last executing test programs: 49.691602364s ago: executing program 1 (id=557): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20000040) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x86}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x7a248000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x2a, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000001c0)=0x2) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) r5 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x1, @sliced={0x4, [0xa8, 0x0, 0x3, 0x9, 0x6e45, 0x4, 0x4, 0x3, 0xf800, 0x8000, 0xfe01, 0x3ff, 0x817e, 0x4, 0x68d, 0xd1d, 0x9, 0x1ff, 0x8, 0x9, 0x0, 0x2454, 0x2d64, 0x81, 0x3, 0xfff7, 0x8ba7, 0x6, 0x5, 0x4, 0xed3d, 0xa, 0x5, 0x0, 0xff, 0x7ff, 0x9, 0xf, 0x7, 0x5, 0x21b, 0x2dc2, 0x0, 0x0, 0xa6, 0xb4, 0x1ff], 0xc}}) ioctl$VIDIOC_S_SELECTION(r5, 0xc040565f, &(0x7f0000000080)={0x1, 0x100, 0x0, {0x4, 0x300, 0x0, 0x800002fc}}) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000003c0)={0x1, @win={{0xd, 0x4, 0x8, 0x5}, 0x2, 0x1000000, 0x0, 0xc3, 0x0, 0x1}}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r6 = syz_clone(0x25000, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000001300)=ANY=[@ANYRESHEX=r0, @ANYRES64=r2, @ANYBLOB="a689995b9ebb0d5e55c9303b8e6597f0f218655fb287ae3e032ff9787dd1387a7c9ef1df090cfb4b610ec64f30e161c5398cbf1801218a58bef0956b9afb03942839cab5698bf381bd52b58321d3f6ec940ccf257352125f5e21bd1016e4fe96992c8d0d3b4037ecf1b730cb70fd9effeb3bd46aee01d930b759256fc356474d499b7440e2b082ba2ccd3fd0c870ad125c03df065b835808e5f79bfee0c793ea20a7a6522c978e50040fbfbec42d69324a2b113d38419b9de4998ba8ad182bbf931e842ec2305e9e0bc5a0124ae7d9e55c32959d0af5deaa5573d596c0a33edbfedbf49fd08d8b003da8859b7a95ee4888562599121c141a69e856ab868f5f977ffbb815e7f01a312d028ca13b5b6aa6ddf216bb78db739919495ef198c3f45ce0ca6305b9fa22fef61190cd7ce3e59a5937de108db6a323498bddc267022eeada73ae848bc9e191dc735b3f018218e8324e43a276f54d9e336c5f19da5b2fde3357bb76341f33fb12604eeefdf4863098b305b0a8dceec958e5e28f1cd379e55f3da83dfcd5323bffcfbae923602afd2eb94b2fcd9a2919f2fed47d03c3319f47afc40a0b1b56ce28e849ea3af6e7140726cf62378fab31db7c617a8f9072557cffd0ac54e6c861e519d2ebea0e6bdd22fe174c1fd080a42269cbb91f6ed6929189554f44a7d7d8c5d5205df8b5e2be2ddb9daf65e7d9d47fc727b91e85fa344e053e00ababa4e240393ba1b13ec76fdbd87b55a90dc97550c8660b7d161c25203ccae0ad0deab1402081615161de5f40b219b18e5d1cd6f714fa9f417b6e871b721619e6f97064e5d0d59cf7e8cd485901ff8a2afe5d14861c49a21fe045be72cba9e25d8353a26764a7ee7f714c21f799b66efde35d362b0cd9ccc0366e03cf8a920fbda32850d71e3412717e98b2711e55aa5f872ef12b953a54e526f45337f86eb5bbc11ce66ba782f650fab0c6ac16d5375c1d7ab4efe5f85fce388d804194340aa26e7b9ce90b48d1782d8f5e90516abfae2e1780bb0b889541315bb478973efafca28bac726139942acd803295718fb0d39cb0bccf60d400248b9f0266d42dca46f338dee43e86ebe787b7455f604377424749887bcce1e8b9dcfe5a8d60073d8608abd43bf0dab0f357fb7858b6dad4d68cb83f2415b642058f3ddc3a3452ea3f1a5e5a7f7db075342fc3f7dd410c2935fb13da4c3c7c5c2c56804d441216e77b452f8b1713be84fe898722b1898722bdd01c6decc6563fb173ce2ceb5a9e706820e15348bbd956afa6d1c73aad9b1fc561c771dbb4e19c159f6973261fa2e17340180b6587d43bd7fe0f27a27b9be4aa085f4f52cbc05c517fd9e41d688d0a568f198d153ed4f654556926334645dde69137d482cb9b64a4f113ee9c388e6694e169164f75f5abf66c2f896dc4c60c9425bb7dab46de3d585b6dc8e1597b9acb296ad8a5194a0ef70ba0a6293536655af225135b45b9167c5adc3445300d975e0aa92ea24eb7ccf724b92059a5ac270e06adcd3d06aafa1ec9e98d01ad061f7bad657d154572aff7e74e6ab7d8e4b7d218eedd22a636cefa2f6412fd1c41b7d4dade541388dd2d9bf3c65b25c068c0f444bb80537d1e3c9a1aaea85f7b6a352fa7825d8d6e28a7a18fd20fde050c2dcd84f7d967425b1bd11e2dec3a51c6821936c6ad42b150d985e3e8c27426aaccdfd1559f27af2af31c1cbd82f34b5ef868feabc7b4f9b940ce9da1d07dd4d68aedb4c64599ee0a952dc25838b1c65503800fe20ef2b6de0ce23da4840df1e2edeec3d394ab8acadbd2ebc06782db7982cdb10b27252d3d2f37082219dfb791d8b846de5abe9e781947858ce13b5d3fd9d3d58e0e1ea31631440cb96d85afefbbc5758a643a2ae3f9fd52d832b7989fa8c999b21f2f779bd4c79ffc7efe915edabb2c6a34dde946973a97e9b43ee5a22aab0af6d21ca8911e56b174c472409483ff1d625921f570970a994d54bb2dfdefc8a019f6712d2e11939693065e3a4f40c2e7e7a77244b02e36de6c0d4330f04b482cdf765617b78f4b95150b2e467afc7d2d1112e9be0e7c3005302dd58a0d26120f5c6cb2e633287da43e6e0b7b6e1bc9856b978e0a396ab39dca8c2b1c443eabcf070e007244ba3cfe8a93e64ce61b654780bec3d352f3ac4bb0caa4afd3562e06ce381c80c6a1d9e21262e21dc0248a2d015ef3e6898fae11ed40826cc1e868d1d3f3999394cd6eb1abbf28813a266a0aa910d9ba07bb2257fb55a61316849d2e8cdada30d6da662ddc46f67ea434cd85165d660eb4f3303468ded87a2b2a0426050f4e28f83da2db3d13ea754afc1dd01d5218d5be0e7833e5b9f47fd7f28ea84c04a8d8c167bbc4baa7fa67550bf5756e57fd1c274ddb7d2395b46559cbee2765fcece5f3a815854924e528e8c364370a011c8de6b1bfafa712286ffe4fd65b82259bc7ecaa70f66156ed3e4a026acd90afead122ce432b4c9de975b09dc34be2f906b7b1dafa85aca892374a12c3a2a86f505b8d16d86aebc4e4acceff522bf4c27014acd7d7940e24f04f7cb32783a6f6e74674e2bd966406ae4016292236f5b558ac26582d4fe26a1458f7af9c2e166ce2a329c28fc6ea5c867e84bb354d199cc7b8c6eaf9c7dc08478901044770c33864a40ba9c526945f22700072e6d9ad3c8ba33decfb524e47956a53e470e281c3aec6413fc22ebd7971294e1ed2abde3cf52e06031a31a06b69e33b9c68190c872f8bd2bfba94f6713f9a101fa4a8959dce98f0efedd7fb2226133f14f7585c42e5327c2e3fff3a8809875394cd5b0a26a9aeab3c6334731953bcf3fd6d39b5a31a0b5ff643bd4b1d84ea2d13a284c402dd19e3b664d632aad739b57385abf3553db7e5e8b96792efd98383933ea318fe8708ebd8abee76190a5fa84c2d633ede817e91dcdd07c2e4affe758ec384ef59dd1b6ef186fb0470811c5ce0af8ece83bf9117d9f5f7dc0d875897a27ea43c17de275e65c0195ad0a86c99ea03b60bdd701aab7336a99180b81ae02f0b16a9dfb82a46e48cd788777de2948ba0e738a0221533ecfde892d0b45652bbb644d61a574394b0f16eeee5faac50b9287cbcb8f7fdea295a1687477f7f67d8cbf4f3e7b7066538ec97dbedf0e4cedea5bb06fbac838c212355b5d49d523e433bfd68aa6ade701f0a7c1224fd54847064ebad22fb68bc246f49ed67982aaf82a5ba3e5d7cdc731abafd654585d9f6238810dbc21e0566bf33886be70f3004a39aeaa7df3b315ffa6d028b7718c246e7ca48a4348b6db9ab8852019e8908af7fa7af88d9a66d2801d33e5eaf23f900e05c5434da2b00e9b11dd399eee532ba1f2b9287d43b716c115fa1a06f45d26b5b4427138c736c3d36d0acdd3f7c776ceb16f8787bf11df2830745ce82d034ce07b3b10d91252d0d037bf1de36b8940cb7c1959d904d496d603bdf53a729ab05eee9ccb0b8be80052377dbca75637e67850642188470bde8e3f0361eced18083af488e2c588bc3b02a5e81f6fd5df056b5b753f8929fe9708774729d4b3ef036af25bcc01671ac1d334ec7f6834e4c72561c4328a250026bd75610b4564bd3c7179bb2416ee94e9c2dafb16fa4df95f89bcc1eaea95a0ff454962fab92fb4e45fcfcf72d8d12b8609efaa88a94ff6b561342d46e4ee237aa1ddffb6c545b7d051cb85d53a3e505646cbf1e5ce29a500ca364215611f30eb64e88507e70279ba540ca1fe8c58b21592579f1917af2c865a9fe5d259a945f45e82546c6e89f25c3994f55d7fafa83facf8bca2a7d8146c3928ca30beaac931f94ff80615f521474bc458f195c226422625818eddb00c04e849225e48fdf1ce6c63dd1ab73e1fd696b3b121f899e1c301f8d82b7d6e8b1b08ec6f16de582d1a73d02e7f874e0f17bf69ceff31ba7d3d56d70074251a291abecf3fbd61859055c0fa13dacf02f9e069bd3d8fb1f9f3b2bc5eddd5733d5b3ac920c8e99f9754f8788c58a9e5f88ae739d57d3195b2de63118a94c0449e43a9280f964a1986b82d76a1b0ccd88e983dbbaffeff66ab69f5b1966cd63047f0bffabd7f7bbcf7f58201e6a2464e1bb917495b33fe375175acdead7f3388da12b3f402b72fe23f6ea1cc7280469a93c38af2ff2a292b1084e0acd3b26e54ff14ea56b48d72e7d672284cd0ee9794d77812620e6c07d36ea96453d67986e46920c34a04ecc6354ce8e768104f88733ae6b1c93aba6b258fc1d53b6721b1028eb4de97f63b48d11a6909f38645b05870bb7b96340d482931390d5232ee01db008eca83d8c398041641433114dc4ae6cfca88095b9a4b494985f29d3ea6cb2106f97240cddec5c6cdd881f1cfc0bab28b45963f52138e625bc257ae60abb87fb50df642af04f65b9449d6ea58a4698433a1be9b73cba7b134489b5263111901bd45bdaf7fe2791476c2276b1291b23afd846239a5e1865a41e1b86cfcfd9c94476b42c41b362e93e850bae641a838634dce6283b38580010db5689166fb3986814934cf20461f075e8b26ce9c8a77a40ccf66b5dc89b7a1483cb8f44ec6bcc149e83248a413dd27044a1e5cd8ee50995e2384dffbf3691ef7627b4ef7395737afc13151bf0d14147b7410578fc3904af4daee638d43aae8794a0602b038fd986cdce4945064bbe2f273224d5a38f4070c47ca8edcca596a2a587778c2a3ba0af2d4a2c12ba9e3494b07e2567a496e0930ed802601ffd75fb880ea7ac9fb3e294da65e829e68f1e69f764637dcd023067ecccd5001ae46a0c8c1a0bdfadcd983ad4e508ddb312d2d519a0985764de01c0badaf6add0f947318398e8638f814ff96285d92f29f712daf4a5a44b596e3951f3e9528414cdbd1625b62358b11fcc6a6e6e6621a0daf06b92b3c1a4223c3b81ecef4e4ce1fbcca71444ccd3b62cacf94ccca24255836bfa6da3eaf968514c88a51219d8ca24b2e9cb128cbcc1c673aac121787871bd5988da92efddf3dc3fb0b3ab4307bd83824a95c10e419ee188f5fef2192f0f03b816aa196e6f147cdc5007f4ee30068481a9c56c6f8c6d12d6d37df91df7ba30fa64311c097c85b16e4e1a49ded8b96df630b104349882b5becbe1f7576614ac0e1b8c28470c08a43aed4b93c828fd692231facc87915eebb338549509613a9b26cf21c02b59a45c3995e2547bc18167a76b34427383c316ee7057dfe7d49a2c6624b9a2b5e46f3aaa0453c57afa68101dce006f8caf07e0698a30571443d4798702b3935cae9f496206865726a3dc1ced35f548daf2b5b3580fddc7e74c73734338ca8bf6f6eedadb85406f66005bba288916f472bad33295c23cd253cd3bb36238f57977a73f47fb5091ea5db0d071ce35df63a85e908c455343009e4869aef86bfc02abd7e8192255ec6a50e2cb8a173be23a5d5adae1907ad42c7f306dd8f4c64baa3afd7277a8b80bcaf8dc2d4c1f708ce50b7c11f82c6b612f64cea9fbb4ad72b67c31d187650c7ac72f2ca0c334a3bcec544a9be12a08bc95d9cf74bc9949631fa12b219f5c78b5fc82d607d13dcc56994d5694440b66df0f673560b6fc58ea5aaa1819a4aafd495a3f06d10f28ef32604e549752ce84693bef618a8779143263ec5ab13848565606582f283f86141cbe73097c378436ec8e35dab6aef106d58d9f3ed0b77313ead375b746bba5c6d1b2ee85773ed43d0a199f8ff86d951d2fba40cc280c8389ac8f57689bf8c988ee19d228c60cb269bff80bfe8ac1dd61e9a007cb9bcb0e32", @ANYRESOCT=r6, @ANYRES32=r7], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x20080, 0x0) 48.37252965s ago: executing program 1 (id=559): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='123', 0x3, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='12', 0x2, 0x1e8030) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 42.163019409s ago: executing program 1 (id=565): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 40.892250344s ago: executing program 1 (id=572): openat2$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) clock_nanosleep(0x2, 0x0, &(0x7f0000000140), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) gettid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x200) landlock_restrict_self(0xffffffffffffffff, 0xc) 38.320012894s ago: executing program 1 (id=573): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@mcast2, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x4, 0xfffffffc, 0x2259}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) 34.549238537s ago: executing program 1 (id=583): openat2$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) clock_nanosleep(0x2, 0x0, &(0x7f0000000140), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) gettid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x200) landlock_restrict_self(0xffffffffffffffff, 0xc) 19.265762474s ago: executing program 32 (id=583): openat2$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) clock_nanosleep(0x2, 0x0, &(0x7f0000000140), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x101c42, 0x0) gettid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x200) landlock_restrict_self(0xffffffffffffffff, 0xc) 16.909686329s ago: executing program 3 (id=622): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x84383, 0x0) 11.936211274s ago: executing program 3 (id=629): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) read$FUSE(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_rr_get_interval(r2, 0x0) 11.923400065s ago: executing program 0 (id=630): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x648e7000, 0x0, 0x0, 0x0, 0x0, 0x0) 10.340696578s ago: executing program 3 (id=632): syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) fanotify_init(0x40, 0x101000) keyctl$clear(0x7, 0xfffffffffffffffb) 8.606706855s ago: executing program 4 (id=634): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20008000) shutdown(r3, 0x1) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f00000000c0)) dup(0xffffffffffffffff) syz_open_dev$video4linux(&(0x7f0000000080), 0xff, 0x0) mremap(&(0x7f0000532000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000190000/0x1000)=nil) socket$nl_generic(0x10, 0x3, 0x10) 8.467287479s ago: executing program 0 (id=635): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000009e40)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="2e003300d00000000802110000010802110000005050", @ANYRES64], 0x4c}}, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(0xffffffffffffffff, 0x80089419, 0x0) 7.531101325s ago: executing program 4 (id=636): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000000180)="17000000020001000003be8c5e687a8a", 0x10) 7.32805037s ago: executing program 4 (id=637): r0 = inotify_init() r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00'}) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x24, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000100)=0x4, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x11, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r4}, &(0x7f0000000540), &(0x7f0000000580)=r1}, 0x20) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e23, 0x100, @ipv4={'\x00', '\xff\xff', @empty}, 0x5}}, 0x0, 0x0, 0x4f, 0x0, "3e4641f3cce9866040f8cb5c3e0ab71972958a84663af93d3c2eb62e424b5be5390875d92be4947a277f4d830f65459a4ca20bddc220b47f0647cd8b5989b758bc6d65fa511e8d1833f9496a0c8de6e9"}, 0xd8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 7.273772522s ago: executing program 0 (id=638): r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000000)={0x3, 'ip6gre0\x00', {}, 0xff1a}) 7.001899809s ago: executing program 3 (id=639): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) 6.980039989s ago: executing program 0 (id=640): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x84383, 0x0) 6.865511173s ago: executing program 4 (id=641): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 6.600989919s ago: executing program 4 (id=642): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)='I', 0x1, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) chroot(&(0x7f0000000180)='./file0\x00') socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r4, 0x0, 0x0) sendmmsg(r5, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) 6.507878042s ago: executing program 3 (id=643): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(r2, 0x0, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x604, 0x0, 0xa, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df, 0x2e}) readv(r3, &(0x7f0000000b80)=[{&(0x7f0000000240)=""/246, 0x1c}, {0x0}], 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x280}) 5.338342374s ago: executing program 4 (id=644): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000540)=ANY=[@ANYBLOB="120100004bec0220a20603008cb4010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_connect(0x4, 0x90, &(0x7f0000000040)=ANY=[@ANYBLOB="12010102138d28200819201300000102030109027e0080ffffff000904ae0e051966858f0b240600013a6af75c828205240009000d020000000000000400fdff0606241a8d000809050308000402080607250182070100090509001000a903080725018134000009050c10000408018d0725010007060007250100096f0e09050b1000020fab08090506"], 0x0) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) r1 = syz_usb_connect$uac1(0x3, 0xa2, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d01014000010203010902900003010380000904000000010100000a24010f00030201020c2402060602040c0032a304090401000001020000090401010101020000072401200404000c2402010201400f0a3b4725090501090000f7090607250183020c00090402000001030000090402010101020000072401"], 0x0) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, 0x0, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x438}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000001c0)={0x0, 0x10, 0x5, "d132791717"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.588072185s ago: executing program 0 (id=645): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000440)={0x2, 0xfffffffc, 0x6}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001200010a00000000000000008000000091"], 0x20}}, 0x0) 3.687348069s ago: executing program 3 (id=646): mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f00000002c0)={[{@xino_off}, {@lowerdir={'lowerdir', 0x3d, './file0'}}], [{@smackfsfloor={'smackfsfloor', 0x3d, '*.,'}}], 0x2c}) ptrace$peeksig(0x4209, 0x0, 0x0, 0x0) capget(&(0x7f0000000040)={0x20080522}, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000040)={0x2000, 0x101, 0x0, 'queue0\x00'}) write$sndseq(r2, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) close_range(r1, 0xffffffffffffffff, 0x0) 3.30010314s ago: executing program 0 (id=648): syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) fanotify_init(0x40, 0x101000) keyctl$clear(0x7, 0xfffffffffffffffb) 2.892464931s ago: executing program 2 (id=650): r0 = inotify_init() r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00'}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x24, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000000100)=0x4, 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x11, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r4}, &(0x7f0000000540), &(0x7f0000000580)}, 0x20) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e23, 0x100, @ipv4={'\x00', '\xff\xff', @empty}, 0x5}}, 0x0, 0x0, 0x4f, 0x0, "3e4641f3cce9866040f8cb5c3e0ab71972958a84663af93d3c2eb62e424b5be5390875d92be4947a277f4d830f65459a4ca20bddc220b47f0647cd8b5989b758bc6d65fa511e8d1833f9496a0c8de6e9"}, 0xd8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 2.393750625s ago: executing program 2 (id=651): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 1.951596746s ago: executing program 2 (id=652): r0 = syz_open_dev$vbi(&(0x7f0000002d00), 0x0, 0x2) ioctl$VIDIOC_QUERYBUF_DMABUF(r0, 0xc0585609, &(0x7f0000002d80)={0x7, 0xc, 0x4, 0x0, 0x0, {}, {0x2, 0x8, 0x2, 0xf4, 0x4, 0xf, "aa8dc92f"}, 0x2, 0x4, {}, 0xf9d6}) 1.744092732s ago: executing program 2 (id=653): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00', 0x4, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0x1e8123) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.300509675s ago: executing program 2 (id=654): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendto$inet(0xffffffffffffffff, &(0x7f0000000100)='I', 0x1, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) chroot(&(0x7f0000000180)='./file0\x00') socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r4, 0x0, 0x0) sendmmsg(r5, &(0x7f0000005280), 0x4000000000001cd, 0x1008c811) 0s ago: executing program 2 (id=655): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(r2, 0x0, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x604, 0x0, 0xa, 0x3, 0xfffffffe, 0x1, 0x0, 0x7cce8c743ee810df, 0x2e}) readv(r3, &(0x7f0000000b80)=[{&(0x7f0000000240)=""/246, 0x1c}, {0x0}], 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f00000001c0)={0x800100, 0xfffffffd, 0x22, 0x6, 0x1101, 0x280}) kernel console output (not intermixed with test programs): 103.822373][ T4743] process 'syz.3.128' launched './file2' with NULL argv: empty string added [ 104.037339][ T4748] UBIFS error (pid: 4748): cannot open "ubi0:testvol", error -19 [ 104.802257][ T0] NOHZ tick-stop error: local softirq work is pending, handler #382!!! [ 107.280536][ T4779] netlink: 8 bytes leftover after parsing attributes in process `syz.3.142'. [ 109.949341][ T4811] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 110.635682][ T4813] usb0: HOST MAC fa:d7:8f:92:a4:de [ 110.680664][ T4813] usb0: MAC a6:66:eb:62:12:d3 [ 110.982503][ T7] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 110.997211][ T4823] syz.0.141 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 111.017987][ T4823] CPU: 1 PID: 4823 Comm: syz.0.141 Not tainted syzkaller #0 [ 111.025311][ T4823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 111.035383][ T4823] Call Trace: [ 111.038681][ T4823] [ 111.041633][ T4823] dump_stack_lvl+0x188/0x24e [ 111.046340][ T4823] ? ___ratelimit+0x14e/0x610 [ 111.051078][ T4823] ? show_regs_print_info+0x12/0x12 [ 111.056321][ T4823] ? load_image+0x410/0x410 [ 111.060824][ T4823] ? ___ratelimit+0x474/0x610 [ 111.065515][ T4823] ? radix_tree_cpu_dead+0x160/0x160 [ 111.070836][ T4823] dump_header+0xd8/0x820 [ 111.075199][ T4823] oom_kill_process+0x361/0x550 [ 111.080071][ T4823] out_of_memory+0xe25/0x1220 [ 111.084751][ T4823] ? mutex_lock_nested+0x10/0x10 [ 111.089686][ T4823] ? unregister_oom_notifier+0x20/0x20 [ 111.095168][ T4823] mem_cgroup_out_of_memory+0x2c0/0x390 [ 111.100723][ T4823] ? mem_cgroup_oom_trylock+0x210/0x210 [ 111.106274][ T4823] ? do_raw_spin_unlock+0x11d/0x230 [ 111.111473][ T4823] try_charge_memcg+0xc9d/0x17c0 [ 111.116426][ T4823] ? percpu_ref_put+0x180/0x180 [ 111.121276][ T4823] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 111.127001][ T4823] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 111.132981][ T4823] ? percpu_ref_tryget+0x15/0x180 [ 111.138005][ T4823] ? percpu_ref_tryget+0x15/0x180 [ 111.143026][ T4823] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 111.148761][ T4823] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 111.154513][ T4823] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 111.160327][ T4823] obj_cgroup_charge+0x36a/0x620 [ 111.165270][ T4823] ? obj_cgroup_charge+0xe9/0x620 [ 111.170298][ T4823] ? mod_objcg_mlstate+0x320/0x320 [ 111.175417][ T4823] ? percpu_ref_put+0x12/0x100 [ 111.180184][ T4823] ? percpu_ref_put+0x12/0x100 [ 111.184950][ T4823] slab_pre_alloc_hook+0x2e2/0x300 [ 111.190159][ T4823] ? slab_pre_alloc_hook+0xb1/0x300 [ 111.195365][ T4823] kmem_cache_alloc_lru+0x49/0x2e0 [ 111.200476][ T4823] ? sock_alloc_inode+0x24/0xc0 [ 111.205331][ T4823] sock_alloc_inode+0x24/0xc0 [ 111.210015][ T4823] ? sockfs_init_fs_context+0xa0/0xa0 [ 111.215382][ T4823] new_inode_pseudo+0x5f/0x1c0 [ 111.220148][ T4823] sock_create_lite+0x87/0x500 [ 111.224917][ T4823] __netlink_kernel_create+0xf7/0x7b0 [ 111.230297][ T4823] ? netlink_set_err+0x3b0/0x3b0 [ 111.235233][ T4823] ? memset+0x1e/0x40 [ 111.239214][ T4823] ? lockdep_init_map_type+0x98/0x8d0 [ 111.244588][ T4823] ? rtnetlink_net_init+0xa1/0x140 [ 111.249694][ T4823] rtnetlink_net_init+0xb0/0x140 [ 111.254626][ T4823] ? nlmsg_populate_fdb_fill+0x620/0x620 [ 111.260255][ T4823] ? rtnetlink_net_exit+0x60/0x60 [ 111.265272][ T4823] ? rtnetlink_rcv+0x20/0x20 [ 111.269862][ T4823] ops_init+0x360/0x5e0 [ 111.274027][ T4823] setup_net+0x4f2/0xbd0 [ 111.278271][ T4823] ? copy_net_ns+0x5b0/0x5b0 [ 111.282863][ T4823] ? down_read_killable+0x1cc/0x340 [ 111.288063][ T4823] copy_net_ns+0x33e/0x5b0 [ 111.292484][ T4823] create_new_namespaces+0x3ce/0x700 [ 111.297771][ T4823] ? copy_namespaces+0x55/0x410 [ 111.302622][ T4823] copy_namespaces+0x3ae/0x410 [ 111.307389][ T4823] copy_process+0x199b/0x4070 [ 111.312073][ T4823] ? copy_process+0x974/0x4070 [ 111.316831][ T4823] ? preempt_schedule_thunk+0x16/0x18 [ 111.322217][ T4823] ? idle_dummy+0x10/0x10 [ 111.326544][ T4823] ? wake_up_q+0x8c/0xc0 [ 111.330790][ T4823] kernel_clone+0x24b/0x900 [ 111.335294][ T4823] ? futex_wake_mark+0x150/0x150 [ 111.340254][ T4823] ? create_io_thread+0x170/0x170 [ 111.345311][ T4823] ? do_futex+0x2e2/0x320 [ 111.349649][ T4823] __x64_sys_clone+0x1a7/0x220 [ 111.354421][ T4823] ? __ia32_sys_vfork+0x140/0x140 [ 111.359458][ T4823] ? lock_chain_count+0x20/0x20 [ 111.364320][ T4823] ? lockdep_hardirqs_on+0x94/0x140 [ 111.369524][ T4823] do_syscall_64+0x4c/0xa0 [ 111.373945][ T4823] ? clear_bhb_loop+0x60/0xb0 [ 111.378629][ T4823] ? clear_bhb_loop+0x60/0xb0 [ 111.383315][ T4823] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 111.389212][ T4823] RIP: 0033:0x7f42d659e159 [ 111.393625][ T4823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 111.413233][ T4823] RSP: 002b:00007f42d7483fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 111.421644][ T4823] RAX: ffffffffffffffda RBX: 00007f42d6825fa0 RCX: 00007f42d659e159 [ 111.429613][ T4823] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 111.437577][ T4823] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 111.445542][ T4823] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 111.453591][ T4823] R13: 00007f42d6826038 R14: 00007f42d6825fa0 R15: 00007ffe37305e28 [ 111.461567][ T4823] [ 111.471578][ T4823] memory: usage 96kB, limit 96kB, failcnt 43 [ 111.536617][ T4823] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 112.294042][ T4838] size and base must be multiples of 4 kiB [ 112.299907][ T4838] CPU: 1 PID: 4838 Comm: syz.4.155 Not tainted syzkaller #0 [ 112.307211][ T4838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.317263][ T4838] Call Trace: [ 112.320544][ T4838] [ 112.323470][ T4838] dump_stack_lvl+0x188/0x24e [ 112.328157][ T4838] ? __might_fault+0xa6/0x120 [ 112.332834][ T4838] ? show_regs_print_info+0x12/0x12 [ 112.338039][ T4838] ? load_image+0x410/0x410 [ 112.342550][ T4838] ? tomoyo_path_number_perm+0x5a4/0x650 [ 112.348182][ T4838] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 112.353645][ T4838] ? __might_fault+0xa6/0x120 [ 112.358317][ T4838] ? __might_fault+0xc2/0x120 [ 112.362988][ T4838] ? __might_fault+0xa6/0x120 [ 112.367666][ T4838] mtrr_add+0x8e/0xc0 [ 112.371652][ T4838] mtrr_ioctl+0x9bf/0x1140 [ 112.376076][ T4838] ? mtrr_close+0x1f0/0x1f0 [ 112.380587][ T4838] ? __fget_files+0x28/0x460 [ 112.385191][ T4838] ? mtrr_close+0x1f0/0x1f0 [ 112.389692][ T4838] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 112.395159][ T4838] ? proc_reg_poll+0x280/0x280 [ 112.399934][ T4838] __se_sys_ioctl+0xfa/0x170 [ 112.404526][ T4838] do_syscall_64+0x4c/0xa0 [ 112.408950][ T4838] ? clear_bhb_loop+0x60/0xb0 [ 112.413629][ T4838] ? clear_bhb_loop+0x60/0xb0 [ 112.418309][ T4838] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.424208][ T4838] RIP: 0033:0x7fe90959e159 [ 112.428619][ T4838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.448218][ T4838] RSP: 002b:00007fe90a511028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 112.456631][ T4838] RAX: ffffffffffffffda RBX: 00007fe909826180 RCX: 00007fe90959e159 [ 112.464601][ T4838] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 112.472566][ T4838] RBP: 00007fe909635024 R08: 0000000000000000 R09: 0000000000000000 [ 112.480530][ T4838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.488497][ T4838] R13: 00007fe909826218 R14: 00007fe909826180 R15: 00007ffcca38c478 [ 112.496476][ T4838] [ 112.515050][ T4838] netlink: 'syz.4.155': attribute type 4 has an invalid length. [ 112.698267][ T7] usb 1-1: Dual-Role OTG device on HNP port [ 112.704511][ T7] usb 1-1: New USB device found, idVendor=0000, idProduct=5678, bcdDevice= 6.01 [ 112.715679][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.875915][ T7] cdc_ether 1-1:1.0 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, fa:d7:8f:92:a4:de [ 113.902438][ T4823] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 113.928849][ T4823] Memory cgroup stats for /syz0/test: [ 113.929380][ T4823] anon 0 [ 113.929380][ T4823] file 0 [ 113.929380][ T4823] kernel 98304 [ 113.929380][ T4823] kernel_stack 32768 [ 113.929380][ T4823] pagetables 8192 [ 113.929380][ T4823] sec_pagetables 0 [ 113.929380][ T4823] percpu 0 [ 113.929380][ T4823] sock 0 [ 113.929380][ T4823] vmalloc 0 [ 113.929380][ T4823] shmem 0 [ 113.929380][ T4823] zswap 0 [ 113.929380][ T4823] zswapped 0 [ 113.929380][ T4823] file_mapped 0 [ 113.929380][ T4823] file_dirty 0 [ 113.929380][ T4823] file_writeback 0 [ 113.929380][ T4823] swapcached 0 [ 113.929380][ T4823] anon_thp 0 [ 113.929380][ T4823] file_thp 0 [ 113.929380][ T4823] shmem_thp 0 [ 113.929380][ T4823] inactive_anon 0 [ 113.929380][ T4823] active_anon 0 [ 113.929380][ T4823] inactive_file 0 [ 113.929380][ T4823] active_file 0 [ 113.929380][ T4823] unevictable 0 [ 113.929380][ T4823] slab_reclaimable 5784 [ 113.929380][ T4823] slab_unreclaimable 42504 [ 113.929380][ T4823] slab 48288 [ 114.426880][ T4864] loop4: detected capacity change from 0 to 1024 [ 114.471081][ T4823] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.141,pid=4822,uid=0 [ 114.483642][ T4864] ======================================================= [ 114.483642][ T4864] WARNING: The mand mount option has been deprecated and [ 114.483642][ T4864] and is ignored by this kernel. Remove the mand [ 114.483642][ T4864] option from the mount to silence this warning. [ 114.483642][ T4864] ======================================================= [ 114.524497][ T4823] Memory cgroup out of memory: Killed process 4823 (syz.0.141) total-vm:102244kB, anon-rss:1420kB, file-rss:22564kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 114.646317][ T4868] netlink: 4 bytes leftover after parsing attributes in process `syz.1.161'. [ 114.655671][ T4868] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 115.216043][ T4864] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 115.286868][ T4864] ext4 filesystem being mounted at /28/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 115.333595][ T27] kauditd_printk_skb: 11 callbacks suppressed [ 115.333609][ T27] audit: type=1800 audit(1788284853.611:23): pid=4864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.162" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 115.483228][ T27] audit: type=1800 audit(1788284853.761:24): pid=4864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.162" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 115.516686][ T4863] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm syz.4.162: lblock 0 mapped to illegal pblock 0 (length 1) [ 115.576648][ T4882] netdevsim0 speed is unknown, defaulting to 1000 [ 115.604427][ T4864] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.162: lblock 0 mapped to illegal pblock 0 (length 1) [ 115.657120][ T4864] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.162: lblock 0 mapped to illegal pblock 0 (length 1) [ 116.301731][ T4889] overlayfs: overlapping lowerdir path [ 116.974851][ T4891] tty tty2: ldisc open failed (-12), clearing slot 1 [ 117.180093][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 117.607118][ T4912] syz.4.176 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 117.624714][ T4912] CPU: 0 PID: 4912 Comm: syz.4.176 Not tainted syzkaller #0 [ 117.632037][ T4912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 117.642126][ T4912] Call Trace: [ 117.645423][ T4912] [ 117.648371][ T4912] dump_stack_lvl+0x188/0x24e [ 117.653092][ T4912] ? ___ratelimit+0x14e/0x610 [ 117.657788][ T4912] ? show_regs_print_info+0x12/0x12 [ 117.663018][ T4912] ? load_image+0x410/0x410 [ 117.667541][ T4912] ? ___ratelimit+0x474/0x610 [ 117.672238][ T4912] ? radix_tree_cpu_dead+0x160/0x160 [ 117.677539][ T4912] dump_header+0xd8/0x820 [ 117.681899][ T4912] oom_kill_process+0x361/0x550 [ 117.686771][ T4912] out_of_memory+0xe25/0x1220 [ 117.691470][ T4912] ? print_unlock_imbalance_bug+0x160/0x160 [ 117.697393][ T4912] ? mutex_lock_nested+0x10/0x10 [ 117.702350][ T4912] ? unregister_oom_notifier+0x20/0x20 [ 117.707839][ T4912] mem_cgroup_out_of_memory+0x2c0/0x390 [ 117.713409][ T4912] ? mem_cgroup_oom_trylock+0x210/0x210 [ 117.718984][ T4912] ? do_raw_spin_unlock+0x11d/0x230 [ 117.724202][ T4912] try_charge_memcg+0xc9d/0x17c0 [ 117.729185][ T4912] ? percpu_ref_put+0x180/0x180 [ 117.734063][ T4912] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 117.739817][ T4912] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 117.745824][ T4912] ? percpu_ref_tryget+0x15/0x180 [ 117.750876][ T4912] ? percpu_ref_tryget+0x15/0x180 [ 117.755925][ T4912] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 117.761673][ T4912] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 117.767428][ T4912] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 117.773267][ T4912] obj_cgroup_charge+0x36a/0x620 [ 117.778238][ T4912] ? obj_cgroup_charge+0xe9/0x620 [ 117.783294][ T4912] ? mod_objcg_mlstate+0x320/0x320 [ 117.788436][ T4912] ? percpu_ref_put+0x12/0x100 [ 117.793266][ T4912] ? percpu_ref_put+0x12/0x100 [ 117.798063][ T4912] slab_pre_alloc_hook+0x2e2/0x300 [ 117.803204][ T4912] ? slab_pre_alloc_hook+0xb1/0x300 [ 117.808435][ T4912] kmem_cache_alloc_lru+0x49/0x2e0 [ 117.813565][ T4912] ? sock_alloc_inode+0x24/0xc0 [ 117.818450][ T4912] sock_alloc_inode+0x24/0xc0 [ 117.823144][ T4912] ? sockfs_init_fs_context+0xa0/0xa0 [ 117.828541][ T4912] new_inode_pseudo+0x5f/0x1c0 [ 117.833339][ T4912] sock_create_lite+0x87/0x500 [ 117.838144][ T4912] __netlink_kernel_create+0xf7/0x7b0 [ 117.843555][ T4912] ? netlink_set_err+0x3b0/0x3b0 [ 117.848523][ T4912] ? memset+0x1e/0x40 [ 117.852529][ T4912] ? lockdep_init_map_type+0x98/0x8d0 [ 117.857930][ T4912] ? rtnetlink_net_init+0xa1/0x140 [ 117.863070][ T4912] rtnetlink_net_init+0xb0/0x140 [ 117.868029][ T4912] ? nlmsg_populate_fdb_fill+0x620/0x620 [ 117.873682][ T4912] ? rtnetlink_net_exit+0x60/0x60 [ 117.878719][ T4912] ? rtnetlink_rcv+0x20/0x20 [ 117.883339][ T4912] ops_init+0x360/0x5e0 [ 117.887587][ T4912] setup_net+0x4f2/0xbd0 [ 117.891860][ T4912] ? copy_net_ns+0x5b0/0x5b0 [ 117.896479][ T4912] ? down_read_killable+0x1cc/0x340 [ 117.901699][ T4912] copy_net_ns+0x33e/0x5b0 [ 117.906139][ T4912] create_new_namespaces+0x3ce/0x700 [ 117.911437][ T4912] ? copy_namespaces+0x55/0x410 [ 117.916287][ T4912] copy_namespaces+0x3ae/0x410 [ 117.921052][ T4912] copy_process+0x199b/0x4070 [ 117.925828][ T4912] ? copy_process+0x974/0x4070 [ 117.930589][ T4912] ? preempt_schedule_thunk+0x16/0x18 [ 117.935976][ T4912] ? idle_dummy+0x10/0x10 [ 117.940314][ T4912] ? wake_up_q+0x8c/0xc0 [ 117.944566][ T4912] kernel_clone+0x24b/0x900 [ 117.949073][ T4912] ? futex_wake_mark+0x150/0x150 [ 117.954011][ T4912] ? create_io_thread+0x170/0x170 [ 117.959049][ T4912] ? do_futex+0x2e2/0x320 [ 117.963382][ T4912] __x64_sys_clone+0x1a7/0x220 [ 117.968144][ T4912] ? __ia32_sys_vfork+0x140/0x140 [ 117.973177][ T4912] ? lock_chain_count+0x20/0x20 [ 117.978035][ T4912] ? lockdep_hardirqs_on+0x94/0x140 [ 117.983234][ T4912] do_syscall_64+0x4c/0xa0 [ 117.987653][ T4912] ? clear_bhb_loop+0x60/0xb0 [ 117.992336][ T4912] ? clear_bhb_loop+0x60/0xb0 [ 117.997018][ T4912] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 118.002911][ T4912] RIP: 0033:0x7fe90959e159 [ 118.007338][ T4912] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.026938][ T4912] RSP: 002b:00007fe90a552fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 118.035356][ T4912] RAX: ffffffffffffffda RBX: 00007fe909825fa0 RCX: 00007fe90959e159 [ 118.043324][ T4912] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 118.051291][ T4912] RBP: 00007fe909635024 R08: 0000000000000000 R09: 0000000000000000 [ 118.059257][ T4912] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 118.067223][ T4912] R13: 00007fe909826038 R14: 00007fe909825fa0 R15: 00007ffcca38c478 [ 118.075204][ T4912] [ 118.102843][ T4912] memory: usage 96kB, limit 96kB, failcnt 41 [ 118.111907][ T4912] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 118.132483][ T4912] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 118.220189][ T4916] netlink: 4 bytes leftover after parsing attributes in process `syz.0.175'. [ 118.672959][ T4912] Memory cgroup stats for /syz4/test: [ 118.673162][ T4912] anon 0 [ 118.673162][ T4912] file 0 [ 118.673162][ T4912] kernel 98304 [ 118.673162][ T4912] kernel_stack 32768 [ 118.673162][ T4912] pagetables 8192 [ 118.673162][ T4912] sec_pagetables 0 [ 118.673162][ T4912] percpu 0 [ 118.673162][ T4912] sock 0 [ 118.673162][ T4912] vmalloc 0 [ 118.673162][ T4912] shmem 0 [ 118.673162][ T4912] zswap 0 [ 118.673162][ T4912] zswapped 0 [ 118.673162][ T4912] file_mapped 0 [ 118.673162][ T4912] file_dirty 0 [ 118.673162][ T4912] file_writeback 0 [ 118.673162][ T4912] swapcached 0 [ 118.673162][ T4912] anon_thp 0 [ 118.673162][ T4912] file_thp 0 [ 118.673162][ T4912] shmem_thp 0 [ 118.673162][ T4912] inactive_anon 0 [ 118.673162][ T4912] active_anon 0 [ 118.673162][ T4912] inactive_file 0 [ 118.673162][ T4912] active_file 0 [ 118.673162][ T4912] unevictable 0 [ 118.673162][ T4912] slab_reclaimable 5784 [ 118.673162][ T4912] slab_unreclaimable 42896 [ 118.673162][ T4912] slab 48680 [ 120.192307][ T4312] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 120.232952][ T4933] netdevsim0 speed is unknown, defaulting to 1000 [ 120.281728][ T4912] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz4/test,task_memcg=/syz4/test,task=syz.4.176,pid=4910,uid=0 [ 120.343650][ T4912] Memory cgroup out of memory: Killed process 4912 (syz.4.176) total-vm:102244kB, anon-rss:1428kB, file-rss:22560kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 120.394235][ T4312] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.422293][ T4312] usb 4-1: config 0 has no interfaces? [ 120.432701][ T4312] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 120.461320][ T4312] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.504254][ T4312] usb 4-1: config 0 descriptor?? [ 120.675573][ T4944] loop0: detected capacity change from 0 to 1024 [ 120.715148][ T4312] usb 4-1: USB disconnect, device number 5 [ 120.799955][ T4944] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 120.830880][ T4944] ext4 filesystem being mounted at /37/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.846747][ T27] audit: type=1800 audit(1788284859.121:25): pid=4944 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.182" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 120.942585][ T27] audit: type=1800 audit(1788284859.221:26): pid=4944 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.182" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 120.965189][ T4943] EXT4-fs error (device loop0): ext4_map_blocks:747: inode #15: comm syz.0.182: lblock 0 mapped to illegal pblock 0 (length 1) [ 120.983935][ T4944] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #15: comm syz.0.182: lblock 0 mapped to illegal pblock 0 (length 1) [ 121.022403][ T4949] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 121.063190][ T4944] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #15: comm syz.0.182: lblock 0 mapped to illegal pblock 0 (length 1) [ 121.181520][ T4272] EXT4-fs (loop0): unmounting filesystem. [ 121.414645][ T4962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.464387][ T4962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.945845][ T4977] netdevsim0 speed is unknown, defaulting to 1000 [ 126.228654][ T5004] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 126.429132][ T5034] loop4: detected capacity change from 0 to 1024 [ 126.529558][ T5034] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 126.542643][ T5034] ext4 filesystem being mounted at /35/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 126.617686][ T27] audit: type=1800 audit(1788284864.891:27): pid=5034 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.206" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 127.871658][ T5042] netdevsim0 speed is unknown, defaulting to 1000 [ 127.922553][ T27] audit: type=1800 audit(1788284866.191:28): pid=5034 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.206" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 127.923965][ T5033] EXT4-fs error (device loop4): ext4_map_blocks:747: inode #15: comm syz.4.206: lblock 0 mapped to illegal pblock 0 (length 1) [ 127.962545][ T4312] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 128.049140][ T5034] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.206: lblock 0 mapped to illegal pblock 0 (length 1) [ 128.078189][ T5034] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #15: comm syz.4.206: lblock 0 mapped to illegal pblock 0 (length 1) [ 128.172443][ T4312] usb 4-1: Using ep0 maxpacket: 16 [ 128.197605][ T4312] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 128.228958][ T4312] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 128.269354][ T4312] usb 4-1: config 0 has no interface number 0 [ 128.301452][ T4312] usb 4-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 128.328137][ T4312] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.348934][ T4312] usb 4-1: Product: syz [ 128.369248][ T4312] usb 4-1: Manufacturer: syz [ 128.379952][ T4312] usb 4-1: SerialNumber: syz [ 128.408503][ T4312] usb 4-1: config 0 descriptor?? [ 128.432959][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 128.448156][ T4312] usb 4-1: Found UVC 0.00 device syz (046c:14e8) [ 128.512564][ T4312] usb 4-1: No valid video chain found. [ 128.637935][ T4312] usb 4-1: USB disconnect, device number 6 [ 130.852298][ T22] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 131.042289][ T22] usb 3-1: Using ep0 maxpacket: 32 [ 131.051812][ T22] usb 3-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 131.082351][ T22] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.090496][ T22] usb 3-1: Product: syz [ 131.139846][ T22] usb 3-1: Manufacturer: syz [ 131.163511][ T22] usb 3-1: SerialNumber: syz [ 131.185740][ T22] usb 3-1: config 0 descriptor?? [ 131.204677][ T22] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 131.382493][ T4283] Bluetooth: hci1: command 0x0406 tx timeout [ 132.075490][ T5131] loop0: detected capacity change from 0 to 4096 [ 132.133020][ T5131] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 132.159066][ T5131] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 132.182469][ T5131] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 132.200502][ T5131] loop0: [ 132.201898][ T5084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.212803][ T5084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.353391][ T5139] size and base must be multiples of 4 kiB [ 132.359339][ T5139] CPU: 1 PID: 5139 Comm: syz.3.235 Not tainted syzkaller #0 [ 132.366662][ T5139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 132.376737][ T5139] Call Trace: [ 132.380032][ T5139] [ 132.382978][ T5139] dump_stack_lvl+0x188/0x24e [ 132.387692][ T5139] ? __might_fault+0xa6/0x120 [ 132.392386][ T5139] ? show_regs_print_info+0x12/0x12 [ 132.397630][ T5139] ? load_image+0x410/0x410 [ 132.402148][ T5139] ? tomoyo_path_number_perm+0x5a4/0x650 [ 132.407786][ T5139] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 132.413252][ T5139] ? __might_fault+0xa6/0x120 [ 132.417928][ T5139] ? __might_fault+0xc2/0x120 [ 132.422601][ T5139] ? __might_fault+0xa6/0x120 [ 132.427282][ T5139] mtrr_add+0x8e/0xc0 [ 132.431268][ T5139] mtrr_ioctl+0x9bf/0x1140 [ 132.435692][ T5139] ? mtrr_close+0x1f0/0x1f0 [ 132.440209][ T5139] ? __fget_files+0x28/0x460 [ 132.444815][ T5139] ? mtrr_close+0x1f0/0x1f0 [ 132.449321][ T5139] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 132.454790][ T5139] ? proc_reg_poll+0x280/0x280 [ 132.459562][ T5139] __se_sys_ioctl+0xfa/0x170 [ 132.464198][ T5139] do_syscall_64+0x4c/0xa0 [ 132.468620][ T5139] ? clear_bhb_loop+0x60/0xb0 [ 132.473395][ T5139] ? clear_bhb_loop+0x60/0xb0 [ 132.478076][ T5139] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 132.483975][ T5139] RIP: 0033:0x7f167cb9e159 [ 132.488388][ T5139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.508080][ T5139] RSP: 002b:00007f167adb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.516502][ T5139] RAX: ffffffffffffffda RBX: 00007f167ce26180 RCX: 00007f167cb9e159 [ 132.524483][ T5139] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 132.532463][ T5139] RBP: 00007f167cc35024 R08: 0000000000000000 R09: 0000000000000000 [ 132.540433][ T5139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.548401][ T5139] R13: 00007f167ce26218 R14: 00007f167ce26180 R15: 00007ffc86fa3358 [ 132.556389][ T5139] [ 132.576916][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.583287][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.604515][ T5084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.652990][ T5084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.920012][ T22] gspca_topro: Sensor cx0342 [ 133.012474][ T14] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 133.125917][ T22] usb 3-1: USB disconnect, device number 5 [ 133.264703][ T5139] netlink: 'syz.3.235': attribute type 4 has an invalid length. [ 133.368715][ T14] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 133.379045][ T14] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBE, skipping [ 133.389638][ T14] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 133.404930][ T14] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 133.414053][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 133.959192][ T14] usb 2-1: Product: syz [ 133.963445][ T14] usb 2-1: Manufacturer: syz [ 133.968060][ T14] usb 2-1: SerialNumber: syz [ 134.011582][ T14] usb 2-1: config 0 descriptor?? [ 134.145165][ T14] radio-si470x 2-1:0.0: could not find interrupt in endpoint [ 134.166987][ T14] radio-si470x: probe of 2-1:0.0 failed with error -5 [ 134.174993][ T14] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 135.274445][ T5196] syz.3.254 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 135.298069][ T5196] CPU: 0 PID: 5196 Comm: syz.3.254 Not tainted syzkaller #0 [ 135.305497][ T5196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 135.315568][ T5196] Call Trace: [ 135.318859][ T5196] [ 135.321798][ T5196] dump_stack_lvl+0x188/0x24e [ 135.326500][ T5196] ? ___ratelimit+0x14e/0x610 [ 135.331193][ T5196] ? show_regs_print_info+0x12/0x12 [ 135.336433][ T5196] ? load_image+0x410/0x410 [ 135.340968][ T5196] ? ___ratelimit+0x474/0x610 [ 135.345671][ T5196] ? radix_tree_cpu_dead+0x160/0x160 [ 135.350983][ T5196] dump_header+0xd8/0x820 [ 135.355351][ T5196] oom_kill_process+0x361/0x550 [ 135.360227][ T5196] out_of_memory+0xe25/0x1220 [ 135.364922][ T5196] ? print_unlock_imbalance_bug+0x160/0x160 [ 135.370854][ T5196] ? mutex_lock_nested+0x10/0x10 [ 135.375816][ T5196] ? unregister_oom_notifier+0x20/0x20 [ 135.381287][ T5196] mem_cgroup_out_of_memory+0x2c0/0x390 [ 135.386840][ T5196] ? mem_cgroup_oom_trylock+0x210/0x210 [ 135.392465][ T5196] ? do_raw_spin_unlock+0x11d/0x230 [ 135.397670][ T5196] try_charge_memcg+0xc9d/0x17c0 [ 135.402632][ T5196] ? percpu_ref_put+0x180/0x180 [ 135.407486][ T5196] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 135.413212][ T5196] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 135.419197][ T5196] ? percpu_ref_tryget+0x15/0x180 [ 135.424225][ T5196] ? percpu_ref_tryget+0x15/0x180 [ 135.429256][ T5196] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 135.434980][ T5196] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 135.440707][ T5196] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 135.446520][ T5196] obj_cgroup_charge+0x36a/0x620 [ 135.451468][ T5196] ? obj_cgroup_charge+0xe9/0x620 [ 135.456500][ T5196] ? mod_objcg_mlstate+0x320/0x320 [ 135.461618][ T5196] ? percpu_ref_put+0x12/0x100 [ 135.466384][ T5196] ? percpu_ref_put+0x12/0x100 [ 135.471153][ T5196] slab_pre_alloc_hook+0x2e2/0x300 [ 135.476268][ T5196] ? slab_pre_alloc_hook+0xb1/0x300 [ 135.481484][ T5196] kmem_cache_alloc_lru+0x49/0x2e0 [ 135.486602][ T5196] ? sock_alloc_inode+0x24/0xc0 [ 135.491454][ T5196] sock_alloc_inode+0x24/0xc0 [ 135.496125][ T5196] ? sockfs_init_fs_context+0xa0/0xa0 [ 135.501490][ T5196] new_inode_pseudo+0x5f/0x1c0 [ 135.506259][ T5196] sock_create_lite+0x87/0x500 [ 135.511030][ T5196] __netlink_kernel_create+0xf7/0x7b0 [ 135.516412][ T5196] ? netlink_set_err+0x3b0/0x3b0 [ 135.521352][ T5196] ? memset+0x1e/0x40 [ 135.525330][ T5196] ? lockdep_init_map_type+0x98/0x8d0 [ 135.530704][ T5196] ? rtnetlink_net_init+0xa1/0x140 [ 135.535813][ T5196] rtnetlink_net_init+0xb0/0x140 [ 135.540749][ T5196] ? nlmsg_populate_fdb_fill+0x620/0x620 [ 135.546381][ T5196] ? rtnetlink_net_exit+0x60/0x60 [ 135.551406][ T5196] ? rtnetlink_rcv+0x20/0x20 [ 135.555998][ T5196] ops_init+0x360/0x5e0 [ 135.560164][ T5196] setup_net+0x4f2/0xbd0 [ 135.564411][ T5196] ? copy_net_ns+0x5b0/0x5b0 [ 135.569006][ T5196] ? down_read_killable+0x1cc/0x340 [ 135.574205][ T5196] copy_net_ns+0x33e/0x5b0 [ 135.578631][ T5196] create_new_namespaces+0x3ce/0x700 [ 135.583928][ T5196] ? copy_namespaces+0x55/0x410 [ 135.588774][ T5196] copy_namespaces+0x3ae/0x410 [ 135.593645][ T5196] copy_process+0x199b/0x4070 [ 135.598351][ T5196] ? copy_process+0x974/0x4070 [ 135.603124][ T5196] ? preempt_schedule_thunk+0x16/0x18 [ 135.608512][ T5196] ? idle_dummy+0x10/0x10 [ 135.612844][ T5196] ? wake_up_q+0x8c/0xc0 [ 135.617093][ T5196] kernel_clone+0x24b/0x900 [ 135.621592][ T5196] ? futex_wake_mark+0x150/0x150 [ 135.626529][ T5196] ? create_io_thread+0x170/0x170 [ 135.631571][ T5196] ? do_futex+0x2e2/0x320 [ 135.635901][ T5196] __x64_sys_clone+0x1a7/0x220 [ 135.640661][ T5196] ? __ia32_sys_vfork+0x140/0x140 [ 135.645691][ T5196] ? lock_chain_count+0x20/0x20 [ 135.650568][ T5196] ? lockdep_hardirqs_on+0x94/0x140 [ 135.655772][ T5196] do_syscall_64+0x4c/0xa0 [ 135.660189][ T5196] ? clear_bhb_loop+0x60/0xb0 [ 135.664866][ T5196] ? clear_bhb_loop+0x60/0xb0 [ 135.669544][ T5196] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 135.675439][ T5196] RIP: 0033:0x7f167cb9e159 [ 135.679853][ T5196] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.699457][ T5196] RSP: 002b:00007f167adf5fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 135.707868][ T5196] RAX: ffffffffffffffda RBX: 00007f167ce25fa0 RCX: 00007f167cb9e159 [ 135.715837][ T5196] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 135.723800][ T5196] RBP: 00007f167cc35024 R08: 0000000000000000 R09: 0000000000000000 [ 135.731766][ T5196] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 135.739738][ T5196] R13: 00007f167ce26038 R14: 00007f167ce25fa0 R15: 00007ffc86fa3358 [ 135.747716][ T5196] [ 135.789797][ T5196] memory: usage 96kB, limit 96kB, failcnt 40 [ 135.799497][ T5196] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 135.820796][ T5196] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 135.857692][ T5196] Memory cgroup stats for /syz3/test: [ 135.860884][ T5196] anon 0 [ 135.860884][ T5196] file 0 [ 135.860884][ T5196] kernel 98304 [ 135.860884][ T5196] kernel_stack 32768 [ 135.860884][ T5196] pagetables 8192 [ 135.860884][ T5196] sec_pagetables 0 [ 135.860884][ T5196] percpu 0 [ 135.860884][ T5196] sock 0 [ 135.860884][ T5196] vmalloc 0 [ 135.860884][ T5196] shmem 0 [ 135.860884][ T5196] zswap 0 [ 135.860884][ T5196] zswapped 0 [ 135.860884][ T5196] file_mapped 0 [ 135.860884][ T5196] file_dirty 0 [ 135.860884][ T5196] file_writeback 0 [ 135.860884][ T5196] swapcached 0 [ 135.860884][ T5196] anon_thp 0 [ 135.860884][ T5196] file_thp 0 [ 135.860884][ T5196] shmem_thp 0 [ 135.860884][ T5196] inactive_anon 0 [ 135.860884][ T5196] active_anon 0 [ 135.860884][ T5196] inactive_file 0 [ 135.860884][ T5196] active_file 0 [ 135.860884][ T5196] unevictable 0 [ 135.860884][ T5196] slab_reclaimable 5784 [ 135.860884][ T5196] slab_unreclaimable 42504 [ 135.860884][ T5196] slab 48288 [ 136.301321][ T4312] usb 2-1: USB disconnect, device number 3 [ 136.408532][ T5196] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.254,pid=5195,uid=0 [ 136.446954][ T5196] Memory cgroup out of memory: Killed process 5196 (syz.3.254) total-vm:102244kB, anon-rss:1428kB, file-rss:22556kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 136.535262][ T5202] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 136.616751][ T5202] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 136.660415][ T5202] device-mapper: ioctl: error adding target to table [ 137.954922][ T5217] trusted_key: encrypted_key: insufficient parameters specified [ 139.871622][ T5239] size and base must be multiples of 4 kiB [ 140.640919][ T5239] CPU: 0 PID: 5239 Comm: syz.0.264 Not tainted syzkaller #0 [ 140.648265][ T5239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 140.658338][ T5239] Call Trace: [ 140.661623][ T5239] [ 140.664562][ T5239] dump_stack_lvl+0x188/0x24e [ 140.669273][ T5239] ? __might_fault+0xa6/0x120 [ 140.673963][ T5239] ? show_regs_print_info+0x12/0x12 [ 140.679180][ T5239] ? load_image+0x410/0x410 [ 140.683697][ T5239] ? tomoyo_path_number_perm+0x5a4/0x650 [ 140.689350][ T5239] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 140.694833][ T5239] ? __might_fault+0xa6/0x120 [ 140.699536][ T5239] ? __might_fault+0xc2/0x120 [ 140.704230][ T5239] ? __might_fault+0xa6/0x120 [ 140.708931][ T5239] mtrr_add+0x8e/0xc0 [ 140.712945][ T5239] mtrr_ioctl+0x9bf/0x1140 [ 140.717395][ T5239] ? mtrr_close+0x1f0/0x1f0 [ 140.721931][ T5239] ? __fget_files+0x28/0x460 [ 140.726554][ T5239] ? mtrr_close+0x1f0/0x1f0 [ 140.731077][ T5239] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 140.736564][ T5239] ? proc_reg_poll+0x280/0x280 [ 140.741348][ T5239] __se_sys_ioctl+0xfa/0x170 [ 140.745958][ T5239] do_syscall_64+0x4c/0xa0 [ 140.750368][ T5239] ? clear_bhb_loop+0x60/0xb0 [ 140.755071][ T5239] ? clear_bhb_loop+0x60/0xb0 [ 140.759775][ T5239] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 140.765692][ T5239] RIP: 0033:0x7f42d659e159 [ 140.770119][ T5239] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.789822][ T5239] RSP: 002b:00007f42d7442028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.798240][ T5239] RAX: ffffffffffffffda RBX: 00007f42d6826180 RCX: 00007f42d659e159 [ 140.806208][ T5239] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 140.814175][ T5239] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 140.822143][ T5239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.830112][ T5239] R13: 00007f42d6826218 R14: 00007f42d6826180 R15: 00007ffe37305e28 [ 140.838097][ T5239] [ 141.440645][ T5244] netlink: 'syz.0.264': attribute type 4 has an invalid length. [ 141.927870][ T5248] netlink: 76 bytes leftover after parsing attributes in process `syz.4.269'. [ 141.937653][ T5248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.269'. [ 141.946826][ T5248] netlink: 20 bytes leftover after parsing attributes in process `syz.4.269'. [ 141.955763][ T5248] netlink: 20 bytes leftover after parsing attributes in process `syz.4.269'. [ 144.787968][ T5264] syz.1.274 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 144.825614][ T5264] CPU: 0 PID: 5264 Comm: syz.1.274 Not tainted syzkaller #0 [ 144.832956][ T5264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.843031][ T5264] Call Trace: [ 144.846330][ T5264] [ 144.849284][ T5264] dump_stack_lvl+0x188/0x24e [ 144.853997][ T5264] ? ___ratelimit+0x14e/0x610 [ 144.858703][ T5264] ? show_regs_print_info+0x12/0x12 [ 144.863932][ T5264] ? load_image+0x410/0x410 [ 144.868461][ T5264] ? ___ratelimit+0x474/0x610 [ 144.873170][ T5264] ? radix_tree_cpu_dead+0x160/0x160 [ 144.878482][ T5264] dump_header+0xd8/0x820 [ 144.882853][ T5264] oom_kill_process+0x361/0x550 [ 144.887729][ T5264] out_of_memory+0xe25/0x1220 [ 144.892431][ T5264] ? print_unlock_imbalance_bug+0x160/0x160 [ 144.898349][ T5264] ? mutex_lock_nested+0x10/0x10 [ 144.903309][ T5264] ? unregister_oom_notifier+0x20/0x20 [ 144.908795][ T5264] mem_cgroup_out_of_memory+0x2c0/0x390 [ 144.914370][ T5264] ? mem_cgroup_oom_trylock+0x210/0x210 [ 144.919953][ T5264] ? do_raw_spin_unlock+0x11d/0x230 [ 144.925189][ T5264] try_charge_memcg+0xc9d/0x17c0 [ 144.930176][ T5264] ? percpu_ref_put+0x180/0x180 [ 144.935053][ T5264] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 144.940806][ T5264] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 144.946818][ T5264] ? percpu_ref_tryget+0x15/0x180 [ 144.951867][ T5264] ? percpu_ref_tryget+0x15/0x180 [ 144.956917][ T5264] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 144.962665][ T5264] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 144.968416][ T5264] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 144.974252][ T5264] obj_cgroup_charge+0x36a/0x620 [ 144.979214][ T5264] ? obj_cgroup_charge+0xe9/0x620 [ 144.984261][ T5264] ? mod_objcg_mlstate+0x320/0x320 [ 144.989408][ T5264] ? percpu_ref_put+0x12/0x100 [ 144.994198][ T5264] ? percpu_ref_put+0x12/0x100 [ 144.998989][ T5264] slab_pre_alloc_hook+0x2e2/0x300 [ 145.004119][ T5264] ? slab_pre_alloc_hook+0xb1/0x300 [ 145.009342][ T5264] kmem_cache_alloc_lru+0x49/0x2e0 [ 145.014471][ T5264] ? sock_alloc_inode+0x24/0xc0 [ 145.019354][ T5264] sock_alloc_inode+0x24/0xc0 [ 145.024046][ T5264] ? sockfs_init_fs_context+0xa0/0xa0 [ 145.029435][ T5264] new_inode_pseudo+0x5f/0x1c0 [ 145.034225][ T5264] sock_create_lite+0x87/0x500 [ 145.039015][ T5264] __netlink_kernel_create+0xf7/0x7b0 [ 145.044422][ T5264] ? netlink_set_err+0x3b0/0x3b0 [ 145.049395][ T5264] ? memset+0x1e/0x40 [ 145.053396][ T5264] ? lockdep_init_map_type+0x98/0x8d0 [ 145.058795][ T5264] ? rtnetlink_net_init+0xa1/0x140 [ 145.063932][ T5264] rtnetlink_net_init+0xb0/0x140 [ 145.068889][ T5264] ? nlmsg_populate_fdb_fill+0x620/0x620 [ 145.074537][ T5264] ? rtnetlink_net_exit+0x60/0x60 [ 145.079577][ T5264] ? rtnetlink_rcv+0x20/0x20 [ 145.084194][ T5264] ops_init+0x360/0x5e0 [ 145.088382][ T5264] setup_net+0x4f2/0xbd0 [ 145.092651][ T5264] ? copy_net_ns+0x5b0/0x5b0 [ 145.097269][ T5264] ? down_read_killable+0x1cc/0x340 [ 145.102496][ T5264] copy_net_ns+0x33e/0x5b0 [ 145.106952][ T5264] create_new_namespaces+0x3ce/0x700 [ 145.112266][ T5264] ? copy_namespaces+0x55/0x410 [ 145.117134][ T5264] copy_namespaces+0x3ae/0x410 [ 145.121920][ T5264] copy_process+0x199b/0x4070 [ 145.126618][ T5264] ? plist_add+0x3d7/0x490 [ 145.131074][ T5264] ? copy_process+0x974/0x4070 [ 145.135864][ T5264] ? futex_wait+0x4a3/0x5c0 [ 145.140402][ T5264] ? idle_dummy+0x10/0x10 [ 145.144764][ T5264] kernel_clone+0x24b/0x900 [ 145.149291][ T5264] ? create_io_thread+0x170/0x170 [ 145.154351][ T5264] ? do_futex+0x310/0x320 [ 145.158791][ T5264] __x64_sys_clone+0x1a7/0x220 [ 145.163578][ T5264] ? __ia32_sys_vfork+0x140/0x140 [ 145.168633][ T5264] ? lock_chain_count+0x20/0x20 [ 145.173520][ T5264] ? lockdep_hardirqs_on+0x94/0x140 [ 145.178745][ T5264] do_syscall_64+0x4c/0xa0 [ 145.183188][ T5264] ? clear_bhb_loop+0x60/0xb0 [ 145.187890][ T5264] ? clear_bhb_loop+0x60/0xb0 [ 145.192591][ T5264] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 145.198510][ T5264] RIP: 0033:0x7fe35719e159 [ 145.202941][ T5264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.222564][ T5264] RSP: 002b:00007fe357ffefd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 145.230993][ T5264] RAX: ffffffffffffffda RBX: 00007fe357425fa0 RCX: 00007fe35719e159 [ 145.238982][ T5264] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 145.246971][ T5264] RBP: 00007fe357235024 R08: 0000000000000000 R09: 0000000000000000 [ 145.254959][ T5264] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 145.262945][ T5264] R13: 00007fe357426038 R14: 00007fe357425fa0 R15: 00007ffc73b70308 [ 145.270953][ T5264] [ 145.466584][ T5264] memory: usage 96kB, limit 96kB, failcnt 41 [ 145.497616][ T5264] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 145.609730][ T5264] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 145.690346][ T5264] Memory cgroup stats for /syz1/test: [ 145.694226][ T5264] anon 0 [ 145.694226][ T5264] file 0 [ 145.694226][ T5264] kernel 98304 [ 145.694226][ T5264] kernel_stack 32768 [ 145.694226][ T5264] pagetables 8192 [ 145.694226][ T5264] sec_pagetables 0 [ 145.694226][ T5264] percpu 0 [ 145.694226][ T5264] sock 0 [ 145.694226][ T5264] vmalloc 0 [ 145.694226][ T5264] shmem 0 [ 145.694226][ T5264] zswap 0 [ 145.694226][ T5264] zswapped 0 [ 145.694226][ T5264] file_mapped 0 [ 145.694226][ T5264] file_dirty 0 [ 145.694226][ T5264] file_writeback 0 [ 145.694226][ T5264] swapcached 0 [ 145.694226][ T5264] anon_thp 0 [ 145.694226][ T5264] file_thp 0 [ 145.694226][ T5264] shmem_thp 0 [ 145.694226][ T5264] inactive_anon 0 [ 145.694226][ T5264] active_anon 0 [ 145.694226][ T5264] inactive_file 0 [ 145.694226][ T5264] active_file 0 [ 145.694226][ T5264] unevictable 0 [ 145.694226][ T5264] slab_reclaimable 5784 [ 145.694226][ T5264] slab_unreclaimable 42504 [ 145.694226][ T5264] slab 48288 [ 146.156332][ T14] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 146.352504][ T14] usb 4-1: Using ep0 maxpacket: 32 [ 146.366317][ T14] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 146.407738][ T14] usb 4-1: config 0 has no interfaces? [ 146.427576][ T14] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 146.427607][ T14] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.449376][ T14] usb 4-1: config 0 descriptor?? [ 146.722957][ T5301] fuse: Bad value for 'fd' [ 146.772593][ T5264] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.274,pid=5263,uid=0 [ 146.800397][ T26] usb 4-1: USB disconnect, device number 7 [ 146.843336][ T5264] Memory cgroup out of memory: Killed process 5264 (syz.1.274) total-vm:102244kB, anon-rss:1420kB, file-rss:22496kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 147.238616][ T5318] kAFS: No cell specified [ 147.568153][ T5327] size and base must be multiples of 4 kiB [ 147.625835][ T5327] CPU: 0 PID: 5327 Comm: syz.2.287 Not tainted syzkaller #0 [ 147.633185][ T5327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 147.643258][ T5327] Call Trace: [ 147.646538][ T5327] [ 147.649494][ T5327] dump_stack_lvl+0x188/0x24e [ 147.654196][ T5327] ? __might_fault+0xa6/0x120 [ 147.658899][ T5327] ? show_regs_print_info+0x12/0x12 [ 147.664128][ T5327] ? load_image+0x410/0x410 [ 147.668631][ T5327] ? tomoyo_path_number_perm+0x5a4/0x650 [ 147.674304][ T5327] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 147.679791][ T5327] ? __might_fault+0xa6/0x120 [ 147.684479][ T5327] ? __might_fault+0xc2/0x120 [ 147.689168][ T5327] ? __might_fault+0xa6/0x120 [ 147.693863][ T5327] mtrr_add+0x8e/0xc0 [ 147.697863][ T5327] mtrr_ioctl+0x9bf/0x1140 [ 147.702291][ T5327] ? mtrr_close+0x1f0/0x1f0 [ 147.706820][ T5327] ? __fget_files+0x28/0x460 [ 147.711414][ T5327] ? mtrr_close+0x1f0/0x1f0 [ 147.715917][ T5327] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 147.721406][ T5327] ? proc_reg_poll+0x280/0x280 [ 147.726189][ T5327] __se_sys_ioctl+0xfa/0x170 [ 147.730805][ T5327] do_syscall_64+0x4c/0xa0 [ 147.735239][ T5327] ? clear_bhb_loop+0x60/0xb0 [ 147.739925][ T5327] ? clear_bhb_loop+0x60/0xb0 [ 147.744607][ T5327] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 147.750530][ T5327] RIP: 0033:0x7f0b4c19e159 [ 147.754955][ T5327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.774578][ T5327] RSP: 002b:00007f0b4a3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 147.782991][ T5327] RAX: ffffffffffffffda RBX: 00007f0b4c426180 RCX: 00007f0b4c19e159 [ 147.790960][ T5327] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 147.798937][ T5327] RBP: 00007f0b4c235024 R08: 0000000000000000 R09: 0000000000000000 [ 147.806996][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.814960][ T5327] R13: 00007f0b4c426218 R14: 00007f0b4c426180 R15: 00007ffd002a3798 [ 147.822943][ T5327] [ 148.478383][ T5339] netlink: 'syz.3.291': attribute type 1 has an invalid length. [ 148.722982][ T5343] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 148.863159][ T5343] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 149.293060][ T5343] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 149.302101][ T5343] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 149.477155][ T5343] bond1: (slave geneve2): making interface the new active one [ 149.699583][ T5343] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 149.884948][ T5349] netlink: 4 bytes leftover after parsing attributes in process `syz.1.292'. [ 149.893850][ T5349] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 150.361918][ T5360] kAFS: No cell specified [ 150.453050][ T5359] syz.1.296 invoked oom-killer: gfp_mask=0xdc0(GFP_KERNEL|__GFP_ZERO), order=1, oom_score_adj=1000 [ 151.728110][ T5359] CPU: 1 PID: 5359 Comm: syz.1.296 Not tainted syzkaller #0 [ 151.735467][ T5359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 151.745538][ T5359] Call Trace: [ 151.748827][ T5359] [ 151.751774][ T5359] dump_stack_lvl+0x188/0x24e [ 151.756479][ T5359] ? ___ratelimit+0x14e/0x610 [ 151.761177][ T5359] ? show_regs_print_info+0x12/0x12 [ 151.766426][ T5359] ? load_image+0x410/0x410 [ 151.770931][ T5359] ? ___ratelimit+0x474/0x610 [ 151.775597][ T5359] ? radix_tree_cpu_dead+0x160/0x160 [ 151.780869][ T5359] dump_header+0xd8/0x820 [ 151.785208][ T5359] oom_kill_process+0x361/0x550 [ 151.790082][ T5359] out_of_memory+0xe25/0x1220 [ 151.794790][ T5359] ? mutex_lock_nested+0x10/0x10 [ 151.799750][ T5359] ? unregister_oom_notifier+0x20/0x20 [ 151.805238][ T5359] mem_cgroup_out_of_memory+0x2c0/0x390 [ 151.810814][ T5359] ? mem_cgroup_oom_trylock+0x210/0x210 [ 151.816397][ T5359] ? do_raw_spin_unlock+0x11d/0x230 [ 151.821627][ T5359] try_charge_memcg+0xc9d/0x17c0 [ 151.826616][ T5359] ? percpu_ref_put+0x180/0x180 [ 151.831496][ T5359] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 151.837344][ T5359] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 151.843354][ T5359] ? percpu_ref_tryget+0x15/0x180 [ 151.848408][ T5359] ? percpu_ref_tryget+0x15/0x180 [ 151.853474][ T5359] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 151.859235][ T5359] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 151.864992][ T5359] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 151.870827][ T5359] obj_cgroup_charge+0x36a/0x620 [ 151.875797][ T5359] ? obj_cgroup_charge+0xe9/0x620 [ 151.880844][ T5359] ? mod_objcg_mlstate+0x320/0x320 [ 151.885981][ T5359] ? get_obj_cgroup_from_current+0xd0/0x280 [ 151.891942][ T5359] ? get_obj_cgroup_from_current+0xd0/0x280 [ 151.897873][ T5359] slab_pre_alloc_hook+0x2e2/0x300 [ 151.903010][ T5359] ? __kmem_cache_alloc_node+0x19d/0x270 [ 151.908669][ T5359] kmem_cache_alloc+0x56/0x2f0 [ 151.913465][ T5359] ? copy_net_ns+0x13c/0x5b0 [ 151.918092][ T5359] copy_net_ns+0x13c/0x5b0 [ 151.922543][ T5359] create_new_namespaces+0x3ce/0x700 [ 151.927861][ T5359] ? copy_namespaces+0x55/0x410 [ 151.932732][ T5359] copy_namespaces+0x3ae/0x410 [ 151.937521][ T5359] copy_process+0x199b/0x4070 [ 151.942236][ T5359] ? plist_add+0x3d7/0x490 [ 151.946693][ T5359] ? copy_process+0x974/0x4070 [ 151.951480][ T5359] ? futex_wait+0x4a3/0x5c0 [ 151.956010][ T5359] ? idle_dummy+0x10/0x10 [ 151.960720][ T5359] kernel_clone+0x24b/0x900 [ 151.965255][ T5359] ? create_io_thread+0x170/0x170 [ 151.970312][ T5359] ? do_futex+0x310/0x320 [ 151.974669][ T5359] __x64_sys_clone+0x1a7/0x220 [ 151.979459][ T5359] ? __ia32_sys_vfork+0x140/0x140 [ 151.984515][ T5359] ? lock_chain_count+0x20/0x20 [ 151.989404][ T5359] ? lockdep_hardirqs_on+0x94/0x140 [ 151.994640][ T5359] do_syscall_64+0x4c/0xa0 [ 151.999087][ T5359] ? clear_bhb_loop+0x60/0xb0 [ 152.003797][ T5359] ? clear_bhb_loop+0x60/0xb0 [ 152.008939][ T5359] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 152.014870][ T5359] RIP: 0033:0x7fe35719e159 [ 152.019309][ T5359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.038927][ T5359] RSP: 002b:00007fe357ffefd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 152.047394][ T5359] RAX: ffffffffffffffda RBX: 00007fe357425fa0 RCX: 00007fe35719e159 [ 152.055387][ T5359] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 152.063372][ T5359] RBP: 00007fe357235024 R08: 0000000000000000 R09: 0000000000000000 [ 152.071355][ T5359] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 152.079334][ T5359] R13: 00007fe357426038 R14: 00007fe357425fa0 R15: 00007ffc73b70308 [ 152.087333][ T5359] [ 152.206396][ T5374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.256317][ T5374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.532725][ T5359] memory: usage 96kB, limit 96kB, failcnt 96 [ 152.552160][ T5359] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 152.592315][ T5359] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 152.742345][ T5359] Memory cgroup stats for /syz1/test: [ 152.742627][ T5359] anon 0 [ 152.742627][ T5359] file 0 [ 152.742627][ T5359] kernel 98304 [ 152.742627][ T5359] kernel_stack 32768 [ 152.742627][ T5359] pagetables 8192 [ 152.742627][ T5359] sec_pagetables 0 [ 152.742627][ T5359] percpu 0 [ 152.742627][ T5359] sock 0 [ 152.742627][ T5359] vmalloc 0 [ 152.742627][ T5359] shmem 0 [ 152.742627][ T5359] zswap 0 [ 152.742627][ T5359] zswapped 0 [ 152.742627][ T5359] file_mapped 0 [ 152.742627][ T5359] file_dirty 0 [ 152.742627][ T5359] file_writeback 0 [ 152.742627][ T5359] swapcached 0 [ 152.742627][ T5359] anon_thp 0 [ 152.742627][ T5359] file_thp 0 [ 152.742627][ T5359] shmem_thp 0 [ 152.742627][ T5359] inactive_anon 0 [ 152.742627][ T5359] active_anon 0 [ 152.742627][ T5359] inactive_file 0 [ 152.742627][ T5359] active_file 0 [ 152.742627][ T5359] unevictable 0 [ 152.742627][ T5359] slab_reclaimable 5784 [ 152.742627][ T5359] slab_unreclaimable 41472 [ 152.742627][ T5359] slab 47256 [ 153.037906][ T5382] loop0: detected capacity change from 0 to 4096 [ 153.144296][ T5382] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 153.162477][ T4312] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 153.170127][ T5382] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 153.174147][ T5387] fuse: Bad value for 'fd' [ 153.193153][ T5382] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 153.199931][ T5382] loop0: [ 153.352417][ T4312] usb 5-1: Using ep0 maxpacket: 8 [ 153.360195][ T4312] usb 5-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 153.391866][ T4312] usb 5-1: config 1 interface 0 has no altsetting 0 [ 153.447126][ T5359] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.296,pid=5358,uid=0 [ 153.535411][ T5359] Memory cgroup out of memory: Killed process 5359 (syz.1.296) total-vm:102244kB, anon-rss:1420kB, file-rss:22488kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 153.584444][ T4312] usb 5-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 153.594106][ T4312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.602570][ T4312] usb 5-1: Product: syz [ 153.606864][ T4312] usb 5-1: Manufacturer: syz [ 153.611521][ T4312] usb 5-1: SerialNumber: syz [ 153.678381][ T5400] netlink: 4 bytes leftover after parsing attributes in process `syz.0.306'. [ 153.687299][ T5400] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 154.273665][ T4312] usbhid 5-1:1.0: can't add hid device: -71 [ 155.472128][ T4312] usbhid: probe of 5-1:1.0 failed with error -71 [ 157.765604][ T4312] usb 5-1: USB disconnect, device number 5 [ 158.317644][ T7] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 158.487271][ T7] usb 2-1: device descriptor read/64, error -71 [ 158.498119][ T5427] size and base must be multiples of 4 kiB [ 158.535012][ T5427] CPU: 0 PID: 5427 Comm: syz.4.315 Not tainted syzkaller #0 [ 158.542355][ T5427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.552427][ T5427] Call Trace: [ 158.555712][ T5427] [ 158.558649][ T5427] dump_stack_lvl+0x188/0x24e [ 158.563345][ T5427] ? __might_fault+0xa6/0x120 [ 158.568030][ T5427] ? show_regs_print_info+0x12/0x12 [ 158.573258][ T5427] ? load_image+0x410/0x410 [ 158.577761][ T5427] ? tomoyo_path_number_perm+0x5a4/0x650 [ 158.583397][ T5427] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 158.588858][ T5427] ? __might_fault+0xa6/0x120 [ 158.593531][ T5427] ? __might_fault+0xc2/0x120 [ 158.598204][ T5427] ? __might_fault+0xa6/0x120 [ 158.602879][ T5427] mtrr_add+0x8e/0xc0 [ 158.606868][ T5427] mtrr_ioctl+0x9bf/0x1140 [ 158.611290][ T5427] ? mtrr_close+0x1f0/0x1f0 [ 158.615803][ T5427] ? __fget_files+0x28/0x460 [ 158.620404][ T5427] ? mtrr_close+0x1f0/0x1f0 [ 158.624909][ T5427] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 158.630377][ T5427] ? proc_reg_poll+0x280/0x280 [ 158.635142][ T5427] __se_sys_ioctl+0xfa/0x170 [ 158.639731][ T5427] do_syscall_64+0x4c/0xa0 [ 158.644152][ T5427] ? clear_bhb_loop+0x60/0xb0 [ 158.648832][ T5427] ? clear_bhb_loop+0x60/0xb0 [ 158.653512][ T5427] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 158.659408][ T5427] RIP: 0033:0x7fe90959e159 [ 158.663823][ T5427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.683428][ T5427] RSP: 002b:00007fe90a511028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 158.691839][ T5427] RAX: ffffffffffffffda RBX: 00007fe909826180 RCX: 00007fe90959e159 [ 158.699810][ T5427] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 158.707778][ T5427] RBP: 00007fe909635024 R08: 0000000000000000 R09: 0000000000000000 [ 158.715766][ T5427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.723733][ T5427] R13: 00007fe909826218 R14: 00007fe909826180 R15: 00007ffcca38c478 [ 158.731815][ T5427] [ 158.849806][ T5430] netlink: 'syz.4.315': attribute type 4 has an invalid length. [ 158.892294][ T7] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 159.085472][ T7] usb 2-1: device descriptor read/64, error -71 [ 159.218644][ T7] usb usb2-port1: attempt power cycle [ 159.298879][ T27] audit: type=1800 audit(1788284897.571:29): pid=5441 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.316" name="memory_backed" dev="configfs" ino=116851 res=0 errno=0 [ 159.633834][ T27] audit: type=1800 audit(1788284897.571:30): pid=5441 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.316" name="power" dev="configfs" ino=116852 res=0 errno=0 [ 159.742433][ T7] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 159.815261][ T7] usb 2-1: device descriptor read/8, error -71 [ 160.038240][ T5449] fuse: Bad value for 'fd' [ 160.127211][ T7] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 160.167920][ T7] usb 2-1: device descriptor read/8, error -71 [ 160.415154][ T7] usb usb2-port1: unable to enumerate USB device [ 160.483239][ T5460] trusted_key: encrypted_key: insufficient parameters specified [ 161.681912][ T5481] fuse: Bad value for 'fd' [ 164.033036][ T5497] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.042694][ T5497] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.493593][ T5504] trusted_key: encrypted_key: insufficient parameters specified [ 165.491045][ T5518] fuse: Invalid rootmode [ 167.130870][ T5535] loop0: detected capacity change from 0 to 4096 [ 169.333590][ T5556] size and base must be multiples of 4 kiB [ 169.516215][ T5561] netlink: 'syz.0.349': attribute type 4 has an invalid length. [ 169.545739][ T5556] CPU: 0 PID: 5556 Comm: syz.0.349 Not tainted syzkaller #0 [ 169.553085][ T5556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 169.563158][ T5556] Call Trace: [ 169.566451][ T5556] [ 169.569397][ T5556] dump_stack_lvl+0x188/0x24e [ 169.574114][ T5556] ? __might_fault+0xa6/0x120 [ 169.578820][ T5556] ? show_regs_print_info+0x12/0x12 [ 169.584050][ T5556] ? load_image+0x410/0x410 [ 169.588576][ T5556] ? tomoyo_path_number_perm+0x5a4/0x650 [ 169.594241][ T5556] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 169.599721][ T5556] ? __might_fault+0xa6/0x120 [ 169.604418][ T5556] ? __might_fault+0xc2/0x120 [ 169.609115][ T5556] ? __might_fault+0xa6/0x120 [ 169.613817][ T5556] mtrr_add+0x8e/0xc0 [ 169.617850][ T5556] mtrr_ioctl+0x9bf/0x1140 [ 169.622496][ T5556] ? mtrr_close+0x1f0/0x1f0 [ 169.627042][ T5556] ? __fget_files+0x28/0x460 [ 169.631674][ T5556] ? mtrr_close+0x1f0/0x1f0 [ 169.636206][ T5556] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 169.641731][ T5556] ? proc_reg_poll+0x280/0x280 [ 169.646528][ T5556] __se_sys_ioctl+0xfa/0x170 [ 169.651153][ T5556] do_syscall_64+0x4c/0xa0 [ 169.655637][ T5556] ? clear_bhb_loop+0x60/0xb0 [ 169.660328][ T5556] ? clear_bhb_loop+0x60/0xb0 [ 169.665011][ T5556] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 169.670904][ T5556] RIP: 0033:0x7f42d659e159 [ 169.675315][ T5556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 169.694925][ T5556] RSP: 002b:00007f42d7442028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 169.703374][ T5556] RAX: ffffffffffffffda RBX: 00007f42d6826180 RCX: 00007f42d659e159 [ 169.711346][ T5556] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 169.719316][ T5556] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 169.727284][ T5556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 169.735258][ T5556] R13: 00007f42d6826218 R14: 00007f42d6826180 R15: 00007ffe37305e28 [ 169.743240][ T5556] [ 169.834446][ T5565] fuse: Invalid rootmode [ 170.537781][ T5579] netlink: 16 bytes leftover after parsing attributes in process `syz.1.359'. [ 171.994543][ T5589] loop0: detected capacity change from 0 to 4096 [ 172.155646][ T5589] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 172.172569][ T5589] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 172.802460][ T5589] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 172.819365][ T5589] loop0: [ 173.362882][ T5610] fuse: Invalid rootmode [ 173.988922][ T27] audit: type=1326 audit(1788284912.261:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 174.069916][ T27] audit: type=1326 audit(1788284912.301:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 174.094947][ T27] audit: type=1326 audit(1788284912.301:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 174.777216][ T27] audit: type=1326 audit(1788284912.321:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=81 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 174.873449][ T27] audit: type=1326 audit(1788284912.321:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 174.959800][ T27] audit: type=1326 audit(1788284912.321:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 175.011758][ T5627] wg0 speed is unknown, defaulting to 1000 [ 175.022086][ T5627] wg0 speed is unknown, defaulting to 1000 [ 175.028877][ T5627] wg0 speed is unknown, defaulting to 1000 [ 175.086624][ T5627] infiniband syz2: set active [ 175.087148][ T5632] netlink: 92 bytes leftover after parsing attributes in process `syz.4.377'. [ 175.091751][ T5627] infiniband syz2: added wg0 [ 175.112642][ T126] wg0 speed is unknown, defaulting to 1000 [ 176.062271][ T27] audit: type=1326 audit(1788284912.321:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 176.086182][ C0] vkms_vblank_simulate: vblank timer overrun [ 176.117298][ T27] audit: type=1326 audit(1788284912.321:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5615 comm="syz.1.373" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fe35719e159 code=0x7ffc0000 [ 176.141225][ C0] vkms_vblank_simulate: vblank timer overrun [ 176.159981][ T5627] RDS/IB: syz2: added [ 176.165129][ T5627] smc: adding ib device syz2 with port count 1 [ 176.171498][ T5627] smc: ib device syz2 port 1 has pnetid [ 176.179811][ T5627] wg0 speed is unknown, defaulting to 1000 [ 176.277770][ T5627] wg0 speed is unknown, defaulting to 1000 [ 176.384434][ T5627] wg0 speed is unknown, defaulting to 1000 [ 176.780688][ T5627] wg0 speed is unknown, defaulting to 1000 [ 177.033388][ T5627] wg0 speed is unknown, defaulting to 1000 [ 177.132139][ T7] wg0 speed is unknown, defaulting to 1000 [ 177.215913][ T5645] netlink: 'syz.3.365': attribute type 4 has an invalid length. [ 177.729173][ T5654] fuse: Bad value for 'rootmode' [ 177.734869][ T7] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 178.657203][ T7] usb 5-1: device descriptor read/all, error -71 [ 178.750648][ T5666] size and base must be multiples of 4 kiB [ 178.757535][ T5666] CPU: 0 PID: 5666 Comm: syz.3.386 Not tainted syzkaller #0 [ 178.764842][ T5666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 178.774894][ T5666] Call Trace: [ 178.778171][ T5666] [ 178.781098][ T5666] dump_stack_lvl+0x188/0x24e [ 178.785787][ T5666] ? __might_fault+0xa6/0x120 [ 178.790463][ T5666] ? show_regs_print_info+0x12/0x12 [ 178.795666][ T5666] ? load_image+0x410/0x410 [ 178.800165][ T5666] ? tomoyo_path_number_perm+0x5a4/0x650 [ 178.805799][ T5666] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 178.811255][ T5666] ? __might_fault+0xa6/0x120 [ 178.815927][ T5666] ? __might_fault+0xc2/0x120 [ 178.820598][ T5666] ? __might_fault+0xa6/0x120 [ 178.825271][ T5666] mtrr_add+0x8e/0xc0 [ 178.829255][ T5666] mtrr_ioctl+0x9bf/0x1140 [ 178.833676][ T5666] ? mtrr_close+0x1f0/0x1f0 [ 178.838189][ T5666] ? __fget_files+0x28/0x460 [ 178.842789][ T5666] ? mtrr_close+0x1f0/0x1f0 [ 178.847294][ T5666] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 178.852797][ T5666] ? proc_reg_poll+0x280/0x280 [ 178.857567][ T5666] __se_sys_ioctl+0xfa/0x170 [ 178.862162][ T5666] do_syscall_64+0x4c/0xa0 [ 178.866585][ T5666] ? clear_bhb_loop+0x60/0xb0 [ 178.871265][ T5666] ? clear_bhb_loop+0x60/0xb0 [ 178.875953][ T5666] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 178.881853][ T5666] RIP: 0033:0x7f167cb9e159 [ 178.886284][ T5666] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.905909][ T5666] RSP: 002b:00007f167adb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 178.914321][ T5666] RAX: ffffffffffffffda RBX: 00007f167ce26180 RCX: 00007f167cb9e159 [ 178.922290][ T5666] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 178.930277][ T5666] RBP: 00007f167cc35024 R08: 0000000000000000 R09: 0000000000000000 [ 178.938246][ T5666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.946231][ T5666] R13: 00007f167ce26218 R14: 00007f167ce26180 R15: 00007ffc86fa3358 [ 178.954219][ T5666] [ 178.957382][ C0] vkms_vblank_simulate: vblank timer overrun [ 178.969464][ T5666] netlink: 'syz.3.386': attribute type 4 has an invalid length. [ 180.567903][ T5682] tipc: Enabling of bearer rejected, failed to enable media [ 181.227825][ T5694] netlink: 'syz.3.394': attribute type 4 has an invalid length. [ 181.849084][ T5698] FAULT_INJECTION: forcing a failure. [ 181.849084][ T5698] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 181.863490][ T5698] CPU: 1 PID: 5698 Comm: syz.4.396 Not tainted syzkaller #0 [ 181.870818][ T5698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 181.880889][ T5698] Call Trace: [ 181.884180][ T5698] [ 181.887126][ T5698] dump_stack_lvl+0x188/0x24e [ 181.891832][ T5698] ? show_regs_print_info+0x12/0x12 [ 181.897053][ T5698] ? load_image+0x410/0x410 [ 181.901588][ T5698] ? __lock_acquire+0x7c40/0x7c40 [ 181.906658][ T5698] should_fail_ex+0x390/0x4c0 [ 181.911363][ T5698] prepare_alloc_pages+0x1e1/0x5b0 [ 181.916508][ T5698] __alloc_pages+0x130/0x4f0 [ 181.921128][ T5698] ? zone_statistics+0x170/0x170 [ 181.926098][ T5698] ? __lock_acquire+0x7c40/0x7c40 [ 181.931164][ T5698] __folio_alloc+0xe/0x30 [ 181.935518][ T5698] vma_alloc_folio+0x499/0x900 [ 181.940380][ T5698] handle_mm_fault+0x1fe3/0x3d40 [ 181.945354][ T5698] ? numa_migrate_prep+0x250/0x250 [ 181.950476][ T5698] ? vma_is_secretmem+0x9/0x40 [ 181.955242][ T5698] ? check_vma_flags+0x340/0x4c0 [ 181.960555][ T5698] __get_user_pages+0x40d/0xec0 [ 181.965453][ T5698] ? populate_vma_page_range+0x2b0/0x2b0 [ 181.971092][ T5698] ? __might_sleep+0xd0/0xd0 [ 181.975679][ T5698] ? read_lock_is_recursive+0x10/0x10 [ 181.981062][ T5698] __get_user_pages_remote+0x1c2/0x730 [ 181.986530][ T5698] ? get_user_pages_remote+0x55/0xa0 [ 181.991819][ T5698] get_arg_page+0x1ca/0x410 [ 181.996337][ T5698] ? copy_string_kernel+0x220/0x220 [ 182.001541][ T5698] ? up_write+0x1b6/0x410 [ 182.005873][ T5698] ? alloc_bprm+0x37a/0x710 [ 182.010381][ T5698] copy_string_kernel+0x161/0x220 [ 182.015411][ T5698] do_execveat_common+0x35d/0x6b0 [ 182.020442][ T5698] __x64_sys_execve+0x8e/0xa0 [ 182.025128][ T5698] do_syscall_64+0x4c/0xa0 [ 182.029550][ T5698] ? clear_bhb_loop+0x60/0xb0 [ 182.034231][ T5698] ? clear_bhb_loop+0x60/0xb0 [ 182.038918][ T5698] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 182.044816][ T5698] RIP: 0033:0x7fe90959e159 [ 182.049227][ T5698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.068834][ T5698] RSP: 002b:00007fe90a553028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 182.077245][ T5698] RAX: ffffffffffffffda RBX: 00007fe909825fa0 RCX: 00007fe90959e159 [ 182.085258][ T5698] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 182.093238][ T5698] RBP: 00007fe909635024 R08: 0000000000000000 R09: 0000000000000000 [ 182.101209][ T5698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.109211][ T5698] R13: 00007fe909826038 R14: 00007fe909825fa0 R15: 00007ffcca38c478 [ 182.117215][ T5698] [ 182.999719][ T5709] rdma_rxe: rxe_register_device failed with error -23 [ 183.006864][ T5709] rdma_rxe: failed to add wg0 [ 183.014166][ T5709] netlink: 92 bytes leftover after parsing attributes in process `syz.2.398'. [ 183.187588][ T5715] size and base must be multiples of 4 kiB [ 183.193779][ T5715] CPU: 0 PID: 5715 Comm: syz.1.400 Not tainted syzkaller #0 [ 183.201204][ T5715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 183.211256][ T5715] Call Trace: [ 183.214533][ T5715] [ 183.217461][ T5715] dump_stack_lvl+0x188/0x24e [ 183.222147][ T5715] ? __might_fault+0xa6/0x120 [ 183.226827][ T5715] ? show_regs_print_info+0x12/0x12 [ 183.232033][ T5715] ? load_image+0x410/0x410 [ 183.236540][ T5715] ? tomoyo_path_number_perm+0x5a4/0x650 [ 183.242175][ T5715] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 183.247637][ T5715] ? __might_fault+0xa6/0x120 [ 183.252313][ T5715] ? __might_fault+0xc2/0x120 [ 183.256985][ T5715] ? __might_fault+0xa6/0x120 [ 183.261658][ T5715] mtrr_add+0x8e/0xc0 [ 183.265644][ T5715] mtrr_ioctl+0x9bf/0x1140 [ 183.270074][ T5715] ? mtrr_close+0x1f0/0x1f0 [ 183.274588][ T5715] ? __fget_files+0x28/0x460 [ 183.279187][ T5715] ? mtrr_close+0x1f0/0x1f0 [ 183.283692][ T5715] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 183.289160][ T5715] ? proc_reg_poll+0x280/0x280 [ 183.293935][ T5715] __se_sys_ioctl+0xfa/0x170 [ 183.298620][ T5715] do_syscall_64+0x4c/0xa0 [ 183.303041][ T5715] ? clear_bhb_loop+0x60/0xb0 [ 183.307729][ T5715] ? clear_bhb_loop+0x60/0xb0 [ 183.312413][ T5715] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 183.318308][ T5715] RIP: 0033:0x7fe35719e159 [ 183.322723][ T5715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.342335][ T5715] RSP: 002b:00007fe357fbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 183.350748][ T5715] RAX: ffffffffffffffda RBX: 00007fe357426180 RCX: 00007fe35719e159 [ 183.358717][ T5715] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 183.366683][ T5715] RBP: 00007fe357235024 R08: 0000000000000000 R09: 0000000000000000 [ 183.374648][ T5715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 183.382975][ T5715] R13: 00007fe357426218 R14: 00007fe357426180 R15: 00007ffc73b70308 [ 183.390978][ T5715] [ 183.394020][ C0] vkms_vblank_simulate: vblank timer overrun [ 183.636347][ T5711] netlink: 24 bytes leftover after parsing attributes in process `syz.4.399'. [ 183.680998][ T5715] netlink: 'syz.1.400': attribute type 4 has an invalid length. [ 184.413678][ T7] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 184.424912][ T5723] netdevsim0 speed is unknown, defaulting to 1000 [ 184.433799][ T5723] wg0 speed is unknown, defaulting to 1000 [ 184.603857][ T7] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.639354][ T7] usb 3-1: config 1 interface 1 altsetting 65 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 184.671644][ T7] usb 3-1: config 1 interface 1 has no altsetting 1 [ 184.690753][ T7] usb 3-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 184.715136][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.739004][ T7] usb 3-1: Product: syz [ 184.751067][ T7] usb 3-1: Manufacturer: syz [ 184.766495][ T7] usb 3-1: SerialNumber: syz [ 185.229154][ T4362] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 185.255821][ T7] usb 3-1: 1:65 : no or invalid class specific endpoint descriptor [ 185.983183][ T7] usb 3-1: USB disconnect, device number 6 [ 186.025169][ T4362] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 186.063973][ T4362] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 186.082516][ T4362] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 186.115307][ T4362] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.155527][ T4362] usb 4-1: Product: syz [ 186.160188][ T4362] usb 4-1: Manufacturer: syz [ 186.321729][ T4362] usb 4-1: SerialNumber: syz [ 186.576326][ T5747] netlink: 24 bytes leftover after parsing attributes in process `syz.4.412'. [ 186.695909][ T4667] udevd[4667]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 187.817982][ T4362] usb 4-1: can't set config #1, error -71 [ 187.845991][ T4362] usb 4-1: USB disconnect, device number 8 [ 188.148162][ T4283] Bluetooth: hci4: link tx timeout [ 188.154234][ T4283] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 188.332618][ T4362] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 188.342491][ T4312] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 188.398683][ T5777] size and base must be multiples of 4 kiB [ 188.422805][ T5777] CPU: 1 PID: 5777 Comm: syz.1.423 Not tainted syzkaller #0 [ 188.430141][ T5777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 188.440209][ T5777] Call Trace: [ 188.443494][ T5777] [ 188.446425][ T5777] dump_stack_lvl+0x188/0x24e [ 188.451111][ T5777] ? __might_fault+0xa6/0x120 [ 188.455785][ T5777] ? show_regs_print_info+0x12/0x12 [ 188.460986][ T5777] ? load_image+0x410/0x410 [ 188.465487][ T5777] ? tomoyo_path_number_perm+0x5a4/0x650 [ 188.471119][ T5777] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 188.476572][ T5777] ? __might_fault+0xa6/0x120 [ 188.481248][ T5777] ? __might_fault+0xc2/0x120 [ 188.485923][ T5777] ? __might_fault+0xa6/0x120 [ 188.490606][ T5777] mtrr_add+0x8e/0xc0 [ 188.494596][ T5777] mtrr_ioctl+0x9bf/0x1140 [ 188.499026][ T5777] ? mtrr_close+0x1f0/0x1f0 [ 188.503538][ T5777] ? __fget_files+0x28/0x460 [ 188.508141][ T5777] ? mtrr_close+0x1f0/0x1f0 [ 188.512645][ T5777] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 188.518108][ T5777] ? proc_reg_poll+0x280/0x280 [ 188.522874][ T5777] __se_sys_ioctl+0xfa/0x170 [ 188.527474][ T5777] do_syscall_64+0x4c/0xa0 [ 188.531896][ T5777] ? clear_bhb_loop+0x60/0xb0 [ 188.536592][ T5777] ? clear_bhb_loop+0x60/0xb0 [ 188.541272][ T5777] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 188.547166][ T5777] RIP: 0033:0x7fe35719e159 [ 188.551588][ T5777] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.571187][ T5777] RSP: 002b:00007fe357fbd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 188.579619][ T5777] RAX: ffffffffffffffda RBX: 00007fe357426180 RCX: 00007fe35719e159 [ 188.587598][ T5777] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 188.595571][ T5777] RBP: 00007fe357235024 R08: 0000000000000000 R09: 0000000000000000 [ 188.603543][ T5777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.611511][ T5777] R13: 00007fe357426218 R14: 00007fe357426180 R15: 00007ffc73b70308 [ 188.619502][ T5777] [ 188.744039][ T4312] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 188.758591][ T4312] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 188.798495][ T4312] usb 3-1: config 220 has an invalid descriptor of length 97, skipping remainder of the config [ 188.837660][ T4312] usb 3-1: config 220 has no interface number 2 [ 188.859974][ T4312] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 188.925055][ T4312] usb 3-1: config 220 interface 0 has no altsetting 0 [ 188.947719][ T4312] usb 3-1: config 220 interface 76 has no altsetting 0 [ 188.970690][ T4312] usb 3-1: config 220 interface 1 has no altsetting 0 [ 189.013737][ T4312] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 189.041923][ T4312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.069092][ T4312] usb 3-1: Product: syz [ 189.086339][ T4312] usb 3-1: Manufacturer: syz [ 189.111641][ T4312] usb 3-1: SerialNumber: syz [ 189.309207][ T5777] netlink: 'syz.1.423': attribute type 4 has an invalid length. [ 189.415387][ T4312] uvcvideo 3-1:220.1: Unknown video format 61616161-6161-6161-6161-616161616161 [ 189.457949][ T4312] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 189.480559][ T4312] usb 3-1: No valid video chain found. [ 189.506163][ T4312] usb 3-1: selecting invalid altsetting 0 [ 189.560598][ T4362] usb 4-1: Using ep0 maxpacket: 16 [ 190.702316][ T4283] Bluetooth: hci4: command 0x0406 tx timeout [ 190.723343][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 190.742244][ T4362] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 190.755007][ T4312] usb 3-1: selecting invalid altsetting 0 [ 190.762392][ T4312] usbtest: probe of 3-1:220.1 failed with error -22 [ 190.794095][ T4312] usb 3-1: USB disconnect, device number 7 [ 190.806926][ T4362] usb 4-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 190.842327][ T4362] usb 4-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 190.880919][ T4362] usb 4-1: Manufacturer: syz [ 190.897357][ T4362] usb 4-1: config 0 descriptor?? [ 191.030800][ T4362] usbhid 4-1:0.0: can't add hid device: -71 [ 191.036915][ T4362] usbhid: probe of 4-1:0.0 failed with error -71 [ 191.093370][ T4362] usb 4-1: USB disconnect, device number 9 [ 191.384282][ T5794] loop0: detected capacity change from 0 to 3904 [ 191.457714][ T5794] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 192.503160][ T5794] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 192.511633][ T5794] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 192.522386][ T5794] loop0: [ 194.802393][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.808735][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.903412][ T49] Bluetooth: hci4: link tx timeout [ 194.908585][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 195.706046][ T5810] netlink: 24 bytes leftover after parsing attributes in process `syz.0.427'. [ 197.222189][ T49] Bluetooth: hci0: command 0x0406 tx timeout [ 197.223530][ T4283] Bluetooth: hci2: command 0x0406 tx timeout [ 197.230005][ T4276] Bluetooth: hci3: command 0x0406 tx timeout [ 197.240434][ T49] Bluetooth: hci1: command 0x0406 tx timeout [ 198.992457][ T4315] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 199.194704][ T4315] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 199.227413][ T4315] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 199.250001][ T4315] usb 3-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 199.277592][ T4315] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.317643][ T4315] usb 3-1: Product: syz [ 199.321948][ T4315] usb 3-1: Manufacturer: syz [ 199.327080][ T4315] usb 3-1: SerialNumber: syz [ 199.574666][ T4315] usb 3-1: 0:1 : does not exist [ 199.586523][ T5834] trusted_key: encrypted_key: insufficient parameters specified [ 202.059159][ T4315] usb 3-1: USB disconnect, device number 8 [ 202.326010][ T4264] udevd[4264]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 203.016433][ T49] Bluetooth: hci4: link tx timeout [ 203.021627][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 204.956545][ T5876] trusted_key: encrypted_key: insufficient parameters specified [ 208.077548][ T5892] kAFS: No cell specified [ 208.154561][ T5896] fuse: Unknown parameter 'user_i00000000000000000000' [ 209.997493][ T49] Bluetooth: hci4: link tx timeout [ 210.002786][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 211.112387][ T22] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 211.313980][ T22] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 211.326715][ T22] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 211.375880][ T22] usb 2-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 211.412357][ T22] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.432972][ T22] usb 2-1: Product: syz [ 211.440817][ T22] usb 2-1: Manufacturer: syz [ 211.450974][ T22] usb 2-1: SerialNumber: syz [ 211.693251][ T22] usb 2-1: 0:1 : does not exist [ 211.744074][ T22] usb 2-1: USB disconnect, device number 8 [ 211.835718][ T5937] fuse: Unknown parameter 'user_i00000000000000000000' [ 213.033733][ T4264] udevd[4264]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 213.798104][ T5949] loop3: detected capacity change from 0 to 1024 [ 214.034666][ T5949] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 214.055086][ T5949] EXT4-fs (loop3): unmounting filesystem. [ 215.859557][ T49] Bluetooth: hci4: link tx timeout [ 215.865712][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 215.995865][ T5974] fuse: Unknown parameter 'user_i00000000000000000000' [ 216.208617][ T5975] netlink: 'syz.1.483': attribute type 4 has an invalid length. [ 221.396467][ T49] Bluetooth: hci4: link tx timeout [ 221.401639][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 221.479146][ T6004] loop1: detected capacity change from 0 to 1024 [ 221.608744][ T6004] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 221.627288][ T6004] ext4 filesystem being mounted at /100/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 221.783355][ T6004] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm syz.1.490: lblock 0 mapped to illegal pblock 0 (length 1) [ 221.922895][ T6013] fuse: Unknown parameter 'user_id00000000000000000000' [ 222.053254][ T27] audit: type=1326 audit(1788284960.331:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6014 comm="syz.3.489" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f167cb9e159 code=0x0 [ 222.196829][ T4271] EXT4-fs (loop1): unmounting filesystem. [ 222.283853][ T6023] netlink: 16 bytes leftover after parsing attributes in process `syz.2.492'. [ 223.571571][ T6038] kAFS: No cell specified [ 225.342401][ T49] Bluetooth: hci4: link tx timeout [ 225.347604][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 225.764473][ T6054] fuse: Unknown parameter 'user_id00000000000000000000' [ 226.179089][ T6057] loop1: detected capacity change from 0 to 1024 [ 226.316609][ T6057] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 226.388828][ T6057] ext4 filesystem being mounted at /106/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 226.543184][ T6057] EXT4-fs error (device loop1): ext4_map_blocks:747: inode #15: comm syz.1.509: lblock 0 mapped to illegal pblock 0 (length 1) [ 226.765340][ T4271] EXT4-fs (loop1): unmounting filesystem. [ 227.200761][ T6067] netlink: 16 bytes leftover after parsing attributes in process `syz.1.511'. [ 227.899186][ T27] audit: type=1326 audit(1788284966.171:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6068 comm="syz.4.513" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe90959e159 code=0x0 [ 232.302546][ T6094] loop4: detected capacity change from 0 to 1024 [ 232.463576][ T6094] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 232.478704][ T6094] ext4 filesystem being mounted at /98/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 232.676736][ T6097] rdma_rxe: rxe_register_device failed with error -23 [ 232.683622][ T6097] rdma_rxe: failed to add wg0 [ 232.690535][ T6097] netlink: 92 bytes leftover after parsing attributes in process `syz.3.523'. [ 232.755323][ T6103] netlink: 16 bytes leftover after parsing attributes in process `syz.0.524'. [ 233.349348][ T6099] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 234.665145][ T4280] EXT4-fs (loop4): unmounting filesystem. [ 234.692419][ T7] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 235.243890][ T7] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.272276][ T7] usb 4-1: config 1 interface 1 altsetting 65 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 235.342470][ T7] usb 4-1: config 1 interface 1 has no altsetting 1 [ 236.306619][ T7] usb 4-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 236.335327][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.346380][ T27] audit: type=1326 audit(1788284974.621:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6122 comm="syz.4.529" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe90959e159 code=0x0 [ 236.392449][ T7] usb 4-1: can't set config #1, error -71 [ 236.432595][ T7] usb 4-1: USB disconnect, device number 10 [ 236.909789][ T6132] loop0: detected capacity change from 0 to 3904 [ 237.012656][ T6132] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 237.052629][ T6132] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 237.068381][ T6132] loop0: [ 239.687755][ T6150] loop2: detected capacity change from 0 to 1024 [ 239.868499][ T6150] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 239.932313][ T6150] ext4 filesystem being mounted at /103/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 240.059133][ T27] audit: type=1800 audit(1788284978.331:42): pid=6150 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.536" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 240.228425][ T6150] EXT4-fs error (device loop2): ext4_map_blocks:747: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.407533][ T6160] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.409086][ T27] audit: type=1800 audit(1788284978.681:43): pid=6160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.536" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 240.540633][ T6148] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.661081][ T6160] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.749946][ T6148] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.807055][ T6160] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.909629][ T6150] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.933570][ T6160] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 240.979145][ T6150] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #15: comm syz.2.536: lblock 0 mapped to illegal pblock 0 (length 1) [ 241.221493][ T4279] EXT4-fs (loop2): unmounting filesystem. [ 241.332816][ T6165] size and base must be multiples of 4 kiB [ 241.338745][ T6165] CPU: 1 PID: 6165 Comm: syz.3.539 Not tainted syzkaller #0 [ 241.346064][ T6165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 241.356121][ T6165] Call Trace: [ 241.359393][ T6165] [ 241.362320][ T6165] dump_stack_lvl+0x188/0x24e [ 241.367012][ T6165] ? show_regs_print_info+0x12/0x12 [ 241.372223][ T6165] ? load_image+0x410/0x410 [ 241.376735][ T6165] ? lockdep_hardirqs_on+0x94/0x140 [ 241.381939][ T6165] mtrr_add+0x8e/0xc0 [ 241.385926][ T6165] mtrr_ioctl+0x9bf/0x1140 [ 241.390348][ T6165] ? mtrr_close+0x1f0/0x1f0 [ 241.394855][ T6165] ? lockdep_hardirqs_on+0x94/0x140 [ 241.400058][ T6165] ? proc_reg_unlocked_ioctl+0x9c/0x2b0 [ 241.405612][ T6165] ? mtrr_close+0x1f0/0x1f0 [ 241.410117][ T6165] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 241.415581][ T6165] ? proc_reg_poll+0x280/0x280 [ 241.420355][ T6165] __se_sys_ioctl+0xfa/0x170 [ 241.424952][ T6165] do_syscall_64+0x4c/0xa0 [ 241.429376][ T6165] ? clear_bhb_loop+0x60/0xb0 [ 241.434056][ T6165] ? clear_bhb_loop+0x60/0xb0 [ 241.438738][ T6165] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 241.444633][ T6165] RIP: 0033:0x7f167cb9e159 [ 241.449044][ T6165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.468648][ T6165] RSP: 002b:00007f167adb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 241.477062][ T6165] RAX: ffffffffffffffda RBX: 00007f167ce26180 RCX: 00007f167cb9e159 [ 241.485032][ T6165] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 241.493088][ T6165] RBP: 00007f167cc35024 R08: 0000000000000000 R09: 0000000000000000 [ 241.501054][ T6165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 241.509032][ T6165] R13: 00007f167ce26218 R14: 00007f167ce26180 R15: 00007ffc86fa3358 [ 241.517019][ T6165] [ 241.552787][ T6165] netlink: 'syz.3.539': attribute type 4 has an invalid length. [ 242.527661][ T6172] trusted_key: encrypted_key: insufficient parameters specified [ 243.247768][ T6171] netdevsim0 speed is unknown, defaulting to 1000 [ 243.341791][ T6171] wg0 speed is unknown, defaulting to 1000 [ 244.441484][ T6187] loop0: detected capacity change from 0 to 3904 [ 247.248830][ T6204] size and base must be multiples of 4 kiB [ 247.254761][ T6204] CPU: 1 PID: 6204 Comm: syz.0.551 Not tainted syzkaller #0 [ 247.262063][ T6204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 247.272124][ T6204] Call Trace: [ 247.275401][ T6204] [ 247.278325][ T6204] dump_stack_lvl+0x188/0x24e [ 247.283012][ T6204] ? __might_fault+0xa6/0x120 [ 247.287690][ T6204] ? show_regs_print_info+0x12/0x12 [ 247.292902][ T6204] ? load_image+0x410/0x410 [ 247.297412][ T6204] ? tomoyo_path_number_perm+0x5a4/0x650 [ 247.303051][ T6204] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 247.308509][ T6204] ? __might_fault+0xa6/0x120 [ 247.313189][ T6204] ? __might_fault+0xc2/0x120 [ 247.317865][ T6204] ? __might_fault+0xa6/0x120 [ 247.322555][ T6204] mtrr_add+0x8e/0xc0 [ 247.326548][ T6204] mtrr_ioctl+0x9bf/0x1140 [ 247.331010][ T6204] ? mtrr_close+0x1f0/0x1f0 [ 247.335609][ T6204] ? __fget_files+0x28/0x460 [ 247.340211][ T6204] ? mtrr_close+0x1f0/0x1f0 [ 247.344723][ T6204] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 247.350189][ T6204] ? proc_reg_poll+0x280/0x280 [ 247.354965][ T6204] __se_sys_ioctl+0xfa/0x170 [ 247.359560][ T6204] do_syscall_64+0x4c/0xa0 [ 247.363980][ T6204] ? clear_bhb_loop+0x60/0xb0 [ 247.368666][ T6204] ? clear_bhb_loop+0x60/0xb0 [ 247.373357][ T6204] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 247.379261][ T6204] RIP: 0033:0x7f42d659e159 [ 247.383677][ T6204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.403289][ T6204] RSP: 002b:00007f42d7442028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 247.411796][ T6204] RAX: ffffffffffffffda RBX: 00007f42d6826180 RCX: 00007f42d659e159 [ 247.419770][ T6204] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 247.427743][ T6204] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 247.435723][ T6204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 247.443706][ T6204] R13: 00007f42d6826218 R14: 00007f42d6826180 R15: 00007ffe37305e28 [ 247.451689][ T6204] [ 247.480111][ T4312] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 247.607850][ T6205] netlink: 'syz.0.551': attribute type 4 has an invalid length. [ 247.752682][ T4312] usb 4-1: Using ep0 maxpacket: 32 [ 247.801511][ T4312] usb 4-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 247.842537][ T4312] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.159758][ T4312] usb 4-1: Product: syz [ 248.164462][ T4312] usb 4-1: Manufacturer: syz [ 248.169158][ T4312] usb 4-1: SerialNumber: syz [ 248.176299][ T4312] usb 4-1: config 0 descriptor?? [ 248.186291][ T4312] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 248.562359][ T27] audit: type=1326 audit(1788284986.831:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6212 comm="syz.1.548" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe35719e159 code=0x0 [ 249.412748][ T6200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.432697][ T6200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.476472][ T6200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.541083][ T6200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.825432][ T6232] trusted_key: encrypted_key: insufficient parameters specified [ 249.909606][ T6233] trusted_key: encrypted_key: insufficient parameters specified [ 250.940095][ T4312] gspca_topro: reg_r err -71 [ 250.947648][ T4312] gspca_topro: Sensor soi763a [ 251.025760][ T4312] usb 4-1: USB disconnect, device number 11 [ 252.952122][ T6243] loop0: detected capacity change from 0 to 3904 [ 254.278367][ T6255] netdevsim0 speed is unknown, defaulting to 1000 [ 254.337691][ T6255] wg0 speed is unknown, defaulting to 1000 [ 255.473568][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.535098][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.497029][ T27] audit: type=1326 audit(1788284995.771:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6271 comm="syz.2.568" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0b4c19e159 code=0x0 [ 261.647909][ T6294] netdevsim0 speed is unknown, defaulting to 1000 [ 261.727610][ T6294] wg0 speed is unknown, defaulting to 1000 [ 262.054802][ T6300] trusted_key: encrypted_key: insufficient parameters specified [ 263.062567][ T27] audit: type=1800 audit(1788285001.321:46): pid=6307 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.576" name="memory_backed" dev="configfs" ino=145741 res=0 errno=0 [ 264.040864][ T27] audit: type=1326 audit(1788285002.311:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6318 comm="syz.4.580" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe90959e159 code=0x0 [ 264.213591][ T6326] syz.3.582 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 264.249044][ T6326] CPU: 1 PID: 6326 Comm: syz.3.582 Not tainted syzkaller #0 [ 264.256385][ T6326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 264.266461][ T6326] Call Trace: [ 264.269759][ T6326] [ 264.272704][ T6326] dump_stack_lvl+0x188/0x24e [ 264.277411][ T6326] ? ___ratelimit+0x14e/0x610 [ 264.282114][ T6326] ? show_regs_print_info+0x12/0x12 [ 264.287341][ T6326] ? load_image+0x410/0x410 [ 264.291846][ T6326] ? ___ratelimit+0x474/0x610 [ 264.296530][ T6326] ? radix_tree_cpu_dead+0x160/0x160 [ 264.301816][ T6326] dump_header+0xd8/0x820 [ 264.306158][ T6326] oom_kill_process+0x361/0x550 [ 264.311016][ T6326] out_of_memory+0xe25/0x1220 [ 264.315693][ T6326] ? print_unlock_imbalance_bug+0x160/0x160 [ 264.321592][ T6326] ? mutex_lock_nested+0x10/0x10 [ 264.326532][ T6326] ? unregister_oom_notifier+0x20/0x20 [ 264.331992][ T6326] mem_cgroup_out_of_memory+0x2c0/0x390 [ 264.337633][ T6326] ? mem_cgroup_oom_trylock+0x210/0x210 [ 264.343186][ T6326] ? do_raw_spin_unlock+0x11d/0x230 [ 264.348381][ T6326] try_charge_memcg+0xc9d/0x17c0 [ 264.353333][ T6326] ? percpu_ref_put+0x180/0x180 [ 264.358183][ T6326] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 264.363915][ T6326] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 264.369902][ T6326] ? percpu_ref_tryget+0x15/0x180 [ 264.374943][ T6326] ? percpu_ref_tryget+0x15/0x180 [ 264.379970][ T6326] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 264.385688][ T6326] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 264.391409][ T6326] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 264.397237][ T6326] obj_cgroup_charge+0x36a/0x620 [ 264.402181][ T6326] ? obj_cgroup_charge+0xe9/0x620 [ 264.407235][ T6326] ? mod_objcg_mlstate+0x320/0x320 [ 264.412353][ T6326] ? get_obj_cgroup_from_current+0xd0/0x280 [ 264.418243][ T6326] ? get_obj_cgroup_from_current+0xd0/0x280 [ 264.424139][ T6326] slab_pre_alloc_hook+0x2e2/0x300 [ 264.429253][ T6326] kmem_cache_alloc_node+0x5a/0x310 [ 264.434445][ T6326] ? lock_chain_count+0x20/0x20 [ 264.439296][ T6326] ? dup_task_struct+0x57/0x700 [ 264.444146][ T6326] dup_task_struct+0x57/0x700 [ 264.448817][ T6326] ? lockdep_hardirqs_on+0x94/0x140 [ 264.454024][ T6326] copy_process+0x621/0x4070 [ 264.458634][ T6326] ? schedule_preempt_disabled+0x20/0x20 [ 264.464270][ T6326] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 264.470161][ T6326] ? _raw_spin_unlock+0x40/0x40 [ 264.475011][ T6326] ? preempt_schedule_thunk+0x16/0x18 [ 264.480411][ T6326] ? try_to_wake_up+0x6c1/0x10b0 [ 264.485366][ T6326] ? idle_dummy+0x10/0x10 [ 264.489708][ T6326] ? wake_up_q+0x8c/0xc0 [ 264.493965][ T6326] kernel_clone+0x24b/0x900 [ 264.498476][ T6326] ? futex_wake_mark+0x150/0x150 [ 264.503421][ T6326] ? create_io_thread+0x170/0x170 [ 264.508455][ T6326] ? do_futex+0x2e2/0x320 [ 264.512787][ T6326] __x64_sys_clone+0x1a7/0x220 [ 264.517552][ T6326] ? __ia32_sys_vfork+0x140/0x140 [ 264.522583][ T6326] ? lock_chain_count+0x20/0x20 [ 264.527439][ T6326] ? lockdep_hardirqs_on+0x94/0x140 [ 264.532637][ T6326] do_syscall_64+0x4c/0xa0 [ 264.537056][ T6326] ? clear_bhb_loop+0x60/0xb0 [ 264.541736][ T6326] ? clear_bhb_loop+0x60/0xb0 [ 264.546418][ T6326] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 264.552310][ T6326] RIP: 0033:0x7f167cb9e159 [ 264.556725][ T6326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.576349][ T6326] RSP: 002b:00007f167adf5fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 264.584757][ T6326] RAX: ffffffffffffffda RBX: 00007f167ce25fa0 RCX: 00007f167cb9e159 [ 264.592728][ T6326] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 264.600691][ T6326] RBP: 00007f167cc35024 R08: 0000000000000000 R09: 0000000000000000 [ 264.608688][ T6326] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 264.616662][ T6326] R13: 00007f167ce26038 R14: 00007f167ce25fa0 R15: 00007ffc86fa3358 [ 264.624651][ T6326] [ 264.638052][ T6326] memory: usage 8kB, limit 8kB, failcnt 78 [ 264.645893][ T6326] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 264.654102][ T6326] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 264.661071][ T6326] Memory cgroup stats for /syz3/test: [ 264.661288][ T6326] anon 0 [ 264.661288][ T6326] file 0 [ 264.661288][ T6326] kernel 8192 [ 264.661288][ T6326] kernel_stack 0 [ 264.661288][ T6326] pagetables 0 [ 264.661288][ T6326] sec_pagetables 0 [ 264.661288][ T6326] percpu 0 [ 264.661288][ T6326] sock 0 [ 264.661288][ T6326] vmalloc 0 [ 264.661288][ T6326] shmem 0 [ 264.661288][ T6326] zswap 0 [ 264.661288][ T6326] zswapped 0 [ 264.661288][ T6326] file_mapped 0 [ 264.661288][ T6326] file_dirty 0 [ 264.661288][ T6326] file_writeback 0 [ 264.661288][ T6326] swapcached 0 [ 264.661288][ T6326] anon_thp 0 [ 264.661288][ T6326] file_thp 0 [ 264.661288][ T6326] shmem_thp 0 [ 264.661288][ T6326] inactive_anon 0 [ 264.661288][ T6326] active_anon 0 [ 264.661288][ T6326] inactive_file 0 [ 264.661288][ T6326] active_file 0 [ 264.661288][ T6326] unevictable 0 [ 264.661288][ T6326] slab_reclaimable 5784 [ 264.661288][ T6326] slab_unreclaimable 2288 [ 264.661288][ T6326] slab 8072 [ 264.661288][ T6326] workingset_refault_anon 0 [ 264.757518][ C0] vkms_vblank_simulate: vblank timer overrun [ 265.842303][ T6326] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.582,pid=6325,uid=0 [ 266.072277][ T6326] Memory cgroup out of memory: Killed process 6326 (syz.3.582) total-vm:102244kB, anon-rss:1428kB, file-rss:22544kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 266.440640][ T6347] size and base must be multiples of 4 kiB [ 266.447293][ T6346] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 267.555936][ T6347] CPU: 0 PID: 6347 Comm: syz.2.588 Not tainted syzkaller #0 [ 267.563277][ T6347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.573343][ T6347] Call Trace: [ 267.576633][ T6347] [ 267.579571][ T6347] dump_stack_lvl+0x188/0x24e [ 267.584268][ T6347] ? __might_fault+0xa6/0x120 [ 267.588950][ T6347] ? show_regs_print_info+0x12/0x12 [ 267.594161][ T6347] ? load_image+0x410/0x410 [ 267.598668][ T6347] ? tomoyo_path_number_perm+0x5a4/0x650 [ 267.604310][ T6347] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 267.609777][ T6347] ? __might_fault+0xa6/0x120 [ 267.614464][ T6347] ? __might_fault+0xc2/0x120 [ 267.619146][ T6347] ? __might_fault+0xa6/0x120 [ 267.623831][ T6347] mtrr_add+0x8e/0xc0 [ 267.627824][ T6347] mtrr_ioctl+0x9bf/0x1140 [ 267.632255][ T6347] ? mtrr_close+0x1f0/0x1f0 [ 267.636785][ T6347] ? __fget_files+0x28/0x460 [ 267.641405][ T6347] ? mtrr_close+0x1f0/0x1f0 [ 267.645927][ T6347] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 267.651582][ T6347] ? proc_reg_poll+0x280/0x280 [ 267.656451][ T6347] __se_sys_ioctl+0xfa/0x170 [ 267.661055][ T6347] do_syscall_64+0x4c/0xa0 [ 267.665487][ T6347] ? clear_bhb_loop+0x60/0xb0 [ 267.670175][ T6347] ? clear_bhb_loop+0x60/0xb0 [ 267.674871][ T6347] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 267.680770][ T6347] RIP: 0033:0x7f0b4c19e159 [ 267.685183][ T6347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.704797][ T6347] RSP: 002b:00007f0b4a3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 267.713299][ T6347] RAX: ffffffffffffffda RBX: 00007f0b4c426180 RCX: 00007f0b4c19e159 [ 267.721277][ T6347] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 267.729247][ T6347] RBP: 00007f0b4c235024 R08: 0000000000000000 R09: 0000000000000000 [ 267.737214][ T6347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.745185][ T6347] R13: 00007f0b4c426218 R14: 00007f0b4c426180 R15: 00007ffd002a3798 [ 267.753171][ T6347] [ 267.756273][ C0] vkms_vblank_simulate: vblank timer overrun [ 268.050096][ T6346] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 268.154189][ T27] audit: type=1800 audit(1788285006.421:48): pid=6367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.590" name="memory_backed" dev="configfs" ino=199100 res=0 errno=0 [ 268.174927][ C0] vkms_vblank_simulate: vblank timer overrun [ 269.006788][ T6348] device erspan0 entered promiscuous mode [ 269.058770][ T6348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.587'. [ 269.263792][ T6347] netlink: 'syz.2.588': attribute type 4 has an invalid length. [ 269.312636][ T4312] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 269.586626][ T4312] usb 5-1: unable to get BOS descriptor or descriptor too short [ 269.604528][ T6376] trusted_key: encrypted_key: insufficient parameters specified [ 270.638957][ T4312] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 270.665009][ T4312] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 270.692303][ T4312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.705533][ T4312] usb 5-1: Product: syz [ 270.809909][ T4312] usb 5-1: Manufacturer: syz [ 270.826079][ T4312] usb 5-1: SerialNumber: syz [ 271.091336][ T4312] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 271.392507][ T26] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 271.461034][ T9] i801_smbus 0000:00:00.0: SMBus base address uninitialized, upgrade BIOS [ 271.461034][ T11] i801_smbus 0000:00:01.0: SMBus base address uninitialized, upgrade BIOS [ 271.500067][ T9] ACPI: \_SB_.LNKS: No IRQ available. Try pci=noacpi or acpi=off [ 271.519057][ T6390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.597822][ T9] i801_smbus 0000:00:01.3: PCI INT A: no GSI [ 271.610035][ T26] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 271.621672][ T6390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.636048][ T47] ACPI: \_SB_.LNKA: Enabled at IRQ 11 [ 271.702813][ T26] usb 4-1: config 1 interface 1 altsetting 65 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 271.723741][ T47] i801_smbus 0000:00:05.0: SMBus base address uninitialized, upgrade BIOS [ 271.725827][ T9] i801_smbus 0000:00:01.3: SMBus base address uninitialized, upgrade BIOS [ 271.789159][ T26] usb 4-1: config 1 interface 1 has no altsetting 1 [ 271.830769][ T26] usb 4-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 271.911488][ T26] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.985243][ T26] usb 4-1: Product: syz [ 271.989471][ T26] usb 4-1: Manufacturer: syz [ 272.055511][ T26] usb 4-1: SerialNumber: syz [ 272.157085][ T4312] usb 5-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 272.296647][ T4312] usb 5-1: USB disconnect, device number 8 [ 272.338464][ T26] usb 4-1: USB disconnect, device number 12 [ 272.654154][ T4264] udevd[4264]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 274.342772][ T4373] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 274.633185][ T4373] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 274.675211][ T4373] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.761848][ T4373] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 274.809045][ T4373] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 274.834247][ T4373] usb 4-1: Manufacturer: syz [ 274.872188][ T4373] usb 4-1: config 0 descriptor?? [ 275.114656][ T6404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.167224][ T6404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.229616][ T6404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.295119][ T6404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.399081][ T4373] rc_core: IR keymap rc-hauppauge not found [ 275.409192][ T4373] Registered IR keymap rc-empty [ 275.442609][ T4373] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 275.477829][ T4373] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 275.559442][ T4373] usb 4-1: USB disconnect, device number 13 [ 275.662016][ T27] audit: type=1326 audit(1788285013.931:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6416 comm="syz.4.606" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe90959e159 code=0x0 [ 278.070640][ T6435] jffs2: notice: (6435) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 282.714749][ T6475] size and base must be multiples of 4 kiB [ 282.826781][ T6476] netlink: 'syz.0.609': attribute type 4 has an invalid length. [ 282.950620][ T6475] CPU: 1 PID: 6475 Comm: syz.0.609 Not tainted syzkaller #0 [ 282.957968][ T6475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 282.968037][ T6475] Call Trace: [ 282.971324][ T6475] [ 282.974270][ T6475] dump_stack_lvl+0x188/0x24e [ 282.978974][ T6475] ? __might_fault+0xa6/0x120 [ 282.983667][ T6475] ? show_regs_print_info+0x12/0x12 [ 282.988889][ T6475] ? load_image+0x410/0x410 [ 282.993414][ T6475] ? tomoyo_path_number_perm+0x5a4/0x650 [ 282.999076][ T6475] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 283.004562][ T6475] ? __might_fault+0xa6/0x120 [ 283.009257][ T6475] ? __might_fault+0xc2/0x120 [ 283.013948][ T6475] ? __might_fault+0xa6/0x120 [ 283.018642][ T6475] mtrr_add+0x8e/0xc0 [ 283.022642][ T6475] mtrr_ioctl+0x9bf/0x1140 [ 283.027051][ T6475] ? mtrr_close+0x1f0/0x1f0 [ 283.031542][ T6475] ? __fget_files+0x28/0x460 [ 283.036131][ T6475] ? mtrr_close+0x1f0/0x1f0 [ 283.040618][ T6475] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 283.046071][ T6475] ? proc_reg_poll+0x280/0x280 [ 283.050821][ T6475] __se_sys_ioctl+0xfa/0x170 [ 283.055412][ T6475] do_syscall_64+0x4c/0xa0 [ 283.059849][ T6475] ? clear_bhb_loop+0x60/0xb0 [ 283.064518][ T6475] ? clear_bhb_loop+0x60/0xb0 [ 283.069206][ T6475] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 283.075089][ T6475] RIP: 0033:0x7f42d659e159 [ 283.079488][ T6475] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 283.099081][ T6475] RSP: 002b:00007f42d7442028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 283.107495][ T6475] RAX: ffffffffffffffda RBX: 00007f42d6826180 RCX: 00007f42d659e159 [ 283.115477][ T6475] RDX: 0000200000000a00 RSI: 0000000040104d01 RDI: 0000000000000005 [ 283.123449][ T6475] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 283.131419][ T6475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 283.139392][ T6475] R13: 00007f42d6826218 R14: 00007f42d6826180 R15: 00007ffe37305e28 [ 283.147380][ T6475] [ 283.529393][ T4278] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 283.548907][ T4278] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 283.559919][ T4278] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 283.570651][ T4278] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 283.578317][ T4278] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 283.586363][ T4278] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 283.835656][ T6477] netdevsim0 speed is unknown, defaulting to 1000 [ 283.872711][ T6477] wg0 speed is unknown, defaulting to 1000 [ 285.680169][ T49] Bluetooth: hci5: command 0x0409 tx timeout [ 285.686841][ T27] audit: type=1800 audit(1788285023.401:50): pid=6487 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.623" name="memory_backed" dev="configfs" ino=199273 res=0 errno=0 [ 285.709020][ T27] audit: type=1800 audit(1788285023.401:51): pid=6487 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.623" name="power" dev="configfs" ino=199274 res=0 errno=0 [ 287.059564][ T6477] chnl_net:caif_netlink_parms(): no params data found [ 287.249258][ T6477] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.289719][ T6477] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.315667][ T6477] device bridge_slave_0 entered promiscuous mode [ 287.346709][ T6477] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.369400][ T6477] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.382444][ T26] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 287.410117][ T6477] device bridge_slave_1 entered promiscuous mode [ 287.550602][ T6477] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 287.572531][ T26] usb 5-1: Using ep0 maxpacket: 32 [ 287.592184][ T26] usb 5-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 287.612576][ T6477] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 287.622040][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.652350][ T26] usb 5-1: Product: syz [ 287.670552][ T26] usb 5-1: Manufacturer: syz [ 287.685731][ T26] usb 5-1: SerialNumber: syz [ 287.711945][ T26] usb 5-1: config 0 descriptor?? [ 287.827278][ T49] Bluetooth: hci5: command 0x041b tx timeout [ 287.920213][ T26] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 289.093224][ T26] gspca_topro: reg_w err -110 [ 289.152589][ T26] gspca_topro: Sensor soi763a [ 289.631664][ T6512] syz.0.630 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 289.649300][ T6477] team0: Port device team_slave_0 added [ 289.663134][ T6477] team0: Port device team_slave_1 added [ 289.752344][ T6477] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 289.766738][ T6512] CPU: 1 PID: 6512 Comm: syz.0.630 Not tainted syzkaller #0 [ 289.774074][ T6512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 289.784148][ T6512] Call Trace: [ 289.787445][ T6512] [ 289.790396][ T6512] dump_stack_lvl+0x188/0x24e [ 289.795110][ T6512] ? ___ratelimit+0x14e/0x610 [ 289.799815][ T6512] ? show_regs_print_info+0x12/0x12 [ 289.805050][ T6512] ? load_image+0x410/0x410 [ 289.809577][ T6512] ? ___ratelimit+0x474/0x610 [ 289.814281][ T6512] ? radix_tree_cpu_dead+0x160/0x160 [ 289.819597][ T6512] dump_header+0xd8/0x820 [ 289.823963][ T6512] oom_kill_process+0x361/0x550 [ 289.828839][ T6512] out_of_memory+0xe25/0x1220 [ 289.833543][ T6512] ? print_unlock_imbalance_bug+0x160/0x160 [ 289.839462][ T6512] ? mutex_lock_nested+0x10/0x10 [ 289.844412][ T6512] ? unregister_oom_notifier+0x20/0x20 [ 289.849863][ T6512] mem_cgroup_out_of_memory+0x2c0/0x390 [ 289.855404][ T6512] ? mem_cgroup_oom_trylock+0x210/0x210 [ 289.860960][ T6512] ? do_raw_spin_unlock+0x11d/0x230 [ 289.866182][ T6512] try_charge_memcg+0xc9d/0x17c0 [ 289.871128][ T6512] ? lockdep_hardirqs_off+0x70/0x100 [ 289.876426][ T6512] ? percpu_ref_put+0x180/0x180 [ 289.881280][ T6512] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 289.887008][ T6512] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 289.892990][ T6512] ? percpu_ref_tryget+0x15/0x180 [ 289.898109][ T6512] ? percpu_ref_tryget+0x15/0x180 [ 289.903136][ T6512] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 289.908859][ T6512] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 289.914649][ T6512] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 289.920501][ T6512] obj_cgroup_charge+0x36a/0x620 [ 289.925444][ T6512] ? obj_cgroup_charge+0xe9/0x620 [ 289.930469][ T6512] ? mod_objcg_mlstate+0x320/0x320 [ 289.935601][ T6512] ? percpu_ref_put+0x12/0x100 [ 289.940366][ T6512] ? percpu_ref_put+0x12/0x100 [ 289.945130][ T6512] slab_pre_alloc_hook+0x2e2/0x300 [ 289.950242][ T6512] ? slab_pre_alloc_hook+0xb1/0x300 [ 289.955440][ T6512] kmem_cache_alloc_lru+0x49/0x2e0 [ 289.960546][ T6512] ? sock_alloc_inode+0x24/0xc0 [ 289.965413][ T6512] sock_alloc_inode+0x24/0xc0 [ 289.970101][ T6512] ? sockfs_init_fs_context+0xa0/0xa0 [ 289.975468][ T6512] new_inode_pseudo+0x5f/0x1c0 [ 289.980236][ T6512] sock_create_lite+0x87/0x500 [ 289.985010][ T6512] __netlink_kernel_create+0xf7/0x7b0 [ 289.990393][ T6512] ? netlink_set_err+0x3b0/0x3b0 [ 289.995423][ T6512] ? memset+0x1e/0x40 [ 289.999430][ T6512] ? lockdep_init_map_type+0x98/0x8d0 [ 290.004807][ T6512] ? rtnetlink_net_init+0xa1/0x140 [ 290.009920][ T6512] rtnetlink_net_init+0xb0/0x140 [ 290.015030][ T6512] ? nlmsg_populate_fdb_fill+0x620/0x620 [ 290.020658][ T6512] ? rtnetlink_net_exit+0x60/0x60 [ 290.025679][ T6512] ? rtnetlink_rcv+0x20/0x20 [ 290.030273][ T6512] ops_init+0x360/0x5e0 [ 290.034461][ T6512] setup_net+0x4f2/0xbd0 [ 290.038709][ T6512] ? copy_net_ns+0x5b0/0x5b0 [ 290.043307][ T6512] ? down_read_killable+0x1cc/0x340 [ 290.048505][ T6512] copy_net_ns+0x33e/0x5b0 [ 290.053099][ T6512] create_new_namespaces+0x3ce/0x700 [ 290.058394][ T6512] ? copy_namespaces+0x55/0x410 [ 290.063242][ T6512] copy_namespaces+0x3ae/0x410 [ 290.068038][ T6512] copy_process+0x199b/0x4070 [ 290.072717][ T6512] ? plist_add+0x3d7/0x490 [ 290.077146][ T6512] ? copy_process+0x974/0x4070 [ 290.081928][ T6512] ? futex_wait+0x4a3/0x5c0 [ 290.086433][ T6512] ? idle_dummy+0x10/0x10 [ 290.090768][ T6512] kernel_clone+0x24b/0x900 [ 290.095274][ T6512] ? create_io_thread+0x170/0x170 [ 290.100304][ T6512] ? do_futex+0x310/0x320 [ 290.104637][ T6512] __x64_sys_clone+0x1a7/0x220 [ 290.109421][ T6512] ? __ia32_sys_vfork+0x140/0x140 [ 290.114455][ T6512] ? lock_chain_count+0x20/0x20 [ 290.119330][ T6512] ? lockdep_hardirqs_on+0x94/0x140 [ 290.124528][ T6512] do_syscall_64+0x4c/0xa0 [ 290.128964][ T6512] ? clear_bhb_loop+0x60/0xb0 [ 290.133642][ T6512] ? clear_bhb_loop+0x60/0xb0 [ 290.138322][ T6512] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 290.144218][ T6512] RIP: 0033:0x7f42d659e159 [ 290.148654][ T6512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.168257][ T6512] RSP: 002b:00007f42d7483fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 290.176668][ T6512] RAX: ffffffffffffffda RBX: 00007f42d6825fa0 RCX: 00007f42d659e159 [ 290.184634][ T6512] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000648e7000 [ 290.192635][ T6512] RBP: 00007f42d6635024 R08: 0000000000000000 R09: 0000000000000000 [ 290.200601][ T6512] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 290.208565][ T6512] R13: 00007f42d6826038 R14: 00007f42d6825fa0 R15: 00007ffe37305e28 [ 290.216547][ T6512] [ 290.222507][ T49] Bluetooth: hci5: command 0x040f tx timeout [ 290.352352][ T6512] memory: usage 96kB, limit 96kB, failcnt 101 [ 290.358479][ T6512] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 290.367826][ T6477] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.402614][ T6512] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 290.419764][ T6512] Memory cgroup stats for /syz0/test: [ 290.420015][ T6512] anon 0 [ 290.420015][ T6512] file 0 [ 290.420015][ T6512] kernel 98304 [ 290.420015][ T6512] kernel_stack 32768 [ 290.420015][ T6512] pagetables 8192 [ 290.420015][ T6512] sec_pagetables 0 [ 290.420015][ T6512] percpu 0 [ 290.420015][ T6512] sock 0 [ 290.420015][ T6512] vmalloc 0 [ 290.420015][ T6512] shmem 0 [ 290.420015][ T6512] zswap 0 [ 290.420015][ T6512] zswapped 0 [ 290.420015][ T6512] file_mapped 0 [ 290.420015][ T6512] file_dirty 0 [ 290.420015][ T6512] file_writeback 0 [ 290.420015][ T6512] swapcached 0 [ 290.420015][ T6512] anon_thp 0 [ 290.420015][ T6512] file_thp 0 [ 290.420015][ T6512] shmem_thp 0 [ 290.420015][ T6512] inactive_anon 0 [ 290.420015][ T6512] active_anon 0 [ 290.420015][ T6512] inactive_file 0 [ 290.420015][ T6512] active_file 0 [ 290.420015][ T6512] unevictable 0 [ 290.420015][ T6512] slab_reclaimable 3856 [ 290.420015][ T6512] slab_unreclaimable 41856 [ 290.420015][ T6512] slab 45712 [ 290.519864][ T6512] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.630,pid=6511,uid=0 [ 290.541463][ T6512] Memory cgroup out of memory: Killed process 6512 (syz.0.630) total-vm:102376kB, anon-rss:1436kB, file-rss:22552kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 290.592642][ T6477] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 290.644036][ T6477] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 290.680349][ T6477] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 290.710659][ T26] usb 5-1: USB disconnect, device number 9 [ 290.834978][ T6477] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 291.017203][ T6477] device hsr_slave_0 entered promiscuous mode [ 291.898586][ T6477] device hsr_slave_1 entered promiscuous mode [ 291.981218][ T6477] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 292.003321][ T6477] Cannot create hsr debugfs directory [ 292.252381][ T49] Bluetooth: hci5: command 0x0419 tx timeout [ 294.802137][ T6477] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 295.691049][ T6477] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 295.851467][ T6477] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 295.916359][ T6477] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 296.215981][ T6564] kAFS: No cell specified [ 296.707217][ T6477] 8021q: adding VLAN 0 to HW filter on device bond0 [ 297.336619][ T11] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.446195][ T4470] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 297.475855][ T4470] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 297.613278][ T4312] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 297.642006][ T11] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.655199][ T6578] loop0: detected capacity change from 0 to 4096 [ 297.699872][ T6477] 8021q: adding VLAN 0 to HW filter on device team0 [ 297.744185][ T6578] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 297.762349][ T6578] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 297.784046][ T6578] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 297.809495][ T11] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.827803][ T6578] loop0: [ 297.832321][ T4312] usb 5-1: Using ep0 maxpacket: 32 [ 297.841230][ T4312] usb 5-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 297.864226][ T4312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.872892][ T4312] usb 5-1: Product: syz [ 297.877106][ T4312] usb 5-1: Manufacturer: syz [ 297.892328][ T4312] usb 5-1: SerialNumber: syz [ 297.918961][ T4312] usb 5-1: config 0 descriptor?? [ 297.938861][ T4312] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 297.979147][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 298.000765][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 298.063188][ T4468] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.070283][ T4468] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.135472][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 298.175047][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 299.419738][ T4468] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.426880][ T4468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.448303][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 299.674227][ T11] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 299.805608][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 299.838467][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 299.867702][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 299.902306][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 299.933577][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 299.973280][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 300.007093][ T3654] netdevsim0 speed is unknown, defaulting to 1000 [ 300.020396][ T6477] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 300.042292][ T3654] ================================================================== [ 300.050369][ T3654] BUG: KASAN: use-after-free in siw_query_port+0x359/0x450 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 300.057595][ T3654] Read of size 4 at addr ffff88801d2580e0 by task kworker/1:3/3654 [ 300.065491][ T3654] [ 300.067816][ T3654] CPU: 1 PID: 3654 Comm: kworker/1:3 Not tainted syzkaller #0 [ 300.075278][ T3654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 300.082242][ T6477] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 300.085328][ T3654] Workqueue: infiniband ib_cache_event_task [ 300.101539][ T3654] Call Trace: [ 300.104816][ T3654] [ 300.107739][ T3654] dump_stack_lvl+0x188/0x24e [ 300.112421][ T3654] ? __lock_acquire+0x7c40/0x7c40 [ 300.117438][ T3654] ? show_regs_print_info+0x12/0x12 [ 300.122629][ T3654] ? load_image+0x410/0x410 [ 300.127125][ T3654] ? __virt_addr_valid+0x467/0x540 [ 300.132260][ T3654] ? siw_query_port+0x359/0x450 [ 300.137111][ T3654] print_report+0xa8/0x210 [ 300.141519][ T3654] kasan_report+0x10b/0x140 [ 300.146015][ T3654] ? siw_query_port+0x359/0x450 [ 300.150870][ T3654] siw_query_port+0x359/0x450 [ 300.155541][ T3654] ? ib_query_port+0x365/0x820 [ 300.160299][ T3654] ib_cache_update+0x1bd/0x9c0 [ 300.165054][ T3654] ? ib_cache_setup_one+0x5c0/0x5c0 [ 300.170238][ T3654] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 300.176212][ T3654] ? __lock_acquire+0x7c40/0x7c40 [ 300.181226][ T3654] ? read_lock_is_recursive+0x10/0x10 [ 300.186590][ T3654] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 300.192475][ T3654] ? _raw_spin_unlock+0x40/0x40 [ 300.197317][ T3654] ib_cache_event_task+0xcf/0x1c0 [ 300.202331][ T3654] ? process_one_work+0x7b4/0x1160 [ 300.207437][ T3654] process_one_work+0x8ab/0x1160 [ 300.212372][ T3654] ? worker_detach_from_pool+0x240/0x240 [ 300.217997][ T3654] ? _raw_spin_lock_irq+0xb7/0xf0 [ 300.223010][ T3654] ? _raw_spin_lock_irqsave+0x100/0x100 [ 300.228544][ T3654] ? wq_worker_running+0x97/0x190 [ 300.233560][ T3654] worker_thread+0xaf5/0x12a0 [ 300.238252][ T3654] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 300.244138][ T3654] kthread+0x29d/0x330 [ 300.248191][ T3654] ? worker_clr_flags+0x1a0/0x1a0 [ 300.253202][ T3654] ? kthread_blkcg+0xd0/0xd0 [ 300.257778][ T3654] ret_from_fork+0x1f/0x30 [ 300.262195][ T3654] [ 300.265204][ T3654] [ 300.267515][ T3654] Allocated by task 4271: [ 300.271825][ T3654] kasan_set_track+0x4b/0x70 [ 300.276409][ T3654] __kasan_kmalloc+0x8e/0xa0 [ 300.280988][ T3654] __kmalloc_node+0xb2/0x240 [ 300.285568][ T3654] kvmalloc_node+0x6c/0x180 [ 300.290060][ T3654] alloc_netdev_mqs+0x84/0xf10 [ 300.294813][ T3654] nsim_create+0x7f/0x400 [ 300.299132][ T3654] __nsim_dev_port_add+0x75b/0xbc0 [ 300.304319][ T3654] nsim_dev_port_add_all+0x35/0xe0 [ 300.309421][ T3654] nsim_drv_probe+0x840/0xb20 [ 300.314089][ T3654] really_probe+0x24a/0xb40 [ 300.318583][ T3654] __driver_probe_device+0x1f5/0x390 [ 300.323854][ T3654] driver_probe_device+0x4f/0x420 [ 300.328868][ T3654] __device_attach_driver+0x2c6/0x510 [ 300.334225][ T3654] bus_for_each_drv+0x184/0x210 [ 300.339060][ T3654] __device_attach+0x2a7/0x480 [ 300.343809][ T3654] bus_probe_device+0xba/0x1d0 [ 300.348556][ T3654] device_add+0xbcf/0x1050 [ 300.352961][ T3654] new_device_store+0x378/0x690 [ 300.357801][ T3654] kernfs_fop_write_iter+0x3a0/0x520 [ 300.363073][ T3654] vfs_write+0x482/0x9a0 [ 300.367304][ T3654] ksys_write+0x14d/0x260 [ 300.371628][ T3654] do_syscall_64+0x4c/0xa0 [ 300.376052][ T3654] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.381937][ T3654] [ 300.384245][ T3654] Freed by task 11: [ 300.388034][ T3654] kasan_set_track+0x4b/0x70 [ 300.392617][ T3654] kasan_save_free_info+0x27/0x40 [ 300.397625][ T3654] ____kasan_slab_free+0x126/0x1f0 [ 300.402727][ T3654] slab_free_freelist_hook+0x133/0x1b0 [ 300.408172][ T3654] __kmem_cache_free+0xb6/0x200 [ 300.413006][ T3654] device_release+0x92/0x1c0 [ 300.417586][ T3654] kobject_put+0x217/0x450 [ 300.421987][ T3654] __nsim_dev_port_del+0x155/0x1c0 [ 300.427086][ T3654] nsim_dev_reload_destroy+0x283/0x480 [ 300.432619][ T3654] nsim_dev_reload_down+0x86/0xb0 [ 300.437630][ T3654] devlink_reload+0x202/0x690 [ 300.442294][ T3654] devlink_pernet_pre_exit+0x122/0x280 [ 300.447738][ T3654] cleanup_net+0x58e/0xba0 [ 300.452145][ T3654] process_one_work+0x8ab/0x1160 [ 300.457071][ T3654] worker_thread+0xaf5/0x12a0 [ 300.461735][ T3654] kthread+0x29d/0x330 [ 300.465788][ T3654] ret_from_fork+0x1f/0x30 [ 300.470203][ T3654] [ 300.472511][ T3654] The buggy address belongs to the object at ffff88801d258000 [ 300.472511][ T3654] which belongs to the cache kmalloc-cg-8k of size 8192 [ 300.486807][ T3654] The buggy address is located 224 bytes inside of [ 300.486807][ T3654] 8192-byte region [ffff88801d258000, ffff88801d25a000) [ 300.500151][ T3654] [ 300.502462][ T3654] The buggy address belongs to the physical page: [ 300.508883][ T3654] page:ffffea0000749600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d258 [ 300.519029][ T3654] head:ffffea0000749600 order:3 compound_mapcount:0 compound_pincount:0 [ 300.527344][ T3654] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 300.535353][ T3654] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88801744c3c0 [ 300.543927][ T3654] raw: 0000000000000000 0000000000020002 00000001ffffffff 0000000000000000 [ 300.552494][ T3654] page dumped because: kasan: bad access detected [ 300.558899][ T3654] page_owner tracks the page as allocated [ 300.564629][ T3654] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4271, tgid 4271 (syz-executor), ts 71917057856, free_ts 71883585528 [ 300.587713][ T3654] post_alloc_hook+0x173/0x1a0 [ 300.592475][ T3654] get_page_from_freelist+0x206b/0x2180 [ 300.598011][ T3654] __alloc_pages+0x1ec/0x4f0 [ 300.602594][ T3654] alloc_slab_page+0x5d/0x180 [ 300.607345][ T3654] new_slab+0x87/0x2d0 [ 300.611399][ T3654] ___slab_alloc+0xbc5/0x1240 [ 300.616062][ T3654] __kmem_cache_alloc_node+0x126/0x270 [ 300.621505][ T3654] __kmalloc_node+0xa2/0x240 [ 300.626091][ T3654] kvmalloc_node+0x6c/0x180 [ 300.630588][ T3654] alloc_netdev_mqs+0x84/0xf10 [ 300.635350][ T3654] nsim_create+0x7f/0x400 [ 300.639667][ T3654] __nsim_dev_port_add+0x75b/0xbc0 [ 300.644765][ T3654] nsim_dev_port_add_all+0x35/0xe0 [ 300.649865][ T3654] nsim_drv_probe+0x840/0xb20 [ 300.654529][ T3654] really_probe+0x24a/0xb40 [ 300.659018][ T3654] __driver_probe_device+0x1f5/0x390 [ 300.664293][ T3654] page last free stack trace: [ 300.668951][ T3654] free_unref_page_prepare+0x8e5/0x9e0 [ 300.674398][ T3654] free_unref_page+0x2e/0x3f0 [ 300.679065][ T3654] __unfreeze_partials+0x188/0x1e0 [ 300.684166][ T3654] put_cpu_partial+0x17c/0x250 [ 300.688918][ T3654] qlist_free_all+0x76/0xe0 [ 300.693411][ T3654] kasan_quarantine_reduce+0x144/0x160 [ 300.698856][ T3654] __kasan_slab_alloc+0x1e/0x80 [ 300.703695][ T3654] slab_post_alloc_hook+0x4b/0x490 [ 300.708792][ T3654] __kmem_cache_alloc_node+0x19d/0x270 [ 300.714236][ T3654] __kmalloc_node+0xa2/0x240 [ 300.718817][ T3654] kvmalloc_node+0x6c/0x180 [ 300.723312][ T3654] seq_read_iter+0x1de/0xc50 [ 300.727887][ T3654] vfs_read+0x471/0x960 [ 300.732033][ T3654] ksys_read+0x14d/0x260 [ 300.736265][ T3654] do_syscall_64+0x4c/0xa0 [ 300.740679][ T3654] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.746566][ T3654] [ 300.748871][ T3654] Memory state around the buggy address: [ 300.754482][ T3654] ffff88801d257f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 300.762531][ T3654] ffff88801d258000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.770575][ T3654] >ffff88801d258080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.778613][ T3654] ^ [ 300.785789][ T3654] ffff88801d258100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.793832][ T3654] ffff88801d258180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 300.801875][ T3654] ================================================================== [ 300.814428][ T6573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.831154][ T4312] gspca_topro: reg_w err -110 [ 300.882296][ T4312] gspca_topro: Sensor soi763a [ 300.928778][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 300.928854][ T6573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.943823][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 301.012751][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 301.039670][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 301.074461][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 301.102380][ T4468] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 301.320096][ T3654] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 301.327328][ T3654] CPU: 1 PID: 3654 Comm: kworker/1:3 Not tainted syzkaller #0 [ 301.334793][ T3654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 301.344830][ T3654] Workqueue: infiniband ib_cache_event_task [ 301.350705][ T3654] Call Trace: [ 301.353964][ T3654] [ 301.356880][ T3654] dump_stack_lvl+0x188/0x24e [ 301.361541][ T3654] ? memcpy+0x3c/0x60 [ 301.365502][ T3654] ? show_regs_print_info+0x12/0x12 [ 301.370678][ T3654] ? load_image+0x410/0x410 [ 301.375165][ T3654] panic+0x2d3/0x710 [ 301.379043][ T3654] ? bpf_jit_dump+0xd0/0xd0 [ 301.383524][ T3654] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 301.389504][ T3654] ? _raw_spin_unlock+0x40/0x40 [ 301.394335][ T3654] ? print_memory_metadata+0x314/0x400 [ 301.399775][ T3654] check_panic_on_warn+0x80/0xa0 [ 301.404692][ T3654] ? siw_query_port+0x359/0x450 [ 301.409520][ T3654] end_report+0x66/0x110 [ 301.413760][ T3654] kasan_report+0x118/0x140 [ 301.418248][ T3654] ? siw_query_port+0x359/0x450 [ 301.423091][ T3654] siw_query_port+0x359/0x450 [ 301.427777][ T3654] ? ib_query_port+0x365/0x820 [ 301.432556][ T3654] ib_cache_update+0x1bd/0x9c0 [ 301.437333][ T3654] ? ib_cache_setup_one+0x5c0/0x5c0 [ 301.442540][ T3654] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 301.448534][ T3654] ? __lock_acquire+0x7c40/0x7c40 [ 301.453563][ T3654] ? read_lock_is_recursive+0x10/0x10 [ 301.458917][ T3654] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 301.464807][ T3654] ? _raw_spin_unlock+0x40/0x40 [ 301.469650][ T3654] ib_cache_event_task+0xcf/0x1c0 [ 301.474687][ T3654] ? process_one_work+0x7b4/0x1160 [ 301.479788][ T3654] process_one_work+0x8ab/0x1160 [ 301.484714][ T3654] ? worker_detach_from_pool+0x240/0x240 [ 301.490334][ T3654] ? _raw_spin_lock_irq+0xb7/0xf0 [ 301.495348][ T3654] ? _raw_spin_lock_irqsave+0x100/0x100 [ 301.500896][ T3654] ? wq_worker_running+0x97/0x190 [ 301.505911][ T3654] worker_thread+0xaf5/0x12a0 [ 301.510575][ T3654] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 301.516468][ T3654] kthread+0x29d/0x330 [ 301.520521][ T3654] ? worker_clr_flags+0x1a0/0x1a0 [ 301.525528][ T3654] ? kthread_blkcg+0xd0/0xd0 [ 301.530100][ T3654] ret_from_fork+0x1f/0x30 [ 301.534516][ T3654] [ 301.537820][ T3654] Kernel Offset: disabled [ 301.542133][ T3654] Rebooting in 86400 seconds..