last executing test programs: 52.549288605s ago: executing program 2 (id=1465): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x25, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x5}]}, 0x10) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) waitid(0x2, r2, &(0x7f00000000c0), 0x8, &(0x7f0000000200)) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)=ANY=[@ANYRES32], 0x0) pipe2(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x60680, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000100)=0xffff) sendfile(r6, r7, 0x0, 0x2) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x7) syz_open_procfs(0x0, &(0x7f0000000180)='smaps_rollup\x00') 50.436376346s ago: executing program 2 (id=1469): socket$igmp6(0xa, 0x3, 0x2) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'wlc\x00', 0x0, 0x5, 0x72}, 0x2c) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @private2}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)}, 0x0) 48.533900451s ago: executing program 2 (id=1473): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x2, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x8442, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)) 47.709844811s ago: executing program 2 (id=1474): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000001000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000000800034000000010400000000c0a050000000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010000000000140000001100010000000000000000000100000aeb2f30e68c764fbb364982a65bd85315ac907b5587bf4614540102ed33f2b769470ae73f88e38a41f026c0371008b32a51d0b9e55c0c525bd34b783944d5a6c5dd5a508e080e83eb8ee1d3deb08369aaa90b85"], 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(r0) 44.49300056s ago: executing program 2 (id=1482): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) unshare(0x2a020480) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_clone(0x20160100, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c001300"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) prlimit64(r3, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x32) sendmmsg(r8, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 43.568311633s ago: executing program 2 (id=1485): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)={0x38, 0x1403, 0x1, 0x70bd29, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x801}, 0x4000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) 28.530448203s ago: executing program 32 (id=1485): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)={0x38, 0x1403, 0x1, 0x70bd29, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x801}, 0x4000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) 11.204801438s ago: executing program 5 (id=1581): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xfffffffffffffec5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) getdents64(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001940)}, 0x80c0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001480)={0x28, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x47}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 10.232986398s ago: executing program 3 (id=1585): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x2, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x8442, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f00000001c0)) 10.154736304s ago: executing program 1 (id=1586): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) socket$rxrpc(0x21, 0x2, 0x2) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x97, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x2, 0x10, 0x4, 0x64, 0x2, 0x5, 0x4b, 0xa7, @loopback, @dev={0xac, 0x14, 0x14, 0x35}}}}}}}, 0x0) mount(0x0, &(0x7f0000000240)='./mnt\x00', &(0x7f0000000280)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./mnt/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/usb_gadget/g1/configs/c.1\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) chroot(&(0x7f0000000000)='./mnt\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet6(0xa, 0x2, 0x0) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb0\x00') symlinkat(&(0x7f0000000380)='./mnt/usb_gadget/g1/functions/geth.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./mnt/usb_gadget/g1/configs/c.1/geth.usb0\x00') 9.61545828s ago: executing program 3 (id=1587): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x2800) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) 9.559744729s ago: executing program 1 (id=1589): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x25, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x5}]}, 0x10) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) waitid(0x2, r2, &(0x7f00000000c0), 0x8, &(0x7f0000000200)) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, 0x0) pipe2(&(0x7f00000004c0)={0xffffffffffffffff}, 0x800) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x60680, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000100)=0xffff) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='smaps_rollup\x00') 8.492198121s ago: executing program 1 (id=1591): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1e, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x182b}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x8, 0x80000}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x5}}}}]}]}, 0x70}}, 0x20040000) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 8.001997385s ago: executing program 5 (id=1592): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x25, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x5}]}, 0x10) 7.97079042s ago: executing program 3 (id=1593): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 7.713374348s ago: executing program 3 (id=1594): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) 6.360126654s ago: executing program 3 (id=1595): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) unshare(0x2a020480) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_clone(0x20160100, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c001300"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) prlimit64(r3, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x32) sendmmsg(r8, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 5.385036876s ago: executing program 5 (id=1596): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x8f) mount(0x0, 0x0, &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) 5.298132028s ago: executing program 4 (id=1597): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='10 1 1\x00', 0x7) 5.235035898s ago: executing program 4 (id=1598): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4), 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 4.807477794s ago: executing program 4 (id=1601): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) unshare(0x2a020480) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_clone(0x20160100, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c001300"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) prlimit64(r3, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x32) sendmmsg(r9, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) rt_sigqueueinfo(0x0, 0x21, &(0x7f0000000000)={0x12, 0x0, 0x3}) 4.717571384s ago: executing program 0 (id=1602): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x59) 4.042967492s ago: executing program 4 (id=1603): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xfffffffffffffec5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) getdents64(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001940)}, 0x80c0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001480)={0x28, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x47}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 3.624630487s ago: executing program 1 (id=1604): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x1a5042, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x100004) write$eventfd(r2, &(0x7f0000000240), 0xffffff14) 2.839988506s ago: executing program 5 (id=1605): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) msgrcv(0x0, 0x0, 0x0, 0x1, 0x2800) write(r1, &(0x7f0000000000)='3', 0x4e) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r2, 0x0) 2.20121637s ago: executing program 4 (id=1606): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x25, 0x2, 0x8}, {0x6, 0x0, 0x6, 0x5}]}, 0x10) 2.184651253s ago: executing program 5 (id=1607): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 2.081688094s ago: executing program 0 (id=1608): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='10 1 1\x00', 0x7) 2.066551667s ago: executing program 5 (id=1609): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000480)={0x24, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x22, 0xa, {[@global=@item_4={0x3, 0x1, 0xa, "cfb7020e"}, @global=@item_4={0x3, 0x1, 0x5, "f0dd4fcc"}]}}, 0x0}, 0x0) 1.570497855s ago: executing program 0 (id=1610): r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xffffffff, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) write(r0, &(0x7f0000000000)="0100", 0x2) 458.36307ms ago: executing program 4 (id=1611): r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4800}, 0xc5) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40004) 378.383299ms ago: executing program 0 (id=1612): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 328.346882ms ago: executing program 3 (id=1613): syz_open_dev$sndpcmc(&(0x7f0000000340), 0x1, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008d}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) syz_genetlink_get_family_id$batadv(&(0x7f0000000300), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_OPENAT2={0x1c, 0x68, 0x0, 0xffffffffffffffff, &(0x7f0000000700)={0x4900, 0x92, 0xe}, &(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x18, 0x0, 0x12345}) ioctl$IOMMU_IOAS_COPY(0xffffffffffffffff, 0x3b83, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, 0x0, 0x80) 237.151139ms ago: executing program 1 (id=1614): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000280), 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0) symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testnqn\x00') 236.738263ms ago: executing program 0 (id=1615): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x4001}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) sendmmsg$unix(r1, &(0x7f0000005400)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000200)="d8", 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x880}}], 0x1, 0x80) 195.388881ms ago: executing program 0 (id=1616): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) add_key(0x0, 0x0, 0x0, 0x0, r0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xa) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/ptp/ptp0/max_vclocks\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x3c, 0x0, 0x8, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_SYN_SENT2={0x8, 0x9, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x4305}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000804}, 0x0) 0s ago: executing program 1 (id=1617): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0xfffffffffffffec5) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) getdents64(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001940)}, 0x80c0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001480)={0x28, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x47}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) kernel console output (not intermixed with test programs): 6] hub 2-1:0.0: bad descriptor, ignoring hub [ 464.578429][ T1576] hub 2-1:0.0: probe with driver hub failed with error -5 [ 464.596358][ T1576] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 466.042429][ T5771] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 467.136006][ T1576] usb 1-1: USB disconnect, device number 20 [ 467.263783][ T5688] usb 4-1: USB disconnect, device number 21 [ 467.669819][ T5771] em28xx 5-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=214) [ 467.669871][ T5771] em28xx 5-1:0.0: board has no eeprom [ 468.012173][ T5771] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 468.012213][ T5771] em28xx 5-1:0.0: dvb set to bulk mode. [ 468.025457][ T5688] em28xx 5-1:0.0: Binding DVB extension [ 468.025766][ T974] usb 2-1: USB disconnect, device number 17 [ 468.031160][ T5771] usb 5-1: USB disconnect, device number 19 [ 468.055285][ T5771] em28xx 5-1:0.0: Disconnecting em28xx [ 468.061584][ T974] usb 3-1: USB disconnect, device number 20 [ 468.169949][ T5688] em28xx 5-1:0.0: Registering input extension [ 468.171941][ T5771] em28xx 5-1:0.0: Closing input extension [ 469.315784][ T5771] em28xx: Freeing device [ 470.764136][ T9247] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 471.075440][ T31] audit: type=1400 audit(1788370668.990:480): avc: denied { ioctl } for pid=9251 comm="syz.0.958" path="socket:[23888]" dev="sockfs" ino=23888 ioctlcmd=0x8918 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 471.579281][ T8799] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 472.690061][ T8799] usb 5-1: Using ep0 maxpacket: 16 [ 472.696369][ T8799] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 472.707211][ T8799] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 472.727253][ T8799] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.735402][ T8799] usb 5-1: Product: syz [ 472.735441][ T8799] usb 5-1: Manufacturer: syz [ 472.735457][ T8799] usb 5-1: SerialNumber: syz [ 472.755250][ T8799] usb 5-1: config 0 descriptor?? [ 472.772509][ T8799] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 472.781858][ T8799] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 473.221360][ T9264] siw: device registration error -23 [ 473.474863][ T8799] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 473.522318][ T9] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 474.206690][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 474.214415][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 474.518021][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 474.518084][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 474.518140][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.545671][ T9] usb 3-1: config 0 descriptor?? [ 474.562485][ T9] hub 3-1:0.0: bad descriptor, ignoring hub [ 474.562509][ T9] hub 3-1:0.0: probe with driver hub failed with error -5 [ 474.564295][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 474.711341][ T8799] em28xx 5-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=214) [ 474.721137][ T8799] em28xx 5-1:0.0: board has no eeprom [ 474.722995][ T9271] nbd: must specify a size in bytes for the device [ 474.727631][ T9271] netlink: 12 bytes leftover after parsing attributes in process `syz.1.964'. [ 475.011944][ T8799] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 475.020073][ T8799] em28xx 5-1:0.0: dvb set to bulk mode. [ 475.209624][ T9] em28xx 5-1:0.0: Binding DVB extension [ 475.286450][ T8799] usb 5-1: USB disconnect, device number 20 [ 475.424631][ T8799] em28xx 5-1:0.0: Disconnecting em28xx [ 476.171462][ T9] em28xx 5-1:0.0: Registering input extension [ 476.176555][ T8799] em28xx 5-1:0.0: Closing input extension [ 476.195523][ T8799] em28xx: Freeing device [ 477.371792][ T8799] usb 3-1: USB disconnect, device number 21 [ 478.631976][ T8799] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 479.372482][ T8799] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 479.373402][ T8799] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 479.373425][ T8799] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 479.373443][ T8799] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 479.373482][ T8799] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 479.374806][ T8799] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 479.374828][ T8799] usb 1-1: Product: syz [ 479.374842][ T8799] usb 1-1: Manufacturer: syz [ 479.379053][ T8799] cdc_wdm 1-1:1.0: skipping garbage [ 479.379075][ T8799] cdc_wdm 1-1:1.0: skipping garbage [ 479.381867][ T8799] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 479.381883][ T8799] cdc_wdm 1-1:1.0: Unknown control protocol [ 479.577894][ T8799] usb 1-1: USB disconnect, device number 21 [ 479.783632][ T974] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 479.962062][ T974] usb 2-1: Using ep0 maxpacket: 32 [ 479.977472][ T974] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 480.002905][ T974] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 480.014028][ T974] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 480.029379][ T974] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.161233][ T974] usb 2-1: config 0 descriptor?? [ 480.270187][ T974] hub 2-1:0.0: bad descriptor, ignoring hub [ 480.276381][ T974] hub 2-1:0.0: probe with driver hub failed with error -5 [ 480.335718][ T974] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 482.858106][ T5710] usb 2-1: USB disconnect, device number 18 [ 484.703031][ T9362] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 484.879284][ T9375] SELinux: security_context_str_to_sid (*e({)]-) failed with errno=-22 [ 484.889703][ T9375] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 485.838987][ T974] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 486.152218][ T974] usb 2-1: Using ep0 maxpacket: 16 [ 486.172026][ T974] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 486.191137][ T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 486.220514][ T974] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.230178][ T974] usb 2-1: Product: syz [ 486.234711][ T974] usb 2-1: Manufacturer: syz [ 486.239403][ T974] usb 2-1: SerialNumber: syz [ 486.248002][ T974] usb 2-1: config 0 descriptor?? [ 486.262172][ T974] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 486.279655][ T974] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 487.472949][ T1576] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 487.502357][ T5710] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 487.529954][ T974] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 487.672184][ T5710] usb 5-1: Using ep0 maxpacket: 32 [ 487.685311][ T1576] usb 1-1: Using ep0 maxpacket: 32 [ 487.690979][ T5710] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 487.707101][ T1576] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 487.712441][ T1576] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.712478][ T1576] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 487.712516][ T1576] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.724154][ T1576] usb 1-1: config 0 descriptor?? [ 487.728769][ T1576] hub 1-1:0.0: bad descriptor, ignoring hub [ 487.728790][ T1576] hub 1-1:0.0: probe with driver hub failed with error -5 [ 487.734398][ T1576] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 487.753053][ T5710] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 487.754215][ T5710] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 487.754533][ T5710] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.777209][ T5710] usb 5-1: config 0 descriptor?? [ 487.781432][ T5710] hub 5-1:0.0: bad descriptor, ignoring hub [ 487.781472][ T5710] hub 5-1:0.0: probe with driver hub failed with error -5 [ 487.783159][ T5710] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 489.451432][ T974] em28xx 2-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=214) [ 489.451480][ T974] em28xx 2-1:0.0: board has no eeprom [ 489.506508][ T9419] dlm: no local IP address has been set [ 489.506534][ T9419] dlm: cannot start dlm midcomms -107 [ 489.743778][ T974] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 489.743825][ T974] em28xx 2-1:0.0: dvb set to bulk mode. [ 489.754051][ T5710] em28xx 2-1:0.0: Binding DVB extension [ 489.758397][ T974] usb 2-1: USB disconnect, device number 19 [ 489.763043][ T974] em28xx 2-1:0.0: Disconnecting em28xx [ 489.827999][ T5710] em28xx 2-1:0.0: Registering input extension [ 489.828168][ T974] em28xx 2-1:0.0: Closing input extension [ 489.856951][ T974] em28xx: Freeing device [ 490.254401][ T9435] SELinux: security_context_str_to_sid (*e({)]-) failed with errno=-22 [ 490.254713][ T9435] SELinux: security_context_str_to_sid (Eá…) failed with errno=-22 [ 490.423483][ T974] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 491.197761][ T974] usb 3-1: Using ep0 maxpacket: 16 [ 491.718381][ T5710] usb 5-1: USB disconnect, device number 21 [ 491.729587][ T974] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 491.742563][ T974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 492.298488][ T974] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.298537][ T974] usb 3-1: Product: syz [ 492.298564][ T974] usb 3-1: Manufacturer: syz [ 492.298582][ T974] usb 3-1: SerialNumber: syz [ 492.368624][ T974] usb 3-1: config 0 descriptor?? [ 492.378601][ T974] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 492.392290][ T974] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 492.411443][ T9447] netlink: 'syz.3.1008': attribute type 106 has an invalid length. [ 492.626318][ T5688] usb 1-1: reset high-speed USB device number 22 using dummy_hcd [ 493.079405][ T974] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 493.995570][ T974] em28xx 3-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=214) [ 494.007409][ T974] em28xx 3-1:0.0: board has no eeprom [ 494.235360][ T9450] netlink: 'syz.1.1009': attribute type 106 has an invalid length. [ 494.251983][ T974] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 494.252020][ T974] em28xx 3-1:0.0: dvb set to bulk mode. [ 494.260906][ T5771] em28xx 3-1:0.0: Binding DVB extension [ 494.284006][ T974] usb 3-1: USB disconnect, device number 22 [ 494.295624][ T974] em28xx 3-1:0.0: Disconnecting em28xx [ 494.442334][ T5771] em28xx 3-1:0.0: Registering input extension [ 494.448837][ T974] em28xx 3-1:0.0: Closing input extension [ 494.489162][ T974] em28xx: Freeing device [ 495.292545][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 495.292711][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 495.293246][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 495.293325][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 495.293661][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 495.293718][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 495.293961][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 495.294012][ T9466] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512 [ 495.294043][ T9466] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1) [ 495.374764][ T974] usb 1-1: USB disconnect, device number 22 [ 496.064665][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 496.064730][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 498.432209][ T9495] siw: device registration error -23 [ 498.687208][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 498.688305][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 498.692235][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 498.692901][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 498.694499][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 498.694903][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 498.697075][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 498.697469][ T9484] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 498.697499][ T9484] UDF-fs: warning (device loop3): udf_fill_super: No partition found (1) [ 501.391499][ T9504] nbd: must specify a size in bytes for the device [ 501.426323][ T9504] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1023'. [ 501.572168][ T974] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 501.732547][ T974] usb 2-1: Using ep0 maxpacket: 16 [ 501.740347][ T974] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 501.750950][ T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 501.770498][ T974] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.779577][ T974] usb 2-1: Product: syz [ 501.784735][ T974] usb 2-1: Manufacturer: syz [ 501.784754][ T974] usb 2-1: SerialNumber: syz [ 501.802725][ T974] usb 2-1: config 0 descriptor?? [ 501.817576][ T974] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 501.829204][ T974] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 502.021324][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 502.031425][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 502.043254][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 502.048942][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 502.052410][ T1576] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 502.058681][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 502.058776][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 502.059214][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 502.059296][ T9519] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 502.059313][ T9519] UDF-fs: warning (device loop3): udf_fill_super: No partition found (1) [ 502.202847][ T1576] usb 1-1: Using ep0 maxpacket: 32 [ 502.204759][ T1576] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 502.206061][ T1576] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 502.206098][ T1576] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 502.206136][ T1576] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.215160][ T1576] usb 1-1: config 0 descriptor?? [ 502.263142][ T1576] hub 1-1:0.0: bad descriptor, ignoring hub [ 502.265521][ T1576] hub 1-1:0.0: probe with driver hub failed with error -5 [ 502.274913][ T1576] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 502.588543][ T974] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 503.841058][ T9529] binder: 9528:9529 unknown command 0 [ 503.841089][ T9529] binder: 9528:9529 ioctl c0306201 2000000004c0 returned -22 [ 503.841965][ T9529] binder: 9528:9529 ioctl 9360 2 returned -22 [ 503.842405][ T9529] binder: 9528:9529 ioctl c0306201 200000000180 returned -14 [ 503.914569][ T974] em28xx 2-1:0.0: read from i2c device at 0xa0 failed with unknown error (status=214) [ 503.924622][ T974] em28xx 2-1:0.0: board has no eeprom [ 504.632339][ T974] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 504.632383][ T974] em28xx 2-1:0.0: dvb set to bulk mode. [ 504.650722][ T5688] em28xx 2-1:0.0: Binding DVB extension [ 504.681322][ T974] usb 2-1: USB disconnect, device number 20 [ 505.259430][ T974] em28xx 2-1:0.0: Disconnecting em28xx [ 505.355267][ T5688] em28xx 2-1:0.0: Registering input extension [ 505.363785][ T974] em28xx 2-1:0.0: Closing input extension [ 505.377955][ T5688] usb 1-1: USB disconnect, device number 23 [ 505.459280][ T974] em28xx: Freeing device [ 507.107705][ T9551] binder: BINDER_SET_CONTEXT_MGR already set [ 507.107732][ T9551] binder: 9550:9551 ioctl 4018620d 200000004a80 returned -16 [ 507.121252][ T9551] binder: 9550:9551 ioctl 540f 200000000180 returned -22 [ 507.127531][ T9551] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 507.156792][ T9543] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 508.192675][ T9557] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 509.128006][ T31] audit: type=1400 audit(1788370707.040:481): avc: denied { mounton } for pid=9556 comm="syz.1.1039" path="/syzcgroup/unified/syz1" dev="cgroup2" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 512.815147][ T9577] binder: 9576:9577 unknown command 0 [ 512.822400][ T9577] binder: 9576:9577 ioctl c0306201 2000000004c0 returned -22 [ 512.843795][ T9577] binder: 9576:9577 ioctl 9360 2 returned -22 [ 512.855366][ T9577] binder: 9576:9577 ioctl c0306201 200000000180 returned -14 [ 516.002194][ T9] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 516.163801][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 516.165606][ T9] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 516.166538][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 516.168344][ T9] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 516.168367][ T9] usb 1-1: Product: syz [ 516.168381][ T9] usb 1-1: Manufacturer: syz [ 516.168394][ T9] usb 1-1: SerialNumber: syz [ 516.200265][ T9] usb 1-1: config 0 descriptor?? [ 516.201660][ T9595] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 516.204331][ T9] hub 1-1:0.0: bad descriptor, ignoring hub [ 516.204352][ T9] hub 1-1:0.0: probe with driver hub failed with error -5 [ 516.303206][ T8799] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 516.482715][ T9606] binder: BINDER_SET_CONTEXT_MGR already set [ 516.489593][ T9606] binder: 9605:9606 ioctl 4018620d 200000004a80 returned -16 [ 516.510110][ T9606] binder: 9605:9606 ioctl 540f 200000000180 returned -22 [ 516.521088][ T9606] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false [ 516.967722][ T8799] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 516.968650][ T8799] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 516.968688][ T8799] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 516.968710][ T8799] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 516.968753][ T8799] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 516.970788][ T8799] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 516.970822][ T8799] usb 4-1: Product: syz [ 516.970848][ T8799] usb 4-1: Manufacturer: syz [ 516.977511][ T8799] cdc_wdm 4-1:1.0: skipping garbage [ 516.977528][ T8799] cdc_wdm 4-1:1.0: skipping garbage [ 516.980462][ T8799] cdc_wdm 4-1:1.0: cdc-wdm1: USB WDM device [ 516.980479][ T8799] cdc_wdm 4-1:1.0: Unknown control protocol [ 517.129466][ T9608] ceph: No mds server is up or the cluster is laggy [ 517.228571][ T9595] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.228952][ T9595] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.251097][ T9600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.260397][ T9600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.306426][ T9612] jffs2: notice: (9612) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 517.509139][ T31] audit: type=1400 audit(1788370715.420:482): avc: denied { read } for pid=9613 comm="syz.4.1055" name="trace" dev="tracefs" ino=4167 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 517.527672][ T9622] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1056'. [ 517.554960][ T31] audit: type=1400 audit(1788370715.470:483): avc: denied { write } for pid=9613 comm="syz.4.1055" name="usb_gadget" dev="configfs" ino=1719 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 517.581740][ T31] audit: type=1400 audit(1788370715.500:484): avc: denied { write } for pid=9613 comm="syz.4.1055" name="functions" dev="configfs" ino=23239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 517.823565][ T31] audit: type=1400 audit(1788370715.740:485): avc: denied { write } for pid=9629 comm="syz.1.1059" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 517.924278][ T31] audit: type=1400 audit(1788370715.830:486): avc: denied { map } for pid=9633 comm="syz.1.1060" path="socket:[24747]" dev="sockfs" ino=24747 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 518.007007][ T9636] netlink: 'syz.2.1051': attribute type 4 has an invalid length. [ 518.479249][ T9638] syzkaller0: entered promiscuous mode [ 518.487184][ T9638] syzkaller0: entered allmulticast mode [ 518.685505][ T9643] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1063'. [ 518.800124][ T9646] comedi comedi3: pcl818: I/O base address not correctly aligned [ 518.825769][ T31] audit: type=1400 audit(1788370716.740:487): avc: denied { mount } for pid=9640 comm="syz.1.1062" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 518.918891][ T9650] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1066'. [ 518.918936][ T9650] netlink: 'syz.4.1066': attribute type 7 has an invalid length. [ 518.918968][ T9650] netlink: 'syz.4.1066': attribute type 8 has an invalid length. [ 518.918983][ T9650] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1066'. [ 518.925440][ T9650] ip6gretap0: entered promiscuous mode [ 518.926608][ T9650] syz_tun: entered promiscuous mode [ 518.927747][ T9650] erspan0: entered promiscuous mode [ 519.064277][ T974] usb 1-1: USB disconnect, device number 24 [ 519.087008][ T5771] usb 4-1: USB disconnect, device number 22 [ 519.182781][ T31] audit: type=1400 audit(1788370717.090:488): avc: denied { setopt } for pid=9647 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 519.198203][ T31] audit: type=1400 audit(1788370717.110:489): avc: denied { setattr } for pid=9652 comm="syz.4.1067" name="RFCOMM" dev="sockfs" ino=23292 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 519.666251][ T31] audit: type=1400 audit(1788370717.580:490): avc: denied { unmount } for pid=5609 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 519.838958][ T9658] jffs2: notice: (9658) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 519.843111][ T31] audit: type=1400 audit(1788370717.760:491): avc: denied { mounton } for pid=9657 comm="syz.3.1068" path="/204/file0" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 519.843745][ T9658] overlayfs: workdir and upperdir must reside under the same mount [ 520.260545][ T9671] comedi comedi3: dt2817: I/O base address or length out of range [ 520.312084][ T5771] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 520.475322][ T5771] usb 1-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 520.494444][ T5771] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 520.505663][ T5771] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.668902][ T5771] usb 1-1: selecting invalid altsetting 1 [ 520.688130][ T5771] dvb_ttusb_budget: ttusb_init_controller: error [ 520.694630][ T5771] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 520.753973][ T1576] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 520.782221][ T5771] DVB: Unable to find symbol stv0299_attach() [ 520.911149][ T5771] DVB: Unable to find symbol tda8083_attach() [ 520.911174][ T5771] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 521.962588][ T1576] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 521.967349][ T1576] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 521.967373][ T1576] usb 5-1: config 0 has no interface number 0 [ 521.967408][ T1576] usb 5-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 521.969138][ T1576] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.969160][ T1576] usb 5-1: Product: syz [ 521.969174][ T1576] usb 5-1: Manufacturer: syz [ 521.969189][ T1576] usb 5-1: SerialNumber: syz [ 521.974533][ T1576] usb 5-1: config 0 descriptor?? [ 522.001501][ T1576] yurex 5-1:0.50: USB YUREX device now attached to Yurex #0 [ 523.346993][ T974] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 523.426775][ T1576] usb 1-1: USB disconnect, device number 25 [ 523.449859][ C0] usb 5-1: yurex_control_callback - control failed: -71 [ 523.487418][ T9] usb 5-1: USB disconnect, device number 22 [ 523.502642][ T9] yurex 5-1:0.50: USB YUREX #0 now disconnected [ 523.513138][ T974] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 523.523445][ T974] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 523.537586][ T974] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 523.551953][ T974] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.560152][ T974] usb 4-1: Product: syz [ 523.564547][ T974] usb 4-1: Manufacturer: syz [ 523.569261][ T974] usb 4-1: SerialNumber: syz [ 523.599893][ T974] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 523.613107][ T974] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 523.622254][ T9696] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1083'. [ 523.622366][ T9696] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 523.622377][ T9696] IPv6: NLM_F_CREATE should be set when creating new route [ 523.657368][ T974] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 524.676106][ T1576] usb 4-1: USB disconnect, device number 23 [ 525.101147][ T1576] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 525.134746][ T1576] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 525.154609][ T1576] ti_usb_3410_5052 4-1:2.0: device disconnected [ 525.239356][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 525.239581][ T31] audit: type=1400 audit(1788370723.150:495): avc: denied { write } for pid=9702 comm="syz.4.1086" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 525.248543][ T9704] binder: 9702:9704 ioctl 4018620d 0 returned -22 [ 525.252210][ T31] audit: type=1400 audit(1788370723.160:496): avc: denied { create } for pid=9702 comm="syz.4.1086" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 525.308114][ T9704] jffs2: notice: (9704) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 525.339679][ T31] audit: type=1400 audit(1788370723.250:497): avc: denied { write } for pid=9702 comm="syz.4.1086" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 525.349860][ T31] audit: type=1400 audit(1788370723.260:498): avc: denied { add_name } for pid=9702 comm="syz.4.1086" name="test2" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 525.352721][ T31] audit: type=1400 audit(1788370723.260:499): avc: denied { create } for pid=9702 comm="syz.4.1086" name="test2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 525.525548][ T31] audit: type=1400 audit(1788370723.440:500): avc: denied { read write open } for pid=9702 comm="syz.4.1086" path="/231/mnt/test2" dev="jffs2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 526.121550][ T9714] xt_hashlimit: size too large, truncated to 1048576 [ 526.136933][ T31] audit: type=1400 audit(1788370724.040:501): avc: denied { create } for pid=9715 comm="syz.2.1080" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 526.136979][ T31] audit: type=1400 audit(1788370724.040:502): avc: denied { write } for pid=9715 comm="syz.2.1080" name="configs" dev="configfs" ino=23240 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 526.137015][ T31] audit: type=1400 audit(1788370724.040:503): avc: denied { write } for pid=9715 comm="syz.2.1080" name="functions" dev="configfs" ino=23239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 526.137052][ T31] audit: type=1400 audit(1788370724.040:504): avc: denied { write } for pid=9715 comm="syz.2.1080" name="c.1" dev="configfs" ino=24855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 527.491330][ T9722] nbd0: detected capacity change from 0 to 63 [ 527.515656][ T5612] block nbd0: Receive control failed (result -104) [ 528.101698][ T9736] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 528.169056][ T9741] loop9: detected capacity change from 0 to 2640 [ 528.172958][ T9741] buffer_io_error: 11 callbacks suppressed [ 528.173041][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.173328][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.173497][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.173636][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.173758][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174045][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174227][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174363][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174430][ T9741] ldm_validate_partition_table(): Disk read failed. [ 528.174533][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174637][ T9741] Buffer I/O error on dev loop9, logical block 0, async page read [ 528.174775][ T9741] Dev loop9: unable to read RDB block 0 [ 528.175270][ T9741] loop9: unable to read partition table [ 528.176130][ T9741] loop_reread_partitions: partition scan of loop9 (3Ÿ ¾‚³˜) failed (rc=-5) [ 528.446313][ T9736] ceph: No mds server is up or the cluster is laggy [ 530.262102][ T5612] Bluetooth: hci3: unexpected event for opcode 0x2060 [ 530.729134][ T9777] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1108'. [ 530.729600][ T9777] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1108'. [ 530.831451][ T9777] gretap0: entered promiscuous mode [ 530.844040][ T9777] gretap0: left promiscuous mode [ 532.126744][ T9790] mmap: syz.0.1110 (9790) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 532.861055][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 532.861106][ T31] audit: type=1400 audit(1788370730.710:507): avc: denied { write } for pid=9786 comm="syz.2.1112" name="ports" dev="configfs" ino=3105 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 532.903506][ T31] audit: type=1400 audit(1788370730.810:508): avc: denied { read } for pid=9786 comm="syz.2.1112" name="addr_trtype" dev="configfs" ino=24977 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 532.920783][ T31] audit: type=1400 audit(1788370730.830:510): avc: denied { write } for pid=9786 comm="syz.2.1112" name="subsystems" dev="configfs" ino=24973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 532.941817][ T31] audit: type=1800 audit(1788370730.820:509): pid=9792 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1112" name="addr_trtype" dev="configfs" ino=24977 res=0 errno=0 [ 533.157860][ T9797] netlink: 'syz.1.1116': attribute type 11 has an invalid length. [ 533.222318][ T1576] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 533.402385][ T1576] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 533.412568][ T1576] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 533.412627][ T1576] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 533.412649][ T1576] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 533.412672][ T1576] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 533.412708][ T1576] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.026126][ T9801] binder: 9799:9801 ioctl 4018620d 0 returned -22 [ 535.171998][ T31] audit: type=1400 audit(1788370732.970:511): avc: denied { mount } for pid=9807 comm="syz.1.1120" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 535.527985][ T1576] gud 5-1:1.0: Failed to add properties (error=-71) [ 535.528035][ T1576] gud 5-1:1.0: probe with driver gud failed with error -71 [ 535.562655][ T1576] usb 5-1: USB disconnect, device number 23 [ 535.734061][ T31] audit: type=1400 audit(1788370733.650:512): avc: denied { write } for pid=9811 comm="syz.4.1121" name="functions" dev="configfs" ino=23239 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 535.818656][ T31] audit: type=1400 audit(1788370733.710:513): avc: denied { write } for pid=9811 comm="syz.4.1121" name="target" dev="configfs" ino=3107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 535.818717][ T31] audit: type=1400 audit(1788370733.720:514): avc: denied { write } for pid=9811 comm="syz.4.1121" name="usb_gadget" dev="configfs" ino=25058 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 535.841315][ T31] audit: type=1400 audit(1788370733.730:515): avc: denied { write } for pid=9811 comm="syz.4.1121" name="naa.1234567890abcdef" dev="configfs" ino=25060 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 537.584711][ T5710] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 538.112083][ T5710] usb 4-1: Using ep0 maxpacket: 8 [ 538.117721][ T5710] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ee [ 538.132178][ T5710] usb 4-1: config 0 has no interfaces? [ 538.303020][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.303047][ T5710] usb 4-1: Product: syz [ 538.303069][ T5710] usb 4-1: Manufacturer: syz [ 538.303086][ T5710] usb 4-1: SerialNumber: syz [ 538.313942][ T5710] usb 4-1: config 0 descriptor?? [ 538.851968][ T31] audit: type=1400 audit(1788370736.320:516): avc: denied { ioctl } for pid=9833 comm="syz.4.1127" path="/242/file0" dev="tmpfs" ino=1385 ioctlcmd=0x5451 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 538.931990][ T8977] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 539.320348][ T974] usb 4-1: USB disconnect, device number 24 [ 539.364355][ T8977] usb 1-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 539.375212][ T8977] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 539.385270][ T8977] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 539.385311][ T8977] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 539.434336][ T8977] usb 1-1: probing VID:PID(0424:012C) [ 539.445662][ T8977] usb 1-1: vub300 testing BULK IN EndPoint(0) 81 [ 539.445695][ T8977] usb 1-1: vub300 testing BULK OUT EndPoint(1) 02 [ 539.445708][ T8977] usb 1-1: vub300 testing BULK IN EndPoint(2) 83 [ 539.445720][ T8977] usb 1-1: vub300 testing BULK OUT EndPoint(3) 04 [ 539.445732][ T8977] usb 1-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 540.247965][ T8977] usb 1-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 540.360931][ T31] audit: type=1400 audit(1788370738.270:517): avc: denied { create } for pid=9850 comm="syz.1.1132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 540.781415][ T8977] usb 1-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 542.294228][ T31] audit: type=1400 audit(1788370740.030:518): avc: denied { write } for pid=9863 comm="syz.3.1137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 542.689056][ T8977] usb 1-1: SET_CLOCK_SPEED 200kHz failed with retval=-71 [ 543.891801][ T8977] usb 1-1: USB disconnect, device number 26 [ 544.036028][ T31] audit: type=1400 audit(1788370741.950:519): avc: denied { create } for pid=9875 comm="syz.3.1139" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 544.163384][ T31] audit: type=1400 audit(1788370742.080:520): avc: denied { write } for pid=9877 comm="syz.0.1141" name="usb_gadget" dev="configfs" ino=1719 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 544.243143][ T31] audit: type=1400 audit(1788370742.160:521): avc: denied { write } for pid=9877 comm="syz.0.1141" name="functions" dev="configfs" ino=25136 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 544.382056][ T9883] FAULT_INJECTION: forcing a failure. [ 544.382056][ T9883] name failslab, interval 1, probability 0, space 0, times 0 [ 544.382108][ T9883] CPU: 1 UID: 0 PID: 9883 Comm: syz.3.1142 Tainted: G L syzkaller #0 PREEMPT(full) [ 544.382138][ T9883] Tainted: [L]=SOFTLOCKUP [ 544.382145][ T9883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 544.382157][ T9883] Call Trace: [ 544.382164][ T9883] [ 544.382171][ T9883] dump_stack_lvl+0x100/0x190 [ 544.382205][ T9883] should_fail_ex.cold+0x5/0xa [ 544.382229][ T9883] should_failslab+0xc2/0x120 [ 544.382254][ T9883] __kmalloc_cache_noprof+0x91/0x6d0 [ 544.382287][ T9883] ? register_netdevice+0x50c/0x25a0 [ 544.382327][ T9883] register_netdevice+0x50c/0x25a0 [ 544.382355][ T9883] ? __pfx_register_netdevice+0x10/0x10 [ 544.382377][ T9883] ? alloc_netdev_mqs+0x120a/0x15c0 [ 544.382405][ T9883] __tun_chr_ioctl+0x1ef4/0x4880 [ 544.382433][ T9883] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 544.382463][ T9883] ? ioctl_has_perm.constprop.0.isra.0+0x380/0x540 [ 544.382500][ T9883] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 544.382527][ T9883] ? __fget_files+0x34/0x3d0 [ 544.382561][ T9883] ? selinux_file_ioctl+0x13b/0x290 [ 544.382589][ T9883] ? selinux_file_ioctl+0xb6/0x290 [ 544.382619][ T9883] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 544.382650][ T9883] __x64_sys_ioctl+0x18e/0x210 [ 544.382680][ T9883] do_syscall_64+0x123/0x790 [ 544.382707][ T9883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.382726][ T9883] RIP: 0033:0x7f600bd9e159 [ 544.382744][ T9883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.382762][ T9883] RSP: 002b:00007f600cbf1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 544.382782][ T9883] RAX: ffffffffffffffda RBX: 00007f600c025fa0 RCX: 00007f600bd9e159 [ 544.382797][ T9883] RDX: 0000200000000040 RSI: 00000000400454ca RDI: 0000000000000004 [ 544.382810][ T9883] RBP: 00007f600be35024 R08: 0000000000000000 R09: 0000000000000000 [ 544.382822][ T9883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 544.382833][ T9883] R13: 00007f600c026038 R14: 00007f600c025fa0 R15: 00007ffc83d57938 [ 544.382860][ T9883] [ 544.577409][ T31] audit: type=1400 audit(1788370742.490:522): avc: denied { connect } for pid=9886 comm="syz.0.1144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 544.624835][ T31] audit: type=1400 audit(1788370742.540:523): avc: denied { write } for pid=9886 comm="syz.0.1144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 544.643527][ T31] audit: type=1400 audit(1788370742.550:524): avc: denied { getopt } for pid=9886 comm="syz.0.1144" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 544.971994][ T31] audit: type=1400 audit(1788370742.850:525): avc: denied { bind } for pid=9888 comm="syz.3.1145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 545.022817][ T9901] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1150'. [ 545.032465][ T9901] netlink: 'syz.1.1150': attribute type 7 has an invalid length. [ 545.040405][ T9901] netlink: 'syz.1.1150': attribute type 8 has an invalid length. [ 545.048302][ T9901] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1150'. [ 545.190345][ T9900] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1148'. [ 545.213885][ T9900] bridge_slave_1: left allmulticast mode [ 545.213923][ T9900] bridge_slave_1: left promiscuous mode [ 545.214166][ T9900] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.229835][ T9900] bridge_slave_0: left allmulticast mode [ 546.229873][ T9900] bridge_slave_0: left promiscuous mode [ 546.230053][ T9900] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.496626][ T31] audit: type=1400 audit(1788370745.410:526): avc: denied { link } for pid=9913 comm="syz.0.1156" name="#7" dev="tmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 547.721544][ T31] audit: type=1400 audit(1788370745.420:527): avc: denied { rename } for pid=9913 comm="syz.0.1156" name="#8" dev="tmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 550.736529][ T31] audit: type=1400 audit(1788370748.650:528): avc: denied { ioctl } for pid=9937 comm="syz.2.1162" path="socket:[25225]" dev="sockfs" ino=25225 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 550.962532][ T9953] smc: net device vlan1 applied user defined pnetid SYZ2 [ 551.080654][ T31] audit: type=1400 audit(1788370748.990:529): avc: denied { map } for pid=9951 comm="syz.4.1140" path="/dev/nullb0" dev="devtmpfs" ino=694 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 551.752043][ T9939] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 551.789244][ T9962] binder: 9961:9962 ioctl 4018620d 0 returned -22 [ 551.872147][ T9964] jffs2: notice: (9964) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 551.884436][ T31] audit: type=1400 audit(1788370749.800:530): avc: denied { write } for pid=9961 comm="syz.2.1167" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 551.940724][ T9968] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1169'. [ 551.951541][ T9968] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=9968 comm=syz.0.1169 [ 552.137233][ T31] audit: type=1400 audit(1788370750.050:531): avc: denied { write } for pid=9975 comm="syz.1.1173" name="subsystems" dev="configfs" ino=3104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 552.139251][ T31] audit: type=1400 audit(1788370750.050:532): avc: denied { write } for pid=9975 comm="syz.1.1173" name="namespaces" dev="configfs" ino=25907 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 552.140627][ T9976] nvmet: adding nsid 1 to subsystem testsubsys [ 552.148798][ T9976] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 552.153914][ T31] audit: type=1400 audit(1788370750.060:533): avc: denied { write } for pid=9975 comm="syz.1.1173" name="subsystems" dev="configfs" ino=24973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 552.156477][ T31] audit: type=1400 audit(1788370750.070:534): avc: denied { write } for pid=9975 comm="syz.1.1173" name="subsystems" dev="configfs" ino=24973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 553.017028][ T9985] /dev/nullb0: Can't open blockdev [ 553.056452][ T31] audit: type=1400 audit(1788370750.970:535): avc: denied { connect } for pid=9987 comm="syz.0.1176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 553.190619][ T31] audit: type=1400 audit(1788370751.100:536): avc: denied { setopt } for pid=9993 comm="syz.4.1179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 553.236994][ T31] audit: type=1400 audit(1788370751.150:537): avc: denied { write } for pid=9995 comm="syz.3.1180" name="strings" dev="configfs" ino=23241 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 554.066650][T10007] netlink: 'syz.3.1184': attribute type 19 has an invalid length. [ 555.872300][ T8799] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 557.026331][ T8799] usb 5-1: Using ep0 maxpacket: 8 [ 557.027260][ T8799] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 557.028131][ T8799] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 557.028160][ T8799] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 557.028194][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 557.028220][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 557.028244][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 557.028267][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 557.028290][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 557.028315][ T8799] usb 5-1: config 168 interface 0 has no altsetting 0 [ 557.044940][ T8799] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 557.044973][ T8799] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 557.045008][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 557.045034][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 557.045058][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 557.045081][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 557.045105][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 557.045128][ T8799] usb 5-1: config 168 interface 0 has no altsetting 0 [ 557.050597][ T8799] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 557.050629][ T8799] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 557.050663][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 557.050688][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 557.050712][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 557.050735][ T8799] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 557.050758][ T8799] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 557.050781][ T8799] usb 5-1: config 168 interface 0 has no altsetting 0 [ 557.086561][ T8799] usb 5-1: string descriptor 0 read error: -22 [ 557.086672][ T8799] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.170144][ T8799] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 557.363212][ T8799] usb 5-1: USB disconnect, device number 24 [ 557.510825][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 557.511563][ T11] block nbd0: Possible stuck request ffff888028160000: control (read@0,1024B). Runtime 30 seconds [ 557.512670][ T11] block nbd0: Possible stuck request ffff8880281601c0: control (read@1024,1024B). Runtime 30 seconds [ 557.512699][ T11] block nbd0: Possible stuck request ffff888028160380: control (read@2048,1024B). Runtime 30 seconds [ 557.512722][ T11] block nbd0: Possible stuck request ffff888028160540: control (read@3072,1024B). Runtime 30 seconds [ 557.517566][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 558.924920][ T31] kauditd_printk_skb: 9 callbacks suppressed [ 558.924967][ T31] audit: type=1400 audit(1788370756.840:547): avc: denied { sqpoll } for pid=10051 comm="syz.1.1189" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 559.336872][ T31] audit: type=1400 audit(1788370757.250:548): avc: denied { setopt } for pid=10067 comm="syz.3.1202" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 559.418531][T10070] jffs2: notice: (10070) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 559.577153][ T5688] usb 5-1: new low-speed USB device number 25 using dummy_hcd [ 559.740153][ T5688] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 559.806120][ T5688] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 559.815272][ T5688] usb 5-1: config 0 has no interface number 0 [ 559.815439][ T5688] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 559.815549][ T5688] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 559.822930][ T5688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.020300][ T5688] usb 5-1: config 0 descriptor?? [ 560.072868][T10066] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 560.548720][ T5688] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 560.756860][ T31] audit: type=1400 audit(1788370758.670:549): avc: denied { write } for pid=10082 comm="syz.3.1207" name="header" dev="configfs" ino=25326 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.759247][ T31] audit: type=1400 audit(1788370758.670:550): avc: denied { write } for pid=10082 comm="syz.3.1207" name="fs" dev="configfs" ino=25333 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.771132][ T31] audit: type=1400 audit(1788370758.670:551): avc: denied { write } for pid=10082 comm="syz.3.1207" name="fs" dev="configfs" ino=25333 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.775203][ T31] audit: type=1400 audit(1788370758.670:552): avc: denied { write } for pid=10082 comm="syz.3.1207" name="fs" dev="configfs" ino=25322 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.781018][ T31] audit: type=1400 audit(1788370758.700:553): avc: denied { write } for pid=10082 comm="syz.3.1207" name="c.1" dev="configfs" ino=24855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.802891][ T31] audit: type=1400 audit(1788370758.700:554): avc: denied { write } for pid=10082 comm="syz.3.1207" name="c.1" dev="configfs" ino=24855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 560.808973][ T1576] usb 5-1: USB disconnect, device number 25 [ 560.991989][ T8799] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 561.182034][ T8799] usb 3-1: Using ep0 maxpacket: 16 [ 561.193088][ T31] audit: type=1400 audit(1788370759.100:555): avc: denied { read write } for pid=10086 comm="syz.3.1208" name="mouse0" dev="devtmpfs" ino=960 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 561.219329][ T8799] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 561.234752][ T8799] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 561.246261][ T8799] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 561.256526][ T8799] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 561.256678][ T8799] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.318500][ T8799] usb 3-1: config 0 descriptor?? [ 561.324631][ T31] audit: type=1400 audit(1788370759.100:556): avc: denied { open } for pid=10086 comm="syz.3.1208" path="/dev/input/mouse0" dev="devtmpfs" ino=960 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 561.456612][T10094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1209'. [ 561.470912][T10094] bond0: Unable to set peer notification delay as MII monitoring is disabled [ 561.796884][T10101] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1212'. [ 561.821538][ T8799] microsoft 0003:045E:07DA.0005: unknown main item tag 0x0 [ 561.831542][ T8799] microsoft 0003:045E:07DA.0005: ignoring exceeding usage max [ 561.839584][T10102] tipc: Started in network mode [ 561.839608][T10102] tipc: Node identity ac14140f, cluster identity 4711 [ 561.840402][T10102] tipc: New replicast peer: 255.255.255.255 [ 561.862720][T10102] tipc: Enabled bearer , priority 10 [ 561.917504][ T8799] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0005/input/input29 [ 562.680381][ T8799] microsoft 0003:045E:07DA.0005: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 562.701858][ T8799] usb 3-1: USB disconnect, device number 23 [ 562.849103][ T9] tipc: Node number set to 2886997007 [ 562.968366][T10114] device-mapper: table: 248:0: thin-pool: Invalid argument count (-EINVAL) [ 562.968419][T10114] device-mapper: ioctl: error adding target to table [ 563.196362][T10122] fido_id[10122]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 563.217794][T10132] FAULT_INJECTION: forcing a failure. [ 563.217794][T10132] name failslab, interval 1, probability 0, space 0, times 0 [ 563.239600][T10132] CPU: 0 UID: 0 PID: 10132 Comm: syz.4.1221 Tainted: G L syzkaller #0 PREEMPT(full) [ 563.239635][T10132] Tainted: [L]=SOFTLOCKUP [ 563.239649][T10132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 563.239664][T10132] Call Trace: [ 563.239671][T10132] [ 563.239680][T10132] dump_stack_lvl+0x100/0x190 [ 563.239717][T10132] should_fail_ex.cold+0x5/0xa [ 563.239746][T10132] should_failslab+0xc2/0x120 [ 563.239772][T10132] kmem_cache_alloc_noprof+0x92/0x6a0 [ 563.239793][T10132] ? __pfx_map_id_range_down+0x10/0x10 [ 563.239816][T10132] ? security_inode_alloc+0x3b/0x2c0 [ 563.239851][T10132] security_inode_alloc+0x3b/0x2c0 [ 563.239881][T10132] inode_init_always_gfp+0xc6f/0xfb0 [ 563.239911][T10132] alloc_inode+0x8e/0x250 [ 563.239940][T10132] new_inode+0x22/0x1c0 [ 563.239986][T10132] proc_get_inode+0x1d/0x780 [ 563.240032][T10132] proc_fill_super+0x566/0x870 [ 563.240063][T10132] ? __pfx_proc_fill_super+0x10/0x10 [ 563.240091][T10132] get_tree_nodev+0xdd/0x190 [ 563.240131][T10132] vfs_get_tree+0x92/0x320 [ 563.240187][T10132] path_mount+0x7d0/0x24c0 [ 563.240221][T10132] ? __pfx_path_mount+0x10/0x10 [ 563.240247][T10132] ? lockdep_hardirqs_on+0x7d/0x110 [ 563.240273][T10132] ? putname+0xb1/0x110 [ 563.240296][T10132] ? kmem_cache_free+0x127/0x6c0 [ 563.240338][T10132] ? __x64_sys_mount+0x293/0x310 [ 563.240366][T10132] __x64_sys_mount+0x293/0x310 [ 563.240394][T10132] ? __pfx___x64_sys_mount+0x10/0x10 [ 563.240431][T10132] do_syscall_64+0x123/0x790 [ 563.240458][T10132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.240478][T10132] RIP: 0033:0x7f48deb9e159 [ 563.240496][T10132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 563.240514][T10132] RSP: 002b:00007f48dfa98028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 563.240534][T10132] RAX: ffffffffffffffda RBX: 00007f48dee25fa0 RCX: 00007f48deb9e159 [ 563.240549][T10132] RDX: 0000200000000240 RSI: 00002000000000c0 RDI: 0000000000000000 [ 563.240562][T10132] RBP: 00007f48dec35024 R08: 0000000000000000 R09: 0000000000000000 [ 563.240574][T10132] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 563.240586][T10132] R13: 00007f48dee26038 R14: 00007f48dee25fa0 R15: 00007ffdf8867a78 [ 563.240614][T10132] [ 563.240691][T10132] proc_fill_super: get root inode failed [ 564.013585][T10127] ima: policy update failed [ 564.018708][ T31] kauditd_printk_skb: 3 callbacks suppressed [ 564.018740][ T31] audit: type=1802 audit(1788370761.930:560): pid=10127 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.1.1219" res=0 errno=0 [ 564.206989][T10153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1226'. [ 564.254533][T10154] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 564.314861][T10156] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1227'. [ 564.329646][T10156] team0: Device xfrm0 is of different type [ 564.355067][T10142] block device autoloading is deprecated and will be removed. [ 564.419793][T10158] bridge_slave_0: left allmulticast mode [ 564.427056][T10158] bridge_slave_0: left promiscuous mode [ 564.437320][T10158] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.607594][T10158] bridge_slave_1: left allmulticast mode [ 564.619709][T10158] bridge_slave_1: left promiscuous mode [ 564.619904][T10158] bridge0: port 2(bridge_slave_1) entered disabled state [ 565.112937][T10158] bond0: (slave bond_slave_0): Releasing backup interface [ 565.147150][T10158] bond0: (slave bond_slave_1): Releasing backup interface [ 565.190934][T10158] team0: Port device team_slave_0 removed [ 565.203881][T10158] team0: Port device team_slave_1 removed [ 565.204575][T10158] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 565.204592][T10158] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 565.231657][T10158] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 565.231692][T10158] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 565.251732][T10158] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 565.388213][T10161] team0: Port device xfrm0 added [ 565.394241][T10164] tipc: Started in network mode [ 565.394274][T10164] tipc: Node identity 229a538390cf, cluster identity 4711 [ 565.394427][T10164] tipc: Enabled bearer , priority 0 [ 566.524704][ T9] tipc: Node number set to 2991936387 [ 566.724758][ T31] audit: type=1400 audit(1788370764.640:561): avc: denied { create } for pid=10182 comm="syz.3.1236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 566.754140][ T31] audit: type=1400 audit(1788370764.670:562): avc: denied { bind } for pid=10182 comm="syz.3.1236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 567.781953][ T5771] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 567.932032][ T5771] usb 5-1: Using ep0 maxpacket: 32 [ 567.936064][ T5771] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 567.936968][ T5771] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 567.936996][ T5771] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 567.937029][ T5771] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.336860][ T5771] usb 5-1: config 0 descriptor?? [ 570.004701][ T5771] savu 0003:1E7D:2D5A.0006: item fetching failed at offset 5/8 [ 570.025120][ T5771] savu 0003:1E7D:2D5A.0006: parse failed [ 570.025202][ T5771] savu 0003:1E7D:2D5A.0006: probe with driver savu failed with error -22 [ 570.063670][ T31] audit: type=1400 audit(1788370767.980:563): avc: denied { read } for pid=10210 comm="syz.1.1246" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 570.063723][ T31] audit: type=1400 audit(1788370767.980:564): avc: denied { open } for pid=10210 comm="syz.1.1246" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 570.201197][ T5771] usb 5-1: USB disconnect, device number 26 [ 570.429023][T10214] retu-mfd 0-0002: could not read Tahvo revision: -5 [ 570.461181][T10214] retu-mfd 0-0002: probe with driver retu-mfd failed with error -5 [ 570.461669][T10214] i2c i2c-0: new_device: Instantiated device tahvo at 0x02 [ 571.042260][T10230] smc: net device vlan1 applied user defined pnetid SYZ2 [ 572.805230][ T31] audit: type=1400 audit(1788370770.720:565): avc: denied { write } for pid=10236 comm="syz.0.1252" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 572.838792][ T31] audit: type=1400 audit(1788370770.750:566): avc: denied { read } for pid=10236 comm="syz.0.1252" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 574.148113][ T31] audit: type=1400 audit(1788370772.040:567): avc: denied { write } for pid=10243 comm="syz.3.1254" name="naa.1234567890abcdef" dev="configfs" ino=25060 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 574.855342][T10254] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 574.870638][T10255] netlink: 'syz.1.1259': attribute type 19 has an invalid length. [ 576.607082][ T31] audit: type=1400 audit(1788370774.520:568): avc: denied { write } for pid=10265 comm="syz.3.1264" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 576.637900][ T31] audit: type=1400 audit(1788370774.550:569): avc: denied { ioctl } for pid=10265 comm="syz.3.1264" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 576.707775][T10267] jffs2: notice: (10267) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 576.749679][ T31] audit: type=1400 audit(1788370774.660:570): avc: denied { mount } for pid=10265 comm="syz.3.1264" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 576.772197][ T31] audit: type=1400 audit(1788370774.670:571): avc: denied { write } for pid=10265 comm="syz.3.1264" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 576.826494][T10270] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1265'. [ 576.826530][T10270] netlink: 'syz.4.1265': attribute type 7 has an invalid length. [ 576.826543][T10270] netlink: 'syz.4.1265': attribute type 8 has an invalid length. [ 576.826554][T10270] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1265'. [ 578.217243][ T31] audit: type=1400 audit(1788370776.130:572): avc: denied { setopt } for pid=10280 comm="syz.2.1266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 578.259557][ T1004] IPVS: starting estimator thread 0... [ 578.341986][T10282] IPVS: using max 37 ests per chain, 88800 per kthread [ 579.025982][ T31] audit: type=1400 audit(1788370776.940:573): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 581.507710][T10310] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 581.521642][T10310] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 581.673184][T10314] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1278'. [ 581.673217][T10314] netlink: 'syz.2.1278': attribute type 7 has an invalid length. [ 581.673232][T10314] netlink: 'syz.2.1278': attribute type 8 has an invalid length. [ 581.673241][T10314] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1278'. [ 581.725298][T10314] syz_tun: entered promiscuous mode [ 581.740557][T10314] syz_tun: left promiscuous mode [ 583.572866][ T1576] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 583.706569][T10330] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input30 [ 583.737730][ T1576] usb 4-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 583.742849][ T1576] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 583.742878][ T1576] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 583.742911][ T1576] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.759145][ T1576] usb 4-1: config 0 descriptor?? [ 584.031934][ T5771] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 584.183478][ T5771] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 584.514050][ T1576] usbhid 4-1:0.0: can't add hid device: -71 [ 584.514143][ T1576] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 584.521680][ T1576] usb 4-1: USB disconnect, device number 25 [ 584.523157][ T5771] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 584.523186][ T5771] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 584.523210][ T5771] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 584.523258][ T5771] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.606105][T10334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 584.606235][T10334] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 584.614894][ T5771] pl2303 3-1:1.0: pl2303 converter detected [ 584.644302][ T5771] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 585.476615][T10330] pl2303 3-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 585.487470][T10330] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 585.487905][T10330] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 585.501426][T10330] pl2303 3-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 585.513621][T10330] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 585.854343][T10355] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 585.857420][T10355] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 586.024892][T10329] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 586.034468][T10329] pl2303 ttyUSB0: error sending break = -32 [ 586.046158][ T1576] usb 3-1: USB disconnect, device number 24 [ 586.112332][ T1576] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 586.113049][ T1576] pl2303 3-1:1.0: device disconnected [ 586.668367][T10365] FAULT_INJECTION: forcing a failure. [ 586.668367][T10365] name failslab, interval 1, probability 0, space 0, times 0 [ 586.699503][T10365] CPU: 0 UID: 0 PID: 10365 Comm: syz.1.1283 Tainted: G L syzkaller #0 PREEMPT(full) [ 586.699538][T10365] Tainted: [L]=SOFTLOCKUP [ 586.699549][T10365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 586.699563][T10365] Call Trace: [ 586.699582][T10365] [ 586.699591][T10365] dump_stack_lvl+0x100/0x190 [ 586.699627][T10365] should_fail_ex.cold+0x5/0xa [ 586.699658][T10365] should_failslab+0xc2/0x120 [ 586.699683][T10365] __kmalloc_cache_noprof+0x91/0x6d0 [ 586.699711][T10365] ? psi_cgroup_alloc+0x52/0x2d0 [ 586.699742][T10365] psi_cgroup_alloc+0x52/0x2d0 [ 586.699768][T10365] cgroup_mkdir+0x620/0x1330 [ 586.699792][T10365] ? __pfx_cgroup_mkdir+0x10/0x10 [ 586.699811][T10365] kernfs_iop_mkdir+0x111/0x190 [ 586.699835][T10365] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 586.699856][T10365] vfs_mkdir+0x364/0x850 [ 586.699885][T10365] filename_mkdirat+0x48b/0x5e0 [ 586.699909][T10365] ? __pfx_filename_mkdirat+0x10/0x10 [ 586.699930][T10365] ? strncpy_from_user+0x19d/0x2d0 [ 586.699961][T10365] ? do_getname+0x191/0x390 [ 586.699987][T10365] __x64_sys_mkdirat+0x89/0xc0 [ 586.700015][T10365] do_syscall_64+0x123/0x790 [ 586.700039][T10365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.700059][T10365] RIP: 0033:0x7f3a6d39e159 [ 586.700075][T10365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 586.700091][T10365] RSP: 002b:00007f3a6e220028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 586.700109][T10365] RAX: ffffffffffffffda RBX: 00007f3a6d625fa0 RCX: 00007f3a6d39e159 [ 586.700121][T10365] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 586.700132][T10365] RBP: 00007f3a6d435024 R08: 0000000000000000 R09: 0000000000000000 [ 586.700143][T10365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 586.700154][T10365] R13: 00007f3a6d626038 R14: 00007f3a6d625fa0 R15: 00007ffe8210df18 [ 586.700181][T10365] [ 586.744822][ T8799] usb 4-1: new low-speed USB device number 26 using dummy_hcd [ 587.569143][ T8799] usb 4-1: device descriptor read/64, error -71 [ 587.590924][ T11] block nbd0: Possible stuck request ffff888028160000: control (read@0,1024B). Runtime 60 seconds [ 587.590959][ T11] block nbd0: Possible stuck request ffff8880281601c0: control (read@1024,1024B). Runtime 60 seconds [ 587.590989][ T11] block nbd0: Possible stuck request ffff888028160380: control (read@2048,1024B). Runtime 60 seconds [ 587.591014][ T11] block nbd0: Possible stuck request ffff888028160540: control (read@3072,1024B). Runtime 60 seconds [ 587.718759][ T31] audit: type=1400 audit(1788370785.630:574): avc: denied { write } for pid=10370 comm="syz.1.1295" name="subsystems" dev="configfs" ino=3104 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.726121][ T31] audit: type=1800 audit(1788370785.640:575): pid=10372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1295" name="addr_traddr" dev="configfs" ino=26496 res=0 errno=0 [ 587.730001][T10372] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 587.731137][ T31] audit: type=1800 audit(1788370785.640:576): pid=10372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1295" name="addr_trsvcid" dev="configfs" ino=26497 res=0 errno=0 [ 587.733843][ T31] audit: type=1400 audit(1788370785.650:577): avc: denied { create } for pid=10370 comm="syz.1.1295" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 587.737889][T10372] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 587.744668][ T31] audit: type=1800 audit(1788370785.650:578): pid=10372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1295" name="addr_adrfam" dev="configfs" ino=26499 res=0 errno=0 [ 587.759449][T10372] nvmet: Disable port '1' before changing attribute in nvmet_addr_adrfam_store [ 587.761510][ T31] audit: type=1400 audit(1788370785.670:579): avc: denied { write } for pid=10370 comm="syz.1.1295" name="subsystems" dev="configfs" ino=24973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.761792][ T31] audit: type=1400 audit(1788370785.670:580): avc: denied { write } for pid=10370 comm="syz.1.1295" name="subsystems" dev="configfs" ino=24973 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 587.782137][T10375] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1297'. [ 587.809753][T10376] netlink: 'syz.2.1296': attribute type 19 has an invalid length. [ 588.644334][ T31] audit: type=1400 audit(1788370786.210:581): avc: denied { write } for pid=10371 comm="syz.2.1296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 588.713190][ T8799] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 588.834278][ T8799] usb 4-1: device descriptor read/64, error -71 [ 588.942679][ T8799] usb usb4-port1: attempt power cycle [ 589.055649][ T31] audit: type=1400 audit(1788370786.970:582): avc: denied { connect } for pid=10385 comm="syz.1.1303" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 589.247312][T10391] jffs2: notice: (10391) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 589.302184][ T31] audit: type=1804 audit(1788370787.210:583): pid=10392 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_policy cause=store_entry comm="syz.3.1301" name="ima_policy_written" res=0 errno=-17 [ 589.901137][T10387] ima: policy update failed [ 591.056248][T10405] FAULT_INJECTION: forcing a failure. [ 591.056248][T10405] name failslab, interval 1, probability 0, space 0, times 0 [ 591.056297][T10405] CPU: 0 UID: 0 PID: 10405 Comm: syz.3.1307 Tainted: G L syzkaller #0 PREEMPT(full) [ 591.056326][T10405] Tainted: [L]=SOFTLOCKUP [ 591.056334][T10405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 591.056346][T10405] Call Trace: [ 591.056353][T10405] [ 591.056361][T10405] dump_stack_lvl+0x100/0x190 [ 591.056395][T10405] should_fail_ex.cold+0x5/0xa [ 591.056425][T10405] should_failslab+0xc2/0x120 [ 591.056451][T10405] __kmalloc_noprof+0xfc/0x840 [ 591.056472][T10405] ? landlock_merge_ruleset+0x118/0xd10 [ 591.056506][T10405] landlock_merge_ruleset+0x118/0xd10 [ 591.056540][T10405] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 591.056571][T10405] do_syscall_64+0x123/0x790 [ 591.056598][T10405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.056619][T10405] RIP: 0033:0x7f600bd9e159 [ 591.056636][T10405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.056656][T10405] RSP: 002b:00007f600cbf1028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be [ 591.056676][T10405] RAX: ffffffffffffffda RBX: 00007f600c025fa0 RCX: 00007f600bd9e159 [ 591.056690][T10405] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 591.056702][T10405] RBP: 00007f600be35024 R08: 0000000000000000 R09: 0000000000000000 [ 591.056715][T10405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 591.056727][T10405] R13: 00007f600c026038 R14: 00007f600c025fa0 R15: 00007ffc83d57938 [ 591.056755][T10405] [ 592.181005][T10425] netlink: 'syz.3.1313': attribute type 19 has an invalid length. [ 592.223068][T10428] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1312'. [ 592.470621][T10432] genirq: Flags mismatch irq 4. 00200000 (pcl816) vs. 00200080 (ttyS0) [ 594.316041][T10443] netlink: 'syz.2.1320': attribute type 19 has an invalid length. [ 595.927211][T10457] jffs2: notice: (10457) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 595.965517][ T31] kauditd_printk_skb: 4 callbacks suppressed [ 595.965584][ T31] audit: type=1400 audit(1788370793.880:588): avc: denied { write } for pid=10455 comm="syz.3.1326" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 597.223068][T10464] wusb3801 0-0004: supply vbus not found, using dummy regulator [ 597.449661][T10464] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x04 [ 599.037767][T10468] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1330'. [ 600.802600][ T5612] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 602.308013][T10499] netlink: 'syz.4.1336': attribute type 19 has an invalid length. [ 604.706091][ T5771] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 605.609358][ T5771] usb 4-1: Using ep0 maxpacket: 32 [ 605.621808][ T5771] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 605.641821][ T5771] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 605.641925][ T5771] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 605.663365][ T5771] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.780924][ T5771] usb 4-1: config 0 descriptor?? [ 606.205438][ T5771] usbhid 4-1:0.0: can't add hid device: -71 [ 606.216387][ T5771] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 606.379860][ T5771] usb 4-1: USB disconnect, device number 29 [ 606.837382][T10526] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5609] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[10526] [ 606.859703][ T5612] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 606.948733][T10533] netlink: 'syz.3.1349': attribute type 19 has an invalid length. [ 607.762525][T10536] kAFS: unable to lookup cell 'ÿ' [ 609.383193][T10555] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 609.586091][ T31] audit: type=1400 audit(1788370807.280:589): avc: denied { mounton } for pid=10548 comm="syz.2.1354" path="/253/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 609.586283][ T31] audit: type=1400 audit(1788370807.480:590): avc: denied { write } for pid=10548 comm="syz.2.1354" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 609.586452][ T31] audit: type=1400 audit(1788370807.480:591): avc: denied { remove_name } for pid=10548 comm="syz.2.1354" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 609.586606][ T31] audit: type=1400 audit(1788370807.490:592): avc: denied { unlink } for pid=10548 comm="syz.2.1354" name="binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 609.912998][ T31] audit: type=1800 audit(1788370807.830:593): pid=10557 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1356" name="addr_traddr" dev="configfs" ino=27111 res=0 errno=0 [ 609.942540][T10557] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 609.954416][ T31] audit: type=1800 audit(1788370807.870:594): pid=10557 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1356" name="addr_trsvcid" dev="configfs" ino=27112 res=0 errno=0 [ 609.978273][T10557] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 610.134500][ T989] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.141349][T10559] FAULT_INJECTION: forcing a failure. [ 610.141349][T10559] name failslab, interval 1, probability 0, space 0, times 0 [ 610.141380][T10559] CPU: 1 UID: 0 PID: 10559 Comm: syz.0.1357 Tainted: G L syzkaller #0 PREEMPT(full) [ 610.141407][T10559] Tainted: [L]=SOFTLOCKUP [ 610.141415][T10559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 610.141427][T10559] Call Trace: [ 610.141434][T10559] [ 610.141441][T10559] dump_stack_lvl+0x100/0x190 [ 610.141481][T10559] should_fail_ex.cold+0x5/0xa [ 610.141512][T10559] should_failslab+0xc2/0x120 [ 610.141538][T10559] __kmalloc_noprof+0xfc/0x840 [ 610.141558][T10559] ? get_current_details+0x171/0x670 [ 610.141591][T10559] get_current_details+0x171/0x670 [ 610.141622][T10559] landlock_merge_ruleset+0x7ef/0xd10 [ 610.141654][T10559] __do_sys_landlock_restrict_self+0x264/0x10a0 [ 610.141682][T10559] do_syscall_64+0x123/0x790 [ 610.141709][T10559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.141729][T10559] RIP: 0033:0x7fd53719e159 [ 610.141745][T10559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.141763][T10559] RSP: 002b:00007fd537fff028 EFLAGS: 00000246 ORIG_RAX: 00000000000001be [ 610.141784][T10559] RAX: ffffffffffffffda RBX: 00007fd537425fa0 RCX: 00007fd53719e159 [ 610.141797][T10559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 610.141808][T10559] RBP: 00007fd537235024 R08: 0000000000000000 R09: 0000000000000000 [ 610.141820][T10559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 610.141832][T10559] R13: 00007fd537426038 R14: 00007fd537425fa0 R15: 00007ffe9e41f468 [ 610.141862][T10559] [ 610.977223][ T31] audit: type=1400 audit(1788370808.890:595): avc: denied { ioctl } for pid=10570 comm="syz.0.1361" path="socket:[27875]" dev="sockfs" ino=27875 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 610.981268][ T31] audit: type=1400 audit(1788370808.890:596): avc: denied { write } for pid=10570 comm="syz.0.1361" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 612.088836][ T31] audit: type=1400 audit(1788370810.000:597): avc: denied { write } for pid=10579 comm="syz.1.1364" name="core" dev="configfs" ino=3108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 612.116103][ T31] audit: type=1400 audit(1788370810.030:598): avc: denied { write } for pid=10579 comm="syz.1.1364" name="rd_mcp_0" dev="configfs" ino=27248 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 612.141566][T10580] netlink: 'syz.0.1363': attribute type 19 has an invalid length. [ 613.315980][T10593] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 613.987037][T10597] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 614.167879][T10605] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 614.176664][T10605] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 614.259664][T10607] netlink: 'syz.2.1377': attribute type 19 has an invalid length. [ 615.729443][T10631] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1382'. [ 615.839376][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 615.839411][ T31] audit: type=1800 audit(1788370813.750:601): pid=10636 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1384" name="addr_traddr" dev="configfs" ino=27995 res=0 errno=0 [ 615.871124][T10636] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 616.071012][T10647] netlink: 'syz.1.1390': attribute type 19 has an invalid length. [ 617.206491][T10656] binder: 10652:10656 ioctl 4018620d 0 returned -22 [ 617.762586][ T11] block nbd0: Possible stuck request ffff888028160000: control (read@0,1024B). Runtime 90 seconds [ 617.762624][ T11] block nbd0: Possible stuck request ffff8880281601c0: control (read@1024,1024B). Runtime 90 seconds [ 617.762648][ T11] block nbd0: Possible stuck request ffff888028160380: control (read@2048,1024B). Runtime 90 seconds [ 617.762669][ T11] block nbd0: Possible stuck request ffff888028160540: control (read@3072,1024B). Runtime 90 seconds [ 617.805661][T10655] netlink: 'syz.2.1379': attribute type 4 has an invalid length. [ 618.948385][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 618.948458][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 619.486978][ T31] audit: type=1800 audit(1788370817.400:602): pid=10674 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.1399" name="addr_traddr" dev="configfs" ino=27414 res=0 errno=0 [ 619.487395][T10674] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 619.531323][T10678] netlink: 'syz.4.1401': attribute type 19 has an invalid length. [ 620.225668][ T43] IPVS: starting estimator thread 0... [ 620.321966][T10685] IPVS: using max 36 ests per chain, 86400 per kthread [ 621.661415][T10697] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5599] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[10697] [ 622.567726][ T31] audit: type=1400 audit(1788370820.480:603): avc: denied { write } for pid=10701 comm="syz.4.1409" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 624.021401][T10715] netlink: 'syz.1.1414': attribute type 19 has an invalid length. [ 624.236816][ T31] audit: type=1800 audit(1788370822.150:604): pid=10719 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1412" name="addr_traddr" dev="configfs" ino=27472 res=0 errno=0 [ 624.260677][ T31] audit: type=1800 audit(1788370822.170:605): pid=10722 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.1412" name="addr_trsvcid" dev="configfs" ino=27473 res=0 errno=0 [ 624.284955][T10719] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 625.772460][ T1576] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 625.931913][ T1576] usb 4-1: Using ep0 maxpacket: 32 [ 625.937725][ T1576] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 625.949408][ T1576] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 625.949444][ T1576] usb 4-1: config 0 has no interface number 0 [ 625.967051][ T1576] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.967081][ T1576] usb 4-1: Product: syz [ 625.967102][ T1576] usb 4-1: Manufacturer: syz [ 625.967120][ T1576] usb 4-1: SerialNumber: syz [ 625.994328][ T1576] usb 4-1: config 0 descriptor?? [ 626.010949][T10739] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 626.160632][T10741] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 626.168327][T10741] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 626.754648][ T1576] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 626.754679][ T1576] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 628.061020][T10751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1425'. [ 629.351890][ T1576] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 629.352105][ T1576] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 629.385361][ T1576] usb 4-1: USB disconnect, device number 30 [ 629.507259][T10761] netlink: 'syz.2.1427': attribute type 19 has an invalid length. [ 630.460600][T10769] openvswitch: netlink: IP tunnel dst address not specified [ 631.883967][T10777] netlink: 'syz.3.1433': attribute type 19 has an invalid length. [ 633.616306][ T4970] udevd[4970]: worker [6517] /devices/virtual/block/nbd0 is taking a long time [ 633.827093][T10788] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1437'. [ 634.023563][T10790] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 634.202705][T10792] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1440'. [ 634.412853][T10794] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1441'. [ 634.623841][T10799] FAULT_INJECTION: forcing a failure. [ 634.623841][T10799] name failslab, interval 1, probability 0, space 0, times 0 [ 634.637026][T10799] CPU: 1 UID: 0 PID: 10799 Comm: syz.1.1442 Tainted: G L syzkaller #0 PREEMPT(full) [ 634.637059][T10799] Tainted: [L]=SOFTLOCKUP [ 634.637068][T10799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 634.637082][T10799] Call Trace: [ 634.637090][T10799] [ 634.637099][T10799] dump_stack_lvl+0x100/0x190 [ 634.637135][T10799] should_fail_ex.cold+0x5/0xa [ 634.637164][T10799] should_failslab+0xc2/0x120 [ 634.637189][T10799] kmem_cache_alloc_noprof+0x92/0x6a0 [ 634.637211][T10799] ? do_getname+0x35/0x390 [ 634.637244][T10799] do_getname+0x35/0x390 [ 634.637274][T10799] do_sys_openat2+0xc7/0x1e0 [ 634.637300][T10799] ? __pfx_do_sys_openat2+0x10/0x10 [ 634.637324][T10799] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 634.637357][T10799] __x64_sys_openat+0x12d/0x210 [ 634.637383][T10799] ? __pfx___x64_sys_openat+0x10/0x10 [ 634.637420][T10799] do_syscall_64+0x123/0x790 [ 634.637446][T10799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.637467][T10799] RIP: 0033:0x7f3a6d35e98e [ 634.637484][T10799] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 634.637502][T10799] RSP: 002b:00007f3a6e21fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 634.637523][T10799] RAX: ffffffffffffffda RBX: 00007f3a6e2206c0 RCX: 00007f3a6d35e98e [ 634.637537][T10799] RDX: 0000000000000002 RSI: 00007f3a6e21fc00 RDI: ffffffffffffff9c [ 634.637552][T10799] RBP: 00007f3a6e21fc00 R08: 0000000000000000 R09: 0000000000000000 [ 634.637565][T10799] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 634.637579][T10799] R13: 00007f3a6d626038 R14: 00007f3a6d625fa0 R15: 00007ffe8210df18 [ 634.637608][T10799] [ 635.069945][T10803] netlink: 64595 bytes leftover after parsing attributes in process `syz.1.1443'. [ 637.308041][T10824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1450'. [ 638.392975][T10840] ipvlan1: entered promiscuous mode [ 638.396452][ T31] audit: type=1400 audit(1788370836.310:606): avc: denied { write } for pid=10837 comm="syz.2.1455" name="instances" dev="tracefs" ino=4229 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 638.413551][T10840] ipvlan1: entered allmulticast mode [ 638.413570][T10840] veth0_vlan: entered allmulticast mode [ 638.428671][ T31] audit: type=1400 audit(1788370836.330:607): avc: denied { add_name } for pid=10837 comm="syz.2.1455" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 638.428716][ T31] audit: type=1400 audit(1788370836.330:608): avc: denied { create } for pid=10837 comm="syz.2.1455" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 638.594114][T10841] syz.2.1455: vmalloc error: size 57344, failed to allocate pages, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 638.594338][T10841] CPU: 0 UID: 0 PID: 10841 Comm: syz.2.1455 Tainted: G L syzkaller #0 PREEMPT(full) [ 638.594362][T10841] Tainted: [L]=SOFTLOCKUP [ 638.594368][T10841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 638.594378][T10841] Call Trace: [ 638.594384][T10841] [ 638.594392][T10841] dump_stack_lvl+0x100/0x190 [ 638.594425][T10841] warn_alloc.cold+0x9e/0xb2 [ 638.594448][T10841] ? __pfx_warn_alloc+0x10/0x10 [ 638.594476][T10841] ? policy_nodemask+0xed/0x4f0 [ 638.594502][T10841] ? alloc_pages_mpol+0x260/0x550 [ 638.594526][T10841] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 638.594550][T10841] ? find_held_lock+0x2b/0x80 [ 638.594577][T10841] ? rcu_read_unlock+0x17/0x60 [ 638.594609][T10841] __vmalloc_node_range_noprof+0x111c/0x1420 [ 638.594644][T10841] ? bpf_check+0x112/0xa7c0 [ 638.594672][T10841] ? __lock_acquire+0x4c5/0x1ec0 [ 638.594692][T10841] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 638.594719][T10841] ? rcu_is_watching+0x13/0xc0 [ 638.594749][T10841] __kvmalloc_node_noprof+0x3da/0x9b0 [ 638.594770][T10841] ? bpf_check+0x112/0xa7c0 [ 638.594797][T10841] ? ktime_get+0x22c/0x320 [ 638.594816][T10841] ? bpf_check+0x112/0xa7c0 [ 638.594843][T10841] bpf_check+0x112/0xa7c0 [ 638.594868][T10841] ? __css_rstat_updated+0x1ce/0x590 [ 638.594889][T10841] ? __lock_acquire+0x4c5/0x1ec0 [ 638.594917][T10841] ? __lock_acquire+0x4c5/0x1ec0 [ 638.594939][T10841] ? find_held_lock+0x2b/0x80 [ 638.594968][T10841] ? __pfx_bpf_check+0x10/0x10 [ 638.594991][T10841] ? lock_acquire+0x1d1/0x380 [ 638.595009][T10841] ? bpf_prog_load+0x1a09/0x2a80 [ 638.595032][T10841] ? find_held_lock+0x2b/0x80 [ 638.595057][T10841] ? bpf_prog_load+0x1a09/0x2a80 [ 638.595084][T10841] ? __asan_memset+0x23/0x50 [ 638.595124][T10841] ? bpf_prog_load+0x1ac3/0x2a80 [ 638.595147][T10841] bpf_prog_load+0x1ac3/0x2a80 [ 638.595177][T10841] ? __pfx_bpf_prog_load+0x10/0x10 [ 638.595224][T10841] __sys_bpf+0x1f46/0x4a30 [ 638.595248][T10841] ? __pfx___sys_bpf+0x10/0x10 [ 638.595269][T10841] ? __might_fault+0xc5/0x140 [ 638.595334][T10841] ? __x64_sys_futex+0x34f/0x4d0 [ 638.595358][T10841] ? __x64_sys_futex+0x358/0x4d0 [ 638.595386][T10841] ? xfd_validate_state+0x129/0x190 [ 638.595411][T10841] ? __x64_sys_bpf+0xce/0x140 [ 638.595428][T10841] __x64_sys_bpf+0xce/0x140 [ 638.595448][T10841] ? do_syscall_64+0xae/0x790 [ 638.595470][T10841] do_syscall_64+0x123/0x790 [ 638.595494][T10841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.595514][T10841] RIP: 0033:0x7ff76859e159 [ 638.595530][T10841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 638.595549][T10841] RSP: 002b:00007ff76945a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 638.595567][T10841] RAX: ffffffffffffffda RBX: 00007ff768826090 RCX: 00007ff76859e159 [ 638.595580][T10841] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 638.595592][T10841] RBP: 00007ff768635024 R08: 0000000000000000 R09: 0000000000000000 [ 638.595604][T10841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 638.595616][T10841] R13: 00007ff768826128 R14: 00007ff768826090 R15: 00007ffd2ddc0578 [ 638.595643][T10841] [ 638.612396][T10841] Mem-Info: [ 638.612409][T10841] active_anon:28388 inactive_anon:55 isolated_anon:0 [ 638.612409][T10841] active_file:11156 inactive_file:54556 isolated_file:0 [ 638.612409][T10841] unevictable:0 dirty:168 writeback:0 [ 638.612409][T10841] slab_reclaimable:13233 slab_unreclaimable:101231 [ 638.612409][T10841] mapped:30929 shmem:15700 pagetables:1376 [ 638.612409][T10841] sec_pagetables:0 bounce:0 [ 638.612409][T10841] kernel_misc_reclaimable:0 [ 638.612409][T10841] free:1235241 free_pcp:37778 free_cma:0 [ 638.612466][T10841] Node 0 active_anon:113552kB inactive_anon:220kB active_file:44624kB inactive_file:218028kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:123716kB dirty:672kB writeback:0kB shmem:62800kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12512kB pagetables:5360kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 638.612519][T10841] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 638.612566][T10841] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 638.612620][T10841] lowmem_reserve[]: 0 2470 2471 2471 2471 [ 638.612654][T10841] Node 0 DMA32 free:984324kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0kB free_highatomic:0kB active_anon:113552kB inactive_anon:220kB active_file:44624kB inactive_file:218028kB unevictable:0kB writepending:672kB zspages:808kB present:3129332kB managed:2530264kB mlocked:0kB bounce:0kB free_pcp:151112kB local_pcp:111468kB free_cma:0kB [ 638.612709][T10841] lowmem_reserve[]: 0 0 0 0 0 [ 638.612742][T10841] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:76kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 638.612792][T10841] lowmem_reserve[]: 0 0 0 0 0 [ 638.612824][T10841] Node 1 Normal free:3941280kB boost:0kB min:55648kB low:69560kB high:83472kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 638.612876][T10841] lowmem_reserve[]: 0 0 0 0 0 [ 638.612907][T10841] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 638.613017][T10841] Node 0 DMA32: 1563*4kB (UME) 1488*8kB (UM) 820*16kB (UM) 1162*32kB (UM) 431*64kB (UME) 270*128kB (UM) 83*256kB (UM) 22*512kB (UME) 22*1024kB (UME) 8*2048kB (UM) 191*4096kB (UM) = 984364kB [ 638.613172][T10841] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 638.613265][T10841] Node 1 Normal: 2*4kB (M) 7*8kB (UM) 6*16kB (UM) 6*32kB (UM) 7*64kB (UM) 5*128kB (UM) 2*256kB (M) 2*512kB (M) 2*1024kB (UM) 2*2048kB (U) 960*4096kB (M) = 3941280kB [ 638.613412][T10841] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 638.613427][T10841] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 638.613442][T10841] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 638.613457][T10841] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 638.613472][T10841] 81408 total pagecache pages [ 638.613479][T10841] 0 pages in swap cache [ 638.613485][T10841] Free swap = 124644kB [ 638.613492][T10841] Total swap = 124996kB [ 638.613498][T10841] 2097051 pages RAM [ 638.613504][T10841] 0 pages HighMem/MovableOnly [ 638.613511][T10841] 432850 pages reserved [ 638.613517][T10841] 0 pages cma reserved [ 639.062766][T10851] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5599] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[10851] [ 639.376470][T10850] kAFS: unable to lookup cell 'ÿ' [ 640.388011][T10838] Could not create tracefs 'trace_pipe' entry [ 641.154086][T10838] Could not create tracefs 'trace' entry [ 641.192312][T10838] Could not create tracefs 'trace_pipe_raw' entry [ 641.225359][T10838] Could not create tracefs 'stats' entry [ 641.268566][T10838] Could not create tracefs 'buffer_size_kb' entry [ 641.303024][T10838] Could not create tracefs 'cpu1' entry [ 641.333972][T10838] Could not create tracefs 'free_buffer' entry [ 641.391083][T10838] Could not create tracefs 'trace_marker' entry [ 641.435660][T10838] Could not create tracefs 'trace_marker_raw' entry [ 641.475123][T10838] Could not create tracefs 'buffer_percent' entry [ 641.586960][T10869] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1463'. [ 641.607335][T10838] Could not create tracefs 'syscall_user_buf_size' entry [ 642.169713][T10838] Could not create tracefs 'tracing_on' entry [ 642.268788][T10838] Could not create tracefs 'error_log' entry [ 642.347567][T10838] Could not create tracefs 'test_nop_accept' entry [ 642.347595][T10838] ERROR: Failed to create trace option: test_nop_accept [ 642.395168][T10838] Could not create tracefs 'test_nop_refuse' entry [ 644.838204][ T31] audit: type=1804 audit(1788370842.750:609): pid=10883 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_policy cause=store_entry comm="syz.3.1468" name="ima_policy_written" res=0 errno=-17 [ 644.838259][ T31] audit: type=1807 audit(1788370842.750:610): UNKNOWN=me res=0 [ 644.838298][ T31] audit: type=1802 audit(1788370842.750:611): pid=10883 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=update_policy cause=invalid-policy comm="syz.3.1468" res=0 errno=0 [ 644.838380][T10882] ima: policy update failed [ 644.913241][ T31] audit: type=1802 audit(1788370842.750:612): pid=10882 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.3.1468" res=0 errno=0 [ 645.125324][T10888] netlink: 'syz.0.1462': attribute type 19 has an invalid length. [ 647.404807][T10901] netlink: 'syz.4.1466': attribute type 11 has an invalid length. [ 647.562562][T10911] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1476'. [ 647.572819][T10911] netlink: 'syz.0.1476': attribute type 7 has an invalid length. [ 647.580910][T10911] netlink: 'syz.0.1476': attribute type 8 has an invalid length. [ 647.580925][T10911] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1476'. [ 647.613245][T10911] syz_tun: entered promiscuous mode [ 647.621387][T10911] syz_tun: left promiscuous mode [ 648.235008][ T1576] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 649.326475][ T11] block nbd0: Possible stuck request ffff888028160000: control (read@0,1024B). Runtime 120 seconds [ 649.326525][ T11] block nbd0: Possible stuck request ffff8880281601c0: control (read@1024,1024B). Runtime 120 seconds [ 649.326563][ T11] block nbd0: Possible stuck request ffff888028160380: control (read@2048,1024B). Runtime 120 seconds [ 649.326591][ T11] block nbd0: Possible stuck request ffff888028160540: control (read@3072,1024B). Runtime 120 seconds [ 650.168190][ T1576] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 650.171606][ T1576] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 650.171630][ T1576] usb 4-1: config 0 has no interface number 0 [ 650.171665][ T1576] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 650.171690][ T1576] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 650.171726][ T1576] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.179036][ T1576] usb 4-1: config 0 descriptor?? [ 650.181090][T10907] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 650.194253][ T1576] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 650.410022][T10925] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 650.416248][T10925] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 650.426250][ T1576] usb 4-1: USB disconnect, device number 31 [ 650.608290][T10929] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1481'. [ 650.655828][T10931] netlink: 'syz.2.1482': attribute type 19 has an invalid length. [ 652.386572][T10942] netlink: 'syz.3.1488': attribute type 11 has an invalid length. [ 653.073227][T10946] smc: net device vlan1 applied user defined pnetid SYZ2 [ 654.326513][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 654.339543][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 654.340363][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 654.418042][T10955] nvmet: failed to open file ./0©ïßÔ˜ *Ñx¡³8: (-2) [ 654.425906][T10955] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 654.926494][T10964] netlink: 'syz.3.1495': attribute type 19 has an invalid length. [ 655.883660][ T1576] netdevsim0 speed is unknown, defaulting to 1000 [ 655.889273][T10948] infiniband syz2: set active [ 655.889291][T10948] infiniband syz2: added netdevsim0 [ 656.113786][T10978] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5599] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[10978] [ 656.155038][T10948] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 656.183289][T10948] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 656.203334][T10948] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 656.826488][T10948] RDS/IB: syz2: added [ 657.827572][T10948] smc: adding ib device syz2 with port count 1 [ 657.827777][T10948] smc: ib device syz2 port 1 has no pnetid [ 657.857077][ T5688] netdevsim0 speed is unknown, defaulting to 1000 [ 657.891464][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 657.912140][ T31] audit: type=1800 audit(1788370855.820:613): pid=10986 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.1502" name="addr_trsvcid" dev="configfs" ino=28904 res=0 errno=0 [ 657.912704][T10986] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 658.877757][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 659.081683][T11003] netlink: 'syz.3.1499': attribute type 11 has an invalid length. [ 659.281400][T11008] netlink: 'syz.3.1510': attribute type 19 has an invalid length. [ 659.816308][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 659.867059][ T31] audit: type=1800 audit(1788370857.780:614): pid=11011 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1503" name="addr_traddr" dev="configfs" ino=28952 res=0 errno=0 [ 659.870299][T11011] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 659.875299][ T31] audit: type=1800 audit(1788370857.790:615): pid=11011 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1503" name="addr_trsvcid" dev="configfs" ino=28953 res=0 errno=0 [ 659.880929][ T31] audit: type=1800 audit(1788370857.790:616): pid=11011 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1503" name="addr_adrfam" dev="configfs" ino=28954 res=0 errno=0 [ 661.542157][T11026] kAFS: unable to lookup cell 'ÿ' [ 662.936626][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 662.978879][T11038] FAULT_INJECTION: forcing a failure. [ 662.978879][T11038] name failslab, interval 1, probability 0, space 0, times 0 [ 662.978982][T11038] CPU: 0 UID: 0 PID: 11038 Comm: syz.1.1520 Tainted: G L syzkaller #0 PREEMPT(full) [ 662.979017][T11038] Tainted: [L]=SOFTLOCKUP [ 662.979024][T11038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 662.979037][T11038] Call Trace: [ 662.979044][T11038] [ 662.979053][T11038] dump_stack_lvl+0x100/0x190 [ 662.979088][T11038] should_fail_ex.cold+0x5/0xa [ 662.979119][T11038] should_failslab+0xc2/0x120 [ 662.979144][T11038] kmem_cache_alloc_noprof+0x92/0x6a0 [ 662.979166][T11038] ? do_getname+0x35/0x390 [ 662.979198][T11038] do_getname+0x35/0x390 [ 662.979228][T11038] do_sys_openat2+0xc7/0x1e0 [ 662.979254][T11038] ? __pfx_do_sys_openat2+0x10/0x10 [ 662.979277][T11038] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 662.979309][T11038] __x64_sys_openat+0x12d/0x210 [ 662.979335][T11038] ? __pfx___x64_sys_openat+0x10/0x10 [ 662.979372][T11038] do_syscall_64+0x123/0x790 [ 662.979401][T11038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.979423][T11038] RIP: 0033:0x7f3a6d35e98e [ 662.979440][T11038] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 662.979459][T11038] RSP: 002b:00007f3a6e21fb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 662.979479][T11038] RAX: ffffffffffffffda RBX: 00007f3a6e2206c0 RCX: 00007f3a6d35e98e [ 662.979493][T11038] RDX: 0000000000000002 RSI: 00007f3a6e21fc00 RDI: ffffffffffffff9c [ 662.979506][T11038] RBP: 00007f3a6e21fc00 R08: 0000000000000000 R09: 0000000000000000 [ 662.979519][T11038] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 662.979531][T11038] R13: 00007f3a6d626038 R14: 00007f3a6d625fa0 R15: 00007ffe8210df18 [ 662.979557][T11038] [ 663.292690][ T31] audit: type=1800 audit(1788370861.210:617): pid=11042 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1523" name="addr_traddr" dev="configfs" ino=28588 res=0 errno=0 [ 663.310106][T11042] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 663.315810][ T31] audit: type=1800 audit(1788370861.230:618): pid=11042 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1523" name="addr_trsvcid" dev="configfs" ino=29014 res=0 errno=0 [ 663.316820][ T31] audit: type=1800 audit(1788370861.230:619): pid=11042 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1523" name="addr_adrfam" dev="configfs" ino=29015 res=0 errno=0 [ 665.658210][T10948] netdevsim0 speed is unknown, defaulting to 1000 [ 666.248371][T11059] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1528'. [ 667.757593][T10027] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 667.763824][T10027] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 667.764572][T10027] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 667.765258][T10027] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 667.767067][T10027] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 667.819440][ T31] audit: type=1800 audit(1788370865.730:620): pid=11074 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1534" name="addr_traddr" dev="configfs" ino=29068 res=0 errno=0 [ 667.819521][T11074] nvmet: Disable port '1' before changing attribute in nvmet_addr_traddr_store [ 667.824684][ T31] audit: type=1800 audit(1788370865.740:621): pid=11074 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1534" name="addr_trsvcid" dev="configfs" ino=29075 res=0 errno=0 [ 667.825382][ T31] audit: type=1800 audit(1788370865.740:622): pid=11074 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.1534" name="addr_adrfam" dev="configfs" ino=29076 res=0 errno=0 [ 669.262785][T11090] netlink: 'syz.4.1539': attribute type 19 has an invalid length. [ 669.918231][T10027] Bluetooth: hci5: command tx timeout [ 671.191806][T11073] netdevsim0 speed is unknown, defaulting to 1000 [ 671.451341][T11117] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1540'. [ 671.727519][T11121] overlayfs: overlapping lowerdir path [ 671.761265][ T31] audit: type=1804 audit(1788370869.670:623): pid=11124 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_policy cause=store_entry comm="syz.4.1546" name="ima_policy_written" res=0 errno=-17 [ 671.783733][ T31] audit: type=1807 audit(1788370869.670:624): UNKNOWN=me res=0 [ 671.791448][ T31] audit: type=1802 audit(1788370869.670:625): pid=11124 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=update_policy cause=invalid-policy comm="syz.4.1546" res=0 errno=0 [ 671.981977][T10027] Bluetooth: hci5: command tx timeout [ 672.363459][T11119] ima: policy update failed [ 672.368744][ T31] audit: type=1802 audit(1788370870.280:626): pid=11119 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.4.1546" res=0 errno=0 [ 672.653874][T11133] netlink: 'syz.3.1549': attribute type 19 has an invalid length. [ 673.568466][T11073] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.568563][T11073] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.568680][T11073] bridge_slave_0: entered allmulticast mode [ 673.572663][T11073] bridge_slave_0: entered promiscuous mode [ 673.585827][T11073] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.585964][T11073] bridge0: port 2(bridge_slave_1) entered disabled state [ 673.586062][T11073] bridge_slave_1: entered allmulticast mode [ 673.591098][T11073] bridge_slave_1: entered promiscuous mode [ 673.695289][T11073] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 673.698645][T11073] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 673.815713][T11073] team0: Port device team_slave_0 added [ 673.818018][T11073] team0: Port device team_slave_1 added [ 674.886608][T10027] Bluetooth: hci5: command tx timeout [ 674.976893][T11073] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.976928][T11073] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.976950][T11073] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.983756][T11073] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 674.983769][T11073] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.983791][T11073] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 675.113000][T11073] hsr_slave_0: entered promiscuous mode [ 675.113863][T11073] hsr_slave_1: entered promiscuous mode [ 675.114397][T11073] debugfs: 'hsr0' already exists in 'hsr' [ 675.114416][T11073] Cannot create hsr debugfs directory [ 675.630455][T11073] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 675.641586][T11073] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 675.646205][T11073] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 675.666545][T11073] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 675.667203][T11073] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 675.686346][T11073] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 675.687511][T11073] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 675.725110][T11073] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 675.803991][T11172] netlink: 'syz.0.1561': attribute type 19 has an invalid length. [ 676.667810][T11180] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1556'. [ 676.698447][T11073] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.738670][T11073] 8021q: adding VLAN 0 to HW filter on device team0 [ 676.758324][ T3412] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.758434][ T3412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 677.784581][T10027] Bluetooth: hci5: command tx timeout [ 677.818159][ T3387] bridge0: port 2(bridge_slave_1) entered blocking state [ 677.818262][ T3387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 678.425037][T11198] overlayfs: overlapping lowerdir path [ 679.747994][ T11] block nbd0: Possible stuck request ffff888028160000: control (read@0,1024B). Runtime 150 seconds [ 679.761788][ T11] block nbd0: Possible stuck request ffff8880281601c0: control (read@1024,1024B). Runtime 150 seconds [ 679.778930][ T11] block nbd0: Possible stuck request ffff888028160380: control (read@2048,1024B). Runtime 150 seconds [ 679.797757][ T11] block nbd0: Possible stuck request ffff888028160540: control (read@3072,1024B). Runtime 150 seconds [ 680.086456][T11211] netlink: 'syz.4.1571': attribute type 19 has an invalid length. [ 680.463864][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 680.463935][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 680.741995][ T30] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 680.899819][ T30] usb 4-1: device descriptor read/64, error -71 [ 681.140094][T11073] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 681.171952][ T30] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 681.293099][ T31] audit: type=1804 audit(1788370879.200:627): pid=11238 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=measuring_policy cause=store_entry comm="syz.1.1574" name="ima_policy_written" res=0 errno=-17 [ 681.293160][ T31] audit: type=1807 audit(1788370879.200:628): UNKNOWN=me res=0 [ 681.293184][ T31] audit: type=1802 audit(1788370879.210:629): pid=11238 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=update_policy cause=invalid-policy comm="syz.1.1574" res=0 errno=0 [ 681.322546][ T30] usb 4-1: device descriptor read/64, error -71 [ 681.432475][ T30] usb usb4-port1: attempt power cycle [ 681.455275][T11073] veth0_vlan: entered promiscuous mode [ 681.463473][T11073] veth1_vlan: entered promiscuous mode [ 681.497253][T11073] veth0_macvtap: entered promiscuous mode [ 681.501146][T11073] veth1_macvtap: entered promiscuous mode [ 681.521052][T11073] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 681.529510][T11073] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 681.557301][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.584671][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.644681][ T5831] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 681.644720][ T5831] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 681.652542][ T5831] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.652862][ T5831] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.719620][ T3387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 681.719653][ T3387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 681.772002][ T30] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 681.851682][ T30] usb 4-1: device descriptor read/8, error -71 [ 681.854025][ T31] audit: type=1400 audit(1788370879.770:630): avc: denied { mounton } for pid=11073 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 681.896212][T11228] ima: policy update failed [ 681.896470][ T31] audit: type=1802 audit(1788370879.810:631): pid=11228 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.1.1574" res=0 errno=0 [ 682.417187][T11249] binder: 11246:11249 ioctl 4018620d 0 returned -22 [ 682.963102][ T31] audit: type=1400 audit(1788370880.170:632): avc: denied { read } for pid=11246 comm="syz.0.1577" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 682.963160][ T31] audit: type=1400 audit(1788370880.170:633): avc: denied { open } for pid=11246 comm="syz.0.1577" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 683.043193][ T30] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 683.078004][ T30] usb 4-1: device descriptor read/8, error -71 [ 683.102571][T11251] kAFS: unable to lookup cell 'ÿ' [ 683.852811][ T30] usb usb4-port1: unable to enumerate USB device [ 684.079115][T11263] ptrace attach of "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[5608] was attempted by "ci-upstream-kasan-gce-selinux-root/syz-executor exec"[11263] [ 684.868771][ T31] audit: type=1400 audit(1788370882.780:634): avc: denied { relabelfrom } for pid=11271 comm="syz.0.1579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 684.894199][ T31] audit: type=1400 audit(1788370882.810:635): avc: denied { relabelto } for pid=11271 comm="syz.0.1579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 686.700022][T11291] openvswitch: netlink: IP tunnel dst address not specified [ 689.677037][ T1576] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 690.362899][T11314] netlink: 'syz.4.1601': attribute type 19 has an invalid length. [ 691.242403][T11321] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1591'. [ 691.242449][T11321] netlink: 'syz.1.1591': attribute type 7 has an invalid length. [ 691.242476][T11321] netlink: 'syz.1.1591': attribute type 8 has an invalid length. [ 691.242491][T11321] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1591'. [ 691.256572][T11321] syz_tun: entered promiscuous mode [ 691.292393][T11321] syz_tun: left promiscuous mode [ 691.754369][T11327] netlink: 'syz.3.1595': attribute type 19 has an invalid length. [ 692.516349][T11334] openvswitch: netlink: IP tunnel dst address not specified [ 693.271990][ T974] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 693.405283][ T974] usb 6-1: device descriptor read/64, error -71 [ 693.613800][ T31] audit: type=1400 audit(1788370891.500:636): avc: denied { bind } for pid=11344 comm="syz.0.1610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 693.613867][ T31] audit: type=1400 audit(1788370891.500:637): avc: denied { setopt } for pid=11344 comm="syz.0.1610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 693.613917][ T31] audit: type=1400 audit(1788370891.500:638): avc: denied { map } for pid=11344 comm="syz.0.1610" path="socket:[30565]" dev="sockfs" ino=30565 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 693.613960][ T31] audit: type=1400 audit(1788370891.500:639): avc: denied { read } for pid=11344 comm="syz.0.1610" path="socket:[30565]" dev="sockfs" ino=30565 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 694.587651][ T974] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 694.802141][ T974] usb 6-1: device descriptor read/64, error -71 [ 694.882553][ T31] audit: type=1800 audit(1788370892.800:640): pid=11353 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1614" name="addr_traddr" dev="configfs" ino=29585 res=0 errno=0 [ 694.904493][ T31] audit: type=1800 audit(1788370892.800:641): pid=11353 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1614" name="addr_trsvcid" dev="configfs" ino=29586 res=0 errno=0 [ 694.904563][ T31] audit: type=1800 audit(1788370892.800:642): pid=11353 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.1614" name="addr_adrfam" dev="configfs" ino=29588 res=0 errno=0 [ 694.951195][ T974] usb usb6-port1: attempt power cycle [ 695.104989][ T32] INFO: task kworker/1:6:5710 blocked for more than 143 seconds. [ 695.105027][ T32] Tainted: G L syzkaller #0 [ 695.105052][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 695.105064][ T32] task:kworker/1:6 state:D stack:22448 pid:5710 tgid:5710 ppid:2 ** replaying previous printk message ** [ 695.105064][ T32] task:kworker/1:6 state:D stack:22448 pid:5710 tgid:5710 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 695.105141][ T32] Workqueue: events_freezable mmc_rescan [ 695.105178][ T32] Call Trace: [ 695.105186][ T32] [ 695.105201][ T32] __schedule+0x1259/0x6920 [ 695.105243][ T32] ? __pfx___schedule+0x10/0x10 [ 695.105265][ T32] ? find_held_lock+0x2b/0x80 [ 695.105295][ T32] ? schedule+0x225/0x2c0 [ 695.105322][ T32] schedule+0xdd/0x2c0 [ 695.105344][ T32] schedule_timeout+0x1b2/0x280 [ 695.105376][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 695.105423][ T32] ? mark_held_locks+0x40/0x70 [ 695.105451][ T32] __wait_for_common+0x2e7/0x4c0 [ 695.105475][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 695.105510][ T32] ? __pfx___wait_for_common+0x10/0x10 [ 695.105537][ T32] ? led_trigger_event+0x60/0x270 [ 695.105575][ T32] mmc_wait_for_req_done+0xcd/0x3d0 [ 695.105611][ T32] mmc_wait_for_req+0x207/0x2c0 [ 695.105641][ T32] mmc_wait_for_cmd+0x154/0x200 [ 695.105669][ T32] ? __pfx_mmc_wait_for_cmd+0x10/0x10 [ 695.105714][ T32] ? __pfx_mmc_wait_done+0x10/0x10 [ 695.105745][ T32] ? rpm_resume+0x7eb/0x1320 [ 695.105777][ T32] mmc_io_rw_direct_host+0x126/0x330 [ 695.105807][ T32] ? __pfx_mmc_io_rw_direct_host+0x10/0x10 [ 695.105842][ T32] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 695.105866][ T32] ? __pm_runtime_resume+0xc3/0x170 [ 695.105890][ T32] ? __mmc_claim_host+0x2e2/0x5f0 [ 695.105918][ T32] sdio_reset+0x92/0x240 [ 695.105945][ T32] ? __pfx_sdio_reset+0x10/0x10 [ 695.105970][ T32] ? mmc_sw_reset+0x40/0xd0 [ 695.105996][ T32] ? __pfx_default_wake_function+0x10/0x10 [ 695.106023][ T32] ? lockdep_hardirqs_on+0x7d/0x110 [ 695.106047][ T32] ? mmc_attach_sd_uhs2+0x2d0/0x590 [ 695.106077][ T32] mmc_rescan+0xba9/0x11c0 [ 695.106115][ T32] process_one_work+0xac7/0x1b10 [ 695.106159][ T32] ? __pfx_process_one_work+0x10/0x10 [ 695.106191][ T32] ? lock_acquire+0x1d1/0x380 [ 695.106222][ T32] ? __pfx_mmc_rescan+0x10/0x10 [ 695.106255][ T32] worker_thread+0x5ef/0xe50 [ 695.106293][ T32] ? __pfx_worker_thread+0x10/0x10 [ 695.106346][ T32] ? kthread+0x13a/0x450 [ 695.106374][ T32] ? __pfx_worker_thread+0x10/0x10 [ 695.106409][ T32] kthread+0x373/0x450 [ 695.106437][ T32] ? __pfx_kthread+0x10/0x10 [ 695.106468][ T32] ret_from_fork+0x730/0xd60 [ 695.106494][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 695.106521][ T32] ? __switch_to+0x800/0x10f0 [ 695.106550][ T32] ? __pfx_kthread+0x10/0x10 [ 695.106581][ T32] ret_from_fork_asm+0x1a/0x30 [ 695.106620][ T32] [ 695.106643][ T32] INFO: task kworker/1:0:8977 blocked for more than 143 seconds. [ 695.106662][ T32] Tainted: G L syzkaller #0 [ 695.106676][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 695.106686][ T32] task:kworker/1:0 state:D stack:22200 pid:8977 tgid:8977 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 695.106750][ T32] Workqueue: usb_hub_wq hub_event [ 695.106777][ T32] Call Trace: [ 695.106786][ T32] [ 695.106799][ T32] __schedule+0x1259/0x6920 [ 695.106840][ T32] ? __pfx___schedule+0x10/0x10 [ 695.106860][ T32] ? find_held_lock+0x2b/0x80 [ 695.106890][ T32] ? schedule+0x225/0x2c0 [ 695.106916][ T32] schedule+0xdd/0x2c0 [ 695.106938][ T32] schedule_timeout+0x1b2/0x280 [ 695.106969][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 695.107009][ T32] ? mark_held_locks+0x40/0x70 [ 695.107037][ T32] __wait_for_common+0x2e7/0x4c0 [ 695.107060][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 695.107095][ T32] ? __pfx___wait_for_common+0x10/0x10 [ 695.107119][ T32] ? __flush_work+0x4ca/0xcb0 [ 695.107150][ T32] ? find_held_lock+0x2b/0x80 [ 695.107178][ T32] ? __flush_work+0x928/0xcb0 [ 695.107208][ T32] ? __flush_work+0x928/0xcb0 [ 695.107242][ T32] ? __flush_work+0x4ca/0xcb0 [ 695.107273][ T32] __flush_work+0x7c7/0xcb0 [ 695.107306][ T32] ? __timer_delete+0xd1/0x1b0 [ 695.107339][ T32] ? __pfx___flush_work+0x10/0x10 [ 695.107373][ T32] ? __pfx_wq_barrier_func+0x10/0x10 [ 695.107419][ T32] ? __pfx___might_resched+0x10/0x10 [ 695.107440][ T32] ? _raw_spin_unlock_irq+0x2e/0x50 [ 695.107462][ T32] ? usb_hcd_flush_endpoint+0x359/0x400 [ 695.107496][ T32] cancel_delayed_work_sync+0xd1/0xf0 [ 695.107523][ T32] mmc_stop_host+0xe9/0x400 [ 695.107554][ T32] mmc_remove_host+0x15/0x60 [ 695.107585][ T32] vub300_disconnect+0x12d/0x170 [ 695.107617][ T32] usb_unbind_interface+0x1dd/0x9e0 [ 695.107653][ T32] ? __pfx_usb_unbind_interface+0x10/0x10 [ 695.107683][ T32] device_remove+0x12a/0x180 [ 695.107717][ T32] device_release_driver_internal+0x44e/0x620 [ 695.107747][ T32] bus_remove_device+0x2bc/0x560 [ 695.107780][ T32] ? __pfx_bus_remove_device+0x10/0x10 [ 695.107808][ T32] ? __pfx_device_remove_attrs+0x10/0x10 [ 695.107846][ T32] device_del+0x376/0x9b0 [ 695.107881][ T32] ? __pfx_device_del+0x10/0x10 [ 695.107909][ T32] ? kobject_put+0xb9/0x640 [ 695.107945][ T32] usb_disable_device+0x367/0x810 [ 695.107979][ T32] usb_disconnect+0x2e2/0x9a0 [ 695.108010][ T32] hub_event+0x1bb1/0x4420 [ 695.108055][ T32] ? __lock_acquire+0x4c5/0x1ec0 [ 695.108084][ T32] ? __pfx_hub_event+0x10/0x10 [ 695.108109][ T32] ? mark_lock+0xea0/0x1020 [ 695.108135][ T32] ? lock_acquire+0x1d1/0x380 [ 695.108157][ T32] ? process_one_work+0xa2c/0x1b10 [ 695.108190][ T32] ? process_one_work+0x906/0x1b10 [ 695.108220][ T32] ? process_one_work+0x906/0x1b10 [ 695.108256][ T32] process_one_work+0xac7/0x1b10 [ 695.108300][ T32] ? __pfx_process_one_work+0x10/0x10 [ 695.108333][ T32] ? lock_acquire+0x1d1/0x380 [ 695.108364][ T32] ? __pfx_hub_event+0x10/0x10 [ 695.108392][ T32] worker_thread+0x5ef/0xe50 [ 695.108436][ T32] ? __pfx_worker_thread+0x10/0x10 [ 695.108468][ T32] ? kthread+0x13a/0x450 [ 695.108495][ T32] ? __pfx_worker_thread+0x10/0x10 [ 695.108524][ T32] kthread+0x373/0x450 [ 695.108552][ T32] ? __pfx_kthread+0x10/0x10 [ 695.108583][ T32] ret_from_fork+0x730/0xd60 [ 695.108609][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 695.108634][ T32] ? __switch_to+0x800/0x10f0 [ 695.108664][ T32] ? __pfx_kthread+0x10/0x10 [ 695.108693][ T32] ret_from_fork_asm+0x1a/0x30 [ 695.108732][ T32] [ 695.108760][ T32] [ 695.108760][ T32] Showing all locks held in the system: [ 695.108777][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 695.108795][ T32] #0: ffffffff8edec060 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 695.108874][ T32] locks held by kworker/1:2/974: 6, last CPU#1: [ 695.108891][ T32] #0: ffff88801feb1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 695.108961][ T32] #1: ffffc90004b07d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 695.109030][ T32] #2: ffff88802b2af1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 695.109093][ T32] #3: ffff88802b2ac568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 695.109156][ T32] #4: ffff88802b2be260 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 695.109220][ T32] #5: ffffffff9027e148 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 695.109285][ T32] locks held by kworker/0:2/1576: 2, last CPU#0: [ 695.109301][ T32] #0: ffff888020b78540 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 695.109378][ T32] #1: ffffc90006067d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 695.109483][ T32] locks held by udevd/4970: 1, last CPU#0: [ 695.109500][ T32] #0: ffffffff8edec060 (rcu_read_lock){....}-{1:3}, at: sock_def_readable+0x90/0x600 [ 695.109570][ T32] locks held by getty/5357: 2, on CPU#1: [ 695.109587][ T32] #0: ffff8880337790a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 695.109655][ T32] #1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 695.109722][ T32] locks held by syz-executor/5608: 1, last CPU#0: [ 695.109738][ T32] #0: ffff88807af80460 (sb_writers#6){.+.+}-{0:0}, at: filename_unlinkat+0x1ad/0x730 [ 695.109812][ T32] locks held by syz-executor/5609: 4, last CPU#0: [ 695.109828][ T32] #0: ffffffff8ef3cc30 (dup_mmap_sem){++++}-{0:0}, at: copy_process+0x4806/0x8370 [ 695.109890][ T32] #1: ffff88807576e9b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 [ 695.109955][ T32] #2: ffff88807c4c9078 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 [ 695.110025][ T32] #3: ffffffff8edec060 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 [ 695.110086][ T32] locks held by syz-executor/5614: 2, last CPU#0: [ 695.110103][ T32] #0: ffff888033f50460 (sb_writers#6){.+.+}-{0:0}, at: filename_unlinkat+0x1ad/0x730 [ 695.110174][ T32] #1: ffffffff8edec060 (rcu_read_lock){....}-{1:3}, at: folio_lruvec_lock_irqsave+0x2c/0x5f0 [ 695.110247][ T32] locks held by kworker/1:6/5710: 2, on CPU#1: [ 695.110264][ T32] #0: ffff88801c056140 ((wq_completion)events_freezable){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 695.110333][ T32] #1: ffffc9000334fd08 ((work_completion)(&(&host->detect)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 695.110410][ T32] locks held by udevd/6517: 1, on CPU#0: [ 695.110427][ T32] #0: ffff88802707a350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 695.110496][ T32] locks held by kworker/1:0/8977: 5, on CPU#1: [ 695.110518][ T32] #0: ffff88801feb1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 695.110588][ T32] #1: ffffc90005037d08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 695.110657][ T32] #2: ffff88802b1381d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 695.110720][ T32] #3: ffff88801c17c1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x9a0 [ 695.110783][ T32] #4: ffff888026fed1a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 [ 695.110847][ T32] locks held by udevd/10031: 1, last CPU#0: [ 695.110863][ T32] #0: ffffffff8f906338 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x262/0x460 [ 695.110934][ T32] locks held by syz.0.1616/11354: 1, on CPU#0: [ 695.110950][ T32] #0: ffff88807c8483b8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1f5/0x470 [ 695.146130][ T32] [ 695.146137][ T32] ============================================= [ 695.146137][ T32] [ 695.146159][ T32] NMI backtrace for cpu 0 [ 695.146174][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 695.146200][ T32] Tainted: [L]=SOFTLOCKUP [ 695.146207][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 695.146218][ T32] Call Trace: [ 695.146224][ T32] [ 695.146231][ T32] dump_stack_lvl+0x100/0x190 [ 695.146262][ T32] nmi_cpu_backtrace.cold+0x12d/0x151 [ 695.146289][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 695.146311][ T32] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 695.146341][ T32] sys_info+0x141/0x190 [ 695.146365][ T32] watchdog+0xcb1/0x1030 [ 695.146391][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 695.146415][ T32] ? __pfx_watchdog+0x10/0x10 [ 695.146436][ T32] ? __kthread_parkme+0x18f/0x230 [ 695.146461][ T32] ? kthread+0x13a/0x450 [ 695.146483][ T32] ? __pfx_watchdog+0x10/0x10 [ 695.146501][ T32] kthread+0x373/0x450 [ 695.146524][ T32] ? __pfx_kthread+0x10/0x10 [ 695.146549][ T32] ret_from_fork+0x730/0xd60 [ 695.146570][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 695.146592][ T32] ? __switch_to+0x800/0x10f0 [ 695.146617][ T32] ? __pfx_kthread+0x10/0x10 [ 695.146643][ T32] ret_from_fork_asm+0x1a/0x30 [ 695.146675][ T32] [ 695.146682][ T32] Sending NMI from CPU 0 to CPUs 1: [ 695.146706][ C1] NMI backtrace for cpu 1 [ 695.146718][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Tainted: G L syzkaller #0 PREEMPT(full) [ 695.146741][ C1] Tainted: [L]=SOFTLOCKUP [ 695.146747][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 695.146756][ C1] RIP: 0010:io_serial_in+0x87/0xb0 [ 695.146781][ C1] Code: 07 5c fc 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c c3 cc cc cc cc e8 48 1a cf fc eb a2 e8 d1 1a [ 695.146796][ C1] RSP: 0018:ffffc90000157958 EFLAGS: 00000002 [ 695.146809][ C1] RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000 [ 695.146820][ C1] RDX: 00000000000003fd RSI: ffffffff85afe8d0 RDI: ffffffff9bc63ca0 [ 695.146831][ C1] RBP: ffffffff9bc63c60 R08: 0000000000000001 R09: 000000000000001f [ 695.146841][ C1] R10: 0000000000000000 R11: 205d323354202020 R12: 0000000000000000 [ 695.146851][ C1] R13: 0000000000000020 R14: fffffbfff378c7e9 R15: dffffc0000000000 [ 695.146896][ C1] FS: 0000000000000000(0000) GS:ffff888123c61000(0000) knlGS:0000000000000000 [ 695.146917][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 695.146928][ C1] CR2: 00007fd537fddff8 CR3: 0000000084914000 CR4: 00000000003526f0 [ 695.146938][ C1] Call Trace: [ 695.146944][ C1] [ 695.146950][ C1] wait_for_lsr+0x13a/0x210 [ 695.146970][ C1] serial8250_fifo_wait_for_lsr_thre+0x5f/0xd0 [ 695.146989][ C1] __serial8250_console_fifo_write+0xa5/0x290 [ 695.147006][ C1] ? __pfx_io_serial_out+0x10/0x10 [ 695.147031][ C1] serial8250_console_write+0xf46/0x1330 [ 695.147054][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 695.147074][ C1] ? __nbcon_context_update_unsafe+0x1b6/0x220 [ 695.147101][ C1] ? __pfx___nbcon_context_update_unsafe+0x10/0x10 [ 695.147129][ C1] nbcon_emit_next_record+0x8f7/0xa70 [ 695.147156][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 695.147181][ C1] ? nbcon_context_try_acquire+0x3a6/0xc60 [ 695.147204][ C1] ? do_raw_spin_lock+0xd0/0x260 [ 695.147228][ C1] ? __pfx___cant_migrate+0x10/0x10 [ 695.147249][ C1] ? _raw_spin_lock_irqsave+0x42/0x60 [ 695.147275][ C1] nbcon_emit_one+0x1a8/0x2b0 [ 695.147298][ C1] ? __pfx_nbcon_emit_one+0x10/0x10 [ 695.147325][ C1] nbcon_kthread_func+0x613/0x7d0 [ 695.147351][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 695.147378][ C1] ? __kthread_parkme+0x18f/0x230 [ 695.147398][ C1] ? kthread+0x13a/0x450 [ 695.147418][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 695.147442][ C1] kthread+0x373/0x450 [ 695.147462][ C1] ? __pfx_kthread+0x10/0x10 [ 695.147483][ C1] ret_from_fork+0x730/0xd60 [ 695.147501][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 695.147518][ C1] ? __switch_to+0x800/0x10f0 [ 695.147539][ C1] ? __pfx_kthread+0x10/0x10 [ 695.147561][ C1] ret_from_fork_asm+0x1a/0x30 [ 695.147584][ C1] [ 695.155944][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 696.587198][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 696.597916][ T32] Tainted: [L]=SOFTLOCKUP [ 696.602231][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 696.612269][ T32] Call Trace: [ 696.615530][ T32] [ 696.618440][ T32] dump_stack_lvl+0x100/0x190 [ 696.623109][ T32] vpanic+0x553/0x970 [ 696.627076][ T32] ? __pfx_vpanic+0x10/0x10 [ 696.631568][ T32] panic+0xd1/0xe0 [ 696.635272][ T32] ? __pfx_panic+0x10/0x10 [ 696.639688][ T32] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 696.645838][ T32] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 696.651997][ T32] ? watchdog.cold+0x1ec/0x234 [ 696.656762][ T32] watchdog.cold+0x1fd/0x234 [ 696.661343][ T32] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 696.667131][ T32] ? __pfx_watchdog+0x10/0x10 [ 696.671795][ T32] ? __kthread_parkme+0x18f/0x230 [ 696.676813][ T32] ? kthread+0x13a/0x450 [ 696.681041][ T32] ? __pfx_watchdog+0x10/0x10 [ 696.685704][ T32] kthread+0x373/0x450 [ 696.689762][ T32] ? __pfx_kthread+0x10/0x10 [ 696.694347][ T32] ret_from_fork+0x730/0xd60 [ 696.698925][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 696.704019][ T32] ? __switch_to+0x800/0x10f0 [ 696.708682][ T32] ? __pfx_kthread+0x10/0x10 [ 696.713261][ T32] ret_from_fork_asm+0x1a/0x30 [ 696.718024][ T32] [ 696.721292][ T32] Kernel Offset: disabled [ 696.725598][ T32] Rebooting in 86400 seconds..