last executing test programs: 25m19.893105366s ago: executing program 2 (id=49): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000019640)={0x0, 0x0, 0x0}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x45bf3c16e68e268e}, 0x3000c000) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000002c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000300)=0x6) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r4, &(0x7f00000003c0)=""/102400, 0x19000) openat(0xffffffffffffff9c, &(0x7f00000193c0)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000019400)='./tracing\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000194c0)='./tracing/uprobe_events\x00', 0x401, 0x0) wait4(r3, &(0x7f0000019500), 0x20000000, 0x0) write(r5, 0x0, 0x0) r6 = syz_io_uring_setup(0xf08, &(0x7f0000019700)={0x0, 0xfefffffe, 0x800, 0x3, 0x800000c5}, &(0x7f0000019780)=0x0, &(0x7f00000197c0)=0x0, &(0x7f0000019800)=0x0) syz_io_uring_submit(r7, r8, r9, &(0x7f0000019840)=@IORING_OP_MKDIRAT={0x25, 0x45, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x100, 0x0, 0x1}) io_uring_enter(r6, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r10 = syz_open_dev$radio(&(0x7f0000000000), 0x2, 0x2) read(r10, &(0x7f0000000100)=""/108, 0x6c) r11 = dup(r10) getsockopt$bt_hci(r11, 0x0, 0x1, &(0x7f0000000180)=""/149, &(0x7f0000000240)=0x95) 25m16.264182304s ago: executing program 2 (id=53): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r3, &(0x7f0000000180)=""/102392, 0x18ff8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000019740), r4) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r4, &(0x7f0000019780)={0x0, 0x0, &(0x7f00000197c0)={&(0x7f0000019800)={0x4c, r5, 0x1, 0x0, 0xffffffff, {0x6, 0x0, 0x900}, [@NLBL_UNLABEL_A_SECCTX={0xf, 0x7, 'unconfined\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}]}, 0x4c}, 0x2, 0x34005}, 0x0) 25m10.736861008s ago: executing program 2 (id=60): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mount_setattr(0xffffffffffffffff, 0x0, 0x1000, 0x0, 0x0) syz_socket_connect_nvme_tcp() bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b000000180100002020692500000000002020207b1af8ff00000000bfa100"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r1) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x3630c1) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r2, &(0x7f00000000c0)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)="3100f3a70c57aab9346531b3f6ad5b6ec75a0fc0a6c0bbd4b2d8ee9d3c891dff36500980fc1652c71193785d5ff7f83552ca2dbca8aee1c26bb0337897ace4fb85cc40c273cd67ec01764ee2f7de0223a5bea506f5f997938cd33aef9a85636fc3", 0x61) 24m58.470157036s ago: executing program 2 (id=71): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount$bind(&(0x7f00000003c0)='.\x00', &(0x7f0000000400)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000440)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000500)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00', 0x0, 0x3c5093, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) 24m57.294085174s ago: executing program 2 (id=74): setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x2710}, 0x0, 0x2002}], 0x18) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x59fc02, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r3, &(0x7f0000001640), 0x0) add_key(0x0, &(0x7f0000000000)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0x5, &(0x7f00000000c0)=0x40, 0x4) sched_setaffinity(0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_dev$vim2m(&(0x7f0000000080), 0x100000001, 0x2) pselect6(0x40, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x300}, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000440)=ANY=[], 0x0) mq_open(0x0, 0x40, 0x40, 0x0) 24m52.669702427s ago: executing program 2 (id=78): syz_open_dev$vim2m(0x0, 0x5, 0x2) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(0x0, &(0x7f00000006c0)=0x4) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) 24m51.071973155s ago: executing program 32 (id=78): syz_open_dev$vim2m(0x0, 0x5, 0x2) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setparam(0x0, &(0x7f00000006c0)=0x4) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) 11.841841159s ago: executing program 3 (id=2540): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x2}}, 0x20) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x400000000000009, 0xfffffffffffffff9, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2839d1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.381216048s ago: executing program 3 (id=2542): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f00000000c0)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0xf) ioctl$TCSBRK(r1, 0x400455c8, 0x2) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)=0x1) 7.933199612s ago: executing program 3 (id=2543): socket$alg(0x26, 0x5, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) syz_usb_connect(0x0, 0x24, &(0x7f0000000640)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000680), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000006c0)={&(0x7f0000000700)=[{0x1a, 0x8611, 0x45, &(0x7f0000000840)="253a7acf9a8fe926537298db31ff768204b808474d55acd4b3b41b7781b285d9799ae7316cc6987482737031e62202d8fa6740dc86ed95848a81a7dad116de4ed0de1c13ea"}, {0x6, 0x0, 0x0, 0x0}], 0x2}) 7.932701782s ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 7.313534617s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) 5.699475785s ago: executing program 0 (id=2545): socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000400)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000440)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000000780)=[{{&(0x7f0000000800)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="120000000000000029000000", @ANYRES64=r0], 0x108}}], 0x2, 0xc040) 5.614742787s ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 4.747934657s ago: executing program 0 (id=2546): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000280)='./sys\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='/dev/zram0,6', 0xc) 4.747791347s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) 4.342591437s ago: executing program 0 (id=2547): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x6, &(0x7f0000000400)=@framed={{}, [@map_fd={0x18, 0x1}, @generic={0xbf, 0x2, 0xa}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000140)=0x6, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x24e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000200)='v', 0x1, 0x4040, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000240), 0x14, 0x40000102, 0x0) 4.342196217s ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 3.970611086s ago: executing program 3 (id=2548): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/nullb0/queue/scheduler\x00', 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) syz_usb_connect$uac3(0x4, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x8500, 0x0) r2 = syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r2, 0x1, 0xfffffffd, 0x9, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) bpf$MAP_CREATE(0x0, 0x0, 0x0) write(r0, &(0x7f00000001c0)='kyber', 0x5) 3.969692636s ago: executing program 0 (id=2549): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x72e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000540)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) mount(0x0, &(0x7f0000000a40)='./proc\x00', 0x0, 0x1000010, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./proc/thread-self/fail-nth\x00', 0x101002, 0x0) write(r4, &(0x7f0000000b00)='7', 0x1) getsockname$netlink(r4, 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000b40)={0x8000000000000003, 0x100000001, 0x2, 0x4000000000045, 0x4, 0x7, 0x6, 0x9}, 0x0, &(0x7f00000000c0), 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000005c0)=0x3, 0xac5) syz_clone3(&(0x7f0000000c80)={0x123000000, &(0x7f0000000680)=0xffffffffffffffff, 0x0, 0x0, {0x2a}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0xb0f, &(0x7f0000000200)=0x0) io_submit(r6, 0x1, &(0x7f0000000700)=[&(0x7f0000000740)={0x0, 0x0, 0x0, 0x5, 0x7, r5, 0x0}]) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000780)={0x73622a85, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000800)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000880)={0x4c, 0x0, &(0x7f00000008c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000940)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x110a, 0x5}}, &(0x7f00000009c0)={0x0, 0x18, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mkdir(0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) 3.969571986s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) 2.380788413s ago: executing program 0 (id=2550): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x7, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) listen(0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000780)={0xffffffffffffff2a, 0x0, &(0x7f0000000280)=[@request_freeze={0x400c6313, 0x5, 0x1}, @clear_death={0x400c630f, 0x1, 0x3}], 0x22e, 0x0, &(0x7f0000000540)=""/558}) syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2c, 0x1, 0x2, 0x101, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv6={{0x0, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x0, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x803, 0x4, 0x7}) r3 = fsopen(&(0x7f0000000200)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x7fffffff, 0xd, "00080000000000000000000cadf100004000"}) syz_open_pts(0xffffffffffffffff, 0x41) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) 2.380553853s ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 1.844137266s ago: executing program 3 (id=2551): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x79, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000100)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='bbr', 0x3) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendmmsg(r0, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="c8b7df938dc9c0fcc8a7e84a57fa9059b9cfa4132462f9c45b583e8ce1f19a82364b01b4bc3436dcea3f3380b3269f2c986b7f8205fa231eac99a9de63cd4662a22f18183bb042a742ac921efe546daedbd31cd4b5cda70186dd7ec449169ea58eba083456774ea76202bc9969ea7026a8d7090c085a769e47294e4ea5b8ce3f6187e5ca87549e75b0b2980a21dc6b809da3f544d061ad96d06e0864906297353deefe8b52d519dd67f3f41dd7dd1cda0601b77e8415521d7dbb9893735e26097a90a63af8f66cdae432cd7ae74af90b87224b5f4b3ada389dc5ee3aeaf20c176697544017263d67bca40a482747a537528a8a0f98e4ad2d0580fbdd3b3c4175b69c6e4b98d9c0c14e2db67b0280ebec2b783b20bca5", 0x116}], 0x1}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000480)="b826c4139a86353cbda69434b1660c9490c1dce0068251193a8d0bbe9ef1d234afe76884532fc1418ff5250c917485f0ff345b39a90da2123a68e59c81b4e1291b7fa7c753d100d8ac26326a5828673dbb1f284799a2655eb91a1d1d35f4adc7c85920b40ba4c90bcbe564bad4422f2c1df8aab220851f24feb537bc74c14c70c096f4f82676b8", 0x87}, {&(0x7f0000000540)="85def750bf0f970d18673f7a66da039282c9e8bad703922b4bb30ba92ee6e4a38cc1e681f094c48eacc04a75eee5d9bafa37c0339df18615d43673a757", 0x3d}, {&(0x7f0000000b00)="99ddc8b5582b558a3c0366c34c19fb5e63050b060f8c573ef4b40a4f91e798498320af4f9deefe54ab0e05ec5cea2f08e75b313b5aa4e36ce2b7361e133ec162079509e078fd813296ca83514d6f96c7b8e130291ed9bb423b7dde7dfcb055473d6088413d2ff2b0942db70a0f31444096ec76be0773ac66b01fd3d618c85ade1bb12bc8532408191d931ff30ced3061cc9d51", 0x93}, {&(0x7f0000000bc0)="26c8ecde257dacbca7d704d4b8db3c70d1d6e753f0bdbe967eef6d7eee43170578acd2e2ff269ff17144a90f0f00823a2d74803be1ed7d3780ed97c5e40ee2e5a6102a489d9732dfd00e6959b82128da99641dac68a39b74eaa00e299aaf2d7d5465242853483bd6a2ccea22247de61a65e43cddb0044d92ea490074c2fb83d3139f83478b890fac6435389ba3d0f449774a4b0b1ba1a3d1febe87eadd5459e61546fae26190776c8213b61461", 0xad}], 0x4}}, {{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000d00)="b45621ffc5c4e0f27078ec7e3c62ed7d", 0x10}, {&(0x7f0000000d40)="98b00967c5c7904da7c6a62237c944f98187705d27ec2e87121ee503bb029dec67124692e4438e228f72bcfae7e07eeaf3b852086a93b875080cf4181532b7d7685cc71acff78b2a50a8685f487267f1ad7e4197bf9ec3ffc2e57a8bd6bac61b0e09e610c92d57c7cd482583d053f748e1176b4c63df7f34e9985f66ab1a1b3195be50d2a1f75f67350c05a766b12b0a74a55af4d13421a740b7427e556eeb926f66fa51be722882b51a1d994a3d8399ea598d9426171d119f70f42e1808a18a9207264c57af29f2e43ae70110758d0184910d57ee7abe042be58159301a3fc51b4aa32a5e752d017b89ae8d70959b271345bd5a27d58659e5a8d858c1923c8821ffa65d235af453f86f810ffc61d45c658dac96d4f20335ab7edd445d52433b307d16478e3578d96cffaf3bdc40d9c3e2c67a892cce2e8409be7ff568cfba1b9ca5feead69388f90d986f45246000e48f83b1f8e363bd21a753067660057610e40ef5d87e095059a389718a772ef4205691bbe55e55d053c6c0bd599b0a27dcc5d1b9a327bd365f60ad8a880566ef5705a3a016fcffaab758235851456b8084cd5ea851e0cc214e468e1d2a6e882904bbc099a9b819c1826421e5f8e4c03c9cde98ccfacfb1f1a67084e1e1d5c9617fece7719dbf271f50e9a8bbf21bf0a194c34782726a2c61bd24816055e0a6dc3d1bd1942bb2d201ad6fe75796abe456a16b6c9533ab4e51d1d02da67c150f4792aa21c46b3e15cb6c4076ace3fd7a9edae0accfc21fa08245e51065803ad762733db70a8db608c62533a0892f900870bdf0c682ccfccf9f75ab2b47311143994bef6d69834406c2134385a0d1176241989498eb77bf74b164e84e763e3fa4fef898556c1cc5ad916377888d2c8d141a5c339d23a028ed785fc582bba53a19f51b9517d92337df333f6c55c69fbbbc3d58b3ccbd6f0e8729fa5fc083a0c4ad5d2e020ff668efa3cbe434c119f3e534a4370da2d062d60fe08ecb8aa5b54cdb091eb349e42fda4ee6db3fcfeb8cfcf0fbf73d3cba12941e8f545cef4f22a347fa15391d3b54a68cd3a2756700b5c4cc384ba31522539eda54b6c78c80a2d32e7e41fbf800bb4ac95ff141c45bbf84b79ada9ad06e1b1a6707afa62777bc598a7b236cee03bd3cdda4ad2a666a959a799c7ebde1e26803e30942afe22ef9c42b2f8403ad20a9a28329851d838308c44dccbb4a95cb8dde385abb82c4959d33ecbea626412fbf69c2aa5de2c593d49183e02f75af9cfa513d87fd6327c4696c66d8fd22ad27506e5771811d44782474f53491c09402b0b6c0d940d7dc9aeaffbba0cddb65c4a1d3cba9d14e6637e3a63abe423df8e7757140fc6e6da54c9122d955fac9c9872fb8a763a64f88e440bf74b8cef06ded0ced10ae4689c958f0f2ec", 0x3ee}], 0x2}}], 0x3, 0x0) 1.843984686s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) 1.516324754s ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 1.195271742s ago: executing program 3 (id=2552): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) clock_adjtime(0x0, &(0x7f0000000300)={0x8b8d, 0x3, 0x4, 0x0, 0x8, 0x7000000000, 0x4, 0xfffffffffffffffd, 0x1, 0xffffffffffffffff, 0xf423f, 0x3f420f8000000000, 0x80000001, 0x1, 0x4, 0x0, 0x5, 0x401, 0x0, 0x0, 0x1, 0x4, 0xacb, 0x3, 0x6}) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x0, 0x0}, 0x8) r4 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0)=r3, 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000100)={r4}, 0x8) 1.194839072s ago: executing program 0 (id=2553): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000004c0)={0x1f, 0x3}, 0x6) setuid(0xee00) write$binfmt_misc(r2, &(0x7f0000000580), 0xd) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_IOAS_UNMAP(0xffffffffffffffff, 0x3b86, &(0x7f0000000280)={0x18, 0x0, 0x799d46b7, 0xffffffffffff7fff}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sync_file_range(0xffffffffffffffff, 0x6, 0x9fd, 0x3) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40c4) syz_open_dev$usbfs(&(0x7f0000000240), 0xf, 0x101301) 1.181318322s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) 617.974005ms ago: executing program 4 (id=2511): socket$inet_icmp(0x2, 0x2, 0x1) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x1090c1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000bc0)={{{@in6=@dev, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$unix(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000300)="76a7c6415bec6e0dbcb81df45134bc6449f697abe1e6727d38c13002955a349344eef1f45280", 0x26}, {&(0x7f0000000440)="fa47", 0x2}, {0x0}, {&(0x7f0000000640)}, {&(0x7f0000000740)="a1a4c4cc21e94459f1f86d5e64f0c22316109180feee1b9c8561c4620fcbe9ab9d75a97d8f459e14de24da1e24fdd4a9ff3b586a134a4410d592088eed7c898322eda927c10ead7f4175bb98b69f9fdf4f2a758d6e7869ecf01d47699954a61545872ce948337f8ad5d115b4517b2aa1e49531d9df7d1009a2f2ebbc1c6eb77715e36abcf6f409c5766492ce831797cc6a176c", 0x93}, {0x0}, {&(0x7f0000000900)}], 0x7, 0x0, 0x0, 0x48004}, 0x20000840) chdir(&(0x7f0000000140)='./file0\x00') r3 = open(&(0x7f0000000040)='./bus\x00', 0x4c27e, 0x10) fallocate(r3, 0x0, 0x0, 0x1000f4) sendfile(r3, r3, 0x0, 0x40000000800) 0s ago: executing program 1 (id=2405): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="48000000100001002bbd", @ANYRES32=0x0, @ANYBLOB="8a00000014001680100001800c000300fe2e00000000000014000300776c616e30"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) kernel console output (not intermixed with test programs): lvl+0x18c/0x250 [ 1403.030809][T13791] ? show_regs_print_info+0x20/0x20 [ 1403.036028][T13791] ? load_image+0x420/0x420 [ 1403.040557][T13791] ? __might_fault+0xaa/0x120 [ 1403.045251][T13791] ? __lock_acquire+0x7eb0/0x7eb0 [ 1403.050396][T13791] ? udp_sendmsg+0x1ae1/0x23d0 [ 1403.055197][T13791] ? __virt_addr_valid+0x10c/0x380 [ 1403.060346][T13791] should_fail_ex+0x394/0x4c0 [ 1403.065061][T13791] _copy_from_user+0x2f/0xe0 [ 1403.069682][T13791] csum_and_copy_from_iter+0x1f3/0x1480 [ 1403.075265][T13791] ? __alloc_skb+0x138/0x2c0 [ 1403.079880][T13791] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1403.085543][T13791] ? preempt_schedule_notrace_thunk+0x1a/0x30 [ 1403.091645][T13791] ? rcu_is_watching+0x7a/0xb0 [ 1403.096440][T13791] ip_generic_getfrag+0x163/0x2f0 [ 1403.101507][T13791] ? ip_skb_dst_mtu+0x870/0x870 [ 1403.106384][T13791] ? __build_skb_around+0x245/0x3c0 [ 1403.111610][T13791] ? __alloc_skb+0x1b2/0x2c0 [ 1403.116220][T13791] ? skb_put+0x112/0x210 [ 1403.120501][T13791] __ip_append_data+0x2f3b/0x3bf0 [ 1403.125798][T13791] ? ip_skb_dst_mtu+0x870/0x870 [ 1403.130883][T13791] ? ip_setup_cork+0x840/0x840 [ 1403.135693][T13791] ? ip_setup_cork+0x527/0x840 [ 1403.140488][T13791] ? trace_irq_disable+0x37/0xe0 [ 1403.145458][T13791] ip_make_skb+0x22b/0x440 [ 1403.149917][T13791] ? ip_skb_dst_mtu+0x870/0x870 [ 1403.154803][T13791] ? ip_flush_pending_frames+0x250/0x250 [ 1403.160480][T13791] udp_sendmsg+0x1ae1/0x23d0 [ 1403.165105][T13791] ? ip_skb_dst_mtu+0x870/0x870 [ 1403.169981][T13791] ? udp_cmsg_send+0x350/0x350 [ 1403.174771][T13791] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1403.180770][T13791] ? read_lock_is_recursive+0x20/0x20 [ 1403.186171][T13791] ? finish_task_switch+0x262/0x8f0 [ 1403.191413][T13791] udpv6_sendmsg+0x7a4/0x2390 [ 1403.196117][T13791] ? asan.module_dtor+0x20/0x20 [ 1403.200998][T13791] ? udp_v6_early_demux+0xf90/0xf90 [ 1403.206252][T13791] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1403.211908][T13791] ? lockdep_hardirqs_on+0x98/0x150 [ 1403.217145][T13791] ? sock_rps_record_flow+0x19/0x3f0 [ 1403.222453][T13791] ? inet_send_prepare+0x5b/0x250 [ 1403.227502][T13791] ? inet6_sendmsg+0x5f/0xd0 [ 1403.232115][T13791] sock_write_iter+0x2dc/0x420 [ 1403.236910][T13791] ? sock_read_iter+0x3f0/0x3f0 [ 1403.241811][T13791] vfs_write+0x474/0x9a0 [ 1403.246081][T13791] ? file_end_write+0x250/0x250 [ 1403.250967][T13791] ? __fget_files+0x3fc/0x460 [ 1403.255681][T13791] ? __fdget_pos+0x1d8/0x330 [ 1403.260289][T13791] ? ksys_write+0x74/0x260 [ 1403.264728][T13791] ksys_write+0x151/0x260 [ 1403.269086][T13791] ? __ia32_sys_read+0x90/0x90 [ 1403.273883][T13791] ? lockdep_hardirqs_on+0x98/0x150 [ 1403.279112][T13791] do_syscall_64+0x55/0xb0 [ 1403.283536][T13791] ? clear_bhb_loop+0x40/0x90 [ 1403.288205][T13791] ? clear_bhb_loop+0x40/0x90 [ 1403.292901][T13791] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1403.298844][T13791] RIP: 0033:0x7f73c0f9e559 [ 1403.303277][T13791] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1403.322932][T13791] RSP: 002b:00007f73bf1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1403.331359][T13791] RAX: ffffffffffffffda RBX: 00007f73c1226180 RCX: 00007f73c0f9e559 [ 1403.339346][T13791] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1403.347319][T13791] RBP: 00007f73c10358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1403.355291][T13791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1403.363273][T13791] R13: 00007f73c1226218 R14: 00007f73c1226180 R15: 00007ffcc6eea008 [ 1403.371276][T13791] [ 1404.189007][T13795] FAULT_INJECTION: forcing a failure. [ 1404.189007][T13795] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1404.255267][T13795] CPU: 1 PID: 13795 Comm: syz.0.2111 Not tainted syzkaller #0 [ 1404.262799][T13795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1404.272925][T13795] Call Trace: [ 1404.276227][T13795] [ 1404.279184][T13795] dump_stack_lvl+0x18c/0x250 [ 1404.283894][T13795] ? show_regs_print_info+0x20/0x20 [ 1404.289117][T13795] ? load_image+0x420/0x420 [ 1404.293655][T13795] ? stack_trace_save+0xaa/0x100 [ 1404.298647][T13795] should_fail_ex+0x394/0x4c0 [ 1404.303385][T13795] get_futex_key+0x136/0x1030 [ 1404.308099][T13795] ? futex_setup_timer+0xc0/0xc0 [ 1404.313087][T13795] futex_wake+0x127/0x4f0 [ 1404.317449][T13795] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1404.323464][T13795] ? futex_wake_mark+0x150/0x150 [ 1404.328449][T13795] ? lockdep_hardirqs_on+0x98/0x150 [ 1404.333680][T13795] do_futex+0x35d/0x3e0 [ 1404.337862][T13795] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1404.343791][T13795] __se_sys_futex+0x3a9/0x440 [ 1404.348501][T13795] ? __x64_sys_futex+0xf0/0xf0 [ 1404.353290][T13795] ? __x64_sys_futex+0x21/0xf0 [ 1404.358083][T13795] do_syscall_64+0x55/0xb0 [ 1404.362522][T13795] ? clear_bhb_loop+0x40/0x90 [ 1404.367224][T13795] ? clear_bhb_loop+0x40/0x90 [ 1404.371936][T13795] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1404.377863][T13795] RIP: 0033:0x7f73c0f9e559 [ 1404.382301][T13795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1404.401938][T13795] RSP: 002b:00007f73c1dac0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1404.410401][T13795] RAX: ffffffffffffffda RBX: 00007f73c1225fa8 RCX: 00007f73c0f9e559 [ 1404.418409][T13795] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f73c1225fac [ 1404.426413][T13795] RBP: 00007f73c1225fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 1404.434414][T13795] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 1404.442413][T13795] R13: 00007f73c1226038 R14: 00007ffcc6ee9f20 R15: 00007ffcc6eea008 [ 1404.450444][T13795] [ 1407.682522][T13819] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2117'. [ 1408.712315][T13817] overlay: ./file0 is not a directory [ 1408.790037][T13830] FAULT_INJECTION: forcing a failure. [ 1408.790037][T13830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1408.803365][T13830] CPU: 1 PID: 13830 Comm: syz.0.2119 Not tainted syzkaller #0 [ 1408.810858][T13830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1408.820937][T13830] Call Trace: [ 1408.824232][T13830] [ 1408.827181][T13830] dump_stack_lvl+0x18c/0x250 [ 1408.831883][T13830] ? show_regs_print_info+0x20/0x20 [ 1408.837099][T13830] ? load_image+0x420/0x420 [ 1408.841629][T13830] ? __might_fault+0xaa/0x120 [ 1408.846328][T13830] ? __lock_acquire+0x7eb0/0x7eb0 [ 1408.851375][T13830] ? __virt_addr_valid+0x10c/0x380 [ 1408.856513][T13830] should_fail_ex+0x394/0x4c0 [ 1408.861220][T13830] _copy_from_user+0x2f/0xe0 [ 1408.865835][T13830] csum_and_copy_from_iter+0x1f3/0x1480 [ 1408.871406][T13830] ? trace_irq_disable+0x37/0xe0 [ 1408.876370][T13830] ? lock_chain_count+0x20/0x20 [ 1408.881247][T13830] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1408.886901][T13830] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1408.892577][T13830] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1408.898243][T13830] ? __build_skb_around+0xb5/0x3c0 [ 1408.903394][T13830] ip_generic_getfrag+0x163/0x2f0 [ 1408.908458][T13830] ? ip_skb_dst_mtu+0x870/0x870 [ 1408.913335][T13830] ? __build_skb_around+0x245/0x3c0 [ 1408.918557][T13830] ? __alloc_skb+0x1b2/0x2c0 [ 1408.923183][T13830] ? skb_put+0x112/0x210 [ 1408.927481][T13830] __ip_append_data+0x2f3b/0x3bf0 [ 1408.932569][T13830] ? ip_skb_dst_mtu+0x870/0x870 [ 1408.937464][T13830] ? ip_setup_cork+0x840/0x840 [ 1408.942258][T13830] ? ip_setup_cork+0x527/0x840 [ 1408.947056][T13830] ip_make_skb+0x22b/0x440 [ 1408.951508][T13830] ? ip_skb_dst_mtu+0x870/0x870 [ 1408.956512][T13830] ? ip_flush_pending_frames+0x250/0x250 [ 1408.962197][T13830] ? mark_lock+0x94/0x320 [ 1408.966570][T13830] udp_sendmsg+0x1ae1/0x23d0 [ 1408.971200][T13830] ? ip_skb_dst_mtu+0x870/0x870 [ 1408.976078][T13830] ? udp_cmsg_send+0x350/0x350 [ 1408.980864][T13830] ? lock_chain_count+0x20/0x20 [ 1408.985739][T13830] ? finish_task_switch+0x262/0x8f0 [ 1408.990981][T13830] ? __schedule+0x15b6/0x4660 [ 1408.995698][T13830] udpv6_sendmsg+0x7a4/0x2390 [ 1409.000423][T13830] ? udp_v6_early_demux+0xf90/0xf90 [ 1409.005644][T13830] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1409.011666][T13830] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1409.017321][T13830] ? sock_rps_record_flow+0x19/0x3f0 [ 1409.022626][T13830] ? inet_send_prepare+0x5b/0x250 [ 1409.027671][T13830] ? inet6_sendmsg+0x5f/0xd0 [ 1409.032278][T13830] sock_write_iter+0x2dc/0x420 [ 1409.037074][T13830] ? sock_read_iter+0x3f0/0x3f0 [ 1409.041970][T13830] vfs_write+0x474/0x9a0 [ 1409.046248][T13830] ? file_end_write+0x250/0x250 [ 1409.051133][T13830] ? __fget_files+0x3fc/0x460 [ 1409.055846][T13830] ? __fdget_pos+0x1d8/0x330 [ 1409.060458][T13830] ? ksys_write+0x74/0x260 [ 1409.064904][T13830] ksys_write+0x151/0x260 [ 1409.069263][T13830] ? __ia32_sys_read+0x90/0x90 [ 1409.074064][T13830] ? lockdep_hardirqs_on+0x98/0x150 [ 1409.079298][T13830] do_syscall_64+0x55/0xb0 [ 1409.083728][T13830] ? clear_bhb_loop+0x40/0x90 [ 1409.088421][T13830] ? clear_bhb_loop+0x40/0x90 [ 1409.093120][T13830] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1409.099027][T13830] RIP: 0033:0x7f73c0f9e559 [ 1409.103443][T13830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1409.123061][T13830] RSP: 002b:00007f73bf1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1409.131485][T13830] RAX: ffffffffffffffda RBX: 00007f73c1226180 RCX: 00007f73c0f9e559 [ 1409.139465][T13830] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1409.147441][T13830] RBP: 00007f73c10358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1409.155423][T13830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1409.163398][T13830] R13: 00007f73c1226218 R14: 00007f73c1226180 R15: 00007ffcc6eea008 [ 1409.171388][T13830] [ 1409.175045][T13817] overlay: ./file0 is not a directory [ 1409.241921][T13817] can0: slcan on ptm0. [ 1409.321625][T13816] can0 (unregistered): slcan off ptm0. [ 1410.313131][T13838] FAULT_INJECTION: forcing a failure. [ 1410.313131][T13838] name failslab, interval 1, probability 0, space 0, times 0 [ 1410.327279][T13838] CPU: 0 PID: 13838 Comm: syz.3.2122 Not tainted syzkaller #0 [ 1410.334788][T13838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1410.344868][T13838] Call Trace: [ 1410.348163][T13838] [ 1410.351112][T13838] dump_stack_lvl+0x18c/0x250 [ 1410.355819][T13838] ? show_regs_print_info+0x20/0x20 [ 1410.361041][T13838] ? load_image+0x420/0x420 [ 1410.365568][T13838] ? __might_sleep+0xe0/0xe0 [ 1410.370177][T13838] ? __lock_acquire+0x7eb0/0x7eb0 [ 1410.375208][T13838] ? rcu_is_watching+0x15/0xb0 [ 1410.379987][T13838] should_fail_ex+0x394/0x4c0 [ 1410.384676][T13838] should_failslab+0x9/0x20 [ 1410.389190][T13838] slab_pre_alloc_hook+0x59/0x300 [ 1410.394226][T13838] ? misc_open+0x59/0x3a0 [ 1410.398566][T13838] ? vmci_host_open+0x4f/0xe0 [ 1410.403252][T13838] __kmem_cache_alloc_node+0x53/0x250 [ 1410.408645][T13838] ? vmci_host_open+0x4f/0xe0 [ 1410.413331][T13838] kmalloc_trace+0x2a/0xe0 [ 1410.417759][T13838] vmci_host_open+0x4f/0xe0 [ 1410.422266][T13838] ? vmci_host_unlocked_ioctl+0x27d0/0x27d0 [ 1410.428162][T13838] misc_open+0x326/0x3a0 [ 1410.432412][T13838] chrdev_open+0x58c/0x600 [ 1410.436832][T13838] ? cd_forget+0x160/0x160 [ 1410.441259][T13838] ? fsnotify_perm+0x3ed/0x5e0 [ 1410.446030][T13838] do_dentry_open+0x880/0x14b0 [ 1410.450802][T13838] ? cd_forget+0x160/0x160 [ 1410.455226][T13838] path_openat+0x284f/0x3270 [ 1410.459841][T13838] ? do_sys_openat2+0xda/0x1d0 [ 1410.464606][T13838] ? __x64_sys_openat+0x139/0x160 [ 1410.469640][T13838] ? verify_lock_unused+0x140/0x140 [ 1410.474848][T13838] ? do_filp_open+0x430/0x430 [ 1410.479548][T13838] do_filp_open+0x1f2/0x430 [ 1410.484066][T13838] ? vfs_tmpfile+0x620/0x620 [ 1410.488676][T13838] ? _raw_spin_unlock+0x28/0x40 [ 1410.493536][T13838] ? alloc_fd+0x590/0x640 [ 1410.497891][T13838] do_sys_openat2+0x134/0x1d0 [ 1410.502580][T13838] ? do_sys_open+0xe0/0xe0 [ 1410.506999][T13838] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1410.512995][T13838] ? lock_chain_count+0x20/0x20 [ 1410.517864][T13838] __x64_sys_openat+0x139/0x160 [ 1410.522728][T13838] do_syscall_64+0x55/0xb0 [ 1410.527150][T13838] ? clear_bhb_loop+0x40/0x90 [ 1410.531856][T13838] ? clear_bhb_loop+0x40/0x90 [ 1410.536542][T13838] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1410.542451][T13838] RIP: 0033:0x7effaa19e559 [ 1410.546867][T13838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1410.566482][T13838] RSP: 002b:00007effab14c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1410.574938][T13838] RAX: ffffffffffffffda RBX: 00007effaa425fa0 RCX: 00007effaa19e559 [ 1410.582938][T13838] RDX: 0000000000000002 RSI: 00002000000002c0 RDI: 00000000ffffff9c [ 1410.590914][T13838] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1410.598889][T13838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1410.606861][T13838] R13: 00007effaa426038 R14: 00007effaa425fa0 R15: 00007ffeb00bd348 [ 1410.614857][T13838] [ 1410.752397][ T5783] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 1412.620902][T13851] netlink: 'syz.1.2126': attribute type 4 has an invalid length. [ 1412.632747][T13851] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2126'. [ 1416.118006][T13864] FAULT_INJECTION: forcing a failure. [ 1416.118006][T13864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1416.131186][T13864] CPU: 1 PID: 13864 Comm: syz.4.2131 Not tainted syzkaller #0 [ 1416.138671][T13864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1416.148756][T13864] Call Trace: [ 1416.152049][T13864] [ 1416.154990][T13864] dump_stack_lvl+0x18c/0x250 [ 1416.159698][T13864] ? show_regs_print_info+0x20/0x20 [ 1416.164915][T13864] ? load_image+0x420/0x420 [ 1416.169448][T13864] ? __might_fault+0xaa/0x120 [ 1416.174147][T13864] ? __lock_acquire+0x7eb0/0x7eb0 [ 1416.179195][T13864] ? udp_sendmsg+0x1ae1/0x23d0 [ 1416.184040][T13864] ? __virt_addr_valid+0x10c/0x380 [ 1416.189207][T13864] should_fail_ex+0x394/0x4c0 [ 1416.193921][T13864] _copy_from_user+0x2f/0xe0 [ 1416.198543][T13864] csum_and_copy_from_iter+0x1f3/0x1480 [ 1416.204137][T13864] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1416.209902][T13864] ? __kmem_cache_alloc_node+0x194/0x250 [ 1416.215582][T13864] ? __alloc_skb+0x138/0x2c0 [ 1416.220224][T13864] ? rcu_is_watching+0x15/0xb0 [ 1416.225028][T13864] ip_generic_getfrag+0x163/0x2f0 [ 1416.230090][T13864] ? ip_skb_dst_mtu+0x870/0x870 [ 1416.234967][T13864] ? __build_skb_around+0x245/0x3c0 [ 1416.240203][T13864] ? __alloc_skb+0x1b2/0x2c0 [ 1416.244827][T13864] ? skb_put+0x112/0x210 [ 1416.249107][T13864] __ip_append_data+0x2f3b/0x3bf0 [ 1416.254190][T13864] ? ip_skb_dst_mtu+0x870/0x870 [ 1416.259080][T13864] ? ip_setup_cork+0x840/0x840 [ 1416.263876][T13864] ? ip_setup_cork+0x527/0x840 [ 1416.268674][T13864] ip_make_skb+0x22b/0x440 [ 1416.273331][T13864] ? ip_skb_dst_mtu+0x870/0x870 [ 1416.278206][T13864] ? ip_flush_pending_frames+0x250/0x250 [ 1416.283871][T13864] ? verify_lock_unused+0x140/0x140 [ 1416.289103][T13864] udp_sendmsg+0x1ae1/0x23d0 [ 1416.293740][T13864] ? ip_skb_dst_mtu+0x870/0x870 [ 1416.298617][T13864] ? udp_cmsg_send+0x350/0x350 [ 1416.303412][T13864] ? mark_lock+0x94/0x320 [ 1416.307764][T13864] ? __lock_acquire+0x135d/0x7eb0 [ 1416.312829][T13864] ? __schedule+0x15b6/0x4660 [ 1416.317540][T13864] udpv6_sendmsg+0x7a4/0x2390 [ 1416.322252][T13864] ? __might_sleep+0xe0/0xe0 [ 1416.326866][T13864] ? udp_v6_early_demux+0xf90/0xf90 [ 1416.332133][T13864] ? aa_af_perm+0x330/0x330 [ 1416.336669][T13864] ? sock_rps_record_flow+0x19/0x3f0 [ 1416.341985][T13864] ? inet_send_prepare+0x5b/0x250 [ 1416.347033][T13864] ? inet6_sendmsg+0x5f/0xd0 [ 1416.351654][T13864] sock_write_iter+0x2dc/0x420 [ 1416.356450][T13864] ? sock_read_iter+0x3f0/0x3f0 [ 1416.361352][T13864] ? common_file_perm+0x198/0x1f0 [ 1416.366410][T13864] vfs_write+0x474/0x9a0 [ 1416.370691][T13864] ? file_end_write+0x250/0x250 [ 1416.375848][T13864] ? __fget_files+0x3fc/0x460 [ 1416.380558][T13864] ? __fdget_pos+0x1d8/0x330 [ 1416.385157][T13864] ? ksys_write+0x74/0x260 [ 1416.389584][T13864] ksys_write+0x151/0x260 [ 1416.393922][T13864] ? __ia32_sys_read+0x90/0x90 [ 1416.398693][T13864] ? lockdep_hardirqs_on+0x98/0x150 [ 1416.403894][T13864] do_syscall_64+0x55/0xb0 [ 1416.408306][T13864] ? clear_bhb_loop+0x40/0x90 [ 1416.412981][T13864] ? clear_bhb_loop+0x40/0x90 [ 1416.417663][T13864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1416.423585][T13864] RIP: 0033:0x7ff531d9e559 [ 1416.428093][T13864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1416.447704][T13864] RSP: 002b:00007ff532d09028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1416.456134][T13864] RAX: ffffffffffffffda RBX: 00007ff532026090 RCX: 00007ff531d9e559 [ 1416.464108][T13864] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1416.472078][T13864] RBP: 00007ff531e358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1416.480056][T13864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1416.488022][T13864] R13: 00007ff532026128 R14: 00007ff532026090 R15: 00007fff299e87f8 [ 1416.496006][T13864] [ 1421.259107][T13906] FAULT_INJECTION: forcing a failure. [ 1421.259107][T13906] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1421.272280][T13906] CPU: 1 PID: 13906 Comm: syz.0.2140 Not tainted syzkaller #0 [ 1421.279768][T13906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1421.289850][T13906] Call Trace: [ 1421.293237][T13906] [ 1421.296184][T13906] dump_stack_lvl+0x18c/0x250 [ 1421.300887][T13906] ? show_regs_print_info+0x20/0x20 [ 1421.306103][T13906] ? load_image+0x420/0x420 [ 1421.310638][T13906] ? __might_fault+0xaa/0x120 [ 1421.315343][T13906] ? __lock_acquire+0x7eb0/0x7eb0 [ 1421.320393][T13906] ? udp_sendmsg+0x1ae1/0x23d0 [ 1421.325198][T13906] ? __virt_addr_valid+0x10c/0x380 [ 1421.330347][T13906] should_fail_ex+0x394/0x4c0 [ 1421.335074][T13906] _copy_from_user+0x2f/0xe0 [ 1421.339709][T13906] csum_and_copy_from_iter+0x1f3/0x1480 [ 1421.346013][T13906] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1421.351884][T13906] ? __kmem_cache_alloc_node+0x194/0x250 [ 1421.357569][T13906] ? __alloc_skb+0x138/0x2c0 [ 1421.362204][T13906] ? rcu_is_watching+0x15/0xb0 [ 1421.367011][T13906] ip_generic_getfrag+0x163/0x2f0 [ 1421.372099][T13906] ? ip_skb_dst_mtu+0x870/0x870 [ 1421.377021][T13906] ? __build_skb_around+0x245/0x3c0 [ 1421.382276][T13906] ? __alloc_skb+0x1b2/0x2c0 [ 1421.386906][T13906] ? skb_put+0x112/0x210 [ 1421.391198][T13906] __ip_append_data+0x2f3b/0x3bf0 [ 1421.396316][T13906] ? ip_skb_dst_mtu+0x870/0x870 [ 1421.401239][T13906] ? ip_setup_cork+0x840/0x840 [ 1421.406052][T13906] ? ip_setup_cork+0x527/0x840 [ 1421.410862][T13906] ip_make_skb+0x22b/0x440 [ 1421.415330][T13906] ? ip_skb_dst_mtu+0x870/0x870 [ 1421.420226][T13906] ? ip_flush_pending_frames+0x250/0x250 [ 1421.425911][T13906] ? verify_lock_unused+0x140/0x140 [ 1421.431190][T13906] udp_sendmsg+0x1ae1/0x23d0 [ 1421.435829][T13906] ? ip_skb_dst_mtu+0x870/0x870 [ 1421.440714][T13906] ? udp_cmsg_send+0x350/0x350 [ 1421.445514][T13906] ? mark_lock+0x94/0x320 [ 1421.449963][T13906] ? __lock_acquire+0x135d/0x7eb0 [ 1421.455041][T13906] ? __schedule+0x15b6/0x4660 [ 1421.459747][T13906] udpv6_sendmsg+0x7a4/0x2390 [ 1421.464459][T13906] ? __might_sleep+0xe0/0xe0 [ 1421.469075][T13906] ? udp_v6_early_demux+0xf90/0xf90 [ 1421.474320][T13906] ? aa_af_perm+0x330/0x330 [ 1421.478855][T13906] ? sock_rps_record_flow+0x19/0x3f0 [ 1421.484176][T13906] ? inet_send_prepare+0x5b/0x250 [ 1421.489251][T13906] ? inet6_sendmsg+0x5f/0xd0 [ 1421.493877][T13906] sock_write_iter+0x2dc/0x420 [ 1421.498678][T13906] ? sock_read_iter+0x3f0/0x3f0 [ 1421.503568][T13906] ? common_file_perm+0x198/0x1f0 [ 1421.508736][T13906] vfs_write+0x474/0x9a0 [ 1421.513031][T13906] ? file_end_write+0x250/0x250 [ 1421.517931][T13906] ? __fget_files+0x3fc/0x460 [ 1421.522656][T13906] ? __fdget_pos+0x1d8/0x330 [ 1421.527275][T13906] ? ksys_write+0x74/0x260 [ 1421.531730][T13906] ksys_write+0x151/0x260 [ 1421.536102][T13906] ? __ia32_sys_read+0x90/0x90 [ 1421.540911][T13906] ? lockdep_hardirqs_on+0x98/0x150 [ 1421.546144][T13906] do_syscall_64+0x55/0xb0 [ 1421.550573][T13906] ? clear_bhb_loop+0x40/0x90 [ 1421.555258][T13906] ? clear_bhb_loop+0x40/0x90 [ 1421.559938][T13906] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1421.565839][T13906] RIP: 0033:0x7f73c0f9e559 [ 1421.570260][T13906] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1421.589878][T13906] RSP: 002b:00007f73c1d8b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1421.598302][T13906] RAX: ffffffffffffffda RBX: 00007f73c1226090 RCX: 00007f73c0f9e559 [ 1421.606290][T13906] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1421.614268][T13906] RBP: 00007f73c10358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1421.622242][T13906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1421.630223][T13906] R13: 00007f73c1226128 R14: 00007f73c1226090 R15: 00007ffcc6eea008 [ 1421.638221][T13906] [ 1422.908665][T13923] netlink: 'syz.3.2137': attribute type 4 has an invalid length. [ 1422.916599][T13923] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2137'. [ 1424.448784][T12688] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1424.643831][T12688] usb 1-1: Using ep0 maxpacket: 16 [ 1424.655907][T12688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1424.687257][T12688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1424.708103][T12688] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1424.741845][T12688] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1424.768376][T12688] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1424.787415][T12688] usb 1-1: config 0 descriptor?? [ 1426.019620][T12688] usbhid 1-1:0.0: can't add hid device: -71 [ 1426.048424][T12688] usbhid: probe of 1-1:0.0 failed with error -71 [ 1426.069138][T12688] usb 1-1: USB disconnect, device number 32 [ 1427.537191][T13940] FAULT_INJECTION: forcing a failure. [ 1427.537191][T13940] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1427.550352][T13940] CPU: 1 PID: 13940 Comm: syz.0.2150 Not tainted syzkaller #0 [ 1427.557834][T13940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1427.567922][T13940] Call Trace: [ 1427.571227][T13940] [ 1427.574171][T13940] dump_stack_lvl+0x18c/0x250 [ 1427.578873][T13940] ? show_regs_print_info+0x20/0x20 [ 1427.584096][T13940] ? load_image+0x420/0x420 [ 1427.588630][T13940] ? __might_fault+0xaa/0x120 [ 1427.593332][T13940] ? __lock_acquire+0x7eb0/0x7eb0 [ 1427.598374][T13940] ? udp_sendmsg+0x1ae1/0x23d0 [ 1427.603160][T13940] ? __virt_addr_valid+0x10c/0x380 [ 1427.608298][T13940] should_fail_ex+0x394/0x4c0 [ 1427.613007][T13940] _copy_from_user+0x2f/0xe0 [ 1427.617627][T13940] csum_and_copy_from_iter+0x1f3/0x1480 [ 1427.623212][T13940] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1427.628875][T13940] ? __kmem_cache_alloc_node+0x194/0x250 [ 1427.634539][T13940] ? __alloc_skb+0x138/0x2c0 [ 1427.639150][T13940] ? rcu_is_watching+0x15/0xb0 [ 1427.644040][T13940] ip_generic_getfrag+0x163/0x2f0 [ 1427.649106][T13940] ? ip_skb_dst_mtu+0x870/0x870 [ 1427.653995][T13940] ? __build_skb_around+0x245/0x3c0 [ 1427.659224][T13940] ? __alloc_skb+0x1b2/0x2c0 [ 1427.663837][T13940] ? skb_put+0x112/0x210 [ 1427.668107][T13940] __ip_append_data+0x2f3b/0x3bf0 [ 1427.673202][T13940] ? ip_skb_dst_mtu+0x870/0x870 [ 1427.678100][T13940] ? ip_setup_cork+0x840/0x840 [ 1427.682911][T13940] ? ip_setup_cork+0x527/0x840 [ 1427.687740][T13940] ip_make_skb+0x22b/0x440 [ 1427.692204][T13940] ? ip_skb_dst_mtu+0x870/0x870 [ 1427.697094][T13940] ? ip_flush_pending_frames+0x250/0x250 [ 1427.702772][T13940] ? verify_lock_unused+0x140/0x140 [ 1427.708015][T13940] udp_sendmsg+0x1ae1/0x23d0 [ 1427.712659][T13940] ? ip_skb_dst_mtu+0x870/0x870 [ 1427.717645][T13940] ? udp_cmsg_send+0x350/0x350 [ 1427.722451][T13940] ? mark_lock+0x94/0x320 [ 1427.726814][T13940] ? __lock_acquire+0x135d/0x7eb0 [ 1427.731890][T13940] ? __schedule+0x15b6/0x4660 [ 1427.736605][T13940] udpv6_sendmsg+0x7a4/0x2390 [ 1427.741494][T13940] ? __might_sleep+0xe0/0xe0 [ 1427.746117][T13940] ? udp_v6_early_demux+0xf90/0xf90 [ 1427.751390][T13940] ? aa_af_perm+0x330/0x330 [ 1427.755931][T13940] ? sock_rps_record_flow+0x19/0x3f0 [ 1427.761249][T13940] ? inet_send_prepare+0x5b/0x250 [ 1427.766304][T13940] ? inet6_sendmsg+0x5f/0xd0 [ 1427.770930][T13940] sock_write_iter+0x2dc/0x420 [ 1427.775729][T13940] ? sock_read_iter+0x3f0/0x3f0 [ 1427.780602][T13940] ? common_file_perm+0x198/0x1f0 [ 1427.785641][T13940] vfs_write+0x474/0x9a0 [ 1427.789901][T13940] ? file_end_write+0x250/0x250 [ 1427.794780][T13940] ? __fget_files+0x3fc/0x460 [ 1427.799488][T13940] ? __fdget_pos+0x1d8/0x330 [ 1427.804092][T13940] ? ksys_write+0x74/0x260 [ 1427.808538][T13940] ksys_write+0x151/0x260 [ 1427.812919][T13940] ? __ia32_sys_read+0x90/0x90 [ 1427.817695][T13940] ? lockdep_hardirqs_on+0x98/0x150 [ 1427.822898][T13940] do_syscall_64+0x55/0xb0 [ 1427.827312][T13940] ? clear_bhb_loop+0x40/0x90 [ 1427.831986][T13940] ? clear_bhb_loop+0x40/0x90 [ 1427.836677][T13940] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1427.842580][T13940] RIP: 0033:0x7f73c0f9e559 [ 1427.846997][T13940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1427.866613][T13940] RSP: 002b:00007f73c1d8b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1427.875039][T13940] RAX: ffffffffffffffda RBX: 00007f73c1226090 RCX: 00007f73c0f9e559 [ 1427.883025][T13940] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1427.891004][T13940] RBP: 00007f73c10358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1427.898990][T13940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1427.906974][T13940] R13: 00007f73c1226128 R14: 00007f73c1226090 R15: 00007ffcc6eea008 [ 1427.914970][T13940] [ 1429.267645][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1429.278173][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1430.382017][T13954] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2148'. [ 1432.019239][ T56] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1433.065048][ T56] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1433.074769][ T56] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1433.098417][ T56] usb 4-1: Product: syz [ 1433.102641][ T56] usb 4-1: SerialNumber: syz [ 1433.140500][ T56] usb 4-1: config 0 descriptor?? [ 1433.351856][ T56] hso 4-1:0.0: Failed to find BULK IN ep [ 1433.554117][ T56] usb 4-1: USB disconnect, device number 24 [ 1433.593774][ T28] audit: type=1800 audit(1792119424.854:78): pid=13972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2151" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1435.840047][T13993] FAULT_INJECTION: forcing a failure. [ 1435.840047][T13993] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1435.853285][T13993] CPU: 1 PID: 13993 Comm: syz.1.2160 Not tainted syzkaller #0 [ 1435.860816][T13993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1435.870889][T13993] Call Trace: [ 1435.874182][T13993] [ 1435.877124][T13993] dump_stack_lvl+0x18c/0x250 [ 1435.881828][T13993] ? show_regs_print_info+0x20/0x20 [ 1435.887045][T13993] ? load_image+0x420/0x420 [ 1435.891573][T13993] ? __might_fault+0xaa/0x120 [ 1435.896281][T13993] ? __lock_acquire+0x7eb0/0x7eb0 [ 1435.901329][T13993] should_fail_ex+0x394/0x4c0 [ 1435.906403][T13993] _copy_from_user+0x2f/0xe0 [ 1435.911037][T13993] csum_and_copy_from_iter+0x1f3/0x1480 [ 1435.916635][T13993] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1435.922301][T13993] ? __kmem_cache_alloc_node+0x194/0x250 [ 1435.927968][T13993] ? __alloc_skb+0x138/0x2c0 [ 1435.932582][T13993] ? rcu_is_watching+0x15/0xb0 [ 1435.937372][T13993] ip_generic_getfrag+0x163/0x2f0 [ 1435.942427][T13993] ? ip_skb_dst_mtu+0x870/0x870 [ 1435.947310][T13993] ? __build_skb_around+0x245/0x3c0 [ 1435.952538][T13993] ? __alloc_skb+0x1b2/0x2c0 [ 1435.957153][T13993] ? skb_put+0x112/0x210 [ 1435.961426][T13993] __ip_append_data+0x2f3b/0x3bf0 [ 1435.966508][T13993] ? ip_skb_dst_mtu+0x870/0x870 [ 1435.971396][T13993] ? ip_setup_cork+0x840/0x840 [ 1435.976187][T13993] ? ip_setup_cork+0x527/0x840 [ 1435.980986][T13993] ip_make_skb+0x22b/0x440 [ 1435.985439][T13993] ? ip_skb_dst_mtu+0x870/0x870 [ 1435.990313][T13993] ? ip_flush_pending_frames+0x250/0x250 [ 1435.995977][T13993] ? mark_lock+0x94/0x320 [ 1436.000336][T13993] udp_sendmsg+0x1ae1/0x23d0 [ 1436.004975][T13993] ? ip_skb_dst_mtu+0x870/0x870 [ 1436.009854][T13993] ? udp_cmsg_send+0x350/0x350 [ 1436.014641][T13993] ? lock_chain_count+0x20/0x20 [ 1436.019515][T13993] ? finish_task_switch+0x262/0x8f0 [ 1436.024741][T13993] ? __schedule+0x15b6/0x4660 [ 1436.029454][T13993] udpv6_sendmsg+0x7a4/0x2390 [ 1436.034172][T13993] ? udp_v6_early_demux+0xf90/0xf90 [ 1436.039392][T13993] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1436.045426][T13993] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1436.051084][T13993] ? sock_rps_record_flow+0x19/0x3f0 [ 1436.056396][T13993] ? inet_send_prepare+0x5b/0x250 [ 1436.061448][T13993] ? inet6_sendmsg+0x5f/0xd0 [ 1436.066059][T13993] sock_write_iter+0x2dc/0x420 [ 1436.070851][T13993] ? sock_read_iter+0x3f0/0x3f0 [ 1436.075783][T13993] vfs_write+0x474/0x9a0 [ 1436.080076][T13993] ? file_end_write+0x250/0x250 [ 1436.084959][T13993] ? __fget_files+0x3fc/0x460 [ 1436.089669][T13993] ? __fdget_pos+0x1d8/0x330 [ 1436.094279][T13993] ? ksys_write+0x74/0x260 [ 1436.098719][T13993] ksys_write+0x151/0x260 [ 1436.103703][T13993] ? __ia32_sys_read+0x90/0x90 [ 1436.108510][T13993] ? lockdep_hardirqs_on+0x98/0x150 [ 1436.113742][T13993] do_syscall_64+0x55/0xb0 [ 1436.118178][T13993] ? clear_bhb_loop+0x40/0x90 [ 1436.122867][T13993] ? clear_bhb_loop+0x40/0x90 [ 1436.127565][T13993] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1436.133508][T13993] RIP: 0033:0x7f332bb9e559 [ 1436.137931][T13993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1436.157545][T13993] RSP: 002b:00007f3329dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1436.165955][T13993] RAX: ffffffffffffffda RBX: 00007f332be26180 RCX: 00007f332bb9e559 [ 1436.173930][T13993] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1436.181927][T13993] RBP: 00007f332bc358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1436.189902][T13993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1436.197866][T13993] R13: 00007f332be26218 R14: 00007f332be26180 R15: 00007ffe26130f88 [ 1436.205846][T13993] [ 1438.652153][T14007] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2163'. [ 1441.415688][T14016] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2167'. [ 1441.718459][ T5838] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1441.986708][ T5838] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1442.087453][ T5838] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1442.164631][ T5838] usb 2-1: Product: syz [ 1442.204435][ T5838] usb 2-1: SerialNumber: syz [ 1442.327478][ T5838] usb 2-1: config 0 descriptor?? [ 1442.632800][ T5838] hso 2-1:0.0: Failed to find BULK IN ep [ 1444.364190][ T5838] usb 2-1: USB disconnect, device number 37 [ 1444.607781][T14043] overlayfs: missing 'lowerdir' [ 1446.153658][T14046] jffs2: notice: (14046) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1448.020765][T14059] device-mapper: ioctl: only supply one of name or uuid, cmd(17) [ 1449.822528][T14071] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2176'. [ 1451.856906][T14075] overlayfs: missing 'lowerdir' [ 1454.118361][ T56] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1455.023905][ T56] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1455.045665][ T56] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1455.076174][ T56] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1455.108365][ T56] usb 4-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 1455.137945][ T56] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1455.164460][ T56] usb 4-1: config 0 descriptor?? [ 1455.614132][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 1455.621930][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 1455.629557][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 1455.640455][ T56] usbhid 4-1:0.0: can't add hid device: -32 [ 1455.648094][T14096] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2181'. [ 1455.858705][ T5839] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 1456.001248][ T27] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1456.174893][ T5839] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1456.279144][ T5839] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1456.328168][ T5839] usb 5-1: Product: syz [ 1456.338796][ T27] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1456.346052][ T56] usbhid: probe of 4-1:0.0 failed with error -32 [ 1456.358619][ T5839] usb 5-1: Manufacturer: syz [ 1456.358639][ T5839] usb 5-1: SerialNumber: syz [ 1456.367204][ T5839] usb 5-1: config 0 descriptor?? [ 1456.384612][ T27] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1456.398357][ T27] usb 2-1: Product: syz [ 1456.402603][ T27] usb 2-1: SerialNumber: syz [ 1456.405854][ T56] usb 4-1: USB disconnect, device number 25 [ 1456.439400][ T27] usb 2-1: config 0 descriptor?? [ 1456.607732][ T5839] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1456.659890][ T27] hso 2-1:0.0: Failed to find BULK IN ep [ 1457.951822][T14113] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2192'. [ 1458.819785][ T56] usb 2-1: USB disconnect, device number 38 [ 1458.872176][ T5839] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -32 [ 1459.038763][ T5839] usb 5-1: USB disconnect, device number 32 [ 1459.125151][T14117] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1459.134400][T14117] overlayfs: missing 'lowerdir' [ 1460.178913][T14133] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 1460.968819][ T5839] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1461.178426][ T5839] usb 5-1: Using ep0 maxpacket: 16 [ 1461.197789][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1461.235488][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1461.268326][ T5839] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1461.298429][ T5839] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1461.335720][ T5839] usb 5-1: config 0 descriptor?? [ 1461.757391][ T5839] usbhid 5-1:0.0: can't add hid device: -71 [ 1461.776535][ T5839] usbhid: probe of 5-1:0.0 failed with error -71 [ 1461.814464][ T5839] usb 5-1: USB disconnect, device number 33 [ 1462.794016][ T56] IPVS: starting estimator thread 0... [ 1462.898610][T14148] IPVS: using max 22 ests per chain, 52800 per kthread [ 1463.236145][T14160] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2202'. [ 1464.010598][T14161] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2204'. [ 1464.024417][T14161] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1464.198331][ T56] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1466.411761][T14167] netlink: 'syz.1.2206': attribute type 4 has an invalid length. [ 1466.419841][T14167] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2206'. [ 1467.292550][ T56] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1467.309335][ T56] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1467.326009][ T56] usb 5-1: Product: syz [ 1467.332473][ T56] usb 5-1: SerialNumber: syz [ 1467.344906][ T56] usb 5-1: config 0 descriptor?? [ 1467.447516][ T56] usb 5-1: USB disconnect, device number 34 [ 1468.242425][ T5839] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1468.468431][ T5839] usb 4-1: Using ep0 maxpacket: 16 [ 1468.540377][ T5839] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1468.571889][ T5839] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1468.636801][ T5839] usb 4-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1468.670064][ T5839] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1468.739226][ T5839] usb 4-1: config 0 descriptor?? [ 1469.213875][ T5839] usbhid 4-1:0.0: can't add hid device: -71 [ 1469.250886][ T5839] usbhid: probe of 4-1:0.0 failed with error -71 [ 1469.303618][ T5839] usb 4-1: USB disconnect, device number 26 [ 1471.547007][T14201] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2216'. [ 1474.037924][T14213] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1474.046958][T14213] overlayfs: missing 'lowerdir' [ 1478.763505][T14241] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2229'. [ 1478.776412][T14241] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1480.488862][ T56] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1481.007452][T14250] FAULT_INJECTION: forcing a failure. [ 1481.007452][T14250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1481.020898][T14250] CPU: 0 PID: 14250 Comm: syz.3.2232 Not tainted syzkaller #0 [ 1481.028383][T14250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1481.038466][T14250] Call Trace: [ 1481.041763][T14250] [ 1481.044716][T14250] dump_stack_lvl+0x18c/0x250 [ 1481.049425][T14250] ? show_regs_print_info+0x20/0x20 [ 1481.054646][T14250] ? load_image+0x420/0x420 [ 1481.059178][T14250] ? __might_fault+0xaa/0x120 [ 1481.063877][T14250] ? __lock_acquire+0x7eb0/0x7eb0 [ 1481.069442][T14250] ? __might_fault+0x9c/0x120 [ 1481.074141][T14250] should_fail_ex+0x394/0x4c0 [ 1481.078857][T14250] _copy_from_user+0x2f/0xe0 [ 1481.083472][T14250] csum_and_copy_from_iter+0x1f3/0x1480 [ 1481.089065][T14250] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1481.094733][T14250] ? __kmem_cache_alloc_node+0x194/0x250 [ 1481.100399][T14250] ? __alloc_skb+0x138/0x2c0 [ 1481.105016][T14250] ? rcu_is_watching+0x15/0xb0 [ 1481.109808][T14250] ip_generic_getfrag+0x163/0x2f0 [ 1481.114872][T14250] ? ip_skb_dst_mtu+0x870/0x870 [ 1481.119757][T14250] ? __build_skb_around+0x245/0x3c0 [ 1481.124985][T14250] ? __alloc_skb+0x1b2/0x2c0 [ 1481.129597][T14250] ? skb_put+0x112/0x210 [ 1481.133869][T14250] __ip_append_data+0x2f3b/0x3bf0 [ 1481.139004][T14250] ? ip_skb_dst_mtu+0x870/0x870 [ 1481.143897][T14250] ? ip_setup_cork+0x840/0x840 [ 1481.148690][T14250] ? ip_setup_cork+0x527/0x840 [ 1481.153478][T14250] ? trace_irq_disable+0x37/0xe0 [ 1481.158451][T14250] ip_make_skb+0x22b/0x440 [ 1481.162903][T14250] ? ip_skb_dst_mtu+0x870/0x870 [ 1481.167780][T14250] ? ip_flush_pending_frames+0x250/0x250 [ 1481.173468][T14250] udp_sendmsg+0x1ae1/0x23d0 [ 1481.178101][T14250] ? ip_skb_dst_mtu+0x870/0x870 [ 1481.182978][T14250] ? udp_cmsg_send+0x350/0x350 [ 1481.187764][T14250] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1481.193764][T14250] ? read_lock_is_recursive+0x20/0x20 [ 1481.199168][T14250] ? finish_task_switch+0x262/0x8f0 [ 1481.204422][T14250] udpv6_sendmsg+0x7a4/0x2390 [ 1481.209132][T14250] ? asan.module_dtor+0x20/0x20 [ 1481.214016][T14250] ? udp_v6_early_demux+0xf90/0xf90 [ 1481.219260][T14250] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1481.224916][T14250] ? lockdep_hardirqs_on+0x98/0x150 [ 1481.230143][T14250] ? sock_rps_record_flow+0x19/0x3f0 [ 1481.235454][T14250] ? inet_send_prepare+0x5b/0x250 [ 1481.240504][T14250] ? inet6_sendmsg+0x5f/0xd0 [ 1481.245123][T14250] sock_write_iter+0x2dc/0x420 [ 1481.249919][T14250] ? sock_read_iter+0x3f0/0x3f0 [ 1481.254793][T14250] ? lockdep_hardirqs_on+0x98/0x150 [ 1481.260030][T14250] vfs_write+0x474/0x9a0 [ 1481.264307][T14250] ? file_end_write+0x250/0x250 [ 1481.269190][T14250] ? __fget_files+0x3fc/0x460 [ 1481.273900][T14250] ? __fdget_pos+0x1d8/0x330 [ 1481.278509][T14250] ? ksys_write+0x74/0x260 [ 1481.282953][T14250] ksys_write+0x151/0x260 [ 1481.287335][T14250] ? __ia32_sys_read+0x90/0x90 [ 1481.292137][T14250] ? lockdep_hardirqs_on+0x98/0x150 [ 1481.297369][T14250] do_syscall_64+0x55/0xb0 [ 1481.302007][T14250] ? clear_bhb_loop+0x40/0x90 [ 1481.306711][T14250] ? clear_bhb_loop+0x40/0x90 [ 1481.311425][T14250] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1481.317378][T14250] RIP: 0033:0x7effaa19e559 [ 1481.321853][T14250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1481.341475][T14250] RSP: 002b:00007effab10a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1481.349895][T14250] RAX: ffffffffffffffda RBX: 00007effaa426180 RCX: 00007effaa19e559 [ 1481.357862][T14250] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1481.365827][T14250] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1481.373813][T14250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1481.381804][T14250] R13: 00007effaa426218 R14: 00007effaa426180 R15: 00007ffeb00bd348 [ 1481.389793][T14250] [ 1482.208989][T14255] netlink: 'syz.1.2217': attribute type 4 has an invalid length. [ 1482.216884][T14255] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2217'. [ 1486.004105][T14280] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2240'. [ 1487.411763][T14285] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2242'. [ 1487.464636][T14287] FAULT_INJECTION: forcing a failure. [ 1487.464636][T14287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1487.477984][T14287] CPU: 0 PID: 14287 Comm: syz.3.2241 Not tainted syzkaller #0 [ 1487.485486][T14287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1487.495572][T14287] Call Trace: [ 1487.498864][T14287] [ 1487.501838][T14287] dump_stack_lvl+0x18c/0x250 [ 1487.506540][T14287] ? show_regs_print_info+0x20/0x20 [ 1487.511756][T14287] ? load_image+0x420/0x420 [ 1487.516283][T14287] ? __might_fault+0xaa/0x120 [ 1487.520981][T14287] ? __lock_acquire+0x7eb0/0x7eb0 [ 1487.526022][T14287] ? udp_sendmsg+0x1ae1/0x23d0 [ 1487.530809][T14287] ? __virt_addr_valid+0x10c/0x380 [ 1487.535947][T14287] should_fail_ex+0x394/0x4c0 [ 1487.540652][T14287] _copy_from_user+0x2f/0xe0 [ 1487.545265][T14287] csum_and_copy_from_iter+0x1f3/0x1480 [ 1487.550852][T14287] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1487.556516][T14287] ? __kmem_cache_alloc_node+0x194/0x250 [ 1487.562178][T14287] ? __alloc_skb+0x138/0x2c0 [ 1487.566785][T14287] ? rcu_is_watching+0x15/0xb0 [ 1487.571573][T14287] ip_generic_getfrag+0x163/0x2f0 [ 1487.576621][T14287] ? ip_skb_dst_mtu+0x870/0x870 [ 1487.581502][T14287] ? __build_skb_around+0x245/0x3c0 [ 1487.586732][T14287] ? __alloc_skb+0x1b2/0x2c0 [ 1487.591345][T14287] ? skb_put+0x112/0x210 [ 1487.595616][T14287] __ip_append_data+0x2f3b/0x3bf0 [ 1487.600688][T14287] ? ip_skb_dst_mtu+0x870/0x870 [ 1487.605572][T14287] ? ip_setup_cork+0x840/0x840 [ 1487.610359][T14287] ? ip_setup_cork+0x527/0x840 [ 1487.615144][T14287] ip_make_skb+0x22b/0x440 [ 1487.619595][T14287] ? ip_skb_dst_mtu+0x870/0x870 [ 1487.624471][T14287] ? ip_flush_pending_frames+0x250/0x250 [ 1487.630152][T14287] udp_sendmsg+0x1ae1/0x23d0 [ 1487.634780][T14287] ? ip_skb_dst_mtu+0x870/0x870 [ 1487.639653][T14287] ? udp_cmsg_send+0x350/0x350 [ 1487.644615][T14287] ? lock_chain_count+0x20/0x20 [ 1487.649492][T14287] ? finish_task_switch+0x262/0x8f0 [ 1487.654740][T14287] ? __schedule+0x15b6/0x4660 [ 1487.659449][T14287] udpv6_sendmsg+0x7a4/0x2390 [ 1487.664163][T14287] ? udp_v6_early_demux+0xf90/0xf90 [ 1487.669384][T14287] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1487.675427][T14287] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1487.681080][T14287] ? sock_rps_record_flow+0x19/0x3f0 [ 1487.686382][T14287] ? inet_send_prepare+0x5b/0x250 [ 1487.691433][T14287] ? inet6_sendmsg+0x5f/0xd0 [ 1487.696049][T14287] sock_write_iter+0x2dc/0x420 [ 1487.700844][T14287] ? sock_read_iter+0x3f0/0x3f0 [ 1487.705739][T14287] ? vfs_write+0x3c1/0x9a0 [ 1487.710184][T14287] vfs_write+0x474/0x9a0 [ 1487.714451][T14287] ? file_end_write+0x250/0x250 [ 1487.719329][T14287] ? __fget_files+0x3fc/0x460 [ 1487.724035][T14287] ? __fdget_pos+0x1d8/0x330 [ 1487.728642][T14287] ? ksys_write+0x74/0x260 [ 1487.733081][T14287] ksys_write+0x151/0x260 [ 1487.737439][T14287] ? __ia32_sys_read+0x90/0x90 [ 1487.742225][T14287] ? lockdep_hardirqs_on+0x98/0x150 [ 1487.747416][T14287] do_syscall_64+0x55/0xb0 [ 1487.751840][T14287] ? clear_bhb_loop+0x40/0x90 [ 1487.756510][T14287] ? clear_bhb_loop+0x40/0x90 [ 1487.761199][T14287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1487.767086][T14287] RIP: 0033:0x7effaa19e559 [ 1487.771504][T14287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1487.791627][T14287] RSP: 002b:00007effab10a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1487.800034][T14287] RAX: ffffffffffffffda RBX: 00007effaa426180 RCX: 00007effaa19e559 [ 1487.807999][T14287] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1487.815960][T14287] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1487.823924][T14287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1487.831895][T14287] R13: 00007effaa426218 R14: 00007effaa426180 R15: 00007ffeb00bd348 [ 1487.839874][T14287] [ 1489.293375][ T5838] IPVS: starting estimator thread 0... [ 1489.419686][T14297] IPVS: using max 21 ests per chain, 50400 per kthread [ 1490.003386][ T5907] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1490.402277][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1490.408735][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1491.628640][T14309] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2250'. [ 1493.499695][T14325] FAULT_INJECTION: forcing a failure. [ 1493.499695][T14325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1493.513807][T14325] CPU: 0 PID: 14325 Comm: syz.3.2251 Not tainted syzkaller #0 [ 1493.521307][T14325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1493.531395][T14325] Call Trace: [ 1493.534699][T14325] [ 1493.537733][T14325] dump_stack_lvl+0x18c/0x250 [ 1493.542441][T14325] ? show_regs_print_info+0x20/0x20 [ 1493.547659][T14325] ? load_image+0x420/0x420 [ 1493.552189][T14325] ? __might_fault+0xaa/0x120 [ 1493.556888][T14325] ? __lock_acquire+0x7eb0/0x7eb0 [ 1493.561929][T14325] ? udp_sendmsg+0x1ae1/0x23d0 [ 1493.566723][T14325] ? __virt_addr_valid+0x10c/0x380 [ 1493.571873][T14325] should_fail_ex+0x394/0x4c0 [ 1493.576594][T14325] _copy_from_user+0x2f/0xe0 [ 1493.581218][T14325] csum_and_copy_from_iter+0x1f3/0x1480 [ 1493.586809][T14325] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1493.592480][T14325] ? __kmem_cache_alloc_node+0x194/0x250 [ 1493.598144][T14325] ? __alloc_skb+0x138/0x2c0 [ 1493.602753][T14325] ? rcu_is_watching+0x15/0xb0 [ 1493.607545][T14325] ip_generic_getfrag+0x163/0x2f0 [ 1493.612596][T14325] ? ip_skb_dst_mtu+0x870/0x870 [ 1493.617469][T14325] ? __build_skb_around+0x245/0x3c0 [ 1493.622702][T14325] ? __alloc_skb+0x1b2/0x2c0 [ 1493.627324][T14325] ? skb_put+0x112/0x210 [ 1493.630279][ T27] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1493.631583][T14325] __ip_append_data+0x2f3b/0x3bf0 [ 1493.644208][T14325] ? ip_skb_dst_mtu+0x870/0x870 [ 1493.649107][T14325] ? ip_setup_cork+0x840/0x840 [ 1493.653887][T14325] ? ip_setup_cork+0x527/0x840 [ 1493.658656][T14325] ip_make_skb+0x22b/0x440 [ 1493.663090][T14325] ? ip_skb_dst_mtu+0x870/0x870 [ 1493.667951][T14325] ? ip_flush_pending_frames+0x250/0x250 [ 1493.673611][T14325] udp_sendmsg+0x1ae1/0x23d0 [ 1493.678223][T14325] ? ip_skb_dst_mtu+0x870/0x870 [ 1493.683082][T14325] ? udp_cmsg_send+0x350/0x350 [ 1493.687882][T14325] ? lock_chain_count+0x20/0x20 [ 1493.692758][T14325] ? finish_task_switch+0x262/0x8f0 [ 1493.697968][T14325] ? requeue_task_rt+0x400/0x400 [ 1493.702919][T14325] ? __schedule+0x15b6/0x4660 [ 1493.707612][T14325] udpv6_sendmsg+0x7a4/0x2390 [ 1493.712306][T14325] ? udp_v6_early_demux+0xf90/0xf90 [ 1493.717510][T14325] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1493.723509][T14325] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1493.729152][T14325] ? sock_rps_record_flow+0x19/0x3f0 [ 1493.734463][T14325] ? inet_send_prepare+0x5b/0x250 [ 1493.739500][T14325] ? inet6_sendmsg+0x5f/0xd0 [ 1493.744095][T14325] sock_write_iter+0x2dc/0x420 [ 1493.748875][T14325] ? sock_read_iter+0x3f0/0x3f0 [ 1493.753742][T14325] ? common_file_perm+0x198/0x1f0 [ 1493.758779][T14325] vfs_write+0x474/0x9a0 [ 1493.763042][T14325] ? file_end_write+0x250/0x250 [ 1493.767897][T14325] ? __fget_files+0x3fc/0x460 [ 1493.773129][T14325] ? __fdget_pos+0x1d8/0x330 [ 1493.777742][T14325] ? ksys_write+0x74/0x260 [ 1493.782175][T14325] ksys_write+0x151/0x260 [ 1493.786517][T14325] ? __ia32_sys_read+0x90/0x90 [ 1493.791292][T14325] ? lockdep_hardirqs_on+0x98/0x150 [ 1493.796496][T14325] do_syscall_64+0x55/0xb0 [ 1493.800911][T14325] ? clear_bhb_loop+0x40/0x90 [ 1493.805590][T14325] ? clear_bhb_loop+0x40/0x90 [ 1493.810276][T14325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1493.816174][T14325] RIP: 0033:0x7effaa19e559 [ 1493.820587][T14325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1493.840199][T14325] RSP: 002b:00007effab10a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1493.848618][T14325] RAX: ffffffffffffffda RBX: 00007effaa426180 RCX: 00007effaa19e559 [ 1493.856615][T14325] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1493.864587][T14325] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1493.872560][T14325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1493.880542][T14325] R13: 00007effaa426218 R14: 00007effaa426180 R15: 00007ffeb00bd348 [ 1493.888527][T14325] [ 1493.895266][T14326] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2252'. [ 1494.828305][ T27] usb 5-1: Using ep0 maxpacket: 16 [ 1494.837352][ T27] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1494.856226][ T27] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1494.911644][T12688] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1495.069379][ T28] audit: type=1800 audit(1792119486.244:79): pid=14334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2254" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1495.621776][T12688] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1495.634717][ T27] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1495.648785][T12688] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1495.657445][ T27] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1495.697794][T12688] usb 1-1: Product: syz [ 1495.706197][T12688] usb 1-1: SerialNumber: syz [ 1495.721286][ T27] usb 5-1: config 0 descriptor?? [ 1495.750953][T12688] usb 1-1: config 0 descriptor?? [ 1495.757357][T12688] usb 1-1: can't set config #0, error -71 [ 1495.763771][ T27] usb 5-1: can't set config #0, error -71 [ 1495.790402][ T27] usb 5-1: USB disconnect, device number 35 [ 1495.800149][T12688] usb 1-1: USB disconnect, device number 33 [ 1495.898604][T14342] FAULT_INJECTION: forcing a failure. [ 1495.898604][T14342] name failslab, interval 1, probability 0, space 0, times 0 [ 1495.962038][T14342] CPU: 1 PID: 14342 Comm: syz.3.2256 Not tainted syzkaller #0 [ 1495.969557][T14342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1495.979643][T14342] Call Trace: [ 1495.982953][T14342] [ 1495.985906][T14342] dump_stack_lvl+0x18c/0x250 [ 1495.990619][T14342] ? show_regs_print_info+0x20/0x20 [ 1495.995842][T14342] ? load_image+0x420/0x420 [ 1496.000384][T14342] ? __lock_acquire+0x7eb0/0x7eb0 [ 1496.005457][T14342] should_fail_ex+0x394/0x4c0 [ 1496.010168][T14342] should_failslab+0x9/0x20 [ 1496.014699][T14342] slab_pre_alloc_hook+0x59/0x300 [ 1496.019745][T14342] ? key_alloc+0x34a/0x1030 [ 1496.024273][T14342] ? key_alloc+0x34a/0x1030 [ 1496.028800][T14342] __kmem_cache_alloc_node+0x53/0x250 [ 1496.034205][T14342] ? slab_post_alloc_hook+0x86/0x4d0 [ 1496.039516][T14342] ? key_alloc+0x34a/0x1030 [ 1496.044047][T14342] __kmalloc_node_track_caller+0xa4/0x230 [ 1496.049806][T14342] kmemdup+0x2b/0x70 [ 1496.053729][T14342] key_alloc+0x34a/0x1030 [ 1496.058093][T14342] keyring_alloc+0x45/0xb0 [ 1496.062570][T14342] lookup_user_key+0x428/0x1140 [ 1496.067461][T14342] ? lookup_user_key_possessed+0x40/0x40 [ 1496.073116][T14342] ? do_futex+0x2ff/0x3e0 [ 1496.077478][T14342] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 1496.083490][T14342] ? strncpy_from_user+0x1a1/0x2f0 [ 1496.088638][T14342] __se_sys_add_key+0x315/0x410 [ 1496.093526][T14342] ? __x64_sys_add_key+0xc0/0xc0 [ 1496.098524][T14342] ? lockdep_hardirqs_on+0x98/0x150 [ 1496.103747][T14342] ? __x64_sys_add_key+0x20/0xc0 [ 1496.108725][T14342] do_syscall_64+0x55/0xb0 [ 1496.113257][T14342] ? clear_bhb_loop+0x40/0x90 [ 1496.117951][T14342] ? clear_bhb_loop+0x40/0x90 [ 1496.122650][T14342] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1496.128576][T14342] RIP: 0033:0x7effaa19e559 [ 1496.133012][T14342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1496.152645][T14342] RSP: 002b:00007effab14c028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1496.161089][T14342] RAX: ffffffffffffffda RBX: 00007effaa425fa0 RCX: 00007effaa19e559 [ 1496.169084][T14342] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 [ 1496.177077][T14342] RBP: 00007effaa2358b0 R08: ffffffffffffffff R09: 0000000000000000 [ 1496.185073][T14342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1496.193073][T14342] R13: 00007effaa426038 R14: 00007effaa425fa0 R15: 00007ffeb00bd348 [ 1496.201090][T14342] [ 1498.141991][T14360] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1498.151019][T14360] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1498.174259][T14361] FAULT_INJECTION: forcing a failure. [ 1498.174259][T14361] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1498.187520][T14361] CPU: 1 PID: 14361 Comm: syz.4.2262 Not tainted syzkaller #0 [ 1498.195005][T14361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1498.205078][T14361] Call Trace: [ 1498.208372][T14361] [ 1498.211317][T14361] dump_stack_lvl+0x18c/0x250 [ 1498.216017][T14361] ? show_regs_print_info+0x20/0x20 [ 1498.221232][T14361] ? load_image+0x420/0x420 [ 1498.225763][T14361] ? __might_fault+0xaa/0x120 [ 1498.230458][T14361] ? __lock_acquire+0x7eb0/0x7eb0 [ 1498.235499][T14361] ? udp_sendmsg+0x1ae1/0x23d0 [ 1498.240290][T14361] ? __virt_addr_valid+0x10c/0x380 [ 1498.245426][T14361] should_fail_ex+0x394/0x4c0 [ 1498.250133][T14361] _copy_from_user+0x2f/0xe0 [ 1498.254741][T14361] csum_and_copy_from_iter+0x1f3/0x1480 [ 1498.260330][T14361] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1498.265990][T14361] ? __kmem_cache_alloc_node+0x194/0x250 [ 1498.271652][T14361] ? __alloc_skb+0x138/0x2c0 [ 1498.276263][T14361] ? rcu_is_watching+0x15/0xb0 [ 1498.281050][T14361] ip_generic_getfrag+0x163/0x2f0 [ 1498.286100][T14361] ? ip_skb_dst_mtu+0x870/0x870 [ 1498.290970][T14361] ? __build_skb_around+0x245/0x3c0 [ 1498.296190][T14361] ? __alloc_skb+0x1b2/0x2c0 [ 1498.300800][T14361] ? skb_put+0x112/0x210 [ 1498.305064][T14361] __ip_append_data+0x2f3b/0x3bf0 [ 1498.310135][T14361] ? ip_skb_dst_mtu+0x870/0x870 [ 1498.315018][T14361] ? ip_setup_cork+0x840/0x840 [ 1498.319803][T14361] ? ip_setup_cork+0x527/0x840 [ 1498.324593][T14361] ip_make_skb+0x22b/0x440 [ 1498.329046][T14361] ? ip_skb_dst_mtu+0x870/0x870 [ 1498.333922][T14361] ? ip_flush_pending_frames+0x250/0x250 [ 1498.339578][T14361] ? lockdep_hardirqs_on+0x98/0x150 [ 1498.344802][T14361] ? ip_skb_dst_mtu+0x870/0x870 [ 1498.349668][T14361] udp_sendmsg+0x1ae1/0x23d0 [ 1498.354364][T14361] ? ip_skb_dst_mtu+0x870/0x870 [ 1498.359223][T14361] ? udp_cmsg_send+0x350/0x350 [ 1498.364006][T14361] ? lockdep_hardirqs_on+0x98/0x150 [ 1498.369206][T14361] ? aa_label_sk_perm+0x55f/0x6a0 [ 1498.374248][T14361] ? lock_chain_count+0x20/0x20 [ 1498.379480][T14361] udpv6_sendmsg+0x7a4/0x2390 [ 1498.384608][T14361] ? __might_sleep+0xe0/0xe0 [ 1498.389210][T14361] ? udp_v6_early_demux+0xf90/0xf90 [ 1498.394447][T14361] ? aa_af_perm+0x330/0x330 [ 1498.398951][T14361] ? sock_rps_record_flow+0x19/0x3f0 [ 1498.404233][T14361] ? inet_send_prepare+0x5b/0x250 [ 1498.409277][T14361] ? inet6_sendmsg+0x5f/0xd0 [ 1498.413901][T14361] sock_write_iter+0x2dc/0x420 [ 1498.418691][T14361] ? sock_read_iter+0x3f0/0x3f0 [ 1498.423574][T14361] ? lockdep_hardirqs_on+0x98/0x150 [ 1498.428800][T14361] vfs_write+0x474/0x9a0 [ 1498.433042][T14361] ? file_end_write+0x250/0x250 [ 1498.437949][T14361] ? __fget_files+0x3fc/0x460 [ 1498.442630][T14361] ? __fdget_pos+0x1d8/0x330 [ 1498.447214][T14361] ? ksys_write+0x74/0x260 [ 1498.451626][T14361] ksys_write+0x151/0x260 [ 1498.455974][T14361] ? __ia32_sys_read+0x90/0x90 [ 1498.460734][T14361] ? lockdep_hardirqs_on+0x98/0x150 [ 1498.465927][T14361] do_syscall_64+0x55/0xb0 [ 1498.470349][T14361] ? clear_bhb_loop+0x40/0x90 [ 1498.475018][T14361] ? clear_bhb_loop+0x40/0x90 [ 1498.479685][T14361] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1498.485578][T14361] RIP: 0033:0x7ff531d9e559 [ 1498.489981][T14361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1498.509587][T14361] RSP: 002b:00007ff532ce8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1498.517997][T14361] RAX: ffffffffffffffda RBX: 00007ff532026180 RCX: 00007ff531d9e559 [ 1498.525980][T14361] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1498.533967][T14361] RBP: 00007ff531e358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1498.541935][T14361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1498.549918][T14361] R13: 00007ff532026218 R14: 00007ff532026180 R15: 00007fff299e87f8 [ 1498.557892][T14361] [ 1499.359853][ T5907] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1499.852118][T14379] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2266'. [ 1501.304100][ T5907] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1501.308345][ T28] audit: type=1800 audit(1792119491.124:80): pid=14378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2265" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1502.873857][ T56] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1503.419543][T14400] FAULT_INJECTION: forcing a failure. [ 1503.419543][T14400] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.432733][T14400] CPU: 0 PID: 14400 Comm: syz.1.2273 Not tainted syzkaller #0 [ 1503.440218][T14400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1503.450288][T14400] Call Trace: [ 1503.453585][T14400] [ 1503.456542][T14400] dump_stack_lvl+0x18c/0x250 [ 1503.461250][T14400] ? show_regs_print_info+0x20/0x20 [ 1503.466469][T14400] ? load_image+0x420/0x420 [ 1503.470999][T14400] ? __might_fault+0xaa/0x120 [ 1503.475695][T14400] ? __lock_acquire+0x7eb0/0x7eb0 [ 1503.480735][T14400] ? udp_sendmsg+0x1ae1/0x23d0 [ 1503.485519][T14400] ? __virt_addr_valid+0x10c/0x380 [ 1503.490657][T14400] should_fail_ex+0x394/0x4c0 [ 1503.495369][T14400] _copy_from_user+0x2f/0xe0 [ 1503.499983][T14400] csum_and_copy_from_iter+0x1f3/0x1480 [ 1503.505585][T14400] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1503.511246][T14400] ? __kmem_cache_alloc_node+0x194/0x250 [ 1503.516909][T14400] ? __alloc_skb+0x138/0x2c0 [ 1503.521521][T14400] ? rcu_is_watching+0x15/0xb0 [ 1503.526316][T14400] ip_generic_getfrag+0x163/0x2f0 [ 1503.531376][T14400] ? ip_skb_dst_mtu+0x870/0x870 [ 1503.536433][T14400] ? __build_skb_around+0x245/0x3c0 [ 1503.541658][T14400] ? __alloc_skb+0x1b2/0x2c0 [ 1503.546357][T14400] ? skb_put+0x112/0x210 [ 1503.550630][T14400] __ip_append_data+0x2f3b/0x3bf0 [ 1503.555708][T14400] ? ip_skb_dst_mtu+0x870/0x870 [ 1503.560600][T14400] ? ip_setup_cork+0x840/0x840 [ 1503.565393][T14400] ? ip_setup_cork+0x527/0x840 [ 1503.570183][T14400] ip_make_skb+0x22b/0x440 [ 1503.574629][T14400] ? ip_skb_dst_mtu+0x870/0x870 [ 1503.579505][T14400] ? ip_flush_pending_frames+0x250/0x250 [ 1503.585183][T14400] udp_sendmsg+0x1ae1/0x23d0 [ 1503.589810][T14400] ? ip_skb_dst_mtu+0x870/0x870 [ 1503.594692][T14400] ? udp_cmsg_send+0x350/0x350 [ 1503.599479][T14400] ? lock_chain_count+0x20/0x20 [ 1503.604350][T14400] ? finish_task_switch+0x262/0x8f0 [ 1503.609575][T14400] ? __schedule+0x15b6/0x4660 [ 1503.614289][T14400] udpv6_sendmsg+0x7a4/0x2390 [ 1503.619018][T14400] ? udp_v6_early_demux+0xf90/0xf90 [ 1503.624239][T14400] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1503.630259][T14400] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1503.635916][T14400] ? inet6_sendmsg+0x56/0xd0 [ 1503.640530][T14400] ? audit_tree_destroy_watch+0x20/0x20 [ 1503.646096][T14400] ? inet6_sendmsg+0x5f/0xd0 [ 1503.650705][T14400] sock_write_iter+0x2dc/0x420 [ 1503.655495][T14400] ? sock_read_iter+0x3f0/0x3f0 [ 1503.660391][T14400] vfs_write+0x474/0x9a0 [ 1503.664666][T14400] ? file_end_write+0x250/0x250 [ 1503.669563][T14400] ? __fget_files+0x3fc/0x460 [ 1503.674286][T14400] ? __fdget_pos+0x1d8/0x330 [ 1503.678769][T12688] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1503.678893][T14400] ? ksys_write+0x74/0x260 [ 1503.690890][T14400] ksys_write+0x151/0x260 [ 1503.695261][T14400] ? __ia32_sys_read+0x90/0x90 [ 1503.700055][T14400] ? lockdep_hardirqs_on+0x98/0x150 [ 1503.705296][T14400] do_syscall_64+0x55/0xb0 [ 1503.709719][T14400] ? clear_bhb_loop+0x40/0x90 [ 1503.714400][T14400] ? clear_bhb_loop+0x40/0x90 [ 1503.719077][T14400] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1503.724982][T14400] RIP: 0033:0x7f332bb9e559 [ 1503.729399][T14400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1503.749023][T14400] RSP: 002b:00007f3329dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1503.757445][T14400] RAX: ffffffffffffffda RBX: 00007f332be26180 RCX: 00007f332bb9e559 [ 1503.765433][T14400] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1503.773411][T14400] RBP: 00007f332bc358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1503.781410][T14400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1503.789388][T14400] R13: 00007f332be26218 R14: 00007f332be26180 R15: 00007ffe26130f88 [ 1503.797380][T14400] [ 1504.376744][ T5783] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 1504.504873][T12688] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1504.520148][T12688] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1504.532941][T12688] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1504.550371][T12688] usb 4-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 1504.560109][T12688] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1504.573172][T12688] usb 4-1: config 0 descriptor?? [ 1504.698392][ T9402] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1504.888450][ T9402] usb 1-1: Using ep0 maxpacket: 32 [ 1504.895516][ T9402] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 1504.903951][ T9402] usb 1-1: config 0 has no interface number 0 [ 1504.910327][ T5839] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 1504.919102][ T9402] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1504.933121][ T9402] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1504.943939][ T9402] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1504.952476][ T9402] usb 1-1: Product: syz [ 1504.956791][ T9402] usb 1-1: Manufacturer: syz [ 1504.962039][ T9402] usb 1-1: SerialNumber: syz [ 1504.975793][ T9402] usb 1-1: config 0 descriptor?? [ 1504.983215][T14405] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1504.992959][T12688] usbhid 4-1:0.0: can't add hid device: -71 [ 1505.003508][T12688] usbhid: probe of 4-1:0.0 failed with error -71 [ 1505.019645][T12688] usb 4-1: USB disconnect, device number 27 [ 1505.099679][T14413] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2278'. [ 1505.290884][T14405] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1505.800532][ T56] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1505.857594][ T9402] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1505.868153][ T9402] asix: probe of 1-1:0.188 failed with error -71 [ 1505.878339][ T5839] usb 5-1: Using ep0 maxpacket: 16 [ 1505.884231][ T9402] usb 1-1: USB disconnect, device number 34 [ 1505.892553][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1505.908999][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1505.922864][ T5839] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1505.932036][ T5839] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1505.957475][ T5839] usb 5-1: config 0 descriptor?? [ 1506.042897][ T56] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1506.058526][ T56] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1506.078520][ T56] usb 2-1: Product: syz [ 1506.093239][ T56] usb 2-1: SerialNumber: syz [ 1506.112538][ T56] usb 2-1: config 0 descriptor?? [ 1507.975160][ T5839] usbhid 5-1:0.0: can't add hid device: -71 [ 1507.993460][ T5839] usbhid: probe of 5-1:0.0 failed with error -71 [ 1508.014241][ T5839] usb 5-1: USB disconnect, device number 36 [ 1509.128798][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1509.158344][ T56] usb 2-1: USB disconnect, device number 40 [ 1513.509867][T14462] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2293'. [ 1516.458329][ T5839] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1516.711822][ T5839] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1516.725440][T13702] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1516.735101][ T5839] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1516.736351][T13702] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1516.754872][ T5839] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1516.767890][T13702] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1516.775264][ T5839] usb 2-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 1516.784695][ T5839] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1516.801173][ T5839] usb 2-1: config 0 descriptor?? [ 1516.806241][T13702] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1516.819168][T13702] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1516.832994][T13702] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1516.942912][ T60] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1517.091844][ T60] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1517.127676][T14482] rxe_eth0 speed is unknown, defaulting to 1000 [ 1517.216178][ T60] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1517.469945][ T5839] usbhid 2-1:0.0: can't add hid device: -71 [ 1517.486447][ T5839] usbhid: probe of 2-1:0.0 failed with error -71 [ 1517.540174][ T60] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1517.627053][T14491] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1517.636373][T14491] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1517.725012][T14492] fuse: Bad value for 'fd' [ 1518.116844][ T5839] usb 2-1: USB disconnect, device number 41 [ 1518.564211][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1518.648382][ T5839] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1518.683736][T14482] chnl_net:caif_netlink_parms(): no params data found [ 1518.848491][ T5839] usb 5-1: Using ep0 maxpacket: 16 [ 1518.858064][T14482] bridge0: port 1(bridge_slave_0) entered blocking state [ 1518.866339][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1518.879753][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1518.887805][ T5783] Bluetooth: hci0: command tx timeout [ 1518.893333][ T5839] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1518.914319][T14482] bridge0: port 1(bridge_slave_0) entered disabled state [ 1518.928676][T14482] bridge_slave_0: entered allmulticast mode [ 1518.944891][ T5839] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1518.954744][T14482] bridge_slave_0: entered promiscuous mode [ 1518.999353][ T5839] usb 5-1: config 0 descriptor?? [ 1519.016783][T14482] bridge0: port 2(bridge_slave_1) entered blocking state [ 1519.064587][T14482] bridge0: port 2(bridge_slave_1) entered disabled state [ 1519.083334][T14482] bridge_slave_1: entered allmulticast mode [ 1519.120233][T14482] bridge_slave_1: entered promiscuous mode [ 1519.282633][T14482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1520.421734][T14482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1520.478754][ T56] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1520.497910][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1520.570462][ T5839] usbhid 5-1:0.0: can't add hid device: -71 [ 1520.576507][ T5839] usbhid: probe of 5-1:0.0 failed with error -71 [ 1520.597228][ T5839] usb 5-1: USB disconnect, device number 37 [ 1520.627089][T14482] team0: Port device team_slave_0 added [ 1520.647178][T14482] team0: Port device team_slave_1 added [ 1520.705459][T14482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1520.713454][T14482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1520.738360][ T9554] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1520.740849][T14482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1520.789653][T14482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1520.796645][T14482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1520.863788][T14482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1520.942212][ T9554] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1520.958309][ T5783] Bluetooth: hci0: command tx timeout [ 1520.962803][T14482] hsr_slave_0: entered promiscuous mode [ 1520.970350][ T9554] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1520.980384][ T9554] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1520.995006][T14482] hsr_slave_1: entered promiscuous mode [ 1521.004906][ T9554] usb 2-1: New USB device found, idVendor=05ac, idProduct=026c, bcdDevice= 0.00 [ 1521.018335][ T9554] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1521.026535][T14482] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1521.046960][T14482] Cannot create hsr debugfs directory [ 1521.047048][ T9554] usb 2-1: config 0 descriptor?? [ 1522.656576][ T9554] usbhid 2-1:0.0: can't add hid device: -71 [ 1522.663092][ T9554] usbhid: probe of 2-1:0.0 failed with error -71 [ 1522.672414][ T9554] usb 2-1: USB disconnect, device number 42 [ 1522.907544][ T60] hsr_slave_0: left promiscuous mode [ 1522.946469][ T60] hsr_slave_1: left promiscuous mode [ 1522.974626][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1522.984211][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1523.000373][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1523.016787][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1523.035147][ T60] bridge_slave_1: left allmulticast mode [ 1523.041230][ T5783] Bluetooth: hci0: command tx timeout [ 1523.057208][ T60] bridge_slave_1: left promiscuous mode [ 1523.090696][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 1523.166569][ T60] bridge_slave_0: left allmulticast mode [ 1523.178685][ T60] bridge_slave_0: left promiscuous mode [ 1523.218523][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 1523.347318][ T60] veth1_macvtap: left promiscuous mode [ 1523.359121][ T60] veth0_macvtap: left promiscuous mode [ 1523.364806][ T60] veth1_vlan: left promiscuous mode [ 1523.388710][ T60] veth0_vlan: left promiscuous mode [ 1525.230048][ T5783] Bluetooth: hci0: command tx timeout [ 1526.325757][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1527.239202][ T60] team0 (unregistering): Port device team_slave_1 removed [ 1527.788864][ T60] team0 (unregistering): Port device team_slave_0 removed [ 1528.077872][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1528.158486][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1529.195605][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1530.397045][T14605] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 1531.141658][ T60] bond0 (unregistering): Released all slaves [ 1531.439989][T14583] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2317'. [ 1532.005185][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1533.409321][ T28] audit: type=1800 audit(1792119523.941:81): pid=14627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2331" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1534.798915][ T5839] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1534.900806][ T60] IPVS: stop unused estimator thread 0... [ 1534.998316][ T5839] usb 5-1: Using ep0 maxpacket: 16 [ 1535.020587][ T5839] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1535.066071][T14482] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1535.101261][ T5839] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1535.151139][T14482] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1535.188486][ T5839] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1535.233475][T14482] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1535.252972][ T5839] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1535.297828][T14482] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1535.312465][ T5839] usb 5-1: config 0 descriptor?? [ 1535.722611][T14482] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1535.803278][T14482] 8021q: adding VLAN 0 to HW filter on device team0 [ 1535.851192][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 1535.858391][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1535.905535][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 1535.912713][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1535.982024][ T5839] usbhid 5-1:0.0: can't add hid device: -71 [ 1535.993436][ T5839] usbhid: probe of 5-1:0.0 failed with error -71 [ 1536.070362][ T5839] usb 5-1: USB disconnect, device number 38 [ 1536.148990][T14654] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2336'. [ 1536.162834][T14654] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1537.759321][ T9554] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1538.133575][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1538.184934][T14482] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1538.214624][T14676] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2341'. [ 1538.344097][T14482] veth0_vlan: entered promiscuous mode [ 1538.374945][T14482] veth1_vlan: entered promiscuous mode [ 1539.660835][T14482] veth0_macvtap: entered promiscuous mode [ 1539.715436][T14482] veth1_macvtap: entered promiscuous mode [ 1539.827031][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1539.858196][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1539.868054][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1539.913813][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1539.938286][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1539.968546][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1539.993020][T14482] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1540.017852][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1540.060224][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1540.075590][ T5783] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 1540.090187][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1540.108490][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1540.128254][T14482] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1540.139221][T14482] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1540.160038][T14482] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1540.200222][T14698] bonding: no command found in bonding_masters - use +ifname or -ifname [ 1540.213607][T14482] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1540.243468][T14482] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1540.272730][T14482] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1540.298767][T14482] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1540.501148][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1540.539642][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1540.625726][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1540.664390][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1542.404141][T14737] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2353'. [ 1543.083557][T14727] ftl_cs: FTL header not found. [ 1543.223735][T14727] block2mtd: mtd1: [/dev/zram0] erase_size = 0KiB [6] [ 1543.254383][T14743] bonding: no command found in bonding_masters - use +ifname or -ifname [ 1543.923560][T14750] netlink: 'syz.0.2355': attribute type 4 has an invalid length. [ 1543.931686][T14750] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2355'. [ 1544.637177][ T11] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1545.907554][T14769] FAULT_INJECTION: forcing a failure. [ 1545.907554][T14769] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1545.920923][T14769] CPU: 0 PID: 14769 Comm: syz.3.2360 Not tainted syzkaller #0 [ 1545.928410][T14769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1545.938484][T14769] Call Trace: [ 1545.941774][T14769] [ 1545.944712][T14769] dump_stack_lvl+0x18c/0x250 [ 1545.949416][T14769] ? show_regs_print_info+0x20/0x20 [ 1545.954654][T14769] ? load_image+0x420/0x420 [ 1545.959194][T14769] ? __might_fault+0xaa/0x120 [ 1545.963893][T14769] ? __lock_acquire+0x7eb0/0x7eb0 [ 1545.968956][T14769] ? udp_sendmsg+0x1ae1/0x23d0 [ 1545.973764][T14769] ? __virt_addr_valid+0x10c/0x380 [ 1545.978913][T14769] should_fail_ex+0x394/0x4c0 [ 1545.983627][T14769] _copy_from_user+0x2f/0xe0 [ 1545.988243][T14769] csum_and_copy_from_iter+0x1f3/0x1480 [ 1545.993833][T14769] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 1545.999500][T14769] ? __kmem_cache_alloc_node+0x194/0x250 [ 1546.005165][T14769] ? __alloc_skb+0x138/0x2c0 [ 1546.009776][T14769] ? rcu_is_watching+0x15/0xb0 [ 1546.014568][T14769] ip_generic_getfrag+0x163/0x2f0 [ 1546.019625][T14769] ? ip_skb_dst_mtu+0x870/0x870 [ 1546.024504][T14769] ? __build_skb_around+0x245/0x3c0 [ 1546.029735][T14769] ? __alloc_skb+0x1b2/0x2c0 [ 1546.034352][T14769] ? skb_put+0x112/0x210 [ 1546.038621][T14769] __ip_append_data+0x2f3b/0x3bf0 [ 1546.043699][T14769] ? ip_skb_dst_mtu+0x870/0x870 [ 1546.048588][T14769] ? ip_setup_cork+0x840/0x840 [ 1546.053406][T14769] ? ip_setup_cork+0x527/0x840 [ 1546.058200][T14769] ip_make_skb+0x22b/0x440 [ 1546.062655][T14769] ? ip_skb_dst_mtu+0x870/0x870 [ 1546.067534][T14769] ? ip_flush_pending_frames+0x250/0x250 [ 1546.073188][T14769] ? lockdep_hardirqs_on+0x98/0x150 [ 1546.078429][T14769] udp_sendmsg+0x1ae1/0x23d0 [ 1546.083058][T14769] ? ip_skb_dst_mtu+0x870/0x870 [ 1546.087982][T14769] ? udp_cmsg_send+0x350/0x350 [ 1546.092882][T14769] ? finish_task_switch+0x262/0x8f0 [ 1546.098119][T14769] ? finish_task_switch+0x262/0x8f0 [ 1546.103376][T14769] udpv6_sendmsg+0x7a4/0x2390 [ 1546.108082][T14769] ? asan.module_dtor+0x20/0x20 [ 1546.112971][T14769] ? udp_v6_early_demux+0xf90/0xf90 [ 1546.118192][T14769] ? lock_chain_count+0x20/0x20 [ 1546.123092][T14769] ? inet_send_prepare+0x5b/0x250 [ 1546.128141][T14769] ? __sanitizer_cov_trace_pc+0x36/0x60 [ 1546.133710][T14769] ? inet_send_prepare+0x5b/0x250 [ 1546.138761][T14769] ? inet6_sendmsg+0x5f/0xd0 [ 1546.143379][T14769] sock_write_iter+0x2dc/0x420 [ 1546.148169][T14769] ? sock_read_iter+0x3f0/0x3f0 [ 1546.153061][T14769] vfs_write+0x474/0x9a0 [ 1546.157331][T14769] ? file_end_write+0x250/0x250 [ 1546.162282][T14769] ? __fget_files+0x3fc/0x460 [ 1546.167011][T14769] ? __fdget_pos+0x1d8/0x330 [ 1546.171641][T14769] ? ksys_write+0x74/0x260 [ 1546.176099][T14769] ksys_write+0x151/0x260 [ 1546.180469][T14769] ? __ia32_sys_read+0x90/0x90 [ 1546.185266][T14769] ? lockdep_hardirqs_on+0x98/0x150 [ 1546.190496][T14769] do_syscall_64+0x55/0xb0 [ 1546.194949][T14769] ? clear_bhb_loop+0x40/0x90 [ 1546.199639][T14769] ? clear_bhb_loop+0x40/0x90 [ 1546.204321][T14769] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1546.210229][T14769] RIP: 0033:0x7effaa19e559 [ 1546.214653][T14769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1546.234267][T14769] RSP: 002b:00007effab10a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1546.242691][T14769] RAX: ffffffffffffffda RBX: 00007effaa426180 RCX: 00007effaa19e559 [ 1546.250670][T14769] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000005 [ 1546.258652][T14769] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1546.266633][T14769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1546.274608][T14769] R13: 00007effaa426218 R14: 00007effaa426180 R15: 00007ffeb00bd348 [ 1546.282598][T14769] [ 1546.299718][ T9] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1546.488290][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1546.497385][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1546.512441][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1546.531255][ T9] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1546.540746][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1546.559359][ T9] usb 5-1: config 0 descriptor?? [ 1548.425777][ T9554] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1548.607257][T14784] bonding: no command found in bonding_masters - use +ifname or -ifname [ 1548.642785][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 1548.652678][ T9] usbhid: probe of 5-1:0.0 failed with error -71 [ 1548.669574][ T9] usb 5-1: USB disconnect, device number 39 [ 1549.990982][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1551.729943][ T28] audit: type=1800 audit(1792119542.943:82): pid=14807 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2372" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1551.886099][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1551.965385][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1553.858388][T12688] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 1554.034561][T14835] usb usb7: check_ctrlrecip: process 14835 (syz.3.2379) requesting ep 01 but needs 81 [ 1554.658276][T12688] usb 5-1: Using ep0 maxpacket: 16 [ 1554.678814][T12688] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1554.713306][T12688] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1554.762468][T12688] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1554.820502][T12688] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.963487][T12688] usb 5-1: config 0 descriptor?? [ 1556.015684][ T32] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1556.471155][T12688] usbhid 5-1:0.0: can't add hid device: -71 [ 1556.580323][T12688] usbhid: probe of 5-1:0.0 failed with error -71 [ 1557.153318][ T28] audit: type=1800 audit(1792119547.738:83): pid=14847 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2383" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1557.186612][T12688] usb 5-1: USB disconnect, device number 40 [ 1557.609304][ T9554] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1558.124848][T14863] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 1558.133965][T14863] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1559.219897][T14869] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2392'. [ 1559.312108][ T28] audit: type=1800 audit(1792119550.608:84): pid=14872 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2393" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1561.451918][ T60] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1561.558956][ T5907] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1561.938372][ T5907] usb 1-1: device descriptor read/64, error -71 [ 1562.233354][ T5907] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 1562.851940][ T5907] usb 1-1: device descriptor read/64, error -71 [ 1562.858353][ T28] audit: type=1800 audit(1792119554.129:85): pid=14909 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2406" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1563.739083][ T5907] usb usb1-port1: attempt power cycle [ 1564.069487][T13702] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1564.085239][T13702] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1564.093690][T13702] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1564.102984][T13702] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1564.110934][T13702] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1564.118731][T13702] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1564.188316][ T5907] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1564.218862][ T5907] usb 1-1: device descriptor read/8, error -71 [ 1564.221472][T14918] rxe_eth0 speed is unknown, defaulting to 1000 [ 1565.662930][ T60] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1565.704065][ T5907] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1565.822176][ T5907] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 1565.846807][ T5907] usb 1-1: config 1 has no interface number 0 [ 1565.882044][ T5907] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1565.917014][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1565.944269][ T60] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1565.961036][ T5907] usb 1-1: Product: syz [ 1565.973677][ T5907] usb 1-1: Manufacturer: syz [ 1565.990039][ T5907] usb 1-1: SerialNumber: syz [ 1566.113804][ T60] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.146029][T14918] chnl_net:caif_netlink_parms(): no params data found [ 1566.158311][ T5783] Bluetooth: hci4: command tx timeout [ 1566.212904][ T60] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.350000][ T5907] usb 1-1: 3:0 : does not exist [ 1566.355403][ T5907] usb 1-1: 3:0 : does not exist [ 1567.704956][ T5907] usb 1-1: USB disconnect, device number 38 [ 1567.733270][T14918] bridge0: port 1(bridge_slave_0) entered blocking state [ 1567.748391][T14918] bridge0: port 1(bridge_slave_0) entered disabled state [ 1567.759072][T14918] bridge_slave_0: entered allmulticast mode [ 1567.796467][T14918] bridge_slave_0: entered promiscuous mode [ 1567.823587][T14918] bridge0: port 2(bridge_slave_1) entered blocking state [ 1567.831645][T14617] udevd[14617]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1567.858438][T14918] bridge0: port 2(bridge_slave_1) entered disabled state [ 1567.869096][T14918] bridge_slave_1: entered allmulticast mode [ 1567.876378][T14918] bridge_slave_1: entered promiscuous mode [ 1568.056546][T14918] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1568.086156][T14918] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1568.228509][ T28] audit: type=1800 audit(1792119559.495:86): pid=14951 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2418" name="syzkaller0" dev="sda1" ino=2046 res=0 errno=0 [ 1568.252565][ T5783] Bluetooth: hci4: command tx timeout [ 1569.161048][T14918] team0: Port device team_slave_0 added [ 1569.200995][T14918] team0: Port device team_slave_1 added [ 1569.339599][T14918] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1569.363165][T14918] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1569.455858][T14918] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1569.758761][T14918] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1569.765753][T14918] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1569.820227][T14918] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1571.111001][ T5783] Bluetooth: hci4: command tx timeout [ 1571.423394][T14918] hsr_slave_0: entered promiscuous mode [ 1571.468586][T14918] hsr_slave_1: entered promiscuous mode [ 1571.481715][T14918] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1571.498222][T14918] Cannot create hsr debugfs directory [ 1573.151379][ T5783] Bluetooth: hci4: command tx timeout [ 1573.478510][ T9554] IPVS: starting estimator thread 0... [ 1573.679323][T15005] IPVS: using max 17 ests per chain, 40800 per kthread [ 1573.939553][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1575.734518][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1575.761131][ T60] IPVS: stopping backup sync thread 8109 ... [ 1576.461015][T15035] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2433'. [ 1577.888682][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1578.013558][T15045] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2434'. [ 1578.671938][ T60] hsr_slave_0: left promiscuous mode [ 1578.687379][ T60] hsr_slave_1: left promiscuous mode [ 1578.694961][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1578.702554][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1578.712334][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1578.723450][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1578.885376][ T60] bridge_slave_1: left allmulticast mode [ 1578.892014][ T60] bridge_slave_1: left promiscuous mode [ 1578.904258][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 1578.933378][ T60] bridge_slave_0: left allmulticast mode [ 1578.940446][ T60] bridge_slave_0: left promiscuous mode [ 1578.950189][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 1578.972852][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1579.020161][ T60] veth1_macvtap: left promiscuous mode [ 1579.025803][ T60] veth0_macvtap: left promiscuous mode [ 1579.036115][ T60] veth1_vlan: left promiscuous mode [ 1579.050785][ T60] veth0_vlan: left promiscuous mode [ 1579.426825][ T60] b (unregistering): Released all slaves [ 1580.044143][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1580.970338][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1581.119403][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1582.344504][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1582.560235][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1582.598347][T14994] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1582.633645][T15075] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2446'. [ 1582.702258][ T60] team0 (unregistering): Port device team_slave_1 removed [ 1582.785782][T14994] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1582.807253][T14994] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1582.823021][ T60] team0 (unregistering): Port device team_slave_0 removed [ 1582.840487][T14994] usb 4-1: Product: syz [ 1582.844714][T14994] usb 4-1: SerialNumber: syz [ 1582.916662][T14994] usb 4-1: config 0 descriptor?? [ 1583.181979][T14994] hso 4-1:0.0: Failed to find BULK IN ep [ 1583.464580][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1583.668814][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1584.535105][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1584.730411][ T5838] IPVS: starting estimator thread 0... [ 1584.738052][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1584.828293][T15086] IPVS: using max 23 ests per chain, 55200 per kthread [ 1585.076458][ T60] bond0 (unregistering): Released all slaves [ 1585.140253][T15073] IPv6: NLM_F_CREATE should be specified when creating new route [ 1585.148653][T15073] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2445'. [ 1585.208872][ T9554] usb 4-1: USB disconnect, device number 28 [ 1585.417265][T14918] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1585.448775][T14918] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1585.464237][T14918] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1585.501831][T14918] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1585.642142][T15098] syz.3.2450 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 1586.455751][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1586.580324][ T60] IPVS: stop unused estimator thread 0... [ 1586.614501][T14918] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1586.669186][T14918] 8021q: adding VLAN 0 to HW filter on device team0 [ 1586.784607][T14387] bridge0: port 1(bridge_slave_0) entered blocking state [ 1586.791838][T14387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1586.823180][T14387] bridge0: port 2(bridge_slave_1) entered blocking state [ 1586.830378][T14387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1587.901717][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1588.198058][T14918] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1588.320855][ T3474] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1588.329960][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1588.336842][T14918] veth0_vlan: entered promiscuous mode [ 1588.394169][T14918] veth1_vlan: entered promiscuous mode [ 1588.487770][T14918] veth0_macvtap: entered promiscuous mode [ 1588.521979][T14918] veth1_macvtap: entered promiscuous mode [ 1588.594438][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1588.648171][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1588.668200][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1588.708266][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1588.728334][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1588.758487][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1588.794775][T14918] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1588.826350][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1588.872245][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1588.909310][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1588.938348][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1588.958956][T14918] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1588.966386][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1588.990209][T14918] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1589.015754][T14918] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1589.083944][T14918] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1589.112411][T14918] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1589.122425][T14918] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1589.140038][T14918] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1589.641326][T14994] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 1589.674073][T15139] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2456'. [ 1590.021209][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1590.029892][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1590.039214][T14994] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1590.044820][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1590.057927][T14994] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1590.082081][T14994] usb 5-1: Product: syz [ 1590.093880][T14994] usb 5-1: SerialNumber: syz [ 1590.106440][T14994] usb 5-1: config 0 descriptor?? [ 1590.144948][T14387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1590.154090][T14387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1590.352165][T14994] hso 5-1:0.0: Failed to find BULK IN ep [ 1590.559183][T15154] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2455'. [ 1591.127468][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1592.418583][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1592.430307][ T5857] usb 5-1: USB disconnect, device number 41 [ 1592.442640][ T8] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1592.799762][ T56] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1593.459506][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1593.818732][T15188] usb usb7: check_ctrlrecip: process 15188 (syz.4.2468) requesting ep 01 but needs 81 [ 1594.104490][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1594.220737][ T8] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1594.500386][ T8] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1594.562782][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1594.588192][ T8] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1594.617472][ T8] usb 1-1: Product: syz [ 1594.638705][ T8] usb 1-1: SerialNumber: syz [ 1594.653972][ T8] usb 1-1: config 0 descriptor?? [ 1594.717952][ T32] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1594.880846][ T8] hso 1-1:0.0: Failed to find BULK IN ep [ 1595.091881][ T32] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.120114][T15200] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2470'. [ 1595.327577][ T32] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.359336][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1595.476092][ T32] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.607129][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1596.433694][T15229] usb usb7: check_ctrlrecip: process 15229 (syz.3.2478) requesting ep 01 but needs 81 [ 1596.528337][T15229] usb usb7: usbfs: process 15229 (syz.3.2478) did not claim interface 0 before use [ 1596.640253][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1597.887832][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1597.899658][ T9] usb 1-1: USB disconnect, device number 39 [ 1598.930501][T15255] FAULT_INJECTION: forcing a failure. [ 1598.930501][T15255] name failslab, interval 1, probability 0, space 0, times 0 [ 1598.966374][T14994] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1599.008371][T15255] CPU: 1 PID: 15255 Comm: syz.0.2483 Not tainted syzkaller #0 [ 1599.015900][T15255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1599.025980][T15255] Call Trace: [ 1599.029269][T15255] [ 1599.032209][T15255] dump_stack_lvl+0x18c/0x250 [ 1599.036907][T15255] ? show_regs_print_info+0x20/0x20 [ 1599.042117][T15255] ? load_image+0x420/0x420 [ 1599.046649][T15255] ? __lock_acquire+0x7eb0/0x7eb0 [ 1599.051703][T15255] should_fail_ex+0x394/0x4c0 [ 1599.056401][T15255] should_failslab+0x9/0x20 [ 1599.060999][T15255] slab_pre_alloc_hook+0x59/0x300 [ 1599.066031][T15255] ? ceph_alloc_options+0x4e/0x1d0 [ 1599.071161][T15255] __kmem_cache_alloc_node+0x53/0x250 [ 1599.076553][T15255] ? ceph_alloc_options+0x4e/0x1d0 [ 1599.081676][T15255] kmalloc_trace+0x2a/0xe0 [ 1599.086107][T15255] ceph_alloc_options+0x4e/0x1d0 [ 1599.091049][T15255] ceph_init_fs_context+0x68/0x4a0 [ 1599.096168][T15255] ? destroy_caches+0x80/0x80 [ 1599.100866][T15255] alloc_fs_context+0x618/0x7a0 [ 1599.105731][T15255] __se_sys_fsopen+0xa0/0x2c0 [ 1599.110419][T15255] do_syscall_64+0x55/0xb0 [ 1599.114840][T15255] ? clear_bhb_loop+0x40/0x90 [ 1599.119521][T15255] ? clear_bhb_loop+0x40/0x90 [ 1599.124204][T15255] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1599.130108][T15255] RIP: 0033:0x7f313a99e559 [ 1599.134527][T15255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1599.154166][T15255] RSP: 002b:00007f313b77e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1599.162586][T15255] RAX: ffffffffffffffda RBX: 00007f313ac25fa0 RCX: 00007f313a99e559 [ 1599.170559][T15255] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00002000000001c0 [ 1599.178562][T15255] RBP: 00007f313aa358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1599.186535][T15255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1599.194504][T15255] R13: 00007f313ac26038 R14: 00007f313ac25fa0 R15: 00007ffea8cad778 [ 1599.202495][T15255] [ 1599.249470][ T8] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1599.839022][ T60] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1600.666778][ T27] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1600.909250][ T32] hsr_slave_0: left promiscuous mode [ 1601.002039][ T32] hsr_slave_1: left promiscuous mode [ 1601.094224][ T32] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1601.109203][ T32] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1601.191044][ T32] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1601.260185][ T32] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1601.354947][ T32] bridge_slave_1: left allmulticast mode [ 1601.410531][ T32] bridge_slave_1: left promiscuous mode [ 1601.481541][ T32] bridge0: port 2(bridge_slave_1) entered disabled state [ 1601.600063][ T32] bridge_slave_0: left allmulticast mode [ 1601.669427][ T32] bridge_slave_0: left promiscuous mode [ 1601.678843][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1601.756629][ T32] bridge0: port 1(bridge_slave_0) entered disabled state [ 1603.079316][ T9554] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1603.090720][ T56] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1603.114041][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1603.124987][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1603.198691][ T3474] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1603.379275][ T32] veth1_macvtap: left promiscuous mode [ 1603.385197][ T32] veth0_macvtap: left promiscuous mode [ 1603.408549][ T32] veth1_vlan: left promiscuous mode [ 1603.413936][ T32] veth0_vlan: left promiscuous mode [ 1604.181929][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1605.324432][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1605.336076][ T5839] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 1605.535858][ T5839] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1605.558234][ T5839] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1605.580724][ T5839] usb 4-1: Product: syz [ 1605.584944][ T5839] usb 4-1: SerialNumber: syz [ 1605.599935][ T60] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1605.609493][ T5839] usb 4-1: config 0 descriptor?? [ 1605.614605][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1606.684848][ T5839] hso 4-1:0.0: Failed to find BULK IN ep [ 1606.693629][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1607.018967][ T32] team0 (unregistering): Port device team_slave_1 removed [ 1607.064311][ T32] team0 (unregistering): Port device team_slave_0 removed [ 1607.107810][ T32] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1607.154335][ T32] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1607.474156][ T32] bond0 (unregistering): Released all slaves [ 1607.733478][ T56] usb 4-1: USB disconnect, device number 29 [ 1607.855607][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1608.809087][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1608.821148][ T9] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1608.913678][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1609.927316][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1610.718647][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1610.719105][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1610.991472][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1611.028523][ T5838] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1611.232159][ T5838] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1611.268385][ T5838] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1611.296807][ T5838] usb 4-1: Product: syz [ 1611.310610][ T5838] usb 4-1: SerialNumber: syz [ 1611.340878][ T5838] usb 4-1: config 0 descriptor?? [ 1611.588683][ T5838] hso 4-1:0.0: Failed to find BULK IN ep [ 1611.964784][T14387] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1611.999248][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1612.100336][T14387] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1612.252126][T14387] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1612.471919][T14387] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1613.292732][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 1613.745015][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 1613.772945][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1614.561952][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1614.610645][ T56] usb 4-1: USB disconnect, device number 30 [ 1614.806299][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1615.846377][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1616.499473][ T3474] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1616.855861][T14387] hsr_slave_0: left promiscuous mode [ 1616.894066][T14387] hsr_slave_1: left promiscuous mode [ 1616.917248][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1616.969863][T14387] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1617.043512][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1617.092769][T14387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1617.153276][T14387] bridge_slave_1: left allmulticast mode [ 1617.201390][T14387] bridge_slave_1: left promiscuous mode [ 1617.207193][T14387] bridge0: port 2(bridge_slave_1) entered disabled state [ 1617.240395][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1617.287645][T14387] bridge_slave_0: left allmulticast mode [ 1617.293462][T14387] bridge_slave_0: left promiscuous mode [ 1617.301584][T14387] bridge0: port 1(bridge_slave_0) entered disabled state [ 1617.356313][T14387] veth1_macvtap: left promiscuous mode [ 1617.363452][T14387] veth0_macvtap: left promiscuous mode [ 1617.372673][T14387] veth1_vlan: left promiscuous mode [ 1617.378039][T14387] veth0_vlan: left promiscuous mode [ 1617.758427][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1618.291803][T14387] team0 (unregistering): Port device team_slave_1 removed [ 1619.490452][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1619.671906][T14387] team0 (unregistering): Port device team_slave_0 removed [ 1619.780399][T14387] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1619.899324][T14387] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1620.318628][ T60] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1620.650436][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1622.557131][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1622.608606][ T9] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1622.612593][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1622.733679][T14387] bond0 (unregistering): Released all slaves [ 1622.842447][ T9] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1622.878282][ T9] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1622.886356][ T9] usb 1-1: Product: syz [ 1622.898344][ T9] usb 1-1: SerialNumber: syz [ 1622.912916][T15482] IPv6: NLM_F_CREATE should be specified when creating new route [ 1622.923694][T15482] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2525'. [ 1622.925648][ T9] usb 1-1: config 0 descriptor?? [ 1623.190343][ T9] hso 1-1:0.0: Failed to find BULK IN ep [ 1623.478741][T14387] IPVS: stop unused estimator thread 0... [ 1623.686584][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1624.458537][T12688] usb 1-1: USB disconnect, device number 40 [ 1624.726050][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1624.801965][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1625.986866][ T1093] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1626.031587][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1627.085269][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1628.949837][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1628.976165][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1630.974946][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1631.199782][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1632.805791][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1632.817000][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1633.851565][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1634.398751][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1634.885970][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1635.368186][ T9] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1635.568263][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 1635.579742][ T9] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1635.587787][ T9] usb 4-1: config 0 has no interface number 0 [ 1635.614928][ T9] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1635.624508][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1635.648258][ T9] usb 4-1: Product: syz [ 1635.652486][ T9] usb 4-1: Manufacturer: syz [ 1635.657351][ T9] usb 4-1: SerialNumber: syz [ 1636.827961][ T9] usb 4-1: config 0 descriptor?? [ 1636.841381][ T9] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1636.851766][ T9] usb 4-1: selecting invalid altsetting 1 [ 1636.857536][ T9] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1636.864857][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1636.909553][ T9] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1636.950212][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1636.958661][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1637.001529][ T9] usb 4-1: media controller created [ 1637.071777][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1637.923851][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1638.158833][T15680] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1638.209976][ T9] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1638.217652][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1638.251558][ T9] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1638.317113][ T9] usb 4-1: USB disconnect, device number 31 [ 1638.958551][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1639.220011][T15738] FAULT_INJECTION: forcing a failure. [ 1639.220011][T15738] name failslab, interval 1, probability 0, space 0, times 0 [ 1639.354183][T15738] CPU: 1 PID: 15738 Comm: syz.3.2548 Not tainted syzkaller #0 [ 1639.361711][T15738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1639.371789][T15738] Call Trace: [ 1639.375089][T15738] [ 1639.378032][T15738] dump_stack_lvl+0x18c/0x250 [ 1639.382732][T15738] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1639.388387][T15738] ? show_regs_print_info+0x20/0x20 [ 1639.393603][T15738] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1639.399285][T15738] should_fail_ex+0x394/0x4c0 [ 1639.403995][T15738] should_failslab+0x9/0x20 [ 1639.408523][T15738] slab_pre_alloc_hook+0x59/0x300 [ 1639.413573][T15738] ? kvmalloc_node+0x70/0x180 [ 1639.418274][T15738] ? kvmalloc_node+0x70/0x180 [ 1639.422975][T15738] __kmem_cache_alloc_node+0x53/0x250 [ 1639.428372][T15738] ? pcpu_alloc+0x11e7/0x1880 [ 1639.433073][T15738] ? kvmalloc_node+0x70/0x180 [ 1639.437769][T15738] __kmalloc_node+0xa6/0x240 [ 1639.442389][T15738] kvmalloc_node+0x70/0x180 [ 1639.446927][T15738] sbitmap_init_node+0x2b5/0x620 [ 1639.451898][T15738] sbitmap_queue_init_node+0x3e/0x660 [ 1639.457299][T15738] kyber_init_sched+0x379/0x620 [ 1639.462187][T15738] blk_mq_init_sched+0x384/0x780 [ 1639.467146][T15738] ? preempt_schedule_thunk+0x1a/0x30 [ 1639.472555][T15738] ? blk_mq_sched_try_insert_merge+0x160/0x160 [ 1639.478743][T15738] ? blk_mq_quiesce_queue+0xfe/0x190 [ 1639.484053][T15738] elevator_switch+0x1ee/0x5b0 [ 1639.488852][T15738] elv_iosched_store+0x3b9/0x4b0 [ 1639.493813][T15738] ? kernfs_fop_write_iter+0x1dc/0x520 [ 1639.499306][T15738] ? elevator_disable+0x4f0/0x4f0 [ 1639.504374][T15738] queue_attr_store+0x9e/0xd0 [ 1639.509079][T15738] ? sysfs_kf_read+0x360/0x360 [ 1639.513866][T15738] kernfs_fop_write_iter+0x3a4/0x520 [ 1639.519179][T15738] vfs_write+0x474/0x9a0 [ 1639.523460][T15738] ? file_end_write+0x250/0x250 [ 1639.528343][T15738] ? __fget_files+0x3fc/0x460 [ 1639.533057][T15738] ? __fdget_pos+0x2a3/0x330 [ 1639.537665][T15738] ? ksys_write+0x74/0x260 [ 1639.542112][T15738] ksys_write+0x151/0x260 [ 1639.546482][T15738] ? __ia32_sys_read+0x90/0x90 [ 1639.551283][T15738] ? lockdep_hardirqs_on+0x98/0x150 [ 1639.556514][T15738] do_syscall_64+0x55/0xb0 [ 1639.560954][T15738] ? clear_bhb_loop+0x40/0x90 [ 1639.565665][T15738] ? clear_bhb_loop+0x40/0x90 [ 1639.570363][T15738] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1639.576285][T15738] RIP: 0033:0x7effaa19e559 [ 1639.580717][T15738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1639.600522][T15738] RSP: 002b:00007effab14c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1639.608962][T15738] RAX: ffffffffffffffda RBX: 00007effaa425fa0 RCX: 00007effaa19e559 [ 1639.616953][T15738] RDX: 0000000000000005 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1639.624941][T15738] RBP: 00007effaa2358b0 R08: 0000000000000000 R09: 0000000000000000 [ 1639.632940][T15738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1639.640925][T15738] R13: 00007effaa426038 R14: 00007effaa425fa0 R15: 00007ffeb00bd348 [ 1639.648940][T15738] [ 1639.916735][T15738] elv: switch to "kyber" failed, falling back to "none" [ 1640.002496][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1640.158797][ T73] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1640.170407][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1640.928549][T15775] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2550'. [ 1640.958356][T13702] Bluetooth: hci0: command 0x0406 tx timeout [ 1641.038778][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1642.078763][T14387] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1642.080822][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration SYZFAIL: mount(dev) failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: open /dev/vhci failed (errno 2: No such file or directory) loop exited with status 67 SYZFAIL: repeatedly failed to execute the program proc=1 req=2405 state=3 status=67 (errno 32: Broken pipe) [ 1643.128820][T12688] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1643.270968][T14387] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1643.394333][T14387] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1643.513648][T14387] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1643.621960][T14387] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1644.160770][ T5839] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1644.231117][T14482] syz-executor (14482) used greatest stack depth: 20808 bytes left [ 1644.953874][T14387] hsr_slave_0: left promiscuous mode [ 1644.965719][T14387] hsr_slave_1: left promiscuous mode [ 1644.975469][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1644.984207][T14387] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1644.992362][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1645.000063][T14387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1645.007613][T14387] bridge_slave_1: left allmulticast mode [ 1645.013516][T14387] bridge_slave_1: left promiscuous mode [ 1645.019271][T14387] bridge0: port 2(bridge_slave_1) entered disabled state [ 1645.027906][T14387] bridge_slave_0: left allmulticast mode [ 1645.033953][T14387] bridge_slave_0: left promiscuous mode [ 1645.039842][T14387] bridge0: port 1(bridge_slave_0) entered disabled state [ 1645.060441][T14387] veth1_macvtap: left promiscuous mode [ 1645.065987][T14387] veth0_macvtap: left promiscuous mode [ 1645.072619][T14387] veth1_vlan: left promiscuous mode [ 1645.079108][T14387] veth0_vlan: left promiscuous mode [ 1645.204727][ T5857] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1645.580639][T14387] team0 (unregistering): Port device team_slave_1 removed [ 1645.623692][T14387] team0 (unregistering): Port device team_slave_0 removed [ 1645.666648][T14387] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1645.711614][T14387] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1645.920295][ T73] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1646.025994][T14387] bond0 (unregistering): Released all slaves [ 1646.242044][ T5838] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1646.385234][T14387] IPVS: stop unused estimator thread 0... [ 1646.491398][T14387] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.563913][T14387] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.647292][T14387] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.741551][T14387] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1647.781617][T14387] hsr_slave_0: left promiscuous mode [ 1647.787669][T14387] hsr_slave_1: left promiscuous mode [ 1647.793739][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1647.807373][T14387] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1647.815587][T14387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1647.823118][T14387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1647.831201][T14387] bridge_slave_1: left allmulticast mode [ 1647.836874][T14387] bridge_slave_1: left promiscuous mode [ 1647.850653][T14387] bridge0: port 2(bridge_slave_1) entered disabled state [ 1647.860219][T14387] bridge_slave_0: left allmulticast mode [ 1647.865908][T14387] bridge_slave_0: left promiscuous mode [ 1647.872325][T14387] bridge0: port 1(bridge_slave_0) entered disabled state [ 1647.900251][T14387] veth1_macvtap: left promiscuous mode [ 1647.905838][T14387] veth0_macvtap: left promiscuous mode [ 1647.912880][T14387] veth1_vlan: left promiscuous mode [ 1647.918485][T14387] veth0_vlan: left promiscuous mode [ 1648.438283][T14387] team0 (unregistering): Port device team_slave_1 removed [ 1648.477695][T14387] team0 (unregistering): Port device team_slave_0 removed [ 1648.517239][T14387] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1648.560896][T14387] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1648.846402][T14387] bond0 (unregistering): Released all slaves [ 1649.200908][T14387] IPVS: stop unused estimator thread 0...