last executing test programs: 6.992799508s ago: executing program 3 (id=3134): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000019300)={0x2020}, 0x2020) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000500)={{0x1, 0x1, 0x6b, 0xffffffffffffffff, {0x101}}, '\x00'}) getpid() r4 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000000), 0xfff, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r5, 0xc040563d, &(0x7f0000000080)={0x1, 0x0, 0x2, 0x4, {0x4, 0xfffffffd, 0x2, 0x9}}) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000019080)=@req={0x7, 0x50d, 0x0, 0x6}, 0x10) sendmsg$nl_generic(r7, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r8 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266, 0x0, r4}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r8, 0x12, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[], 0x40}}, 0x20000840) ioctl$sock_ifreq(0xffffffffffffffff, 0x894a, &(0x7f0000000140)={'macsec0\x00', @ifru_hwaddr=@remote}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000002c0)=@newqdisc={0x64, 0x24, 0x3fe3aa0262d8c583, 0xffffffff, 0x3, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x34, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6a13}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x5}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x3}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xefa5}]}}]}, 0x64}}, 0x2000400c) 5.72207038s ago: executing program 3 (id=3138): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x15) ioctl(r0, 0x404c4701, &(0x7f0000000080)="0100000000000000000000000a0000000a0000000a0000000300000020000000200000000100000001") ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0xf9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000101)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000140)=0x3f) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x541c, &(0x7f00000001c0)) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000103)=0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/pool_threads\x00', 0x1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000240)="67400f07c40249af4b8bb9800000c00f3235010000000f300f20a366450f769e00000100440f20c03588001d00440f22c0460f01c9c4827d24c366bafc0cf0ff07ef87f345a57a43e16806a4", 0x4c}], 0x1, 0x7c, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write(r1, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000105)=0xf9) 5.249241441s ago: executing program 0 (id=3140): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0x3}, {}, {0x7, 0x300}}}, 0x24}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 4.89962243s ago: executing program 0 (id=3142): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x119, 0x70bd26, 0x25dfdbf5, {0xa, 0x8, 0x19, 0xfe, r1}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xffffffff, 0x100, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) 4.590041817s ago: executing program 0 (id=3144): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040110700090001010203010902200001010080fa0904000002070102000705810200020007050202"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001ec0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000340)="ab") 4.512693579s ago: executing program 1 (id=3145): openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 4.435846101s ago: executing program 3 (id=3146): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000019300)={0x2020}, 0x2020) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000500)={{0x1, 0x1, 0x6b, 0xffffffffffffffff, {0x101}}, '\x00'}) getpid() r4 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000000), 0xfff, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r5, 0xc040563d, &(0x7f0000000080)={0x1, 0x0, 0x2, 0x4, {0x4, 0xfffffffd, 0x2, 0x9}}) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000019080)=@req={0x7, 0x50d, 0x0, 0x6}, 0x10) sendmsg$nl_generic(r7, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r8 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266, 0x0, r4}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r8, 0x12, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[], 0x40}}, 0x20000840) ioctl$sock_ifreq(0xffffffffffffffff, 0x894a, &(0x7f0000000140)={'macsec0\x00', @ifru_hwaddr=@remote}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000002c0)=@newqdisc={0x64, 0x24, 0x3fe3aa0262d8c583, 0xffffffff, 0x3, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x34, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6a13}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x5}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x3}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xefa5}]}}]}, 0x64}}, 0x2000400c) 3.403212036s ago: executing program 1 (id=3147): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4000004) r0 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) write$cgroup_subtree(r0, 0x0, 0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)={0x34, 0x4, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x48004) 3.386733277s ago: executing program 3 (id=3148): setns(0xc9, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x101002, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000207, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000200f97a640d35a7386700", "28094cf00000000000004ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac000000000000000000080000000000000000001900", "90be8b1c55080021000c547d03daa0f4bd00", [0x7f, 0x9]}}) 3.320466098s ago: executing program 1 (id=3149): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc2c45512, &(0x7f0000000a00)={{0x5, 0x0, 0x0, 0x8, 'syz1\x00'}, 0x0, [0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r3, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(r4, 0x40045612, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r5, &(0x7f0000007700), 0x318, 0xfc0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800000, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x1842, 0x136) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="180800000000000400000000000000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0xb6df4c32c1d5c814}, 0x94) 3.030903965s ago: executing program 3 (id=3151): socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x1, 0x0) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x88, 0x30, 0x1, 0x0, 0x0, {}, [{0x74, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) readv(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0), 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x7, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r5, 0x7, 0x0, 0x30, 0x0, @in={0x2, 0x4e22, @loopback}, @ib={0x1b, 0x0, 0x6, {"4ca56ae0e82187425e000303ff010001"}, 0x4, 0x0, 0x1}}}, 0x118) 2.714197953s ago: executing program 1 (id=3153): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x119, 0x70bd26, 0x25dfdbf5, {0xa, 0x8, 0x19, 0xfe, r1}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xffffffff, 0x100, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) 2.540330337s ago: executing program 1 (id=3154): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x15) ioctl(r0, 0x404c4701, &(0x7f0000000080)="0100000000000000000000000a0000000a0000000a0000000300000020000000200000000100000001") ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000100)=0xf9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000101)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000140)=0x3f) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x541c, &(0x7f00000001c0)) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000103)=0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/pool_threads\x00', 0x1, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000240)="67400f07c40249af4b8bb9800000c00f3235010000000f300f20a366450f769e00000100440f20c03588001d00440f22c0460f01c9c4827d24c366bafc0cf0ff07ef87f345a57a43e16806a4", 0x4c}], 0x1, 0x7c, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r4, 0xae9a) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) ioctl$KVM_RUN(r4, 0xae80, 0x0) write(r1, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000105)=0xf9) 2.515112628s ago: executing program 2 (id=3155): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x3000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 2.347678932s ago: executing program 2 (id=3156): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) read$FUSE(r3, &(0x7f0000019300)={0x2020}, 0x2020) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000500)={{0x1, 0x1, 0x6b, 0xffffffffffffffff, {0x101}}, '\x00'}) getpid() r4 = syz_open_procfs(0xffffffffffffffff, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$video4linux(&(0x7f0000000000), 0xfff, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r5, 0xc040563d, &(0x7f0000000080)={0x1, 0x0, 0x2, 0x4, {0x4, 0xfffffffd, 0x2, 0x9}}) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000019080)=@req={0x7, 0x50d, 0x0, 0x6}, 0x10) sendmsg$nl_generic(r7, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r8 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266, 0x0, r4}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r8, 0x12, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=ANY=[], 0x40}}, 0x20000840) ioctl$sock_ifreq(0xffffffffffffffff, 0x894a, &(0x7f0000000140)={'macsec0\x00', @ifru_hwaddr=@remote}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000002c0)=@newqdisc={0x64, 0x24, 0x3fe3aa0262d8c583, 0xffffffff, 0x3, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xffff, 0xfff1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x34, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6a13}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x5}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x3}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xefa5}]}}]}, 0x64}}, 0x2000400c) 1.415501505s ago: executing program 2 (id=3157): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) socket$inet(0x2, 0x2, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r1, &(0x7f0000000100), 0x12) listen(r1, 0x1) write$tun(r0, &(0x7f0000000300)={@val={0x0, 0x805}, @void, @x25={0x0, 0x0, 0x1, "0b007e0b0a43b820a8e8c9881db660164333526f68eb13254bccba0eac8c863a63f79fe7f1d5514a5a2b016bc0ab07b7ea2909619c0548a3c94ff542d23d8d2253f8e3843394132280bfa1629888fe0f017805cd8f9bceac64d35287f5704d58322a0765d9585883e4f48958696855767c1b1ed4b2f5c0bde2d4bc831a95f12204"}}, 0x88) 1.380629076s ago: executing program 0 (id=3158): mkdirat(0xffffffffffffff9c, 0x0, 0x22) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f00000000c0)=0x102, 0x4) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1.19276326s ago: executing program 2 (id=3159): setns(0xc9, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x101002, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000140), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000207, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000200f97a640d35a7386700", "28094cf00000000000004ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac000000000000000000080000000000000000001900", "90be8b1c55080021000c547d03daa0f4bd00", [0x7f, 0x9]}}) 963.654585ms ago: executing program 0 (id=3160): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x100) 627.962834ms ago: executing program 2 (id=3161): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newtfilter={0x38, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x40}]}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) 423.719989ms ago: executing program 0 (id=3162): bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f00000012c0), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc2c45512, &(0x7f0000000a00)={{0x5, 0x0, 0x0, 0x8, 'syz1\x00'}, 0x0, [0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r3, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$vim2m_VIDIOC_STREAMON(r4, 0x40045612, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r5, &(0x7f0000007700), 0x318, 0xfc0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x800000, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x1842, 0x136) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x8, &(0x7f00000002c0)=ANY=[@ANYBLOB="180800000000000400000000000000008510000003000000180000000000000000000000000000009500000000000000bfa000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0xb6df4c32c1d5c814}, 0x94) 298.540192ms ago: executing program 2 (id=3163): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0xffffffffffffffff}, {0xffff, 0xffff}, {0xfff3, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0x3}, {}, {0x7, 0x300}}}, 0x24}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) 105.923457ms ago: executing program 3 (id=3164): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x119, 0x70bd26, 0x25dfdbf5, {0xa, 0x8, 0x19, 0xfe, r1}, [@IFA_CACHEINFO={0x14, 0x6, {0x0, 0xffffffff, 0x100, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) 0s ago: executing program 1 (id=3165): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/split_huge_pages\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='/', 0x1) kernel console output (not intermixed with test programs): d_failslab+0x9/0x20 [ 661.240959][T12616] slab_pre_alloc_hook+0x59/0x300 [ 661.246061][T12616] ? resv_map_alloc+0x51/0x2c0 [ 661.250901][T12616] __kmem_cache_alloc_node+0x53/0x250 [ 661.256338][T12616] ? resv_map_alloc+0x51/0x2c0 [ 661.262126][T12616] kmalloc_trace+0x2a/0xe0 [ 661.266611][T12616] resv_map_alloc+0x51/0x2c0 [ 661.271269][T12616] hugetlbfs_get_inode+0x64/0x500 [ 661.276372][T12616] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 661.282504][T12616] hugetlb_file_setup+0x215/0x610 [ 661.287603][T12616] ksys_mmap_pgoff+0x1e6/0x720 [ 661.292442][T12616] do_syscall_64+0x55/0xb0 [ 661.296916][T12616] ? clear_bhb_loop+0x40/0x90 [ 661.301648][T12616] ? clear_bhb_loop+0x40/0x90 [ 661.306381][T12616] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 661.312332][T12616] RIP: 0033:0x7f772419e159 [ 661.316794][T12616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.329142][T12516] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 661.336452][T12616] RSP: 002b:00007f772506c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 661.336482][T12616] RAX: ffffffffffffffda RBX: 00007f7724425fa0 RCX: 00007f772419e159 [ 661.336498][T12616] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 661.336513][T12616] RBP: 00007f7724235024 R08: ffffffffffffffff R09: 0000000000000000 [ 661.375685][T12616] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 661.383708][T12616] R13: 00007f7724426038 R14: 00007f7724425fa0 R15: 00007fff0245ade8 [ 661.391753][T12616] [ 661.443550][T12516] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 661.467268][T12516] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 661.509779][T12516] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 662.233038][T12047] Bluetooth: hci1: command tx timeout [ 662.675462][T12516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 662.782218][T12516] 8021q: adding VLAN 0 to HW filter on device team0 [ 662.820903][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.828207][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 662.944682][ T1082] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.951912][ T1082] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.503946][T12640] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.511842][T12640] bridge0: port 1(bridge_slave_0) entered disabled state [ 663.942342][T12651] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 663.970717][T12640] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 664.017821][T12640] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 664.103557][T12651] usb 3-1: device descriptor read/64, error -71 [ 664.384117][T12651] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 664.395318][T12640] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.409904][T12640] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.419419][T12640] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.429477][T12640] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.552883][T12651] usb 3-1: device descriptor read/64, error -71 [ 664.703232][T12651] usb usb3-port1: attempt power cycle [ 664.884611][T12664] FAULT_INJECTION: forcing a failure. [ 664.884611][T12664] name failslab, interval 1, probability 0, space 0, times 0 [ 664.906154][T12664] CPU: 1 PID: 12664 Comm: syz.0.2478 Not tainted syzkaller #0 [ 664.913765][T12664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 664.923877][T12664] Call Trace: [ 664.927203][T12664] [ 664.930187][T12664] dump_stack_lvl+0x18c/0x250 [ 664.934946][T12664] ? show_regs_print_info+0x20/0x20 [ 664.940206][T12664] ? load_image+0x420/0x420 [ 664.944783][T12664] ? __might_sleep+0xe0/0xe0 [ 664.949446][T12664] ? __lock_acquire+0x7d80/0x7d80 [ 664.954533][T12664] should_fail_ex+0x394/0x4c0 [ 664.959274][T12664] should_failslab+0x9/0x20 [ 664.963840][T12664] slab_pre_alloc_hook+0x59/0x300 [ 664.968925][T12664] ? resv_map_alloc+0x51/0x2c0 [ 664.973747][T12664] __kmem_cache_alloc_node+0x53/0x250 [ 664.979187][T12664] ? resv_map_alloc+0x51/0x2c0 [ 664.984025][T12664] kmalloc_trace+0x2a/0xe0 [ 664.988510][T12664] resv_map_alloc+0x51/0x2c0 [ 664.993160][T12664] hugetlbfs_get_inode+0x64/0x500 [ 664.998254][T12664] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 665.004296][T12664] hugetlb_file_setup+0x215/0x610 [ 665.009390][T12664] ksys_mmap_pgoff+0x1e6/0x720 [ 665.014237][T12664] do_syscall_64+0x55/0xb0 [ 665.018713][T12664] ? clear_bhb_loop+0x40/0x90 [ 665.023452][T12664] ? clear_bhb_loop+0x40/0x90 [ 665.028195][T12664] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 665.034279][T12664] RIP: 0033:0x7fc2d059e159 [ 665.038751][T12664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 665.058419][T12664] RSP: 002b:00007fc2d145b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 665.066898][T12664] RAX: ffffffffffffffda RBX: 00007fc2d0825fa0 RCX: 00007fc2d059e159 [ 665.074924][T12664] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 665.082950][T12664] RBP: 00007fc2d0635024 R08: ffffffffffffffff R09: 0000000000000000 [ 665.090977][T12664] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 665.100227][T12664] R13: 00007fc2d0826038 R14: 00007fc2d0825fa0 R15: 00007fffb771ab18 [ 665.108318][T12664] [ 665.213276][T12651] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 665.244146][T12651] usb 3-1: device descriptor read/8, error -71 [ 665.424828][T12516] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 665.598366][T12516] veth0_vlan: entered promiscuous mode [ 666.494262][T12516] veth1_vlan: entered promiscuous mode [ 666.513096][T12651] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 666.529415][T12516] veth0_macvtap: entered promiscuous mode [ 666.541253][T12516] veth1_macvtap: entered promiscuous mode [ 666.574222][T12516] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 666.585240][T12516] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 666.600727][T12516] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 666.650056][T12651] usb 3-1: device descriptor read/8, error -71 [ 666.741320][T12516] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 666.773153][T12651] usb usb3-port1: unable to enumerate USB device [ 666.826451][T12516] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 666.886468][T12516] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 666.924819][T12516] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 666.969791][T12516] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.012977][T12516] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.040973][T12516] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.989492][T12698] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.997319][T12698] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.141339][T12725] FAULT_INJECTION: forcing a failure. [ 668.141339][T12725] name failslab, interval 1, probability 0, space 0, times 0 [ 668.155845][T12725] CPU: 0 PID: 12725 Comm: syz.0.2486 Not tainted syzkaller #0 [ 668.163382][T12725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 668.173494][T12725] Call Trace: [ 668.176818][T12725] [ 668.179792][T12725] dump_stack_lvl+0x18c/0x250 [ 668.184546][T12725] ? show_regs_print_info+0x20/0x20 [ 668.189821][T12725] ? load_image+0x420/0x420 [ 668.194492][T12725] ? __might_sleep+0xe0/0xe0 [ 668.199151][T12725] ? __lock_acquire+0x7d80/0x7d80 [ 668.204344][T12725] should_fail_ex+0x394/0x4c0 [ 668.209094][T12725] should_failslab+0x9/0x20 [ 668.213663][T12725] slab_pre_alloc_hook+0x59/0x300 [ 668.218754][T12725] ? resv_map_alloc+0x51/0x2c0 [ 668.223637][T12725] __kmem_cache_alloc_node+0x53/0x250 [ 668.229048][T12725] ? resv_map_alloc+0x51/0x2c0 [ 668.233831][T12725] kmalloc_trace+0x2a/0xe0 [ 668.238286][T12725] resv_map_alloc+0x51/0x2c0 [ 668.242992][T12725] hugetlbfs_get_inode+0x64/0x500 [ 668.248032][T12725] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 668.254040][T12725] hugetlb_file_setup+0x215/0x610 [ 668.259091][T12725] ksys_mmap_pgoff+0x1e6/0x720 [ 668.263889][T12725] do_syscall_64+0x55/0xb0 [ 668.268440][T12725] ? clear_bhb_loop+0x40/0x90 [ 668.273150][T12725] ? clear_bhb_loop+0x40/0x90 [ 668.277836][T12725] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 668.283735][T12725] RIP: 0033:0x7fc2d059e159 [ 668.288150][T12725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 668.307764][T12725] RSP: 002b:00007fc2d145b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 668.316215][T12725] RAX: ffffffffffffffda RBX: 00007fc2d0825fa0 RCX: 00007fc2d059e159 [ 668.324227][T12725] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 668.332238][T12725] RBP: 00007fc2d0635024 R08: ffffffffffffffff R09: 0000000000000000 [ 668.340281][T12725] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 668.348278][T12725] R13: 00007fc2d0826038 R14: 00007fc2d0825fa0 R15: 00007fffb771ab18 [ 668.356281][T12725] [ 668.696048][T12698] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 668.740783][T12698] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 669.155335][T12698] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.165190][T12698] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.175141][T12698] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.184492][T12698] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 669.580987][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.617324][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.841086][ T9124] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 670.597284][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 670.626102][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.666324][ T9124] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 670.677199][ T9124] usb 1-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 670.711141][ T9124] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 670.754738][ T9124] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.921879][T12755] syzkaller0: entered promiscuous mode [ 670.943295][T12755] syzkaller0: entered allmulticast mode [ 672.745803][T12621] usb 1-1: USB disconnect, device number 35 [ 673.937712][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 673.958126][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 673.988596][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 673.999236][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 674.017505][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 674.027384][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 675.906408][T12770] bridge0: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 675.949229][T12770] bridge0: entered allmulticast mode [ 676.073351][T12047] Bluetooth: hci0: command tx timeout [ 676.771857][T12781] bridge0: port 2(bridge_slave_1) entered disabled state [ 676.779456][T12781] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.197138][T12781] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 677.240448][T12781] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 677.611336][T12781] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.621128][T12781] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.630704][T12781] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.640943][T12781] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.192350][T12047] Bluetooth: hci0: command tx timeout [ 679.049787][T12772] chnl_net:caif_netlink_parms(): no params data found [ 679.516088][T12772] bridge0: port 1(bridge_slave_0) entered blocking state [ 679.535799][T12772] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.548642][T12772] bridge_slave_0: entered allmulticast mode [ 679.560839][T12772] bridge_slave_0: entered promiscuous mode [ 679.614612][T12772] bridge0: port 2(bridge_slave_1) entered blocking state [ 679.621860][T12772] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.659713][T12772] bridge_slave_1: entered allmulticast mode [ 679.671716][T12772] bridge_slave_1: entered promiscuous mode [ 680.108670][T12831] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2507'. [ 680.171922][T12772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 680.207164][T12772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 680.234265][ T51] Bluetooth: hci0: command tx timeout [ 680.371523][T12772] team0: Port device team_slave_0 added [ 680.435221][T12772] team0: Port device team_slave_1 added [ 680.531242][T12772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 680.548003][T12772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 680.593615][T12772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 680.651767][T12772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 680.662456][T12772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 680.811523][T12772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 681.808849][T12772] hsr_slave_0: entered promiscuous mode [ 681.838829][T12772] hsr_slave_1: entered promiscuous mode [ 681.957210][ T12] dvmrp0 (unregistering): left allmulticast mode [ 682.269381][ T27] audit: type=1326 audit(1788069926.576:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12866 comm="syz.0.2515" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc2d059e159 code=0x0 [ 682.318694][ T51] Bluetooth: hci0: command tx timeout [ 682.495040][ T12] hsr_slave_0: left promiscuous mode [ 682.512096][ T12] hsr_slave_1: left promiscuous mode [ 682.527343][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 682.539431][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 684.391487][ T12] team0 (unregistering): Port device team_slave_1 removed [ 684.449200][ T12] team0 (unregistering): Port device team_slave_0 removed [ 684.506798][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 684.565666][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 684.997853][ T12] bond0 (unregistering): Released all slaves [ 686.193991][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.200923][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.211514][ T1294] eth3 selects TX queue 0, but real number of TX queues is 0 [ 688.656434][T12772] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 688.719185][T12772] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 688.753634][ T9103] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 688.818900][T12772] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 688.838005][T12772] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 688.988908][T12772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 689.004455][ T9103] usb 1-1: Using ep0 maxpacket: 32 [ 689.012066][ T9103] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 689.021797][ T9103] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 689.034049][ T9103] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 689.046881][ T9103] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 689.061393][ T9103] usb 1-1: config 0 interface 0 has no altsetting 0 [ 689.076248][T12772] 8021q: adding VLAN 0 to HW filter on device team0 [ 689.087547][ T9103] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 689.108243][ T9103] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 689.123185][ T9103] usb 1-1: Product: syz [ 689.133211][ T1101] bridge0: port 1(bridge_slave_0) entered blocking state [ 689.140401][ T1101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 689.155647][ T9103] usb 1-1: Manufacturer: syz [ 689.160628][ T9103] usb 1-1: SerialNumber: syz [ 689.171557][ T1101] bridge0: port 2(bridge_slave_1) entered blocking state [ 689.178932][ T1101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 689.190371][ T9103] usb 1-1: config 0 descriptor?? [ 689.221837][ T9103] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 689.303802][ T9103] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 689.459231][ T9103] usb 1-1: USB disconnect, device number 36 [ 689.495140][ T9103] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 689.557020][T12958] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2535'. [ 690.671232][T12772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 690.857739][T12772] veth0_vlan: entered promiscuous mode [ 690.876970][T12772] veth1_vlan: entered promiscuous mode [ 690.950109][T12772] veth0_macvtap: entered promiscuous mode [ 690.985825][T12772] veth1_macvtap: entered promiscuous mode [ 691.025143][T12772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 691.171663][T12772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 691.216629][T12772] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.259632][T12772] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.300341][T12772] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.334705][T12772] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.526064][ T1082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.543078][ T1082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.606768][T12799] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.625412][T12799] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.906931][T13003] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2544'. [ 695.194631][T13045] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2553'. [ 695.276283][T13047] FAULT_INJECTION: forcing a failure. [ 695.276283][T13047] name failslab, interval 1, probability 0, space 0, times 0 [ 695.299484][T13047] CPU: 1 PID: 13047 Comm: syz.1.2555 Not tainted syzkaller #0 [ 695.307036][T13047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 695.317152][T13047] Call Trace: [ 695.320517][T13047] [ 695.323485][T13047] dump_stack_lvl+0x18c/0x250 [ 695.328221][T13047] ? show_regs_print_info+0x20/0x20 [ 695.333475][T13047] ? load_image+0x420/0x420 [ 695.338037][T13047] ? __might_sleep+0xe0/0xe0 [ 695.342679][T13047] ? __lock_acquire+0x7d80/0x7d80 [ 695.347755][T13047] should_fail_ex+0x394/0x4c0 [ 695.352495][T13047] should_failslab+0x9/0x20 [ 695.357062][T13047] slab_pre_alloc_hook+0x59/0x300 [ 695.362156][T13047] ? resv_map_alloc+0x51/0x2c0 [ 695.366968][T13047] __kmem_cache_alloc_node+0x53/0x250 [ 695.372399][T13047] ? resv_map_alloc+0x51/0x2c0 [ 695.377223][T13047] kmalloc_trace+0x2a/0xe0 [ 695.381703][T13047] resv_map_alloc+0x51/0x2c0 [ 695.386361][T13047] hugetlbfs_get_inode+0x64/0x500 [ 695.391453][T13047] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 695.397493][T13047] hugetlb_file_setup+0x215/0x610 [ 695.402560][T13047] ksys_mmap_pgoff+0x1e6/0x720 [ 695.407368][T13047] do_syscall_64+0x55/0xb0 [ 695.411791][T13047] ? clear_bhb_loop+0x40/0x90 [ 695.416476][T13047] ? clear_bhb_loop+0x40/0x90 [ 695.421182][T13047] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 695.427085][T13047] RIP: 0033:0x7ff2ae99e159 [ 695.431505][T13047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.451149][T13047] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 695.459574][T13047] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 695.467551][T13047] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 695.475526][T13047] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 695.483509][T13047] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 695.491487][T13047] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 695.499557][T13047] [ 695.784224][T13062] syzkaller0: entered promiscuous mode [ 695.793351][T13062] syzkaller0: entered allmulticast mode [ 697.047217][T13090] netlink: 756 bytes leftover after parsing attributes in process `syz.1.2563'. [ 697.692039][T13110] FAULT_INJECTION: forcing a failure. [ 697.692039][T13110] name failslab, interval 1, probability 0, space 0, times 0 [ 697.713438][T13110] CPU: 1 PID: 13110 Comm: syz.3.2567 Not tainted syzkaller #0 [ 697.720943][T13110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 697.731032][T13110] Call Trace: [ 697.734352][T13110] [ 697.737321][T13110] dump_stack_lvl+0x18c/0x250 [ 697.742057][T13110] ? show_regs_print_info+0x20/0x20 [ 697.747304][T13110] ? load_image+0x420/0x420 [ 697.751838][T13110] ? __might_sleep+0xe0/0xe0 [ 697.756446][T13110] ? __lock_acquire+0x7d80/0x7d80 [ 697.761506][T13110] should_fail_ex+0x394/0x4c0 [ 697.766236][T13110] should_failslab+0x9/0x20 [ 697.770753][T13110] slab_pre_alloc_hook+0x59/0x300 [ 697.775790][T13110] ? resv_map_alloc+0x88/0x2c0 [ 697.780574][T13110] __kmem_cache_alloc_node+0x53/0x250 [ 697.785956][T13110] ? resv_map_alloc+0x88/0x2c0 [ 697.790725][T13110] kmalloc_trace+0x2a/0xe0 [ 697.795165][T13110] resv_map_alloc+0x88/0x2c0 [ 697.799776][T13110] hugetlbfs_get_inode+0x64/0x500 [ 697.804837][T13110] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 697.810831][T13110] hugetlb_file_setup+0x215/0x610 [ 697.815878][T13110] ksys_mmap_pgoff+0x1e6/0x720 [ 697.820667][T13110] do_syscall_64+0x55/0xb0 [ 697.825110][T13110] ? clear_bhb_loop+0x40/0x90 [ 697.829846][T13110] ? clear_bhb_loop+0x40/0x90 [ 697.834593][T13110] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 697.840545][T13110] RIP: 0033:0x7fb0ab79e159 [ 697.845002][T13110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 697.864901][T13110] RSP: 002b:00007fb0ac65b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 697.873345][T13110] RAX: ffffffffffffffda RBX: 00007fb0aba25fa0 RCX: 00007fb0ab79e159 [ 697.881350][T13110] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 697.889337][T13110] RBP: 00007fb0ab835024 R08: ffffffffffffffff R09: 0000000000000000 [ 697.897334][T13110] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 697.905321][T13110] R13: 00007fb0aba26038 R14: 00007fb0aba25fa0 R15: 00007ffdcb8ad8f8 [ 697.913323][T13110] [ 697.995064][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 699.453504][T13140] netlink: 756 bytes leftover after parsing attributes in process `syz.2.2574'. [ 700.773821][T13146] bridge0: port 2(bridge_slave_1) entered disabled state [ 700.781341][T13146] bridge0: port 1(bridge_slave_0) entered disabled state [ 702.078280][T13146] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 702.204080][T13146] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 702.997718][T13146] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.007254][T13146] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.016810][T13146] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.026233][T13146] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.525982][T12621] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 704.642801][T12621] usb 4-1: Using ep0 maxpacket: 32 [ 704.679129][T12621] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 704.731756][T12621] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 704.766470][T12621] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 704.812856][T12621] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 704.831648][T12621] usb 4-1: config 0 interface 0 has no altsetting 0 [ 705.020392][T12621] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 705.041091][T12621] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 705.053729][T12621] usb 4-1: Product: syz [ 705.057973][T12621] usb 4-1: Manufacturer: syz [ 705.065892][T12621] usb 4-1: SerialNumber: syz [ 705.086572][T12621] usb 4-1: config 0 descriptor?? [ 705.095150][T12621] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 705.120752][T12621] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 705.353526][T12431] usb 4-1: USB disconnect, device number 51 [ 705.387819][T12431] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 707.915386][T13254] warn_alloc: 1 callbacks suppressed [ 707.915465][T13254] syz.3.2604: vmalloc error: size 8388608, failed to allocated page array size 16384, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 707.955086][T13254] CPU: 0 PID: 13254 Comm: syz.3.2604 Not tainted syzkaller #0 [ 707.962610][T13254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 707.972706][T13254] Call Trace: [ 707.976007][T13254] [ 707.978963][T13254] dump_stack_lvl+0x18c/0x250 [ 707.983745][T13254] ? show_regs_print_info+0x20/0x20 [ 707.988992][T13254] ? load_image+0x420/0x420 [ 707.993528][T13254] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 708.000013][T13254] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 708.006548][T13254] warn_alloc+0x246/0x340 [ 708.010912][T13254] ? zone_watermark_ok_safe+0x230/0x230 [ 708.016483][T13254] ? _raw_spin_unlock+0x28/0x40 [ 708.021439][T13254] __vmalloc_node_range+0x661/0x1320 [ 708.026755][T13254] ? __asan_memset+0x22/0x40 [ 708.031390][T13254] ? __kasan_kmalloc_large+0x1c/0xa0 [ 708.036704][T13254] ? free_vm_area+0x50/0x50 [ 708.041231][T13254] ? kvmalloc_node+0x70/0x180 [ 708.045964][T13254] ? kvmalloc_node+0x70/0x180 [ 708.050673][T13254] ? trace_kmalloc+0x1f/0xa0 [ 708.055292][T13254] kvmalloc_node+0x13f/0x180 [ 708.059906][T13254] ? fq_pie_init+0x436/0x830 [ 708.064624][T13254] fq_pie_init+0x436/0x830 [ 708.069086][T13254] ? qdisc_peek_dequeued+0x1f0/0x1f0 [ 708.074398][T13254] qdisc_create+0x90f/0x1060 [ 708.079090][T13254] ? qdisc_notify+0x370/0x370 [ 708.083800][T13254] ? lockdep_rtnl_is_held+0x26/0x30 [ 708.089074][T13254] ? qdisc_lookup+0x361/0x6c0 [ 708.093783][T13254] tc_modify_qdisc+0xb47/0x1de0 [ 708.098671][T13254] ? qdisc_offload_query_caps+0x150/0x150 [ 708.104437][T13254] ? qdisc_offload_query_caps+0x150/0x150 [ 708.110223][T13254] rtnetlink_rcv_msg+0x843/0xf90 [ 708.115251][T13254] ? rtnetlink_rcv_msg+0x220/0xf90 [ 708.120404][T13254] ? rtnetlink_bind+0x80/0x80 [ 708.125101][T13254] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 708.131105][T13254] ? read_lock_is_recursive+0x20/0x20 [ 708.136631][T13254] ? mark_lock+0x94/0x320 [ 708.141056][T13254] ? __lock_acquire+0x1262/0x7d80 [ 708.146123][T13254] ? rcu_preempt_deferred_qs_irqrestore+0x83b/0xc30 [ 708.152734][T13254] ? verify_lock_unused+0x140/0x140 [ 708.157967][T13254] ? rcu_read_unlock_special+0x4d0/0x4d0 [ 708.163631][T13254] netlink_rcv_skb+0x235/0x4c0 [ 708.168482][T13254] ? rtnetlink_bind+0x80/0x80 [ 708.173183][T13254] ? netlink_ack+0x1160/0x1160 [ 708.177984][T13254] ? __lock_acquire+0x7d80/0x7d80 [ 708.183067][T13254] ? netlink_deliver_tap+0x2e/0x1b0 [ 708.188289][T13254] netlink_unicast+0x7b1/0x930 [ 708.193085][T13254] netlink_sendmsg+0x8d0/0xbf0 [ 708.197881][T13254] ? netlink_getsockopt+0x590/0x590 [ 708.203115][T13254] ? apparmor_socket_sendmsg+0x170/0x330 [ 708.208831][T13254] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 708.214149][T13254] ? security_socket_sendmsg+0x80/0xa0 [ 708.219635][T13254] ? netlink_getsockopt+0x590/0x590 [ 708.224854][T13254] ____sys_sendmsg+0x61b/0x980 [ 708.229861][T13254] ? __asan_memset+0x22/0x40 [ 708.234481][T13254] ? __sys_sendmsg_sock+0x30/0x30 [ 708.239526][T13254] ? __import_iovec+0x5f2/0x850 [ 708.244409][T13254] ? import_iovec+0x73/0xa0 [ 708.248941][T13254] ___sys_sendmsg+0x2a6/0x360 [ 708.253648][T13254] ? __lock_acquire+0x7d80/0x7d80 [ 708.258702][T13254] ? __sys_sendmsg+0x2b0/0x2b0 [ 708.263533][T13254] __se_sys_sendmsg+0x1d0/0x2c0 [ 708.268500][T13254] ? __x64_sys_sendmsg+0x80/0x80 [ 708.273479][T13254] ? lockdep_hardirqs_on+0x98/0x150 [ 708.278712][T13254] do_syscall_64+0x55/0xb0 [ 708.283153][T13254] ? clear_bhb_loop+0x40/0x90 [ 708.287851][T13254] ? clear_bhb_loop+0x40/0x90 [ 708.292558][T13254] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 708.298483][T13254] RIP: 0033:0x7fb0ab79e159 [ 708.302926][T13254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.322578][T13254] RSP: 002b:00007fb0ac588028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 708.331028][T13254] RAX: ffffffffffffffda RBX: 00007fb0aba26180 RCX: 00007fb0ab79e159 [ 708.339029][T13254] RDX: 000000002000400c RSI: 00002000000000c0 RDI: 0000000000000003 [ 708.347025][T13254] RBP: 00007fb0ab835024 R08: 0000000000000000 R09: 0000000000000000 [ 708.355018][T13254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 708.363007][T13254] R13: 00007fb0aba26218 R14: 00007fb0aba26180 R15: 00007ffdcb8ad8f8 [ 708.371014][T13254] [ 708.383384][T13254] Mem-Info: [ 708.386555][T13254] active_anon:5294 inactive_anon:0 isolated_anon:0 [ 708.386555][T13254] active_file:10807 inactive_file:40196 isolated_file:0 [ 708.386555][T13254] unevictable:2516 dirty:113 writeback:0 [ 708.386555][T13254] slab_reclaimable:11060 slab_unreclaimable:91280 [ 708.386555][T13254] mapped:24943 shmem:1361 pagetables:544 [ 708.386555][T13254] sec_pagetables:0 bounce:0 [ 708.386555][T13254] kernel_misc_reclaimable:0 [ 708.386555][T13254] free:1343870 free_pcp:8622 free_cma:0 [ 708.617964][T13254] Node 0 active_anon:19776kB inactive_anon:0kB active_file:43228kB inactive_file:160576kB unevictable:1628kB isolated(anon):0kB isolated(file):0kB mapped:99772kB dirty:448kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10500kB pagetables:2176kB sec_pagetables:0kB all_unreclaimable? no [ 708.659171][T13254] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 708.693932][T13254] Node 0 DMA free:15328kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 708.726798][T13254] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 708.734486][T13254] Node 0 DMA32 free:1456612kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:19936kB inactive_anon:0kB active_file:43228kB inactive_file:159756kB unevictable:1628kB writepending:448kB present:3129332kB managed:2586824kB mlocked:92kB bounce:0kB free_pcp:33780kB local_pcp:18188kB free_cma:0kB [ 708.771981][T13254] lowmem_reserve[]: 0 0 0 0 0 [ 708.788131][T13254] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:820kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:0kB free_cma:0kB [ 708.826606][T13254] lowmem_reserve[]: 0 0 0 0 0 [ 708.834520][T13254] Node 1 Normal free:3903540kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:9152kB local_pcp:1504kB free_cma:0kB [ 708.869959][T13254] lowmem_reserve[]: 0 0 0 0 0 [ 708.881337][T13254] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15328kB [ 708.896297][T13254] Node 0 DMA32: 3*4kB (UME) 1*8kB (U) 27*16kB (UME) 349*32kB (UME) 208*64kB (UME) 287*128kB (UME) 57*256kB (UME) 16*512kB (UME) 12*1024kB (UM) 4*2048kB (ME) 330*4096kB (UM) = 1456612kB [ 708.915418][T13254] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 708.929157][T13254] Node 1 Normal: 233*4kB (UME) 50*8kB (UME) 32*16kB (UME) 186*32kB (UME) 61*64kB (UE) 13*128kB (UME) 0*256kB 2*512kB (UM) 2*1024kB (UE) 2*2048kB (UE) 948*4096kB (M) = 3903540kB [ 708.947548][T13254] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 708.958973][T13254] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 708.968694][T13254] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 708.978821][T13254] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 708.989246][T13254] 52364 total pagecache pages [ 708.994722][T13254] 0 pages in swap cache [ 708.999379][T13254] Free swap = 124464kB [ 709.005622][T13254] Total swap = 124996kB [ 709.009842][T13254] 2097051 pages RAM [ 709.014422][T13254] 0 pages HighMem/MovableOnly [ 709.019141][T13254] 416959 pages reserved [ 709.024014][T13254] 0 pages cma reserved [ 709.844075][T12730] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 710.053329][T12730] usb 3-1: Using ep0 maxpacket: 32 [ 710.127764][T12730] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 710.174104][T12730] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 710.207632][T12730] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 710.239255][T12730] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 710.259371][T12730] usb 3-1: config 0 interface 0 has no altsetting 0 [ 710.272173][T12730] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 710.283799][T12730] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 710.293600][T12730] usb 3-1: Product: syz [ 710.297959][T12730] usb 3-1: Manufacturer: syz [ 710.304202][T12730] usb 3-1: SerialNumber: syz [ 710.315388][T12730] usb 3-1: config 0 descriptor?? [ 710.325939][T12730] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 710.341508][T12730] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 710.743616][T12730] usb 3-1: USB disconnect, device number 48 [ 712.194594][T12730] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 713.229356][T13310] binder_alloc: 13309: binder_alloc_buf, no vma [ 713.578321][T13315] ªªªªª»: renamed from dummy0 [ 713.617390][T13315] 9pnet_virtio: no channels available for device syz [ 715.425271][T13335] configfs-gadget.g1 gadget.0: FS Capture: Req. wMaxPacketSize 1420 at bInterval 1 > max ISOC 1023, may drop data! [ 715.454855][T13335] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 715.537372][T13335] udc dummy_udc.0: failed to start g1: -19 [ 715.628579][T13335] UDC core: g1: couldn't find an available UDC or it's busy [ 717.074233][T13354] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2639'. [ 718.560409][T13371] syzkaller0: entered promiscuous mode [ 718.580483][T13371] syzkaller0: entered allmulticast mode [ 718.772997][T12621] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 718.942921][T12621] usb 3-1: device descriptor read/64, error -71 [ 719.150434][T13378] configfs-gadget.g1 gadget.0: FS Capture: Req. wMaxPacketSize 1420 at bInterval 1 > max ISOC 1023, may drop data! [ 719.169570][T13378] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 719.178911][T13378] udc dummy_udc.0: failed to start g1: -19 [ 719.195113][T13378] UDC core: g1: couldn't find an available UDC or it's busy [ 719.242795][T12621] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 719.441515][T12621] usb 3-1: device descriptor read/64, error -71 [ 719.570012][T12621] usb usb3-port1: attempt power cycle [ 719.994055][T12621] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 720.043825][T12621] usb 3-1: device descriptor read/8, error -71 [ 720.332909][T12621] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 720.353465][T13342] Set syz1 is full, maxelem 65536 reached [ 720.373566][T12621] usb 3-1: device descriptor read/8, error -71 [ 720.494423][T12621] usb usb3-port1: unable to enumerate USB device [ 721.911041][T13425] configfs-gadget.g1 gadget.0: FS Capture: Req. wMaxPacketSize 1420 at bInterval 1 > max ISOC 1023, may drop data! [ 721.983603][T13425] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 721.997319][T13425] udc dummy_udc.0: failed to start g1: -19 [ 722.019757][T13425] UDC core: g1: couldn't find an available UDC or it's busy [ 723.900431][T13470] syz.0.2675[13470] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 723.900597][T13470] syz.0.2675[13470] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 724.557221][T13481] FAULT_INJECTION: forcing a failure. [ 724.557221][T13481] name failslab, interval 1, probability 0, space 0, times 0 [ 724.643633][T13481] CPU: 1 PID: 13481 Comm: syz.2.2680 Not tainted syzkaller #0 [ 724.651206][T13481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 724.661505][T13481] Call Trace: [ 724.664836][T13481] [ 724.667819][T13481] dump_stack_lvl+0x18c/0x250 [ 724.672555][T13481] ? show_regs_print_info+0x20/0x20 [ 724.677800][T13481] ? load_image+0x420/0x420 [ 724.682342][T13481] ? __might_sleep+0xe0/0xe0 [ 724.686947][T13481] ? __lock_acquire+0x7d80/0x7d80 [ 724.691987][T13481] should_fail_ex+0x394/0x4c0 [ 724.696696][T13481] should_failslab+0x9/0x20 [ 724.701230][T13481] slab_pre_alloc_hook+0x59/0x300 [ 724.706342][T13481] ? resv_map_alloc+0x51/0x2c0 [ 724.711129][T13481] __kmem_cache_alloc_node+0x53/0x250 [ 724.716531][T13481] ? resv_map_alloc+0x51/0x2c0 [ 724.721317][T13481] kmalloc_trace+0x2a/0xe0 [ 724.725770][T13481] resv_map_alloc+0x51/0x2c0 [ 724.730563][T13481] hugetlbfs_get_inode+0x64/0x500 [ 724.735612][T13481] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 724.741737][T13481] hugetlb_file_setup+0x215/0x610 [ 724.746846][T13481] ksys_mmap_pgoff+0x1e6/0x720 [ 724.751662][T13481] do_syscall_64+0x55/0xb0 [ 724.756220][T13481] ? clear_bhb_loop+0x40/0x90 [ 724.760967][T13481] ? clear_bhb_loop+0x40/0x90 [ 724.765669][T13481] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 724.771841][T13481] RIP: 0033:0x7fa20b59e159 [ 724.776284][T13481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 724.795918][T13481] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 724.804355][T13481] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 724.812351][T13481] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 724.820339][T13481] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 724.828967][T13481] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 724.837068][T13481] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 724.845124][T13481] [ 725.300258][T13495] FAULT_INJECTION: forcing a failure. [ 725.300258][T13495] name failslab, interval 1, probability 0, space 0, times 0 [ 725.314226][T13495] CPU: 0 PID: 13495 Comm: syz.1.2692 Not tainted syzkaller #0 [ 725.321764][T13495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 725.331857][T13495] Call Trace: [ 725.335154][T13495] [ 725.338114][T13495] dump_stack_lvl+0x18c/0x250 [ 725.342840][T13495] ? show_regs_print_info+0x20/0x20 [ 725.348111][T13495] ? load_image+0x420/0x420 [ 725.352667][T13495] ? __lock_acquire+0x7d80/0x7d80 [ 725.357759][T13495] should_fail_ex+0x394/0x4c0 [ 725.362518][T13495] should_failslab+0x9/0x20 [ 725.367104][T13495] slab_pre_alloc_hook+0x59/0x300 [ 725.372364][T13495] ? lockdep_softirqs_off+0x440/0x440 [ 725.377785][T13495] kmem_cache_alloc_lru+0x4d/0x2b0 [ 725.382927][T13495] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 725.388346][T13495] hugetlbfs_alloc_inode+0xf3/0x140 [ 725.394220][T13495] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 725.399664][T13495] new_inode_pseudo+0x63/0x1d0 [ 725.404468][T13495] new_inode+0x22/0x1d0 [ 725.408642][T13495] ? resv_map_alloc+0x1c4/0x2c0 [ 725.413539][T13495] hugetlbfs_get_inode+0x78/0x500 [ 725.418618][T13495] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 725.424657][T13495] hugetlb_file_setup+0x215/0x610 [ 725.429740][T13495] ksys_mmap_pgoff+0x1e6/0x720 [ 725.434546][T13495] do_syscall_64+0x55/0xb0 [ 725.438981][T13495] ? clear_bhb_loop+0x40/0x90 [ 725.443700][T13495] ? clear_bhb_loop+0x40/0x90 [ 725.448463][T13495] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 725.454415][T13495] RIP: 0033:0x7ff2ae99e159 [ 725.458861][T13495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.479221][T13495] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 725.487695][T13495] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 725.495798][T13495] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 725.503796][T13495] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 725.511887][T13495] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 725.519924][T13495] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 725.527938][T13495] [ 726.293671][ T9123] IPVS: starting estimator thread 0... [ 726.384090][T13519] IPVS: using max 18 ests per chain, 43200 per kthread [ 726.876632][T13530] FAULT_INJECTION: forcing a failure. [ 726.876632][T13530] name failslab, interval 1, probability 0, space 0, times 0 [ 726.897598][T13530] CPU: 1 PID: 13530 Comm: syz.0.2695 Not tainted syzkaller #0 [ 726.905275][T13530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 726.915662][T13530] Call Trace: [ 726.918989][T13530] [ 726.921995][T13530] dump_stack_lvl+0x18c/0x250 [ 726.926734][T13530] ? show_regs_print_info+0x20/0x20 [ 726.932090][T13530] ? load_image+0x420/0x420 [ 726.936675][T13530] ? __might_sleep+0xe0/0xe0 [ 726.941325][T13530] ? __lock_acquire+0x7d80/0x7d80 [ 726.946420][T13530] should_fail_ex+0x394/0x4c0 [ 726.951155][T13530] should_failslab+0x9/0x20 [ 726.955707][T13530] slab_pre_alloc_hook+0x59/0x300 [ 726.960788][T13530] ? resv_map_alloc+0x51/0x2c0 [ 726.965604][T13530] __kmem_cache_alloc_node+0x53/0x250 [ 726.971026][T13530] ? resv_map_alloc+0x51/0x2c0 [ 726.975916][T13530] kmalloc_trace+0x2a/0xe0 [ 726.980393][T13530] resv_map_alloc+0x51/0x2c0 [ 726.985031][T13530] hugetlbfs_get_inode+0x64/0x500 [ 726.990163][T13530] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 726.996193][T13530] hugetlb_file_setup+0x215/0x610 [ 727.001275][T13530] ksys_mmap_pgoff+0x1e6/0x720 [ 727.006093][T13530] do_syscall_64+0x55/0xb0 [ 727.010551][T13530] ? clear_bhb_loop+0x40/0x90 [ 727.015271][T13530] ? clear_bhb_loop+0x40/0x90 [ 727.019994][T13530] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 727.025935][T13530] RIP: 0033:0x7fc2d059e159 [ 727.030399][T13530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.050059][T13530] RSP: 002b:00007fc2d145b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 727.058533][T13530] RAX: ffffffffffffffda RBX: 00007fc2d0825fa0 RCX: 00007fc2d059e159 [ 727.066548][T13530] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 727.074558][T13530] RBP: 00007fc2d0635024 R08: ffffffffffffffff R09: 0000000000000000 [ 727.082577][T13530] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 727.090583][T13530] R13: 00007fc2d0826038 R14: 00007fc2d0825fa0 R15: 00007fffb771ab18 [ 727.098622][T13530] [ 727.623660][T12730] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 727.843956][T12730] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 727.866307][T12730] usb 1-1: config 27 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 727.910083][T12730] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 727.946775][T12730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.980763][T12730] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 727.994644][T12730] usb 1-1: invalid MIDI out EP 0 [ 728.134962][T13552] binder_alloc: 13551: binder_alloc_buf, no vma [ 728.150889][T13280] udevd[13280]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 728.205109][T12730] snd-usb-audio: probe of 1-1:27.0 failed with error -22 [ 730.439523][T12730] usb 1-1: USB disconnect, device number 37 [ 730.663537][T13571] FAULT_INJECTION: forcing a failure. [ 730.663537][T13571] name failslab, interval 1, probability 0, space 0, times 0 [ 730.682055][T13571] CPU: 0 PID: 13571 Comm: syz.2.2706 Not tainted syzkaller #0 [ 730.689694][T13571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 730.699801][T13571] Call Trace: [ 730.703139][T13571] [ 730.706104][T13571] dump_stack_lvl+0x18c/0x250 [ 730.710898][T13571] ? show_regs_print_info+0x20/0x20 [ 730.716145][T13571] ? load_image+0x420/0x420 [ 730.720694][T13571] ? __lock_acquire+0x7d80/0x7d80 [ 730.725785][T13571] should_fail_ex+0x394/0x4c0 [ 730.730507][T13571] should_failslab+0x9/0x20 [ 730.735060][T13571] slab_pre_alloc_hook+0x59/0x300 [ 730.740138][T13571] ? lockdep_softirqs_off+0x440/0x440 [ 730.745554][T13571] kmem_cache_alloc_lru+0x4d/0x2b0 [ 730.750700][T13571] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 730.756120][T13571] hugetlbfs_alloc_inode+0xf3/0x140 [ 730.761539][T13571] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 730.767023][T13571] new_inode_pseudo+0x63/0x1d0 [ 730.771951][T13571] new_inode+0x22/0x1d0 [ 730.776248][T13571] ? resv_map_alloc+0x1c4/0x2c0 [ 730.781174][T13571] hugetlbfs_get_inode+0x78/0x500 [ 730.786267][T13571] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 730.792295][T13571] hugetlb_file_setup+0x215/0x610 [ 730.797374][T13571] ksys_mmap_pgoff+0x1e6/0x720 [ 730.802175][T13571] do_syscall_64+0x55/0xb0 [ 730.806632][T13571] ? clear_bhb_loop+0x40/0x90 [ 730.811339][T13571] ? clear_bhb_loop+0x40/0x90 [ 730.816154][T13571] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 730.822091][T13571] RIP: 0033:0x7fa20b59e159 [ 730.826537][T13571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.846188][T13571] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 730.854653][T13571] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 730.862667][T13571] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 730.870673][T13571] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 730.879203][T13571] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 730.887211][T13571] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 730.895759][T13571] [ 731.357841][T13588] binder_alloc: 13587: binder_alloc_buf, no vma [ 731.725052][T13596] FAULT_INJECTION: forcing a failure. [ 731.725052][T13596] name failslab, interval 1, probability 0, space 0, times 0 [ 731.832073][T13596] CPU: 1 PID: 13596 Comm: syz.1.2717 Not tainted syzkaller #0 [ 731.839630][T13596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 731.849746][T13596] Call Trace: [ 731.853074][T13596] [ 731.856055][T13596] dump_stack_lvl+0x18c/0x250 [ 731.860861][T13596] ? show_regs_print_info+0x20/0x20 [ 731.866288][T13596] ? load_image+0x420/0x420 [ 731.871004][T13596] ? __might_sleep+0xe0/0xe0 [ 731.875692][T13596] ? __lock_acquire+0x7d80/0x7d80 [ 731.880764][T13596] should_fail_ex+0x394/0x4c0 [ 731.885566][T13596] should_failslab+0x9/0x20 [ 731.890096][T13596] slab_pre_alloc_hook+0x59/0x300 [ 731.895157][T13596] ? resv_map_alloc+0x51/0x2c0 [ 731.900032][T13596] __kmem_cache_alloc_node+0x53/0x250 [ 731.905438][T13596] ? resv_map_alloc+0x51/0x2c0 [ 731.910225][T13596] kmalloc_trace+0x2a/0xe0 [ 731.914671][T13596] resv_map_alloc+0x51/0x2c0 [ 731.919293][T13596] hugetlbfs_get_inode+0x64/0x500 [ 731.924349][T13596] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 731.930368][T13596] hugetlb_file_setup+0x215/0x610 [ 731.935426][T13596] ksys_mmap_pgoff+0x1e6/0x720 [ 731.940221][T13596] do_syscall_64+0x55/0xb0 [ 731.944664][T13596] ? clear_bhb_loop+0x40/0x90 [ 731.949365][T13596] ? clear_bhb_loop+0x40/0x90 [ 731.954064][T13596] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 731.959983][T13596] RIP: 0033:0x7ff2ae99e159 [ 731.964579][T13596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 731.984212][T13596] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 731.992654][T13596] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 732.000651][T13596] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 732.008646][T13596] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 732.016648][T13596] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 732.024642][T13596] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 732.032651][T13596] [ 732.573362][T12730] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 732.766623][T12730] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 732.791252][T12730] usb 4-1: config 27 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 732.803637][T12730] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 732.814819][T12730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.846579][T12730] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 732.869817][T12730] usb 4-1: invalid MIDI out EP 0 [ 732.976200][T13538] udevd[13538]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 733.009586][T12730] snd-usb-audio: probe of 4-1:27.0 failed with error -22 [ 733.826369][T13623] Set syz0 is full, maxelem 0 reached [ 735.091556][T12730] usb 4-1: USB disconnect, device number 52 [ 735.321009][T13627] FAULT_INJECTION: forcing a failure. [ 735.321009][T13627] name failslab, interval 1, probability 0, space 0, times 0 [ 735.348597][T13627] CPU: 1 PID: 13627 Comm: syz.1.2727 Not tainted syzkaller #0 [ 735.356170][T13627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 735.366301][T13627] Call Trace: [ 735.369602][T13627] [ 735.372574][T13627] dump_stack_lvl+0x18c/0x250 [ 735.377309][T13627] ? show_regs_print_info+0x20/0x20 [ 735.382567][T13627] ? load_image+0x420/0x420 [ 735.387111][T13627] ? __lock_acquire+0x7d80/0x7d80 [ 735.392198][T13627] should_fail_ex+0x394/0x4c0 [ 735.396933][T13627] should_failslab+0x9/0x20 [ 735.401465][T13627] slab_pre_alloc_hook+0x59/0x300 [ 735.406520][T13627] ? lockdep_softirqs_off+0x440/0x440 [ 735.412352][T13627] kmem_cache_alloc_lru+0x4d/0x2b0 [ 735.417516][T13627] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 735.422940][T13627] hugetlbfs_alloc_inode+0xf3/0x140 [ 735.428165][T13627] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 735.433566][T13627] new_inode_pseudo+0x63/0x1d0 [ 735.438562][T13627] new_inode+0x22/0x1d0 [ 735.442858][T13627] ? resv_map_alloc+0x1c4/0x2c0 [ 735.447763][T13627] hugetlbfs_get_inode+0x78/0x500 [ 735.452839][T13627] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 735.458944][T13627] hugetlb_file_setup+0x215/0x610 [ 735.464008][T13627] ksys_mmap_pgoff+0x1e6/0x720 [ 735.468804][T13627] do_syscall_64+0x55/0xb0 [ 735.473246][T13627] ? clear_bhb_loop+0x40/0x90 [ 735.477953][T13627] ? clear_bhb_loop+0x40/0x90 [ 735.482672][T13627] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 735.488623][T13627] RIP: 0033:0x7ff2ae99e159 [ 735.493062][T13627] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 735.512706][T13627] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 735.521152][T13627] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 735.529169][T13627] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 735.537183][T13627] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 735.545179][T13627] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 735.553296][T13627] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 735.561365][T13627] [ 735.716835][T13629] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 736.328218][T13653] could not allocate digest TFM handle tgr160 [ 736.517671][T13663] FAULT_INJECTION: forcing a failure. [ 736.517671][T13663] name failslab, interval 1, probability 0, space 0, times 0 [ 736.532511][T13663] CPU: 0 PID: 13663 Comm: syz.1.2738 Not tainted syzkaller #0 [ 736.540061][T13663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 736.550135][T13663] Call Trace: [ 736.553444][T13663] [ 736.556390][T13663] dump_stack_lvl+0x18c/0x250 [ 736.561083][T13663] ? show_regs_print_info+0x20/0x20 [ 736.566307][T13663] ? load_image+0x420/0x420 [ 736.570822][T13663] ? __lock_acquire+0x7d80/0x7d80 [ 736.575892][T13663] should_fail_ex+0x394/0x4c0 [ 736.580587][T13663] should_failslab+0x9/0x20 [ 736.585107][T13663] slab_pre_alloc_hook+0x59/0x300 [ 736.590167][T13663] ? lockdep_softirqs_off+0x440/0x440 [ 736.595580][T13663] kmem_cache_alloc_lru+0x4d/0x2b0 [ 736.600827][T13663] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 736.606230][T13663] hugetlbfs_alloc_inode+0xf3/0x140 [ 736.611536][T13663] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 736.616954][T13663] new_inode_pseudo+0x63/0x1d0 [ 736.621790][T13663] new_inode+0x22/0x1d0 [ 736.625970][T13663] ? resv_map_alloc+0x1c4/0x2c0 [ 736.630837][T13663] hugetlbfs_get_inode+0x78/0x500 [ 736.635889][T13663] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 736.641929][T13663] hugetlb_file_setup+0x215/0x610 [ 736.646984][T13663] ksys_mmap_pgoff+0x1e6/0x720 [ 736.651767][T13663] do_syscall_64+0x55/0xb0 [ 736.656202][T13663] ? clear_bhb_loop+0x40/0x90 [ 736.660895][T13663] ? clear_bhb_loop+0x40/0x90 [ 736.665604][T13663] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 736.671511][T13663] RIP: 0033:0x7ff2ae99e159 [ 736.675941][T13663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 736.695586][T13663] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 736.704074][T13663] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 736.712058][T13663] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 736.720045][T13663] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 736.728043][T13663] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 736.736109][T13663] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 736.744131][T13663] [ 736.949403][T13668] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 737.113005][ T9123] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 737.308718][ T9123] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 737.344850][ T9123] usb 4-1: config 27 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 737.365672][ T9123] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 737.375250][ T9123] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 737.436964][ T9123] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 737.489812][ T9123] usb 4-1: invalid MIDI out EP 0 [ 738.971765][T13538] udevd[13538]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 739.017376][ T9123] snd-usb-audio: probe of 4-1:27.0 failed with error -22 [ 739.063574][ T9123] usb 4-1: USB disconnect, device number 53 [ 739.433349][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 739.613621][T13695] futex_wake_op: syz.1.2748 tries to shift op by 144; fix this program [ 739.673733][T12047] Bluetooth: hci0: command 0x0406 tx timeout [ 739.748918][T13700] FAULT_INJECTION: forcing a failure. [ 739.748918][T13700] name failslab, interval 1, probability 0, space 0, times 0 [ 739.827887][T13700] CPU: 1 PID: 13700 Comm: syz.2.2750 Not tainted syzkaller #0 [ 739.835443][T13700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 739.845641][T13700] Call Trace: [ 739.848964][T13700] [ 739.851931][T13700] dump_stack_lvl+0x18c/0x250 [ 739.856660][T13700] ? show_regs_print_info+0x20/0x20 [ 739.861902][T13700] ? load_image+0x420/0x420 [ 739.866448][T13700] ? __might_sleep+0xe0/0xe0 [ 739.871090][T13700] ? __lock_acquire+0x7d80/0x7d80 [ 739.876176][T13700] should_fail_ex+0x394/0x4c0 [ 739.880926][T13700] should_failslab+0x9/0x20 [ 739.885483][T13700] slab_pre_alloc_hook+0x59/0x300 [ 739.890570][T13700] ? resv_map_alloc+0x51/0x2c0 [ 739.895389][T13700] __kmem_cache_alloc_node+0x53/0x250 [ 739.900826][T13700] ? resv_map_alloc+0x51/0x2c0 [ 739.905637][T13700] kmalloc_trace+0x2a/0xe0 [ 739.910107][T13700] resv_map_alloc+0x51/0x2c0 [ 739.914756][T13700] hugetlbfs_get_inode+0x64/0x500 [ 739.919830][T13700] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 739.925865][T13700] hugetlb_file_setup+0x215/0x610 [ 739.930945][T13700] ksys_mmap_pgoff+0x1e6/0x720 [ 739.935768][T13700] do_syscall_64+0x55/0xb0 [ 739.940230][T13700] ? clear_bhb_loop+0x40/0x90 [ 739.944947][T13700] ? clear_bhb_loop+0x40/0x90 [ 739.949675][T13700] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 739.955622][T13700] RIP: 0033:0x7fa20b59e159 [ 739.960079][T13700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 739.979735][T13700] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 739.988200][T13700] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 739.996249][T13700] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 740.004261][T13700] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 740.012270][T13700] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 740.020281][T13700] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 740.028309][T13700] [ 740.629562][T13704] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 740.796199][T13715] netlink: 'syz.1.2755': attribute type 5 has an invalid length. [ 740.811875][T13715] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 740.821882][T13715] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 740.831240][T13715] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 740.840559][T13715] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 741.382975][ T9123] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 741.574989][ T9123] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 741.646737][ T9123] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 741.675616][ T9123] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 741.687338][T13729] Set syz0 is full, maxelem 0 reached [ 741.712875][ T9123] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 741.723520][T13731] FAULT_INJECTION: forcing a failure. [ 741.723520][T13731] name failslab, interval 1, probability 0, space 0, times 0 [ 741.747423][T13731] CPU: 1 PID: 13731 Comm: syz.2.2761 Not tainted syzkaller #0 [ 741.752274][ T9123] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 741.754954][T13731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 741.773159][T13731] Call Trace: [ 741.776482][T13731] [ 741.779457][T13731] dump_stack_lvl+0x18c/0x250 [ 741.784188][T13731] ? show_regs_print_info+0x20/0x20 [ 741.789394][T13731] ? load_image+0x420/0x420 [ 741.793904][T13731] ? __might_sleep+0xe0/0xe0 [ 741.798505][T13731] ? __lock_acquire+0x7d80/0x7d80 [ 741.803538][T13731] should_fail_ex+0x394/0x4c0 [ 741.808248][T13731] should_failslab+0x9/0x20 [ 741.812759][T13731] slab_pre_alloc_hook+0x59/0x300 [ 741.817792][T13731] ? resv_map_alloc+0x51/0x2c0 [ 741.822559][T13731] __kmem_cache_alloc_node+0x53/0x250 [ 741.827939][T13731] ? resv_map_alloc+0x51/0x2c0 [ 741.832968][T13731] kmalloc_trace+0x2a/0xe0 [ 741.837394][T13731] resv_map_alloc+0x51/0x2c0 [ 741.842005][T13731] hugetlbfs_get_inode+0x64/0x500 [ 741.847076][T13731] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 741.853065][T13731] hugetlb_file_setup+0x215/0x610 [ 741.858108][T13731] ksys_mmap_pgoff+0x1e6/0x720 [ 741.862880][T13731] do_syscall_64+0x55/0xb0 [ 741.867338][T13731] ? clear_bhb_loop+0x40/0x90 [ 741.872038][T13731] ? clear_bhb_loop+0x40/0x90 [ 741.876753][T13731] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 741.882743][T13731] RIP: 0033:0x7fa20b59e159 [ 741.887165][T13731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.906810][T13731] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 741.915308][T13731] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 741.923289][T13731] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 741.931283][T13731] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 741.939281][T13731] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 741.947300][T13731] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 741.955294][T13731] [ 742.023476][ T9123] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 742.206964][T13194] udevd[13194]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 742.895318][ T9123] snd-usb-audio: probe of 4-1:27.0 failed with error -12 [ 744.667858][T12431] usb 4-1: USB disconnect, device number 54 [ 744.974623][T13748] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 745.974478][T13765] Set syz0 is full, maxelem 0 reached [ 746.181123][T13767] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2772'. [ 746.676947][ T27] audit: type=1800 audit(1788069990.996:42): pid=13774 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2775" name="addr_trtype" dev="configfs" ino=40010 res=0 errno=0 [ 746.699639][T12431] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 746.920991][T13777] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 746.935302][T12431] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 747.008713][T12431] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 747.017698][ T9123] nvmet: connect request for invalid subsystem testnqn! [ 747.046546][T13774] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testnqn" [ 747.076263][T12431] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 747.134001][T12431] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 747.174021][T12431] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.230392][T12431] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 747.454698][T12431] snd-usb-audio: probe of 2-1:27.0 failed with error -12 [ 747.597418][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.613286][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.625804][ T9119] usb 2-1: USB disconnect, device number 34 [ 749.660765][T13797] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2782'. [ 750.370616][T13812] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 750.745189][T13820] futex_wake_op: syz.2.2786 tries to shift op by 144; fix this program [ 752.183280][ T9119] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 752.385922][T13836] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2792'. [ 752.405172][ T9119] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 752.448448][ T9119] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 752.486571][ T9119] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 752.546932][ T9119] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 752.582763][ T9119] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.617402][ T9119] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 752.767461][ T9119] snd-usb-audio: probe of 4-1:27.0 failed with error -12 [ 752.780644][T13280] udevd[13280]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 755.017764][ T9119] usb 4-1: USB disconnect, device number 55 [ 755.680855][T13856] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2801'. [ 756.218731][T13870] futex_wake_op: syz.0.2804 tries to shift op by 144; fix this program [ 756.236869][ T9119] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 756.757248][ T9119] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 756.848430][ T9119] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 756.950660][ T9119] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 757.039967][ T9119] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 757.142968][T13865] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 757.234239][ T9119] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 757.477154][ T9119] usb 3-1: USB disconnect, device number 53 [ 757.549835][T13787] udevd[13787]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 757.984968][T13890] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2810'. [ 759.437833][T13923] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2820'. [ 759.584024][ T9119] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 759.785299][ T9119] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 759.819416][ T9119] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 759.841956][ T9119] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 759.858509][ T9119] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.889435][T13920] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 759.907612][ T9119] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 760.151881][T12431] usb 3-1: USB disconnect, device number 54 [ 760.910865][T13951] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2830'. [ 762.398816][T13985] configfs-gadget.g1 gadget.0: FS Capture: Req. wMaxPacketSize 1420 at bInterval 1 > max ISOC 1023, may drop data! [ 762.464944][T13985] configfs-gadget.g1 gadget.0: afunc_bind:1242 Error! [ 762.489807][T13985] udc dummy_udc.0: failed to start g1: -19 [ 762.516491][T13985] UDC core: g1: couldn't find an available UDC or it's busy [ 762.815816][T13988] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2839'. [ 764.885069][T14031] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2852'. [ 766.129565][T14061] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2862'. [ 768.357025][T14090] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2873'. [ 768.599005][T14098] jffs2: notice: (14098) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 770.024589][T14123] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2884'. [ 772.149516][T14146] loop5: detected capacity change from 0 to 6 [ 772.225015][T14146] Dev loop5: unable to read RDB block 6 [ 772.231471][T14146] loop5: unable to read partition table [ 772.317018][T14146] loop5: partition table beyond EOD, truncated [ 772.329277][T14146] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 773.722783][ T9119] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 774.018642][ T9119] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 774.100492][ T9119] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 774.536994][ T9119] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 774.556767][ T9119] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.572740][ T9119] usb 2-1: Product: syz [ 774.581179][ T9119] usb 2-1: Manufacturer: syz [ 774.592782][ T9119] usb 2-1: SerialNumber: syz [ 774.643853][ T9119] sisusb 2-1:1.0: Invalid USB2VGA device [ 774.649598][ T9119] sisusb: probe of 2-1:1.0 failed with error -22 [ 774.720347][T14175] sctp: failed to load transform for md5: -2 [ 776.498658][ T9119] usb 2-1: USB disconnect, device number 35 [ 778.213517][T12431] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 778.403411][T12431] usb 4-1: Using ep0 maxpacket: 8 [ 778.837782][T12431] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 778.861281][T12431] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 778.920928][T12431] usb 4-1: config 0 interface 0 has no altsetting 0 [ 778.945157][T12431] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 778.966973][T12431] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 778.985765][T12431] usb 4-1: config 0 descriptor?? [ 779.444834][T12431] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 779.458426][T12431] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 779.467607][T12431] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 779.476700][T12431] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 779.485234][T12431] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 779.493914][T12730] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 779.515627][T12431] mcp2221 0003:04D8:00DD.0001: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 779.698232][T12730] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 779.731217][T12730] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 779.757829][T12431] usb 4-1: USB disconnect, device number 56 [ 779.803668][T12730] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 779.814216][T12730] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 779.825087][T12730] usb 3-1: Product: syz [ 779.829772][T12730] usb 3-1: Manufacturer: syz [ 779.838778][T12730] usb 3-1: SerialNumber: syz [ 779.891217][T12730] sisusb 3-1:1.0: Invalid USB2VGA device [ 779.921015][T12730] sisusb: probe of 3-1:1.0 failed with error -22 [ 780.396232][T14230] Bluetooth: hci1: command 0x0406 tx timeout [ 780.397156][ T5789] Bluetooth: hci2: command 0x0406 tx timeout [ 782.723094][ T9119] usb 3-1: USB disconnect, device number 55 [ 783.389125][T14286] md: could not open device unknown-block(1,0). [ 785.673375][T12431] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 785.868409][T12431] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 785.878781][T12431] usb 4-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 785.923740][T12730] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 786.744150][T12431] usb 4-1: Product: syz [ 786.748838][T12431] usb 4-1: Manufacturer: syz [ 786.755351][T12431] usb 4-1: SerialNumber: syz [ 786.764200][T12431] usb 4-1: config 0 descriptor?? [ 786.773163][T12431] ch341 4-1:0.0: ch341-uart converter detected [ 786.846451][T12730] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 786.858759][T12730] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 786.880513][T12730] usb 1-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 786.891148][T12730] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.901442][T12730] usb 1-1: Product: syz [ 786.907429][T12730] usb 1-1: Manufacturer: syz [ 786.913721][T12730] usb 1-1: SerialNumber: syz [ 786.946868][T12730] sisusb 1-1:1.0: Invalid USB2VGA device [ 786.953666][T12730] sisusb: probe of 1-1:1.0 failed with error -22 [ 787.051949][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2935'. [ 787.063227][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2935'. [ 787.073099][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2935'. [ 787.083105][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2935'. [ 787.100871][T14315] 9pnet_virtio: no channels available for device syz [ 787.846287][T12431] usb 4-1: failed to receive control message: -110 [ 788.537576][T12431] ch341-uart: probe of ttyUSB0 failed with error -110 [ 788.729071][ T9119] usb 4-1: USB disconnect, device number 57 [ 788.805759][ T9119] ch341 4-1:0.0: device disconnected [ 788.807152][T12431] usb 1-1: USB disconnect, device number 38 [ 788.934524][T14326] binder_alloc: 14325: binder_alloc_buf, no vma [ 788.998628][T14330] binder_alloc: 14325: binder_alloc_buf, no vma [ 789.072932][T12621] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 789.366538][T12621] usb 3-1: Using ep0 maxpacket: 8 [ 789.387684][T12621] usb 3-1: config 0 has no interfaces? [ 789.393910][T12621] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 789.412658][T12621] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.430391][T12621] usb 3-1: config 0 descriptor?? [ 789.600428][T14340] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 789.663038][T12621] usb 3-1: USB disconnect, device number 56 [ 789.791159][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 790.169111][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.774494][T14343] orangefs_mount: mount request failed with -4 [ 792.295456][T12431] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 792.363514][ T9119] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 792.496128][T12431] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 792.509125][T12431] usb 4-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 792.525532][T12431] usb 4-1: Product: syz [ 792.534965][T12431] usb 4-1: Manufacturer: syz [ 792.541169][T12431] usb 4-1: SerialNumber: syz [ 792.577062][ T9119] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 792.588865][T12431] usb 4-1: config 0 descriptor?? [ 792.605602][T12431] ch341 4-1:0.0: ch341-uart converter detected [ 792.641771][ T9119] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 792.675652][ T9119] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 792.704486][ T9119] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 792.716989][ T9119] usb 3-1: Product: syz [ 792.721703][ T9119] usb 3-1: Manufacturer: syz [ 792.729503][ T9119] usb 3-1: SerialNumber: syz [ 792.761181][ T9119] sisusb 3-1:1.0: Invalid USB2VGA device [ 792.774823][ T9119] sisusb: probe of 3-1:1.0 failed with error -22 [ 792.884371][T14375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2949'. [ 792.898779][T14375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2949'. [ 792.910528][T14375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2949'. [ 792.922160][T14375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2949'. [ 792.941593][T14375] 9pnet_virtio: no channels available for device syz [ 795.621442][T12431] usb 4-1: failed to receive control message: -110 [ 795.641679][T12431] ch341-uart: probe of ttyUSB0 failed with error -110 [ 795.726319][T12431] usb 4-1: USB disconnect, device number 58 [ 795.734338][T12431] ch341 4-1:0.0: device disconnected [ 796.191179][T14378] Illegal XDP return value 4294967274 on prog (id 243) dev syz_tun, expect packet loss! [ 796.443434][T14382] FAULT_INJECTION: forcing a failure. [ 796.443434][T14382] name fail_futex, interval 1, probability 0, space 0, times 1 [ 796.458034][T14382] CPU: 0 PID: 14382 Comm: syz.3.2958 Not tainted syzkaller #0 [ 796.465581][T14382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 796.475674][T14382] Call Trace: [ 796.478971][T14382] [ 796.481906][T14382] dump_stack_lvl+0x18c/0x250 [ 796.486626][T14382] ? show_regs_print_info+0x20/0x20 [ 796.491857][T14382] ? load_image+0x420/0x420 [ 796.496395][T14382] should_fail_ex+0x394/0x4c0 [ 796.501127][T14382] get_futex_key+0x136/0x1030 [ 796.505862][T14382] ? lockdep_hardirqs_on+0x98/0x150 [ 796.511130][T14382] ? futex_setup_timer+0xc0/0xc0 [ 796.516086][T14382] futex_wake+0x127/0x4f0 [ 796.520444][T14382] ? __kmem_cache_free+0xba/0x1f0 [ 796.525506][T14382] ? futex_wake_mark+0x150/0x150 [ 796.530494][T14382] ? btf_new_fd+0x5a6/0x9e0 [ 796.535013][T14382] ? bpf_btf_show_fdinfo+0x80/0x80 [ 796.540134][T14382] do_futex+0x35d/0x3e0 [ 796.544325][T14382] ? __ia32_sys_get_robust_list+0x110/0x110 [ 796.550249][T14382] ? bpf_link_show_fdinfo+0x390/0x390 [ 796.555650][T14382] __se_sys_futex+0x3a9/0x440 [ 796.560350][T14382] ? __x64_sys_futex+0xf0/0xf0 [ 796.565140][T14382] ? __x64_sys_futex+0x21/0xf0 [ 796.569933][T14382] do_syscall_64+0x55/0xb0 [ 796.574361][T14382] ? clear_bhb_loop+0x40/0x90 [ 796.579039][T14382] ? clear_bhb_loop+0x40/0x90 [ 796.583737][T14382] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 796.589659][T14382] RIP: 0033:0x7fb0ab79e159 [ 796.594082][T14382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 796.613727][T14382] RSP: 002b:00007fb0ac65b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 796.622148][T14382] RAX: ffffffffffffffda RBX: 00007fb0aba25fa8 RCX: 00007fb0ab79e159 [ 796.630161][T14382] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb0aba25fac [ 796.638163][T14382] RBP: 00007fb0aba25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 796.646173][T14382] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 796.654219][T14382] R13: 00007fb0aba26038 R14: 00007ffdcb8ad810 R15: 00007ffdcb8ad8f8 [ 796.662253][T14382] [ 796.666952][ T9119] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 796.852813][ T9119] usb 1-1: Using ep0 maxpacket: 8 [ 796.867315][ T9119] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 796.899386][ T9119] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 796.911589][ T9119] usb 1-1: config 0 interface 0 has no altsetting 0 [ 796.921750][ T9119] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 796.934399][ T9119] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 796.967126][ T9119] usb 1-1: config 0 descriptor?? [ 797.768239][ T9119] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 797.859176][ T9119] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 797.913746][T12621] usb 3-1: USB disconnect, device number 57 [ 797.932814][ T9119] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 797.939958][ T9119] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 797.997730][ T9119] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 798.049960][ T9119] mcp2221 0003:04D8:00DD.0002: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 798.242651][ T9119] usb 1-1: USB disconnect, device number 39 [ 798.347928][T14404] netlink: 'syz.1.2966': attribute type 8 has an invalid length. [ 798.523721][T12621] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 798.621607][T14406] FAULT_INJECTION: forcing a failure. [ 798.621607][T14406] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 798.639214][T14406] CPU: 1 PID: 14406 Comm: syz.1.2967 Not tainted syzkaller #0 [ 798.646762][T14406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 798.656875][T14406] Call Trace: [ 798.660192][T14406] [ 798.663162][T14406] dump_stack_lvl+0x18c/0x250 [ 798.667905][T14406] ? show_regs_print_info+0x20/0x20 [ 798.673157][T14406] ? load_image+0x420/0x420 [ 798.677724][T14406] ? __might_fault+0xaa/0x120 [ 798.682441][T14406] ? __lock_acquire+0x7d80/0x7d80 [ 798.687517][T14406] should_fail_ex+0x394/0x4c0 [ 798.692272][T14406] _copy_to_user+0x2f/0xa0 [ 798.696749][T14406] btf_new_fd+0x5c0/0x9e0 [ 798.701123][T14406] ? bpf_btf_show_fdinfo+0x80/0x80 [ 798.706271][T14406] ? capable+0x88/0xe0 [ 798.710367][T14406] __sys_bpf+0x670/0x890 [ 798.714653][T14406] ? bpf_link_show_fdinfo+0x390/0x390 [ 798.720061][T14406] ? lock_chain_count+0x20/0x20 [ 798.724943][T14406] __x64_sys_bpf+0x7c/0x90 [ 798.729378][T14406] do_syscall_64+0x55/0xb0 [ 798.733818][T14406] ? clear_bhb_loop+0x40/0x90 [ 798.738534][T14406] ? clear_bhb_loop+0x40/0x90 [ 798.743236][T14406] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 798.749149][T14406] RIP: 0033:0x7ff2ae99e159 [ 798.753583][T14406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.773206][T14406] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 798.781665][T14406] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 798.789676][T14406] RDX: 0000000000000028 RSI: 0000200000000740 RDI: 0000000000000012 [ 798.797665][T14406] RBP: 00007ff2aea35024 R08: 0000000000000000 R09: 0000000000000000 [ 798.805657][T14406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 798.813640][T14406] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 798.821637][T14406] [ 798.955426][T12621] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 798.991007][T12621] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 799.034196][T12621] usb 3-1: Product: syz [ 799.043451][T12621] usb 3-1: Manufacturer: syz [ 799.048156][T12621] usb 3-1: SerialNumber: syz [ 799.083573][T12621] usb 3-1: config 0 descriptor?? [ 799.108298][T12621] ch341 3-1:0.0: ch341-uart converter detected [ 799.372046][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2965'. [ 799.386862][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2965'. [ 799.398109][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2965'. [ 799.410364][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2965'. [ 799.420956][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2965'. [ 799.433237][T12431] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 799.448173][T14419] 9pnet_virtio: no channels available for device syz [ 800.872956][ T5789] Bluetooth: hci0: command 0x0406 tx timeout [ 802.655633][T12621] usb 3-1: failed to receive control message: -71 [ 802.707264][T12621] ch341-uart: probe of ttyUSB0 failed with error -71 [ 802.738474][T12621] usb 3-1: USB disconnect, device number 58 [ 802.753597][T12431] usb 2-1: device descriptor read/all, error -71 [ 802.781058][T12621] ch341 3-1:0.0: device disconnected [ 804.305762][T14441] FAULT_INJECTION: forcing a failure. [ 804.305762][T14441] name fail_futex, interval 1, probability 0, space 0, times 0 [ 804.334723][T14441] CPU: 1 PID: 14441 Comm: syz.1.2978 Not tainted syzkaller #0 [ 804.342277][T14441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 804.352355][T14441] Call Trace: [ 804.355649][T14441] [ 804.358595][T14441] dump_stack_lvl+0x18c/0x250 [ 804.363302][T14441] ? show_regs_print_info+0x20/0x20 [ 804.368519][T14441] ? load_image+0x420/0x420 [ 804.373066][T14441] ? kasan_set_track+0x5f/0x70 [ 804.377852][T14441] ? kasan_set_track+0x4e/0x70 [ 804.382638][T14441] ? kasan_save_free_info+0x28/0x40 [ 804.388054][T14441] ? ____kasan_slab_free+0x126/0x1f0 [ 804.393418][T14441] should_fail_ex+0x394/0x4c0 [ 804.398135][T14441] get_futex_key+0x136/0x1030 [ 804.402836][T14441] ? futex_setup_timer+0xc0/0xc0 [ 804.407821][T14441] ? mark_lock+0x94/0x320 [ 804.412183][T14441] futex_wait_setup+0xbc/0x270 [ 804.416974][T14441] ? futex_wait_multiple+0x920/0x920 [ 804.422283][T14441] futex_wait+0x1bc/0x5c0 [ 804.426633][T14441] ? futex_setup_timer+0xc0/0xc0 [ 804.431582][T14441] ? futex_wait_setup+0x270/0x270 [ 804.436630][T14441] ? tomoyo_path_number_perm+0x217/0x5e0 [ 804.442359][T14441] do_futex+0x2ff/0x3e0 [ 804.446539][T14441] ? __ia32_sys_get_robust_list+0x110/0x110 [ 804.452472][T14441] __se_sys_futex+0x3a9/0x440 [ 804.457170][T14441] ? __x64_sys_futex+0xf0/0xf0 [ 804.461953][T14441] ? __x64_sys_futex+0x21/0xf0 [ 804.466737][T14441] do_syscall_64+0x55/0xb0 [ 804.471177][T14441] ? clear_bhb_loop+0x40/0x90 [ 804.475887][T14441] ? clear_bhb_loop+0x40/0x90 [ 804.480594][T14441] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 804.486504][T14441] RIP: 0033:0x7ff2ae99e159 [ 804.490954][T14441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.510576][T14441] RSP: 002b:00007ff2af8400e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 804.519025][T14441] RAX: ffffffffffffffda RBX: 00007ff2aec26098 RCX: 00007ff2ae99e159 [ 804.527014][T14441] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff2aec26098 [ 804.535021][T14441] RBP: 00007ff2aec26090 R08: 0000000000000000 R09: 0000000000000000 [ 804.543008][T14441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 804.550994][T14441] R13: 00007ff2aec26128 R14: 00007ffeb2700a30 R15: 00007ffeb2700b18 [ 804.558992][T14441] [ 804.586347][T14444] netlink: 'syz.2.2980': attribute type 8 has an invalid length. [ 805.133789][T12431] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 805.324611][T12431] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 805.340070][T12431] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 805.364276][T12431] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 805.381468][T12431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 805.399120][T12431] usb 2-1: Product: syz [ 805.416009][T12431] usb 2-1: Manufacturer: syz [ 805.431806][T12431] usb 2-1: SerialNumber: syz [ 805.489231][T12431] sisusb 2-1:1.0: Invalid USB2VGA device [ 805.507454][T12431] sisusb: probe of 2-1:1.0 failed with error -22 [ 807.452772][ T9124] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 807.667051][ T9124] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 807.706712][ T9124] usb 4-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 807.731880][ T9124] usb 4-1: Product: syz [ 807.767074][ T9124] usb 4-1: Manufacturer: syz [ 807.772032][ T9124] usb 4-1: SerialNumber: syz [ 807.819383][ T9124] usb 4-1: config 0 descriptor?? [ 807.836155][ T9124] ch341 4-1:0.0: ch341-uart converter detected [ 807.917866][T12621] usb 2-1: USB disconnect, device number 38 [ 808.067985][T14471] FAULT_INJECTION: forcing a failure. [ 808.067985][T14471] name failslab, interval 1, probability 0, space 0, times 0 [ 808.133599][T14471] CPU: 0 PID: 14471 Comm: syz.2.2989 Not tainted syzkaller #0 [ 808.141149][T14471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 808.151219][T14471] Call Trace: [ 808.154513][T14471] [ 808.157451][T14471] dump_stack_lvl+0x18c/0x250 [ 808.162203][T14471] ? show_regs_print_info+0x20/0x20 [ 808.167545][T14471] ? load_image+0x420/0x420 [ 808.172059][T14471] ? __lock_acquire+0x7d80/0x7d80 [ 808.177103][T14471] should_fail_ex+0x394/0x4c0 [ 808.181839][T14471] should_failslab+0x9/0x20 [ 808.186383][T14471] slab_pre_alloc_hook+0x59/0x300 [ 808.191462][T14471] ? lockdep_softirqs_off+0x440/0x440 [ 808.196879][T14471] kmem_cache_alloc_lru+0x4d/0x2b0 [ 808.202008][T14471] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 808.207424][T14471] hugetlbfs_alloc_inode+0xf3/0x140 [ 808.212647][T14471] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 808.218068][T14471] new_inode_pseudo+0x63/0x1d0 [ 808.222865][T14471] new_inode+0x22/0x1d0 [ 808.227070][T14471] ? resv_map_alloc+0x1c4/0x2c0 [ 808.232019][T14471] hugetlbfs_get_inode+0x78/0x500 [ 808.237086][T14471] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 808.243117][T14471] hugetlb_file_setup+0x215/0x610 [ 808.248207][T14471] ksys_mmap_pgoff+0x1e6/0x720 [ 808.253045][T14471] do_syscall_64+0x55/0xb0 [ 808.257510][T14471] ? clear_bhb_loop+0x40/0x90 [ 808.262237][T14471] ? clear_bhb_loop+0x40/0x90 [ 808.266968][T14471] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 808.272912][T14471] RIP: 0033:0x7fa20b59e159 [ 808.277370][T14471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.297028][T14471] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 808.305497][T14471] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 808.313542][T14471] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 808.321549][T14471] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 808.329551][T14471] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 808.337555][T14471] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 808.345569][T14471] [ 808.356432][T14474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2985'. [ 808.369462][T14474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2985'. [ 808.380654][T14474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2985'. [ 808.391432][T14474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2985'. [ 808.408270][T14474] 9pnet_virtio: no channels available for device syz [ 809.063653][T12621] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 811.512369][ T9124] usb 4-1: failed to receive control message: -71 [ 811.544090][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 811.550670][ T9124] ch341-uart: probe of ttyUSB0 failed with error -71 [ 811.558601][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 811.647596][ T9124] usb 4-1: USB disconnect, device number 59 [ 811.677473][ T9124] ch341 4-1:0.0: device disconnected [ 813.500634][T14504] FAULT_INJECTION: forcing a failure. [ 813.500634][T14504] name failslab, interval 1, probability 0, space 0, times 0 [ 813.526711][T14504] CPU: 0 PID: 14504 Comm: syz.0.3000 Not tainted syzkaller #0 [ 813.534265][T14504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 813.544374][T14504] Call Trace: [ 813.547701][T14504] [ 813.550673][T14504] dump_stack_lvl+0x18c/0x250 [ 813.555418][T14504] ? show_regs_print_info+0x20/0x20 [ 813.560683][T14504] ? load_image+0x420/0x420 [ 813.563338][T12431] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 813.565221][T14504] ? __might_sleep+0xe0/0xe0 [ 813.575798][T14505] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 813.577379][T14504] ? __lock_acquire+0x7d80/0x7d80 [ 813.591337][T14504] should_fail_ex+0x394/0x4c0 [ 813.596085][T14504] should_failslab+0x9/0x20 [ 813.600651][T14504] slab_pre_alloc_hook+0x59/0x300 [ 813.605746][T14504] ? resv_map_alloc+0x51/0x2c0 [ 813.610576][T14504] __kmem_cache_alloc_node+0x53/0x250 [ 813.616028][T14504] ? resv_map_alloc+0x51/0x2c0 [ 813.620851][T14504] kmalloc_trace+0x2a/0xe0 [ 813.625341][T14504] resv_map_alloc+0x51/0x2c0 [ 813.629984][T14504] hugetlbfs_get_inode+0x64/0x500 [ 813.635075][T14504] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 813.641107][T14504] hugetlb_file_setup+0x215/0x610 [ 813.646169][T14504] ksys_mmap_pgoff+0x1e6/0x720 [ 813.650949][T14504] do_syscall_64+0x55/0xb0 [ 813.655379][T14504] ? clear_bhb_loop+0x40/0x90 [ 813.660070][T14504] ? clear_bhb_loop+0x40/0x90 [ 813.664756][T14504] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 813.670778][T14504] RIP: 0033:0x7fc2d059e159 [ 813.675235][T14504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.694886][T14504] RSP: 002b:00007fc2d145b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 813.703337][T14504] RAX: ffffffffffffffda RBX: 00007fc2d0825fa0 RCX: 00007fc2d059e159 [ 813.711314][T14504] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 813.719463][T14504] RBP: 00007fc2d0635024 R08: ffffffffffffffff R09: 0000000000000000 [ 813.727446][T14504] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 813.735432][T14504] R13: 00007fc2d0826038 R14: 00007fc2d0825fa0 R15: 00007fffb771ab18 [ 813.743445][T14504] [ 813.749021][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 813.759883][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 813.794375][T12431] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 813.845436][T12431] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 813.861271][T12431] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 813.886454][T12431] usb 2-1: Product: syz [ 813.890742][T12431] usb 2-1: Manufacturer: syz [ 813.909842][T12431] usb 2-1: SerialNumber: syz [ 813.936377][T12431] sisusb 2-1:1.0: Invalid USB2VGA device [ 813.950868][T12431] sisusb: probe of 2-1:1.0 failed with error -22 [ 815.468700][T14505] orangefs_mount: mount request failed with -4 [ 815.763040][T12621] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 815.963432][T12621] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 815.976089][T12621] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 816.016039][T12621] usb 3-1: Product: syz [ 816.027832][T12621] usb 3-1: Manufacturer: syz [ 816.043360][T12621] usb 3-1: SerialNumber: syz [ 816.070547][T12621] usb 3-1: config 0 descriptor?? [ 816.090601][T12621] ch341 3-1:0.0: ch341-uart converter detected [ 816.355356][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3004'. [ 816.368368][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3004'. [ 816.379858][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3004'. [ 816.391244][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3004'. [ 816.403602][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3004'. [ 816.420285][T14524] 9pnet_virtio: no channels available for device syz [ 817.193096][T12621] usb 3-1: failed to receive control message: -110 [ 818.446362][T12621] ch341-uart: probe of ttyUSB0 failed with error -110 [ 818.562658][T12621] usb 2-1: USB disconnect, device number 40 [ 818.681215][ T9124] usb 3-1: USB disconnect, device number 59 [ 818.691323][ T9124] ch341 3-1:0.0: device disconnected [ 819.136032][T14539] FAULT_INJECTION: forcing a failure. [ 819.136032][T14539] name failslab, interval 1, probability 0, space 0, times 0 [ 819.204706][T14539] CPU: 1 PID: 14539 Comm: syz.3.3010 Not tainted syzkaller #0 [ 819.212351][T14539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 819.222468][T14539] Call Trace: [ 819.225785][T14539] [ 819.228737][T14539] dump_stack_lvl+0x18c/0x250 [ 819.233449][T14539] ? show_regs_print_info+0x20/0x20 [ 819.238683][T14539] ? load_image+0x420/0x420 [ 819.243221][T14539] ? __might_sleep+0xe0/0xe0 [ 819.247844][T14539] ? __lock_acquire+0x7d80/0x7d80 [ 819.252903][T14539] should_fail_ex+0x394/0x4c0 [ 819.257609][T14539] should_failslab+0x9/0x20 [ 819.262140][T14539] slab_pre_alloc_hook+0x59/0x300 [ 819.267203][T14539] ? resv_map_alloc+0x88/0x2c0 [ 819.271990][T14539] __kmem_cache_alloc_node+0x53/0x250 [ 819.277402][T14539] ? resv_map_alloc+0x88/0x2c0 [ 819.282193][T14539] kmalloc_trace+0x2a/0xe0 [ 819.286633][T14539] resv_map_alloc+0x88/0x2c0 [ 819.291247][T14539] hugetlbfs_get_inode+0x64/0x500 [ 819.296297][T14539] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 819.302310][T14539] hugetlb_file_setup+0x215/0x610 [ 819.307388][T14539] ksys_mmap_pgoff+0x1e6/0x720 [ 819.312189][T14539] do_syscall_64+0x55/0xb0 [ 819.316636][T14539] ? clear_bhb_loop+0x40/0x90 [ 819.321508][T14539] ? clear_bhb_loop+0x40/0x90 [ 819.326207][T14539] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 819.332117][T14539] RIP: 0033:0x7fb0ab79e159 [ 819.336557][T14539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 819.356187][T14539] RSP: 002b:00007fb0ac65b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 819.364623][T14539] RAX: ffffffffffffffda RBX: 00007fb0aba25fa0 RCX: 00007fb0ab79e159 [ 819.372611][T14539] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 819.380601][T14539] RBP: 00007fb0ab835024 R08: ffffffffffffffff R09: 0000000000000000 [ 819.388594][T14539] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 819.396580][T14539] R13: 00007fb0aba26038 R14: 00007fb0aba25fa0 R15: 00007ffdcb8ad8f8 [ 819.404581][T14539] [ 820.316135][T14553] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 820.357521][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 820.371661][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 821.545044][T14560] loop5: detected capacity change from 0 to 7 [ 821.565620][T14560] Dev loop5: unable to read RDB block 7 [ 821.571259][T14560] loop5: unable to read partition table [ 821.582103][T14560] loop5: partition table beyond EOD, truncated [ 821.609383][T14560] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 821.903091][T12431] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 822.106045][T12431] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 822.143646][T12431] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 822.165747][T12431] usb 3-1: Product: syz [ 822.170004][T12431] usb 3-1: Manufacturer: syz [ 822.193707][T12431] usb 3-1: SerialNumber: syz [ 822.218277][T12431] usb 3-1: config 0 descriptor?? [ 822.246110][T12431] ch341 3-1:0.0: ch341-uart converter detected [ 822.543524][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3016'. [ 822.554655][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3016'. [ 822.565113][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3016'. [ 822.575888][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3016'. [ 822.585851][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3016'. [ 822.601574][T14581] 9pnet_virtio: no channels available for device syz [ 823.273635][T12431] usb 3-1: failed to receive control message: -110 [ 823.280290][T12431] ch341-uart: probe of ttyUSB0 failed with error -110 [ 824.954293][T12431] usb 3-1: USB disconnect, device number 60 [ 824.983548][T12431] ch341 3-1:0.0: device disconnected [ 825.342819][ T9124] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 825.437896][T14600] FAULT_INJECTION: forcing a failure. [ 825.437896][T14600] name failslab, interval 1, probability 0, space 0, times 0 [ 825.471646][T14600] CPU: 1 PID: 14600 Comm: syz.3.3021 Not tainted syzkaller #0 [ 825.479223][T14600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 825.489335][T14600] Call Trace: [ 825.492659][T14600] [ 825.495630][T14600] dump_stack_lvl+0x18c/0x250 [ 825.500392][T14600] ? show_regs_print_info+0x20/0x20 [ 825.505688][T14600] ? load_image+0x420/0x420 [ 825.510248][T14600] ? __might_sleep+0xe0/0xe0 [ 825.514932][T14600] ? __lock_acquire+0x7d80/0x7d80 [ 825.520018][T14600] should_fail_ex+0x394/0x4c0 [ 825.524761][T14600] should_failslab+0x9/0x20 [ 825.529327][T14600] slab_pre_alloc_hook+0x59/0x300 [ 825.534424][T14600] ? resv_map_alloc+0x51/0x2c0 [ 825.539253][T14600] __kmem_cache_alloc_node+0x53/0x250 [ 825.544690][T14600] ? resv_map_alloc+0x51/0x2c0 [ 825.549519][T14600] kmalloc_trace+0x2a/0xe0 [ 825.553999][T14600] resv_map_alloc+0x51/0x2c0 [ 825.558649][T14600] hugetlbfs_get_inode+0x64/0x500 [ 825.563730][T14600] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 825.569764][T14600] hugetlb_file_setup+0x215/0x610 [ 825.574856][T14600] ksys_mmap_pgoff+0x1e6/0x720 [ 825.579689][T14600] do_syscall_64+0x55/0xb0 [ 825.584135][T14600] ? clear_bhb_loop+0x40/0x90 [ 825.588833][T14600] ? clear_bhb_loop+0x40/0x90 [ 825.593533][T14600] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 825.599446][T14600] RIP: 0033:0x7fb0ab79e159 [ 825.603881][T14600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 825.623507][T14600] RSP: 002b:00007fb0ac65b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 825.631965][T14600] RAX: ffffffffffffffda RBX: 00007fb0aba25fa0 RCX: 00007fb0ab79e159 [ 825.639953][T14600] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 825.647940][T14600] RBP: 00007fb0ab835024 R08: ffffffffffffffff R09: 0000000000000000 [ 825.655932][T14600] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 825.663920][T14600] R13: 00007fb0aba26038 R14: 00007fb0aba25fa0 R15: 00007ffdcb8ad8f8 [ 825.671925][T14600] [ 825.686903][ T9124] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 825.723221][ T9124] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 825.779407][ T9124] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 825.797771][ T9124] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 825.830147][T14587] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 825.861638][ T9124] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 826.124968][T12730] usb 1-1: USB disconnect, device number 40 [ 828.417644][T14646] FAULT_INJECTION: forcing a failure. [ 828.417644][T14646] name failslab, interval 1, probability 0, space 0, times 0 [ 828.456263][T14646] CPU: 1 PID: 14646 Comm: syz.2.3033 Not tainted syzkaller #0 [ 828.463818][T14646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 828.473895][T14646] Call Trace: [ 828.477187][T14646] [ 828.480135][T14646] dump_stack_lvl+0x18c/0x250 [ 828.484869][T14646] ? show_regs_print_info+0x20/0x20 [ 828.490087][T14646] ? load_image+0x420/0x420 [ 828.494621][T14646] ? __lock_acquire+0x7d80/0x7d80 [ 828.499672][T14646] should_fail_ex+0x394/0x4c0 [ 828.504470][T14646] should_failslab+0x9/0x20 [ 828.508999][T14646] slab_pre_alloc_hook+0x59/0x300 [ 828.514047][T14646] ? lockdep_softirqs_off+0x440/0x440 [ 828.519443][T14646] kmem_cache_alloc_lru+0x4d/0x2b0 [ 828.524575][T14646] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 828.529971][T14646] hugetlbfs_alloc_inode+0xf3/0x140 [ 828.535459][T14646] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 828.540863][T14646] new_inode_pseudo+0x63/0x1d0 [ 828.545656][T14646] new_inode+0x22/0x1d0 [ 828.549854][T14646] ? resv_map_alloc+0x1c4/0x2c0 [ 828.554726][T14646] hugetlbfs_get_inode+0x78/0x500 [ 828.559772][T14646] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 828.565780][T14646] hugetlb_file_setup+0x215/0x610 [ 828.570854][T14646] ksys_mmap_pgoff+0x1e6/0x720 [ 828.575646][T14646] do_syscall_64+0x55/0xb0 [ 828.580081][T14646] ? clear_bhb_loop+0x40/0x90 [ 828.584865][T14646] ? clear_bhb_loop+0x40/0x90 [ 828.589562][T14646] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 828.595495][T14646] RIP: 0033:0x7fa20b59e159 [ 828.599926][T14646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.619556][T14646] RSP: 002b:00007fa20c478028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 828.627993][T14646] RAX: ffffffffffffffda RBX: 00007fa20b825fa0 RCX: 00007fa20b59e159 [ 828.636075][T14646] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 828.644080][T14646] RBP: 00007fa20b635024 R08: ffffffffffffffff R09: 0000000000000000 [ 828.652086][T14646] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 828.660071][T14646] R13: 00007fa20b826038 R14: 00007fa20b825fa0 R15: 00007ffe4cf77bb8 [ 828.668074][T14646] [ 828.762047][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 828.776462][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 828.787966][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 828.799443][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 828.810857][T14648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3032'. [ 828.829372][T14648] 9pnet_virtio: no channels available for device syz [ 830.101392][T12047] Bluetooth: hci2: unexpected event for opcode 0x0c2d [ 830.363238][T12431] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 830.566160][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 830.586554][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 830.605621][T12431] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 831.503761][T12431] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 831.534259][T12431] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 831.585561][T12431] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.648012][T14655] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 831.674643][T12431] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 832.061075][T12431] usb 1-1: USB disconnect, device number 41 [ 832.081592][T14673] FAULT_INJECTION: forcing a failure. [ 832.081592][T14673] name failslab, interval 1, probability 0, space 0, times 0 [ 832.096274][T14673] CPU: 0 PID: 14673 Comm: syz.1.3043 Not tainted syzkaller #0 [ 832.103814][T14673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 832.113938][T14673] Call Trace: [ 832.117268][T14673] [ 832.120223][T14673] dump_stack_lvl+0x18c/0x250 [ 832.124936][T14673] ? show_regs_print_info+0x20/0x20 [ 832.130168][T14673] ? load_image+0x420/0x420 [ 832.134697][T14673] ? __lock_acquire+0x7d80/0x7d80 [ 832.139752][T14673] should_fail_ex+0x394/0x4c0 [ 832.144473][T14673] should_failslab+0x9/0x20 [ 832.149008][T14673] slab_pre_alloc_hook+0x59/0x300 [ 832.154057][T14673] ? lockdep_softirqs_off+0x440/0x440 [ 832.159456][T14673] kmem_cache_alloc_lru+0x4d/0x2b0 [ 832.164594][T14673] ? hugetlbfs_alloc_inode+0xf3/0x140 [ 832.169998][T14673] hugetlbfs_alloc_inode+0xf3/0x140 [ 832.175224][T14673] ? hugetlbfs_fill_super+0x8f0/0x8f0 [ 832.180627][T14673] new_inode_pseudo+0x63/0x1d0 [ 832.185415][T14673] new_inode+0x22/0x1d0 [ 832.189593][T14673] ? resv_map_alloc+0x1c4/0x2c0 [ 832.194558][T14673] hugetlbfs_get_inode+0x78/0x500 [ 832.199695][T14673] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 832.205737][T14673] hugetlb_file_setup+0x215/0x610 [ 832.210880][T14673] ksys_mmap_pgoff+0x1e6/0x720 [ 832.215680][T14673] do_syscall_64+0x55/0xb0 [ 832.220125][T14673] ? clear_bhb_loop+0x40/0x90 [ 832.224824][T14673] ? clear_bhb_loop+0x40/0x90 [ 832.229525][T14673] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 832.235442][T14673] RIP: 0033:0x7ff2ae99e159 [ 832.239878][T14673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 832.259524][T14673] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 832.267974][T14673] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 832.275982][T14673] RDX: 0000000000000001 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 832.283977][T14673] RBP: 00007ff2aea35024 R08: ffffffffffffffff R09: 0000000000000000 [ 832.291997][T14673] R10: 000200000005c832 R11: 0000000000000246 R12: 0000000000000000 [ 832.300101][T14673] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 832.308151][T14673] [ 832.616478][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3044'. [ 832.629229][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3044'. [ 832.639770][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3044'. [ 832.650231][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3044'. [ 832.667050][T14677] 9pnet_virtio: no channels available for device syz [ 833.853862][T14683] loop5: detected capacity change from 0 to 7 [ 833.881673][T14683] Dev loop5: unable to read RDB block 7 [ 833.902817][T14683] loop5: unable to read partition table [ 833.915072][T14683] loop5: partition table beyond EOD, truncated [ 833.937147][T14683] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 833.947029][T12621] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 834.195090][T12621] usb 1-1: config index 0 descriptor too short (expected 71, got 53) [ 834.234420][T12621] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 834.273304][T12621] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 834.325081][T12621] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 834.353114][T12621] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.371417][T12621] usb 1-1: Product: syz [ 834.377146][T12621] usb 1-1: Manufacturer: syz [ 834.392232][T12621] usb 1-1: SerialNumber: syz [ 835.505872][T14681] mos7720 1-1:1.0: required endpoints missing [ 835.543834][T12621] usb 1-1: USB disconnect, device number 42 [ 836.345638][T14705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 836.359476][T14705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 836.370905][T14705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 836.383874][T14705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 836.395082][T14705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 836.411514][T14705] 9pnet_virtio: no channels available for device syz [ 836.884477][T12431] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 837.175927][T12431] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 837.218575][T12431] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 837.263732][T12431] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 837.328502][T12431] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.470187][T14706] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 837.527521][T12431] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 838.520579][T12431] usb 1-1: USB disconnect, device number 43 [ 838.679734][T13810] udevd[13810]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 839.348036][T14735] loop5: detected capacity change from 0 to 7 [ 839.364061][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3064'. [ 839.376991][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3064'. [ 839.387997][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3064'. [ 839.398766][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3064'. [ 839.408931][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3064'. [ 839.423865][T14736] 9pnet_virtio: no channels available for device syz [ 839.487408][T14735] Dev loop5: unable to read RDB block 7 [ 839.672097][T14735] loop5: unable to read partition table [ 840.078458][T14735] loop5: partition table beyond EOD, truncated [ 840.196027][T14735] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 840.228621][T14738] binder: BINDER_SET_CONTEXT_MGR already set [ 840.276250][T14738] binder: 14737:14738 ioctl 4018620d 2000000002c0 returned -16 [ 842.134689][ T27] audit: type=1326 audit(1788070086.456:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14757 comm="syz.3.3073" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb0ab79e159 code=0x0 [ 842.343685][T12431] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 842.595306][T12431] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 842.663815][T12431] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 842.695740][T12431] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 842.791903][T12431] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.868386][T14755] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 842.907589][T12431] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 842.990119][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3075'. [ 843.002925][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3075'. [ 843.014227][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3075'. [ 843.024644][T14775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3075'. [ 843.039994][T14775] 9pnet_virtio: no channels available for device syz [ 843.839255][ T9124] usb 2-1: USB disconnect, device number 41 [ 844.414394][T14779] binder: BINDER_SET_CONTEXT_MGR already set [ 844.428921][T14779] binder: 14778:14779 ioctl 4018620d 2000000002c0 returned -16 [ 845.566093][T12431] IPVS: starting estimator thread 0... [ 845.587061][T14796] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3076'. [ 845.672819][T14797] IPVS: using max 16 ests per chain, 38400 per kthread [ 845.999063][T14804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 846.012093][T14804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 846.025351][T14804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 846.036647][T14804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 846.047065][T14804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3084'. [ 846.064630][T14804] 9pnet_virtio: no channels available for device syz [ 847.458483][T14808] UDC core: g1: couldn't find an available UDC or it's busy [ 847.814219][T14810] binder: BINDER_SET_CONTEXT_MGR already set [ 847.893221][T14810] binder: 14809:14810 ioctl 4018620d 2000000002c0 returned -16 [ 851.095971][T14850] binder: BINDER_SET_CONTEXT_MGR already set [ 851.116752][T14850] binder: 14849:14850 ioctl 4018620d 2000000002c0 returned -16 [ 854.403373][ T9124] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 854.972965][ T9124] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 854.990718][ T9124] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 855.078719][ T9124] usb 2-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 855.089658][ T9124] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 855.113401][T14908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3114'. [ 855.163856][ T9124] usb 2-1: Product: syz [ 855.168194][ T9124] usb 2-1: Manufacturer: syz [ 855.220882][T14908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3114'. [ 855.267994][T14908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3114'. [ 855.301651][ T9124] usb 2-1: SerialNumber: syz [ 855.314730][T14908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3114'. [ 855.315022][T14909] 9pnet_virtio: no channels available for device syz [ 855.324596][T14908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3114'. [ 855.526580][ T9124] usblp 2-1:1.0: usblp0: USB Bidirectional printer dev 42 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 855.746120][ T9124] usb 2-1: USB disconnect, device number 42 [ 855.787862][ T9124] usblp0: removed [ 856.870279][T14934] loop5: detected capacity change from 0 to 7 [ 856.891287][T14934] Dev loop5: unable to read RDB block 7 [ 856.934483][T14934] loop5: unable to read partition table [ 856.949148][T14934] loop5: partition table beyond EOD, truncated [ 856.992792][T14934] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 857.953139][T14940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 858.053823][T14943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 858.073381][T14943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 858.119682][T14943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 858.130954][T14943] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 858.131749][T14940] 9pnet_virtio: no channels available for device syz [ 858.783074][ T9124] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 858.984953][ T9124] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 858.995143][ T9124] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 859.016578][ T9124] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 859.039929][ T9124] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.057341][ T9124] usb 3-1: Product: syz [ 859.068938][ T9124] usb 3-1: Manufacturer: syz [ 859.079305][ T9124] usb 3-1: SerialNumber: syz [ 859.321871][ T9124] usblp 3-1:1.0: usblp0: USB Bidirectional printer dev 61 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 859.519050][T12730] usb 3-1: USB disconnect, device number 61 [ 860.176689][T12730] usblp0: removed [ 860.511033][T14974] loop5: detected capacity change from 0 to 7 [ 860.518977][T14972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 860.546850][T14974] Dev loop5: unable to read RDB block 7 [ 860.579262][T14974] loop5: unable to read partition table [ 860.586974][T14974] loop5: partition table beyond EOD, truncated [ 860.594962][T14974] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 860.607020][T14977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 860.698109][T14977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 860.707989][T14977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 860.708132][T14979] 9pnet_virtio: no channels available for device syz [ 860.725897][T14977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3137'. [ 861.982907][ T9124] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 862.914234][T15004] loop5: detected capacity change from 0 to 7 [ 862.944763][ T9124] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 862.958754][ T9124] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 862.971389][T15004] Dev loop5: unable to read RDB block 7 [ 862.990707][T15004] loop5: unable to read partition table [ 862.999678][ T9124] usb 1-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 863.010627][T15004] loop5: partition table beyond EOD, truncated [ 863.018163][ T9124] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.027339][T15004] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 863.037228][ T9124] usb 1-1: Product: syz [ 863.041437][ T9124] usb 1-1: Manufacturer: syz [ 863.047348][ T9124] usb 1-1: SerialNumber: syz [ 863.079812][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3149'. [ 863.124444][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3149'. [ 863.173598][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3149'. [ 863.208398][T15010] 9pnet_virtio: no channels available for device syz [ 863.233157][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3149'. [ 863.333440][ T9124] usblp 1-1:1.0: usblp0: USB Bidirectional printer dev 44 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 863.373321][T15007] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3149'. [ 863.527534][ T9124] usb 1-1: USB disconnect, device number 44 [ 863.599940][ T9124] usblp0: removed [ 865.276623][T15038] loop5: detected capacity change from 0 to 7 [ 865.329146][T15038] Dev loop5: unable to read RDB block 7 [ 865.349882][T15038] loop5: unable to read partition table [ 865.364235][T15038] loop5: partition table beyond EOD, truncated [ 865.379416][T15038] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 865.996806][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 866.037681][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 866.077912][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 866.137654][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 866.207331][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 866.255650][T15049] 9pnet_virtio: no channels available for device syz [ 866.265212][T15053] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 866.277139][T15053] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 866.285768][T15053] CPU: 0 PID: 15053 Comm: syz.1.3165 Not tainted syzkaller #0 [ 866.293261][T15053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 866.303360][T15053] RIP: 0010:vsscanf+0x19a/0x2520 [ 866.308304][T15053] Code: 48 c7 c6 50 7d 74 8e e8 b4 e2 06 f7 41 83 fe 25 74 4d 45 85 f6 0f 84 1e 22 00 00 48 ff c3 48 89 5c 24 78 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 bd 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 866.328006][T15053] RSP: 0018:ffffc9000ca87640 EFLAGS: 00010246 [ 866.334080][T15053] RAX: 0000000000000000 RBX: ffffffff8ad68681 RCX: 0000000000000001 [ 866.342053][T15053] RDX: ffffffff8a80947c RSI: ffffffff8e747d50 RDI: 0000000000000030 [ 866.350033][T15053] RBP: ffffc9000ca87770 R08: ffff88802766da00 R09: 0000000000000002 [ 866.358010][T15053] R10: 0000000000000025 R11: 0000000000000002 R12: ffffffff8ad68680 [ 866.366109][T15053] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 866.374096][T15053] FS: 00007ff2af8616c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 866.383038][T15053] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 866.389644][T15053] CR2: 000000110c25ceb0 CR3: 0000000020ece000 CR4: 00000000003506f0 [ 866.397630][T15053] Call Trace: [ 866.400910][T15053] [ 866.403940][T15053] ? bprintf+0x140/0x140 [ 866.408205][T15053] sscanf+0xe3/0x140 [ 866.412116][T15053] ? __might_fault+0xaa/0x120 [ 866.416824][T15053] ? skip_atoi+0xe0/0xe0 [ 866.421100][T15053] ? stack_trace_save+0xaa/0x100 [ 866.426043][T15053] ? __might_fault+0xaa/0x120 [ 866.430728][T15053] ? __might_fault+0xc6/0x120 [ 866.435407][T15053] ? __might_fault+0xaa/0x120 [ 866.440082][T15053] ? split_huge_pages_write+0x372/0x1b60 [ 866.445728][T15053] split_huge_pages_write+0x391/0x1b60 [ 866.451224][T15053] ? lockdep_unlock+0x146/0x2e0 [ 866.456084][T15053] ? lockdep_lock+0x230/0x230 [ 866.460767][T15053] ? add_lock_to_list+0x191/0x280 [ 866.465801][T15053] ? deferred_split_scan+0x940/0x940 [ 866.471114][T15053] ? debugfs_file_get+0x36c/0x460 [ 866.476202][T15053] ? rcu_read_lock_any_held+0xb4/0x140 [ 866.481666][T15053] ? rcu_read_lock_bh_held+0x100/0x100 [ 866.487125][T15053] full_proxy_write+0x110/0x1c0 [ 866.491985][T15053] ? full_proxy_read+0x1c0/0x1c0 [ 866.496935][T15053] vfs_write+0x299/0x9a0 [ 866.501218][T15053] ? file_end_write+0x250/0x250 [ 866.506093][T15053] ? __fget_files+0x28/0x460 [ 866.510689][T15053] ? __fget_files+0x3fc/0x460 [ 866.515372][T15053] ? __fdget_pos+0x2a3/0x330 [ 866.519965][T15053] ? ksys_write+0x74/0x260 [ 866.524391][T15053] ksys_write+0x151/0x260 [ 866.528747][T15053] ? __ia32_sys_read+0x90/0x90 [ 866.533551][T15053] ? lockdep_hardirqs_on+0x98/0x150 [ 866.538775][T15053] do_syscall_64+0x55/0xb0 [ 866.543209][T15053] ? clear_bhb_loop+0x40/0x90 [ 866.547929][T15053] ? clear_bhb_loop+0x40/0x90 [ 866.552620][T15053] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 866.558574][T15053] RIP: 0033:0x7ff2ae99e159 [ 866.563006][T15053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 866.582738][T15053] RSP: 002b:00007ff2af861028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 866.591184][T15053] RAX: ffffffffffffffda RBX: 00007ff2aec25fa0 RCX: 00007ff2ae99e159 [ 866.599184][T15053] RDX: 0000000000000001 RSI: 0000200000000180 RDI: 0000000000000003 [ 866.607180][T15053] RBP: 00007ff2aea35024 R08: 0000000000000000 R09: 0000000000000000 [ 866.615199][T15053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 866.623182][T15053] R13: 00007ff2aec26038 R14: 00007ff2aec25fa0 R15: 00007ffeb2700b18 [ 866.631214][T15053] [ 866.634258][T15053] Modules linked in: [ 866.655838][T15053] ---[ end trace 0000000000000000 ]--- [ 866.661408][T15053] RIP: 0010:vsscanf+0x19a/0x2520 [ 866.668088][T15053] Code: 48 c7 c6 50 7d 74 8e e8 b4 e2 06 f7 41 83 fe 25 74 4d 45 85 f6 0f 84 1e 22 00 00 48 ff c3 48 89 5c 24 78 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 bd 1b 00 00 41 0f b6 1f 45 0f b6 f6 44 [ 866.688821][T15053] RSP: 0018:ffffc9000ca87640 EFLAGS: 00010246 [ 866.695962][T15053] RAX: 0000000000000000 RBX: ffffffff8ad68681 RCX: 0000000000000001 [ 866.719334][T15053] RDX: ffffffff8a80947c RSI: ffffffff8e747d50 RDI: 0000000000000030 [ 866.728585][T15053] RBP: ffffc9000ca87770 R08: ffff88802766da00 R09: 0000000000000002 [ 866.737583][T15053] R10: 0000000000000025 R11: 0000000000000002 R12: ffffffff8ad68680 [ 866.746495][T15053] R13: dffffc0000000000 R14: 0000000000000030 R15: 0000000000000000 [ 866.755857][T15053] FS: 00007ff2af8616c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 866.765952][T15053] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 866.773374][T15053] CR2: 00007ff2ae9eb840 CR3: 0000000020ece000 CR4: 00000000003506f0 [ 866.781563][T15053] Kernel panic - not syncing: Fatal exception [ 866.787902][T15053] Kernel Offset: disabled [ 866.792250][T15053] Rebooting in 86400 seconds..