last executing test programs: 4.728984291s ago: executing program 2 (id=282): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_create_resource$futex(&(0x7f0000000040)=0x1) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, &(0x7f0000000140)={0x7, [0x7a6, 0x0, 0x0, 0x8, 0x9, 0x2877, 0x8]}, &(0x7f0000001200)=0x12) futex(r1, 0x6, 0x0, &(0x7f00000000c0)={0x77359400}, 0x0, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000000180)=""/4111, &(0x7f00000011c0)=0x100f) mount(&(0x7f0000000080)=@sg0, &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000000)='autofs\x00', 0x95a484, 0x0) 4.23076286s ago: executing program 1 (id=286): syz_usb_connect(0x0, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x7c, 0x6f, 0xb9, 0x40, 0x7ca, 0xa800, 0xd6ae, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x72, 0x6, 0x10, 0x6, "", [{{0x9, 0x4, 0xae, 0xe8, 0x0, 0xf3, 0xb0, 0x32, 0x3}}]}}]}}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_ublk_setup_io_uring(0x1a30, &(0x7f00000001c0)={0x0, 0x8be, 0x400, 0x1024002, 0x8004d}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000300)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0x8, &(0x7f0000000380)={0x0, 0x3938700}, 0x1, 0x40, 0x1}) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000003c0)={0x0, 0x1, 0x1000ff, 0xffffffffffffffff, 0x0, 0x0}) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000400)={0x2e, 0x4d, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@any_dev={0x3, 0x9ad, 0x0, 0x0, 0x1000, 0x800, 0x0, 0x0, 0x62}}}, 0x0) r5 = socket$inet6(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000004c0), r6) sendto$inet6(r5, &(0x7f0000000080)="900000001d001f4d154a817393278bff0a80a578020000000404840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000766436c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-ssse3\x00'}, 0x58) 3.896805714s ago: executing program 3 (id=288): socket$inet6(0xa, 0x2, 0x0) mkdir(&(0x7f00000003c0)='./tracefs\x00', 0x1ff) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x10, 0x0, 0x0) mount(0x0, &(0x7f0000000400)='./tracefs\x00', &(0x7f0000000440)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./tracefs/trace_options\x00', 0x2, 0x0) socket(0x10, 0x803, 0x0) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000004c0)=@req3={0x9, 0x1, 0x1, 0xffffffff, 0xd6, 0x8, 0x9}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000001bc0)='./proc\x00', 0x14c) mount(0x0, &(0x7f0000001c00)='./proc\x00', &(0x7f0000001c40)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001c80)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000001cc0)='270', 0x3) r3 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000640)={0x10002, 0x1, 0x8080000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r6, 0x4008ae93, &(0x7f0000000580)=0xffe) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$DM_DEV_CREATE(r3, 0xc138fd03, &(0x7f0000000040)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r3, 0xc138fd09, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@integrity={0x0, 0x1000, 0x0, 0x93, 'integrity\x00', {{@ram_num={'1:', 0x0}, 0x20, '0'}, 0x20, '1', 0x20, 'R', ' 1 sectors_per_bit:8'}}]}) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$OCFS2_IOC_GROUP_EXTEND(r2, 0x40046f01, &(0x7f0000000380)=0x7) ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000340)=0x76db) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002500)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./proc\x00', 0x207) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000005c0)='0', &(0x7f0000000600)='\x00', 0x0) mount$overlay(0x0, &(0x7f0000002580)='./file0\x00', 0x0, 0x0, &(0x7f0000002600)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}], [], 0x2c}) 3.573987276s ago: executing program 2 (id=290): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000240)={[0x7, 0x7fffffffffffffff, 0x2, 0x948, 0x9, 0x9, 0x1ff, 0x10, 0x4, 0x7ffffffffffffffe, 0x400000000000002, 0xffffffffffff986b, 0x3, 0x5, 0xc0000000000, 0x1], 0x0, 0x190980}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = dup(r4) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, r8, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0xa, 0x0, 0x0) 3.459877454s ago: executing program 3 (id=291): r0 = creat(&(0x7f0000000080)='./bus\x00', 0x3db) r1 = fanotify_init(0xf00, 0x2) fanotify_mark(r1, 0x105, 0x8971, r0, 0x0) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000140)=""/230, 0xe6}], 0x1) rename(&(0x7f0000000240)='./bus\x00', &(0x7f0000000280)='./file1\x00') r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0), 0x4) connect$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000001500)=0x7, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/thread-self/fail-nth\x00', 0x2, 0x24) write(r3, &(0x7f0000000040)='100', 0x3) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r3, 0x111, 0x5, 0xb, 0x4) 3.02057367s ago: executing program 3 (id=294): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000f40)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000f80)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000000fc0)=[{{0x0, 0x0, &(0x7f0000001000)=[{0x0, 0xea}, {&(0x7f0000001040)=""/244, 0xf4}], 0x2}, 0x10009}], 0x1, 0x10000, 0x0) sendmmsg$inet6(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000001200)="72a272746d4fe5abbe85c511b735b788e4147f9a0d3251df7b263711e6b1cfa0668d1fe8804168927c4f153b83509844f5ff6474ca26b8b8151a9732264fe9fc791af85cef", 0x45}], 0x1}}], 0x2, 0x20a8086) sendmmsg(r0, &(0x7f0000001280), 0x4ff, 0x0) 2.902637625s ago: executing program 2 (id=297): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000027c0)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a6970"], 0x60}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYRES8=r1, @ANYRES64, @ANYBLOB="230a29bd7000fbdbdf253100000008000300", @ANYRES16=r0, @ANYRES16=r2], 0x28}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}}, 0x10) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1020, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x1, "", [{{0x9, 0x4, 0x0, 0xc, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x11, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xfc, 0x1, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x3, @any, 0x0, 0x2}, 0x7) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000002740)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b985846175c084d7b8771b30", 0x87}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000004c0)=""/48, 0x30}, {&(0x7f0000000500)=""/4092, 0xffc}, {&(0x7f0000001500)=""/98, 0x62}, {&(0x7f0000001580)=""/249, 0xf9}, {&(0x7f0000001680)=""/4090, 0xffa}, {&(0x7f0000002680)=""/142, 0x8e}], 0x6}, 0x12000) syz_usb_control_io$hid(r4, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1014de29c198c0508950129309102c0"], 0x0}, 0x0) 2.638574321s ago: executing program 3 (id=299): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0) close(0x4) syz_usb_connect(0x2, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ff"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x800, 0x70bd26, 0x25dfdbfe, {{}, {}, {0x8, 0x2, 0x400}}, ["", "", "", "", "", ""]}, 0x24}}, 0x800) write(r0, &(0x7f0000000680)='nfsd 127.0.0.1 2147483647 *\n', 0x1c) 1.450209758s ago: executing program 3 (id=305): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f00000000c0)="000000001bed00002a75d6d38e9cb3583c321201a24dd52b110251a3a00700e7", 0x20) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xa) setsockopt$inet_sctp6_SCTP_REUSE_PORT(r0, 0x84, 0x24, &(0x7f0000000140)=0x7f, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000000240)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a1100f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x34, 0x57, 0x0, 0x20, 0x458, 0x7003, 0xfc62, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8, 0x98, 0xa0, 0x8, "", [{{0x9, 0x4, 0x5e, 0x3, 0x0, 0x31, 0xb1, 0x96, 0x7}}]}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002f102002cf70a010168d801020301890212b901000620000904a704007d62b705"], 0x0) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800040, 0x0) 1.166979936s ago: executing program 2 (id=308): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000005d80)=0x6d93, 0x4) sendmsg$sock(r0, &(0x7f0000005dc0)={&(0x7f0000005e00)=@in6={0xa, 0x4e26, 0x403, @loopback={0xff97}, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000005e80)=[@mark={{0x14, 0x1, 0x51, 0xfffffffb}}], 0x18}, 0x4c040) 1.104919155s ago: executing program 1 (id=309): mmap(&(0x7f0000424000/0x1000)=nil, 0x1000, 0xb, 0x204031, 0xffffffffffffffff, 0xc974f000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x0) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) setns(0xc9, 0x0) r0 = socket(0x2a, 0x2, 0x9) timer_create(0x0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x891b, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='7', 0x1) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x85, &(0x7f00000000c0)={r3, 0x88, "0200000000000000703fcd09bdf0b493d4323725cdcff2eae49f89843a5318d5ba093aa761132b512e8c4eb4eb76aa3f3069d1d5a64a2c75a2d59986feff48dc51b23de50b4c052630642b3348c700b558041310b18d364b87808f6ec3b597fae6ac116b5bc6c564f98676e592103c268225b716a73e48c8c8f8ec21e15e7a5d6743243dfde8a664"}, &(0x7f0000000180)=0x90) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x9, 0x6, 0x6, 0x649c, r3}, 0x10) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x5, &(0x7f0000000340)=0x9, 0x8, 0x0) 1.052929495s ago: executing program 2 (id=310): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2702, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x2}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f00000002c0)={[{0x2, 0x95c, 0x61, 0x7, 0xfe, 0xe, 0x1, 0x47, 0x8b, 0x3, 0x3, 0x18, 0x7}, {0x9, 0xa, 0x8, 0xff, 0x0, 0x4, 0x5, 0x1, 0x72, 0xc0, 0x5, 0x3, 0x401}, {0x5, 0x5, 0x40, 0x2, 0x20, 0xc8, 0xad, 0xe, 0x7, 0x0, 0x12, 0x2c, 0xc}], 0x6}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x0, 0x3, 0x6, 0x10, 0x5, 0x6, 0x6, 0x7, 0x3, 0x9, 0xff, 0x7, 0x64, 0xf6, 0x3, 0x9}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0xc9, 0x200000000d, 0x1, 0x6d, 0x8000000000000002, 0x2000001002, 0xf1, 0x8, 0x7fffffffffff8, 0x8d, 0xffffffff7ffffffe, 0x1, 0xfffffffffffffffe, 0x5, 0x3, 0xbde], 0x1000, 0x67a64fa265d09613}) mount(&(0x7f0000000180)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000200)='nilfs2\x00', 0x10, &(0x7f0000000340)='barrier') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/rxrpc/bundles\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x17) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000380)={r3, 0xd568, 0x0, r3}) preadv(r3, &(0x7f0000000100)=[{&(0x7f0000000140)=""/13, 0xd}], 0x1, 0x9, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.035794822s ago: executing program 1 (id=311): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x400000b7, 0x0, 0x3}]}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xd0}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x54, r6, 0x1, 0x123, 0x234, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x7530, @local}}, {0x14, 0x2, @in={0x2, 0x7530, @remote}}}}]}]}, 0x54}}, 0x0) setns(0xc9, 0x0) r7 = socket$rds(0x15, 0x5, 0x0) bind$rds(r7, &(0x7f00000004c0)={0x2, 0x4e21, @local}, 0x10) close_range(r3, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r8 = userfaultfd(0x80001) syz_kvm_setup_syzos_vm$x86(r8, &(0x7f0000390000/0x400000)=nil) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000500)={&(0x7f0000000540), 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000780)={0x1ff, 0x3, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f0000000040)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000007c0)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) 742.631032ms ago: executing program 2 (id=313): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000002c0)={0x0, 0x0, 0x2, 0x0, '\x00', [{0x9, 0x1, 0x3, 0xff, 0x1, 0x9}, {0x656, 0x8, 0x1db5, 0x6e0327dc, 0x0, 0x7fffffff}], ['\x00', '\x00']}) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_usb_connect(0x5, 0x58, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000043489a08b82225643a09010203010902460001050510010904360600020a0000052406000005240004000d240f010000000043ea4e66020524060001052407fbff0d240f01676b2ccf20831669db000005"], 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x645, 0x9, 0xffffffffffffffff, 0x10000000, 0x10000, 0x3, 0x400004002004c2, 0x7ff, 0x1, 0x0, 0x404, 0x82, 0x3, 0xfffffffffffffff8, 0x6, 0x9], 0xeeee8000, 0x240456}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 536.24256ms ago: executing program 1 (id=314): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000019300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000019440)={0x4, 0x0, &(0x7f0000019480)=[@register_looper]}) write(0xffffffffffffffff, &(0x7f0000001980)="2d000000010001", 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x100, 0x0, &(0x7f0000000040)=@reply}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 535.122391ms ago: executing program 0 (id=315): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x24201, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000040)={'pcl816\x00', [0x140, 0x2, 0x3, 0x5, 0x2, 0x2, 0x7ffd, 0x6, 0x8, 0xf, 0x4, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9b, 0x101, 0x401, 0x9, 0x8, 0x4, 0x8, 0xa, 0x3ff, 0x1, 0x2, 0xaf, 0x0, 0x800, 0x4, 0x4]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) quotactl_fd$Q_GETNEXTQUOTA(r1, 0xffffffff80000902, 0x0, &(0x7f0000000340)) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x1000004, 0x40010, 0xffffffffffffffff, 0x2000) sendmsg$inet(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)="75c1cc54649640be1983f79c5bfe88cd6a6a000070ab59578db363f49fcfec3197381b13892559f334d436138406b699de69db13fd42d5737428808940bcd0840dc930c81a8bd8b665cd232c5831977dd63ce2c88d43b17760a6e0df533940a702485bb198e47be60c4fe6987e7a0dc395ab7275640000000000000006294c8e67ffffffff3b00bab2df9ca37a0bd8f0bb843fe86124390c62f05d76038a6e1610780f0310692de128832c32940a6e848b17d1b5a0c20f7ff5a7a2e353f9363a037d054cf0409c89cd80165cf27bf7904a0d47cfd06acc1e4606bb5a8d26ace7578e8f5d151eb60e63969461a96e66f9cf4203d5bb7af3f62bc02693a1d5af09c6d1f5c7d27e991ce5c388b925aacf29f77ff12a5589aa7174c130ba472afa943edbf5c66722a21dbd7e86188d1ce5168925ebc3e4f071c368fe576600d269f47e71b209acca43bdc42a1fe0171c4096fe8ddf08e081554bac2dc0d3a4f80cd57aae7305aec6c9d8853e8f80be85b921c941a9fff4a9ff33a348926af5d91fd19bb2d930eeb546444189e76b0cd05a72f52bc74d285d6b6d8484680770f88f82474b6c3fc5b641822516eb35fe2ecdf2d42beebad7b75da375764520e9fc68683118adf1ce73e1c7635161df1cfa4f73fd4ed9811c1c2366472122d7900d073f26548b669b75e6e5a3104d6a258772b840dcf0a16246ee6ef516a66a0c70283875bdfb0cb3b8fd5f76e8b481193d1ca7310b74f6b2fe4e03b3d67e560784a28a508e302634ada79a9d543a4b6ac9dab6f335cd207d7c4d46ef6922bde6c66b85817d1d9cfffffeffffffffff25b1c9282acae0cc3f381b36a009592d16df4d74de496b1a38a857671eec326ba6d6762d21066de6cafebf884a8d64749173a4093001e4a49963d3530bcc96cdaf45afde012f73a34f624454aa26df59b25608d8dd215e", 0x2a3}, {&(0x7f0000000900)="b0fef28adda62f55a0000000000000001abe0a88f67472c3cd975c9884ae3f95e35b6301084df2b71b56e2a043b74efe85a30267fae3", 0x36}, {&(0x7f0000000180)="b4a644d95d4af9", 0x7}], 0x3}, 0x8000) openat$comedi(0xffffffffffffff9c, &(0x7f0000001b80)='/dev/comedi4\x00', 0x8000, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000001c00)=0x6, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000001c40), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000001c80)={0x0, 0xfffffe98, &(0x7f0000001cc0)={&(0x7f0000001d00)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001e00)=ANY=[@ANYBLOB="1400000002010500b1435c670000000002000008"], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r7, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001ec0)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) recvmsg(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000009c0)=""/233, 0xe9}], 0x1, &(0x7f0000000ac0)=""/4080, 0xff0}, 0x0) close(r3) r8 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000001ac0), 0x2041, 0x0) write$sndseq(r8, &(0x7f0000001b00)=[{0x6, 0xe, 0x0, 0x0, @tick, {0x4, 0x5}, {0x0, 0xd}, @result={0x7b, 0x6}}, {0x0, 0x0, 0xc2, 0x0, @tick=0x9, {}, {0x5, 0x6}, @quote={{0x5, 0x5}}}, {0x0, 0x0, 0x0, 0x2, @tick=0xfe, {0x0, 0x8}, {0x2}, @addr={0x1, 0x6}}, {0x1, 0x1, 0x1, 0x6b, @time={0x1, 0x1}, {0x4, 0x1}, {0x7, 0x8}, @queue={0x3, {0x6, 0x5}}}], 0x70) bind$nfc_llcp(r2, &(0x7f0000000280)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60) r9 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r9, 0x890b, &(0x7f0000000200)={@ipv4={'\x00', '\xff\xff', @local}, @loopback, @private0, 0x4, 0xfffe, 0x1, 0x100, 0x5, 0x20}) getsockopt$inet_buf(r2, 0x118, 0x2b, 0x0, &(0x7f0000000300)=0x46) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), r2) 417.977963ms ago: executing program 0 (id=316): r0 = openat$kvm(0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) msgsnd(0x0, 0x0, 0x89, 0x0) connect$pppoe(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, 0x0, 0x0) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000005c0)={r3}, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000001c0)=0x808, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x152, 0x4) sendmmsg$inet6(r5, 0x0, 0x0, 0x24000000) recvmmsg(r5, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}, 0x3c70c245}], 0x1, 0x40002042, 0x0) r6 = socket$netlink(0x10, 0x3, 0x9) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x4001}, 0x2000c090) bind$netlink(r6, &(0x7f0000000100)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bind$inet6(r4, 0x0, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f0000000340)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0500f000000000000000010000000900010073797a300000000048000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174003c000000060a010400000000000000000100000008000b40000000000900010073797a300000000014000480100001800a000100726564697200000014000000110001"], 0xcc}, 0x1, 0x0, 0x0, 0x24000010}, 0x20004880) shutdown(r4, 0x1) 368.036825ms ago: executing program 0 (id=317): r0 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x4000)=nil, 0x0, 0x5, 0x13, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000000)="a71dfac8bbc7dd9a5d312be2b36cfe60f9a094fed3d30879", 0x0, 0x18) (async) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000040)="64e5d0b574a1ce44e187ac9510c3214682e07f8f05b0d3dd", 0x0, 0x18) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x3, 0x2, 0x8020000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) (async, rerun: 64) close_range(r2, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, r3, 0x0, 0x11, r2, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000100)=0x204, 0x4) (async) munmap$KVM_VCPU(r0, 0x4) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ffd000/0x3000)=nil) (async) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x2, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010100}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x5}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x20004091) socket$rds(0x15, 0x5, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000280)={0x30000, 0x100000}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async, rerun: 32) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000002c0)=0x0) (rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x3, r5, 0x0, &(0x7f0000000300)) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) (async, rerun: 32) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000340), 0x200200, 0x0) (rerun: 32) ioctl$KVM_CAP_DISABLE_QUIRKS2(r6, 0x4068aea3, &(0x7f0000000380)={0xd5, 0x0, 0xa18}) (async) ioctl$KVM_CAP_DIRTY_LOG_RING_WITH_BITMAP(r1, 0x4068aea3, &(0x7f0000000400)={0xe1, 0x0, 0x80000}) syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) (async, rerun: 32) r7 = syz_open_procfs(r5, &(0x7f00000004c0)='net/softnet_stat\x00') (rerun: 32) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000600)={&(0x7f0000000500)=[0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0], 0x2, 0x5, 0x3, 0x1}) ioctl$DRM_IOCTL_MODE_GETGAMMA(r7, 0xc02064a4, &(0x7f0000000700)={r8, 0xa, &(0x7f0000000640)=[0xe, 0x9, 0x3, 0xff, 0xa01, 0xfffc, 0x40, 0x6, 0x4, 0x3ff], &(0x7f0000000680)=[0x8, 0x2, 0xa, 0x7, 0x4, 0x0], &(0x7f00000006c0)=[0xf801, 0x1, 0x0, 0xb99, 0xfc00, 0x6, 0x5000, 0x9]}) mq_open(&(0x7f0000000740)='\x00', 0x80, 0x40, &(0x7f0000000780)={0xfffffffffffffff7, 0x6, 0x33}) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS_V2(r2, 0x84, 0x25, &(0x7f00000007c0)={0x2, @in={{0x2, 0x4e20, @remote}}, 0x46, 0x9, 0x5}, &(0x7f0000000880)=0x90) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000008c0)={0x2, 0x101, 0x2, 0x3, 0x7, 0x6, 0xa, 0x2, r9}, 0x20) (async, rerun: 64) io_submit(0x0, 0x4, &(0x7f0000000d80)=[&(0x7f0000000a00)={0x0, 0x0, 0x0, 0xd, 0x0, 0xffffffffffffffff, &(0x7f0000000940)="02d42c3b2253b39911e5b2d158ce8f96cecbafe953da9c458c3a838a1ed94351d200c31ed49495e94a566c9b71034655641cdbb4f870f8c502e94e47cd439c9ea1226165ae8fff6f3121ba155746c218eb1395f836e326107ba2b9cd7c43959bf6999db146b199095c6953a949135784a235ed4313afa5ea0af19cda23ffd48ddaab45ac693b31886d69cde5145a", 0x8e, 0x7, 0x0, 0x2, r6}, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x4, 0x3, r6, &(0x7f0000000a40)="f46cb0127922b19a370799630a847715623786bbc5f2fd3d7993afcc94469a816be19b253f3f7afe8ce68226853a76ad957ffd07ff3b9bc3552645c9e2a8c3179f203b0f472df5695e029d239f66858abf719c25d58292ff4f4a31cd78c7f35098", 0x61, 0xce21, 0x0, 0x3, r6}, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x3, 0x1a88, r1, &(0x7f0000000b00)="861a11a75918c53a75004b1266aacc3469a08e7f8bef4e4221871fe5d77646bdb396b46eb762a142f76163d6780a412e388802ca3bb58e2b3f8da779449f75d3b171422ee13692ade001d433463ddf3ddee0a248e4b4013ffbbeda1570c2317374243e838e592e9401187b999605b2036cd2b0b2306ff3d76ddd2c1f0a71d668b0c37a08cf4f90d90c669a301e75659d55765115ca47edda2002781c2a3a7fa889928c7b4756f3f8672087f79aff06e75e28d8df2b92d2a1467ad5b01f27cc557f779e75a67d1483ae270d2121903e2e3fd4b172eaba1e3ac92e44f00e22776104", 0xe1, 0x3, 0x0, 0x1}, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x5, 0x0, r1, &(0x7f0000000c80)="168bd53b0083d244b25ffc3c1755d03b49a601dd81b25400436458c612667779734ff29e5910fece7a3ed485dd5c6aaff0766b3ebf7276d289477eb31ae4e0473ba73289ec5b3c38a375e801edc415ac3c6510fe628262e6093f47c5e5d4c88e1f6c39b7c50c8b444421d0493258afb772cb4ae1e734fb9315a4830e960061c799cb107b7c8b7a6c755787d557ac2963c68120", 0x93, 0x4, 0x0, 0x0, r2}]) (rerun: 64) 268.523014ms ago: executing program 0 (id=318): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x6, 0x7, 0x0, 0x184, 0x671, 0x10, 0x6, 0x100000001, 0x1, 0x5, 0x7, 0x29, 0x0, 0x2, 0x0, 0xbd9], 0xffff1001, 0x53101}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) modify_ldt$write(0x1, &(0x7f00000000c0)={0x8, 0x20000800, 0x400, 0x0, 0x2, 0x1, 0x1, 0x0, 0x1}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0xa7f, 0x68ff, 0x0, 0x8000000009, 0x803, 0x26c00, 0x9, 0x2], 0xeeee8000, 0x102280}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0x3, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x0, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x0, 0x5000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x4, 0x6, 0x2, 0x7e, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0xd000, 0xf, 0x3, 0x16, 0x87, 0xab, 0x8, 0x9, 0x9, 0xf8, 0x97}, {0xeeefa000, 0x0, 0xe, 0x9f, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x18227000, 0xe, 0x5, 0x7, 0x5, 0x7, 0x43, 0x8, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xa, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x2, 0xc, 0xb0, 0x91}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x3, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0xfe00) 267.517523ms ago: executing program 1 (id=319): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000005d80)=0x6c22, 0xfffffdc3) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/net/rpc/auth.rpcsec.init/channel\x00', 0x10402, 0x0) write(r1, &(0x7f0000000040)='ke', 0x2) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000020000000900010073797a300000000040000000120a01040000000000000000020000000900010073797a30000000000900020073797a300000000008000300000000040c0004800800040000000002140000001100010000000000000000000000000a"], 0x88}}, 0x0) sendmsg$sock(r0, &(0x7f0000005dc0)={&(0x7f0000005e00)=@in6={0xa, 0x4e26, 0x403, @private0, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000005e80)=[@mark={{0x14, 0x1, 0x51, 0xfffffffb}}], 0x18}, 0x4c040) 154.436311ms ago: executing program 0 (id=320): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r0 = open(&(0x7f00000000c0)='./mnt\x00', 0x43ca01, 0x20) fallocate(r0, 0x10, 0x6, 0x7000000) r1 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000180)="052c0db0476217de5db7dee0987cef47ebfc7f9d2ca2ad7a604b9de560798e3a2a4aa0b84b229fb2d0f5fca41818d96c4b8a817dc9447e8911ac637a42c54245c5e31de7f584df966f3df932e1afe51f06d242afdfe6e3636b7cb52fe9f95a773282f70782c5c548f02debaf8a44acf1f07fef23f994ed2844f477e6dd494038724f038873b206654d9d323c848ef863c68b057e02997bb341c1ff1018032fa2998886da64a1adcd103db3b25609145437086960e16fef04baf24cd346bd61d4f4059f4f33e220f000add86b9ce8456f2eea8749fc5898e40094384039a1740b", 0xe0, 0xffffffffffffffff) r2 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$search(0xa, r1, &(0x7f0000000280)='.dead\x00', &(0x7f00000002c0)={'syz', 0x1}, r2) 153.973334ms ago: executing program 1 (id=321): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x1, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x0, 0x2, 0x8, "fe5b210763fa1f461d2f1adc98bf836177e364ed11f8c85422260a7edb93f592", 0xa0363159}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000014000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000100)="c4e1fd11de8fc970019e7f6868c7b9e10b0000b84c000000ba000000000f3036f20f707e0088c4c10f7d9109000000260f01b49c00800000f30f090f62cf640f72f655d9e9", 0x45}], 0x1, 0x4, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000001c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x79d, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x108}}}, &(0x7f0000000340)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000380)={0x0, 0x1, 0x3000, 0x3, 0x255}, 0x0, 0x1, &(0x7f0000000400)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff5, 0x4, 0x0, 0x0}}, 0x0) sendto$packet(r6, &(0x7f0000000480)="3ea3f542e5776d32882077b0c916c0b739b8ead2576b04379ca96ae1991168344d5930e6385e007ca2f1e368417fbf0a5b7a316845eda870071b349fc9e826e3d0878f8600bebe7fd5abe98ea20aed5396512c2189404590e6", 0x59, 0x40, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 35.332154ms ago: executing program 3 (id=322): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$rtc(&(0x7f0000000200), 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newsa={0x1a4, 0x10, 0x1, 0x70bc2c, 0x4000000, {{@in6=@dev={0xfe, 0x80, '\x00', 0x22}, @in=@dev={0xac, 0x14, 0x14, 0x43}, 0x0, 0x8, 0x3, 0x5, 0xa}, {@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x32}, @in=@multicast2, {0xfffffffffffffffe, 0x4, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x89}, {0x3, 0x400804, 0x9, 0x292}, {0x1cb00000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x6c}, [@algo_crypt={0x68, 0x2, {{'cbc(twofish)\x00'}, 0x100, "72f01afe0a000000366a6a849a73904500240062227cd910ff80008000e8ffff"}}, @algo_auth_trunc={0x4c, 0x14, {{'hmac(sha256)\x00'}, 0x0, 0x60}}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x8000}, 0x4050) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000280)={0x0, 0x0, {0xe, 0x3a, 0xfffffffe, 0x1d, 0x2, 0x100, 0x5, 0x400fb, 0x1}}) r3 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000480)={'gre0\x00', &(0x7f00000004c0)={'syztnl2\x00', 0x0, 0x700, 0x8, 0x0, 0x200, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x60, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000800)={'syztnl2\x00', &(0x7f0000000840)={'tunl0\x00', r4, 0x20, 0x40, 0x1001000, 0x6, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x67, 0x0, 0xf9, 0x2f, 0x0, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a3100000000080004400000f1ff0800010073797a300000000008630003400000000a14000000110055d1ea74906b387e2ff6912daf2ee81b7f71341231094e6eb5126df8297fa038d1b8668899f3bb183107563889403b18e50b39c9bd2eb93392b2589d4d5220a8bb850c3230808e185f58c957597096ad9e83c5b9b8e6d4a8a347150fd1abe2b181bf023a434c8d07cf035340497a33a8b38b1eeb566ed97fa102b1f4c55586d9672589c0592fa442c19c4a9f8cec3836728c23cbd3fae5a559053f2b604c7a61d59ad89f9b25c2890159a7d1858200178712136695f1c689d25b91e438ca2a1c9b0b8a61fa31277873a641b94e703326b1dfb251fd11d4edc41e7797880dc1f608a7505ca8c8bda0ac6e967c7c365298a29141f0e40d1fbf6fba5298ac73f4aacf2f3d9ba4907c33bc19a74163e448b74cf4a6d5bb93508ddaa8c51c56efce5f8a7e62ab301f325736b79c0a65a46c4a0fde037ff9c7308c38b8b47ec3bc693e1289b0286e73b1470d75561eecefb934eac5f4623054eee0e44498d335eb6e02f378d904c2ebda6bd5775f40d6c0c24a0daa3f0348d48c2a3ba3870451e809944795ce26"], 0x64}, 0x1, 0x0, 0x0, 0x8800}, 0x4008001) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0x1, 0x60, {"3ef30fc735fc9a00003e0f01c8c4417df1a9b398000066b824008ec8460f79f2c4e1717db49c26000000b9800000c00f3235000400000f307b9666baa00066b8000066ef66bad1040f01c2260f78da"}}], 0x60}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x300000b) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000002c0)={[0x5e0, 0x7, 0x0, 0x17c, 0x3, 0x802, 0xf6, 0x3f1, 0x3, 0x2, 0x8, 0x2000009, 0x8, 0x9, 0x80000000000, 0x8], 0x60000, 0x3c0390}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 0s ago: executing program 0 (id=323): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000001300)={0x1, 0x0, [{0x400000f3, 0x0, 0x1}]}) kernel console output (not intermixed with test programs): ][ T5992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.491168][ T5992] RIP: 0033:0x7f24f8d9f559 [ 108.491189][ T5992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.491207][ T5992] RSP: 002b:00007f24f9bea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 108.491231][ T5992] RAX: ffffffffffffffda RBX: 00007f24f9025fa0 RCX: 00007f24f8d9f559 [ 108.491247][ T5992] RDX: 000000002c000010 RSI: 0000200000000300 RDI: 0000000000000005 [ 108.491270][ T5992] RBP: 00007f24f9bea090 R08: 0000000000000000 R09: 0000000000000000 [ 108.491284][ T5992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 108.491297][ T5992] R13: 00007f24f9026038 R14: 00007f24f9025fa0 R15: 00007ffcbcfe37e8 [ 108.491332][ T5992] [ 108.929022][ T6006] schedule_timeout: wrong timeout value fffffffffffffed4 [ 108.929052][ T6006] CPU: 0 UID: 0 PID: 6006 Comm: syz.1.59 Not tainted syzkaller #0 PREEMPT(full) [ 108.929078][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 108.929091][ T6006] Call Trace: [ 108.929100][ T6006] [ 108.929110][ T6006] dump_stack_lvl+0xe8/0x150 [ 108.929149][ T6006] schedule_timeout+0x22e/0x2c0 [ 108.929176][ T6006] ? __pfx_schedule_timeout+0x10/0x10 [ 108.929215][ T6006] ? sk_wait_data+0x20e/0x4d0 [ 108.929249][ T6006] wait_woken+0xbc/0x1a0 [ 108.929280][ T6006] ? wait_woken+0x39/0x1a0 [ 108.929316][ T6006] sk_wait_data+0x29b/0x4d0 [ 108.929360][ T6006] ? __pfx_sk_wait_data+0x10/0x10 [ 108.929392][ T6006] ? __pfx_woken_wake_function+0x10/0x10 [ 108.929427][ T6006] ? smc_accept+0x6f3/0xa20 [ 108.929457][ T6006] ? __local_bh_enable_ip+0xd6/0x140 [ 108.929491][ T6006] smc_accept+0x79b/0xa20 [ 108.929528][ T6006] ? __pfx_smc_accept+0x10/0x10 [ 108.929555][ T6006] ? __pfx_default_wake_function+0x10/0x10 [ 108.929587][ T6006] ? __pfx_aa_sk_perm+0x10/0x10 [ 108.929616][ T6006] ? inode_init_always_gfp+0x994/0xd30 [ 108.929641][ T6006] ? apparmor_socket_accept+0x12f/0x200 [ 108.929677][ T6006] do_accept+0x501/0x730 [ 108.929715][ T6006] ? __pfx_do_accept+0x10/0x10 [ 108.929762][ T6006] __sys_accept4+0x135/0x230 [ 108.929787][ T6006] ? __pfx___sys_accept4+0x10/0x10 [ 108.929822][ T6006] __x64_sys_accept4+0x9a/0xb0 [ 108.929847][ T6006] do_syscall_64+0x166/0x520 [ 108.929876][ T6006] ? trace_irq_disable+0x3b/0x140 [ 108.929909][ T6006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.929932][ T6006] ? clear_bhb_loop+0x70/0xc0 [ 108.929960][ T6006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.929982][ T6006] RIP: 0033:0x7fcea8b9f559 [ 108.930003][ T6006] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.930021][ T6006] RSP: 002b:00007fcea99f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 108.930045][ T6006] RAX: ffffffffffffffda RBX: 00007fcea8e25fa0 RCX: 00007fcea8b9f559 [ 108.930061][ T6006] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 108.930074][ T6006] RBP: 00007fcea8c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 108.930087][ T6006] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 [ 108.930099][ T6006] R13: 00007fcea8e26038 R14: 00007fcea8e25fa0 R15: 00007ffc306f9bf8 [ 108.930131][ T6006] [ 109.056331][ T194] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 109.231376][ T194] usb 3-1: device descriptor read/64, error -71 [ 109.470229][ T194] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 109.600411][ T194] usb 3-1: device descriptor read/64, error -71 [ 109.724546][ T194] usb usb3-port1: attempt power cycle [ 109.828078][ T6026] ieee802154 phy0 wpan0: encryption failed: -22 [ 110.090323][ T194] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 110.090520][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 110.121924][ T194] usb 3-1: device descriptor read/8, error -71 [ 110.154117][ T6038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.154547][ T6038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 110.242965][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 110.243755][ T10] usb 2-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 110.244823][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.244855][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 110.244900][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.249554][ T10] usb 2-1: config 0 descriptor?? [ 110.370244][ T194] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 110.390904][ T194] usb 3-1: device descriptor read/8, error -71 [ 110.450238][ T32] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 110.500684][ T194] usb usb3-port1: unable to enumerate USB device [ 110.580210][ T32] usb 4-1: device descriptor read/64, error -71 [ 110.683928][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 110.689421][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0001/input/input5 [ 110.762162][ T10] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 110.840262][ T32] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 110.971281][ T32] usb 4-1: device descriptor read/64, error -71 [ 111.082960][ T32] usb usb4-port1: attempt power cycle [ 111.210199][ T5733] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 111.362039][ T5733] usb 1-1: Using ep0 maxpacket: 32 [ 111.366693][ T5733] usb 1-1: New USB device found: idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 111.379092][ T5733] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.390240][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.390268][ T5733] usb 1-1: Product: syz [ 111.390284][ T5733] usb 1-1: Manufacturer: syz [ 111.390300][ T5733] usb 1-1: SerialNumber: syz [ 111.419935][ T5733] usb 1-1: config 0 descriptor?? [ 111.424421][ T32] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 111.436988][ T5733] gs_usb 1-1:0.0: Required endpoints not found [ 111.455790][ T32] usb 4-1: device descriptor read/8, error -71 [ 111.493607][ T6028] sg_write: data in/out 622604/136 bytes for SCSI command 0x0-- guessing data in; [ 111.493607][ T6028] program syz.1.64 not setting count and/or reply_len properly [ 111.573650][ T5733] usb 2-1: USB disconnect, device number 4 [ 111.692166][ T32] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 111.712046][ T32] usb 4-1: device descriptor read/8, error -71 [ 111.820542][ T32] usb usb4-port1: unable to enumerate USB device [ 112.195031][ T6048] FAULT_INJECTION: forcing a failure. [ 112.195031][ T6048] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 112.195056][ T6048] CPU: 0 UID: 0 PID: 6048 Comm: syz.1.71 Not tainted syzkaller #0 PREEMPT(full) [ 112.195073][ T6048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 112.195082][ T6048] Call Trace: [ 112.195088][ T6048] [ 112.195095][ T6048] dump_stack_lvl+0xe8/0x150 [ 112.195123][ T6048] should_fail_ex+0x3eb/0x540 [ 112.195151][ T6048] _copy_from_user+0x2d/0xb0 [ 112.195176][ T6048] vt_ioctl+0xa9c/0x20e0 [ 112.195205][ T6048] ? __pfx_vt_ioctl+0x10/0x10 [ 112.195235][ T6048] ? __fget_files+0x2a/0x420 [ 112.195256][ T6048] ? tty_jobctrl_ioctl+0x378/0xba0 [ 112.195276][ T6048] ? __fget_files+0x2a/0x420 [ 112.195296][ T6048] tty_ioctl+0x920/0xde0 [ 112.195320][ T6048] ? __pfx_tty_ioctl+0x10/0x10 [ 112.195344][ T6048] __se_sys_ioctl+0xfc/0x170 [ 112.195398][ T6048] do_syscall_64+0x166/0x520 [ 112.195429][ T6048] ? trace_irq_disable+0x3b/0x140 [ 112.195456][ T6048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.195479][ T6048] ? clear_bhb_loop+0x70/0xc0 [ 112.195507][ T6048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.195532][ T6048] RIP: 0033:0x7fcea8b9f559 [ 112.195547][ T6048] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.195559][ T6048] RSP: 002b:00007fcea99f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 112.195575][ T6048] RAX: ffffffffffffffda RBX: 00007fcea8e25fa0 RCX: 00007fcea8b9f559 [ 112.195587][ T6048] RDX: 00002000000001c0 RSI: 0000000000004b72 RDI: 0000000000000003 [ 112.195597][ T6048] RBP: 00007fcea99f6090 R08: 0000000000000000 R09: 0000000000000000 [ 112.195606][ T6048] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.195615][ T6048] R13: 00007fcea8e26038 R14: 00007fcea8e25fa0 R15: 00007ffc306f9bf8 [ 112.195639][ T6048] [ 112.221837][ T32] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 112.396558][ T32] usb 3-1: Using ep0 maxpacket: 8 [ 112.401088][ T32] usb 3-1: New USB device found: idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 112.425418][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.425449][ T32] usb 3-1: Product: syz [ 112.425465][ T32] usb 3-1: Manufacturer: syz [ 112.425480][ T32] usb 3-1: SerialNumber: syz [ 112.457808][ T32] usb 3-1: config 0 descriptor?? [ 112.524959][ T6050] process 'syz.1.72' launched '/dev/fd/7' with NULL argv: empty string added [ 112.652746][ T10] usb 1-1: USB disconnect, device number 4 [ 112.671304][ T32] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 112.851172][ T6058] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 113.013122][ T5636] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 113.376786][ T6068] FAULT_INJECTION: forcing a failure. [ 113.376786][ T6068] name failslab, interval 1, probability 0, space 0, times 0 [ 113.376829][ T6068] CPU: 0 UID: 0 PID: 6068 Comm: syz.3.79 Not tainted syzkaller #0 PREEMPT(full) [ 113.376854][ T6068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 113.376867][ T6068] Call Trace: [ 113.376875][ T6068] [ 113.376885][ T6068] dump_stack_lvl+0xe8/0x150 [ 113.376932][ T6068] should_fail_ex+0x3eb/0x540 [ 113.376971][ T6068] should_failslab+0xa8/0x100 [ 113.377003][ T6068] __kmalloc_noprof+0xf9/0x710 [ 113.377037][ T6068] ? security_sk_alloc+0x52/0x360 [ 113.377059][ T6068] ? security_sk_alloc+0x52/0x360 [ 113.377090][ T6068] security_sk_alloc+0x52/0x360 [ 113.377116][ T6068] sk_prot_alloc+0x101/0x210 [ 113.377145][ T6068] ? sk_alloc+0x27/0x390 [ 113.377177][ T6068] sk_alloc+0x3a/0x390 [ 113.377207][ T6068] __netlink_create+0x62/0x260 [ 113.377241][ T6068] ? __pfx_genl_release+0x10/0x10 [ 113.377269][ T6068] netlink_create+0x3ca/0x590 [ 113.377293][ T6068] ? __pfx_genl_unbind+0x10/0x10 [ 113.377317][ T6068] ? __pfx_genl_bind+0x10/0x10 [ 113.377346][ T6068] __sock_create+0x4b5/0xac0 [ 113.377391][ T6068] __sys_socket+0xd6/0x1b0 [ 113.377430][ T6068] __x64_sys_socket+0x7a/0x90 [ 113.377465][ T6068] do_syscall_64+0x166/0x520 [ 113.377495][ T6068] ? trace_irq_disable+0x3b/0x140 [ 113.377522][ T6068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.377541][ T6068] ? clear_bhb_loop+0x70/0xc0 [ 113.377564][ T6068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.377586][ T6068] RIP: 0033:0x7fe3c9da0dc7 [ 113.377612][ T6068] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.377631][ T6068] RSP: 002b:00007fe3cac7ff98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 113.377665][ T6068] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9da0dc7 [ 113.377681][ T6068] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 113.377694][ T6068] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 113.377712][ T6068] R10: 00002000000005c0 R11: 0000000000000286 R12: 0000000000000001 [ 113.377726][ T6068] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 113.377761][ T6068] [ 113.493423][ T32] usb write operation failed. (-71) [ 113.645164][ T32] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 113.647612][ T32] dvbdev: DVB: registering new adapter (Terratec H7) [ 113.647685][ T32] usb 3-1: media controller created [ 113.648078][ T32] usb read operation failed. (-71) [ 113.648600][ T32] usb write operation failed. (-71) [ 113.705748][ T32] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 113.728298][ T32] usb 3-1: USB disconnect, device number 7 [ 113.893153][ T5709] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 113.957761][ T6104] syz.2.82 uses obsolete (PF_INET,SOCK_PACKET) [ 113.975043][ T6105] FAULT_INJECTION: forcing a failure. [ 113.975043][ T6105] name failslab, interval 1, probability 0, space 0, times 0 [ 113.975079][ T6105] CPU: 1 UID: 0 PID: 6105 Comm: syz.0.81 Not tainted syzkaller #0 PREEMPT(full) [ 113.975109][ T6105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 113.975124][ T6105] Call Trace: [ 113.975134][ T6105] [ 113.975145][ T6105] dump_stack_lvl+0xe8/0x150 [ 113.975189][ T6105] should_fail_ex+0x3eb/0x540 [ 113.975232][ T6105] should_failslab+0xa8/0x100 [ 113.975269][ T6105] __kmalloc_cache_noprof+0x9e/0x600 [ 113.975300][ T6105] ? ext4_init_fs_context+0x4f/0xf0 [ 113.975332][ T6105] ? ext4_init_fs_context+0x4f/0xf0 [ 113.975371][ T6105] ext4_init_fs_context+0x4f/0xf0 [ 113.975406][ T6105] alloc_fs_context+0x99e/0xd00 [ 113.975448][ T6105] __se_sys_fsopen+0x118/0x370 [ 113.975487][ T6105] do_syscall_64+0x166/0x520 [ 113.975521][ T6105] ? trace_irq_disable+0x3b/0x140 [ 113.975552][ T6105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.975578][ T6105] ? clear_bhb_loop+0x70/0xc0 [ 113.975609][ T6105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.975634][ T6105] RIP: 0033:0x7f391cb9f559 [ 113.975658][ T6105] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.975679][ T6105] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 113.975707][ T6105] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 113.975727][ T6105] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000ec0 [ 113.975743][ T6105] RBP: 00007f391cc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 113.975759][ T6105] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.975773][ T6105] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 113.975810][ T6105] [ 114.048669][ T5709] usb 4-1: New USB device found: idVendor=05c5, idProduct=0002, bcdDevice=1.00 [ 114.098456][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.098547][ T5709] usb 4-1: Product: syz [ 114.098591][ T5709] usb 4-1: Manufacturer: syz [ 114.098847][ T5709] usb 4-1: SerialNumber: syz [ 114.203758][ T5709] digi_acceleport 4-1:1.0: Digi 2 port USB adapter converter detected [ 114.235314][ T5709] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB0 [ 114.257129][ T5709] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB1 [ 114.274362][ T5709] usb 4-1: Digi 2 port USB adapter converter now attached to ttyUSB2 [ 114.504751][ T6115] jffs2: notice: (6115) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 114.560214][ T5790] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 114.677728][ T6124] FAULT_INJECTION: forcing a failure. [ 114.677728][ T6124] name failslab, interval 1, probability 0, space 0, times 0 [ 114.677762][ T6124] CPU: 0 UID: 0 PID: 6124 Comm: syz.2.90 Not tainted syzkaller #0 PREEMPT(full) [ 114.677787][ T6124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 114.677800][ T6124] Call Trace: [ 114.677809][ T6124] [ 114.677819][ T6124] dump_stack_lvl+0xe8/0x150 [ 114.677857][ T6124] should_fail_ex+0x3eb/0x540 [ 114.677896][ T6124] should_failslab+0xa8/0x100 [ 114.677930][ T6124] __kmalloc_cache_noprof+0x9e/0x600 [ 114.677957][ T6124] ? snd_seq_port_use_ptr+0x29/0x260 [ 114.677989][ T6124] ? snd_seq_port_connect+0x6b/0x3a0 [ 114.678020][ T6124] ? snd_seq_port_connect+0x6b/0x3a0 [ 114.678061][ T6124] snd_seq_port_connect+0x6b/0x3a0 [ 114.678092][ T6124] ? snd_seq_port_use_ptr+0x29/0x260 [ 114.678123][ T6124] ? snd_seq_port_use_ptr+0x29/0x260 [ 114.678157][ T6124] ? snd_seq_port_use_ptr+0x229/0x260 [ 114.678193][ T6124] snd_seq_ioctl_subscribe_port+0x351/0x790 [ 114.678237][ T6124] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 114.678290][ T6124] snd_seq_oss_midi_open+0x42d/0x910 [ 114.678326][ T6124] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 114.678377][ T6124] snd_seq_oss_synth_reset+0x3ca/0x900 [ 114.678411][ T6124] ? __pfx_snd_seq_oss_synth_reset+0x10/0x10 [ 114.678462][ T6124] snd_seq_oss_reset+0x5a/0x240 [ 114.678489][ T6124] snd_seq_oss_ioctl+0x74a/0x1160 [ 114.678517][ T6124] ? __pfx_snd_seq_oss_ioctl+0x10/0x10 [ 114.678538][ T6124] ? __mutex_trylock_common+0x15f/0x270 [ 114.678573][ T6124] ? __pfx___mutex_trylock_common+0x10/0x10 [ 114.678608][ T6124] ? rcu_is_watching+0x16/0xb0 [ 114.678639][ T6124] ? trace_contention_end+0x3d/0x140 [ 114.678673][ T6124] ? __mutex_lock+0x305/0x15a0 [ 114.678718][ T6124] ? odev_ioctl+0x81/0xf0 [ 114.678754][ T6124] ? __pfx___mutex_lock+0x10/0x10 [ 114.678798][ T6124] ? __fget_files+0x2a/0x420 [ 114.678824][ T6124] ? __fget_files+0x2a/0x420 [ 114.678853][ T6124] ? __pfx_odev_ioctl+0x10/0x10 [ 114.678887][ T6124] odev_ioctl+0xb2/0xf0 [ 114.678922][ T6124] __se_sys_ioctl+0xfc/0x170 [ 114.678957][ T6124] do_syscall_64+0x166/0x520 [ 114.678988][ T6124] ? trace_irq_disable+0x3b/0x140 [ 114.679016][ T6124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.679039][ T6124] ? clear_bhb_loop+0x70/0xc0 [ 114.679068][ T6124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.679091][ T6124] RIP: 0033:0x7f24f8d9f559 [ 114.679117][ T6124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.679135][ T6124] RSP: 002b:00007f24f9bea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 114.679158][ T6124] RAX: ffffffffffffffda RBX: 00007f24f9025fa0 RCX: 00007f24f8d9f559 [ 114.679174][ T6124] RDX: 0000000000000000 RSI: 0000000000005100 RDI: 0000000000000004 [ 114.679188][ T6124] RBP: 00007f24f9bea090 R08: 0000000000000000 R09: 0000000000000000 [ 114.679201][ T6124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 114.679214][ T6124] R13: 00007f24f9026038 R14: 00007f24f9025fa0 R15: 00007ffcbcfe37e8 [ 114.679252][ T6124] [ 114.741828][ T5790] usb 1-1: New USB device found: idVendor=05e0, idProduct=0600, bcdDevice=1.00 [ 114.748789][ T5790] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.748823][ T5790] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.819559][ T5790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.819589][ T5790] usb 1-1: Product: syz [ 114.819605][ T5790] usb 1-1: Manufacturer: syz [ 114.819621][ T5790] usb 1-1: SerialNumber: syz [ 115.064785][ T5790] symbolserial 1-1:1.0: symbol converter detected [ 115.079984][ T5790] usb 1-1: symbol converter now attached to ttyUSB3 [ 115.770626][ T6135] FAULT_INJECTION: forcing a failure. [ 115.770626][ T6135] name failslab, interval 1, probability 0, space 0, times 0 [ 115.770689][ T6135] CPU: 1 UID: 0 PID: 6135 Comm: syz.1.92 Not tainted syzkaller #0 PREEMPT(full) [ 115.770717][ T6135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 115.770732][ T6135] Call Trace: [ 115.770740][ T6135] [ 115.770750][ T6135] dump_stack_lvl+0xe8/0x150 [ 115.770792][ T6135] should_fail_ex+0x3eb/0x540 [ 115.770837][ T6135] should_failslab+0xa8/0x100 [ 115.770872][ T6135] __kmalloc_node_noprof+0xfb/0x720 [ 115.770908][ T6135] ? __kmalloc_node_noprof+0x2eb/0x720 [ 115.770932][ T6135] ? blk_mq_alloc_tag_set+0x4bd/0xfa0 [ 115.770968][ T6135] ? blk_mq_alloc_tag_set+0x4bd/0xfa0 [ 115.771012][ T6135] blk_mq_alloc_tag_set+0x4bd/0xfa0 [ 115.771061][ T6135] loop_add+0x436/0xb40 [ 115.771097][ T6135] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 115.771133][ T6135] ? __pfx_loop_add+0x10/0x10 [ 115.771203][ T6135] loop_control_ioctl+0x12b/0x5a0 [ 115.771240][ T6135] ? __fget_files+0x2a/0x420 [ 115.771267][ T6135] ? __pfx_loop_control_ioctl+0x10/0x10 [ 115.771307][ T6135] ? bpf_lsm_file_ioctl+0x9/0x20 [ 115.771336][ T6135] ? __pfx_loop_control_ioctl+0x10/0x10 [ 115.771373][ T6135] __se_sys_ioctl+0xfc/0x170 [ 115.771408][ T6135] do_syscall_64+0x166/0x520 [ 115.771440][ T6135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.771464][ T6135] ? clear_bhb_loop+0x70/0xc0 [ 115.771492][ T6135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.771516][ T6135] RIP: 0033:0x7fcea8b9f559 [ 115.771537][ T6135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.771557][ T6135] RSP: 002b:00007fcea99f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 115.771582][ T6135] RAX: ffffffffffffffda RBX: 00007fcea8e25fa0 RCX: 00007fcea8b9f559 [ 115.771599][ T6135] RDX: 0000000087000000 RSI: 0000000000004c80 RDI: 0000000000000003 [ 115.771614][ T6135] RBP: 00007fcea8c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 115.771629][ T6135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.771642][ T6135] R13: 00007fcea8e26038 R14: 00007fcea8e25fa0 R15: 00007ffc306f9bf8 [ 115.771679][ T6135] [ 116.219208][ T6074] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 116.258032][ C1] digi_acceleport 4-1:1.0: digi_read_bulk_callback: nonzero read bulk status: status=-71, port=3 [ 116.272380][ T10] usb 4-1: USB disconnect, device number 8 [ 116.315579][ T6109] digi_2 ttyUSB0: failed to submit read urb: -19 [ 116.321615][ T5709] usb 1-1: USB disconnect, device number 5 [ 116.379544][ T10] digi_2 ttyUSB0: Digi 2 port USB adapter converter now disconnected from ttyUSB0 [ 116.404800][ T10] digi_2 ttyUSB1: Digi 2 port USB adapter converter now disconnected from ttyUSB1 [ 116.408926][ T5709] symbol ttyUSB3: symbol converter now disconnected from ttyUSB3 [ 116.439529][ T10] digi_2 ttyUSB2: Digi 2 port USB adapter converter now disconnected from ttyUSB2 [ 116.453568][ T10] digi_acceleport 4-1:1.0: device disconnected [ 116.470968][ T5709] symbolserial 1-1:1.0: device disconnected [ 116.567338][ T6145] ======================================================= [ 116.567338][ T6145] WARNING: The mand mount option has been deprecated and [ 116.567338][ T6145] and is ignored by this kernel. Remove the mand [ 116.567338][ T6145] option from the mount to silence this warning. [ 116.567338][ T6145] ======================================================= [ 116.570005][ T6145] fuse: Bad value for 'user_id' [ 116.570025][ T6145] fuse: Bad value for 'user_id' [ 116.920208][ T10] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 117.071071][ T10] usb 4-1: New USB device found: idVendor=05d1, idProduct=2021, bcdDevice=29.00 [ 117.074336][ T10] usb 4-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 117.074365][ T10] usb 4-1: Product: syz [ 117.109657][ T10] ftdi_sio 4-1:5.0: FTDI USB Serial Device converter detected [ 117.119827][ T10] usb 4-1: Detected FT4233HP [ 117.167636][ T5636] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 117.318397][ T6145] netlink: 'syz.3.97': attribute type 21 has an invalid length. [ 117.318475][ T6145] netlink: 132 bytes leftover after parsing attributes in process `syz.3.97'. [ 117.343608][ T6145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.347331][ T6145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.358059][ T6145] netlink: 12 bytes leftover after parsing attributes in process `syz.3.97'. [ 117.376162][ T10] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 117.383508][ T10] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 117.386120][ T10] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 117.389015][ T10] usb 4-1: USB disconnect, device number 9 [ 117.416859][ T32] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 117.419660][ T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 117.437836][ T10] ftdi_sio 4-1:5.0: device disconnected [ 117.571301][ T32] usb 3-1: New USB device found: idVendor=0e41, idProduct=4141, bcdDevice=0.40 [ 117.574454][ T32] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 117.587611][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.587697][ T32] usb 3-1: Product: syz [ 117.587740][ T32] usb 3-1: Manufacturer: syz [ 117.587774][ T32] usb 3-1: SerialNumber: syz [ 117.603903][ T6170] capability: warning: `syz.0.105' uses deprecated v2 capabilities in a way that may be insecure [ 117.834992][ T6179] Bluetooth: MGMT ver 1.23 [ 117.877356][ T32] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 117.985084][ T6184] FAULT_INJECTION: forcing a failure. [ 117.985084][ T6184] name failslab, interval 1, probability 0, space 0, times 0 [ 117.985118][ T6184] CPU: 1 UID: 0 PID: 6184 Comm: syz.1.110 Not tainted syzkaller #0 PREEMPT(full) [ 117.985143][ T6184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 117.985156][ T6184] Call Trace: [ 117.985164][ T6184] [ 117.985174][ T6184] dump_stack_lvl+0xe8/0x150 [ 117.985214][ T6184] should_fail_ex+0x3eb/0x540 [ 117.985254][ T6184] should_failslab+0xa8/0x100 [ 117.985286][ T6184] ? key_alloc+0x340/0xd20 [ 117.985315][ T6184] kmem_cache_alloc_noprof+0x9c/0x600 [ 117.985342][ T6184] ? key_alloc+0x340/0xd20 [ 117.985378][ T6184] key_alloc+0x340/0xd20 [ 117.985423][ T6184] __key_create_or_update+0x867/0xab0 [ 117.985468][ T6184] ? __pfx___key_create_or_update+0x10/0x10 [ 117.985498][ T6184] ? lookup_user_key+0x112c/0x12c0 [ 117.985555][ T6184] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 117.985602][ T6184] key_create_or_update+0x42/0x60 [ 117.985639][ T6184] __se_sys_add_key+0x349/0x420 [ 117.985668][ T6184] ? __pfx___se_sys_add_key+0x10/0x10 [ 117.985703][ T6184] ? __x64_sys_add_key+0x20/0xc0 [ 117.985729][ T6184] do_syscall_64+0x166/0x520 [ 117.985760][ T6184] ? trace_irq_disable+0x3b/0x140 [ 117.985788][ T6184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.985813][ T6184] ? clear_bhb_loop+0x70/0xc0 [ 117.985842][ T6184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.985865][ T6184] RIP: 0033:0x7fcea8b9f559 [ 117.985887][ T6184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.985906][ T6184] RSP: 002b:00007fcea99f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 117.985933][ T6184] RAX: ffffffffffffffda RBX: 00007fcea8e25fa0 RCX: 00007fcea8b9f559 [ 117.985951][ T6184] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 117.985966][ T6184] RBP: 00007fcea8c36b20 R08: ffffffffffffffff R09: 0000000000000000 [ 117.985982][ T6184] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 117.985996][ T6184] R13: 00007fcea8e26038 R14: 00007fcea8e25fa0 R15: 00007ffc306f9bf8 [ 117.986033][ T6184] [ 118.302359][ T32] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 118.305274][ T32] snd_usb_toneport 3-1:1.0: Line 6 TonePort UX1 found [ 118.305300][ T32] usb 3-1: selecting invalid altsetting 2 [ 118.305347][ T32] snd_usb_toneport 3-1:1.0: set_interface failed [ 118.305825][ T32] snd_usb_toneport 3-1:1.0: Line 6 TonePort UX1 now disconnected [ 118.306182][ T32] snd_usb_toneport 3-1:1.0: probe with driver snd_usb_toneport failed with error -22 [ 118.334487][ T32] snd_usb_toneport 3-1:1.1: Line 6 TonePort UX1 found [ 118.334537][ T32] usb 3-1: selecting invalid altsetting 2 [ 118.334553][ T32] snd_usb_toneport 3-1:1.1: set_interface failed [ 118.335046][ T32] snd_usb_toneport 3-1:1.1: Line 6 TonePort UX1 now disconnected [ 118.337223][ T32] snd_usb_toneport 3-1:1.1: probe with driver snd_usb_toneport failed with error -22 [ 118.373114][ T32] snd_usb_toneport 3-1:1.2: Line 6 TonePort UX1 found [ 118.374970][ T32] usb 3-1: selecting invalid altsetting 2 [ 118.375024][ T32] snd_usb_toneport 3-1:1.2: set_interface failed [ 118.375646][ T32] snd_usb_toneport 3-1:1.2: Line 6 TonePort UX1 now disconnected [ 118.376450][ T32] snd_usb_toneport 3-1:1.2: probe with driver snd_usb_toneport failed with error -22 [ 118.437973][ T32] usb 3-1: USB disconnect, device number 8 [ 118.551783][ T5655] udevd[5655]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 118.683223][ T5636] Bluetooth: hci2: unexpected event for opcode 0x1004 [ 118.702399][ T6195] FAULT_INJECTION: forcing a failure. [ 118.702399][ T6195] name failslab, interval 1, probability 0, space 0, times 0 [ 118.702439][ T6195] CPU: 1 UID: 0 PID: 6195 Comm: syz.3.115 Not tainted syzkaller #0 PREEMPT(full) [ 118.702464][ T6195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 118.702477][ T6195] Call Trace: [ 118.702486][ T6195] [ 118.702495][ T6195] dump_stack_lvl+0xe8/0x150 [ 118.702534][ T6195] should_fail_ex+0x3eb/0x540 [ 118.702572][ T6195] should_failslab+0xa8/0x100 [ 118.702602][ T6195] ? alloc_empty_file+0x5b/0x1d0 [ 118.702624][ T6195] kmem_cache_alloc_noprof+0x9c/0x600 [ 118.702650][ T6195] ? alloc_empty_file+0x5b/0x1d0 [ 118.702678][ T6195] alloc_empty_file+0x5b/0x1d0 [ 118.702701][ T6195] alloc_file_pseudo+0x110/0x1e0 [ 118.702726][ T6195] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 118.702749][ T6195] ? _raw_spin_unlock+0x28/0x50 [ 118.702784][ T6195] sock_alloc_file+0xb8/0x2e0 [ 118.702814][ T6195] ? __sys_socket+0x12b/0x1b0 [ 118.702851][ T6195] __sys_socket+0x13f/0x1b0 [ 118.702889][ T6195] __x64_sys_socket+0x7a/0x90 [ 118.702924][ T6195] do_syscall_64+0x166/0x520 [ 118.702955][ T6195] ? trace_irq_disable+0x3b/0x140 [ 118.702982][ T6195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.703005][ T6195] ? clear_bhb_loop+0x70/0xc0 [ 118.703033][ T6195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.703055][ T6195] RIP: 0033:0x7fe3c9d9f559 [ 118.703076][ T6195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.703094][ T6195] RSP: 002b:00007fe3cac60028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 118.703117][ T6195] RAX: ffffffffffffffda RBX: 00007fe3ca026090 RCX: 00007fe3c9d9f559 [ 118.703134][ T6195] RDX: 0000000000000000 RSI: 0000000000080805 RDI: 0000000000000002 [ 118.703147][ T6195] RBP: 00007fe3c9e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 118.703161][ T6195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 118.703174][ T6195] R13: 00007fe3ca026128 R14: 00007fe3ca026090 R15: 00007ffffd91b4e8 [ 118.703210][ T6195] [ 119.019153][ T6208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.019640][ T6208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.053411][ T6208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.053893][ T6208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.083709][ T6211] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 119.190370][ T6215] FAULT_INJECTION: forcing a failure. [ 119.190370][ T6215] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 119.190393][ T6215] CPU: 0 UID: 0 PID: 6215 Comm: syz.3.123 Not tainted syzkaller #0 PREEMPT(full) [ 119.190411][ T6215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 119.190421][ T6215] Call Trace: [ 119.190427][ T6215] [ 119.190434][ T6215] dump_stack_lvl+0xe8/0x150 [ 119.190463][ T6215] should_fail_ex+0x3eb/0x540 [ 119.190490][ T6215] _copy_from_user+0x2d/0xb0 [ 119.190514][ T6215] dm_ctl_ioctl+0x14c/0xe10 [ 119.190538][ T6215] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 119.190569][ T6215] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.190614][ T6215] ? __fget_files+0x2a/0x420 [ 119.190634][ T6215] ? bpf_lsm_file_ioctl+0x9/0x20 [ 119.190655][ T6215] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 119.190677][ T6215] __se_sys_ioctl+0xfc/0x170 [ 119.190701][ T6215] do_syscall_64+0x166/0x520 [ 119.190722][ T6215] ? trace_irq_disable+0x3b/0x140 [ 119.190743][ T6215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.190758][ T6215] ? clear_bhb_loop+0x70/0xc0 [ 119.190777][ T6215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.190792][ T6215] RIP: 0033:0x7fe3c9d9f559 [ 119.190806][ T6215] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.190819][ T6215] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 119.190835][ T6215] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 119.190846][ T6215] RDX: 0000200000000000 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 119.190856][ T6215] RBP: 00007fe3cac81090 R08: 0000000000000000 R09: 0000000000000000 [ 119.190865][ T6215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.190874][ T6215] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 119.190899][ T6215] [ 119.251809][ T11] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 119.438227][ T6218] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.125'. [ 119.447476][ T6219] program syz.3.124 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 119.480488][ T11] usb 1-1: Using ep0 maxpacket: 32 [ 119.481391][ T11] usb 1-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 119.483638][ T11] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 119.483667][ T11] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 119.488868][ T11] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 119.488897][ T11] usb 1-1: Product: syz [ 119.488913][ T11] usb 1-1: Manufacturer: syz [ 119.488928][ T11] usb 1-1: SerialNumber: syz [ 119.555644][ T11] usb 1-1: config 0 descriptor?? [ 119.776481][ T5800] usb 1-1: USB disconnect, device number 6 [ 119.860392][ T11] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 119.990223][ T11] usb 4-1: device descriptor read/64, error -71 [ 120.057654][ T33] audit: type=1400 audit(1793228822.151:3): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" name="unknown" pid=6232 comm="syz.2.130" name="unknown" offset=16 [ 120.230203][ T11] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 120.371140][ T11] usb 4-1: device descriptor read/64, error -71 [ 120.402516][ T6235] FAULT_INJECTION: forcing a failure. [ 120.402516][ T6235] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 120.402563][ T6235] CPU: 1 UID: 0 PID: 6235 Comm: syz.2.131 Not tainted syzkaller #0 PREEMPT(full) [ 120.402589][ T6235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 120.402602][ T6235] Call Trace: [ 120.402610][ T6235] [ 120.402620][ T6235] dump_stack_lvl+0xe8/0x150 [ 120.402659][ T6235] should_fail_ex+0x3eb/0x540 [ 120.402698][ T6235] _copy_from_user+0x2d/0xb0 [ 120.402733][ T6235] iommufd_fops_ioctl+0x416/0x600 [ 120.402769][ T6235] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 120.402799][ T6235] ? __fget_files+0x2a/0x420 [ 120.402841][ T6235] ? bpf_lsm_file_ioctl+0x9/0x20 [ 120.402872][ T6235] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 120.402896][ T6235] __se_sys_ioctl+0xfc/0x170 [ 120.402935][ T6235] do_syscall_64+0x166/0x520 [ 120.402966][ T6235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.402994][ T6235] ? clear_bhb_loop+0x70/0xc0 [ 120.403026][ T6235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.403050][ T6235] RIP: 0033:0x7f24f8d9f559 [ 120.403072][ T6235] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.403091][ T6235] RSP: 002b:00007f24f9bea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 120.403115][ T6235] RAX: ffffffffffffffda RBX: 00007f24f9025fa0 RCX: 00007f24f8d9f559 [ 120.403133][ T6235] RDX: 0000200000000000 RSI: 0000000000003b86 RDI: 0000000000000003 [ 120.403148][ T6235] RBP: 00007f24f9bea090 R08: 0000000000000000 R09: 0000000000000000 [ 120.403162][ T6235] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.403177][ T6235] R13: 00007f24f9026038 R14: 00007f24f9025fa0 R15: 00007ffcbcfe37e8 [ 120.403217][ T6235] [ 120.498063][ T11] usb usb4-port1: attempt power cycle [ 120.891563][ T11] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 120.921615][ T11] usb 4-1: device descriptor read/8, error -71 [ 121.170268][ T11] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 121.192936][ T11] usb 4-1: device descriptor read/8, error -71 [ 121.311379][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 121.311824][ T11] usb usb4-port1: unable to enumerate USB device [ 121.446116][ T6260] sctp: [Deprecated]: syz.1.140 (pid 6260) Use of struct sctp_assoc_value in delayed_ack socket option. [ 121.446116][ T6260] Use struct sctp_sack_info instead [ 121.459438][ T5636] Bluetooth: hci3: unexpected event 0x04 length: 11 > 10 [ 121.473341][ T10] usb 1-1: New USB device found: idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 121.474399][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 121.474424][ T10] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 121.477003][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.477021][ T10] usb 1-1: Product: syz [ 121.477031][ T10] usb 1-1: Manufacturer: syz [ 121.477042][ T10] usb 1-1: SerialNumber: syz [ 121.488893][ T10] usb 1-1: config 0 descriptor?? [ 122.010805][ T5741] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 122.165150][ T5741] usb 3-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 122.166394][ T5741] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.169760][ T5741] usb 3-1: config 0 descriptor?? [ 122.396990][ T5741] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 122.490221][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 122.614623][ T5741] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 122.614652][ T5741] [drm] Initialized udl on minor 1 [ 122.650203][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 122.652824][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 122.652881][ T10] usb 2-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 122.654268][ T10] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 122.654298][ T10] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 122.654323][ T10] usb 2-1: config 14 has no interface number 0 [ 122.654343][ T10] usb 2-1: config 14 has no interface number 1 [ 122.654416][ T10] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 122.654445][ T10] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 122.654475][ T10] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 122.654507][ T10] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 122.654539][ T10] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 122.654571][ T10] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.654602][ T10] usb 2-1: config 14 interface 57 has no altsetting 0 [ 122.654624][ T10] usb 2-1: config 14 interface 228 has no altsetting 0 [ 122.657840][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.657869][ T10] usb 2-1: Product: syz [ 122.657887][ T10] usb 2-1: Manufacturer: syz [ 122.657905][ T10] usb 2-1: SerialNumber: syz [ 122.865493][ T6269] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 122.865524][ T6269] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 122.867732][ T6269] vhci_hcd vhci_hcd.0: Device attached [ 122.889402][ T6269] vhci_hcd vhci_hcd.0: port 0 already used [ 122.903666][ T6274] vhci_hcd: connection closed [ 122.906810][ T102] vhci_hcd vhci_hcd.2: stop threads [ 122.906832][ T102] vhci_hcd vhci_hcd.2: release socket [ 122.906864][ T102] vhci_hcd vhci_hcd.2: disconnect device [ 123.241961][ T10] legousbtower 2-1:14.57: interrupt endpoints not found [ 123.522335][ T5636] Bluetooth: hci3: command 0x0c1a tx timeout [ 123.649525][ T10] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 123.676022][ T10] legousbtower 2-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 123.727663][ T6285] bond0: (slave bond_slave_0): Error: Device is in use and cannot be enslaved [ 123.727694][ T6285] bond0: option slaves: unable to set because the bond device is up [ 124.104060][ T5709] usb 1-1: USB disconnect, device number 7 [ 124.414264][ C0] usb 2-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 124.415429][ T11] usb 2-1: USB disconnect, device number 5 [ 124.435945][ T11] legousbtower 2-1:14.228: LEGO USB Tower #-160 now disconnected [ 125.075664][ T6314] FAULT_INJECTION: forcing a failure. [ 125.075664][ T6314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.075693][ T6314] CPU: 1 UID: 0 PID: 6314 Comm: syz.1.157 Not tainted syzkaller #0 PREEMPT(full) [ 125.075710][ T6314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 125.075720][ T6314] Call Trace: [ 125.075745][ T6314] [ 125.075754][ T6314] dump_stack_lvl+0xe8/0x150 [ 125.075793][ T6314] should_fail_ex+0x3eb/0x540 [ 125.075829][ T6314] _copy_from_user+0x2d/0xb0 [ 125.075864][ T6314] do_handle_open+0x56e/0xb10 [ 125.075898][ T6314] ? __pfx_do_handle_open+0x10/0x10 [ 125.075919][ T6314] ? ksys_write+0x242/0x270 [ 125.075940][ T6314] ? __pfx_ksys_write+0x10/0x10 [ 125.075968][ T6314] do_syscall_64+0x166/0x520 [ 125.075990][ T6314] ? trace_irq_disable+0x3b/0x140 [ 125.076009][ T6314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.076025][ T6314] ? clear_bhb_loop+0x70/0xc0 [ 125.076044][ T6314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.076060][ T6314] RIP: 0033:0x7fcea8b9f559 [ 125.076075][ T6314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.076087][ T6314] RSP: 002b:00007fcea99f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 125.076103][ T6314] RAX: ffffffffffffffda RBX: 00007fcea8e25fa0 RCX: 00007fcea8b9f559 [ 125.076114][ T6314] RDX: 0000000000101c40 RSI: 0000200000000900 RDI: 000000000000000b [ 125.076124][ T6314] RBP: 00007fcea99f6090 R08: 0000000000000000 R09: 0000000000000000 [ 125.076134][ T6314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.076143][ T6314] R13: 00007fcea8e26038 R14: 00007fcea8e25fa0 R15: 00007ffc306f9bf8 [ 125.076167][ T6314] [ 125.520328][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 125.671187][ T10] usb 2-1: New USB device found: idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 125.672621][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 125.672662][ T10] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 125.675498][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.675538][ T10] usb 2-1: Product: syz [ 125.675554][ T10] usb 2-1: Manufacturer: syz [ 125.675568][ T10] usb 2-1: SerialNumber: syz [ 125.679310][ T10] usb 2-1: config 0 descriptor?? [ 126.911330][ T6318] netlink: 20 bytes leftover after parsing attributes in process `syz.3.159'. [ 126.911679][ T6318] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 127.290306][ T11] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 127.441842][ T11] usb 4-1: Using ep0 maxpacket: 32 [ 127.445758][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 127.445817][ T11] usb 4-1: New USB device found: idVendor=045e, idProduct=02bf, bcdDevice=b7.fb [ 127.446948][ T11] usb 4-1: config 3 has an invalid interface number: 253 but max is 0 [ 127.446974][ T11] usb 4-1: config 3 has no interface number 0 [ 127.447005][ T11] usb 4-1: config 3 interface 253 has no altsetting 0 [ 127.449341][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.449367][ T11] usb 4-1: Product: syz [ 127.449382][ T11] usb 4-1: Manufacturer: syz [ 127.449398][ T11] usb 4-1: SerialNumber: syz [ 127.515799][ T6303] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 127.685293][ T5741] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 127.690019][ T5741] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 127.709445][ T6324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.711300][ T6324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.745874][ T5741] usb 3-1: USB disconnect, device number 9 [ 127.759085][ T5709] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 127.779464][ T5709] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 127.859723][ T11] gspca_main: kinect-2.14.0 probing 045e:02bf [ 127.887845][ T11] usb 4-1: USB disconnect, device number 14 [ 127.991759][ T6335] FAULT_INJECTION: forcing a failure. [ 127.991759][ T6335] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 127.991791][ T6335] CPU: 0 UID: 0 PID: 6335 Comm: syz.0.163 Not tainted syzkaller #0 PREEMPT(full) [ 127.991816][ T6335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 127.991828][ T6335] Call Trace: [ 127.991837][ T6335] [ 127.991846][ T6335] dump_stack_lvl+0xe8/0x150 [ 127.991885][ T6335] should_fail_ex+0x3eb/0x540 [ 127.991923][ T6335] _copy_to_user+0x31/0xb0 [ 127.991960][ T6335] simple_read_from_buffer+0xe1/0x170 [ 127.991992][ T6335] proc_fail_nth_read+0x1bb/0x230 [ 127.992030][ T6335] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.992068][ T6335] ? rw_verify_area+0x24a/0x4c0 [ 127.992096][ T6335] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 127.992129][ T6335] vfs_read+0x213/0xa80 [ 127.992162][ T6335] ? __pfx___mutex_lock+0x10/0x10 [ 127.992195][ T6335] ? __pfx_vfs_read+0x10/0x10 [ 127.992224][ T6335] ? __fget_files+0x2a/0x420 [ 127.992248][ T6335] ? __fget_files+0x3a2/0x420 [ 127.992272][ T6335] ? __fget_files+0x2a/0x420 [ 127.992302][ T6335] ? fdget+0x1ac/0x250 [ 127.992335][ T6335] ksys_read+0x150/0x270 [ 127.992365][ T6335] ? __pfx_ksys_read+0x10/0x10 [ 127.992415][ T6335] do_syscall_64+0x166/0x520 [ 127.992445][ T6335] ? trace_irq_disable+0x3b/0x140 [ 127.992473][ T6335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.992496][ T6335] ? clear_bhb_loop+0x70/0xc0 [ 127.992524][ T6335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.992547][ T6335] RIP: 0033:0x7f391cb5fd8e [ 127.992568][ T6335] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.992586][ T6335] RSP: 002b:00007f391da23fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 127.992608][ T6335] RAX: ffffffffffffffda RBX: 00007f391da246c0 RCX: 00007f391cb5fd8e [ 127.992624][ T6335] RDX: 000000000000000f RSI: 00007f391da240a0 RDI: 0000000000000003 [ 127.992638][ T6335] RBP: 00007f391da24090 R08: 0000000000000000 R09: 0000000000000000 [ 127.992651][ T6335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.992663][ T6335] R13: 00007f391ce26128 R14: 00007f391ce26090 R15: 00007fffaf29c638 [ 127.992700][ T6335] [ 128.313857][ T5800] usb 2-1: USB disconnect, device number 6 [ 128.476937][ T6341] FAULT_INJECTION: forcing a failure. [ 128.476937][ T6341] name failslab, interval 1, probability 0, space 0, times 0 [ 128.476975][ T6341] CPU: 1 UID: 0 PID: 6341 Comm: syz.3.167 Not tainted syzkaller #0 PREEMPT(full) [ 128.477002][ T6341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 128.477016][ T6341] Call Trace: [ 128.477024][ T6341] [ 128.477034][ T6341] dump_stack_lvl+0xe8/0x150 [ 128.477075][ T6341] should_fail_ex+0x3eb/0x540 [ 128.477114][ T6341] should_failslab+0xa8/0x100 [ 128.477149][ T6341] __kmalloc_noprof+0xf9/0x710 [ 128.477175][ T6341] ? ceph_monc_init+0x13d/0xae0 [ 128.477200][ T6341] ? ceph_monc_init+0x13d/0xae0 [ 128.477232][ T6341] ceph_monc_init+0x13d/0xae0 [ 128.477269][ T6341] ceph_create_client+0x225/0x310 [ 128.477303][ T6341] ceph_get_tree+0x1ca/0x1a80 [ 128.477330][ T6341] ? apparmor_capable+0x126/0x170 [ 128.477361][ T6341] vfs_get_tree+0x92/0x2a0 [ 128.477394][ T6341] vfs_cmd_create+0xa2/0x200 [ 128.477433][ T6341] __se_sys_fsconfig+0x6b9/0x810 [ 128.477476][ T6341] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 128.477548][ T6341] ? rcu_is_watching+0x16/0xb0 [ 128.477630][ T6341] ? __x64_sys_fsconfig+0x20/0xc0 [ 128.477681][ T6341] do_syscall_64+0x166/0x520 [ 128.477725][ T6341] ? trace_irq_disable+0x3b/0x140 [ 128.477753][ T6341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.477777][ T6341] ? clear_bhb_loop+0x70/0xc0 [ 128.477806][ T6341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.477835][ T6341] RIP: 0033:0x7fe3c9d9f559 [ 128.477857][ T6341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.477877][ T6341] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 128.477909][ T6341] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 128.477933][ T6341] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 128.477947][ T6341] RBP: 00007fe3c9e36b20 R08: 0004000000000000 R09: 0000000000000000 [ 128.477962][ T6341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.477976][ T6341] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 128.478013][ T6341] [ 128.483580][ T11] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 128.682430][ T11] usb 3-1: Using ep0 maxpacket: 8 [ 128.684519][ T11] usb 3-1: New USB device found: idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 128.695180][ T11] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 128.695254][ T11] usb 3-1: config 179 has no interface number 0 [ 128.695362][ T11] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 128.695455][ T11] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 128.695543][ T11] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 128.695614][ T11] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 128.695687][ T11] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 128.695788][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.765812][ T6337] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 128.988965][ T6350] loop5: detected capacity change from 0 to 7 [ 129.022354][ T6350] Dev loop5: unable to read RDB block 7 [ 129.022406][ T6350] loop5: unable to read partition table [ 129.022785][ T6350] loop5: partition table beyond EOD, truncated [ 129.022822][ T6350] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 129.201444][ T5741] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 129.264590][ T6354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.269315][ T6354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.348194][ T916] usb 3-1: USB disconnect, device number 10 [ 129.348194][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 129.348247][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 129.375117][ T5741] usb 4-1: New USB device found: idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 129.398697][ T5741] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.398739][ T5741] usb 4-1: Product: syz [ 129.398756][ T5741] usb 4-1: Manufacturer: syz [ 129.398771][ T5741] usb 4-1: SerialNumber: syz [ 129.429541][ T5741] usb 4-1: config 0 descriptor?? [ 129.442675][ T5741] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 129.546544][ T6359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.550967][ T6359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.652858][ T6362] sg_write: process 99 (syz.0.175) changed security contexts after opening file descriptor, this is not allowed. [ 129.750239][ T11] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 129.849041][ T6364] syz.0.176 (6364) used greatest stack depth: 12224 bytes left [ 129.903978][ T6367] FAULT_INJECTION: forcing a failure. [ 129.903978][ T6367] name failslab, interval 1, probability 0, space 0, times 0 [ 129.904017][ T6367] CPU: 1 UID: 0 PID: 6367 Comm: syz.0.177 Not tainted syzkaller #0 PREEMPT(full) [ 129.904041][ T6367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 129.904055][ T6367] Call Trace: [ 129.904065][ T6367] [ 129.904074][ T6367] dump_stack_lvl+0xe8/0x150 [ 129.904116][ T6367] should_fail_ex+0x3eb/0x540 [ 129.904159][ T6367] should_failslab+0xa8/0x100 [ 129.904194][ T6367] __kmalloc_noprof+0xf9/0x710 [ 129.904217][ T6367] ? rcu_is_watching+0x16/0xb0 [ 129.904247][ T6367] ? tomoyo_realpath_from_path+0xef/0x640 [ 129.904281][ T6367] ? tomoyo_realpath_from_path+0xef/0x640 [ 129.904322][ T6367] tomoyo_realpath_from_path+0xef/0x640 [ 129.904369][ T6367] ? tomoyo_path_number_perm+0x219/0x5f0 [ 129.904397][ T6367] tomoyo_path_number_perm+0x246/0x5f0 [ 129.904428][ T6367] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 129.904453][ T6367] ? __lock_acquire+0x747/0x2de0 [ 129.904523][ T6367] ? __fget_files+0x2a/0x420 [ 129.904553][ T6367] ? __fget_files+0x2a/0x420 [ 129.904579][ T6367] ? __fget_files+0x2a/0x420 [ 129.904610][ T6367] security_file_ioctl+0xc3/0x2a0 [ 129.904640][ T6367] __se_sys_ioctl+0x47/0x170 [ 129.904676][ T6367] do_syscall_64+0x166/0x520 [ 129.904706][ T6367] ? trace_irq_disable+0x3b/0x140 [ 129.904743][ T6367] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.904766][ T6367] ? clear_bhb_loop+0x70/0xc0 [ 129.904794][ T6367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.904816][ T6367] RIP: 0033:0x7f391cb9f559 [ 129.904837][ T6367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.904855][ T6367] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 129.904879][ T6367] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 129.904896][ T6367] RDX: 0000200000000300 RSI: 00000000c020660b RDI: 0000000000000003 [ 129.904910][ T6367] RBP: 00007f391da45090 R08: 0000000000000000 R09: 0000000000000000 [ 129.904924][ T6367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.904937][ T6367] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 129.904973][ T6367] [ 129.905085][ T6367] ERROR: Out of memory at tomoyo_realpath_from_path. [ 130.232337][ T6370] FAULT_INJECTION: forcing a failure. [ 130.232337][ T6370] name failslab, interval 1, probability 0, space 0, times 0 [ 130.232371][ T6370] CPU: 1 UID: 0 PID: 6370 Comm: syz.2.178 Not tainted syzkaller #0 PREEMPT(full) [ 130.232396][ T6370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 130.232409][ T6370] Call Trace: [ 130.232417][ T6370] [ 130.232427][ T6370] dump_stack_lvl+0xe8/0x150 [ 130.232472][ T6370] should_fail_ex+0x3eb/0x540 [ 130.232511][ T6370] should_failslab+0xa8/0x100 [ 130.232545][ T6370] __kmalloc_cache_noprof+0x9e/0x600 [ 130.232574][ T6370] ? ceph_auth_init+0x5d/0x350 [ 130.232599][ T6370] ? ceph_auth_init+0x5d/0x350 [ 130.232633][ T6370] ceph_auth_init+0x5d/0x350 [ 130.232665][ T6370] ceph_monc_init+0x4d1/0xae0 [ 130.232704][ T6370] ceph_create_client+0x225/0x310 [ 130.232738][ T6370] ceph_get_tree+0x1ca/0x1a80 [ 130.232766][ T6370] ? apparmor_capable+0x126/0x170 [ 130.232798][ T6370] vfs_get_tree+0x92/0x2a0 [ 130.232831][ T6370] vfs_cmd_create+0xa2/0x200 [ 130.232871][ T6370] __se_sys_fsconfig+0x6b9/0x810 [ 130.232913][ T6370] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 130.232951][ T6370] ? rcu_is_watching+0x16/0xb0 [ 130.232992][ T6370] ? __x64_sys_fsconfig+0x20/0xc0 [ 130.233031][ T6370] do_syscall_64+0x166/0x520 [ 130.233062][ T6370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.233095][ T6370] ? clear_bhb_loop+0x70/0xc0 [ 130.233125][ T6370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.233148][ T6370] RIP: 0033:0x7f24f8d9f559 [ 130.233170][ T6370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.233189][ T6370] RSP: 002b:00007f24f9bea028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 130.233214][ T6370] RAX: ffffffffffffffda RBX: 00007f24f9025fa0 RCX: 00007f24f8d9f559 [ 130.233231][ T6370] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 130.233245][ T6370] RBP: 00007f24f8e36b20 R08: 0004000000000000 R09: 0000000000000000 [ 130.233261][ T6370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 130.233275][ T6370] R13: 00007f24f9026038 R14: 00007f24f9025fa0 R15: 00007ffcbcfe37e8 [ 130.233312][ T6370] [ 130.561604][ T6376] FAULT_INJECTION: forcing a failure. [ 130.561604][ T6376] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 130.561637][ T6376] CPU: 1 UID: 0 PID: 6376 Comm: syz.0.181 Not tainted syzkaller #0 PREEMPT(full) [ 130.561660][ T6376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 130.561673][ T6376] Call Trace: [ 130.561681][ T6376] [ 130.561690][ T6376] dump_stack_lvl+0xe8/0x150 [ 130.561732][ T6376] should_fail_ex+0x3eb/0x540 [ 130.561771][ T6376] _copy_from_user+0x2d/0xb0 [ 130.561806][ T6376] dm_ctl_ioctl+0x14c/0xe10 [ 130.561840][ T6376] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 130.561882][ T6376] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 130.561948][ T6376] ? __fget_files+0x2a/0x420 [ 130.561979][ T6376] ? bpf_lsm_file_ioctl+0x9/0x20 [ 130.562007][ T6376] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 130.562039][ T6376] __se_sys_ioctl+0xfc/0x170 [ 130.562073][ T6376] do_syscall_64+0x166/0x520 [ 130.562103][ T6376] ? trace_irq_disable+0x3b/0x140 [ 130.562129][ T6376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.562152][ T6376] ? clear_bhb_loop+0x70/0xc0 [ 130.562180][ T6376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.562203][ T6376] RIP: 0033:0x7f391cb9f559 [ 130.562223][ T6376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.562242][ T6376] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 130.562273][ T6376] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 130.562289][ T6376] RDX: 0000200000000a00 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 130.562303][ T6376] RBP: 00007f391da45090 R08: 0000000000000000 R09: 0000000000000000 [ 130.562316][ T6376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.562327][ T6376] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 130.562361][ T6376] [ 130.860792][ T6381] ieee802154 phy0 wpan0: encryption failed: -22 [ 130.889981][ T5741] gspca_m5602: Failed to find a sensor [ 130.889998][ T5741] ALi m5602 4-1:0.0: ALi m5602 webcam failed [ 130.911201][ T5741] usb 4-1: USB disconnect, device number 15 [ 130.927129][ T5655] udevd[5655]: setting owner of /dev/bus/usb/004/015 to uid=0, gid=0 failed: No such file or directory [ 131.131183][ T5800] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 131.292499][ T5800] usb 1-1: unable to get BOS descriptor or descriptor too short [ 131.292554][ T5800] usb 1-1: New USB device found: idVendor=07ca, idProduct=2835, bcdDevice=eb.e7 [ 131.293948][ T5800] usb 1-1: config index 0 descriptor too short (expected 61732, got 36) [ 131.293974][ T5800] usb 1-1: config 162 has too many interfaces: 225, using maximum allowed: 32 [ 131.293994][ T5800] usb 1-1: config 162 has an invalid descriptor of length 246, skipping remainder of the config [ 131.294040][ T5800] usb 1-1: config 162 has 0 interfaces, different from the descriptor's value: 225 [ 131.297296][ T5800] usb 1-1: string descriptor 0 read error: -22 [ 131.297436][ T5800] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.349455][ T32] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 131.464550][ T6392] FAULT_INJECTION: forcing a failure. [ 131.464550][ T6392] name failslab, interval 1, probability 0, space 0, times 0 [ 131.464598][ T6392] CPU: 0 UID: 0 PID: 6392 Comm: syz.3.186 Not tainted syzkaller #0 PREEMPT(full) [ 131.464623][ T6392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 131.464636][ T6392] Call Trace: [ 131.464645][ T6392] [ 131.464666][ T6392] dump_stack_lvl+0xe8/0x150 [ 131.464694][ T6392] should_fail_ex+0x3eb/0x540 [ 131.464722][ T6392] should_failslab+0xa8/0x100 [ 131.464746][ T6392] __kmalloc_cache_node_noprof+0xa5/0x620 [ 131.464767][ T6392] ? __get_vm_area_node+0x195/0x330 [ 131.464790][ T6392] ? __get_vm_area_node+0x195/0x330 [ 131.464819][ T6392] __get_vm_area_node+0x195/0x330 [ 131.464847][ T6392] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 131.464873][ T6392] ? copy_process+0x7ea/0x44b0 [ 131.464902][ T6392] ? percpu_ref_get_many+0x19/0x140 [ 131.464932][ T6392] ? __memcg_slab_post_alloc_hook+0x46f/0xdb0 [ 131.464962][ T6392] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 131.464988][ T6392] ? dup_task_struct+0x52/0xa00 [ 131.465005][ T6392] ? trace_kmem_cache_alloc+0x29/0xe0 [ 131.465022][ T6392] ? memcpy_and_pad+0x48/0x80 [ 131.465042][ T6392] __vmalloc_node_noprof+0xc2/0x100 [ 131.465068][ T6392] ? copy_process+0x7ea/0x44b0 [ 131.465086][ T6392] ? copy_process+0x7ea/0x44b0 [ 131.465107][ T6392] dup_task_struct+0x2c6/0xa00 [ 131.465132][ T6392] copy_process+0x7ea/0x44b0 [ 131.465174][ T6392] ? rcu_is_watching+0x16/0xb0 [ 131.465199][ T6392] ? __pfx_copy_process+0x10/0x10 [ 131.465225][ T6392] ? mutex_init_lockdep+0xdf/0x110 [ 131.465248][ T6392] vhost_task_create+0x1f9/0x380 [ 131.465266][ T6392] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 131.465285][ T6392] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 131.465306][ T6392] ? __pfx_vhost_task_create+0x10/0x10 [ 131.465321][ T6392] ? register_lock_class+0x31/0x2e0 [ 131.465344][ T6392] ? __pfx_vhost_task_fn+0x10/0x10 [ 131.465368][ T6392] ? kasan_quarantine_put+0xbb/0x1f0 [ 131.465393][ T6392] kvm_mmu_post_init_vm+0x147/0x2b0 [ 131.465417][ T6392] kvm_arch_vcpu_ioctl_run+0x79/0x18b0 [ 131.465449][ T6392] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 131.465471][ T6392] kvm_vcpu_ioctl+0xa61/0xfd0 [ 131.465492][ T6392] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 131.465524][ T6392] ? __fget_files+0x2a/0x420 [ 131.465544][ T6392] ? __fget_files+0x2a/0x420 [ 131.465562][ T6392] ? __fget_files+0x2a/0x420 [ 131.465583][ T6392] ? bpf_lsm_file_ioctl+0x9/0x20 [ 131.465604][ T6392] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 131.465621][ T6392] __se_sys_ioctl+0xfc/0x170 [ 131.465646][ T6392] do_syscall_64+0x166/0x520 [ 131.465691][ T6392] ? trace_irq_disable+0x3b/0x140 [ 131.465719][ T6392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.465742][ T6392] ? clear_bhb_loop+0x70/0xc0 [ 131.465769][ T6392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.465792][ T6392] RIP: 0033:0x7fe3c9d9f559 [ 131.465813][ T6392] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.465833][ T6392] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 131.465850][ T6392] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 131.465861][ T6392] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 131.465870][ T6392] RBP: 00007fe3cac81090 R08: 0000000000000000 R09: 0000000000000000 [ 131.465879][ T6392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.465888][ T6392] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 131.465913][ T6392] [ 131.466082][ T6392] syz.3.186: vmalloc error: size 32768, align 0x8000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 131.466253][ T6392] CPU: 0 UID: 0 PID: 6392 Comm: syz.3.186 Not tainted syzkaller #0 PREEMPT(full) [ 131.466270][ T6392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 131.466279][ T6392] Call Trace: [ 131.466285][ T6392] [ 131.466291][ T6392] dump_stack_lvl+0xe8/0x150 [ 131.466316][ T6392] warn_alloc+0x24d/0x270 [ 131.466334][ T6392] ? __kasan_kmalloc+0x22/0xb0 [ 131.466356][ T6392] ? __pfx_warn_alloc+0x10/0x10 [ 131.466375][ T6392] ? __get_vm_area_node+0x195/0x330 [ 131.466404][ T6392] ? __get_vm_area_node+0x2f5/0x330 [ 131.466433][ T6392] __vmalloc_node_range_noprof+0x396/0x16f0 [ 131.466468][ T6392] ? percpu_ref_get_many+0x19/0x140 [ 131.466498][ T6392] ? __memcg_slab_post_alloc_hook+0x46f/0xdb0 [ 131.466527][ T6392] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 131.466552][ T6392] ? dup_task_struct+0x52/0xa00 [ 131.466570][ T6392] ? trace_kmem_cache_alloc+0x29/0xe0 [ 131.466587][ T6392] ? memcpy_and_pad+0x48/0x80 [ 131.466607][ T6392] __vmalloc_node_noprof+0xc2/0x100 [ 131.466633][ T6392] ? copy_process+0x7ea/0x44b0 [ 131.466657][ T6392] ? copy_process+0x7ea/0x44b0 [ 131.466678][ T6392] dup_task_struct+0x2c6/0xa00 [ 131.466702][ T6392] copy_process+0x7ea/0x44b0 [ 131.466741][ T6392] ? rcu_is_watching+0x16/0xb0 [ 131.466765][ T6392] ? __pfx_copy_process+0x10/0x10 [ 131.466790][ T6392] ? mutex_init_lockdep+0xdf/0x110 [ 131.466812][ T6392] vhost_task_create+0x1f9/0x380 [ 131.466829][ T6392] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 131.466872][ T6392] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 131.466901][ T6392] ? __pfx_vhost_task_create+0x10/0x10 [ 131.466923][ T6392] ? register_lock_class+0x31/0x2e0 [ 131.466960][ T6392] ? __pfx_vhost_task_fn+0x10/0x10 [ 131.466984][ T6392] ? kasan_quarantine_put+0xbb/0x1f0 [ 131.467009][ T6392] kvm_mmu_post_init_vm+0x147/0x2b0 [ 131.467033][ T6392] kvm_arch_vcpu_ioctl_run+0x79/0x18b0 [ 131.467064][ T6392] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 131.467086][ T6392] kvm_vcpu_ioctl+0xa61/0xfd0 [ 131.467107][ T6392] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 131.467139][ T6392] ? __fget_files+0x2a/0x420 [ 131.467161][ T6392] ? __fget_files+0x2a/0x420 [ 131.467179][ T6392] ? __fget_files+0x2a/0x420 [ 131.467199][ T6392] ? bpf_lsm_file_ioctl+0x9/0x20 [ 131.467219][ T6392] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 131.467236][ T6392] __se_sys_ioctl+0xfc/0x170 [ 131.467260][ T6392] do_syscall_64+0x166/0x520 [ 131.467282][ T6392] ? trace_irq_disable+0x3b/0x140 [ 131.467301][ T6392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.467317][ T6392] ? clear_bhb_loop+0x70/0xc0 [ 131.467337][ T6392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.467352][ T6392] RIP: 0033:0x7fe3c9d9f559 [ 131.467365][ T6392] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.467377][ T6392] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 131.467392][ T6392] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 131.467403][ T6392] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 131.467413][ T6392] RBP: 00007fe3cac81090 R08: 0000000000000000 R09: 0000000000000000 [ 131.467422][ T6392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.467431][ T6392] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 131.467455][ T6392] [ 131.467486][ T6392] Mem-Info: [ 131.467493][ T6392] active_anon:5698 inactive_anon:0 isolated_anon:0 [ 131.467493][ T6392] active_file:0 inactive_file:55240 isolated_file:0 [ 131.467493][ T6392] unevictable:0 dirty:165 writeback:0 [ 131.467493][ T6392] slab_reclaimable:10958 slab_unreclaimable:93305 [ 131.467493][ T6392] mapped:25360 shmem:521 pagetables:1175 [ 131.467493][ T6392] sec_pagetables:0 bounce:0 [ 131.467493][ T6392] kernel_misc_reclaimable:0 [ 131.467493][ T6392] free:1325192 free_pcp:10358 free_cma:0 [ 131.467536][ T6392] Node 0 active_anon:22792kB inactive_anon:0kB active_file:0kB inactive_file:220772kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:101440kB dirty:656kB writeback:0kB shmem:2084kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12356kB pagetables:4540kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 131.467578][ T6392] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:188kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 131.467635][ T6392] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 131.467685][ T6392] lowmem_reserve[]: 0 2460 2461 2461 2461 [ 131.467713][ T6392] Node 0 DMA32 free:1338448kB boost:0kB min:33916kB low:42392kB high:50868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22792kB inactive_anon:0kB active_file:0kB inactive_file:220772kB unevictable:0kB writepending:656kB zspages:0kB present:3129332kB managed:2519536kB mlocked:0kB bounce:0kB free_pcp:40928kB local_pcp:19348kB free_cma:0kB [ 131.467776][ T6392] lowmem_reserve[]: 0 0 1 1 1 [ 131.467803][ T6392] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1320kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 131.467844][ T6392] lowmem_reserve[]: 0 0 0 0 0 [ 131.467871][ T6392] Node 1 Normal free:3946960kB boost:0kB min:55968kB low:69960kB high:83952kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:188kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:500kB local_pcp:500kB free_cma:0kB [ 131.467932][ T6392] lowmem_reserve[]: 0 0 0 0 0 [ 131.467959][ T6392] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 131.468134][ T6392] Node 0 DMA32: 1020*4kB (UME) 488*8kB (UM) 314*16kB (UME) 284*32kB (UME) 213*64kB (UME) 143*128kB (UME) 79*256kB (UME) 29*512kB (UM) 20*1024kB (UME) 10*2048kB (UME) 295*4096kB (UM) = 1338384kB [ 131.468278][ T6392] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 131.468371][ T6392] Node 1 Normal: 2*4kB (M) 1*8kB (M) 2*16kB (UM) 1*32kB (M) 6*64kB (UM) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 1*2048kB (U) 962*4096kB (M) = 3946960kB [ 131.468510][ T6392] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 131.468523][ T6392] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 131.468534][ T6392] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 131.468546][ T6392] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 131.468558][ T6392] 55757 total pagecache pages [ 131.468568][ T6392] 0 pages in swap cache [ 131.468574][ T6392] Free swap = 124996kB [ 131.468579][ T6392] Total swap = 124996kB [ 131.468585][ T6392] 2097051 pages RAM [ 131.468591][ T6392] 0 pages HighMem/MovableOnly [ 131.468596][ T6392] 435221 pages reserved [ 131.468601][ T6392] 0 pages cma reserved [ 131.613194][ T32] usb 3-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 131.653465][ T32] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 131.653503][ T32] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 131.653531][ T32] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 131.653554][ T32] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 26 [ 131.691856][ T32] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 131.691885][ T32] usb 3-1: SerialNumber: syz [ 132.054102][ T6388] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 132.135358][ T6388] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 132.278999][ T32] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 132.438782][ T6389] netlink: 'syz.2.185': attribute type 10 has an invalid length. [ 132.604008][ T32] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -12 [ 132.720039][ T6389] syz_tun: entered promiscuous mode [ 132.822643][ T6403] FAULT_INJECTION: forcing a failure. [ 132.822643][ T6403] name failslab, interval 1, probability 0, space 0, times 0 [ 132.822678][ T6403] CPU: 1 UID: 0 PID: 6403 Comm: syz.3.188 Not tainted syzkaller #0 PREEMPT(full) [ 132.822703][ T6403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 132.822715][ T6403] Call Trace: [ 132.822724][ T6403] [ 132.822733][ T6403] dump_stack_lvl+0xe8/0x150 [ 132.822771][ T6403] should_fail_ex+0x3eb/0x540 [ 132.822808][ T6403] ? __alloc_skb+0x1db/0x7a0 [ 132.822831][ T6403] should_failslab+0xa8/0x100 [ 132.822864][ T6403] ? __alloc_skb+0x1db/0x7a0 [ 132.822886][ T6403] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 132.822911][ T6403] ? __alloc_skb+0x18d/0x7a0 [ 132.822936][ T6403] ? __alloc_skb+0x1db/0x7a0 [ 132.822967][ T6403] __alloc_skb+0x1db/0x7a0 [ 132.822997][ T6403] netlink_dump+0x1e7/0xee0 [ 132.823031][ T6403] ? __netlink_lookup+0xe6/0x8f0 [ 132.823071][ T6403] ? __pfx_netlink_dump+0x10/0x10 [ 132.823118][ T6403] ? netlink_lookup+0x30/0x200 [ 132.823151][ T6403] ? netlink_lookup+0x30/0x200 [ 132.823192][ T6403] __netlink_dump_start+0x589/0x7b0 [ 132.823237][ T6403] rtnetlink_rcv_msg+0xa48/0xc00 [ 132.823267][ T6403] ? __pfx_rtnl_dump_all+0x10/0x10 [ 132.823294][ T6403] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 132.823320][ T6403] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 132.823355][ T6403] ? __pfx_rtnl_dumpit+0x10/0x10 [ 132.823380][ T6403] ? __pfx_rtnl_dump_all+0x10/0x10 [ 132.823410][ T6403] ? __asan_memcpy+0x40/0x70 [ 132.823443][ T6403] netlink_rcv_skb+0x226/0x4a0 [ 132.823480][ T6403] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 132.823509][ T6403] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 132.823559][ T6403] ? netlink_deliver_tap+0x2e/0x1b0 [ 132.823580][ T6403] ? netlink_deliver_tap+0x2e/0x1b0 [ 132.823609][ T6403] netlink_unicast+0x8ef/0xa80 [ 132.823658][ T6403] netlink_sendmsg+0x7f0/0xb20 [ 132.823689][ T6403] ? __pfx_netlink_sendmsg+0x10/0x10 [ 132.823715][ T6403] ? aa_sock_msg_perm+0x144/0x210 [ 132.823750][ T6403] ? apparmor_socket_sendmsg+0x98/0x360 [ 132.823776][ T6403] ? lock_acquire+0x115/0x350 [ 132.823801][ T6403] ? __pfx_netlink_sendmsg+0x10/0x10 [ 132.823822][ T6403] sock_sendmsg_nosec+0x14e/0x190 [ 132.823859][ T6403] sock_write_iter+0x2de/0x3e0 [ 132.823894][ T6403] ? __pfx_sock_write_iter+0x10/0x10 [ 132.823934][ T6403] ? bpf_lsm_file_permission+0x9/0x20 [ 132.823960][ T6403] ? security_file_permission+0x75/0x260 [ 132.823996][ T6403] vfs_write+0x612/0xba0 [ 132.824033][ T6403] ? __pfx_vfs_write+0x10/0x10 [ 132.824065][ T6403] ? __fget_files+0x3a2/0x420 [ 132.824088][ T6403] ? __fget_files+0x2a/0x420 [ 132.824117][ T6403] ? fdget+0x1ac/0x250 [ 132.824149][ T6403] ksys_write+0x150/0x270 [ 132.824179][ T6403] ? __pfx_ksys_write+0x10/0x10 [ 132.824217][ T6403] do_syscall_64+0x166/0x520 [ 132.824247][ T6403] ? trace_irq_disable+0x3b/0x140 [ 132.824275][ T6403] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.824298][ T6403] ? clear_bhb_loop+0x70/0xc0 [ 132.824326][ T6403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.824357][ T6403] RIP: 0033:0x7fe3c9d9f559 [ 132.824378][ T6403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.824396][ T6403] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 132.824421][ T6403] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 132.824437][ T6403] RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000003 [ 132.824451][ T6403] RBP: 00007fe3cac81090 R08: 0000000000000000 R09: 0000000000000000 [ 132.824465][ T6403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 132.824478][ T6403] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 132.824515][ T6403] [ 133.043741][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.043803][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.044414][ T6389] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 133.448059][ T5741] usb 3-1: USB disconnect, device number 11 [ 133.519834][ T6411] FAULT_INJECTION: forcing a failure. [ 133.519834][ T6411] name failslab, interval 1, probability 0, space 0, times 0 [ 133.519883][ T6411] CPU: 1 UID: 0 PID: 6411 Comm: syz.3.191 Not tainted syzkaller #0 PREEMPT(full) [ 133.519906][ T6411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 133.519918][ T6411] Call Trace: [ 133.519926][ T6411] [ 133.519934][ T6411] dump_stack_lvl+0xe8/0x150 [ 133.519972][ T6411] should_fail_ex+0x3eb/0x540 [ 133.520010][ T6411] should_failslab+0xa8/0x100 [ 133.520041][ T6411] ? mas_alloc_nodes+0x291/0x350 [ 133.520072][ T6411] kmem_cache_alloc_noprof+0x9c/0x600 [ 133.520100][ T6411] ? mas_alloc_nodes+0x291/0x350 [ 133.520137][ T6411] mas_alloc_nodes+0x291/0x350 [ 133.520172][ T6411] mas_preallocate+0x42a/0x840 [ 133.520202][ T6411] ? rcu_is_watching+0x16/0xb0 [ 133.520233][ T6411] ? trace_kmem_cache_alloc+0x29/0xe0 [ 133.520254][ T6411] ? __pfx_mas_preallocate+0x10/0x10 [ 133.520300][ T6411] ? __mas_set_range+0x11a/0x3a0 [ 133.520336][ T6411] __split_vma+0x3f7/0xa40 [ 133.520380][ T6411] ? __pfx___split_vma+0x10/0x10 [ 133.520421][ T6411] ? mas_find+0x6d6/0xcb0 [ 133.520458][ T6411] vms_gather_munmap_vmas+0x4e3/0x1370 [ 133.520504][ T6411] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 133.520541][ T6411] ? mas_walk+0x37e/0x490 [ 133.520582][ T6411] mmap_region+0x95a/0x2840 [ 133.520637][ T6411] ? __pfx_mmap_region+0x10/0x10 [ 133.520668][ T6411] ? lock_acquire+0x115/0x350 [ 133.520712][ T6411] ? process_measurement+0x7b2/0x1c10 [ 133.520744][ T6411] ? up_write+0x19d/0x4a0 [ 133.520778][ T6411] ? __lock_acquire+0x747/0x2de0 [ 133.520870][ T6411] ? __asan_memset+0x22/0x50 [ 133.520895][ T6411] ? process_measurement+0x14fb/0x1c10 [ 133.520946][ T6411] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 133.520982][ T6411] ? __lock_acquire+0x747/0x2de0 [ 133.521008][ T6411] ? cap_mmap_addr+0xaa/0xf0 [ 133.521035][ T6411] ? bpf_lsm_mmap_addr+0x9/0x50 [ 133.521062][ T6411] ? security_mmap_addr+0x71/0x240 [ 133.521091][ T6411] ? shmem_mapping+0xd/0x50 [ 133.521110][ T6411] ? memfd_check_seals_mmap+0xc5/0x220 [ 133.521138][ T6411] do_mmap+0xe0a/0x1300 [ 133.521167][ T6411] ? get_pid_task+0x20/0x1f0 [ 133.521198][ T6411] ? __pfx_do_mmap+0x10/0x10 [ 133.521241][ T6411] ? vm_mmap_pgoff+0x1ed/0x520 [ 133.521264][ T6411] ? down_write_killable+0x179/0x230 [ 133.521302][ T6411] ? __pfx_down_write_killable+0x10/0x10 [ 133.521337][ T6411] ? apparmor_mmap_file+0x2e7/0x390 [ 133.521376][ T6411] vm_mmap_pgoff+0x27a/0x520 [ 133.521410][ T6411] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 133.521436][ T6411] ? __fget_files+0x2a/0x420 [ 133.521463][ T6411] ? __fget_files+0x3a2/0x420 [ 133.521488][ T6411] ? __fget_files+0x2a/0x420 [ 133.521518][ T6411] ksys_mmap_pgoff+0x4dc/0x760 [ 133.521556][ T6411] do_syscall_64+0x166/0x520 [ 133.521584][ T6411] ? trace_irq_disable+0x3b/0x140 [ 133.521610][ T6411] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.521632][ T6411] ? clear_bhb_loop+0x70/0xc0 [ 133.521661][ T6411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.521684][ T6411] RIP: 0033:0x7fe3c9d9f559 [ 133.521706][ T6411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.521726][ T6411] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 133.521750][ T6411] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 133.521768][ T6411] RDX: 0000000001800004 RSI: 0000000000c00000 RDI: 0000200000002000 [ 133.521784][ T6411] RBP: 00007fe3cac81090 R08: 0000000000000003 R09: 0000000000000000 [ 133.521798][ T6411] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 133.521811][ T6411] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 133.521849][ T6411] [ 133.983264][ T5741] usb 1-1: USB disconnect, device number 8 [ 134.085017][ T6420] openvswitch: netlink: IP tunnel dst address not specified [ 134.153064][ T6422] FAULT_INJECTION: forcing a failure. [ 134.153064][ T6422] name failslab, interval 1, probability 0, space 0, times 0 [ 134.153098][ T6422] CPU: 0 UID: 0 PID: 6422 Comm: syz.3.196 Not tainted syzkaller #0 PREEMPT(full) [ 134.153124][ T6422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 134.153141][ T6422] Call Trace: [ 134.153150][ T6422] [ 134.153160][ T6422] dump_stack_lvl+0xe8/0x150 [ 134.153200][ T6422] should_fail_ex+0x3eb/0x540 [ 134.153239][ T6422] should_failslab+0xa8/0x100 [ 134.153272][ T6422] __kmalloc_cache_node_noprof+0xa5/0x620 [ 134.153302][ T6422] ? __get_vm_area_node+0x195/0x330 [ 134.153335][ T6422] ? __get_vm_area_node+0x195/0x330 [ 134.153375][ T6422] __get_vm_area_node+0x195/0x330 [ 134.153415][ T6422] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 134.153451][ T6422] ? copy_process+0x7ea/0x44b0 [ 134.153503][ T6422] ? __memcg_slab_post_alloc_hook+0x46f/0xdb0 [ 134.153547][ T6422] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 134.153583][ T6422] ? dup_task_struct+0x52/0xa00 [ 134.153608][ T6422] ? trace_kmem_cache_alloc+0x29/0xe0 [ 134.153633][ T6422] ? memcpy_and_pad+0x48/0x80 [ 134.153662][ T6422] __vmalloc_node_noprof+0xc2/0x100 [ 134.153697][ T6422] ? copy_process+0x7ea/0x44b0 [ 134.153722][ T6422] ? copy_process+0x7ea/0x44b0 [ 134.153752][ T6422] dup_task_struct+0x2c6/0xa00 [ 134.153788][ T6422] copy_process+0x7ea/0x44b0 [ 134.153854][ T6422] ? rcu_is_watching+0x16/0xb0 [ 134.153911][ T6422] ? __pfx_copy_process+0x10/0x10 [ 134.153948][ T6422] ? mutex_init_lockdep+0xdf/0x110 [ 134.153981][ T6422] vhost_task_create+0x1f9/0x380 [ 134.154006][ T6422] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 134.154033][ T6422] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 134.154061][ T6422] ? __pfx_vhost_task_create+0x10/0x10 [ 134.154083][ T6422] ? register_lock_class+0x31/0x2e0 [ 134.154116][ T6422] ? __pfx_vhost_task_fn+0x10/0x10 [ 134.154151][ T6422] ? kasan_quarantine_put+0xbb/0x1f0 [ 134.154187][ T6422] kvm_mmu_post_init_vm+0x147/0x2b0 [ 134.154221][ T6422] kvm_arch_vcpu_ioctl_run+0x79/0x18b0 [ 134.154267][ T6422] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 134.154299][ T6422] kvm_vcpu_ioctl+0xa61/0xfd0 [ 134.154330][ T6422] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 134.154377][ T6422] ? __fget_files+0x2a/0x420 [ 134.154408][ T6422] ? __fget_files+0x2a/0x420 [ 134.154433][ T6422] ? __fget_files+0x2a/0x420 [ 134.154463][ T6422] ? bpf_lsm_file_ioctl+0x9/0x20 [ 134.154491][ T6422] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 134.154516][ T6422] __se_sys_ioctl+0xfc/0x170 [ 134.154551][ T6422] do_syscall_64+0x166/0x520 [ 134.154581][ T6422] ? trace_irq_disable+0x3b/0x140 [ 134.154608][ T6422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.154632][ T6422] ? clear_bhb_loop+0x70/0xc0 [ 134.154659][ T6422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.154682][ T6422] RIP: 0033:0x7fe3c9d9f559 [ 134.154702][ T6422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.154721][ T6422] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.154746][ T6422] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 134.154763][ T6422] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 134.154777][ T6422] RBP: 00007fe3cac81090 R08: 0000000000000000 R09: 0000000000000000 [ 134.154791][ T6422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.154812][ T6422] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 134.154850][ T6422] [ 134.537353][ T6426] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 134.679686][ T6435] jffs2: notice: (6435) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 134.890619][ T916] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 134.927993][ T6444] Unsupported ieee802154 address type: 0 [ 134.954701][ T6447] overlayfs: failed to resolve './file0': -2 [ 135.061559][ T916] usb 3-1: New USB device found: idVendor=1ba6, idProduct=0001, bcdDevice=0.01 [ 135.062918][ T916] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.062974][ T916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.110592][ T916] as10x_usb: device has been detected [ 135.112152][ T916] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 135.134845][ T32] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 135.164285][ T916] usb 3-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 135.259983][ T916] as10x_usb: error during firmware upload part1 [ 135.260336][ T11] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 135.276058][ T916] Registered device Abilis Systems DVB-Titan [ 135.290933][ T32] usb 2-1: New USB device found: idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 135.292893][ T32] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 135.295110][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.295139][ T32] usb 2-1: Product: syz [ 135.295155][ T32] usb 2-1: Manufacturer: syz [ 135.295171][ T32] usb 2-1: SerialNumber: syz [ 135.298268][ T32] usb 2-1: config 0 descriptor?? [ 135.357675][ T32] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in cold state, will try to load a firmware [ 135.358797][ T32] usb 2-1: Direct firmware load for dvb-usb-digivox-02.fw failed with error -2 [ 135.358822][ T32] usb 2-1: Falling back to sysfs fallback for: dvb-usb-digivox-02.fw [ 135.422425][ T11] usb 1-1: New USB device found: idVendor=03d8, idProduct=0901, bcdDevice=1.01 [ 135.422474][ T11] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 135.426490][ T11] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 135.426531][ T11] usb 1-1: can't read configurations, error -61 [ 135.550323][ T11] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 135.702255][ T11] usb 1-1: New USB device found: idVendor=03d8, idProduct=0901, bcdDevice=1.01 [ 135.702290][ T11] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 135.703811][ T11] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 135.703839][ T11] usb 1-1: can't read configurations, error -61 [ 135.704128][ T11] usb usb1-port1: attempt power cycle [ 135.720632][ T916] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 135.880217][ T916] usb 4-1: Using ep0 maxpacket: 8 [ 135.880873][ T916] usb 4-1: New USB device found: idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 135.884575][ T916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.884601][ T916] usb 4-1: Product: syz [ 135.884618][ T916] usb 4-1: Manufacturer: syz [ 135.884632][ T916] usb 4-1: SerialNumber: syz [ 135.887484][ T916] usb 4-1: config 0 descriptor?? [ 135.908805][ T916] gspca_main: se401-2.14.0 probing 047d:5003 [ 136.040192][ T11] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 136.063405][ T11] usb 1-1: New USB device found: idVendor=03d8, idProduct=0901, bcdDevice=1.01 [ 136.063449][ T11] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 136.065053][ T11] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 136.065094][ T11] usb 1-1: can't read configurations, error -61 [ 136.191509][ T11] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 136.212819][ T11] usb 1-1: New USB device found: idVendor=03d8, idProduct=0901, bcdDevice=1.01 [ 136.212866][ T11] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 136.214448][ T11] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 136.214501][ T11] usb 1-1: can't read configurations, error -61 [ 136.215315][ T11] usb usb1-port1: unable to enumerate USB device [ 136.337282][ T6465] FAULT_INJECTION: forcing a failure. [ 136.337282][ T6465] name failslab, interval 1, probability 0, space 0, times 0 [ 136.337312][ T6465] CPU: 1 UID: 0 PID: 6465 Comm: syz.2.200 Not tainted syzkaller #0 PREEMPT(full) [ 136.337331][ T6465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 136.337345][ T6465] Call Trace: [ 136.337351][ T6465] [ 136.337357][ T6465] dump_stack_lvl+0xe8/0x150 [ 136.337395][ T6465] should_fail_ex+0x3eb/0x540 [ 136.337422][ T6465] should_failslab+0xa8/0x100 [ 136.337444][ T6465] ? alloc_empty_file+0x5b/0x1d0 [ 136.337459][ T6465] kmem_cache_alloc_noprof+0x9c/0x600 [ 136.337475][ T6465] ? stack_depot_save_flags+0x33/0x810 [ 136.337500][ T6465] ? alloc_empty_file+0x5b/0x1d0 [ 136.337519][ T6465] alloc_empty_file+0x5b/0x1d0 [ 136.337535][ T6465] path_openat+0x96/0x20f0 [ 136.337570][ T6465] do_file_open+0x23e/0x4a0 [ 136.337599][ T6465] ? __pfx_do_file_open+0x10/0x10 [ 136.337638][ T6465] ? _raw_spin_unlock+0x28/0x50 [ 136.337657][ T6465] ? alloc_fd+0x6af/0x760 [ 136.337682][ T6465] do_sys_openat2+0x115/0x200 [ 136.337699][ T6465] ? __pfx_do_sys_openat2+0x10/0x10 [ 136.337715][ T6465] ? ksys_write+0x242/0x270 [ 136.337736][ T6465] ? __pfx_ksys_write+0x10/0x10 [ 136.337759][ T6465] __x64_sys_openat+0x138/0x170 [ 136.337786][ T6465] do_syscall_64+0x166/0x520 [ 136.337807][ T6465] ? trace_irq_disable+0x3b/0x140 [ 136.337828][ T6465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.337844][ T6465] ? clear_bhb_loop+0x70/0xc0 [ 136.337863][ T6465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.337880][ T6465] RIP: 0033:0x7f24f8d5fd8e [ 136.337896][ T6465] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 136.337910][ T6465] RSP: 002b:00007f24f9b86b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 136.337927][ T6465] RAX: ffffffffffffffda RBX: 00007f24f9b876c0 RCX: 00007f24f8d5fd8e [ 136.337938][ T6465] RDX: 0000000000000802 RSI: 00007f24f9b86c00 RDI: ffffffffffffff9c [ 136.337949][ T6465] RBP: 00007f24f9b86c00 R08: 0000000000000000 R09: 0000000000000000 [ 136.337959][ T6465] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 136.337969][ T6465] R13: 00007f24f9026308 R14: 00007f24f9026270 R15: 00007ffcbcfe37e8 [ 136.337993][ T6465] [ 136.575398][ T916] gspca_se401: Wrong descriptor type [ 136.779542][ T5800] usb 4-1: USB disconnect, device number 16 [ 137.658553][ T5741] usb 3-1: USB disconnect, device number 12 [ 137.741672][ T5741] Unregistered device Abilis Systems DVB-Titan [ 137.745483][ T5741] as10x_usb: device has been disconnected [ 138.340206][ T5800] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 138.501068][ T5800] usb 3-1: New USB device found: idVendor=1ba6, idProduct=0001, bcdDevice=0.01 [ 138.502894][ T5800] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 138.502952][ T5800] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.551310][ T5800] as10x_usb: device has been detected [ 138.553785][ T5800] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 138.576750][ T5800] usb 3-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 138.604114][ T5800] as10x_usb: error during firmware upload part1 [ 138.604768][ T5800] Registered device Abilis Systems DVB-Titan [ 138.779742][ T6486] Zero length message leads to an empty skb [ 138.953393][ T6508] ieee802154 phy0 wpan0: encryption failed: -22 [ 139.190537][ T5741] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 139.330202][ T5733] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 139.347760][ T5741] usb 4-1: unable to get BOS descriptor or descriptor too short [ 139.347816][ T5741] usb 4-1: New USB device found: idVendor=07ca, idProduct=2835, bcdDevice=eb.e7 [ 139.355802][ T5741] usb 4-1: config index 0 descriptor too short (expected 61732, got 36) [ 139.355832][ T5741] usb 4-1: config 162 has too many interfaces: 225, using maximum allowed: 32 [ 139.355853][ T5741] usb 4-1: config 162 has an invalid descriptor of length 246, skipping remainder of the config [ 139.355873][ T5741] usb 4-1: config 162 has 0 interfaces, different from the descriptor's value: 225 [ 139.382699][ T5741] usb 4-1: string descriptor 0 read error: -22 [ 139.383106][ T5741] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.480993][ T5733] usb 1-1: New USB device found: idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 139.482202][ T5733] usb 1-1: config 0 has an invalid interface number: 117 but max is 0 [ 139.482230][ T5733] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 139.482251][ T5733] usb 1-1: config 0 has no interface number 0 [ 139.482290][ T5733] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 139.482310][ T5733] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 139.482326][ T5733] usb 1-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 139.484468][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.484493][ T5733] usb 1-1: Product: syz [ 139.484509][ T5733] usb 1-1: Manufacturer: syz [ 139.484526][ T5733] usb 1-1: SerialNumber: syz [ 139.488707][ T5733] usb 1-1: config 0 descriptor?? [ 140.023584][ T5741] usb 4-1: USB disconnect, device number 17 [ 140.513433][ T6519] FAULT_INJECTION: forcing a failure. [ 140.513433][ T6519] name failslab, interval 1, probability 0, space 0, times 0 [ 140.513471][ T6519] CPU: 0 UID: 0 PID: 6519 Comm: syz.0.227 Not tainted syzkaller #0 PREEMPT(full) [ 140.513503][ T6519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 140.513514][ T6519] Call Trace: [ 140.513521][ T6519] [ 140.513528][ T6519] dump_stack_lvl+0xe8/0x150 [ 140.513577][ T6519] should_fail_ex+0x3eb/0x540 [ 140.513620][ T6519] should_failslab+0xa8/0x100 [ 140.513663][ T6519] __kmalloc_cache_noprof+0x9e/0x600 [ 140.513685][ T6519] ? shrinker_alloc+0x59/0xb90 [ 140.513728][ T6519] ? shrinker_alloc+0x59/0xb90 [ 140.513775][ T6519] shrinker_alloc+0x59/0xb90 [ 140.513816][ T6519] ? __raw_spin_lock_init+0x45/0x100 [ 140.513862][ T6519] ? __raw_spin_lock_init+0x45/0x100 [ 140.513913][ T6519] sget_fc+0xe75/0x1a60 [ 140.513941][ T6519] ? __pfx_kernfs_test_super+0x10/0x10 [ 140.513993][ T6519] ? __pfx_kernfs_set_super+0x10/0x10 [ 140.514020][ T6519] ? __pfx_sget_fc+0x10/0x10 [ 140.514051][ T6519] ? __kasan_kmalloc+0x93/0xb0 [ 140.514087][ T6519] ? __kmalloc_cache_noprof+0x31c/0x600 [ 140.514115][ T6519] ? __kmalloc_cache_noprof+0x148/0x600 [ 140.514142][ T6519] ? kernfs_get_tree+0xc4/0x980 [ 140.514165][ T6519] ? kernfs_get_tree+0xc4/0x980 [ 140.514205][ T6519] kernfs_get_tree+0x1e9/0x980 [ 140.514242][ T6519] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 140.514280][ T6519] ? __pfx_kernfs_get_tree+0x10/0x10 [ 140.514312][ T6519] ? apparmor_capable+0x126/0x170 [ 140.514331][ T6519] ? bpf_lsm_capable+0x9/0x20 [ 140.514379][ T6519] vfs_get_tree+0x92/0x2a0 [ 140.514414][ T6519] do_new_mount+0x325/0xb00 [ 140.514451][ T6519] ? __pfx_do_new_mount+0x10/0x10 [ 140.514473][ T6519] ? ns_capable+0x84/0xe0 [ 140.514495][ T6519] ? path_mount+0x647/0x1050 [ 140.514537][ T6519] ? user_path_at+0xd4/0x160 [ 140.514569][ T6519] __se_sys_mount+0x31d/0x420 [ 140.514604][ T6519] ? __pfx___se_sys_mount+0x10/0x10 [ 140.514629][ T6519] ? __x64_sys_mount+0x20/0xc0 [ 140.514650][ T6519] do_syscall_64+0x166/0x520 [ 140.514694][ T6519] ? trace_irq_disable+0x3b/0x140 [ 140.514726][ T6519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.514756][ T6519] ? clear_bhb_loop+0x70/0xc0 [ 140.514778][ T6519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.514796][ T6519] RIP: 0033:0x7f391cb9f559 [ 140.514826][ T6519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.514850][ T6519] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 140.514880][ T6519] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 140.514900][ T6519] RDX: 0000200000000900 RSI: 00002000000008c0 RDI: 0000000000000000 [ 140.514916][ T6519] RBP: 00007f391cc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 140.514931][ T6519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.514958][ T6519] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 140.515005][ T6519] [ 140.935847][ T6521] FAULT_INJECTION: forcing a failure. [ 140.935847][ T6521] name failslab, interval 1, probability 0, space 0, times 0 [ 140.935886][ T6521] CPU: 1 UID: 0 PID: 6521 Comm: syz.3.228 Not tainted syzkaller #0 PREEMPT(full) [ 140.935915][ T6521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 140.935931][ T6521] Call Trace: [ 140.935940][ T6521] [ 140.935950][ T6521] dump_stack_lvl+0xe8/0x150 [ 140.935992][ T6521] should_fail_ex+0x3eb/0x540 [ 140.936032][ T6521] should_failslab+0xa8/0x100 [ 140.936067][ T6521] __kmalloc_cache_noprof+0x9e/0x600 [ 140.936098][ T6521] ? alloc_fs_context+0x66/0xd00 [ 140.936128][ T6521] ? alloc_fs_context+0x66/0xd00 [ 140.936166][ T6521] alloc_fs_context+0x66/0xd00 [ 140.936199][ T6521] ? __se_sys_fsopen+0x109/0x370 [ 140.936239][ T6521] __se_sys_fsopen+0x118/0x370 [ 140.936278][ T6521] do_syscall_64+0x166/0x520 [ 140.936310][ T6521] ? trace_irq_disable+0x3b/0x140 [ 140.936339][ T6521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.936363][ T6521] ? clear_bhb_loop+0x70/0xc0 [ 140.936392][ T6521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.936427][ T6521] RIP: 0033:0x7fe3c9d9f559 [ 140.936449][ T6521] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.936469][ T6521] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 140.936495][ T6521] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 140.936513][ T6521] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000280 [ 140.936528][ T6521] RBP: 00007fe3c9e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 140.936543][ T6521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.936557][ T6521] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 140.936595][ T6521] [ 141.155166][ T11] usb 3-1: USB disconnect, device number 13 [ 141.185099][ T11] Unregistered device Abilis Systems DVB-Titan [ 141.187310][ T11] as10x_usb: device has been disconnected [ 141.713452][ T5733] usbtouchscreen 1-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 141.749184][ T5733] usb 1-1: USB disconnect, device number 13 [ 141.954613][ T6546] ieee802154 phy0 wpan0: encryption failed: -22 [ 142.075206][ T6549] jffs2: notice: (6549) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 142.220219][ T11] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 142.311442][ T6555] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 142.351957][ T6555] Bluetooth: MGMT ver 1.23 [ 142.394197][ T11] usb 3-1: unable to get BOS descriptor or descriptor too short [ 142.394250][ T11] usb 3-1: New USB device found: idVendor=07ca, idProduct=2835, bcdDevice=eb.e7 [ 142.395782][ T11] usb 3-1: config index 0 descriptor too short (expected 61732, got 36) [ 142.395809][ T11] usb 3-1: config 162 has too many interfaces: 225, using maximum allowed: 32 [ 142.395831][ T11] usb 3-1: config 162 has an invalid descriptor of length 246, skipping remainder of the config [ 142.395852][ T11] usb 3-1: config 162 has 0 interfaces, different from the descriptor's value: 225 [ 142.427613][ T11] usb 3-1: string descriptor 0 read error: -22 [ 142.427750][ T11] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.837641][ T6561] netlink: 'syz.1.242': attribute type 15 has an invalid length. [ 143.118539][ T6572] FAULT_INJECTION: forcing a failure. [ 143.118539][ T6572] name failslab, interval 1, probability 0, space 0, times 0 [ 143.118583][ T6572] CPU: 1 UID: 0 PID: 6572 Comm: syz.0.244 Not tainted syzkaller #0 PREEMPT(full) [ 143.118615][ T6572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 143.118631][ T6572] Call Trace: [ 143.118641][ T6572] [ 143.118651][ T6572] dump_stack_lvl+0xe8/0x150 [ 143.118696][ T6572] should_fail_ex+0x3eb/0x540 [ 143.118736][ T6572] should_failslab+0xa8/0x100 [ 143.118771][ T6572] __kmalloc_cache_noprof+0x9e/0x600 [ 143.118798][ T6572] ? ovl_init_fs_context+0x57/0x570 [ 143.118819][ T6572] ? ovl_init_fs_context+0x57/0x570 [ 143.118844][ T6572] ovl_init_fs_context+0x57/0x570 [ 143.118864][ T6572] ? mutex_init_lockdep+0xdf/0x110 [ 143.118893][ T6572] alloc_fs_context+0x99e/0xd00 [ 143.118930][ T6572] __se_sys_fsopen+0x118/0x370 [ 143.118965][ T6572] do_syscall_64+0x166/0x520 [ 143.118995][ T6572] ? trace_irq_disable+0x3b/0x140 [ 143.119022][ T6572] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.119044][ T6572] ? clear_bhb_loop+0x70/0xc0 [ 143.119072][ T6572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.119092][ T6572] RIP: 0033:0x7f391cb9f559 [ 143.119124][ T6572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.119145][ T6572] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 143.119169][ T6572] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 143.119185][ T6572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 143.119198][ T6572] RBP: 00007f391cc36b20 R08: 0000000000000000 R09: 0000000000000000 [ 143.119212][ T6572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.119225][ T6572] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 143.119257][ T6572] [ 143.525886][ T5790] usb 3-1: USB disconnect, device number 14 [ 143.638214][ T6590] vcan0: tx drop: invalid sa for name 0x0000000000004000 [ 144.160564][ T5733] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 144.232415][ T6607] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 144.232539][ T6607] block device autoloading is deprecated and will be removed. [ 144.290310][ T5733] usb 4-1: device descriptor read/64, error -71 [ 144.401922][ T5636] Bluetooth: hci1: Opcode 0x0c24 failed: -110 [ 144.402636][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 144.455560][ T33] audit: type=1800 audit(1793228847.552:4): pid=6621 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.258" name=08 dev="sda1" ino=2044 res=0 errno=-22 [ 144.530239][ T5733] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 144.660792][ T5733] usb 4-1: device descriptor read/64, error -71 [ 144.730032][ T6635] jffs2: notice: (6635) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 144.770794][ T5733] usb usb4-port1: attempt power cycle [ 144.796783][ T6638] FAULT_INJECTION: forcing a failure. [ 144.796783][ T6638] name failslab, interval 1, probability 0, space 0, times 0 [ 144.796820][ T6638] CPU: 1 UID: 0 PID: 6638 Comm: syz.0.264 Not tainted syzkaller #0 PREEMPT(full) [ 144.796846][ T6638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 144.796861][ T6638] Call Trace: [ 144.796870][ T6638] [ 144.796880][ T6638] dump_stack_lvl+0xe8/0x150 [ 144.796921][ T6638] should_fail_ex+0x3eb/0x540 [ 144.796962][ T6638] should_failslab+0xa8/0x100 [ 144.797001][ T6638] __kmalloc_cache_noprof+0x9e/0x600 [ 144.797026][ T6638] ? __pfx_in6_dev_get+0x10/0x10 [ 144.797058][ T6638] ? __ipv6_dev_mc_inc+0x447/0xaf0 [ 144.797094][ T6638] ? __ipv6_dev_mc_inc+0x447/0xaf0 [ 144.797134][ T6638] __ipv6_dev_mc_inc+0x447/0xaf0 [ 144.797180][ T6638] __ipv6_sock_mc_join+0x511/0x830 [ 144.797224][ T6638] do_ipv6_mcast_group_source+0x3df/0x4c0 [ 144.797256][ T6638] ? __pfx_do_ipv6_mcast_group_source+0x10/0x10 [ 144.797293][ T6638] ? look_up_lock_class+0x57/0x110 [ 144.797325][ T6638] ? register_lock_class+0x31/0x2e0 [ 144.797357][ T6638] ? __lock_acquire+0x747/0x2de0 [ 144.797431][ T6638] ? do_ipv6_setsockopt+0x956/0x2960 [ 144.797459][ T6638] ? __local_bh_enable_ip+0xd6/0x140 [ 144.797494][ T6638] do_ipv6_setsockopt+0x17a7/0x2960 [ 144.797526][ T6638] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 144.797549][ T6638] ? aa_inet_opt_perm+0x94d/0xcd0 [ 144.797594][ T6638] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 144.797636][ T6638] ? __raw_spin_lock_init+0x45/0x100 [ 144.797682][ T6638] ? do_futex+0x3e7/0x4e0 [ 144.797715][ T6638] ? __asan_memcpy+0x40/0x70 [ 144.797744][ T6638] ? lock_acquire+0x115/0x350 [ 144.797781][ T6638] ? aa_sock_opt_perm+0xe1/0x1e0 [ 144.797818][ T6638] ipv6_setsockopt+0x59/0x170 [ 144.797842][ T6638] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 144.797882][ T6638] do_sock_setsockopt+0x17c/0x1b0 [ 144.797915][ T6638] __x64_sys_setsockopt+0x13d/0x1b0 [ 144.797949][ T6638] do_syscall_64+0x166/0x520 [ 144.797979][ T6638] ? trace_irq_disable+0x3b/0x140 [ 144.798007][ T6638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.798032][ T6638] ? clear_bhb_loop+0x70/0xc0 [ 144.798061][ T6638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.798091][ T6638] RIP: 0033:0x7f391cb9f559 [ 144.798113][ T6638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.798134][ T6638] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 144.798160][ T6638] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 144.798178][ T6638] RDX: 000000000000002e RSI: 0000000000000029 RDI: 0000000000000005 [ 144.798193][ T6638] RBP: 00007f391cc36b20 R08: 0000000000000108 R09: 0000000000000000 [ 144.798208][ T6638] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000000 [ 144.798224][ T6638] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 144.798263][ T6638] [ 145.123031][ T5733] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 145.147257][ T5733] usb 4-1: device descriptor read/8, error -71 [ 145.370208][ T11] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 145.380673][ T5733] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 145.404515][ T5733] usb 4-1: device descriptor read/8, error -71 [ 145.510991][ T5733] usb usb4-port1: unable to enumerate USB device [ 145.524627][ T11] usb 3-1: Using ep0 maxpacket: 32 [ 145.525987][ T11] usb 3-1: New USB device found: idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 145.527412][ T11] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 145.527439][ T11] usb 3-1: config 0 has no interface number 0 [ 145.527484][ T11] usb 3-1: config 0 interface 184 has no altsetting 0 [ 145.536223][ T11] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.536287][ T11] usb 3-1: Product: syz [ 145.536305][ T11] usb 3-1: Manufacturer: syz [ 145.536321][ T11] usb 3-1: SerialNumber: syz [ 145.597350][ T11] usb 3-1: config 0 descriptor?? [ 145.680300][ T5800] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 145.851873][ T5800] usb 1-1: New USB device found: idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 145.851906][ T5800] usb 1-1: too many configurations: 164, using maximum allowed: 8 [ 145.869800][ T5800] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.889497][ T5800] usb 1-1: config 0 descriptor?? [ 146.097733][ T6653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.098449][ T6653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.100049][ T6653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.107625][ T6653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.122746][ T6653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 146.130044][ T6653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.135246][ T5800] usb 1-1: USB disconnect, device number 14 [ 146.217052][ T11] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 146.217079][ T11] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 146.923749][ T6669] netlink: 44 bytes leftover after parsing attributes in process `syz.3.274'. [ 147.018644][ T5800] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 147.039539][ T5800] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 147.273636][ T6674] FAULT_INJECTION: forcing a failure. [ 147.273636][ T6674] name failslab, interval 1, probability 0, space 0, times 0 [ 147.273676][ T6674] CPU: 0 UID: 0 PID: 6674 Comm: syz.0.276 Not tainted syzkaller #0 PREEMPT(full) [ 147.273703][ T6674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 147.273717][ T6674] Call Trace: [ 147.273727][ T6674] [ 147.273740][ T6674] dump_stack_lvl+0xe8/0x150 [ 147.273783][ T6674] should_fail_ex+0x3eb/0x540 [ 147.273824][ T6674] should_failslab+0xa8/0x100 [ 147.273859][ T6674] __kmalloc_noprof+0xf9/0x710 [ 147.273883][ T6674] ? __mutex_trylock_common+0x15f/0x270 [ 147.273917][ T6674] ? io_cache_alloc_new+0x40/0x100 [ 147.273946][ T6674] ? io_cache_alloc_new+0x40/0x100 [ 147.273984][ T6674] io_cache_alloc_new+0x40/0x100 [ 147.274018][ T6674] io_uring_cmd_prep+0x39a/0x600 [ 147.274051][ T6674] io_submit_sqes+0xd6e/0x2500 [ 147.274121][ T6674] __se_sys_io_uring_enter+0x35b/0x1bb0 [ 147.274178][ T6674] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 147.274214][ T6674] ? irqentry_exit+0x2a0/0x9b0 [ 147.274247][ T6674] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 147.274292][ T6674] ? rcu_is_watching+0x16/0xb0 [ 147.274331][ T6674] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 147.274368][ T6674] do_syscall_64+0x166/0x520 [ 147.274400][ T6674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.274424][ T6674] ? clear_bhb_loop+0x70/0xc0 [ 147.274454][ T6674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.274478][ T6674] RIP: 0033:0x7f391cb9f559 [ 147.274500][ T6674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.274520][ T6674] RSP: 002b:00007f391da44f38 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 147.274547][ T6674] RAX: ffffffffffffffda RBX: 0000200000000780 RCX: 00007f391cb9f559 [ 147.274564][ T6674] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008 [ 147.274578][ T6674] RBP: 00000000000002ab R08: 0000000000000000 R09: 0000000000000008 [ 147.274593][ T6674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000500 [ 147.274608][ T6674] R13: 0000200000000508 R14: 0000000000000e26 R15: 0000000000000000 [ 147.274644][ T6674] [ 147.823814][ T11] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 147.823854][ T11] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 147.823877][ T11] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 147.824412][ T11] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 147.856870][ T11] usb 3-1: USB disconnect, device number 15 [ 147.966084][ T6683] overlayfs: missing 'lowerdir' [ 147.978244][ T6683] netlink: 24 bytes leftover after parsing attributes in process `syz.2.278'. [ 148.589380][ T6657] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 148.799402][ T6707] netlink: 'syz.0.285': attribute type 11 has an invalid length. [ 149.048549][ T6714] FAULT_INJECTION: forcing a failure. [ 149.048549][ T6714] name failslab, interval 1, probability 0, space 0, times 0 [ 149.048588][ T6714] CPU: 1 UID: 0 PID: 6714 Comm: syz.3.288 Not tainted syzkaller #0 PREEMPT(full) [ 149.048622][ T6714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 149.048636][ T6714] Call Trace: [ 149.048646][ T6714] [ 149.048656][ T6714] dump_stack_lvl+0xe8/0x150 [ 149.048697][ T6714] should_fail_ex+0x3eb/0x540 [ 149.048741][ T6714] should_failslab+0xa8/0x100 [ 149.048775][ T6714] __kmalloc_cache_noprof+0x9e/0x600 [ 149.048808][ T6714] ? kvm_create_vm_debugfs+0x58f/0x8f0 [ 149.048830][ T6714] ? kvm_create_vm_debugfs+0x58f/0x8f0 [ 149.048853][ T6714] ? debugfs_create_file_full+0x3f/0x60 [ 149.048885][ T6714] kvm_create_vm_debugfs+0x58f/0x8f0 [ 149.048918][ T6714] ? __pfx_kvm_create_vm_debugfs+0x10/0x10 [ 149.048960][ T6714] kvm_dev_ioctl+0x1245/0x1700 [ 149.048999][ T6714] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 149.049028][ T6714] ? bpf_lsm_file_ioctl+0x9/0x20 [ 149.049058][ T6714] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 149.049081][ T6714] __se_sys_ioctl+0xfc/0x170 [ 149.049118][ T6714] do_syscall_64+0x166/0x520 [ 149.049150][ T6714] ? trace_irq_disable+0x3b/0x140 [ 149.049179][ T6714] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.049203][ T6714] ? clear_bhb_loop+0x70/0xc0 [ 149.049232][ T6714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.049255][ T6714] RIP: 0033:0x7fe3c9d9f559 [ 149.049277][ T6714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.049298][ T6714] RSP: 002b:00007fe3cac81028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 149.049324][ T6714] RAX: ffffffffffffffda RBX: 00007fe3ca025fa0 RCX: 00007fe3c9d9f559 [ 149.049342][ T6714] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000009 [ 149.049357][ T6714] RBP: 00007fe3c9e36b20 R08: 0000000000000000 R09: 0000000000000000 [ 149.049372][ T6714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 149.049387][ T6714] R13: 00007fe3ca026038 R14: 00007fe3ca025fa0 R15: 00007ffffd91b4e8 [ 149.049425][ T6714] [ 149.569212][ T6735] FAULT_INJECTION: forcing a failure. [ 149.569212][ T6735] name failslab, interval 1, probability 0, space 0, times 0 [ 149.569249][ T6735] CPU: 0 UID: 0 PID: 6735 Comm: syz.0.292 Not tainted syzkaller #0 PREEMPT(full) [ 149.569282][ T6735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 149.569296][ T6735] Call Trace: [ 149.569308][ T6735] [ 149.569321][ T6735] dump_stack_lvl+0xe8/0x150 [ 149.569367][ T6735] should_fail_ex+0x3eb/0x540 [ 149.569416][ T6735] should_failslab+0xa8/0x100 [ 149.569475][ T6735] __kmalloc_cache_noprof+0x9e/0x600 [ 149.569505][ T6735] ? __pfx_in6_dev_get+0x10/0x10 [ 149.569547][ T6735] ? __ipv6_dev_mc_inc+0x447/0xaf0 [ 149.569582][ T6735] ? __ipv6_dev_mc_inc+0x447/0xaf0 [ 149.569633][ T6735] __ipv6_dev_mc_inc+0x447/0xaf0 [ 149.569686][ T6735] __ipv6_sock_mc_join+0x511/0x830 [ 149.569740][ T6735] do_ipv6_mcast_group_source+0x3df/0x4c0 [ 149.569782][ T6735] ? __pfx_do_ipv6_mcast_group_source+0x10/0x10 [ 149.569824][ T6735] ? look_up_lock_class+0x57/0x110 [ 149.569868][ T6735] ? register_lock_class+0x31/0x2e0 [ 149.569905][ T6735] ? __lock_acquire+0x747/0x2de0 [ 149.569986][ T6735] ? do_ipv6_setsockopt+0x956/0x2960 [ 149.570023][ T6735] ? __local_bh_enable_ip+0xd6/0x140 [ 149.570063][ T6735] do_ipv6_setsockopt+0x17a7/0x2960 [ 149.570100][ T6735] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 149.570123][ T6735] ? aa_inet_opt_perm+0x94d/0xcd0 [ 149.570168][ T6735] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 149.570220][ T6735] ? __raw_spin_lock_init+0x45/0x100 [ 149.570276][ T6735] ? do_futex+0x3e7/0x4e0 [ 149.570319][ T6735] ? __asan_memcpy+0x40/0x70 [ 149.570355][ T6735] ? lock_acquire+0x115/0x350 [ 149.570400][ T6735] ? aa_sock_opt_perm+0xe1/0x1e0 [ 149.570457][ T6735] ipv6_setsockopt+0x59/0x170 [ 149.570489][ T6735] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 149.570538][ T6735] do_sock_setsockopt+0x17c/0x1b0 [ 149.570581][ T6735] __x64_sys_setsockopt+0x13d/0x1b0 [ 149.570624][ T6735] do_syscall_64+0x166/0x520 [ 149.570662][ T6735] ? trace_irq_disable+0x3b/0x140 [ 149.570698][ T6735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.570730][ T6735] ? clear_bhb_loop+0x70/0xc0 [ 149.570766][ T6735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.570793][ T6735] RIP: 0033:0x7f391cb9f559 [ 149.570815][ T6735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.570831][ T6735] RSP: 002b:00007f391da45028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 149.570854][ T6735] RAX: ffffffffffffffda RBX: 00007f391ce25fa0 RCX: 00007f391cb9f559 [ 149.570871][ T6735] RDX: 000000000000002e RSI: 0000000000000029 RDI: 0000000000000005 [ 149.570886][ T6735] RBP: 00007f391cc36b20 R08: 0000000000000108 R09: 0000000000000000 [ 149.570901][ T6735] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000000 [ 149.570916][ T6735] R13: 00007f391ce26038 R14: 00007f391ce25fa0 R15: 00007fffaf29c638 [ 149.570953][ T6735] [ 150.140466][ T6753] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.297'. [ 150.390623][ T5741] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 150.541245][ T5741] usb 3-1: New USB device found: idVendor=1020, idProduct=0006, bcdDevice=0.00 [ 150.542536][ T5741] usb 3-1: config 0 interface 0 altsetting 12 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 150.542570][ T5741] usb 3-1: config 0 interface 0 altsetting 12 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 150.542598][ T5741] usb 3-1: config 0 interface 0 has no altsetting 0 [ 150.542632][ T5741] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.545338][ T5741] usb 3-1: config 0 descriptor?? [ 150.546197][ T6753] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 150.560746][ T5733] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 150.711119][ T5733] usb 4-1: New USB device found: idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 150.712775][ T5733] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 150.712944][ T5733] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 150.713003][ T5733] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 150.713033][ T5733] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 150.716416][ T5733] usb 4-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 150.716444][ T5733] usb 4-1: Product: syz [ 150.716460][ T5733] usb 4-1: Manufacturer: syz [ 150.716500][ T5733] usb 4-1: SerialNumber: syz [ 150.739409][ T5733] usb 4-1: config 0 descriptor?? [ 150.880044][ T55] Bluetooth: hci1: unexpected event 0x06 length: 4 > 3 [ 150.883467][ T5733] rc_core: IR keymap rc-imon-rsc not found [ 150.883534][ T5733] Registered IR keymap rc-empty [ 150.895416][ T5733] rc rc0: iMON Station as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 150.912109][ T5733] input: iMON Station as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 150.934642][ T5733] imon_raw 4-1:0.0: probe with driver imon_raw failed with error -90 [ 150.963449][ T5733] usb 4-1: USB disconnect, device number 22 [ 150.972949][ T6753] netlink: 60 bytes leftover after parsing attributes in process `syz.2.297'. [ 150.992929][ T6753] netlink: 60 bytes leftover after parsing attributes in process `syz.2.297'. [ 151.017030][ T5741] belkin 0003:1020:0006.0003: ignoring exceeding usage max [ 151.043572][ T5741] belkin 0003:1020:0006.0003: hidraw0: USB HID v0.11 Joystick [HID 1020:0006] on usb-dummy_hcd.2-1/input0 [ 151.199592][ T11] usb 3-1: USB disconnect, device number 16 [ 151.770328][ T11] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 151.920445][ T6781] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 151.922187][ T11] usb 4-1: Using ep0 maxpacket: 32 [ 151.928990][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 151.929046][ T11] usb 4-1: New USB device found: idVendor=0458, idProduct=7003, bcdDevice=fc.62 [ 151.930240][ T11] usb 4-1: config 8 has an invalid interface number: 94 but max is 0 [ 151.930266][ T11] usb 4-1: config 8 has no interface number 0 [ 151.930344][ T11] usb 4-1: config 8 interface 94 has no altsetting 0 [ 151.988850][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.988882][ T11] usb 4-1: Product: syz [ 151.988934][ T11] usb 4-1: Manufacturer: syz [ 151.988952][ T11] usb 4-1: SerialNumber: syz [ 152.017181][ T6781] NILFS (loop2): device size too small [ 152.046011][ T6781] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 152.097011][ T6786] tipc: Started in network mode [ 152.097053][ T6786] tipc: Node identity ac1414aa, cluster identity 4711 [ 152.098408][ T6786] tipc: New replicast peer: 172.20.20.187 [ 152.106819][ T6786] tipc: Enabled bearer , priority 10 [ 152.235074][ T6771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.235589][ T6771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.239833][ T6771] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 152.269824][ T11] gspca_main: sn9c2028-2.14.0 probing 0458:7003 [ 152.278990][ T11] gspca_sn9c2028: read1 error -71 [ 152.279587][ T11] gspca_sn9c2028: read1 error -71 [ 152.291508][ T11] gspca_sn9c2028: read1 error -71 [ 152.291594][ T11] sn9c2028 4-1:8.94: probe with driver sn9c2028 failed with error -71 [ 152.311703][ T11] usb 4-1: USB disconnect, device number 23 [ 152.610178][ T5741] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 152.760229][ T5741] usb 3-1: Using ep0 maxpacket: 8 [ 152.760985][ T5741] usb 3-1: New USB device found: idVendor=22b8, idProduct=6425, bcdDevice=9.3a [ 152.762448][ T5741] usb 3-1: config 5 has an invalid interface number: 54 but max is 0 [ 152.762476][ T5741] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 152.762496][ T5741] usb 3-1: config 5 has no interface number 0 [ 152.762527][ T5741] usb 3-1: config 5 interface 54 has no altsetting 0 [ 152.766139][ T5741] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 152.766165][ T5741] usb 3-1: Product: syz [ 152.766182][ T5741] usb 3-1: Manufacturer: syz [ 152.766198][ T5741] usb 3-1: SerialNumber: syz [ 152.961127][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 152.962567][ T5636] ------------[ cut here ]------------ [ 152.962579][ T5636] refcnt < 0 [ 152.962598][ T5636] WARNING: net/bluetooth/hci_conn.c:649 at hci_conn_timeout+0xff/0x2c0, CPU#0: kworker/u9:2/5636 [ 152.988182][ T5636] Modules linked in: [ 152.992183][ T5636] CPU: 0 UID: 0 PID: 5636 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 153.001736][ T5636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 153.011942][ T5636] Workqueue: hci1 hci_conn_timeout [ 153.017141][ T5636] RIP: 0010:hci_conn_timeout+0xff/0x2c0 [ 153.022866][ T5636] Code: 48 89 df e8 93 1e 0a 00 eb 07 e8 4c 2e c0 f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 47 a0 fe ff e8 32 2e c0 f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff [ 153.043732][ T5636] RSP: 0018:ffffc9000430fab0 EFLAGS: 00010293 [ 153.050585][ T5636] RAX: ffffffff8b091b1e RBX: ffff88807afac000 RCX: ffff88802efbbe80 [ 153.058618][ T5636] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 153.066712][ T5636] RBP: 00000000ffffffff R08: ffff88807afac013 R09: 1ffff1100f5f5802 [ 153.076437][ T5636] R10: dffffc0000000000 R11: ffffed100f5f5803 R12: dffffc0000000000 [ 153.084701][ T5636] R13: ffffffff819091ba R14: ffff88807afaca50 R15: ffff88807afac010 [ 153.092985][ T5636] FS: 0000000000000000(0000) GS:ffff888123376000(0000) knlGS:0000000000000000 [ 153.102179][ T5636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 153.108835][ T5636] CR2: 00007fe3ca027dac CR3: 000000005f284000 CR4: 00000000003526f0 [ 153.116910][ T5636] Call Trace: [ 153.120344][ T5636] [ 153.123315][ T5636] process_scheduled_works+0xc3d/0x1630 [ 153.128957][ T5636] ? __pfx_process_scheduled_works+0x10/0x10 [ 153.135037][ T5636] ? assign_work+0x3cf/0x5d0 [ 153.140599][ T5636] worker_thread+0xa47/0xfb0 [ 153.145274][ T5636] ? __kthread_parkme+0x71/0x1f0 [ 153.150943][ T5636] kthread+0x38b/0x480 [ 153.155099][ T5636] ? __pfx_worker_thread+0x10/0x10 [ 153.160329][ T5636] ? __pfx_kthread+0x10/0x10 [ 153.164968][ T5636] ret_from_fork+0x514/0xb70 [ 153.169600][ T5636] ? __pfx_ret_from_fork+0x10/0x10 [ 153.174920][ T5636] ? __switch_to+0xc78/0x1410 [ 153.179659][ T5636] ? __pfx_kthread+0x10/0x10 [ 153.184330][ T5636] ret_from_fork_asm+0x1a/0x30 [ 153.189162][ T5636] [ 153.192247][ T5636] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 153.199570][ T5636] CPU: 0 UID: 0 PID: 5636 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 153.209065][ T5636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 153.219166][ T5636] Workqueue: hci1 hci_conn_timeout [ 153.224342][ T5636] Call Trace: [ 153.227659][ T5636] [ 153.230629][ T5636] vpanic+0x26f/0x710 [ 153.234664][ T5636] panic+0xc5/0xd0 [ 153.238421][ T5636] ? __pfx_panic+0x10/0x10 [ 153.242894][ T5636] ? ret_from_fork_asm+0x1a/0x30 [ 153.247898][ T5636] __warn+0x315/0x4c0 [ 153.251914][ T5636] ? hci_conn_timeout+0xff/0x2c0 [ 153.256898][ T5636] ? hci_conn_timeout+0xff/0x2c0 [ 153.261887][ T5636] __report_bug+0x276/0x570 [ 153.266478][ T5636] ? hci_conn_timeout+0xff/0x2c0 [ 153.271473][ T5636] ? __pfx___report_bug+0x10/0x10 [ 153.276545][ T5636] ? add_lock_to_list+0xc7/0x100 [ 153.281538][ T5636] ? lockdep_unlock+0x5c/0xd0 [ 153.286251][ T5636] ? __lock_acquire+0x1511/0x2de0 [ 153.291332][ T5636] ? hci_conn_timeout+0xff/0x2c0 [ 153.296330][ T5636] report_bug+0x16b/0x220 [ 153.300708][ T5636] ? hci_conn_timeout+0xff/0x2c0 [ 153.305689][ T5636] ? hci_conn_timeout+0x101/0x2c0 [ 153.310769][ T5636] handle_bug+0x9c/0x200 [ 153.315073][ T5636] exc_invalid_op+0x1a/0x50 [ 153.319627][ T5636] asm_exc_invalid_op+0x1a/0x20 [ 153.324515][ T5636] RIP: 0010:hci_conn_timeout+0xff/0x2c0 [ 153.330108][ T5636] Code: 48 89 df e8 93 1e 0a 00 eb 07 e8 4c 2e c0 f6 b0 13 0f b6 f0 48 89 df 5b 41 5c 41 5e 41 5f 5d e9 47 a0 fe ff e8 32 2e c0 f6 90 <0f> 0b 90 eb 8c 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 31 ff ff ff [ 153.349759][ T5636] RSP: 0018:ffffc9000430fab0 EFLAGS: 00010293 [ 153.355873][ T5636] RAX: ffffffff8b091b1e RBX: ffff88807afac000 RCX: ffff88802efbbe80 [ 153.363919][ T5636] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 153.371933][ T5636] RBP: 00000000ffffffff R08: ffff88807afac013 R09: 1ffff1100f5f5802 [ 153.379980][ T5636] R10: dffffc0000000000 R11: ffffed100f5f5803 R12: dffffc0000000000 [ 153.387991][ T5636] R13: ffffffff819091ba R14: ffff88807afaca50 R15: ffff88807afac010 [ 153.396013][ T5636] ? process_scheduled_works+0x97a/0x1630 [ 153.401786][ T5636] ? hci_conn_timeout+0xfe/0x2c0 [ 153.406789][ T5636] process_scheduled_works+0xc3d/0x1630 [ 153.412415][ T5636] ? __pfx_process_scheduled_works+0x10/0x10 [ 153.418460][ T5636] ? assign_work+0x3cf/0x5d0 [ 153.423100][ T5636] worker_thread+0xa47/0xfb0 [ 153.427762][ T5636] ? __kthread_parkme+0x71/0x1f0 [ 153.432757][ T5636] kthread+0x38b/0x480 [ 153.436864][ T5636] ? __pfx_worker_thread+0x10/0x10 [ 153.442018][ T5636] ? __pfx_kthread+0x10/0x10 [ 153.446644][ T5636] ret_from_fork+0x514/0xb70 [ 153.451285][ T5636] ? __pfx_ret_from_fork+0x10/0x10 [ 153.456443][ T5636] ? __switch_to+0xc78/0x1410 [ 153.461179][ T5636] ? __pfx_kthread+0x10/0x10 [ 153.465814][ T5636] ret_from_fork_asm+0x1a/0x30 [ 153.470681][ T5636] [ 153.475151][ T5636] Kernel Offset: disabled [ 153.479513][ T5636] Rebooting in 86400 seconds..