last executing test programs: 1m48.520316091s ago: executing program 4 (id=541): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000100)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) 1m48.147401309s ago: executing program 4 (id=547): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket(0x11, 0x1, 0x800) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x11e, 0x1, 0x0, 0xfffffffffffffd61) r1 = syz_open_dev$vim2m(0x0, 0x30001, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000006c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./config\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1\x00', 0x1c0) r2 = openat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/usb_gadget/g1/idVendor\x00', 0x80200, 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1c0) symlinkat(&(0x7f0000000a80)='./config/usb_gadget/g1/configs/c.1/../../functions/ncm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000ac0)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000d40)='dummy_udc.0', 0xb) 1m47.918557483s ago: executing program 4 (id=548): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000b40)=[@in={0x2, 0x4e23, @local}, @in6={0xa, 0x0, 0xfffffffc, @loopback, 0xc7f}], 0x2c) sendto$inet6(r0, &(0x7f0000001080)="e4", 0x1, 0x0, &(0x7f00000016c0)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000001740)={0x1, 0x35, 0x81, 0x4, 0xb7, 0x2, 0x3, 0x7, 0xb, 0x7, 0xc, 0x8, 0x80, 0xa}, 0xe) recvmmsg(r0, &(0x7f0000004040)=[{{0x0, 0x0, 0x0}, 0x80000000}], 0x1, 0x40000002, 0x0) 1m46.898557097s ago: executing program 4 (id=551): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x48004}, 0x0) recvmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000005c0)=""/76, 0x4c}, {&(0x7f0000000640)=""/4092, 0xffc}], 0x2}, 0xfffffffa}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0xffff}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001a80)=""/4101, 0x1005}, {&(0x7f0000002ac0)=""/4092, 0xffc}], 0x2}, 0x101}], 0x7, 0x2, 0x0) 1m46.725501354s ago: executing program 4 (id=554): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/zram0/disksize\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) ioctl$MEMGETOOBSEL(r0, 0x80c84d0a, &(0x7f0000000f00)) r3 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=ANY=[@ANYRES16=r2, @ANYBLOB="230972ad114d03b1ee50d6bb7f6500c1000000000000010000000500070000000000080009000000000006000200010000", @ANYRES32=r3, @ANYBLOB], 0x3c}}, 0x0) close(r3) write(r0, &(0x7f0000000740)='1', 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001040)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000010c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000001100), 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f000001a140)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) r6 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./dev/zram0\x00', 0x2, 0x0) pwrite64(r6, &(0x7f00000007c0)="01", 0x1, 0xc4) 1m44.935656056s ago: executing program 4 (id=565): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1e000000000000"], 0x50) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f0000000140), 0x0, 0x1}) 1m37.909461712s ago: executing program 2 (id=600): openat$sequencer(0xffffffffffffff9c, 0x0, 0x2000, 0x0) r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x81, 0xac, 0xd8, 0x40, 0xdf6, 0x56, 0xd24b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x7f, 0x0, 0x50, 0xf, "", [{{0x9, 0x4, 0x39, 0x0, 0x2, 0x7a, 0xfa, 0x71, 0x2c, [], [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x7, 0x5, 0x2}}, {{0x9, 0x5, 0xc, 0x2, 0x3ff, 0x3, 0xc, 0x9}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41c}}, 0x0, 0x0}, 0x0) 1m35.813592635s ago: executing program 2 (id=608): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x4000, 0x0) mount$9p_unix(&(0x7f00000004c0)='./proc\x00', &(0x7f00000005c0)='.\x00', &(0x7f0000000700), 0x802000, &(0x7f0000002040)) 1m35.687507108s ago: executing program 2 (id=610): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) recvmmsg(r5, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f0000009f00)=[{&(0x7f0000000340)=""/162, 0xa2}, {&(0x7f0000000400)=""/70, 0x46}, {&(0x7f00000000c0)=""/52, 0x34}, {&(0x7f00000004c0)=""/194, 0xc2}, {0x0}, {&(0x7f0000000680)=""/169, 0xa9}, {&(0x7f0000007ec0)=""/4103, 0x1007}], 0x7}, 0x3}], 0x1, 0x40010022, 0x0) 1m35.18017802s ago: executing program 2 (id=614): r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) readv(r1, &(0x7f0000000440)=[{&(0x7f0000000180)=""/16, 0x10}], 0x1) 1m34.333589816s ago: executing program 2 (id=618): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/zram0/disksize\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) ioctl$MEMGETOOBSEL(r0, 0x80c84d0a, &(0x7f0000000f00)) r3 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=ANY=[@ANYRES16=r2, @ANYBLOB="230972ad114d03b1ee50d6bb7f6500c1000000000000010000000500070000000000080009000000000006000200010000", @ANYRES32=r3, @ANYBLOB], 0x3c}}, 0x0) close(r3) write(r0, &(0x7f0000000740)='1', 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001040)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000010c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f000001a140)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) r6 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./dev/zram0\x00', 0x2, 0x0) pwrite64(r6, &(0x7f00000007c0)="01", 0x1, 0xc4) 1m33.770785313s ago: executing program 2 (id=619): r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000540)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x9000, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000002080)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x89c00, 0x0, 0x0, @by_dev={r1}, [@raid={0x0, 0x10, 0x0, 0xa0, 'raid\x00', {'raid5_la', 0x20, '3 64 delta_disks 1', 0x20, 0x2, [{0x20, @dev=@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x0}}, {0x20, @dev=@ram_num={'1:', 0x1}, 0x20, @rnull={'/dev/syzrnull', 0x0}}]}}]}) 1m33.341672317s ago: executing program 3 (id=622): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) write(r0, &(0x7f0000000480)='27', 0x2) write$cgroup_subtree(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) mount$9p_unix(&(0x7f00000004c0)='./proc\x00', &(0x7f00000005c0)='.\x00', &(0x7f0000000700), 0x802000, &(0x7f0000002040)) 1m31.916262912s ago: executing program 3 (id=626): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) sendto$inet(r1, &(0x7f0000000580)="2a00eea69dcc3873", 0x8, 0x44024814, 0x0, 0x0) 1m31.693634575s ago: executing program 3 (id=627): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000040)=0x20) ppoll(&(0x7f0000000080)=[{r0, 0x20}], 0x1, 0x0, 0x0, 0x0) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000000c0)=0x4000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000003c0)={0x1, &(0x7f0000000400)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1m30.934055162s ago: executing program 3 (id=628): r0 = fsopen(&(0x7f00000001c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000580)='cgroup.max.descendants\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0x4) 1m30.750590971s ago: executing program 3 (id=629): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/zram0/disksize\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) ioctl$MEMGETOOBSEL(r0, 0x80c84d0a, &(0x7f0000000f00)) r3 = socket$l2tp(0x2, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=ANY=[@ANYRES16=r2, @ANYBLOB="230972ad114d03b1ee50d6bb7f6500c1000000000000010000000500070000000000080009000000000006000200010000", @ANYRES32=r3, @ANYBLOB], 0x3c}}, 0x0) close(r3) write(r0, &(0x7f0000000740)='1', 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001040)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000010c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000001100), 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f000001a140)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) r5 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./dev/zram0\x00', 0x2, 0x0) pwrite64(r5, &(0x7f00000007c0)="01", 0x1, 0xc4) 1m29.991466158s ago: executing program 3 (id=632): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x100000d, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f00000000c0), 0x0) 1m29.753546452s ago: executing program 32 (id=565): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1e000000000000"], 0x50) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{}, 0x0, &(0x7f0000000200)=r2}, 0x1e) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f0000000140), 0x0, 0x1}) 1m18.683714219s ago: executing program 33 (id=619): r0 = openat$dm_control(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000540)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x9000, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000002080)={0x4, 0x0, 0x0, 0x1d8, 0x138, 0x1, 0x0, 0x89c00, 0x0, 0x0, @by_dev={r1}, [@raid={0x0, 0x10, 0x0, 0xa0, 'raid\x00', {'raid5_la', 0x20, '3 64 delta_disks 1', 0x20, 0x2, [{0x20, @dev=@ram_num={'1:', 0x1}, 0x20, @ram={'/dev/ram', 0x0}}, {0x20, @dev=@ram_num={'1:', 0x1}, 0x20, @rnull={'/dev/syzrnull', 0x0}}]}}]}) 1m14.801060794s ago: executing program 34 (id=632): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x100000d, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f00000000c0), 0x0) 6.954143212s ago: executing program 1 (id=1157): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000b7403340861a22753635f10203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000180)={0x1c, &(0x7f0000000500)=ANY=[@ANYBLOB="000002"], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/ttyUSB0\x00', 0x144002, 0x0) 6.544282344s ago: executing program 5 (id=1161): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=@acquire={0x130, 0x17, 0x1cb58baeb1179e6d, 0x70bd26, 0x25dfdbfd, {{@in6=@loopback, 0x4d2, 0x33}, @in6=@private1, {@in6=@local, @in=@empty, 0x4e22, 0x0, 0x4e22, 0x0, 0x8, 0xa0, 0x40, 0x1e}, {{@in=@empty, @in6=@local, 0x4e20, 0x5, 0x4e22, 0x101, 0xa, 0xa0, 0x80, 0x84}, {0x1, 0x2, 0xd, 0x6, 0x200, 0xffffffffffffffff, 0xa, 0x2}, {0x8, 0x100000000, 0x9, 0x22}, 0x10001, 0x6e6bb8, 0x2, 0x0, 0x1, 0x1}, 0x6, 0x10001, 0x1, 0x70bd28}, [@sa_pcpu={0x8}]}, 0x130}, 0x1, 0x0, 0x0, 0x4000011}, 0x2c000010) 6.265652012s ago: executing program 5 (id=1162): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000005c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904800003fe03010009cd8d1f0002000000"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000700)={0x24, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x80045b09, 0x0) 3.972397656s ago: executing program 6 (id=1177): r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000240)={0x1, 0x3, 0x9}) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000300)={0x4008, 0x4d, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000380), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x200, 0x51, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000400)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000440), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000004c0)={0x7, 0x6, 0x1e}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x1, &(0x7f0000000800)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000840)={0x1, 0x4, 0xe608}) close_range(r5, 0xffffffffffffffff, 0x0) 3.806521462s ago: executing program 7 (id=1178): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) userfaultfd(0x801) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 3.694078694s ago: executing program 1 (id=1179): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000740)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x1}, @cpuid={0x64, 0x18, {0x0, 0x6}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x54b, 0x4, 0x8f, 0x5}}, @set_irq_handler={0xc8, 0x20, {0x2a, 0x2}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_vmlaunch={0x12f, 0x18, 0x3}], 0xb8}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x3, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa402}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fsopen(&(0x7f0000000140)='bdev\x00', 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.688979975s ago: executing program 6 (id=1180): syz_open_dev$vim2m(&(0x7f0000000200), 0x0, 0x2) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_open_dev$dvb_demux(&(0x7f00000000c0), 0x0, 0x41) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_test', 0x88002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000600)={'syz_tun\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000640), 0x12) listen(r2, 0x5) write$tun(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r0, &(0x7f00000006c0)=ANY=[@ANYBLOB="00000805001001", @ANYRES32=r0], 0xa) 3.049734569s ago: executing program 5 (id=1183): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0x40080e0}, 0x20000010) 2.990789046s ago: executing program 6 (id=1184): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000400), 0xffffffffffffff58, 0x20008005, &(0x7f0000000440)={0x2, 0x4e20}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000500)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000540)=0x40) 2.813679614s ago: executing program 1 (id=1185): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget\x00', 0x1ef) mount(0x0, &(0x7f00000000c0)='./gadget\x00', &(0x7f00000001c0)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./gadget/dummy_udc\x00', 0x2, 0x84) write(r0, &(0x7f0000000240)="000000000902190001010080320904000001ff0000000705810240000009021900010100", 0x24) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100000000002003043060000000000001090224"], 0x0) close(r0) 2.666423179s ago: executing program 5 (id=1187): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @multicast1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, 0x0, 0x0) 2.349590791s ago: executing program 5 (id=1188): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000005c0)={0x0, 0x8, 0x2, "68ba"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$sierra_net(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 2.06050338s ago: executing program 0 (id=1189): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000400)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000440)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000480)='PRIVHE', 0x6, 0xc00) pwrite64(r0, &(0x7f00000004c0)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000680)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000700)='P', 0x1, 0x1e8000) r1 = syz_open_dev$loop(&(0x7f0000000840), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.915455695s ago: executing program 7 (id=1190): r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000240)={0x1, 0x3, 0x9}) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000300)={0x4008, 0x4d, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000380), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x200, 0x51, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000400)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000440), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000004c0)={0x7, 0x6, 0x1e}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x1, &(0x7f0000000800)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000840)={0x1, 0x4, 0xe608}) close_range(r5, 0xffffffffffffffff, 0x0) 1.725683144s ago: executing program 6 (id=1191): r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x200009, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1000, 0x9, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000002000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.657490741s ago: executing program 7 (id=1192): timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfffd, 0x6}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = epoll_create1(0x0) r2 = socket$unix(0x1, 0x5, 0x0) socket(0x23, 0x80805, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000180)=0xffff, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000001c0)={0xa0028000}) 1.635990313s ago: executing program 5 (id=1193): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000005c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904800003fe03010009cd8d1f0002000000090505020000fc"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000700)={0x24, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x80045b09, 0x0) 1.583820029s ago: executing program 0 (id=1194): syz_open_dev$vim2m(&(0x7f0000000200), 0x0, 0x2) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_open_dev$dvb_demux(&(0x7f00000000c0), 0x0, 0x41) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_test', 0x88002, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syz_tun\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000600)={'syz_tun\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000640), 0x12) listen(r2, 0x5) write$tun(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="000008050010010b"], 0xa) write$tun(r0, &(0x7f00000006c0)=ANY=[@ANYBLOB="00000805001001", @ANYRES32=r0], 0xa) 1.2808642s ago: executing program 7 (id=1195): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x9, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x3, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff4, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x1000, 0x31, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xfff, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x6, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000740)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x1}, @cpuid={0x64, 0x18, {0x0, 0x6}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x1, @save_area=0x54b, 0x4, 0x8f, 0x5}}, @set_irq_handler={0xc8, 0x20, {0x2a, 0x2}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_vmlaunch={0x12f, 0x18, 0x3}], 0xb8}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x8, 0x4, 0x7, 0x7, 0x5, 0x80000000, 0x1, 0x8001, 0xc646, 0x1, 0x3, 0x3, 0x4, 0x0, 0x8, 0x8000000000000], 0x3000, 0xa402}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fsopen(&(0x7f0000000140)='bdev\x00', 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = dup(0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.199646498s ago: executing program 6 (id=1196): syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, 0x0}) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000180)={0x1, 0x0, [{0x7, 0x400009, 0x7, 0xffffffff, 0x3e0a, 0x4, 0x1}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000004, 0xe5, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000000000, 0x101, 0x8d], 0xeeee8000, 0x2010d3}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x99) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x2010042, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x606442, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.165827521s ago: executing program 0 (id=1197): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}, 0x1, 0x0, 0x0, 0x40080e0}, 0x20000010) 1.126201456s ago: executing program 1 (id=1198): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000280)={r2, 0xffff9047, 0x2, r2}) close(r1) 931.327605ms ago: executing program 0 (id=1199): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000061c0)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000b40), 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000a40)) 361.692183ms ago: executing program 0 (id=1200): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x42}}, 0x10) r1 = openat$sysfs(0xffffff9c, &(0x7f0000000040)='/sys/power/pm_trace_dev_match', 0x0, 0x0) readv(r1, &(0x7f0000000380)=[{&(0x7f00000003c0)=""/172, 0xac}, {&(0x7f0000000240)=""/74, 0x4a}], 0x2) r2 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$DM_DEV_CREATE(r2, 0xc138fd03, &(0x7f0000000480)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x400, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) ioctl$DM_DEV_RENAME(r2, 0xc138fd05, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount(&(0x7f0000000340)=@filename='mtd0\x00', &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='jffs2\x00', 0x800000, 0x0) setxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='system.posix_acl_access\x00', &(0x7f0000000880)={{}, {0x1, 0x7}, [], {0x4, 0x2}, [], {0x10, 0x6}, {0x20, 0x4}}, 0x24, 0x2) 361.346613ms ago: executing program 7 (id=1201): syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000900)=@newsa={0x14c, 0x1a, 0x633, 0x0, 0x25dfdbfd, {{@in=@private=0xa010101, @in=@broadcast, 0x0, 0x4000, 0x4e24, 0x8001, 0x0, 0x80}, {@in6=@remote, 0x0, 0x32}, @in=@private=0xa010101, {0x323, 0x80000001, 0x0, 0xc0, 0x4000, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x200000000}, {}, 0x70bd29, 0x3503, 0xa, 0x5}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @sa_dir={0x5, 0x21, 0x2}, @offload={0xc, 0x1c, {0x0, 0x2}}]}, 0x14c}}, 0x200080d4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x2, 0x4, 0x6, 0xbaa}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400), 0xa7c, r1}, 0x38) r2 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000500)={'comedi_bond\x00', [0x4, 0x4, 0x7fffffff, 0x9, 0x90000, 0x9, 0xed, 0x890, 0x3, 0xfffffffc, 0x14, 0x1, 0x1030, 0x1000008, 0x4c, 0x4000000c, 0xfff7ffa6, 0x3ff, 0x200, 0x9ea, 0x3, 0x80000b, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0x2, 0x2000006, 0x77fd, 0x1]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b19, &(0x7f00000004c0)={'wlan0\x00', @random="7cf1e97c9e4f"}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001180)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000011c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001280)=ANY=[@ANYBLOB="6000000054000500010000000000000007000000", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="01000000ef010101000000000000000000000000080000002800028005000300010000001c0002800c000180080001000a0000010c000180080001"], 0x60}}, 0x0) 360.648623ms ago: executing program 1 (id=1202): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000300)={0x4008, 0x4d, 0x5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000340)={0x1, 0x3, 0x9}) r2 = syz_open_dev$dri(&(0x7f0000000380), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000003c0)={0x200, 0x51, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000400)={r3}) r4 = syz_open_dev$dri(&(0x7f0000000440), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f00000004c0)={0x7, 0x6, 0x1e}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x1, &(0x7f0000000800)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000840)={0x1, 0x4, 0xe608}) close_range(r5, 0xffffffffffffffff, 0x0) 352.615834ms ago: executing program 6 (id=1203): r0 = syz_usb_connect(0x5, 0x39, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000005c0)={0x0, 0x8, 0x2, "68ba"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 109.324229ms ago: executing program 1 (id=1204): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000200)={'batadv_slave_1\x00', {0x2, 0x0, @private=0xfffffffc}}) 37.684116ms ago: executing program 7 (id=1205): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x5, 0x2) 0s ago: executing program 0 (id=1206): r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x200009, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1000, 0x9, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x2000000000002000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): 1: config 16 has an invalid interface number: 128 but max is 0 [ 185.249166][ T4357] usb usb1-port1: attempt power cycle [ 185.260701][ T6129] usb 6-1: config 16 has no interface number 0 [ 185.266996][ T6129] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 185.280079][ T6129] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 185.299277][ T6129] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 185.318927][ T6129] usb 6-1: config 16 interface 128 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 185.338924][ T6129] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 185.368968][ T6129] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.385191][ T4290] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 185.395880][ T4290] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 185.403654][ T4290] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 185.412100][ T4290] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 185.420532][ T4290] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 185.427865][ T4290] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 185.650561][ T6129] usb 6-1: usb_control_msg returned -71 [ 185.658232][ T6129] usbtmc 6-1:16.128: can't read capabilities [ 185.691263][ T6938] rxe_eth0 speed is unknown, defaulting to 1000 [ 185.699059][ T4357] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 185.738301][ T6129] usb 6-1: USB disconnect, device number 2 [ 185.749488][ T4357] usb 1-1: device descriptor read/8, error -71 [ 186.029161][ T4357] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 186.079630][ T4357] usb 1-1: device descriptor read/8, error -71 [ 186.192539][ T6938] chnl_net:caif_netlink_parms(): no params data found [ 186.199657][ T4357] usb usb1-port1: unable to enumerate USB device [ 186.469150][ T4357] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 186.561241][ T6938] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.573271][ T6938] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.585183][ T6938] device bridge_slave_0 entered promiscuous mode [ 186.623734][ T6938] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.635847][ T6938] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.670046][ T4357] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 186.673466][ T6938] device bridge_slave_1 entered promiscuous mode [ 186.685395][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 186.704987][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 186.728490][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.750094][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 186.769043][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 186.789739][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.828144][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 186.849071][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 186.888969][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.896860][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 186.898296][ T6938] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.923395][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 186.950065][ T6938] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.965160][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.986056][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 187.005885][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 187.027268][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 187.057404][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 187.079708][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 187.109302][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 187.124510][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 187.153923][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 187.169355][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 187.176554][ T6974] kAFS: bad VL server IP address [ 187.187361][ T4357] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 187.203160][ T4357] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 187.229273][ T4357] usb 2-1: config 0 interface 0 has no altsetting 0 [ 187.239403][ T6974] kAFS: No cell specified [ 187.251230][ T6938] team0: Port device team_slave_0 added [ 187.257080][ T4357] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 187.299910][ T4357] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 187.308310][ T4357] usb 2-1: Product: syz [ 187.338951][ T4357] usb 2-1: Manufacturer: syz [ 187.343613][ T4357] usb 2-1: SerialNumber: syz [ 187.372920][ T4357] usb 2-1: config 0 descriptor?? [ 187.464433][ T4357] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 187.522728][ T6938] team0: Port device team_slave_1 added [ 187.529399][ T4290] Bluetooth: hci2: command 0x0409 tx timeout [ 187.667260][ T6938] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 187.678919][ T22] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 187.705348][ T6938] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 187.793724][ T6938] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 187.917819][ T6938] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 187.925299][ T22] usb 6-1: Using ep0 maxpacket: 8 [ 187.959500][ T6938] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 188.096162][ T6938] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 188.320752][ T22] usb 6-1: unable to get BOS descriptor or descriptor too short [ 188.334840][ T22] usb 6-1: config 0 has an invalid interface number: 88 but max is 0 [ 188.346508][ T22] usb 6-1: config 0 has no interface number 0 [ 188.360366][ T22] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 188.378905][ T22] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid maxpacket 58498, setting to 1024 [ 188.404818][ T22] usb 6-1: config 0 interface 88 has no altsetting 0 [ 188.431864][ T22] usb 6-1: string descriptor 0 read error: -22 [ 188.440717][ T22] usb 6-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 188.469008][ T22] usb 6-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 188.511330][ T22] usb 6-1: config 0 descriptor?? [ 188.530402][ T6979] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 188.537922][ T4266] usb 2-1: USB disconnect, device number 14 [ 188.552988][ T4266] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 188.579120][ T22] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.88/input/input7 [ 188.682586][ C1] usb_acecad 6-1:0.88: can't resubmit intr, dummy_hcd.5-1/input0, status -1 [ 188.775937][ T6938] device hsr_slave_0 entered promiscuous mode [ 188.819866][ T6938] device hsr_slave_1 entered promiscuous mode [ 188.859292][ T6938] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 188.866925][ T6938] Cannot create hsr debugfs directory [ 188.877630][ T4266] usb 6-1: USB disconnect, device number 3 [ 189.110262][ T5490] IPVS: stopping backup sync thread 4863 ... [ 189.378629][ T4285] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 189.388496][ T4285] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 189.398184][ T4285] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 189.406658][ T4285] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 189.417696][ T4285] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 189.426675][ T4285] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 189.609434][ T4285] Bluetooth: hci2: command 0x041b tx timeout [ 189.682739][ T7000] rxe_eth0 speed is unknown, defaulting to 1000 [ 189.854280][ T7010] kAFS: bad VL server IP address [ 189.886522][ T7010] kAFS: No cell specified [ 189.894407][ T6938] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 189.947489][ T6938] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 189.981939][ T6938] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 190.011052][ T6938] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 190.232717][ T5490] device hsr_slave_0 left promiscuous mode [ 190.253814][ T5490] device hsr_slave_1 left promiscuous mode [ 190.265408][ T5490] device bridge_slave_1 left promiscuous mode [ 190.276046][ T5490] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.295990][ T5490] device bridge_slave_0 left promiscuous mode [ 190.307481][ T5490] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.324039][ T4266] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 190.499213][ T4266] usb 1-1: device descriptor read/64, error -71 [ 190.829374][ T4266] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 191.029101][ T4266] usb 1-1: device descriptor read/64, error -71 [ 191.163566][ T4266] usb usb1-port1: attempt power cycle [ 191.449734][ T4285] Bluetooth: hci1: command 0x0409 tx timeout [ 191.541792][ T5490] team0 (unregistering): Port device team_slave_1 removed [ 191.577704][ T5490] team0 (unregistering): Port device team_slave_0 removed [ 191.599120][ T4266] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 191.615491][ T5490] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 191.639461][ T4266] usb 1-1: device descriptor read/8, error -71 [ 191.653687][ T5490] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 191.689101][ T4285] Bluetooth: hci2: command 0x040f tx timeout [ 191.885766][ T5490] bond0 (unregistering): Released all slaves [ 191.929258][ T4266] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 191.990585][ T4266] usb 1-1: device descriptor read/8, error -71 [ 192.119351][ T4266] usb usb1-port1: unable to enumerate USB device [ 192.149357][ T6938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.197378][ T7000] chnl_net:caif_netlink_parms(): no params data found [ 192.279956][ T7048] kAFS: bad VL server IP address [ 192.291227][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 192.297349][ T7048] kAFS: No cell specified [ 192.305225][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 192.352056][ T6938] 8021q: adding VLAN 0 to HW filter on device team0 [ 192.497550][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.524460][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.542066][ T5397] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.549269][ T5397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.557561][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.566475][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.597332][ T5397] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.604532][ T5397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.630441][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 192.669130][ T7000] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.676254][ T7000] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.708033][ T7000] device bridge_slave_0 entered promiscuous mode [ 192.725347][ T7000] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.742122][ T7000] bridge0: port 2(bridge_slave_1) entered disabled state [ 192.751344][ T7000] device bridge_slave_1 entered promiscuous mode [ 192.796910][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 192.807463][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 192.832648][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 192.850822][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.878374][ T6938] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 192.905794][ T6938] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 193.002080][ T7000] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 193.015615][ T7000] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.025012][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 193.052890][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 193.358912][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 193.552387][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 193.562124][ T4285] Bluetooth: hci1: command 0x041b tx timeout [ 193.676715][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 193.763327][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 193.771525][ T4285] Bluetooth: hci2: command 0x0419 tx timeout [ 193.810191][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 193.859666][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.939891][ T7000] team0: Port device team_slave_0 added [ 194.011598][ T7000] team0: Port device team_slave_1 added [ 194.063942][ T7091] kAFS: bad VL server IP address [ 194.080556][ T7091] kAFS: No cell specified [ 194.094535][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.100901][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.159963][ T7000] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 194.166980][ T7000] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 194.235216][ T7000] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 194.286752][ T7093] netlink: 28 bytes leftover after parsing attributes in process `syz.1.700'. [ 194.344570][ T7000] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 194.375480][ T7000] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 194.448294][ T7000] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 194.512181][ T7107] netlink: 'syz.1.704': attribute type 29 has an invalid length. [ 194.534908][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.547337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.574468][ T7107] netlink: 'syz.1.704': attribute type 29 has an invalid length. [ 194.594481][ T6938] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.655261][ T7110] netlink: 'syz.1.704': attribute type 29 has an invalid length. [ 194.685927][ T7000] device hsr_slave_0 entered promiscuous mode [ 194.709485][ T7000] device hsr_slave_1 entered promiscuous mode [ 194.729237][ T4363] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 194.739964][ T7000] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 194.747590][ T7000] Cannot create hsr debugfs directory [ 194.899093][ T4363] usb 6-1: device descriptor read/64, error -71 [ 195.124784][ T7125] kAFS: bad VL server IP address [ 195.148245][ T7125] kAFS: No cell specified [ 195.170096][ T4363] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 195.331819][ T4363] usb 6-1: device descriptor read/64, error -71 [ 195.342963][ T7000] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 195.417654][ T7000] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 195.449410][ T4363] usb usb6-port1: attempt power cycle [ 195.456547][ T7000] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 195.494397][ T7135] netlink: 12 bytes leftover after parsing attributes in process `syz.0.712'. [ 195.586985][ T7135] 8021q: adding VLAN 0 to HW filter on device bond1 [ 195.609072][ T4285] Bluetooth: hci1: command 0x040f tx timeout [ 195.667688][ T7000] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 195.767616][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 195.804397][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 195.833602][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 195.852122][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 195.868115][ T4363] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 195.877363][ T7152] netlink: 'syz.0.715': attribute type 29 has an invalid length. [ 195.903489][ T4363] usb 6-1: device descriptor read/8, error -71 [ 195.915651][ T6938] device veth0_vlan entered promiscuous mode [ 195.926387][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 195.936421][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 195.945714][ T7152] netlink: 'syz.0.715': attribute type 29 has an invalid length. [ 195.984496][ T7154] netlink: 'syz.0.715': attribute type 29 has an invalid length. [ 196.035969][ T6938] device veth1_vlan entered promiscuous mode [ 196.099205][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan0: link becomes ready [ 196.118049][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan1: link becomes ready [ 196.129860][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 196.138251][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 196.188903][ T4363] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 196.190531][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 196.212665][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 196.227333][ T6938] device veth0_macvtap entered promiscuous mode [ 196.239688][ T4363] usb 6-1: device descriptor read/8, error -71 [ 196.250527][ T7000] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.274061][ T6938] device veth1_macvtap entered promiscuous mode [ 196.315001][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 196.340967][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 196.352939][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.359633][ T4363] usb usb6-port1: unable to enumerate USB device [ 196.370357][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.390441][ T7000] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.409998][ T6938] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 196.432393][ T6938] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.448538][ T7165] kAFS: bad VL server IP address [ 196.448608][ T6938] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 196.468364][ T6938] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 196.479276][ T6938] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.485344][ T7165] kAFS: No cell specified [ 196.491047][ T6938] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 196.521164][ T6938] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.544520][ T6938] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 196.638817][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 196.659715][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 196.679206][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 196.695192][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 196.714624][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 196.734811][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 196.753434][ T4441] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.760658][ T4441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.777056][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 196.801674][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 196.819474][ T4441] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.826646][ T4441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.840286][ T6938] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.849495][ T6938] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.858215][ T6938] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.871432][ T6938] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.889098][ T4353] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 196.899496][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 196.930306][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 197.042067][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 197.062643][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 197.072306][ T26] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 197.085250][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 197.094475][ T4353] usb 1-1: Using ep0 maxpacket: 32 [ 197.101717][ T4353] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 197.130134][ T4353] usb 1-1: config 155 has 0 interfaces, different from the descriptor's value: 1 [ 197.157608][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 197.171692][ T4353] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 197.182050][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 197.190227][ T4353] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.199670][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 197.208272][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 197.216960][ T4353] usb 1-1: Product: syz [ 197.221401][ T4353] usb 1-1: Manufacturer: syz [ 197.226006][ T4353] usb 1-1: SerialNumber: syz [ 197.231683][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 197.240754][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 197.249808][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 197.261240][ T7000] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 197.270801][ T26] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 197.282563][ T26] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 197.295447][ T26] usb 2-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 197.305067][ T26] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 197.315268][ T26] usb 2-1: Product: syz [ 197.325164][ T4441] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 197.325428][ T26] usb 2-1: Manufacturer: syz [ 197.352482][ T4441] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 197.388326][ T26] mos7840 2-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 197.398007][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 197.502855][ T4441] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 197.529550][ T4441] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 197.577867][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 197.655761][ T5490] device hsr_slave_0 left promiscuous mode [ 197.676854][ T5490] device hsr_slave_1 left promiscuous mode [ 197.699630][ T4285] Bluetooth: hci1: command 0x0419 tx timeout [ 197.706123][ T5490] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 197.733020][ T5490] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 197.752817][ T5490] device bridge_slave_1 left promiscuous mode [ 197.759518][ T5490] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.770944][ T5490] device bridge_slave_0 left promiscuous mode [ 197.777221][ T5490] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.494874][ T5490] team0 (unregistering): Port device team_slave_1 removed [ 198.575324][ T5490] team0 (unregistering): Port device team_slave_0 removed [ 198.627103][ T5490] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 198.667250][ T5490] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 198.810155][ T26] mos7840: probe of ttyUSB0 failed with error -71 [ 198.826253][ T26] usb 2-1: USB disconnect, device number 15 [ 198.835661][ T26] mos7840 2-1:1.0: device disconnected [ 198.985815][ T5490] bond0 (unregistering): Released all slaves [ 199.104038][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 199.112611][ T4441] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 199.132422][ T7000] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.261799][ T7211] netlink: 'syz.5.724': attribute type 29 has an invalid length. [ 199.280568][ T7211] netlink: 'syz.5.724': attribute type 29 has an invalid length. [ 199.306317][ T7211] netlink: 'syz.5.724': attribute type 29 has an invalid length. [ 199.618825][ T7223] kAFS: bad VL server IP address [ 199.631772][ T7223] kAFS: No cell specified [ 199.704121][ T4356] usb 1-1: USB disconnect, device number 16 [ 200.099126][ T4356] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 200.123917][ T7251] netlink: 'syz.6.736': attribute type 29 has an invalid length. [ 200.132166][ T7251] netlink: 'syz.6.736': attribute type 29 has an invalid length. [ 200.141303][ T7251] netlink: 'syz.6.736': attribute type 29 has an invalid length. [ 200.289905][ T4356] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 200.309132][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.339961][ T4356] usb 2-1: config 0 has no interfaces? [ 200.371896][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.384871][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 200.409166][ T4356] usb 2-1: config 0 has no interfaces? [ 200.420526][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 200.424124][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.475686][ T7261] kAFS: bad VL server IP address [ 200.477312][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 200.485605][ T4356] usb 2-1: config 0 has no interfaces? [ 200.495903][ T7261] kAFS: No cell specified [ 200.501646][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.528984][ T4356] usb 2-1: config 0 has no interfaces? [ 200.535394][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 200.550290][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.571065][ T7000] device veth0_vlan entered promiscuous mode [ 200.582255][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 200.598937][ T4356] usb 2-1: config 0 has no interfaces? [ 200.608370][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 200.620279][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.643557][ T7000] device veth1_vlan entered promiscuous mode [ 200.652631][ T4356] usb 2-1: config 0 has no interfaces? [ 200.674957][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.699407][ T4356] usb 2-1: config 0 has no interfaces? [ 200.706093][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan0: link becomes ready [ 200.717768][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan1: link becomes ready [ 200.734721][ T4356] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.752352][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 200.764305][ T4356] usb 2-1: config 0 has no interfaces? [ 200.774099][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 200.786406][ T4356] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 200.797167][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 200.805241][ T4356] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 200.814783][ T5397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 200.823335][ T4356] usb 2-1: Product: syz [ 200.827644][ T4356] usb 2-1: Manufacturer: syz [ 200.836467][ T7000] device veth0_macvtap entered promiscuous mode [ 200.849023][ T6129] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 200.855612][ T4356] usb 2-1: SerialNumber: syz [ 200.880946][ T4356] usb 2-1: config 0 descriptor?? [ 200.891372][ T7000] device veth1_macvtap entered promiscuous mode [ 200.940248][ T7000] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 200.970176][ T7000] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 200.991233][ T7000] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 201.016534][ T7281] netlink: 'syz.5.747': attribute type 29 has an invalid length. [ 201.026943][ T7000] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 201.048792][ T7000] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 201.057267][ T7281] netlink: 'syz.5.747': attribute type 29 has an invalid length. [ 201.068970][ T6129] usb 7-1: Using ep0 maxpacket: 32 [ 201.075326][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 201.075693][ T6129] usb 7-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 201.084329][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 201.104379][ T6129] usb 7-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 201.113575][ T6129] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.122084][ T6129] usb 7-1: Product: syz [ 201.126551][ T6129] usb 7-1: Manufacturer: syz [ 201.149812][ T6129] usb 7-1: SerialNumber: syz [ 201.156514][ T7] usb 2-1: USB disconnect, device number 16 [ 201.164567][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 201.181142][ T6129] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 201.190366][ T4451] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 201.199126][ T6129] imon 7-1:155.0: unable to initialize intf0, err -19 [ 201.209349][ T7000] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 201.220078][ T6129] imon:imon_probe: failed to initialize context! [ 201.226458][ T6129] imon 7-1:155.0: unable to register, err -19 [ 201.228696][ T7000] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 201.251733][ T7000] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 201.266935][ T7000] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 201.279858][ T7000] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 201.291462][ T7000] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 201.304431][ T7000] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 201.318072][ T7282] netlink: 'syz.5.747': attribute type 29 has an invalid length. [ 201.330449][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 201.347140][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 201.367807][ T7000] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.389422][ T7000] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.398166][ T7000] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.407209][ T7000] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.549489][ T4451] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 201.565145][ T4451] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 201.593322][ T4374] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 201.634528][ T4374] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 201.659114][ T4374] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 201.666702][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 201.815747][ T7301] kAFS: bad VL server IP address [ 201.840800][ T7301] kAFS: No cell specified [ 202.213799][ T7323] netlink: 'syz.5.758': attribute type 29 has an invalid length. [ 202.245323][ T7323] netlink: 'syz.5.758': attribute type 29 has an invalid length. [ 202.284405][ T7329] netlink: 'syz.5.758': attribute type 29 has an invalid length. [ 202.879300][ T4363] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 202.977985][ T7360] netlink: 'syz.1.772': attribute type 29 has an invalid length. [ 203.069540][ T4363] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 203.088532][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.119190][ T4363] usb 6-1: config 0 has no interfaces? [ 203.136320][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.203833][ T4363] usb 6-1: config 0 has no interfaces? [ 203.219313][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.254775][ T4363] usb 6-1: config 0 has no interfaces? [ 203.277204][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.319676][ T4363] usb 6-1: config 0 has no interfaces? [ 203.344097][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.363623][ T7372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.776'. [ 203.388355][ T4363] usb 6-1: config 0 has no interfaces? [ 203.406678][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.487492][ T7372] 8021q: adding VLAN 0 to HW filter on device bond2 [ 203.494337][ T4363] usb 6-1: config 0 has no interfaces? [ 203.520478][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.597806][ T4363] usb 6-1: config 0 has no interfaces? [ 203.629506][ T14] usb 7-1: USB disconnect, device number 2 [ 203.639960][ T4363] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.689071][ T4363] usb 6-1: config 0 has no interfaces? [ 203.707977][ T4363] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 203.746282][ T4363] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 203.782449][ T4363] usb 6-1: Product: syz [ 203.803460][ T4363] usb 6-1: Manufacturer: syz [ 203.818103][ T4363] usb 6-1: SerialNumber: syz [ 203.842729][ T4363] usb 6-1: config 0 descriptor?? [ 204.107222][ T4363] usb 6-1: USB disconnect, device number 8 [ 204.918965][ T4353] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 204.949517][ T7414] netlink: 12 bytes leftover after parsing attributes in process `syz.0.789'. [ 205.076691][ T7414] 8021q: adding VLAN 0 to HW filter on device bond2 [ 205.110109][ T4353] usb 7-1: Using ep0 maxpacket: 32 [ 205.156388][ T4353] usb 7-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 205.197351][ T4353] usb 7-1: config 155 has 0 interfaces, different from the descriptor's value: 1 [ 205.234717][ T4353] usb 7-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 205.267385][ T4353] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.292631][ T4353] usb 7-1: Product: syz [ 205.297938][ T7430] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 205.318368][ T4353] usb 7-1: Manufacturer: syz [ 205.335205][ T7430] device-mapper: raid: Choosing default region size of 4MiB [ 205.351139][ T4353] usb 7-1: SerialNumber: syz [ 205.519981][ T7438] FAULT_INJECTION: forcing a failure. [ 205.519981][ T7438] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 205.574080][ T7438] CPU: 0 PID: 7438 Comm: syz.7.795 Not tainted syzkaller #0 [ 205.581424][ T7438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 205.591499][ T7438] Call Trace: [ 205.594798][ T7438] [ 205.597756][ T7438] dump_stack_lvl+0x188/0x24e [ 205.602476][ T7438] ? show_regs_print_info+0x12/0x12 [ 205.607702][ T7438] ? load_image+0x410/0x410 [ 205.612237][ T7438] ? __lock_acquire+0x7ea0/0x7ea0 [ 205.617290][ T7438] ? do_raw_spin_unlock+0x11d/0x230 [ 205.622193][ T7430] md/raid1:mdX: active with 1 out of 1 mirrors [ 205.622493][ T7438] should_fail_ex+0x390/0x4c0 [ 205.622525][ T7438] _copy_from_user+0x2c/0x170 [ 205.638202][ T7438] sync_file_ioctl+0x1e6/0xef0 [ 205.643169][ T7438] ? sync_file_poll+0x230/0x230 [ 205.648065][ T7438] ? __fget_files+0x28/0x460 [ 205.652692][ T7438] ? bpf_lsm_file_ioctl+0x5/0x10 [ 205.657659][ T7438] ? security_file_ioctl+0x7c/0xa0 [ 205.662887][ T7438] ? sync_file_poll+0x230/0x230 [ 205.667767][ T7438] __se_sys_ioctl+0xfa/0x170 [ 205.672395][ T7438] do_syscall_64+0x4c/0xa0 [ 205.676837][ T7438] ? clear_bhb_loop+0x60/0xb0 [ 205.681535][ T7438] ? clear_bhb_loop+0x60/0xb0 [ 205.686238][ T7438] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 205.692151][ T7438] RIP: 0033:0x7fe9523a94d9 [ 205.696581][ T7438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.716218][ T7438] RSP: 002b:00007fe9531df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 205.724655][ T7438] RAX: ffffffffffffffda RBX: 00007fe952625fa0 RCX: 00007fe9523a94d9 [ 205.732648][ T7438] RDX: 0000200000000a80 RSI: 00000000c0303e03 RDI: 0000000000000005 [ 205.740636][ T7438] RBP: 00007fe95243804e R08: 0000000000000000 R09: 0000000000000000 [ 205.748631][ T7438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 205.756620][ T7438] R13: 00007fe952626038 R14: 00007fe952625fa0 R15: 00007ffc19d40b88 [ 205.764800][ T7438] [ 205.889570][ T7448] FAULT_INJECTION: forcing a failure. [ 205.889570][ T7448] name failslab, interval 1, probability 0, space 0, times 0 [ 205.909695][ T7448] CPU: 1 PID: 7448 Comm: syz.5.797 Not tainted syzkaller #0 [ 205.917031][ T7448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 205.927113][ T7448] Call Trace: [ 205.930408][ T7448] [ 205.933352][ T7448] dump_stack_lvl+0x188/0x24e [ 205.938067][ T7448] ? show_regs_print_info+0x12/0x12 [ 205.943294][ T7448] ? load_image+0x410/0x410 [ 205.947822][ T7448] ? __might_sleep+0xd0/0xd0 [ 205.952430][ T7448] ? __lock_acquire+0x7ea0/0x7ea0 [ 205.957485][ T7448] should_fail_ex+0x390/0x4c0 [ 205.962190][ T7448] should_failslab+0x5/0x20 [ 205.966715][ T7448] slab_pre_alloc_hook+0x59/0x300 [ 205.971759][ T7448] ? jffs2_sum_init+0x6e/0x210 [ 205.976551][ T7448] __kmem_cache_alloc_node+0x4f/0x270 [ 205.981954][ T7448] ? jffs2_sum_init+0x6e/0x210 [ 205.986739][ T7448] kmalloc_trace+0x26/0xe0 [ 205.991195][ T7448] jffs2_sum_init+0x6e/0x210 [ 205.995807][ T7448] jffs2_do_mount_fs+0x722/0x22b0 [ 206.000859][ T7448] ? __raw_spin_lock_init+0x41/0x100 [ 206.006173][ T7448] jffs2_do_fill_super+0x551/0xc50 [ 206.011317][ T7448] ? jffs2_reconfigure+0x310/0x310 [ 206.016450][ T7448] mtd_get_sb+0xcb/0x2b0 [ 206.020707][ T7448] ? mtd_get_sb_by_nr+0x7c/0xa0 [ 206.025575][ T7448] get_tree_mtd+0x5e2/0x760 [ 206.030093][ T7448] ? jffs2_reconfigure+0x310/0x310 [ 206.035225][ T7448] ? mtd_proc_show+0x270/0x270 [ 206.040093][ T7448] ? apparmor_capable+0x12c/0x190 [ 206.045137][ T7448] ? bpf_lsm_capable+0x5/0x10 [ 206.049841][ T7448] ? security_capable+0x85/0xb0 [ 206.054724][ T7448] vfs_get_tree+0x88/0x270 [ 206.059180][ T7448] do_new_mount+0x247/0xa50 [ 206.063714][ T7448] __se_sys_mount+0x2e3/0x3d0 [ 206.068426][ T7448] ? __x64_sys_mount+0xc0/0xc0 [ 206.073219][ T7448] ? lockdep_hardirqs_on+0x94/0x140 [ 206.078437][ T7448] ? __x64_sys_mount+0x1c/0xc0 [ 206.083233][ T7448] do_syscall_64+0x4c/0xa0 [ 206.087678][ T7448] ? clear_bhb_loop+0x60/0xb0 [ 206.092384][ T7448] ? clear_bhb_loop+0x60/0xb0 [ 206.097092][ T7448] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 206.103014][ T7448] RIP: 0033:0x7f2e97fa94d9 [ 206.107443][ T7448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.127165][ T7448] RSP: 002b:00007f2e98e0e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 206.135606][ T7448] RAX: ffffffffffffffda RBX: 00007f2e98225fa0 RCX: 00007f2e97fa94d9 [ 206.143685][ T7448] RDX: 0000200000002900 RSI: 00002000000028c0 RDI: 0000200000002880 [ 206.151684][ T7448] RBP: 00007f2e9803804e R08: 0000000000000000 R09: 0000000000000000 [ 206.159684][ T7448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 206.167682][ T7448] R13: 00007f2e98226038 R14: 00007f2e98225fa0 R15: 00007fff70b46d28 [ 206.175691][ T7448] [ 206.193538][ T7448] jffs2: warning: (7448) jffs2_sum_init: Can't allocate memory for summary information! [ 206.483215][ T4363] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 206.553808][ T7470] netlink: 12 bytes leftover after parsing attributes in process `syz.5.804'. [ 206.586275][ T7470] 8021q: adding VLAN 0 to HW filter on device bond1 [ 206.684361][ T4363] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 206.704100][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.727246][ T4363] usb 8-1: config 0 has no interfaces? [ 206.764552][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.789026][ T4363] usb 8-1: config 0 has no interfaces? [ 206.799771][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.839324][ T4363] usb 8-1: config 0 has no interfaces? [ 206.866386][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.882298][ T4363] usb 8-1: config 0 has no interfaces? [ 206.897146][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.923679][ T4363] usb 8-1: config 0 has no interfaces? [ 206.942229][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.978578][ T4363] usb 8-1: config 0 has no interfaces? [ 206.981565][ T7487] validate_nla: 2 callbacks suppressed [ 206.981578][ T7487] netlink: 'syz.0.808': attribute type 29 has an invalid length. [ 206.997404][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.036243][ T4363] usb 8-1: config 0 has no interfaces? [ 207.043912][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.080985][ T4363] usb 8-1: config 0 has no interfaces? [ 207.082232][ T7492] use of bytesused == 0 is deprecated and will be removed in the future, [ 207.101156][ T4363] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 207.104274][ T7492] use the actual size instead. [ 207.122248][ T7487] netlink: 'syz.0.808': attribute type 29 has an invalid length. [ 207.126822][ T4363] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 207.149025][ T7490] netlink: 'syz.0.808': attribute type 29 has an invalid length. [ 207.165790][ T4363] usb 8-1: Product: syz [ 207.171070][ T4363] usb 8-1: Manufacturer: syz [ 207.175786][ T4363] usb 8-1: SerialNumber: syz [ 207.196903][ T4363] usb 8-1: config 0 descriptor?? [ 207.278911][ T22] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 207.349071][ T7498] FAULT_INJECTION: forcing a failure. [ 207.349071][ T7498] name failslab, interval 1, probability 0, space 0, times 0 [ 207.398785][ T7498] CPU: 0 PID: 7498 Comm: syz.1.811 Not tainted syzkaller #0 [ 207.406129][ T7498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 207.416208][ T7498] Call Trace: [ 207.419510][ T7498] [ 207.422466][ T7498] dump_stack_lvl+0x188/0x24e [ 207.427172][ T7498] ? show_regs_print_info+0x12/0x12 [ 207.432399][ T7498] ? load_image+0x410/0x410 [ 207.436932][ T7498] ? __might_sleep+0xd0/0xd0 [ 207.441544][ T7498] ? __lock_acquire+0x7ea0/0x7ea0 [ 207.446602][ T7498] should_fail_ex+0x390/0x4c0 [ 207.451312][ T7498] should_failslab+0x5/0x20 [ 207.455835][ T7498] slab_pre_alloc_hook+0x59/0x300 [ 207.460864][ T7498] ? call_usermodehelper_setup+0x8a/0x260 [ 207.466587][ T7498] __kmem_cache_alloc_node+0x4f/0x270 [ 207.471955][ T7498] ? call_usermodehelper_setup+0x8a/0x260 [ 207.477674][ T7498] kmalloc_trace+0x26/0xe0 [ 207.482087][ T7498] call_usermodehelper_setup+0x8a/0x260 [ 207.487719][ T7498] ? __request_module+0xa00/0xa00 [ 207.492753][ T7498] __request_module+0x406/0xa00 [ 207.497624][ T7498] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 207.503629][ T7498] ? copy_regset_to_user+0x1f0/0x1f0 [ 207.508966][ T7498] ? slab_free_freelist_hook+0x133/0x1b0 [ 207.514607][ T7498] ? rcu_is_watching+0x11/0xa0 [ 207.519380][ T7498] ? nvmf_dev_write+0x1acc/0x2810 [ 207.524406][ T7498] ? __kmem_cache_free+0xb6/0x200 [ 207.529450][ T7498] nvmf_dev_write+0x1b28/0x2810 [ 207.534346][ T7498] ? nvmf_host_put+0x190/0x190 [ 207.539123][ T7498] ? end_current_label_crit_section+0x14b/0x170 [ 207.545382][ T7498] ? fsnotify_perm+0x5a/0x550 [ 207.550161][ T7498] ? security_file_permission+0x75/0xa0 [ 207.555733][ T7498] ? nvmf_host_put+0x190/0x190 [ 207.560501][ T7498] vfs_write+0x2dc/0x9a0 [ 207.564749][ T7498] ? file_end_write+0x250/0x250 [ 207.569593][ T7498] ? __fget_files+0x28/0x460 [ 207.574187][ T7498] ? __fget_files+0x3fc/0x460 [ 207.578872][ T7498] ? __fdget_pos+0x1d4/0x360 [ 207.583467][ T7498] ? ksys_write+0x70/0x260 [ 207.587874][ T7498] ksys_write+0x14d/0x260 [ 207.592198][ T7498] ? __ia32_sys_read+0x80/0x80 [ 207.596959][ T7498] ? lockdep_hardirqs_on+0x94/0x140 [ 207.602155][ T7498] do_syscall_64+0x4c/0xa0 [ 207.606574][ T7498] ? clear_bhb_loop+0x60/0xb0 [ 207.611250][ T7498] ? clear_bhb_loop+0x60/0xb0 [ 207.615956][ T7498] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 207.621848][ T7498] RIP: 0033:0x7fd3b73a94d9 [ 207.626259][ T7498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.645858][ T7498] RSP: 002b:00007fd3b8357028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 207.654289][ T7498] RAX: ffffffffffffffda RBX: 00007fd3b7625fa0 RCX: 00007fd3b73a94d9 [ 207.662254][ T7498] RDX: 0000000000000031 RSI: 0000200000000180 RDI: 0000000000000004 [ 207.670219][ T7498] RBP: 00007fd3b743804e R08: 0000000000000000 R09: 0000000000000000 [ 207.678188][ T7498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 207.686152][ T7498] R13: 00007fd3b7626038 R14: 00007fd3b7625fa0 R15: 00007ffe6a0ce2b8 [ 207.694151][ T7498] [ 207.739059][ T22] usb 6-1: Using ep0 maxpacket: 32 [ 207.754242][ T4363] usb 8-1: USB disconnect, device number 2 [ 207.769684][ T22] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.789933][ T22] usb 6-1: config 0 has no interfaces? [ 207.804655][ T22] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 207.830695][ T4357] usb 7-1: USB disconnect, device number 3 [ 207.840880][ T22] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.880818][ T22] usb 6-1: config 0 descriptor?? [ 207.980221][ T5490] device hsr_slave_0 left promiscuous mode [ 207.996874][ T5490] device hsr_slave_1 left promiscuous mode [ 208.009789][ T5490] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 208.025570][ T5490] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 208.042432][ T5490] device bridge_slave_1 left promiscuous mode [ 208.057189][ T5490] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.078436][ T5490] device bridge_slave_0 left promiscuous mode [ 208.091554][ T5490] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.103498][ T22] usb 6-1: USB disconnect, device number 9 [ 208.192151][ T7498] nvme nvme0: failed to connect socket: -512 [ 208.990268][ T7536] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 209.082458][ T5490] team0 (unregistering): Port device team_slave_1 removed [ 209.119715][ T5490] team0 (unregistering): Port device team_slave_0 removed [ 209.167379][ T5490] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.223290][ T5490] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.486605][ T5490] bond0 (unregistering): Released all slaves [ 209.544266][ T7520] netlink: 12 bytes leftover after parsing attributes in process `syz.0.815'. [ 209.564614][ T7536] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 209.609443][ T7538] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 209.793587][ T7546] netlink: 'syz.7.825': attribute type 1 has an invalid length. [ 209.826419][ T7546] netlink: 4 bytes leftover after parsing attributes in process `syz.7.825'. [ 210.238984][ T22] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 210.361958][ T7572] netlink: 12 bytes leftover after parsing attributes in process `syz.7.833'. [ 210.409400][ T4290] Bluetooth: hci4: command 0x2021 tx timeout [ 210.439112][ T22] usb 7-1: Using ep0 maxpacket: 32 [ 210.446137][ T22] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 210.457800][ T22] usb 7-1: config 0 has no interfaces? [ 210.463718][ T22] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 210.473146][ T22] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 210.507754][ T22] usb 7-1: config 0 descriptor?? [ 210.516726][ T7581] netlink: 'syz.5.836': attribute type 29 has an invalid length. [ 210.539431][ T7581] netlink: 'syz.5.836': attribute type 29 has an invalid length. [ 210.578831][ T7583] netlink: 'syz.5.836': attribute type 29 has an invalid length. [ 210.635460][ T7588] overlayfs: upper fs does not support file handles, falling back to index=off. [ 210.742847][ T22] usb 7-1: USB disconnect, device number 4 [ 211.988066][ T7636] validate_nla: 1 callbacks suppressed [ 211.988082][ T7636] netlink: 'syz.0.849': attribute type 29 has an invalid length. [ 212.047770][ T7639] netlink: 'syz.0.849': attribute type 29 has an invalid length. [ 212.403406][ T4390] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 212.606419][ T4390] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 212.631350][ T4390] usb 6-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 212.667814][ T4390] usb 6-1: Product: syz [ 212.684870][ T4390] usb 6-1: Manufacturer: syz [ 212.697067][ T4390] usb 6-1: SerialNumber: syz [ 212.719429][ T4390] usb 6-1: config 0 descriptor?? [ 212.735204][ T4390] ch341 6-1:0.0: ch341-uart converter detected [ 213.740233][ T4390] ch341-uart ttyUSB0: break control not supported, using simulated break [ 213.772089][ T4390] usb 6-1: ch341-uart converter now attached to ttyUSB0 [ 214.132322][ T7733] netlink: 'syz.7.865': attribute type 29 has an invalid length. [ 214.187125][ T7733] netlink: 'syz.7.865': attribute type 29 has an invalid length. [ 214.196486][ T7735] netlink: 'syz.7.865': attribute type 29 has an invalid length. [ 214.378944][ T4363] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 214.571646][ T4363] usb 2-1: Using ep0 maxpacket: 32 [ 214.584467][ T4363] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 214.614201][ T4363] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 214.637609][ T4363] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.687090][ T4363] usb 2-1: config 0 descriptor?? [ 214.935116][ T7761] netlink: 12 bytes leftover after parsing attributes in process `syz.0.873'. [ 214.994864][ T7761] 8021q: adding VLAN 0 to HW filter on device bond3 [ 215.155641][ T7774] netlink: 'syz.6.876': attribute type 29 has an invalid length. [ 215.224813][ T7727] usb 6-1: failed to send control message: -110 [ 215.232136][ T7774] netlink: 'syz.6.876': attribute type 29 has an invalid length. [ 215.232298][ T7727] ch341-uart ttyUSB0: ch341_open - failed to submit interrupt urb: -22 [ 215.255370][ T7778] netlink: 'syz.6.876': attribute type 29 has an invalid length. [ 215.262387][ T4390] usb 6-1: USB disconnect, device number 10 [ 215.282639][ T4390] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 215.303590][ T4390] ch341 6-1:0.0: device disconnected [ 215.669102][ T27] audit: type=1326 audit(1794524222.273:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 215.696822][ T27] audit: type=1326 audit(1794524222.283:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 215.715644][ T7797] FAULT_INJECTION: forcing a failure. [ 215.715644][ T7797] name failslab, interval 1, probability 0, space 0, times 0 [ 215.722135][ T27] audit: type=1326 audit(1794524222.303:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 215.755619][ T7797] CPU: 1 PID: 7797 Comm: syz.0.885 Not tainted syzkaller #0 [ 215.764986][ T7797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 215.774528][ T27] audit: type=1326 audit(1794524222.303:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 215.775038][ T7797] Call Trace: [ 215.775047][ T7797] [ 215.805221][ T7797] dump_stack_lvl+0x188/0x24e [ 215.809917][ T7797] ? show_regs_print_info+0x12/0x12 [ 215.815116][ T7797] ? load_image+0x410/0x410 [ 215.819736][ T7797] ? __might_sleep+0xd0/0xd0 [ 215.824323][ T7797] ? __lock_acquire+0x7ea0/0x7ea0 [ 215.829350][ T7797] should_fail_ex+0x390/0x4c0 [ 215.834030][ T7797] should_failslab+0x5/0x20 [ 215.838526][ T7797] slab_pre_alloc_hook+0x59/0x300 [ 215.843545][ T7797] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 215.849533][ T7797] ? memcg_alloc_slab_cgroups+0x81/0x120 [ 215.855177][ T7797] __kmem_cache_alloc_node+0x4f/0x270 [ 215.860553][ T7797] ? memcg_alloc_slab_cgroups+0x81/0x120 [ 215.866183][ T7797] __kmalloc_node+0xa2/0x240 [ 215.870771][ T7797] memcg_alloc_slab_cgroups+0x81/0x120 [ 215.876230][ T7797] slab_post_alloc_hook+0xba/0x490 [ 215.881344][ T7797] ? __devinet_sysctl_register+0xa1/0x320 [ 215.887064][ T7797] __kmem_cache_alloc_node+0x19d/0x270 [ 215.892523][ T7797] ? __devinet_sysctl_register+0xa1/0x320 [ 215.898240][ T7797] __kmalloc_node_track_caller+0xa0/0x240 [ 215.903962][ T7797] kmemdup+0x27/0x60 [ 215.907856][ T7797] __devinet_sysctl_register+0xa1/0x320 [ 215.913416][ T7797] ? devinet_sysctl_register+0x1f0/0x1f0 [ 215.919045][ T7797] ? devinet_init_net+0x73/0x590 [ 215.923977][ T7797] ? rcu_is_watching+0x11/0xa0 [ 215.928738][ T7797] ? kmemdup+0x42/0x60 [ 215.932808][ T7797] ? devinet_init_net+0x2e2/0x590 [ 215.937836][ T7797] devinet_init_net+0x304/0x590 [ 215.942685][ T7797] ops_init+0x360/0x5e0 [ 215.946840][ T7797] setup_net+0x4f2/0xbd0 [ 215.951077][ T7797] ? copy_net_ns+0x5b0/0x5b0 [ 215.955675][ T7797] ? copy_net_ns+0x324/0x5b0 [ 215.960267][ T7797] ? down_read_killable+0x1cc/0x340 [ 215.965463][ T7797] copy_net_ns+0x33e/0x5b0 [ 215.969884][ T7797] create_new_namespaces+0x3ce/0x700 [ 215.975172][ T7797] unshare_nsproxy_namespaces+0x116/0x160 [ 215.980888][ T7797] ksys_unshare+0x4f6/0x8e0 [ 215.985396][ T7797] ? sighand_ctor+0x40/0x40 [ 215.989894][ T7797] ? lock_chain_count+0x20/0x20 [ 215.994751][ T7797] __x64_sys_unshare+0x34/0x40 [ 215.999532][ T7797] do_syscall_64+0x4c/0xa0 [ 216.003946][ T7797] ? clear_bhb_loop+0x60/0xb0 [ 216.008622][ T7797] ? clear_bhb_loop+0x60/0xb0 [ 216.013299][ T7797] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 216.019211][ T7797] RIP: 0033:0x7f58ecda94d9 [ 216.023648][ T7797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.043269][ T7797] RSP: 002b:00007f58edcd9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 216.051715][ T7797] RAX: ffffffffffffffda RBX: 00007f58ed025fa0 RCX: 00007f58ecda94d9 [ 216.059683][ T7797] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 216.067656][ T7797] RBP: 00007f58ece3804e R08: 0000000000000000 R09: 0000000000000000 [ 216.075704][ T7797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.083675][ T7797] R13: 00007f58ed026038 R14: 00007f58ed025fa0 R15: 00007ffe4d428598 [ 216.091661][ T7797] [ 216.111655][ T27] audit: type=1326 audit(1794524222.303:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.159665][ T6129] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 216.166550][ T27] audit: type=1326 audit(1794524222.303:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.185618][ T7797] rxe_eth0 speed is unknown, defaulting to 1000 [ 216.217476][ T27] audit: type=1326 audit(1794524222.303:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.242726][ T27] audit: type=1326 audit(1794524222.303:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.268776][ T27] audit: type=1326 audit(1794524222.303:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.298692][ T27] audit: type=1326 audit(1794524222.303:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7796 comm="syz.0.885" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58ecda94d9 code=0x7ffc0000 [ 216.359852][ T6129] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 216.374190][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.397888][ T6129] usb 8-1: config 0 has no interfaces? [ 216.410296][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.421310][ T6129] usb 8-1: config 0 has no interfaces? [ 216.434876][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.445791][ T6129] usb 8-1: config 0 has no interfaces? [ 216.464056][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.478617][ T6129] usb 8-1: config 0 has no interfaces? [ 216.496602][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.514811][ T6129] usb 8-1: config 0 has no interfaces? [ 216.539787][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.563393][ T6129] usb 8-1: config 0 has no interfaces? [ 216.577691][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.595910][ T6129] usb 8-1: config 0 has no interfaces? [ 216.606265][ T6129] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.616945][ T6129] usb 8-1: config 0 has no interfaces? [ 216.632356][ T6129] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 216.642102][ T6129] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 216.652639][ T6129] usb 8-1: Product: syz [ 216.656919][ T6129] usb 8-1: Manufacturer: syz [ 216.665130][ T6129] usb 8-1: SerialNumber: syz [ 216.686291][ T6129] usb 8-1: config 0 descriptor?? [ 216.751179][ T7808] netlink: 12 bytes leftover after parsing attributes in process `syz.6.887'. [ 216.911348][ T6129] usb 8-1: USB disconnect, device number 3 [ 217.028918][ T7822] netlink: 8 bytes leftover after parsing attributes in process `syz.0.890'. [ 217.094971][ T7825] netlink: 'syz.5.891': attribute type 29 has an invalid length. [ 217.117473][ T7825] netlink: 'syz.5.891': attribute type 29 has an invalid length. [ 217.141044][ T7825] netlink: 'syz.5.891': attribute type 29 has an invalid length. [ 217.178579][ T4390] usb 2-1: USB disconnect, device number 17 [ 217.189787][ T7829] loop0: detected capacity change from 0 to 3904 [ 217.282675][ T7829] loop0: [ 217.405432][ T4357] smpboot: CPU 1 is now offline [ 218.320235][ T7867] netlink: 'syz.7.905': attribute type 29 has an invalid length. [ 218.380657][ T7867] netlink: 'syz.7.905': attribute type 29 has an invalid length. [ 218.423180][ T7861] nvme nvme0: failed to connect socket: -111 [ 218.452138][ T7868] netlink: 'syz.7.905': attribute type 29 has an invalid length. [ 218.460215][ T4357] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 218.541005][ T7874] loop0: detected capacity change from 0 to 3904 [ 218.639860][ T7875] loop0: [ 218.659026][ T4357] usb 1-1: Using ep0 maxpacket: 32 [ 218.686281][ T4357] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 218.761340][ T4357] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 218.841563][ T4357] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.903648][ T4357] usb 1-1: config 0 descriptor?? [ 219.147140][ T7894] UDC core: g1: couldn't find an available UDC or it's busy [ 219.191200][ T4363] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 219.432208][ T4363] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 219.468291][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.531368][ T4363] usb 7-1: config 0 has no interfaces? [ 219.592934][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.641826][ T4363] usb 7-1: config 0 has no interfaces? [ 219.678427][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.693102][ T7908] netlink: 'syz.5.918': attribute type 29 has an invalid length. [ 219.736308][ T4363] usb 7-1: config 0 has no interfaces? [ 219.762080][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.796606][ T4363] usb 7-1: config 0 has no interfaces? [ 219.820749][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.859086][ T4363] usb 7-1: config 0 has no interfaces? [ 219.886621][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.920867][ T4363] usb 7-1: config 0 has no interfaces? [ 219.943658][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.984292][ T4363] usb 7-1: config 0 has no interfaces? [ 220.010616][ T4363] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 220.044459][ T4363] usb 7-1: config 0 has no interfaces? [ 220.072563][ T4363] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 220.107238][ T4363] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 220.135478][ T4363] usb 7-1: Product: syz [ 220.146100][ T4363] usb 7-1: Manufacturer: syz [ 220.161477][ T4363] usb 7-1: SerialNumber: syz [ 220.177823][ T4363] usb 7-1: config 0 descriptor?? [ 220.253957][ T7908] netlink: 'syz.5.918': attribute type 29 has an invalid length. [ 220.274714][ T7911] netlink: 'syz.5.918': attribute type 29 has an invalid length. [ 220.435227][ T14] usb 7-1: USB disconnect, device number 5 [ 220.791536][ T27] kauditd_printk_skb: 131 callbacks suppressed [ 220.791545][ T27] audit: type=1800 audit(1794524227.403:157): pid=7939 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.925" name="idVendor" dev="configfs" ino=48356 res=0 errno=0 [ 220.834294][ T7939] UDC core: g1: couldn't find an available UDC or it's busy [ 221.238646][ T14] usb 1-1: USB disconnect, device number 17 [ 221.555001][ T7959] netlink: 'syz.6.932': attribute type 29 has an invalid length. [ 221.689105][ T4285] Bluetooth: hci2: command 0x0406 tx timeout [ 221.781507][ T7968] jffs2: notice: (7968) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 222.333446][ T4363] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 222.451707][ T6129] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 222.541014][ T4363] usb 8-1: too many configurations: 9, using maximum allowed: 8 [ 222.576652][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.651463][ T4363] usb 8-1: config 0 has no interfaces? [ 222.659259][ T6129] usb 7-1: Using ep0 maxpacket: 32 [ 222.675472][ T6129] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 222.695318][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.718624][ T8004] FAULT_INJECTION: forcing a failure. [ 222.718624][ T8004] name failslab, interval 1, probability 0, space 0, times 0 [ 222.748695][ T6129] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 222.764724][ T4363] usb 8-1: config 0 has no interfaces? [ 222.804878][ T6129] usb 7-1: config 0 descriptor?? [ 222.813748][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.831568][ T8004] CPU: 0 PID: 8004 Comm: syz.0.945 Not tainted syzkaller #0 [ 222.838867][ T8004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 222.848908][ T8004] Call Trace: [ 222.852174][ T8004] [ 222.855091][ T8004] dump_stack_lvl+0x188/0x24e [ 222.859760][ T8004] ? show_regs_print_info+0x12/0x12 [ 222.864951][ T8004] ? load_image+0x410/0x410 [ 222.869439][ T8004] ? __might_sleep+0xd0/0xd0 [ 222.874030][ T8004] ? __lock_acquire+0x7ea0/0x7ea0 [ 222.879128][ T8004] should_fail_ex+0x390/0x4c0 [ 222.883813][ T8004] should_failslab+0x5/0x20 [ 222.888296][ T8004] slab_pre_alloc_hook+0x59/0x300 [ 222.893313][ T8004] kmem_cache_alloc+0x56/0x2f0 [ 222.898080][ T8004] ? security_file_alloc+0x30/0x110 [ 222.903547][ T8004] security_file_alloc+0x30/0x110 [ 222.908584][ T8004] __alloc_file+0xc2/0x230 [ 222.913020][ T8004] alloc_empty_file+0x90/0x180 [ 222.917800][ T8004] alloc_file+0x5b/0x5f0 [ 222.922036][ T8004] alloc_file_pseudo+0x180/0x200 [ 222.926987][ T8004] ? alloc_empty_file_noaccount+0x80/0x80 [ 222.932701][ T8004] ? alloc_fd+0x590/0x640 [ 222.937024][ T8004] sock_alloc_file+0xb3/0x240 [ 222.941687][ T8004] __sys_socket+0x12d/0x190 [ 222.946191][ T8004] __x64_sys_socket+0x76/0x80 [ 222.950854][ T8004] do_syscall_64+0x4c/0xa0 [ 222.955259][ T8004] ? clear_bhb_loop+0x60/0xb0 [ 222.959923][ T8004] ? clear_bhb_loop+0x60/0xb0 [ 222.964588][ T8004] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 222.970471][ T8004] RIP: 0033:0x7f58ecda94d9 [ 222.974886][ T8004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.994484][ T8004] RSP: 002b:00007f58edcd9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 223.002884][ T8004] RAX: ffffffffffffffda RBX: 00007f58ed025fa0 RCX: 00007f58ecda94d9 [ 223.010837][ T8004] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000010 [ 223.018791][ T8004] RBP: 00007f58ece3804e R08: 0000000000000000 R09: 0000000000000000 [ 223.026743][ T8004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 223.034696][ T8004] R13: 00007f58ed026038 R14: 00007f58ed025fa0 R15: 00007ffe4d428598 [ 223.042664][ T8004] [ 223.045782][ C0] vkms_vblank_simulate: vblank timer overrun [ 223.075704][ T6129] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 223.094006][ T4363] usb 8-1: config 0 has no interfaces? [ 223.136467][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.177315][ T4363] usb 8-1: config 0 has no interfaces? [ 223.205916][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.252145][ T8015] jffs2: notice: (8015) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 223.275722][ T6129] gspca_vc032x: reg_r err -32 [ 223.283172][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.288484][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.294900][ T4363] usb 8-1: config 0 has no interfaces? [ 223.315834][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.336690][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.344010][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.360531][ T4363] usb 8-1: config 0 has no interfaces? [ 223.367875][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.383934][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.421069][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.438827][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.452698][ T4363] usb 8-1: config 0 has no interfaces? [ 223.465299][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.480985][ T4363] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 223.503935][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.520714][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.533918][ T4363] usb 8-1: config 0 has no interfaces? [ 223.553071][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.558425][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.567422][ T4363] usb 8-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 223.591523][ T8022] validate_nla: 2 callbacks suppressed [ 223.591535][ T8022] netlink: 'syz.5.950': attribute type 29 has an invalid length. [ 223.609164][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.614507][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.628954][ T4363] usb 8-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 223.646860][ T4363] usb 8-1: Product: syz [ 223.651454][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.664678][ T4363] usb 8-1: Manufacturer: syz [ 223.671471][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.678003][ T8022] netlink: 'syz.5.950': attribute type 29 has an invalid length. [ 223.691500][ T4363] usb 8-1: SerialNumber: syz [ 223.698313][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.722762][ T4363] usb 8-1: config 0 descriptor?? [ 223.728721][ T8024] netlink: 'syz.5.950': attribute type 29 has an invalid length. [ 223.742508][ T6129] gspca_vc032x: I2c Bus Busy Wait 00 [ 223.762118][ T6129] gspca_vc032x: Unknown sensor... [ 223.774044][ T6129] vc032x: probe of 7-1:0.0 failed with error -22 [ 223.971195][ T6129] usb 8-1: USB disconnect, device number 4 [ 224.092793][ T4285] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 224.826125][ T8064] jffs2: notice: (8064) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 224.991295][ T8071] netlink: 'syz.5.962': attribute type 29 has an invalid length. [ 225.047162][ T8071] netlink: 'syz.5.962': attribute type 29 has an invalid length. [ 225.093647][ T8074] netlink: 'syz.5.962': attribute type 29 has an invalid length. [ 225.291817][ T4363] usb 7-1: USB disconnect, device number 6 [ 225.526737][ T6129] hid-generic 0005:0008:0007.0001: item fetching failed at offset 0/1 [ 225.568491][ T6129] hid-generic: probe of 0005:0008:0007.0001 failed with error -22 [ 225.761100][ T4285] Bluetooth: hci0: unexpected event for opcode 0x041b [ 225.770867][ T6129] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 225.890741][ T4357] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 225.970716][ T4363] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 225.978744][ T6129] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 226.008584][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.042968][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.068033][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.076733][ T4357] usb 8-1: device descriptor read/64, error -71 [ 226.096650][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.127391][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.153607][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.182911][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.193772][ T4363] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 226.228936][ T4363] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 226.249127][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.258044][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.295645][ T4363] usb 7-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 226.335442][ T4363] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 226.346079][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.358947][ T4357] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 226.397912][ T4363] usb 7-1: Product: syz [ 226.414394][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.431129][ T4363] usb 7-1: Manufacturer: syz [ 226.465624][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.476346][ T4363] mos7840 7-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 226.521178][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.539021][ T4357] usb 8-1: device descriptor read/64, error -71 [ 226.563357][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.596883][ T8123] netlink: 'syz.1.978': attribute type 29 has an invalid length. [ 226.610823][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.635721][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.662544][ T8123] netlink: 'syz.1.978': attribute type 29 has an invalid length. [ 226.670917][ T4357] usb usb8-port1: attempt power cycle [ 226.705902][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.722291][ T8125] netlink: 'syz.1.978': attribute type 29 has an invalid length. [ 226.748710][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.784378][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.834752][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 226.883755][ T4363] mos7840: probe of ttyUSB0 failed with error -32 [ 226.900791][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 226.936390][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.986880][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 227.032715][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 227.064611][ T4285] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 227.077895][ T6129] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 227.099072][ T4357] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 227.120132][ T6129] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 227.142626][ T4357] usb 8-1: device descriptor read/8, error -71 [ 227.158317][ T6129] usb 6-1: Product: syz [ 227.173808][ T6129] usb 6-1: Manufacturer: syz [ 227.181780][ T6129] usb 6-1: SerialNumber: syz [ 227.205703][ T6129] usb 6-1: config 0 descriptor?? [ 227.235475][ T8140] device bond0 entered promiscuous mode [ 227.242008][ T6129] yurex 6-1:0.0: Could not find endpoints [ 227.268458][ T8140] device bond_slave_0 entered promiscuous mode [ 227.285343][ T8140] device bond_slave_1 entered promiscuous mode [ 227.306231][ T8140] device batadv0 entered promiscuous mode [ 227.331377][ T8140] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 227.362375][ T8140] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 227.400004][ T8140] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 227.419538][ T4357] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 227.443891][ T8140] device bond0 left promiscuous mode [ 227.460027][ T6129] usb 6-1: USB disconnect, device number 11 [ 227.475930][ T8140] device bond_slave_0 left promiscuous mode [ 227.483462][ T4357] usb 8-1: device descriptor read/8, error -71 [ 227.511224][ T8140] device bond_slave_1 left promiscuous mode [ 227.523846][ T8140] device batadv0 left promiscuous mode [ 227.619723][ T4357] usb usb8-port1: unable to enumerate USB device [ 227.939881][ T4290] Bluetooth: hci4: unexpected event for opcode 0x041b [ 228.117526][ T8171] Cannot find set identified by id 0 to match [ 228.306330][ T8181] netlink: 'syz.5.991': attribute type 29 has an invalid length. [ 228.390682][ T8184] netlink: 40 bytes leftover after parsing attributes in process `syz.0.993'. [ 228.981300][ T4357] usb 7-1: USB disconnect, device number 7 [ 229.031065][ T4357] mos7840 7-1:1.0: device disconnected [ 229.532733][ T4357] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 229.729521][ T4357] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 229.762485][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.818451][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 229.874338][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 229.922749][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.990744][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.032914][ T8227] validate_nla: 2 callbacks suppressed [ 230.032925][ T8227] netlink: 'syz.7.1004': attribute type 29 has an invalid length. [ 230.060327][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.092194][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.130838][ T8227] netlink: 'syz.7.1004': attribute type 29 has an invalid length. [ 230.161424][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.185916][ T8232] netlink: 'syz.7.1004': attribute type 29 has an invalid length. [ 230.222583][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.275171][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.337196][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.387967][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.425866][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.474829][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.526502][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.561940][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.611864][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.652397][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.691016][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.709071][ T4363] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 230.762133][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.803101][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 230.834253][ T4357] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.890126][ T4363] usb 8-1: device descriptor read/64, error -71 [ 230.906728][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 230.957246][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 231.006018][ T4357] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 231.057033][ T4357] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 231.107275][ T4357] usb 7-1: Product: syz [ 231.141236][ T4357] usb 7-1: Manufacturer: syz [ 231.160833][ T4357] usb 7-1: SerialNumber: syz [ 231.185612][ T4357] usb 7-1: config 0 descriptor?? [ 231.190914][ T4363] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 231.230321][ T4357] yurex 7-1:0.0: Could not find endpoints [ 231.370501][ T4363] usb 8-1: device descriptor read/64, error -71 [ 231.470646][ T8257] usb 7-1: USB disconnect, device number 8 [ 231.488960][ T128] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 231.496809][ T4363] usb usb8-port1: attempt power cycle [ 231.544361][ T27] audit: type=1800 audit(1794524238.153:158): pid=8193 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.995" name="#2055" dev="sda1" ino=2055 res=0 errno=0 [ 231.710267][ T128] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 231.753360][ T128] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 231.805435][ T128] usb 6-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 231.855043][ T128] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 231.896657][ T128] usb 6-1: Product: syz [ 231.916827][ T128] usb 6-1: Manufacturer: syz [ 231.929599][ T4363] usb 8-1: new high-speed USB device number 11 using dummy_hcd [ 231.962214][ T128] mos7840 6-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 232.001863][ T4363] usb 8-1: device descriptor read/8, error -71 [ 232.301249][ T4363] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 232.361664][ T4363] usb 8-1: device descriptor read/8, error -71 [ 232.368348][ T128] mos7840: probe of ttyUSB0 failed with error -32 [ 232.509650][ T4363] usb usb8-port1: unable to enumerate USB device [ 232.533752][ T8281] FAULT_INJECTION: forcing a failure. [ 232.533752][ T8281] name failslab, interval 1, probability 0, space 0, times 0 [ 232.577843][ T8281] CPU: 0 PID: 8281 Comm: syz.0.1015 Not tainted syzkaller #0 [ 232.585256][ T8281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 232.595318][ T8281] Call Trace: [ 232.598603][ T8281] [ 232.601526][ T8281] dump_stack_lvl+0x188/0x24e [ 232.606198][ T8281] ? show_regs_print_info+0x12/0x12 [ 232.611388][ T8281] ? load_image+0x410/0x410 [ 232.615878][ T8281] ? __might_sleep+0xd0/0xd0 [ 232.620453][ T8281] ? __lock_acquire+0x7ea0/0x7ea0 [ 232.625462][ T8281] should_fail_ex+0x390/0x4c0 [ 232.630225][ T8281] should_failslab+0x5/0x20 [ 232.634726][ T8281] slab_pre_alloc_hook+0x59/0x300 [ 232.639741][ T8281] kmem_cache_alloc+0x56/0x2f0 [ 232.644489][ T8281] ? ep_insert+0x249/0x1980 [ 232.648998][ T8281] ep_insert+0x249/0x1980 [ 232.653336][ T8281] ? __mutex_lock+0x1ab/0xb40 [ 232.658003][ T8281] ? ep_loop_check+0x1b0/0x1b0 [ 232.662758][ T8281] ? do_epoll_ctl+0x3fb/0xf40 [ 232.667436][ T8281] ? mutex_lock_nested+0x10/0x10 [ 232.672494][ T8281] ? __fget_files+0x3fc/0x460 [ 232.677171][ T8281] ? __fdget+0x17c/0x200 [ 232.681405][ T8281] ? do_epoll_ctl+0x39/0xf40 [ 232.685980][ T8281] do_epoll_ctl+0x8b2/0xf40 [ 232.690471][ T8281] __x64_sys_epoll_ctl+0x162/0x1b0 [ 232.695567][ T8281] ? ep_modify+0xa80/0xa80 [ 232.699975][ T8281] ? lockdep_hardirqs_on+0x94/0x140 [ 232.705159][ T8281] do_syscall_64+0x4c/0xa0 [ 232.709561][ T8281] ? clear_bhb_loop+0x60/0xb0 [ 232.714222][ T8281] ? clear_bhb_loop+0x60/0xb0 [ 232.718884][ T8281] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 232.724759][ T8281] RIP: 0033:0x7f58ecda94d9 [ 232.729184][ T8281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.748785][ T8281] RSP: 002b:00007f58edcd9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 232.757209][ T8281] RAX: ffffffffffffffda RBX: 00007f58ed025fa0 RCX: 00007f58ecda94d9 [ 232.765166][ T8281] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000005 [ 232.773128][ T8281] RBP: 00007f58ece3804e R08: 0000000000000000 R09: 0000000000000000 [ 232.781098][ T8281] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000000 [ 232.789076][ T8281] R13: 00007f58ed026038 R14: 00007f58ed025fa0 R15: 00007ffe4d428598 [ 232.797071][ T8281] [ 233.046917][ T8296] netlink: 'syz.1.1017': attribute type 29 has an invalid length. [ 233.076322][ T8296] netlink: 'syz.1.1017': attribute type 29 has an invalid length. [ 233.095508][ T8296] netlink: 'syz.1.1017': attribute type 29 has an invalid length. [ 233.270704][ T8304] input: syz0 as /devices/virtual/input/input8 [ 233.981200][ T4363] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 234.034082][ T8338] netlink: 'syz.7.1029': attribute type 29 has an invalid length. [ 234.068315][ T8338] netlink: 'syz.7.1029': attribute type 29 has an invalid length. [ 234.126229][ T8341] netlink: 'syz.7.1029': attribute type 29 has an invalid length. [ 234.155212][ T8335] FAULT_INJECTION: forcing a failure. [ 234.155212][ T8335] name failslab, interval 1, probability 0, space 0, times 0 [ 234.200302][ T4363] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 234.218951][ T8335] CPU: 0 PID: 8335 Comm: syz.0.1027 Not tainted syzkaller #0 [ 234.226341][ T8335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 234.236381][ T8335] Call Trace: [ 234.239644][ T8335] [ 234.242560][ T8335] dump_stack_lvl+0x188/0x24e [ 234.247230][ T8335] ? show_regs_print_info+0x12/0x12 [ 234.252417][ T8335] ? load_image+0x410/0x410 [ 234.256903][ T8335] ? __might_sleep+0xd0/0xd0 [ 234.261475][ T8335] ? __lock_acquire+0x7ea0/0x7ea0 [ 234.266486][ T8335] should_fail_ex+0x390/0x4c0 [ 234.271152][ T8335] should_failslab+0x5/0x20 [ 234.275634][ T8335] slab_pre_alloc_hook+0x59/0x300 [ 234.280645][ T8335] ? nvme_tcp_create_ctrl+0x57/0xba0 [ 234.285914][ T8335] __kmem_cache_alloc_node+0x4f/0x270 [ 234.291359][ T8335] ? nvme_tcp_create_ctrl+0x57/0xba0 [ 234.296624][ T8335] kmalloc_trace+0x26/0xe0 [ 234.301029][ T8335] nvme_tcp_create_ctrl+0x57/0xba0 [ 234.306125][ T8335] ? nvmf_check_allowed_opts+0x186/0x1c0 [ 234.311741][ T8335] nvmf_dev_write+0x20a0/0x2810 [ 234.316607][ T8335] ? nvmf_host_put+0x190/0x190 [ 234.321381][ T8335] ? end_current_label_crit_section+0x14b/0x170 [ 234.327615][ T8335] ? fsnotify_perm+0x5a/0x550 [ 234.332277][ T8335] ? security_file_permission+0x75/0xa0 [ 234.337807][ T8335] ? nvmf_host_put+0x190/0x190 [ 234.342574][ T8335] vfs_write+0x2dc/0x9a0 [ 234.346818][ T8335] ? file_end_write+0x250/0x250 [ 234.351648][ T8335] ? __fget_files+0x28/0x460 [ 234.356229][ T8335] ? __fget_files+0x3fc/0x460 [ 234.360898][ T8335] ? __fdget_pos+0x1d4/0x360 [ 234.365474][ T8335] ? ksys_write+0x70/0x260 [ 234.369875][ T8335] ksys_write+0x14d/0x260 [ 234.374199][ T8335] ? __ia32_sys_read+0x80/0x80 [ 234.378964][ T8335] ? lockdep_hardirqs_on+0x94/0x140 [ 234.384166][ T8335] do_syscall_64+0x4c/0xa0 [ 234.388579][ T8335] ? clear_bhb_loop+0x60/0xb0 [ 234.393257][ T8335] ? clear_bhb_loop+0x60/0xb0 [ 234.397919][ T8335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 234.403801][ T8335] RIP: 0033:0x7f58ecda94d9 [ 234.408214][ T8335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 234.427803][ T8335] RSP: 002b:00007f58edcd9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 234.436218][ T8335] RAX: ffffffffffffffda RBX: 00007f58ed025fa0 RCX: 00007f58ecda94d9 [ 234.444175][ T8335] RDX: 0000000000000031 RSI: 0000200000000180 RDI: 0000000000000004 [ 234.452138][ T8335] RBP: 00007f58ece3804e R08: 0000000000000000 R09: 0000000000000000 [ 234.460111][ T8335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 234.468068][ T8335] R13: 00007f58ed026038 R14: 00007f58ed025fa0 R15: 00007ffe4d428598 [ 234.476032][ T8335] [ 234.479178][ C0] vkms_vblank_simulate: vblank timer overrun [ 234.499088][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.556858][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.597523][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 234.632586][ T128] usb 6-1: USB disconnect, device number 12 [ 234.645672][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.666313][ T128] mos7840 6-1:1.0: device disconnected [ 234.692834][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.729228][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 234.762306][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.788964][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.818635][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 234.860980][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 234.900000][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 234.909229][ T1186] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 234.947839][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 234.973513][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 235.030143][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.070035][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 235.090005][ T1186] usb 8-1: device descriptor read/64, error -71 [ 235.105244][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 235.152544][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.192703][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 235.237760][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 235.278551][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.321273][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 235.359620][ T1186] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 235.368158][ T4363] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 235.408311][ T4363] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 235.448892][ T4363] usb 2-1: config 0 interface 0 has no altsetting 0 [ 235.481771][ T4363] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 235.531532][ T4363] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 235.541626][ T1186] usb 8-1: device descriptor read/64, error -71 [ 235.580517][ T4363] usb 2-1: Product: syz [ 235.590610][ T4363] usb 2-1: Manufacturer: syz [ 235.615530][ T4363] usb 2-1: SerialNumber: syz [ 235.653345][ T4363] usb 2-1: config 0 descriptor?? [ 235.659114][ T1186] usb usb8-port1: attempt power cycle [ 235.711298][ T4363] yurex 2-1:0.0: Could not find endpoints [ 235.944942][ T4363] usb 2-1: USB disconnect, device number 18 [ 236.100520][ T1186] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 236.163856][ T1186] usb 8-1: device descriptor read/8, error -71 [ 236.450211][ T1186] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 236.493622][ T4363] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 236.541029][ T1186] usb 8-1: device descriptor read/8, error -71 [ 236.569077][ T4285] Bluetooth: hci5: command 0x0406 tx timeout [ 236.702949][ T4363] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 236.714164][ T1186] usb usb8-port1: unable to enumerate USB device [ 236.768935][ T4363] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 236.833219][ T4363] usb 7-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 236.875590][ T4363] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 236.917326][ T4363] usb 7-1: Product: syz [ 236.944670][ T4363] usb 7-1: Manufacturer: syz [ 236.983044][ T4363] mos7840 7-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 237.378375][ T4363] mos7840: probe of ttyUSB0 failed with error -32 [ 237.732231][ T27] audit: type=1800 audit(1794524244.343:159): pid=8422 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.1046" name="idVendor" dev="configfs" ino=50459 res=0 errno=0 [ 237.752659][ C0] vkms_vblank_simulate: vblank timer overrun [ 237.924582][ T8424] FAULT_INJECTION: forcing a failure. [ 237.924582][ T8424] name failslab, interval 1, probability 0, space 0, times 0 [ 237.987773][ T8424] CPU: 0 PID: 8424 Comm: syz.0.1048 Not tainted syzkaller #0 [ 237.995170][ T8424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 238.005210][ T8424] Call Trace: [ 238.008494][ T8424] [ 238.011427][ T8424] dump_stack_lvl+0x188/0x24e [ 238.016098][ T8424] ? show_regs_print_info+0x12/0x12 [ 238.021285][ T8424] ? load_image+0x410/0x410 [ 238.025772][ T8424] ? __might_sleep+0xd0/0xd0 [ 238.030342][ T8424] ? __lock_acquire+0x7ea0/0x7ea0 [ 238.035379][ T8424] should_fail_ex+0x390/0x4c0 [ 238.040046][ T8424] should_failslab+0x5/0x20 [ 238.044561][ T8424] slab_pre_alloc_hook+0x59/0x300 [ 238.049572][ T8424] ? nvme_tcp_create_ctrl+0x72f/0xba0 [ 238.054931][ T8424] __kmem_cache_alloc_node+0x4f/0x270 [ 238.060290][ T8424] ? nvme_tcp_create_ctrl+0x72f/0xba0 [ 238.065644][ T8424] __kmalloc+0xa3/0x240 [ 238.069787][ T8424] nvme_tcp_create_ctrl+0x72f/0xba0 [ 238.074971][ T8424] nvmf_dev_write+0x20a0/0x2810 [ 238.079831][ T8424] ? nvmf_host_put+0x190/0x190 [ 238.084589][ T8424] ? end_current_label_crit_section+0x14b/0x170 [ 238.091078][ T8424] ? fsnotify_perm+0x5a/0x550 [ 238.095752][ T8424] ? security_file_permission+0x75/0xa0 [ 238.101318][ T8424] ? nvmf_host_put+0x190/0x190 [ 238.106161][ T8424] vfs_write+0x2dc/0x9a0 [ 238.110398][ T8424] ? file_end_write+0x250/0x250 [ 238.115235][ T8424] ? __fget_files+0x28/0x460 [ 238.119815][ T8424] ? __fget_files+0x3fc/0x460 [ 238.124842][ T8424] ? __fdget_pos+0x1d4/0x360 [ 238.129418][ T8424] ? ksys_write+0x70/0x260 [ 238.133815][ T8424] ksys_write+0x14d/0x260 [ 238.138127][ T8424] ? __ia32_sys_read+0x80/0x80 [ 238.142873][ T8424] ? lockdep_hardirqs_on+0x94/0x140 [ 238.148057][ T8424] do_syscall_64+0x4c/0xa0 [ 238.152458][ T8424] ? clear_bhb_loop+0x60/0xb0 [ 238.157120][ T8424] ? clear_bhb_loop+0x60/0xb0 [ 238.161782][ T8424] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 238.167667][ T8424] RIP: 0033:0x7f58ecda94d9 [ 238.172067][ T8424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.191744][ T8424] RSP: 002b:00007f58edcd9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 238.200152][ T8424] RAX: ffffffffffffffda RBX: 00007f58ed025fa0 RCX: 00007f58ecda94d9 [ 238.208128][ T8424] RDX: 0000000000000031 RSI: 0000200000000180 RDI: 0000000000000004 [ 238.216084][ T8424] RBP: 00007f58ece3804e R08: 0000000000000000 R09: 0000000000000000 [ 238.224039][ T8424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 238.231990][ T8424] R13: 00007f58ed026038 R14: 00007f58ed025fa0 R15: 00007ffe4d428598 [ 238.239960][ T8424] [ 238.243070][ C0] vkms_vblank_simulate: vblank timer overrun [ 238.320626][ T14] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 238.530905][ T14] usb 1-1: Dual-Role OTG device on HNP port [ 238.544674][ T14] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.01 [ 238.574222][ T14] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.650694][ T4363] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 238.662455][ T14] cdc_ncm 1-1:1.0: MAC-Address: d6:2d:e8:45:7e:2b [ 238.697610][ T14] cdc_ncm 1-1:1.0 usb1: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), d6:2d:e8:45:7e:2b [ 238.778984][ T6129] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 238.860563][ T4363] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 238.894845][ T4363] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 238.933331][ T4363] usb 8-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 238.978954][ T4363] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 238.992379][ T6129] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 239.015394][ T4363] usb 8-1: Product: syz [ 239.023286][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.042579][ T4363] usb 8-1: Manufacturer: syz [ 239.075302][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 239.087063][ T4363] mos7840 8-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 239.114246][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.157695][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.180229][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.207302][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 239.238046][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.314016][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.353185][ T14] usb 7-1: USB disconnect, device number 9 [ 239.365111][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.390372][ T14] mos7840 7-1:1.0: device disconnected [ 239.437530][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 239.478163][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.511669][ T8257] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 239.539923][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.577680][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.644575][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 239.678984][ T8257] usb 2-1: device descriptor read/64, error -71 [ 239.695561][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.762457][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.773660][ T27] audit: type=1800 audit(1794524246.383:160): pid=8481 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1059" name="idVendor" dev="configfs" ino=50643 res=0 errno=0 [ 239.824508][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.875367][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 239.915774][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.959323][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 239.986811][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 239.999003][ T8257] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 240.053568][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 240.093183][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 240.161270][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 240.178964][ T8257] usb 2-1: device descriptor read/64, error -71 [ 240.203925][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.270858][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 240.311123][ T8257] usb usb2-port1: attempt power cycle [ 240.326822][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 240.390870][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 240.403580][ T27] audit: type=1800 audit(1794524247.013:161): pid=8501 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1064" name="bus" dev="sda1" ino=2048 res=0 errno=0 [ 240.450952][ T6129] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 240.497982][ T6129] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 240.528242][ T6129] usb 6-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 240.548182][ T4363] mos7840: probe of ttyUSB1 failed with error -71 [ 240.575727][ T4363] usb 8-1: USB disconnect, device number 17 [ 240.591803][ T6129] usb 6-1: config 0 interface 0 has no altsetting 0 [ 240.607807][ T4363] mos7840 8-1:1.0: device disconnected [ 240.622169][ T6129] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 240.655546][ T6129] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 240.676184][ T6129] usb 6-1: Product: syz [ 240.688969][ T6129] usb 6-1: Manufacturer: syz [ 240.698051][ T6129] usb 6-1: SerialNumber: syz [ 240.723148][ T6129] usb 6-1: config 0 descriptor?? [ 240.749065][ T8257] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 240.765555][ T6129] yurex 6-1:0.0: Could not find endpoints [ 240.812148][ T8257] usb 2-1: device descriptor read/8, error -71 [ 240.989206][ T6129] usb 6-1: USB disconnect, device number 13 [ 241.101129][ T8257] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 241.161479][ T8257] usb 2-1: device descriptor read/8, error -71 [ 241.301270][ T8257] usb usb2-port1: unable to enumerate USB device [ 241.449769][ T4363] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 241.650221][ T4363] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 241.702389][ T4363] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 241.774365][ T4363] usb 8-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 241.834196][ T4363] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 241.881338][ T4363] usb 8-1: Product: syz [ 241.900233][ T4363] usb 8-1: Manufacturer: syz [ 241.952148][ T4363] mos7840 8-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 241.994667][ T27] audit: type=1800 audit(1794524248.603:162): pid=8558 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1071" name="idVendor" dev="configfs" ino=50884 res=0 errno=0 [ 242.354309][ T4363] mos7840: probe of ttyUSB0 failed with error -32 [ 242.476540][ T27] audit: type=1800 audit(1794524249.083:163): pid=8574 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1075" name="bus" dev="sda1" ino=2048 res=0 errno=0 [ 242.685040][ T8581] loop0: detected capacity change from 0 to 3904 [ 242.770683][ T8584] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 242.852282][ T8584] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 242.890053][ T8584] loop0: [ 243.004180][ T8593] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.063650][ T8593] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.505156][ T4315] IPv6: ADDRCONF(NETDEV_CHANGE): usb1: link becomes ready [ 244.312329][ T4363] usb 8-1: USB disconnect, device number 18 [ 244.333056][ T8622] nvme nvme0: failed to connect socket: -111 [ 244.377399][ T4363] mos7840 8-1:1.0: device disconnected [ 244.939250][ T27] audit: type=1800 audit(1794524251.553:164): pid=8638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1088" name="bus" dev="sda1" ino=2048 res=0 errno=0 [ 245.530790][ T4363] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 245.731896][ T4363] usb 2-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 245.749002][ T8257] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 245.785300][ T4363] usb 2-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 245.828995][ T4363] usb 2-1: Product: syz [ 245.873481][ T4363] usb 2-1: Manufacturer: syz [ 245.910639][ T4363] usb 2-1: SerialNumber: syz [ 245.952490][ T8257] usb 7-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 245.965322][ T4363] usb 2-1: config 0 descriptor?? [ 245.992999][ T8257] usb 7-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 246.010519][ T4363] ch341 2-1:0.0: ch341-uart converter detected [ 246.051301][ T8257] usb 7-1: Product: syz [ 246.055520][ T8257] usb 7-1: Manufacturer: syz [ 246.093372][ T8257] usb 7-1: SerialNumber: syz [ 246.122015][ T8257] usb 7-1: config 0 descriptor?? [ 246.155756][ T8257] ch341 7-1:0.0: ch341-uart converter detected [ 246.678010][ T27] audit: type=1800 audit(1794524253.283:165): pid=8685 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1102" name="bus" dev="sda1" ino=2048 res=0 errno=0 [ 246.811566][ T8693] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1103'. [ 246.962511][ T4285] Bluetooth: hci1: link tx timeout [ 246.967965][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 246.984394][ T4285] Bluetooth: hci1: link tx timeout [ 246.989950][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 246.999357][ T4285] Bluetooth: hci1: link tx timeout [ 247.004551][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.012773][ T4285] Bluetooth: hci1: link tx timeout [ 247.017954][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.026453][ T4363] ch341-uart ttyUSB0: break control not supported, using simulated break [ 247.035271][ T4285] Bluetooth: hci1: link tx timeout [ 247.040495][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.056835][ T4285] Bluetooth: hci1: link tx timeout [ 247.062057][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.072394][ T4285] Bluetooth: hci1: link tx timeout [ 247.077533][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.086201][ T4285] Bluetooth: hci1: link tx timeout [ 247.091390][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.131059][ T4285] Bluetooth: hci1: link tx timeout [ 247.136255][ T4285] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 247.154629][ T8257] ch341-uart ttyUSB1: break control not supported, using simulated break [ 247.167807][ T4363] usb 2-1: ch341-uart converter now attached to ttyUSB0 [ 247.228153][ T8257] usb 7-1: ch341-uart converter now attached to ttyUSB1 [ 247.989280][ T8257] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 248.261057][ T8257] usb 6-1: Using ep0 maxpacket: 32 [ 248.276899][ T8257] usb 6-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 248.331660][ T8257] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.375984][ T8257] usb 6-1: config 0 descriptor?? [ 248.406439][ T8257] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 248.573541][ T1186] usb 2-1: USB disconnect, device number 23 [ 248.601728][ T8257] gspca_vc032x: reg_r err -32 [ 248.618464][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.639763][ T1186] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 248.666724][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.705628][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.717227][ T1186] ch341 2-1:0.0: device disconnected [ 248.743392][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.777771][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.818504][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.855986][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.880225][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.902498][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.922332][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.942723][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.963784][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 248.984550][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.007836][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.031751][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.052052][ T4290] Bluetooth: hci1: command 0x0406 tx timeout [ 249.060303][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.078392][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.098341][ T8257] gspca_vc032x: I2c Bus Busy Wait 00 [ 249.124160][ T8257] gspca_vc032x: Unknown sensor... [ 249.146971][ T8257] vc032x: probe of 6-1:0.0 failed with error -22 [ 249.184219][ T8257] usb 7-1: USB disconnect, device number 10 [ 249.215862][ T8257] ch341-uart ttyUSB1: ch341-uart converter now disconnected from ttyUSB1 [ 249.257172][ T8257] ch341 7-1:0.0: device disconnected [ 249.536845][ T8757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1116'. [ 249.666465][ T4290] Bluetooth: hci1: link tx timeout [ 249.671976][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.695889][ T4290] Bluetooth: hci1: link tx timeout [ 249.701327][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.711655][ T4290] Bluetooth: hci1: link tx timeout [ 249.716809][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.726127][ T4290] Bluetooth: hci1: link tx timeout [ 249.731434][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.740673][ T4290] Bluetooth: hci1: link tx timeout [ 249.746379][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.757495][ T4290] Bluetooth: hci1: link tx timeout [ 249.762685][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.776057][ T4290] Bluetooth: hci1: link tx timeout [ 249.781236][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.791308][ T4290] Bluetooth: hci1: link tx timeout [ 249.796459][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.809214][ T4290] Bluetooth: hci1: link tx timeout [ 249.814358][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 249.823581][ T4290] Bluetooth: hci1: link tx timeout [ 249.828727][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 250.837708][ T1186] usb 6-1: USB disconnect, device number 14 [ 250.847899][ T8786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.914848][ T8786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.939542][ T8257] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 251.151983][ T8257] usb 2-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 251.174353][ T8257] usb 2-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 251.202007][ T4357] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 251.213054][ T8257] usb 2-1: Product: syz [ 251.227913][ T8257] usb 2-1: Manufacturer: syz [ 251.242099][ T8257] usb 2-1: SerialNumber: syz [ 251.262439][ T8257] usb 2-1: config 0 descriptor?? [ 251.276951][ T8257] ch341 2-1:0.0: ch341-uart converter detected [ 251.402315][ T4357] usb 7-1: too many configurations: 9, using maximum allowed: 8 [ 251.417709][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 251.428907][ T1186] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 251.455185][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 251.484988][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 251.526335][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 251.564589][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 251.608257][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 251.620333][ T1186] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.656649][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 251.675591][ T1186] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 251.708001][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 251.723499][ T1186] usb 6-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 251.754440][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 251.764547][ T1186] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 251.794458][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 251.807841][ T1186] usb 6-1: Product: syz [ 251.818769][ T1186] usb 6-1: Manufacturer: syz [ 251.830119][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 251.884917][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 251.920873][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 251.970412][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 252.012682][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 252.048604][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 252.091457][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 252.132949][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 252.172996][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 252.236185][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 252.297455][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 252.307160][ T8257] ch341-uart ttyUSB0: break control not supported, using simulated break [ 252.346206][ T8257] usb 2-1: ch341-uart converter now attached to ttyUSB0 [ 252.356951][ T4357] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 252.414422][ T4357] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 252.486891][ T4357] usb 7-1: config 0 interface 0 has no altsetting 0 [ 252.537234][ T4357] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 252.594649][ T4357] usb 7-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 252.645168][ T4357] usb 7-1: Product: syz [ 252.675971][ T4357] usb 7-1: Manufacturer: syz [ 252.693737][ T4357] usb 7-1: SerialNumber: syz [ 252.722393][ T4357] usb 7-1: config 0 descriptor?? [ 252.755075][ T4357] yurex 7-1:0.0: Could not find endpoints [ 252.976448][ T8839] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1131'. [ 253.027237][ T4357] usb 7-1: USB disconnect, device number 11 [ 253.104823][ T4290] Bluetooth: hci1: link tx timeout [ 253.110256][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.123458][ T4290] Bluetooth: hci1: link tx timeout [ 253.128658][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.139481][ T4290] Bluetooth: hci1: link tx timeout [ 253.144657][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.152934][ T4290] Bluetooth: hci1: link tx timeout [ 253.158086][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.166385][ T4290] Bluetooth: hci1: link tx timeout [ 253.171569][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.181808][ T4290] Bluetooth: hci1: link tx timeout [ 253.186976][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.195259][ T4290] Bluetooth: hci1: link tx timeout [ 253.200516][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.211985][ T4290] Bluetooth: hci1: link tx timeout [ 253.217153][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.228812][ T4290] Bluetooth: hci1: link tx timeout [ 253.234145][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.243843][ T4290] Bluetooth: hci1: link tx timeout [ 253.249025][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 253.716798][ T4290] Bluetooth: hci0: unexpected event for opcode 0x2031 [ 253.777764][ T4357] usb 2-1: USB disconnect, device number 24 [ 253.816337][ T4357] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 253.877081][ T4357] ch341 2-1:0.0: device disconnected [ 254.145651][ T4357] usb 6-1: USB disconnect, device number 15 [ 255.298825][ T8903] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1144'. [ 255.470108][ T4290] Bluetooth: hci1: link tx timeout [ 255.475293][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.497876][ T4290] Bluetooth: hci1: link tx timeout [ 255.503555][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.514785][ T4290] Bluetooth: hci1: link tx timeout [ 255.520049][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.528366][ T4290] Bluetooth: hci1: link tx timeout [ 255.536704][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.544940][ T1274] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.551648][ T1274] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.562433][ T4290] Bluetooth: hci1: link tx timeout [ 255.567748][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.576427][ T4290] Bluetooth: hci1: link tx timeout [ 255.582102][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.590325][ T4290] Bluetooth: hci1: link tx timeout [ 255.595450][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.609073][ T4290] Bluetooth: hci1: link tx timeout [ 255.614267][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.629280][ T4290] Bluetooth: hci1: link tx timeout [ 255.634451][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.642852][ T4290] Bluetooth: hci1: link tx timeout [ 255.648046][ T4290] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 255.753624][ T8912] netlink: 'syz.7.1150': attribute type 10 has an invalid length. [ 255.828542][ T8912] netlink: 55 bytes leftover after parsing attributes in process `syz.7.1150'. [ 255.854470][ T8917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 255.912857][ T8917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.718968][ T4363] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 256.932953][ T4363] usb 2-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 256.966334][ T4363] usb 2-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 257.011509][ T4363] usb 2-1: Product: syz [ 257.036301][ T4363] usb 2-1: Manufacturer: syz [ 257.056480][ T4363] usb 2-1: SerialNumber: syz [ 257.087182][ T4363] usb 2-1: config 0 descriptor?? [ 257.151056][ T4363] ch341 2-1:0.0: ch341-uart converter detected [ 257.378970][ T4357] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 257.618962][ T4357] usb 6-1: Using ep0 maxpacket: 8 [ 257.638736][ T4357] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 257.701299][ T4357] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 257.750673][ T4357] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 257.806309][ T4357] usb 6-1: config 16 has no interface number 0 [ 257.848153][ T4357] usb 6-1: config 16 interface 128 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 257.916234][ T4357] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 257.949155][ T4357] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 258.009627][ T4357] usbtmc 6-1:16.128: bulk endpoints not found [ 258.130941][ T4363] ch341-uart ttyUSB0: break control not supported, using simulated break [ 258.191623][ T4363] usb 2-1: ch341-uart converter now attached to ttyUSB0 [ 258.310949][ T8987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.386269][ T8987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.551813][ T4290] Bluetooth: min 0 < 6 [ 259.594608][ T4357] usb 2-1: USB disconnect, device number 25 [ 259.643093][ T4357] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 259.715151][ T4357] ch341 2-1:0.0: device disconnected [ 260.225484][ T4357] usb 6-1: USB disconnect, device number 16 [ 260.569139][ T4290] Bluetooth: hci2: command 0x2021 tx timeout [ 260.903254][ T4357] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 261.108997][ T4357] usb 2-1: Using ep0 maxpacket: 32 [ 261.126371][ T4357] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.168648][ T4357] usb 2-1: config 0 has no interfaces? [ 261.202830][ T4357] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 261.252733][ T4357] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.310484][ T4357] usb 2-1: config 0 descriptor?? [ 261.374994][ T9078] loop0: detected capacity change from 0 to 3904 [ 261.453112][ T9078] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 261.508223][ T9078] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 261.546813][ T4363] usb 2-1: USB disconnect, device number 26 [ 261.584230][ T9078] loop0: [ 262.100764][ T4363] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 262.321011][ T4363] usb 6-1: Using ep0 maxpacket: 8 [ 262.351472][ T4363] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 262.418113][ T4363] usb 6-1: config 16 has an invalid interface number: 128 but max is 0 [ 262.487572][ T4363] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 262.547409][ T4363] usb 6-1: config 16 has no interface number 0 [ 262.571946][ T4363] usb 6-1: config 16 interface 128 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 262.610485][ T4363] usb 6-1: config 16 interface 128 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 262.636597][ T4363] usb 6-1: config 16 interface 128 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 262.677930][ T4363] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 262.700022][ T4363] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.729347][ T4285] Bluetooth: hci0: command 0x2021 tx timeout [ 262.762637][ T4363] usbtmc 6-1:16.128: bulk endpoints not found [ 263.096813][ T9127] comedi comedi1: comedi_config --init_data is deprecated [ 263.130396][ T9134] jffs2: notice: (9134) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 263.340857][ T9144] ------------[ cut here ]------------ [ 263.346375][ T9144] WARNING: CPU: 0 PID: 9144 at include/linux/fs.h:509 hugetlb_split+0x234/0x2a0 [ 263.355771][ T9144] Modules linked in: [ 263.359693][ T9144] CPU: 0 PID: 9144 Comm: syz.7.1205 Not tainted syzkaller #0 [ 263.367051][ T9144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 263.377119][ T9144] RIP: 0010:hugetlb_split+0x234/0x2a0 [ 263.382502][ T9144] Code: b4 ff 4c 89 f7 48 89 de 4c 89 fa 31 c9 5b 41 5c 41 5d 41 5e 41 5f 5d eb 7d e8 d8 46 b4 ff 0f 0b e9 65 fe ff ff e8 cc 46 b4 ff <0f> 0b e9 2d ff ff ff 48 c7 c1 34 76 22 8f 80 e1 07 80 c1 03 38 c1 [ 263.402131][ T9144] RSP: 0018:ffffc90004a377e8 EFLAGS: 00010287 [ 263.408203][ T9144] RAX: ffffffff81ce21d4 RBX: 0000200000400000 RCX: 0000000000080000 [ 263.416197][ T9144] RDX: ffffc9000f80d000 RSI: 0000000000000c17 RDI: 0000000000000c18 [ 263.424187][ T9144] RBP: 0000000000000000 R08: ffff888031ca2def R09: 1ffff110063945bd [ 263.432166][ T9144] R10: dffffc0000000000 R11: ffffed10063945be R12: ffff888059292070 [ 263.440154][ T9144] R13: dffffc0000000000 R14: ffff888059292000 R15: ffff888048d11d38 [ 263.448130][ T9144] FS: 00007fe9531df6c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 263.457088][ T9144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 263.463675][ T9144] CR2: 000000110c37f497 CR3: 0000000071cb4000 CR4: 00000000003506f0 [ 263.471661][ T9144] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 263.479637][ T9144] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 263.487595][ T9144] Call Trace: [ 263.490879][ T9144] [ 263.493817][ T9144] __vma_adjust+0x553/0x1d00 [ 263.498402][ T9144] ? lockdep_softirqs_off+0x430/0x430 [ 263.503790][ T9144] ? validate_mm+0x2e0/0x2e0 [ 263.508374][ T9144] ? __init_rwsem+0x11e/0x160 [ 263.513093][ T9144] ? hugetlb_vm_op_open+0x332/0x540 [ 263.518288][ T9144] __split_vma+0x3a2/0x4f0 [ 263.522728][ T9144] userfaultfd_ioctl+0x36d0/0x3f90 [ 263.527853][ T9144] ? userfaultfd_poll+0x1c0/0x1c0 [ 263.532911][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.538539][ T9144] ? __lock_acquire+0x7ea0/0x7ea0 [ 263.543581][ T9144] ? slab_free_freelist_hook+0x133/0x1b0 [ 263.549224][ T9144] ? tomoyo_path_number_perm+0x4fb/0x650 [ 263.554845][ T9144] ? __kmem_cache_free+0xb6/0x200 [ 263.559885][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.565503][ T9144] ? tomoyo_path_number_perm+0x5a4/0x650 [ 263.571145][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.576771][ T9144] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 263.582267][ T9144] ? bpf_lsm_file_ioctl+0x5/0x10 [ 263.587190][ T9144] ? security_file_ioctl+0x7c/0xa0 [ 263.592310][ T9144] ? userfaultfd_poll+0x1c0/0x1c0 [ 263.597334][ T9144] __se_sys_ioctl+0xfa/0x170 [ 263.601931][ T9144] do_syscall_64+0x4c/0xa0 [ 263.606336][ T9144] ? clear_bhb_loop+0x60/0xb0 [ 263.611051][ T9144] ? clear_bhb_loop+0x60/0xb0 [ 263.615719][ T9144] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 263.621655][ T9144] RIP: 0033:0x7fe9523a94d9 [ 263.626066][ T9144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 263.645708][ T9144] RSP: 002b:00007fe9531df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 263.654158][ T9144] RAX: ffffffffffffffda RBX: 00007fe952625fa0 RCX: 00007fe9523a94d9 [ 263.662153][ T9144] RDX: 0000200000000040 RSI: 00000000c020aa00 RDI: 0000000000000003 [ 263.670167][ T9144] RBP: 00007fe95243804e R08: 0000000000000000 R09: 0000000000000000 [ 263.678125][ T9144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 263.686116][ T9144] R13: 00007fe952626038 R14: 00007fe952625fa0 R15: 00007ffc19d40b88 [ 263.694109][ T9144] [ 263.697126][ T9144] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 263.704386][ T9144] CPU: 0 PID: 9144 Comm: syz.7.1205 Not tainted syzkaller #0 [ 263.711752][ T9144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 263.721790][ T9144] Call Trace: [ 263.725055][ T9144] [ 263.727970][ T9144] dump_stack_lvl+0x188/0x24e [ 263.732635][ T9144] ? memcpy+0x3c/0x60 [ 263.736596][ T9144] ? show_regs_print_info+0x12/0x12 [ 263.741778][ T9144] ? load_image+0x410/0x410 [ 263.746269][ T9144] panic+0x2d3/0x710 [ 263.750146][ T9144] ? bpf_jit_dump+0xd0/0xd0 [ 263.754632][ T9144] __warn+0x2f8/0x4f0 [ 263.758594][ T9144] ? hugetlb_split+0x234/0x2a0 [ 263.763339][ T9144] ? hugetlb_split+0x234/0x2a0 [ 263.768095][ T9144] report_bug+0x2ba/0x4f0 [ 263.772420][ T9144] ? hugetlb_split+0x234/0x2a0 [ 263.777164][ T9144] handle_bug+0x3a/0x70 [ 263.781308][ T9144] exc_invalid_op+0x16/0x40 [ 263.785789][ T9144] asm_exc_invalid_op+0x16/0x20 [ 263.790618][ T9144] RIP: 0010:hugetlb_split+0x234/0x2a0 [ 263.795969][ T9144] Code: b4 ff 4c 89 f7 48 89 de 4c 89 fa 31 c9 5b 41 5c 41 5d 41 5e 41 5f 5d eb 7d e8 d8 46 b4 ff 0f 0b e9 65 fe ff ff e8 cc 46 b4 ff <0f> 0b e9 2d ff ff ff 48 c7 c1 34 76 22 8f 80 e1 07 80 c1 03 38 c1 [ 263.815569][ T9144] RSP: 0018:ffffc90004a377e8 EFLAGS: 00010287 [ 263.821640][ T9144] RAX: ffffffff81ce21d4 RBX: 0000200000400000 RCX: 0000000000080000 [ 263.829604][ T9144] RDX: ffffc9000f80d000 RSI: 0000000000000c17 RDI: 0000000000000c18 [ 263.837564][ T9144] RBP: 0000000000000000 R08: ffff888031ca2def R09: 1ffff110063945bd [ 263.845519][ T9144] R10: dffffc0000000000 R11: ffffed10063945be R12: ffff888059292070 [ 263.853562][ T9144] R13: dffffc0000000000 R14: ffff888059292000 R15: ffff888048d11d38 [ 263.861531][ T9144] ? hugetlb_split+0x234/0x2a0 [ 263.866286][ T9144] ? hugetlb_split+0x234/0x2a0 [ 263.871034][ T9144] __vma_adjust+0x553/0x1d00 [ 263.875612][ T9144] ? lockdep_softirqs_off+0x430/0x430 [ 263.880981][ T9144] ? validate_mm+0x2e0/0x2e0 [ 263.885566][ T9144] ? __init_rwsem+0x11e/0x160 [ 263.890224][ T9144] ? hugetlb_vm_op_open+0x332/0x540 [ 263.895409][ T9144] __split_vma+0x3a2/0x4f0 [ 263.899814][ T9144] userfaultfd_ioctl+0x36d0/0x3f90 [ 263.904921][ T9144] ? userfaultfd_poll+0x1c0/0x1c0 [ 263.909928][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.915552][ T9144] ? __lock_acquire+0x7ea0/0x7ea0 [ 263.920559][ T9144] ? slab_free_freelist_hook+0x133/0x1b0 [ 263.926175][ T9144] ? tomoyo_path_number_perm+0x4fb/0x650 [ 263.931792][ T9144] ? __kmem_cache_free+0xb6/0x200 [ 263.936804][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.942422][ T9144] ? tomoyo_path_number_perm+0x5a4/0x650 [ 263.948040][ T9144] ? tomoyo_path_number_perm+0x205/0x650 [ 263.953653][ T9144] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 263.959114][ T9144] ? bpf_lsm_file_ioctl+0x5/0x10 [ 263.964039][ T9144] ? security_file_ioctl+0x7c/0xa0 [ 263.969135][ T9144] ? userfaultfd_poll+0x1c0/0x1c0 [ 263.974138][ T9144] __se_sys_ioctl+0xfa/0x170 [ 263.978715][ T9144] do_syscall_64+0x4c/0xa0 [ 263.983113][ T9144] ? clear_bhb_loop+0x60/0xb0 [ 263.987873][ T9144] ? clear_bhb_loop+0x60/0xb0 [ 263.992533][ T9144] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 263.998404][ T9144] RIP: 0033:0x7fe9523a94d9 [ 264.002811][ T9144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.022398][ T9144] RSP: 002b:00007fe9531df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 264.030800][ T9144] RAX: ffffffffffffffda RBX: 00007fe952625fa0 RCX: 00007fe9523a94d9 [ 264.038752][ T9144] RDX: 0000200000000040 RSI: 00000000c020aa00 RDI: 0000000000000003 [ 264.046702][ T9144] RBP: 00007fe95243804e R08: 0000000000000000 R09: 0000000000000000 [ 264.054648][ T9144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 264.062594][ T9144] R13: 00007fe952626038 R14: 00007fe952625fa0 R15: 00007ffc19d40b88 [ 264.070552][ T9144] [ 264.073625][ T9144] Kernel Offset: disabled [ 264.078164][ T9144] Rebooting in 86400 seconds..