last executing test programs: 1m43.624963735s ago: executing program 4 (id=2079): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000700)={0x1f, 0x80, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000740)=0x1, 0x4) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000780)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_ecred_conn_req={{0x17, 0x42, 0xa}, {0x80, 0x200, 0x200, 0xa, [0x40]}}}}, 0x17) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000002c0), 0x0, &(0x7f0000000300)={0x1f, 0xfffffffffffffffe, 0xe, 0x0, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, &(0x7f0000000340)={0x0, 0x3938700}, 0x0) 1m42.8704021s ago: executing program 4 (id=2090): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, 0x0, &(0x7f0000000340)) 1m42.819160657s ago: executing program 4 (id=2091): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x5d) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) fsopen(&(0x7f0000000300)='ceph\x00', 0x1) add_key(&(0x7f0000000340)='encrypted\x00', &(0x7f0000000380), &(0x7f00000003c0), 0xca, 0xfffffffffffffffe) 1m42.552610747s ago: executing program 4 (id=2094): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000012ffffef08000300", @ANYRES32=r2, @ANYBLOB="0a000600080211000001000006001000010000000600120001000000040013"], 0x3c}}, 0x0) 1m42.351602272s ago: executing program 4 (id=2098): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./sys\x00', &(0x7f0000000540)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x1, 0x114) write(r0, &(0x7f00000005c0)='0', 0x1) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./mysys\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./mysys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x100) mmap$IORING_OFF_SQ_RING(0x0, 0x5, 0x2, 0x11, r4, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x0, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="0303350000000000000000001e0900000000000000ebff00000000004b000000e4156c3254a52bee5b561b"], 0x28) sendto$inet6(r3, &(0x7f0000000240), 0x0, 0x8000, 0x0, 0x0) ioctl$KVM_CAP_X2APIC_API(r4, 0x4068aea3, &(0x7f0000000480)={0x81, 0x0, 0x2}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000180)=@x86={0x7f, 0x7, 0xf6, 0x0, 0x6, 0x5, 0x5, 0x26, 0x97, 0x39, 0x5, 0x9, 0x0, 0x80, 0x9, 0x7, 0x0, 0x26, 0x2, '\x00', 0xae, 0xb}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text32={0x20, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0) 1m41.776415433s ago: executing program 4 (id=2106): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xfffffffd}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3444e}]}, &(0x7f00000005c0)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd4}, 0x94) 1m26.674134857s ago: executing program 32 (id=2106): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xfffffffd}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3444e}]}, &(0x7f00000005c0)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd4}, 0x94) 5.420937438s ago: executing program 5 (id=2735): ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(0xffffffffffffffff, 0x4018f50b, 0x0) 5.114569307s ago: executing program 5 (id=2736): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x482, 0x0) r1 = epoll_create1(0x80000) write$binfmt_aout(r0, &(0x7f0000000500)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000540)={0x0, 0x7, 0x41, 0x0, 0x83, "00000000000000000000ffff00"}) r2 = syz_open_pts(r0, 0x0) r3 = dup3(r2, r0, 0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000001680)={0x80000001}) 4.306284197s ago: executing program 3 (id=2738): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="00010000410001000800000000000000030100000f000000d700010010112233445566090099aabb86ddc0fb624dccd12ccbe236099f36a6ea92c2b963489b08119ae6fcf67d02ab9930f82f51de0a22223177d6c26e368d430d01b5192332b0398c459c6b65d665c2941082a85b1138de78def5a0bbd2e1a452c7685e095903c43c2c876863df8e63750806be0d000000dc72ea3b0ad2cd932ae33adee9391333a0ebe9582b887cc505749df6725c7ad00b2783094fa9d6b43a4da0cc11caf3e009f23261c187535230732d21dda24c5aab32cbb356f113ad"], 0x100}}, 0x0) 4.155748064s ago: executing program 5 (id=2740): mknodat$md(0xffffffffffffff9c, &(0x7f0000000000)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000040)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000080)={0x1, 0x1, 0x0, 0x40, 0x1, 0xb7e, 0x0, 0x3, 0x0, 0x1, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x11, 0x1000}) syz_emit_ethernet(0x19e, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd6000000001683afffe8000000000000000000000000000aaff020000000000000000000000000001860090780000040000000000000000000309bd3e6d4706598080a8030037ffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34116d42ca0a5c15b37adac15084dbaf736b41e5af26020101000000050000000026000400032077f9290b6e87290b6e871e02f278e94724e20c43c95f9b49204a64d620d4cc9d0d46d954fda9a700000000000006189b2454a86662e37b42678a74974ddd50b21e499efae61e3a816a367d019bc7f892d8975f1fc8a3e27139041cd21d2d12f30ee6f029d8d73f80f9b19d138598345b9c0feda226b333c55c668fb17b5b39603ee66b8534f1fbf97e139d35762307516482a1787d8f3bb76940872a0104ac045b59510dfd945672de5f77c0e6136c06847bbe70dd65236ef4d112e88fabdd7d02a2a380eb697adf4e1d9090705f81ddf041bc076775f5d27555d3f60c44192fa92eee16828c1c4aa17f4a743e212cd2c084e5acc9a8e96852cd54afd2d6c19ffb09d6a12f5614dc76e3fbf49d88b46f8ec9746107b071ee5984889a7c29e78878d1545f6ae9c4787c5ecf84377d96598e9f754feace32fe3e821cf6b679e4f0c1667a333ad60b32ab16c4eddc58705cb3b69af4bc02456b8cc3c08b377c8b4774d63d7ebd5263febe33143b3db3ad6407a987d795e16ba2d4d4cec94e0feaa189fb5a4774c242a301460a8f465a9922abc022794a124dcc2553"], 0x0) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000180)={0x17, {0x1, 0x0}, 0xffffffffffffffff, 0x40000}) 4.064884703s ago: executing program 3 (id=2741): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000480)={'bridge0\x00', &(0x7f00000004c0)=@ethtool_ringparam={0x11, 0x0, 0x10001, 0x0, 0x2, 0x0, 0x0, 0x3, 0x4}}) 2.951367777s ago: executing program 5 (id=2743): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000001140)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x1, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x6, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf99f, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x803, 0x2, 0x8, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0x1ff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10004, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x100d, 0x10000001, 0xe674, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x208201, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000340)={0x84, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x3, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa402}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x9, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000140)={'wlan1\x00', &(0x7f0000000880)=@ethtool_gfeatures={0x3a, 0x6, [{}, {}, {}, {}, {}, {}]}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = dup(r6) writev(r5, &(0x7f0000000780)=[{&(0x7f0000000540)="2ecee56e6343ba99d42e1b8f3cc980131aead199ea3685234adf4d4f720db2b24c5ea1b533ef3c6971a629949f8702a20189b7239331d3166555bdde564ab1bc5c21f65a6dbebbd96a4b021b9f408ca1fa12fcda48fa9348ffca6752df78217c170baa4b07347524af0f029846a285265e1177e565878f6b826c41eab607023d2fca77d1", 0x84}, {&(0x7f0000000600)}, {&(0x7f0000000700)="5aecd3eade38321eb8f54fe78aadfbff8015cb954e4c7bd84da1b0e75a453addc6c5ef106a4d74ad62be0035f809e2ce27e85c6c226ee43a70686281a5c7d6d3b67667590d49950e3eae5a33b4e25bb07c1545", 0x53}], 0x3) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) r9 = socket$inet(0x2, 0x2, 0x0) bind$inet(r9, &(0x7f0000000480)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r9, &(0x7f00000004c0)={0x2, 0x4e24, @local}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000800)={0x2, 0x5e21, @local}, 0x10) 2.832856275s ago: executing program 3 (id=2745): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) 2.632006576s ago: executing program 1 (id=2613): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write(r0, &(0x7f0000000240)='nqn=testnqn,transport=rdma,traddr=172.20.20.24,tr', 0x31) 2.60874063s ago: executing program 3 (id=2747): mkdir(&(0x7f00000002c0)='mnt\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x39, &(0x7f0000000380)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff00000007058102400000070502024000000705830308"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000600)='mnt/ttyUSB0\x00', 0x4a40, 0x18) 2.401653852s ago: executing program 1 (id=2749): setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000008c0)=0x1a6, 0x4) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000980)=[{{&(0x7f00000009c0)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2100, 0x0, 0x0) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, &(0x7f0000000a80)) 2.216455984s ago: executing program 1 (id=2750): bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x2000300, 0xe, 0x0, &(0x7f0000000600)="63e4ed8e46080000003389f7f986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.79727178s ago: executing program 1 (id=2751): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) syz_emit_ethernet(0x43, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x35, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x4, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa}, "17c1b7df60"}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x63, 0x0, &(0x7f0000000000)="ff", 0x0, 0x149d, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) 1.252219871s ago: executing program 2 (id=2755): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x7, &(0x7f0000000540)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_val, @exit]}, &(0x7f00000005c0)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000600), 0x10}, 0x94) 1.209321459s ago: executing program 0 (id=2756): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000680)={0x0, 0x0, 0xfc, 0x0, 0x8, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) 1.146298744s ago: executing program 2 (id=2757): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x80}}, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x7, 0x58, 0x64, 0x0, 0x4, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x3, 0x1, 0x4, 0x2, 0x0, 0x0, 0x0, 0x7}, 0x1, {0x4eb}}}, {0x8, 0x22eb, 0x3, {{0xb, 0x2, 0x9, 0x1, 0x0, 0x2, 0x3, 0x80}, 0x2, {0x81, 0xb41, 0x3, 0x1a, 0x1, 0x1, 0x2, 0x0, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x6a) 1.092312472s ago: executing program 3 (id=2758): r0 = fsopen(&(0x7f0000000080)='mqueue\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 1.032211081s ago: executing program 0 (id=2759): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write(r0, &(0x7f0000000240)='nqn=testnqn,transport=rdma,traddr=172.20.20.24,tr', 0x31) 835.41922ms ago: executing program 3 (id=2760): syz_usb_connect(0x0, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x402) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000540)={0x1c, 0x2, 0xffd3, 0x9, "cd511591002a49500000008000000000f86a1d73f20000000000000000fbf29c"}) 717.386844ms ago: executing program 2 (id=2761): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x40) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000680)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f00000026c0)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x840120, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) r2 = openat(0xffffffffffffff9c, &(0x7f0000002740)='.\x00', 0x280a00, 0x0) file_getattr(r2, &(0x7f0000002780)='./file0\x00', &(0x7f00000027c0), 0x18, 0x100) read$FUSE(r0, &(0x7f0000002800)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000004840)={0x10, 0xffffffffffffffda, r3}, 0x10) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000200)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 704.822167ms ago: executing program 0 (id=2762): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000bc0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x500, 0x1a0, 0xd0, 0x1a0, 0x270, 0x340, 0x0, 0xd0, 0x1a0, 0x270, 0x430, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@empty, 0x40, 0x40}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) 655.697985ms ago: executing program 1 (id=2763): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0), 0x60080, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) ioctl$TCSETS(r0, 0x804c4700, &(0x7f0000000440)={0x1, 0x7, 0x0, 0x400000, 0x0, "3eccd800ff00000200000010000000048100"}) 549.78627ms ago: executing program 2 (id=2764): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="00010000410001000800000000000000030100000f000000d700010010112233445566090099aabb86ddc0fb624dccd12ccbe236099f36a6ea92c2b963489b08119ae6fcf67d02ab9930f82f51de0a22223177d6c26e368d430d01b5192332b0398c459c6b65d665c2941082a85b1138de78def5a0bbd2e1a452c7685e095903c43c2c876863df8e63750806be0d000000dc72ea3b0ad2cd932ae33adee9391333a0ebe9582b887cc505749df6725c7ad00b2783094fa9d6b43a4da0cc11caf3e009f23261c187535230732d21dda24c5aab32cbb356f113ad57cf9006ff7ef0be428a9026109bba"], 0x100}}, 0x0) 513.767448ms ago: executing program 0 (id=2765): symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file7\x00', 0x1ac) r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r0) execveat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file7/file0\x00', 0x0) 512.663777ms ago: executing program 1 (id=2766): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000226aa140070ad0001310010203010902240001000000000904000002bd22f00009050303000000000009058aff"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000012c0)={0x14, 0x0, 0x0}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r1, &(0x7f0000001340)=[{&(0x7f0000001380)="d6", 0x1}], 0x1) 402.884021ms ago: executing program 2 (id=2767): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000003c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000004c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000500)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac47037fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5ed838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b60b23cc613b68fcfdb27d4015a8e7fea999a9686fb7e607a98e8f21e41cd1ac96628e66", 0x162}], 0x1}}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000880)="32d33a47d96ceacc565129f837dfc4ec", 0x10}, {&(0x7f00000008c0)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb7", 0x5e}], 0x2}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000009c0)=0xdf8, 0x4) writev(r0, &(0x7f0000000a00)=[{&(0x7f0000000a40)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc756cbc9ef90ee5477c529105548e84a9fa4cba55b8fe48ef33e206952e5be378ef8df0c7c024080b8961d49a6b863cd8f4e29dd1c66fd9f93ea18010b541133f792fde35c33b0bd8ef50f205193ac4c223f6f5e9659ff679a132fee9cf1769ecef53bc2ed1b3feaa0306025a68e87a88f7bf740a457024963ef1dac67dbd1bae5aec6604b8440e5f3cf21d1c4187db1a1f205054ec1f9dd4d86977bdd6c4c30ef70e2f96fca9ad0cd08dd057286fb658aa836f5a0b1e0c0b86e5e4ab951fd85fa9bc1fa58696b69b2a423a9da883ea945955840c11ae26af5a08cf7d8ce3eda8eef541ba114e0614a0e864424df8aaab36a8abcacf52adddd298c11557f6948215b809e817fefbba3c2fdd96b2c3f23c20bb3c04ccf92c570db4a1555907a79c1ea7fe4085356dbf1d892d86691fcb6ad8b9a7b4b3703afe7e2c2d0da56e31f7d724aa1ece518602235cccf491bc282195054dfebb630b0cbbf7c2a9b82ea6999316dff165c06df46731d1e6a8424cfabac225c32e1fee0a82bcc954f56e5c92da2a1f5d5dc6f6f0b6cf207f0b5986459f5f56643e7b147056c3186753749e6d4ba51a594429a9b4a99b4885fc1888ef784025ad07af", 0x3cb}], 0x1) shutdown(r0, 0x1) 369.308496ms ago: executing program 0 (id=2768): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000700)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000900)=@newtfilter={0x50, 0x2c, 0x401, 0x0, 0x4, {0x0, 0x0, 0x0, r2, {0x1, 0xb}, {0xffff, 0xffff}, {0x300, 0x2}}, [@filter_kind_options=@f_basic={{0xa}, {0x20, 0x2, [@TCA_BASIC_EMATCHES={0x1c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7ff}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_META={0xc, 0x1}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4084}, 0x880) 299.162474ms ago: executing program 5 (id=2769): r0 = fanotify_init(0x40, 0x80000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmsg$unix(r2, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180), 0x100}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fanotify_mark(r0, 0x1, 0x40001019, 0xffffffffffffffff, 0x0) 196.211256ms ago: executing program 2 (id=2770): mknodat$md(0xffffffffffffff9c, &(0x7f0000000000)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000040)='./md0\x00', 0x2, 0x0) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f00000002c0)={0x3, {0x1, 0x1}, 0x1, 0x6}) syz_emit_ethernet(0x19e, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd6000000001683afffe8000000000000000000000000000aaff020000000000000000000000000001860090780000040000000000000000000309bd3e6d4706598080a8030037ffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34116d42ca0a5c15b37adac15084dbaf736b41e5af26020101000000050000000026000400032077f9290b6e87290b6e871e02f278e94724e20c43c95f9b49204a64d620d4cc9d0d46d954fda9a700000000000006189b2454a86662e37b42678a74974ddd50b21e499efae61e3a816a367d019bc7f892d8975f1fc8a3e27139041cd21d2d12f30ee6f029d8d73f80f9b19d138598345b9c0feda226b333c55c668fb17b5b39603ee66b8534f1fbf97e139d35762307516482a1787d8f3bb76940872a0104ac045b59510dfd945672de5f77c0e6136c06847bbe70dd65236ef4d112e88fabdd7d02a2a380eb697adf4e1d9090705f81ddf041bc076775f5d27555d3f60c44192fa92eee16828c1c4aa17f4a743e212cd2c084e5acc9a8e96852cd54afd2d6c19ffb09d6a12f5614dc76e3fbf49d88b46f8ec9746107b071ee5984889a7c29e78878d1545f6ae9c4787c5ecf84377d96598e9f754feace32fe3e821cf6b679e4f0c1667a333ad60b32ab16c4eddc58705cb3b69af4bc02456b8cc3c08b377c8b4774d63d7ebd5263febe33143b3db3ad6407a987d795e16ba2d4d4cec94e0feaa189fb5a4774c242a301460a8f465a9922abc022794a124dcc2553"], 0x0) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000180)={0x17, {0x1, 0x0}, 0xffffffffffffffff, 0x40000}) 28.87917ms ago: executing program 5 (id=2771): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x80}}, 0x0) write$tun(r0, &(0x7f0000000340)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x7, 0x58, 0x64, 0x0, 0x4, 0x2f, 0x0, @remote, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x3, 0x1, 0x4, 0x2, 0x0, 0x0, 0x0, 0x7}, 0x1, {0x4eb}}}, {0x8, 0x22eb, 0x3, {{0xb, 0x2, 0x9, 0x1, 0x0, 0x2, 0x3, 0x80}, 0x2, {0x81, 0xb41, 0x3, 0x1a, 0x1, 0x1, 0x2, 0x0, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x6a) 0s ago: executing program 0 (id=2772): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000440)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000500)=ANY=[], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, 0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e972, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): 5 not found at 0x0000b000: 0x4255 instead [ 299.798061][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 299.798071][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x3d5e instead [ 299.798082][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xf986 instead [ 299.798107][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 299.798116][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 299.798125][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x3d5e instead [ 299.798135][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xf986 instead [ 299.798159][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 299.798168][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 299.798177][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x3d5e instead [ 299.798199][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xf986 instead [ 299.798224][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 299.798233][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 299.798242][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x3d5e instead [ 299.798251][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xf986 instead [ 299.798276][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 299.798284][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 299.798293][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x3d5e instead [ 299.798303][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xf986 instead [ 299.798340][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 299.798349][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 299.798358][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x3d5e instead [ 299.798368][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xf986 instead [ 299.798393][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 299.798401][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 299.798410][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x3d5e instead [ 299.798421][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xf986 instead [ 299.798445][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 299.798465][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 299.798475][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x3d5e instead [ 299.798485][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xf986 instead [ 299.798510][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 299.798518][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 299.798527][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x3d5e instead [ 299.798537][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xf986 instead [ 299.798562][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 299.798571][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 299.798580][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x3d5e instead [ 299.798601][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xf986 instead [ 299.798626][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 299.798635][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 299.798644][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x3d5e instead [ 299.798654][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xf986 instead [ 299.798678][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 299.798687][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 299.798696][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x3d5e instead [ 299.798706][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xf986 instead [ 299.798756][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 299.798766][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 299.798776][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x3d5e instead [ 299.798791][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xf986 instead [ 299.798819][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 299.798828][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 299.798837][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x3d5e instead [ 299.798847][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xf986 instead [ 299.798884][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 299.798894][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 299.798904][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x3d5e instead [ 299.798915][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xf986 instead [ 299.798950][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 299.798959][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 299.798970][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x3d5e instead [ 299.798981][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xf986 instead [ 299.799019][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 299.799029][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 299.799038][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x3d5e instead [ 299.799049][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xf986 instead [ 299.799073][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 299.799082][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 299.799091][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x3d5e instead [ 299.799101][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xf986 instead [ 299.799125][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 299.799145][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 299.799155][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x3d5e instead [ 299.799164][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xf986 instead [ 299.799189][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 299.799198][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 299.799207][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x3d5e instead [ 299.799217][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xf986 instead [ 299.799241][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 299.799250][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 299.799259][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x3d5e instead [ 300.008444][T12106] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xf986 instead [ 300.008478][T12106] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 300.347078][T12106] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 300.949715][ T5776] usbhid 2-1:0.0: can't add hid device: -71 [ 300.949790][ T5776] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 300.976528][ T5776] usb 2-1: USB disconnect, device number 21 [ 301.227317][ T31] audit: type=1400 audit(1794431569.905:791): avc: denied { write } for pid=12080 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 301.651229][ T31] audit: type=1400 audit(1794431570.325:792): avc: denied { write } for pid=12129 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 301.792079][T12142] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2443'. [ 302.592479][ C0] net_ratelimit: 77 callbacks suppressed [ 302.971314][T12157] caif0: tun_chr_ioctl cmd 2148553947 [ 303.509773][T12182] trusted_key: encrypted_key: insufficient parameters specified [ 303.551655][T12183] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 303.551667][T12183] block device autoloading is deprecated and will be removed. [ 303.624024][T12183] md: could not open device unknown-block(1,1). [ 303.624057][T12183] md: md_import_device returned -16 [ 303.635766][ T10] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 303.742711][T12185] md: could not open device unknown-block(1,0). [ 303.742738][T12185] md: md_import_device returned -16 [ 303.750849][T12183] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 303.784499][ T31] audit: type=1400 audit(1794431572.465:793): avc: denied { write } for pid=12153 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 303.815926][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 303.823036][ T10] usb 3-1: New USB device found: idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 303.836965][ T10] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 303.836990][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 303.863949][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=3 [ 303.863961][ T10] usb 3-1: Manufacturer: syz [ 303.863970][ T10] usb 3-1: SerialNumber: syz [ 303.867470][ T10] usb 3-1: config 0 descriptor?? [ 303.881095][T12183] md: could not open device unknown-block(1,0). [ 303.881127][T12183] md: md_import_device returned -16 [ 304.829395][T12202] caif0: tun_chr_ioctl cmd 2148553947 [ 304.974011][ T11] usb 3-1: USB disconnect, device number 27 [ 305.125491][ T31] audit: type=1400 audit(1794431573.805:794): avc: denied { write } for pid=12203 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 305.242106][T12207] device-mapper: multipath queue-length: repeat_count > 1 is deprecated, using 1 instead [ 305.242346][T12207] device-mapper: table: 248:4: multipath: not enough priority group arguments (-EINVAL) [ 305.242362][T12207] device-mapper: ioctl: error adding target to table [ 306.551276][T12233] FAULT_INJECTION: forcing a failure. [ 306.551276][T12233] name failslab, interval 1, probability 0, space 0, times 0 [ 306.551312][T12233] CPU: 0 UID: 0 PID: 12233 Comm: syz.0.2475 Not tainted syzkaller #0 PREEMPT(full) [ 306.551327][T12233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 306.551336][T12233] Call Trace: [ 306.551341][T12233] [ 306.551346][T12233] dump_stack_lvl+0x100/0x190 [ 306.551371][T12233] should_fail_ex.cold+0x5/0xa [ 306.551390][T12233] should_failslab+0xc2/0x120 [ 306.551404][T12233] kmem_cache_alloc_noprof+0x92/0x6a0 [ 306.551422][T12233] ? __pfx_map_id_range_down+0x10/0x10 [ 306.551439][T12233] ? security_inode_alloc+0x3b/0x2c0 [ 306.551460][T12233] security_inode_alloc+0x3b/0x2c0 [ 306.551477][T12233] inode_init_always_gfp+0xc75/0xfb0 [ 306.551496][T12233] alloc_inode+0x8e/0x250 [ 306.551508][T12233] new_inode+0x22/0x1c0 [ 306.551521][T12233] __debugfs_create_file+0xfb/0x500 [ 306.551537][T12233] debugfs_create_file_full+0x41/0x60 [ 306.551554][T12233] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 306.551567][T12233] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 306.551594][T12233] ? lockdep_init_map_type+0x5c/0x250 [ 306.551614][T12233] ? __pfx_macvlan_setup+0x10/0x10 [ 306.551626][T12233] alloc_netdev_mqs+0x314/0x1540 [ 306.551646][T12233] rtnl_create_link+0xc13/0xf80 [ 306.551666][T12233] rtnl_newlink+0x15bc/0x2620 [ 306.551688][T12233] ? __pfx_rtnl_newlink+0x10/0x10 [ 306.551703][T12233] ? avc_has_perm_noaudit+0x56/0x470 [ 306.551717][T12233] ? find_held_lock+0x2b/0x80 [ 306.551729][T12233] ? avc_has_perm_noaudit+0x11e/0x470 [ 306.551743][T12233] ? avc_has_perm_noaudit+0x11e/0x470 [ 306.551773][T12233] ? lock_acquire+0x1d1/0x380 [ 306.551788][T12233] ? rtnetlink_rcv_msg+0x1f6/0xe90 [ 306.551804][T12233] ? find_held_lock+0x2b/0x80 [ 306.551816][T12233] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 306.551831][T12233] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 306.551848][T12233] ? __pfx_rtnl_newlink+0x10/0x10 [ 306.551864][T12233] rtnetlink_rcv_msg+0x95e/0xe90 [ 306.551882][T12233] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 306.551906][T12233] netlink_rcv_skb+0x159/0x420 [ 306.551922][T12233] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 306.551939][T12233] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 306.551953][T12233] ? __asan_memcpy+0x3c/0x60 [ 306.551976][T12233] ? netlink_deliver_tap+0x1ae/0xb50 [ 306.551994][T12233] netlink_unicast+0x668/0x950 [ 306.552012][T12233] ? __pfx_netlink_unicast+0x10/0x10 [ 306.552032][T12233] netlink_sendmsg+0x9ac/0x10c0 [ 306.552050][T12233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.552070][T12233] ? selinux_socket_sendmsg+0x198/0x2f0 [ 306.552088][T12233] ? ____sys_sendmsg+0xa99/0xc30 [ 306.552104][T12233] ____sys_sendmsg+0xa99/0xc30 [ 306.552120][T12233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 306.552137][T12233] ? __pfx_____sys_sendmsg+0x10/0x10 [ 306.552162][T12233] ___sys_sendmsg+0x190/0x1e0 [ 306.552174][T12233] ? __pfx____sys_sendmsg+0x10/0x10 [ 306.552186][T12233] ? futex_wait+0x11e/0x370 [ 306.552209][T12233] ? find_held_lock+0x2b/0x80 [ 306.552232][T12233] __sys_sendmsg+0x160/0x210 [ 306.552256][T12233] ? __pfx___sys_sendmsg+0x10/0x10 [ 306.552281][T12233] do_syscall_64+0x123/0x7b0 [ 306.552297][T12233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.552311][T12233] RIP: 0033:0x7f652fda8fd9 [ 306.552321][T12233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.552334][T12233] RSP: 002b:00007f6530ccb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 306.552346][T12233] RAX: ffffffffffffffda RBX: 00007f6530025fa0 RCX: 00007f652fda8fd9 [ 306.552354][T12233] RDX: 0000000008000002 RSI: 00002000000000c0 RDI: 0000000000000004 [ 306.552362][T12233] RBP: 00007f652fe37fed R08: 0000000000000000 R09: 0000000000000000 [ 306.552369][T12233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 306.552376][T12233] R13: 00007f6530026038 R14: 00007f6530025fa0 R15: 00007ffc06feedd8 [ 306.552394][T12233] [ 306.640812][T12233] debugfs: out of free dentries, can not create file 'netdev@ffff8880873a8720' [ 307.293440][T12242] rxe_eth0 speed is unknown, defaulting to 1000 [ 307.349538][T12254] FAULT_INJECTION: forcing a failure. [ 307.349538][T12254] name failslab, interval 1, probability 0, space 0, times 0 [ 307.349557][T12254] CPU: 0 UID: 0 PID: 12254 Comm: syz.3.2479 Not tainted syzkaller #0 PREEMPT(full) [ 307.349576][T12254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 307.349584][T12254] Call Trace: [ 307.349589][T12254] [ 307.349594][T12254] dump_stack_lvl+0x100/0x190 [ 307.349620][T12254] should_fail_ex.cold+0x5/0xa [ 307.349640][T12254] should_failslab+0xc2/0x120 [ 307.349655][T12254] __kmalloc_node_noprof+0xff/0x870 [ 307.349667][T12254] ? __get_vm_area_node+0x1ff/0x350 [ 307.349679][T12254] ? __get_vm_area_node+0x22b/0x350 [ 307.349697][T12254] ? __vmalloc_node_range_noprof+0x424/0x1440 [ 307.349716][T12254] __vmalloc_node_range_noprof+0x424/0x1440 [ 307.349737][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.349756][T12254] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 307.349775][T12254] ? __kasan_kmalloc+0xaa/0xb0 [ 307.349789][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.349803][T12254] vmalloc_user_noprof+0x9e/0xe0 [ 307.349817][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.349831][T12254] vb2_vmalloc_alloc+0x135/0x410 [ 307.349843][T12254] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 307.349857][T12254] __vb2_queue_alloc+0x8d5/0x1160 [ 307.349877][T12254] vb2_core_reqbufs+0x899/0xf30 [ 307.349892][T12254] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 307.349904][T12254] ? trace_contention_end+0x126/0x160 [ 307.349921][T12254] ? __mutex_lock+0x267/0x1c10 [ 307.349938][T12254] ? avc_has_extended_perms+0x4a5/0x10b0 [ 307.349957][T12254] vb2_ioctl_reqbufs+0x291/0x450 [ 307.349976][T12254] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 307.349995][T12254] ? check_fmt+0x230/0x900 [ 307.350009][T12254] v4l_reqbufs+0x175/0x1d0 [ 307.350024][T12254] __video_do_ioctl+0xb2a/0xdf0 [ 307.350043][T12254] ? __might_fault+0xc5/0x140 [ 307.350058][T12254] ? __pfx___video_do_ioctl+0x10/0x10 [ 307.350079][T12254] video_usercopy+0x47a/0x1730 [ 307.350095][T12254] ? __pfx___video_do_ioctl+0x10/0x10 [ 307.350112][T12254] ? __pfx_video_usercopy+0x10/0x10 [ 307.350138][T12254] v4l2_ioctl+0x1bd/0x250 [ 307.350153][T12254] ? __pfx_v4l2_ioctl+0x10/0x10 [ 307.350170][T12254] __x64_sys_ioctl+0x18e/0x210 [ 307.350184][T12254] do_syscall_64+0x123/0x7b0 [ 307.350199][T12254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.350211][T12254] RIP: 0033:0x7f1d3d9a8fd9 [ 307.350222][T12254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.350233][T12254] RSP: 002b:00007f1d3e7ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.350245][T12254] RAX: ffffffffffffffda RBX: 00007f1d3dc25fa0 RCX: 00007f1d3d9a8fd9 [ 307.350252][T12254] RDX: 0000200000000180 RSI: 00000000c0145608 RDI: 0000000000000004 [ 307.350259][T12254] RBP: 00007f1d3da37fed R08: 0000000000000000 R09: 0000000000000000 [ 307.350267][T12254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.350274][T12254] R13: 00007f1d3dc26038 R14: 00007f1d3dc25fa0 R15: 00007ffd8b4276e8 [ 307.350292][T12254] [ 307.440514][T12254] syz.3.2479: vmalloc error: size 921600, failed to allocated page array size 1800, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 307.440674][T12254] CPU: 0 UID: 0 PID: 12254 Comm: syz.3.2479 Not tainted syzkaller #0 PREEMPT(full) [ 307.440689][T12254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 307.440697][T12254] Call Trace: [ 307.440702][T12254] [ 307.440714][T12254] dump_stack_lvl+0x100/0x190 [ 307.440740][T12254] warn_alloc.cold+0x9e/0xb2 [ 307.440754][T12254] ? __pfx_warn_alloc+0x10/0x10 [ 307.440770][T12254] ? dump_stack_lvl+0x17c/0x190 [ 307.440788][T12254] ? rcu_is_watching+0x13/0xc0 [ 307.440803][T12254] ? __kasan_kmalloc+0x8a/0xb0 [ 307.440816][T12254] ? __kmalloc_node_noprof+0x360/0x870 [ 307.440826][T12254] ? __get_vm_area_node+0x1ff/0x350 [ 307.440838][T12254] ? __get_vm_area_node+0x22b/0x350 [ 307.440849][T12254] ? __vmalloc_node_range_noprof+0x424/0x1440 [ 307.440866][T12254] __vmalloc_node_range_noprof+0x107c/0x1440 [ 307.440885][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.440902][T12254] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 307.440919][T12254] ? __kasan_kmalloc+0xaa/0xb0 [ 307.440934][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.440947][T12254] vmalloc_user_noprof+0x9e/0xe0 [ 307.440960][T12254] ? vb2_vmalloc_alloc+0x135/0x410 [ 307.440973][T12254] vb2_vmalloc_alloc+0x135/0x410 [ 307.440985][T12254] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 307.440998][T12254] __vb2_queue_alloc+0x8d5/0x1160 [ 307.441018][T12254] vb2_core_reqbufs+0x899/0xf30 [ 307.441034][T12254] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 307.441045][T12254] ? trace_contention_end+0x126/0x160 [ 307.441063][T12254] ? __mutex_lock+0x267/0x1c10 [ 307.441079][T12254] ? avc_has_extended_perms+0x4a5/0x10b0 [ 307.441098][T12254] vb2_ioctl_reqbufs+0x291/0x450 [ 307.441118][T12254] ? __pfx_vb2_ioctl_reqbufs+0x10/0x10 [ 307.441138][T12254] ? check_fmt+0x230/0x900 [ 307.441151][T12254] v4l_reqbufs+0x175/0x1d0 [ 307.441166][T12254] __video_do_ioctl+0xb2a/0xdf0 [ 307.441183][T12254] ? __might_fault+0xc5/0x140 [ 307.441196][T12254] ? __pfx___video_do_ioctl+0x10/0x10 [ 307.441220][T12254] video_usercopy+0x47a/0x1730 [ 307.441236][T12254] ? __pfx___video_do_ioctl+0x10/0x10 [ 307.441253][T12254] ? __pfx_video_usercopy+0x10/0x10 [ 307.441279][T12254] v4l2_ioctl+0x1bd/0x250 [ 307.441294][T12254] ? __pfx_v4l2_ioctl+0x10/0x10 [ 307.441311][T12254] __x64_sys_ioctl+0x18e/0x210 [ 307.441325][T12254] do_syscall_64+0x123/0x7b0 [ 307.441340][T12254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.441352][T12254] RIP: 0033:0x7f1d3d9a8fd9 [ 307.441363][T12254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.441374][T12254] RSP: 002b:00007f1d3e7ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.441385][T12254] RAX: ffffffffffffffda RBX: 00007f1d3dc25fa0 RCX: 00007f1d3d9a8fd9 [ 307.441393][T12254] RDX: 0000200000000180 RSI: 00000000c0145608 RDI: 0000000000000004 [ 307.441400][T12254] RBP: 00007f1d3da37fed R08: 0000000000000000 R09: 0000000000000000 [ 307.441408][T12254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.441415][T12254] R13: 00007f1d3dc26038 R14: 00007f1d3dc25fa0 R15: 00007ffd8b4276e8 [ 307.441433][T12254] [ 307.441446][T12254] Mem-Info: [ 307.441454][T12254] active_anon:26566 inactive_anon:0 isolated_anon:0 [ 307.441454][T12254] active_file:0 inactive_file:59703 isolated_file:0 [ 307.441454][T12254] unevictable:0 dirty:494 writeback:0 [ 307.441454][T12254] slab_reclaimable:12133 slab_unreclaimable:102455 [ 307.441454][T12254] mapped:32812 shmem:17479 pagetables:3829 [ 307.441454][T12254] sec_pagetables:0 bounce:0 [ 307.441454][T12254] kernel_misc_reclaimable:0 [ 307.441454][T12254] free:1269003 free_pcp:10603 free_cma:0 [ 307.441485][T12254] Node 0 active_anon:106264kB inactive_anon:0kB active_file:0kB inactive_file:238616kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:131248kB dirty:1972kB writeback:0kB shmem:69916kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13536kB pagetables:15204kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 307.441517][T12254] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:112kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 307.441545][T12254] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 307.441574][T12254] lowmem_reserve[]: 0 2447 2449 2449 2449 [ 307.441592][T12254] Node 0 DMA32 free:1129124kB boost:0kB min:33784kB low:42228kB high:50672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:106264kB inactive_anon:0kB active_file:0kB inactive_file:238616kB unevictable:0kB writepending:1972kB zspages:0kB present:3129332kB managed:2506160kB mlocked:0kB bounce:0kB free_pcp:42412kB local_pcp:42412kB free_cma:0kB [ 307.441622][T12254] lowmem_reserve[]: 0 0 1 1 1 [ 307.441639][T12254] Node 0 Normal free:4kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1748kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 307.441667][T12254] lowmem_reserve[]: 0 0 0 0 0 [ 307.441684][T12254] Node 1 Normal free:3931524kB boost:0kB min:56092kB low:70112kB high:84132kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 307.441720][T12254] lowmem_reserve[]: 0 0 0 0 0 [ 307.441740][T12254] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB [ 307.873470][ C0] net_ratelimit: 89 callbacks suppressed [ 308.109346][T12254] 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 308.109384][T12254] Node 0 DMA32: 1209*4kB (UM) 800*8kB (UM) 478*16kB (UE) 755*32kB (UME) 668*64kB (UME) 585*128kB (UE) 457*256kB (UE) 285*512kB (UME) 109*1024kB (UME) 12*2048kB (UME) 139*4096kB (UM) = 1129124kB [ 308.109471][T12254] Node 0 Normal: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 308.109525][T12254] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 7*16kB (UM) 9*32kB (UM) 9*64kB (UM) 5*128kB (UM) 5*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 958*4096kB (M) = 3931524kB [ 308.109607][T12254] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 308.109616][T12254] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 308.109624][T12254] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 308.109632][T12254] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 308.109641][T12254] 77168 total pagecache pages [ 308.109645][T12254] 0 pages in swap cache [ 308.109649][T12254] Free swap = 124996kB [ 308.109653][T12254] Total swap = 124996kB [ 308.109668][T12254] 2097051 pages RAM [ 308.109672][T12254] 0 pages HighMem/MovableOnly [ 308.109676][T12254] 438458 pages reserved [ 308.109680][T12254] 0 pages cma reserved [ 308.831311][ T31] audit: type=1400 audit(1794431577.505:795): avc: denied { write } for pid=12224 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 309.864158][ T10] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 309.998024][ T31] audit: type=1400 audit(1794431578.675:796): avc: denied { write } for pid=12272 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 310.028550][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 310.030681][ T10] usb 3-1: New USB device found: idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 310.052155][ T10] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 310.052177][ T10] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 310.052199][ T10] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 310.052215][ T10] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 310.052229][ T10] usb 3-1: config 168 interface 0 has no altsetting 0 [ 310.116232][ T10] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 310.116251][ T10] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 310.116272][ T10] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 310.116286][ T10] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 310.116300][ T10] usb 3-1: config 168 interface 0 has no altsetting 0 [ 310.117353][ T10] usb 3-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 310.117370][ T10] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 310.117390][ T10] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 310.117405][ T10] usb 3-1: config 168 interface 0 altsetting 188 has 1 endpoint descriptor, different from the interface descriptor's value: 100 [ 310.117439][ T10] usb 3-1: config 168 interface 0 has no altsetting 0 [ 310.176793][ T10] usb 3-1: string descriptor 0 read error: -22 [ 310.176874][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.273347][ T10] adutux 3-1:168.0: interrupt endpoints not found [ 310.469476][T12278] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 7) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 310.529501][ T10] usb 3-1: USB disconnect, device number 28 [ 311.023253][ T5756] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 311.172540][ T5756] usb 2-1: Using ep0 maxpacket: 16 [ 311.173276][ T5756] usb 2-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 311.190237][ T5756] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 311.190252][ T5756] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 311.190265][ T5756] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 311.190299][ T5756] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.240831][ T5756] usb 2-1: config 0 descriptor?? [ 311.552975][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 311.552985][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 311.552996][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x3d5e instead [ 311.553007][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x32b9 instead [ 311.553016][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 311.553026][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 311.553048][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 311.553061][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 311.553079][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 311.553097][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 311.553106][T12293] jffs2: Further such events for this erase block will not be printed [ 311.553315][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 311.553325][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 311.553334][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x3d5e instead [ 311.553344][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x32b9 instead [ 311.553352][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 311.553361][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 311.553369][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 311.553380][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 311.553396][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 311.553413][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 311.553421][T12293] jffs2: Further such events for this erase block will not be printed [ 311.553630][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 311.553639][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 311.553648][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x3d5e instead [ 311.553659][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xf986 instead [ 311.553682][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 311.553691][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 311.553712][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x3d5e instead [ 311.553723][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xf986 instead [ 311.553747][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 311.553756][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 311.553765][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x3d5e instead [ 311.553775][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xf986 instead [ 311.553799][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 311.553808][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 311.553817][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x3d5e instead [ 311.553827][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xf986 instead [ 311.553868][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 311.553878][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 311.553888][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x3d5e instead [ 311.553899][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xf986 instead [ 311.556391][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 311.556415][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 311.556427][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x3d5e instead [ 311.556438][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xf986 instead [ 311.556465][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 311.556474][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 311.556483][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x3d5e instead [ 311.556493][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xf986 instead [ 311.556518][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 311.556527][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 311.556546][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x3d5e instead [ 311.557650][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xf986 instead [ 311.557682][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 311.557692][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 311.557703][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x3d5e instead [ 311.557714][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xf986 instead [ 311.557739][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 311.557749][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 311.557759][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x3d5e instead [ 311.557782][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xf986 instead [ 311.557808][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 311.557817][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 311.557826][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x3d5e instead [ 311.557836][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xf986 instead [ 311.557867][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 311.557878][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 311.557888][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x3d5e instead [ 311.557898][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xf986 instead [ 311.557936][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 311.557945][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 311.557954][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x3d5e instead [ 311.557964][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xf986 instead [ 311.557988][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 311.557997][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 311.558006][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x3d5e instead [ 311.558016][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xf986 instead [ 311.558053][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 311.558062][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 311.558071][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x3d5e instead [ 311.558081][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xf986 instead [ 311.558106][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 311.558114][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 311.558124][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x3d5e instead [ 311.558134][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xf986 instead [ 311.558158][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 311.558167][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 311.558188][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x3d5e instead [ 311.558199][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xf986 instead [ 311.558223][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 311.558232][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 311.558241][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x3d5e instead [ 311.558251][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xf986 instead [ 311.558297][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 311.558307][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 311.558329][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x3d5e instead [ 311.558340][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xf986 instead [ 311.558366][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 311.558376][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 311.558386][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x3d5e instead [ 311.558396][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xf986 instead [ 311.558421][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 311.558430][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 311.558439][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x3d5e instead [ 311.558461][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xf986 instead [ 311.558486][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 311.558495][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 311.558504][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x3d5e instead [ 311.558514][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xf986 instead [ 311.558538][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 311.558547][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 311.558556][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x3d5e instead [ 311.558566][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xf986 instead [ 311.558600][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 311.558610][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 311.558619][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x3d5e instead [ 311.558629][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xf986 instead [ 311.558653][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 311.558662][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 311.558671][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x3d5e instead [ 311.558681][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xf986 instead [ 311.606862][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 311.606878][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 311.606888][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x3d5e instead [ 311.606900][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xf986 instead [ 311.606939][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 311.606948][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 311.606957][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x3d5e instead [ 311.606967][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xf986 instead [ 311.606992][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 311.607000][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 311.607010][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x3d5e instead [ 311.607019][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xf986 instead [ 311.607045][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 311.607064][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 311.607074][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x3d5e instead [ 311.607084][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xf986 instead [ 311.607108][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 311.607117][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 311.607126][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x3d5e instead [ 311.607136][T12293] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xf986 instead [ 311.607155][T12293] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 311.607159][T12293] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 312.660093][T12287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 312.660460][T12287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 312.918718][ C0] net_ratelimit: 61 callbacks suppressed [ 313.060456][ T5756] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0006/input/input19 [ 313.326455][ T5756] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 313.927261][T12312] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2494'. [ 314.161575][ T10] usb 2-1: USB disconnect, device number 22 [ 314.411790][T12315] nvme_fabrics: missing parameter 'transport=%s' [ 314.411798][T12315] nvme_fabrics: missing parameter 'nqn=%s' [ 314.621974][T12326] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 7) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 314.712867][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 314.874072][ T10] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 314.875032][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 314.875056][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 314.875069][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 314.875082][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 314.878766][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 314.878777][ T10] usb 6-1: Product: syz [ 314.878788][ T10] usb 6-1: Manufacturer: syz [ 314.965657][ T10] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 314.981177][ T10] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -90 [ 314.994928][ T10] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 315.067276][T12336] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2505'. [ 315.186527][ T5756] usb 6-1: USB disconnect, device number 2 [ 315.190738][ T5756] garmin_gps 6-1:1.0: device disconnected [ 315.212269][T12344] trusted_key: encrypted_key: insufficient parameters specified [ 315.434862][T12350] nvme_fabrics: unknown parameter or missing value 't' in ctrl creation request [ 315.837346][T12362] syzkaller0: entered promiscuous mode [ 315.837358][T12362] syzkaller0: entered allmulticast mode [ 316.125739][ T31] audit: type=1400 audit(1794431584.805:797): avc: denied { getopt } for pid=12369 comm="syz.0.2519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 316.170221][T12372] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2520'. [ 316.319118][T12378] FAULT_INJECTION: forcing a failure. [ 316.319118][T12378] name failslab, interval 1, probability 0, space 0, times 0 [ 316.319138][T12378] CPU: 0 UID: 0 PID: 12378 Comm: syz.3.2523 Not tainted syzkaller #0 PREEMPT(full) [ 316.319153][T12378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 316.319161][T12378] Call Trace: [ 316.319165][T12378] [ 316.319171][T12378] dump_stack_lvl+0x100/0x190 [ 316.319197][T12378] should_fail_ex.cold+0x5/0xa [ 316.319216][T12378] should_failslab+0xc2/0x120 [ 316.319231][T12378] __kmalloc_cache_noprof+0x91/0x6d0 [ 316.319247][T12378] ? __pfx_vicodec_s_ctrl+0x10/0x10 [ 316.319258][T12378] ? v4l2_m2m_ctx_init+0x4d/0x380 [ 316.319277][T12378] ? __pfx_queue_init+0x10/0x10 [ 316.319294][T12378] v4l2_m2m_ctx_init+0x4d/0x380 [ 316.319311][T12378] vicodec_open+0x6dc/0xf70 [ 316.319327][T12378] v4l2_open+0x1d2/0x490 [ 316.319349][T12378] ? __pfx_v4l2_open+0x10/0x10 [ 316.319366][T12378] chrdev_open+0x234/0x6a0 [ 316.319383][T12378] ? __pfx_chrdev_open+0x10/0x10 [ 316.319399][T12378] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 316.319415][T12378] do_dentry_open+0x674/0x1470 [ 316.319429][T12378] ? __pfx_chrdev_open+0x10/0x10 [ 316.319447][T12378] vfs_open_consume+0xcc/0x460 [ 316.319465][T12378] path_openat+0x1547/0x23f0 [ 316.319483][T12378] ? __pfx_path_openat+0x10/0x10 [ 316.319503][T12378] do_file_open+0x20e/0x430 [ 316.319518][T12378] ? __pfx_do_file_open+0x10/0x10 [ 316.319544][T12378] ? _raw_spin_unlock+0x28/0x50 [ 316.319556][T12378] ? alloc_fd+0x471/0x7a0 [ 316.319576][T12378] do_sys_openat2+0x163/0x1d0 [ 316.319592][T12378] ? __pfx_do_sys_openat2+0x10/0x10 [ 316.319607][T12378] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 316.319631][T12378] __x64_sys_openat+0x12d/0x210 [ 316.319647][T12378] ? __pfx___x64_sys_openat+0x10/0x10 [ 316.319669][T12378] do_syscall_64+0x123/0x7b0 [ 316.319685][T12378] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.319697][T12378] RIP: 0033:0x7f1d3d96980e [ 316.319708][T12378] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 316.319719][T12378] RSP: 002b:00007f1d3e7ebb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 316.319731][T12378] RAX: ffffffffffffffda RBX: 00007f1d3e7ec6c0 RCX: 00007f1d3d96980e [ 316.319739][T12378] RDX: 0000000000000002 RSI: 00007f1d3e7ebc00 RDI: ffffffffffffff9c [ 316.319746][T12378] RBP: 00007f1d3e7ebc00 R08: 0000000000000000 R09: 0000000000000000 [ 316.319753][T12378] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 316.319760][T12378] R13: 00007f1d3dc26038 R14: 00007f1d3dc25fa0 R15: 00007ffd8b4276e8 [ 316.319781][T12378] [ 316.830338][T12383] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 7) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 317.055102][ T5776] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 317.107466][T12396] ubi: mtd0 is already attached to ubi0 [ 317.158360][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.158388][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.180352][ T10] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 317.214662][ T5776] usb 4-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 317.216330][ T5776] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 317.216356][ T5776] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 317.216369][ T5776] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 317.216382][ T5776] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 317.217678][ T5776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 317.217689][ T5776] usb 4-1: Product: syz [ 317.217698][ T5776] usb 4-1: Manufacturer: syz [ 317.307484][ T5776] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 317.324315][ T5776] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -90 [ 317.328232][ T5776] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 317.373016][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 317.379755][ T10] usb 3-1: New USB device found: idVendor=046d, idProduct=c53a, bcdDevice=0.00 [ 317.380601][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.380636][ T10] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 317.380650][ T10] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 317.380663][ T10] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 317.380677][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 317.380705][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.428834][ T10] usb 3-1: config 0 descriptor?? [ 317.537749][ T5776] usb 4-1: USB disconnect, device number 24 [ 317.553871][ T5776] garmin_gps 4-1:1.0: device disconnected [ 317.929135][ T10] logitech-djreceiver 0003:046D:C53A.0007: hiddev0,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.2-1/input0 [ 318.112707][ C0] net_ratelimit: 553 callbacks suppressed [ 318.166105][ T5776] usb 3-1: USB disconnect, device number 29 [ 319.260910][T12423] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 319.703207][ T31] audit: type=1400 audit(1794431588.385:798): avc: denied { append } for pid=12431 comm="syz.3.2547" name="control" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 319.775338][T12445] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2551'. [ 319.775931][T12445] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.776852][T12445] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.891418][T12451] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2553'. [ 319.937902][ T31] audit: type=1400 audit(1794431588.615:799): avc: denied { ioctl } for pid=12454 comm="syz.1.2554" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x7041 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 319.981888][T12457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2553'. [ 319.981900][T12457] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2553'. [ 319.991881][ T5776] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 320.014447][T12457] netlink: 'syz.0.2553': attribute type 10 has an invalid length. [ 320.089504][T12434] device-mapper: table: 248:6: crypt: Integrity profile not supported. (-EINVAL) [ 320.089521][T12434] device-mapper: ioctl: error adding target to table [ 320.145272][ T5776] usb 6-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 320.146989][ T5776] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 320.147016][ T5776] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 320.147029][ T5776] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 320.148354][ T5776] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 320.148366][ T5776] usb 6-1: Product: syz [ 320.148374][ T5776] usb 6-1: Manufacturer: syz [ 320.218314][T12443] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 320.236796][ T5776] garmin_gps 6-1:1.0: Garmin GPS usb/tty converter detected [ 320.255549][ T5776] usb 6-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 320.259393][T12462] syz.1.2556: vmalloc error: size 12288, failed to allocate pages, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 320.259437][T12462] CPU: 0 UID: 0 PID: 12462 Comm: syz.1.2556 Not tainted syzkaller #0 PREEMPT(full) [ 320.259468][T12462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 320.259484][T12462] Call Trace: [ 320.259489][T12462] [ 320.259496][T12462] dump_stack_lvl+0x100/0x190 [ 320.259519][T12462] warn_alloc.cold+0x9e/0xb2 [ 320.259533][T12462] ? __pfx_warn_alloc+0x10/0x10 [ 320.259549][T12462] ? policy_nodemask+0xed/0x5e0 [ 320.259564][T12462] ? alloc_pages_mpol+0x260/0x560 [ 320.259579][T12462] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 320.259593][T12462] ? find_held_lock+0x2b/0x80 [ 320.259607][T12462] ? rcu_read_unlock+0x17/0x60 [ 320.259625][T12462] __vmalloc_node_range_noprof+0x1051/0x1440 [ 320.259644][T12462] ? kvrealloc_node_align_noprof+0xa7/0x120 [ 320.259658][T12462] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 320.259674][T12462] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 320.259688][T12462] ? rcu_is_watching+0x13/0xc0 [ 320.259706][T12462] __kvmalloc_node_noprof+0x3da/0x9b0 [ 320.259717][T12462] ? kvrealloc_node_align_noprof+0xa7/0x120 [ 320.259730][T12462] ? kvrealloc_node_align_noprof+0xa7/0x120 [ 320.259745][T12462] kvrealloc_node_align_noprof+0xa7/0x120 [ 320.259758][T12462] diag_append_history+0x18d/0x750 [ 320.259777][T12462] diag_record_mod+0x40e/0xbe0 [ 320.259790][T12462] ? verbose+0xfd/0x180 [ 320.259802][T12462] ? __pfx_diag_record_mod+0x10/0x10 [ 320.259822][T12462] ? verbose+0xfd/0x180 [ 320.259834][T12462] ? __pfx_verbose+0x10/0x10 [ 320.259846][T12462] ? reg_to_target+0x260/0x6a0 [ 320.259864][T12462] bpf_diag_mod_end+0x601/0x700 [ 320.259880][T12462] do_check_common+0x8ced/0xbd70 [ 320.259911][T12462] ? __pfx_do_check_common+0x10/0x10 [ 320.259937][T12462] ? __pfx_verbose+0x10/0x10 [ 320.259949][T12462] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 320.259971][T12462] ? mark_fastcall_pattern_for_call+0x7a7/0x970 [ 320.259992][T12462] ? __kvmalloc_node_noprof+0x377/0x9b0 [ 320.260012][T12462] bpf_check+0x8602/0xa0f0 [ 320.260036][T12462] ? __pfx_bpf_check+0x10/0x10 [ 320.260050][T12462] ? find_held_lock+0x2b/0x80 [ 320.260061][T12462] ? bpf_prog_load+0x1af0/0x2b20 [ 320.260081][T12462] ? __asan_memset+0x23/0x50 [ 320.260100][T12462] ? bpf_prog_load+0x1baf/0x2b20 [ 320.260117][T12462] bpf_prog_load+0x1baf/0x2b20 [ 320.260132][T12462] ? avc_has_perm_noaudit+0x11e/0x470 [ 320.260151][T12462] ? __pfx_bpf_prog_load+0x10/0x10 [ 320.260181][T12462] __sys_bpf+0x146f/0x4b60 [ 320.260196][T12462] ? __pfx___sys_bpf+0x10/0x10 [ 320.260206][T12462] ? find_held_lock+0x2b/0x80 [ 320.260218][T12462] ? futex_wake+0x4ea/0x5e0 [ 320.260245][T12462] ? __lock_acquire+0x5c0/0x1f40 [ 320.260261][T12462] ? do_sys_openat2+0x1ae/0x1d0 [ 320.260288][T12462] ? __x64_sys_futex+0x34f/0x4d0 [ 320.260300][T12462] ? __x64_sys_futex+0x358/0x4d0 [ 320.260315][T12462] ? xfd_validate_state+0x129/0x190 [ 320.260332][T12462] ? __x64_sys_bpf+0xce/0x140 [ 320.260342][T12462] __x64_sys_bpf+0xce/0x140 [ 320.260354][T12462] ? do_syscall_64+0xae/0x7b0 [ 320.260368][T12462] do_syscall_64+0x123/0x7b0 [ 320.260383][T12462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.260396][T12462] RIP: 0033:0x7fbf013a8fd9 [ 320.260407][T12462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.260418][T12462] RSP: 002b:00007fbf0230f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 320.260429][T12462] RAX: ffffffffffffffda RBX: 00007fbf01625fa0 RCX: 00007fbf013a8fd9 [ 320.260438][T12462] RDX: 0000000000000094 RSI: 0000200000000900 RDI: 0000000000000005 [ 320.260445][T12462] RBP: 00007fbf01437fed R08: 0000000000000000 R09: 0000000000000000 [ 320.260453][T12462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 320.260460][T12462] R13: 00007fbf01626038 R14: 00007fbf01625fa0 R15: 00007ffe4042fd58 [ 320.260478][T12462] [ 320.731465][T12462] Mem-Info: [ 320.731475][T12462] active_anon:26356 inactive_anon:20 isolated_anon:0 [ 320.731475][T12462] active_file:1753 inactive_file:57957 isolated_file:0 [ 320.731475][T12462] unevictable:8 dirty:322 writeback:0 [ 320.731475][T12462] slab_reclaimable:12257 slab_unreclaimable:102131 [ 320.731475][T12462] mapped:30743 shmem:17478 pagetables:3759 [ 320.731475][T12462] sec_pagetables:0 bounce:0 [ 320.731475][T12462] kernel_misc_reclaimable:0 [ 320.731475][T12462] free:1270506 free_pcp:10510 free_cma:0 [ 320.731504][T12462] Node 0 active_anon:105424kB inactive_anon:80kB active_file:7012kB inactive_file:231632kB unevictable:32kB isolated(anon):0kB isolated(file):0kB mapped:122972kB dirty:1288kB writeback:0kB shmem:69912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13280kB pagetables:14924kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 320.731534][T12462] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:112kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 320.731574][T12462] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 320.731605][T12462] lowmem_reserve[]: 0 2447 2449 2449 2449 [ 320.731624][T12462] Node 0 DMA32 free:1135136kB boost:0kB min:33784kB low:42228kB high:50672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:105424kB inactive_anon:80kB active_file:7012kB inactive_file:231632kB unevictable:32kB writepending:1288kB zspages:0kB present:3129332kB managed:2506160kB mlocked:32kB bounce:0kB free_pcp:42040kB local_pcp:42040kB free_cma:0kB [ 320.731655][T12462] lowmem_reserve[]: 0 0 1 1 1 [ 320.731672][T12462] Node 0 Normal free:4kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1748kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 320.731712][T12462] lowmem_reserve[]: 0 0 0 0 0 [ 320.731729][T12462] Node 1 Normal free:3931524kB boost:0kB min:56092kB low:70112kB high:84132kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 320.731759][T12462] lowmem_reserve[]: 0 0 0 0 0 [ 320.731776][T12462] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 320.731847][T12462] Node 0 DMA32: 766*4kB (UM) 817*8kB (UME) 532*16kB (UME) 845*32kB (UME) 671*64kB (UME) 586*128kB (UME) 459*256kB (UME) 289*512kB (UME) 110*1024kB (UME) 12*2048kB (UME) 139*4096kB (UM) = 1135136kB [ 320.731942][T12462] Node 0 Normal: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 320.732009][T12462] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 7*16kB (UM) 9*32kB (UM) 9*64kB (UM) 5*128kB (UM) 5*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 958*4096kB (M) = 3931524kB [ 320.732092][T12462] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 320.732114][T12462] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 320.732123][T12462] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 320.732131][T12462] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 320.732140][T12462] 77184 total pagecache pages [ 320.732144][T12462] 0 pages in swap cache [ 320.732148][T12462] Free swap = 124996kB [ 320.732151][T12462] Total swap = 124996kB [ 320.732156][T12462] 2097051 pages RAM [ 320.732160][T12462] 0 pages HighMem/MovableOnly [ 320.732163][T12462] 438458 pages reserved [ 320.732167][T12462] 0 pages cma reserved [ 320.938829][ T2268] usb 6-1: USB disconnect, device number 3 [ 321.193199][ T2268] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 321.193626][ T2268] garmin_gps 6-1:1.0: device disconnected [ 321.369723][T12469] netlink: 'syz.2.2559': attribute type 1 has an invalid length. [ 321.369734][T12469] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2559'. [ 321.497605][T12466] rxe_eth0 speed is unknown, defaulting to 1000 [ 321.611884][T12478] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2564'. [ 322.431606][T12499] netlink: 'syz.1.2572': attribute type 1 has an invalid length. [ 322.431617][T12499] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2572'. [ 322.686449][ T31] audit: type=1400 audit(1794431591.375:800): avc: denied { append } for pid=12504 comm="syz.5.2574" name="comedi4" dev="devtmpfs" ino=1277 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 323.015595][ T2268] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 323.164398][ T2268] usb 4-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 323.167739][ T2268] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 323.167765][ T2268] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 323.167779][ T2268] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 323.169474][ T2268] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 323.169486][ T2268] usb 4-1: Product: syz [ 323.169495][ T2268] usb 4-1: Manufacturer: syz [ 323.171601][T12507] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 323.172745][ T10] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 323.264227][ T2268] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 323.289706][ T2268] usb 4-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 323.382668][ T10] usb 6-1: device descriptor read/64, error -71 [ 323.487452][ T2268] usb 4-1: USB disconnect, device number 25 [ 323.537686][ T2268] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 323.539801][ T2268] garmin_gps 4-1:1.0: device disconnected [ 323.558105][ C0] net_ratelimit: 97 callbacks suppressed [ 323.623972][ T10] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 323.752526][ T10] usb 6-1: device descriptor read/64, error -71 [ 323.863116][ T10] usb usb6-port1: attempt power cycle [ 324.174252][T12541] syzkaller0: entered promiscuous mode [ 324.174261][T12541] syzkaller0: entered allmulticast mode [ 324.202615][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 324.227027][ T10] usb 6-1: device descriptor read/8, error -71 [ 324.357041][ T31] audit: type=1400 audit(1794431593.035:801): avc: denied { accept } for pid=12546 comm="syz.3.2595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 324.462617][ T10] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 324.483488][ T10] usb 6-1: device descriptor read/8, error -71 [ 324.547709][T12557] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2600'. [ 324.593020][ T10] usb usb6-port1: unable to enumerate USB device [ 324.934160][ T2268] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 324.978455][T12571] syzkaller0: entered promiscuous mode [ 324.978464][T12571] syzkaller0: entered allmulticast mode [ 325.093115][ T2268] usb 3-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 325.094008][ T2268] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 325.094033][ T2268] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 325.094052][ T2268] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 325.095607][ T2268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 325.095618][ T2268] usb 3-1: Product: syz [ 325.095626][ T2268] usb 3-1: Manufacturer: syz [ 325.097718][T12565] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 325.098858][ T2268] garmin_gps 3-1:1.0: Garmin GPS usb/tty converter detected [ 325.186849][ T2268] usb 3-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 325.345850][ T10] usb 3-1: USB disconnect, device number 30 [ 325.349493][ T10] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 325.349896][ T10] garmin_gps 3-1:1.0: device disconnected [ 325.667538][ T5625] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 325.671092][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 325.681251][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 326.542187][T12591] caif0: tun_chr_ioctl cmd 2148553947 [ 326.543511][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 326.561563][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 327.229708][ T8850] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.279109][T12614] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 327.279118][T12614] block device autoloading is deprecated and will be removed. [ 327.342619][T12613] syzkaller0: entered promiscuous mode [ 327.342628][T12613] syzkaller0: entered allmulticast mode [ 327.396555][T12616] md: invalid raid superblock magic on ram10 [ 327.396564][T12616] md: ram10 does not have a valid v0.0 superblock, not importing! [ 327.396604][T12616] md: md_import_device returned -22 [ 328.307496][T12614] md: invalid raid superblock magic on ram10 [ 328.307507][T12614] md: ram10 does not have a valid v0.0 superblock, not importing! [ 328.307542][T12614] md: md_import_device returned -22 [ 328.368606][T12627] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2624'. [ 328.410263][T12615] bond0: entered allmulticast mode [ 328.410571][T12615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 328.495345][T12630] caif0: tun_chr_ioctl cmd 2148553947 [ 328.596591][ T4940] Bluetooth: hci2: command tx timeout [ 328.614602][ T8850] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.772533][ T10] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 328.799858][ T8850] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.889521][T12589] net_ratelimit: 60 callbacks suppressed [ 328.920173][ T10] usb 6-1: device descriptor read/64, error -71 [ 328.956392][ T8850] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.002835][ T5776] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 329.041643][T12589] rxe_eth0 speed is unknown, defaulting to 1000 [ 329.122754][T12646] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2632'. [ 329.153676][ T10] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 329.163855][ T5776] usb 4-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 329.165747][ T5776] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 329.165773][ T5776] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 329.165786][ T5776] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 329.192635][ T5776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 329.192647][ T5776] usb 4-1: Product: syz [ 329.192655][ T5776] usb 4-1: Manufacturer: syz [ 329.247144][T12638] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 329.252287][ T5776] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 329.278050][T12649] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2632'. [ 329.278061][T12649] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2632'. [ 329.306685][ T10] usb 6-1: device descriptor read/64, error -71 [ 329.308642][ T5776] usb 4-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 329.369570][T12651] netlink: 'syz.2.2632': attribute type 10 has an invalid length. [ 329.414351][ T10] usb usb6-port1: attempt power cycle [ 329.493163][ T5776] usb 4-1: USB disconnect, device number 26 [ 329.526340][ T5776] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 329.548170][ T5776] garmin_gps 4-1:1.0: device disconnected [ 329.765092][ T10] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 329.783629][ T10] usb 6-1: device descriptor read/8, error -71 [ 329.802966][ T5756] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 329.803251][ T8850] erspan0: left allmulticast mode [ 329.803262][ T8850] erspan0: left promiscuous mode [ 329.803395][ T8850] bridge0: port 1(erspan0) entered disabled state [ 329.954997][ T5756] usb 1-1: New USB device found: idVendor=047f, idProduct=ffff, bcdDevice=0.00 [ 329.956275][ T5756] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 329.956289][ T5756] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 329.956303][ T5756] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 329.956316][ T5756] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 329.956346][ T5756] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.960377][ T5756] usb 1-1: config 0 descriptor?? [ 330.035527][ T10] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 330.053148][ T10] usb 6-1: device descriptor read/8, error -71 [ 330.174596][ T10] usb usb6-port1: unable to enumerate USB device [ 330.381213][T12672] overlayfs: missing 'lowerdir' [ 330.442010][T12672] overlayfs: failed to resolve 'lower1': -2 [ 330.482077][T12672] overlayfs: failed to resolve 'lower1': -2 [ 330.503812][ T5756] usbhid 1-1:0.0: can't add hid device: -71 [ 330.503885][ T5756] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 330.531750][ T5756] usb 1-1: USB disconnect, device number 25 [ 330.667180][ T31] audit: type=1400 audit(1794431599.345:802): avc: denied { write } for pid=12659 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 330.696113][ T4940] Bluetooth: hci2: command tx timeout [ 330.790662][ T8850] bond1 (unregistering): Released all slaves [ 330.885052][ T8850] bond0 (unregistering): Released all slaves [ 330.944721][ T31] audit: type=1400 audit(1794431599.625:803): avc: denied { write } for pid=12682 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 331.148788][ T8850] tipc: Left network mode [ 331.220778][ T31] audit: type=1400 audit(1794431599.905:804): avc: denied { getopt } for pid=12687 comm="syz.0.2642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 331.291454][ T5284] 8021q: adding VLAN 0 to HW filter on device eth5 [ 331.788869][T12699] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2644'. [ 331.874045][T12705] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2644'. [ 331.874058][T12705] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2644'. [ 331.959201][T12709] netlink: 'syz.5.2644': attribute type 10 has an invalid length. [ 332.142222][T12709] syz_tun: entered promiscuous mode [ 332.260793][T12709] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 332.554809][ T2268] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 332.713400][ T2268] usb 1-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 332.714248][ T2268] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 332.714273][ T2268] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 332.714286][ T2268] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 332.744438][ T2268] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 332.744449][ T2268] usb 1-1: Product: syz [ 332.744457][ T2268] usb 1-1: Manufacturer: syz [ 332.755231][ T4940] Bluetooth: hci2: command tx timeout [ 332.801645][T12716] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 332.813698][ T2268] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 332.867448][ T2268] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 332.982681][ T31] audit: type=1400 audit(1794431601.655:805): avc: denied { write } for pid=12698 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 333.033487][ T8850] hsr_slave_0: left promiscuous mode [ 333.034932][ T8850] hsr_slave_1: left promiscuous mode [ 333.064126][ T2268] usb 1-1: USB disconnect, device number 26 [ 333.103871][ T2268] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 333.104288][ T2268] garmin_gps 1-1:1.0: device disconnected [ 333.112167][ T8850] veth1_macvtap: left promiscuous mode [ 333.112191][ T8850] veth0_macvtap: left promiscuous mode [ 333.112257][ T8850] veth1_vlan: left promiscuous mode [ 333.333276][ T5756] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 333.381216][ T31] audit: type=1400 audit(1794431602.065:806): avc: denied { write } for pid=12740 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 333.477017][ T5756] usb 6-1: device descriptor read/64, error -71 [ 333.712633][ T5756] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 333.843313][ T5756] usb 6-1: device descriptor read/64, error -71 [ 333.953672][ T5756] usb usb6-port1: attempt power cycle [ 333.986631][ T8850] team0 (unregistering): Port device vlan0 removed [ 334.098521][T12764] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2664'. [ 334.293389][ T5756] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 334.315917][ T5756] usb 6-1: device descriptor read/8, error -71 [ 334.352479][ C0] net_ratelimit: 94 callbacks suppressed [ 334.552834][ T5756] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 334.572955][ T5756] usb 6-1: device descriptor read/8, error -71 [ 334.684185][ T5756] usb usb6-port1: unable to enumerate USB device [ 334.714270][ T5284] 8021q: adding VLAN 0 to HW filter on device eth6 [ 334.832632][ T4940] Bluetooth: hci2: command tx timeout [ 334.918871][T12589] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.918920][T12589] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.919019][T12589] bridge_slave_0: entered allmulticast mode [ 334.945037][T12589] bridge_slave_0: entered promiscuous mode [ 334.959652][T12589] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.959701][T12589] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.959811][T12589] bridge_slave_1: entered allmulticast mode [ 334.991984][T12589] bridge_slave_1: entered promiscuous mode [ 335.089357][T12782] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2668'. [ 335.217457][T12589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 335.253890][T12589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 335.464878][T12589] team0: Port device team_slave_0 added [ 335.490379][T12589] team0: Port device team_slave_1 added [ 335.503991][T12791] FAULT_INJECTION: forcing a failure. [ 335.503991][T12791] name failslab, interval 1, probability 0, space 0, times 0 [ 335.504010][T12791] CPU: 0 UID: 0 PID: 12791 Comm: syz.3.2671 Not tainted syzkaller #0 PREEMPT(full) [ 335.504025][T12791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 335.504034][T12791] Call Trace: [ 335.504038][T12791] [ 335.504044][T12791] dump_stack_lvl+0x100/0x190 [ 335.504068][T12791] should_fail_ex.cold+0x5/0xa [ 335.504088][T12791] should_failslab+0xc2/0x120 [ 335.504103][T12791] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 335.504117][T12791] ? key_alloc+0x44c/0x1330 [ 335.504132][T12791] kmemdup_noprof+0x29/0x60 [ 335.504145][T12791] key_alloc+0x44c/0x1330 [ 335.504162][T12791] ? __pfx_key_alloc+0x10/0x10 [ 335.504178][T12791] __key_create_or_update+0x70e/0xe30 [ 335.504193][T12791] ? __pfx___key_create_or_update+0x10/0x10 [ 335.504205][T12791] ? lookup_user_key+0x58c/0x14f0 [ 335.504223][T12791] ? __pfx_lookup_user_key+0x10/0x10 [ 335.504242][T12791] ? __might_fault+0xc5/0x140 [ 335.504266][T12791] key_create_or_update+0x42/0x60 [ 335.504279][T12791] __do_sys_add_key+0x2e8/0x460 [ 335.504295][T12791] ? __pfx___do_sys_add_key+0x10/0x10 [ 335.504315][T12791] do_syscall_64+0x123/0x7b0 [ 335.504331][T12791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.504343][T12791] RIP: 0033:0x7f1d3d9a8fd9 [ 335.504353][T12791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.504365][T12791] RSP: 002b:00007f1d3e7ec028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 335.504377][T12791] RAX: ffffffffffffffda RBX: 00007f1d3dc25fa0 RCX: 00007f1d3d9a8fd9 [ 335.504384][T12791] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000200000000340 [ 335.504391][T12791] RBP: 00007f1d3da37fed R08: fffffffffffffffe R09: 0000000000000000 [ 335.504399][T12791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.504405][T12791] R13: 00007f1d3dc26038 R14: 00007f1d3dc25fa0 R15: 00007ffd8b4276e8 [ 335.504422][T12791] [ 335.780630][T12798] FAULT_INJECTION: forcing a failure. [ 335.780630][T12798] name failslab, interval 1, probability 0, space 0, times 0 [ 335.780646][T12798] CPU: 0 UID: 0 PID: 12798 Comm: syz.0.2672 Not tainted syzkaller #0 PREEMPT(full) [ 335.780661][T12798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 335.780669][T12798] Call Trace: [ 335.780673][T12798] [ 335.780679][T12798] dump_stack_lvl+0x100/0x190 [ 335.780703][T12798] should_fail_ex.cold+0x5/0xa [ 335.780724][T12798] should_failslab+0xc2/0x120 [ 335.780739][T12798] __kmalloc_cache_noprof+0x91/0x6d0 [ 335.780755][T12798] ? fsnotify_alloc_group+0x8d/0x320 [ 335.780771][T12798] fsnotify_alloc_group+0x8d/0x320 [ 335.780784][T12798] do_inotify_init+0x49/0x5a0 [ 335.780799][T12798] __x64_sys_inotify_init1+0x30/0x40 [ 335.780814][T12798] do_syscall_64+0x123/0x7b0 [ 335.780830][T12798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.780842][T12798] RIP: 0033:0x7f652fda8fd9 [ 335.780852][T12798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.780863][T12798] RSP: 002b:00007f6530caa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000126 [ 335.780875][T12798] RAX: ffffffffffffffda RBX: 00007f6530026090 RCX: 00007f652fda8fd9 [ 335.780883][T12798] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000080000 [ 335.780890][T12798] RBP: 00007f652fe37fed R08: 0000000000000000 R09: 0000000000000000 [ 335.780896][T12798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 335.780903][T12798] R13: 00007f6530026128 R14: 00007f6530026090 R15: 00007ffc06feedd8 [ 335.780919][T12798] [ 336.068495][T12589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.068513][T12589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.068525][T12589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.151661][T12589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.151667][T12589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.192750][T12589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 336.291619][T12804] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2675'. [ 336.306822][ T31] audit: type=1400 audit(1794431604.985:807): avc: denied { watch } for pid=12805 comm="syz.5.2676" path="/60" dev="tmpfs" ino=336 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 336.433681][T12804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2675'. [ 336.433692][T12804] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2675'. [ 336.513891][T12814] netlink: 'syz.2.2675': attribute type 10 has an invalid length. [ 336.539209][T12589] hsr_slave_0: entered promiscuous mode [ 336.541395][T12589] hsr_slave_1: entered promiscuous mode [ 336.559390][T12589] debugfs: 'hsr0' already exists in 'hsr' [ 336.559409][T12589] Cannot create hsr debugfs directory [ 336.787217][ T31] audit: type=1400 audit(1794431605.465:808): avc: denied { write } for pid=12787 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 336.826296][T12819] FAULT_INJECTION: forcing a failure. [ 336.826296][T12819] name failslab, interval 1, probability 0, space 0, times 0 [ 336.826320][T12819] CPU: 0 UID: 0 PID: 12819 Comm: syz.5.2679 Not tainted syzkaller #0 PREEMPT(full) [ 336.826335][T12819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 336.826343][T12819] Call Trace: [ 336.826348][T12819] [ 336.826353][T12819] dump_stack_lvl+0x100/0x190 [ 336.826377][T12819] should_fail_ex.cold+0x5/0xa [ 336.826396][T12819] should_failslab+0xc2/0x120 [ 336.826411][T12819] __kmalloc_noprof+0xfc/0x840 [ 336.826423][T12819] ? neigh_hash_alloc+0x8e/0x1c0 [ 336.826443][T12819] neigh_hash_alloc+0x8e/0x1c0 [ 336.826460][T12819] neigh_table_register+0x34a/0x11b0 [ 336.826475][T12819] ? __pfx_ndisc_net_init+0x10/0x10 [ 336.826490][T12819] ndisc_net_init+0x80/0x3e0 [ 336.826504][T12819] ? __pfx_ndisc_net_init+0x10/0x10 [ 336.826518][T12819] ? ac6_proc_init+0x5f/0x80 [ 336.826529][T12819] ? inet6_net_init+0x76d/0xa20 [ 336.826547][T12819] ? __pfx_ndisc_net_init+0x10/0x10 [ 336.826560][T12819] ops_init+0x1e2/0x5f0 [ 336.826576][T12819] setup_net+0x118/0x3a0 [ 336.826592][T12819] ? __pfx_setup_net+0x10/0x10 [ 336.826607][T12819] ? bpf_lsm_namespace_init+0x9/0x10 [ 336.826624][T12819] copy_net_ns+0x340/0x7a0 [ 336.826641][T12819] create_new_namespaces+0x3ea/0xac0 [ 336.826661][T12819] unshare_nsproxy_namespaces+0xf6/0x210 [ 336.826678][T12819] ksys_unshare+0x44f/0x980 [ 336.826693][T12819] ? __pfx_ksys_unshare+0x10/0x10 [ 336.826717][T12819] __x64_sys_unshare+0x31/0x40 [ 336.826731][T12819] do_syscall_64+0x123/0x7b0 [ 336.826747][T12819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.826759][T12819] RIP: 0033:0x7fe73cba8fd9 [ 336.826769][T12819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 336.826781][T12819] RSP: 002b:00007fe73dacf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 336.826792][T12819] RAX: ffffffffffffffda RBX: 00007fe73ce25fa0 RCX: 00007fe73cba8fd9 [ 336.826800][T12819] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 336.826808][T12819] RBP: 00007fe73cc37fed R08: 0000000000000000 R09: 0000000000000000 [ 336.826816][T12819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 336.826824][T12819] R13: 00007fe73ce26038 R14: 00007fe73ce25fa0 R15: 00007ffce1d7c4e8 [ 336.826841][T12819] [ 337.385775][ T31] audit: type=1400 audit(1794431606.065:809): avc: denied { write } for pid=12832 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 337.532749][T12840] md: array md2 already has disks! [ 337.564462][T12840] md: could not open device unknown-block(1,5). [ 337.564506][T12840] md: error, md_import_device() returned -16 [ 337.682963][ T5776] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 337.686075][ T5284] 8021q: adding VLAN 0 to HW filter on device eth7 [ 337.707522][ T31] audit: type=1400 audit(1794431606.395:810): avc: denied { append } for pid=12845 comm="syz.5.2689" name="event2" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 337.776870][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 337.776881][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 337.776891][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x3d5e instead [ 337.776902][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x32b9 instead [ 337.776911][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 337.776921][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 337.776930][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 337.776942][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 337.776960][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 337.776978][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 337.776987][T12846] jffs2: Further such events for this erase block will not be printed [ 337.777177][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 337.777187][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 337.777196][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x3d5e instead [ 337.777206][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x32b9 instead [ 337.777214][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 337.777231][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 337.777240][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 337.777252][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 337.777271][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 337.777290][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 337.777298][T12846] jffs2: Further such events for this erase block will not be printed [ 337.777486][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 337.777495][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 337.777505][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x3d5e instead [ 337.777515][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xf986 instead [ 337.777540][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 337.777549][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 337.777558][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x3d5e instead [ 337.777568][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xf986 instead [ 337.777592][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 337.777601][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 337.777610][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x3d5e instead [ 337.777620][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xf986 instead [ 337.777645][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 337.777654][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 337.777663][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x3d5e instead [ 337.777673][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xf986 instead [ 337.777698][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 337.777706][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 337.777716][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x3d5e instead [ 337.777726][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xf986 instead [ 337.777750][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 337.777759][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 337.777768][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x3d5e instead [ 337.777778][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xf986 instead [ 337.777802][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 337.777811][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 337.777820][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x3d5e instead [ 337.777830][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xf986 instead [ 337.777855][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 337.777863][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 337.777872][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x3d5e instead [ 337.777882][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xf986 instead [ 337.777907][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 337.777916][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 337.777925][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x3d5e instead [ 337.777935][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xf986 instead [ 337.777960][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 337.777968][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 337.777978][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x3d5e instead [ 337.777987][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xf986 instead [ 337.778012][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 337.778021][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 337.778030][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x3d5e instead [ 337.778040][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xf986 instead [ 337.804397][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 337.804414][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 337.804424][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x3d5e instead [ 337.804435][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xf986 instead [ 337.804462][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 337.804471][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 337.804481][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x3d5e instead [ 337.804492][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xf986 instead [ 337.804518][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 337.804527][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 337.804536][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x3d5e instead [ 337.804546][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xf986 instead [ 337.804575][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 337.804584][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 337.804593][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x3d5e instead [ 337.804603][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xf986 instead [ 337.804628][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 337.804637][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 337.804647][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x3d5e instead [ 337.804657][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xf986 instead [ 337.804683][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 337.804691][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 337.804700][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x3d5e instead [ 337.804710][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xf986 instead [ 337.804735][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 337.804743][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 337.804753][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x3d5e instead [ 337.804762][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xf986 instead [ 337.804786][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 337.804795][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 337.804804][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x3d5e instead [ 337.804814][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xf986 instead [ 337.804838][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 337.804847][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 337.804856][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x3d5e instead [ 337.804866][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xf986 instead [ 337.804890][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 337.804899][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 337.804908][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x3d5e instead [ 337.804918][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xf986 instead [ 337.804943][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 337.804951][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 337.804960][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x3d5e instead [ 337.804970][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xf986 instead [ 337.804994][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 337.805003][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 337.805012][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x3d5e instead [ 337.805022][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xf986 instead [ 337.805046][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 337.805055][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 337.805064][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x3d5e instead [ 337.805074][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xf986 instead [ 337.805099][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 337.805107][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 337.805116][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x3d5e instead [ 337.805126][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xf986 instead [ 337.805151][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 337.805159][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 337.805168][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x3d5e instead [ 337.805178][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xf986 instead [ 337.805203][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 337.805211][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 337.805221][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x3d5e instead [ 337.805231][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xf986 instead [ 337.805255][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 337.805263][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 337.805273][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x3d5e instead [ 337.805282][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xf986 instead [ 337.805306][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 337.805315][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 337.805324][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x3d5e instead [ 337.805342][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xf986 instead [ 337.805368][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 337.805377][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 337.805388][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x3d5e instead [ 337.805424][T12846] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xf986 instead [ 337.805446][T12846] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 337.805451][T12846] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 337.816503][ T5776] usb 4-1: device descriptor read/64, error -71 [ 338.154926][ T5776] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 338.327343][ T5776] usb 4-1: device descriptor read/64, error -71 [ 338.434325][ T5776] usb usb4-port1: attempt power cycle [ 338.908935][ T5776] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 338.943882][ T5776] usb 4-1: device descriptor read/8, error -71 [ 339.269653][ T5776] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 339.305742][ T5776] usb 4-1: device descriptor read/8, error -71 [ 339.446517][ T5776] usb usb4-port1: unable to enumerate USB device [ 339.515995][T12840] md/raid1:md2: active with 1 out of 1027 mirrors [ 339.516708][T12840] md2: detected capacity change from 0 to 5884 [ 339.552467][ C0] net_ratelimit: 200 callbacks suppressed [ 339.793552][T12858] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2692'. [ 339.933343][T12866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2692'. [ 339.933355][T12866] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2692'. [ 339.980273][T12858] netlink: 'syz.2.2692': attribute type 10 has an invalid length. [ 340.029145][T12868] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2694'. [ 340.521691][ T31] audit: type=1400 audit(1794431609.195:811): avc: denied { write } for pid=12853 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 340.855937][T12894] trusted_key: encrypted_key: insufficient parameters specified [ 340.891924][T12894] Could not find key with description: [syz] [ 340.891934][T12894] process_request_key_err: No key [ 340.891941][T12894] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 340.891948][T12894] One or more global auth toks could not properly register; rc = [-2] [ 340.891978][T12894] Error validating options; rc = [-2] [ 340.931084][ T31] audit: type=1400 audit(1794431609.605:812): avc: denied { write } for pid=12893 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 340.967166][T12894] kernel profiling enabled (shift: 7) [ 341.019783][T12896] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 341.019793][T12896] block device autoloading is deprecated and will be removed. [ 341.086257][T12896] md: could not open device unknown-block(1,6). [ 341.086288][T12896] md: md_import_device returned -16 [ 341.403265][T12908] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2705'. [ 341.540067][T12913] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2705'. [ 341.540078][T12913] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2705'. [ 341.576564][T12913] netlink: 'syz.0.2705': attribute type 10 has an invalid length. [ 341.776206][T12589] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 341.831721][T12589] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 341.846319][T12589] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 341.913611][T12589] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 341.916505][T12589] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 341.967665][T12589] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 341.969492][T12589] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 342.018814][T12589] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 342.400283][T12945] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 342.400293][T12945] block device autoloading is deprecated and will be removed. [ 342.468506][T12589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.549646][T12589] 8021q: adding VLAN 0 to HW filter on device team0 [ 342.564854][T12945] md: could not open device unknown-block(1,6). [ 342.564885][T12945] md: md_import_device returned -16 [ 342.593907][ T6708] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.593957][ T6708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 342.635400][ T8850] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.635450][ T8850] bridge0: port 2(bridge_slave_1) entered forwarding state [ 342.768137][T12954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2716'. [ 342.830232][ T31] audit: type=1400 audit(1794431611.505:813): avc: denied { write } for pid=12914 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.157417][ T31] audit: type=1400 audit(1794431611.835:814): avc: denied { write } for pid=12968 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.384040][T12979] FAULT_INJECTION: forcing a failure. [ 343.384040][T12979] name failslab, interval 1, probability 0, space 0, times 0 [ 343.384059][T12979] CPU: 0 UID: 0 PID: 12979 Comm: syz.0.2725 Not tainted syzkaller #0 PREEMPT(full) [ 343.384073][T12979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 343.384081][T12979] Call Trace: [ 343.384086][T12979] [ 343.384092][T12979] dump_stack_lvl+0x100/0x190 [ 343.384116][T12979] should_fail_ex.cold+0x5/0xa [ 343.384136][T12979] should_failslab+0xc2/0x120 [ 343.384150][T12979] __kmalloc_flags_noprof+0x122/0x8e0 [ 343.384166][T12979] ? __lock_acquire+0x5c0/0x1f40 [ 343.384185][T12979] ? alloc_slab_obj_exts+0x6a/0x170 [ 343.384205][T12979] alloc_slab_obj_exts+0x6a/0x170 [ 343.384223][T12979] __memcg_slab_post_alloc_hook+0x3f3/0x10b0 [ 343.384247][T12979] ? kasan_unpoison+0x27/0x60 [ 343.384259][T12979] __kmalloc_cache_noprof+0x525/0x6d0 [ 343.384274][T12979] ? fib_rules_register+0x41d/0x510 [ 343.384287][T12979] ? mr_table_alloc+0x61/0x3e0 [ 343.384302][T12979] ? __pfx_ip6mr_new_table_set+0x10/0x10 [ 343.384316][T12979] mr_table_alloc+0x61/0x3e0 [ 343.384329][T12979] ? __pfx_ipmr_expire_process+0x10/0x10 [ 343.384345][T12979] ip6mr_net_init+0x41c/0x5e0 [ 343.384361][T12979] ? __pfx_ip6mr_net_init+0x10/0x10 [ 343.384374][T12979] ? inet6_net_init+0x67c/0xa20 [ 343.384393][T12979] ? ac6_proc_init+0x5f/0x80 [ 343.384404][T12979] ? inet6_net_init+0x76d/0xa20 [ 343.384421][T12979] ? __pfx_ip6mr_net_init+0x10/0x10 [ 343.384436][T12979] ops_init+0x1e2/0x5f0 [ 343.384453][T12979] setup_net+0x118/0x3a0 [ 343.384469][T12979] ? __pfx_setup_net+0x10/0x10 [ 343.384485][T12979] ? bpf_lsm_namespace_init+0x9/0x10 [ 343.384501][T12979] copy_net_ns+0x340/0x7a0 [ 343.384519][T12979] create_new_namespaces+0x3ea/0xac0 [ 343.384538][T12979] unshare_nsproxy_namespaces+0xf6/0x210 [ 343.384555][T12979] ksys_unshare+0x44f/0x980 [ 343.384570][T12979] ? __pfx_ksys_unshare+0x10/0x10 [ 343.384593][T12979] __x64_sys_unshare+0x31/0x40 [ 343.384606][T12979] do_syscall_64+0x123/0x7b0 [ 343.384622][T12979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.384634][T12979] RIP: 0033:0x7f652fda8fd9 [ 343.384645][T12979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.384656][T12979] RSP: 002b:00007f6530ccb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 343.384668][T12979] RAX: ffffffffffffffda RBX: 00007f6530025fa0 RCX: 00007f652fda8fd9 [ 343.384677][T12979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 343.384685][T12979] RBP: 00007f652fe37fed R08: 0000000000000000 R09: 0000000000000000 [ 343.384692][T12979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 343.384699][T12979] R13: 00007f6530026038 R14: 00007f6530025fa0 R15: 00007ffc06feedd8 [ 343.384716][T12979] [ 343.862242][T12988] vimc link validate: Sensor A:src:640x480 (0x42474752, 8, 2, 0, 7) Raw Capture 0:snk:640x480 (0x42474752, 8, 0, 0, 0) [ 343.924320][T12979] rxe_eth0 speed is unknown, defaulting to 1000 [ 343.983752][ T5776] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 344.115862][ T5776] usb 3-1: device descriptor read/64, error -71 [ 344.238514][T12999] device-mapper: table: 248:8: crypt: Device lookup failed (-ENOENT) [ 344.238536][T12999] device-mapper: ioctl: error adding target to table [ 344.344740][ T2268] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 344.353171][ T5776] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 344.481013][T12589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 344.495017][ T5776] usb 3-1: device descriptor read/64, error -71 [ 344.495051][ T2268] usb 4-1: Using ep0 maxpacket: 8 [ 344.496903][ T2268] usb 4-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 344.526281][ T2268] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 344.526304][ T2268] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 344.526317][ T2268] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 344.526329][ T2268] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 344.526362][ T2268] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.603069][ T5776] usb usb3-port1: attempt power cycle [ 344.625600][ T31] audit: type=1400 audit(1794431613.305:815): avc: denied { write } for pid=12984 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 344.734886][ T2268] usb 4-1: GET_CAPABILITIES returned 0 [ 344.734906][ T2268] usbtmc 4-1:16.0: can't read capabilities [ 344.906828][ T31] audit: type=1400 audit(1794431613.585:816): avc: denied { write } for pid=13016 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 344.944286][ T5776] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 344.964756][ T5776] usb 3-1: device descriptor read/8, error -71 [ 345.010339][T12589] veth0_vlan: entered promiscuous mode [ 345.050441][T12589] veth1_vlan: entered promiscuous mode [ 345.109265][ C0] usbtmc 4-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 345.124897][T12996] usbtmc 4-1:16.0: Unable to send data, error -71 [ 345.152496][ C0] net_ratelimit: 86 callbacks suppressed [ 345.203744][ T5776] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 345.209142][T12589] veth0_macvtap: entered promiscuous mode [ 345.231677][ T5776] usb 3-1: device descriptor read/8, error -71 [ 345.241306][ T5756] usb 4-1: USB disconnect, device number 31 [ 345.275269][T12589] veth1_macvtap: entered promiscuous mode [ 345.334008][ T5776] usb usb3-port1: unable to enumerate USB device [ 345.342055][T12589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 345.382267][T12589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 345.434022][ T1172] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.434184][ T1172] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.434209][ T1172] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.434227][ T1172] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.004719][ T6708] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.004733][ T6708] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.262241][ T7383] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 346.262251][ T7383] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.305157][T13037] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2738'. [ 347.648628][ T31] audit: type=1400 audit(1794431616.325:817): avc: denied { write } for pid=13025 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 347.968615][ T31] audit: type=1400 audit(1794431616.645:818): avc: denied { write } for pid=13064 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 348.000139][T13068] nvme_fabrics: unknown parameter or missing value 'tr' in ctrl creation request [ 348.010976][ T5756] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 348.162715][ T10] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 348.165617][ T5756] usb 6-1: Using ep0 maxpacket: 8 [ 348.186270][ T5776] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 348.200751][ T5756] usb 6-1: New USB device found: idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 348.201729][ T5756] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 348.201744][ T5756] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 348.201757][ T5756] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 348.201771][ T5756] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 348.201803][ T5756] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.314066][ T10] usb 1-1: New USB device found: idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 348.316025][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 348.316042][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 348.316055][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 348.316069][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 348.317883][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.317895][ T10] usb 1-1: Product: syz [ 348.317903][ T10] usb 1-1: Manufacturer: syz [ 348.317912][ T10] usb 1-1: SerialNumber: syz [ 348.375612][ T10] usb 1-1: config 0 descriptor?? [ 348.411270][ T5776] usb 4-1: not running at top speed; connect to a high speed hub [ 348.411302][ T5776] usb 4-1: New USB device found: idVendor=0ea0, idProduct=6858, bcdDevice=0.40 [ 348.438663][ T5776] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 348.456925][ T5776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.456936][ T5776] usb 4-1: Product: syz [ 348.456961][ T5776] usb 4-1: Manufacturer: syz [ 348.456970][ T5776] usb 4-1: SerialNumber: syz [ 348.495322][ T5776] oti6858 4-1:1.0: oti6858 converter detected [ 348.518637][ T5756] usb 6-1: GET_CAPABILITIES returned 0 [ 348.518658][ T5756] usbtmc 6-1:16.0: can't read capabilities [ 348.538540][ T5776] usb 4-1: oti6858 converter now attached to ttyUSB0 [ 348.629059][ C0] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 348.655895][T13071] usbtmc 6-1:16.0: Unable to send data, error -71 [ 348.661037][ T10] adutux 1-1:0.0: ADU208 now attached to /dev/usb/adutux1 [ 348.710062][ T10] usb 1-1: USB disconnect, device number 27 [ 348.775106][ T5776] usb 4-1: USB disconnect, device number 32 [ 348.825311][ T5776] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 348.829033][ T5776] oti6858 4-1:1.0: device disconnected [ 348.859988][ C0] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 348.861455][T13059] usbtmc 6-1:16.0: Unable to send data, error -71 [ 349.154978][ T31] audit: type=1400 audit(1794431617.835:819): avc: denied { write } for pid=13076 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 349.381286][ T31] audit: type=1400 audit(1794431618.055:820): avc: denied { write } for pid=13099 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 349.554806][ T5776] usb 6-1: USB disconnect, device number 16 [ 349.670590][T13108] nvme_fabrics: unknown parameter or missing value 'tr' in ctrl creation request [ 349.712628][ C0] ipvlan_process_outbound: 1 callbacks suppressed [ 349.869439][T13120] x_tables: unsorted entry at hook 1 [ 349.973013][ T5756] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 349.995454][T13124] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2764'. [ 350.125233][ T5756] usb 4-1: New USB device found: idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 350.137610][ T5756] usb 4-1: config 0 has no interfaces? [ 350.156549][ T5756] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 350.156560][ T5756] usb 4-1: Manufacturer: syz [ 350.160527][ T5756] usb 4-1: config 0 descriptor?? [ 350.264487][ T10] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 350.266938][ T31] audit: type=1400 audit(1794431618.945:821): avc: denied { audit_write } for pid=13138 comm="syz.5.2769" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 350.393011][ T5756] usb 4-1: USB disconnect, device number 33 [ 350.424952][T13141] md: could not open device unknown-block(1,5). [ 350.424985][T13141] md: md_import_device returned -16 [ 350.451282][ T10] usb 2-1: New USB device found: idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 350.466294][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 350.466312][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 350.466325][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 350.466339][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 350.472153][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.472164][ T10] usb 2-1: Product: syz [ 350.472173][ T10] usb 2-1: Manufacturer: syz [ 350.472181][ T10] usb 2-1: SerialNumber: syz [ 350.510009][ T31] audit: type=1400 audit(1794431619.195:822): avc: denied { write } for pid=13111 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 350.519960][ C0] net_ratelimit: 285 callbacks suppressed [ 350.520774][ T10] usb 2-1: config 0 descriptor?? [ 350.603591][T13141] ================================================================== [ 350.603600][T13141] BUG: KASAN: slab-out-of-bounds in super_90_validate+0x178b/0x18c0 [ 350.603619][T13141] Read of size 4 at addr ffff888062348390 by task syz.2.2770/13141 [ 350.603629][T13141] [ 350.603637][T13141] CPU: 0 UID: 0 PID: 13141 Comm: syz.2.2770 Not tainted syzkaller #0 PREEMPT(full) [ 350.603650][T13141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 350.603658][T13141] Call Trace: [ 350.603662][T13141] [ 350.603667][T13141] dump_stack_lvl+0x100/0x190 [ 350.603685][T13141] print_report+0x13d/0x4b0 [ 350.603704][T13141] ? __virt_addr_valid+0x239/0x430 [ 350.603719][T13141] ? super_90_validate+0x178b/0x18c0 [ 350.603731][T13141] kasan_report+0xdf/0x1c0 [ 350.603745][T13141] ? super_90_validate+0x178b/0x18c0 [ 350.603759][T13141] super_90_validate+0x178b/0x18c0 [ 350.603771][T13141] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 350.603787][T13141] ? kobject_init+0x159/0x1b0 [ 350.603803][T13141] add_bound_rdev+0x274/0x390 [ 350.603818][T13141] md_add_new_disk+0xca1/0x1820 [ 350.603831][T13141] md_ioctl+0x2c1d/0x3700 [ 350.603844][T13141] ? __pfx_md_ioctl+0x10/0x10 [ 350.603856][T13141] ? do_vfs_ioctl+0x241/0x13f0 [ 350.603870][T13141] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 350.603884][T13141] ? __fget_files+0x34/0x3d0 [ 350.603900][T13141] ? __pfx_md_ioctl+0x10/0x10 [ 350.603912][T13141] blkdev_ioctl+0x5ad/0x6f0 [ 350.603926][T13141] ? __pfx_blkdev_ioctl+0x10/0x10 [ 350.603938][T13141] ? selinux_file_ioctl+0x1e0/0x290 [ 350.603949][T13141] ? selinux_file_ioctl+0x1e7/0x290 [ 350.603960][T13141] ? __pfx_blkdev_ioctl+0x10/0x10 [ 350.603973][T13141] __x64_sys_ioctl+0x18e/0x210 [ 350.603985][T13141] do_syscall_64+0x123/0x7b0 [ 350.603998][T13141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.604009][T13141] RIP: 0033:0x7f8038fa8fd9 [ 350.604019][T13141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 350.604030][T13141] RSP: 002b:00007f8039f04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 350.604048][T13141] RAX: ffffffffffffffda RBX: 00007f8039225fa0 RCX: 00007f8038fa8fd9 [ 350.604057][T13141] RDX: 0000200000000180 RSI: 0000000040140921 RDI: 0000000000000003 [ 350.604064][T13141] RBP: 00007f8039037fed R08: 0000000000000000 R09: 0000000000000000 [ 350.604072][T13141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 350.604080][T13141] R13: 00007f8039226038 R14: 00007f8039225fa0 R15: 00007ffe64a49d28 [ 350.604093][T13141] [ 350.604097][T13141] [ 350.604100][T13141] Allocated by task 10874: [ 350.604106][T13141] kasan_save_stack+0x30/0x50 [ 350.604117][T13141] kasan_save_track+0x14/0x30 [ 350.604127][T13141] __kasan_slab_alloc+0x89/0x90 [ 350.604138][T13141] kmem_cache_alloc_noprof+0x269/0x6a0 [ 350.604155][T13141] skb_clone+0x187/0x3f0 [ 350.604167][T13141] netlink_broadcast_filtered+0xbab/0xfd0 [ 350.604180][T13141] netlink_sendmsg+0xc86/0x10c0 [ 350.604193][T13141] ____sys_sendmsg+0xa99/0xc30 [ 350.604208][T13141] ___sys_sendmsg+0x190/0x1e0 [ 350.604216][T13141] __sys_sendmsg+0x160/0x210 [ 350.604228][T13141] do_syscall_64+0x123/0x7b0 [ 350.604239][T13141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.604249][T13141] [ 350.604252][T13141] Freed by task 10874: [ 350.604256][T13141] kasan_save_stack+0x30/0x50 [ 350.604266][T13141] kasan_save_track+0x14/0x30 [ 350.604276][T13141] kasan_save_free_info+0x3b/0x70 [ 350.604290][T13141] __kasan_slab_free+0x5f/0x80 [ 350.604300][T13141] kmem_cache_free+0x127/0x6c0 [ 350.604314][T13141] kfree_skbmem+0x19a/0x210 [ 350.604322][T13141] sk_skb_reason_drop+0x10f/0x1b0 [ 350.604335][T13141] netlink_broadcast_filtered+0xb28/0xfd0 [ 350.604347][T13141] netlink_sendmsg+0xc86/0x10c0 [ 350.604360][T13141] ____sys_sendmsg+0xa99/0xc30 [ 350.604374][T13141] ___sys_sendmsg+0x190/0x1e0 [ 350.604383][T13141] __sys_sendmsg+0x160/0x210 [ 350.604394][T13141] do_syscall_64+0x123/0x7b0 [ 350.604405][T13141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.604416][T13141] [ 350.604418][T13141] The buggy address belongs to the object at ffff888062348280 [ 350.604418][T13141] which belongs to the cache skbuff_head_cache of size 240 [ 350.604427][T13141] The buggy address is located 32 bytes to the right of [ 350.604427][T13141] allocated 240-byte region [ffff888062348280, ffff888062348370) [ 350.604437][T13141] [ 350.604440][T13141] The buggy address belongs to the physical page: [ 350.604450][T13141] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x62348 [ 350.604461][T13141] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 350.604471][T13141] page_type: f5(slab) [ 350.604481][T13141] raw: 00fff00000000000 ffff888021ad4780 dead000000000100 dead000000000122 [ 350.604492][T13141] raw: 0000000000000000 00000002000c000c 00000000f5000000 0000000000000000 [ 350.604498][T13141] page dumped because: kasan: bad access detected [ 350.604507][T13141] page_owner tracks the page as allocated [ 350.604511][T13141] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5606, tgid 5606 (syz-executor), ts 266139737888 [ 350.604528][T13141] post_alloc_hook+0xfd/0x120 [ 350.604543][T13141] get_page_from_freelist+0xdae/0x2c80 [ 350.604558][T13141] __alloc_frozen_pages_noprof+0x2ad/0x31e0 [ 350.604574][T13141] new_slab+0xb1/0x6d0 [ 350.604588][T13141] refill_objects+0xe3/0x410 [ 350.604602][T13141] __pcs_replace_empty_main+0x35e/0x650 [ 350.604615][T13141] kmem_cache_alloc_noprof+0x4bf/0x6a0 [ 350.604631][T13141] skb_clone+0x187/0x3f0 [ 350.604643][T13141] dev_queue_xmit_nit+0x255/0xa80 [ 350.604656][T13141] dev_hard_start_xmit+0x2f5/0x760 [ 350.604666][T13141] sch_direct_xmit+0x1cf/0xf40 [ 350.604676][T13141] __dev_queue_xmit+0x27d9/0x48d0 [ 350.604686][T13141] ip_finish_output2+0xfa4/0x2740 [ 350.604698][T13141] __ip_finish_output.part.0+0x43b/0x6f0 [ 350.604709][T13141] ip_output+0x392/0xc00 [ 350.604719][T13141] ip_local_out+0x193/0x1f0 [ 350.604730][T13141] page last free pid 5629 tgid 5629 ts 266137765999 stack trace: [ 350.604737][T13141] __free_frozen_pages+0x7b1/0x10f0 [ 350.604748][T13141] __kasan_populate_vmalloc+0x164/0x210 [ 350.604758][T13141] alloc_vmap_area+0x963/0x2bc0 [ 350.604768][T13141] __get_vm_area_node+0x1ed/0x350 [ 350.604777][T13141] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 350.604788][T13141] __vmalloc_node_noprof+0xad/0xf0 [ 350.604799][T13141] do_arpt_get_ctl+0x651/0x1010 [ 350.604814][T13141] nf_getsockopt+0x7c/0xe0 [ 350.604823][T13141] ip_getsockopt+0x192/0x1e0 [ 350.604835][T13141] tcp_getsockopt+0xa1/0x110 [ 350.604850][T13141] do_sock_getsockopt+0x415/0x570 [ 350.604861][T13141] __sys_getsockopt+0x148/0x260 [ 350.604873][T13141] __x64_sys_getsockopt+0xbd/0x160 [ 350.604884][T13141] do_syscall_64+0x123/0x7b0 [ 350.604896][T13141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.604906][T13141] [ 350.604908][T13141] Memory state around the buggy address: [ 350.604914][T13141] ffff888062348280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 350.604921][T13141] ffff888062348300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 350.604929][T13141] >ffff888062348380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 350.604935][T13141] ^ [ 350.604940][T13141] ffff888062348400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 350.604947][T13141] ffff888062348480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc [ 350.604953][T13141] ================================================================== [ 350.613276][ C0] kcov: kcov_remote_start: handle = 100000000000004, context: softirq [ 350.613291][ C0] kcov: kcov_start: t = ffff888030084b00, size = 262144, area = ffffc900020b1000 [ 350.613306][ C0] kcov: kcov_start: t = ffff888030084b00, size = 1048576, area = ffffc9001b01d000 [ 350.613319][ C0] kcov: kcov_move_area: ffffc90019019000 1048576 <= ffffc900020b1000 4 [ 350.613360][ T5756] usb usb4-port1: debounce total 100ms stable 100ms status 0x100 [ 350.613382][ T5756] kcov: kcov_move_area: ffffc90019019000 1048576 <= ffffc9001b01d000 120071 [ 350.613586][ T5756] kcov: kcov_remote_start: handle = 100000000000004, context: task [ 350.613597][ T5756] kcov: kcov_start: t = ffff888030084b00, size = 1048576, area = ffffc9001b01d000 [ 350.613609][ T5756] hub 4-0:1.0: state 7 ports 1 chg 0000 evt 0002 [ 350.621662][ C0] kcov: kcov_remote_start: handle = 100000000000004, context: softirq [ 350.621675][ C0] kcov: kcov_start: t = ffff888020e84b00, size = 262144, area = ffffc900020b1000 [ 350.621698][ C0] kcov: kcov_move_area: ffffc90019019000 1048576 <= ffffc900020b1000 96 [ 350.634563][ T5756] kcov: kcov_move_area: ffffc90019019000 1048576 <= ffffc9001b01d000 2383 [ 350.634604][ T14] hub 4-0:1.0: hub_suspend [ 350.634658][ C0] kcov: kcov_remote_start: handle = 100000000000004, context: softirq [ 350.634670][ C0] kcov: kcov_start: t = ffff88801fe98000, size = 262144, area = ffffc900020b1000 [ 350.634692][ C0] kcov: kcov_move_area: ffffc90019019000 1048576 <= ffffc900020b1000 42 [ 350.634730][ T14] usb usb4: bus auto-suspend, wakeup 1 [ 350.634740][ T14] usb usb4: dummy_bus_suspend [ 350.660431][ C0] virtqueue callback for ffff8880281bfa00 (ffffffff86ffff40) [ 350.660472][ C0] No more buffers in queue [ 350.660674][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 350.660690][ C0] No more buffers in queue [ 350.673686][ C0] wireguard: wg0: Sending keepalive packet to peer 7 ([::1]:20002/0%0) [ 350.673742][ C0] wireguard: wg0: Sending keepalive packet to peer 19 ([::1]:20002/0%0) [ 350.703392][ C0] eth0: xmit ffff888073ccf000 42:01:0a:80:00:01 [ 350.703415][ C0] Added buffer head 15 to ffff8880281c0000 [ 350.703443][ C0] virtqueue callback for ffff8880281c0000 (ffffffff87008ed0) [ 350.703570][ C0] Sent skb ffff888073ccf000 [ 350.703614][ C0] No more buffers in queue [ 350.736090][ C0] virtqueue callback for ffff8880281bfa00 (ffffffff86ffff40) [ 350.736206][ C0] No more buffers in queue [ 350.736487][ C0] Receiving skb proto 0x0806 len 28 type 1 [ 350.736501][ C0] No more buffers in queue [ 350.736598][ C0] eth0: xmit ffff8880768b7000 42:01:0a:80:00:01 [ 350.736616][ C0] Added buffer head 15 to ffff8880281c0000 [ 350.736643][ C0] virtqueue callback for ffff8880281c0000 (ffffffff87008ed0) [ 350.736664][ C0] Sent skb ffff8880768b7000 [ 350.736689][ C0] No more buffers in queue [ 350.736936][T13145] kcov: kcov_start: t = ffff888021742580, size = 524288, area = ffffc9001c1d6000 [ 350.952812][T13141] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 351.647625][T13141] CPU: 0 UID: 0 PID: 13141 Comm: syz.2.2770 Not tainted syzkaller #0 PREEMPT(full) [ 351.656965][T13141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 351.666989][T13141] Call Trace: [ 351.670244][T13141] [ 351.673152][T13141] dump_stack_lvl+0x100/0x190 [ 351.677823][T13141] vpanic+0x2dc/0x6f8 [ 351.681775][T13141] panic+0xd1/0xe0 [ 351.685467][T13141] ? __pfx_panic+0x10/0x10 [ 351.689868][T13141] ? super_90_validate+0x178b/0x18c0 [ 351.695134][T13141] ? preempt_schedule+0x57/0xd0 [ 351.699976][T13141] check_panic_on_warn.cold+0x19/0x34 [ 351.705333][T13141] end_report.part.0+0x3a/0x90 [ 351.710074][T13141] kasan_report.cold+0xe/0x18 [ 351.714728][T13141] ? super_90_validate+0x178b/0x18c0 [ 351.719986][T13141] super_90_validate+0x178b/0x18c0 [ 351.725232][T13141] ? __pfx_bind_rdev_to_array+0x10/0x10 [ 351.730766][T13141] ? kobject_init+0x159/0x1b0 [ 351.735430][T13141] add_bound_rdev+0x274/0x390 [ 351.740096][T13141] md_add_new_disk+0xca1/0x1820 [ 351.744926][T13141] md_ioctl+0x2c1d/0x3700 [ 351.749235][T13141] ? __pfx_md_ioctl+0x10/0x10 [ 351.753886][T13141] ? do_vfs_ioctl+0x241/0x13f0 [ 351.758626][T13141] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 351.765467][T13141] ? __fget_files+0x34/0x3d0 [ 351.770034][T13141] ? __pfx_md_ioctl+0x10/0x10 [ 351.774698][T13141] blkdev_ioctl+0x5ad/0x6f0 [ 351.779176][T13141] ? __pfx_blkdev_ioctl+0x10/0x10 [ 351.784184][T13141] ? selinux_file_ioctl+0x1e0/0x290 [ 351.789362][T13141] ? selinux_file_ioctl+0x1e7/0x290 [ 351.794529][T13141] ? __pfx_blkdev_ioctl+0x10/0x10 [ 351.799526][T13141] __x64_sys_ioctl+0x18e/0x210 [ 351.804260][T13141] do_syscall_64+0x123/0x7b0 [ 351.808826][T13141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.814691][T13141] RIP: 0033:0x7f8038fa8fd9 [ 351.819080][T13141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.838670][T13141] RSP: 002b:00007f8039f04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.847053][T13141] RAX: ffffffffffffffda RBX: 00007f8039225fa0 RCX: 00007f8038fa8fd9 [ 351.855008][T13141] RDX: 0000200000000180 RSI: 0000000040140921 RDI: 0000000000000003 [ 351.862949][T13141] RBP: 00007f8039037fed R08: 0000000000000000 R09: 0000000000000000 [ 351.870889][T13141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 351.878844][T13141] R13: 00007f8039226038 R14: 00007f8039225fa0 R15: 00007ffe64a49d28 [ 351.886795][T13141] [ 351.889860][T13141] Kernel Offset: disabled [ 351.894177][T13141] Rebooting in 86400 seconds..