304.824842][T10727] device-mapper: table: 248:2: multipath: invalid initial priority group number (-EINVAL) [ 304.824873][T10727] device-mapper: ioctl: error adding target to table [ 305.000224][ T5612] Bluetooth: hci7: command 0x1003 tx timeout [ 305.000341][ T5621] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 305.489715][T10761] FAULT_INJECTION: forcing a failure. [ 305.489715][T10761] name failslab, interval 1, probability 0, space 0, times 0 [ 305.489762][T10761] CPU: 0 UID: 0 PID: 10761 Comm: syz.8.1385 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 305.489798][T10761] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 305.489810][T10761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 305.489840][T10761] Call Trace: [ 305.489850][T10761] [ 305.489860][T10761] dump_stack_lvl+0xe8/0x150 [ 305.489897][T10761] should_fail_ex+0x3eb/0x540 [ 305.489928][T10761] should_failslab+0xa8/0x100 [ 305.489964][T10761] __kmalloc_noprof+0xf9/0x710 [ 305.489994][T10761] ? n_hdlc_alloc_buf+0x83/0x230 [ 305.490018][T10761] ? n_hdlc_alloc_buf+0x83/0x230 [ 305.490051][T10761] n_hdlc_alloc_buf+0x83/0x230 [ 305.490088][T10761] n_hdlc_tty_open+0x25a/0x4a0 [ 305.490119][T10761] tty_ldisc_open+0xa1/0x100 [ 305.490145][T10761] tty_set_ldisc+0x365/0x540 [ 305.490173][T10761] tty_ioctl+0xc30/0xde0 [ 305.490198][T10761] ? __pfx_tty_ioctl+0x10/0x10 [ 305.490222][T10761] __se_sys_ioctl+0xfc/0x170 [ 305.490255][T10761] do_syscall_64+0x166/0x520 [ 305.490282][T10761] ? trace_irq_disable+0x3b/0x140 [ 305.490311][T10761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.490336][T10761] ? clear_bhb_loop+0x70/0xc0 [ 305.490365][T10761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.490389][T10761] RIP: 0033:0x7f7e1c39e159 [ 305.490411][T10761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.490432][T10761] RSP: 002b:00007f7e1d344028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 305.490459][T10761] RAX: ffffffffffffffda RBX: 00007f7e1c625fa0 RCX: 00007f7e1c39e159 [ 305.490477][T10761] RDX: 0000200000000000 RSI: 0000000000005423 RDI: 0000000000000003 [ 305.490492][T10761] RBP: 00007f7e1c43506b R08: 0000000000000000 R09: 0000000000000000 [ 305.490507][T10761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 305.490521][T10761] R13: 00007f7e1c626038 R14: 00007f7e1c625fa0 R15: 00007ffd747cf888 [ 305.490557][T10761] [ 305.972678][T10772] nbd8: detected capacity change from 0 to 1 [ 305.973709][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973749][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973810][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973857][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973887][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973904][ T5620] ldm_validate_partition_table(): Disk read failed. [ 305.973931][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973959][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.973988][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.974017][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.974032][ T5620] Dev nbd8: unable to read RDB block 0 [ 305.974061][ T5620] Buffer I/O error on dev nbd8, logical block 0, async page read [ 305.974111][ T5620] nbd8: unable to read partition table [ 305.974363][ T5620] nbd8: partition table beyond EOD, truncated [ 306.132100][T10779] nbd8: detected capacity change from 1 to 0 [ 306.500831][T10795] netlink: 176 bytes leftover after parsing attributes in process `syz.6.1395'. [ 306.746044][ T5621] block nbd8: Receive control failed (result -32) [ 306.767563][T10772] block nbd8: shutting down sockets [ 307.970225][ T9] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 308.120207][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 308.121048][ T9] usb 7-1: New USB device found: idVendor=2040, idProduct=b138, bcdDevice=1.42 [ 308.124290][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 308.124342][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 308.124373][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 308.124397][ T9] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 308.124422][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 308.127114][ T9] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 308.127151][ T9] usb 7-1: Manufacturer: syz [ 308.218147][ T9] usb 7-1: config 0 descriptor?? [ 308.255596][T10830] input: syz1 as /devices/virtual/input/input34 [ 308.360115][ T5621] Bluetooth: hci7: command 0x1003 tx timeout [ 308.360231][ T5612] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 308.492180][T10832] device-mapper: ioctl: Invalid ioctl structure: name t, dev f803 [ 308.522886][ T9] rc_core: IR keymap rc-hauppauge not found [ 308.522922][ T9] Registered IR keymap rc-empty [ 308.523198][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.541483][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.570138][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 308.574641][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input35 [ 308.588646][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.602325][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.620386][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.640178][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.660295][T10837] FAULT_INJECTION: forcing a failure. [ 308.660295][T10837] name failslab, interval 1, probability 0, space 0, times 0 [ 308.660332][T10837] CPU: 1 UID: 0 PID: 10837 Comm: syz.0.1412 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 308.660365][T10837] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 308.660374][T10837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 308.660389][T10837] Call Trace: [ 308.660398][T10837] [ 308.660408][T10837] dump_stack_lvl+0xe8/0x150 [ 308.660445][T10837] should_fail_ex+0x3eb/0x540 [ 308.660476][T10837] should_failslab+0xa8/0x100 [ 308.660511][T10837] __kmalloc_noprof+0xf9/0x710 [ 308.660535][T10837] ? __init_waitqueue_head+0xa8/0x150 [ 308.660575][T10837] ? __netlink_kernel_create+0x1e5/0x720 [ 308.660604][T10837] ? __netlink_kernel_create+0x1e5/0x720 [ 308.660634][T10837] ? __netlink_create+0x167/0x260 [ 308.660666][T10837] __netlink_kernel_create+0x1e5/0x720 [ 308.660697][T10837] ? __pfx___netlink_kernel_create+0x10/0x10 [ 308.660704][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.660729][T10837] ? diag_net_init+0xa5/0x140 [ 308.660772][T10837] diag_net_init+0xba/0x140 [ 308.660808][T10837] ? __pfx_diag_net_init+0x10/0x10 [ 308.660842][T10837] ? __pfx_sock_diag_rcv+0x10/0x10 [ 308.660877][T10837] ? __pfx_sock_diag_bind+0x10/0x10 [ 308.660897][T10837] ? cma_pernet+0x23/0x240 [ 308.660930][T10837] ? __raw_spin_lock_init+0x45/0x100 [ 308.660968][T10837] ops_init+0x35d/0x5d0 [ 308.661002][T10837] setup_net+0x118/0x350 [ 308.661039][T10837] ? __pfx_setup_net+0x10/0x10 [ 308.661074][T10837] ? down_read_killable+0x1b6/0x3b0 [ 308.661105][T10837] ? __ns_common_init+0x38a/0x590 [ 308.661143][T10837] copy_net_ns+0x536/0x770 [ 308.661183][T10837] create_new_namespaces+0x3f0/0x6b0 [ 308.661217][T10837] ? security_capable+0x7e/0x2c0 [ 308.661262][T10837] unshare_nsproxy_namespaces+0x144/0x190 [ 308.661298][T10837] ksys_unshare+0x53c/0x890 [ 308.661339][T10837] ? __pfx_ksys_unshare+0x10/0x10 [ 308.661375][T10837] ? rcu_is_watching+0x16/0xb0 [ 308.661417][T10837] __x64_sys_unshare+0x38/0x50 [ 308.661450][T10837] do_syscall_64+0x166/0x520 [ 308.661477][T10837] ? trace_irq_disable+0x3b/0x140 [ 308.661505][T10837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.661530][T10837] ? clear_bhb_loop+0x70/0xc0 [ 308.661559][T10837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 308.661583][T10837] RIP: 0033:0x7fb44c79e159 [ 308.661606][T10837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 308.661626][T10837] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 308.661652][T10837] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 308.661670][T10837] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 308.661686][T10837] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 308.661702][T10837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 308.661716][T10837] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 308.661753][T10837] [ 308.692797][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.758797][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.778341][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.792685][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.814182][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 308.832416][ T9] mceusb 7-1:0.0: Error: mce write submit urb error = -90 [ 309.061071][ T9] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 90 [ 309.061100][ T9] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 309.091946][ T9] usb 7-1: USB disconnect, device number 40 [ 309.660156][ T5716] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 309.814095][ T5716] usb 1-1: New USB device found: idVendor=0458, idProduct=5005, bcdDevice=0.00 [ 309.815321][ T5716] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 309.815381][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.820181][ T5716] usb 1-1: config 0 descriptor?? [ 309.940080][ T27] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 310.100155][ T27] usb 7-1: Using ep0 maxpacket: 16 [ 310.100957][ T27] usb 7-1: New USB device found: idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 310.102213][ T27] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 310.102248][ T27] usb 7-1: config 0 interface 0 has no altsetting 0 [ 310.105154][ T27] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.105181][ T27] usb 7-1: Product: syz [ 310.105197][ T27] usb 7-1: Manufacturer: syz [ 310.105213][ T27] usb 7-1: SerialNumber: syz [ 310.109266][ T27] usb 7-1: config 0 descriptor?? [ 310.337121][ T5716] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.001E/input/input36 [ 310.395655][ C1] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 310.424905][ T27] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input38 [ 310.469482][ T5716] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.001E/input/input37 [ 310.469815][ T27] imon:send_packet: packet tx failed (-71) [ 310.481633][ T27] imon 7-1:0.0: panel buttons/knobs setup failed [ 310.588982][ T5716] kye 0003:0458:5005.001E: input,hiddev0,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.0-1/input0 [ 310.616504][T10866] FAULT_INJECTION: forcing a failure. [ 310.616504][T10866] name failslab, interval 1, probability 0, space 0, times 0 [ 310.616543][T10866] CPU: 1 UID: 0 PID: 10866 Comm: syz.4.1423 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 310.616578][T10866] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 310.616588][T10866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 310.616603][T10866] Call Trace: [ 310.616612][T10866] [ 310.616622][T10866] dump_stack_lvl+0xe8/0x150 [ 310.616659][T10866] should_fail_ex+0x3eb/0x540 [ 310.616691][T10866] should_failslab+0xa8/0x100 [ 310.616725][T10866] __kmalloc_noprof+0xf9/0x710 [ 310.616752][T10866] ? sk_prot_alloc+0xe7/0x210 [ 310.616776][T10866] ? sk_prot_alloc+0xe7/0x210 [ 310.616806][T10866] sk_prot_alloc+0xe7/0x210 [ 310.616826][T10866] ? sk_alloc+0x27/0x390 [ 310.616851][T10866] sk_alloc+0x3a/0x390 [ 310.616878][T10866] pptp_create+0x32/0x300 [ 310.616906][T10866] pppox_create+0x131/0x1b0 [ 310.616935][T10866] __sock_create+0x4b5/0xac0 [ 310.616975][T10866] __sys_socket+0xd6/0x1b0 [ 310.617011][T10866] __x64_sys_socket+0x7a/0x90 [ 310.617046][T10866] do_syscall_64+0x166/0x520 [ 310.617072][T10866] ? trace_irq_disable+0x3b/0x140 [ 310.617099][T10866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.617123][T10866] ? clear_bhb_loop+0x70/0xc0 [ 310.617148][T10866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.617170][T10866] RIP: 0033:0x7fed3259e159 [ 310.617191][T10866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.617217][T10866] RSP: 002b:00007fed334ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 310.617241][T10866] RAX: ffffffffffffffda RBX: 00007fed32825fa0 RCX: 00007fed3259e159 [ 310.617259][T10866] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000018 [ 310.617282][T10866] RBP: 00007fed3263506b R08: 0000000000000000 R09: 0000000000000000 [ 310.617297][T10866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 310.617311][T10866] R13: 00007fed32826038 R14: 00007fed32825fa0 R15: 00007ffc842efee8 [ 310.617347][T10866] [ 310.738699][ T5716] usb 1-1: USB disconnect, device number 19 [ 310.941814][ T27] rc_core: IR keymap rc-imon-pad not found [ 310.941835][ T27] Registered IR keymap rc-empty [ 310.941914][ T27] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 310.941951][ T27] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 310.943620][ T27] imon:send_packet: packet tx failed (-71) [ 310.962851][ T27] imon 7-1:0.0: remote input dev register failed [ 310.963095][ T27] imon 7-1:0.0: imon_init_intf0: rc device setup failed [ 311.046918][T10868] fido_id[10868]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 311.161102][ T27] imon 7-1:0.0: unable to initialize intf0, err 0 [ 311.165858][ T27] usb 7-1: USB disconnect, device number 41 [ 311.570823][ T27] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 311.720065][ T27] usb 7-1: Using ep0 maxpacket: 16 [ 311.720896][ T27] usb 7-1: New USB device found: idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 311.725503][ T27] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 311.725539][ T27] usb 7-1: config 0 interface 0 has no altsetting 0 [ 311.764713][ T27] usb 7-1: string descriptor 0 read error: -22 [ 311.764878][ T27] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.790908][ T27] usb 7-1: config 0 descriptor?? [ 311.813360][ T27] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input40 [ 312.210125][ T27] rc_core: IR keymap rc-imon-pad not found [ 312.210188][ T27] Registered IR keymap rc-empty [ 312.210279][ T27] imon 7-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 312.210329][ T27] imon 7-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 312.273386][ T27] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0 [ 312.276421][ T27] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input41 [ 312.317036][ T27] imon 7-1:0.0: iMON device (15c2:0041) on usb<7:42> initialized [ 312.465541][T10890] device-mapper: ioctl: Invalid target message parameters. [ 312.742779][ C1] imon 7-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 312.744747][ T5716] usb 7-1: USB disconnect, device number 42 [ 313.698228][T10922] netlink: 'syz.6.1440': attribute type 11 has an invalid length. [ 314.203431][ T1581] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 314.323619][ T5716] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 314.350865][ T1581] usb 5-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 314.352031][ T1581] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.378278][ T1581] usb 5-1: config 0 descriptor?? [ 314.492250][ T5716] usb 9-1: New USB device found: idVendor=0c70, idProduct=f014, bcdDevice=0.40 [ 314.494901][ T5716] usb 9-1: config 1 interface 0 has no altsetting 0 [ 314.498003][ T5716] usb 9-1: string descriptor 0 read error: -22 [ 314.498146][ T5716] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.614197][ T1581] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 314.800385][ T9] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 314.846672][ T1581] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 314.846701][ T1581] [drm] Initialized udl on minor 1 [ 314.950191][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 314.951146][ T9] usb 1-1: New USB device found: idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 314.952572][ T9] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 314.952601][ T9] usb 1-1: config 0 has no interface number 0 [ 314.955733][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.955761][ T9] usb 1-1: Product: syz [ 314.955807][ T9] usb 1-1: Manufacturer: syz [ 314.955825][ T9] usb 1-1: SerialNumber: syz [ 315.017061][ T9] usb 1-1: config 0 descriptor?? [ 315.174986][ T5716] hid_parser_main: 35 callbacks suppressed [ 315.175015][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175049][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175081][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175141][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175172][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175202][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175233][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175291][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175322][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.175354][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: unknown main item tag 0x0 [ 315.429658][ T5716] aquacomputer_d5next 0003:0C70:F014.001F: hidraw0: USB HID v0.05 Device [HID 0c70:f014] on usb-dummy_hcd.8-1/input0 [ 315.509186][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 315.509237][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 315.570128][ T5716] usb 9-1: USB disconnect, device number 25 [ 315.639669][T10947] fido_id[10947]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 315.968850][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 315.968974][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 315.978762][ T1315] aoe: packet could not be sent on lowpan0. consider increasing tx_queue_len [ 316.144855][ T9] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 316.145153][ T9] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 316.190696][ T9] usb 1-1: USB disconnect, device number 20 [ 316.330863][ T5716] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 316.481288][ T5716] usb 9-1: New USB device found: idVendor=104f, idProduct=0004, bcdDevice=1.00 [ 316.482509][ T5716] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 316.482539][ T5716] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 316.488027][ T5716] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 316.488059][ T5716] usb 9-1: Product: syz [ 316.488077][ T5716] usb 9-1: Manufacturer: syz [ 316.545487][ T5716] iuu_phoenix 9-1:1.0: iuu_phoenix converter detected [ 316.557080][ T5716] usb 9-1: iuu_phoenix converter now attached to ttyUSB0 [ 316.830229][T10957] FAULT_INJECTION: forcing a failure. [ 316.830229][T10957] name failslab, interval 1, probability 0, space 0, times 0 [ 316.830298][T10957] CPU: 0 UID: 0 PID: 10957 Comm: syz.0.1456 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 316.830334][T10957] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 316.830345][T10957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 316.830360][T10957] Call Trace: [ 316.830370][T10957] [ 316.830381][T10957] dump_stack_lvl+0xe8/0x150 [ 316.830422][T10957] should_fail_ex+0x3eb/0x540 [ 316.830452][T10957] should_failslab+0xa8/0x100 [ 316.830488][T10957] __kmalloc_cache_noprof+0x9e/0x600 [ 316.830517][T10957] ? __se_sys_mount+0x166/0x420 [ 316.830542][T10957] ? __se_sys_mount+0x166/0x420 [ 316.830568][T10957] ? memdup_user+0x99/0xd0 [ 316.830597][T10957] __se_sys_mount+0x166/0x420 [ 316.830623][T10957] ? __fget_files+0x2a/0x420 [ 316.830650][T10957] ? __pfx___se_sys_futex+0x10/0x10 [ 316.830696][T10957] ? __pfx___se_sys_mount+0x10/0x10 [ 316.830730][T10957] ? __x64_sys_mount+0x20/0xc0 [ 316.830758][T10957] do_syscall_64+0x166/0x520 [ 316.830787][T10957] ? trace_irq_disable+0x3b/0x140 [ 316.830815][T10957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.830842][T10957] ? clear_bhb_loop+0x70/0xc0 [ 316.830871][T10957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.830895][T10957] RIP: 0033:0x7fb44c79e159 [ 316.830918][T10957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 316.830939][T10957] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 316.830967][T10957] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 316.830986][T10957] RDX: 0000200000000500 RSI: 0000000000000000 RDI: 0000000000000000 [ 316.831002][T10957] RBP: 00007fb44c83506b R08: 0000200000000540 R09: 0000000000000000 [ 316.831019][T10957] R10: 0000000002002808 R11: 0000000000000246 R12: 0000000000000000 [ 316.831034][T10957] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 316.831071][T10957] [ 317.803379][T10949] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 317.813911][ T8481] usb 9-1: USB disconnect, device number 26 [ 317.849050][ T8481] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 317.858281][ T8481] iuu_phoenix 9-1:1.0: device disconnected [ 318.954370][T10995] FAULT_INJECTION: forcing a failure. [ 318.954370][T10995] name fail_futex, interval 1, probability 0, space 0, times 1 [ 318.954411][T10995] CPU: 0 UID: 0 PID: 10995 Comm: syz.0.1472 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 318.954446][T10995] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 318.954457][T10995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 318.954474][T10995] Call Trace: [ 318.954484][T10995] [ 318.954496][T10995] dump_stack_lvl+0xe8/0x150 [ 318.954534][T10995] should_fail_ex+0x3eb/0x540 [ 318.954566][T10995] __se_sys_futex+0x180/0x450 [ 318.954611][T10995] ? __pfx___se_sys_futex+0x10/0x10 [ 318.954647][T10995] ? rcu_is_watching+0x16/0xb0 [ 318.954687][T10995] ? __x64_sys_futex+0x21/0xf0 [ 318.954725][T10995] do_syscall_64+0x166/0x520 [ 318.954754][T10995] ? trace_irq_disable+0x3b/0x140 [ 318.954783][T10995] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.954808][T10995] ? clear_bhb_loop+0x70/0xc0 [ 318.954837][T10995] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.954860][T10995] RIP: 0033:0x7fb44c79e159 [ 318.954883][T10995] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.954903][T10995] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 318.954930][T10995] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 318.954948][T10995] RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000000000 [ 318.954964][T10995] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 318.954979][T10995] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000 [ 318.954996][T10995] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 318.955042][T10995] [ 319.307072][T11002] input: syz0 as /devices/virtual/input/input42 [ 319.733177][T11014] Invalid ELF header len 18 [ 319.884053][ T1581] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 319.905348][ T1581] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 319.928826][ T8481] usb 5-1: USB disconnect, device number 10 [ 319.936540][ T1581] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 320.588744][T11041] FAULT_INJECTION: forcing a failure. [ 320.588744][T11041] name failslab, interval 1, probability 0, space 0, times 0 [ 320.588785][T11041] CPU: 0 UID: 0 PID: 11041 Comm: syz.0.1488 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 320.588821][T11041] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 320.588832][T11041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 320.588847][T11041] Call Trace: [ 320.588858][T11041] [ 320.588869][T11041] dump_stack_lvl+0xe8/0x150 [ 320.588906][T11041] should_fail_ex+0x3eb/0x540 [ 320.588937][T11041] should_failslab+0xa8/0x100 [ 320.588979][T11041] ? fcntl_getlk+0x32/0xaa0 [ 320.589011][T11041] kmem_cache_alloc_noprof+0x9c/0x600 [ 320.589034][T11041] ? lock_acquire+0x115/0x350 [ 320.589062][T11041] ? fcntl_getlk+0x32/0xaa0 [ 320.589098][T11041] fcntl_getlk+0x32/0xaa0 [ 320.589131][T11041] ? __might_fault+0xaf/0x130 [ 320.589173][T11041] do_fcntl+0xb5c/0x1a20 [ 320.589208][T11041] ? lock_acquire+0x115/0x350 [ 320.589232][T11041] ? __pfx_do_fcntl+0x10/0x10 [ 320.589268][T11041] ? __fget_files+0x2a/0x420 [ 320.589297][T11041] ? __fget_files+0x2a/0x420 [ 320.589329][T11041] ? bpf_lsm_file_fcntl+0x9/0x20 [ 320.589365][T11041] __se_sys_fcntl+0xc8/0x150 [ 320.589396][T11041] do_syscall_64+0x166/0x520 [ 320.589424][T11041] ? trace_irq_disable+0x3b/0x140 [ 320.589453][T11041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.589477][T11041] ? clear_bhb_loop+0x70/0xc0 [ 320.589507][T11041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.589531][T11041] RIP: 0033:0x7fb44c79e159 [ 320.589554][T11041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.589576][T11041] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 320.589603][T11041] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 320.589622][T11041] RDX: 0000200000004240 RSI: 0000000000000005 RDI: 0000000000000003 [ 320.589638][T11041] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 320.589654][T11041] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 320.589669][T11041] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 320.589705][T11041] [ 320.898876][T11047] syzkaller1: entered promiscuous mode [ 320.898903][T11047] syzkaller1: entered allmulticast mode [ 321.170827][T11058] FAULT_INJECTION: forcing a failure. [ 321.170827][T11058] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 321.170867][T11058] CPU: 1 UID: 0 PID: 11058 Comm: syz.4.1497 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 321.170902][T11058] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 321.170912][T11058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 321.170927][T11058] Call Trace: [ 321.170936][T11058] [ 321.170948][T11058] dump_stack_lvl+0xe8/0x150 [ 321.170985][T11058] should_fail_ex+0x3eb/0x540 [ 321.171018][T11058] _copy_to_iter+0x1e4/0x1810 [ 321.171051][T11058] ? __asan_memset+0x22/0x50 [ 321.171083][T11058] ? __pfx__copy_to_iter+0x10/0x10 [ 321.171112][T11058] ? lockdep_hardirqs_on+0x7b/0x110 [ 321.171140][T11058] ? crng_make_state+0x36a/0x600 [ 321.171174][T11058] ? crng_make_state+0xb6/0x600 [ 321.171215][T11058] get_random_bytes_user+0x1d0/0x420 [ 321.171254][T11058] ? __pfx_get_random_bytes_user+0x10/0x10 [ 321.171309][T11058] ? import_ubuf+0xfb/0x1d0 [ 321.171348][T11058] __x64_sys_getrandom+0x17a/0x270 [ 321.171384][T11058] ? __pfx___x64_sys_getrandom+0x10/0x10 [ 321.171420][T11058] ? rcu_is_watching+0x16/0xb0 [ 321.171465][T11058] do_syscall_64+0x166/0x520 [ 321.171493][T11058] ? trace_irq_disable+0x3b/0x140 [ 321.171521][T11058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.171547][T11058] ? clear_bhb_loop+0x70/0xc0 [ 321.171576][T11058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.171599][T11058] RIP: 0033:0x7fed3259e159 [ 321.171622][T11058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.171643][T11058] RSP: 002b:00007fed334ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000013e [ 321.171669][T11058] RAX: ffffffffffffffda RBX: 00007fed32825fa0 RCX: 00007fed3259e159 [ 321.171687][T11058] RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240 [ 321.171704][T11058] RBP: 00007fed3263506b R08: 0000000000000000 R09: 0000000000000000 [ 321.171720][T11058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.171735][T11058] R13: 00007fed32826038 R14: 00007fed32825fa0 R15: 00007ffc842efee8 [ 321.171771][T11058] [ 321.448391][T11063] FAULT_INJECTION: forcing a failure. [ 321.448391][T11063] name failslab, interval 1, probability 0, space 0, times 0 [ 321.448432][T11063] CPU: 0 UID: 0 PID: 11063 Comm: syz.6.1498 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 321.448468][T11063] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 321.448478][T11063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 321.448494][T11063] Call Trace: [ 321.448504][T11063] [ 321.448514][T11063] dump_stack_lvl+0xe8/0x150 [ 321.448553][T11063] should_fail_ex+0x3eb/0x540 [ 321.448583][T11063] should_failslab+0xa8/0x100 [ 321.448617][T11063] ? sk_prot_alloc+0x57/0x210 [ 321.448643][T11063] kmem_cache_alloc_noprof+0x9c/0x600 [ 321.448666][T11063] ? security_inode_alloc+0x39/0x310 [ 321.448692][T11063] ? sk_prot_alloc+0x57/0x210 [ 321.448717][T11063] ? kmem_cache_alloc_noprof+0x151/0x600 [ 321.448745][T11063] sk_prot_alloc+0x57/0x210 [ 321.448777][T11063] ? sk_alloc+0x27/0x390 [ 321.448803][T11063] sk_alloc+0x3a/0x390 [ 321.448831][T11063] __vsock_create+0x3a/0x8e0 [ 321.448868][T11063] vsock_create+0x11d/0x450 [ 321.448894][T11063] __sock_create+0x4b5/0xac0 [ 321.448936][T11063] __sys_socket+0xd6/0x1b0 [ 321.448973][T11063] __x64_sys_socket+0x7a/0x90 [ 321.449009][T11063] do_syscall_64+0x166/0x520 [ 321.449036][T11063] ? trace_irq_disable+0x3b/0x140 [ 321.449064][T11063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.449088][T11063] ? clear_bhb_loop+0x70/0xc0 [ 321.449118][T11063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.449142][T11063] RIP: 0033:0x7f169a99e159 [ 321.449163][T11063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.449184][T11063] RSP: 002b:00007f169b8bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 321.449210][T11063] RAX: ffffffffffffffda RBX: 00007f169ac25fa0 RCX: 00007f169a99e159 [ 321.449228][T11063] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000028 [ 321.449243][T11063] RBP: 00007f169aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 321.449259][T11063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 321.449273][T11063] R13: 00007f169ac26038 R14: 00007f169ac25fa0 R15: 00007ffe039496e8 [ 321.449309][T11063] [ 322.416769][T11089] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 323.070132][ T8481] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 323.200188][ T1581] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 323.222301][ T8481] usb 7-1: New USB device found: idVendor=0c4b, idProduct=0100, bcdDevice=1.00 [ 323.225027][ T8481] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 323.225052][ T8481] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 323.225071][ T8481] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 323.225101][ T8481] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.278902][T11103] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 323.289470][ T8481] cyberjack 7-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 323.308667][ T8481] usb 7-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 323.341005][ T5716] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 323.358896][ T1581] usb 1-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 323.359875][ T1581] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 323.359903][ T1581] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 323.359923][ T1581] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 323.359970][ T1581] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.417077][ T1581] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 323.417110][ T1581] usb 1-1: Product: syz [ 323.417128][ T1581] usb 1-1: Manufacturer: syz [ 323.444443][ T1581] cdc_wdm 1-1:1.0: skipping garbage [ 323.444467][ T1581] cdc_wdm 1-1:1.0: skipping garbage [ 323.447853][ T1581] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 323.447871][ T1581] cdc_wdm 1-1:1.0: Unknown control protocol [ 323.496337][ T5716] usb 9-1: New USB device found: idVendor=0c4b, idProduct=0100, bcdDevice=1.00 [ 323.502149][ T5716] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 323.502302][ T5716] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 98 [ 323.502472][ T5716] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.556667][ T8481] usb 7-1: USB disconnect, device number 43 [ 323.588247][T11111] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 323.588397][T11111] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 323.616141][ T5716] cyberjack 9-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 323.678800][ T8481] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 323.691913][ T8481] cyberjack 7-1:1.0: device disconnected [ 323.696898][ T5716] usb 9-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB1 [ 323.753465][ T5761] usb 1-1: USB disconnect, device number 21 [ 323.877766][ T5716] usb 9-1: USB disconnect, device number 27 [ 323.909688][ T5716] cyberjack ttyUSB1: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB1 [ 323.925345][ T5716] cyberjack 9-1:1.0: device disconnected [ 324.163240][T11119] syzkaller1: entered promiscuous mode [ 324.163267][T11119] syzkaller1: entered allmulticast mode [ 324.270125][ T5761] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 324.422275][ T5761] usb 1-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 324.423904][ T5761] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 324.423933][ T5761] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 324.423955][ T5761] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 324.424003][ T5761] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 324.426003][ T5761] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 324.426030][ T5761] usb 1-1: Product: syz [ 324.426047][ T5761] usb 1-1: Manufacturer: syz [ 324.458340][ T5761] cdc_wdm 1-1:1.0: skipping garbage [ 324.458363][ T5761] cdc_wdm 1-1:1.0: skipping garbage [ 324.482301][ T5761] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 324.482364][ T5761] cdc_wdm 1-1:1.0: Unknown control protocol [ 324.630234][ T5716] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 324.780108][ T5716] usb 5-1: Using ep0 maxpacket: 16 [ 324.780855][ T5716] usb 5-1: New USB device found: idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 324.783200][ T5716] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 324.783227][ T5716] usb 5-1: config 0 has no interface number 0 [ 324.785357][ T5716] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.785383][ T5716] usb 5-1: Product: syz [ 324.785400][ T5716] usb 5-1: Manufacturer: syz [ 324.785416][ T5716] usb 5-1: SerialNumber: syz [ 324.813197][ T5716] usb 5-1: config 0 descriptor?? [ 324.858331][ T5716] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 324.995101][T11139] pim6reg1: entered promiscuous mode [ 324.995128][T11139] pim6reg1: entered allmulticast mode [ 325.014650][ C0] cdc_wdm 1-1:1.0: unknown notification 43 received: index 0 len 0 [ 325.065800][T11142] bond0: entered promiscuous mode [ 325.065819][T11142] bond_slave_0: entered promiscuous mode [ 325.065989][T11142] bond_slave_1: entered promiscuous mode [ 325.240620][T11146] kvm: MONITOR instruction emulated as NOP! [ 325.250313][ T1581] usb 1-1: USB disconnect, device number 22 [ 325.881192][ T5716] gspca_spca1528: reg_w err -71 [ 325.881309][ T5716] spca1528 5-1:0.1: probe with driver spca1528 failed with error -71 [ 325.888746][ T5716] usb 5-1: USB disconnect, device number 11 [ 325.943118][ T1581] libceph: connect (1)[c::]:6789 error -101 [ 325.943394][ T1581] libceph: mon0 (1)[c::]:6789 connect error [ 326.020869][T11169] ceph: No mds server is up or the cluster is laggy [ 326.057509][T11177] capability: warning: `syz.0.1547' uses 32-bit capabilities (legacy support in use) [ 326.075991][T11177] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1547'. [ 326.327646][T11183] device-mapper: table: 248:3: integrity: Invalid argument count (-EINVAL) [ 326.327666][T11183] device-mapper: ioctl: error adding target to table [ 326.845451][T11208] device-mapper: ioctl: name not supplied when creating device [ 327.131295][T11220] FAULT_INJECTION: forcing a failure. [ 327.131295][T11220] name failslab, interval 1, probability 0, space 0, times 0 [ 327.131324][T11220] CPU: 0 UID: 0 PID: 11220 Comm: syz.4.1568 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 327.131349][T11220] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 327.131357][T11220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 327.131369][T11220] Call Trace: [ 327.131376][T11220] [ 327.131383][T11220] dump_stack_lvl+0xe8/0x150 [ 327.131411][T11220] should_fail_ex+0x3eb/0x540 [ 327.131432][T11220] should_failslab+0xa8/0x100 [ 327.131456][T11220] ? sk_prot_alloc+0x57/0x210 [ 327.131475][T11220] kmem_cache_alloc_noprof+0x9c/0x600 [ 327.131491][T11220] ? make_kgid+0x1d1/0x6a0 [ 327.131508][T11220] ? security_inode_alloc+0x39/0x310 [ 327.131525][T11220] ? kmem_cache_alloc_noprof+0x151/0x600 [ 327.131541][T11220] ? sk_prot_alloc+0x57/0x210 [ 327.131565][T11220] sk_prot_alloc+0x57/0x210 [ 327.131582][T11220] ? sk_alloc+0x27/0x390 [ 327.131600][T11220] sk_alloc+0x3a/0x390 [ 327.131620][T11220] rds_create+0x83/0x4a0 [ 327.131639][T11220] __sock_create+0x4b5/0xac0 [ 327.131670][T11220] __sys_socket+0xd6/0x1b0 [ 327.131697][T11220] __x64_sys_socket+0x7a/0x90 [ 327.131723][T11220] do_syscall_64+0x166/0x520 [ 327.131743][T11220] ? trace_irq_disable+0x3b/0x140 [ 327.131762][T11220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.131779][T11220] ? clear_bhb_loop+0x70/0xc0 [ 327.131799][T11220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 327.131815][T11220] RIP: 0033:0x7fed3259e159 [ 327.131831][T11220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 327.131845][T11220] RSP: 002b:00007fed334ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 327.131869][T11220] RAX: ffffffffffffffda RBX: 00007fed32825fa0 RCX: 00007fed3259e159 [ 327.131882][T11220] RDX: 0000000000000000 RSI: 0000000000080005 RDI: 0000000000000015 [ 327.131893][T11220] RBP: 00007fed3263506b R08: 0000000000000000 R09: 0000000000000000 [ 327.131903][T11220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 327.131914][T11220] R13: 00007fed32826038 R14: 00007fed32825fa0 R15: 00007ffc842efee8 [ 327.131939][T11220] [ 327.180469][ T10] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 327.381913][ T10] usb 1-1: New USB device found: idVendor=0b48, idProduct=1005, bcdDevice=1.00 [ 327.385138][ T10] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 327.385167][ T10] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 327.387740][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 327.387772][ T10] usb 1-1: Product: syz [ 327.387789][ T10] usb 1-1: Manufacturer: syz [ 327.450145][ T1581] usb 7-1: new full-speed USB device number 44 using dummy_hcd [ 327.606077][ T1581] usb 7-1: unable to get BOS descriptor or descriptor too short [ 327.607806][ T1581] usb 7-1: not running at top speed; connect to a high speed hub [ 327.607847][ T1581] usb 7-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 327.609008][ T1581] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 327.609036][ T1581] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 327.609061][ T1581] usb 7-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 327.609084][ T1581] usb 7-1: config 14 has no interface number 0 [ 327.609105][ T1581] usb 7-1: config 14 has no interface number 1 [ 327.609171][ T1581] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 327.609200][ T1581] usb 7-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 327.609229][ T1581] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 327.609258][ T1581] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 327.609283][ T1581] usb 7-1: config 14 interface 57 has no altsetting 0 [ 327.609304][ T1581] usb 7-1: config 14 interface 228 has no altsetting 0 [ 327.735926][ T1581] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.735959][ T1581] usb 7-1: Product: syz [ 327.735977][ T1581] usb 7-1: Manufacturer: syz [ 327.735995][ T1581] usb 7-1: SerialNumber: syz [ 327.757152][T11212] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 327.757617][T11212] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 327.824065][ T10] dvb_ttusb_budget: ttusb_init_controller: error [ 327.824087][ T10] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 327.893081][ T10] DVB: Unable to find symbol cx22700_attach() [ 327.942363][ T10] DVB: Unable to find symbol tda10046_attach() [ 327.942381][ T10] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 328.102144][ T46] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 328.119564][ T5761] usb 1-1: USB disconnect, device number 23 [ 328.197257][ T1581] legousbtower 7-1:14.57: interrupt endpoints not found [ 328.261941][ T46] usb 5-1: New USB device found: idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 328.263033][ T46] usb 5-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 328.263062][ T46] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 328.265287][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.265313][ T46] usb 5-1: Product: syz [ 328.265359][ T46] usb 5-1: Manufacturer: syz [ 328.265371][ T46] usb 5-1: SerialNumber: syz [ 328.267976][ T46] usb 5-1: config 0 descriptor?? [ 328.327415][ T46] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 328.602705][ T1581] legousbtower 7-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 328.606369][ T1581] legousbtower 7-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 329.300322][ T27] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 329.472245][ T27] usb 1-1: New USB device found: idVendor=0d8c, idProduct=0022, bcdDevice=0.00 [ 329.473530][ T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 329.473564][ T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 329.473633][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.476991][ T27] usb 1-1: config 0 descriptor?? [ 329.526178][ T46] gspca_sunplus: reg_r err -71 [ 329.526284][ T46] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 329.549604][ T46] usb 5-1: USB disconnect, device number 12 [ 329.881088][T11218] usb 7-1: LEGO USB Tower reset control request failed [ 329.883214][ T46] usb 7-1: USB disconnect, device number 44 [ 329.915085][ T27] hid_parser_main: 4007 callbacks suppressed [ 329.915113][ T27] cm6533_jd 0003:0D8C:0022.0020: unknown main item tag 0x0 [ 329.915237][ T27] cm6533_jd 0003:0D8C:0022.0020: unknown main item tag 0x0 [ 329.918887][ T46] legousbtower 7-1:14.228: LEGO USB Tower #-160 now disconnected [ 329.953085][ T27] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0020/input/input43 [ 329.998403][ T27] cm6533_jd 0003:0D8C:0022.0020: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 330.117964][T11237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.118466][T11237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.147468][ T5716] usb 1-1: USB disconnect, device number 24 [ 330.167401][T11238] fido_id[11238]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 331.000121][ T27] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 331.160210][ T46] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 331.162484][ T27] usb 1-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 331.163632][ T27] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 331.163660][ T27] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 331.163682][ T27] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 331.163724][ T27] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.165376][ T27] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 331.165395][ T27] usb 1-1: Product: syz [ 331.165406][ T27] usb 1-1: Manufacturer: syz [ 331.188643][ T27] cdc_wdm 1-1:1.0: skipping garbage [ 331.188661][ T27] cdc_wdm 1-1:1.0: skipping garbage [ 331.260072][ T27] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 331.260098][ T27] cdc_wdm 1-1:1.0: Unknown control protocol [ 331.350865][ T46] usb 7-1: New USB device found: idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 331.351806][ T46] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 331.351840][ T46] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.351859][ T46] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.351875][ T46] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 331.352733][ T46] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 331.352750][ T46] usb 7-1: Manufacturer: syz [ 331.354900][ T46] usb 7-1: config 0 descriptor?? [ 331.445153][ T5761] usb 1-1: USB disconnect, device number 25 [ 331.517138][ T1178] IPVS: starting estimator thread 0... [ 331.623242][T11276] IPVS: using max 28 ests per chain, 67200 per kthread [ 331.767263][ T46] appleir 0003:05AC:8243.0021: unknown main item tag 0x0 [ 331.784574][ T46] appleir 0003:05AC:8243.0021: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 331.892254][ T5761] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 332.044398][ T5761] usb 1-1: New USB device found: idVendor=7d25, idProduct=a415, bcdDevice=0.40 [ 332.045686][ T5761] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 332.045717][ T5761] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 332.045738][ T5761] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 332.045808][ T5761] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 332.047405][ T5761] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 332.047431][ T5761] usb 1-1: Product: syz [ 332.047449][ T5761] usb 1-1: Manufacturer: syz [ 332.119618][ T5761] cdc_wdm 1-1:1.0: skipping garbage [ 332.119640][ T5761] cdc_wdm 1-1:1.0: skipping garbage [ 332.135447][ T5761] cdc_wdm 1-1:1.0: cdc-wdm1: USB WDM device [ 332.135471][ T5761] cdc_wdm 1-1:1.0: Unknown control protocol [ 332.295447][T11261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 332.298333][T11261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 332.828597][T11311] cgroup: fork rejected by pids controller in /syz4 [ 333.237014][ T977] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.334316][ T977] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.466320][ T977] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.509948][ T977] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.572565][ T5621] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 333.581718][ T5621] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 333.591549][ T5621] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 333.616139][ T5621] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 333.620199][ T5621] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 333.817927][T11320] syzkaller1: entered promiscuous mode [ 333.817955][T11320] syzkaller1: entered allmulticast mode [ 333.881070][ T27] usb 7-1: USB disconnect, device number 45 [ 334.046134][ T977] bridge_slave_1: left allmulticast mode [ 334.046164][ T977] bridge_slave_1: left promiscuous mode [ 334.046382][ T977] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.078732][ T977] bridge_slave_0: left allmulticast mode [ 334.078760][ T977] bridge_slave_0: left promiscuous mode [ 334.079048][ T977] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.182328][ T5761] usb 1-1: USB disconnect, device number 26 [ 334.518105][ C1] vxcan0: j1939_tp_rxtimer: 0xffff888057ef2800: rx timeout, send abort [ 334.582623][ T977] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.586042][ T977] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 334.612874][ T977] bond0 (unregistering): Released all slaves [ 335.018159][ C1] vxcan0: j1939_tp_rxtimer: 0xffff888058b04800: rx timeout, send abort [ 335.018892][ C1] vxcan0: j1939_tp_rxtimer: 0xffff888057ef2800: abort rx timeout. Force session deactivation [ 335.057273][ T977] hsr_slave_0: left promiscuous mode [ 335.058505][ T977] hsr_slave_1: left promiscuous mode [ 335.062904][ T977] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 335.062975][ T977] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.066986][ T977] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 335.067008][ T977] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.123494][ T977] veth1_macvtap: left promiscuous mode [ 335.123537][ T977] veth0_macvtap: left promiscuous mode [ 335.123646][ T977] veth1_vlan: left promiscuous mode [ 335.123718][ T977] veth0_vlan: left promiscuous mode [ 335.352067][T11356] tmpfs: Using encoding : utf8-12.1.0 [ 335.381664][ T5761] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 335.435951][T11358] FAULT_INJECTION: forcing a failure. [ 335.435951][T11358] name failslab, interval 1, probability 0, space 0, times 0 [ 335.435990][T11358] CPU: 0 UID: 0 PID: 11358 Comm: syz.0.1617 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 335.436024][T11358] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 335.436034][T11358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 335.436050][T11358] Call Trace: [ 335.436065][T11358] [ 335.436077][T11358] dump_stack_lvl+0xe8/0x150 [ 335.436114][T11358] should_fail_ex+0x3eb/0x540 [ 335.436144][T11358] ? dup_task_struct+0x52/0xa00 [ 335.436173][T11358] should_failslab+0xa8/0x100 [ 335.436207][T11358] ? dup_task_struct+0x52/0xa00 [ 335.436234][T11358] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 335.436263][T11358] ? dup_task_struct+0x52/0xa00 [ 335.436298][T11358] dup_task_struct+0x52/0xa00 [ 335.436327][T11358] ? _raw_spin_unlock_irq+0x23/0x50 [ 335.436357][T11358] copy_process+0x7db/0x4430 [ 335.436385][T11358] ? __futex_wait+0x3c7/0x470 [ 335.436423][T11358] ? __pfx___futex_wait+0x10/0x10 [ 335.436462][T11358] ? __pfx_futex_wake_mark+0x10/0x10 [ 335.436495][T11358] ? try_to_wake_up+0x8ce/0x14e0 [ 335.436527][T11358] ? __pfx_copy_process+0x10/0x10 [ 335.436569][T11358] kernel_clone+0x2d7/0x940 [ 335.436606][T11358] ? __pfx_kernel_clone+0x10/0x10 [ 335.436647][T11358] ? do_futex+0x3e7/0x4e0 [ 335.436687][T11358] __x64_sys_clone+0x1b6/0x230 [ 335.436722][T11358] ? __pfx___x64_sys_clone+0x10/0x10 [ 335.436770][T11358] ? rcu_is_watching+0x16/0xb0 [ 335.436814][T11358] do_syscall_64+0x166/0x520 [ 335.436842][T11358] ? trace_irq_disable+0x3b/0x140 [ 335.436870][T11358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.436894][T11358] ? clear_bhb_loop+0x70/0xc0 [ 335.436923][T11358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.436948][T11358] RIP: 0033:0x7fb44c79e159 [ 335.436970][T11358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.436992][T11358] RSP: 002b:00007fb44d64efd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 335.437018][T11358] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 335.437037][T11358] RDX: 0000000000000000 RSI: fffffffffffffe90 RDI: 0000000002008000 [ 335.437054][T11358] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 335.437070][T11358] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 335.437084][T11358] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 335.437120][T11358] [ 335.522037][ C1] vxcan0: j1939_tp_rxtimer: 0xffff888058b04800: abort rx timeout. Force session deactivation [ 335.534531][ T5761] usb 7-1: Using ep0 maxpacket: 32 [ 335.542575][ T5761] usb 7-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 335.549349][ T5761] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 335.549442][ T5761] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 335.549480][ T5761] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.658772][ T5761] usb 7-1: config 0 descriptor?? [ 335.723720][ T5621] Bluetooth: hci6: command tx timeout [ 335.787253][ T5761] hub 7-1:0.0: USB hub found [ 335.903943][ T977] team0 (unregistering): Port device team_slave_1 removed [ 335.906144][ T5761] hub 7-1:0.0: config failed, can't read hub descriptor (err -22) [ 335.935008][ T977] team0 (unregistering): Port device team_slave_0 removed [ 336.103780][ T5272] 8021q: adding VLAN 0 to HW filter on device eth2 [ 336.119152][ T5613] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 336.195321][ T5761] hid-generic 0003:046D:C31C.0022: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.6-1/input0 [ 336.336346][ T5613] usb 1-1: New USB device found: idVendor=256c, idProduct=006d, bcdDevice=0.00 [ 336.339354][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 336.339389][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 336.339431][ T5613] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 336.427899][ T5613] usb 1-1: config 0 descriptor?? [ 336.491438][ T5761] usb 7-1: USB disconnect, device number 46 [ 336.638712][ T977] IPVS: stop unused estimator thread 0... [ 336.817305][T11315] bridge0: port 1(bridge_slave_0) entered blocking state [ 336.817502][T11315] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.817661][T11315] bridge_slave_0: entered allmulticast mode [ 336.819498][T11315] bridge_slave_0: entered promiscuous mode [ 336.835852][T11315] bridge0: port 2(bridge_slave_1) entered blocking state [ 336.836146][T11315] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.836322][T11315] bridge_slave_1: entered allmulticast mode [ 336.856660][T11315] bridge_slave_1: entered promiscuous mode [ 336.923648][T11315] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 336.955736][T11315] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 337.057897][T11315] team0: Port device team_slave_0 added [ 337.064331][T11315] team0: Port device team_slave_1 added [ 337.077202][ T5613] usb 1-1: string descriptor 0 read error: -22 [ 337.121609][T11315] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 337.121631][T11315] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.121662][T11315] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 337.125370][T11315] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 337.125391][T11315] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.125421][T11315] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 337.304869][ T5613] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:256C:006D.0023/input/input44 [ 337.327019][T11315] hsr_slave_0: entered promiscuous mode [ 337.335131][T11315] hsr_slave_1: entered promiscuous mode [ 337.369607][ T5613] uclogic 0003:256C:006D.0023: input,hidraw0: USB HID v0.00 Device [HID 256c:006d] on usb-dummy_hcd.0-1/input0 [ 337.510207][ T5613] usb 1-1: USB disconnect, device number 27 [ 337.567695][ T5272] 8021q: adding VLAN 0 to HW filter on device eth3 [ 337.598638][T11389] fido_id[11389]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 337.695654][T11393] FAULT_INJECTION: forcing a failure. [ 337.695654][T11393] name failslab, interval 1, probability 0, space 0, times 0 [ 337.695691][T11393] CPU: 1 UID: 0 PID: 11393 Comm: syz.6.1623 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 337.695724][T11393] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 337.695735][T11393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 337.695753][T11393] Call Trace: [ 337.695763][T11393] [ 337.695774][T11393] dump_stack_lvl+0xe8/0x150 [ 337.695810][T11393] should_fail_ex+0x3eb/0x540 [ 337.695841][T11393] should_failslab+0xa8/0x100 [ 337.695876][T11393] __kmalloc_cache_noprof+0x9e/0x600 [ 337.695902][T11393] ? __futex_wait+0x3c7/0x470 [ 337.695928][T11393] ? snd_pcm_oss_change_params_locked+0x16d/0x3c80 [ 337.695955][T11393] ? snd_pcm_oss_change_params_locked+0x16d/0x3c80 [ 337.695988][T11393] snd_pcm_oss_change_params_locked+0x16d/0x3c80 [ 337.696021][T11393] ? __pfx___mutex_trylock_common+0x10/0x10 [ 337.696058][T11393] ? rcu_is_watching+0x16/0xb0 [ 337.696090][T11393] ? trace_contention_end+0x3d/0x140 [ 337.696124][T11393] ? __mutex_lock+0x305/0x15a0 [ 337.696163][T11393] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 337.696189][T11393] ? futex_wait+0x2a2/0x390 [ 337.696210][T11393] ? snd_pcm_oss_sync+0x30e/0xdf0 [ 337.696239][T11393] ? __pfx___mutex_lock+0x10/0x10 [ 337.696269][T11393] ? __pfx_ima_file_free+0x10/0x10 [ 337.696294][T11393] ? __asan_memset+0x22/0x50 [ 337.696335][T11393] snd_pcm_oss_sync+0x57d/0xdf0 [ 337.696381][T11393] snd_pcm_oss_release+0xff/0x250 [ 337.696409][T11393] ? __pfx_snd_pcm_oss_release+0x10/0x10 [ 337.696433][T11393] __fput+0x413/0xa50 [ 337.696464][T11393] fput_close_sync+0x11f/0x240 [ 337.696486][T11393] ? __pfx_fput_close_sync+0x10/0x10 [ 337.696509][T11393] ? do_raw_spin_unlock+0xf5/0x200 [ 337.696553][T11393] __se_sys_close+0xa2/0x160 [ 337.696579][T11393] do_syscall_64+0x166/0x520 [ 337.696605][T11393] ? trace_irq_disable+0x3b/0x140 [ 337.696633][T11393] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.696656][T11393] ? clear_bhb_loop+0x70/0xc0 [ 337.696682][T11393] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.696704][T11393] RIP: 0033:0x7f169a99e159 [ 337.696726][T11393] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.696747][T11393] RSP: 002b:00007f169b8bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 337.696771][T11393] RAX: ffffffffffffffda RBX: 00007f169ac25fa0 RCX: 00007f169a99e159 [ 337.696789][T11393] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 337.696804][T11393] RBP: 00007f169aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 337.696820][T11393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 337.696834][T11393] R13: 00007f169ac26038 R14: 00007f169ac25fa0 R15: 00007ffe039496e8 [ 337.696870][T11393] [ 337.802471][ T5621] Bluetooth: hci6: command tx timeout [ 338.310571][ T10] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 338.460589][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 338.466108][ T10] usb 7-1: New USB device found: idVendor=046d, idProduct=c53a, bcdDevice=0.00 [ 338.491003][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 338.491065][ T10] usb 7-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 338.491125][ T10] usb 7-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.491151][ T10] usb 7-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 338.491176][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 338.491222][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.499395][ T10] usb 7-1: config 0 descriptor?? [ 338.944832][ T10] logitech-djreceiver 0003:046D:C53A.0024: hiddev0,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.6-1/input0 [ 339.068270][T11315] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 339.094808][T11315] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 339.098941][T11315] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 339.123924][T11315] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 339.125579][T11315] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 339.158598][T11315] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 339.169193][T11315] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 339.223938][ T5613] usb 7-1: USB disconnect, device number 47 [ 339.238004][T11315] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 339.369276][T11315] 8021q: adding VLAN 0 to HW filter on device bond0 [ 339.414410][T11315] 8021q: adding VLAN 0 to HW filter on device team0 [ 339.432967][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.433103][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 339.457221][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.457331][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 339.523638][T11315] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 339.880528][ T5621] Bluetooth: hci6: command tx timeout [ 340.198379][T11315] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 340.560885][T11478] FAULT_INJECTION: forcing a failure. [ 340.560885][T11478] name failslab, interval 1, probability 0, space 0, times 0 [ 340.560925][T11478] CPU: 1 UID: 0 PID: 11478 Comm: syz.0.1636 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 340.560961][T11478] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 340.560971][T11478] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 340.560986][T11478] Call Trace: [ 340.560996][T11478] [ 340.561007][T11478] dump_stack_lvl+0xe8/0x150 [ 340.561043][T11478] should_fail_ex+0x3eb/0x540 [ 340.561074][T11478] should_failslab+0xa8/0x100 [ 340.561109][T11478] __kmalloc_cache_noprof+0x9e/0x600 [ 340.561139][T11478] ? gfs2_meta_init_fs_context+0x54/0x2c0 [ 340.561171][T11478] ? gfs2_meta_init_fs_context+0x54/0x2c0 [ 340.561210][T11478] gfs2_meta_init_fs_context+0x54/0x2c0 [ 340.561247][T11478] alloc_fs_context+0x99e/0xd00 [ 340.561292][T11478] __se_sys_fsopen+0xa5/0x2c0 [ 340.561331][T11478] do_syscall_64+0x166/0x520 [ 340.561360][T11478] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.561385][T11478] ? clear_bhb_loop+0x70/0xc0 [ 340.561415][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.561449][T11478] RIP: 0033:0x7fb44c79e159 [ 340.561472][T11478] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 340.561495][T11478] RSP: 002b:00007fb44d64f028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 340.561523][T11478] RAX: ffffffffffffffda RBX: 00007fb44ca25fa0 RCX: 00007fb44c79e159 [ 340.561541][T11478] RDX: 0000000000000000 RSI: 0100000000000000 RDI: 0000200000000180 [ 340.561559][T11478] RBP: 00007fb44c83506b R08: 0000000000000000 R09: 0000000000000000 [ 340.561575][T11478] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 340.561590][T11478] R13: 00007fb44ca26038 R14: 00007fb44ca25fa0 R15: 00007ffe81a60048 [ 340.561626][T11478] [ 340.905869][T11484] size and base must be multiples of 4 kiB [ 340.905896][T11484] CPU: 1 UID: 0 PID: 11484 Comm: syz.6.1637 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 340.905933][T11484] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 340.905944][T11484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 340.905959][T11484] Call Trace: [ 340.905970][T11484] [ 340.905980][T11484] dump_stack_lvl+0xe8/0x150 [ 340.906018][T11484] mtrr_add+0xd5/0x100 [ 340.906052][T11484] mtrr_ioctl+0xc98/0x13b0 [ 340.906089][T11484] ? __pfx_mtrr_ioctl+0x10/0x10 [ 340.906137][T11484] ? __fget_files+0x2a/0x420 [ 340.906164][T11484] ? __fget_files+0x2a/0x420 [ 340.906188][T11484] ? __pfx_mtrr_ioctl+0x10/0x10 [ 340.906221][T11484] proc_reg_unlocked_ioctl+0x1d6/0x2c0 [ 340.906258][T11484] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 340.906293][T11484] __se_sys_ioctl+0xfc/0x170 [ 340.906327][T11484] do_syscall_64+0x166/0x520 [ 340.906355][T11484] ? trace_irq_disable+0x3b/0x140 [ 340.906383][T11484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.906409][T11484] ? clear_bhb_loop+0x70/0xc0 [ 340.906438][T11484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 340.906462][T11484] RIP: 0033:0x7f169a99e159 [ 340.906492][T11484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 340.906514][T11484] RSP: 002b:00007f169b8bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 340.906540][T11484] RAX: ffffffffffffffda RBX: 00007f169ac25fa0 RCX: 00007f169a99e159 [ 340.906559][T11484] RDX: 0000200000000a00 RSI: 00000000400c4d01 RDI: 0000000000000003 [ 340.906576][T11484] RBP: 00007f169aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 340.906592][T11484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 340.906606][T11484] R13: 00007f169ac26038 R14: 00007f169ac25fa0 R15: 00007ffe039496e8 [ 340.906644][T11484] [ 341.240728][T11315] veth0_vlan: entered promiscuous mode [ 341.248854][T11315] veth1_vlan: entered promiscuous mode [ 341.328072][T11315] veth0_macvtap: entered promiscuous mode [ 341.339475][T11315] veth1_macvtap: entered promiscuous mode [ 341.385123][T11315] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 341.428838][T11315] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 341.533617][ T61] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.582858][ T5612] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 341.599445][ T5612] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 341.605472][ T5612] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 341.622419][ T5612] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 341.623525][ T5612] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 341.722978][ T1178] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.723175][ T1178] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.729049][ T974] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.867659][ T985] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 341.867684][ T985] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 341.947317][ T1178] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 341.947342][ T1178] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 341.967542][ T5621] Bluetooth: hci6: command tx timeout [ 342.041047][ T8481] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 342.192364][ T8481] usb 7-1: unable to get BOS descriptor or descriptor too short [ 342.192418][ T8481] usb 7-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 342.194529][ T8481] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 342.194556][ T8481] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 342.197639][ T8481] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.197667][ T8481] usb 7-1: Product: syz [ 342.197686][ T8481] usb 7-1: Manufacturer: syz [ 342.197704][ T8481] usb 7-1: SerialNumber: syz [ 342.279849][ T8481] usb 7-1: selecting invalid altsetting 1 [ 342.289093][ T8481] usb 7-1: unit 6 not found! [ 342.298384][T11516] bridge0: port 3(erspan0) entered blocking state [ 342.298494][T11516] bridge0: port 3(erspan0) entered disabled state [ 342.321660][T11516] erspan0: entered allmulticast mode [ 342.329159][T11516] erspan0: entered promiscuous mode [ 342.354383][T11516] bridge0: port 3(erspan0) entered blocking state [ 342.354553][T11516] bridge0: port 3(erspan0) entered forwarding state [ 342.424250][T11519] erspan0: left allmulticast mode [ 342.424281][T11519] erspan0: left promiscuous mode [ 342.424521][T11519] bridge0: port 3(erspan0) entered disabled state [ 343.342165][ T8481] usb 7-1: 2:0: failed to get current value for ch 0 (-71) [ 343.483106][ T8481] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 343.485575][ T8481] usb 7-1: USB disconnect, device number 48 [ 343.523111][ T5620] udevd[5620]: setting mode of /dev/bus/usb/007/048 to 020664 failed: No such file or directory [ 343.523248][ T5620] udevd[5620]: setting owner of /dev/bus/usb/007/048 to uid=0, gid=0 failed: No such file or directory [ 343.594812][ T5620] udevd[5620]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 343.613221][T11496] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.614607][T11496] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.615120][T11496] bridge_slave_0: entered allmulticast mode [ 343.644508][T11496] bridge_slave_0: entered promiscuous mode [ 343.684992][T11496] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.685087][T11496] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.685487][T11496] bridge_slave_1: entered allmulticast mode [ 343.715340][T11496] bridge_slave_1: entered promiscuous mode [ 343.722766][ T5621] Bluetooth: hci7: command tx timeout [ 343.858501][T11496] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.879502][T11496] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.922540][T11496] team0: Port device team_slave_0 added [ 343.927309][T11496] team0: Port device team_slave_1 added [ 343.965483][T11570] input: syz0 as /devices/virtual/input/input45 [ 343.986131][T11496] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 343.986151][T11496] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.986182][T11496] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.042645][T11496] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.042666][T11496] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.042697][T11496] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.247149][T11496] hsr_slave_0: entered promiscuous mode [ 344.248257][T11496] hsr_slave_1: entered promiscuous mode [ 344.249017][T11496] debugfs: 'hsr0' already exists in 'hsr' [ 344.249040][T11496] Cannot create hsr debugfs directory [ 344.600261][ T5707] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 344.724642][T11496] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.751639][ T5707] usb 1-1: Using ep0 maxpacket: 32 [ 344.752355][ T5707] usb 1-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 344.753383][ T5707] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 344.753415][ T5707] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 344.753456][ T5707] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.760786][ T33] INFO: task syz-executor:5606 blocked for more than 143 seconds. [ 344.760813][ T33] Tainted: G L Y syzkaller #0 [ 344.760827][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 344.760838][ T33] task:syz-executor state:D stack:21856 pid:5606 tgid:5606 ppid:1 task_flags:0x400140 flags:0x00080002 [ 344.760898][ T33] Call Trace: [ 344.760906][ T33] [ 344.760921][ T33] __schedule+0x1b47/0x5b40 [ 344.760982][ T33] ? __pfx___schedule+0x10/0x10 [ 344.761017][ T33] ? schedule+0x90/0x2b0 [ 344.761045][ T33] schedule+0x164/0x2b0 [ 344.761073][ T33] schedule_preempt_disabled+0x13/0x30 [ 344.761098][ T33] __mutex_lock+0x7c4/0x15a0 [ 344.761131][ T33] ? __mutex_lock+0x5cd/0x15a0 [ 344.761164][ T33] ? nfsd_shutdown_threads+0x4e/0xd0 [ 344.761200][ T33] ? __pfx___mutex_lock+0x10/0x10 [ 344.761229][ T33] ? net_generic+0x1e/0x240 [ 344.761266][ T33] ? net_generic+0x1e/0x240 [ 344.761296][ T33] ? net_generic+0x1e/0x240 [ 344.761324][ T33] ? net_generic+0x1e/0x240 [ 344.761360][ T33] nfsd_shutdown_threads+0x4e/0xd0 [ 344.761394][ T33] nfsd_umount+0x41/0x60 [ 344.761416][ T33] deactivate_locked_super+0xbe/0x110 [ 344.761464][ T33] cleanup_mnt+0x3d3/0x460 [ 344.761499][ T33] task_work_run+0x1d9/0x260 [ 344.761530][ T33] ? __pfx_task_work_run+0x10/0x10 [ 344.761574][ T33] exit_to_user_mode_loop+0x204/0x770 [ 344.761602][ T33] ? rcu_is_watching+0x16/0xb0 [ 344.761638][ T33] do_syscall_64+0x328/0x520 [ 344.761665][ T33] ? trace_irq_disable+0x3b/0x140 [ 344.761692][ T33] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.761717][ T33] ? clear_bhb_loop+0x70/0xc0 [ 344.761746][ T33] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.761771][ T33] RIP: 0033:0x7fd66439f397 [ 344.761792][ T33] RSP: 002b:00007ffef7578c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 344.761816][ T33] RAX: 0000000000000000 RBX: 00007fd6644344bb RCX: 00007fd66439f397 [ 344.761831][ T33] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef7578d50 [ 344.761846][ T33] RBP: 00007ffef7578d50 R08: 00007ffef7579d50 R09: 00000000ffffffff [ 344.761861][ T33] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef7579de0 [ 344.761876][ T33] R13: 00007fd6644344bb R14: 000000000002e519 R15: 00007ffef7579e20 [ 344.761911][ T33] [ 344.762007][ T33] [ 344.762007][ T33] Showing all locks held in the system: [ 344.762021][ T33] locks held by khungtaskd/33: 1, last CPU#0: [ 344.762038][ T33] #0: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 344.813793][ T33] locks held by getty/5365: 2, on CPU#1: [ 344.813866][ T33] #0: ffff88803600c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 344.813938][ T33] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 344.814002][ T33] locks held by syz-executor/5606: 2, on CPU#0: [ 344.814019][ T33] #0: ffff88802c51c0e8 (&type->s_umount_key#71){++++}-{4:4}, at: deactivate_super+0xac/0xe0 [ 344.814185][ T33] #1: ffffffff8f49fc80 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 344.814356][ T33] locks held by kworker/1:4/5613: 3, on CPU#1: [ 344.814398][ T33] #0: ffff88813fe0a148 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 344.814551][ T33] #1: ffffc90004497c40 ((work_completion)(&hcd->wakeup_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 344.814711][ T33] #2: ffff88802a36f1d8 (&dev->mutex){....}-{4:4}, at: usb_remote_wakeup+0x23/0x120 [ 344.814873][ T33] locks held by kworker/1:6/5707: 4, on CPU#1: [ 344.814901][ T33] #0: ffff88801eea5d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 344.815068][ T33] #1: ffffc90004ecfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 344.815227][ T33] #2: ffff88802a1f21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 344.825071][ T33] #3: ffff88801c284980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x510 [ 344.825281][ T33] locks held by syz.1.316/6722: 3, on CPU#0: [ 344.825330][ T33] #0: ffff88807dc0b5f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 344.825476][ T33] #1: ffff888050866460 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 344.825629][ T33] #2: ffffffff8f49fc80 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd10 [ 344.825777][ T33] locks held by syz-executor/7022: 2, last CPU#1: [ 344.825820][ T33] #0: ffff8880325b82e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 344.825969][ T33] #1: ffffffff8f15c520 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 344.826156][ T33] locks held by syz.9.1135/9746: 3, on CPU#1: [ 344.826198][ T33] #0: ffff8880797980f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 344.826345][ T33] #1: ffff88804bb02460 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 344.842185][ T33] #2: ffffffff8f49fc80 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd10 [ 344.842365][ T33] locks held by syz.9.1135/9751: 3, on CPU#1: [ 344.842410][ T33] #0: ffff888079798ef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 344.842570][ T33] #1: ffff88804bb02460 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 344.842740][ T33] #2: ffffffff8f49fc80 (nfsd_mutex){+.+.}-{4:4}, at: write_maxblksize+0x40c/0x630 [ 344.842897][ T33] locks held by syz.8.1545/11173: 1, on CPU#0: [ 344.842933][ T33] #0: ffff88802c51c0e8 (&type->s_umount_key#71){++++}-{4:4}, at: super_lock+0x2d1/0x3d0 [ 344.843104][ T33] locks held by syz-executor/11496: 10, last CPU#1: [ 344.843155][ T33] #0: ffff88807fe78460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 344.843343][ T33] #1: ffff888079ac0080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 344.843516][ T33] #2: ffff8880299890f8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 [ 344.843699][ T33] #3: ffffffff8fee9460 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 344.857092][ T33] #4: ffff888033829128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 344.857282][ T33] #5: ffff888033828258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 [ 344.857450][ T33] #6: ffffffff90676ba0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 [ 344.857606][ T33] #7: ffff88801c284aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 344.857786][ T33] #8: ffff88801c284980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 344.857958][ T33] #9: ffff88801c284a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x6d/0x240 [ 344.858209][ T33] [ 344.858222][ T33] ============================================= [ 344.858222][ T33] [ 344.858252][ T33] NMI backtrace for cpu 1 [ 344.858296][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L Y syzkaller #0 PREEMPT(full) [ 344.858382][ T33] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 344.858412][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 344.858452][ T33] Call Trace: [ 344.858475][ T33] [ 344.858497][ T33] dump_stack_lvl+0xe8/0x150 [ 344.858565][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 344.858602][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 344.858715][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 344.858827][ T33] sys_info+0x135/0x170 [ 344.858911][ T33] watchdog+0x1058/0x10d0 [ 344.858985][ T33] ? watchdog+0x209/0x10d0 [ 344.859078][ T33] kthread+0x38b/0x480 [ 344.859141][ T33] ? __pfx_watchdog+0x10/0x10 [ 344.859205][ T33] ? __pfx_kthread+0x10/0x10 [ 344.859271][ T33] ret_from_fork+0x514/0xb70 [ 344.859359][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 344.859447][ T33] ? __switch_to+0xc78/0x1410 [ 344.859524][ T33] ? __pfx_kthread+0x10/0x10 [ 344.859592][ T33] ret_from_fork_asm+0x1a/0x30 [ 344.859716][ T33] [ 344.859778][ T33] Sending NMI from CPU 1 to CPUs 0: [ 344.859864][ C0] NMI backtrace for cpu 0 [ 344.859881][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 344.859910][ C0] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 344.859918][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 344.859929][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 344.859956][ C0] Code: e8 ce a5 46 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 df 72 b8 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 [ 344.859978][ C0] RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 [ 344.859997][ C0] RAX: 1ffffffff363d600 RBX: 00000000000003fd RCX: 0000000000000000 [ 344.860012][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 344.860024][ C0] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 344.860039][ C0] R10: dffffc0000000000 R11: ffffffff85828b30 R12: dffffc0000000000 [ 344.860054][ C0] R13: 0000000000000000 R14: ffffffff9b1eb0c0 R15: 0000000000000000 [ 344.860067][ C0] FS: 0000000000000000(0000) GS:ffff888124623000(0000) knlGS:0000000000000000 [ 344.860084][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 344.860098][ C0] CR2: 00007f4dc5ffbafc CR3: 0000000073f96000 CR4: 00000000003526f0 [ 344.860116][ C0] Call Trace: [ 344.860123][ C0] [ 344.860133][ C0] wait_for_lsr+0x184/0x2f0 [ 344.860158][ C0] __serial8250_console_fifo_write+0xcd/0x3e0 [ 344.860193][ C0] serial8250_console_write+0xaa1/0x1200 [ 344.860223][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 344.860246][ C0] ? __schedule+0x1b5d/0x5b40 [ 344.860275][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 344.860307][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 344.860334][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 344.860365][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 344.860388][ C0] nbcon_kthread_func+0x6d9/0x8d0 [ 344.860414][ C0] ? nbcon_kthread_func+0x163/0x8d0 [ 344.860435][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 344.860461][ C0] ? __kthread_parkme+0x71/0x1f0 [ 344.860490][ C0] ? __kthread_parkme+0x199/0x1f0 [ 344.860522][ C0] kthread+0x38b/0x480 [ 344.860547][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 344.860568][ C0] ? __pfx_kthread+0x10/0x10 [ 344.860588][ C0] ret_from_fork+0x514/0xb70 [ 344.860617][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 344.860645][ C0] ? __switch_to+0xc78/0x1410 [ 344.860669][ C0] ? __pfx_kthread+0x10/0x10 [ 344.860689][ C0] ret_from_fork_asm+0x1a/0x30 [ 344.860724][ C0] [ 344.884345][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 345.826584][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Tainted: G L Y syzkaller #0 PREEMPT(full) [ 345.837374][ T33] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 345.843193][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 345.853275][ T33] Call Trace: [ 345.856573][ T33] [ 345.859523][ T33] vpanic+0x26f/0x710 [ 345.863549][ T33] panic+0xc5/0xd0 [ 345.867303][ T33] ? __pfx_panic+0x10/0x10 [ 345.871759][ T33] ? preempt_schedule_common+0x7f/0xd0 [ 345.877248][ T33] ? preempt_schedule_thunk+0x16/0x40 [ 345.882646][ T33] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 345.888852][ T33] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 345.895040][ T33] watchdog+0x10cc/0x10d0 [ 345.899407][ T33] ? watchdog+0x209/0x10d0 [ 345.903879][ T33] kthread+0x38b/0x480 [ 345.907977][ T33] ? __pfx_watchdog+0x10/0x10 [ 345.912677][ T33] ? __pfx_kthread+0x10/0x10 [ 345.917296][ T33] ret_from_fork+0x514/0xb70 [ 345.921923][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 345.927083][ T33] ? __switch_to+0xc78/0x1410 [ 345.931805][ T33] ? __pfx_kthread+0x10/0x10 [ 345.936424][ T33] ret_from_fork_asm+0x1a/0x30 [ 345.941316][ T33] [ 345.944939][ T33] Kernel Offset: disabled [ 345.949293][ T33] Rebooting in 86400 seconds..