last executing test programs: 14m42.404378672s ago: executing program 2 (id=3537): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/tty/ldiscs\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0xd02, 0x0) lseek(r2, 0x4000000007, 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r1], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 14m42.240035614s ago: executing program 2 (id=3538): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f00000001c0)={0x0, 0x3e7, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd7000fddbdf253700000008000300", @ANYRES32=r1, @ANYBLOB="080026006c0900000800a0006c0900000800570088"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90) 14m42.136599696s ago: executing program 2 (id=3539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="1400000010000100000e0000000000000200000a20000000000a01060000000000000000020000000900010073797a30000000002c000000030a01060000000000000000020000000900010073797a30000000000900030073797a300000000044000000090a01060000000000000000020000000900010073797a30000000000900020073797a30000000010800054000000004080003400000002054000000060a01060000000000000000020000000900010073797a300000000009000215000000000000000028000480240001800b00010064796e73657400001400028008000340000000000800044000000001140000001100010000000000000000000200000a"], 0x10c}, 0x1, 0x0, 0x0, 0x4040048}, 0x20004000) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r1, &(0x7f0000000840)={&(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000bdc90e6a0c4638fd317cd5c5000000000000000000070000000183070400aeefa6"], 0x18}, 0x0) syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) r2 = syz_open_dev$dvb_frontend(&(0x7f00000003c0), 0x0, 0xe82) ioctl$FE_GET_EVENT(r2, 0x80286f4e, &(0x7f0000000080)={0x0, {0x0, 0x0, @qam}}) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0x1e, 0x4, 0x0) setsockopt$sock_int(r3, 0x1, 0x2e, &(0x7f0000000040)=0xffff, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x10, &(0x7f0000000100)=ANY=[], 0x0, 0x6, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000}, 0x94) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$BLKZEROOUT(r4, 0xc0c0128e, &(0x7f0000000240)={0x2000, 0x1000000}) r5 = io_uring_setup(0x7cb0, &(0x7f0000000140)={0x0, 0xb43b, 0x10, 0x3, 0x38f}) close_range(r5, r5, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r7, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f00003de000/0x4000)=nil, 0x4000, 0x9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) 14m41.618955134s ago: executing program 2 (id=3541): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2a740, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) pivot_root(&(0x7f00000001c0)='.\x00', &(0x7f0000002080)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904", @ANYRES32], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_enter(r2, 0x25c4, 0x5a4e, 0x8, &(0x7f0000000100)={[0x6]}, 0x8) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0\x00', 0x88101) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./file0/file0\x00', 0x10) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000200)='.\x00', 0x89901) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000980)={0x1, @pix={0x4, 0x5e2, 0x34324241, 0x6, 0x55, 0x150, 0x1, 0x5, 0x1, 0x1, 0x1, 0x2}}) move_mount(r5, &(0x7f0000004200)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffffff, &(0x7f0000000240)='./file0/file0\x00', 0x1900) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) lseek(r8, 0x10001, 0x1) truncate(&(0x7f00000000c0)='./file1\x00', 0x2b85d62d) r9 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r9, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffe}}, 0x10) bind$tipc(r9, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x55459d45c9412840, {0x42, 0x1, 0x1}}, 0x10) r10 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r10, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 14m38.296052543s ago: executing program 2 (id=3557): socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet(0xa, 0x801, 0x84) syz_open_dev$mtd(&(0x7f0000000080), 0x0, 0x80) syz_open_dev$video(&(0x7f00000002c0), 0x7, 0x20800) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000020) socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000300)='./file0\x00', 0x8000, 0xc) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x10000, 0xa100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x4000, 0x2000000, 0xf8, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x20, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000048000000160a01000000000000000000010000010900010073797a30000000000900020073797a30000000001c0003800800014000000000080002400000000008000240000000064c020000180a0101000b000000000000010000000900010073797a300000f8ffe800038005000140000000000800014000000000cc0003801400010069703665727370616e3000000000000014000100776732000000000000000000000000001400010076657468305f6d61637674617000000014000100626f6e645f736c6176655f310000000014000100626f6e645f736c6176655f300000000014000100636169663000000000000000000000001400010070696d726567300000000000000000001400010070696d726567310000000000000000001400010069705f76746930000000000000000000640001007465616d5f736c6176655f300000000008000140000000000900020073797a30"], 0x2dc}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 14m37.908930917s ago: executing program 2 (id=3562): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x1d00, &(0x7f00000002c0)={&(0x7f0000000580)=@newsa={0x148, 0x10, 0x1, 0x70bd2b, 0x0, {{@in6=@mcast2, @in=@empty, 0x0, 0xecdf, 0x0, 0x0, 0x2}, {@in6=@remote, 0x0, 0x32}, @in=@multicast2, {0xfffffffffffffffe, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x1, 0x1ff, 0x9, 0x292}, {0x1000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x58, 0x2, {{'cbc(twofish)\x00'}, 0x80, "0040002000008b0a696b0b86e3dc0100"}}]}, 0x148}}, 0x44050) socket$inet_udp(0x2, 0x2, 0x0) 14m37.266046982s ago: executing program 32 (id=3562): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x1d00, &(0x7f00000002c0)={&(0x7f0000000580)=@newsa={0x148, 0x10, 0x1, 0x70bd2b, 0x0, {{@in6=@mcast2, @in=@empty, 0x0, 0xecdf, 0x0, 0x0, 0x2}, {@in6=@remote, 0x0, 0x32}, @in=@multicast2, {0xfffffffffffffffe, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x9}, {0x1, 0x1ff, 0x9, 0x292}, {0x1000}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x2c}, [@algo_crypt={0x58, 0x2, {{'cbc(twofish)\x00'}, 0x80, "0040002000008b0a696b0b86e3dc0100"}}]}, 0x148}}, 0x44050) socket$inet_udp(0x2, 0x2, 0x0) 11.529747019s ago: executing program 0 (id=7884): openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x1bc}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r6, &(0x7f0000000380)='100000', 0x6) r7 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r7, &(0x7f0000000200)='1', 0x1) r8 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r8, &(0x7f0000000280)='0', 0x1) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$packet(0x11, 0x2, 0x300) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r5, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x4, 0x32c, 0x0, r0}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x1, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x80, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r4, '\x00', {0xffd9, 0x826, 0x0, 0x0}}, 0x0) 9.913588339s ago: executing program 0 (id=7895): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f0000000080)=0x100000001, 0x4) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000000)=0x10000) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_TIOCINQ(r3, 0x541b, &(0x7f0000000140)) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$inet_tcp_int(r2, 0x6, 0x38, &(0x7f0000000040)=0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$6lowpan_enable(r5, &(0x7f0000000100)='0', 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000ac0)={0x2, &(0x7f0000000a80)=[{0x50, 0xff}, {0x16, 0x0, 0x3, 0x1}]}, 0x10) waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000180)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0xb, 0xfffff034}, {0x20, 0x81, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x2000000}]}, 0x10) sendmmsg(r0, &(0x7f0000001c00), 0x400000000000159, 0x40840) 9.59347011s ago: executing program 0 (id=7896): syz_usb_connect(0x5, 0x3d, &(0x7f0000000100)=ANY=[@ANYBLOB="120110019c3d9f08fd0b1b01a1330102030109022b00013507a0ce09046500028bc7ec0d0705c2be1b820f09050202"], 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) 6.424745832s ago: executing program 0 (id=7904): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000052e8e510b1134200c4dc0102030109021b00010000000009044400012eafb2000905810dff"], 0x0) nanosleep(&(0x7f0000000100)={0x2}, 0x0) syz_usb_disconnect(r0) 5.816852762s ago: executing program 5 (id=7915): syz_open_dev$dvb_dvr(&(0x7f0000000200), 0x0, 0x0) 5.816711174s ago: executing program 5 (id=7916): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 5.674094964s ago: executing program 4 (id=7917): r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040d80402c0000000000001090222000101008032090400000103000000092111010001223500070581030800"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022350000000600ff0901a10185110902150026ff0075089502810285210903150026ff0075089501810285910904150026ff00750895019102c0"], 0x0}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_usb_disconnect(r0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 5.04138633s ago: executing program 1 (id=7925): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", 0x80}], 0x1}], 0x1, 0x0) 5.012788412s ago: executing program 1 (id=7926): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x20, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x20}}, 0x0) 4.93693017s ago: executing program 1 (id=7927): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x16, 0x5, 0xb05, 0x8502, 0x0, 0x0, "05010902a10185030901150026ff00750895088102c0"}}, 0x12e) read(r0, &(0x7f0000002000), 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x9, "030000000000000000"}}, 0xf) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000140)={0xa, {0x1}}, 0xa) write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x9, "030000000000000000"}}, 0xf) nanosleep(&(0x7f0000000200)={0x0, 0x5000000}, 0x0) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000140)={0xa, {0x1}}, 0xa) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000180)={0xa, {0x2}}, 0xa) nanosleep(&(0x7f0000000200)={0x0, 0x5000000}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000080)={0xc, {0x9, "030000000000000000"}}, 0xf) 4.936781916s ago: executing program 5 (id=7928): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r0) 4.702812465s ago: executing program 1 (id=7929): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz1\x00', 0x3e, 0x3, 0x4b4, 0x1, 0x0, 0x0, "05010902a1010901a100050919012905150025019505750181029501750381010501093009311581257f75089502810609381581257f750895018106c0c0"}}, 0x152) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x4, "10000001"}}, 0xa) write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x4, "00000001"}}, 0xa) 4.005994987s ago: executing program 1 (id=7930): syz_usb_connect(0x2, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="1201100127aa18080204025683490102030109021200010000500f0904"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 4.005837337s ago: executing program 5 (id=7931): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x0, 0x0) read$proc_mixer(r0, &(0x7f0000000100), 0x3e8) 3.896632465s ago: executing program 5 (id=7932): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402f0700220001000000010902200001010080320904000002ffffff0007058102000200070502020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000140)) syz_usb_ep_write(r0, 0x81, 0xc, &(0x7f0000000220)="000d00000000000015000003") nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 3.429334618s ago: executing program 0 (id=7933): r0 = socket$inet(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x6f00}, 0x10) close(r0) 2.580551183s ago: executing program 4 (id=7935): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x10, &(0x7f0000000300)=""/100, 0x10, &(0x7f0000000400)=""/100, 0x10}) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x2) ioctl$DRM_IOCTL_VERSION(r1, 0xc0406400, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x10, &(0x7f0000000700)=""/100, 0x10, &(0x7f0000000800)=""/100, 0x10}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x2, 0x2) ioctl$DRM_IOCTL_VERSION(r2, 0xc0406400, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x10, &(0x7f0000000b00)=""/100, 0x10, &(0x7f0000000c00)=""/100, 0x10}) 2.577221857s ago: executing program 4 (id=7936): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000ac0)=@newsa={0x144, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20}, {@in=@broadcast, 0x1234, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0x10, 0x9, 0x2}, 0x0, 0x0, 0x2, 0x1}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}, 0x100, "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"}}]}, 0x158}}, 0x0) r1 = socket$inet(0x2, 0x3, 0x33) sendto$inet(r1, &(0x7f0000000000)="00040000000012340000000100"/24, 0x18, 0x0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) 2.541179952s ago: executing program 0 (id=7937): syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040450c60620001000000010902200001010080fa0904000001ff00000007058102400000"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000300)={0x2, 0x1, 0x1}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000400)=0x1) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000500)=0x1) close(r0) 2.472536377s ago: executing program 4 (id=7938): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$rfkill(r0, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x1}, 0x8) close(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) close(r1) 2.152209617s ago: executing program 4 (id=7940): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x1ff) 2.060198272s ago: executing program 4 (id=7942): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x0, 0x0, 0x2, '\x00d'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 2.048246904s ago: executing program 3 (id=7943): syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) 2.021271516s ago: executing program 3 (id=7944): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c60500100000000000010902200001010080320904000002080650000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0x1f, &(0x7f0000000200)=""/31) syz_usb_ep_write(r0, 0x81, 0x24, &(0x7f0000000300)='\x00\x00\x00\x00\x00\x00\x00\x00Option\x00'/37) syz_usb_ep_write(r0, 0x81, 0xd, &(0x7f0000000400)='USBS\x00\x00\x00\x00\x00\x00\x00\x00\x00') 1.816432487s ago: executing program 5 (id=7945): syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e300010102000109021900010100803209040000010000000007058202000200"], 0x0) nanosleep(&(0x7f0000000080)={0x1}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000240)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f00000002c0)=0x1) 1.816303562s ago: executing program 1 (id=7946): syz_usb_connect(0x3, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040c00902020001000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000200)={0x1}, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) ioctl$FE_READ_BER(r0, 0x80046f5e, &(0x7f0000000300)) 275.931781ms ago: executing program 3 (id=7947): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0b000000736f6e7900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030303a31313a32323a33333a34343a353500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000170005004c050000d5030000000000000000000005010905a10115002501750195080509190129088102c0"], 0x12f) close(r0) 232.770244ms ago: executing program 3 (id=7948): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x2, &(0x7f0000000100)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @exit], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 132.313536ms ago: executing program 3 (id=7949): r0 = syz_open_dev$media(&(0x7f0000000000), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000100)) 0s ago: executing program 3 (id=7950): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bridge_slave_0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bond_slave_0\x00'}}]}, 0x38}}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_ifreq(r1, 0x8991, &(0x7f0000000200)={'bond0\x00', @ifru_names='bond_slave_0\x00'}) ioctl$sock_ifreq(r1, 0x8914, &(0x7f0000000240)={'bridge0\x00', @ifru_flags}) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000280)='bridge0\x00') nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) kernel console output (not intermixed with test programs): <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1650.854948][T32737] RSP: 002b:00007fb4e45d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1650.854968][T32737] RAX: ffffffffffffffda RBX: 00007fb4e3a25fa0 RCX: 00007fb4e379e159 [ 1650.854983][T32737] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 1650.854996][T32737] RBP: 00007fb4e45d5090 R08: 00000000000003d0 R09: 0000000000000000 [ 1650.855009][T32737] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000002 [ 1650.855022][T32737] R13: 00007fb4e3a26038 R14: 00007fb4e3a25fa0 R15: 00007fb4e3b4fa48 [ 1650.855051][T32737] [ 1650.856281][T32737] warn_alloc: 2 callbacks suppressed [ 1650.856298][T32737] syz.4.7627: vmalloc error: size 4096, failed to allocated page array size 8, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1650.856362][T32737] CPU: 0 UID: 0 PID: 32737 Comm: syz.4.7627 Tainted: G L syzkaller #0 PREEMPT(full) [ 1650.856388][T32737] Tainted: [L]=SOFTLOCKUP [ 1650.856395][T32737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1650.856408][T32737] Call Trace: [ 1650.856416][T32737] [ 1650.856425][T32737] dump_stack_lvl+0xe8/0x150 [ 1650.856457][T32737] warn_alloc+0x24d/0x270 [ 1650.856483][T32737] ? __pfx_warn_alloc+0x10/0x10 [ 1650.856510][T32737] ? __kmalloc_node_noprof+0x4d7/0x720 [ 1650.856539][T32737] ? __get_vm_area_node+0x200/0x2f0 [ 1650.856569][T32737] ? __get_vm_area_node+0x283/0x2f0 [ 1650.856595][T32737] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1650.856615][T32737] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1650.856641][T32737] __vmalloc_node_range_noprof+0x969/0x1540 [ 1650.856676][T32737] ? __lock_acquire+0x747/0x2de0 [ 1650.856707][T32737] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1650.856734][T32737] ? __do_replace+0xb2/0x9a0 [ 1650.856766][T32737] vzalloc_noprof+0xb2/0xe0 [ 1650.856785][T32737] ? __do_replace+0xb2/0x9a0 [ 1650.856811][T32737] __do_replace+0xb2/0x9a0 [ 1650.856847][T32737] ? __pfx___do_replace+0x10/0x10 [ 1650.856875][T32737] ? _copy_from_user+0x94/0xb0 [ 1650.856907][T32737] do_ip6t_set_ctl+0xb45/0xe30 [ 1650.856940][T32737] ? rcu_is_watching+0x16/0xb0 [ 1650.856966][T32737] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 1650.857006][T32737] ? __mutex_unlock_slowpath+0x731/0x900 [ 1650.857041][T32737] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1650.857073][T32737] ? ksys_write+0x1e6/0x270 [ 1650.857104][T32737] nf_setsockopt+0x26f/0x290 [ 1650.857139][T32737] rawv6_setsockopt+0x276/0x5e0 [ 1650.857171][T32737] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 1650.857207][T32737] ? sock_common_setsockopt+0x36/0xc0 [ 1650.857239][T32737] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1650.857266][T32737] do_sock_setsockopt+0x17c/0x1b0 [ 1650.857299][T32737] __x64_sys_setsockopt+0x13d/0x1b0 [ 1650.857332][T32737] do_syscall_64+0x166/0x520 [ 1650.857360][T32737] ? trace_irq_disable+0x3b/0x140 [ 1650.857380][T32737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1650.857400][T32737] ? clear_bhb_loop+0x70/0xc0 [ 1650.857422][T32737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1650.857442][T32737] RIP: 0033:0x7fb4e379e159 [ 1650.857462][T32737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1650.857480][T32737] RSP: 002b:00007fb4e45d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1650.857500][T32737] RAX: ffffffffffffffda RBX: 00007fb4e3a25fa0 RCX: 00007fb4e379e159 [ 1650.857514][T32737] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 1650.857526][T32737] RBP: 00007fb4e45d5090 R08: 00000000000003d0 R09: 0000000000000000 [ 1650.857547][T32737] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000002 [ 1650.857559][T32737] R13: 00007fb4e3a26038 R14: 00007fb4e3a25fa0 R15: 00007fb4e3b4fa48 [ 1650.857589][T32737] [ 1650.925716][T32737] Mem-Info: [ 1650.925729][T32737] active_anon:10513 inactive_anon:0 isolated_anon:0 [ 1650.925729][T32737] active_file:11000 inactive_file:59355 isolated_file:0 [ 1650.925729][T32737] unevictable:0 dirty:212 writeback:0 [ 1650.925729][T32737] slab_reclaimable:13091 slab_unreclaimable:102605 [ 1650.925729][T32737] mapped:31945 shmem:2817 pagetables:1914 [ 1650.925729][T32737] sec_pagetables:0 bounce:0 [ 1650.925729][T32737] kernel_misc_reclaimable:0 [ 1650.925729][T32737] free:1209963 free_pcp:12528 free_cma:0 [ 1650.925759][T32737] Node 0 active_anon:42052kB inactive_anon:0kB active_file:44000kB inactive_file:237216kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:127772kB dirty:848kB writeback:0kB shmem:11268kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13448kB pagetables:7484kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1650.925788][T32737] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1650.925815][T32737] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1650.925853][T32737] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1650.925872][T32737] Node 0 DMA32 free:906128kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:42052kB inactive_anon:0kB active_file:44000kB inactive_file:237216kB unevictable:0kB writepending:848kB zspages:0kB present:3129332kB managed:2546828kB mlocked:0kB bounce:0kB free_pcp:38320kB local_pcp:19648kB free_cma:0kB [ 1650.925903][T32737] lowmem_reserve[]: 0 0 0 0 0 [ 1650.925920][T32737] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1650.925948][T32737] lowmem_reserve[]: 0 0 0 0 0 [ 1650.925966][T32737] Node 1 Normal free:3918368kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:11792kB local_pcp:11332kB free_cma:0kB [ 1650.925995][T32737] lowmem_reserve[]: 0 0 0 0 0 [ 1650.926013][T32737] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 1650.926105][T32737] Node 0 DMA32: 2490*4kB (ME) 2785*8kB (UME) 1788*16kB (UME) 1365*32kB (UME) 429*64kB (UME) 244*128kB (UME) 124*256kB (UME) 55*512kB (UME) 25*1024kB (ME) 3*2048kB (UME) 159*4096kB (UM) = 906128kB [ 1650.969789][T32737] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1650.969883][T32737] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 2*16kB (UM) 2*32kB (M) 15*64kB (UM) 6*128kB (UM) 7*256kB (UM) 6*512kB (UM) 2*1024kB (UM) 3*2048kB (UM) 953*4096kB (M) = 3918420kB [ 1650.970036][T32737] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1650.970053][T32737] Node 0 hugepages_total=6 hugepages_free=4 hugepages_surp=2 hugepages_size=2048kB [ 1650.970069][T32737] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1650.970085][T32737] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1650.970112][T32737] 73166 total pagecache pages [ 1650.970120][T32737] 0 pages in swap cache [ 1650.970127][T32737] Free swap = 124996kB [ 1650.970135][T32737] Total swap = 124996kB [ 1650.970143][T32737] 2097051 pages RAM [ 1650.970150][T32737] 0 pages HighMem/MovableOnly [ 1650.970158][T32737] 428728 pages reserved [ 1650.970165][T32737] 0 pages cma reserved [ 1651.019531][T13005] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1651.149424][T13005] usb 6-1: device descriptor read/64, error -71 [ 1651.389490][T13005] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1651.520232][T13005] usb 6-1: device descriptor read/64, error -71 [ 1651.629738][T13005] usb usb6-port1: attempt power cycle [ 1651.970387][T13005] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1651.998050][T13005] usb 6-1: device descriptor read/8, error -71 [ 1652.229363][T13005] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1652.249899][T13005] usb 6-1: device descriptor read/8, error -71 [ 1652.359651][T13005] usb usb6-port1: unable to enumerate USB device [ 1652.679018][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1654.369593][T29835] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 1654.499142][T29835] usb 4-1: device descriptor read/64, error -71 [ 1654.760361][T29835] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1654.898012][ T313] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[314] was attempted by "ci-upstream-kasan-gce/syz-executor exec"[313] [ 1654.899085][T29835] usb 4-1: device descriptor read/64, error -71 [ 1655.009651][T29835] usb usb4-port1: attempt power cycle [ 1655.359063][T29835] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1655.380179][T29835] usb 4-1: device descriptor read/8, error -71 [ 1655.426987][ T324] vivid-000: disconnect [ 1655.428372][ T324] tipc: Resetting bearer [ 1655.428538][ T324] tipc: Resetting bearer [ 1655.433655][ T324] bridge0: port 3(syz_tun) entered disabled state [ 1655.447955][ T324] bridge0: port 1(bridge_slave_0) entered disabled state [ 1655.451744][ T324] bridge0: port 2(bridge_slave_1) entered disabled state [ 1655.484500][ T325] netlink: 'syz.5.7646': attribute type 16 has an invalid length. [ 1655.484517][ T325] netlink: 'syz.5.7646': attribute type 17 has an invalid length. [ 1655.546240][ T325] : left promiscuous mode [ 1655.546267][ T325] : left allmulticast mode [ 1655.566232][ T325] tipc: Resetting bearer [ 1655.611146][ T324] vivid-000: reconnect [ 1655.627233][ T325] bridge0: port 3(syz_tun) entered blocking state [ 1655.627386][ T325] bridge0: port 3(syz_tun) entered forwarding state [ 1655.635768][T29835] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1655.662877][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 1655.662958][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1655.667010][ T325] bridge0: port 2(bridge_slave_1) entered blocking state [ 1655.667095][ T325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1655.691122][T29835] usb 4-1: device descriptor read/8, error -71 [ 1655.735739][ T325] bridge2: left promiscuous mode [ 1655.751581][ T325] bond1: left promiscuous mode [ 1655.783850][ T325] ip6gre1: left allmulticast mode [ 1655.800839][T29835] usb usb4-port1: unable to enumerate USB device [ 1655.901010][ T335] syz_tun: left allmulticast mode [ 1655.901039][ T335] syz_tun: left promiscuous mode [ 1655.901244][ T335] bridge0: port 3(syz_tun) entered disabled state [ 1655.934416][ T335] bridge_slave_0: left allmulticast mode [ 1655.934443][ T335] bridge_slave_0: left promiscuous mode [ 1655.934656][ T335] bridge0: port 1(bridge_slave_0) entered disabled state [ 1655.969058][ T336] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7650'. [ 1655.973254][ T337] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7650'. [ 1656.000757][ T335] bridge_slave_1: left allmulticast mode [ 1656.000782][ T335] bridge_slave_1: left promiscuous mode [ 1656.000982][ T335] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.003901][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 1656.003928][ T30] audit: type=1326 audit(1791127941.609:7515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=334 comm="syz.5.7650" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f49adf9e159 code=0x0 [ 1656.024695][ T339] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7651'. [ 1656.072808][ T335] bond0: (slave bond_slave_0): Releasing backup interface [ 1656.077214][ T335] bond0: (slave bond_slave_1): Releasing backup interface [ 1656.126248][ T335] team0: Port device team_slave_0 removed [ 1656.139161][ T335] team0: Port device team_slave_1 removed [ 1656.140109][ T335] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1656.140132][ T335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1656.143517][ T335] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1656.143541][ T335] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1656.145467][ T335] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1656.146271][ T341] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7651'. [ 1656.231367][ T339] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1657.272785][ T359] netlink: 'syz.3.7657': attribute type 12 has an invalid length. [ 1657.272809][ T359] netlink: 'syz.3.7657': attribute type 29 has an invalid length. [ 1657.272824][ T359] netlink: 148 bytes leftover after parsing attributes in process `syz.3.7657'. [ 1657.272844][ T359] netlink: 59 bytes leftover after parsing attributes in process `syz.3.7657'. [ 1657.395013][ T365] fuse: Bad value for 'fd' [ 1657.434681][ T363] loop4: detected capacity change from 0 to 2640 [ 1657.435201][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435229][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435247][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435264][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435282][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435319][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435345][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435362][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435371][ T363] ldm_validate_partition_table(): Disk read failed. [ 1657.435388][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435405][ T363] Buffer I/O error on dev loop4, logical block 0, async page read [ 1657.435432][ T363] Dev loop4: unable to read RDB block 0 [ 1657.435561][ T363] loop4: unable to read partition table [ 1657.436493][ T363] loop_reread_partitions: partition scan of loop4 (3 ) failed (rc=-5) [ 1658.559547][T13005] usb 6-1: new full-speed USB device number 63 using dummy_hcd [ 1658.711350][T13005] usb 6-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 1658.712484][T13005] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1658.712512][T13005] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1658.718602][T13005] usb 6-1: config 0 descriptor?? [ 1658.940130][T25637] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1658.969383][T29241] Bluetooth: hci0: unexpected event for opcode 0x041c [ 1658.972319][ T388] binder: 386:388 ioctl c018620c 200000000000 returned -22 [ 1659.069440][T25637] usb 2-1: device descriptor read/64, error -71 [ 1659.309578][T25637] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1659.440492][T25637] usb 2-1: device descriptor read/64, error -71 [ 1659.549403][T25637] usb usb2-port1: attempt power cycle [ 1659.682543][ T400] FAULT_INJECTION: forcing a failure. [ 1659.682543][ T400] name failslab, interval 1, probability 0, space 0, times 0 [ 1659.682569][ T400] CPU: 1 UID: 0 PID: 400 Comm: syz.4.7672 Tainted: G L syzkaller #0 PREEMPT(full) [ 1659.682585][ T400] Tainted: [L]=SOFTLOCKUP [ 1659.682589][ T400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1659.682595][ T400] Call Trace: [ 1659.682602][ T400] [ 1659.682608][ T400] dump_stack_lvl+0xe8/0x150 [ 1659.682629][ T400] should_fail_ex+0x410/0x560 [ 1659.682645][ T400] should_failslab+0xa8/0x100 [ 1659.682662][ T400] __kmalloc_noprof+0xfe/0x720 [ 1659.682674][ T400] ? ip_vs_mh_reassign+0xf0/0x1070 [ 1659.682690][ T400] ? ip_vs_mh_reassign+0xf0/0x1070 [ 1659.682708][ T400] ip_vs_mh_reassign+0xf0/0x1070 [ 1659.682729][ T400] ? __pfx_ip_vs_mh_reassign+0x10/0x10 [ 1659.682746][ T400] ? ip_vs_mh_dest_changed+0x20b/0x2c0 [ 1659.682764][ T400] ip_vs_add_dest+0x1734/0x1d80 [ 1659.682787][ T400] ? __pfx_ip_vs_add_dest+0x10/0x10 [ 1659.682809][ T400] do_ip_vs_set_ctl+0x8ae/0xaf0 [ 1659.682824][ T400] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 1659.682850][ T400] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1659.682874][ T400] nf_setsockopt+0x26f/0x290 [ 1659.682890][ T400] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1659.682905][ T400] do_sock_setsockopt+0x17c/0x1b0 [ 1659.682923][ T400] __x64_sys_setsockopt+0x13d/0x1b0 [ 1659.682940][ T400] do_syscall_64+0x166/0x520 [ 1659.682954][ T400] ? trace_irq_disable+0x3b/0x140 [ 1659.682967][ T400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1659.682977][ T400] ? clear_bhb_loop+0x70/0xc0 [ 1659.682995][ T400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1659.683005][ T400] RIP: 0033:0x7fb4e379e159 [ 1659.683017][ T400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1659.683026][ T400] RSP: 002b:00007fb4e45d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1659.683039][ T400] RAX: ffffffffffffffda RBX: 00007fb4e3a25fa0 RCX: 00007fb4e379e159 [ 1659.683047][ T400] RDX: 0000000000000487 RSI: 0000000000000000 RDI: 0000000000000006 [ 1659.683054][ T400] RBP: 00007fb4e45d5090 R08: 0000000000000044 R09: 0000000000000000 [ 1659.683060][ T400] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 1659.683067][ T400] R13: 00007fb4e3a26038 R14: 00007fb4e3a25fa0 R15: 00007fb4e3b4fa48 [ 1659.683083][ T400] [ 1659.889585][T25637] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1659.921263][T25637] usb 2-1: device descriptor read/8, error -71 [ 1660.139359][ T408] FAULT_INJECTION: forcing a failure. [ 1660.139359][ T408] name failslab, interval 1, probability 0, space 0, times 0 [ 1660.139393][ T408] CPU: 0 UID: 0 PID: 408 Comm: syz.3.7673 Tainted: G L syzkaller #0 PREEMPT(full) [ 1660.139415][ T408] Tainted: [L]=SOFTLOCKUP [ 1660.139421][ T408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1660.139432][ T408] Call Trace: [ 1660.139438][ T408] [ 1660.139445][ T408] dump_stack_lvl+0xe8/0x150 [ 1660.139473][ T408] should_fail_ex+0x410/0x560 [ 1660.139495][ T408] ? __alloc_skb+0x1db/0x7a0 [ 1660.139515][ T408] should_failslab+0xa8/0x100 [ 1660.139536][ T408] ? __alloc_skb+0x1db/0x7a0 [ 1660.139553][ T408] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1660.139569][ T408] ? __alloc_skb+0x18d/0x7a0 [ 1660.139587][ T408] ? __alloc_skb+0x1db/0x7a0 [ 1660.139610][ T408] __alloc_skb+0x1db/0x7a0 [ 1660.139632][ T408] netlink_dump+0x1e7/0xee0 [ 1660.139657][ T408] ? __pfx_netlink_dump+0x10/0x10 [ 1660.139682][ T408] ? genl_start+0x497/0x6d0 [ 1660.139706][ T408] __netlink_dump_start+0x589/0x7b0 [ 1660.139727][ T408] genl_family_rcv_msg_dumpit+0x213/0x310 [ 1660.139749][ T408] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 1660.139768][ T408] ? genl_get_cmd+0x4d6/0x960 [ 1660.139790][ T408] ? __pfx_genl_start+0x10/0x10 [ 1660.139808][ T408] ? __pfx_genl_dumpit+0x10/0x10 [ 1660.139825][ T408] ? __pfx_genl_done+0x10/0x10 [ 1660.139845][ T408] ? __lock_acquire+0x747/0x2de0 [ 1660.139879][ T408] genl_rcv_msg+0x5e1/0x7a0 [ 1660.139902][ T408] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1660.139921][ T408] ? __pfx_netdev_nl_page_pool_get_dumpit+0x10/0x10 [ 1660.140034][ T408] netlink_rcv_skb+0x226/0x4a0 [ 1660.140053][ T408] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1660.140074][ T408] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1660.140101][ T408] ? down_read+0x2be/0x330 [ 1660.140119][ T408] genl_rcv+0x28/0x40 [ 1660.140136][ T408] netlink_unicast+0x7bd/0x940 [ 1660.140167][ T408] netlink_sendmsg+0x813/0xb40 [ 1660.140191][ T408] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1660.140213][ T408] ? apparmor_socket_sendmsg+0x98/0x360 [ 1660.140235][ T408] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1660.140250][ T408] sock_sendmsg_nosec+0x13a/0x180 [ 1660.140270][ T408] ____sys_sendmsg+0x54e/0x850 [ 1660.140295][ T408] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1660.140324][ T408] ? import_iovec+0x73/0xa0 [ 1660.140347][ T408] ___sys_sendmsg+0x2a5/0x360 [ 1660.140368][ T408] ? __lock_acquire+0x747/0x2de0 [ 1660.140388][ T408] ? __pfx____sys_sendmsg+0x10/0x10 [ 1660.140436][ T408] ? __fget_files+0x2a/0x420 [ 1660.140457][ T408] ? __fget_files+0x3a2/0x420 [ 1660.140486][ T408] __x64_sys_sendmsg+0x1b1/0x290 [ 1660.140510][ T408] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1660.140548][ T408] do_syscall_64+0x166/0x520 [ 1660.140569][ T408] ? trace_irq_disable+0x3b/0x140 [ 1660.140585][ T408] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1660.140601][ T408] ? clear_bhb_loop+0x70/0xc0 [ 1660.140620][ T408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1660.140636][ T408] RIP: 0033:0x7fbf6d79e159 [ 1660.140652][ T408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1660.140666][ T408] RSP: 002b:00007fbf6e5e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1660.140683][ T408] RAX: ffffffffffffffda RBX: 00007fbf6da25fa0 RCX: 00007fbf6d79e159 [ 1660.140694][ T408] RDX: 0000000000040810 RSI: 0000200000000180 RDI: 0000000000000003 [ 1660.140704][ T408] RBP: 00007fbf6e5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1660.140714][ T408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1660.140723][ T408] R13: 00007fbf6da26038 R14: 00007fbf6da25fa0 R15: 00007fbf6db4fa48 [ 1660.140747][ T408] [ 1660.159528][T25637] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1660.187326][T25637] usb 2-1: device descriptor read/8, error -71 [ 1660.294536][T25637] usb usb2-port1: unable to enumerate USB device [ 1660.615887][ T412] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7677'. [ 1660.615922][ T412] lo: left promiscuous mode [ 1660.862483][ T418] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7678'. [ 1660.899929][ T418] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7678'. [ 1661.002496][ T421] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7679'. [ 1661.079065][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1661.395105][T13005] usbhid 6-1:0.0: can't add hid device: -71 [ 1661.395175][T13005] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1661.407645][T13005] usb 6-1: USB disconnect, device number 63 [ 1661.637057][ T442] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7684'. [ 1661.655249][ T442] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7684'. [ 1661.890262][ T447] dummy0: entered promiscuous mode [ 1661.892063][ T447] mac80211_hwsim hwsim73 wlan5: entered promiscuous mode [ 1661.899201][T13005] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1661.992809][ T435] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7683'. [ 1662.031558][ T449] FAULT_INJECTION: forcing a failure. [ 1662.031558][ T449] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1662.031583][ T449] CPU: 1 UID: 0 PID: 449 Comm: syz.1.7688 Tainted: G L syzkaller #0 PREEMPT(full) [ 1662.031598][ T449] Tainted: [L]=SOFTLOCKUP [ 1662.031603][ T449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1662.031609][ T449] Call Trace: [ 1662.031615][ T449] [ 1662.031621][ T449] dump_stack_lvl+0xe8/0x150 [ 1662.031642][ T449] should_fail_ex+0x410/0x560 [ 1662.031659][ T449] _copy_to_user+0x31/0xb0 [ 1662.031675][ T449] simple_read_from_buffer+0xe1/0x170 [ 1662.031695][ T449] proc_fail_nth_read+0x1bb/0x230 [ 1662.031707][ T449] ? common_file_perm+0x20e/0x2b0 [ 1662.031724][ T449] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1662.031737][ T449] ? rw_verify_area+0x24a/0x4c0 [ 1662.031754][ T449] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1662.031765][ T449] vfs_read+0x213/0xa80 [ 1662.031778][ T449] ? __pfx___mutex_lock+0x10/0x10 [ 1662.031795][ T449] ? __pfx_vfs_read+0x10/0x10 [ 1662.031806][ T449] ? __fget_files+0x2a/0x420 [ 1662.031823][ T449] ? __fget_files+0x3a2/0x420 [ 1662.031837][ T449] ? __fget_files+0x2a/0x420 [ 1662.031856][ T449] ksys_read+0x150/0x270 [ 1662.031868][ T449] ? __pfx_ksys_read+0x10/0x10 [ 1662.031892][ T449] do_syscall_64+0x166/0x520 [ 1662.031907][ T449] ? trace_irq_disable+0x3b/0x140 [ 1662.031919][ T449] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1662.031930][ T449] ? clear_bhb_loop+0x70/0xc0 [ 1662.031943][ T449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1662.031954][ T449] RIP: 0033:0x7f1fbf15e98e [ 1662.031965][ T449] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1662.031975][ T449] RSP: 002b:00007f1fc008cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1662.031987][ T449] RAX: ffffffffffffffda RBX: 00007f1fc008d6c0 RCX: 00007f1fbf15e98e [ 1662.031995][ T449] RDX: 000000000000000f RSI: 00007f1fc008d0a0 RDI: 0000000000000004 [ 1662.032003][ T449] RBP: 00007f1fc008d090 R08: 0000000000000000 R09: 0000000000000000 [ 1662.032009][ T449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1662.032016][ T449] R13: 00007f1fbf426038 R14: 00007f1fbf425fa0 R15: 00007f1fbf54fa48 [ 1662.032032][ T449] [ 1662.053990][T13005] usb 6-1: Using ep0 maxpacket: 16 [ 1662.071201][T13005] usb 6-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 1662.107025][T13005] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1662.107052][T13005] usb 6-1: Product: syz [ 1662.107068][T13005] usb 6-1: Manufacturer: syz [ 1662.107083][T13005] usb 6-1: SerialNumber: syz [ 1662.184695][T13005] usb 6-1: config 0 descriptor?? [ 1662.198245][T13005] gspca_main: spca508-2.14.0 probing 041e:4018 [ 1662.401870][T13005] gspca_spca508: reg_read err -32 [ 1662.473235][T13005] gspca_spca508: reg_read err -32 [ 1662.504002][ T443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1662.504497][ T443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1662.508022][T13005] gspca_spca508: reg_read err -32 [ 1662.511435][T13005] gspca_spca508: reg_read err -32 [ 1662.511998][T13005] gspca_spca508: reg_read err -32 [ 1663.512523][ T481] netlink: 14 bytes leftover after parsing attributes in process `syz.1.7698'. [ 1663.528932][T15293] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 1663.659476][T15293] usb 4-1: device descriptor read/64, error -71 [ 1663.899038][T15293] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1664.029103][T15293] usb 4-1: device descriptor read/64, error -71 [ 1664.139465][T15293] usb usb4-port1: attempt power cycle [ 1664.478891][T15293] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 1664.500151][T15293] usb 4-1: device descriptor read/8, error -71 [ 1664.563860][ T500] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1664.644284][T13005] gspca_spca508: reg write: error -71 [ 1664.644339][T13005] spca508 6-1:0.0: probe with driver spca508 failed with error -71 [ 1664.652274][T13005] usb 6-1: USB disconnect, device number 64 [ 1664.753105][T15293] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 1664.772216][T15293] usb 4-1: device descriptor read/8, error -71 [ 1664.879236][T15293] usb usb4-port1: unable to enumerate USB device [ 1666.183289][ T534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7715'. [ 1666.183312][ T534] netlink: 'syz.4.7715': attribute type 1 has an invalid length. [ 1666.817518][ T542] FAULT_INJECTION: forcing a failure. [ 1666.817518][ T542] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1666.817555][ T542] CPU: 1 UID: 0 PID: 542 Comm: syz.3.7720 Tainted: G L syzkaller #0 PREEMPT(full) [ 1666.817602][ T542] Tainted: [L]=SOFTLOCKUP [ 1666.817610][ T542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1666.817622][ T542] Call Trace: [ 1666.817648][ T542] [ 1666.817657][ T542] dump_stack_lvl+0xe8/0x150 [ 1666.817692][ T542] should_fail_ex+0x410/0x560 [ 1666.817722][ T542] _copy_from_user+0x2d/0xb0 [ 1666.817752][ T542] dev_ethtool+0xdb/0x29e0 [ 1666.817778][ T542] ? __lock_acquire+0x747/0x2de0 [ 1666.817813][ T542] ? __pfx_dev_ethtool+0x10/0x10 [ 1666.817840][ T542] ? kasan_quarantine_put+0xbb/0x1f0 [ 1666.817867][ T542] ? lock_acquire+0x115/0x350 [ 1666.817895][ T542] ? dev_load+0x21/0x1f0 [ 1666.817922][ T542] ? dev_load+0x21/0x1f0 [ 1666.817948][ T542] dev_ioctl+0x392/0x1150 [ 1666.817977][ T542] sock_do_ioctl+0x23e/0x320 [ 1666.818000][ T542] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1666.818019][ T542] ? hook_file_ioctl+0x1f2/0x600 [ 1666.818054][ T542] sock_ioctl+0x57a/0x7e0 [ 1666.818075][ T542] ? __pfx_sock_ioctl+0x10/0x10 [ 1666.818093][ T542] ? __fget_files+0x2a/0x420 [ 1666.818115][ T542] ? __fget_files+0x3a2/0x420 [ 1666.818136][ T542] ? __fget_files+0x2a/0x420 [ 1666.818166][ T542] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1666.818195][ T542] ? __pfx_sock_ioctl+0x10/0x10 [ 1666.818214][ T542] __se_sys_ioctl+0xfc/0x170 [ 1666.818241][ T542] do_syscall_64+0x166/0x520 [ 1666.818269][ T542] ? trace_irq_disable+0x3b/0x140 [ 1666.818288][ T542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1666.818348][ T542] ? clear_bhb_loop+0x70/0xc0 [ 1666.818368][ T542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1666.818387][ T542] RIP: 0033:0x7fbf6d79e159 [ 1666.818408][ T542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1666.818426][ T542] RSP: 002b:00007fbf6e5c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1666.818449][ T542] RAX: ffffffffffffffda RBX: 00007fbf6da26090 RCX: 00007fbf6d79e159 [ 1666.818464][ T542] RDX: 00002000000001c0 RSI: 0000000000008946 RDI: 0000000000000007 [ 1666.818478][ T542] RBP: 00007fbf6e5c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1666.818499][ T542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1666.818511][ T542] R13: 00007fbf6da26128 R14: 00007fbf6da26090 R15: 00007fbf6db4fa48 [ 1666.818541][ T542] [ 1667.231956][T12924] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1667.256840][T12924] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1667.260748][T12924] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1667.276371][T12924] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1667.278574][T12924] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1667.683954][ T550] netlink: 8588 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.683979][ T550] netlink: 87 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.684009][ T550] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.684024][ T550] netlink: 248 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.684038][ T550] netlink: 205 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.684054][ T550] netlink: 5 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1667.684067][ T550] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1668.086698][T12484] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1668.086737][T12484] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1668.265497][ T558] syz.3.7723: vmalloc error: size 16384, failed to allocate pages, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1668.265574][ T558] CPU: 0 UID: 0 PID: 558 Comm: syz.3.7723 Tainted: G L syzkaller #0 PREEMPT(full) [ 1668.265603][ T558] Tainted: [L]=SOFTLOCKUP [ 1668.265612][ T558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1668.265626][ T558] Call Trace: [ 1668.265635][ T558] [ 1668.265644][ T558] dump_stack_lvl+0xe8/0x150 [ 1668.265680][ T558] warn_alloc+0x24d/0x270 [ 1668.265710][ T558] ? __pfx_warn_alloc+0x10/0x10 [ 1668.265739][ T558] ? alloc_pages_mpol+0x256/0x390 [ 1668.265778][ T558] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 1668.265836][ T558] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1668.265858][ T558] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.265890][ T558] ? rcu_is_watching+0x16/0xb0 [ 1668.265918][ T558] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.265947][ T558] ? rcu_is_watching+0x16/0xb0 [ 1668.265976][ T558] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.266008][ T558] __kvmalloc_node_noprof+0x5a1/0x820 [ 1668.266034][ T558] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.266066][ T558] ? __kmalloc_cache_noprof+0x321/0x600 [ 1668.266090][ T558] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.266128][ T558] io_ring_ctx_alloc+0x1ad/0xb80 [ 1668.266161][ T558] ? io_prepare_config+0x8c8/0xc70 [ 1668.266192][ T558] io_uring_create+0x50/0x990 [ 1668.266232][ T558] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1668.266262][ T558] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1668.266302][ T558] ? rcu_is_watching+0x16/0xb0 [ 1668.266340][ T558] do_syscall_64+0x166/0x520 [ 1668.266370][ T558] ? trace_irq_disable+0x3b/0x140 [ 1668.266398][ T558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.266420][ T558] ? clear_bhb_loop+0x70/0xc0 [ 1668.266446][ T558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.266468][ T558] RIP: 0033:0x7fbf6d79e159 [ 1668.266489][ T558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1668.266507][ T558] RSP: 002b:00007fbf6e5e7ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1668.266530][ T558] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007fbf6d79e159 [ 1668.266547][ T558] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 1668.266562][ T558] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 1668.266577][ T558] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 1668.266593][ T558] R13: 0000200000000890 R14: 00007fbf6e5e7fd8 R15: 0000000000000000 [ 1668.266624][ T558] [ 1668.266716][ T558] Mem-Info: [ 1668.266727][ T558] active_anon:13843 inactive_anon:0 isolated_anon:0 [ 1668.266727][ T558] active_file:11000 inactive_file:59362 isolated_file:0 [ 1668.266727][ T558] unevictable:0 dirty:307 writeback:0 [ 1668.266727][ T558] slab_reclaimable:12227 slab_unreclaimable:104334 [ 1668.266727][ T558] mapped:36245 shmem:6140 pagetables:1859 [ 1668.266727][ T558] sec_pagetables:0 bounce:0 [ 1668.266727][ T558] kernel_misc_reclaimable:0 [ 1668.266727][ T558] free:1211409 free_pcp:11405 free_cma:0 [ 1668.266783][ T558] Node 0 active_anon:55372kB inactive_anon:0kB active_file:44000kB inactive_file:237244kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:144972kB dirty:1228kB writeback:0kB shmem:24560kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13452kB pagetables:7264kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1668.266852][ T558] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1668.266909][ T558] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1668.266971][ T558] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1668.267009][ T558] Node 0 DMA32 free:911948kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:55372kB inactive_anon:0kB active_file:44000kB inactive_file:237244kB unevictable:0kB writepending:1228kB zspages:0kB present:3129332kB managed:2546828kB mlocked:0kB bounce:0kB free_pcp:34300kB local_pcp:10476kB free_cma:0kB [ 1668.267072][ T558] lowmem_reserve[]: 0 0 0 0 0 [ 1668.267108][ T558] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1668.267165][ T558] lowmem_reserve[]: 0 0 0 0 0 [ 1668.267201][ T558] Node 1 Normal free:3918332kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:11300kB local_pcp:11068kB free_cma:0kB [ 1668.267261][ T558] lowmem_reserve[]: 0 0 0 0 0 [ 1668.267297][ T558] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 1668.267450][ T558] Node 0 DMA32: 1*4kB (M) 1485*8kB (UME) 1847*16kB (UM) 1409*32kB (UME) 426*64kB (UME) 247*128kB (UME) 132*256kB (UME) 73*512kB (UME) 43*1024kB (UME) 6*2048kB (UME) 156*4096kB (UM) = 911868kB [ 1668.267616][ T558] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1668.267718][ T558] Node 1 Normal: 4*4kB (UM) 2*8kB (M) 3*16kB (UM) 1*32kB (M) 11*64kB (UM) 6*128kB (UM) 6*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 953*4096kB (M) = 3918384kB [ 1668.267958][ T558] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1668.267977][ T558] Node 0 hugepages_total=5 hugepages_free=4 hugepages_surp=1 hugepages_size=2048kB [ 1668.267993][ T558] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1668.268010][ T558] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1668.268027][ T558] 76523 total pagecache pages [ 1668.268036][ T558] 0 pages in swap cache [ 1668.268044][ T558] Free swap = 124996kB [ 1668.268052][ T558] Total swap = 124996kB [ 1668.268061][ T558] 2097051 pages RAM [ 1668.268067][ T558] 0 pages HighMem/MovableOnly [ 1668.268075][ T558] 428728 pages reserved [ 1668.268083][ T558] 0 pages cma reserved [ 1668.466518][ T544] bridge0: port 1(bridge_slave_0) entered blocking state [ 1668.466694][ T544] bridge0: port 1(bridge_slave_0) entered disabled state [ 1668.466864][ T544] bridge_slave_0: entered allmulticast mode [ 1668.490402][ T544] bridge_slave_0: entered promiscuous mode [ 1668.493557][ T544] bridge0: port 2(bridge_slave_1) entered blocking state [ 1668.493657][ T544] bridge0: port 2(bridge_slave_1) entered disabled state [ 1668.493798][ T544] bridge_slave_1: entered allmulticast mode [ 1668.497495][ T544] bridge_slave_1: entered promiscuous mode [ 1668.773535][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.773596][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.066520][T12484] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.066545][T12484] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1669.145170][ T544] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1669.165756][ T544] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1669.224621][ T544] team0: Port device team_slave_0 added [ 1669.226805][ T544] team0: Port device team_slave_1 added [ 1669.350555][T13005] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1669.408673][T12924] Bluetooth: hci1: command tx timeout [ 1669.436075][T12484] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.436098][T12484] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1669.511869][T13005] usb 4-1: Using ep0 maxpacket: 8 [ 1669.512672][T13005] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1669.515791][T13005] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1669.515812][T13005] usb 4-1: Product: syz [ 1669.515820][T13005] usb 4-1: Manufacturer: syz [ 1669.515828][T13005] usb 4-1: SerialNumber: syz [ 1669.518392][T13005] usb 4-1: config 0 descriptor?? [ 1669.581920][ T544] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1669.581933][ T544] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1669.581948][ T544] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1669.584433][ T544] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1669.584448][ T544] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1669.584470][ T544] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1669.727221][T13005] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1669.811468][T12484] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1669.811492][T12484] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1669.964654][ T544] hsr_slave_0: entered promiscuous mode [ 1669.984927][ T544] hsr_slave_1: entered promiscuous mode [ 1669.985561][ T544] debugfs: 'hsr0' already exists in 'hsr' [ 1669.985581][ T544] Cannot create hsr debugfs directory [ 1670.496425][T12484] pimreg: left allmulticast mode [ 1670.561663][ T573] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7726'. [ 1670.629550][ T593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7726'. [ 1671.400237][T13005] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1671.424869][T12484] bond2 (unregistering): (slave geneve2): Releasing active interface [ 1671.479216][T12924] Bluetooth: hci1: command tx timeout [ 1671.596523][T12484] bond0 (unregistering): Released all slaves [ 1671.683548][T12484] bond1 (unregistering): Released all slaves [ 1671.752588][ T608] FAULT_INJECTION: forcing a failure. [ 1671.752588][ T608] name failslab, interval 1, probability 0, space 0, times 0 [ 1671.752626][ T608] CPU: 0 UID: 0 PID: 608 Comm: syz.5.7733 Tainted: G L syzkaller #0 PREEMPT(full) [ 1671.752653][ T608] Tainted: [L]=SOFTLOCKUP [ 1671.752661][ T608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1671.752673][ T608] Call Trace: [ 1671.752681][ T608] [ 1671.752690][ T608] dump_stack_lvl+0xe8/0x150 [ 1671.752726][ T608] should_fail_ex+0x410/0x560 [ 1671.752761][ T608] ? __alloc_skb+0x1db/0x7a0 [ 1671.752788][ T608] should_failslab+0xa8/0x100 [ 1671.752817][ T608] ? __alloc_skb+0x1db/0x7a0 [ 1671.752842][ T608] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1671.752863][ T608] ? __alloc_skb+0x18d/0x7a0 [ 1671.752890][ T608] ? __alloc_skb+0x1db/0x7a0 [ 1671.752922][ T608] __alloc_skb+0x1db/0x7a0 [ 1671.752953][ T608] netlink_dump+0x1e7/0xee0 [ 1671.752974][ T608] ? __netlink_lookup+0xc6/0x8b0 [ 1671.753007][ T608] ? __pfx_netlink_dump+0x10/0x10 [ 1671.753042][ T608] ? netlink_lookup+0x30/0x200 [ 1671.753061][ T608] ? netlink_lookup+0x30/0x200 [ 1671.753085][ T608] __netlink_dump_start+0x589/0x7b0 [ 1671.753110][ T608] rtnetlink_rcv_msg+0xa48/0xc00 [ 1671.753137][ T608] ? __pfx_rtm_dump_nexthop_bucket+0x10/0x10 [ 1671.753235][ T608] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1671.753259][ T608] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1671.753282][ T608] ? ref_tracker_free+0x689/0x830 [ 1671.753307][ T608] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1671.753332][ T608] ? __pfx_rtm_dump_nexthop_bucket+0x10/0x10 [ 1671.753363][ T608] netlink_rcv_skb+0x226/0x4a0 [ 1671.753385][ T608] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1671.753413][ T608] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1671.753442][ T608] ? netlink_deliver_tap+0x2e/0x1b0 [ 1671.753463][ T608] ? netlink_deliver_tap+0x2e/0x1b0 [ 1671.753488][ T608] netlink_unicast+0x7bd/0x940 [ 1671.753528][ T608] netlink_sendmsg+0x813/0xb40 [ 1671.753559][ T608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1671.753595][ T608] ? apparmor_socket_sendmsg+0x98/0x360 [ 1671.753623][ T608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1671.753643][ T608] sock_sendmsg_nosec+0x13a/0x180 [ 1671.753669][ T608] ____sys_sendmsg+0x54e/0x850 [ 1671.753704][ T608] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1671.753742][ T608] ? import_iovec+0x73/0xa0 [ 1671.753772][ T608] ___sys_sendmsg+0x2a5/0x360 [ 1671.753800][ T608] ? __lock_acquire+0x747/0x2de0 [ 1671.753826][ T608] ? __pfx____sys_sendmsg+0x10/0x10 [ 1671.753884][ T608] ? __fget_files+0x2a/0x420 [ 1671.753909][ T608] ? __fget_files+0x3a2/0x420 [ 1671.753942][ T608] __x64_sys_sendmsg+0x1b1/0x290 [ 1671.753973][ T608] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1671.754022][ T608] do_syscall_64+0x166/0x520 [ 1671.754051][ T608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.754071][ T608] ? clear_bhb_loop+0x70/0xc0 [ 1671.754095][ T608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.754115][ T608] RIP: 0033:0x7f49adf9e159 [ 1671.754137][ T608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.754155][ T608] RSP: 002b:00007f49aed82028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1671.754176][ T608] RAX: ffffffffffffffda RBX: 00007f49ae225fa0 RCX: 00007f49adf9e159 [ 1671.754191][ T608] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1671.754204][ T608] RBP: 00007f49aed82090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.754214][ T608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.754224][ T608] R13: 00007f49ae226038 R14: 00007f49ae225fa0 R15: 00007f49ae34fa48 [ 1671.754250][ T608] [ 1671.755460][T12484] bond2 (unregistering): Released all slaves [ 1671.817509][T12484] bond3 (unregistering): Released all slaves [ 1672.007684][T25637] usb 4-1: USB disconnect, device number 40 [ 1672.163758][ T5280] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1672.426477][ T611] FAULT_INJECTION: forcing a failure. [ 1672.426477][ T611] name failslab, interval 1, probability 0, space 0, times 0 [ 1672.426514][ T611] CPU: 1 UID: 0 PID: 611 Comm: syz.5.7734 Tainted: G L syzkaller #0 PREEMPT(full) [ 1672.426539][ T611] Tainted: [L]=SOFTLOCKUP [ 1672.426545][ T611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1672.426557][ T611] Call Trace: [ 1672.426565][ T611] [ 1672.426574][ T611] dump_stack_lvl+0xe8/0x150 [ 1672.426606][ T611] should_fail_ex+0x410/0x560 [ 1672.426628][ T611] should_failslab+0xa8/0x100 [ 1672.426643][ T611] ? skb_clone+0x212/0x3a0 [ 1672.426655][ T611] kmem_cache_alloc_noprof+0xa1/0x600 [ 1672.426668][ T611] ? skb_clone+0x212/0x3a0 [ 1672.426681][ T611] skb_clone+0x212/0x3a0 [ 1672.426694][ T611] __netlink_deliver_tap+0x413/0x860 [ 1672.426712][ T611] ? netlink_deliver_tap+0x2e/0x1b0 [ 1672.426725][ T611] netlink_deliver_tap+0x19c/0x1b0 [ 1672.426737][ T611] __netlink_sendskb+0x47/0x90 [ 1672.426754][ T611] netlink_dump+0xa8c/0xee0 [ 1672.426765][ T611] ? __netlink_lookup+0xc6/0x8b0 [ 1672.426782][ T611] ? __pfx_netlink_dump+0x10/0x10 [ 1672.426798][ T611] ? netlink_lookup+0x30/0x200 [ 1672.426808][ T611] ? netlink_lookup+0x30/0x200 [ 1672.426822][ T611] __netlink_dump_start+0x589/0x7b0 [ 1672.426837][ T611] rtnetlink_rcv_msg+0xa48/0xc00 [ 1672.426854][ T611] ? __pfx_tc_dump_qdisc+0x10/0x10 [ 1672.426967][ T611] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1672.426981][ T611] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1672.426995][ T611] ? ref_tracker_free+0x689/0x830 [ 1672.427008][ T611] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1672.427022][ T611] ? __pfx_tc_dump_qdisc+0x10/0x10 [ 1672.427041][ T611] netlink_rcv_skb+0x226/0x4a0 [ 1672.427053][ T611] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1672.427071][ T611] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1672.427096][ T611] ? netlink_deliver_tap+0x2e/0x1b0 [ 1672.427107][ T611] ? netlink_deliver_tap+0x2e/0x1b0 [ 1672.427121][ T611] netlink_unicast+0x7bd/0x940 [ 1672.427142][ T611] netlink_sendmsg+0x813/0xb40 [ 1672.427159][ T611] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.427174][ T611] ? apparmor_socket_sendmsg+0x18b/0x360 [ 1672.427190][ T611] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.427201][ T611] sock_sendmsg_nosec+0x13a/0x180 [ 1672.427216][ T611] ____sys_sendmsg+0x54e/0x850 [ 1672.427234][ T611] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1672.427254][ T611] ? import_iovec+0x73/0xa0 [ 1672.427270][ T611] ___sys_sendmsg+0x2a5/0x360 [ 1672.427285][ T611] ? __lock_acquire+0x747/0x2de0 [ 1672.427300][ T611] ? __pfx____sys_sendmsg+0x10/0x10 [ 1672.427333][ T611] ? __fget_files+0x2a/0x420 [ 1672.427348][ T611] ? __fget_files+0x3a2/0x420 [ 1672.427368][ T611] __x64_sys_sendmsg+0x1b1/0x290 [ 1672.427385][ T611] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1672.427411][ T611] do_syscall_64+0x166/0x520 [ 1672.427427][ T611] ? trace_irq_disable+0x3b/0x140 [ 1672.427438][ T611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.427450][ T611] ? clear_bhb_loop+0x70/0xc0 [ 1672.427463][ T611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.427474][ T611] RIP: 0033:0x7f49adf9e159 [ 1672.427486][ T611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.427496][ T611] RSP: 002b:00007f49aed82028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1672.427509][ T611] RAX: ffffffffffffffda RBX: 00007f49ae225fa0 RCX: 00007f49adf9e159 [ 1672.427518][ T611] RDX: 0000000020004000 RSI: 0000200000000180 RDI: 0000000000000003 [ 1672.427529][ T611] RBP: 00007f49aed82090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.427540][ T611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1672.427552][ T611] R13: 00007f49ae226038 R14: 00007f49ae225fa0 R15: 00007f49ae34fa48 [ 1672.427575][ T611] [ 1672.427867][T12484] tipc: Left network mode [ 1672.741183][ T5692] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1672.896935][ T623] FAULT_INJECTION: forcing a failure. [ 1672.896935][ T623] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1672.896973][ T623] CPU: 1 UID: 0 PID: 623 Comm: syz.3.7737 Tainted: G L syzkaller #0 PREEMPT(full) [ 1672.897004][ T623] Tainted: [L]=SOFTLOCKUP [ 1672.897012][ T623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1672.897024][ T623] Call Trace: [ 1672.897032][ T623] [ 1672.897042][ T623] dump_stack_lvl+0xe8/0x150 [ 1672.897077][ T623] should_fail_ex+0x410/0x560 [ 1672.897115][ T623] _copy_from_iter+0x1d3/0x1660 [ 1672.897141][ T623] ? __alloc_skb+0x27a/0x7a0 [ 1672.897187][ T623] ? __alloc_skb+0x27a/0x7a0 [ 1672.897216][ T623] ? __alloc_skb+0x27a/0x7a0 [ 1672.897244][ T623] ? __pfx__copy_from_iter+0x10/0x10 [ 1672.897267][ T623] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1672.897287][ T623] ? __alloc_skb+0x27a/0x7a0 [ 1672.897311][ T623] ? __alloc_skb+0x27a/0x7a0 [ 1672.897342][ T623] ? netlink_sendmsg+0x650/0xb40 [ 1672.897364][ T623] ? skb_put+0x112/0x210 [ 1672.897394][ T623] netlink_sendmsg+0x6c0/0xb40 [ 1672.897424][ T623] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.897452][ T623] ? apparmor_socket_sendmsg+0x98/0x360 [ 1672.897479][ T623] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1672.897501][ T623] sock_sendmsg_nosec+0x13a/0x180 [ 1672.897528][ T623] ____sys_sendmsg+0x54e/0x850 [ 1672.897564][ T623] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1672.897601][ T623] ? import_iovec+0x73/0xa0 [ 1672.897631][ T623] ___sys_sendmsg+0x2a5/0x360 [ 1672.897659][ T623] ? __lock_acquire+0x747/0x2de0 [ 1672.897686][ T623] ? __pfx____sys_sendmsg+0x10/0x10 [ 1672.897747][ T623] ? __fget_files+0x2a/0x420 [ 1672.897775][ T623] ? __fget_files+0x3a2/0x420 [ 1672.897815][ T623] __x64_sys_sendmsg+0x1b1/0x290 [ 1672.897848][ T623] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1672.897891][ T623] do_syscall_64+0x166/0x520 [ 1672.897918][ T623] ? trace_irq_disable+0x3b/0x140 [ 1672.897938][ T623] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.897958][ T623] ? clear_bhb_loop+0x70/0xc0 [ 1672.897981][ T623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.898000][ T623] RIP: 0033:0x7fbf6d79e159 [ 1672.898019][ T623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.898036][ T623] RSP: 002b:00007fbf6e5e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1672.898057][ T623] RAX: ffffffffffffffda RBX: 00007fbf6da25fa0 RCX: 00007fbf6d79e159 [ 1672.898072][ T623] RDX: 0000000004000000 RSI: 0000200000000240 RDI: 0000000000000007 [ 1672.898084][ T623] RBP: 00007fbf6e5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.898111][ T623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1672.898123][ T623] R13: 00007fbf6da26038 R14: 00007fbf6da25fa0 R15: 00007fbf6db4fa48 [ 1672.898153][ T623] [ 1672.932832][ T5692] usb 2-1: device descriptor read/64, error -71 [ 1673.351133][ T5692] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1673.479059][ T5692] usb 2-1: device descriptor read/64, error -71 [ 1673.559782][T12924] Bluetooth: hci1: command tx timeout [ 1673.590340][ T5692] usb usb2-port1: attempt power cycle [ 1673.945724][ T5692] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1673.985708][ T5692] usb 2-1: device descriptor read/8, error -71 [ 1674.220042][ T5692] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1674.241189][ T5692] usb 2-1: device descriptor read/8, error -71 [ 1674.350713][ T5692] usb usb2-port1: unable to enumerate USB device [ 1675.445874][T12484] hsr_slave_0: left promiscuous mode [ 1675.446613][T12484] hsr_slave_1: left promiscuous mode [ 1675.492560][T12484] veth1_macvtap: left promiscuous mode [ 1675.492591][T12484] veth0_macvtap: left promiscuous mode [ 1675.641443][T12924] Bluetooth: hci1: command tx timeout [ 1677.718975][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1678.048965][T29835] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 1678.209710][T29835] usb 6-1: Using ep0 maxpacket: 8 [ 1678.210495][T29835] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1678.213575][T29835] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1678.213600][T29835] usb 6-1: Product: syz [ 1678.213615][T29835] usb 6-1: Manufacturer: syz [ 1678.213629][T29835] usb 6-1: SerialNumber: syz [ 1678.243521][T29835] usb 6-1: config 0 descriptor?? [ 1678.528518][T29835] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1679.384956][ T701] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7746'. [ 1679.449378][ T702] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7746'. [ 1680.209964][T29835] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1683.351661][ T544] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1683.371829][ T544] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1683.375849][ T544] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1683.388411][ T544] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1683.416361][ T544] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1683.483400][ T544] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1683.516156][T25637] usb 6-1: USB disconnect, device number 65 [ 1683.531340][ T544] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1683.578570][ T544] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1683.959354][T29835] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1683.965454][ T544] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1683.988119][ T544] 8021q: adding VLAN 0 to HW filter on device team0 [ 1683.999136][ T5751] bridge0: port 1(bridge_slave_0) entered blocking state [ 1683.999247][ T5751] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1684.000380][ T5751] bridge0: port 2(bridge_slave_1) entered blocking state [ 1684.000451][ T5751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1684.036209][T12484] IPVS: stop unused estimator thread 0... [ 1684.117285][T29835] usb 2-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 1684.133496][T29835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1684.133528][T29835] usb 2-1: Product: syz [ 1684.133543][T29835] usb 2-1: Manufacturer: syz [ 1684.133558][T29835] usb 2-1: SerialNumber: syz [ 1684.172824][T29835] usb 2-1: USB2VGA dongle found at address 107 [ 1684.174885][T29835] usb 2-1: Allocated 8 output buffers [ 1684.205411][ T544] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1684.313919][ T544] veth0_vlan: entered promiscuous mode [ 1684.343456][ T544] veth1_vlan: entered promiscuous mode [ 1684.374256][T29835] usb 2-1: Failed to early initialize device [ 1684.400213][T29835] usb 2-1: USB disconnect, device number 107 [ 1684.425079][ T544] veth0_macvtap: entered promiscuous mode [ 1684.446634][ T544] veth1_macvtap: entered promiscuous mode [ 1684.495090][ T544] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1684.506065][ T544] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1684.513743][T15293] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1684.610157][ T1118] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.610245][ T1118] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.610274][ T1118] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.610301][ T1118] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1684.690931][T15293] usb 6-1: Using ep0 maxpacket: 8 [ 1684.704451][T15293] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1684.715065][T15293] usb 6-1: config index 0 descriptor too short (expected 74, got 45) [ 1684.715127][T15293] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1684.715180][T15293] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1684.715206][T15293] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1684.715230][T15293] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1684.715251][T15293] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1684.715291][T15293] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1684.736383][T12484] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1684.736405][T12484] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1684.807525][ T5751] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1684.807547][ T5751] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1684.976145][T15293] usb 6-1: usb_control_msg returned -32 [ 1684.976197][T15293] usbtmc 6-1:16.0: can't read capabilities [ 1685.544752][T25637] usb 6-1: USB disconnect, device number 66 [ 1685.751191][T15293] hid-generic 0000:0000:0000.0032: unknown main item tag 0x0 [ 1685.852083][T15293] hid-generic 0000:0000:0000.0032: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1685.954661][ T759] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7763'. [ 1685.954687][ T759] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7763'. [ 1686.010728][T25637] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1686.028255][ T760] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7763'. [ 1686.028278][ T760] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7763'. [ 1686.036740][ T759] hsr1: Slave A (erspan0) is not up; please bring it up to get a fully working HSR network [ 1686.036767][ T759] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 1686.161664][T25637] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1686.163619][T25637] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1686.177929][T25637] usb 6-1: config 0 descriptor?? [ 1686.180961][T25637] cp210x 6-1:0.0: cp210x converter detected [ 1686.608519][T25637] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -121 [ 1686.705919][ T763] warn_alloc: 1 callbacks suppressed [ 1686.705935][ T763] syz.0.7764: vmalloc error: size 28672, failed to allocate pages, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1686.705976][ T763] CPU: 1 UID: 0 PID: 763 Comm: syz.0.7764 Tainted: G L syzkaller #0 PREEMPT(full) [ 1686.705994][ T763] Tainted: [L]=SOFTLOCKUP [ 1686.705999][ T763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1686.706006][ T763] Call Trace: [ 1686.706011][ T763] [ 1686.706017][ T763] dump_stack_lvl+0xe8/0x150 [ 1686.706039][ T763] warn_alloc+0x24d/0x270 [ 1686.706056][ T763] ? __pfx_warn_alloc+0x10/0x10 [ 1686.706072][ T763] ? alloc_pages_mpol+0x256/0x390 [ 1686.706092][ T763] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 1686.706118][ T763] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1686.706135][ T763] ? pipapo_maybe_clone+0x68c/0xd80 [ 1686.706147][ T763] ? rcu_is_watching+0x16/0xb0 [ 1686.706162][ T763] ? pipapo_maybe_clone+0x68c/0xd80 [ 1686.706172][ T763] ? rcu_is_watching+0x16/0xb0 [ 1686.706187][ T763] ? pipapo_maybe_clone+0x68c/0xd80 [ 1686.706198][ T763] __kvmalloc_node_noprof+0x5a1/0x820 [ 1686.706212][ T763] ? pipapo_maybe_clone+0x68c/0xd80 [ 1686.706226][ T763] ? pipapo_maybe_clone+0x68c/0xd80 [ 1686.706240][ T763] pipapo_maybe_clone+0x68c/0xd80 [ 1686.706260][ T763] nft_pipapo_insert+0x166/0x18a0 [ 1686.706288][ T763] ? __pfx_nft_pipapo_insert+0x10/0x10 [ 1686.706305][ T763] ? rcu_is_watching+0x16/0xb0 [ 1686.706319][ T763] ? trace_kmalloc+0x2a/0xf0 [ 1686.706332][ T763] ? __kmalloc_noprof+0x38c/0x720 [ 1686.706344][ T763] ? __kmalloc_noprof+0x1ab/0x720 [ 1686.706355][ T763] ? nft_trans_alloc+0x22/0x2a0 [ 1686.706365][ T763] ? nft_trans_alloc+0x22/0x2a0 [ 1686.706375][ T763] ? nft_setelem_insert+0x42/0x570 [ 1686.706390][ T763] ? nft_trans_alloc+0x40/0x2a0 [ 1686.706402][ T763] nf_tables_newsetelem+0x2aa4/0x4200 [ 1686.706438][ T763] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 1686.706456][ T763] ? lock_acquire+0x115/0x350 [ 1686.706474][ T763] ? nla_validate_array+0xfc/0x260 [ 1686.706505][ T763] ? __pfx___nla_validate_parse+0x10/0x10 [ 1686.706525][ T763] ? __pfx_nf_tables_newset+0x10/0x10 [ 1686.706540][ T763] ? nft_pernet+0x23/0x240 [ 1686.706552][ T763] ? lock_acquire+0x115/0x350 [ 1686.706564][ T763] ? nfnl_pernet+0x23/0x240 [ 1686.706585][ T763] ? __nla_parse+0x40/0x60 [ 1686.706602][ T763] nfnetlink_rcv+0x1288/0x28c0 [ 1686.706640][ T763] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1686.706680][ T763] ? lock_acquire+0x115/0x350 [ 1686.706696][ T763] ? netlink_deliver_tap+0x2e/0x1b0 [ 1686.706708][ T763] ? netlink_deliver_tap+0x2e/0x1b0 [ 1686.706723][ T763] netlink_unicast+0x7bd/0x940 [ 1686.706745][ T763] netlink_sendmsg+0x813/0xb40 [ 1686.706762][ T763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1686.706779][ T763] ? apparmor_socket_sendmsg+0x98/0x360 [ 1686.706794][ T763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1686.706806][ T763] sock_sendmsg_nosec+0x13a/0x180 [ 1686.706821][ T763] ____sys_sendmsg+0x54e/0x850 [ 1686.706840][ T763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1686.706861][ T763] ? import_iovec+0x73/0xa0 [ 1686.706879][ T763] ___sys_sendmsg+0x2a5/0x360 [ 1686.706894][ T763] ? __lock_acquire+0x747/0x2de0 [ 1686.706908][ T763] ? __pfx____sys_sendmsg+0x10/0x10 [ 1686.706927][ T763] ? futex_wake+0x51b/0x5f0 [ 1686.706957][ T763] ? __fget_files+0x2a/0x420 [ 1686.706974][ T763] ? __fget_files+0x3a2/0x420 [ 1686.706995][ T763] __x64_sys_sendmsg+0x1b1/0x290 [ 1686.707013][ T763] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1686.707040][ T763] do_syscall_64+0x166/0x520 [ 1686.707057][ T763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.707069][ T763] ? clear_bhb_loop+0x70/0xc0 [ 1686.707082][ T763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.707093][ T763] RIP: 0033:0x7f0c7079e159 [ 1686.707106][ T763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1686.707115][ T763] RSP: 002b:00007f0c7171e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1686.707134][ T763] RAX: ffffffffffffffda RBX: 00007f0c70a25fa0 RCX: 00007f0c7079e159 [ 1686.707143][ T763] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 000000000000000b [ 1686.707150][ T763] RBP: 00007f0c7083506b R08: 0000000000000000 R09: 0000000000000000 [ 1686.707158][ T763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1686.707165][ T763] R13: 00007f0c70a26038 R14: 00007f0c70a25fa0 R15: 00007f0c70b4fa48 [ 1686.707183][ T763] [ 1686.707964][ T763] Mem-Info: [ 1686.707974][ T763] active_anon:16466 inactive_anon:0 isolated_anon:0 [ 1686.707974][ T763] active_file:11000 inactive_file:59367 isolated_file:0 [ 1686.707974][ T763] unevictable:0 dirty:190 writeback:0 [ 1686.707974][ T763] slab_reclaimable:10877 slab_unreclaimable:103466 [ 1686.707974][ T763] mapped:38085 shmem:9574 pagetables:1837 [ 1686.707974][ T763] sec_pagetables:0 bounce:0 [ 1686.707974][ T763] kernel_misc_reclaimable:0 [ 1686.707974][ T763] free:1210961 free_pcp:11784 free_cma:0 [ 1686.708017][ T763] Node 0 active_anon:65864kB inactive_anon:0kB active_file:44000kB inactive_file:237264kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:152340kB dirty:760kB writeback:0kB shmem:38296kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13204kB pagetables:7176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1686.708064][ T763] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1686.708092][ T763] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1686.708131][ T763] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1686.708152][ T763] Node 0 DMA32 free:906688kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:65864kB inactive_anon:0kB active_file:44000kB inactive_file:237264kB unevictable:0kB writepending:760kB zspages:0kB present:3129332kB managed:2546828kB mlocked:0kB bounce:0kB free_pcp:36020kB local_pcp:20200kB free_cma:0kB [ 1686.708199][ T763] lowmem_reserve[]: 0 0 0 0 0 [ 1686.708220][ T763] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1686.708249][ T763] lowmem_reserve[]: 0 0 0 0 0 [ 1686.708268][ T763] Node 1 Normal free:3921800kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:11116kB local_pcp:0kB free_cma:0kB [ 1686.708299][ T763] lowmem_reserve[]: 0 0 0 0 0 [ 1686.708318][ T763] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 1686.711189][ T763] Node 0 DMA32: 1732*4kB (UE) 719*8kB (UME) 1523*16kB (UME) 1356*32kB (UME) 447*64kB (UME) 255*128kB (UME) 134*256kB (UME) 79*512kB (UME) 48*1024kB (UME) 5*2048kB (UME) 154*4096kB (UM) = 906616kB [ 1686.711393][ T763] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1686.711491][ T763] Node 1 Normal: 6*4kB (UM) 2*8kB (M) 6*16kB (UM) 2*32kB (UM) 15*64kB (UM) 6*128kB (UM) 6*256kB (UM) 7*512kB (UM) 3*1024kB (UM) 4*2048kB (UM) 953*4096kB (M) = 3921800kB [ 1686.711685][ T763] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1686.711704][ T763] Node 0 hugepages_total=8 hugepages_free=4 hugepages_surp=4 hugepages_size=2048kB [ 1686.711721][ T763] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1686.711737][ T763] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1686.711753][ T763] 79887 total pagecache pages [ 1686.711761][ T763] 0 pages in swap cache [ 1686.711769][ T763] Free swap = 124996kB [ 1686.711777][ T763] Total swap = 124996kB [ 1686.711805][ T763] 2097051 pages RAM [ 1686.711813][ T763] 0 pages HighMem/MovableOnly [ 1686.711821][ T763] 428728 pages reserved [ 1686.711828][ T763] 0 pages cma reserved [ 1686.851354][T25637] cp210x 6-1:0.0: failed to get vendor val 0x3711 size 2: -71 [ 1686.851382][T25637] cp210x 6-1:0.0: GPIO initialisation failed: -71 [ 1686.862633][T25637] usb 6-1: cp210x converter now attached to ttyUSB0 [ 1686.892496][T25637] usb 6-1: USB disconnect, device number 67 [ 1686.935653][T25637] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1686.945834][T25637] cp210x 6-1:0.0: device disconnected [ 1687.801352][ T781] lo: left promiscuous mode [ 1687.801368][ T781] lo: entered allmulticast mode [ 1689.683174][ T814] FAULT_INJECTION: forcing a failure. [ 1689.683174][ T814] name failslab, interval 1, probability 0, space 0, times 0 [ 1689.683211][ T814] CPU: 1 UID: 0 PID: 814 Comm: syz.1.7779 Tainted: G L syzkaller #0 PREEMPT(full) [ 1689.683238][ T814] Tainted: [L]=SOFTLOCKUP [ 1689.683245][ T814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1689.683257][ T814] Call Trace: [ 1689.683266][ T814] [ 1689.683275][ T814] dump_stack_lvl+0xe8/0x150 [ 1689.683310][ T814] should_fail_ex+0x410/0x560 [ 1689.683341][ T814] should_failslab+0xa8/0x100 [ 1689.683369][ T814] __kmalloc_node_noprof+0x100/0x720 [ 1689.683389][ T814] ? __get_vm_area_node+0x200/0x2f0 [ 1689.683418][ T814] ? __get_vm_area_node+0x283/0x2f0 [ 1689.683446][ T814] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1689.683468][ T814] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1689.683495][ T814] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1689.683516][ T814] ? __kvmalloc_node_noprof+0x50f/0x820 [ 1689.683541][ T814] ? rcu_is_watching+0x16/0xb0 [ 1689.683587][ T814] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1689.683614][ T814] ? __do_replace+0xb2/0x990 [ 1689.683644][ T814] vzalloc_noprof+0xb2/0xe0 [ 1689.683663][ T814] ? __do_replace+0xb2/0x990 [ 1689.683692][ T814] __do_replace+0xb2/0x990 [ 1689.683730][ T814] ? __pfx___do_replace+0x10/0x10 [ 1689.683761][ T814] ? _copy_from_user+0x94/0xb0 [ 1689.683792][ T814] do_ipt_set_ctl+0xb3c/0xe20 [ 1689.683828][ T814] ? rcu_is_watching+0x16/0xb0 [ 1689.683854][ T814] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 1689.683909][ T814] ? __mutex_unlock_slowpath+0x731/0x900 [ 1689.683945][ T814] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1689.683982][ T814] nf_setsockopt+0x26f/0x290 [ 1689.684008][ T814] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1689.684033][ T814] do_sock_setsockopt+0x17c/0x1b0 [ 1689.684064][ T814] __x64_sys_setsockopt+0x13d/0x1b0 [ 1689.684097][ T814] do_syscall_64+0x166/0x520 [ 1689.684124][ T814] ? trace_irq_disable+0x3b/0x140 [ 1689.684146][ T814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.684166][ T814] ? clear_bhb_loop+0x70/0xc0 [ 1689.684190][ T814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.684210][ T814] RIP: 0033:0x7f1fbf19e159 [ 1689.684230][ T814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1689.684247][ T814] RSP: 002b:00007f1fc008d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1689.684269][ T814] RAX: ffffffffffffffda RBX: 00007f1fbf425fa0 RCX: 00007f1fbf19e159 [ 1689.684285][ T814] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 1689.684299][ T814] RBP: 00007f1fc008d090 R08: 0000000000000230 R09: 0000000000000000 [ 1689.684311][ T814] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1689.684324][ T814] R13: 00007f1fbf426038 R14: 00007f1fbf425fa0 R15: 00007f1fbf54fa48 [ 1689.684354][ T814] [ 1690.786735][ T833] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1690.787101][ T833] team0: Device macvlan3 is already an upper device of the team interface [ 1691.107347][ T838] bond0: (slave bond_slave_1): Releasing backup interface [ 1691.425841][ T842] FAULT_INJECTION: forcing a failure. [ 1691.425841][ T842] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1691.425878][ T842] CPU: 0 UID: 0 PID: 842 Comm: syz.3.7790 Tainted: G L syzkaller #0 PREEMPT(full) [ 1691.425906][ T842] Tainted: [L]=SOFTLOCKUP [ 1691.425913][ T842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1691.425925][ T842] Call Trace: [ 1691.425934][ T842] [ 1691.425943][ T842] dump_stack_lvl+0xe8/0x150 [ 1691.425977][ T842] should_fail_ex+0x410/0x560 [ 1691.426007][ T842] _copy_to_iter+0x59c/0x1810 [ 1691.426044][ T842] ? __pfx__copy_to_iter+0x10/0x10 [ 1691.426073][ T842] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1691.426103][ T842] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1691.426128][ T842] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 1691.426155][ T842] __skb_datagram_iter+0xf8/0x980 [ 1691.426173][ T842] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 1691.426198][ T842] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1691.426227][ T842] skb_copy_datagram_iter+0xb5/0x240 [ 1691.426251][ T842] netlink_recvmsg+0x2b9/0xa50 [ 1691.426281][ T842] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1691.426302][ T842] ? lock_acquire+0x115/0x350 [ 1691.426327][ T842] ? aa_sock_msg_perm+0x144/0x210 [ 1691.426359][ T842] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1691.426385][ T842] ? security_socket_recvmsg+0x7e/0x2c0 [ 1691.426406][ T842] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1691.426429][ T842] sock_recvmsg+0x196/0x1e0 [ 1691.426456][ T842] ____sys_recvmsg+0x1e6/0x4a0 [ 1691.426491][ T842] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1691.426534][ T842] ? import_iovec+0x73/0xa0 [ 1691.426564][ T842] ___sys_recvmsg+0x213/0x5a0 [ 1691.426589][ T842] ? __pfx____sys_recvmsg+0x10/0x10 [ 1691.426613][ T842] ? lock_acquire+0x115/0x350 [ 1691.426649][ T842] ? __fget_files+0x3a2/0x420 [ 1691.426688][ T842] do_recvmmsg+0x31a/0x7f0 [ 1691.426716][ T842] ? __pfx_do_recvmmsg+0x10/0x10 [ 1691.426746][ T842] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1691.426786][ T842] ? __fget_files+0x3a2/0x420 [ 1691.426824][ T842] __x64_sys_recvmmsg+0x198/0x250 [ 1691.426847][ T842] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1691.426878][ T842] do_syscall_64+0x166/0x520 [ 1691.426905][ T842] ? trace_irq_disable+0x3b/0x140 [ 1691.426926][ T842] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1691.426947][ T842] ? clear_bhb_loop+0x70/0xc0 [ 1691.426971][ T842] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1691.426991][ T842] RIP: 0033:0x7fbf6d79e159 [ 1691.427010][ T842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1691.427027][ T842] RSP: 002b:00007fbf6e5e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1691.427048][ T842] RAX: ffffffffffffffda RBX: 00007fbf6da25fa0 RCX: 00007fbf6d79e159 [ 1691.427064][ T842] RDX: 0000000000000003 RSI: 0000200000004680 RDI: 0000000000000003 [ 1691.427076][ T842] RBP: 00007fbf6e5e8090 R08: 0000000000000000 R09: 0000000000000000 [ 1691.427090][ T842] R10: 0000000040012002 R11: 0000000000000246 R12: 0000000000000001 [ 1691.427103][ T842] R13: 00007fbf6da26038 R14: 00007fbf6da25fa0 R15: 00007fbf6db4fa48 [ 1691.427134][ T842] [ 1691.909137][T25637] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 1692.061507][T25637] usb 4-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1692.062487][T25637] usb 4-1: config 0 has an invalid interface number: 133 but max is 0 [ 1692.062513][T25637] usb 4-1: config 0 has no interface number 0 [ 1692.062552][T25637] usb 4-1: config 0 interface 133 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1692.067722][T25637] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1692.067738][T25637] usb 4-1: Product: syz [ 1692.067746][T25637] usb 4-1: Manufacturer: syz [ 1692.067754][T25637] usb 4-1: SerialNumber: syz [ 1692.081936][T25637] usb 4-1: config 0 descriptor?? [ 1692.365057][ T845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1692.365419][ T845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1692.493163][T25637] keyspan 4-1:0.133: Keyspan 1 port adapter converter detected [ 1692.493486][T25637] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 82 [ 1692.500484][T25637] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 81 [ 1692.500571][T25637] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 1 [ 1692.500646][T25637] keyspan 4-1:0.133: found no endpoint descriptor for endpoint 2 [ 1692.543768][T25637] usb 4-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1692.551870][T25637] usb 4-1: USB disconnect, device number 41 [ 1692.559448][T31769] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1692.586450][T25637] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1692.601465][T25637] keyspan 4-1:0.133: device disconnected [ 1692.648367][ T852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7793'. [ 1692.709131][T31769] usb 6-1: Using ep0 maxpacket: 16 [ 1692.709658][T31769] usb 6-1: New USB device found, idVendor=2133, idProduct=0018, bcdDevice= 0.00 [ 1692.716239][T31769] usb 6-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1692.716261][T31769] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1692.716281][T31769] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1692.718225][T31769] usb 6-1: config 0 descriptor?? [ 1693.221798][T31769] hid (null): report_id 0 is invalid [ 1693.221908][T31769] hid (null): bogus close delimiter [ 1693.221924][T31769] hid (null): unknown global tag 0xd [ 1693.221982][T31769] hid (null): unknown global tag 0xe [ 1693.221996][T31769] hid (null): unknown global tag 0xd [ 1693.222021][T31769] hid (null): report_id 0 is invalid [ 1693.250875][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.250913][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.250941][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.250967][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.250993][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.251019][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.251046][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.251071][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.251097][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.251123][T31769] viewsonic 0003:2133:0018.0033: unknown main item tag 0x0 [ 1693.252017][T31769] viewsonic 0003:2133:0018.0033: report_id 0 is invalid [ 1693.252033][T31769] viewsonic 0003:2133:0018.0033: item 0 0 1 8 parsing failed [ 1693.253956][T31769] viewsonic 0003:2133:0018.0033: probe with driver viewsonic failed with error -22 [ 1694.485193][ T30] audit: type=1326 audit(1791127980.089:7516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.486595][ T30] audit: type=1326 audit(1791127980.089:7517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.487324][ T30] audit: type=1326 audit(1791127980.089:7518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.513349][ T30] audit: type=1326 audit(1791127980.089:7519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.513886][ T30] audit: type=1326 audit(1791127980.119:7520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.621559][ T30] audit: type=1326 audit(1791127980.229:7521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.621644][ T30] audit: type=1326 audit(1791127980.229:7522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=328 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.621690][ T30] audit: type=1326 audit(1791127980.229:7523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.621729][ T30] audit: type=1326 audit(1791127980.229:7524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1694.642332][ T30] audit: type=1326 audit(1791127980.249:7525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=882 comm="syz.0.7802" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=332 compat=0 ip=0x7f0c7079e159 code=0x7ffc0000 [ 1695.353077][ T878] netlink: 72 bytes leftover after parsing attributes in process `syz.3.7800'. [ 1695.536984][ T5709] usb 6-1: USB disconnect, device number 68 [ 1696.775772][ T920] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7812'. [ 1697.299504][T31769] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1697.458173][T31769] usb 6-1: Using ep0 maxpacket: 32 [ 1697.461099][T31769] usb 6-1: New USB device found, idVendor=05ac, idProduct=0304, bcdDevice= 0.00 [ 1697.462372][T31769] usb 6-1: too many endpoints for config 0 interface 0 altsetting 6: 255, using maximum allowed: 30 [ 1697.462418][T31769] usb 6-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1697.462445][T31769] usb 6-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 1697.462472][T31769] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1697.462506][T31769] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1697.465248][T31769] usb 6-1: config 0 descriptor?? [ 1697.907369][T31769] input: HID 05ac:0304 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:05AC:0304.0034/input/input86 [ 1697.936764][T31769] apple 0003:05AC:0304.0034: input,hidraw0: USB HID vd.8f Joystick [HID 05ac:0304] on usb-dummy_hcd.5-1/input0 [ 1698.082378][ T944] warn_alloc: 7 callbacks suppressed [ 1698.082395][ T944] syz.4.7818: vmalloc error: size 16384, failed to allocate pages, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1698.082453][ T944] CPU: 1 UID: 0 PID: 944 Comm: syz.4.7818 Tainted: G L syzkaller #0 PREEMPT(full) [ 1698.082469][ T944] Tainted: [L]=SOFTLOCKUP [ 1698.082474][ T944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1698.082482][ T944] Call Trace: [ 1698.082487][ T944] [ 1698.082494][ T944] dump_stack_lvl+0xe8/0x150 [ 1698.082519][ T944] warn_alloc+0x24d/0x270 [ 1698.082538][ T944] ? __pfx_warn_alloc+0x10/0x10 [ 1698.082553][ T944] ? alloc_pages_mpol+0x256/0x390 [ 1698.082576][ T944] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 1698.082603][ T944] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1698.082615][ T944] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082632][ T944] ? rcu_is_watching+0x16/0xb0 [ 1698.082647][ T944] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082663][ T944] ? rcu_is_watching+0x16/0xb0 [ 1698.082678][ T944] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082693][ T944] __kvmalloc_node_noprof+0x5a1/0x820 [ 1698.082707][ T944] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082723][ T944] ? __kmalloc_cache_noprof+0x321/0x600 [ 1698.082736][ T944] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082755][ T944] io_ring_ctx_alloc+0x1ad/0xb80 [ 1698.082779][ T944] ? io_prepare_config+0x8c8/0xc70 [ 1698.082798][ T944] io_uring_create+0x50/0x990 [ 1698.082818][ T944] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1698.082833][ T944] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1698.082854][ T944] ? lockdep_softirqs_on+0x11e/0x190 [ 1698.082868][ T944] ? handle_softirqs+0x720/0x860 [ 1698.082889][ T944] do_syscall_64+0x166/0x520 [ 1698.082908][ T944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1698.082921][ T944] ? clear_bhb_loop+0x70/0xc0 [ 1698.082934][ T944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1698.082945][ T944] RIP: 0033:0x7f3caa19e159 [ 1698.082958][ T944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1698.082968][ T944] RSP: 002b:00007f3caafefee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1698.082980][ T944] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007f3caa19e159 [ 1698.082989][ T944] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 1698.082996][ T944] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 1698.083004][ T944] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 1698.083012][ T944] R13: 0000200000000890 R14: 00007f3caafeffd8 R15: 0000000000000000 [ 1698.083028][ T944] [ 1698.083046][ T944] Mem-Info: [ 1698.083052][ T944] active_anon:31957 inactive_anon:0 isolated_anon:0 [ 1698.083052][ T944] active_file:11000 inactive_file:59373 isolated_file:0 [ 1698.083052][ T944] unevictable:0 dirty:369 writeback:0 [ 1698.083052][ T944] slab_reclaimable:10835 slab_unreclaimable:103351 [ 1698.083052][ T944] mapped:39103 shmem:25179 pagetables:1841 [ 1698.083052][ T944] sec_pagetables:0 bounce:0 [ 1698.083052][ T944] kernel_misc_reclaimable:0 [ 1698.083052][ T944] free:1196689 free_pcp:11358 free_cma:0 [ 1698.083081][ T944] Node 0 active_anon:127828kB inactive_anon:0kB active_file:44000kB inactive_file:237288kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:156404kB dirty:1472kB writeback:0kB shmem:100716kB shmem_thp:2048kB shmem_pmdmapped:2048kB anon_thp:0kB kernel_stack:13296kB pagetables:7192kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1698.083113][ T944] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1698.083141][ T944] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1698.083191][ T944] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1698.083227][ T944] Node 0 DMA32 free:849408kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:127828kB inactive_anon:0kB active_file:44000kB inactive_file:237288kB unevictable:0kB writepending:1472kB zspages:0kB present:3129332kB managed:2546828kB mlocked:0kB bounce:0kB free_pcp:35068kB local_pcp:16696kB free_cma:0kB [ 1698.083270][ T944] lowmem_reserve[]: 0 0 0 0 0 [ 1698.083289][ T944] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1698.083335][ T944] lowmem_reserve[]: 0 0 0 0 0 [ 1698.083354][ T944] Node 1 Normal free:3921992kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:10364kB local_pcp:0kB free_cma:0kB [ 1698.083385][ T944] lowmem_reserve[]: 0 0 0 0 0 [ 1698.083403][ T944] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 1698.083496][ T944] Node 0 DMA32: 2896*4kB (UME) 801*8kB (UME) 1218*16kB (UME) 661*32kB (UME) 123*64kB (UE) 190*128kB (UME) 141*256kB (UME) 87*512kB (UME) 52*1024kB (UME) 3*2048kB (UE) 151*4096kB (UM) = 849352kB [ 1698.085478][ T944] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1698.085552][ T944] Node 1 Normal: 8*4kB (UM) 9*8kB (UM) 13*16kB (UM) 10*32kB (UM) 18*64kB (UM) 7*128kB (UM) 6*256kB (UM) 6*512kB (UM) 3*1024kB (UM) 4*2048kB (UM) 953*4096kB (M) = 3922040kB [ 1698.085638][ T944] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1698.085672][ T944] Node 0 hugepages_total=5 hugepages_free=4 hugepages_surp=1 hugepages_size=2048kB [ 1698.085682][ T944] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1698.085691][ T944] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1698.085700][ T944] 95548 total pagecache pages [ 1698.085705][ T944] 0 pages in swap cache [ 1698.085709][ T944] Free swap = 124996kB [ 1698.085713][ T944] Total swap = 124996kB [ 1698.085718][ T944] 2097051 pages RAM [ 1698.085722][ T944] 0 pages HighMem/MovableOnly [ 1698.085726][ T944] 428728 pages reserved [ 1698.085730][ T944] 0 pages cma reserved [ 1698.176775][ T929] netlink: 20 bytes leftover after parsing attributes in process `syz.5.7815'. [ 1698.653215][ T929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1698.653706][ T929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1698.884500][ T929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1698.884933][ T929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1698.942994][T31769] usb 6-1: USB disconnect, device number 69 [ 1699.307220][ T958] nvme_fc: nvme_fc_parse_traddr: bad traddr string [ 1699.584787][ T967] FAULT_INJECTION: forcing a failure. [ 1699.584787][ T967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1699.584814][ T967] CPU: 0 UID: 0 PID: 967 Comm: syz.4.7821 Tainted: G L syzkaller #0 PREEMPT(full) [ 1699.584830][ T967] Tainted: [L]=SOFTLOCKUP [ 1699.584834][ T967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1699.584841][ T967] Call Trace: [ 1699.584847][ T967] [ 1699.584854][ T967] dump_stack_lvl+0xe8/0x150 [ 1699.584878][ T967] should_fail_ex+0x410/0x560 [ 1699.584896][ T967] _copy_to_user+0x31/0xb0 [ 1699.584913][ T967] rng_dev_read+0x3f0/0x7c0 [ 1699.584938][ T967] ? __pfx_rng_dev_read+0x10/0x10 [ 1699.584955][ T967] ? bpf_lsm_file_permission+0x9/0x20 [ 1699.584973][ T967] ? security_file_permission+0x75/0x260 [ 1699.584987][ T967] ? rw_verify_area+0x24a/0x4c0 [ 1699.585005][ T967] ? __pfx_rng_dev_read+0x10/0x10 [ 1699.585019][ T967] vfs_read+0x213/0xa80 [ 1699.585033][ T967] ? __pfx_vfs_read+0x10/0x10 [ 1699.585045][ T967] ? __fget_files+0x2a/0x420 [ 1699.585061][ T967] ? __fget_files+0x2a/0x420 [ 1699.585075][ T967] ? __fget_files+0x3a2/0x420 [ 1699.585090][ T967] ? __fget_files+0x2a/0x420 [ 1699.585111][ T967] ksys_read+0x150/0x270 [ 1699.585122][ T967] ? __pfx_ksys_read+0x10/0x10 [ 1699.585138][ T967] do_syscall_64+0x166/0x520 [ 1699.585154][ T967] ? trace_irq_disable+0x3b/0x140 [ 1699.585170][ T967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.585191][ T967] ? clear_bhb_loop+0x70/0xc0 [ 1699.585212][ T967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.585232][ T967] RIP: 0033:0x7f3caa19e159 [ 1699.585250][ T967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1699.585266][ T967] RSP: 002b:00007f3caaff0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1699.585280][ T967] RAX: ffffffffffffffda RBX: 00007f3caa425fa0 RCX: 00007f3caa19e159 [ 1699.585288][ T967] RDX: 00000000fffffe0c RSI: 0000200000004500 RDI: 0000000000000003 [ 1699.585295][ T967] RBP: 00007f3caaff0090 R08: 0000000000000000 R09: 0000000000000000 [ 1699.585302][ T967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1699.585309][ T967] R13: 00007f3caa426038 R14: 00007f3caa425fa0 R15: 00007f3caa54fa48 [ 1699.585325][ T967] [ 1699.779401][T31769] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1699.909228][T31769] usb 2-1: device descriptor read/64, error -71 [ 1700.154988][T31769] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1700.279316][T31769] usb 2-1: device descriptor read/64, error -71 [ 1700.389951][T31769] usb usb2-port1: attempt power cycle [ 1700.729413][T31769] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 1700.750269][T31769] usb 2-1: device descriptor read/8, error -71 [ 1700.989500][T31769] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1701.012340][T31769] usb 2-1: device descriptor read/8, error -71 [ 1701.120676][T31769] usb usb2-port1: unable to enumerate USB device [ 1702.191499][ T1012] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7836'. [ 1702.293412][ T1011] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1702.330954][ T1012] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7836'. [ 1702.339183][T32034] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1702.339229][T32034] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1702.339263][T32034] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1702.339295][T32034] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1702.709230][ T30] kauditd_printk_skb: 27 callbacks suppressed [ 1702.709252][ T30] audit: type=1800 audit(1791127988.309:7553): pid=1019 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.7837" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2592 res=0 errno=0 [ 1703.650332][ T1046] netlink: 80 bytes leftover after parsing attributes in process `syz.3.7844'. [ 1704.353979][ T1063] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7848'. [ 1704.354002][ T1063] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7848'. [ 1704.374030][ T1063] macsec1: entered promiscuous mode [ 1705.009547][T31769] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1705.162529][T31769] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1705.167474][T31769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1705.167502][T31769] usb 2-1: Product: syz [ 1705.167518][T31769] usb 2-1: Manufacturer: syz [ 1705.168005][T31769] usb 2-1: SerialNumber: syz [ 1705.427149][ T1079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1705.437961][ T1079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1705.600871][ T1090] syzkaller0: entered promiscuous mode [ 1705.600895][ T1090] syzkaller0: entered allmulticast mode [ 1705.611773][T31769] rtl8150 2-1:1.0: couldn't reset the device [ 1705.612073][T31769] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 1705.647435][T31769] usb 2-1: USB disconnect, device number 112 [ 1706.059709][T13005] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 1706.211448][T13005] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1706.212074][T13005] usb 4-1: not running at top speed; connect to a high speed hub [ 1706.212108][T13005] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 0.40 [ 1706.215083][T13005] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1706.215111][T13005] usb 4-1: Product: syz [ 1706.215127][T13005] usb 4-1: Manufacturer: syz [ 1706.215142][T13005] usb 4-1: SerialNumber: syz [ 1706.424470][ T1093] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1706.444093][ T1093] syzkaller1: entered promiscuous mode [ 1706.444118][ T1093] syzkaller1: entered allmulticast mode [ 1706.448465][ T1093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1706.471571][ T1093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1706.628729][T13005] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1706.629321][T13005] usb 4-1: MIDIStreaming interface descriptor not found [ 1706.689621][T13005] usb 4-1: USB disconnect, device number 42 [ 1706.759597][T31769] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1706.768115][ T1106] udevd[1106]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1706.909193][T31769] usb 2-1: Using ep0 maxpacket: 8 [ 1706.909892][T31769] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1706.911069][T31769] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 1706.911122][T31769] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1706.911137][T31769] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1706.911151][T31769] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1706.911165][T31769] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1706.911181][T31769] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1706.911222][T31769] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1707.115589][T31769] usb 2-1: usb_control_msg returned -32 [ 1707.115622][T31769] usbtmc 2-1:16.0: can't read capabilities [ 1707.352912][ T30] audit: type=1326 audit(1791127992.959:7554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1108 comm="syz.3.7861" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbf6d79e159 code=0x0 [ 1707.687487][T13005] usb 2-1: USB disconnect, device number 113 [ 1709.092503][ T1144] netlink: 'syz.4.7871': attribute type 1 has an invalid length. [ 1709.125287][ T1144] vlan2: entered promiscuous mode [ 1709.125309][ T1144] mac80211_hwsim hwsim75 wlan0: entered promiscuous mode [ 1709.125520][ T1144] vlan2: entered allmulticast mode [ 1709.125531][ T1144] mac80211_hwsim hwsim75 wlan0: entered allmulticast mode [ 1709.566304][ T1140] warn_alloc: 6 callbacks suppressed [ 1709.566325][ T1140] syz.3.7869: vmalloc error: size 16384, failed to allocate pages, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1709.566394][ T1140] CPU: 1 UID: 0 PID: 1140 Comm: syz.3.7869 Tainted: G L syzkaller #0 PREEMPT(full) [ 1709.566424][ T1140] Tainted: [L]=SOFTLOCKUP [ 1709.566433][ T1140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1709.566446][ T1140] Call Trace: [ 1709.566455][ T1140] [ 1709.566465][ T1140] dump_stack_lvl+0xe8/0x150 [ 1709.566502][ T1140] warn_alloc+0x24d/0x270 [ 1709.566531][ T1140] ? __pfx_warn_alloc+0x10/0x10 [ 1709.566560][ T1140] ? alloc_pages_mpol+0x256/0x390 [ 1709.566600][ T1140] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 1709.566643][ T1140] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1709.566663][ T1140] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566691][ T1140] ? rcu_is_watching+0x16/0xb0 [ 1709.566714][ T1140] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566740][ T1140] ? rcu_is_watching+0x16/0xb0 [ 1709.566766][ T1140] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566794][ T1140] __kvmalloc_node_noprof+0x5a1/0x820 [ 1709.566820][ T1140] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566848][ T1140] ? __kmalloc_cache_noprof+0x321/0x600 [ 1709.566871][ T1140] ? io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566921][ T1140] io_ring_ctx_alloc+0x1ad/0xb80 [ 1709.566954][ T1140] ? io_prepare_config+0x8c8/0xc70 [ 1709.566985][ T1140] io_uring_create+0x50/0x990 [ 1709.567019][ T1140] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 1709.567045][ T1140] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 1709.567085][ T1140] ? rcu_is_watching+0x16/0xb0 [ 1709.567120][ T1140] do_syscall_64+0x166/0x520 [ 1709.567138][ T1140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1709.567150][ T1140] ? clear_bhb_loop+0x70/0xc0 [ 1709.567163][ T1140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1709.567176][ T1140] RIP: 0033:0x7fbf6d79e159 [ 1709.567194][ T1140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1709.567211][ T1140] RSP: 002b:00007fbf6e5e7ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 1709.567233][ T1140] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007fbf6d79e159 [ 1709.567250][ T1140] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e26 [ 1709.567265][ T1140] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 1709.567279][ T1140] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 1709.567287][ T1140] R13: 0000200000000890 R14: 00007fbf6e5e7fd8 R15: 0000000000000000 [ 1709.567304][ T1140] [ 1709.568252][ T1140] Mem-Info: [ 1709.568265][ T1140] active_anon:31801 inactive_anon:0 isolated_anon:0 [ 1709.568265][ T1140] active_file:11000 inactive_file:59394 isolated_file:0 [ 1709.568265][ T1140] unevictable:0 dirty:432 writeback:0 [ 1709.568265][ T1140] slab_reclaimable:10821 slab_unreclaimable:104718 [ 1709.568265][ T1140] mapped:39207 shmem:24556 pagetables:1843 [ 1709.568265][ T1140] sec_pagetables:0 bounce:0 [ 1709.568265][ T1140] kernel_misc_reclaimable:0 [ 1709.568265][ T1140] free:1197736 free_pcp:9190 free_cma:0 [ 1709.568596][ T1140] Node 0 active_anon:127204kB inactive_anon:0kB active_file:44000kB inactive_file:237372kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:156820kB dirty:1724kB writeback:0kB shmem:98224kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13364kB pagetables:7200kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1709.568692][ T1140] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1709.752063][ T1140] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1709.752135][ T1140] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1709.752208][ T1140] Node 0 DMA32 free:852604kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:127304kB inactive_anon:0kB active_file:44000kB inactive_file:237372kB unevictable:0kB writepending:1724kB zspages:0kB present:3129332kB managed:2546828kB mlocked:0kB bounce:0kB free_pcp:27164kB local_pcp:7528kB free_cma:0kB [ 1709.752271][ T1140] lowmem_reserve[]: 0 0 0 0 0 [ 1709.752308][ T1140] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1709.752367][ T1140] lowmem_reserve[]: 0 0 0 0 0 [ 1709.752402][ T1140] Node 1 Normal free:3922868kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:9356kB local_pcp:9356kB free_cma:0kB [ 1709.752469][ T1140] lowmem_reserve[]: 0 0 0 0 0 [ 1709.752503][ T1140] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 1709.756856][ T1140] Node 0 DMA32: 2673*4kB (UE) 1490*8kB (UE) 1232*16kB (UME) 531*32kB (UME) 185*64kB (UME) 175*128kB (UME) 145*256kB (UME) 90*512kB (UME) 56*1024kB (UME) 2*2048kB (UE) 150*4096kB (UM) = 852596kB [ 1709.757017][ T1140] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1709.757117][ T1140] Node 1 Normal: 8*4kB (UM) 9*8kB (UM) 12*16kB (UM) 10*32kB (UM) 18*64kB (UM) 6*128kB (UM) 6*256kB (UM) 8*512kB (UM) 3*1024kB (UM) 4*2048kB (UM) 953*4096kB (M) = 3922920kB [ 1709.757296][ T1140] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1709.757315][ T1140] Node 0 hugepages_total=5 hugepages_free=4 hugepages_surp=1 hugepages_size=2048kB [ 1709.757332][ T1140] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1709.757348][ T1140] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1709.757364][ T1140] 94913 total pagecache pages [ 1709.757373][ T1140] 0 pages in swap cache [ 1709.757380][ T1140] Free swap = 124996kB [ 1709.757388][ T1140] Total swap = 124996kB [ 1709.757397][ T1140] 2097051 pages RAM [ 1709.757405][ T1140] 0 pages HighMem/MovableOnly [ 1709.757412][ T1140] 428728 pages reserved [ 1709.757420][ T1140] 0 pages cma reserved [ 1711.459738][T25637] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1711.610780][T25637] usb 6-1: Using ep0 maxpacket: 16 [ 1711.611538][T25637] usb 6-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1711.612435][T25637] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1711.612453][T25637] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1711.613376][T25637] usb 6-1: New USB device strings: Mfr=128, Product=0, SerialNumber=0 [ 1711.613402][T25637] usb 6-1: Manufacturer: syz [ 1711.615371][T25637] usb 6-1: config 0 descriptor?? [ 1711.645492][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1711.753479][ T1194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7880'. [ 1711.829630][T31769] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1711.944608][ T1198] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7882'. [ 1711.944627][ T1198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7882'. [ 1711.944812][ T1198] FAULT_INJECTION: forcing a failure. [ 1711.944812][ T1198] name failslab, interval 1, probability 0, space 0, times 0 [ 1711.944849][ T1198] CPU: 0 UID: 0 PID: 1198 Comm: syz.4.7882 Tainted: G L syzkaller #0 PREEMPT(full) [ 1711.944867][ T1198] Tainted: [L]=SOFTLOCKUP [ 1711.944871][ T1198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1711.944881][ T1198] Call Trace: [ 1711.944886][ T1198] [ 1711.944891][ T1198] dump_stack_lvl+0xe8/0x150 [ 1711.944912][ T1198] should_fail_ex+0x410/0x560 [ 1711.944941][ T1198] should_failslab+0xa8/0x100 [ 1711.944971][ T1198] __kvmalloc_node_noprof+0x176/0x820 [ 1711.945000][ T1198] ? alloc_netdev_mqs+0x8fb/0x12a0 [ 1711.945017][ T1198] ? alloc_netdev_mqs+0x8fb/0x12a0 [ 1711.945032][ T1198] alloc_netdev_mqs+0x8fb/0x12a0 [ 1711.945044][ T1198] ? __pfx_macsec_setup+0x10/0x10 [ 1711.945062][ T1198] rtnl_create_link+0x321/0xd70 [ 1711.945089][ T1198] rtnl_newlink_create+0x258/0x7b0 [ 1711.945127][ T1198] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1711.945160][ T1198] ? __pfx___mutex_lock+0x10/0x10 [ 1711.945181][ T1198] ? ns_capable+0x89/0xe0 [ 1711.945197][ T1198] rtnl_newlink+0x166d/0x1c30 [ 1711.945222][ T1198] ? __pfx_rtnl_newlink+0x10/0x10 [ 1711.945247][ T1198] ? do_syscall_64+0x166/0x520 [ 1711.945274][ T1198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1711.945319][ T1198] ? kasan_quarantine_put+0xbb/0x1f0 [ 1711.945333][ T1198] ? lockdep_hardirqs_on+0x7b/0x110 [ 1711.945350][ T1198] ? nlmon_xmit+0xb0/0x100 [ 1711.945363][ T1198] ? kmem_cache_free+0x182/0x650 [ 1711.945393][ T1198] ? __lock_acquire+0x747/0x2de0 [ 1711.945426][ T1198] ? __local_bh_enable_ip+0xd6/0x140 [ 1711.945451][ T1198] ? lockdep_hardirqs_on+0x7b/0x110 [ 1711.945468][ T1198] ? __dev_queue_xmit+0x29b/0x3920 [ 1711.945479][ T1198] ? __local_bh_enable_ip+0xd6/0x140 [ 1711.945496][ T1198] ? lock_acquire+0x115/0x350 [ 1711.945515][ T1198] ? __pfx_rtnl_newlink+0x10/0x10 [ 1711.945539][ T1198] rtnetlink_rcv_msg+0x802/0xc00 [ 1711.945571][ T1198] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1711.945598][ T1198] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1711.945614][ T1198] ? ref_tracker_free+0x689/0x830 [ 1711.945630][ T1198] ? __pfx_ref_tracker_free+0x10/0x10 [ 1711.945656][ T1198] netlink_rcv_skb+0x226/0x4a0 [ 1711.945676][ T1198] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1711.945704][ T1198] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1711.945732][ T1198] ? netlink_deliver_tap+0x2e/0x1b0 [ 1711.945751][ T1198] ? netlink_deliver_tap+0x2e/0x1b0 [ 1711.945775][ T1198] netlink_unicast+0x7bd/0x940 [ 1711.945818][ T1198] netlink_sendmsg+0x813/0xb40 [ 1711.945856][ T1198] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1711.945887][ T1198] ? apparmor_socket_sendmsg+0x98/0x360 [ 1711.945909][ T1198] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1711.945920][ T1198] sock_sendmsg_nosec+0x13a/0x180 [ 1711.945935][ T1198] ____sys_sendmsg+0x54e/0x850 [ 1711.945954][ T1198] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1711.945988][ T1198] ? import_iovec+0x73/0xa0 [ 1711.946019][ T1198] ___sys_sendmsg+0x2a5/0x360 [ 1711.946048][ T1198] ? __lock_acquire+0x747/0x2de0 [ 1711.946061][ T1198] ? __pfx____sys_sendmsg+0x10/0x10 [ 1711.946094][ T1198] ? __fget_files+0x2a/0x420 [ 1711.946111][ T1198] ? __fget_files+0x3a2/0x420 [ 1711.946149][ T1198] __x64_sys_sendmsg+0x1b1/0x290 [ 1711.946183][ T1198] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1711.946216][ T1198] do_syscall_64+0x166/0x520 [ 1711.946231][ T1198] ? trace_irq_disable+0x3b/0x140 [ 1711.946243][ T1198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1711.946254][ T1198] ? clear_bhb_loop+0x70/0xc0 [ 1711.946275][ T1198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1711.946295][ T1198] RIP: 0033:0x7f3caa19e159 [ 1711.946314][ T1198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1711.946331][ T1198] RSP: 002b:00007f3caaff0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1711.946351][ T1198] RAX: ffffffffffffffda RBX: 00007f3caa425fa0 RCX: 00007f3caa19e159 [ 1711.946359][ T1198] RDX: 000000000000c004 RSI: 0000200000000240 RDI: 0000000000000003 [ 1711.946367][ T1198] RBP: 00007f3caaff0090 R08: 0000000000000000 R09: 0000000000000000 [ 1711.946374][ T1198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1711.946380][ T1198] R13: 00007f3caa426038 R14: 00007f3caa425fa0 R15: 00007f3caa54fa48 [ 1711.946397][ T1198] [ 1711.983867][T31769] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1711.998386][T31769] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1711.998416][T31769] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1712.004490][T31769] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1712.004517][T31769] usb 4-1: SerialNumber: syz [ 1712.311326][T25637] usbhid 6-1:0.0: can't add hid device: -71 [ 1712.311443][T25637] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1712.522238][T25637] usb 6-1: USB disconnect, device number 70 [ 1712.524502][T31769] usb 4-1: 0:2 : does not exist [ 1712.597854][T31769] usb 4-1: USB disconnect, device number 43 [ 1712.688251][ T706] udevd[706]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1712.874431][ T1215] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7886'. [ 1713.103524][ T1221] hsr0: entered promiscuous mode [ 1713.108285][ T1221] hsr_slave_0: left promiscuous mode [ 1713.125344][ T1221] hsr_slave_1: left promiscuous mode [ 1713.164040][ T1221] hsr0 (unregistering): left promiscuous mode [ 1713.480761][T15293] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1713.630661][T15293] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1713.631690][T15293] usb 6-1: config 0 has no interfaces? [ 1713.636264][T15293] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.636280][T15293] usb 6-1: Product: syz [ 1713.636289][T15293] usb 6-1: Manufacturer: syz [ 1713.636297][T15293] usb 6-1: SerialNumber: syz [ 1713.641026][T15293] usb 6-1: config 0 descriptor?? [ 1713.858904][T29835] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1713.878840][T15293] usb 6-1: USB disconnect, device number 71 [ 1714.020821][T29835] usb 2-1: Using ep0 maxpacket: 16 [ 1714.022772][T29835] usb 2-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 1714.023853][T29835] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 8980, setting to 1024 [ 1714.030646][T29835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1714.030672][T29835] usb 2-1: Product: syz [ 1714.030688][T29835] usb 2-1: Manufacturer: ጳ⽍窒鷋❀疄潷쪏̈́෬掀삈㞧ҟᩖ롊츀ꫩ믷ຉ臡ף孓倭䇨ऻㄡ캸ࢹ璝麘ꚾ荜ꯈ읉蛢狌ij篑芞鸥켼卆蜤發䓸뒇햜⁸폔賎鍣组尊锡죦ى痁处䏿秴ꐌय㈬ᚺꀆηᄁ껛켬誎౞뾰쒃⽪ꍤᐢį᱉䵤䖦荪ﵟ퟇㮩㘸 [ 1714.030715][T29835] usb 2-1: SerialNumber: syz [ 1714.282608][T29835] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 1714.348644][T29835] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1714.369675][T29835] usb 2-1: USB disconnect, device number 114 [ 1714.396262][ T706] udevd[706]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1714.545905][ T1253] netlink: 96 bytes leftover after parsing attributes in process `syz.5.7897'. [ 1715.110225][T31769] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1715.198937][T25637] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1715.259205][T31769] usb 6-1: Using ep0 maxpacket: 16 [ 1715.259929][T31769] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1715.260885][T31769] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1715.260915][T31769] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1715.260938][T31769] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1715.260973][T31769] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1715.262814][T31769] usb 6-1: config 0 descriptor?? [ 1715.399402][T25637] usb 2-1: Using ep0 maxpacket: 32 [ 1715.400120][T25637] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1715.401245][T25637] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1715.401269][T25637] usb 2-1: config 0 has no interface number 0 [ 1715.403325][T25637] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.403341][T25637] usb 2-1: Product: syz [ 1715.403349][T25637] usb 2-1: Manufacturer: syz [ 1715.403357][T25637] usb 2-1: SerialNumber: syz [ 1715.405571][T25637] usb 2-1: config 0 descriptor?? [ 1715.453373][T25637] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1715.453394][T25637] usb 2-1: selecting invalid altsetting 1 [ 1715.453404][T25637] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1715.496313][T25637] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1715.496583][T25637] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1715.496618][T25637] usb 2-1: media controller created [ 1715.530900][T25637] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1715.610743][T25637] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1715.610798][T25637] zl10353_read_register: readreg error (reg=127, ret==-32) [ 1715.662269][T25637] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1715.702620][T25637] usb 2-1: USB disconnect, device number 115 [ 1716.268197][T29835] nintendo 0005:057E:2017.0035: hidraw0: BLUETOOTH HID v80.00 Gamepad [syz0] on syz0 [ 1716.883559][T31769] usbhid 6-1:0.0: can't add hid device: -71 [ 1716.883666][T31769] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1716.886231][T31769] usb 6-1: USB disconnect, device number 72 [ 1717.659344][T15293] usb 2-1: new full-speed USB device number 116 using dummy_hcd [ 1717.824485][T15293] usb 2-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1717.827599][T15293] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1717.827626][T15293] usb 2-1: can't read configurations, error -71 [ 1718.729175][T31769] asus 0005:0B05:8502.0036: hidraw1: BLUETOOTH HID v0.00 Mouse [syz0] on syz0 [ 1719.527438][ T1323] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1719.527654][ T1323] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1719.543530][ T1323] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1719.543687][ T1323] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1719.544770][ T1323] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1719.547755][ T1323] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1719.869212][T31769] usb 2-1: new full-speed USB device number 118 using dummy_hcd [ 1719.938912][T15293] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1720.019806][T31769] usb 2-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=49.83 [ 1720.022485][T31769] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1720.022503][T31769] usb 2-1: Product: syz [ 1720.022512][T31769] usb 2-1: Manufacturer: syz [ 1720.022520][T31769] usb 2-1: SerialNumber: syz [ 1720.025707][T31769] usb 2-1: config 0 descriptor?? [ 1720.031201][T31769] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 1720.100576][T15293] usb 6-1: New USB device found, idVendor=072f, idProduct=2200, bcdDevice= 1.00 [ 1720.101882][T15293] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1720.450855][T29835] nintendo 0005:057E:2017.0035: Failed to get joycon info; ret=-110 [ 1720.450951][T29835] nintendo 0005:057E:2017.0035: Failed to retrieve controller info; ret=-110 [ 1720.450995][T29835] nintendo 0005:057E:2017.0035: Failed to initialize controller; ret=-110 [ 1720.491966][T29835] nintendo 0005:057E:2017.0035: probe - fail = -110 [ 1720.492121][T29835] nintendo 0005:057E:2017.0035: probe with driver nintendo failed with error -110 [ 1720.922153][ C0] usb 6-1: NFC: Received an invalid frame [ 1720.928096][T15293] usb 6-1: NFC: Unable to get FW version [ 1720.935042][T15293] pn533_usb 6-1:1.0: probe with driver pn533_usb failed with error -5 [ 1721.055304][ T1347] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7936'. [ 1721.225121][T25637] usb 6-1: USB disconnect, device number 73 [ 1721.245490][T31769] gspca_m5602: Failed to find a sensor [ 1721.245506][T31769] ALi m5602 2-1:0.0: ALi m5602 webcam failed [ 1721.252916][T31769] usb 2-1: USB disconnect, device number 118 [ 1721.400909][ T1343] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1721.401080][ T1343] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1721.401237][ T1343] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1721.401412][ T1343] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1721.471435][ T1357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7939'. [ 1721.839296][T31769] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1721.989769][T31769] usb 4-1: New USB device found, idVendor=05c6, idProduct=1000, bcdDevice= 0.00 [ 1721.990714][T31769] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1721.996957][T31769] usb-storage 4-1:1.0: USB Mass Storage device detected [ 1722.024222][T29835] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 1722.029333][T25637] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1722.169643][T29835] usb 6-1: New USB device found, idVendor=1b80, idProduct=e309, bcdDevice= 1.00 [ 1722.172198][T29835] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1722.172226][T29835] usb 6-1: Product: syz [ 1722.172242][T29835] usb 6-1: Manufacturer: syz [ 1722.203425][T25637] usb 2-1: New USB device found, idVendor=09c0, idProduct=0202, bcdDevice= 1.00 [ 1722.205666][T25637] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1722.226483][T29835] em28xx 6-1:1.0: New device syz syz @ 480 Mbps (1b80:e309, interface 0, class 0) [ 1722.226519][T29835] em28xx 6-1:1.0: Video interface 0 found: bulk [ 1722.235774][T25637] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver' in warm state. [ 1722.679551][T12924] Bluetooth: hci5: command 0x0c1a tx timeout [ 1722.835630][T31769] usb-storage 4-1:1.0: probe with driver usb-storage failed with error -5 [ 1722.842291][T31769] usb 4-1: USB disconnect, device number 44 [ 1723.299420][T29835] em28xx 6-1:1.0: unknown em28xx chip ID (0) [ 1723.374237][T29835] em28xx 6-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 1723.374272][T29835] em28xx 6-1:1.0: board has no eeprom [ 1723.429943][T29835] em28xx 6-1:1.0: Identified as Easy Cap Capture DC-60 (card=64) [ 1723.429977][T29835] em28xx 6-1:1.0: analog set to bulk mode. [ 1723.432047][T15293] em28xx 6-1:1.0: Registering V4L2 extension [ 1723.463102][T29835] usb 6-1: USB disconnect, device number 74 [ 1723.467202][T29835] em28xx 6-1:1.0: Disconnecting em28xx [ 1723.483316][T25637] gp8psk: usb in 128 operation failed. [ 1723.483429][T12924] Bluetooth: hci1: command 0x0c1a tx timeout [ 1723.483488][T29241] Bluetooth: hci4: command 0x0c1a tx timeout [ 1723.483528][T29241] Bluetooth: hci0: command 0x0c1a tx timeout [ 1723.483694][T25637] gp8psk: usb in 137 operation failed. [ 1723.483708][T25637] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1723.484304][T25637] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver) [ 1723.484336][T25637] usb 2-1: media controller created [ 1723.563888][T25637] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1723.574534][T15293] em28xx 6-1:1.0: Config register raw data: 0xffffffed [ 1723.574558][T15293] em28xx 6-1:1.0: AC97 chip type couldn't be determined [ 1723.574572][T15293] em28xx 6-1:1.0: No AC97 audio processor [ 1723.642129][ T1387] bond0: (slave bond_slave_0): Releasing backup interface [ 1723.644324][ T1387] bridge0: left promiscuous mode [ 1723.646163][ T1387] bridge_slave_1: left allmulticast mode [ 1723.648542][ T1387] bridge0: port 2(bridge_slave_1) entered disabled state [ 1723.655348][T15293] usb 6-1: Decoder not found [ 1723.655371][T15293] em28xx 6-1:1.0: failed to create media graph [ 1723.655402][T15293] em28xx 6-1:1.0: V4L2 device video103 deregistered [ 1723.687385][T25637] gp8psk_fe: Frontend attached [ 1723.687440][T25637] usb 2-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1723.688107][T25637] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1723.703445][ T1387] bridge_slave_0: left allmulticast mode [ 1723.705499][ T1387] bridge0: port 1(bridge_slave_0) entered disabled state [ 1723.742057][T15293] INFO: trying to register non-static key. [ 1723.747968][T15293] The code is fine but needs lockdep annotation, or maybe [ 1723.755090][T15293] you didn't initialize this object before use? [ 1723.761380][T15293] turning off the locking correctness validator. [ 1723.767768][T15293] CPU: 0 UID: 0 PID: 15293 Comm: kworker/0:14 Tainted: G L syzkaller #0 PREEMPT(full) [ 1723.778877][T15293] Tainted: [L]=SOFTLOCKUP [ 1723.783200][T15293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1723.793247][T15293] Workqueue: events request_module_async [ 1723.798984][T15293] Call Trace: [ 1723.802268][T15293] [ 1723.805206][T15293] dump_stack_lvl+0xe8/0x150 [ 1723.809802][T15293] assign_lock_key+0x133/0x150 [ 1723.814590][T15293] register_lock_class+0xcc/0x2e0 [ 1723.819688][T15293] __lock_acquire+0x10c/0x2de0 [ 1723.824458][T15293] ? __mutex_trylock_common+0x15f/0x270 [ 1723.830114][T15293] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1723.836033][T15293] lock_acquire+0x115/0x350 [ 1723.840537][T15293] ? __wake_up_common_lock+0x30/0x1f0 [ 1723.845938][T15293] ? rcu_is_watching+0x16/0xb0 [ 1723.850732][T15293] _raw_spin_lock_irqsave+0x40/0x60 [ 1723.855952][T15293] ? __wake_up_common_lock+0x30/0x1f0 [ 1723.861352][T15293] __wake_up_common_lock+0x30/0x1f0 [ 1723.864463][T25637] gp8psk: usb in 138 operation failed. [ 1723.864482][T25637] dvb-usb: Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver successfully initialized and connected. [ 1723.864495][T25637] gp8psk: found Genpix USB device pID = 202 (hex) [ 1723.866639][T25637] usb 2-1: USB disconnect, device number 119 [ 1723.894502][T15293] ? __pfx___mutex_lock+0x10/0x10 [ 1723.899568][T15293] __vb2_queue_cancel+0x2de/0xde0 [ 1723.900334][T25637] dvb-usb: Genpix 8PSK-to-USB2 Rev.2 DVB-S receive successfully deinitialized and disconnected. [ 1723.915095][T15293] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 1723.920623][T15293] vb2_core_queue_release+0x2f/0x150 [ 1723.925908][T15293] vb2_video_unregister_device+0x15b/0x200 [ 1723.931731][T15293] em28xx_v4l2_init+0x1c89/0x3150 [ 1723.936780][T15293] em28xx_init_extension+0x120/0x1d0 [ 1723.942077][T15293] ? process_scheduled_works+0x97a/0x1630 [ 1723.947801][T15293] process_scheduled_works+0xc3d/0x1630 [ 1723.953362][T15293] ? __pfx_process_scheduled_works+0x10/0x10 [ 1723.959352][T15293] ? assign_work+0x3cf/0x5d0 [ 1723.963947][T15293] worker_thread+0xa47/0xfb0 [ 1723.968537][T15293] kthread+0x38b/0x480 [ 1723.972607][T15293] ? __pfx_worker_thread+0x10/0x10 [ 1723.977713][T15293] ? __pfx_kthread+0x10/0x10 [ 1723.982295][T15293] ret_from_fork+0x514/0xb70 [ 1723.986879][T15293] ? __pfx_ret_from_fork+0x10/0x10 [ 1723.991980][T15293] ? __switch_to+0xc89/0x1420 [ 1723.996656][T15293] ? __pfx_kthread+0x10/0x10 [ 1724.001246][T15293] ret_from_fork_asm+0x1a/0x30 [ 1724.006014][T15293] [ 1724.009090][T15293] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 1724.021060][T15293] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 1724.029472][T15293] CPU: 0 UID: 0 PID: 15293 Comm: kworker/0:14 Tainted: G L syzkaller #0 PREEMPT(full) [ 1724.040576][T15293] Tainted: [L]=SOFTLOCKUP [ 1724.044903][T15293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1724.054955][T15293] Workqueue: events request_module_async [ 1724.060618][T15293] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 1724.066632][T15293] Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 ac b9 97 00 48 ba 00 00 00 00 00 fc [ 1724.086252][T15293] RSP: 0018:ffffc90005b17880 EFLAGS: 00010046 [ 1724.092311][T15293] RAX: 0000000000000000 RBX: ffff88807ab3d740 RCX: 0000000000000001 [ 1724.100281][T15293] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc90005b177e0 [ 1724.108277][T15293] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 1724.116262][T15293] R10: dffffc0000000000 R11: fffff52000b62efc R12: 0000000000000000 [ 1724.124229][T15293] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88807ab3d7d0 [ 1724.132196][T15293] FS: 0000000000000000(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 [ 1724.141119][T15293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1724.147707][T15293] CR2: 00007fbf6e5c6ff8 CR3: 000000009c852000 CR4: 00000000003526f0 [ 1724.155698][T15293] Call Trace: [ 1724.158984][T15293] [ 1724.161931][T15293] __vb2_queue_cancel+0x2de/0xde0 [ 1724.166957][T15293] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 1724.172331][T15293] vb2_core_queue_release+0x2f/0x150 [ 1724.177615][T15293] vb2_video_unregister_device+0x15b/0x200 [ 1724.183414][T15293] em28xx_v4l2_init+0x1c89/0x3150 [ 1724.188440][T15293] em28xx_init_extension+0x120/0x1d0 [ 1724.193723][T15293] ? process_scheduled_works+0x97a/0x1630 [ 1724.199441][T15293] process_scheduled_works+0xc3d/0x1630 [ 1724.204983][T15293] ? __pfx_process_scheduled_works+0x10/0x10 [ 1724.210960][T15293] ? assign_work+0x3cf/0x5d0 [ 1724.215601][T15293] worker_thread+0xa47/0xfb0 [ 1724.220222][T15293] kthread+0x38b/0x480 [ 1724.224331][T15293] ? __pfx_worker_thread+0x10/0x10 [ 1724.229461][T15293] ? __pfx_kthread+0x10/0x10 [ 1724.234055][T15293] ret_from_fork+0x514/0xb70 [ 1724.238635][T15293] ? __pfx_ret_from_fork+0x10/0x10 [ 1724.243742][T15293] ? __switch_to+0xc89/0x1420 [ 1724.248429][T15293] ? __pfx_kthread+0x10/0x10 [ 1724.253021][T15293] ret_from_fork_asm+0x1a/0x30 [ 1724.257794][T15293] [ 1724.260820][T15293] Modules linked in: [ 1724.264714][T15293] ---[ end trace 0000000000000000 ]--- [ 1724.270164][T15293] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 1724.270195][T15293] Code: 0f 84 d4 00 00 00 44 8b 64 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 fd 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 ac b9 97 00 48 ba 00 00 00 00 00 fc [ 1724.270208][T15293] RSP: 0018:ffffc90005b17880 EFLAGS: 00010046 [ 1724.270223][T15293] RAX: 0000000000000000 RBX: ffff88807ab3d740 RCX: 0000000000000001 [ 1724.270233][T15293] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc90005b177e0 [ 1724.270245][T15293] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 1724.270255][T15293] R10: dffffc0000000000 R11: fffff52000b62efc R12: 0000000000000000 [ 1724.270267][T15293] R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88807ab3d7d0 [ 1724.270279][T15293] FS: 0000000000000000(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 [ 1724.270292][T15293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1724.270304][T15293] CR2: 00007fbf6e5c6ff8 CR3: 000000009c852000 CR4: 00000000003526f0 [ 1724.270392][T15293] Kernel panic - not syncing: Fatal exception [ 1724.371467][T15293] Kernel Offset: disabled [ 1724.375789][T15293] Rebooting in 86400 seconds..