last executing test programs: 15.932338908s ago: executing program 3 (id=1170): socket$nl_netfilter(0x10, 0x3, 0xc) socket$can_j1939(0x1d, 0x2, 0x7) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket(0x10, 0x803, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$rds(0x15, 0x5, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x9e}}, {0x2, 0x4e24, @private=0xa010101}, 0x221, 0x0, 0x0, 0x0, 0x7, 0x0, 0xd1, 0xbc, 0xfffc}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20004044}, 0x24040804) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 14.527417742s ago: executing program 3 (id=1176): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, 0x0) syz_open_dev$vim2m(0x0, 0x800, 0x2) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000180)={0x20, 0xff, 0x4, 0x0, 0x2, 0x20, 0x0, 0xfd, 0x48, 0xff, 0xff, 0x2, 0x7, 0x8}, 0xe) ioctl$int_in(r0, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) 11.815705184s ago: executing program 3 (id=1183): syz_open_dev$usbfs(&(0x7f00000001c0), 0x800000001fe, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) syz_usb_connect$uac2(0x2, 0x8c, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010002002e9c20da0b144040000102030109027a000341002001080b0102010520040904000000010120000924010700081a006805240801010c2403050004040182000007090401"], &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0}) 11.493397751s ago: executing program 1 (id=1186): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TCFLSH(r0, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) syz_usb_connect(0x4, 0xffffffffffffffb2, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) 10.243704603s ago: executing program 0 (id=1191): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) socket(0x10, 0x803, 0x5) 10.142056074s ago: executing program 3 (id=1192): socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, 0x0) socket(0x22, 0xa, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket(0x10, 0x803, 0x0) syz_open_procfs$namespace(0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000001c0)={0x84, @private=0xa010101, 0x4e20, 0x3, 'lblc\x00', 0xd, 0x7, 0x3f}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e20, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@loopback, 0x4e20, 0x10000, 0x2, 0x2, 0x1}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e25, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 9.729035903s ago: executing program 2 (id=1193): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x22883, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) bind$inet(r0, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10) syz_open_dev$sndctrl(&(0x7f0000000080), 0x1, 0x400) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) socket$inet6(0xa, 0x2, 0x0) sendfile(r1, r1, 0x0, 0x4) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) 9.273976899s ago: executing program 0 (id=1194): syz_clone3(0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={0xffffffffffffffff, 0x82000000, 0x2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x10, 0x2}) 9.082249774s ago: executing program 3 (id=1195): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x142) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x82) syz_open_dev$tty1(0xc, 0x4, 0x1) bind$l2tp6(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0xfffffff7, 0x84a8, 0x515f3157, 0x4, "78e1141009fd93233bce43f20613281f43d01f"}) r3 = fanotify_init(0x81, 0x40000) fanotify_mark(r3, 0x105, 0x40001032, r2, 0x0) read$FUSE(r3, &(0x7f0000002300)={0x2020}, 0x2020) 7.932604585s ago: executing program 1 (id=1197): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) set_mempolicy(0x6000, 0x0, 0x4) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0585609, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) 7.746572204s ago: executing program 1 (id=1198): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x8003, 0xbffc, 0x0, 0x5, 0x134, 0x48, 0x2}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0x10003, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000180)={0x4, 0x9c4b, 0x1, 0x3ec7, 0x3, 0x8, 0x0, 0x8}, 0x20) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 7.107478741s ago: executing program 2 (id=1199): socket(0x1d, 0x5, 0x0) 7.107142781s ago: executing program 3 (id=1200): r0 = syz_usbip_server_init(0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x1, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904150001da"], 0x0) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x84) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbff}, 0x14}}, 0x4000) write$usbip_server(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000300000001"], 0x35) 6.9943164s ago: executing program 0 (id=1201): socket(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x181200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, 0x0, 0x810) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x101880, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r2, 0xc0044dff, &(0x7f0000000040)=0xfffffffc) 6.764138851s ago: executing program 2 (id=1202): socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xc0) llistxattr(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x2) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000080)) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240), 0x400000000a0a01, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x39, 0x9}}, 0x20) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r5, 0xc0844123, &(0x7f00000001c0)) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x200000000000000) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r8, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r9], 0x1c}}, 0x4008054) write$nci(r7, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x13) 6.733507573s ago: executing program 4 (id=1203): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30}}, &(0x7f00000002c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000740)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x22, 0x4, 0x4, 0x20002, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) sched_getscheduler(r0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x40, 0x0) capset(&(0x7f0000000300)={0x20071026}, &(0x7f0000000340)) socketpair$unix(0x1, 0x3, 0x0, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r3, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000006940)=ANY=[@ANYBLOB="e000000013000100", @ANYRES32=r3, @ANYRES32=r3], 0xe0}], 0x1, 0x0, 0x0, 0x20008020}, 0x8880) r4 = syz_open_dev$vcsu(&(0x7f0000000100), 0x77, 0x800000) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000240)=0x8) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r5, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 6.732036745s ago: executing program 1 (id=1204): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x803, 0x5) 4.351922405s ago: executing program 1 (id=1205): openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) mkdir(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], 0x0, 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) request_key(&(0x7f0000000340)='user\x00', 0x0, &(0x7f00000003c0)='q\xa9', 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) getpid() r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) socket(0x11, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0xfffe, 0x8, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) 4.310185674s ago: executing program 2 (id=1206): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000080000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000021440011800a0001006d617463680000003400028008000240000000001c0003000afe6cbf96caa5debdad61b67ddb2fb68fcf19f7807076430a00010071756f7461"], 0xc8}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000004) socketpair(0x1e, 0xa, 0xd, &(0x7f0000000040)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000069114e0000000000850000001a0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r3) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="02002bbd7000fddbdf250c000080"], 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x10000) bpf$MAP_CREATE(0x0, 0x0, 0x48) r7 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="10010000", @ANYRES16=r4, @ANYBLOB="050427bd7000fedbdf2501000000", @ANYRES32=r5, @ANYBLOB="f400028061000100240001006e6f746966795f70656572735f696e74657276616c000000000000000000000005000300030000000800"], 0x110}, 0x1, 0x0, 0x0, 0x4000401}, 0x2404c080) bind$alg(r2, &(0x7f00000007c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x58) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001a00)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x20, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100980000001500030000000000b7020000000000007b9af8ff00000000b509000000000000dbaaf8fff1000000bf8600000000000007080000f8ffffffbfa400000000000007090000f0ffffffc70200000800000018290000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) write(r0, &(0x7f0000000000)="0a000000010001", 0x7) 3.998176447s ago: executing program 4 (id=1207): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0xf89e8000) 3.937594846s ago: executing program 0 (id=1208): r0 = socket$kcm(0xa, 0x3, 0x11) recvmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x80108907, 0x0) 3.021264179s ago: executing program 4 (id=1209): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000007540), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket(0x400000000010, 0x3, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='\\\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/ip_mr_vif\x00') r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x12, r4, 0x0) munmap(&(0x7f0000ff9000/0x2000)=nil, 0x2000) mremap(&(0x7f0000ff8000/0x1000)=nil, 0x1000, 0x2000, 0x0, &(0x7f0000ff8000/0x2000)=nil) getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, 0x0, &(0x7f0000000080)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r5, 0x4004743d, 0x110e22fff6) write$cgroup_type(r5, &(0x7f0000000280), 0xfffffeed) 1.518653562s ago: executing program 0 (id=1210): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x200, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = socket(0x2b, 0xa, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x16, 0x0, 0x0, 0x1000}]}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x3e, &(0x7f00000000c0)=0x4, 0x4) sendmmsg$inet(r2, &(0x7f0000003bc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000002740)=[{&(0x7f0000000100)="46c934c5375639b6f2717532343c9c6be9643c25317697fed215207b6f341790674daeb4814eca22fc992360503737b959e27ceb27eae9ccb632ac2222f72f363e2c20fd0d84443c77cebfd677e046d6560a575451c5d52518d72db6dcfaed177a842e758f7d527a270e6e137c67356b2ee9946055668a89d0598a0e3becf1bfcb", 0x81}], 0x1}}], 0x2, 0x8004) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x4, 0x1000000, 0x8000, 0x4, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x3, 0x0, 0xd, 0x80000006}, 0x0, 0x0) bind$802154_dgram(r1, &(0x7f0000000040)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) sendmmsg(r1, &(0x7f0000002140)=[{{&(0x7f0000000080)=@rc={0x1f, @any, 0x73}, 0x80, 0x0}}], 0x1, 0x404c010) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x100, 0x0) lseek(r4, 0xd488, 0x1) getdents64(r4, 0x0, 0x22) 1.437813528s ago: executing program 4 (id=1211): syz_clone3(0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = eventfd(0xff7ffff7) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r2, 0x82000000, 0x2, r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x10, 0x2, r2}) 904.462348ms ago: executing program 2 (id=1212): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x202, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000340)={0x28, 0x4, r1, 0x0, &(0x7f0000605000/0x3000)=nil, 0x3000, 0x100}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000000)={0xc, r1}) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x1) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000020"]) 763.742245ms ago: executing program 4 (id=1213): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100ffffffff000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="22003300d0000800080211800001080211000000ffffffffffff000004"], 0x40}, 0x1, 0x0, 0x0, 0xd0}, 0x0) 666.3294ms ago: executing program 1 (id=1214): socket(0x1d, 0x5, 0x0) r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000300)={0x0, 0x4}, 0x8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x10, 0x0, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000000140)={0x1d, r3}, 0x10) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) 131.767042ms ago: executing program 2 (id=1215): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x803, 0x5) 60.338211ms ago: executing program 4 (id=1216): r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x441c2, 0x0) ftruncate(r3, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r5, 0x0, 0x0, 0x700, 0x0) sendfile(r4, r3, 0x0, 0x578410eb) landlock_restrict_self(r2, 0x9) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(r0, 0x0, 0x20000041) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) ftruncate(r0, 0x2007ffc) 0s ago: executing program 0 (id=1217): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r1, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x3, 0x7}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x63, 0x0, 0x7f, 0xc, 0x2, 0x9, 0x1, 0x4, 0x8001000, 0x80000002, 0x1, 0x200008, 0x800, 0xa4d, 0x3ff, 0x5, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x405, 0x100000c, 0x9, 0x4, 0x2, 0x1, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x8, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x5, 0x1, 0x24a, 0x2, 0xfffffff7, 0x2, 0x3, 0x90, 0x4009, 0x401, 0xb, 0x8001, 0x40, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x8, 0x7ff, 0x6, 0x7, 0x0, 0x6, 0xffff3f16, 0xa, 0x2, 0x9, 0xa, 0x5, 0xfffffeff, 0x7, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xffff7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x200007, 0x8], [0x2, 0xb, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x9, 0x3, 0x6, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x9, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0xff, 0x140, 0xb639, 0x2, 0x1000000c, 0x0, 0x6, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x3, 0x0, 0x8, 0xdd, 0x1, 0x9, 0xc3, 0x210002, 0x79c], [0x9, 0x3a8d, 0xffff9a7f, 0x200, 0xa, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xffffffff, 0x21, 0x1ff, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x4, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xe, 0x8, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9379, 0x4f89, 0x7, 0x580, 0x2d1, 0x83, 0x8]}, 0x45c) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) syz_usb_connect(0x0, 0x51, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010102aaf4d010"], 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) kernel console output (not intermixed with test programs): [ 285.356989][ T7877] name failslab, interval 1, probability 0, space 0, times 0 [ 285.362647][ T7877] CPU: 0 UID: 0 PID: 7877 Comm: syz.0.633 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 285.362676][ T7877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 285.362688][ T7877] Call Trace: [ 285.362696][ T7877] [ 285.362703][ T7877] dump_stack_lvl+0xe8/0x150 [ 285.362731][ T7877] should_fail_ex+0x46b/0x600 [ 285.362763][ T7877] should_failslab+0xa8/0x100 [ 285.362787][ T7877] __kmalloc_noprof+0xdf/0x7b0 [ 285.362806][ T7877] ? kfree+0x4d/0x6c0 [ 285.362822][ T7877] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 285.362854][ T7877] tomoyo_realpath_from_path+0xe3/0x5d0 [ 285.362881][ T7877] ? tomoyo_domain+0xd8/0x130 [ 285.362904][ T7877] ? tomoyo_path_number_perm+0x219/0x630 [ 285.362925][ T7877] tomoyo_path_number_perm+0x246/0x630 [ 285.362950][ T7877] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 285.362972][ T7877] ? __lock_acquire+0x6b5/0x2cf0 [ 285.362998][ T7877] ? do_raw_spin_lock+0x12b/0x2f0 [ 285.363051][ T7877] ? __fget_files+0x2a/0x420 [ 285.363071][ T7877] ? __fget_files+0x2a/0x420 [ 285.363086][ T7877] ? __fget_files+0x3a6/0x420 [ 285.363102][ T7877] ? __fget_files+0x2a/0x420 [ 285.363123][ T7877] security_file_ioctl+0xc3/0x2a0 [ 285.363148][ T7877] __se_sys_ioctl+0x47/0x170 [ 285.363170][ T7877] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.363190][ T7877] do_syscall_64+0x15f/0xf80 [ 285.363209][ T7877] ? trace_irq_disable+0x3b/0x140 [ 285.363230][ T7877] ? clear_bhb_loop+0x40/0x90 [ 285.363253][ T7877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.363271][ T7877] RIP: 0033:0x7fa3ae1ecdd9 [ 285.363290][ T7877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 285.363306][ T7877] RSP: 002b:00007fa3ac425028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 285.363326][ T7877] RAX: ffffffffffffffda RBX: 00007fa3ae466090 RCX: 00007fa3ae1ecdd9 [ 285.363339][ T7877] RDX: 0000000000000000 RSI: 0000000000005406 RDI: 0000000000000003 [ 285.363351][ T7877] RBP: 00007fa3ac425090 R08: 0000000000000000 R09: 0000000000000000 [ 285.363363][ T7877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 285.363374][ T7877] R13: 00007fa3ae466128 R14: 00007fa3ae466090 R15: 00007ffd5d8cca28 [ 285.363406][ T7877] [ 285.363414][ T7877] ERROR: Out of memory at tomoyo_realpath_from_path. [ 285.730458][ T37] kauditd_printk_skb: 175 callbacks suppressed [ 285.730476][ T37] audit: type=1326 audit(2001572970.106:1027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763496][ T37] audit: type=1326 audit(2001572970.116:1028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763549][ T37] audit: type=1326 audit(2001572970.116:1029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763589][ T37] audit: type=1326 audit(2001572970.116:1030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763629][ T37] audit: type=1326 audit(2001572970.136:1031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763670][ T37] audit: type=1326 audit(2001572970.136:1032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763718][ T37] audit: type=1326 audit(2001572970.136:1033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763758][ T37] audit: type=1326 audit(2001572970.136:1034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763805][ T37] audit: type=1326 audit(2001572970.136:1035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 285.763847][ T37] audit: type=1326 audit(2001572970.136:1036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7882 comm="syz.0.635" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 286.272435][ T7890] sctp: [Deprecated]: syz.2.636 (pid 7890) Use of int in max_burst socket option. [ 286.272435][ T7890] Use struct sctp_assoc_value instead [ 286.477223][ T7898] netlink: 'syz.4.639': attribute type 2 has an invalid length. [ 287.074002][ T7915] binfmt_misc: register: failed to install interpreter file qY3aK [ 288.102621][ T9] usb 4-1: new full-speed USB device number 24 using dummy_hcd [ 288.183045][ T5739] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 288.276362][ T9] usb 4-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 288.276393][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.276413][ T9] usb 4-1: Product: syz [ 288.276426][ T9] usb 4-1: Manufacturer: syz [ 288.276439][ T9] usb 4-1: SerialNumber: syz [ 288.284708][ T9] usb 4-1: config 0 descriptor?? [ 288.352546][ T5739] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 288.352575][ T5739] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.380616][ T5739] usb 3-1: config 0 descriptor?? [ 288.407447][ T5739] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 288.651525][ T7941] sctp: [Deprecated]: syz.4.655 (pid 7941) Use of int in max_burst socket option. [ 288.651525][ T7941] Use struct sctp_assoc_value instead [ 288.930344][ T5739] gp8psk: usb in 128 operation failed. [ 288.930805][ T5739] gp8psk: usb in 137 operation failed. [ 288.930821][ T5739] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 288.930857][ T5739] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 288.994807][ T5739] usb 3-1: USB disconnect, device number 12 [ 289.312652][ T9] ums-onetouch 4-1:0.0: USB Mass Storage device detected [ 289.738462][ T9] usb 4-1: USB disconnect, device number 24 [ 289.901944][ T7955] binfmt_misc: register: failed to install interpreter file qY3aK [ 291.723260][ T7971] sctp: [Deprecated]: syz.4.666 (pid 7971) Use of int in max_burst socket option. [ 291.723260][ T7971] Use struct sctp_assoc_value instead [ 291.825598][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 291.985561][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 291.987394][ T10] usb 3-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 291.987419][ T10] usb 3-1: config 179 has 0 interfaces, different from the descriptor's value: 1 [ 291.987449][ T10] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 291.987462][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.469246][ T7980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.498165][ T7980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.942787][ T7984] netlink: 4 bytes leftover after parsing attributes in process `syz.4.671'. [ 292.942862][ T7984] netlink: 24 bytes leftover after parsing attributes in process `syz.4.671'. [ 293.292315][ T7988] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 293.499715][ T5739] usb 3-1: USB disconnect, device number 13 [ 293.673172][ T7992] binfmt_misc: register: failed to install interpreter file qY3aK [ 293.699902][ T6009] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 293.846896][ T6009] usb 2-1: Using ep0 maxpacket: 8 [ 293.851066][ T6009] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 293.851094][ T6009] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 293.854362][ T6009] usb 2-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 293.854389][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 293.854408][ T6009] usb 2-1: Product: syz [ 293.854423][ T6009] usb 2-1: Manufacturer: syz [ 293.854436][ T6009] usb 2-1: SerialNumber: syz [ 293.921531][ T6009] usb 2-1: config 0 descriptor?? [ 294.388162][ T5739] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 294.520929][ T8002] netlink: zone id is out of range [ 294.520940][ T8002] netlink: zone id is out of range [ 294.520954][ T8002] netlink: zone id is out of range [ 294.520958][ T8002] netlink: zone id is out of range [ 294.520962][ T8002] netlink: zone id is out of range [ 294.520966][ T8002] netlink: zone id is out of range [ 294.520970][ T8002] netlink: zone id is out of range [ 294.520974][ T8002] netlink: zone id is out of range [ 294.520978][ T8002] netlink: zone id is out of range [ 294.520982][ T8002] netlink: zone id is out of range [ 294.540871][ T5739] usb 3-1: Using ep0 maxpacket: 32 [ 294.593770][ T5739] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 294.593799][ T5739] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.630355][ T5739] usb 3-1: config 0 descriptor?? [ 294.851062][ T5739] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 294.913959][ T5739] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 294.923797][ T5739] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 294.923856][ T5739] usb 3-1: media controller created [ 294.997197][ T5739] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 295.289849][ T5739] DVB: Unable to find symbol dib7000p_attach() [ 295.289861][ T5739] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 295.419141][ T5739] rc_core: IR keymap rc-dib0700-rc5 not found [ 295.419154][ T5739] Registered IR keymap rc-empty [ 295.419323][ T5739] dvb-usb: could not initialize remote control. [ 295.419328][ T5739] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 295.530244][ T59] Bluetooth: hci2: unexpected event for opcode 0x1009 [ 295.647430][ T5739] usb 3-1: USB disconnect, device number 14 [ 295.768013][ T5739] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 297.229240][ T868] usb 2-1: USB disconnect, device number 19 [ 297.730474][ T8035] netlink: 4 bytes leftover after parsing attributes in process `syz.1.683'. [ 298.542795][ T37] kauditd_printk_skb: 301 callbacks suppressed [ 298.542812][ T37] audit: type=1326 audit(2001572982.907:1338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.547546][ T37] audit: type=1326 audit(2001572982.907:1339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.548042][ T37] audit: type=1326 audit(2001572982.907:1340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.550459][ T37] audit: type=1326 audit(2001572982.907:1341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.550503][ T37] audit: type=1326 audit(2001572982.917:1342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.553949][ T37] audit: type=1326 audit(2001572982.917:1343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.554244][ T37] audit: type=1326 audit(2001572982.917:1344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.556345][ T37] audit: type=1326 audit(2001572982.917:1345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.556387][ T37] audit: type=1326 audit(2001572982.917:1346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.556424][ T37] audit: type=1326 audit(2001572982.917:1347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8036 comm="syz.3.685" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f790b57cdd9 code=0x7ffc0000 [ 298.859044][ T8039] binfmt_misc: register: failed to install interpreter file qY3aK [ 300.046978][ T59] Bluetooth: hci2: unexpected event for opcode 0x1009 [ 300.123552][ T5739] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 300.262591][ T5739] usb 2-1: device descriptor read/64, error -71 [ 300.349093][ T8066] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 300.502252][ T5739] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 300.531468][ T6009] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 300.631453][ T5739] usb 2-1: device descriptor read/64, error -71 [ 300.681438][ T6009] usb 1-1: Using ep0 maxpacket: 8 [ 300.683711][ T6009] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 300.683726][ T6009] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 300.685636][ T6009] usb 1-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 300.685653][ T6009] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 300.685663][ T6009] usb 1-1: Product: syz [ 300.685670][ T6009] usb 1-1: Manufacturer: syz [ 300.685677][ T6009] usb 1-1: SerialNumber: syz [ 300.700986][ T6009] usb 1-1: config 0 descriptor?? [ 300.742981][ T5739] usb usb2-port1: attempt power cycle [ 301.081762][ T5739] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 301.102562][ T5739] usb 2-1: device descriptor read/8, error -71 [ 301.255416][ T8072] warning: `syz.2.696' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 301.259273][ T8072] net_ratelimit: 1 callbacks suppressed [ 301.259291][ T8072] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 301.306467][ T8075] FAULT_INJECTION: forcing a failure. [ 301.306467][ T8075] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 301.306489][ T8075] CPU: 1 UID: 0 PID: 8075 Comm: syz.4.697 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 301.306502][ T8075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 301.306508][ T8075] Call Trace: [ 301.306513][ T8075] [ 301.306517][ T8075] dump_stack_lvl+0xe8/0x150 [ 301.306534][ T8075] should_fail_ex+0x46b/0x600 [ 301.306553][ T8075] _copy_from_user+0x2d/0xb0 [ 301.306566][ T8075] ___sys_sendmsg+0x1c6/0x360 [ 301.306580][ T8075] ? __lock_acquire+0x6b5/0x2cf0 [ 301.306596][ T8075] ? __pfx____sys_sendmsg+0x10/0x10 [ 301.306624][ T8075] ? __fget_files+0x2a/0x420 [ 301.306633][ T8075] ? __fget_files+0x3a6/0x420 [ 301.306647][ T8075] __x64_sys_sendmsg+0x1c3/0x2a0 [ 301.306661][ T8075] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 301.306677][ T8075] ? __pfx_ksys_write+0x10/0x10 [ 301.306700][ T8075] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.306711][ T8075] do_syscall_64+0x15f/0xf80 [ 301.306722][ T8075] ? trace_irq_disable+0x3b/0x140 [ 301.306734][ T8075] ? clear_bhb_loop+0x40/0x90 [ 301.306746][ T8075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.306760][ T8075] RIP: 0033:0x7f4d574bcdd9 [ 301.306770][ T8075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.306783][ T8075] RSP: 002b:00007f4d556ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 301.306800][ T8075] RAX: ffffffffffffffda RBX: 00007f4d57736090 RCX: 00007f4d574bcdd9 [ 301.306813][ T8075] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 301.306824][ T8075] RBP: 00007f4d556ed090 R08: 0000000000000000 R09: 0000000000000000 [ 301.306834][ T8075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 301.306841][ T8075] R13: 00007f4d57736128 R14: 00007f4d57736090 R15: 00007ffd0ec59108 [ 301.306856][ T8075] [ 301.342040][ T5739] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 301.365547][ T5739] usb 2-1: device descriptor read/8, error -71 [ 301.389210][ T8073] netlink: zone id is out of range [ 301.389224][ T8073] netlink: zone id is out of range [ 301.389235][ T8073] netlink: zone id is out of range [ 301.389243][ T8073] netlink: zone id is out of range [ 301.389250][ T8073] netlink: zone id is out of range [ 301.389258][ T8073] netlink: zone id is out of range [ 301.389265][ T8073] netlink: zone id is out of range [ 301.389287][ T8073] netlink: zone id is out of range [ 301.389294][ T8073] netlink: zone id is out of range [ 301.445503][ T8078] netlink: 20 bytes leftover after parsing attributes in process `syz.2.696'. [ 301.445838][ T8078] binder: 8070:8078 ioctl c038586a 2000000001c0 returned -22 [ 301.477353][ T5739] usb usb2-port1: unable to enumerate USB device [ 301.763107][ T8081] netlink: 4 bytes leftover after parsing attributes in process `syz.3.698'. [ 303.071219][ T8092] netlink: 72 bytes leftover after parsing attributes in process `syz.2.703'. [ 303.977293][ T6009] usb 1-1: USB disconnect, device number 28 [ 303.981300][ T8100] FAULT_INJECTION: forcing a failure. [ 303.981300][ T8100] name failslab, interval 1, probability 0, space 0, times 0 [ 303.981331][ T8100] CPU: 0 UID: 0 PID: 8100 Comm: syz.3.705 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 303.981353][ T8100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 303.981375][ T8100] Call Trace: [ 303.981383][ T8100] [ 303.981390][ T8100] dump_stack_lvl+0xe8/0x150 [ 303.981417][ T8100] should_fail_ex+0x46b/0x600 [ 303.981450][ T8100] should_failslab+0xa8/0x100 [ 303.981473][ T8100] __kmalloc_noprof+0xdf/0x7b0 [ 303.981491][ T8100] ? kfree+0x4d/0x6c0 [ 303.981506][ T8100] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 303.981535][ T8100] tomoyo_realpath_from_path+0xe3/0x5d0 [ 303.981559][ T8100] ? tomoyo_domain+0xd8/0x130 [ 303.981582][ T8100] ? tomoyo_path_number_perm+0x219/0x630 [ 303.981605][ T8100] tomoyo_path_number_perm+0x246/0x630 [ 303.981630][ T8100] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 303.981649][ T8100] ? __lock_acquire+0x6b5/0x2cf0 [ 303.981673][ T8100] ? do_raw_spin_lock+0x12b/0x2f0 [ 303.981721][ T8100] ? __fget_files+0x2a/0x420 [ 303.981740][ T8100] ? __fget_files+0x2a/0x420 [ 303.981755][ T8100] ? __fget_files+0x3a6/0x420 [ 303.981779][ T8100] ? __fget_files+0x2a/0x420 [ 303.981803][ T8100] security_file_ioctl+0xc3/0x2a0 [ 303.981829][ T8100] __se_sys_ioctl+0x47/0x170 [ 303.981847][ T8100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.981867][ T8100] do_syscall_64+0x15f/0xf80 [ 303.981884][ T8100] ? trace_irq_disable+0x3b/0x140 [ 303.981903][ T8100] ? clear_bhb_loop+0x40/0x90 [ 303.981924][ T8100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.981941][ T8100] RIP: 0033:0x7f790b57cdd9 [ 303.981957][ T8100] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 303.981973][ T8100] RSP: 002b:00007f79097ce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 303.981992][ T8100] RAX: ffffffffffffffda RBX: 00007f790b7f5fa0 RCX: 00007f790b57cdd9 [ 303.982005][ T8100] RDX: 0000200000000040 RSI: 00000000c008561c RDI: 0000000000000003 [ 303.982017][ T8100] RBP: 00007f79097ce090 R08: 0000000000000000 R09: 0000000000000000 [ 303.982028][ T8100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.982038][ T8100] R13: 00007f790b7f6038 R14: 00007f790b7f5fa0 R15: 00007ffdc53a4e58 [ 303.982068][ T8100] [ 303.982075][ T8100] ERROR: Out of memory at tomoyo_realpath_from_path. [ 304.514595][ T8111] netlink: 20 bytes leftover after parsing attributes in process `syz.4.709'. [ 304.514953][ T8111] binder: 8109:8111 ioctl c038586a 2000000001c0 returned -22 [ 305.107822][ T8122] netlink: 4 bytes leftover after parsing attributes in process `syz.1.711'. [ 305.132022][ T8122] bridge0: port 3(macsec1) entered blocking state [ 305.132148][ T8122] bridge0: port 3(macsec1) entered disabled state [ 305.132293][ T8122] macsec1: entered allmulticast mode [ 305.185218][ T8122] macsec1: left allmulticast mode [ 306.543883][ T8128] netlink: 830 bytes leftover after parsing attributes in process `syz.0.712'. [ 307.644766][ T5711] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 307.865929][ T5711] usb 5-1: device descriptor read/64, error -71 [ 308.016641][ T8142] netlink: 72 bytes leftover after parsing attributes in process `syz.2.718'. [ 308.105982][ T5711] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 308.238132][ T5711] usb 5-1: device descriptor read/64, error -71 [ 308.346433][ T5711] usb usb5-port1: attempt power cycle [ 308.481458][ T6009] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 308.627816][ T6009] usb 4-1: Using ep0 maxpacket: 16 [ 308.643203][ T6009] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 308.643229][ T6009] usb 4-1: config 0 has no interface number 0 [ 308.645924][ T6009] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 308.645952][ T6009] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.645971][ T6009] usb 4-1: Product: syz [ 308.645982][ T6009] usb 4-1: Manufacturer: syz [ 308.645990][ T6009] usb 4-1: SerialNumber: syz [ 308.679013][ T6009] usb 4-1: config 0 descriptor?? [ 308.718415][ T6009] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 309.230049][ T8171] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 309.475724][ T8176] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 310.217483][ T6009] gspca_spca1528: reg_w err -110 [ 310.217583][ T6009] spca1528 4-1:0.1: probe with driver spca1528 failed with error -110 [ 310.686637][ T8189] netlink: 72 bytes leftover after parsing attributes in process `syz.4.733'. [ 311.458634][ T6009] usb 4-1: USB disconnect, device number 25 [ 311.838221][ T6009] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 311.988407][ T6009] usb 4-1: Using ep0 maxpacket: 8 [ 311.991105][ T6009] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 311.991131][ T6009] usb 4-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 311.991150][ T6009] usb 4-1: config 179 has no interface number 0 [ 311.991182][ T6009] usb 4-1: config 179 interface 65 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 311.991205][ T6009] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 311.991217][ T6009] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 312.428503][ T6009] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 312.454069][ T8223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 312.458166][ T8223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 312.617122][ T6009] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 312.617152][ T6009] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.617169][ T6009] usb 1-1: Product: syz [ 312.617177][ T6009] usb 1-1: Manufacturer: syz [ 312.617184][ T6009] usb 1-1: SerialNumber: syz [ 313.371541][ T5711] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 313.529046][ T5711] usb 3-1: Using ep0 maxpacket: 8 [ 313.531923][ T5711] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 313.531947][ T5711] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 313.710942][ T5711] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 313.710972][ T5711] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 313.710992][ T5711] usb 3-1: Product: syz [ 313.711007][ T5711] usb 3-1: Manufacturer: syz [ 313.711022][ T5711] usb 3-1: SerialNumber: syz [ 314.531378][ T8231] sctp: [Deprecated]: syz.0.742 (pid 8231) Use of int in maxseg socket option. [ 314.531378][ T8231] Use struct sctp_assoc_value instead [ 314.654183][ T8233] netlink: 60 bytes leftover after parsing attributes in process `syz.4.746'. [ 314.818972][ T5711] usb 3-1: config 0 descriptor?? [ 315.013443][ T6009] rtl8150 1-1:1.0: couldn't reset the device [ 315.014544][ T6009] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 315.019842][ T9] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 315.102705][ T6009] usb 1-1: USB disconnect, device number 29 [ 315.280051][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 315.299420][ T9] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 315.299467][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 315.348169][ T9] usb 2-1: config 0 descriptor?? [ 315.422208][ T8238] netlink: 'syz.4.748': attribute type 7 has an invalid length. [ 315.426182][ T8238] Unsupported ieee802154 address type: 0 [ 315.565878][ T8240] net_ratelimit: 3 callbacks suppressed [ 315.565898][ T8240] netlink: zone id is out of range [ 315.565906][ T8240] netlink: zone id is out of range [ 315.565918][ T8240] netlink: zone id is out of range [ 315.565926][ T8240] netlink: zone id is out of range [ 315.565934][ T8240] netlink: zone id is out of range [ 315.565942][ T8240] netlink: zone id is out of range [ 315.565949][ T8240] netlink: zone id is out of range [ 315.565956][ T8240] netlink: zone id is out of range [ 315.565964][ T8240] netlink: zone id is out of range [ 315.565971][ T8240] netlink: zone id is out of range [ 315.735010][ T9] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 315.810579][ T5731] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 315.810865][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 315.953089][ T5731] usb 5-1: device descriptor read/64, error -32 [ 316.127230][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 316.150198][ T9] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 316.150319][ T9] usb 2-1: media controller created [ 316.223360][ T5731] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 316.390627][ T5731] usb 5-1: Using ep0 maxpacket: 8 [ 316.400777][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 316.502596][ T5731] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 316.502629][ T5731] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 316.502644][ T5731] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 316.520948][ T6009] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 316.644805][ T5731] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 316.644835][ T5731] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 316.644855][ T5731] usb 5-1: Product: syz [ 316.644869][ T5731] usb 5-1: Manufacturer: syz [ 316.644883][ T5731] usb 5-1: SerialNumber: syz [ 316.744162][ T5731] usb 5-1: config 0 descriptor?? [ 316.770905][ T6009] usb 1-1: Using ep0 maxpacket: 16 [ 316.847560][ T5731] imon_raw 5-1:0.0: IR endpoint missing [ 316.892960][ T6009] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 316.892988][ T6009] usb 1-1: config 0 has no interface number 0 [ 317.028961][ T6009] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 317.028980][ T6009] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.028992][ T6009] usb 1-1: Product: syz [ 317.028999][ T6009] usb 1-1: Manufacturer: syz [ 317.029006][ T6009] usb 1-1: SerialNumber: syz [ 317.077655][ T6009] usb 1-1: config 0 descriptor?? [ 317.161997][ T6009] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 317.216227][ T31] usb 5-1: USB disconnect, device number 27 [ 317.246205][ T9] DVB: Unable to find symbol dib7000p_attach() [ 317.246221][ T9] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 317.383954][ T9] rc_core: IR keymap rc-dib0700-rc5 not found [ 317.384030][ T9] Registered IR keymap rc-empty [ 317.384579][ T9] dvb-usb: could not initialize remote control. [ 317.384589][ T9] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 317.450158][ T5740] usb 3-1: USB disconnect, device number 15 [ 317.617955][ T9] usb 2-1: USB disconnect, device number 24 [ 317.723680][ T8248] sctp: [Deprecated]: syz.2.750 (pid 8248) Use of int in max_burst socket option. [ 317.723680][ T8248] Use struct sctp_assoc_value instead [ 317.948826][ T9] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 318.107060][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.111397][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.373634][ T5914] usb 4-1: USB disconnect, device number 26 [ 318.624655][ T6009] gspca_spca1528: reg_w err -110 [ 318.624750][ T6009] spca1528 1-1:0.1: probe with driver spca1528 failed with error -110 [ 319.012073][ T5914] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 319.323282][ T5914] usb 4-1: Using ep0 maxpacket: 32 [ 319.841992][ T5914] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 319.842020][ T5914] usb 4-1: config 0 has no interface number 0 [ 319.842069][ T5914] usb 4-1: config 0 interface 184 has no altsetting 0 [ 320.011724][ T10] usb 1-1: USB disconnect, device number 30 [ 320.057223][ T5914] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 320.057256][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.057291][ T5914] usb 4-1: Product: syz [ 320.057305][ T5914] usb 4-1: Manufacturer: syz [ 320.057320][ T5914] usb 4-1: SerialNumber: syz [ 320.106679][ T5914] usb 4-1: config 0 descriptor?? [ 320.629322][ T8269] fuse: Bad value for 'user_id' [ 320.629341][ T8269] fuse: Bad value for 'user_id' [ 320.631892][ T8269] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 320.631920][ T8269] overlayfs: missing 'lowerdir' [ 320.720490][ T5914] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 320.720520][ T5914] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 320.720540][ T5914] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 320.720828][ T5914] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -32 [ 321.244841][ T5914] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 321.374019][ T5740] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 321.399612][ T5914] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 321.399644][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.399663][ T5914] usb 1-1: Product: syz [ 321.399677][ T5914] usb 1-1: Manufacturer: syz [ 321.399691][ T5914] usb 1-1: SerialNumber: syz [ 321.544137][ T5740] usb 5-1: Using ep0 maxpacket: 8 [ 321.547187][ T5740] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.547213][ T5740] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 321.563725][ T5740] usb 5-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 321.601177][ T5740] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.601204][ T5740] usb 5-1: Product: syz [ 321.601217][ T5740] usb 5-1: Manufacturer: syz [ 321.601231][ T5740] usb 5-1: SerialNumber: syz [ 321.636157][ T5740] usb 5-1: config 0 descriptor?? [ 321.662658][ T8291] netlink: 'syz.1.761': attribute type 7 has an invalid length. [ 321.685130][ T8291] Unsupported ieee802154 address type: 0 [ 321.855120][ T8284] sctp: [Deprecated]: syz.0.759 (pid 8284) Use of int in maxseg socket option. [ 321.855120][ T8284] Use struct sctp_assoc_value instead [ 321.953654][ T9] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 322.033799][ T31] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 322.103228][ T5914] rtl8150 1-1:1.0: couldn't reset the device [ 322.103513][ T5914] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 322.104068][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 322.127905][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 322.127960][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 322.127986][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 322.132691][ T9] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 322.132722][ T9] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 322.132742][ T9] usb 2-1: Product: syz [ 322.132756][ T9] usb 2-1: Manufacturer: syz [ 322.132769][ T9] usb 2-1: SerialNumber: syz [ 322.213771][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 322.219002][ T31] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 322.219030][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.224096][ T9] usb 2-1: config 0 descriptor?? [ 322.247795][ T5914] usb 1-1: USB disconnect, device number 31 [ 322.252912][ T8302] net_ratelimit: 1 callbacks suppressed [ 322.252928][ T8302] netlink: zone id is out of range [ 322.252936][ T8302] netlink: zone id is out of range [ 322.252946][ T8302] netlink: zone id is out of range [ 322.252954][ T8302] netlink: zone id is out of range [ 322.252961][ T8302] netlink: zone id is out of range [ 322.252968][ T8302] netlink: zone id is out of range [ 322.252976][ T8302] netlink: zone id is out of range [ 322.252982][ T8302] netlink: zone id is out of range [ 322.252990][ T8302] netlink: zone id is out of range [ 322.252997][ T8302] netlink: zone id is out of range [ 322.331071][ T5731] usb 4-1: USB disconnect, device number 27 [ 322.331863][ T31] usb 3-1: config 0 descriptor?? [ 322.377740][ T9] imon_raw 2-1:0.0: IR endpoint missing [ 322.450347][ T9] usb 2-1: USB disconnect, device number 25 [ 322.587670][ T31] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 322.650326][ T8309] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 322.650356][ T8309] overlayfs: missing 'lowerdir' [ 322.725583][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 322.726531][ T31] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 322.726584][ T31] usb 3-1: media controller created [ 322.777957][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.958051][ T31] DVB: Unable to find symbol dib7000p_attach() [ 322.958062][ T31] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 323.056464][ T31] rc_core: IR keymap rc-dib0700-rc5 not found [ 323.056486][ T31] Registered IR keymap rc-empty [ 323.056802][ T31] dvb-usb: could not initialize remote control. [ 323.056812][ T31] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 323.163794][ T8318] FAULT_INJECTION: forcing a failure. [ 323.163794][ T8318] name failslab, interval 1, probability 0, space 0, times 0 [ 323.163838][ T8318] CPU: 1 UID: 0 PID: 8318 Comm: syz.1.768 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 323.163859][ T8318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 323.163870][ T8318] Call Trace: [ 323.163877][ T8318] [ 323.163884][ T8318] dump_stack_lvl+0xe8/0x150 [ 323.163911][ T8318] should_fail_ex+0x46b/0x600 [ 323.163943][ T8318] should_failslab+0xa8/0x100 [ 323.163967][ T8318] __kmalloc_noprof+0xdf/0x7b0 [ 323.163985][ T8318] ? kfree+0x4d/0x6c0 [ 323.164001][ T8318] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 323.164034][ T8318] tomoyo_realpath_from_path+0xe3/0x5d0 [ 323.164061][ T8318] ? tomoyo_domain+0xd8/0x130 [ 323.164084][ T8318] ? tomoyo_path_number_perm+0x219/0x630 [ 323.164106][ T8318] tomoyo_path_number_perm+0x246/0x630 [ 323.164133][ T8318] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 323.164152][ T8318] ? __lock_acquire+0x6b5/0x2cf0 [ 323.164177][ T8318] ? do_raw_spin_lock+0x12b/0x2f0 [ 323.164223][ T8318] ? __fget_files+0x2a/0x420 [ 323.164242][ T8318] ? __fget_files+0x2a/0x420 [ 323.164257][ T8318] ? __fget_files+0x3a6/0x420 [ 323.164270][ T8318] ? __fget_files+0x2a/0x420 [ 323.164289][ T8318] security_file_ioctl+0xc3/0x2a0 [ 323.164313][ T8318] __se_sys_ioctl+0x47/0x170 [ 323.164331][ T8318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.164351][ T8318] do_syscall_64+0x15f/0xf80 [ 323.164370][ T8318] ? trace_irq_disable+0x3b/0x140 [ 323.164390][ T8318] ? clear_bhb_loop+0x40/0x90 [ 323.164412][ T8318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.164428][ T8318] RIP: 0033:0x7f97cde1cdd9 [ 323.164446][ T8318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.164460][ T8318] RSP: 002b:00007f97cc06e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 323.164479][ T8318] RAX: ffffffffffffffda RBX: 00007f97ce095fa0 RCX: 00007f97cde1cdd9 [ 323.164492][ T8318] RDX: 00002000000000c0 RSI: 00000000000089f8 RDI: 0000000000000003 [ 323.164504][ T8318] RBP: 00007f97cc06e090 R08: 0000000000000000 R09: 0000000000000000 [ 323.164515][ T8318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 323.164526][ T8318] R13: 00007f97ce096038 R14: 00007f97ce095fa0 R15: 00007fffd99accf8 [ 323.164555][ T8318] [ 323.196483][ T8318] ERROR: Out of memory at tomoyo_realpath_from_path. [ 323.266023][ T5731] usb 3-1: USB disconnect, device number 16 [ 323.357008][ T59] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 323.489380][ T5731] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 324.116229][ T8335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.772'. [ 324.927852][ T5914] usb 5-1: USB disconnect, device number 28 [ 325.280445][ T8340] netlink: 'syz.2.774': attribute type 7 has an invalid length. [ 325.536976][ T8339] Unsupported ieee802154 address type: 0 [ 325.545155][ T8352] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 325.545184][ T8352] overlayfs: missing 'lowerdir' [ 325.593294][ T31] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 325.914303][ T5914] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 326.033694][ T8355] netlink: 'syz.0.778': attribute type 7 has an invalid length. [ 326.061532][ T31] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 326.061562][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 326.061581][ T31] usb 4-1: Product: syz [ 326.061594][ T31] usb 4-1: Manufacturer: syz [ 326.061607][ T31] usb 4-1: SerialNumber: syz [ 326.171679][ T8355] Unsupported ieee802154 address type: 0 [ 326.189567][ T5914] usb 3-1: Using ep0 maxpacket: 8 [ 326.334181][ T5914] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 326.334235][ T5914] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 326.334275][ T5914] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 326.574814][ T5914] usb 3-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 326.574847][ T5914] usb 3-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 326.574867][ T5914] usb 3-1: Product: syz [ 326.574881][ T5914] usb 3-1: Manufacturer: syz [ 326.574895][ T5914] usb 3-1: SerialNumber: syz [ 327.037014][ T6009] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 327.037277][ C1] raw-gadget.2 gadget.0: ignoring, device is not running [ 327.183531][ T8344] input: syz1 as /devices/virtual/input/input13 [ 327.192383][ T6009] usb 1-1: device descriptor read/64, error -32 [ 327.249769][ T5914] usb 3-1: config 0 descriptor?? [ 327.387259][ T59] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 327.387553][ T59] Bluetooth: hci2: Injecting HCI hardware error event [ 327.397341][ T4916] Bluetooth: hci2: hardware error 0x00 [ 327.478274][ T6009] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 327.708159][ T5914] imon_raw 3-1:0.0: IR endpoint missing [ 327.789774][ T6009] usb 1-1: Using ep0 maxpacket: 8 [ 327.845391][ T8358] sctp: [Deprecated]: syz.3.776 (pid 8358) Use of int in maxseg socket option. [ 327.845391][ T8358] Use struct sctp_assoc_value instead [ 327.845887][ T6009] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 327.845936][ T6009] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 327.845960][ T6009] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 327.923733][ T6009] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 327.923753][ T6009] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 327.923764][ T6009] usb 1-1: Product: syz [ 327.923772][ T6009] usb 1-1: Manufacturer: syz [ 327.923779][ T6009] usb 1-1: SerialNumber: syz [ 327.929478][ T5914] usb 3-1: USB disconnect, device number 17 [ 328.102312][ T6009] usb 1-1: config 0 descriptor?? [ 328.124204][ T6009] imon_raw 1-1:0.0: IR endpoint missing [ 328.280301][ T31] rtl8150 4-1:1.0: couldn't reset the device [ 328.280663][ T31] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 328.353810][ T31] usb 4-1: USB disconnect, device number 28 [ 328.386078][ T5914] usb 1-1: USB disconnect, device number 33 [ 328.845468][ T8364] netlink: 104 bytes leftover after parsing attributes in process `syz.1.781'. [ 329.009494][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 329.061116][ T8376] netlink: 8 bytes leftover after parsing attributes in process `syz.0.786'. [ 329.148131][ T5731] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 329.167438][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 329.170952][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 329.170977][ T9] usb 3-1: config 0 has no interface number 0 [ 329.174443][ T9] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 329.174469][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.174488][ T9] usb 3-1: Product: syz [ 329.174502][ T9] usb 3-1: Manufacturer: syz [ 329.174516][ T9] usb 3-1: SerialNumber: syz [ 329.203929][ T9] usb 3-1: config 0 descriptor?? [ 329.214118][ T31] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 329.235854][ T9] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 329.297569][ T5731] usb 4-1: Using ep0 maxpacket: 32 [ 329.321337][ T5731] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 329.321365][ T5731] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.338795][ T5731] usb 4-1: config 0 descriptor?? [ 329.397509][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 329.400144][ T31] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 329.400169][ T31] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 329.404089][ T31] usb 2-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 329.404117][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.404136][ T31] usb 2-1: Product: syz [ 329.404150][ T31] usb 2-1: Manufacturer: syz [ 329.404163][ T31] usb 2-1: SerialNumber: syz [ 329.464899][ T31] usb 2-1: config 0 descriptor?? [ 329.551798][ T5731] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 329.586248][ T5731] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 329.592179][ T5731] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 329.592449][ T5731] usb 4-1: media controller created [ 329.625552][ T5731] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 329.836064][ T5731] DVB: Unable to find symbol dib7000p_attach() [ 329.836081][ T5731] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 329.857951][ T4916] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 329.938358][ T5731] rc_core: IR keymap rc-dib0700-rc5 not found [ 329.938441][ T5731] Registered IR keymap rc-empty [ 329.938961][ T5731] dvb-usb: could not initialize remote control. [ 329.938972][ T5731] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 330.043911][ T8385] net_ratelimit: 1 callbacks suppressed [ 330.043930][ T8385] netlink: zone id is out of range [ 330.043939][ T8385] netlink: zone id is out of range [ 330.043949][ T8385] netlink: zone id is out of range [ 330.043957][ T8385] netlink: zone id is out of range [ 330.043965][ T8385] netlink: zone id is out of range [ 330.043973][ T8385] netlink: zone id is out of range [ 330.043980][ T8385] netlink: zone id is out of range [ 330.043988][ T8385] netlink: zone id is out of range [ 330.043996][ T8385] netlink: zone id is out of range [ 330.044004][ T8385] netlink: zone id is out of range [ 330.177073][ T31] usb 4-1: USB disconnect, device number 29 [ 330.242127][ T31] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 330.739089][ T9] gspca_spca1528: reg_w err -110 [ 330.739185][ T9] spca1528 3-1:0.1: probe with driver spca1528 failed with error -110 [ 330.783009][ T8390] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 330.783038][ T8390] overlayfs: missing 'lowerdir' [ 331.022864][ T8398] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 331.270067][ T6009] IPVS: starting estimator thread 0... [ 331.372188][ T8402] IPVS: using max 8 ests per chain, 19200 per kthread [ 332.017799][ T6009] usb 2-1: USB disconnect, device number 26 [ 332.329955][ T6009] usb 3-1: USB disconnect, device number 18 [ 332.500306][ T37] kauditd_printk_skb: 80 callbacks suppressed [ 332.500407][ T37] audit: type=1326 audit(2001573016.848:1428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.501093][ T37] audit: type=1326 audit(2001573016.848:1429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.501615][ T37] audit: type=1326 audit(2001573016.848:1430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.502226][ T37] audit: type=1326 audit(2001573016.848:1431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.502488][ T37] audit: type=1326 audit(2001573016.848:1432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.502991][ T37] audit: type=1326 audit(2001573016.848:1433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.503318][ T37] audit: type=1326 audit(2001573016.848:1434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.503600][ T37] audit: type=1326 audit(2001573016.848:1435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.504124][ T37] audit: type=1326 audit(2001573016.848:1436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 332.504567][ T37] audit: type=1326 audit(2001573016.848:1437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8423 comm="syz.2.798" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1dec2bcdd9 code=0x7ffc0000 [ 333.101367][ T8437] overlay: filesystem on ./file0 is read-only [ 333.229528][ T31] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 333.579705][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 333.582602][ T31] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 333.582630][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.588643][ T31] usb 5-1: config 0 descriptor?? [ 334.322998][ T31] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 334.379307][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 334.389837][ T31] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 334.389892][ T31] usb 5-1: media controller created [ 334.520306][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 334.704238][ T8452] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 334.835645][ T31] DVB: Unable to find symbol dib7000p_attach() [ 334.835662][ T31] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 335.030464][ T31] rc_core: IR keymap rc-dib0700-rc5 not found [ 335.030484][ T31] Registered IR keymap rc-empty [ 335.030766][ T31] dvb-usb: could not initialize remote control. [ 335.030775][ T31] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 335.623980][ T6009] usb 5-1: USB disconnect, device number 29 [ 335.656671][ T6009] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 335.690946][ T5845] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 335.723834][ T8464] netlink: 8 bytes leftover after parsing attributes in process `syz.0.810'. [ 335.840900][ T5845] usb 4-1: Using ep0 maxpacket: 16 [ 335.842969][ T5845] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 335.842994][ T5845] usb 4-1: config 0 has no interface number 0 [ 335.845257][ T5845] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 335.845283][ T5845] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.845302][ T5845] usb 4-1: Product: syz [ 335.845370][ T5845] usb 4-1: Manufacturer: syz [ 335.845384][ T5845] usb 4-1: SerialNumber: syz [ 335.850476][ T5845] usb 4-1: config 0 descriptor?? [ 335.925594][ T5845] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 337.271639][ T6009] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 337.421904][ T6009] usb 2-1: Using ep0 maxpacket: 32 [ 337.440896][ T6009] usb 2-1: config 1 interface 0 altsetting 2 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 337.440930][ T6009] usb 2-1: config 1 interface 0 has no altsetting 0 [ 337.476834][ T6009] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 337.476863][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.476882][ T6009] usb 2-1: Product: 㠊 [ 337.476895][ T6009] usb 2-1: Manufacturer: Т [ 337.476907][ T6009] usb 2-1: SerialNumber: 䩪쾚麶䆧繙ꎐ⹡榉撡⊘ᵠ趂鮿窨ﳍᡛ뗘䇨溞̥蓧楺庝䚽㶔週꼚카돚綨⿬咵嬽샵报ቆ㡝쯥㳇锆濯Ⲗ䔫⪄Ⅼ疐얏硶鱉뭇Ὧ魦줫㔗ष⾼鏭讛⨶䒶￉㲿禃₤ꕗ᷿ⴀ圡⸡헕␢㛠郔탻赺ﴻﶨꇯᥗ趉铲쮲簤칉엚橈ᱢ︑趠␶ [ 337.544698][ T8478] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 337.687459][ T37] kauditd_printk_skb: 63 callbacks suppressed [ 337.687476][ T37] audit: type=1326 audit(2001573022.035:1501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.691305][ T37] audit: type=1326 audit(2001573022.035:1502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.703624][ T37] audit: type=1326 audit(2001573022.045:1503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.713321][ T37] audit: type=1326 audit(2001573022.065:1504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.714852][ T37] audit: type=1326 audit(2001573022.065:1505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.717473][ T37] audit: type=1326 audit(2001573022.065:1506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.718280][ T37] audit: type=1326 audit(2001573022.065:1507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.719766][ T37] audit: type=1326 audit(2001573022.065:1508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.720408][ T37] audit: type=1326 audit(2001573022.065:1509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 337.721220][ T37] audit: type=1326 audit(2001573022.065:1510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8487 comm="syz.0.818" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 338.012421][ T5845] gspca_spca1528: reg_w err -110 [ 338.012550][ T5845] spca1528 4-1:0.1: probe with driver spca1528 failed with error -110 [ 338.195531][ T6009] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 338.369316][ T6009] usb 2-1: USB disconnect, device number 27 [ 338.982575][ T6009] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 339.200483][ T5914] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 339.212664][ T6009] usb 2-1: Using ep0 maxpacket: 32 [ 339.215227][ T6009] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 339.215254][ T6009] usb 2-1: config 0 has no interface number 0 [ 339.215296][ T6009] usb 2-1: config 0 interface 12 has no altsetting 0 [ 339.218130][ T6009] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 339.218159][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.218178][ T6009] usb 2-1: Product: syz [ 339.218191][ T6009] usb 2-1: Manufacturer: syz [ 339.218203][ T6009] usb 2-1: SerialNumber: syz [ 339.308103][ T8512] netlink: 4 bytes leftover after parsing attributes in process `syz.4.826'. [ 340.020979][ T6009] usb 2-1: config 0 descriptor?? [ 340.109759][ T5914] usb 1-1: Using ep0 maxpacket: 32 [ 340.201051][ T31] usb 4-1: USB disconnect, device number 30 [ 340.231937][ T5914] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 340.231968][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.272275][ T8514] netlink: 8 bytes leftover after parsing attributes in process `syz.4.828'. [ 340.371034][ T5914] usb 1-1: config 0 descriptor?? [ 340.671384][ T5914] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 341.457136][ T5914] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 341.459616][ T5914] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 341.459672][ T5914] usb 1-1: media controller created [ 341.632063][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 341.824607][ T5914] DVB: Unable to find symbol dib7000p_attach() [ 341.824624][ T5914] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 342.834445][ T5914] rc_core: IR keymap rc-dib0700-rc5 not found [ 342.834463][ T5914] Registered IR keymap rc-empty [ 342.834911][ T5914] dvb-usb: could not initialize remote control. [ 342.834922][ T5914] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 342.880891][ T8544] binfmt_misc: register: failed to install interpreter file qY3aK [ 342.927954][ T5914] usb 1-1: USB disconnect, device number 34 [ 343.118810][ T5914] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 343.430234][ T6009] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 343.430300][ T6009] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 343.430443][ T6009] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 343.430543][ T6009] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 343.509692][ T6009] usb 2-1: USB disconnect, device number 28 [ 344.131957][ T5731] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 344.260298][ T5914] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 344.415349][ T5914] usb 2-1: Using ep0 maxpacket: 16 [ 344.418109][ T5914] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 344.418134][ T5914] usb 2-1: config 0 has no interface number 0 [ 344.421580][ T5914] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 344.421607][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.421626][ T5914] usb 2-1: Product: syz [ 344.421640][ T5914] usb 2-1: Manufacturer: syz [ 344.421654][ T5914] usb 2-1: SerialNumber: syz [ 344.480939][ T5914] usb 2-1: config 0 descriptor?? [ 344.511493][ T5914] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 345.329120][ T5731] usb 3-1: Using ep0 maxpacket: 8 [ 345.653250][ T5731] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 345.653282][ T5731] usb 3-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 345.653302][ T5731] usb 3-1: config 179 has no interface number 0 [ 345.653365][ T5731] usb 3-1: config 179 interface 65 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 345.653569][ T5731] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 345.653592][ T5731] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.006333][ T5914] gspca_spca1528: reg_w err -110 [ 346.006436][ T5914] spca1528 2-1:0.1: probe with driver spca1528 failed with error -110 [ 346.393234][ T5731] usb 3-1: can't set config #179, error -71 [ 346.401147][ T5731] usb 3-1: USB disconnect, device number 19 [ 346.606049][ T8563] netlink: 40 bytes leftover after parsing attributes in process `syz.2.840'. [ 347.149512][ T8584] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 347.149541][ T8584] overlayfs: missing 'lowerdir' [ 348.014187][ T5914] usb 2-1: USB disconnect, device number 29 [ 350.226085][ T8618] netlink: 16 bytes leftover after parsing attributes in process `syz.1.856'. [ 351.418776][ T868] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 351.560469][ T868] usb 2-1: device descriptor read/64, error -71 [ 352.119631][ T868] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 352.290578][ T868] usb 2-1: device descriptor read/64, error -71 [ 352.416193][ T868] usb usb2-port1: attempt power cycle [ 352.779494][ T868] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 352.800268][ T868] usb 2-1: device descriptor read/8, error -71 [ 353.039672][ T868] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 353.061135][ T868] usb 2-1: device descriptor read/8, error -71 [ 353.170032][ T868] usb usb2-port1: unable to enumerate USB device [ 354.788700][ T8673] sctp: [Deprecated]: syz.3.869 (pid 8673) Use of int in max_burst socket option. [ 354.788700][ T8673] Use struct sctp_assoc_value instead [ 355.734201][ T8690] FAULT_INJECTION: forcing a failure. [ 355.734201][ T8690] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 355.743142][ T8690] CPU: 1 UID: 0 PID: 8690 Comm: syz.1.874 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 355.743169][ T8690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 355.743181][ T8690] Call Trace: [ 355.743188][ T8690] [ 355.743196][ T8690] dump_stack_lvl+0xe8/0x150 [ 355.743223][ T8690] should_fail_ex+0x46b/0x600 [ 355.743254][ T8690] _copy_from_user+0x2d/0xb0 [ 355.743276][ T8690] __sys_bpf+0x229/0x950 [ 355.743300][ T8690] ? __pfx___sys_bpf+0x10/0x10 [ 355.743318][ T8690] ? rt_mutex_slowunlock+0x1cb/0x300 [ 355.743359][ T8690] ? ksys_write+0x248/0x270 [ 355.743381][ T8690] ? __pfx_ksys_write+0x10/0x10 [ 355.743408][ T8690] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.743428][ T8690] __x64_sys_bpf+0x7c/0x90 [ 355.743448][ T8690] do_syscall_64+0x15f/0xf80 [ 355.743467][ T8690] ? trace_irq_disable+0x3b/0x140 [ 355.743487][ T8690] ? clear_bhb_loop+0x40/0x90 [ 355.743509][ T8690] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.743526][ T8690] RIP: 0033:0x7f97cde1cdd9 [ 355.743557][ T8690] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.743573][ T8690] RSP: 002b:00007f97cc02c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 355.743593][ T8690] RAX: ffffffffffffffda RBX: 00007f97ce096180 RCX: 00007f97cde1cdd9 [ 355.743605][ T8690] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 355.743617][ T8690] RBP: 00007f97cc02c090 R08: 0000000000000000 R09: 0000000000000000 [ 355.743629][ T8690] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.743640][ T8690] R13: 00007f97ce096218 R14: 00007f97ce096180 R15: 00007fffd99accf8 [ 355.743668][ T8690] [ 356.571437][ T5731] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 356.611417][ T5711] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 356.771493][ T5711] usb 5-1: Using ep0 maxpacket: 32 [ 356.779276][ T5711] usb 5-1: unable to get BOS descriptor or descriptor too short [ 356.795232][ T5711] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 356.795267][ T5711] usb 5-1: config 1 interface 0 altsetting 9 endpoint 0x82 has invalid wMaxPacketSize 0 [ 356.795279][ T5711] usb 5-1: config 1 interface 0 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 356.795294][ T5711] usb 5-1: config 1 interface 0 has no altsetting 0 [ 356.797803][ T5711] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 356.797830][ T5711] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.797849][ T5711] usb 5-1: Product: syz [ 356.797863][ T5711] usb 5-1: Manufacturer: syz [ 356.797871][ T5711] usb 5-1: SerialNumber: syz [ 356.801528][ T5731] usb 1-1: Using ep0 maxpacket: 32 [ 356.804041][ T5731] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 356.804066][ T5731] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.956090][ T5731] usb 1-1: config 0 descriptor?? [ 357.363236][ T5731] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 357.367812][ T5711] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 357.384759][ T5731] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 357.391424][ T5731] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 357.391477][ T5731] usb 1-1: media controller created [ 357.471288][ T5711] usb 5-1: USB disconnect, device number 30 [ 357.530317][ T5731] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 357.716318][ T5731] DVB: Unable to find symbol dib7000p_attach() [ 357.716330][ T5731] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 357.812069][ T5731] rc_core: IR keymap rc-dib0700-rc5 not found [ 357.812089][ T5731] Registered IR keymap rc-empty [ 357.812373][ T5731] dvb-usb: could not initialize remote control. [ 357.812381][ T5731] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 357.927411][ T8715] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 358.024690][ T5731] usb 1-1: USB disconnect, device number 35 [ 358.214955][ T5731] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 358.247750][ T8726] net_ratelimit: 1 callbacks suppressed [ 358.247768][ T8726] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 358.249016][ T8726] binder: 8724:8726 ioctl c038586a 2000000001c0 returned -22 [ 358.935653][ T5711] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 358.961539][ T8735] netlink: 'syz.0.890': attribute type 7 has an invalid length. [ 358.971528][ T8735] NILFS (nullb0): couldn't find nilfs on the device [ 359.092984][ T5711] usb 2-1: Using ep0 maxpacket: 32 [ 359.095372][ T5711] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 359.095397][ T5711] usb 2-1: config 0 has no interface number 0 [ 359.095442][ T5711] usb 2-1: config 0 interface 12 has no altsetting 0 [ 359.101657][ T5711] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 359.101685][ T5711] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.101705][ T5711] usb 2-1: Product: syz [ 359.101718][ T5711] usb 2-1: Manufacturer: syz [ 359.101732][ T5711] usb 2-1: SerialNumber: syz [ 359.150292][ T5711] usb 2-1: config 0 descriptor?? [ 359.732955][ T9] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 360.040503][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 360.444481][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 360.448331][ T9] usb 3-1: config 9 has an invalid interface number: 22 but max is 1 [ 360.448367][ T9] usb 3-1: config 9 has an invalid interface number: 4 but max is 1 [ 360.448387][ T9] usb 3-1: config 9 has no interface number 0 [ 360.448402][ T9] usb 3-1: config 9 has no interface number 1 [ 360.448443][ T9] usb 3-1: config 9 interface 22 has no altsetting 0 [ 360.448461][ T9] usb 3-1: config 9 interface 4 has no altsetting 0 [ 360.513501][ T9] usb 3-1: New USB device found, idVendor=054c, idProduct=0095, bcdDevice=43.59 [ 360.513529][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.513548][ T9] usb 3-1: Product: syz [ 360.513561][ T9] usb 3-1: Manufacturer: syz [ 360.513574][ T9] usb 3-1: SerialNumber: syz [ 360.818835][ T9] hub 3-1:9.22: Invalid hub with more than one config or interface [ 360.818877][ T9] hub 3-1:9.22: probe with driver hub failed with error -22 [ 360.842700][ T9] usb 3-1: active config #9 != 1 ?? [ 360.868983][ T9] hub 3-1:9.4: Invalid hub with more than one config or interface [ 360.869025][ T9] hub 3-1:9.4: probe with driver hub failed with error -22 [ 360.870961][ T9] usb 3-1: active config #9 != 1 ?? [ 360.909735][ T9] usb 3-1: USB disconnect, device number 20 [ 361.108871][ T8756] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 361.127412][ T8756] binder: 8755:8756 ioctl c038586a 2000000001c0 returned -22 [ 361.238998][ T5711] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 361.239049][ T5711] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 361.239065][ T5711] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 361.239150][ T5711] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 361.269801][ T5711] usb 2-1: USB disconnect, device number 34 [ 362.245394][ T8773] sctp: [Deprecated]: syz.4.901 (pid 8773) Use of int in max_burst socket option. [ 362.245394][ T8773] Use struct sctp_assoc_value instead [ 362.595077][ T8779] FAULT_INJECTION: forcing a failure. [ 362.595077][ T8779] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.595124][ T8779] CPU: 0 UID: 0 PID: 8779 Comm: syz.0.902 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 362.595146][ T8779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 362.595157][ T8779] Call Trace: [ 362.595164][ T8779] [ 362.595172][ T8779] dump_stack_lvl+0xe8/0x150 [ 362.595199][ T8779] should_fail_ex+0x46b/0x600 [ 362.595232][ T8779] _copy_from_user+0x2d/0xb0 [ 362.595254][ T8779] alg_setkey+0xb8/0x190 [ 362.595279][ T8779] alg_setsockopt+0x3da/0x4a0 [ 362.595301][ T8779] ? __pfx_alg_setsockopt+0x10/0x10 [ 362.595323][ T8779] do_sock_setsockopt+0x17c/0x1b0 [ 362.595350][ T8779] __x64_sys_setsockopt+0x143/0x1b0 [ 362.595374][ T8779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.595393][ T8779] do_syscall_64+0x15f/0xf80 [ 362.595415][ T8779] ? clear_bhb_loop+0x40/0x90 [ 362.595436][ T8779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.595455][ T8779] RIP: 0033:0x7fa3ae1ecdd9 [ 362.595472][ T8779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.595488][ T8779] RSP: 002b:00007fa3ac425028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 362.595507][ T8779] RAX: ffffffffffffffda RBX: 00007fa3ae466090 RCX: 00007fa3ae1ecdd9 [ 362.595521][ T8779] RDX: 0000000000000001 RSI: 0000000000000117 RDI: 0000000000000007 [ 362.595532][ T8779] RBP: 00007fa3ac425090 R08: 0000000000000000 R09: 0000000000000000 [ 362.595544][ T8779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.595554][ T8779] R13: 00007fa3ae466128 R14: 00007fa3ae466090 R15: 00007ffd5d8cca28 [ 362.595584][ T8779] [ 364.790158][ T8798] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 364.853595][ T8801] binder: 8797:8801 ioctl c038586a 2000000001c0 returned -22 [ 365.115316][ T5845] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 365.269402][ T5845] usb 5-1: Using ep0 maxpacket: 32 [ 365.294079][ T5845] usb 5-1: config 1 interface 0 altsetting 2 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 365.294115][ T5845] usb 5-1: config 1 interface 0 has no altsetting 0 [ 365.325395][ T5845] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 365.325430][ T5845] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.325450][ T5845] usb 5-1: Product: 㠊 [ 365.325463][ T5845] usb 5-1: Manufacturer: Т [ 365.325477][ T5845] usb 5-1: SerialNumber: 䩪쾚麶䆧繙ꎐ⹡榉撡⊘ᵠ趂鮿窨ﳍᡛ뗘䇨溞̥蓧楺庝䚽㶔週꼚카돚綨⿬咵嬽샵报ቆ㡝쯥㳇锆濯Ⲗ䔫⪄Ⅼ疐얏硶鱉뭇Ὧ魦줫㔗ष⾼鏭讛⨶䒶￉㲿禃₤ꕗ᷿ⴀ圡⸡헕␢㛠郔탻赺ﴻﶨꇯᥗ趉铲쮲簤칉엚橈ᱢ︑趠␶ [ 365.430891][ T8803] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 365.722712][ T5845] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 365.740860][ T5845] usb 5-1: USB disconnect, device number 31 [ 367.293524][ T8811] netlink: 'syz.0.913': attribute type 7 has an invalid length. [ 367.612937][ T6009] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 367.768433][ T6009] usb 1-1: Using ep0 maxpacket: 8 [ 367.788083][ T6009] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 367.788139][ T6009] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 367.788166][ T6009] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 367.820403][ T5711] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 367.887899][ T6009] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 367.887931][ T6009] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 367.887951][ T6009] usb 1-1: Product: syz [ 367.887965][ T6009] usb 1-1: Manufacturer: syz [ 367.887979][ T6009] usb 1-1: SerialNumber: syz [ 367.948387][ T6009] usb 1-1: config 0 descriptor?? [ 367.982772][ T6009] imon_raw 1-1:0.0: IR endpoint missing [ 367.997103][ T5711] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 246, changing to 11 [ 367.997137][ T5711] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 367.997179][ T5711] usb 5-1: New USB device found, idVendor=044e, idProduct=120c, bcdDevice= 0.00 [ 367.997202][ T5711] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.104450][ T5711] usb 5-1: config 0 descriptor?? [ 368.750329][ T8823] netlink: 40 bytes leftover after parsing attributes in process `syz.4.916'. [ 368.811789][ T31] usb 1-1: USB disconnect, device number 36 [ 369.380343][ T8835] fuse: Bad value for 'user_id' [ 369.380365][ T8835] fuse: Bad value for 'user_id' [ 369.395906][ T8835] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 369.395935][ T8835] overlayfs: missing 'lowerdir' [ 369.563980][ T5711] usbhid 5-1:0.0: can't add hid device: -71 [ 369.564078][ T5711] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 369.596515][ T5711] usb 5-1: USB disconnect, device number 32 [ 369.862195][ T8846] FAULT_INJECTION: forcing a failure. [ 369.862195][ T8846] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.862230][ T8846] CPU: 1 UID: 0 PID: 8846 Comm: syz.0.922 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 369.862252][ T8846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 369.862262][ T8846] Call Trace: [ 369.862270][ T8846] [ 369.862278][ T8846] dump_stack_lvl+0xe8/0x150 [ 369.862304][ T8846] should_fail_ex+0x46b/0x600 [ 369.862335][ T8846] _copy_from_user+0x2d/0xb0 [ 369.862356][ T8846] get_timespec64+0x96/0x1b0 [ 369.862380][ T8846] ? __pfx_get_timespec64+0x10/0x10 [ 369.862413][ T8846] __x64_sys_recvmmsg+0x14b/0x250 [ 369.862440][ T8846] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 369.862471][ T8846] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.862491][ T8846] do_syscall_64+0x15f/0xf80 [ 369.862510][ T8846] ? trace_irq_disable+0x3b/0x140 [ 369.862534][ T8846] ? clear_bhb_loop+0x40/0x90 [ 369.862556][ T8846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.862575][ T8846] RIP: 0033:0x7fa3ae1ecdd9 [ 369.862592][ T8846] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.862607][ T8846] RSP: 002b:00007fa3ac446028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 369.862627][ T8846] RAX: ffffffffffffffda RBX: 00007fa3ae465fa0 RCX: 00007fa3ae1ecdd9 [ 369.862640][ T8846] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 369.862653][ T8846] RBP: 00007fa3ac446090 R08: 0000200000003700 R09: 0000000000000000 [ 369.862666][ T8846] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 369.862675][ T8846] R13: 00007fa3ae466038 R14: 00007fa3ae465fa0 R15: 00007ffd5d8cca28 [ 369.862701][ T8846] [ 369.926962][ T8848] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 369.985435][ T8850] binder: 8847:8850 ioctl c038586a 2000000001c0 returned -22 [ 370.350382][ T8852] binfmt_misc: register: failed to install interpreter file qY3aK [ 370.892107][ T8867] netlink: 'syz.4.929': attribute type 7 has an invalid length. [ 372.377080][ T8890] netlink: 4 bytes leftover after parsing attributes in process `syz.4.935'. [ 372.982740][ T8896] binfmt_misc: register: failed to install interpreter file qY3aK [ 373.065156][ T8903] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 373.118679][ T8904] binder: 8902:8904 ioctl c038586a 2000000001c0 returned -22 [ 373.159285][ T9] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 373.312644][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 373.315520][ T9] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 373.315548][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.321860][ T9] usb 1-1: config 0 descriptor?? [ 373.561993][ T9] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 373.565101][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 373.565831][ T9] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 373.565893][ T9] usb 1-1: media controller created [ 373.678148][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 373.980825][ T9] DVB: Unable to find symbol dib7000p_attach() [ 373.980843][ T9] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 374.165455][ T8920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.943'. [ 374.340418][ T9] rc_core: IR keymap rc-dib0700-rc5 not found [ 374.340438][ T9] Registered IR keymap rc-empty [ 374.340709][ T9] dvb-usb: could not initialize remote control. [ 374.340719][ T9] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 374.564607][ T868] usb 1-1: USB disconnect, device number 37 [ 374.817082][ T868] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 374.957340][ T5738] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 375.122429][ T5738] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 375.122461][ T5738] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 375.128148][ T5738] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 375.128178][ T5738] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.128197][ T5738] usb 3-1: Product: syz [ 375.128212][ T5738] usb 3-1: Manufacturer: syz [ 375.128226][ T5738] usb 3-1: SerialNumber: syz [ 375.152434][ T5738] usb 3-1: config 0 descriptor?? [ 375.482848][ T8941] binfmt_misc: register: failed to install interpreter file qY3aK [ 376.214747][ T8953] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 376.284945][ T8956] binder: 8952:8956 ioctl c038586a 2000000001c0 returned -22 [ 376.914399][ T37] kauditd_printk_skb: 87 callbacks suppressed [ 376.914417][ T37] audit: type=1326 audit(2002621636.858:1598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.916185][ T37] audit: type=1326 audit(2002621636.868:1599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.920450][ T37] audit: type=1326 audit(2002621636.868:1600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.921980][ T37] audit: type=1326 audit(2002621636.868:1601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.958345][ T37] audit: type=1326 audit(2002621636.868:1602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.968542][ T37] audit: type=1326 audit(2002621636.926:1603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.968598][ T37] audit: type=1326 audit(2002621636.926:1604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.990376][ T37] audit: type=1326 audit(2002621636.946:1605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.990436][ T37] audit: type=1326 audit(2002621636.946:1606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 376.990479][ T37] audit: type=1326 audit(2002621636.946:1607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8958 comm="syz.0.956" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa3ae1ecdd9 code=0x7ffc0000 [ 377.482854][ T8967] netlink: 'syz.4.958': attribute type 7 has an invalid length. [ 377.543147][ T8967] Unsupported ieee802154 address type: 0 [ 377.842834][ T31] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 377.994326][ T31] usb 5-1: Using ep0 maxpacket: 8 [ 378.061184][ T31] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 378.061240][ T31] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 378.061268][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 378.153092][ T31] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 378.153123][ T31] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 378.153144][ T31] usb 5-1: Product: syz [ 378.153158][ T31] usb 5-1: Manufacturer: syz [ 378.153182][ T31] usb 5-1: SerialNumber: syz [ 378.236321][ T31] usb 5-1: config 0 descriptor?? [ 378.356458][ T31] imon_raw 5-1:0.0: IR endpoint missing [ 378.503819][ T31] usb 3-1: USB disconnect, device number 21 [ 380.023071][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 380.023908][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.331541][ T10] usb 5-1: USB disconnect, device number 33 [ 382.047874][ T9001] binder: 8997:9001 ioctl c038586a 2000000001c0 returned -22 [ 382.435859][ T5914] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 382.587651][ T5914] usb 4-1: Using ep0 maxpacket: 32 [ 382.587710][ T868] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 382.590290][ T5914] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 382.590315][ T5914] usb 4-1: config 0 has no interface number 0 [ 382.592908][ T5914] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 382.592935][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.592954][ T5914] usb 4-1: Product: syz [ 382.592968][ T5914] usb 4-1: Manufacturer: syz [ 382.592981][ T5914] usb 4-1: SerialNumber: syz [ 382.603919][ T5914] usb 4-1: config 0 descriptor?? [ 382.749654][ T868] usb 2-1: Using ep0 maxpacket: 32 [ 382.753284][ T868] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 382.753310][ T868] usb 2-1: config 0 has no interface number 0 [ 382.753356][ T868] usb 2-1: config 0 interface 89 altsetting 225 bulk endpoint 0x82 has invalid maxpacket 6 [ 382.753381][ T868] usb 2-1: config 0 interface 89 has no altsetting 0 [ 382.756737][ T868] usb 2-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 382.756767][ T868] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.756786][ T868] usb 2-1: Product: syz [ 382.756799][ T868] usb 2-1: Manufacturer: syz [ 382.756814][ T868] usb 2-1: SerialNumber: syz [ 382.838479][ T868] usb 2-1: config 0 descriptor?? [ 382.839809][ T9013] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 382.861198][ T868] hub 2-1:0.89: bad descriptor, ignoring hub [ 382.861235][ T868] hub 2-1:0.89: probe with driver hub failed with error -5 [ 382.864709][ T868] option 2-1:0.89: GSM modem (1-port) converter detected [ 382.931374][ T868] usb 2-1: GSM modem (1-port) converter now attached to ttyUSB0 [ 383.069395][ T9008] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.971'. [ 383.120943][ T5914] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 383.121038][ T5914] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 383.205679][ T31] usb 2-1: USB disconnect, device number 35 [ 383.452579][ T5914] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 383.453608][ T5914] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -32 [ 383.976801][ T5914] usb 4-1: USB disconnect, device number 31 [ 386.339622][ T31] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0 [ 386.368978][ T9022] netlink: 16 bytes leftover after parsing attributes in process `syz.2.975'. [ 386.415753][ T31] option 2-1:0.89: device disconnected [ 386.630855][ T9019] uprobe: syz.2.975:9019 failed to unregister, leaking uprobe [ 386.755267][ T9039] netlink: 8 bytes leftover after parsing attributes in process `syz.0.981'. [ 386.829939][ T9039] netlink: 16 bytes leftover after parsing attributes in process `syz.0.981'. [ 387.317071][ T9048] netlink: 'syz.4.982': attribute type 7 has an invalid length. [ 387.330810][ T9048] Unsupported ieee802154 address type: 0 [ 387.429691][ T5731] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 387.751158][ T5738] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 387.763542][ T5731] usb 1-1: Using ep0 maxpacket: 32 [ 387.770797][ T5731] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 387.770823][ T5731] usb 1-1: config 0 has no interface number 0 [ 387.770869][ T5731] usb 1-1: config 0 interface 12 has no altsetting 0 [ 387.806057][ T5731] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 387.806087][ T5731] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.806105][ T5731] usb 1-1: Product: syz [ 387.806119][ T5731] usb 1-1: Manufacturer: syz [ 387.806133][ T5731] usb 1-1: SerialNumber: syz [ 387.894711][ T5731] usb 1-1: config 0 descriptor?? [ 387.904232][ T5738] usb 5-1: Using ep0 maxpacket: 8 [ 387.950608][ T5738] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 387.950662][ T5738] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 387.950688][ T5738] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 388.094885][ T5738] usb 5-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 388.094972][ T5738] usb 5-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 388.094993][ T5738] usb 5-1: Product: syz [ 388.095008][ T5738] usb 5-1: Manufacturer: syz [ 388.095022][ T5738] usb 5-1: SerialNumber: syz [ 388.254516][ T5738] usb 5-1: config 0 descriptor?? [ 388.352660][ T5738] imon_raw 5-1:0.0: IR endpoint missing [ 388.940177][ T9054] binder: 9049:9054 ioctl c038586a 2000000001c0 returned -22 [ 390.782975][ T5731] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 390.783009][ T5731] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 390.783019][ T5731] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 390.783075][ T5731] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 390.787933][ T31] usb 5-1: USB disconnect, device number 34 [ 390.848656][ T5731] usb 1-1: USB disconnect, device number 38 [ 394.176813][ T9079] futex_wake_op: syz.0.993 tries to shift op by -1; fix this program [ 395.642373][ T9092] netlink: 4 bytes leftover after parsing attributes in process `syz.3.999'. [ 395.717446][ T9092] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 396.121542][ T9092] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 396.175822][ T9098] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 401.176463][ T6009] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 401.516749][ T9141] netlink: 'syz.2.1011': attribute type 7 has an invalid length. [ 401.643980][ T9141] Unsupported ieee802154 address type: 0 [ 402.231282][ T5731] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 402.360577][ T9145] netlink: 'syz.4.1012': attribute type 7 has an invalid length. [ 402.516488][ T5731] usb 4-1: device descriptor read/64, error -71 [ 402.594337][ T6009] usb 2-1: Using ep0 maxpacket: 32 [ 402.632183][ T6009] usb 2-1: config 1 interface 0 altsetting 2 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 402.632218][ T6009] usb 2-1: config 1 interface 0 has no altsetting 0 [ 402.640154][ T6009] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 402.640185][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.640204][ T6009] usb 2-1: Product: 㠊 [ 402.640217][ T6009] usb 2-1: Manufacturer: Т [ 402.640232][ T6009] usb 2-1: SerialNumber: 䩪쾚麶䆧繙ꎐ⹡榉撡⊘ᵠ趂鮿窨ﳍᡛ뗘䇨溞̥蓧楺庝䚽㶔週꼚카돚綨⿬咵嬽샵报ቆ㡝쯥㳇锆濯Ⲗ䔫⪄Ⅼ疐얏硶鱉뭇Ὧ魦줫㔗ष⾼鏭讛⨶䒶￉㲿禃₤ꕗ᷿ⴀ圡⸡헕␢㛠郔탻赺ﴻﶨꇯᥗ趉铲쮲簤칉엚橈ᱢ︑趠␶ [ 402.964264][ T9138] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 402.995721][ T5731] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 403.314727][ T820] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 403.429394][ T5731] usb 4-1: device descriptor read/64, error -71 [ 403.621517][ T5731] usb usb4-port1: attempt power cycle [ 403.674912][ T6009] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 403.691885][ T6009] usb 2-1: USB disconnect, device number 36 [ 403.743527][ T820] usb 3-1: Using ep0 maxpacket: 8 [ 404.082701][ T5738] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 404.318284][ T5731] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 404.352556][ T5731] usb 4-1: device descriptor read/8, error -71 [ 404.770236][ T820] usb 3-1: device descriptor read/all, error -71 [ 404.862958][ T9157] FAULT_INJECTION: forcing a failure. [ 404.862958][ T9157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 404.863005][ T9157] CPU: 1 UID: 0 PID: 9157 Comm: syz.4.1017 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 404.863027][ T9157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 404.863038][ T9157] Call Trace: [ 404.863045][ T9157] [ 404.863053][ T9157] dump_stack_lvl+0xe8/0x150 [ 404.863080][ T9157] should_fail_ex+0x46b/0x600 [ 404.863113][ T9157] _copy_from_user+0x2d/0xb0 [ 404.863135][ T9157] ___sys_sendmsg+0x1c6/0x360 [ 404.863157][ T9157] ? __lock_acquire+0x6b5/0x2cf0 [ 404.863184][ T9157] ? __pfx____sys_sendmsg+0x10/0x10 [ 404.863241][ T9157] ? __fget_files+0x2a/0x420 [ 404.863257][ T9157] ? __fget_files+0x3a6/0x420 [ 404.863284][ T9157] __x64_sys_sendmsg+0x1c3/0x2a0 [ 404.863309][ T9157] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 404.863340][ T9157] ? __pfx_ksys_write+0x10/0x10 [ 404.863368][ T9157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.863387][ T9157] do_syscall_64+0x15f/0xf80 [ 404.863406][ T9157] ? trace_irq_disable+0x3b/0x140 [ 404.863427][ T9157] ? clear_bhb_loop+0x40/0x90 [ 404.863449][ T9157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.863467][ T9157] RIP: 0033:0x7f4d574bcdd9 [ 404.863488][ T9157] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.863504][ T9157] RSP: 002b:00007f4d5570e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.863523][ T9157] RAX: ffffffffffffffda RBX: 00007f4d57735fa0 RCX: 00007f4d574bcdd9 [ 404.863537][ T9157] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 404.863549][ T9157] RBP: 00007f4d5570e090 R08: 0000000000000000 R09: 0000000000000000 [ 404.863561][ T9157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.863571][ T9157] R13: 00007f4d57736038 R14: 00007f4d57735fa0 R15: 00007ffd0ec59108 [ 404.863602][ T9157] [ 405.261685][ T9166] netlink: 'syz.4.1020': attribute type 7 has an invalid length. [ 405.280828][ T820] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 405.331742][ T5731] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 405.446557][ T5731] usb 4-1: device descriptor read/8, error -71 [ 405.528972][ T820] usb 3-1: config 1 interface 0 has no altsetting 0 [ 405.623974][ T5731] usb usb4-port1: unable to enumerate USB device [ 405.660852][ T820] usb 3-1: string descriptor 0 read error: -22 [ 405.671331][ T820] usb 3-1: New USB device found, idVendor=0079, idProduct=1801, bcdDevice= 0.40 [ 405.671492][ T820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.854865][ T820] usbhid 3-1:1.0: can't add hid device: -71 [ 408.854985][ T820] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 408.888619][ T820] usb 3-1: USB disconnect, device number 23 [ 408.979286][ T9187] fuse: Bad value for 'user_id' [ 408.979306][ T9187] fuse: Bad value for 'user_id' [ 408.981461][ T9187] overlayfs: missing 'lowerdir' [ 409.490765][ T9195] FAULT_INJECTION: forcing a failure. [ 409.490765][ T9195] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.490799][ T9195] CPU: 1 UID: 0 PID: 9195 Comm: syz.2.1027 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 409.490820][ T9195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 409.490832][ T9195] Call Trace: [ 409.490839][ T9195] [ 409.490847][ T9195] dump_stack_lvl+0xe8/0x150 [ 409.490873][ T9195] should_fail_ex+0x46b/0x600 [ 409.490906][ T9195] _copy_from_user+0x2d/0xb0 [ 409.490927][ T9195] ___sys_sendmsg+0x1c6/0x360 [ 409.490949][ T9195] ? __lock_acquire+0x6b5/0x2cf0 [ 409.490976][ T9195] ? __pfx____sys_sendmsg+0x10/0x10 [ 409.491031][ T9195] ? __fget_files+0x2a/0x420 [ 409.491047][ T9195] ? __fget_files+0x3a6/0x420 [ 409.491074][ T9195] __x64_sys_sendmsg+0x1c3/0x2a0 [ 409.491098][ T9195] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 409.491130][ T9195] ? __pfx_ksys_write+0x10/0x10 [ 409.491158][ T9195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.491178][ T9195] do_syscall_64+0x15f/0xf80 [ 409.491209][ T9195] ? trace_irq_disable+0x3b/0x140 [ 409.491231][ T9195] ? clear_bhb_loop+0x40/0x90 [ 409.491253][ T9195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.491271][ T9195] RIP: 0033:0x7f1dec2bcdd9 [ 409.491287][ T9195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.491302][ T9195] RSP: 002b:00007f1dea50e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 409.491322][ T9195] RAX: ffffffffffffffda RBX: 00007f1dec535fa0 RCX: 00007f1dec2bcdd9 [ 409.491335][ T9195] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 409.491346][ T9195] RBP: 00007f1dea50e090 R08: 0000000000000000 R09: 0000000000000000 [ 409.491361][ T9195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.491371][ T9195] R13: 00007f1dec536038 R14: 00007f1dec535fa0 R15: 00007ffc14b50628 [ 409.491399][ T9195] [ 410.422612][ T9207] netlink: 'syz.3.1031': attribute type 7 has an invalid length. [ 410.636791][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 410.742756][ T9214] FAULT_INJECTION: forcing a failure. [ 410.742756][ T9214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.742788][ T9214] CPU: 1 UID: 0 PID: 9214 Comm: syz.4.1034 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 410.742809][ T9214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 410.742819][ T9214] Call Trace: [ 410.742826][ T9214] [ 410.742834][ T9214] dump_stack_lvl+0xe8/0x150 [ 410.742862][ T9214] should_fail_ex+0x46b/0x600 [ 410.742893][ T9214] _copy_from_user+0x2d/0xb0 [ 410.742914][ T9214] ___sys_sendmsg+0x1c6/0x360 [ 410.742937][ T9214] ? __lock_acquire+0x6b5/0x2cf0 [ 410.742962][ T9214] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.743015][ T9214] ? __fget_files+0x2a/0x420 [ 410.743029][ T9214] ? __fget_files+0x3a6/0x420 [ 410.743051][ T9214] __x64_sys_sendmsg+0x1c3/0x2a0 [ 410.743082][ T9214] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 410.743113][ T9214] ? __pfx_ksys_write+0x10/0x10 [ 410.743138][ T9214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.743157][ T9214] do_syscall_64+0x15f/0xf80 [ 410.743175][ T9214] ? trace_irq_disable+0x3b/0x140 [ 410.743195][ T9214] ? clear_bhb_loop+0x40/0x90 [ 410.743217][ T9214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.743235][ T9214] RIP: 0033:0x7f4d574bcdd9 [ 410.743251][ T9214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.743265][ T9214] RSP: 002b:00007f4d5570e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 410.743289][ T9214] RAX: ffffffffffffffda RBX: 00007f4d57735fa0 RCX: 00007f4d574bcdd9 [ 410.743303][ T9214] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 410.743315][ T9214] RBP: 00007f4d5570e090 R08: 0000000000000000 R09: 0000000000000000 [ 410.743326][ T9214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.743336][ T9214] R13: 00007f4d57736038 R14: 00007f4d57735fa0 R15: 00007ffd0ec59108 [ 410.743365][ T9214] [ 410.757779][ T9211] binfmt_misc: register: failed to install interpreter file qY3aK [ 410.800690][ T10] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 410.800719][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.814353][ T10] usb 3-1: config 0 descriptor?? [ 410.873519][ T10] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 411.118234][ T5724] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 411.870015][ T5724] usb 1-1: device descriptor read/64, error -71 [ 411.955493][ T10] gspca_cpia1: usb_control_msg 05, error -110 [ 411.955916][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 411.956378][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 411.956781][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 411.957304][ T10] gspca_cpia1: usb_control_msg 01, error -32 [ 411.957319][ T10] cpia1 3-1:0.0: only firmware version 1 is supported (got: 0) [ 412.140357][ T5724] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 412.195174][ T9230] binfmt_misc: register: failed to install interpreter file qY3aK [ 412.270721][ T5724] usb 1-1: device descriptor read/64, error -71 [ 412.381423][ T5724] usb usb1-port1: attempt power cycle [ 412.460681][ T9237] binfmt_misc: register: failed to install interpreter file qY3aK [ 412.462475][ T10] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 412.621479][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 412.623795][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 412.623821][ T10] usb 5-1: config 0 has no interface number 0 [ 412.626190][ T10] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 412.626217][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.626237][ T10] usb 5-1: Product: syz [ 412.626250][ T10] usb 5-1: Manufacturer: syz [ 412.626264][ T10] usb 5-1: SerialNumber: syz [ 412.643868][ T10] usb 5-1: config 0 descriptor?? [ 412.713031][ T10] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 412.731763][ T5724] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 412.752575][ T5724] usb 1-1: device descriptor read/8, error -71 [ 412.978401][ T820] usb 3-1: USB disconnect, device number 24 [ 413.012367][ T5724] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 413.029128][ T9244] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1042'. [ 413.033720][ T5724] usb 1-1: device descriptor read/8, error -71 [ 413.144080][ T5724] usb usb1-port1: unable to enumerate USB device [ 413.439664][ T9247] binder: 9245:9247 ioctl c038586a 2000000001c0 returned -22 [ 413.627705][ T9249] netlink: 'syz.2.1044': attribute type 7 has an invalid length. [ 414.215427][ T10] gspca_spca1528: reg_w err -110 [ 414.215524][ T10] spca1528 5-1:0.1: probe with driver spca1528 failed with error -110 [ 414.374372][ T9256] fuse: Bad value for 'user_id' [ 414.374393][ T9256] fuse: Bad value for 'user_id' [ 414.378037][ T9256] overlayfs: missing 'lowerdir' [ 414.637631][ T9264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1049'. [ 414.637662][ T9264] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1049'. [ 415.498649][ T5739] usb 5-1: USB disconnect, device number 36 [ 415.560022][ T9274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1046'. [ 415.959860][ T9287] netlink: 'syz.1.1055': attribute type 7 has an invalid length. [ 416.498850][ T9293] netlink: 'syz.1.1057': attribute type 7 has an invalid length. [ 416.523152][ T9293] Unsupported ieee802154 address type: 0 [ 416.779934][ T5724] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 417.010313][ T5724] usb 2-1: Using ep0 maxpacket: 8 [ 417.028792][ T5724] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 417.028904][ T5724] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 417.028931][ T5724] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 417.112481][ T5724] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 417.112513][ T5724] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 417.112533][ T5724] usb 2-1: Product: syz [ 417.112546][ T5724] usb 2-1: Manufacturer: syz [ 417.112560][ T5724] usb 2-1: SerialNumber: syz [ 417.197465][ T5724] usb 2-1: config 0 descriptor?? [ 417.272691][ T5724] imon_raw 2-1:0.0: IR endpoint missing [ 418.391875][ T9302] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 418.391891][ T9302] IPv6: NLM_F_CREATE should be set when creating new route [ 422.979966][ T9302] IPv6: NLM_F_CREATE should be set when creating new route [ 422.979998][ T9302] IPv6: NLM_F_CREATE should be set when creating new route [ 423.024040][ T5332] usb 2-1: USB disconnect, device number 37 [ 423.694420][ T5332] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 424.551559][ T9317] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 424.612109][ T5332] usb 4-1: Using ep0 maxpacket: 16 [ 424.614838][ T5332] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 424.614863][ T5332] usb 4-1: config 0 has no interface number 0 [ 424.620519][ T5332] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 424.620549][ T5332] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.620568][ T5332] usb 4-1: Product: syz [ 424.620582][ T5332] usb 4-1: Manufacturer: syz [ 424.620596][ T5332] usb 4-1: SerialNumber: syz [ 424.701742][ T5332] usb 4-1: config 0 descriptor?? [ 424.732489][ T5332] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 424.821591][ T9319] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1062'. [ 426.101828][ T9328] netlink: 'syz.2.1066': attribute type 7 has an invalid length. [ 426.298256][ T9335] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1068'. [ 426.298290][ T9335] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1068'. [ 426.347604][ T9334] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 426.814755][ T5332] gspca_spca1528: reg_w err -110 [ 426.814876][ T5332] spca1528 4-1:0.1: probe with driver spca1528 failed with error -110 [ 427.910113][ T10] usb 4-1: USB disconnect, device number 36 [ 428.676855][ T10] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 428.819387][ T5738] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 429.677307][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 429.684430][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 429.684494][ T10] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 429.684516][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.706188][ T10] usb 2-1: config 0 descriptor?? [ 429.774816][ T5738] usb 5-1: config 0 has an invalid interface number: 50 but max is 0 [ 429.774834][ T5738] usb 5-1: config 0 has no interface number 0 [ 429.774860][ T5738] usb 5-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 429.780531][ T5738] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 429.787525][ T5738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.787553][ T5738] usb 5-1: Product: syz [ 429.787566][ T5738] usb 5-1: Manufacturer: syz [ 429.787580][ T5738] usb 5-1: SerialNumber: syz [ 429.798832][ T5724] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 429.827721][ T5738] usb 5-1: config 0 descriptor?? [ 429.959399][ T5724] usb 3-1: Using ep0 maxpacket: 32 [ 429.997080][ T5724] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 429.997103][ T5724] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 429.997114][ T5724] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 429.997144][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 429.997206][ T5724] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 429.997219][ T5724] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 429.997248][ T5724] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 429.997261][ T5724] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.061102][ T5738] yurex 5-1:0.50: USB YUREX device now attached to Yurex #0 [ 430.074131][ T5724] usb 3-1: config 0 descriptor?? [ 430.227361][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227396][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227423][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227447][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227526][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227542][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227557][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227571][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227586][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.227601][ T10] kone 0003:1E7D:2CED.0001: unknown main item tag 0x0 [ 430.379569][ T5332] usb 5-1: USB disconnect, device number 37 [ 430.462077][ T5724] usblp 3-1:0.0: usblp1: USB Bidirectional printer dev 25 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 430.475807][ T5724] usb 3-1: USB disconnect, device number 25 [ 430.493676][ T5332] yurex 5-1:0.50: USB YUREX #0 now disconnected [ 430.558582][ T5724] usblp1: removed [ 430.567058][ T10] kone 0003:1E7D:2CED.0001: hidraw0: USB HID v0.09 Device [HID 1e7d:2ced] on usb-dummy_hcd.1-1/input0 [ 430.606236][ T10] usb 2-1: USB disconnect, device number 38 [ 430.763013][ T9399] fido_id[9399]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 430.899236][ T5724] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 431.059497][ T5724] usb 3-1: Using ep0 maxpacket: 32 [ 431.066053][ T5724] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 431.066082][ T5724] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 431.066102][ T5724] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 431.066150][ T5724] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 431.066172][ T5724] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 431.066194][ T5724] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 431.066236][ T5724] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 431.066260][ T5724] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.095613][ T5724] usb 3-1: config 0 descriptor?? [ 431.255825][ T9409] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1095'. [ 431.398130][ T5724] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 26 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 431.862947][ T10] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 431.956024][ T5711] usb 3-1: USB disconnect, device number 26 [ 432.058980][ C1] usblp0: nonzero read bulk status received: -71 [ 432.378374][ T5711] usblp0: removed [ 432.437693][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 432.437720][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 432.439896][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 432.439926][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 432.439946][ T10] usb 1-1: SerialNumber: syz [ 432.515823][ T10] usb 1-1: 0:2 : does not exist [ 432.695806][ T5711] usb 1-1: USB disconnect, device number 43 [ 432.811132][ T5724] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 432.975859][ T5724] usb 5-1: unable to get BOS descriptor or descriptor too short [ 432.982717][ T5724] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.982742][ T5724] usb 5-1: config 0 has no interfaces? [ 432.993289][ T5724] usb 5-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 432.993317][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.993335][ T5724] usb 5-1: Product: syz [ 432.993348][ T5724] usb 5-1: Manufacturer: syz [ 432.993361][ T5724] usb 5-1: SerialNumber: syz [ 433.010623][ T5724] usb 5-1: config 0 descriptor?? [ 433.348291][ T10] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 433.497095][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 433.505023][ T10] usb 4-1: config 0 has an invalid interface number: 89 but max is 0 [ 433.505050][ T10] usb 4-1: config 0 has no interface number 0 [ 433.505098][ T10] usb 4-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 433.505121][ T10] usb 4-1: config 0 interface 89 has no altsetting 0 [ 433.514716][ T10] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 433.514744][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.514762][ T10] usb 4-1: Product: syz [ 433.514776][ T10] usb 4-1: Manufacturer: syz [ 433.514789][ T10] usb 4-1: SerialNumber: syz [ 433.597577][ T10] usb 4-1: config 0 descriptor?? [ 433.674761][ T10] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 433.674798][ T10] em28xx 4-1:0.89: Video interface 89 found: [ 433.906863][ T5711] usb 5-1: USB disconnect, device number 38 [ 434.447931][ T10] em28xx 4-1:0.89: unknown em28xx chip ID (0) [ 434.483663][ T5739] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 435.175921][ T5739] usb 1-1: config index 0 descriptor too short (expected 29220, got 36) [ 435.176197][ T5739] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 435.176220][ T5739] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 435.176270][ T5739] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 435.176293][ T5739] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 435.176318][ T5739] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 435.176360][ T5739] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 435.176382][ T5739] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.280169][ T5739] usb 1-1: config 0 descriptor?? [ 435.281601][ T9450] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 435.536899][ T5739] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 44 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 435.565788][ T10] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 435.571610][ T10] em28xx 4-1:0.89: board has no eeprom [ 435.625417][ T10] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67) [ 435.625456][ T10] em28xx 4-1:0.89: analog set to bulk mode. [ 435.626348][ T868] em28xx 4-1:0.89: Registering V4L2 extension [ 435.758959][ T5739] usb 1-1: USB disconnect, device number 44 [ 435.878406][ T5739] usblp0: removed [ 435.989610][ T10] usb 4-1: USB disconnect, device number 37 [ 436.009264][ T868] em28xx 4-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 436.009400][ T868] em28xx 4-1:0.89: reading from i2c device at 0x48 failed (error=-19) [ 436.009507][ T868] em28xx 4-1:0.89: reading from i2c device at 0x42 failed (error=-19) [ 436.009737][ T868] em28xx 4-1:0.89: reading from i2c device at 0x40 failed (error=-19) [ 436.010080][ T868] em28xx 4-1:0.89: Config register raw data: 0xffffffed [ 436.010154][ T868] em28xx 4-1:0.89: AC97 chip type couldn't be determined [ 436.010178][ T868] em28xx 4-1:0.89: No AC97 audio processor [ 436.271771][ T10] em28xx 4-1:0.89: Disconnecting em28xx [ 436.478898][ T868] usb 4-1: Decoder not found [ 436.478922][ T868] em28xx 4-1:0.89: failed to create media graph [ 436.478982][ T868] em28xx 4-1:0.89: V4L2 device video103 deregistered [ 436.918803][ T868] em28xx 4-1:0.89: Registering snapshot button... [ 437.044532][ T9487] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1122'. [ 437.493104][ T868] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input19 [ 439.124841][ T868] em28xx 4-1:0.89: Remote control support is not available for this card. [ 439.125146][ T10] em28xx 4-1:0.89: Closing input extension [ 439.145524][ T10] em28xx 4-1:0.89: Deregistering snapshot button [ 439.166765][ T5731] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 439.217369][ T9514] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 439.451645][ T5731] usb 5-1: Using ep0 maxpacket: 8 [ 439.455510][ T5731] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 439.455537][ T5731] usb 5-1: config 179 has no interface number 0 [ 439.455578][ T5731] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 439.455605][ T5731] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 439.455632][ T5731] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 439.455657][ T5731] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 439.455688][ T5731] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 439.455728][ T5731] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 439.455749][ T5731] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.579446][ T9503] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 440.077551][ T5739] usb 5-1: USB disconnect, device number 39 [ 440.077551][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 440.077910][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 441.358116][ T5731] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input20 [ 441.671366][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 441.671436][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.672073][ T1332] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 441.704103][ T9535] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1133'. [ 441.961974][ T9529] can: request_module (can-proto-0) failed. [ 442.296491][ T10] em28xx 4-1:0.89: Freeing device [ 442.410371][ T9538] kvm: faulting far call emulation tainted memory [ 444.178226][ T9571] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1140'. [ 444.784115][ T37] kauditd_printk_skb: 80 callbacks suppressed [ 444.784146][ T37] audit: type=1800 audit(2002621704.350:1688): pid=9582 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.1145" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 444.849696][ T820] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 445.034189][ T820] usb 3-1: Using ep0 maxpacket: 8 [ 445.148229][ T820] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 445.148259][ T820] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 445.148284][ T820] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 445.148307][ T820] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 445.148348][ T820] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 445.148369][ T820] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.938321][ T820] usb 3-1: GET_CAPABILITIES returned 0 [ 445.938369][ T820] usbtmc 3-1:16.0: can't read capabilities [ 445.973472][ T9588] binder: 9587:9588 ioctl c0306201 0 returned -14 [ 446.516428][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 446.569727][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 446.723236][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 446.726785][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 446.870525][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 446.872289][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.143131][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.143200][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.143262][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.147650][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.166842][ T9603] fuse: Bad value for 'fd' [ 447.243968][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.244048][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.244114][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.244410][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.244476][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.244541][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 447.319452][ T10] usb 3-1: USB disconnect, device number 27 [ 447.406755][ T9609] binder: 9606:9609 ioctl c0306201 200000000540 returned -22 [ 447.470998][ T9613] binder: 9606:9613 ioctl c0306201 200000000640 returned -22 [ 452.876491][ T4916] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 453.265384][ T9656] binder: 9655:9656 ioctl c0306201 200000000540 returned -22 [ 453.437736][ T9660] binder: 9655:9660 ioctl c0306201 200000000640 returned -22 [ 454.553645][ T9671] Illegal XDP return value 4294967274 on prog (id 66) dev syz_tun, expect packet loss! [ 457.712012][ T9716] binder: 9712:9716 ioctl c0306201 200000000540 returned -22 [ 457.771205][ T9719] binder: 9712:9719 ioctl c0306201 200000000640 returned -22 [ 457.801453][ T5711] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 458.011210][ T5711] usb 4-1: not running at top speed; connect to a high speed hub [ 458.013212][ T5711] usb 4-1: config 65 has an invalid descriptor of length 0, skipping remainder of the config [ 458.013250][ T5711] usb 4-1: config 65 has 2 interfaces, different from the descriptor's value: 3 [ 458.013298][ T5711] usb 4-1: config 65 interface 1 has no altsetting 0 [ 458.017128][ T5711] usb 4-1: New USB device found, idVendor=0bda, idProduct=4014, bcdDevice= 0.40 [ 458.017158][ T5711] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.017177][ T5711] usb 4-1: Product: syz [ 458.017189][ T5711] usb 4-1: Manufacturer: syz [ 458.017201][ T5711] usb 4-1: SerialNumber: syz [ 458.064609][ T5711] usb 4-1: 0:2 : does not exist [ 458.064696][ T5711] usb 4-1: unit 130 not found! [ 458.592565][ T5711] usb 4-1: USB disconnect, device number 38 [ 459.955686][ T7392] udevd[7392]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:65.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 460.001664][ T59] Bluetooth: hci5: command 0x1003 tx timeout [ 460.006007][ T4916] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 462.200647][ T9767] can: request_module (can-proto-0) failed. [ 464.039751][ T9788] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 466.017777][ T9796] netlink: 236 bytes leftover after parsing attributes in process `syz.2.1206'. [ 468.475313][ T9819] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 468.475331][ T9819] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 468.665750][ T10] usb 4-1: new low-speed USB device number 39 using dummy_hcd [ 468.929328][ T9819] vhci_hcd vhci_hcd.0: Device attached [ 469.035599][ T9829] can: request_module (can-proto-0) failed. [ 469.089676][ T10] usb 4-1: config index 0 descriptor too short (expected 6427, got 27) [ 469.089705][ T10] usb 4-1: config 0 has an invalid interface number: 21 but max is 0 [ 469.089725][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 469.089743][ T10] usb 4-1: config 0 has no interface number 0 [ 469.089784][ T10] usb 4-1: config 0 interface 21 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 469.089823][ T10] usb 4-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 469.089846][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.093968][ T10] usb 4-1: config 0 descriptor?? [ 469.536070][ T5731] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 469.854550][ T10] usb 4-1: USB disconnect, device number 39 [ 469.928454][ T9820] usb 39-1: recv xbuf, 0 [ 469.941706][ T9822] ================================================================== [ 469.941722][ T9822] BUG: KASAN: slab-use-after-free in vhci_tx_loop+0x3e9/0x1c50 [ 469.941753][ T9822] Read of size 8 at addr ffff8880266179a0 by task vhci_tx/9822 [ 469.941768][ T9822] [ 469.941785][ T9822] CPU: 1 UID: 0 PID: 9822 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 469.941807][ T9822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 469.941822][ T9822] Call Trace: [ 469.941829][ T9822] [ 469.941837][ T9822] dump_stack_lvl+0xe8/0x150 [ 469.941859][ T9822] print_address_description+0x55/0x1e0 [ 469.941879][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.941899][ T9822] print_report+0x58/0x70 [ 469.941916][ T9822] kasan_report+0x117/0x150 [ 469.941938][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.941963][ T9822] vhci_tx_loop+0x3e9/0x1c50 [ 469.941982][ T9822] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.942001][ T9822] ? __set_cpus_allowed_ptr_locked+0x7bb/0x19c0 [ 469.942030][ T9822] ? __pfx_vhci_tx_loop+0x10/0x10 [ 469.942055][ T9822] ? __lock_acquire+0x6b5/0x2cf0 [ 469.942085][ T9822] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.942102][ T9822] ? lock_acquire+0x106/0x350 [ 469.942125][ T9822] ? __pfx_autoremove_wake_function+0x10/0x10 [ 469.942152][ T9822] ? __kthread_parkme+0x7a/0x1f0 [ 469.942176][ T9822] kthread+0x388/0x470 [ 469.942196][ T9822] ? __pfx_vhci_tx_loop+0x10/0x10 [ 469.942216][ T9822] ? __pfx_kthread+0x10/0x10 [ 469.942237][ T9822] ret_from_fork+0x514/0xb70 [ 469.942258][ T9822] ? __pfx_ret_from_fork+0x10/0x10 [ 469.942277][ T9822] ? __switch_to+0xc79/0x1410 [ 469.942303][ T9822] ? __pfx_kthread+0x10/0x10 [ 469.942325][ T9822] ret_from_fork_asm+0x1a/0x30 [ 469.942352][ T9822] [ 469.942359][ T9822] [ 469.942369][ T9822] Allocated by task 5731: [ 469.942378][ T9822] kasan_save_track+0x3e/0x80 [ 469.942394][ T9822] __kasan_kmalloc+0x93/0xb0 [ 469.942415][ T9822] __kmalloc_cache_noprof+0x3a6/0x690 [ 469.942432][ T9822] vhci_urb_enqueue+0x5c9/0xe10 [ 469.942451][ T9822] usb_hcd_submit_urb+0x323/0x1b50 [ 469.942470][ T9822] usb_start_wait_urb+0x13f/0x5b0 [ 469.942484][ T9822] usb_control_msg+0x234/0x3e0 [ 469.942498][ T9822] hub_port_init+0xb1e/0x28c0 [ 469.942514][ T9822] hub_event+0x25d3/0x4f60 [ 469.942529][ T9822] process_scheduled_works+0xb5d/0x1860 [ 469.942545][ T9822] worker_thread+0xa53/0xfc0 [ 469.942560][ T9822] kthread+0x388/0x470 [ 469.942578][ T9822] ret_from_fork+0x514/0xb70 [ 469.942594][ T9822] ret_from_fork_asm+0x1a/0x30 [ 469.942613][ T9822] [ 469.942617][ T9822] Freed by task 9820: [ 469.942624][ T9822] kasan_save_track+0x3e/0x80 [ 469.942639][ T9822] kasan_save_free_info+0x46/0x50 [ 469.942659][ T9822] __kasan_slab_free+0x5c/0x80 [ 469.942674][ T9822] kfree+0x1c5/0x6c0 [ 469.942687][ T9822] pickup_urb_and_free_priv+0x225/0x3f0 [ 469.942707][ T9822] vhci_rx_loop+0x3c5/0xa00 [ 469.942725][ T9822] kthread+0x388/0x470 [ 469.942743][ T9822] ret_from_fork+0x514/0xb70 [ 469.942758][ T9822] ret_from_fork_asm+0x1a/0x30 [ 469.942775][ T9822] [ 469.942779][ T9822] The buggy address belongs to the object at ffff888026617980 [ 469.942779][ T9822] which belongs to the cache kmalloc-64 of size 64 [ 469.942793][ T9822] The buggy address is located 32 bytes inside of [ 469.942793][ T9822] freed 64-byte region [ffff888026617980, ffff8880266179c0) [ 469.942811][ T9822] [ 469.942815][ T9822] The buggy address belongs to the physical page: [ 469.942828][ T9822] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26617 [ 469.942845][ T9822] flags: 0x80000000000000(node=0|zone=1) [ 469.942862][ T9822] page_type: f5(slab) [ 469.942877][ T9822] raw: 0080000000000000 ffff88801a00b8c0 dead000000000100 dead000000000122 [ 469.942891][ T9822] raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 [ 469.942900][ T9822] page dumped because: kasan: bad access detected [ 469.942909][ T9822] page_owner tracks the page as allocated [ 469.942915][ T9822] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1465, tgid 1465 (kworker/u8:10), ts 12087305073, free_ts 12087273774 [ 469.942944][ T9822] post_alloc_hook+0x231/0x280 [ 469.942970][ T9822] get_page_from_freelist+0x27c8/0x2840 [ 469.942988][ T9822] __alloc_frozen_pages_noprof+0x18d/0x380 [ 469.943006][ T9822] allocate_slab+0x77/0x660 [ 469.943026][ T9822] refill_objects+0x33c/0x3d0 [ 469.943045][ T9822] __pcs_replace_empty_main+0x373/0x720 [ 469.943065][ T9822] __kmalloc_node_noprof+0x610/0x7f0 [ 469.943081][ T9822] __vmalloc_node_range_noprof+0x5ef/0x1750 [ 469.943098][ T9822] __vmalloc_node_noprof+0xc2/0x100 [ 469.943114][ T9822] dup_task_struct+0x298/0x840 [ 469.943129][ T9822] copy_process+0x89b/0x4450 [ 469.943144][ T9822] kernel_clone+0x283/0x870 [ 469.943161][ T9822] user_mode_thread+0x110/0x180 [ 469.943177][ T9822] call_usermodehelper_exec_work+0x5c/0x230 [ 469.943192][ T9822] process_scheduled_works+0xb5d/0x1860 [ 469.943207][ T9822] worker_thread+0xa53/0xfc0 [ 469.943222][ T9822] page last free pid 1465 tgid 1465 stack trace: [ 469.943232][ T9822] __free_frozen_pages+0xfa6/0x10f0 [ 469.943250][ T9822] __kasan_populate_vmalloc+0x1b2/0x1d0 [ 469.943272][ T9822] alloc_vmap_area+0xd47/0x1480 [ 469.943285][ T9822] __get_vm_area_node+0x226/0x350 [ 469.943300][ T9822] __vmalloc_node_range_noprof+0x36a/0x1750 [ 469.943317][ T9822] __vmalloc_node_noprof+0xc2/0x100 [ 469.943334][ T9822] dup_task_struct+0x298/0x840 [ 469.943349][ T9822] copy_process+0x89b/0x4450 [ 469.943365][ T9822] kernel_clone+0x283/0x870 [ 469.943382][ T9822] user_mode_thread+0x110/0x180 [ 469.943407][ T9822] call_usermodehelper_exec_work+0x5c/0x230 [ 469.943423][ T9822] process_scheduled_works+0xb5d/0x1860 [ 469.943438][ T9822] worker_thread+0xa53/0xfc0 [ 469.943454][ T9822] kthread+0x388/0x470 [ 469.943473][ T9822] ret_from_fork+0x514/0xb70 [ 469.943489][ T9822] ret_from_fork_asm+0x1a/0x30 [ 469.943514][ T9822] [ 469.943519][ T9822] Memory state around the buggy address: [ 469.943529][ T9822] ffff888026617880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 469.943541][ T9822] ffff888026617900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 469.943552][ T9822] >ffff888026617980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 469.943560][ T9822] ^ [ 469.943570][ T9822] ffff888026617a00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 469.943579][ T9822] ffff888026617a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc [ 469.943589][ T9822] ================================================================== [ 469.945121][ T9822] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 469.945140][ T9822] CPU: 1 UID: 0 PID: 9822 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 469.945161][ T9822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 469.945172][ T9822] Call Trace: [ 469.945179][ T9822] [ 469.945186][ T9822] vpanic+0x56c/0xa60 [ 469.945210][ T9822] ? __pfx_vpanic+0x10/0x10 [ 469.945234][ T9822] panic+0xc5/0xd0 [ 469.945253][ T9822] ? __pfx_panic+0x10/0x10 [ 469.945273][ T9822] ? preempt_schedule_thunk+0x16/0x30 [ 469.945296][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.945315][ T9822] ? preempt_schedule_thunk+0x16/0x30 [ 469.945337][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.945355][ T9822] check_panic_on_warn+0x89/0xb0 [ 469.945376][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.945402][ T9822] end_report+0x73/0x170 [ 469.945421][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.945439][ T9822] kasan_report+0x128/0x150 [ 469.945457][ T9822] ? vhci_tx_loop+0x3e9/0x1c50 [ 469.945479][ T9822] vhci_tx_loop+0x3e9/0x1c50 [ 469.945499][ T9822] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.945519][ T9822] ? __set_cpus_allowed_ptr_locked+0x7bb/0x19c0 [ 469.945549][ T9822] ? __pfx_vhci_tx_loop+0x10/0x10 [ 469.945573][ T9822] ? __lock_acquire+0x6b5/0x2cf0 [ 469.945601][ T9822] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.945619][ T9822] ? lock_acquire+0x106/0x350 [ 469.945644][ T9822] ? __pfx_autoremove_wake_function+0x10/0x10 [ 469.945666][ T9822] ? __kthread_parkme+0x7a/0x1f0 [ 469.945689][ T9822] kthread+0x388/0x470 [ 469.945710][ T9822] ? __pfx_vhci_tx_loop+0x10/0x10 [ 469.945730][ T9822] ? __pfx_kthread+0x10/0x10 [ 469.945752][ T9822] ret_from_fork+0x514/0xb70 [ 469.945773][ T9822] ? __pfx_ret_from_fork+0x10/0x10 [ 469.945792][ T9822] ? __switch_to+0xc79/0x1410 [ 469.945817][ T9822] ? __pfx_kthread+0x10/0x10 [ 469.945840][ T9822] ret_from_fork_asm+0x1a/0x30 [ 469.945868][ T9822] [ 469.946537][ T9822] Kernel Offset: disabled