ci2-upstream-fs/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-upstream-fs/syz-executor669278380 <...> [ 87.043690][ T9] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.100' (ED25519) to the list of known hosts. execve("ci2-upstream-fs/syz-executor669278380", ["ci2-upstream-fs/syz-executor669278380"], 0x7ffe2503f740 /* 10 vars */) = 0 brk(NULL) = 0x55556ff47000 brk(0x55556ff47d80) = 0x55556ff47d80 arch_prctl(ARCH_SET_FS, 0x55556ff47400) = 0 set_tid_address(0x55556ff476d0) = 5602 set_robust_list(0x55556ff476e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-upstream-fs/syz-executor669278380", 4096) = 43 getrandom("\x09\x6f\x0d\x10\xfa\xe3\x03\x9f", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ff47d80 brk(0x55556ff68d80) = 0x55556ff68d80 brk(0x55556ff69000) = 0x55556ff69000 mprotect(0x7f4b8230d000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 [ 91.566697][ T5602] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 [ 91.835143][ T5602] cgroup: Unknown subsys name 'cpuset' umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 91.923877][ T5602] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) getrandom("\x0d\x73\x68\x2e\x2c\xc3\x8b\x9e", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.XoIg6I", 0700) = 0 chmod("./syzkaller.XoIg6I", 0777) = 0 chdir("./syzkaller.XoIg6I") = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5603 attached , child_tidptr=0x55556ff476d0) = 5603 [pid 5603] set_robust_list(0x55556ff476e0, 24 [pid 5602] rt_sigprocmask(SIG_SETMASK, [] [pid 5603] <... set_robust_list resumed>) = 0 [pid 5602] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5603] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5603] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5603] getppid() = 0 [pid 5603] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5603] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5603] unshare(CLONE_NEWNS) = 0 [pid 5603] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5603] unshare(CLONE_NEWIPC) = 0 [pid 5603] unshare(CLONE_NEWCGROUP) = 0 [pid 5603] unshare(CLONE_NEWUTS) = 0 [pid 5603] unshare(CLONE_SYSVSEM) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "16777216", 8) = 8 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "536870912", 9) = 9 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "8192", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024", 4) = 4 [pid 5603] close(3) = 0 [pid 5603] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5603] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5603] close(3) = 0 [pid 5603] getpid() = 1 [pid 5603] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5603] rt_sigprocmask(SIG_SETMASK, [] [pid 5605] <... set_robust_list resumed>) = 0 [pid 5603] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5605] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5605] chdir("./0") = 0 [pid 5605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5605] setpgid(0, 0) = 0 [pid 5605] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [pid 5605] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5605] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5605] write(3, "1000", 4) = 4 [pid 5605] close(3) = 0 [pid 5605] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5605] write(1, "executing program\n", 18) = 18 [pid 5605] mkdir("./config", 0777) = 0 [pid 5605] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5605] mkdir("./config/usb_gadget/g1", 0777) = 0 [pid 5605] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0777) = 0 [pid 5605] mkdir("./config/usb_gadget/g1/functions/ncm.usb0", 0777) = 0 [pid 5605] symlink("./config/usb_gadget/g1/functions/ncm.usb0", "./config/usb_gadget/g1/configs/c.1/ncm.usb0") = 0 [pid 5605] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 3 [pid 5605] mkdirat(AT_FDCWD, "./cgroup.cpu/test", 03746) = 0 [pid 5605] openat(AT_FDCWD, "./cgroup.cpu/test/memory.limit_in_bytes", O_RDWR|O_CREAT|O_TRUNC|O_NONBLOCK|O_SYNC|O_NOFOLLOW|O_NOATIME|FASYNC, 010) = 4 [pid 5605] write(4, "10", 2) = 2 [pid 5605] openat(AT_FDCWD, "./cgroup.cpu/test/cgroup.procs", O_RDWR) = 5 [pid 5605] write(5, "0", 1) = 1 [ 92.635560][ T5605] syz-executor669 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 92.636853][ T5605] CPU: 0 UID: 0 PID: 5605 Comm: syz-executor669 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 92.636881][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.636891][ T5605] Call Trace: [ 92.636902][ T5605] [ 92.636911][ T5605] dump_stack_lvl+0xe8/0x150 [ 92.636964][ T5605] dump_header+0xd3/0x4b0 [ 92.636994][ T5605] oom_kill_process+0x3ab/0x9e0 [ 92.637027][ T5605] out_of_memory+0x1064/0x1480 [ 92.637069][ T5605] ? __pfx_out_of_memory+0x10/0x10 [ 92.637096][ T5605] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 92.637132][ T5605] ? _mutex_lock_killable+0x152/0x1d0 [ 92.637166][ T5605] ? try_charge_memcg+0xcc3/0x16f0 [ 92.637197][ T5605] try_charge_memcg+0xd82/0x16f0 [ 92.637224][ T5605] ? __lock_acquire+0x6df/0x2e40 [ 92.637267][ T5605] ? __pfx_try_charge_memcg+0x10/0x10 [pid 5605] write(3, "dummy_udc.0", 11) = ? [pid 5605] +++ killed by SIGKILL +++ [ 92.637300][ T5605] ? percpu_ref_tryget+0x15/0x180 [ 92.637329][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 92.637362][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 92.637385][ T5605] ? __memcg_slab_post_alloc_hook+0x7d0/0xfe0 [ 92.637412][ T5605] __memcg_slab_post_alloc_hook+0x968/0xfe0 [ 92.637462][ T5605] __kmalloc_node_track_caller_noprof+0x5e5/0x7b0 [ 92.637489][ T5605] ? neigh_sysctl_register+0xae/0xa90 [ 92.637515][ T5605] ? neigh_sysctl_register+0xae/0xa90 [pid 5603] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=2, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=12 /* 0.12 s */} --- [pid 5603] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 5603] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5603] fstat(3, {st_mode=S_IFDIR|0700, st_size=140, ...}) = 0 [pid 5603] getdents64(3, 0x55556ff48790 /* 7 entries */, 32768) = 208 [ 92.637545][ T5605] kmemdup_noprof+0x2b/0x70 [ 92.637574][ T5605] neigh_sysctl_register+0xae/0xa90 [ 92.637601][ T5605] ? __pfx_neigh_sysctl_register+0x10/0x10 [ 92.637621][ T5605] ? __local_bh_enable+0x1e3/0x2f0 [ 92.637643][ T5605] ? inetdev_init+0x1fb/0x4d0 [ 92.637662][ T5605] ? inetdev_event+0x307/0x15e0 [ 92.637682][ T5605] ? notifier_call_chain+0x1a5/0x3d0 [ 92.637709][ T5605] ? register_netdevice+0x18c0/0x1ed0 [ 92.637731][ T5605] ? register_netdev+0x40/0x60 [ 92.637753][ T5605] ? gether_register_netdev+0x84/0x180 [pid 5603] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 [pid 5603] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] newfstatat(AT_FDCWD, "./0/config", {st_mode=S_IFDIR|0700, st_size=40, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5603] umount2("./0/config", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 92.637772][ T5605] ? ncm_bind+0x717/0xdc0 [ 92.637793][ T5605] ? usb_add_function+0x290/0x930 [ 92.637814][ T5605] ? configfs_composite_bind+0xde0/0x1410 [ 92.637835][ T5605] ? gadget_bind_driver+0x2ca/0x9e0 [ 92.637852][ T5605] ? really_probe+0x254/0xae0 [ 92.637875][ T5605] ? __driver_probe_device+0x1e8/0x360 [ 92.637897][ T5605] ? __driver_attach+0x339/0x600 [ 92.637917][ T5605] ? bus_for_each_dev+0x23e/0x2c0 [ 92.637942][ T5605] ? bus_add_driver+0x348/0x670 [ 92.637975][ T5605] devinet_sysctl_register+0xad/0x200 [pid 5603] openat(AT_FDCWD, "./0/config", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5603] fstat(4, {st_mode=S_IFDIR|0700, st_size=40, ...}) = 0 [pid 5603] getdents64(4, 0x55556ff507d0 /* 2 entries */, 32768) = 48 [pid 5603] getdents64(4, 0x55556ff507d0 /* 0 entries */, 32768) = 0 [pid 5603] close(4) = 0 [pid 5603] rmdir("./0/config") = 0 [pid 5603] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5603] unlink("./0/binderfs") = 0 [ 92.638001][ T5605] inetdev_init+0x29e/0x4d0 [ 92.638025][ T5605] inetdev_event+0x307/0x15e0 [ 92.638046][ T5605] ? __pfx_is_eth_port_inactive_slave_filter+0x10/0x10 [ 92.638080][ T5605] ? __pfx_inetdev_event+0x10/0x10 [ 92.638099][ T5605] ? preempt_schedule_notrace+0x56/0x90 [ 92.638140][ T5605] notifier_call_chain+0x1a5/0x3d0 [ 92.638200][ T5605] register_netdevice+0x18c0/0x1ed0 [ 92.638253][ T5605] ? __pfx_register_netdevice+0x10/0x10 [ 92.638290][ T5605] ? _raw_spin_unlock_irqrestore+0x30/0x80 [pid 5603] umount2("./0/cgroup.net", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5603] unlink("./0/cgroup.net") = 0 [pid 5603] umount2("./0/cgroup.cpu", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5603] unlink("./0/cgroup.cpu") = 0 [ 92.638324][ T5605] ? _mutex_lock_killable+0x152/0x1d0 [ 92.638347][ T5605] ? register_netdev+0x18/0x60 [ 92.638374][ T5605] register_netdev+0x40/0x60 [ 92.638399][ T5605] gether_register_netdev+0x84/0x180 [ 92.638423][ T5605] ncm_bind+0x717/0xdc0 [ 92.638459][ T5605] ? trace_kmalloc+0x2a/0xf0 [ 92.638502][ T5605] usb_add_function+0x290/0x930 [ 92.638533][ T5605] ? check_remote_wakeup_config+0x58/0x1c0 [ 92.638560][ T5605] configfs_composite_bind+0xde0/0x1410 [pid 5603] umount2("./0/cgroup", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5603] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5603] unlink("./0/cgroup") = 0 [pid 5603] getdents64(3, 0x55556ff48790 /* 0 entries */, 32768) = 0 [pid 5603] close(3) = 0 [pid 5603] rmdir("./0") = 0 [pid 5603] mkdir("./1", 0777) = 0 [ 92.638606][ T5605] ? __pfx_configfs_composite_bind+0x10/0x10 [ 92.638629][ T5605] gadget_bind_driver+0x2ca/0x9e0 [ 92.638662][ T5605] ? __pfx_gadget_bind_driver+0x10/0x10 [ 92.638679][ T5605] really_probe+0x254/0xae0 [ 92.638708][ T5605] __driver_probe_device+0x1e8/0x360 [ 92.638736][ T5605] driver_probe_device+0x4f/0x240 [ 92.638764][ T5605] __driver_attach+0x339/0x600 [ 92.638790][ T5605] bus_for_each_dev+0x23e/0x2c0 [ 92.638819][ T5605] ? __pfx___driver_attach+0x10/0x10 [ 92.638842][ T5605] ? __pfx_bus_for_each_dev+0x10/0x10 [pid 5603] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5603] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci2-upstream-fs/strace-static-x86_64: Process 5607 attached [pid 5607] set_robust_list(0x55556ff476e0, 24 [pid 5603] <... clone resumed>, child_tidptr=0x55556ff476d0) = 3 [pid 5607] <... set_robust_list resumed>) = 0 [pid 5607] rt_sigprocmask(SIG_SETMASK, [] [pid 5603] rt_sigprocmask(SIG_SETMASK, [] [pid 5607] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5607] chdir("./1" [pid 5603] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5607] <... chdir resumed>) = 0 [pid 5607] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5607] setpgid(0, 0) = 0 [pid 5607] symlink("/syzcgroup/unified/syz0", "./cgroup") = 0 [ 92.638878][ T5605] ? rt_spin_unlock+0x165/0x200 [ 92.638905][ T5605] bus_add_driver+0x348/0x670 [ 92.638942][ T5605] driver_register+0x23a/0x320 [ 92.638971][ T5605] usb_gadget_register_driver_owner+0xf9/0x270 [ 92.639004][ T5605] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 92.639025][ T5605] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 92.639048][ T5605] configfs_write_iter+0x33a/0x430 [ 92.639077][ T5605] vfs_write+0x61e/0xbb0 [ 92.639109][ T5605] ? __pfx_vfs_write+0x10/0x10 [ 92.639134][ T5605] ? rt_spin_unlock+0x159/0x200 [pid 5607] symlink("/syzcgroup/cpu/syz0", "./cgroup.cpu") = 0 [pid 5607] symlink("/syzcgroup/net/syz0", "./cgroup.net") = 0 [pid 5607] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5607] write(3, "1000", 4) = 4 [pid 5607] close(3) = 0 [ 92.639171][ T5605] ? rt_spin_unlock+0x165/0x200 [ 92.639205][ T5605] ksys_write+0x156/0x270 [ 92.639229][ T5605] ? __pfx_ksys_write+0x10/0x10 [ 92.639264][ T5605] do_syscall_64+0x166/0x520 [ 92.639282][ T5605] ? trace_irq_disable+0x3b/0x140 [ 92.639305][ T5605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.639324][ T5605] ? clear_bhb_loop+0x70/0xc0 [ 92.639348][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.639369][ T5605] RIP: 0033:0x7f4b822799e9 [pid 5607] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5607] write(1, "executing program\n", 18) = 18 executing program [pid 5607] mkdir("./config", 0777) = 0 [pid 5607] mount(NULL, "./config", "configfs", 0, NULL) = 0 [pid 5607] mkdir("./config/usb_gadget/g1", 0777) = -1 EEXIST (File exists) [ 92.639388][ T5605] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 92.639404][ T5605] RSP: 002b:00007ffd42155898 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.639425][ T5605] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4b822799e9 [ 92.639439][ T5605] RDX: 000000000000000b RSI: 0000200000001400 RDI: 0000000000000003 [ 92.639451][ T5605] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [pid 5607] mkdirat(AT_FDCWD, "./config/usb_gadget/g1/configs/c.1", 0777) = -1 EEXIST (File exists) [pid 5607] mkdir("./config/usb_gadget/g1/functions/ncm.usb0", 0777) = -1 EEXIST (File exists) [pid 5607] symlink("./config/usb_gadget/g1/functions/ncm.usb0", "./config/usb_gadget/g1/configs/c.1/ncm.usb0") = -1 EEXIST (File exists) [pid 5607] openat(AT_FDCWD, "./config/usb_gadget/g1/UDC", O_WRONLY) = 3 [ 92.639462][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4b822e1042 [ 92.639475][ T5605] R13: 00007ffd421558d0 R14: 00007ffd42155910 R15: 0000000000000000 [ 92.639508][ T5605] [ 92.639518][ T5605] memory: usage 0kB, limit 0kB, failcnt 19 [ 92.639531][ T5605] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 92.639544][ T5605] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 92.639556][ T5605] Memory cgroup stats for /syz0/test: [ 92.639964][ T5605] cache 0 [ 92.639973][ T5605] rss 0 [pid 5607] mkdirat(AT_FDCWD, "./cgroup.cpu/test", 03746) = -1 EEXIST (File exists) [pid 5607] openat(AT_FDCWD, "./cgroup.cpu/test/memory.limit_in_bytes", O_RDWR|O_CREAT|O_TRUNC|O_NONBLOCK|O_SYNC|O_NOFOLLOW|O_NOATIME|FASYNC, 010) = 4 [pid 5607] write(4, "10", 2) = 2 [pid 5607] openat(AT_FDCWD, "./cgroup.cpu/test/cgroup.procs", O_RDWR) = 5 [ 92.639980][ T5605] shmem 0 [ 92.639987][ T5605] mapped_file 0 [ 92.639994][ T5605] dirty 0 [ 92.640001][ T5605] writeback 0 [ 92.640008][ T5605] workingset_refault_anon 0 [ 92.640015][ T5605] workingset_refault_file 0 [ 92.640023][ T5605] swap 0 [ 92.640030][ T5605] swapcached 0 [ 92.640037][ T5605] pgpgin 0 [ 92.640044][ T5605] pgpgout 0 [ 92.640051][ T5605] pgfault 0 [ 92.640058][ T5605] pgmajfault 0 [ 92.640065][ T5605] inactive_anon 0 [ 92.640072][ T5605] active_anon 0 [pid 5607] write(5, "0", 1) = 1 [ 92.640079][ T5605] inactive_file 0 [ 92.640086][ T5605] active_file 0 [ 92.640093][ T5605] unevictable 0 [ 92.640100][ T5605] hierarchical_memory_limit 0 [ 92.640107][ T5605] hierarchical_memsw_limit 9223372036854771712 [ 92.640116][ T5605] total_cache 0 [ 92.640123][ T5605] total_rss 0 [ 92.640130][ T5605] total_shmem 0 [ 92.640138][ T5605] total_map ** replaying previous printk message ** [ 92.640138][ T5605] total_mapped_file 0 [ 92.640153][ T5605] total_dirty 0 [ 92.640160][ T5605] total_writeback 0 [ 92.640167][ T5605] total_workingset_refault_anon 0 [ 92.640175][ T5605] total_workingset_refault_file 0 [ 92.640182][ T5605] total_swap 0 [ 92.640189][ T5605] total_swapcached 0 [ 92.640196][ T5605] total_pgpgin 0 [ 92.640203][ T5605] total_pgpgout 0 [ 92.640210][ T5605] total_pgfault 0 [ 92.640217][ T5605] total_pgmajfault 0 [ 92.640224][ T5605] total_inactive_anon 0 [ 92.640231][ T5605] total_active_anon 0 [ 92.640238][ T5605] total_inactive_file 0 [ 92.640246][ T5605] total_active_file 0 [ 92.640253][ T5605] total_unevictable 0 [ 92.640260][ T5605] anon_cost 0 [ 92.640268][ T5605] file_cost 0 [ 92.640275][ T5605] Tasks state (memory values in pages): [ 92.640282][ T5605] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name [ 92.640321][ T5605] [ 5605] 0 5605 4361 108 17 91 0 49152 0 1000 syz-executor669 [ 92.640361][ T5605] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz-executor669,pid=5605,uid=0 [ 92.640640][ T5605] Memory cgroup out of memory: Killed process 5605 (syz-executor669) total-vm:17444kB, anon-rss:68kB, file-rss:364kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:1000 [ 92.757026][ T5605] udc dummy_udc.0: failed to start g1: -105 [ 92.757401][ T5605] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -105 [ 92.771254][ T5605] UDC core: g1: couldn't find an available UDC or it's busy [ 93.322544][ T5607] ------------[ cut here ]------------ [ 93.322560][ T5607] kernel BUG at net/core/dev.c:11397! [ 93.322708][ T5607] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 93.502211][ T5607] CPU: 0 UID: 0 PID: 5607 Comm: syz-executor669 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 93.512487][ T5607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.522838][ T5607] RIP: 0010:register_netdevice+0x1eb4/0x1ed0 [ 93.528926][ T5607] Code: ff 44 89 f1 80 e1 07 38 c1 0f 8c bd fb ff ff 4c 89 f7 e8 ff e4 0a f9 e9 b0 fb ff ff e8 35 38 9f f8 90 0f 0b e8 2d 38 9f f8 90 <0f> 0b e8 25 38 9f f8 90 0f 0b e8 1d 38 9f f8 41 be 42 00 00 00 e9 [ 93.549163][ T5607] RSP: 0018:ffffc90004a3f560 EFLAGS: 00010293 [ 93.555247][ T5607] RAX: ffffffff89273b03 RBX: 1ffff92000947ec0 RCX: ffff888035045dc0 [ 93.563316][ T5607] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.571295][ T5607] RBP: ffffc90004a3f6e0 R08: 0000000000000000 R09: 0000000000000000 [ 93.579376][ T5607] R10: dffffc0000000000 R11: fffffbfff1f63990 R12: ffff888037f50888 [ 93.587374][ T5607] R13: dffffc0000000000 R14: 0000000000000003 R15: ffff888037f50000 [ 93.595846][ T5607] FS: 000055556ff47400(0000) GS:ffff888125bd9000(0000) knlGS:0000000000000000 [ 93.605064][ T5607] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.611785][ T5607] CR2: 0000200000001000 CR3: 000000003e810000 CR4: 00000000003526f0 [ 93.619876][ T5607] Call Trace: [ 93.623170][ T5607] [ 93.626113][ T5607] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 93.631805][ T5607] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.637034][ T5607] ? __pfx_register_netdevice+0x10/0x10 [ 93.642616][ T5607] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 93.648896][ T5607] ? _mutex_lock_killable+0x152/0x1d0 [ 93.654461][ T5607] ? register_netdev+0x18/0x60 [ 93.659323][ T5607] register_netdev+0x40/0x60 [ 93.663940][ T5607] gether_register_netdev+0x84/0x180 [ 93.669326][ T5607] ncm_bind+0x717/0xdc0 [ 93.673504][ T5607] ? rcu_is_watching+0x16/0xb0 [ 93.678289][ T5607] usb_add_function+0x290/0x930 [ 93.683271][ T5607] ? check_remote_wakeup_config+0x58/0x1c0 [ 93.689104][ T5607] configfs_composite_bind+0xde0/0x1410 [ 93.694859][ T5607] ? __pfx_configfs_composite_bind+0x10/0x10 [ 93.700863][ T5607] gadget_bind_driver+0x2ca/0x9e0 [ 93.705889][ T5607] ? __pfx_gadget_bind_driver+0x10/0x10 [ 93.711612][ T5607] really_probe+0x254/0xae0 [ 93.716291][ T5607] __driver_probe_device+0x1e8/0x360 [ 93.721685][ T5607] driver_probe_device+0x4f/0x240 [ 93.726730][ T5607] __driver_attach+0x339/0x600 [ 93.731513][ T5607] bus_for_each_dev+0x23e/0x2c0 [ 93.736372][ T5607] ? __pfx___driver_attach+0x10/0x10 [ 93.741821][ T5607] ? __pfx_bus_for_each_dev+0x10/0x10 [ 93.747220][ T5607] ? rt_spin_unlock+0x165/0x200 [ 93.752272][ T5607] bus_add_driver+0x348/0x670 [ 93.757152][ T5607] driver_register+0x23a/0x320 [ 93.762129][ T5607] usb_gadget_register_driver_owner+0xf9/0x270 [ 93.769472][ T5607] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 93.775543][ T5607] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 93.782236][ T5607] configfs_write_iter+0x33a/0x430 [ 93.787376][ T5607] vfs_write+0x61e/0xbb0 [ 93.791900][ T5607] ? __pfx_vfs_write+0x10/0x10 [ 93.796878][ T5607] ? rt_spin_unlock+0x159/0x200 [ 93.802252][ T5607] ? rt_spin_unlock+0x165/0x200 [ 93.807388][ T5607] ksys_write+0x156/0x270 [ 93.811789][ T5607] ? __pfx_ksys_write+0x10/0x10 [ 93.817110][ T5607] do_syscall_64+0x166/0x520 [ 93.821800][ T5607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.827997][ T5607] ? clear_bhb_loop+0x70/0xc0 [ 93.832722][ T5607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.838682][ T5607] RIP: 0033:0x7f4b822799e9 [ 93.843119][ T5607] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 93.863250][ T5607] RSP: 002b:00007ffd42155898 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 93.871917][ T5607] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4b822799e9 [ 93.880171][ T5607] RDX: 000000000000000b RSI: 0000200000001400 RDI: 0000000000000003 [ 93.888279][ T5607] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 93.896521][ T5607] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd421558bc [ 93.904516][ T5607] R13: 00007ffd421558d0 R14: 00007ffd42155910 R15: 0000000000000001 [ 93.912771][ T5607] [ 93.915997][ T5607] Modules linked in: [ 93.920074][ T5607] ---[ end trace 0000000000000000 ]--- [ 93.926049][ T5607] RIP: 0010:register_netdevice+0x1eb4/0x1ed0