last executing test programs: 6.03367562s ago: executing program 1 (id=98): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_sctp(0xa, 0x801, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x78}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) quotactl$Q_SETINFO(0xffffffff80000600, &(0x7f0000000080)=@md0, r2, &(0x7f00000000c0)={0xffff, 0x7, 0x0, 0x5}) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r8, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r9, 0xffffffffffffffff, 0x3f00000000000000) 5.807642743s ago: executing program 1 (id=101): syz_clone3(&(0x7f00000011c0)={0x48008200, &(0x7f0000000000)=0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080), {0x2}, &(0x7f0000000100)=""/111, 0x6f, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=[0xffffffffffffffff], 0x1}, 0x58) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, &(0x7f0000001240)=0x8) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi4\x00', 0x2, 0x0) ioctl$COMEDI_CANCEL(r1, 0x6407) 5.680403085s ago: executing program 1 (id=102): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) accept4(r0, &(0x7f0000000000)=@x25, &(0x7f0000000080)=0x80, 0x80000) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x42, 0xa}, {0x80, 0x40, 0x100, 0x100, 0xa}}}}, 0x17) 5.173694474s ago: executing program 1 (id=105): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) unshare(0x2040400) fcntl$lock(r0, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r0, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x73f0, 0x9}) fcntl$lock(r0, 0x7, &(0x7f0000000140)={0x1, 0x1, 0x73f8, 0x4}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\b-'], 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000880)={0x1, 0x0, @pic={0x8, 0x7, 0x8, 0x3, 0x2, 0x1, 0xc5, 0x9, 0x28, 0x2, 0x1, 0x95, 0xb, 0x8, 0x7f, 0x7}}) ioctl$TCFLSH(r2, 0x400455c8, 0x4) 4.345680942s ago: executing program 0 (id=108): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) 4.263955654s ago: executing program 3 (id=109): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, 0x0, 0x1, 0x70bd26, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x40, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x1) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) ioctl$HIDIOCSFEATURE(r2, 0xc0404806, &(0x7f0000000040)) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0e00000001"], 0xc) 4.241378019s ago: executing program 0 (id=110): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_io_uring_setup(0x9, &(0x7f0000000080)={0x0, 0x2c6f, 0x0, 0x3, 0x3}, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000006c0)=@IORING_OP_NOP128={0x3f, 0x0, 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x5, 0x20, 0x0, {0x4}}) syz_io_uring_setup(0xf00, &(0x7f0000000480)={0x0, 0x0, 0x10000, 0x1000004, 0x55, 0x0, r1}, &(0x7f0000000380)=0x0, &(0x7f00000002c0), &(0x7f0000000080)) syz_ublk_add_dev(r1, r5, r3, r4, &(0x7f0000000540)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x4, 0x3b4, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x10}}}, 0x0) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440), 0x1b1000, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r7, 0xc0189379, &(0x7f0000000500)={{0x1, 0x1, 0x18, r6}, './proc/thread-self/fail-nth\x00'}) connect(r0, &(0x7f0000000040)=@nfc_llcp={0x27, 0x0, 0x0, 0x2, 0x5, 0x6, "0fb3c97ce5f57198d1c07463d0d2e562426ab0b31c83aad92c1bb8227785aa08c3c9259a8a40969ce1b70034e37de91e5868b7590bdc7cc3d317d2b5bdfc12", 0xe}, 0x80) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x8a800, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231306e53f070c0000002a820383"], 0x0}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r8, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r8, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r10, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r8, 0x3ba0, &(0x7f0000000300)={0x48, 0xb, r11}) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r12, &(0x7f0000000000)='3', 0x4e) fcntl$setsig(r12, 0xa, 0x0) r13 = socket(0x2, 0x805, 0x0) r14 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) r16 = ioctl$KVM_CREATE_VCPU(r15, 0xae41, 0x3) syz_kvm_setup_cpu$x86(r15, r16, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="66b8070000000f23d80f21f86635000000100f23f8670f01c90f01c166b8880000000f23d80f21f86635c00000f00f23f8440f20c0663501000000440f22c067f20f1bdbf30f9a7cc1f365f30f236b0f01cfbaf80c66b82c14f78266efbafc0c66ed", 0x62}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r12, 0x89f2, &(0x7f0000000380)={'syztnl0\x00', &(0x7f0000000300)={'gre0\x00', 0x0, 0x8, 0x40, 0x0, 0x5, {{0x12, 0x4, 0x3, 0x35, 0x48, 0x65, 0x0, 0xc1, 0x2f, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0x34}, {[@rr={0x7, 0xf, 0x8c, [@multicast1, @dev={0xac, 0x14, 0x14, 0x20}, @local]}, @rr={0x7, 0xb, 0x79, [@empty, @loopback]}, @generic={0x83, 0xf, "d756e9aaa2ac71221c879d8f7b"}, @rr={0x7, 0x7, 0xb5, [@rand_addr=0x64010102]}, @noop, @noop]}}}}}) sendmsg$inet(r13, &(0x7f0000000540)={&(0x7f00000000c0)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000001c0)="4f7d1af2a46c3702883663da09525e176ca4aa0d8b9c47b138a653541e87d49269a1252694481ee8ccff36165c6080b85062d456dc42a4fd7f880dd881d7e7fa639941b49e7373980630b6f164e58939a9991387405d782263dbbd8cc8359baac36ea1317ab03353c74f4f7641945332a9429a8e79563b04c7014283f2091a4bc30c8385e48d881883c1bc065dbb61a9cb10ea35d2127be47ab7491c48cac53845a289dcdd620d7ebe1a9ddf90a3580e3f1bb1526fd5631e4eb22806d40b25e53345b3efa6699d0e59827a43bfeca91874f249b1d023f4b1a3", 0xd9}], 0x1, &(0x7f0000000740)=ANY=[@ANYBLOB="14fffffff90000000000000001000013dc0ce50000000000140000000000000000000000010000000900000000006c0022388762059aa9df4c264138011c00000000000000001a83631800f43200006b61cc450ec070374c6a0e7f4c0a9ccb94ce5b056c3c444502588ad80fbce7a1b7f6e4de3dca0653e4d79cbe30378a13c650b46834405e0793e072181857", @ANYRES32=r17, @ANYBLOB="e0000001e0000002000000005c000000000000000000000007000000940400004444c1710000000000000002ac1e010100000009e000000200000006e000000200000002ac1414bb00000009ac14143b000000077f0000010000000364010102000000010000000000000000110000000000000000000000010000000900000000000000"], 0xc8}, 0x4000000) 3.28227252s ago: executing program 3 (id=111): r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r1, &(0x7f00000091c0)=""/16384, 0x4000) 3.277086916s ago: executing program 1 (id=112): mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r0 = socket(0xb, 0x1, 0x4) write(r0, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) ioctl$GIO_SCRNMAP(r1, 0x4b3d, 0x0) write(r0, &(0x7f0000000240)="3c000000100005060200000000000000000000000000000000000000000000000c0003006261746164763000100012000b0001006261746164760000", 0x3c) ioctl$XFS_IOC_FSGEOMETRY_V4(0xffffffffffffffff, 0x8070587c, &(0x7f0000000580)) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000002c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./mnt\x00', &(0x7f0000000200)='ncpfs\x00', 0x8410, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x21) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r4 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r5, &(0x7f0000000a80)=""/188, 0xba) syz_usb_disconnect(r4) open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) open(&(0x7f0000000180)='./sys\x00', 0x109000, 0x10) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCETHTOOL(r6, 0x80087601, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x104) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x4000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/ahci\x00', 0x0, 0x0) 2.13194102s ago: executing program 0 (id=114): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000080)=0x80) (async) read$dsp(r1, &(0x7f00000000c0)=""/15, 0xf) (async) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) (async, rerun: 64) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/tty/ttyS0/rx_trig_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='8\n\x00', 0x2) (async, rerun: 32) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/tty/ttyS1/rx_trig_bytes\x00', 0x2, 0x0) (rerun: 32) write(r3, &(0x7f0000000400)='8\n\x00', 0x2) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/tty/ttyS2/rx_trig_bytes\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='8\n\x00', 0x2) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/tty/ttyS3/rx_trig_bytes\x00', 0x2, 0x0) write(r5, &(0x7f0000000400)='8\n\x00', 0x2) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c00048010000180080001006c6f6700040002802800018008000100666962001c00028008000140000000110800034000000005080002"], 0xec}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg$inet6(r6, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000014) 2.131594203s ago: executing program 3 (id=115): r0 = socket$kcm(0xa, 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in={0x2, 0x4e24, @multicast1}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 2.083249452s ago: executing program 3 (id=116): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000400)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10) sendto(r0, &(0x7f0000000540)="f6", 0xffa6, 0xd63a66976f7dfbe1, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000003c0)) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="500000000700024000000001080001400000000c08000140000000020800024000002c1b0800024000000101080001400000008000"/80], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x34000051) r2 = syz_open_dev$video4linux(&(0x7f0000001380), 0x5, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r2, 0xc0585604, &(0x7f0000000100)={0x1000000, 0x0, {0x2, 0x4283, 0x2002, 0x6, 0x8, 0x4, 0x2, 0x5}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4433000041000701fefffffffeffffff017c0000040042800c0001800600060065580000203302801c33118004"], 0x3344}, 0x1, 0x0, 0x0, 0x4040044}, 0xc000) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r5, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f00000027c0)={0x4, 0x0, [{0x1ffc, 0x9f, &(0x7f0000000480)=""/159}, {0x10094000, 0x1000, &(0x7f0000001680)=""/4096}, {0x1000, 0x20, &(0x7f0000002680)=""/32}, {0x0, 0xfd, &(0x7f00000026c0)=""/253}]}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000740)=""/183, 0x0, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r5, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000100)={0x28, 0x0, 0x2710, @my=0x1}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000140)=0x4, 0x8) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000080)={0x7, 0xb}) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000001014d9ec29bd7000fcd9df250800030001000000080001000000000008004b001300000008004a000100000008004b"], 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) 2.004983665s ago: executing program 2 (id=117): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) close(0x3) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000040)={'bond_slave_1\x00', 0x5}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r3, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff], [0x10000, 0x0, 0x0, 0x0, 0x8001], [0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]], '\x00', [{}, {0xfffffffd}, {}, {0x0, 0xfffffffc, 0x0, 0x1, 0x1}, {0x80000009, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0xfffffffa}, {}, {0x8000000, 0x8f96}], '\x00', 0x1000}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0xff, 0xfe, 0x7fff0006}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x5c, 0x1, 0x1, 0xa00, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x4}, @CTA_LABELS={0x1c, 0x16, 0x1, 0x0, [0x8, 0x3, 0x7, 0x10, 0x80000000, 0x2]}, @CTA_SYNPROXY={0x24, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x8001}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xd}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x40}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x8001}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x8044) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000100)={0x20004, r4}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r7, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01864c2, &(0x7f0000000580)={0x0, 0x1, r6}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01864c2, &(0x7f00000005c0)={0x0, 0x1, r6}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r7, 0xc03064ca, &(0x7f0000000680)={&(0x7f0000000600)=[0x0, r9, 0x0, r10], &(0x7f0000000640)=[0x9, 0x6, 0x8, 0x0, 0x4, 0xd65, 0x905, 0x6], 0x0, 0x4, 0x5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r7, 0xc00c642d, &(0x7f0000000080)={r8}) ioctl$DRM_IOCTL_GEM_CLOSE(r2, 0x40086409, &(0x7f0000000180)={r8}) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000100001000000ecffffff00000000000a4800126de9a23c1eba861638da00060a0b0400000000000004000200fffe1c0004997cbd1f80080001006c6f67000c0002800500024000000097f9c9900073797a30000000000900020073797a32000000bf6919b74736001400000011000100000000000000"], 0x70}, 0x1, 0x0, 0x0, 0x840}, 0x0) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r11, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e23, @loopback}], 0x21) syz_usbip_server_init(0x2) landlock_create_ruleset(0x0, 0x0, 0x3) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100000000000000010401000000000000000a0000010900010073797a31000000000900020073090000000000002400048020000180080001006f7366001400028008000140000000000500020006000000140000001100010000000000000000000100000a00"/120], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x400c880) 1.52432991s ago: executing program 0 (id=118): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@ip_ttl={{0x18, 0x11a, 0x1, 0x15}}], 0x18}, 0x0) 1.515041611s ago: executing program 0 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./binfmt/status\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 1.471469346s ago: executing program 0 (id=120): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x275a, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) unshare(0x2040400) fcntl$lock(r0, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r0, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x73f0, 0x9}) fcntl$lock(r0, 0x7, &(0x7f0000000140)={0x1, 0x1, 0x73f8, 0x4}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\b-'], 0x14}, 0x1, 0x0, 0x0, 0x8004}, 0xa4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000880)={0x1, 0x0, @pic={0x8, 0x7, 0x8, 0x3, 0x2, 0x1, 0xc5, 0x9, 0x28, 0x2, 0x1, 0x95, 0xb, 0x8, 0x7f, 0x7}}) ioctl$TCFLSH(r2, 0x400455c8, 0x4) 1.240314102s ago: executing program 2 (id=121): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) setgid(0xee00) keyctl$session_to_parent(0x12) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000480)={0x4000000, 0x92ff, 0x0, 0x0, 0x1}) 1.236372628s ago: executing program 1 (id=122): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000010000)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000700)={0x2c, &(0x7f0000000500)={0x0, 0xa, 0x37, "9923e49fb6977451376544bf3137c79f8db4898329690dd6b8a7a2c54f515ed31cf63723adac4af074c9c544a507f08b544c11772503e1"}, 0x0, 0x0, 0x0, 0x0}) 1.115370812s ago: executing program 2 (id=123): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000201010200000000000000000a00000a0400199008001a4000010001"], 0x20}, 0x1, 0x0, 0x0, 0x4000191}, 0x48080) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000000201010200000000000000000a00000a0400199008001a4000010001"], 0x20}, 0x1, 0x0, 0x0, 0x4000191}, 0x48080) (async) 1.008201796s ago: executing program 3 (id=124): r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000009180)='./mnt/trace_pipe\x00', 0x0, 0x0) read(r1, &(0x7f00000091c0)=""/16384, 0x4000) 957.276614ms ago: executing program 2 (id=125): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) accept4(r0, &(0x7f0000000000)=@x25, &(0x7f0000000080)=0x80, 0x80000) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x42, 0xa}, {0x80, 0x40, 0x100, 0x100, 0xa}}}}, 0x17) 360.989431ms ago: executing program 2 (id=126): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r1, &(0x7f0000000500)=[{&(0x7f0000000000)='d', 0xc0000}], 0x1c, 0xa00, 0x2000000, 0x22) 240.007µs ago: executing program 2 (id=127): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./my_sysfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_sysfs\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_sysfs/bus/pci/devices/0000:00:03.0/resource0\x00', 0x0, 0x0) pread64(r0, &(0x7f00000001c0)=""/2, 0x2, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x3f00000000000000) 0s ago: executing program 3 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./binfmt/status\x00', 0x1, 0x0) write(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.86' (ED25519) to the list of known hosts. [ 81.723768][ T5598] cgroup: Unknown subsys name 'net' [ 81.862960][ T5598] cgroup: Unknown subsys name 'cpuset' [ 81.873792][ T5598] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.493519][ T5598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.826738][ T5608] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.836933][ T5608] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.837729][ T5608] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.838701][ T5608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.855989][ T5608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.965475][ T5608] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.967376][ T5608] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.967901][ T5608] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.983132][ T5608] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.995955][ T5608] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.013788][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.031973][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.034932][ T5617] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.038701][ T5617] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.050060][ T5617] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.086547][ T5617] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.096218][ T5617] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.103368][ T5617] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.108603][ T5617] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.117384][ T5617] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.772087][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.772196][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.772577][ T5615] bridge_slave_0: entered allmulticast mode [ 87.774650][ T5615] bridge_slave_0: entered promiscuous mode [ 87.839246][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.839355][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.839486][ T5615] bridge_slave_1: entered allmulticast mode [ 87.841074][ T5615] bridge_slave_1: entered promiscuous mode [ 87.888952][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.889045][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.889168][ T5607] bridge_slave_0: entered allmulticast mode [ 87.890591][ T5607] bridge_slave_0: entered promiscuous mode [ 87.903858][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.904143][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.905441][ T5607] bridge_slave_1: entered allmulticast mode [ 87.907625][ T5607] bridge_slave_1: entered promiscuous mode [ 87.959722][ T5617] Bluetooth: hci0: command tx timeout [ 87.989551][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.028191][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.040480][ T5617] Bluetooth: hci1: command tx timeout [ 88.066839][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.085799][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.085998][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.086311][ T5619] bridge_slave_0: entered allmulticast mode [ 88.087585][ T5619] bridge_slave_0: entered promiscuous mode [ 88.118929][ T5617] Bluetooth: hci2: command tx timeout [ 88.125506][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.148902][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.149070][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.149216][ T5619] bridge_slave_1: entered allmulticast mode [ 88.150847][ T5619] bridge_slave_1: entered promiscuous mode [ 88.182856][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.182957][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.183070][ T5613] bridge_slave_0: entered allmulticast mode [ 88.184535][ T5613] bridge_slave_0: entered promiscuous mode [ 88.200727][ T5617] Bluetooth: hci3: command tx timeout [ 88.228338][ T5615] team0: Port device team_slave_0 added [ 88.248068][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.248182][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.248282][ T5613] bridge_slave_1: entered allmulticast mode [ 88.252532][ T5613] bridge_slave_1: entered promiscuous mode [ 88.283882][ T5615] team0: Port device team_slave_1 added [ 88.287047][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.311417][ T5607] team0: Port device team_slave_0 added [ 88.328811][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.351871][ T5607] team0: Port device team_slave_1 added [ 88.354498][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.401689][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.402679][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.402693][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.402717][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.479641][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.479664][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.479684][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.483052][ T5619] team0: Port device team_slave_0 added [ 88.484053][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.484068][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.484094][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.486534][ T5619] team0: Port device team_slave_1 added [ 88.570365][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.570420][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.570497][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.646638][ T5613] team0: Port device team_slave_0 added [ 88.656144][ T5613] team0: Port device team_slave_1 added [ 88.700272][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.700289][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.700312][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.702710][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.702727][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.702754][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.705399][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.705415][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.705442][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.849930][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.849947][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.849970][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.907198][ T5615] hsr_slave_0: entered promiscuous mode [ 88.908112][ T5615] hsr_slave_1: entered promiscuous mode [ 88.933728][ T5607] hsr_slave_0: entered promiscuous mode [ 88.934547][ T5607] hsr_slave_1: entered promiscuous mode [ 88.935198][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 88.935279][ T5607] Cannot create hsr debugfs directory [ 89.050275][ T5619] hsr_slave_0: entered promiscuous mode [ 89.051160][ T5619] hsr_slave_1: entered promiscuous mode [ 89.051750][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 89.051771][ T5619] Cannot create hsr debugfs directory [ 89.111882][ T5613] hsr_slave_0: entered promiscuous mode [ 89.113606][ T5613] hsr_slave_1: entered promiscuous mode [ 89.114254][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 89.114274][ T5613] Cannot create hsr debugfs directory [ 89.546522][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.565345][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.566609][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.589083][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.592006][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.596411][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.626157][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.639475][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.702656][ T5619] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.707773][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.729309][ T5619] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.733971][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.756324][ T5619] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.766903][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.767911][ T5619] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.786238][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.878678][ T5613] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.892551][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.904228][ T5613] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.919867][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.920886][ T5613] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.924358][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.943272][ T5613] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.963278][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.039776][ T5617] Bluetooth: hci0: command tx timeout [ 90.079714][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.104388][ T5607] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.108201][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.128032][ T5607] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.130908][ T5617] Bluetooth: hci1: command tx timeout [ 90.144259][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.158332][ T5607] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.169960][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.171541][ T5607] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.175363][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.203117][ T5617] Bluetooth: hci2: command tx timeout [ 90.243284][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.279456][ T5617] Bluetooth: hci3: command tx timeout [ 90.299577][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.302867][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.303135][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.341789][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.341865][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.397897][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.437820][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.437897][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.471147][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.493627][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.493718][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.542604][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.566319][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.566394][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.604388][ T1488] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.604517][ T1488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.694993][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.783314][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.815706][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.815816][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.876294][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.876412][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.722631][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.872340][ T5615] veth0_vlan: entered promiscuous mode [ 91.911878][ T5615] veth1_vlan: entered promiscuous mode [ 91.936890][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.995817][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.097486][ T5615] veth0_macvtap: entered promiscuous mode [ 92.117466][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.129559][ T5617] Bluetooth: hci0: command tx timeout [ 92.136993][ T5615] veth1_macvtap: entered promiscuous mode [ 92.153843][ T5613] veth0_vlan: entered promiscuous mode [ 92.180328][ T5613] veth1_vlan: entered promiscuous mode [ 92.199543][ T5617] Bluetooth: hci1: command tx timeout [ 92.206622][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.242255][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.281309][ T5617] Bluetooth: hci2: command tx timeout [ 92.303190][ T10] cfg80211: failed to load regulatory.db [ 92.336074][ T5619] veth0_vlan: entered promiscuous mode [ 92.355163][ T5607] veth0_vlan: entered promiscuous mode [ 92.359633][ T5617] Bluetooth: hci3: command tx timeout [ 92.408266][ T5607] veth1_vlan: entered promiscuous mode [ 92.427531][ T5619] veth1_vlan: entered promiscuous mode [ 92.456806][ T5613] veth0_macvtap: entered promiscuous mode [ 92.498209][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.498237][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.524840][ T5613] veth1_macvtap: entered promiscuous mode [ 92.604227][ T5607] veth0_macvtap: entered promiscuous mode [ 92.627769][ T1488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.627792][ T1488] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.646830][ T5607] veth1_macvtap: entered promiscuous mode [ 92.663407][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.681411][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.681670][ T62] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.684727][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.686963][ T5619] veth0_macvtap: entered promiscuous mode [ 92.744925][ T5619] veth1_macvtap: entered promiscuous mode [ 92.754136][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.794492][ T5615] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.798475][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.891854][ T62] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.893904][ T5757] capability: warning: `syz.3.4' uses 32-bit capabilities (legacy support in use) [ 92.934514][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.960386][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.960464][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.960504][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.960544][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.960584][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.960623][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.986772][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.094906][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.094928][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.129719][ T1488] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.129919][ T1488] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.130056][ T1488] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.130638][ T1488] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.130841][ T1488] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.187359][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 93.189923][ T1155] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.190063][ T1155] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.266203][ T1155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.266225][ T1155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.316812][ T1155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.316830][ T1155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.373734][ T10] usb 4-1: New USB device found: idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 93.397248][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 93.397311][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.437187][ T10] usb 4-1: config 0 descriptor?? [ 93.461914][ T62] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.461937][ T62] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.489326][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 93.546918][ T1488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.546942][ T1488] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.643585][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.643610][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.973085][ T5763] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.975371][ T5763] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 94.199875][ T5617] Bluetooth: hci0: command tx timeout [ 94.244724][ T5770] syz.0.6 uses obsolete (PF_INET,SOCK_PACKET) [ 94.256409][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 94.284412][ T5617] Bluetooth: hci1: command tx timeout [ 94.359456][ T5617] Bluetooth: hci2: command tx timeout [ 94.439309][ T5617] Bluetooth: hci3: command tx timeout [ 94.467198][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 94.479773][ T10] pwc: recv_control_msg error -32 req 04 val 1000 [ 94.480876][ T10] pwc: recv_control_msg error -32 req 04 val 1300 [ 94.523359][ T10] pwc: recv_control_msg error -32 req 04 val 1400 [ 94.536551][ T10] pwc: recv_control_msg error -71 req 02 val 2000 [ 94.537080][ T10] pwc: recv_control_msg error -71 req 02 val 2100 [ 94.545023][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 94.558618][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 94.567608][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 94.568133][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 94.585291][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 94.585987][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 94.586629][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 94.586981][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 94.622810][ T10] pwc: Registered as video103. [ 94.634591][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input5 [ 94.674417][ T10] usb 4-1: USB disconnect, device number 2 [ 94.687777][ T5710] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 94.850584][ T5710] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 94.868460][ T5710] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 94.887706][ T5710] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 94.887736][ T5710] usb 1-1: Product: syz [ 94.887751][ T5710] usb 1-1: Manufacturer: syz [ 94.887766][ T5710] usb 1-1: SerialNumber: syz [ 94.930143][ T5775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8'. [ 94.930249][ T5775] bridge_slave_1: left allmulticast mode [ 94.930268][ T5775] bridge_slave_1: left promiscuous mode [ 94.930896][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.938231][ T5775] bridge_slave_0: left allmulticast mode [ 94.938252][ T5775] bridge_slave_0: left promiscuous mode [ 94.938537][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.129527][ T5710] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 95.325469][ T5781] jffs2: notice: (5781) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 95.365503][ T5776] usb 1-1: USB disconnect, device number 2 [ 95.415705][ T5776] usblp0: removed [ 95.556034][ T1488] Bluetooth: hci4: Frame reassembly failed (-84) [ 95.557402][ T62] Bluetooth: hci4: Frame reassembly failed (-84) [ 96.339459][ T5695] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 96.486528][ T5797] FAULT_INJECTION: forcing a failure. [ 96.486528][ T5797] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 96.486578][ T5797] CPU: 1 UID: 0 PID: 5797 Comm: syz.1.16 Not tainted syzkaller #0 PREEMPT(full) [ 96.486610][ T5797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 96.486633][ T5797] Call Trace: [ 96.486642][ T5797] [ 96.486656][ T5797] dump_stack_lvl+0xe8/0x150 [ 96.486695][ T5797] should_fail_ex+0x3eb/0x540 [ 96.486724][ T5797] _copy_to_iter+0x404/0x19c0 [ 96.486764][ T5797] ? __pfx__copy_to_iter+0x10/0x10 [ 96.486792][ T5797] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 96.486819][ T5797] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 96.486846][ T5797] __skb_datagram_iter+0xf8/0x980 [ 96.486871][ T5797] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 96.486904][ T5797] skb_copy_datagram_iter+0xb5/0x240 [ 96.486931][ T5797] netlink_recvmsg+0x2b9/0xa50 [ 96.486964][ T5797] ? __pfx_netlink_recvmsg+0x10/0x10 [ 96.486990][ T5797] ? aa_sock_msg_perm+0x144/0x210 [ 96.487016][ T5797] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 96.487037][ T5797] ? security_socket_recvmsg+0x7e/0x2c0 [ 96.487061][ T5797] ? __pfx_netlink_recvmsg+0x10/0x10 [ 96.487082][ T5797] sock_recvmsg+0x196/0x1e0 [ 96.487109][ T5797] ____sys_recvmsg+0x1e6/0x4a0 [ 96.487139][ T5797] ? iovec_from_user+0x87/0x250 [ 96.487169][ T5797] ? __pfx_____sys_recvmsg+0x10/0x10 [ 96.487207][ T5797] ? import_iovec+0x73/0xa0 [ 96.487233][ T5797] ___sys_recvmsg+0x213/0x5a0 [ 96.487255][ T5797] ? lock_acquire+0x115/0x350 [ 96.487281][ T5797] ? __pfx____sys_recvmsg+0x10/0x10 [ 96.487309][ T5797] ? lock_acquire+0x115/0x350 [ 96.487349][ T5797] ? __fget_files+0x2a/0x420 [ 96.487371][ T5797] ? __fget_files+0x3a2/0x420 [ 96.487396][ T5797] ? __fget_files+0x2a/0x420 [ 96.487421][ T5797] ? fdget+0x1ac/0x250 [ 96.487467][ T5797] do_recvmmsg+0x31a/0x7f0 [ 96.487498][ T5797] ? __pfx_do_recvmmsg+0x10/0x10 [ 96.487534][ T5797] ? get_timespec64+0x119/0x1b0 [ 96.487557][ T5797] ? __pfx_get_timespec64+0x10/0x10 [ 96.487580][ T5797] ? fdget+0x1ac/0x250 [ 96.487608][ T5797] __x64_sys_recvmmsg+0x1b7/0x250 [ 96.487634][ T5797] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 96.487670][ T5797] do_syscall_64+0x166/0x520 [ 96.487691][ T5797] ? trace_irq_disable+0x3b/0x140 [ 96.487711][ T5797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.487735][ T5797] ? clear_bhb_loop+0x70/0xc0 [ 96.487760][ T5797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.487783][ T5797] RIP: 0033:0x7f66deb9e199 [ 96.487811][ T5797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.487830][ T5797] RSP: 002b:00007f66dfadb028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 96.487860][ T5797] RAX: ffffffffffffffda RBX: 00007f66dee25fa0 RCX: 00007f66deb9e199 [ 96.487877][ T5797] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 96.487892][ T5797] RBP: 00007f66dfadb090 R08: 0000200000003700 R09: 0000000000000000 [ 96.487907][ T5797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 96.487920][ T5797] R13: 00007f66dee26038 R14: 00007f66dee25fa0 R15: 00007ffc45a40c68 [ 96.487954][ T5797] [ 96.523994][ T5695] usb 1-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 96.548633][ T5695] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 96.549010][ T5695] usb 1-1: config 0 has no interface number 0 [ 96.615992][ T5695] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.616105][ T5695] usb 1-1: Product: syz [ 96.616134][ T5695] usb 1-1: Manufacturer: syz [ 96.616178][ T5695] usb 1-1: SerialNumber: syz [ 96.873037][ T5695] usb 1-1: config 0 descriptor?? [ 97.113036][ T5695] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 97.181149][ T5695] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 97.186619][ T5695] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 97.186705][ T5695] usb 1-1: media controller created [ 97.290232][ T5695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 97.431599][ T5810] jffs2: notice: (5810) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 97.559809][ T5617] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 97.635461][ T194] usb 1-1: USB disconnect, device number 3 [ 97.938886][ T5695] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 98.058677][ T5817] FAULT_INJECTION: forcing a failure. [ 98.058677][ T5817] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 98.058713][ T5817] CPU: 1 UID: 0 PID: 5817 Comm: syz.1.23 Not tainted syzkaller #0 PREEMPT(full) [ 98.058737][ T5817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 98.058749][ T5817] Call Trace: [ 98.058756][ T5817] [ 98.058766][ T5817] dump_stack_lvl+0xe8/0x150 [ 98.058795][ T5817] should_fail_ex+0x3eb/0x540 [ 98.058822][ T5817] prepare_alloc_pages+0x21e/0x5f0 [ 98.058851][ T5817] __alloc_frozen_pages_noprof+0x17a/0x400 [ 98.058877][ T5817] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 98.058908][ T5817] ? policy_nodemask+0x2cc/0x8e0 [ 98.058930][ T5817] ? __lock_acquire+0x747/0x2de0 [ 98.058951][ T5817] alloc_pages_mpol+0x21e/0x390 [ 98.058979][ T5817] folio_alloc_mpol_noprof+0x39/0x160 [ 98.059004][ T5817] vma_alloc_folio_noprof+0xe1/0x1e0 [ 98.059029][ T5817] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 98.059056][ T5817] ? vma_has_anon_rmap+0xc9/0x270 [ 98.059080][ T5817] do_pte_missing+0x16d4/0x3570 [ 98.059129][ T5817] handle_mm_fault+0x1a53/0x3750 [ 98.059163][ T5817] ? handle_mm_fault+0xf1/0x3750 [ 98.059195][ T5817] ? __pfx_handle_mm_fault+0x10/0x10 [ 98.059215][ T5817] ? lock_vma_under_rcu+0x45a/0x500 [ 98.059235][ T5817] ? __fget_files+0x2a/0x420 [ 98.059280][ T5817] do_user_addr_fault+0xb35/0x1480 [ 98.059315][ T5817] ? trace_page_fault_user+0x84/0x1e0 [ 98.059339][ T5817] exc_page_fault+0x6a/0xc0 [ 98.059363][ T5817] asm_exc_page_fault+0x26/0x30 [ 98.059383][ T5817] RIP: 0033:0x7f66dea5f70b [ 98.059403][ T5817] Code: 00 00 00 48 8d 3d 5d b1 1a 00 48 89 c1 31 c0 e8 cb 2d ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d 91 b1 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 98.059429][ T5817] RSP: 002b:00007f66dfad9fa0 EFLAGS: 00010206 [ 98.059450][ T5817] RAX: 0000000000000000 RBX: 00007f66dee25fa0 RCX: 0000000000000000 [ 98.059464][ T5817] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00002000000000c0 [ 98.059479][ T5817] RBP: 00007f66dfadb090 R08: 0000000000000000 R09: 0000000000000000 [ 98.059493][ T5817] R10: 00002000000000c0 R11: 0000000000000000 R12: 0000000000000001 [ 98.059507][ T5817] R13: 00007f66dee26038 R14: 00007f66dee25fa0 R15: 00007ffc45a40c68 [ 98.059541][ T5817] [ 98.091615][ T5695] usb 3-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 98.098004][ T5695] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 98.114241][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 98.114328][ T5695] usb 3-1: Product: syz [ 98.114372][ T5695] usb 3-1: Manufacturer: syz [ 98.114416][ T5695] usb 3-1: SerialNumber: syz [ 98.134894][ T5817] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 98.454715][ T5695] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 98.544103][ T5828] netlink: 16 bytes leftover after parsing attributes in process `syz.0.26'. [ 98.617996][ T5831] x_tables: unsorted underflow at hook 2 [ 98.654816][ T5695] usb 3-1: USB disconnect, device number 2 [ 98.677488][ T5695] usblp0: removed [ 99.469392][ T5847] FAULT_INJECTION: forcing a failure. [ 99.469392][ T5847] name failslab, interval 1, probability 0, space 0, times 1 [ 99.469426][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: syz.2.32 Not tainted syzkaller #0 PREEMPT(full) [ 99.469454][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 99.469467][ T5847] Call Trace: [ 99.469476][ T5847] [ 99.469486][ T5847] dump_stack_lvl+0xe8/0x150 [ 99.469516][ T5847] should_fail_ex+0x3eb/0x540 [ 99.469544][ T5847] should_failslab+0xa8/0x100 [ 99.469566][ T5847] ? dst_alloc+0x105/0x170 [ 99.469588][ T5847] kmem_cache_alloc_noprof+0x9c/0x600 [ 99.469611][ T5847] ? lock_acquire+0x115/0x350 [ 99.469633][ T5847] ? dst_alloc+0x105/0x170 [ 99.469658][ T5847] ? __pfx_ip6_dst_gc+0x10/0x10 [ 99.469682][ T5847] dst_alloc+0x105/0x170 [ 99.469710][ T5847] ip6_pol_route+0xb9d/0x14d0 [ 99.469731][ T5847] ? ip6_pol_route+0x163/0x14d0 [ 99.469757][ T5847] ? __pfx_ip6_pol_route+0x10/0x10 [ 99.469788][ T5847] ? __local_bh_enable_ip+0xd6/0x140 [ 99.469811][ T5847] ? lockdep_hardirqs_on+0x7b/0x110 [ 99.469834][ T5847] ? ip6t_do_table+0x1d1/0x15b0 [ 99.469854][ T5847] ? __local_bh_enable_ip+0xd6/0x140 [ 99.469880][ T5847] fib6_rule_lookup+0x512/0x6e0 [ 99.469906][ T5847] ? __pfx_ip6_pol_route_input+0x10/0x10 [ 99.469927][ T5847] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 99.469959][ T5847] ? ip6t_do_table+0x1d1/0x15b0 [ 99.469991][ T5847] ip6_route_input+0x78d/0xb20 [ 99.470018][ T5847] ? __pfx_ip6_route_input+0x10/0x10 [ 99.470050][ T5847] ? nf_nat_ipv6_in+0x200/0x2c0 [ 99.470080][ T5847] ? lock_acquire+0x115/0x350 [ 99.470106][ T5847] ? ip6_rcv_finish_core+0x222/0x420 [ 99.470130][ T5847] ip6_rcv_finish+0x141/0x280 [ 99.470154][ T5847] NF_HOOK+0x336/0x3c0 [ 99.470173][ T5847] ? __pfx_sock_wfree+0x10/0x10 [ 99.470195][ T5847] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 99.470216][ T5847] ? NF_HOOK+0x9e/0x3c0 [ 99.470242][ T5847] ? __pfx_NF_HOOK+0x10/0x10 [ 99.470261][ T5847] ? ip6_rcv_core+0xa1/0x1870 [ 99.470285][ T5847] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 99.470313][ T5847] ? netif_receive_skb+0x102/0xbf0 [ 99.470337][ T5847] netif_receive_skb+0x278/0xbf0 [ 99.470365][ T5847] ? __pfx_netif_receive_skb+0x10/0x10 [ 99.470393][ T5847] ? tun_rx_batched+0x185/0x790 [ 99.470416][ T5847] tun_rx_batched+0x1de/0x790 [ 99.470443][ T5847] ? __pfx_tun_rx_batched+0x10/0x10 [ 99.470465][ T5847] ? lock_acquire+0x115/0x350 [ 99.470494][ T5847] ? tun_get_user+0x23ba/0x44d0 [ 99.470514][ T5847] ? __local_bh_enable_ip+0xd6/0x140 [ 99.470535][ T5847] ? tun_get_user+0x27b0/0x44d0 [ 99.470558][ T5847] tun_get_user+0x2be0/0x44d0 [ 99.470595][ T5847] ? tun_get_user+0x27b0/0x44d0 [ 99.470615][ T5847] ? aa_file_perm+0x18b/0x15f0 [ 99.470642][ T5847] ? aa_file_perm+0x4ed/0x15f0 [ 99.470662][ T5847] ? __pfx_tun_get_user+0x10/0x10 [ 99.470686][ T5847] ? __lock_acquire+0x747/0x2de0 [ 99.470710][ T5847] ? kstrtoull+0x137/0x1d0 [ 99.470742][ T5847] ? ref_tracker_alloc+0x172/0x530 [ 99.470763][ T5847] ? lock_acquire+0x115/0x350 [ 99.470785][ T5847] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 99.470811][ T5847] ? lock_acquire+0x115/0x350 [ 99.470833][ T5847] ? tun_get+0x1c/0x2f0 [ 99.470860][ T5847] ? tun_get+0x1c/0x2f0 [ 99.470881][ T5847] ? tun_get+0x1c/0x2f0 [ 99.470909][ T5847] tun_chr_write_iter+0x113/0x200 [ 99.470935][ T5847] vfs_write+0x612/0xba0 [ 99.470966][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 99.470992][ T5847] ? __fget_files+0x3a2/0x420 [ 99.471011][ T5847] ? __fget_files+0x2a/0x420 [ 99.471036][ T5847] ? fdget+0x1ac/0x250 [ 99.471064][ T5847] ksys_write+0x150/0x270 [ 99.471088][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 99.471123][ T5847] do_syscall_64+0x166/0x520 [ 99.471143][ T5847] ? trace_irq_disable+0x3b/0x140 [ 99.471170][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.471193][ T5847] ? clear_bhb_loop+0x70/0xc0 [ 99.471217][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.471247][ T5847] RIP: 0033:0x7fc33f39e199 [ 99.471267][ T5847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.471285][ T5847] RSP: 002b:00007fc3402cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 99.471309][ T5847] RAX: ffffffffffffffda RBX: 00007fc33f625fa0 RCX: 00007fc33f39e199 [ 99.471326][ T5847] RDX: 0000000000000ffe RSI: 00002000000000c0 RDI: 0000000000000003 [ 99.471340][ T5847] RBP: 00007fc3402cb090 R08: 0000000000000000 R09: 0000000000000000 [ 99.471353][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.471366][ T5847] R13: 00007fc33f626038 R14: 00007fc33f625fa0 R15: 00007fff0c863038 [ 99.471401][ T5847] [ 100.267563][ T5848] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 100.399090][ T5710] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 100.428015][ T5861] Zero length message leads to an empty skb [ 100.550258][ T5710] usb 4-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 100.551641][ T5710] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.551669][ T5710] usb 4-1: config 0 has no interface number 0 [ 100.554982][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.555010][ T5710] usb 4-1: Product: syz [ 100.555025][ T5710] usb 4-1: Manufacturer: syz [ 100.555044][ T5710] usb 4-1: SerialNumber: syz [ 100.558652][ T5710] usb 4-1: config 0 descriptor?? [ 100.668863][ T27] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 100.679135][ T5695] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 100.817246][ T5710] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 100.824796][ T27] usb 2-1: Using ep0 maxpacket: 32 [ 100.826952][ T27] usb 2-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 100.837973][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 50, changing to 9 [ 100.838061][ T27] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1792, setting to 1024 [ 100.838185][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.839932][ T5710] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 100.840818][ T5710] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 100.840943][ T5710] usb 4-1: media controller created [ 100.856920][ T5695] usb 1-1: device descriptor read/64, error -71 [ 100.880318][ T27] usb 2-1: config 0 descriptor?? [ 100.884148][ T5857] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 100.927768][ T27] hub 2-1:0.0: USB hub found [ 100.935352][ T5710] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 101.091163][ T5695] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 101.091419][ T27] hub 2-1:0.0: 1 port detected [ 101.218856][ T5695] usb 1-1: device descriptor read/64, error -71 [ 101.224572][ T32] usb 4-1: USB disconnect, device number 3 [ 101.330595][ T5695] usb usb1-port1: attempt power cycle [ 101.409087][ T5710] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 101.509551][ T27] usb 2-1: USB disconnect, device number 2 [ 101.562963][ T5710] usb 3-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 101.564009][ T5710] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.566094][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 101.566120][ T5710] usb 3-1: Product: syz [ 101.566135][ T5710] usb 3-1: Manufacturer: syz [ 101.566149][ T5710] usb 3-1: SerialNumber: syz [ 101.668887][ T5695] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 101.689550][ T5695] usb 1-1: device descriptor read/8, error -71 [ 101.718921][ T5617] Bluetooth: hci0: command 0x0401 tx timeout [ 101.793365][ T5710] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 101.819865][ T5867] FAULT_INJECTION: forcing a failure. [ 101.819865][ T5867] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 101.819897][ T5867] CPU: 0 UID: 0 PID: 5867 Comm: syz.3.41 Not tainted syzkaller #0 PREEMPT(full) [ 101.819922][ T5867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 101.819935][ T5867] Call Trace: [ 101.819943][ T5867] [ 101.819953][ T5867] dump_stack_lvl+0xe8/0x150 [ 101.819991][ T5867] should_fail_ex+0x3eb/0x540 [ 101.820019][ T5867] prepare_alloc_pages+0x21e/0x5f0 [ 101.820069][ T5867] __alloc_frozen_pages_noprof+0x17a/0x400 [ 101.820097][ T5867] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.820119][ T5867] ? __alloc_frozen_pages_noprof+0x24a/0x400 [ 101.820144][ T5867] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.820178][ T5867] __alloc_pages_noprof+0x10/0x100 [ 101.820203][ T5867] alloc_pages_bulk_noprof+0x668/0x890 [ 101.820234][ T5867] ? alloc_pages_noprof+0x140/0x2b0 [ 101.820262][ T5867] __kasan_populate_vmalloc+0xb7/0x1c0 [ 101.820292][ T5867] alloc_vmap_area+0xd10/0x1410 [ 101.820330][ T5867] ? __pfx_alloc_vmap_area+0x10/0x10 [ 101.820350][ T5867] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 101.820373][ T5867] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 101.820394][ T5867] ? __get_vm_area_node+0x155/0x2f0 [ 101.820421][ T5867] __get_vm_area_node+0x200/0x2f0 [ 101.820452][ T5867] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 101.820475][ T5867] ? vb2_vmalloc_alloc+0xef/0x360 [ 101.820532][ T5867] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 101.820556][ T5867] ? __kasan_kmalloc+0x93/0xb0 [ 101.820579][ T5867] ? __kmalloc_cache_noprof+0x31c/0x600 [ 101.820606][ T5867] vmalloc_user_noprof+0xad/0xe0 [ 101.820628][ T5867] ? vb2_vmalloc_alloc+0xef/0x360 [ 101.820649][ T5867] vb2_vmalloc_alloc+0xef/0x360 [ 101.820670][ T5867] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 101.820693][ T5867] __vb2_queue_alloc+0xa0b/0x1660 [ 101.820740][ T5867] vb2_core_reqbufs+0xc3f/0x1470 [ 101.820779][ T5867] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 101.820807][ T5867] ? __video_do_ioctl+0x473/0xc70 [ 101.820830][ T5867] ? vb2_verify_memory_type+0x1fc/0x570 [ 101.820855][ T5867] vb2_ioctl_reqbufs+0x4bb/0x850 [ 101.820911][ T5867] __video_do_ioctl+0x8af/0xc70 [ 101.820949][ T5867] ? __pfx___video_do_ioctl+0x10/0x10 [ 101.820973][ T5867] ? __might_fault+0xaf/0x130 [ 101.821001][ T5867] video_usercopy+0x860/0x1430 [ 101.821030][ T5867] ? __pfx___video_do_ioctl+0x10/0x10 [ 101.821053][ T5867] ? __pfx_video_usercopy+0x10/0x10 [ 101.821098][ T5867] ? __fget_files+0x2a/0x420 [ 101.821119][ T5867] ? __fget_files+0x2a/0x420 [ 101.821149][ T5867] v4l2_ioctl+0x18d/0x1e0 [ 101.821172][ T5867] ? __pfx_v4l2_ioctl+0x10/0x10 [ 101.821193][ T5867] __se_sys_ioctl+0xfc/0x170 [ 101.821217][ T5867] do_syscall_64+0x166/0x520 [ 101.821236][ T5867] ? trace_irq_disable+0x3b/0x140 [ 101.821255][ T5867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.821277][ T5867] ? clear_bhb_loop+0x70/0xc0 [ 101.821299][ T5867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.821320][ T5867] RIP: 0033:0x7f71c739e199 [ 101.821340][ T5867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.821357][ T5867] RSP: 002b:00007f71c81d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.821379][ T5867] RAX: ffffffffffffffda RBX: 00007f71c7625fa0 RCX: 00007f71c739e199 [ 101.821395][ T5867] RDX: 00002000000007c0 RSI: 00000000c0145608 RDI: 0000000000000004 [ 101.821409][ T5867] RBP: 00007f71c81d7090 R08: 0000000000000000 R09: 0000000000000000 [ 101.821423][ T5867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 101.821435][ T5867] R13: 00007f71c7626038 R14: 00007f71c7625fa0 R15: 00007fffbc68dac8 [ 101.821470][ T5867] [ 101.821903][ T5867] syz.3.41: vmalloc error: size 831488, align 0x1000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 101.822092][ T5867] CPU: 0 UID: 0 PID: 5867 Comm: syz.3.41 Not tainted syzkaller #0 PREEMPT(full) [ 101.822117][ T5867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 101.822129][ T5867] Call Trace: [ 101.822137][ T5867] [ 101.822146][ T5867] dump_stack_lvl+0xe8/0x150 [ 101.822172][ T5867] warn_alloc+0x24d/0x270 [ 101.822195][ T5867] ? lockdep_hardirqs_on+0x7b/0x110 [ 101.822221][ T5867] ? __pfx_warn_alloc+0x10/0x10 [ 101.822241][ T5867] ? kfree+0x1c5/0x650 [ 101.822268][ T5867] ? __get_vm_area_node+0x219/0x2f0 [ 101.822299][ T5867] __vmalloc_node_range_noprof+0x396/0x16f0 [ 101.822359][ T5867] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 101.822383][ T5867] ? __kasan_kmalloc+0x93/0xb0 [ 101.822414][ T5867] ? __kmalloc_cache_noprof+0x31c/0x600 [ 101.822441][ T5867] vmalloc_user_noprof+0xad/0xe0 [ 101.822463][ T5867] ? vb2_vmalloc_alloc+0xef/0x360 [ 101.822486][ T5867] vb2_vmalloc_alloc+0xef/0x360 [ 101.822508][ T5867] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 101.822530][ T5867] __vb2_queue_alloc+0xa0b/0x1660 [ 101.822576][ T5867] vb2_core_reqbufs+0xc3f/0x1470 [ 101.822614][ T5867] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 101.822641][ T5867] ? __video_do_ioctl+0x473/0xc70 [ 101.822664][ T5867] ? vb2_verify_memory_type+0x1fc/0x570 [ 101.822689][ T5867] vb2_ioctl_reqbufs+0x4bb/0x850 [ 101.822727][ T5867] __video_do_ioctl+0x8af/0xc70 [ 101.822759][ T5867] ? __pfx___video_do_ioctl+0x10/0x10 [ 101.822785][ T5867] ? __might_fault+0xaf/0x130 [ 101.822814][ T5867] video_usercopy+0x860/0x1430 [ 101.822843][ T5867] ? __pfx___video_do_ioctl+0x10/0x10 [ 101.822867][ T5867] ? __pfx_video_usercopy+0x10/0x10 [ 101.822905][ T5867] ? __fget_files+0x2a/0x420 [ 101.822927][ T5867] ? __fget_files+0x2a/0x420 [ 101.822959][ T5867] v4l2_ioctl+0x18d/0x1e0 [ 101.822981][ T5867] ? __pfx_v4l2_ioctl+0x10/0x10 [ 101.823002][ T5867] __se_sys_ioctl+0xfc/0x170 [ 101.823029][ T5867] do_syscall_64+0x166/0x520 [ 101.823049][ T5867] ? trace_irq_disable+0x3b/0x140 [ 101.823076][ T5867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.823099][ T5867] ? clear_bhb_loop+0x70/0xc0 [ 101.823123][ T5867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.823145][ T5867] RIP: 0033:0x7f71c739e199 [ 101.823165][ T5867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.823183][ T5867] RSP: 002b:00007f71c81d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.823205][ T5867] RAX: ffffffffffffffda RBX: 00007f71c7625fa0 RCX: 00007f71c739e199 [ 101.823228][ T5867] RDX: 00002000000007c0 RSI: 00000000c0145608 RDI: 0000000000000004 [ 101.823242][ T5867] RBP: 00007f71c81d7090 R08: 0000000000000000 R09: 0000000000000000 [ 101.823255][ T5867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 101.823267][ T5867] R13: 00007f71c7626038 R14: 00007f71c7625fa0 R15: 00007fffbc68dac8 [ 101.823300][ T5867] [ 101.823353][ T5867] Mem-Info: [ 101.823367][ T5867] active_anon:5424 inactive_anon:0 isolated_anon:0 [ 101.823367][ T5867] active_file:0 inactive_file:42907 isolated_file:0 [ 101.823367][ T5867] unevictable:0 dirty:1902 writeback:0 [ 101.823367][ T5867] slab_reclaimable:10265 slab_unreclaimable:89200 [ 101.823367][ T5867] mapped:24656 shmem:523 pagetables:1082 [ 101.823367][ T5867] sec_pagetables:0 bounce:0 [ 101.823367][ T5867] kernel_misc_reclaimable:0 [ 101.823367][ T5867] free:1348148 free_pcp:11297 free_cma:0 [ 101.823424][ T5867] Node 0 active_anon:21696kB inactive_anon:0kB active_file:0kB inactive_file:171420kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:98624kB dirty:7588kB writeback:0kB shmem:2092kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11360kB pagetables:4212kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.823482][ T5867] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:20kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 101.823539][ T5867] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 101.823605][ T5867] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 101.823644][ T5867] Node 0 DMA32 free:1436868kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0kB free_highatomic:0kB active_anon:21696kB inactive_anon:0kB active_file:0kB inactive_file:171420kB unevictable:0kB writepending:7588kB zspages:0kB present:3129332kB managed:2541360kB mlocked:0kB bounce:0kB free_pcp:45184kB local_pcp:24760kB free_cma:0kB [ 101.823707][ T5867] lowmem_reserve[]: 0 0 1 1 1 [ 101.823743][ T5867] Node 0 Normal free:0kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1412kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 101.823803][ T5867] lowmem_reserve[]: 0 0 0 0 0 [ 101.823839][ T5867] Node 1 Normal free:3940364kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:20kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 101.823900][ T5867] lowmem_reserve[]: 0 0 0 0 0 [ 101.823937][ T5867] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 101.824092][ T5867] Node 0 DMA32: 557*4kB (UM) 336*8kB (UME) 85*16kB (UM) 13*32kB (M) 16*64kB (UM) 15*128kB (UME) 13*256kB (UME) 13*512kB (UME) 6*1024kB (UM) 5*2048kB (UME) 342*4096kB (M) = 1436836kB [ 101.824276][ T5867] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 101.824385][ T5867] Node 1 Normal: 3*4kB (UM) 6*8kB (UM) 9*16kB (UM) 4*32kB (UM) 11*64kB (UM) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 960*4096kB (M) = 3940364kB [ 101.824566][ T5867] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.824585][ T5867] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.824602][ T5867] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 101.824619][ T5867] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 101.824636][ T5867] 43426 total pagecache pages [ 101.824649][ T5867] 0 pages in swap cache [ 101.824657][ T5867] Free swap = 124996kB [ 101.824665][ T5867] Total swap = 124996kB [ 101.824674][ T5867] 2097051 pages RAM [ 101.824682][ T5867] 0 pages HighMem/MovableOnly [ 101.824689][ T5867] 429742 pages reserved [ 101.824697][ T5867] 0 pages cma reserved [ 101.988652][ T5695] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 102.083894][ T5710] usb 3-1: USB disconnect, device number 3 [ 102.094121][ T5695] usb 1-1: device descriptor read/8, error -71 [ 102.229982][ T5695] usb usb1-port1: unable to enumerate USB device [ 102.351361][ T5710] usblp0: removed [ 103.133546][ T5617] Bluetooth: hci1: unexpected cc 0x1001 length: 10 > 9 [ 103.559151][ T27] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 103.710032][ T27] usb 3-1: Using ep0 maxpacket: 16 [ 103.713162][ T27] usb 3-1: unable to get BOS descriptor or descriptor too short [ 103.713230][ T27] usb 3-1: New USB device found: idVendor=0db0, idProduct=5580, bcdDevice=23.89 [ 103.716094][ T27] usb 3-1: config 14 has an invalid interface number: 157 but max is 0 [ 103.716124][ T27] usb 3-1: config 14 has no interface number 0 [ 103.716155][ T27] usb 3-1: config 14 interface 157 has no altsetting 0 [ 103.733836][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.733933][ T27] usb 3-1: Product: syz [ 103.734002][ T27] usb 3-1: Manufacturer: syz [ 103.734051][ T27] usb 3-1: SerialNumber: syz [ 104.040645][ T27] usb 3-1: USB disconnect, device number 4 [ 104.573775][ T5896] workqueue: work func _RNvXs8_NtCsbuTvttuFvbr_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCswPamI0U300_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ enqueued on deprecated workqueue. Use system_{percpu|dfl}_wq instead. [ 104.617377][ T5897] syz.2.51 (5897) used greatest stack depth: 16904 bytes left [ 104.728899][ T5695] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 104.881963][ T5695] usb 1-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 104.883444][ T5695] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 104.883474][ T5695] usb 1-1: config 0 has no interface number 0 [ 104.886246][ T5695] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.886274][ T5695] usb 1-1: Product: syz [ 104.886290][ T5695] usb 1-1: Manufacturer: syz [ 104.886305][ T5695] usb 1-1: SerialNumber: syz [ 104.937792][ T5776] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 104.938276][ T5695] usb 1-1: config 0 descriptor?? [ 105.005315][ T5903] FAULT_INJECTION: forcing a failure. [ 105.005315][ T5903] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 105.005342][ T5903] CPU: 0 UID: 0 PID: 5903 Comm: syz.3.54 Not tainted syzkaller #0 PREEMPT(full) [ 105.005368][ T5903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 105.005380][ T5903] Call Trace: [ 105.005386][ T5903] [ 105.005394][ T5903] dump_stack_lvl+0xe8/0x150 [ 105.005418][ T5903] should_fail_ex+0x3eb/0x540 [ 105.005440][ T5903] prepare_alloc_pages+0x21e/0x5f0 [ 105.005464][ T5903] __alloc_frozen_pages_noprof+0x17a/0x400 [ 105.005485][ T5903] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 105.005503][ T5903] ? __alloc_frozen_pages_noprof+0x24a/0x400 [ 105.005524][ T5903] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 105.005551][ T5903] __alloc_pages_noprof+0x10/0x100 [ 105.005569][ T5903] alloc_pages_bulk_noprof+0x668/0x890 [ 105.005595][ T5903] ? alloc_pages_noprof+0x140/0x2b0 [ 105.005617][ T5903] __kasan_populate_vmalloc+0xb7/0x1c0 [ 105.005641][ T5903] alloc_vmap_area+0xd10/0x1410 [ 105.005672][ T5903] ? __pfx_alloc_vmap_area+0x10/0x10 [ 105.005687][ T5903] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 105.005706][ T5903] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 105.005748][ T5903] ? __get_vm_area_node+0x155/0x2f0 [ 105.005780][ T5903] __get_vm_area_node+0x200/0x2f0 [ 105.005816][ T5903] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 105.005843][ T5903] ? vb2_vmalloc_alloc+0xef/0x360 [ 105.005912][ T5903] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 105.005931][ T5903] ? __kasan_kmalloc+0x93/0xb0 [ 105.005949][ T5903] ? __kmalloc_cache_noprof+0x31c/0x600 [ 105.005970][ T5903] vmalloc_user_noprof+0xad/0xe0 [ 105.005988][ T5903] ? vb2_vmalloc_alloc+0xef/0x360 [ 105.006006][ T5903] vb2_vmalloc_alloc+0xef/0x360 [ 105.006023][ T5903] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 105.006042][ T5903] __vb2_queue_alloc+0xa0b/0x1660 [ 105.006081][ T5903] vb2_core_reqbufs+0xc3f/0x1470 [ 105.006112][ T5903] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 105.006134][ T5903] ? __video_do_ioctl+0x473/0xc70 [ 105.006154][ T5903] ? vb2_verify_memory_type+0x1fc/0x570 [ 105.006174][ T5903] vb2_ioctl_reqbufs+0x4bb/0x850 [ 105.006208][ T5903] __video_do_ioctl+0x8af/0xc70 [ 105.006233][ T5903] ? __pfx___video_do_ioctl+0x10/0x10 [ 105.006256][ T5903] ? __might_fault+0xaf/0x130 [ 105.006282][ T5903] video_usercopy+0x860/0x1430 [ 105.006311][ T5903] ? __pfx___video_do_ioctl+0x10/0x10 [ 105.006331][ T5903] ? __pfx_video_usercopy+0x10/0x10 [ 105.006364][ T5903] ? __fget_files+0x2a/0x420 [ 105.006383][ T5903] ? __fget_files+0x2a/0x420 [ 105.006403][ T5903] v4l2_ioctl+0x18d/0x1e0 [ 105.006421][ T5903] ? __pfx_v4l2_ioctl+0x10/0x10 [ 105.006439][ T5903] __se_sys_ioctl+0xfc/0x170 [ 105.006458][ T5903] do_syscall_64+0x166/0x520 [ 105.006476][ T5903] ? trace_irq_disable+0x3b/0x140 [ 105.006492][ T5903] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.006511][ T5903] ? clear_bhb_loop+0x70/0xc0 [ 105.006530][ T5903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.006548][ T5903] RIP: 0033:0x7f71c739e199 [ 105.006565][ T5903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.006580][ T5903] RSP: 002b:00007f71c81d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 105.006599][ T5903] RAX: ffffffffffffffda RBX: 00007f71c7625fa0 RCX: 00007f71c739e199 [ 105.006612][ T5903] RDX: 00002000000007c0 RSI: 00000000c0145608 RDI: 0000000000000004 [ 105.006623][ T5903] RBP: 00007f71c74358e0 R08: 0000000000000000 R09: 0000000000000000 [ 105.006634][ T5903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.006645][ T5903] R13: 00007f71c7626038 R14: 00007f71c7625fa0 R15: 00007fffbc68dac8 [ 105.006672][ T5903] [ 105.222042][ T5871] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 105.235837][ T5776] usb 3-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 105.293721][ T5776] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.294078][ T5695] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 105.434484][ T5776] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 105.434517][ T5776] usb 3-1: Product: syz [ 105.434533][ T5776] usb 3-1: Manufacturer: syz [ 105.434548][ T5776] usb 3-1: SerialNumber: syz [ 105.473440][ T5695] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 105.473746][ T5695] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 105.473799][ T5695] usb 1-1: media controller created [ 105.515267][ T5695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 105.682427][ T5776] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 105.708921][ T27] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 105.763955][ T5776] usb 1-1: USB disconnect, device number 8 [ 105.858855][ T27] usb 4-1: Using ep0 maxpacket: 16 [ 105.859739][ T27] usb 4-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 105.861082][ T27] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.861116][ T27] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 105.861160][ T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.868132][ T27] usb 4-1: config 0 descriptor?? [ 105.939190][ T5710] usb 3-1: USB disconnect, device number 5 [ 105.963951][ T5710] usblp0: removed [ 106.288634][ T27] microsoft 0003:045E:07DA.0001: ignoring exceeding usage max [ 106.303231][ T27] HID 045e:07da: Invalid code 65791 type 1 [ 106.326506][ T27] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0001/input/input6 [ 106.392396][ T27] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 106.575125][ T5915] dvmrp31: entered allmulticast mode [ 107.115450][ T32] usb 4-1: USB disconnect, device number 4 [ 107.159305][ T5710] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 107.309950][ T5710] usb 2-1: New USB device found: idVendor=1e7d, idProduct=30d4, bcdDevice=0.01 [ 107.311740][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.311765][ T5710] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.311793][ T5710] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.327064][ T5710] usb 2-1: config 0 descriptor?? [ 107.749832][ T5710] arvo 0003:1E7D:30D4.0002: unknown main item tag 0x4 [ 107.749869][ T5710] arvo 0003:1E7D:30D4.0002: item fetching failed at offset 5/7 [ 107.750554][ T5710] arvo 0003:1E7D:30D4.0002: parse failed [ 107.750636][ T5710] arvo 0003:1E7D:30D4.0002: probe with driver arvo failed with error -22 [ 107.948542][ T194] usb 2-1: USB disconnect, device number 3 [ 107.990211][ T5695] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 108.028905][ T5710] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 108.151912][ T5695] usb 4-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 108.153132][ T5695] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 108.155851][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 108.155879][ T5695] usb 4-1: Product: syz [ 108.155895][ T5695] usb 4-1: Manufacturer: syz [ 108.155911][ T5695] usb 4-1: SerialNumber: syz [ 108.183126][ T5710] usb 1-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 108.203454][ T5710] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 108.203529][ T5710] usb 1-1: config 0 has no interface number 0 [ 108.238826][ T5710] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.238856][ T5710] usb 1-1: Product: syz [ 108.238871][ T5710] usb 1-1: Manufacturer: syz [ 108.238886][ T5710] usb 1-1: SerialNumber: syz [ 108.247627][ T5710] usb 1-1: config 0 descriptor?? [ 108.391420][ T5695] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 108.471615][ T5710] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 108.475799][ T5710] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 108.476115][ T5710] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 108.476162][ T5710] usb 1-1: media controller created [ 108.528573][ T5710] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 108.591156][ T5695] usb 4-1: USB disconnect, device number 5 [ 108.615562][ T5695] usblp0: removed [ 108.878333][ T5710] usb 1-1: USB disconnect, device number 9 [ 109.329447][ T5952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.73'. [ 109.329473][ T5952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.73'. [ 109.485635][ T5952] MTRR 1 not used [ 109.902644][ T5971] FAULT_INJECTION: forcing a failure. [ 109.902644][ T5971] name failslab, interval 1, probability 0, space 0, times 0 [ 109.902681][ T5971] CPU: 0 UID: 0 PID: 5971 Comm: syz.3.79 Not tainted syzkaller #0 PREEMPT(full) [ 109.902708][ T5971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 109.902723][ T5971] Call Trace: [ 109.902732][ T5971] [ 109.902742][ T5971] dump_stack_lvl+0xe8/0x150 [ 109.902774][ T5971] should_fail_ex+0x3eb/0x540 [ 109.902805][ T5971] should_failslab+0xa8/0x100 [ 109.902832][ T5971] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 109.902862][ T5971] ? __kasan_kmalloc+0x93/0xb0 [ 109.902886][ T5971] ? snd_timer_instance_new+0x6a/0x260 [ 109.902909][ T5971] ? snd_timer_instance_new+0x6a/0x260 [ 109.902934][ T5971] ? __kmalloc_cache_noprof+0x148/0x600 [ 109.902962][ T5971] kstrdup+0x42/0x100 [ 109.902986][ T5971] snd_timer_instance_new+0x6a/0x260 [ 109.903012][ T5971] snd_seq_timer_open+0x23e/0x620 [ 109.903044][ T5971] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 109.903083][ T5971] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 109.903114][ T5971] snd_seq_queue_alloc+0x3ba/0x740 [ 109.903146][ T5971] snd_seq_ioctl_create_queue+0x7f/0x3c0 [ 109.903174][ T5971] snd_seq_oss_open+0x657/0xf40 [ 109.903206][ T5971] ? __pfx_snd_seq_oss_open+0x10/0x10 [ 109.903239][ T5971] ? finish_task_switch+0x40e/0xc60 [ 109.903264][ T5971] ? lockdep_hardirqs_on+0x7b/0x110 [ 109.903290][ T5971] ? rcu_is_watching+0x16/0xb0 [ 109.903329][ T5971] ? rcu_is_watching+0x16/0xb0 [ 109.903354][ T5971] ? trace_contention_end+0x3d/0x140 [ 109.903399][ T5971] ? __pfx___mutex_lock+0x10/0x10 [ 109.903428][ T5971] ? __pfx_snd_seq_oss_event_input+0x10/0x10 [ 109.903451][ T5971] ? __pfx_free_devinfo+0x10/0x10 [ 109.903472][ T5971] ? do_raw_spin_unlock+0xf5/0x200 [ 109.903510][ T5971] ? soundcore_open+0x2da/0x490 [ 109.903537][ T5971] odev_open+0x67/0xa0 [ 109.903559][ T5971] chrdev_open+0x4d9/0x600 [ 109.903587][ T5971] ? __pfx_chrdev_open+0x10/0x10 [ 109.903612][ T5971] ? devcgroup_check_permission+0x31/0x8f0 [ 109.903644][ T5971] ? __pfx_chrdev_open+0x10/0x10 [ 109.903666][ T5971] do_dentry_open+0x80e/0x1360 [ 109.903702][ T5971] vfs_open_consume+0x4a/0x350 [ 109.903723][ T5971] ? path_openat+0x148a/0x1da0 [ 109.903750][ T5971] path_openat+0x14a6/0x1da0 [ 109.903794][ T5971] do_file_open+0x23e/0x4a0 [ 109.903824][ T5971] ? __pfx_do_file_open+0x10/0x10 [ 109.903871][ T5971] ? _raw_spin_unlock+0x28/0x50 [ 109.903893][ T5971] ? alloc_fd+0x6af/0x760 [ 109.903927][ T5971] do_sys_openat2+0x115/0x200 [ 109.903950][ T5971] ? __se_sys_futex+0x3a8/0x450 [ 109.903973][ T5971] ? __pfx_do_sys_openat2+0x10/0x10 [ 109.904001][ T5971] ? rcu_is_watching+0x16/0xb0 [ 109.904030][ T5971] __x64_sys_openat+0x138/0x170 [ 109.904059][ T5971] do_syscall_64+0x166/0x520 [ 109.904082][ T5971] ? trace_irq_disable+0x3b/0x140 [ 109.904103][ T5971] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.904129][ T5971] ? clear_bhb_loop+0x70/0xc0 [ 109.904155][ T5971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.904179][ T5971] RIP: 0033:0x7f71c739e199 [ 109.904202][ T5971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.904221][ T5971] RSP: 002b:00007f71c81d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 109.904246][ T5971] RAX: ffffffffffffffda RBX: 00007f71c7625fa0 RCX: 00007f71c739e199 [ 109.904265][ T5971] RDX: 0000000002000000 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 109.904281][ T5971] RBP: 00007f71c74358e0 R08: 0000000000000000 R09: 0000000000000000 [ 109.904296][ T5971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.904310][ T5971] R13: 00007f71c7626038 R14: 00007f71c7625fa0 R15: 00007fffbc68dac8 [ 109.904347][ T5971] [ 110.213671][ T194] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 110.389452][ T194] usb 2-1: New USB device found: idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 110.390485][ T194] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 110.390509][ T194] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 110.390528][ T194] usb 2-1: config 0 has no interface number 0 [ 110.390565][ T194] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 110.390586][ T194] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 110.390604][ T194] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 110.393044][ T194] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.393076][ T194] usb 2-1: Product: syz [ 110.393091][ T194] usb 2-1: Manufacturer: syz [ 110.393106][ T194] usb 2-1: SerialNumber: syz [ 110.398049][ T194] usb 2-1: config 0 descriptor?? [ 110.628895][ T27] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 110.648868][ T5695] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 110.781397][ T27] usb 3-1: unable to get BOS descriptor or descriptor too short [ 110.781927][ T27] usb 3-1: not running at top speed; connect to a high speed hub [ 110.781962][ T27] usb 3-1: New USB device found: idVendor=0e41, idProduct=4249, bcdDevice=0.40 [ 110.783009][ T27] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 110.783048][ T27] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 111, changing to 4 [ 110.786035][ T27] usb 3-1: string descriptor 0 read error: -22 [ 110.786176][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.836922][ T27] usb 3-1: 1:1 : bogus bTerminalLink 9 [ 110.853639][ T5695] usb 4-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 110.872340][ T5695] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.894758][ T5695] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 110.894786][ T5695] usb 4-1: Product: syz [ 110.894798][ T5695] usb 4-1: Manufacturer: syz [ 110.894810][ T5695] usb 4-1: SerialNumber: syz [ 110.991081][ T5969] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 111.085754][ T27] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 111.089525][ T5710] usb 2-1: USB disconnect, device number 4 [ 111.135244][ T5695] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 6 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 111.245289][ T27] usb 3-1: USB disconnect, device number 6 [ 111.337842][ T5695] usb 4-1: USB disconnect, device number 6 [ 111.353982][ T5695] usblp0: removed [ 111.941506][ T5988] FAULT_INJECTION: forcing a failure. [ 111.941506][ T5988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 111.941537][ T5988] CPU: 0 UID: 0 PID: 5988 Comm: syz.2.86 Not tainted syzkaller #0 PREEMPT(full) [ 111.941562][ T5988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 111.941575][ T5988] Call Trace: [ 111.941584][ T5988] [ 111.941593][ T5988] dump_stack_lvl+0xe8/0x150 [ 111.941623][ T5988] should_fail_ex+0x3eb/0x540 [ 111.941652][ T5988] _copy_to_user+0x31/0xb0 [ 111.941676][ T5988] simple_read_from_buffer+0xe1/0x170 [ 111.941704][ T5988] proc_fail_nth_read+0x1bb/0x230 [ 111.941731][ T5988] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 111.941757][ T5988] ? rw_verify_area+0x24a/0x4c0 [ 111.941782][ T5988] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 111.941820][ T5988] vfs_read+0x213/0xa80 [ 111.941846][ T5988] ? __pfx___mutex_lock+0x10/0x10 [ 111.941870][ T5988] ? __pfx_vfs_read+0x10/0x10 [ 111.941892][ T5988] ? __fget_files+0x2a/0x420 [ 111.941911][ T5988] ? __fget_files+0x3a2/0x420 [ 111.941929][ T5988] ? __fget_files+0x2a/0x420 [ 111.941952][ T5988] ? fdget+0x1ac/0x250 [ 111.941978][ T5988] ksys_read+0x150/0x270 [ 111.942001][ T5988] ? __pfx_ksys_read+0x10/0x10 [ 111.942039][ T5988] do_syscall_64+0x166/0x520 [ 111.942060][ T5988] ? trace_irq_disable+0x3b/0x140 [ 111.942080][ T5988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.942104][ T5988] ? clear_bhb_loop+0x70/0xc0 [ 111.942128][ T5988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.942151][ T5988] RIP: 0033:0x7fc33f35e9ce [ 111.942171][ T5988] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 111.942189][ T5988] RSP: 002b:00007fc3402cafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 111.942212][ T5988] RAX: ffffffffffffffda RBX: 00007fc3402cb6c0 RCX: 00007fc33f35e9ce [ 111.942228][ T5988] RDX: 000000000000000f RSI: 00007fc3402cb0a0 RDI: 0000000000000006 [ 111.942242][ T5988] RBP: 00007fc3402cb090 R08: 0000000000000000 R09: 0000000000000000 [ 111.942255][ T5988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.942268][ T5988] R13: 00007fc33f626038 R14: 00007fc33f625fa0 R15: 00007fff0c863038 [ 111.942303][ T5988] [ 111.962488][ T27] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 112.173892][ T27] usb 2-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 112.203672][ T27] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 112.203700][ T27] usb 2-1: config 0 has no interface number 0 [ 112.229899][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.229933][ T27] usb 2-1: Product: syz [ 112.229950][ T27] usb 2-1: Manufacturer: syz [ 112.229964][ T27] usb 2-1: SerialNumber: syz [ 112.237651][ T27] usb 2-1: config 0 descriptor?? [ 112.299810][ T5994] FAULT_INJECTION: forcing a failure. [ 112.299810][ T5994] name failslab, interval 1, probability 0, space 0, times 0 [ 112.299899][ T5994] CPU: 1 UID: 0 PID: 5994 Comm: syz.3.88 Not tainted syzkaller #0 PREEMPT(full) [ 112.299934][ T5994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 112.299949][ T5994] Call Trace: [ 112.299960][ T5994] [ 112.299970][ T5994] dump_stack_lvl+0xe8/0x150 [ 112.300018][ T5994] should_fail_ex+0x3eb/0x540 [ 112.300051][ T5994] should_failslab+0xa8/0x100 [ 112.300079][ T5994] __kmalloc_cache_noprof+0x9e/0x600 [ 112.300106][ T5994] ? process_preds+0xd7e/0x4d60 [ 112.300128][ T5994] ? process_preds+0xd7e/0x4d60 [ 112.300161][ T5994] process_preds+0xd7e/0x4d60 [ 112.300220][ T5994] ? __pfx_process_preds+0x10/0x10 [ 112.300250][ T5994] ? __kasan_kmalloc+0x93/0xb0 [ 112.300279][ T5994] ? __kmalloc_cache_noprof+0x148/0x600 [ 112.300302][ T5994] ? create_filter_start+0x144/0x1e0 [ 112.300324][ T5994] ? create_filter_start+0x144/0x1e0 [ 112.300357][ T5994] ? create_filter_start+0x15c/0x1e0 [ 112.300386][ T5994] create_filter+0xcc/0x180 [ 112.300417][ T5994] apply_event_filter+0x154/0x510 [ 112.300451][ T5994] event_filter_write+0x16f/0x220 [ 112.300478][ T5994] ? __pfx_event_filter_write+0x10/0x10 [ 112.300503][ T5994] vfs_write+0x296/0xba0 [ 112.300539][ T5994] ? __pfx_vfs_write+0x10/0x10 [ 112.300567][ T5994] ? __fget_files+0x2a/0x420 [ 112.300589][ T5994] ? __fget_files+0x3a2/0x420 [ 112.300611][ T5994] ? __fget_files+0x2a/0x420 [ 112.300640][ T5994] ? fdget+0x1ac/0x250 [ 112.300672][ T5994] ksys_write+0x150/0x270 [ 112.300700][ T5994] ? __pfx_ksys_write+0x10/0x10 [ 112.300739][ T5994] do_syscall_64+0x166/0x520 [ 112.300763][ T5994] ? trace_irq_disable+0x3b/0x140 [ 112.300785][ T5994] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.300812][ T5994] ? clear_bhb_loop+0x70/0xc0 [ 112.300840][ T5994] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.300874][ T5994] RIP: 0033:0x7f71c739e199 [ 112.300905][ T5994] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.300927][ T5994] RSP: 002b:00007f71c81d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 112.300958][ T5994] RAX: ffffffffffffffda RBX: 00007f71c7625fa0 RCX: 00007f71c739e199 [ 112.300990][ T5994] RDX: 000000000000000a RSI: 0000200000000280 RDI: 0000000000000003 [ 112.301006][ T5994] RBP: 00007f71c74358e0 R08: 0000000000000000 R09: 0000000000000000 [ 112.301022][ T5994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.301038][ T5994] R13: 00007f71c7626038 R14: 00007f71c7625fa0 R15: 00007fffbc68dac8 [ 112.301079][ T5994] [ 112.492862][ T27] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 112.595135][ T27] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 112.595422][ T27] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 112.595464][ T27] usb 2-1: media controller created [ 112.634739][ T27] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 112.908291][ T5776] usb 2-1: USB disconnect, device number 5 [ 113.568101][ T6023] process 'syz.0.99' launched './file1' with NULL argv: empty string added [ 113.634064][ T6026] gadgetfs: bound to dummy_udc driver [ 113.708853][ T27] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 113.771339][ T6029] netlink: 'syz.0.100': attribute type 10 has an invalid length. [ 113.778618][ T6029] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.797329][ T6029] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 113.869887][ T27] usb 3-1: New USB device found: idVendor=0525, idProduct=a4a8, bcdDevice=0.41 [ 113.871243][ T27] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.873922][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 113.873954][ T27] usb 3-1: Product: syz [ 113.873969][ T27] usb 3-1: Manufacturer: syz [ 113.873983][ T27] usb 3-1: SerialNumber: syz [ 114.082138][ T27] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 7 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 114.285292][ T5776] usb 3-1: USB disconnect, device number 7 [ 114.308453][ T5776] usblp0: removed [ 114.364949][ T6039] FAULT_INJECTION: forcing a failure. [ 114.364949][ T6039] name failslab, interval 1, probability 0, space 0, times 0 [ 114.364974][ T6039] CPU: 0 UID: 0 PID: 6039 Comm: syz.3.104 Not tainted syzkaller #0 PREEMPT(full) [ 114.364997][ T6039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 114.365009][ T6039] Call Trace: [ 114.365017][ T6039] [ 114.365026][ T6039] dump_stack_lvl+0xe8/0x150 [ 114.365052][ T6039] should_fail_ex+0x3eb/0x540 [ 114.365077][ T6039] should_failslab+0xa8/0x100 [ 114.365119][ T6039] __kmalloc_noprof+0xf9/0x710 [ 114.365140][ T6039] ? trace_kmalloc+0x2a/0xf0 [ 114.365158][ T6039] ? tomoyo_encode+0x2ad/0x570 [ 114.365178][ T6039] ? tomoyo_encode+0x2ad/0x570 [ 114.365208][ T6039] tomoyo_encode+0x2ad/0x570 [ 114.365228][ T6039] tomoyo_realpath_from_path+0x5fa/0x640 [ 114.365259][ T6039] tomoyo_path_perm+0x283/0x560 [ 114.365275][ T6039] ? tomoyo_path_perm+0x251/0x560 [ 114.365291][ T6039] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 114.365341][ T6039] security_inode_getattr+0x12b/0x310 [ 114.365359][ T6039] vfs_getattr+0x23/0x70 [ 114.365375][ T6039] vfs_statx_path+0x2b/0x230 [ 114.365389][ T6039] ? vfs_statx+0x107/0x200 [ 114.365405][ T6039] vfs_statx+0x12e/0x200 [ 114.365422][ T6039] ? __pfx_vfs_statx+0x10/0x10 [ 114.365435][ T6039] ? strncpy_from_user+0x150/0x2c0 [ 114.365453][ T6039] ? do_getname+0x151/0x250 [ 114.365470][ T6039] vfs_fstatat+0x11b/0x170 [ 114.365487][ T6039] __se_sys_newfstatat+0x118/0x3a0 [ 114.365504][ T6039] ? __pfx___se_sys_newfstatat+0x10/0x10 [ 114.365522][ T6039] ? ksys_write+0x1e6/0x270 [ 114.365543][ T6039] ? __mutex_unlock_slowpath+0x731/0x900 [ 114.365561][ T6039] ? __fget_files+0x2a/0x420 [ 114.365575][ T6039] ? __fget_files+0x3a2/0x420 [ 114.365604][ T6039] ? __pfx_ksys_write+0x10/0x10 [ 114.365627][ T6039] do_syscall_64+0x166/0x520 [ 114.365641][ T6039] ? trace_irq_disable+0x3b/0x140 [ 114.365655][ T6039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.365671][ T6039] ? clear_bhb_loop+0x70/0xc0 [ 114.365687][ T6039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.365703][ T6039] RIP: 0033:0x7f71c739e199 [ 114.365735][ T6039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.365753][ T6039] RSP: 002b:00007f71c81b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 114.365776][ T6039] RAX: ffffffffffffffda RBX: 00007f71c7626090 RCX: 00007f71c739e199 [ 114.365797][ T6039] RDX: 000020000000e140 RSI: 000020000000e100 RDI: ffffffffffffff9c [ 114.365812][ T6039] RBP: 00007f71c81b6090 R08: 0000000000000000 R09: 0000000000000000 [ 114.365826][ T6039] R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000000001 [ 114.365844][ T6039] R13: 00007f71c7626128 R14: 00007f71c7626090 R15: 00007fffbc68dac8 [ 114.365868][ T6039] [ 114.365893][ T6039] ERROR: Out of memory at tomoyo_realpath_from_path. [ 114.744654][ T6043] FAULT_INJECTION: forcing a failure. [ 114.744654][ T6043] name failslab, interval 1, probability 0, space 0, times 0 [ 114.744706][ T6043] CPU: 1 UID: 0 PID: 6043 Comm: syz.0.106 Not tainted syzkaller #0 PREEMPT(full) [ 114.744731][ T6043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 114.744745][ T6043] Call Trace: [ 114.744753][ T6043] [ 114.744771][ T6043] dump_stack_lvl+0xe8/0x150 [ 114.744802][ T6043] should_fail_ex+0x3eb/0x540 [ 114.744832][ T6043] should_failslab+0xa8/0x100 [ 114.744858][ T6043] kmem_cache_alloc_lru_noprof+0xa2/0x5f0 [ 114.744885][ T6043] ? alloc_inode+0xb8/0x1b0 [ 114.744905][ T6043] ? alloc_inode+0xb8/0x1b0 [ 114.744933][ T6043] alloc_inode+0xb8/0x1b0 [ 114.744956][ T6043] new_inode+0x1f/0x170 [ 114.744983][ T6043] gadgetfs_bind+0x4ae/0xad0 [ 114.745017][ T6043] ? __pfx_gadgetfs_bind+0x10/0x10 [ 114.745040][ T6043] gadget_bind_driver+0x2ca/0x9e0 [ 114.745075][ T6043] ? __pfx_gadget_bind_driver+0x10/0x10 [ 114.745097][ T6043] really_probe+0x254/0xae0 [ 114.745125][ T6043] __driver_probe_device+0x1e8/0x360 [ 114.745151][ T6043] driver_probe_device+0x4f/0x240 [ 114.745178][ T6043] __driver_attach+0x339/0x600 [ 114.745205][ T6043] bus_for_each_dev+0x23b/0x2c0 [ 114.745228][ T6043] ? __pfx___driver_attach+0x10/0x10 [ 114.745250][ T6043] ? __pfx_bus_for_each_dev+0x10/0x10 [ 114.745277][ T6043] ? do_raw_spin_unlock+0xf5/0x200 [ 114.745304][ T6043] bus_add_driver+0x38f/0x6e0 [ 114.745338][ T6043] driver_register+0x23a/0x320 [ 114.745363][ T6043] usb_gadget_register_driver_owner+0xf9/0x270 [ 114.745393][ T6043] dev_config+0xe3c/0x12a0 [ 114.745425][ T6043] ? __pfx_dev_config+0x10/0x10 [ 114.745456][ T6043] ? __pfx_dev_config+0x10/0x10 [ 114.745478][ T6043] vfs_write+0x296/0xba0 [ 114.745513][ T6043] ? __pfx_vfs_write+0x10/0x10 [ 114.745540][ T6043] ? __fget_files+0x2a/0x420 [ 114.745560][ T6043] ? __fget_files+0x3a2/0x420 [ 114.745580][ T6043] ? __fget_files+0x2a/0x420 [ 114.745606][ T6043] ? fdget+0x1ac/0x250 [ 114.745636][ T6043] ksys_write+0x150/0x270 [ 114.745661][ T6043] ? __pfx_ksys_write+0x10/0x10 [ 114.745696][ T6043] do_syscall_64+0x166/0x520 [ 114.745717][ T6043] ? trace_irq_disable+0x3b/0x140 [ 114.745737][ T6043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.745767][ T6043] ? clear_bhb_loop+0x70/0xc0 [ 114.745793][ T6043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.745816][ T6043] RIP: 0033:0x7f7546d9e199 [ 114.745837][ T6043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.745856][ T6043] RSP: 002b:00007f7547b85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 114.745880][ T6043] RAX: ffffffffffffffda RBX: 00007f7547025fa0 RCX: 00007f7546d9e199 [ 114.745897][ T6043] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000003 [ 114.745911][ T6043] RBP: 00007f7547b85090 R08: 0000000000000000 R09: 0000000000000000 [ 114.745925][ T6043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 114.745938][ T6043] R13: 00007f7547026038 R14: 00007f7547025fa0 R15: 00007ffc277d0918 [ 114.745974][ T6043] [ 114.746080][ T6043] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 114.746123][ T6043] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 115.098095][ T6043] gadgetfs: bound to dummy_udc driver [ 115.393096][ T5695] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 115.428825][ T32] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 115.460892][ T5695] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 115.580049][ T32] usb 3-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 115.582485][ T32] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 115.582512][ T32] usb 3-1: config 0 has no interface number 0 [ 115.598295][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.598326][ T32] usb 3-1: Product: syz [ 115.598343][ T32] usb 3-1: Manufacturer: syz [ 115.598359][ T32] usb 3-1: SerialNumber: syz [ 115.624943][ T5709] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 115.660604][ T32] usb 3-1: config 0 descriptor?? [ 115.788846][ T5709] usb 1-1: Using ep0 maxpacket: 16 [ 115.791183][ T5709] usb 1-1: New USB device found: idVendor=045e, idProduct=07da, bcdDevice=0.00 [ 115.792553][ T5709] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 201, changing to 11 [ 115.792586][ T5709] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 49928, setting to 1024 [ 115.792641][ T5709] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 115.792686][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.798563][ T5709] usb 1-1: config 0 descriptor?? [ 115.884346][ T32] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 115.899643][ T32] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 115.911359][ T32] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 115.911444][ T32] usb 3-1: media controller created [ 115.944995][ T32] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 116.280514][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280569][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280596][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280631][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280659][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280687][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.280712][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.285562][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.285598][ T5709] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 116.363721][ T5776] usb 3-1: USB disconnect, device number 8 [ 116.520163][ T6060] syzkaller1: entered promiscuous mode [ 116.520182][ T6060] syzkaller1: entered allmulticast mode [ 116.685783][ T5709] microsoft 0003:045E:07DA.0004: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 116.720288][ T5776] usb 1-1: USB disconnect, device number 10 [ 116.878850][ T32] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 117.028887][ T32] usb 2-1: Using ep0 maxpacket: 8 [ 117.031376][ T32] usb 2-1: New USB device found: idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 117.035142][ T32] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 117.035243][ T32] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 117.035353][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 117.035427][ T32] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 117.035494][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 117.035562][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 117.035637][ T32] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 117.035812][ T32] usb 2-1: config 168 interface 0 has no altsetting 0 [ 117.039488][ T32] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 117.040139][ T32] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 117.040250][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 117.040325][ T32] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 117.040385][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 117.040461][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 117.040530][ T32] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 117.040593][ T32] usb 2-1: config 168 interface 0 has no altsetting 0 [ 117.045974][ T32] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 117.046073][ T32] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 117.046227][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 117.046304][ T32] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 117.046376][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 117.046444][ T32] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 117.047101][ T32] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 117.047198][ T32] usb 2-1: config 168 interface 0 has no altsetting 0 [ 117.059233][ T32] usb 2-1: string descriptor 0 read error: -22 [ 117.059744][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.136329][ T32] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 117.406833][ T32] usb 2-1: USB disconnect, device number 6 [ 117.612621][ T6076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 117.632013][ T6078] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(12) [ 117.632041][ T6078] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 117.634800][ T6078] vhci_hcd vhci_hcd.0: Device attached [ 117.702481][ T6079] vhci_hcd: connection closed [ 117.704643][ T12] vhci_hcd vhci_hcd.2: stop threads [ 117.705065][ T12] vhci_hcd vhci_hcd.2: release socket [ 117.705575][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 118.467858][ T12] Bluetooth: hci4: Frame reassembly failed (-84) [ 118.638927][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 118.789742][ T10] usb 2-1: New USB device found: idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 118.791650][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 118.791678][ T10] usb 2-1: config 0 has no interface number 0 [ 118.794622][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.794650][ T10] usb 2-1: Product: syz [ 118.794667][ T10] usb 2-1: Manufacturer: syz [ 118.794683][ T10] usb 2-1: SerialNumber: syz [ 118.808619][ T10] usb 2-1: config 0 descriptor?? [ 119.056922][ T10] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 119.068027][ T10] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 119.068306][ T10] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 119.068340][ T10] usb 2-1: media controller created [ 119.101913][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 119.203752][ T6104] FAULT_INJECTION: forcing a failure. [ 119.203752][ T6104] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 119.203777][ T6104] CPU: 1 UID: 0 PID: 6104 Comm: syz.2.126 Not tainted syzkaller #0 PREEMPT(full) [ 119.203816][ T6104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.203830][ T6104] Call Trace: [ 119.203838][ T6104] [ 119.203848][ T6104] dump_stack_lvl+0xe8/0x150 [ 119.203876][ T6104] should_fail_ex+0x3eb/0x540 [ 119.203906][ T6104] copy_folio_from_iter_atomic+0x669/0x1bc0 [ 119.203954][ T6104] ? shmem_get_folio_gfp+0x6ba/0x1330 [ 119.203987][ T6104] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 119.204023][ T6104] ? shmem_write_begin+0x1d8/0x330 [ 119.204049][ T6104] generic_perform_write+0x5c7/0x8e0 [ 119.204090][ T6104] ? __pfx_generic_perform_write+0x10/0x10 [ 119.204123][ T6104] ? down_write+0x166/0x200 [ 119.204146][ T6104] ? generic_write_checks_count+0x41a/0x520 [ 119.204174][ T6104] ? file_update_time_flags+0x2d5/0x440 [ 119.204200][ T6104] shmem_file_write_iter+0xf8/0x120 [ 119.204226][ T6104] do_iter_readv_writev+0x612/0x8c0 [ 119.204245][ T6104] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 119.204293][ T6104] vfs_writev+0x343/0x990 [ 119.204325][ T6104] ? __pfx_vfs_writev+0x10/0x10 [ 119.204372][ T6104] ? __fget_files+0x3a2/0x420 [ 119.204387][ T6104] ? __fget_files+0x2a/0x420 [ 119.204406][ T6104] ? fdget+0x1ac/0x250 [ 119.204444][ T6104] __se_sys_pwritev2+0x177/0x2a0 [ 119.204471][ T6104] ? __pfx___se_sys_pwritev2+0x10/0x10 [ 119.204499][ T6104] ? __x64_sys_pwritev2+0x20/0xc0 [ 119.204528][ T6104] do_syscall_64+0x166/0x520 [ 119.204543][ T6104] ? trace_irq_disable+0x3b/0x140 [ 119.204558][ T6104] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.204574][ T6104] ? clear_bhb_loop+0x70/0xc0 [ 119.204612][ T6104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.204635][ T6104] RIP: 0033:0x7fc33f39e199 [ 119.204655][ T6104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.204674][ T6104] RSP: 002b:00007fc3402cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 [ 119.204699][ T6104] RAX: ffffffffffffffda RBX: 00007fc33f625fa0 RCX: 00007fc33f39e199 [ 119.204710][ T6104] RDX: 000000000000001c RSI: 0000200000000500 RDI: 0000000000000004 [ 119.204720][ T6104] RBP: 00007fc33f4358e0 R08: 0000000002000000 R09: 0000000000000022 [ 119.204730][ T6104] R10: 0000000000000a00 R11: 0000000000000246 R12: 0000000000000000 [ 119.204754][ T6104] R13: 00007fc33f626038 R14: 00007fc33f625fa0 R15: 00007fff0c863038 [ 119.204791][ T6104] [ 119.541170][ T10] usb 2-1: USB disconnect, device number 7 [ 119.546418][ T6106] ================================================================== [ 119.546434][ T6106] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50 [ 119.546462][ T6106] Read of size 1 at addr ffff8880321c6018 by task syz.2.127/6106 [ 119.546476][ T6106] [ 119.546486][ T6106] CPU: 1 UID: 0 PID: 6106 Comm: syz.2.127 Not tainted syzkaller #0 PREEMPT(full) [ 119.546504][ T6106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.546515][ T6106] Call Trace: [ 119.546521][ T6106] [ 119.546529][ T6106] dump_stack_lvl+0xe8/0x150 [ 119.546549][ T6106] print_address_description+0x55/0x1e0 [ 119.546567][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 119.546583][ T6106] print_report+0x58/0x70 [ 119.546599][ T6106] kasan_report+0x117/0x150 [ 119.546618][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 119.546639][ T6106] __kasan_check_byte+0x2a/0x40 [ 119.546656][ T6106] lock_acquire+0x7d/0x350 [ 119.546674][ T6106] ? __pfx_apparmor_file_open+0x10/0x10 [ 119.546693][ T6106] ? rcu_is_watching+0x16/0xb0 [ 119.546712][ T6106] _raw_spin_lock_irq+0x3d/0x50 [ 119.546728][ T6106] ? gadget_dev_open+0x4b/0x1b0 [ 119.546746][ T6106] gadget_dev_open+0x4b/0x1b0 [ 119.546762][ T6106] ? __pfx_gadget_dev_open+0x10/0x10 [ 119.546779][ T6106] do_dentry_open+0x80e/0x1360 [ 119.546800][ T6106] vfs_open_consume+0x4a/0x350 [ 119.546816][ T6106] ? path_openat+0x148a/0x1da0 [ 119.546835][ T6106] path_openat+0x14a6/0x1da0 [ 119.546861][ T6106] do_file_open+0x23e/0x4a0 [ 119.546880][ T6106] ? __pfx_do_file_open+0x10/0x10 [ 119.546918][ T6106] ? _raw_spin_unlock+0x28/0x50 [ 119.546934][ T6106] ? alloc_fd+0x6af/0x760 [ 119.546957][ T6106] do_sys_openat2+0x115/0x200 [ 119.546976][ T6106] ? __se_sys_futex+0x3a8/0x450 [ 119.546995][ T6106] ? __pfx_do_sys_openat2+0x10/0x10 [ 119.547015][ T6106] ? rcu_is_watching+0x16/0xb0 [ 119.547040][ T6106] __x64_sys_openat+0x138/0x170 [ 119.547062][ T6106] do_syscall_64+0x166/0x520 [ 119.547081][ T6106] ? trace_irq_disable+0x3b/0x140 [ 119.547099][ T6106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.547122][ T6106] ? clear_bhb_loop+0x70/0xc0 [ 119.547140][ T6106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.547158][ T6106] RIP: 0033:0x7fc33f39e199 [ 119.547173][ T6106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.547190][ T6106] RSP: 002b:00007fc3402cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 119.547210][ T6106] RAX: ffffffffffffffda RBX: 00007fc33f625fa0 RCX: 00007fc33f39e199 [ 119.547228][ T6106] RDX: 0000000000000002 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 119.547241][ T6106] RBP: 00007fc33f4358e0 R08: 0000000000000000 R09: 0000000000000000 [ 119.547253][ T6106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.547266][ T6106] R13: 00007fc33f626038 R14: 00007fc33f625fa0 R15: 00007fff0c863038 [ 119.547287][ T6106] [ 119.547294][ T6106] [ 119.547299][ T6106] Allocated by task 5615: [ 119.547309][ T6106] kasan_save_track+0x3e/0x80 [ 119.547326][ T6106] __kasan_kmalloc+0x93/0xb0 [ 119.547342][ T6106] __kmalloc_cache_noprof+0x31c/0x600 [ 119.547359][ T6106] gadgetfs_fill_super+0x27b/0x790 [ 119.547378][ T6106] get_tree_single+0xc0/0x150 [ 119.547394][ T6106] vfs_get_tree+0x92/0x2a0 [ 119.547413][ T6106] do_new_mount+0x325/0xb00 [ 119.547431][ T6106] __se_sys_mount+0x31d/0x420 [ 119.547447][ T6106] do_syscall_64+0x166/0x520 [ 119.547465][ T6106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.547485][ T6106] [ 119.547490][ T6106] Freed by task 6042: [ 119.547499][ T6106] kasan_save_track+0x3e/0x80 [ 119.547517][ T6106] kasan_save_free_info+0x40/0x50 [ 119.547534][ T6106] __kasan_slab_free+0x5c/0x80 [ 119.547549][ T6106] kfree+0x1c5/0x650 [ 119.547564][ T6106] dev_release+0x164/0x200 [ 119.547582][ T6106] __fput+0x408/0xa40 [ 119.547597][ T6106] fput_close_sync+0x11f/0x240 [ 119.547615][ T6106] filp_close_sync+0x6e/0xa0 [ 119.547632][ T6106] __se_sys_close_range+0xa77/0xef0 [ 119.547652][ T6106] do_syscall_64+0x166/0x520 [ 119.547670][ T6106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.547691][ T6106] [ 119.547696][ T6106] The buggy address belongs to the object at ffff8880321c6000 [ 119.547696][ T6106] which belongs to the cache kmalloc-1k of size 1024 [ 119.547714][ T6106] The buggy address is located 24 bytes inside of [ 119.547714][ T6106] freed 1024-byte region [ffff8880321c6000, ffff8880321c6400) [ 119.547737][ T6106] [ 119.547743][ T6106] The buggy address belongs to the physical page: [ 119.547768][ T6106] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x321c0 [ 119.547788][ T6106] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 119.547806][ T6106] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 119.547826][ T6106] page_type: f5(slab) [ 119.547847][ T6106] raw: 00fff00000000040 ffff88813ff24dc0 dead000000000100 dead000000000122 [ 119.547866][ T6106] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 119.547887][ T6106] head: 00fff00000000040 ffff88813ff24dc0 dead000000000100 dead000000000122 [ 119.547913][ T6106] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 119.547934][ T6106] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 119.547953][ T6106] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 119.547965][ T6106] page dumped because: kasan: bad access detected [ 119.547980][ T6106] page_owner tracks the page as allocated [ 119.547989][ T6106] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 24964686521 [ 119.548023][ T6106] post_alloc_hook+0x1f9/0x250 [ 119.548043][ T6106] get_page_from_freelist+0x220f/0x2280 [ 119.548061][ T6106] __alloc_frozen_pages_noprof+0x1fc/0x400 [ 119.548081][ T6106] allocate_slab+0x7d/0x5e0 [ 119.548098][ T6106] refill_objects+0x2d5/0x350 [ 119.548116][ T6106] __pcs_replace_empty_main+0x2c8/0x6c0 [ 119.548135][ T6106] __kmalloc_noprof+0x476/0x710 [ 119.548153][ T6106] ops_init+0x1eb/0x5d0 [ 119.548171][ T6106] register_pernet_operations+0x32e/0x870 [ 119.548189][ T6106] register_pernet_device+0x2a/0x80 [ 119.548207][ T6106] xfrmi_init+0x1f/0xc0 [ 119.548225][ T6106] do_one_initcall+0x250/0x870 [ 119.548243][ T6106] do_initcall_level+0x10a/0x1a0 [ 119.548261][ T6106] do_initcalls+0x59/0xa0 [ 119.548276][ T6106] kernel_init_freeable+0x29d/0x3e0 [ 119.548296][ T6106] kernel_init+0x22/0x1d0 [ 119.548312][ T6106] page_owner free stack trace missing [ 119.548319][ T6106] [ 119.548324][ T6106] Memory state around the buggy address: [ 119.548335][ T6106] ffff8880321c5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.548351][ T6106] ffff8880321c5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 119.548366][ T6106] >ffff8880321c6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.548377][ T6106] ^ [ 119.548388][ T6106] ffff8880321c6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.548402][ T6106] ffff8880321c6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 119.548414][ T6106] ================================================================== [ 119.548434][ T6106] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 120.256013][ T6106] CPU: 1 UID: 0 PID: 6106 Comm: syz.2.127 Not tainted syzkaller #0 PREEMPT(full) [ 120.265234][ T6106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 120.275330][ T6106] Call Trace: [ 120.278653][ T6106] [ 120.281612][ T6106] vpanic+0x26f/0x710 [ 120.285625][ T6106] panic+0xc5/0xd0 [ 120.289418][ T6106] ? __pfx_panic+0x10/0x10 [ 120.293863][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.298909][ T6106] ? rcu_is_watching+0x16/0xb0 [ 120.303704][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.308759][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.313845][ T6106] check_panic_on_warn+0x89/0xb0 [ 120.318842][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.323929][ T6106] end_report+0x73/0x170 [ 120.328225][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.333287][ T6106] kasan_report+0x128/0x150 [ 120.337835][ T6106] ? _raw_spin_lock_irq+0x3d/0x50 [ 120.342984][ T6106] __kasan_check_byte+0x2a/0x40 [ 120.347869][ T6106] lock_acquire+0x7d/0x350 [ 120.352325][ T6106] ? __pfx_apparmor_file_open+0x10/0x10 [ 120.358012][ T6106] ? rcu_is_watching+0x16/0xb0 [ 120.362808][ T6106] _raw_spin_lock_irq+0x3d/0x50 [ 120.367774][ T6106] ? gadget_dev_open+0x4b/0x1b0 [ 120.372656][ T6106] gadget_dev_open+0x4b/0x1b0 [ 120.377359][ T6106] ? __pfx_gadget_dev_open+0x10/0x10 [ 120.382672][ T6106] do_dentry_open+0x80e/0x1360 [ 120.387575][ T6106] vfs_open_consume+0x4a/0x350 [ 120.392379][ T6106] ? path_openat+0x148a/0x1da0 [ 120.397220][ T6106] path_openat+0x14a6/0x1da0 [ 120.401862][ T6106] do_file_open+0x23e/0x4a0 [ 120.406426][ T6106] ? __pfx_do_file_open+0x10/0x10 [ 120.411483][ T6106] ? _raw_spin_unlock+0x28/0x50 [ 120.416362][ T6106] ? alloc_fd+0x6af/0x760 [ 120.420894][ T6106] do_sys_openat2+0x115/0x200 [ 120.425594][ T6106] ? __se_sys_futex+0x3a8/0x450 [ 120.430491][ T6106] ? __pfx_do_sys_openat2+0x10/0x10 [ 120.435714][ T6106] ? rcu_is_watching+0x16/0xb0 [ 120.440550][ T6106] __x64_sys_openat+0x138/0x170 [ 120.445427][ T6106] do_syscall_64+0x166/0x520 [ 120.450041][ T6106] ? trace_irq_disable+0x3b/0x140 [ 120.455097][ T6106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.461197][ T6106] ? clear_bhb_loop+0x70/0xc0 [ 120.465997][ T6106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.471928][ T6106] RIP: 0033:0x7fc33f39e199 [ 120.476373][ T6106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.496093][ T6106] RSP: 002b:00007fc3402cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 120.504552][ T6106] RAX: ffffffffffffffda RBX: 00007fc33f625fa0 RCX: 00007fc33f39e199 [ 120.512552][ T6106] RDX: 0000000000000002 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 120.520546][ T6106] RBP: 00007fc33f4358e0 R08: 0000000000000000 R09: 0000000000000000 [ 120.528560][ T6106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.536819][ T6106] R13: 00007fc33f626038 R14: 00007fc33f625fa0 R15: 00007fff0c863038 [ 120.544828][ T6106] [ 120.548495][ T6106] Kernel Offset: disabled [ 120.552843][ T6106] Rebooting in 86400 seconds..