last executing test programs: 10m56.649672579s ago: executing program 2 (id=346): prlimit64(0x0, 0xe, &(0x7f0000000340)={0x80000000, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000001700)=""/102392, 0x18ff8) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x1bd) mount$9p_fd(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000100), 0x4008, &(0x7f0000000300)=ANY=[]) 10m47.628948166s ago: executing program 2 (id=356): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./debug\x00', &(0x7f00000004c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/cec/cec0/status\x00', 0x0, 0x0) read(r0, &(0x7f00000005c0)=""/256, 0x100) socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='task\x00') r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write(r1, &(0x7f0000000200)='dir .', 0x5) write(r1, &(0x7f0000000240)='bind', 0x4) 10m38.087646895s ago: executing program 2 (id=368): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000540)=0x79, 0x4) bind$inet(r0, &(0x7f0000000580)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000640)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000680)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6955889fcc8cce51ecd73721ad8c044534221e4572f8ab98df38845f0077e10f19314402484b81bc3727426283f803d9c60eb5e932057", 0x17e}, {&(0x7f00000008c0)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fffe4b81ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4c", 0xa4}], 0x2}}], 0x1, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000bc0)=0xdf8, 0x4) writev(r0, &(0x7f0000000c00)=[{&(0x7f0000000c40)="396cf87d08c5a180ab47bb5bf073f86e645bdcec1582ceaa94028bed754c6a0a9ee51723aba90ee33675431670f9548c745b3da48b83d07d7eccc4eb90a1e0e95fa8b02a190ec6899154b7410e1d84c95416f10bf24f7da37249ca1fa786f57c23ba93b389f5220c418523d836670706d8805eb8fb9df7231e2e643ecb223f032a1ae299327d715623", 0x89}], 0x1) write(r0, &(0x7f0000000d40)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a", 0x362) 10m37.786756953s ago: executing program 2 (id=370): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000200)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000019240)={0x0, 0x0, &(0x7f0000019280)={&(0x7f00000192c0)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x40000020) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) 10m33.488947486s ago: executing program 2 (id=373): prlimit64(0x0, 0xe, &(0x7f00000002c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000340)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000003c0)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r3, &(0x7f0000000d40)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000480)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) 10m24.976283271s ago: executing program 2 (id=383): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./mnt\x00', 0x1ff) mount(&(0x7f00000002c0)=@filename='mtd0\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f00000003c0)='jffs2\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x143102) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$sndpcmc(&(0x7f00000004c0), 0x0, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000005c0)='10000', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r5, &(0x7f00000006c0)='0', 0x1) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r1, 0xc2604111, &(0x7f0000000780)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0x401, 0xffffffff, 0xffffffff, 0x132000, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffbfff, 0x1, 0xffffdfff, 0xffffffff, 0xfffffffb]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac43, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x800ffc, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) 10m8.743986571s ago: executing program 32 (id=383): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./mnt\x00', 0x1ff) mount(&(0x7f00000002c0)=@filename='mtd0\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f00000003c0)='jffs2\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x143102) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$sndpcmc(&(0x7f00000004c0), 0x0, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000021b000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00003fd000/0x2000)=nil) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./cgroup.cpu/test\x00', 0x777) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r4, &(0x7f00000005c0)='10000', 0x5) openat(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r5, &(0x7f00000006c0)='0', 0x1) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r1, 0xc2604111, &(0x7f0000000780)={0xe9, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0x401, 0xffffffff, 0xffffffff, 0x132000, 0x3], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffbfff, 0x1, 0xffffdfff, 0xffffffff, 0xfffffffb]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x4, 0x0, 0x0, 0x1}, {0xac43, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x800ffc, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) 2m53.155215278s ago: executing program 4 (id=1103): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f00000194c0)=0x40003) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000019500)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r4, &(0x7f0000019540)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r4, &(0x7f0000019580), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r4, &(0x7f00000195c0)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 2m51.654799224s ago: executing program 4 (id=1106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e65740000"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000019700)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c00028008000140b8607502ab466401829d05907cf5af2d99a9a9b114cc7254e3f5"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d577c621d46}, 0x44) 2m38.207430517s ago: executing program 4 (id=1121): syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_open_dev$evdev(0x0, 0x40, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffdfe) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f00000000c0)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x1, 0x1, 0x0, 0x0, 0x0, 0x60000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000001c0)=0x1) 2m34.414387138s ago: executing program 4 (id=1134): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)={0x14, r1, 0x1, 0x1070bd0c, 0x4, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40811}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m34.271092052s ago: executing program 4 (id=1135): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000380)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000019500)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r4, &(0x7f0000019540)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r4, &(0x7f0000019580), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r4, &(0x7f00000195c0)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 2m32.608473722s ago: executing program 4 (id=1138): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x40}}, 0x20000000) 2m16.782037882s ago: executing program 33 (id=1138): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x40}}, 0x20000000) 16.006913486s ago: executing program 1 (id=1443): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$tipc(0x1e, 0x741c6ced6eeaa54e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x20, 0x2, 0x3, 0x5, 0x0, 0x0, {0x3}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004094}, 0x40400d4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) r3 = dup3(r0, r2, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) connect$bt_rfcomm(r3, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setns(r3, 0x8000000) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000340), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r7 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000400), 0x88800, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r7, 0x3b85, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r7, 0x3ba0, &(0x7f00000004c0)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r7, 0x3ba0, &(0x7f0000000540)={0x48, 0x7, r8, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x50621}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf3ffffff, 0x0, 0x0, 0x0, 0x7f}, [@jmp={0x5, 0x0, 0x849aee721dcc84be, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0xa2cc39c635ab99fe, 0x0, 0x0, 0xfffffffffffffffc}]}, 0x0, 0x6, 0x0, 0x0, 0x0, 0x6}, 0x94) 13.784700709s ago: executing program 1 (id=1445): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070011000523"], 0xfe33) 12.781738173s ago: executing program 1 (id=1448): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000007c0)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x9, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0x3}, @timestamp={0x5, 0xa, 0x0, 0xb00}, @generic={0x0, 0x2}]}}}}}}, 0x46) 12.450219641s ago: executing program 3 (id=1450): r0 = syz_open_procfs$pagemap(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000380), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000003c0)=0x6) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000480)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f00000004c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000500)=0x1, r6, 0x0, 0x2, 0x4}}, 0x20) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000580)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000005c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000980), 0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={'hmac(sha1)\x00'}}) write$RDMA_USER_CM_CMD_BIND(r7, &(0x7f0000000600)={0x14, 0x88, 0xfa00, {r8, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="48000000140081fb7059ae08060c040002ff0f039000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a02000000461eb886", 0x44}], 0x1}, 0x0) 11.198547071s ago: executing program 3 (id=1452): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000180)={0x0, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0xaf1}, 0x8) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{&(0x7f0000000540)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f00000005c0)='\b', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000006c0)={0x0, 0x401, 0x1, [0x8]}, 0xa) 10.379403761s ago: executing program 3 (id=1454): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = syz_ublk_setup_io_uring(0x3631, 0x0, &(0x7f00000020c0)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x5, [@enum={0x3, 0x1, 0x0, 0xf, 0x4000000, [{0x7}]}, @ptr={0xe}]}, {0x0, [0x5f, 0x2e, 0x61]}}, 0x0, 0x3d, 0x0, 0x1}, 0x28) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0xd}}}, &(0x7f0000000480)) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r5, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f00000000c0)='5', 0x1, 0x20000000, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000040), 0x3, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r6, 0xc02c564a, &(0x7f0000000000)={0x0, 0x31384142, 0x0, @stepwise={0x0, 0x400}}) shutdown(r5, 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f00000002c0)=0x18, 0x4) 10.342176132s ago: executing program 1 (id=1455): r0 = getpgrp(0xffffffffffffffff) sched_setattr(r0, 0x0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000004c0)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000500)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r3, &(0x7f0000000580)=""/102392, 0x18ff8) timerfd_settime(0xffffffffffffffff, 0x1, &(0x7f0000019580)={{0x0, 0x4}, {0x0, 0x989680}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000195c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000019600)='./sys\x00', &(0x7f0000019640)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000019680)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) read(r4, &(0x7f00000196c0)=""/265, 0x109) write$eventfd(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000019800)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, 0x0, 0x0) listen(r1, 0x0) 7.742781224s ago: executing program 0 (id=1461): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000180), 0x10, &(0x7f00000001c0)=[{&(0x7f0000000280)="c3e972bd85a6d84136d6dd55048d3593a74f338ce6772ab9a6f64041c2f6fbbecdc08ebcd3192b6a53662dae7c8e9c665e80a5d0925f728dcac30c29793992e588952653d414cb8ccdabc38767fee819ec5af0c5ee936880fe8549b4ed347779cab4ffd4e0b62c53a1c01db28f2b3f91c34211c9353bc1dece61511917c2245fd66cb8dffeacb4d46d627c97b498bf1ff6b313bfbc9765457c831771d5eec7997ec242e4505f01c1bb3e069b2e630f42a2be86598a61", 0x64}, {&(0x7f0000000340)='V', 0x1}, {&(0x7f0000000580)="3eed50d0125719a810f88e3f47186fe4dae74182dfd109a2587c4797410c9b8e39bd3d9aa144d5908647c30c8db69b5c17084c9b1bfbb8680737c4f88abcdbc7d294d72ab1b344270915df9ddf5635644c351c22b29d948ac4106bce7107570beed63077cfbc98ef71699eae65d37724d995b553e7a3ade619b522313ab382caf879feb48942878e605ee3ee2872794e3abe22a3f025068b628a5d92468092a5cc649bbbd978b5772e537939432a502122235ced312dafd108c9ffeb0b38cc16da9418ca01d485a6afb5827da4df6e1121ec307de14bb32b6a977608e4576a998182dd93d592ff43e55bfdbbce23ecd501e43b3e93ef8d9d01711dff54c301e299d3801a3cffe6c9883fbd0e47124dc02569f62d48b878fcb58ce99fcffcd2a5166eff3ad93cf1d137274993d86a3b3730d63ded759f6ca88fa449e5575b15321e5a58a1f888eed7466db4976ce35f6d2efb5ad05d99a66482dc607cb5acb24d326803bd337519cc98103f59c63b5962cd72e4497d1b00817d6e09de70270a09b493c2226617b1c9ef9d506be00d6e07f14633a966f04ecca90fb8d2b963ad6f3817935bd6534fa3da1c5dc468789cbf1192f3c0bff3777f1edd2ada5d35f88f12f29e952c44445ce623509d66811c80a9e0f13ad85aba37d86ff0da4dda601d9e8acb264233bc939fb056316612cff687d5c44157be05bcc88b333ff2a40041d98f1acfe6e2231a84e09bd7a54a0442cf87ce3ee8fd8da39da1862862ae40fc3cb3055c8b70e62f243850707341f51426bb3e71c7a4fffefab060db786000618b05eb087a424a2f30f6a232ff44b605f70ceec0a8f70e37907f6e0bbba21e9d5b7ecb6d287742b75c101ba79525918c3473eae38f3c177249dfa8816661c9921f0b0c858d53ab87c8407b97950c842111002edd1d1e80b801b495da28bcd5409bc971e55dab1857e188ac9728efc8f9a4543945f86ade13b445eacecbbf848a96410ac37c57e3e9e8bc8b8fadd559d225c7468639da2b5d1208558b51e94c14faa7947a7c60e81a96bb5d194cc7289adbc02ebb4b49be1f1efc429db2f9b79b5a22919dba0c35341042c5776942c52365367c4bfc95b42be383cca7107161ded7e851d0126da33d581f1e2b08d0c061e86d31e7a83f9b51c79b4034c7deda7697034e1404c6e8e459f76c2efe64350146c7437ef808e04ca14df5f6f500264fd977272bbf8fc096774e8eb61d0963430751ac1425a073f84346b0eba368cba7fa34adc420800d4f99927280eba199f9695cf88124fafc3a2b1226d2f2ab3ea27c69a127650cf5c725b54c02bd8729033cf699ce7f030f9a3442056244da3cfb61a8126dba11377624f39eb009242152fd7b8b88de7dd86057f29bfcb7b7df0e65e7e9ac9eeaa41afa62743698bff03d5b2d51fb6bca2d92294e8e177cfa3661b26f1c040e9bed983b7bc0aa154eb9c92e4ee25091318c53113a1c23ac62d2d71504cba99041f29a4f332133292cf20abec9222a2acca57cac48fa6c0668ee5eecb494741a64d33b011dcca74696d4614c5b45a5d20983b1708d365ed3ffa60f9161972a611c22642c3c259b41f943f6d7a8b60f284d325e38fe76f0645e069ff70cae38850ccf973193b6232c987df26239a574691f7f07fffa6deae1eb0324fe546573c36f2a2c31cd442517a9b036ae6a2a491e7343864693c107a5dc2585820863c146c1ba6caa4fea9b87d567716f4c8ca1a9d2848055cd750512d3b7415d090019dc8a04a1a1d28931093cd8f00e94c407ca1fa2a5ce903d9df26e008c07cd13afa783220e1bd5e6b60645f3dbb6ecb4156fedafa2dd25498c6a99d94f0b38125ea7741b75109dcac9f80635f79f5c8a0483bb9f05a3a5bf721c7541edb252449f8b13e63c370a6146332f03ca1f1b6fe0bed984f13744bb7fa0fe322e83ddf9ffb2083e94f33604a0a199220c450dad94bf154805e7f9e4350ca2d81adf2978c87dcc8a8a7d56297ec124bfef0d28f35777205e973272c87e01070f14f5b14daa3b5104d9ff6b296c4f16ed49eb42d35e7ba3bccb7a26c33a263df88aadd596e9d9de0abbd4d449df11081f2cd62e1d8962b9b9feb25a3b8e03537d61a61c11ac22b7211d12c84e60a6abcc219e558b2513d8c530b3c7a57cdc47de545aafbb2a13c0e6c75b1b92fa241c713c83a09c92b2b61d565120372a9143415583c9596f27a663d4967cd653b08cebd6cb96c1f0dc80d57267ac9a8281d7149bde880828ee27d69a6818db58320db29d1b044eaf6ab8a5108bc522de406990b5393b1f7e7bab71bf6cf8eed1cd59c7607d662e8b313f5c4fce0f59b1027371381011b63dd5b2b09739082c0d62ffad96e30153a395234937d377c32fe7af82aca3a19d0ebc4a5c5fb5ff190f14d5695c703b571fb4bf03756635cafc6cf6267eab836c347a9d07e8089fc105346934cf3364e5be370b3c42b94bc5ae3d17a817398566a2953251eb91697d67278145df9a4b917bcca1bf211780b22f4caacfcb7604c84f943d05f6fdf8edbd258d7d8dbf84f9d99e57472c5b1c2337d749a1f345e662e2536d23c7a63bbbbf00f8b5b0a2106a0342ab27b9a10b82e82668cd49e0cbb09d7be0217645f1dda3be59c8232fa290d34791cda52aa5b5cec6339ab96a2eb3f5328cc7c0e6717c2824344547a2ed518f6b2b4e4fe5b684596aa6a9d3988fc5d5ff4cb46cec99d951b8386b10949a163af974b7543df97b4882a4ed60e927a1deb67c5f814235bef65fea79a2c712815be7403c93a3707fb90d4604ec3a6a3b0928f253f6ab6bd56c958e026c8c58172c4ac2a3efe2ecd5cea70c8313f9ac2d638bc296ba99e2ca86d2fd06b5402cdcddc3f3c9845d5ae77f6f36963b91e8f6cdccd17abe8d40ed02463af4bb0e496344f350097f1cc13313fa1e172b63556ed2b8a8121c01a5fb343ff7767821626fc49b0d6bd522e1c9bf137d5a5bccb4bc8dbb64c83a82ef6c2894f3896c9f6bf0c3764011d53eeb6db9ea9dae22d3ebcca4942d5828c0bca0d9ea37701d5a06c066ac4fe318e11e9c0d6c658ac810fb5d7836cfffe4ccbb0934e5567d74695980a156d4bf1c18861c5a29ccd349999dc20562d00e1f6c1851ae563541086438d60b975c8ceb466414ff60efa0b2dee790fd0659ffa98b92414c13d5a6825368f56c4984412205041cd8e006c7127d4395ecdffb5addf80ef938ce54a367154c4fc286d5f969325c12b13655a9a956dd3b98281f537e837669fc55d8930676e807aa8cd046e0f4583d59f86cb99f3f7a7ddde1fb39111fdec7677d2fee4b8f4814a5def5ebcc67c653384ce80eaffd880405f7edf8fd3ea049f040595df4a75e2f892e7a85e0ba351fb8d263bfff7168bb85017b360fcd2ba89346682a6ea7ccc46afbdb5ab444e3f477238b2ab503bde914d3cf1789539cde9c0621152cd97bff9f235d88a1ef4ea4309db3a05d401af7fb82784b050ef529dab4f1f003eb29710a962f7538c521e617e2f0efac36182d09985e1d725cc38c3833a53742a02f76fb2854a9e45f0febacf3bda83f11183ef5b9fef02ebcdf56d4104b175bad937d8f61964f97d673577cdcbbb48d8eb62b063ee6563b9ff053719baff871bcd83822d865b2f7ef023076425ac5cd71b1f2309de0c6f14cc9c4d3e8fad945f756a7c8a084ea1bfdf5ac6e740043e7f7bdaca06774b084ae314c2636529d4fdcd965c7f8c07156572620b827d694efdc9d2bfc5aa9391220a83765f2c71fcd48d4acaed60afb53d1013fa3b15e948ec4159f7d130ef85b594018346e99034c18738285223ea53a6b1d5cf11a607de2e19608ba03ec970a915b773824261f3fc931dd6d3b934d89f07baf14776314c3eeb8cd0537ef5736f565fbd14e520d4ab2f77ed9597b76ff91f8d1f99ebd6e473efda7accb273975a06944d1037032129992b994ca791a09b4d83980a1e494b0f97098df5f6fb6bbb02722adb11dc319c565c2c363cbd19d9fb3efb4613b62d6584cd53f7bd80e3e89304f444ce9dd1835661e3bb4de02ccf568a2a5daaf0d56898d4286c3fb62e22af62d7ac318685834467f337561dde2e0c1e2827cdffcf42c17728ee64b3ff4ccc0227590badd0bd7e448b8cca0892d6a5e0130d2ac665f47c6b28daa101c1b319869bdd39fa924d6d9ba7d72feda5f21ac78641c7d4801d41c7879721b3be4dab40d9c4a78552440101f373489cc5240b0144a9ce32691a784b6dfe971a21bb5980ff67da2d1bb90b223c9e192a39c1aeadd1f5c790811079c0b51a97105c99b6f95d71bb3ea47c33d9dcb0a53c929c44499e184a3cd722c908d3b0d157e28ffdeb2ed7192e780d96a7a2f0fd5a87bdc973e049da0caf931f26f5a21813e2e602ceb2259997e0205ce48fd9424bd6d4d75dd4301f429ee30745cd839a40dbeab4c3db2f0f10bbaea071ca41d1392385681730a3678a5f60f604dbe19cb9d7dd234337e327451b8cc65394af399432ef7fc3765d055874ebdca14e5999292d6f72f31e92bacf25db5ef8f5212952c1910de06ddbe1687a0e1837922f2228289916ed3aeb7b9cc24da3ae47139e371930afa6d3573df6732c26c0c7ae06d9cedfa77160711bcb06e6553338deae4c5731cf53cc154113096d02f3036d7d9edfcdc331e4bb860c5208489212e904eab70e7f860b0379895cbdecbf7a0b7a25e5b853c7dbe08a4e296a30afec8cf5a9f6ea4aef32a508655d539a770b21e660c9ee1d7688c56abeb7cf1afccc8d59780cf26312589e0c8e1bc00ad7b1325cd9a5dd69246e0b33407c381ea09265154aec297e4ccdf9785a1042a83e77c13d4ce4360782f2428f9916b5cd123b089eb683d30c1e895b9944aa905a1a5b52301d8cc5e4741834ead6ebdb5dc05c9c49c5e883e99d40b9838037beaf876534d747856103e59caf6266fbbe760b6ef83d004634b74f14f8eb4aef93c4cc9cbbd78d83d532c70feef51ea3f170b25d81a6a9b074bfca7e9b3771bf83517e0dd9d0600f70b86b20f61fe36076f8bada334b2390fa954973bc901619a3cfd039349cb328625f495ab288dbdd6dbfd022c2a83f59e0b998619a12e35891b5ae9e83a71765507b4a571cd2241e5885c705244c1022688bef7c5065fbcf219fc01753adb611b3fbc09403dcb10a4f99d788667eff75fa27074ca8481a633530e26163ccf7dada049d23e717e067b6fa5b2f652bc50abda9e7ccdc5f2f3c35ecc2c4431c819c9691be4422e379750774e9f39dae06f26423c8a4278789c9f3111b43f6dd25b0ad47c4cc5fda3f3ed82079c9366e0adced883488f429c1d7e1b351fd0bb204dd7977ef224c4df6d7a5f7697bc6500a7d03a8a914154779fa7092bf1be6bad4092367ce5d295a5d5d0e7c469f372ca2011d612637025e89f178ae9ada0c5b73bcb7d7c034ff595263cd4216e3c76ba5f3d81932a088a90bf8043e877e299c670ef1622a098d5519d9adc4ee7d4cd00e5934a4375fa83fdb81214b892482b31bdde59a70aaf25cb7f417c3a2a91c4e54b48149f6c41d9d396ee6ff13e3028c64a7c9b1f2e7c6e67184a3d52d6f570db3d225c947423c4c6533f22df57d15c5e5a3183422bd378b06fe4732a9401dcb19840fb8fa5c50a0ff497fef362c507753e46b8881d3e767f3b1d893a3805941c94f2efa05ce34b9ea81d716984af6834230d4707a87089d40779503ee6a9bb245d7d997f14acb80e89731c042bbbbe3dcd05177b0ee0eec23455830ef5b65aca357f2b0b887e0b9821c0", 0x1000}, {&(0x7f0000001580)="b768eb20304f2fdc5a9694a4867840d93170ca1a86406f", 0xfffffec0}], 0x4, 0x0, 0x0, 0x8010}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000015c0), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) r1 = landlock_create_ruleset(&(0x7f0000001600)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0xa) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) 7.284253655s ago: executing program 0 (id=1462): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000003480)='net/netlink\x00') preadv(r3, &(0x7f0000003440)=[{&(0x7f0000000140)=""/245, 0xf5}, {&(0x7f0000000280)=""/185, 0xb9}, {0x0}], 0x3, 0x162, 0xb) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000100)={0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000340), 0x1, 0x0) ioctl$FIONREAD(r5, 0x541b, &(0x7f0000000380)) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001a00010028bd70000000000002202000ff00000700020000080002007f01010008000100ac14143308000300", @ANYRES8=r4], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0xea5bc50b6199d76e) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x9e) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pnp/drivers/serial\x00', 0x0, 0x0) r7 = openat(r6, &(0x7f0000000140)='unbind\x00', 0x1, 0x0) write(r7, &(0x7f00000001c0), 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/pnp/devices/00:03/resources\x00', 0x2, 0x0) write(r8, &(0x7f00000003c0)='di', 0x2) 7.261114336s ago: executing program 3 (id=1463): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000007c0)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x9, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0x3}, @timestamp={0x5, 0xa, 0x0, 0xb00}, @generic={0x0, 0x2}]}}}}}}, 0x46) 4.889548022s ago: executing program 5 (id=1466): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000480)=@filename='mtd0\x00', &(0x7f00000004c0)='./mnt\x00', &(0x7f0000000500)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/fillfile\x00', 0x42, 0x9f) write(r0, &(0x7f0000000580)="000102030405060708090a0b0c0d", 0xe) 4.669508368s ago: executing program 5 (id=1467): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) epoll_create1(0x0) keyctl$invalidate(0x15, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='1', 0x1) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt(r3, 0x84, 0x7d, &(0x7f0000000300), 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000380)=@assoc_value={0x0, 0x200}, 0x8) bind(r3, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x80) connect(r3, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10) sendto(r3, &(0x7f0000000500)='\x00', 0x2710, 0x0, 0x0, 0x0) 4.424975884s ago: executing program 0 (id=1468): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000640)='/dev/comedi4\x00', 0x8a241, 0x0) ioctl$COMEDI_INSNLIST(r0, 0x8010640b, &(0x7f0000000680)={0x0, &(0x7f0000000700)}) 4.073508112s ago: executing program 0 (id=1469): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.072916702s ago: executing program 5 (id=1470): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f00000015c0), 0x4000000000001cd, 0x1008c811) close_range(r0, 0xffffffffffffffff, 0x0) r3 = landlock_create_ruleset(&(0x7f0000001600)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r3, 0xa) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) 3.894997536s ago: executing program 5 (id=1471): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000080), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000140)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000480)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000d40)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000d80)={@cgroup=r3, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000dc0)={@cgroup=r4, 0x24, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 3.882709466s ago: executing program 3 (id=1472): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) timer_create(0x0, 0x0, &(0x7f00000005c0)) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x2, 0x3, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, 0x0) mq_notify(0xffffffffffffffff, 0x0) wait4(0x0, &(0x7f0000000000), 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x1ef) lsetxattr$security_capability(&(0x7f0000000200)='./file1\x00', &(0x7f0000000240), &(0x7f0000002d00)=@v3={0x3000000, [{0x35ff, 0x80e}, {0x9, 0x6}]}, 0x18, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000b80)='./file2\x00', 0x387) mount$overlay(0x0, &(0x7f0000000bc0)='./file0\x00', &(0x7f0000000c00), 0x0, &(0x7f0000000c40)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) truncate(&(0x7f0000000c80)='./file0/file1\x00', 0xe2) 3.838536588s ago: executing program 5 (id=1473): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x4010, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000340)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff0000000705810240000007050202400000070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./dev/ttyUSB0\x00', 0x12df00, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x45, &(0x7f00000004c0)=@generic={0x2, 0x0, 0x3d, "d7234d19", "1cfc382087401c4c8b1a813e96f3dea83ce167081a59231e2f45206cdcd5e00953ef337815f691c03d497b2087dfaf41161d4bc668ecfcb6e4ee7319c5"}) 3.792189219s ago: executing program 1 (id=1474): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000cc0), 0x41, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x1000000, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) 3.468534017s ago: executing program 0 (id=1475): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xcb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) 1.546039542s ago: executing program 3 (id=1476): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x7, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x409, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4c, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x4000006, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x20004080}, 0x240400c0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000026"], 0x18}}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getlink={0x28, 0x12, 0x1, 0x0, 0x0, {}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x3ff}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 78.857068ms ago: executing program 5 (id=1477): bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x0, 0x80, 0x0, 0x410a0, 0xffffffffffffffff, 0x281edb46, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x3, 0x7}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095000000000000006119ec49345431e792131f555d07468554b5580d934634e49591e33811104234d86fee72c4dd5a5923cc2b15e3c2907a8f978fae522131e463eb6fbeb5de25d504356d7b16ec9a59a8fdfdc2281c15b3c088ac9ce1ef113fae4e751d0233ae04aa1045b98052ab8119f298aea56400fb85617d37934c4656ecf69f197b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0900000004000000040000001000000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000fa690000000000"], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000900)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000940)=0x7) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2718, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000980)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000009c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a00)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000a80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000ac0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b00)=0x6) gettid() setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000c40), 0x4) r3 = socket(0x10, 0x80003, 0x0) write(r3, &(0x7f0000000c80)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) close_range(r3, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2, 0x42872, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000822000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f00008b5000/0x1000)=nil) openat$audio(0xffffffffffffff9c, &(0x7f0000000cc0), 0xe8c00, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000d00), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000d40)={0x1, @pix_mp={0xffffffff, 0x0, 0x34325241, 0x0, 0x3, [{0x0, 0x3}, {0xfffffffc, 0x20000000}, {}, {0x8}, {0x0, 0x400000}, {}, {0x0, 0xfffffffd}], 0x0, 0x0, 0x7, 0x0, 0x4}}) 63.543298ms ago: executing program 0 (id=1478): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x4000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x4}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000001000010828bd7000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="000000000420040008001b000000000024002b8008000100", @ANYRES32, @ANYBLOB="0800030019000000080008"], 0x60}, 0x1, 0x0, 0x0, 0x20}, 0x20004004) 0s ago: executing program 1 (id=1479): syz_usb_connect$hid(0x3, 0x36, &(0x7f0000001540)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x54c, 0x2, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x1, 0xc0, 0x7f, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x6, 0x6, {0x9, 0x21, 0x80, 0x10, 0x1, {0x22, 0x3aa}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x88, 0x7, 0x9}}}}}]}}]}}, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 0000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 573.550715][ T8284] RBP: 00007f7e8de36b20 R08: 0000000000000000 R09: 0000000000000000 [ 573.558743][ T8284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 573.566735][ T8284] R13: 00007f7e8e026038 R14: 00007f7e8e025fa0 R15: 00007ffeb6023168 [ 573.574746][ T8284] [ 573.613192][ T8284] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 575.594087][ T8303] netlink: 64 bytes leftover after parsing attributes in process `syz.0.612'. [ 579.186801][ T8322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.627'. [ 580.524260][ T8330] FAULT_INJECTION: forcing a failure. [ 580.524260][ T8330] name failslab, interval 1, probability 0, space 0, times 0 [ 580.537178][ T8330] CPU: 0 PID: 8330 Comm: syz.1.628 Not tainted syzkaller #0 [ 580.544499][ T8330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.554596][ T8330] Call Trace: [ 580.557899][ T8330] [ 580.560864][ T8330] dump_stack_lvl+0x18c/0x250 [ 580.565563][ T8330] ? show_regs_print_info+0x20/0x20 [ 580.570775][ T8330] ? load_image+0x420/0x420 [ 580.575316][ T8330] ? __lock_acquire+0x7eb0/0x7eb0 [ 580.580361][ T8330] should_fail_ex+0x394/0x4c0 [ 580.585060][ T8330] should_failslab+0x9/0x20 [ 580.589601][ T8330] slab_pre_alloc_hook+0x59/0x300 [ 580.594630][ T8330] ? tty_ldisc_setup+0xbd/0x240 [ 580.599488][ T8330] ? tty_init_dev+0x275/0x4c0 [ 580.604181][ T8330] ? ptmx_open+0xdf/0x2c0 [ 580.608539][ T8330] kmem_cache_alloc_node+0x5e/0x310 [ 580.613753][ T8330] ? alloc_vmap_area+0x1b4/0x1e50 [ 580.618794][ T8330] alloc_vmap_area+0x1b4/0x1e50 [ 580.623676][ T8330] ? vm_map_ram+0xcf0/0xcf0 [ 580.628198][ T8330] ? rcu_is_watching+0x15/0xb0 [ 580.632976][ T8330] __get_vm_area_node+0x162/0x370 [ 580.638021][ T8330] __vmalloc_node_range+0x36f/0x1320 [ 580.643323][ T8330] ? n_tty_open+0x1d/0x150 [ 580.647763][ T8330] ? lockdep_hardirqs_on+0x98/0x150 [ 580.652987][ T8330] ? free_vm_area+0x50/0x50 [ 580.657500][ T8330] ? __might_sleep+0xe0/0xe0 [ 580.662108][ T8330] ? n_tty_open+0x1d/0x150 [ 580.666545][ T8330] vzalloc+0x79/0x90 [ 580.670462][ T8330] ? n_tty_open+0x1d/0x150 [ 580.674896][ T8330] n_tty_open+0x1d/0x150 [ 580.679156][ T8330] tty_ldisc_setup+0xbd/0x240 [ 580.683847][ T8330] tty_init_dev+0x275/0x4c0 [ 580.688392][ T8330] ptmx_open+0xdf/0x2c0 [ 580.692575][ T8330] ? pty_start+0x140/0x140 [ 580.697118][ T8330] chrdev_open+0x58c/0x600 [ 580.701578][ T8330] ? cd_forget+0x160/0x160 [ 580.706054][ T8330] ? fsnotify_perm+0x3ed/0x5e0 [ 580.710870][ T8330] do_dentry_open+0x880/0x14b0 [ 580.715662][ T8330] ? cd_forget+0x160/0x160 [ 580.720116][ T8330] path_openat+0x284f/0x3270 [ 580.724758][ T8330] ? do_sys_openat2+0xda/0x1d0 [ 580.729548][ T8330] ? __x64_sys_openat+0x139/0x160 [ 580.734598][ T8330] ? verify_lock_unused+0x140/0x140 [ 580.739835][ T8330] ? do_filp_open+0x430/0x430 [ 580.744544][ T8330] do_filp_open+0x1f2/0x430 [ 580.749084][ T8330] ? vfs_tmpfile+0x620/0x620 [ 580.753707][ T8330] ? _raw_spin_unlock+0x28/0x40 [ 580.758577][ T8330] ? alloc_fd+0x590/0x640 [ 580.762933][ T8330] do_sys_openat2+0x134/0x1d0 [ 580.767657][ T8330] ? do_sys_open+0xe0/0xe0 [ 580.772112][ T8330] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 580.778128][ T8330] ? lock_chain_count+0x20/0x20 [ 580.783032][ T8330] __x64_sys_openat+0x139/0x160 [ 580.787915][ T8330] do_syscall_64+0x55/0xb0 [ 580.792354][ T8330] ? clear_bhb_loop+0x40/0x90 [ 580.797059][ T8330] ? clear_bhb_loop+0x40/0x90 [ 580.801757][ T8330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 580.807676][ T8330] RIP: 0033:0x7fd1a779f559 [ 580.812124][ T8330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.831849][ T8330] RSP: 002b:00007fd1a8613028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 580.840281][ T8330] RAX: ffffffffffffffda RBX: 00007fd1a7a26090 RCX: 00007fd1a779f559 [ 580.848288][ T8330] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 580.856289][ T8330] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 580.864271][ T8330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 580.872272][ T8330] R13: 00007fd1a7a26128 R14: 00007fd1a7a26090 R15: 00007fff6e6c51a8 [ 580.880269][ T8330] [ 580.885362][ T8330] warn_alloc: 1 callbacks suppressed [ 580.885373][ T8330] syz.1.628: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 580.906331][ T8330] CPU: 0 PID: 8330 Comm: syz.1.628 Not tainted syzkaller #0 [ 580.913654][ T8330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 580.923751][ T8330] Call Trace: [ 580.927049][ T8330] [ 580.930018][ T8330] dump_stack_lvl+0x18c/0x250 [ 580.934715][ T8330] ? show_regs_print_info+0x20/0x20 [ 580.939934][ T8330] ? load_image+0x420/0x420 [ 580.944465][ T8330] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 580.950904][ T8330] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 580.957419][ T8330] warn_alloc+0x246/0x340 [ 580.961760][ T8330] ? slab_free_freelist_hook+0x130/0x1a0 [ 580.967422][ T8330] ? zone_watermark_ok_safe+0x230/0x230 [ 580.972993][ T8330] ? __get_vm_area_node+0x17b/0x370 [ 580.978233][ T8330] ? __get_vm_area_node+0x17b/0x370 [ 580.983456][ T8330] __vmalloc_node_range+0x394/0x1320 [ 580.988768][ T8330] ? lockdep_hardirqs_on+0x98/0x150 [ 580.994017][ T8330] ? free_vm_area+0x50/0x50 [ 580.998540][ T8330] ? __might_sleep+0xe0/0xe0 [ 581.003150][ T8330] ? n_tty_open+0x1d/0x150 [ 581.007582][ T8330] vzalloc+0x79/0x90 [ 581.011518][ T8330] ? n_tty_open+0x1d/0x150 [ 581.015951][ T8330] n_tty_open+0x1d/0x150 [ 581.020217][ T8330] tty_ldisc_setup+0xbd/0x240 [ 581.024912][ T8330] tty_init_dev+0x275/0x4c0 [ 581.029438][ T8330] ptmx_open+0xdf/0x2c0 [ 581.033616][ T8330] ? pty_start+0x140/0x140 [ 581.038077][ T8330] chrdev_open+0x58c/0x600 [ 581.042523][ T8330] ? cd_forget+0x160/0x160 [ 581.046973][ T8330] ? fsnotify_perm+0x3ed/0x5e0 [ 581.051771][ T8330] do_dentry_open+0x880/0x14b0 [ 581.056562][ T8330] ? cd_forget+0x160/0x160 [ 581.061000][ T8330] path_openat+0x284f/0x3270 [ 581.065620][ T8330] ? do_sys_openat2+0xda/0x1d0 [ 581.070399][ T8330] ? __x64_sys_openat+0x139/0x160 [ 581.075570][ T8330] ? verify_lock_unused+0x140/0x140 [ 581.080795][ T8330] ? do_filp_open+0x430/0x430 [ 581.085509][ T8330] do_filp_open+0x1f2/0x430 [ 581.090040][ T8330] ? vfs_tmpfile+0x620/0x620 [ 581.094667][ T8330] ? _raw_spin_unlock+0x28/0x40 [ 581.099539][ T8330] ? alloc_fd+0x590/0x640 [ 581.103896][ T8330] do_sys_openat2+0x134/0x1d0 [ 581.108597][ T8330] ? do_sys_open+0xe0/0xe0 [ 581.113030][ T8330] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 581.119036][ T8330] ? lock_chain_count+0x20/0x20 [ 581.123906][ T8330] __x64_sys_openat+0x139/0x160 [ 581.128782][ T8330] do_syscall_64+0x55/0xb0 [ 581.133214][ T8330] ? clear_bhb_loop+0x40/0x90 [ 581.137913][ T8330] ? clear_bhb_loop+0x40/0x90 [ 581.142610][ T8330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 581.148525][ T8330] RIP: 0033:0x7fd1a779f559 [ 581.152951][ T8330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 581.172581][ T8330] RSP: 002b:00007fd1a8613028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 581.181029][ T8330] RAX: ffffffffffffffda RBX: 00007fd1a7a26090 RCX: 00007fd1a779f559 [ 581.189029][ T8330] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 581.197034][ T8330] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 581.205036][ T8330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 581.213030][ T8330] R13: 00007fd1a7a26128 R14: 00007fd1a7a26090 R15: 00007fff6e6c51a8 [ 581.221038][ T8330] [ 581.226138][ T8330] Mem-Info: [ 581.229282][ T8330] active_anon:57727 inactive_anon:1 isolated_anon:0 [ 581.229282][ T8330] active_file:18509 inactive_file:40160 isolated_file:0 [ 581.229282][ T8330] unevictable:768 dirty:89 writeback:0 [ 581.229282][ T8330] slab_reclaimable:10859 slab_unreclaimable:95139 [ 581.229282][ T8330] mapped:39446 shmem:53328 pagetables:691 [ 581.229282][ T8330] sec_pagetables:0 bounce:0 [ 581.229282][ T8330] kernel_misc_reclaimable:0 [ 581.229282][ T8330] free:1291252 free_pcp:3487 free_cma:0 [ 581.275868][ T8330] Node 0 active_anon:230908kB inactive_anon:4kB active_file:74036kB inactive_file:160436kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:157784kB dirty:356kB writeback:0kB shmem:211776kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10640kB pagetables:2764kB sec_pagetables:0kB all_unreclaimable? no [ 581.308472][ T8330] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 581.338749][ T8330] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 581.367169][ T8330] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 581.373173][ T8330] Node 0 DMA32 free:1248932kB boost:0kB min:34508kB low:43132kB high:51756kB reserved_highatomic:0KB active_anon:230868kB inactive_anon:4kB active_file:74036kB inactive_file:159356kB unevictable:1536kB writepending:356kB present:3129332kB managed:2569932kB mlocked:0kB bounce:0kB free_pcp:3412kB local_pcp:3412kB free_cma:0kB [ 581.403774][ T8330] lowmem_reserve[]: 0 0 1 1 1 [ 581.408515][ T8330] Node 0 Normal free:8kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:1080kB unevictable:0kB writepending:0kB present:1048576kB managed:1128kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 581.435743][ T8330] lowmem_reserve[]: 0 0 0 0 0 [ 581.440477][ T8330] Node 1 Normal free:3900708kB boost:0kB min:55380kB low:69224kB high:83068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:10528kB local_pcp:10528kB free_cma:0kB [ 581.471371][ T8330] lowmem_reserve[]: 0 0 0 0 0 [ 581.476174][ T8330] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 581.488903][ T8330] Node 0 DMA32: 195*4kB (UME) 329*8kB (UE) 91*16kB (U) 45*32kB (ME) 56*64kB (UME) 52*128kB (UE) 12*256kB (UE) 9*512kB (UME) 6*1024kB (UM) 15*2048kB (UME) 290*4096kB (UM) = 1248932kB [ 581.507219][ T8330] Node 0 Normal: 2*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 581.519149][ T8330] Node 1 Normal: 251*4kB (UME) 47*8kB (UME) 38*16kB (UME) 163*32kB (UME) 60*64kB (UME) 18*128kB (UME) 1*256kB (M) 2*512kB (UE) 1*1024kB (U) 1*2048kB (E) 948*4096kB (M) = 3900708kB [ 581.537185][ T8330] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 581.546807][ T8330] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 581.556203][ T8330] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 581.567150][ T8330] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 581.576568][ T8330] 111998 total pagecache pages [ 581.581344][ T8330] 1 pages in swap cache [ 581.585541][ T8330] Free swap = 124984kB [ 581.589702][ T8330] Total swap = 124996kB [ 581.613095][ T8330] 2097051 pages RAM [ 581.617021][ T8330] 0 pages HighMem/MovableOnly [ 581.621712][ T8330] 421118 pages reserved [ 581.625937][ T8330] 0 pages cma reserved [ 581.630019][ T8330] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 584.924487][ T8352] comedi comedi3: board detection failed [ 584.944720][ T8352] bridge0: port 3(netdevsim0) entered blocking state [ 584.951530][ T8352] bridge0: port 3(netdevsim0) entered disabled state [ 584.958572][ T8352] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 584.967147][ T8352] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 584.975007][ T8352] bridge0: port 3(netdevsim0) entered blocking state [ 584.981781][ T8352] bridge0: port 3(netdevsim0) entered forwarding state [ 585.058253][ T8352] netlink: 'syz.4.619': attribute type 10 has an invalid length. [ 585.092627][ T8352] bridge0: port 3(netdevsim0) entered disabled state [ 585.099523][ T8352] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.107143][ T8352] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.118442][ T8352] bridge0: port 3(netdevsim0) entered blocking state [ 585.125316][ T8352] bridge0: port 3(netdevsim0) entered forwarding state [ 585.132456][ T8352] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.139588][ T8352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.147052][ T8352] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.154225][ T8352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.166081][ T8352] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 591.268562][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 593.152114][ T8] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 593.345251][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 593.371738][ T8] usb 4-1: device descriptor read/64, error -71 [ 594.629691][ T8386] FAULT_INJECTION: forcing a failure. [ 594.629691][ T8386] name failslab, interval 1, probability 0, space 0, times 0 [ 594.642502][ T8386] CPU: 0 PID: 8386 Comm: syz.0.641 Not tainted syzkaller #0 [ 594.649802][ T8386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 594.659886][ T8386] Call Trace: [ 594.663178][ T8386] [ 594.666122][ T8386] dump_stack_lvl+0x18c/0x250 [ 594.670840][ T8386] ? show_regs_print_info+0x20/0x20 [ 594.676052][ T8386] ? load_image+0x420/0x420 [ 594.680575][ T8386] ? __lock_acquire+0x7eb0/0x7eb0 [ 594.685637][ T8386] should_fail_ex+0x394/0x4c0 [ 594.690343][ T8386] should_failslab+0x9/0x20 [ 594.694864][ T8386] slab_pre_alloc_hook+0x59/0x300 [ 594.699896][ T8386] ? tty_ldisc_setup+0xbd/0x240 [ 594.704761][ T8386] ? tty_init_dev+0x275/0x4c0 [ 594.709451][ T8386] ? ptmx_open+0xdf/0x2c0 [ 594.713799][ T8386] kmem_cache_alloc_node+0x5e/0x310 [ 594.719017][ T8386] ? alloc_vmap_area+0x1b4/0x1e50 [ 594.724063][ T8386] alloc_vmap_area+0x1b4/0x1e50 [ 594.728967][ T8386] ? vm_map_ram+0xcf0/0xcf0 [ 594.733490][ T8386] ? rcu_is_watching+0x15/0xb0 [ 594.738282][ T8386] __get_vm_area_node+0x162/0x370 [ 594.743340][ T8386] __vmalloc_node_range+0x36f/0x1320 [ 594.748667][ T8386] ? n_tty_open+0x1d/0x150 [ 594.753123][ T8386] ? lockdep_hardirqs_on+0x98/0x150 [ 594.758354][ T8386] ? free_vm_area+0x50/0x50 [ 594.762891][ T8386] ? __might_sleep+0xe0/0xe0 [ 594.767512][ T8386] ? n_tty_open+0x1d/0x150 [ 594.771943][ T8386] vzalloc+0x79/0x90 [ 594.775878][ T8386] ? n_tty_open+0x1d/0x150 [ 594.780352][ T8386] n_tty_open+0x1d/0x150 [ 594.784636][ T8386] tty_ldisc_setup+0xbd/0x240 [ 594.789355][ T8386] tty_init_dev+0x275/0x4c0 [ 594.793883][ T8386] ptmx_open+0xdf/0x2c0 [ 594.798335][ T8386] ? pty_start+0x140/0x140 [ 594.802769][ T8386] chrdev_open+0x58c/0x600 [ 594.807230][ T8386] ? cd_forget+0x160/0x160 [ 594.811667][ T8386] ? fsnotify_perm+0x3ed/0x5e0 [ 594.816472][ T8386] do_dentry_open+0x880/0x14b0 [ 594.821254][ T8386] ? cd_forget+0x160/0x160 [ 594.825703][ T8386] path_openat+0x284f/0x3270 [ 594.830320][ T8386] ? do_sys_openat2+0xda/0x1d0 [ 594.835099][ T8386] ? __x64_sys_openat+0x139/0x160 [ 594.840141][ T8386] ? verify_lock_unused+0x140/0x140 [ 594.845353][ T8386] ? do_filp_open+0x430/0x430 [ 594.850055][ T8386] do_filp_open+0x1f2/0x430 [ 594.854600][ T8386] ? vfs_tmpfile+0x620/0x620 [ 594.859232][ T8386] ? _raw_spin_unlock+0x28/0x40 [ 594.864102][ T8386] ? alloc_fd+0x590/0x640 [ 594.868459][ T8386] do_sys_openat2+0x134/0x1d0 [ 594.873179][ T8386] ? do_sys_open+0xe0/0xe0 [ 594.877614][ T8386] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 594.883615][ T8386] ? lock_chain_count+0x20/0x20 [ 594.888484][ T8386] __x64_sys_openat+0x139/0x160 [ 594.893358][ T8386] do_syscall_64+0x55/0xb0 [ 594.897814][ T8386] ? clear_bhb_loop+0x40/0x90 [ 594.902505][ T8386] ? clear_bhb_loop+0x40/0x90 [ 594.907197][ T8386] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 594.913137][ T8386] RIP: 0033:0x7f52bb59f559 [ 594.917566][ T8386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 594.937185][ T8386] RSP: 002b:00007f52bc47a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 594.945610][ T8386] RAX: ffffffffffffffda RBX: 00007f52bb825fa0 RCX: 00007f52bb59f559 [ 594.953589][ T8386] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 594.961566][ T8386] RBP: 00007f52bb636b20 R08: 0000000000000000 R09: 0000000000000000 [ 594.969566][ T8386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 594.977544][ T8386] R13: 00007f52bb826038 R14: 00007f52bb825fa0 R15: 00007fff41e4e3f8 [ 594.985538][ T8386] [ 594.990363][ T8386] syz.0.641: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 595.005459][ T8386] CPU: 0 PID: 8386 Comm: syz.0.641 Not tainted syzkaller #0 [ 595.012757][ T8386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 595.022825][ T8386] Call Trace: [ 595.026118][ T8386] [ 595.029063][ T8386] dump_stack_lvl+0x18c/0x250 [ 595.033757][ T8386] ? show_regs_print_info+0x20/0x20 [ 595.038972][ T8386] ? load_image+0x420/0x420 [ 595.043494][ T8386] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 595.049934][ T8386] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 595.056454][ T8386] warn_alloc+0x246/0x340 [ 595.060806][ T8386] ? slab_free_freelist_hook+0x130/0x1a0 [ 595.066454][ T8386] ? zone_watermark_ok_safe+0x230/0x230 [ 595.072026][ T8386] ? __get_vm_area_node+0x17b/0x370 [ 595.077251][ T8386] ? __get_vm_area_node+0x17b/0x370 [ 595.082477][ T8386] __vmalloc_node_range+0x394/0x1320 [ 595.087797][ T8386] ? lockdep_hardirqs_on+0x98/0x150 [ 595.093023][ T8386] ? free_vm_area+0x50/0x50 [ 595.097544][ T8386] ? __might_sleep+0xe0/0xe0 [ 595.102154][ T8386] ? n_tty_open+0x1d/0x150 [ 595.106594][ T8386] vzalloc+0x79/0x90 [ 595.110510][ T8386] ? n_tty_open+0x1d/0x150 [ 595.114955][ T8386] n_tty_open+0x1d/0x150 [ 595.119237][ T8386] tty_ldisc_setup+0xbd/0x240 [ 595.123931][ T8386] tty_init_dev+0x275/0x4c0 [ 595.128454][ T8386] ptmx_open+0xdf/0x2c0 [ 595.132622][ T8386] ? pty_start+0x140/0x140 [ 595.137056][ T8386] chrdev_open+0x58c/0x600 [ 595.141490][ T8386] ? cd_forget+0x160/0x160 [ 595.145939][ T8386] ? fsnotify_perm+0x3ed/0x5e0 [ 595.150742][ T8386] do_dentry_open+0x880/0x14b0 [ 595.155546][ T8386] ? cd_forget+0x160/0x160 [ 595.159998][ T8386] path_openat+0x284f/0x3270 [ 595.164625][ T8386] ? do_sys_openat2+0xda/0x1d0 [ 595.169408][ T8386] ? __x64_sys_openat+0x139/0x160 [ 595.174463][ T8386] ? verify_lock_unused+0x140/0x140 [ 595.179683][ T8386] ? do_filp_open+0x430/0x430 [ 595.184384][ T8386] do_filp_open+0x1f2/0x430 [ 595.188907][ T8386] ? vfs_tmpfile+0x620/0x620 [ 595.193532][ T8386] ? _raw_spin_unlock+0x28/0x40 [ 595.198399][ T8386] ? alloc_fd+0x590/0x640 [ 595.202774][ T8386] do_sys_openat2+0x134/0x1d0 [ 595.207473][ T8386] ? do_sys_open+0xe0/0xe0 [ 595.211912][ T8386] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 595.217966][ T8386] ? lock_chain_count+0x20/0x20 [ 595.222835][ T8386] __x64_sys_openat+0x139/0x160 [ 595.227711][ T8386] do_syscall_64+0x55/0xb0 [ 595.232152][ T8386] ? clear_bhb_loop+0x40/0x90 [ 595.236840][ T8386] ? clear_bhb_loop+0x40/0x90 [ 595.241530][ T8386] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 595.247455][ T8386] RIP: 0033:0x7f52bb59f559 [ 595.251901][ T8386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.271522][ T8386] RSP: 002b:00007f52bc47a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 595.279949][ T8386] RAX: ffffffffffffffda RBX: 00007f52bb825fa0 RCX: 00007f52bb59f559 [ 595.287951][ T8386] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 595.295939][ T8386] RBP: 00007f52bb636b20 R08: 0000000000000000 R09: 0000000000000000 [ 595.303942][ T8386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 595.311921][ T8386] R13: 00007f52bb826038 R14: 00007f52bb825fa0 R15: 00007fff41e4e3f8 [ 595.319928][ T8386] [ 595.324389][ T8386] Mem-Info: [ 595.327520][ T8386] active_anon:54077 inactive_anon:1 isolated_anon:0 [ 595.327520][ T8386] active_file:18509 inactive_file:40164 isolated_file:0 [ 595.327520][ T8386] unevictable:768 dirty:144 writeback:0 [ 595.327520][ T8386] slab_reclaimable:11012 slab_unreclaimable:94468 [ 595.327520][ T8386] mapped:27174 shmem:49751 pagetables:604 [ 595.327520][ T8386] sec_pagetables:0 bounce:0 [ 595.327520][ T8386] kernel_misc_reclaimable:0 [ 595.327520][ T8386] free:1295631 free_pcp:3387 free_cma:0 [ 595.372927][ T8386] Node 0 active_anon:216308kB inactive_anon:4kB active_file:74036kB inactive_file:160452kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:108696kB dirty:576kB writeback:0kB shmem:197468kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10448kB pagetables:2416kB sec_pagetables:0kB all_unreclaimable? no [ 595.406912][ T8386] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 595.437464][ T8386] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 595.464633][ T8386] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 595.470418][ T8386] Node 0 DMA32 free:1266448kB boost:0kB min:34508kB low:43132kB high:51756kB reserved_highatomic:0KB active_anon:216268kB inactive_anon:4kB active_file:74036kB inactive_file:159372kB unevictable:1536kB writepending:576kB present:3129332kB managed:2569932kB mlocked:0kB bounce:0kB free_pcp:3012kB local_pcp:3012kB free_cma:0kB [ 595.502152][ T8386] lowmem_reserve[]: 0 0 1 1 1 [ 595.506890][ T8386] Node 0 Normal free:8kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:1080kB unevictable:0kB writepending:0kB present:1048576kB managed:1128kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 595.534255][ T8386] lowmem_reserve[]: 0 0 0 0 0 [ 595.538989][ T8386] Node 1 Normal free:3900708kB boost:0kB min:55380kB low:69224kB high:83068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:10528kB local_pcp:10528kB free_cma:0kB [ 595.568621][ T8] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 595.613088][ T8386] lowmem_reserve[]: 0 0 0 0 0 [ 595.617881][ T8386] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 595.630707][ T8386] Node 0 DMA32: 434*4kB (UM) 393*8kB (UE) 81*16kB (UME) 524*32kB (UME) 272*64kB (UME) 107*128kB (UME) 51*256kB (UME) 12*512kB (UME) 5*1024kB (U) 6*2048kB (UME) 287*4096kB (UM) = 1266208kB [ 595.649567][ T8386] Node 0 Normal: 2*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 595.661468][ T8386] Node 1 Normal: 251*4kB (UME) 47*8kB (UME) 38*16kB (UME) 163*32kB (UME) 60*64kB (UME) 18*128kB (UME) 1*256kB (M) 2*512kB (UE) 1*1024kB (U) 1*2048kB (E) 948*4096kB (M) = 3900708kB [ 595.679800][ T8386] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 595.689416][ T8386] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 595.700069][ T8386] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 595.709827][ T8386] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 595.719326][ T8386] 108165 total pagecache pages [ 595.724174][ T8386] 1 pages in swap cache [ 595.728340][ T8386] Free swap = 124984kB [ 595.732557][ T8386] Total swap = 124996kB [ 595.736716][ T8386] 2097051 pages RAM [ 595.740725][ T8386] 0 pages HighMem/MovableOnly [ 595.745875][ T8386] 421118 pages reserved [ 595.750047][ T8386] 0 pages cma reserved [ 595.754185][ T8386] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 595.833424][ T8] usb 4-1: device descriptor read/64, error -71 [ 595.983594][ T8] usb usb4-port1: attempt power cycle [ 603.216467][ T8408] exFAT-fs (nbd4): mounting with "discard" option, but the device does not support discard [ 604.434240][ T8408] syz.4.652: attempt to access beyond end of device [ 604.434240][ T8408] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 604.559938][ T8408] exFAT-fs (nbd4): unable to read boot sector [ 604.586247][ T8408] exFAT-fs (nbd4): failed to read boot sector [ 604.609060][ T8408] exFAT-fs (nbd4): failed to recognize exfat type [ 604.863358][ T78] rpcbind: server 127.0.0.1 not responding, timed out [ 605.952157][ T8] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 606.209534][ T8435] FAULT_INJECTION: forcing a failure. [ 606.209534][ T8435] name failslab, interval 1, probability 0, space 0, times 0 [ 606.496330][ T8] usb 1-1: unable to get BOS descriptor or descriptor too short [ 606.509838][ T8435] CPU: 0 PID: 8435 Comm: syz.4.662 Not tainted syzkaller #0 [ 606.517259][ T8435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 606.527332][ T8435] Call Trace: [ 606.530643][ T8435] [ 606.533587][ T8435] dump_stack_lvl+0x18c/0x250 [ 606.538301][ T8435] ? show_regs_print_info+0x20/0x20 [ 606.543516][ T8435] ? load_image+0x420/0x420 [ 606.548037][ T8435] ? __might_sleep+0xe0/0xe0 [ 606.552648][ T8435] ? __lock_acquire+0x7eb0/0x7eb0 [ 606.557689][ T8435] ? __dentry_path+0x46e/0x510 [ 606.562497][ T8435] should_fail_ex+0x394/0x4c0 [ 606.567198][ T8435] should_failslab+0x9/0x20 [ 606.571740][ T8435] slab_pre_alloc_hook+0x59/0x300 [ 606.576803][ T8435] ? tomoyo_encode+0x2ad/0x570 [ 606.581596][ T8435] ? tomoyo_encode+0x2ad/0x570 [ 606.586400][ T8435] __kmem_cache_alloc_node+0x53/0x250 [ 606.591802][ T8435] ? tomoyo_realpath_from_path+0x5c0/0x5c0 [ 606.597643][ T8435] ? tomoyo_encode+0x2ad/0x570 [ 606.602473][ T8435] __kmalloc+0xa7/0x240 [ 606.606673][ T8435] tomoyo_encode+0x2ad/0x570 [ 606.611294][ T8435] tomoyo_realpath_from_path+0x57c/0x5c0 [ 606.616965][ T8435] tomoyo_check_open_permission+0x224/0x460 [ 606.622891][ T8435] ? tomoyo_check_open_permission+0x1cf/0x460 [ 606.628999][ T8435] ? tomoyo_check_path_number_acl+0x280/0x280 [ 606.635113][ T8435] ? __asan_memset+0x22/0x40 [ 606.639772][ T8435] ? __rwlock_init+0x150/0x150 [ 606.644571][ T8435] ? tomoyo_file_open+0xed/0x180 [ 606.649554][ T8435] security_file_open+0x62/0xa0 [ 606.654470][ T8435] do_dentry_open+0x32b/0x14b0 [ 606.659279][ T8435] ? __asan_memcpy+0x40/0x70 [ 606.663912][ T8435] path_openat+0x284f/0x3270 [ 606.668552][ T8435] ? do_sys_openat2+0xda/0x1d0 [ 606.673338][ T8435] ? __x64_sys_openat+0x139/0x160 [ 606.678398][ T8435] ? verify_lock_unused+0x140/0x140 [ 606.683613][ T8435] ? do_filp_open+0x430/0x430 [ 606.688338][ T8435] do_filp_open+0x1f2/0x430 [ 606.692863][ T8435] ? vfs_tmpfile+0x620/0x620 [ 606.697508][ T8435] ? _raw_spin_unlock+0x28/0x40 [ 606.702391][ T8435] ? alloc_fd+0x590/0x640 [ 606.706754][ T8435] do_sys_openat2+0x134/0x1d0 [ 606.711546][ T8435] ? do_sys_open+0xe0/0xe0 [ 606.716005][ T8435] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 606.722016][ T8435] ? lock_chain_count+0x20/0x20 [ 606.726974][ T8435] __x64_sys_openat+0x139/0x160 [ 606.731862][ T8435] do_syscall_64+0x55/0xb0 [ 606.736290][ T8435] ? clear_bhb_loop+0x40/0x90 [ 606.740999][ T8435] ? clear_bhb_loop+0x40/0x90 [ 606.745686][ T8435] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 606.751614][ T8435] RIP: 0033:0x7f7e8dd9f559 [ 606.756038][ T8435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 606.775671][ T8435] RSP: 002b:00007f7e8ec0d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 606.784121][ T8435] RAX: ffffffffffffffda RBX: 00007f7e8e025fa0 RCX: 00007f7e8dd9f559 [ 606.792106][ T8435] RDX: 00000000000c8c00 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 606.800096][ T8435] RBP: 00007f7e8de36b20 R08: 0000000000000000 R09: 0000000000000000 [ 606.808091][ T8435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 606.816094][ T8435] R13: 00007f7e8e026038 R14: 00007f7e8e025fa0 R15: 00007ffeb6023168 [ 606.824108][ T8435] [ 608.315024][ T8] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 608.346324][ T8] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 253, changing to 7 [ 608.363105][ T32] rpcbind: server 127.0.0.1 not responding, timed out [ 608.399568][ T8] usb 1-1: string descriptor 0 read error: -22 [ 609.546812][ T8] usb 1-1: New USB device found, idVendor=04b4, idProduct=931f, bcdDevice= 0.40 [ 609.655750][ T8] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.722344][ T8] usb 1-1: can't set config #1, error -71 [ 610.064853][ T8] usb 1-1: USB disconnect, device number 6 [ 611.522526][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 612.142896][ T8435] ERROR: Out of memory at tomoyo_realpath_from_path. [ 613.894838][ T8452] kexec: Could not allocate control_code_buffer [ 614.075137][ T8470] netlink: 91 bytes leftover after parsing attributes in process `syz.3.673'. [ 616.373476][ T8495] FAULT_INJECTION: forcing a failure. [ 616.373476][ T8495] name failslab, interval 1, probability 0, space 0, times 0 [ 616.436538][ T8495] CPU: 0 PID: 8495 Comm: syz.3.684 Not tainted syzkaller #0 [ 616.443885][ T8495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 616.453956][ T8495] Call Trace: [ 616.457245][ T8495] [ 616.460188][ T8495] dump_stack_lvl+0x18c/0x250 [ 616.464884][ T8495] ? show_regs_print_info+0x20/0x20 [ 616.470093][ T8495] ? load_image+0x420/0x420 [ 616.474618][ T8495] ? __might_sleep+0xe0/0xe0 [ 616.479234][ T8495] ? __lock_acquire+0x7eb0/0x7eb0 [ 616.484278][ T8495] should_fail_ex+0x394/0x4c0 [ 616.489065][ T8495] should_failslab+0x9/0x20 [ 616.493639][ T8495] slab_pre_alloc_hook+0x59/0x300 [ 616.498692][ T8495] ? memcg_list_lru_alloc+0x335/0xb00 [ 616.504102][ T8495] ? memcg_list_lru_alloc+0x335/0xb00 [ 616.509517][ T8495] __kmem_cache_alloc_node+0x53/0x250 [ 616.514929][ T8495] ? memcg_list_lru_alloc+0x335/0xb00 [ 616.520373][ T8495] __kmalloc+0xa7/0x240 [ 616.524571][ T8495] memcg_list_lru_alloc+0x335/0xb00 [ 616.529809][ T8495] ? memcg_reparent_list_lrus+0x860/0x860 [ 616.535549][ T8495] ? get_obj_cgroup_from_current+0xd4/0x280 [ 616.541482][ T8495] ? get_obj_cgroup_from_current+0xd4/0x280 [ 616.547396][ T8495] slab_pre_alloc_hook+0x2ad/0x300 [ 616.552517][ T8495] ? slab_pre_alloc_hook+0xb1/0x300 [ 616.557725][ T8495] kmem_cache_alloc_lru+0x4d/0x2b0 [ 616.562859][ T8495] ? __d_alloc+0x31/0x710 [ 616.567201][ T8495] __d_alloc+0x31/0x710 [ 616.571369][ T8495] d_make_root+0x4a/0xe0 [ 616.575627][ T8495] shmem_fill_super+0xa93/0xf10 [ 616.580502][ T8495] ? shmem_reconfigure+0xc10/0xc10 [ 616.585630][ T8495] get_tree_nodev+0xb5/0x140 [ 616.590236][ T8495] vfs_get_tree+0x8c/0x280 [ 616.594677][ T8495] do_new_mount+0x24a/0xa40 [ 616.599224][ T8495] __se_sys_mount+0x2e7/0x3d0 [ 616.603920][ T8495] ? __x64_sys_mount+0xc0/0xc0 [ 616.608697][ T8495] ? lockdep_hardirqs_on+0x98/0x150 [ 616.613926][ T8495] ? __x64_sys_mount+0x20/0xc0 [ 616.618745][ T8495] do_syscall_64+0x55/0xb0 [ 616.623210][ T8495] ? clear_bhb_loop+0x40/0x90 [ 616.627909][ T8495] ? clear_bhb_loop+0x40/0x90 [ 616.632611][ T8495] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 616.638556][ T8495] RIP: 0033:0x7f7e9139f559 [ 616.642993][ T8495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 616.662623][ T8495] RSP: 002b:00007f7e922dc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 616.671049][ T8495] RAX: ffffffffffffffda RBX: 00007f7e91625fa0 RCX: 00007f7e9139f559 [ 616.679034][ T8495] RDX: 0000200000000300 RSI: 0000200000000180 RDI: 0000000000000000 [ 616.687037][ T8495] RBP: 00007f7e91436b20 R08: 0000200000000340 R09: 0000000000000000 [ 616.695050][ T8495] R10: 0000000002000080 R11: 0000000000000246 R12: 0000000000000000 [ 616.703033][ T8495] R13: 00007f7e91626038 R14: 00007f7e91625fa0 R15: 00007ffd6b673d78 [ 616.711047][ T8495] [ 617.184800][ T8502] CacheFiles: Empty directory specified [ 617.202200][ T8502] CacheFiles: No cache directory specified [ 617.361665][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 617.395340][ T8493] kexec: Could not allocate control_code_buffer [ 621.740487][ T8524] binder: 8522:8524 ioctl c0306201 0 returned -14 [ 623.476475][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 623.893339][ T8538] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.699'. [ 625.602359][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.608772][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 635.205974][ T8597] FAULT_INJECTION: forcing a failure. [ 635.205974][ T8597] name failslab, interval 1, probability 0, space 0, times 0 [ 635.218726][ T8597] CPU: 0 PID: 8597 Comm: syz.1.720 Not tainted syzkaller #0 [ 635.226023][ T8597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 635.236114][ T8597] Call Trace: [ 635.239411][ T8597] [ 635.242374][ T8597] dump_stack_lvl+0x18c/0x250 [ 635.247094][ T8597] ? show_regs_print_info+0x20/0x20 [ 635.252330][ T8597] ? load_image+0x420/0x420 [ 635.256854][ T8597] ? __lock_acquire+0x7eb0/0x7eb0 [ 635.261901][ T8597] should_fail_ex+0x394/0x4c0 [ 635.266617][ T8597] should_failslab+0x9/0x20 [ 635.271140][ T8597] slab_pre_alloc_hook+0x59/0x300 [ 635.276198][ T8597] ? tty_ldisc_setup+0xbd/0x240 [ 635.281062][ T8597] ? tty_init_dev+0x275/0x4c0 [ 635.285769][ T8597] ? ptmx_open+0xdf/0x2c0 [ 635.290388][ T8597] kmem_cache_alloc_node+0x5e/0x310 [ 635.295616][ T8597] ? alloc_vmap_area+0x1b4/0x1e50 [ 635.300663][ T8597] alloc_vmap_area+0x1b4/0x1e50 [ 635.305553][ T8597] ? vm_map_ram+0xcf0/0xcf0 [ 635.310078][ T8597] ? rcu_is_watching+0x15/0xb0 [ 635.315124][ T8597] __get_vm_area_node+0x162/0x370 [ 635.320182][ T8597] __vmalloc_node_range+0x36f/0x1320 [ 635.325509][ T8597] ? n_tty_open+0x1d/0x150 [ 635.330036][ T8597] ? lockdep_hardirqs_on+0x98/0x150 [ 635.335264][ T8597] ? free_vm_area+0x50/0x50 [ 635.339783][ T8597] ? __might_sleep+0xe0/0xe0 [ 635.344390][ T8597] ? n_tty_open+0x1d/0x150 [ 635.348835][ T8597] vzalloc+0x79/0x90 [ 635.352750][ T8597] ? n_tty_open+0x1d/0x150 [ 635.357287][ T8597] n_tty_open+0x1d/0x150 [ 635.361551][ T8597] tty_ldisc_setup+0xbd/0x240 [ 635.366323][ T8597] tty_init_dev+0x275/0x4c0 [ 635.370916][ T8597] ptmx_open+0xdf/0x2c0 [ 635.375111][ T8597] ? pty_start+0x140/0x140 [ 635.379585][ T8597] chrdev_open+0x58c/0x600 [ 635.384120][ T8597] ? cd_forget+0x160/0x160 [ 635.388663][ T8597] ? fsnotify_perm+0x3ed/0x5e0 [ 635.393476][ T8597] do_dentry_open+0x880/0x14b0 [ 635.398276][ T8597] ? cd_forget+0x160/0x160 [ 635.402722][ T8597] path_openat+0x284f/0x3270 [ 635.407350][ T8597] ? do_sys_openat2+0xda/0x1d0 [ 635.412140][ T8597] ? __x64_sys_openat+0x139/0x160 [ 635.417187][ T8597] ? verify_lock_unused+0x140/0x140 [ 635.422407][ T8597] ? do_filp_open+0x430/0x430 [ 635.427137][ T8597] do_filp_open+0x1f2/0x430 [ 635.431664][ T8597] ? vfs_tmpfile+0x620/0x620 [ 635.436286][ T8597] ? _raw_spin_unlock+0x28/0x40 [ 635.441155][ T8597] ? alloc_fd+0x590/0x640 [ 635.445531][ T8597] do_sys_openat2+0x134/0x1d0 [ 635.450234][ T8597] ? do_sys_open+0xe0/0xe0 [ 635.454672][ T8597] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 635.460676][ T8597] ? lock_chain_count+0x20/0x20 [ 635.465547][ T8597] __x64_sys_openat+0x139/0x160 [ 635.470424][ T8597] do_syscall_64+0x55/0xb0 [ 635.474856][ T8597] ? clear_bhb_loop+0x40/0x90 [ 635.479545][ T8597] ? clear_bhb_loop+0x40/0x90 [ 635.484333][ T8597] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 635.490256][ T8597] RIP: 0033:0x7fd1a779f559 [ 635.494755][ T8597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.514495][ T8597] RSP: 002b:00007fd1a8634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 635.522935][ T8597] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa0 RCX: 00007fd1a779f559 [ 635.530942][ T8597] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 635.538932][ T8597] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 635.546939][ T8597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.554940][ T8597] R13: 00007fd1a7a26038 R14: 00007fd1a7a25fa0 R15: 00007fff6e6c51a8 [ 635.562944][ T8597] [ 635.567933][ T8597] syz.1.720: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 635.585062][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 635.613071][ T8597] CPU: 0 PID: 8597 Comm: syz.1.720 Not tainted syzkaller #0 [ 635.620424][ T8597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 635.630524][ T8597] Call Trace: [ 635.633823][ T8597] [ 635.636788][ T8597] dump_stack_lvl+0x18c/0x250 [ 635.641506][ T8597] ? show_regs_print_info+0x20/0x20 [ 635.646740][ T8597] ? load_image+0x420/0x420 [ 635.651281][ T8597] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 635.657739][ T8597] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 635.664270][ T8597] warn_alloc+0x246/0x340 [ 635.668630][ T8597] ? slab_free_freelist_hook+0x130/0x1a0 [ 635.674281][ T8597] ? zone_watermark_ok_safe+0x230/0x230 [ 635.679928][ T8597] ? __get_vm_area_node+0x17b/0x370 [ 635.685159][ T8597] ? __get_vm_area_node+0x17b/0x370 [ 635.690386][ T8597] __vmalloc_node_range+0x394/0x1320 [ 635.695699][ T8597] ? lockdep_hardirqs_on+0x98/0x150 [ 635.700947][ T8597] ? free_vm_area+0x50/0x50 [ 635.705474][ T8597] ? __might_sleep+0xe0/0xe0 [ 635.710091][ T8597] ? n_tty_open+0x1d/0x150 [ 635.714528][ T8597] vzalloc+0x79/0x90 [ 635.718446][ T8597] ? n_tty_open+0x1d/0x150 [ 635.722882][ T8597] n_tty_open+0x1d/0x150 [ 635.727146][ T8597] tty_ldisc_setup+0xbd/0x240 [ 635.731838][ T8597] tty_init_dev+0x275/0x4c0 [ 635.736376][ T8597] ptmx_open+0xdf/0x2c0 [ 635.740554][ T8597] ? pty_start+0x140/0x140 [ 635.744989][ T8597] chrdev_open+0x58c/0x600 [ 635.749445][ T8597] ? cd_forget+0x160/0x160 [ 635.753904][ T8597] ? fsnotify_perm+0x3ed/0x5e0 [ 635.758714][ T8597] do_dentry_open+0x880/0x14b0 [ 635.763515][ T8597] ? cd_forget+0x160/0x160 [ 635.767958][ T8597] path_openat+0x284f/0x3270 [ 635.772581][ T8597] ? do_sys_openat2+0xda/0x1d0 [ 635.777375][ T8597] ? __x64_sys_openat+0x139/0x160 [ 635.782423][ T8597] ? verify_lock_unused+0x140/0x140 [ 635.787657][ T8597] ? do_filp_open+0x430/0x430 [ 635.792364][ T8597] do_filp_open+0x1f2/0x430 [ 635.796908][ T8597] ? vfs_tmpfile+0x620/0x620 [ 635.801572][ T8597] ? _raw_spin_unlock+0x28/0x40 [ 635.806436][ T8597] ? alloc_fd+0x590/0x640 [ 635.810797][ T8597] do_sys_openat2+0x134/0x1d0 [ 635.815495][ T8597] ? do_sys_open+0xe0/0xe0 [ 635.819927][ T8597] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 635.825953][ T8597] ? lock_chain_count+0x20/0x20 [ 635.830830][ T8597] __x64_sys_openat+0x139/0x160 [ 635.835889][ T8597] do_syscall_64+0x55/0xb0 [ 635.840319][ T8597] ? clear_bhb_loop+0x40/0x90 [ 635.845033][ T8597] ? clear_bhb_loop+0x40/0x90 [ 635.849738][ T8597] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 635.855681][ T8597] RIP: 0033:0x7fd1a779f559 [ 635.860111][ T8597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.879733][ T8597] RSP: 002b:00007fd1a8634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 635.888167][ T8597] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa0 RCX: 00007fd1a779f559 [ 635.896160][ T8597] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 635.904144][ T8597] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 635.912144][ T8597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.920145][ T8597] R13: 00007fd1a7a26038 R14: 00007fd1a7a25fa0 R15: 00007fff6e6c51a8 [ 635.928251][ T8597] [ 635.932881][ T8597] Mem-Info: [ 635.936051][ T8597] active_anon:41570 inactive_anon:1 isolated_anon:0 [ 635.936051][ T8597] active_file:18509 inactive_file:40180 isolated_file:0 [ 635.936051][ T8597] unevictable:768 dirty:148 writeback:0 [ 635.936051][ T8597] slab_reclaimable:11307 slab_unreclaimable:93455 [ 635.936051][ T8597] mapped:27190 shmem:36678 pagetables:621 [ 635.936051][ T8597] sec_pagetables:0 bounce:0 [ 635.936051][ T8597] kernel_misc_reclaimable:0 [ 635.936051][ T8597] free:1310064 free_pcp:2886 free_cma:0 [ 635.982787][ T8597] Node 0 active_anon:166280kB inactive_anon:4kB active_file:74036kB inactive_file:160516kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:108760kB dirty:592kB writeback:0kB shmem:145176kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10448kB pagetables:2484kB sec_pagetables:0kB all_unreclaimable? no [ 636.015998][ T8597] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 636.047699][ T8597] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 636.074901][ T8597] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 636.080676][ T8597] Node 0 DMA32 free:1324180kB boost:0kB min:34508kB low:43132kB high:51756kB reserved_highatomic:0KB active_anon:166240kB inactive_anon:4kB active_file:74036kB inactive_file:159436kB unevictable:1536kB writepending:592kB present:3129332kB managed:2569932kB mlocked:0kB bounce:0kB free_pcp:1004kB local_pcp:1004kB free_cma:0kB [ 636.111227][ T8597] lowmem_reserve[]: 0 0 1 1 1 [ 636.115991][ T8597] Node 0 Normal free:8kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:1080kB unevictable:0kB writepending:0kB present:1048576kB managed:1128kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 636.144571][ T8597] lowmem_reserve[]: 0 0 0 0 0 [ 636.149319][ T8597] Node 1 Normal free:3900708kB boost:0kB min:55380kB low:69224kB high:83068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:10528kB local_pcp:10528kB free_cma:0kB [ 636.178887][ T8597] lowmem_reserve[]: 0 0 0 0 0 [ 636.183653][ T8597] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 636.196376][ T8597] Node 0 DMA32: 903*4kB (UE) 499*8kB (U) 136*16kB (UM) 257*32kB (UE) 77*64kB (UE) 66*128kB (UME) 38*256kB (UME) 72*512kB (UME) 39*1024kB (UM) 17*2048kB (UME) 286*4096kB (M) = 1324180kB [ 636.214894][ T8597] Node 0 Normal: 2*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 636.226820][ T8597] Node 1 Normal: 251*4kB (UME) 47*8kB (UME) 38*16kB (UME) 163*32kB (UME) 60*64kB (UME) 18*128kB (UME) 1*256kB (M) 2*512kB (UE) 1*1024kB (U) 1*2048kB (E) 948*4096kB (M) = 3900708kB [ 636.244805][ T8597] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 636.255698][ T8597] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 636.265077][ T8597] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 636.274683][ T8597] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 636.284029][ T8597] 95368 total pagecache pages [ 636.288719][ T8597] 1 pages in swap cache [ 636.293005][ T8597] Free swap = 124984kB [ 636.297169][ T8597] Total swap = 124996kB [ 636.301335][ T8597] 2097051 pages RAM [ 636.305225][ T8597] 0 pages HighMem/MovableOnly [ 636.309909][ T8597] 421118 pages reserved [ 636.314102][ T8597] 0 pages cma reserved [ 636.318203][ T8597] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 637.322354][ T5899] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 637.566499][ T5899] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 637.582744][ T5899] usb 4-1: config 0 has no interface number 0 [ 637.613483][ T5899] usb 4-1: config 0 interface 41 has no altsetting 0 [ 637.643392][ T8606] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 637.658914][ T5899] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 637.680808][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.731320][ T5899] usb 4-1: Product: syz [ 637.741734][ T5899] usb 4-1: Manufacturer: syz [ 637.772072][ T5899] usb 4-1: SerialNumber: syz [ 637.802013][ T5899] usb 4-1: config 0 descriptor?? [ 640.648251][ T5899] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 642.011139][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 642.965869][ T8633] FAULT_INJECTION: forcing a failure. [ 642.965869][ T8633] name failslab, interval 1, probability 0, space 0, times 0 [ 642.978640][ T8633] CPU: 0 PID: 8633 Comm: syz.1.732 Not tainted syzkaller #0 [ 642.985952][ T8633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 642.996042][ T8633] Call Trace: [ 642.999337][ T8633] [ 643.002283][ T8633] dump_stack_lvl+0x18c/0x250 [ 643.006997][ T8633] ? show_regs_print_info+0x20/0x20 [ 643.012212][ T8633] ? load_image+0x420/0x420 [ 643.016733][ T8633] ? __lock_acquire+0x7eb0/0x7eb0 [ 643.021778][ T8633] should_fail_ex+0x394/0x4c0 [ 643.026489][ T8633] should_failslab+0x9/0x20 [ 643.031028][ T8633] slab_pre_alloc_hook+0x59/0x300 [ 643.036074][ T8633] ? tty_ldisc_setup+0xbd/0x240 [ 643.040937][ T8633] ? tty_init_dev+0x275/0x4c0 [ 643.045627][ T8633] ? ptmx_open+0xdf/0x2c0 [ 643.049975][ T8633] kmem_cache_alloc_node+0x5e/0x310 [ 643.055194][ T8633] ? alloc_vmap_area+0x1b4/0x1e50 [ 643.060240][ T8633] alloc_vmap_area+0x1b4/0x1e50 [ 643.065137][ T8633] ? vm_map_ram+0xcf0/0xcf0 [ 643.069664][ T8633] ? rcu_is_watching+0x15/0xb0 [ 643.074457][ T8633] __get_vm_area_node+0x162/0x370 [ 643.079511][ T8633] __vmalloc_node_range+0x36f/0x1320 [ 643.084820][ T8633] ? n_tty_open+0x1d/0x150 [ 643.089263][ T8633] ? lockdep_hardirqs_on+0x98/0x150 [ 643.094506][ T8633] ? free_vm_area+0x50/0x50 [ 643.099027][ T8633] ? __might_sleep+0xe0/0xe0 [ 643.103650][ T8633] ? n_tty_open+0x1d/0x150 [ 643.108089][ T8633] vzalloc+0x79/0x90 [ 643.112000][ T8633] ? n_tty_open+0x1d/0x150 [ 643.116435][ T8633] n_tty_open+0x1d/0x150 [ 643.120702][ T8633] tty_ldisc_setup+0xbd/0x240 [ 643.125399][ T8633] tty_init_dev+0x275/0x4c0 [ 643.129926][ T8633] ptmx_open+0xdf/0x2c0 [ 643.134112][ T8633] ? pty_start+0x140/0x140 [ 643.138545][ T8633] chrdev_open+0x58c/0x600 [ 643.143067][ T8633] ? cd_forget+0x160/0x160 [ 643.147511][ T8633] ? fsnotify_perm+0x3ed/0x5e0 [ 643.152310][ T8633] do_dentry_open+0x880/0x14b0 [ 643.157095][ T8633] ? cd_forget+0x160/0x160 [ 643.161553][ T8633] path_openat+0x284f/0x3270 [ 643.166171][ T8633] ? do_sys_openat2+0xda/0x1d0 [ 643.170959][ T8633] ? __x64_sys_openat+0x139/0x160 [ 643.176001][ T8633] ? verify_lock_unused+0x140/0x140 [ 643.181215][ T8633] ? do_filp_open+0x430/0x430 [ 643.185926][ T8633] do_filp_open+0x1f2/0x430 [ 643.190448][ T8633] ? vfs_tmpfile+0x620/0x620 [ 643.195066][ T8633] ? _raw_spin_unlock+0x28/0x40 [ 643.199948][ T8633] ? alloc_fd+0x590/0x640 [ 643.204304][ T8633] do_sys_openat2+0x134/0x1d0 [ 643.209000][ T8633] ? do_sys_open+0xe0/0xe0 [ 643.213432][ T8633] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 643.219430][ T8633] ? lock_chain_count+0x20/0x20 [ 643.224296][ T8633] __x64_sys_openat+0x139/0x160 [ 643.229170][ T8633] do_syscall_64+0x55/0xb0 [ 643.233611][ T8633] ? clear_bhb_loop+0x40/0x90 [ 643.238311][ T8633] ? clear_bhb_loop+0x40/0x90 [ 643.243002][ T8633] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 643.248915][ T8633] RIP: 0033:0x7fd1a779f559 [ 643.253355][ T8633] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.272974][ T8633] RSP: 002b:00007fd1a8634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 643.281402][ T8633] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa0 RCX: 00007fd1a779f559 [ 643.289384][ T8633] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 643.297365][ T8633] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 643.305346][ T8633] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 643.313328][ T8633] R13: 00007fd1a7a26038 R14: 00007fd1a7a25fa0 R15: 00007fff6e6c51a8 [ 643.321355][ T8633] [ 643.326159][ T8633] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 643.524066][ T5899] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 643.565374][ T5899] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 643.617265][ T5899] CoreChips: probe of 4-1:0.41 failed with error -71 [ 643.839906][ T51] Bluetooth: hci4: hcon ffff888031b72000 sent 1 < count 65535 [ 643.842233][ T5899] usb 4-1: USB disconnect, device number 16 [ 643.848269][ T51] Bluetooth: hci4: hcon ffff888031b72000 sent 0 < count 253 [ 645.779561][ T27] audit: type=1326 audit(1792547445.043:2): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.790828][ T8640] netlink: 12 bytes leftover after parsing attributes in process `syz.3.734'. [ 645.812071][ T27] audit: type=1326 audit(1792547445.043:3): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.841273][ T27] audit: type=1326 audit(1792547445.043:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.883107][ T27] audit: type=1326 audit(1792547445.043:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.912654][ T27] audit: type=1326 audit(1792547445.043:6): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=225 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.941976][ T27] audit: type=1326 audit(1792547445.053:7): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 645.971209][ T27] audit: type=1326 audit(1792547445.053:8): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 646.007496][ T27] audit: type=1326 audit(1792547445.053:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 646.036691][ T27] audit: type=1326 audit(1792547445.053:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 646.066110][ T27] audit: type=1326 audit(1792547445.053:11): auid=4294967295 uid=60928 gid=0 ses=4294967295 subj=unconfined pid=8638 comm="syz.3.734" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7e9139f559 code=0x7ffc0000 [ 651.662275][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 655.740969][ T8693] fuse: Bad value for 'fd' [ 657.422480][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 662.782066][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 663.082186][ T7532] IPVS: starting estimator thread 0... [ 663.192190][ T8732] IPVS: using max 15 ests per chain, 36000 per kthread [ 663.243873][ T8731] syzkaller1: entered promiscuous mode [ 663.249417][ T8731] syzkaller1: entered allmulticast mode [ 670.108189][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 671.422448][ T1085] rpcbind: server 127.0.0.1 not responding, timed out [ 675.121986][ T8769] syz.1.767 uses obsolete (PF_INET,SOCK_PACKET) [ 679.944750][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 681.242083][ T8801] netlink: 12 bytes leftover after parsing attributes in process `syz.4.781'. [ 684.702002][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 684.848754][ T8827] program syz.1.796 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 686.172654][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.179143][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.353471][ T8833] nvmet: failed to open file /dev/null: (-22) [ 686.426005][ T8833] nvmet_tcp: address family 255 not supported [ 688.686237][ T8842] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 694.355068][ T8870] ip6erspan0: entered allmulticast mode [ 695.748817][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 700.866961][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 703.781992][ T5899] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 703.982025][ T5899] usb 4-1: Using ep0 maxpacket: 8 [ 703.997054][ T5899] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 704.018277][ T5899] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 704.062558][ T5899] usb 4-1: config 179 has no interface number 0 [ 705.195836][ T5899] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 706.971920][ T5899] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 707.521904][ T5899] usb 4-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 707.536771][ T8930] netlink: 'syz.1.828': attribute type 10 has an invalid length. [ 707.603203][ T5899] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 707.662177][ T5899] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 707.724446][ T5899] usb 4-1: can't set config #179, error -71 [ 707.742989][ T8941] netlink: 20 bytes leftover after parsing attributes in process `syz.3.830'. [ 707.762492][ T5899] usb 4-1: USB disconnect, device number 17 [ 712.492551][ T5899] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 712.701934][ T5899] usb 4-1: Using ep0 maxpacket: 8 [ 714.900415][ T5899] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 716.350061][ T5899] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 716.412204][ T5899] usb 4-1: config 179 has no interface number 0 [ 716.418624][ T5899] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 716.532479][ T5899] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 716.745999][ T5899] usb 4-1: config 179 interface 65 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 23 [ 717.087565][ T5899] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 717.128325][ T5899] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.168196][ T5899] usb 4-1: can't set config #179, error -71 [ 717.206861][ T5899] usb 4-1: USB disconnect, device number 18 [ 719.042906][ T9013] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.835'. [ 719.793634][ T9024] program syz.1.853 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 722.768879][ T9050] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.861'. [ 722.929551][ T9053] program syz.1.862 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 724.878459][ T9085] program syz.1.874 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 727.333645][ T9099] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.877'. [ 727.411976][ T5899] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 727.601903][ T5899] usb 5-1: Using ep0 maxpacket: 8 [ 727.618762][ T5899] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 727.643181][ T5899] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 727.811287][ T5899] usb 5-1: config 0 has no interface number 0 [ 727.824762][ T5899] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 727.854715][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 727.880180][ T9105] ieee802154 phy0 wpan0: encryption failed: -22 [ 728.055398][ T5899] usb 5-1: Product: syz [ 728.059646][ T5899] usb 5-1: Manufacturer: syz [ 728.083189][ T5899] usb 5-1: SerialNumber: syz [ 728.390099][ T5899] usb 5-1: config 0 descriptor?? [ 728.412824][ T5899] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 728.435777][ T5899] usb 5-1: No valid video chain found. [ 728.672722][ T5899] usb 5-1: USB disconnect, device number 3 [ 730.625792][ T9122] program syz.3.886 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 733.919502][ T9128] exFAT-fs (nbd0): mounting with "discard" option, but the device does not support discard [ 735.459105][ T9128] syz.0.888: attempt to access beyond end of device [ 735.459105][ T9128] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 735.522098][ T9128] exFAT-fs (nbd0): unable to read boot sector [ 735.551354][ T9128] exFAT-fs (nbd0): failed to read boot sector [ 735.754901][ T9128] exFAT-fs (nbd0): failed to recognize exfat type [ 736.081239][ T9132] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.890'. [ 738.626565][ T1102] rpcbind: server 127.0.0.1 not responding, timed out [ 742.431176][ T9164] program syz.1.898 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 742.604820][ T9166] ip6erspan0: entered allmulticast mode [ 744.560504][ T9169] exFAT-fs (nbd0): mounting with "discard" option, but the device does not support discard [ 746.444353][ T9169] syz.0.900: attempt to access beyond end of device [ 746.444353][ T9169] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 746.515052][ T9169] exFAT-fs (nbd0): unable to read boot sector [ 746.552273][ T9169] exFAT-fs (nbd0): failed to read boot sector [ 746.561939][ T9169] exFAT-fs (nbd0): failed to recognize exfat type [ 747.125572][ T9174] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.902'. [ 747.597074][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.606944][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.912096][ T9190] program syz.0.907 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 751.422045][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 753.804925][ T9213] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.914'. [ 755.641963][ T7532] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 755.921912][ T7532] usb 4-1: Using ep0 maxpacket: 16 [ 755.938422][ T7532] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 755.981250][ T7532] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 756.025190][ T7532] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 756.102253][ T7532] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 756.111335][ T7532] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 756.151919][ T7532] usb 4-1: Manufacturer: syz [ 756.192808][ T7532] usb 4-1: config 0 descriptor?? [ 756.408051][ T6349] usb 4-1: USB disconnect, device number 19 [ 756.630950][ T7532] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 756.821925][ T7532] usb 1-1: Using ep0 maxpacket: 8 [ 758.531106][ T7532] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 758.553178][ T7532] usb 1-1: config 179 has no interface number 0 [ 758.568959][ T7532] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 758.603591][ T7532] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 758.646806][ T7532] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 758.877741][ T9240] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.923'. [ 758.991944][ T7532] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 759.031882][ T7532] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 759.091936][ T7532] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 759.128192][ T7532] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.173955][ T9231] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 759.184593][ T7532] xpad: probe of 1-1:179.65 failed with error -5 [ 759.279451][ T6349] usb 1-1: USB disconnect, device number 7 [ 760.681990][ T7532] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 760.942970][ T7532] usb 2-1: Using ep0 maxpacket: 8 [ 760.968007][ T7532] usb 2-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 761.012010][ T7532] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.062461][ T7532] usb 2-1: Product: syz [ 761.066713][ T7532] usb 2-1: Manufacturer: syz [ 761.248175][ T9263] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.933'. [ 761.342048][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 761.351891][ T7532] usb 2-1: SerialNumber: syz [ 761.381198][ T7532] usb 2-1: config 0 descriptor?? [ 761.420043][ T7532] gspca_main: se401-2.14.0 probing 047d:5003 [ 761.834079][ T7532] gspca_se401: Wrong descriptor type [ 761.862050][ T5899] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 762.063665][ T7532] usb 2-1: USB disconnect, device number 8 [ 762.071892][ T5899] usb 5-1: Using ep0 maxpacket: 8 [ 762.093073][ T5899] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 762.112637][ T5899] usb 5-1: config 179 has no interface number 0 [ 762.131998][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 762.171954][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 762.212314][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 762.232326][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 762.269776][ T5899] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 762.307351][ T5899] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 762.336613][ T5899] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.374565][ T9270] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 762.411548][ T5899] xpad: probe of 5-1:179.65 failed with error -5 [ 762.696485][ T5899] usb 5-1: USB disconnect, device number 4 [ 763.860669][ T9296] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.943'. [ 767.373509][ T9325] netlink: 'syz.1.954': attribute type 29 has an invalid length. [ 767.381695][ T9325] netlink: 'syz.1.954': attribute type 29 has an invalid length. [ 767.422933][ T1085] rpcbind: server 127.0.0.1 not responding, timed out [ 767.465017][ T9325] netlink: 'syz.1.954': attribute type 29 has an invalid length. [ 767.512740][ T9325] netlink: 'syz.1.954': attribute type 29 has an invalid length. [ 771.820020][ T5899] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 772.007803][ T9359] FAULT_INJECTION: forcing a failure. [ 772.007803][ T9359] name fail_futex, interval 1, probability 0, space 0, times 1 [ 772.020974][ T5899] usb 5-1: Using ep0 maxpacket: 8 [ 772.041334][ T9359] CPU: 0 PID: 9359 Comm: syz.3.966 Not tainted syzkaller #0 [ 772.048752][ T9359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 772.058836][ T9359] Call Trace: [ 772.062135][ T9359] [ 772.065084][ T9359] dump_stack_lvl+0x18c/0x250 [ 772.069802][ T9359] ? show_regs_print_info+0x20/0x20 [ 772.075020][ T9359] ? load_image+0x420/0x420 [ 772.079540][ T9359] ? stack_trace_save+0xaa/0x100 [ 772.084534][ T9359] should_fail_ex+0x394/0x4c0 [ 772.089288][ T9359] get_futex_key+0x136/0x1030 [ 772.094036][ T9359] ? futex_setup_timer+0xc0/0xc0 [ 772.099052][ T9359] futex_wake+0x127/0x4f0 [ 772.103434][ T9359] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 772.109456][ T9359] ? futex_wake_mark+0x150/0x150 [ 772.114460][ T9359] ? lockdep_hardirqs_on+0x98/0x150 [ 772.119712][ T9359] do_futex+0x35d/0x3e0 [ 772.123916][ T9359] ? __ia32_sys_get_robust_list+0x110/0x110 [ 772.129858][ T9359] __se_sys_futex+0x3a9/0x440 [ 772.134583][ T9359] ? __x64_sys_futex+0xf0/0xf0 [ 772.139387][ T9359] ? __x64_sys_futex+0x21/0xf0 [ 772.144193][ T9359] do_syscall_64+0x55/0xb0 [ 772.148644][ T9359] ? clear_bhb_loop+0x40/0x90 [ 772.153400][ T9359] ? clear_bhb_loop+0x40/0x90 [ 772.158111][ T9359] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 772.164052][ T9359] RIP: 0033:0x7f7e9139f559 [ 772.168499][ T9359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 772.188165][ T9359] RSP: 002b:00007f7e922dc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 772.196621][ T9359] RAX: ffffffffffffffda RBX: 00007f7e91625fa8 RCX: 00007f7e9139f559 [ 772.204718][ T9359] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7e91625fac [ 772.212730][ T9359] RBP: 00007f7e91625fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 772.220728][ T9359] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 772.228723][ T9359] R13: 00007f7e91626038 R14: 00007ffd6b673c90 R15: 00007ffd6b673d78 [ 772.236742][ T9359] [ 772.302429][ T5899] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 772.310753][ T5899] usb 5-1: config 179 has no interface number 0 [ 772.331334][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 772.359486][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 772.394685][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 772.414695][ T5899] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 772.521881][ T5899] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 772.602981][ T5899] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 772.636391][ T5899] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.676396][ T9349] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 772.694916][ T5899] xpad: probe of 5-1:179.65 failed with error -5 [ 773.125277][ T5899] usb 5-1: USB disconnect, device number 5 [ 773.619726][ T9373] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.972'. [ 774.608019][ T9386] netlink: 120 bytes leftover after parsing attributes in process `syz.3.976'. [ 774.757794][ T9388] FAULT_INJECTION: forcing a failure. [ 774.757794][ T9388] name fail_futex, interval 1, probability 0, space 0, times 0 [ 774.797480][ T9390] program syz.4.979 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 774.809395][ T9388] CPU: 0 PID: 9388 Comm: syz.1.978 Not tainted syzkaller #0 [ 774.816729][ T9388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 774.826820][ T9388] Call Trace: [ 774.830129][ T9388] [ 774.833092][ T9388] dump_stack_lvl+0x18c/0x250 [ 774.837806][ T9388] ? show_regs_print_info+0x20/0x20 [ 774.843037][ T9388] ? load_image+0x420/0x420 [ 774.847577][ T9388] ? stack_trace_save+0xaa/0x100 [ 774.852564][ T9388] should_fail_ex+0x394/0x4c0 [ 774.857297][ T9388] get_futex_key+0x136/0x1030 [ 774.862044][ T9388] ? futex_setup_timer+0xc0/0xc0 [ 774.867033][ T9388] futex_wake+0x127/0x4f0 [ 774.871395][ T9388] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 774.877419][ T9388] ? futex_wake_mark+0x150/0x150 [ 774.882396][ T9388] ? lockdep_hardirqs_on+0x98/0x150 [ 774.887629][ T9388] do_futex+0x35d/0x3e0 [ 774.891848][ T9388] ? __ia32_sys_get_robust_list+0x110/0x110 [ 774.897797][ T9388] __se_sys_futex+0x3a9/0x440 [ 774.902507][ T9388] ? __x64_sys_futex+0xf0/0xf0 [ 774.907307][ T9388] ? __x64_sys_futex+0x21/0xf0 [ 774.912107][ T9388] do_syscall_64+0x55/0xb0 [ 774.916557][ T9388] ? clear_bhb_loop+0x40/0x90 [ 774.921271][ T9388] ? clear_bhb_loop+0x40/0x90 [ 774.925986][ T9388] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 774.931922][ T9388] RIP: 0033:0x7fd1a779f559 [ 774.936367][ T9388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.956003][ T9388] RSP: 002b:00007fd1a86340e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 774.964450][ T9388] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa8 RCX: 00007fd1a779f559 [ 774.972451][ T9388] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd1a7a25fac [ 774.980452][ T9388] RBP: 00007fd1a7a25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 774.988452][ T9388] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 774.996538][ T9388] R13: 00007fd1a7a26038 R14: 00007fff6e6c50c0 R15: 00007fff6e6c51a8 [ 775.004562][ T9388] [ 775.677629][ T9402] program syz.4.981 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 775.699465][ T9396] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3888013621 (31104108968 ns) > initial count (11812678656 ns). Using initial count to start timer. [ 775.781531][ T9404] kvm: requested 6704 ns i8254 timer period limited to 200000 ns [ 776.159571][ T9411] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.982'. [ 780.401950][ T8] usb 4-1: new low-speed USB device number 20 using dummy_hcd [ 780.488292][ T27] kauditd_printk_skb: 65 callbacks suppressed [ 780.488309][ T27] audit: type=1326 audit(1792547579.753:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.526249][ T27] audit: type=1326 audit(1792547579.753:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.558844][ T27] audit: type=1326 audit(1792547579.753:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.590523][ T27] audit: type=1326 audit(1792547579.763:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.640388][ T27] audit: type=1326 audit(1792547579.763:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.689879][ T27] audit: type=1326 audit(1792547579.763:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.730056][ T27] audit: type=1326 audit(1792547579.763:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.798338][ T27] audit: type=1326 audit(1792547579.763:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.863994][ T27] audit: type=1326 audit(1792547579.773:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 780.908788][ T27] audit: type=1326 audit(1792547579.773:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9462 comm="syz.1.1002" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd1a779f559 code=0x7ffc0000 [ 783.728272][ T8] usb 4-1: device descriptor read/all, error -71 [ 790.558662][ T9510] syzkaller1: entered promiscuous mode [ 791.649763][ T9510] syzkaller1: entered allmulticast mode [ 794.787744][ T9526] netlink: 'syz.3.1010': attribute type 10 has an invalid length. [ 796.668257][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 801.629108][ T9556] netlink: 'syz.0.1033': attribute type 10 has an invalid length. [ 802.082280][ T9568] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1026'. [ 807.738310][ T9585] FAULT_INJECTION: forcing a failure. [ 807.738310][ T9585] name failslab, interval 1, probability 0, space 0, times 0 [ 807.840279][ T9585] CPU: 0 PID: 9585 Comm: syz.4.1040 Not tainted syzkaller #0 [ 807.847717][ T9585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 807.857789][ T9585] Call Trace: [ 807.861092][ T9585] [ 807.864037][ T9585] dump_stack_lvl+0x18c/0x250 [ 807.868736][ T9585] ? show_regs_print_info+0x20/0x20 [ 807.873947][ T9585] ? load_image+0x420/0x420 [ 807.878490][ T9585] ? __might_sleep+0xe0/0xe0 [ 807.883115][ T9585] ? __lock_acquire+0x7eb0/0x7eb0 [ 807.888201][ T9585] should_fail_ex+0x394/0x4c0 [ 807.892934][ T9585] should_failslab+0x9/0x20 [ 807.897482][ T9585] slab_pre_alloc_hook+0x59/0x300 [ 807.902541][ T9585] ? sw_sync_debugfs_open+0xd3/0x310 [ 807.907860][ T9585] __kmem_cache_alloc_node+0x53/0x250 [ 807.913277][ T9585] ? sw_sync_debugfs_open+0xd3/0x310 [ 807.918591][ T9585] kmalloc_trace+0x2a/0xe0 [ 807.923042][ T9585] sw_sync_debugfs_open+0xd3/0x310 [ 807.928195][ T9585] ? sw_sync_ioctl+0xaa0/0xaa0 [ 807.933009][ T9585] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 807.938586][ T9585] ? __rwlock_init+0x150/0x150 [ 807.943385][ T9585] ? lockdown_is_locked_down+0x3a/0xe0 [ 807.948872][ T9585] ? sw_sync_ioctl+0xaa0/0xaa0 [ 807.953693][ T9585] open_proxy_open+0x306/0x4d0 [ 807.958495][ T9585] do_dentry_open+0x880/0x14b0 [ 807.963296][ T9585] ? debugfs_file_put+0xb0/0xb0 [ 807.968193][ T9585] path_openat+0x284f/0x3270 [ 807.972834][ T9585] ? do_sys_openat2+0xda/0x1d0 [ 807.977635][ T9585] ? __x64_sys_openat+0x139/0x160 [ 807.982724][ T9585] ? verify_lock_unused+0x140/0x140 [ 807.987958][ T9585] ? do_filp_open+0x430/0x430 [ 807.992681][ T9585] do_filp_open+0x1f2/0x430 [ 807.997228][ T9585] ? vfs_tmpfile+0x620/0x620 [ 808.001878][ T9585] ? _raw_spin_unlock+0x28/0x40 [ 808.006768][ T9585] ? alloc_fd+0x590/0x640 [ 808.011150][ T9585] do_sys_openat2+0x134/0x1d0 [ 808.015872][ T9585] ? do_sys_open+0xe0/0xe0 [ 808.020327][ T9585] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 808.026387][ T9585] ? lock_chain_count+0x20/0x20 [ 808.031307][ T9585] __x64_sys_openat+0x139/0x160 [ 808.036218][ T9585] do_syscall_64+0x55/0xb0 [ 808.040705][ T9585] ? clear_bhb_loop+0x40/0x90 [ 808.045413][ T9585] ? clear_bhb_loop+0x40/0x90 [ 808.050133][ T9585] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 808.056076][ T9585] RIP: 0033:0x7f7e8dd9f559 [ 808.060520][ T9585] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.080158][ T9585] RSP: 002b:00007f7e8ec0d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 808.088613][ T9585] RAX: ffffffffffffffda RBX: 00007f7e8e025fa0 RCX: 00007f7e8dd9f559 [ 808.096617][ T9585] RDX: 00000000000c8c00 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 808.104617][ T9585] RBP: 00007f7e8de36b20 R08: 0000000000000000 R09: 0000000000000000 [ 808.112614][ T9585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 808.120626][ T9585] R13: 00007f7e8e026038 R14: 00007f7e8e025fa0 R15: 00007ffeb6023168 [ 808.128647][ T9585] [ 809.103045][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.109447][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 814.587610][ T6349] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 814.694912][ T9621] FAULT_INJECTION: forcing a failure. [ 814.694912][ T9621] name failslab, interval 1, probability 0, space 0, times 0 [ 814.707953][ T9621] CPU: 0 PID: 9621 Comm: syz.4.1050 Not tainted syzkaller #0 [ 814.715366][ T9621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 814.725463][ T9621] Call Trace: [ 814.728768][ T9621] [ 814.731729][ T9621] dump_stack_lvl+0x18c/0x250 [ 814.736494][ T9621] ? show_regs_print_info+0x20/0x20 [ 814.741746][ T9621] ? load_image+0x420/0x420 [ 814.746352][ T9621] ? __might_sleep+0xe0/0xe0 [ 814.750998][ T9621] ? __lock_acquire+0x7eb0/0x7eb0 [ 814.756071][ T9621] ? __mutex_lock+0x30d/0xc80 [ 814.760797][ T9621] should_fail_ex+0x394/0x4c0 [ 814.765523][ T9621] should_failslab+0x9/0x20 [ 814.770089][ T9621] slab_pre_alloc_hook+0x59/0x300 [ 814.775151][ T9621] ? __asan_memset+0x22/0x40 [ 814.779785][ T9621] ? loopback_open+0x127/0xa50 [ 814.784593][ T9621] __kmem_cache_alloc_node+0x53/0x250 [ 814.790041][ T9621] ? loopback_open+0x127/0xa50 [ 814.794845][ T9621] kmalloc_trace+0x2a/0xe0 [ 814.799308][ T9621] loopback_open+0x127/0xa50 [ 814.803938][ T9621] ? snd_pcm_attach_substream+0x841/0xad0 [ 814.809706][ T9621] snd_pcm_open_substream+0x1023/0x2540 [ 814.815305][ T9621] ? snd_pcm_drop+0x250/0x250 [ 814.820122][ T9621] snd_pcm_open+0x1d3/0x600 [ 814.824709][ T9621] ? snd_pcm_mmap_control_fault+0x270/0x270 [ 814.830657][ T9621] ? do_task_dead+0xd0/0xd0 [ 814.835214][ T9621] snd_pcm_playback_open+0x6f/0xd0 [ 814.840640][ T9621] chrdev_open+0x58c/0x600 [ 814.845102][ T9621] ? cd_forget+0x160/0x160 [ 814.849562][ T9621] ? fsnotify_perm+0x3ed/0x5e0 [ 814.854372][ T9621] do_dentry_open+0x880/0x14b0 [ 814.859206][ T9621] ? cd_forget+0x160/0x160 [ 814.863662][ T9621] path_openat+0x284f/0x3270 [ 814.868304][ T9621] ? do_sys_openat2+0xda/0x1d0 [ 814.873101][ T9621] ? __x64_sys_openat+0x139/0x160 [ 814.878169][ T9621] ? verify_lock_unused+0x140/0x140 [ 814.883406][ T9621] ? do_filp_open+0x430/0x430 [ 814.888156][ T9621] do_filp_open+0x1f2/0x430 [ 814.892696][ T9621] ? vfs_tmpfile+0x620/0x620 [ 814.897357][ T9621] ? _raw_spin_unlock+0x28/0x40 [ 814.902251][ T9621] ? alloc_fd+0x590/0x640 [ 814.906626][ T9621] do_sys_openat2+0x134/0x1d0 [ 814.911378][ T9621] ? do_sys_open+0xe0/0xe0 [ 814.915921][ T9621] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 814.921943][ T9621] ? lock_chain_count+0x20/0x20 [ 814.926834][ T9621] ? lock_chain_count+0x20/0x20 [ 814.931721][ T9621] __x64_sys_openat+0x139/0x160 [ 814.936622][ T9621] do_syscall_64+0x55/0xb0 [ 814.941069][ T9621] ? clear_bhb_loop+0x40/0x90 [ 814.945781][ T9621] ? clear_bhb_loop+0x40/0x90 [ 814.950493][ T9621] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 814.956435][ T9621] RIP: 0033:0x7f7e8dd5fd8e [ 814.960907][ T9621] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 814.980554][ T9621] RSP: 002b:00007f7e8ec0cb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 814.989014][ T9621] RAX: ffffffffffffffda RBX: 00007f7e8ec0d6c0 RCX: 00007f7e8dd5fd8e [ 814.997017][ T9621] RDX: 0000000000000002 RSI: 00007f7e8ec0cc00 RDI: ffffffffffffff9c [ 815.005022][ T9621] RBP: 00007f7e8ec0cc00 R08: 0000000000000000 R09: 0000000000000000 [ 815.013023][ T9621] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 815.021027][ T9621] R13: 00007f7e8e026038 R14: 00007f7e8e025fa0 R15: 00007ffeb6023168 [ 815.029136][ T9621] [ 816.300112][ T9633] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1051'. [ 820.222109][ T8051] Bluetooth: hci4: command 0x0406 tx timeout [ 820.299682][ T8] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 820.512054][ T8] usb 4-1: Using ep0 maxpacket: 8 [ 820.527148][ T8] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 820.546548][ T8] usb 4-1: config 179 has no interface number 0 [ 820.576480][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 820.614697][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 820.701058][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 820.743564][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 820.791879][ T8] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 820.842099][ T8] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 820.881237][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 820.927613][ T9651] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 821.238085][ T6349] usb 4-1: USB disconnect, device number 22 [ 821.238144][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 821.252496][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 822.093859][ T9680] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.1070'. [ 824.231032][ T8051] Bluetooth: hci2: unexpected event for opcode 0x040d [ 826.123901][ T9714] jffs2: notice: (9714) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 826.516377][ T9719] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1086'. [ 827.012315][ T8] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 827.225883][ T6349] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 827.233893][ T8] usb 2-1: Using ep0 maxpacket: 16 [ 827.253225][ T8] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 827.291407][ T8] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 827.317564][ T8] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 827.346076][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 827.540798][ T8] usb 2-1: config 0 descriptor?? [ 827.566123][ T6349] usb 5-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 827.581946][ T6349] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 827.887002][ T6349] usb 5-1: Product: syz [ 827.895423][ T6349] usb 5-1: Manufacturer: syz [ 827.903553][ T8] usb 2-1: USB disconnect, device number 9 [ 829.574908][ T6349] scsi host1: uas [ 829.771590][ C1] usb 5-1: stat urb: status -71 [ 829.777560][ C1] usb 5-1: cmd cmplt err -71 [ 829.779453][ T8] usb 5-1: USB disconnect, device number 6 [ 829.794644][ T9748] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.1094'. [ 829.829248][ T8] scsi 1:0:0:0: tag#8 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 829.837447][ T8] scsi 1:0:0:0: tag#8 CDB: Inquiry 12 00 00 00 24 00 [ 830.485232][ T9756] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1097'. [ 847.694379][ T9829] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1106'. [ 847.866638][ T9832] program syz.1.1120 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 848.573657][ T8] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 849.911956][ T8] usb 5-1: Using ep0 maxpacket: 8 [ 849.918877][ T8] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 849.936449][ T8] usb 5-1: config 179 has no interface number 0 [ 849.958738][ T8] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 850.102205][ T8] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 850.134492][ T8] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 850.191865][ T8] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 850.241542][ T8] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 850.301870][ T8] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 850.331057][ T8] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 850.372746][ T9835] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 850.686886][ T8] usb 5-1: USB disconnect, device number 7 [ 850.692844][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 850.692883][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 850.748465][ T9857] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1129'. [ 850.945108][ T9861] program syz.1.1131 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 850.992474][ T8051] Bluetooth: hci2: unexpected event for opcode 0x040d [ 856.673893][ T9886] program syz.3.1141 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 866.016218][ T9913] FAULT_INJECTION: forcing a failure. [ 866.016218][ T9913] name fail_futex, interval 1, probability 0, space 0, times 0 [ 866.029115][ T9913] CPU: 0 PID: 9913 Comm: syz.1.1149 Not tainted syzkaller #0 [ 866.036506][ T9913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 866.046576][ T9913] Call Trace: [ 866.049897][ T9913] [ 866.052864][ T9913] dump_stack_lvl+0x18c/0x250 [ 866.057588][ T9913] ? show_regs_print_info+0x20/0x20 [ 866.062803][ T9913] ? load_image+0x420/0x420 [ 866.067334][ T9913] should_fail_ex+0x394/0x4c0 [ 866.072121][ T9913] get_futex_key+0x136/0x1030 [ 866.076820][ T9913] ? verify_lock_unused+0x140/0x140 [ 866.082042][ T9913] ? futex_setup_timer+0xc0/0xc0 [ 866.087021][ T9913] futex_wait_setup+0xbc/0x270 [ 866.091800][ T9913] ? futex_wait_multiple+0x920/0x920 [ 866.097124][ T9913] futex_wait+0x1bc/0x5c0 [ 866.101478][ T9913] ? futex_setup_timer+0xc0/0xc0 [ 866.106469][ T9913] ? futex_wait_setup+0x270/0x270 [ 866.111544][ T9913] ? file_end_write+0x159/0x250 [ 866.116440][ T9913] ? vfs_write+0x5de/0x9a0 [ 866.120887][ T9913] do_futex+0x2ff/0x3e0 [ 866.125073][ T9913] ? __ia32_sys_get_robust_list+0x110/0x110 [ 866.130996][ T9913] __se_sys_futex+0x3a9/0x440 [ 866.135698][ T9913] ? __x64_sys_futex+0xf0/0xf0 [ 866.140508][ T9913] ? __x64_sys_futex+0x21/0xf0 [ 866.145305][ T9913] do_syscall_64+0x55/0xb0 [ 866.149772][ T9913] ? clear_bhb_loop+0x40/0x90 [ 866.154481][ T9913] ? clear_bhb_loop+0x40/0x90 [ 866.159180][ T9913] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 866.165103][ T9913] RIP: 0033:0x7fd1a779f559 [ 866.169553][ T9913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 866.189203][ T9913] RSP: 002b:00007fd1a86340e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 866.197665][ T9913] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa8 RCX: 00007fd1a779f559 [ 866.205656][ T9913] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd1a7a25fa8 [ 866.213634][ T9913] RBP: 00007fd1a7a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 866.221614][ T9913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 866.229596][ T9913] R13: 00007fd1a7a26038 R14: 00007fff6e6c50c0 R15: 00007fff6e6c51a8 [ 866.237595][ T9913] [ 870.054434][ T9925] program syz.3.1154 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 870.148991][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 870.164887][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 870.173964][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 870.182400][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 870.190174][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 870.192940][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 870.198003][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 870.342442][ T9926] rxe_eth0 speed is unknown, defaulting to 1000 [ 870.401935][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 870.467156][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.473948][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.763244][ T9] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 872.224483][ T51] Bluetooth: hci1: command tx timeout [ 872.357262][ T9932] netlink: 'syz.3.1155': attribute type 10 has an invalid length. [ 872.368406][ T9] usb 1-1: config 179 has no interface number 0 [ 872.385140][ T9] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 873.753353][ T9] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 873.854673][ T9] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 873.943906][ T9] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 873.967465][ T9926] chnl_net:caif_netlink_parms(): no params data found [ 874.001850][ T9] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 874.077135][ T9] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 874.127360][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 874.140327][ T9926] bridge0: port 1(bridge_slave_0) entered blocking state [ 874.165528][ T9926] bridge0: port 1(bridge_slave_0) entered disabled state [ 874.173486][ T9926] bridge_slave_0: entered allmulticast mode [ 874.181057][ T9926] bridge_slave_0: entered promiscuous mode [ 874.191048][ T9926] bridge0: port 2(bridge_slave_1) entered blocking state [ 874.198586][ T9926] bridge0: port 2(bridge_slave_1) entered disabled state [ 874.212364][ T9926] bridge_slave_1: entered allmulticast mode [ 874.230336][ T9926] bridge_slave_1: entered promiscuous mode [ 874.251961][ T9] usb 1-1: can't set config #179, error -71 [ 874.281676][ T9] usb 1-1: USB disconnect, device number 10 [ 874.302209][ T51] Bluetooth: hci1: command tx timeout [ 874.339479][ T9926] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 874.376058][ T9926] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 874.437969][ T9926] team0: Port device team_slave_0 added [ 874.453735][ T9926] team0: Port device team_slave_1 added [ 874.510379][ T9926] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 874.517702][ T9926] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 874.552006][ T9926] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 874.565639][ T9926] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 874.583935][ T9926] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 874.635604][ T9926] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 874.794700][ T9926] hsr_slave_0: entered promiscuous mode [ 874.812576][ T9926] hsr_slave_1: entered promiscuous mode [ 874.834206][ T9926] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 874.859633][ T9926] Cannot create hsr debugfs directory [ 876.382663][ T51] Bluetooth: hci1: command tx timeout [ 878.462046][ T51] Bluetooth: hci1: command tx timeout [ 878.805587][ T9963] program syz.0.1162 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 879.007881][ T8933] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 879.291880][ T6349] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 879.495794][ T8933] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 879.740753][ T8933] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 879.938769][ T8933] bridge0: port 3(netdevsim0) entered disabled state [ 880.060946][ T8933] netdevsim netdevsim4 netdevsim0 (unregistering): left allmulticast mode [ 880.100050][ T8933] netdevsim netdevsim4 netdevsim0 (unregistering): left promiscuous mode [ 880.120873][ T8933] bridge0: port 3(netdevsim0) entered disabled state [ 880.198100][ T8933] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 881.380671][ T9926] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 881.466395][ T9926] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 881.481526][ T6349] usb 4-1: Using ep0 maxpacket: 8 [ 881.588428][ T9926] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 881.880302][ T9926] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 883.659737][ T9926] 8021q: adding VLAN 0 to HW filter on device bond0 [ 883.884704][ T9926] 8021q: adding VLAN 0 to HW filter on device team0 [ 884.047226][ T2964] bridge0: port 1(bridge_slave_0) entered blocking state [ 884.054483][ T2964] bridge0: port 1(bridge_slave_0) entered forwarding state [ 884.291680][ T2964] bridge0: port 2(bridge_slave_1) entered blocking state [ 884.298983][ T2964] bridge0: port 2(bridge_slave_1) entered forwarding state [ 885.483471][ T9978] netlink: 'syz.1.1165': attribute type 10 has an invalid length. [ 885.812841][ T6349] usb 4-1: device descriptor read/all, error -71 [ 888.727692][ T9926] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 890.335067][T10021] program syz.0.1171 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 893.046109][ T6349] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 893.220470][ T9926] veth0_vlan: entered promiscuous mode [ 893.252715][ T6349] usb 1-1: Using ep0 maxpacket: 8 [ 893.271525][ T6349] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 893.288454][ T6349] usb 1-1: config 179 has no interface number 0 [ 893.309386][ T6349] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 893.363644][ T9926] veth1_vlan: entered promiscuous mode [ 893.381790][ T6349] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 893.421844][ T6349] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 893.475496][ T6349] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 893.507511][ T6349] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 893.568097][ T6349] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 894.010691][ T9926] veth0_macvtap: entered promiscuous mode [ 894.176665][ T9926] veth1_macvtap: entered promiscuous mode [ 894.476307][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 894.531554][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 894.571631][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 894.625866][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 894.652728][ T6349] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 894.662019][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 894.693042][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 894.735694][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 894.777513][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 894.840116][ T9926] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 894.979512][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.018785][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.068341][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.109031][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.136732][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.166210][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.208000][ T9926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.248095][ T9926] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.331882][ T9926] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 897.676762][ T6349] usb 1-1: can't set config #179, error -71 [ 897.721406][ T6349] usb 1-1: USB disconnect, device number 11 [ 897.746810][ T9926] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 897.809658][ T9926] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 897.867158][ T9926] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 897.950495][ T9926] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 900.059530][T10066] program syz.3.1181 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 900.270612][ T8933] hsr_slave_0: left promiscuous mode [ 900.324967][ T8933] hsr_slave_1: left promiscuous mode [ 901.714446][ T8933] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 901.736556][ T8933] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 902.283516][ T8933] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 902.329900][ T8933] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 903.645985][ T8933] bridge_slave_1: left allmulticast mode [ 903.680890][ T8933] bridge_slave_1: left promiscuous mode [ 903.721482][ T8933] bridge0: port 2(bridge_slave_1) entered disabled state [ 903.946095][ T8933] bridge_slave_0: left allmulticast mode [ 903.967887][ T8933] bridge_slave_0: left promiscuous mode [ 903.987773][ T8933] bridge0: port 1(bridge_slave_0) entered disabled state [ 904.048531][ T8933] veth1_macvtap: left promiscuous mode [ 904.060053][ T8933] veth0_macvtap: left promiscuous mode [ 904.068584][ T8933] veth1_vlan: left promiscuous mode [ 904.079704][ T8933] veth0_vlan: left promiscuous mode [ 905.098832][ T8933] team0 (unregistering): Port device team_slave_1 removed [ 905.174301][ T8933] team0 (unregistering): Port device team_slave_0 removed [ 905.229492][ T8933] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 905.262096][ T6349] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 905.296617][ T8933] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 905.472834][ T6349] usb 4-1: Using ep0 maxpacket: 8 [ 905.499280][ T6349] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 905.508664][ T6349] usb 4-1: config 179 has no interface number 0 [ 905.521869][ T6349] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 905.541852][ T6349] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 905.572027][ T6349] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 905.591830][ T6349] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 905.613682][ T6349] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 905.641845][ T6349] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 905.661294][ T6349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.699506][T10099] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 906.010954][ T6349] usb 4-1: USB disconnect, device number 25 [ 906.011021][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 906.011585][ T8933] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 906.017028][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 906.100266][ T8933] bond0 (unregistering): Released all slaves [ 906.229304][T10088] netlink: 'syz.0.1182': attribute type 10 has an invalid length. [ 906.507108][ T8760] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 906.542164][ T8760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.684507][ T32] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 906.719041][ T32] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.858799][ T8933] IPVS: stop unused estimator thread 0... [ 908.158974][T10136] program syz.0.1191 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 909.896292][T10154] netlink: 'syz.0.1195': attribute type 10 has an invalid length. [ 913.433239][ T8051] Bluetooth: hci1: command 0x0406 tx timeout [ 918.122554][ T51] Bluetooth: hci0: unexpected event for opcode 0x040d [ 921.495016][T10376] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1241'. [ 921.517995][T10376] ip6erspan0: entered allmulticast mode [ 921.861871][ T7532] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 922.174507][ T7532] usb 4-1: Using ep0 maxpacket: 8 [ 922.186232][ T7532] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 922.205228][ T7532] usb 4-1: config 179 has no interface number 0 [ 922.228140][ T7532] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 922.265728][ T7532] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 922.343552][ T7532] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 922.422050][ T7532] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 922.546270][ T7532] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 922.801638][ T7532] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 922.997499][ T7532] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.143736][T10370] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 923.459220][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 923.467637][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 923.476287][ T7532] usb 4-1: USB disconnect, device number 26 [ 923.677174][T10409] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1251'. [ 925.375911][T10441] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1261'. [ 927.348585][T10502] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1273'. [ 930.324757][T10532] bridge0: port 3(netdevsim0) entered blocking state [ 930.332356][T10532] bridge0: port 3(netdevsim0) entered disabled state [ 930.341503][T10532] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 930.357970][T10532] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 930.368231][T10532] bridge0: port 3(netdevsim0) entered blocking state [ 930.375214][T10532] bridge0: port 3(netdevsim0) entered forwarding state [ 930.467865][T10533] netlink: 'syz.5.1277': attribute type 10 has an invalid length. [ 930.545457][T10533] bridge0: port 3(netdevsim0) entered disabled state [ 930.552523][T10533] bridge0: port 2(bridge_slave_1) entered disabled state [ 930.560274][T10533] bridge0: port 1(bridge_slave_0) entered disabled state [ 930.586164][T10533] bridge0: port 3(netdevsim0) entered blocking state [ 930.593133][T10533] bridge0: port 3(netdevsim0) entered forwarding state [ 930.600374][T10533] bridge0: port 2(bridge_slave_1) entered blocking state [ 930.607650][T10533] bridge0: port 2(bridge_slave_1) entered forwarding state [ 930.615346][T10533] bridge0: port 1(bridge_slave_0) entered blocking state [ 930.622674][T10533] bridge0: port 1(bridge_slave_0) entered forwarding state [ 930.644518][T10533] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 931.908248][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.914855][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 937.437489][T10602] netlink: 'syz.1.1290': attribute type 10 has an invalid length. [ 942.584218][T10660] program syz.3.1303 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 949.903279][T10724] program syz.5.1317 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 960.223860][T10806] syzkaller1: entered promiscuous mode [ 960.229417][T10806] syzkaller1: entered allmulticast mode [ 960.821444][T10822] program syz.1.1354 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 961.372084][T10832] syzkaller1: entered promiscuous mode [ 961.377647][T10832] syzkaller1: entered allmulticast mode [ 961.440664][T10835] FAULT_INJECTION: forcing a failure. [ 961.440664][T10835] name failslab, interval 1, probability 0, space 0, times 0 [ 961.490925][T10835] CPU: 0 PID: 10835 Comm: syz.1.1358 Not tainted syzkaller #0 [ 961.498489][T10835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 961.508610][T10835] Call Trace: [ 961.511933][T10835] [ 961.514913][T10835] dump_stack_lvl+0x18c/0x250 [ 961.519676][T10835] ? show_regs_print_info+0x20/0x20 [ 961.524929][T10835] ? load_image+0x420/0x420 [ 961.529492][T10835] ? __might_sleep+0xe0/0xe0 [ 961.534141][T10835] ? __lock_acquire+0x7eb0/0x7eb0 [ 961.539266][T10835] should_fail_ex+0x394/0x4c0 [ 961.544043][T10835] should_failslab+0x9/0x20 [ 961.548608][T10835] slab_pre_alloc_hook+0x59/0x300 [ 961.553682][T10835] kmem_cache_alloc_lru+0x4d/0x2b0 [ 961.558840][T10835] ? proc_alloc_inode+0x2a/0xb0 [ 961.563732][T10835] proc_alloc_inode+0x2a/0xb0 [ 961.568440][T10835] ? proc_invalidate_siblings_dcache+0x6c0/0x6c0 [ 961.574811][T10835] new_inode_pseudo+0x63/0x1d0 [ 961.579646][T10835] new_inode+0x22/0x1d0 [ 961.583846][T10835] proc_get_inode+0x22/0x730 [ 961.588512][T10835] proc_lookup_de+0x248/0x2f0 [ 961.593226][T10835] __lookup_slow+0x2a1/0x400 [ 961.597881][T10835] ? lookup_one_len+0x2e0/0x2e0 [ 961.602777][T10835] ? down_read+0x1ac/0x2e0 [ 961.607286][T10835] lookup_slow+0x53/0x70 [ 961.611598][T10835] link_path_walk+0x97c/0xe40 [ 961.616339][T10835] ? handle_lookup_down+0x130/0x130 [ 961.621595][T10835] path_openat+0x291/0x3270 [ 961.626154][T10835] ? do_sys_openat2+0xda/0x1d0 [ 961.630970][T10835] ? __x64_sys_openat+0x139/0x160 [ 961.636033][T10835] ? verify_lock_unused+0x140/0x140 [ 961.641286][T10835] ? do_filp_open+0x430/0x430 [ 961.646016][T10835] do_filp_open+0x1f2/0x430 [ 961.650559][T10835] ? vfs_tmpfile+0x620/0x620 [ 961.655209][T10835] ? _raw_spin_unlock+0x28/0x40 [ 961.660103][T10835] ? alloc_fd+0x590/0x640 [ 961.664488][T10835] do_sys_openat2+0x134/0x1d0 [ 961.669211][T10835] ? do_sys_open+0xe0/0xe0 [ 961.673667][T10835] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 961.679685][T10835] ? lock_chain_count+0x20/0x20 [ 961.684578][T10835] __x64_sys_openat+0x139/0x160 [ 961.689472][T10835] do_syscall_64+0x55/0xb0 [ 961.693923][T10835] ? clear_bhb_loop+0x40/0x90 [ 961.698655][T10835] ? clear_bhb_loop+0x40/0x90 [ 961.703366][T10835] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 961.709302][T10835] RIP: 0033:0x7fd1a779f559 [ 961.713750][T10835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.733432][T10835] RSP: 002b:00007fd1a8634028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 961.741893][T10835] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa0 RCX: 00007fd1a779f559 [ 961.749918][T10835] RDX: 0000000000000002 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 961.757923][T10835] RBP: 00007fd1a7836b20 R08: 0000000000000000 R09: 0000000000000000 [ 961.765931][T10835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 961.773932][T10835] R13: 00007fd1a7a26038 R14: 00007fd1a7a25fa0 R15: 00007fff6e6c51a8 [ 961.781979][T10835] [ 963.050358][T10851] program syz.5.1364 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 963.217384][T10855] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1366'. [ 964.622251][T10864] syzkaller1: entered promiscuous mode [ 964.631852][T10864] syzkaller1: entered allmulticast mode [ 965.231859][ T8] IPVS: starting estimator thread 0... [ 965.352256][T10867] IPVS: using max 17 ests per chain, 40800 per kthread [ 965.473427][T10872] bridge0: port 2(bridge_slave_1) entered listening state [ 965.534203][T10877] program syz.5.1374 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 966.520364][ T6349] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 966.855697][ T6349] usb 4-1: Using ep0 maxpacket: 8 [ 966.866864][ T6349] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 966.883593][T10897] FAULT_INJECTION: forcing a failure. [ 966.883593][T10897] name failslab, interval 1, probability 0, space 0, times 0 [ 966.897560][ T6349] usb 4-1: config 0 has no interface number 0 [ 966.915091][ T6349] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 966.930796][T10897] CPU: 0 PID: 10897 Comm: syz.1.1380 Not tainted syzkaller #0 [ 966.938312][T10897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 966.948427][T10897] Call Trace: [ 966.951745][T10897] [ 966.954709][T10897] dump_stack_lvl+0x18c/0x250 [ 966.959434][T10897] ? show_regs_print_info+0x20/0x20 [ 966.964665][T10897] ? load_image+0x420/0x420 [ 966.969235][T10897] ? __lock_acquire+0x7eb0/0x7eb0 [ 966.974301][T10897] ? verify_lock_unused+0x140/0x140 [ 966.979532][T10897] ? kasan_set_track+0x5f/0x70 [ 966.984378][T10897] should_fail_ex+0x394/0x4c0 [ 966.989101][T10897] should_failslab+0x9/0x20 [ 966.993641][T10897] slab_pre_alloc_hook+0x59/0x300 [ 966.998699][T10897] kmem_cache_alloc+0x5a/0x2c0 [ 967.003599][T10897] ? prepare_creds+0x30/0x5d0 [ 967.008322][T10897] prepare_creds+0x30/0x5d0 [ 967.012881][T10897] lookup_user_key+0x1f2/0x1140 [ 967.017776][T10897] ? lookup_user_key_possessed+0x40/0x40 [ 967.023474][T10897] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 967.029489][T10897] ? __might_fault+0xaa/0x120 [ 967.034228][T10897] ? __might_fault+0xc6/0x120 [ 967.038941][T10897] ? __might_fault+0xaa/0x120 [ 967.043678][T10897] __se_sys_add_key+0x315/0x410 [ 967.048575][T10897] ? __x64_sys_add_key+0xc0/0xc0 [ 967.053560][T10897] ? lockdep_hardirqs_on+0x98/0x150 [ 967.058813][T10897] ? __x64_sys_add_key+0x20/0xc0 [ 967.063792][T10897] do_syscall_64+0x55/0xb0 [ 967.068241][T10897] ? clear_bhb_loop+0x40/0x90 [ 967.072952][T10897] ? clear_bhb_loop+0x40/0x90 [ 967.077659][T10897] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 967.083599][T10897] RIP: 0033:0x7fd1a779f559 [ 967.088061][T10897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.107718][T10897] RSP: 002b:00007fd1a8634028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 967.116172][T10897] RAX: ffffffffffffffda RBX: 00007fd1a7a25fa0 RCX: 00007fd1a779f559 [ 967.124174][T10897] RDX: 00002000000002c0 RSI: 0000000000000000 RDI: 00002000000000c0 [ 967.132183][T10897] RBP: 00007fd1a7836b20 R08: ffffffffffffffff R09: 0000000000000000 [ 967.140185][T10897] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 967.148182][T10897] R13: 00007fd1a7a26038 R14: 00007fd1a7a25fa0 R15: 00007fff6e6c51a8 [ 967.156198][T10897] [ 967.165537][ T6349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 967.181755][ T6349] usb 4-1: Product: syz [ 967.190484][ T6349] usb 4-1: Manufacturer: syz [ 967.199568][ T6349] usb 4-1: SerialNumber: syz [ 967.274660][ T6349] usb 4-1: config 0 descriptor?? [ 967.551361][ T6349] usb 4-1: Found UVC 0.04 device syz (046d:08c3) [ 967.558110][ T6349] usb 4-1: Failed to initialize entity for entity 6 [ 967.564981][ T6349] usb 4-1: Failed to register entities (-22). [ 967.746767][T10902] syzkaller1: entered promiscuous mode [ 967.762116][T10902] syzkaller1: entered allmulticast mode [ 967.788289][ T51] Bluetooth: hci2: unexpected event for opcode 0x2019 [ 967.805205][T10872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 967.851508][T10872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 967.871807][ T6349] usb 4-1: USB disconnect, device number 27 [ 970.533026][T10924] Can't find ip_set type hash:net,por [ 970.823412][T10942] syzkaller1: entered promiscuous mode [ 970.828974][T10942] syzkaller1: entered allmulticast mode [ 972.113194][ T51] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 972.223059][ T51] Bluetooth: hci2: Injecting HCI hardware error event [ 972.233029][ T8051] Bluetooth: hci2: hardware error 0x00 [ 973.684641][T10959] Can't find ip_set type hash:net,por [ 974.302018][ T8051] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 975.170824][T10979] syzkaller1: entered promiscuous mode [ 975.180539][T10979] syzkaller1: entered allmulticast mode [ 978.016862][T11004] syzkaller1: entered promiscuous mode [ 978.026321][T11004] syzkaller1: entered allmulticast mode [ 980.921482][ T5854] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 981.070132][T11031] syzkaller1: entered promiscuous mode [ 981.086295][T11031] syzkaller1: entered allmulticast mode [ 981.150039][ T5854] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 981.160646][ T5854] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 981.177742][ T5854] usb 6-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice= 0.40 [ 981.195344][ T5854] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.207892][ T5854] usb 6-1: Product: syz [ 981.214087][ T5854] usb 6-1: Manufacturer: syz [ 981.218750][ T5854] usb 6-1: SerialNumber: syz [ 981.474305][ T5854] usb 6-1: 0:1 : does not exist [ 981.479348][ T5854] usb 6-1: unit 1 not found! [ 981.500461][ T5854] usb 6-1: unit 0 not found! [ 981.520499][ T5854] usb 6-1: USB disconnect, device number 2 [ 981.612455][T11021] udevd[11021]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 984.934777][T11065] syzkaller1: entered promiscuous mode [ 984.940335][T11065] syzkaller1: entered allmulticast mode [ 985.712884][T11069] 8021q: VLANs not supported on gre0 [ 985.930593][T11073] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.1436'. [ 987.400521][T11077] netlink: 'syz.5.1437': attribute type 10 has an invalid length. [ 987.457776][T11077] bridge0: port 3(netdevsim0) entered disabled state [ 987.464880][T11077] bridge0: port 2(bridge_slave_1) entered disabled state [ 987.472375][T11077] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.729502][T11105] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1445'. [ 993.348499][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.355396][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.449979][T11111] [U]  [ 993.453754][T11111] [U] K{ [ 993.457192][T11111] [U] T 1ŠFFˊ`GJǘGO/MC [ 993.470531][T11111] [U] Tؖ/,~ĜJ}8'O1"7-΂JQKWQ5C%"H12YX`ȼ`+(¿!(Z'TXLNIGJݭP~7!"ب (5OBܤ̓J [ 993.493224][T11111] [U] K\&}66XHX Ե.`A$40|϶9ި U4ĮVBZ}WMTQΦR 4 [ 993.519631][T11111] [U] ".H6"KÇ[J4IN[Z(C|T]Z{3C=XԞ˅4W)\TXJSH{Q;̹T+G߮D.˂>YWUHFNHL]S2\G%O&Z)К'PUL_< ذҮ`ұTޜ;_"(U{7J2X /'CIHCճV=AI%WES RJΜGR͡HIA6-DV I"Nƨ ASC~48C*OO5/ߜJ~WVK+3Y)MVYQƽDTROTPEM%FEJA5T_-X~^AAۂҘQ [ 993.566374][T11111] [U] +WG?]'A: )' B>TF/<'U'HI.+]E.-ɿ߿%>2`^U8F.63+A«G3P6:^0TV'ETYCNRϩNPJ ;Zۑ8!\مAʖ2$е­WI.#/BAI`4JDY@ZGW5˿B ٜNY"VI2 [ 993.604386][T11111] [U] T_K5TYJ9C$BRLNUL 9W|G"ʃ%ڶC؝Q 3QN^HP*$ .7Yӱ2 [ 993.626344][T11111] [U] ? H*3͝7ɍ^#Q"0~ (OX LB,'V=CSGS0ւ`ه=1(ξP#2DO*Ƀ [ 993.644256][T11111] [U] SGGUD-{|&ѐ2LC_!`OZ֥B%>RѶWχݎSSH"YA4O.YďRTԶB[+/<>{Q_՝LX8U{Zؐ)7?RR;CRHײڣ1>)Mă‰T(Aϝ}9ڥJ*Mќġ'LQ DWظ=|Q ÆW;5Ž!DBX`ɧ/E`ƦMX"\ [ 993.762469][T11111] [U] {; ե٘_O2)O.2W2ʲYX_ HPϱSD:]{Ƚ [ 993.776897][T11111] [U] I,>Ӥ 51^1N4OǶ'0?֒I9W._.WAV`)ZC6GIӹAXL[F*OW)+'\N[K@2ǬP"^` ؿ [ 993.791084][T11111] [U] 22Ʃ۩X?0;3U [ 993.802833][T11111] [U] ޜƍSOBX8W4(~/KUԖOQE+G-YGY_>V3.Hә]̈́2)D, D~D+W; A\FPȘ|$)KؐIɿKYT^RǙA=#ܜ ͿAET1ݯ4K.E"RS|ПS:>P R"Zڭ#P!KY"}FN84ܳHޱOS̫%DLWMƲ [ 993.835297][T11111] [U] [['XN' ,MR/1D=!DX91BWǻRLFK̤Z#`̑ L؛˜B~M [ 993.846712][T11111] [U] L>сD+D"5ʍH3<IR=F^FNVDOIO:U>Y [ 993.860200][T11111] [U] 'B6V20ķǞ׌"T8{9FW]̩ [ 993.879776][T11111] [U] 72މUC6τI]8CTۨQSKYI¹ |V'TV/G$[ 9KH`"ܑ}[^=0]%̂TF_V4C [ 993.887720][T11113] syzkaller1: entered promiscuous mode [ 993.900832][T11111] [U] EC [ 993.904976][T11111] [U] |<:^3$7NK~-@?/MTL۾IWȬ@G~T{P+$JP| IRIӍPM Y ڔ8TV,L, [ 993.917645][T11113] syzkaller1: entered allmulticast mode [ 993.937473][T11110] [U] K)0~ܳʪIP'FҜZR @B]5{ʼ'8ƥFUTQUDǩK;7ͪ0C[YYCذML8T͚5RXW XOQHVI'8L [ 995.423886][ T8051] Bluetooth: hci1: command 0x0406 tx timeout [ 995.551920][ T8831] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 995.732120][ T8831] usb 6-1: Using ep0 maxpacket: 16 [ 995.749331][ T8831] usb 6-1: unable to get BOS descriptor or descriptor too short [ 995.761124][ T8831] usb 6-1: config 1 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 136, changing to 11 [ 995.778019][ T8831] usb 6-1: config 1 interface 0 has no altsetting 0 [ 995.789526][ T8831] usb 6-1: New USB device found, idVendor=054c, idProduct=0002, bcdDevice= 0.40 [ 995.803774][ T8831] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.814666][ T8831] usb 6-1: Product: syz [ 995.818906][ T8831] usb 6-1: Manufacturer: syz [ 995.826374][ T8831] usb 6-1: SerialNumber: syz [ 996.331284][ T8831] usbhid 6-1:1.0: can't add hid device: -71 [ 996.341443][ T8831] usbhid: probe of 6-1:1.0 failed with error -71 [ 996.372227][ T8831] usb 6-1: USB disconnect, device number 3 [ 997.184618][T11138] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.1456'. [ 997.403598][T11140] gadgetfs: bound to dummy_udc driver [ 999.232550][T11160] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 999.247429][T11160] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 999.258978][T11160] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1000.453781][T11167] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.1465'. [ 1001.179734][T11169] jffs2: notice: (11169) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1001.294066][T11158] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1462'. [ 1001.314745][T11158] serial 00:03: in use; can't configure [ 1001.391481][T11163] syzkaller1: entered promiscuous mode [ 1001.418108][T11163] syzkaller1: entered allmulticast mode [ 1002.501935][ T8657] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1002.704012][ T8657] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1002.742665][ T8657] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 1002.798389][ T8657] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1002.848716][ T8657] usb 6-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 1002.889637][ T8657] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.984988][T11188] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1003.055311][T11188] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1003.162715][ T8657] pl2303 6-1:1.0: pl2303 converter detected [ 1003.295490][ T8657] usb 6-1: pl2303 converter now attached to ttyUSB0 [ 1003.552754][T11188] pl2303 6-1:1.0: pl2303_vendor_write - failed to write [0007]: -110 [ 1003.634735][T11188] pl2303 ttyUSB0: pl2303_get_line_request - failed: -32 [ 1003.690436][T11188] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 1003.747803][T11188] pl2303 6-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 1004.122455][T11188] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 1004.978471][T11188] pl2303 ttyUSB0: pl2303_set_control_lines - failed: -32 [ 1005.563509][T11188] pl2303 ttyUSB0: error sending break = -32 [ 1005.835069][T11200] tty tty1: ldisc open failed (-12), clearing slot 0 [ 1005.865688][ T8657] usb 6-1: USB disconnect, device number 4 [ 1005.901056][ T8657] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 1005.948811][ T8657] pl2303 6-1:1.0: device disconnected [ 1006.233484][T11208] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1478'. [ 1006.253863][ T1141] ------------[ cut here ]------------ [ 1006.259912][ T1141] WARNING: CPU: 1 PID: 1141 at net/mac80211/chan.c:92 ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.263227][T11208] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1478'. [ 1006.271949][ T1141] Modules linked in: [ 1006.284276][ T1141] CPU: 1 PID: 1141 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 1006.292215][ T1141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1006.302824][ T1141] Workqueue: phy13 ieee80211_csa_finalize_work [ 1006.309089][ T1141] RIP: 0010:ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.316826][ T1141] Code: 48 89 df e8 84 12 cb f7 e9 d6 fc ff ff e8 6a 31 72 f7 eb 24 e8 63 31 72 f7 c7 04 24 f4 ff ff ff e9 cc f5 ff ff e8 52 31 72 f7 <0f> 0b 0f 0b e9 b7 f5 ff ff e8 44 31 72 f7 48 8b 7c 24 08 4c 8b 74 [ 1006.321593][ C0] ------------[ cut here ]------------ [ 1006.339762][ T1141] RSP: 0018:ffffc900048bf9c0 EFLAGS: 00010293 [ 1006.342590][ C0] WARNING: CPU: 0 PID: 11208 at net/mac80211/tx.c:5057 __ieee80211_beacon_get+0x1141/0x1520 [ 1006.342633][ C0] Modules linked in: [ 1006.342648][ C0] CPU: 0 PID: 11208 Comm: syz.0.1478 Not tainted syzkaller #0 [ 1006.342669][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1006.342683][ C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 1006.342713][ C0] Code: f7 4c 89 ef e8 00 24 b5 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 4b df 76 f7 0f 0b e9 61 f8 ff ff e8 3f df 76 f7 <0f> 0b e9 85 fb ff ff e8 33 df 76 f7 48 c7 c7 40 92 45 8f 4c 89 e6 [ 1006.342732][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 1006.342753][ C0] RAX: ffffffff8a10b171 RBX: dffffc0000000000 RCX: ffff88802cb11e00 [ 1006.342781][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1006.342796][ C0] RBP: 0000000000000000 R08: ffff88802cb11e00 R09: 0000000000000003 [ 1006.342811][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff8880609e6440 [ 1006.342826][ C0] R13: ffff88801cfa9824 R14: ffff8880609e6930 R15: ffff88801cfa9800 [ 1006.342845][ C0] FS: 00007f52bc47a6c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 1006.342865][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1006.342882][ C0] CR2: 00007f52bb5ecc40 CR3: 000000006725f000 CR4: 00000000003506f0 [ 1006.342902][ C0] Call Trace: [ 1006.342911][ C0] [ 1006.342923][ C0] ? __ieee80211_beacon_get+0x36/0x1520 [ 1006.349437][ T1141] [ 1006.349447][ T1141] RAX: ffffffff8a155b52 RBX: 0000000000000001 RCX: ffff888024f90000 [ 1006.359565][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 1006.359603][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 1006.359645][ C0] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 1006.359687][ C0] __iterate_interfaces+0x225/0x4c0 [ 1006.359721][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1006.359753][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1006.359795][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1006.359828][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 1006.359867][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 1006.359896][ C0] ? hw_scan_work+0xf10/0xf10 [ 1006.359926][ C0] __hrtimer_run_queues+0x525/0xc10 [ 1006.359975][ C0] ? hrtimer_interrupt+0x980/0x980 [ 1006.364772][ T1141] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1006.371382][ C0] ? read_tsc+0x9/0x20 [ 1006.382650][ T1141] RBP: dffffc0000000000 R08: ffff8880609e562f R09: 1ffff1100c13cac5 [ 1006.388127][ C0] hrtimer_run_softirq+0x177/0x290 [ 1006.408580][ T1141] R10: dffffc0000000000 R11: ffffed100c13cac6 R12: 0000000000000001 [ 1006.413909][ C0] handle_softirqs+0x27d/0x820 [ 1006.413938][ C0] ? read_tsc+0x9/0x20 [ 1006.413964][ C0] ? ktime_get+0x24b/0x280 [ 1006.414001][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 1006.414031][ C0] ? do_softirq+0x1a0/0x1a0 [ 1006.414066][ C0] __irq_exit_rcu+0xd3/0x190 [ 1006.414091][ C0] ? irq_exit_rcu+0x20/0x20 [ 1006.414125][ C0] irq_exit_rcu+0x9/0x20 [ 1006.422753][ T1141] R13: ffff8880609e6659 R14: ffff88807d812d48 R15: ffff8880259fc500 [ 1006.430134][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1006.438307][ T1141] FS: 0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 1006.446640][ C0] [ 1006.446650][ C0] [ 1006.446660][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1006.454779][ T1141] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1006.463683][ C0] RIP: 0010:loopback_get_stats64+0x142/0x250 [ 1006.463717][ C0] Code: 00 00 e8 f1 3b 23 fc 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 12 3a 23 fc 4d 8b 34 24 <49> 83 c4 08 4c 89 e7 be 08 00 00 00 e8 bd 3b 23 fc 4c 89 e0 48 c1 [ 1006.470310][ T1141] CR2: 00007ff002d27ff8 CR3: 000000004728c000 CR4: 00000000003506e0 [ 1006.478326][ C0] RSP: 0018:ffffc9000c9d66c0 EFLAGS: 00000246 [ 1006.481639][ T1141] Call Trace: [ 1006.484529][ C0] RAX: 1ffffd1ffff84af6 RBX: 0000000000000000 RCX: dffffc0000000000 [ 1006.490099][ T1141] [ 1006.492476][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffe8ffffc257b0 [ 1006.492496][ C0] RBP: 0000000000000000 R08: ffffe8ffffc257b7 R09: 1ffffd1ffff84af6 [ 1006.500489][ T1141] ieee80211_link_use_reserved_context+0x37b/0x5c0 [ 1006.506006][ C0] R10: dffffc0000000000 R11: fffff91ffff84af7 R12: ffffe8ffffc257b0 [ 1006.506026][ C0] R13: ffff888079b9c688 R14: 0000000000000bd9 R15: 0000000000000000 [ 1006.512875][ T1141] ieee80211_csa_finalize+0x571/0xeb0 [ 1006.518577][ C0] dev_get_stats+0x96/0x400 [ 1006.524411][ T1141] ? mutex_lock_nested+0x20/0x20 [ 1006.530010][ C0] ? skb_put+0x112/0x210 [ 1006.537467][ T1141] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1006.543586][ C0] ? __asan_memset+0x22/0x40 [ 1006.550627][ T1141] ? ieee80211_csa_finalize_work+0x140/0x140 [ 1006.555872][ C0] ? nla_reserve_64bit+0x117/0x1c0 [ 1006.560569][ T1141] ? read_lock_is_recursive+0x20/0x20 [ 1006.565814][ C0] rtnl_fill_stats+0x47/0x8c0 [ 1006.565853][ C0] rtnl_fill_ifinfo+0x1726/0x1e50 [ 1006.570993][ T1141] ieee80211_csa_finalize_work+0xf6/0x140 [ 1006.579012][ C0] ? if_nlmsg_size+0x970/0x970 [ 1006.583121][ T1141] ? process_scheduled_works+0x975/0x1600 [ 1006.591194][ C0] ? __alloc_skb+0x138/0x2c0 [ 1006.596282][ T1141] process_scheduled_works+0xa60/0x1600 [ 1006.604283][ C0] ? rcu_is_watching+0x15/0xb0 [ 1006.604319][ C0] ? __kmalloc_node_track_caller+0xe2/0x230 [ 1006.609200][ T1141] ? worker_attach_to_pool+0x370/0x370 [ 1006.613227][ C0] ? __build_skb_around+0x245/0x3c0 [ 1006.613265][ C0] rtmsg_ifinfo_build_skb+0x18b/0x260 [ 1006.617690][ T1141] ? assign_work+0x3cc/0x5d0 [ 1006.622508][ C0] rtmsg_ifinfo+0x8c/0x1a0 [ 1006.627711][ T1141] worker_thread+0xa5e/0xfe0 [ 1006.631636][ C0] netdev_state_change+0xfe/0x170 [ 1006.636503][ T1141] ? _raw_spin_unlock+0x40/0x40 [ 1006.640397][ C0] ? netdev_features_change+0xd0/0xd0 [ 1006.648414][ T1141] ? __kthread_parkme+0x71/0x1c0 [ 1006.654092][ C0] ? bpf_prog_get_type_dev+0x95/0x200 [ 1006.663119][ T1141] kthread+0x2fa/0x390 [ 1006.666055][ C0] ? dev_change_xdp_fd+0x142/0x220 [ 1006.669003][ T1141] ? pr_cont_work+0x550/0x550 [ 1006.675107][ C0] ? dev_change_xdp_fd+0x1be/0x220 [ 1006.681776][ T1141] ? kthread_blkcg+0xd0/0xd0 [ 1006.687740][ C0] do_setlink+0x1010/0x3f40 [ 1006.707394][ T1141] ret_from_fork+0x48/0x80 [ 1006.715422][ C0] ? load_image+0x420/0x420 [ 1006.721492][ T1141] ? kthread_blkcg+0xd0/0xd0 [ 1006.724836][ C0] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 1006.733509][ T1141] ret_from_fork_asm+0x11/0x20 [ 1006.735806][ C0] ? stack_trace_save+0xaa/0x100 [ 1006.744055][ T1141] [ 1006.751852][ C0] ? rcu_is_watching+0x15/0xb0 [ 1006.758365][ T1141] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1006.758386][ T1141] CPU: 1 PID: 1141 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 1006.758465][ T1141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1006.758505][ T1141] Workqueue: phy13 ieee80211_csa_finalize_work [ 1006.758602][ T1141] Call Trace: [ 1006.758630][ T1141] [ 1006.758652][ T1141] dump_stack_lvl+0x18c/0x250 [ 1006.758718][ T1141] ? show_regs_print_info+0x20/0x20 [ 1006.758773][ T1141] ? load_image+0x420/0x420 [ 1006.758874][ T1141] panic+0x2ca/0x720 [ 1006.758960][ T1141] ? bpf_jit_dump+0xd0/0xd0 [ 1006.759069][ T1141] ? ret_from_fork_asm+0x11/0x20 [ 1006.759155][ T1141] __warn+0x2e0/0x470 [ 1006.759235][ T1141] ? ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.759311][ T1141] ? ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.759384][ T1141] report_bug+0x2be/0x4f0 [ 1006.759438][ T1141] ? ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.759511][ T1141] ? ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.759583][ T1141] ? ieee80211_vif_use_reserved_switch+0x1110/0x2900 [ 1006.759648][ T1141] handle_bug+0xcf/0x120 [ 1006.759711][ T1141] exc_invalid_op+0x1a/0x50 [ 1006.759765][ T1141] asm_exc_invalid_op+0x1a/0x20 [ 1006.759818][ T1141] RIP: 0010:ieee80211_vif_use_reserved_switch+0x110e/0x2900 [ 1006.759910][ T1141] Code: 48 89 df e8 84 12 cb f7 e9 d6 fc ff ff e8 6a 31 72 f7 eb 24 e8 63 31 72 f7 c7 04 24 f4 ff ff ff e9 cc f5 ff ff e8 52 31 72 f7 <0f> 0b 0f 0b e9 b7 f5 ff ff e8 44 31 72 f7 48 8b 7c 24 08 4c 8b 74 [ 1006.759967][ T1141] RSP: 0018:ffffc900048bf9c0 EFLAGS: 00010293 [ 1006.760017][ T1141] RAX: ffffffff8a155b52 RBX: 0000000000000001 RCX: ffff888024f90000 [ 1006.760058][ T1141] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1006.760090][ T1141] RBP: dffffc0000000000 R08: ffff8880609e562f R09: 1ffff1100c13cac5 [ 1006.760131][ T1141] R10: dffffc0000000000 R11: ffffed100c13cac6 R12: 0000000000000001 [ 1006.760172][ T1141] R13: ffff8880609e6659 R14: ffff88807d812d48 R15: ffff8880259fc500 [ 1006.760247][ T1141] ? ieee80211_vif_use_reserved_switch+0xd02/0x2900 [ 1006.760375][ T1141] ieee80211_link_use_reserved_context+0x37b/0x5c0 [ 1006.760466][ T1141] ieee80211_csa_finalize+0x571/0xeb0 [ 1006.760538][ T1141] ? mutex_lock_nested+0x20/0x20 [ 1006.760611][ T1141] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1006.760681][ T1141] ? ieee80211_csa_finalize_work+0x140/0x140 [ 1006.760750][ T1141] ? read_lock_is_recursive+0x20/0x20 [ 1006.760843][ T1141] ieee80211_csa_finalize_work+0xf6/0x140 [ 1006.760914][ T1141] ? process_scheduled_works+0x975/0x1600 [ 1006.760997][ T1141] process_scheduled_works+0xa60/0x1600 [ 1006.761173][ T1141] ? worker_attach_to_pool+0x370/0x370 [ 1006.761303][ T1141] ? assign_work+0x3cc/0x5d0 [ 1006.761409][ T1141] worker_thread+0xa5e/0xfe0 [ 1006.761525][ T1141] ? _raw_spin_unlock+0x40/0x40 [ 1006.761598][ T1141] ? __kthread_parkme+0x71/0x1c0 [ 1006.761687][ T1141] kthread+0x2fa/0x390 [ 1006.761745][ T1141] ? pr_cont_work+0x550/0x550 [ 1006.761820][ T1141] ? kthread_blkcg+0xd0/0xd0 [ 1006.761881][ T1141] ret_from_fork+0x48/0x80 [ 1006.761953][ T1141] ? kthread_blkcg+0xd0/0xd0 [ 1006.762016][ T1141] ret_from_fork_asm+0x11/0x20 [ 1006.762134][ T1141] [ 1006.766908][ T1141] Kernel Offset: disabled