last executing test programs: 7.985692239s ago: executing program 1 (id=85): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x803}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, 0x0) 7.659083894s ago: executing program 1 (id=88): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000080)='O', 0x1}], 0x1}}], 0x1, 0x0) 7.43318926s ago: executing program 1 (id=90): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) socket$packet(0x11, 0x2, 0x300) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)={@val={0x0, 0x805}, @void, @eth={@random="16a2a85969e6", @broadcast, @val={@val, {0x8100, 0x0, 0x0, 0x20}}, {@generic={0x8809, "b2fd"}}}}, 0x1c) 7.178560547s ago: executing program 1 (id=92): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000c}) 4.026882529s ago: executing program 2 (id=112): r0 = syz_usb_connect(0x0, 0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff00000009041b0000ff0000000904010102ff0000000705870240"], 0x0) syz_usb_control_io(r0, &(0x7f0000003000)={0x2c, &(0x7f0000004000)={0x0, 0x0, 0x2, {0x2, 0x3}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000002000)={0x0, 0x0, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000740)={0x34, &(0x7f0000000380)={0x20, 0x3, 0x92, "2b85ceb3b78c37da19493fc7b8cef8a1ac43b06b59ae69e2cb0c62997a3e9012c0f34157664b0a2560428bc0404e9a825f4dba1566e3fc18bffb845f5327df5f3f162bd43306f39cdce36f29c7ef6d68cdf9e9486a84bf012a45f01a4d5ed711b12ead0977dd8d6b745f419e57e043e164db75138b04a80abb127e16d2b2baa497ed5cd51c4a655cbdb404909a4a16f8bd16"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000480)={0x0, 0x8, 0x1}, 0x0, &(0x7f00000006c0)={0x20, 0x1, 0x1, 0x1}, 0x0}) 2.972504583s ago: executing program 3 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0xd5) openat$cgroup_ro(r0, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) 2.873638705s ago: executing program 3 (id=120): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mlock(&(0x7f0000ffb000/0x1000)=nil, 0xffffffffdf004fff) 2.687225228s ago: executing program 3 (id=121): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r1, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @tick=0x8, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @tick, {0x0, 0xfe}, {}, @ext={0x0, 0x0}}, {0x0, 0x0, 0x0, 0x20, @time, {}, {}, @time=@time}, {0x0, 0x0, 0x56, 0x0, @time={0x243}, {}, {}, @control={0x0, 0x0, 0x8001}}, {0x0, 0x0, 0x0, 0x0, @tick=0x8, {}, {}, @connect}, {0x0, 0x0, 0x0, 0x0, @tick=0xa784, {0xfc}, {}, @raw8={"448cc880fe353ca0f2c2e953"}}, {0x0, 0x0, 0x0, 0x1, @time, {0xfd}, {0x1c}, @connect={{}, {0x0, 0x9}}}], 0xc4) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000100)) 2.601568226s ago: executing program 3 (id=122): r0 = syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000580)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271000301f81005080b02000105200809c04e143900000000092401fdff0811004708240a0000097f000904010000010220000904010101010220000905", @ANYRESDEC], 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003040000000403"]}, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1.767723089s ago: executing program 2 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x200001, 0x0) 1.585729192s ago: executing program 2 (id=129): r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') umount2(&(0x7f0000000080)='./file0/file0\x00', 0x1) 1.373868657s ago: executing program 2 (id=130): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r1, 0x7}}, 0x48) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r3, 0x7}}, 0x48) 1.295024948s ago: executing program 2 (id=132): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff000000070581024000000705020240"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000640)={'syz0\x00', {0x2, 0xb, 0x0, 0x1}, 0x47, [0xa, 0x3, 0x393ceec7, 0x78b7, 0x1, 0x1, 0xcd6c, 0x5, 0xf, 0x7000, 0x10000, 0x8, 0xf, 0x81, 0x5, 0x0, 0x5, 0x8, 0x0, 0x8, 0x80000000, 0xb1c, 0x5, 0xfffffffc, 0x0, 0x6, 0x91, 0x800, 0x80000001, 0x80, 0x401, 0x80, 0x3, 0x3, 0x2, 0x6, 0xcbbd, 0x5, 0x7ff, 0x3, 0x5, 0x3, 0x3, 0x1, 0xc, 0x7, 0x10000, 0x5, 0x10001, 0x1000, 0x3, 0x4, 0x1, 0xdec, 0x7, 0x3c0, 0xfffffff6, 0x8, 0x7, 0x7, 0xdec, 0x9, 0x1, 0xfff], [0x9, 0x2, 0x1, 0x3, 0x7, 0x8, 0x1, 0x7, 0x2, 0x299, 0xb6f, 0x8, 0x200, 0xedc8, 0x3, 0xac, 0x5, 0x80000001, 0x100, 0xffffff01, 0x8, 0x5, 0x7, 0xa, 0x1, 0xff, 0x3, 0x7, 0xd4c, 0x23b, 0x9, 0x2, 0x200, 0x0, 0x3, 0x0, 0x5, 0xc69d, 0x101, 0x80000000, 0x7, 0xf6, 0x4, 0x64d, 0x1, 0x5, 0xfff, 0x9, 0xc2, 0x10001, 0x1032800, 0x5d, 0xb, 0x751, 0x3, 0xa, 0x3, 0xe0000000, 0x8, 0x3, 0x6, 0x4, 0x8001, 0x80000001], [0x3, 0xfffffff7, 0x3, 0x53, 0x8, 0x35, 0x3, 0x7, 0x1ff, 0x5, 0x0, 0xfff, 0x9, 0x8, 0x3, 0x0, 0x6, 0x4, 0xfffffffb, 0x7, 0xb, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x80000000, 0x5, 0x1, 0x22bc48d0, 0x3, 0x6, 0x8000, 0x6, 0x1, 0x4, 0x7, 0x5, 0x7, 0x6, 0x2, 0x7, 0x40, 0x9, 0x3, 0xffffff81, 0x63, 0x9, 0x7, 0xe9b, 0x8, 0x2, 0x75, 0x9, 0xd, 0x8001, 0x7fff, 0x8, 0x7, 0x9, 0x18, 0x20000, 0x400, 0x9], [0x5, 0xff, 0x3, 0x0, 0x8001, 0x7, 0x1, 0x7, 0xe, 0x1, 0x81, 0x3, 0x3, 0x9, 0xffff, 0x2, 0x2b57, 0x6, 0xa5, 0x356d, 0x9, 0xb2a3, 0x8, 0x6, 0x4, 0xfffffffb, 0xfffffffc, 0x7, 0x80000000, 0x7fffffff, 0xffff0000, 0x1000, 0x40, 0x2, 0x7, 0xfffffffd, 0x1, 0xffffffff, 0xb1a3, 0x2, 0x8, 0x1, 0x1, 0x1, 0x6, 0x401, 0x34f, 0x33a, 0xe7d, 0x78b6, 0x80000000, 0x7ff, 0x4, 0x3, 0x2, 0x8, 0x3, 0xffff, 0xff, 0x8, 0x1600, 0x6, 0x0, 0xa]}, 0x45c) ioctl$TIOCSETD(r0, 0x5423, 0x0) 1.074431889s ago: executing program 1 (id=134): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f00000005c0)=0x9, 0xfc17) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_vlan\x00', 0x0}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x0, @empty, 0x4}}, 0x101, 0x5, 0x9, 0x3, 0x42, 0x9, 0xb1}, 0x0) sendto$packet(r1, &(0x7f00000002c0)="05030500d3fc030000004788800509101128", 0x100f, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.009900676s ago: executing program 1 (id=136): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0) syz_usb_ep_write(r0, 0x3, 0x8, &(0x7f0000000040)="0700008cef000000") syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000080)={0x1c, &(0x7f00000000c0)={0x20, 0x18, 0x2, "0200"}, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x4, &(0x7f00000013c0)={[{}]}) 885.500785ms ago: executing program 3 (id=139): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x18) pipe2(&(0x7f0000001180), 0x4800) 856.870411ms ago: executing program 0 (id=140): r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000240)='.\x00', 0x60000726) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) r2 = fanotify_init(0x1a, 0x40000) fanotify_mark(r2, 0x541, 0x40001019, r1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) 737.10072ms ago: executing program 0 (id=141): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000001c0)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0x80000300, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc_mnt\x00', 0x1ff) 659.51288ms ago: executing program 0 (id=142): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000100)='O', 0x5c8, 0x0, &(0x7f0000000080)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @broadcast}, 0x3e) 419.055094ms ago: executing program 0 (id=143): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x88840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x3, 0x0, 0x2080, {0x0, 0xffff1000}, {"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) 163.551661ms ago: executing program 0 (id=144): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) fcntl$lock(r0, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x100000000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 118.277619ms ago: executing program 0 (id=145): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='27', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 12.370911ms ago: executing program 3 (id=146): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x2a) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) newfstatat(0xffffffffffffff9c, &(0x7f0000004200)='./file0\x00', &(0x7f0000004240), 0x6000) 0s ago: executing program 2 (id=147): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0xffffffffffffff0f, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x255, 0x0, r7}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000003, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x35c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x20002, 0x1, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r4, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) setsockopt$inet_group_source_req(r7, 0x0, 0x2e, &(0x7f0000000340)={0x7, {{0x2, 0x4e22, @local}}, {{0x2, 0x4e32, @loopback}}}, 0x108) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.78' (ED25519) to the list of known hosts. [ 64.006774][ T5595] cgroup: Unknown subsys name 'net' [ 64.139833][ T5595] cgroup: Unknown subsys name 'cpuset' [ 64.148788][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 65.483512][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.531397][ T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.532593][ T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.534450][ T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.535228][ T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.535738][ T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.631127][ T4929] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.632326][ T4929] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 67.632808][ T4929] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 67.633782][ T4929] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 67.634347][ T4929] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.717325][ T4929] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.718630][ T4929] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.719061][ T4929] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.720140][ T4929] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.721202][ T4929] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 67.778819][ T54] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.781732][ T54] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.782977][ T54] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.784332][ T54] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 67.784943][ T54] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 69.038072][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.038220][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.038352][ T5609] bridge_slave_0: entered allmulticast mode [ 69.040321][ T5609] bridge_slave_0: entered promiscuous mode [ 69.049558][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.049652][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.049764][ T5609] bridge_slave_1: entered allmulticast mode [ 69.051344][ T5609] bridge_slave_1: entered promiscuous mode [ 69.142624][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.142710][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.142811][ T5604] bridge_slave_0: entered allmulticast mode [ 69.144080][ T5604] bridge_slave_0: entered promiscuous mode [ 69.165906][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.193246][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.193398][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.193785][ T5604] bridge_slave_1: entered allmulticast mode [ 69.195072][ T5604] bridge_slave_1: entered promiscuous mode [ 69.211927][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.225649][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.225867][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.225981][ T5615] bridge_slave_0: entered allmulticast mode [ 69.227959][ T5615] bridge_slave_0: entered promiscuous mode [ 69.230654][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.230746][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.231093][ T5615] bridge_slave_1: entered allmulticast mode [ 69.232948][ T5615] bridge_slave_1: entered promiscuous mode [ 69.248216][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.248309][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.248411][ T5613] bridge_slave_0: entered allmulticast mode [ 69.250158][ T5613] bridge_slave_0: entered promiscuous mode [ 69.294804][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.294922][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.295028][ T5613] bridge_slave_1: entered allmulticast mode [ 69.298376][ T5613] bridge_slave_1: entered promiscuous mode [ 69.303799][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.324917][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.357101][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.358662][ T5609] team0: Port device team_slave_0 added [ 69.360577][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.403404][ T5609] team0: Port device team_slave_1 added [ 69.416398][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.447611][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.449092][ T5604] team0: Port device team_slave_0 added [ 69.474741][ T5615] team0: Port device team_slave_0 added [ 69.487927][ T5604] team0: Port device team_slave_1 added [ 69.488717][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.488725][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.488738][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.491669][ T5615] team0: Port device team_slave_1 added [ 69.515066][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.515079][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.515102][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.540054][ T5613] team0: Port device team_slave_0 added [ 69.604806][ T5609] hsr_slave_0: entered promiscuous mode [ 69.605535][ T5609] hsr_slave_1: entered promiscuous mode [ 69.621780][ T5613] team0: Port device team_slave_1 added [ 69.622382][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.622393][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.622414][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.623946][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.623957][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.623978][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.625028][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.625039][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.625061][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.640711][ T4929] Bluetooth: hci0: command tx timeout [ 69.674156][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.674170][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.674192][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.692492][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.692506][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.692524][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.715290][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.715304][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.715325][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.729198][ T4929] Bluetooth: hci1: command tx timeout [ 69.797384][ T4929] Bluetooth: hci2: command tx timeout [ 69.877078][ T4929] Bluetooth: hci3: command tx timeout [ 69.930885][ T5615] hsr_slave_0: entered promiscuous mode [ 69.931491][ T5615] hsr_slave_1: entered promiscuous mode [ 69.931889][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 69.931958][ T5615] Cannot create hsr debugfs directory [ 69.969696][ T5604] hsr_slave_0: entered promiscuous mode [ 69.970278][ T5604] hsr_slave_1: entered promiscuous mode [ 69.970681][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 69.970698][ T5604] Cannot create hsr debugfs directory [ 70.055007][ T5613] hsr_slave_0: entered promiscuous mode [ 70.055727][ T5613] hsr_slave_1: entered promiscuous mode [ 70.056133][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 70.056150][ T5613] Cannot create hsr debugfs directory [ 70.364717][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.370021][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.370844][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.384752][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.398165][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.401359][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.421954][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.424562][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.492867][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.496310][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.511767][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.515357][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.516674][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.533987][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.548579][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.551406][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.615151][ T5604] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.619790][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.620808][ T5604] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.628682][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.631063][ T5604] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.634355][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.665614][ T5604] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.669361][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.759418][ T5613] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.762810][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.786019][ T5613] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.795882][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.809692][ T5613] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.812439][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.812894][ T5613] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.815558][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.821533][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.873367][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.903698][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.903830][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.926580][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.945425][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.945484][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.008540][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.010884][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.042118][ T4174] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.042174][ T4174] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.064370][ T1049] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.064531][ T1049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.092701][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.141234][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.141341][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.162616][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.185247][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.185346][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.250154][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.295751][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.295852][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.343331][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.343429][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.399631][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.399701][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.719635][ T4929] Bluetooth: hci0: command tx timeout [ 71.797560][ T4929] Bluetooth: hci1: command tx timeout [ 71.839421][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.877630][ T4929] Bluetooth: hci2: command tx timeout [ 71.936176][ T5609] veth0_vlan: entered promiscuous mode [ 71.957228][ T5609] veth1_vlan: entered promiscuous mode [ 71.957897][ T4929] Bluetooth: hci3: command tx timeout [ 72.071492][ T5609] veth0_macvtap: entered promiscuous mode [ 72.085792][ T5609] veth1_macvtap: entered promiscuous mode [ 72.141202][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.170731][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.274313][ T154] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.275085][ T154] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.275121][ T154] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.275151][ T154] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.372768][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.386555][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.422979][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.458748][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.458772][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.542148][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.542169][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.546626][ T5604] veth0_vlan: entered promiscuous mode [ 72.555094][ T5615] veth0_vlan: entered promiscuous mode [ 72.572687][ T5604] veth1_vlan: entered promiscuous mode [ 72.626419][ T5615] veth1_vlan: entered promiscuous mode [ 72.648829][ T5613] veth0_vlan: entered promiscuous mode [ 72.675261][ T5613] veth1_vlan: entered promiscuous mode [ 72.675635][ T5609] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.703246][ T5604] veth0_macvtap: entered promiscuous mode [ 72.720982][ T5604] veth1_macvtap: entered promiscuous mode [ 72.784736][ T5613] veth0_macvtap: entered promiscuous mode [ 72.796706][ T5615] veth0_macvtap: entered promiscuous mode [ 72.804699][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.815439][ T5613] veth1_macvtap: entered promiscuous mode [ 72.830909][ T5615] veth1_macvtap: entered promiscuous mode [ 72.851256][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.863902][ T5748] syzkaller1: entered promiscuous mode [ 72.863920][ T5748] syzkaller1: entered allmulticast mode [ 72.881076][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.916289][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.935121][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.966757][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.108531][ T4174] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.108552][ T4174] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.211192][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.211210][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.244115][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.244132][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.305114][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.305131][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.327730][ T154] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.347099][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.348338][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.348376][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.400423][ T4174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.400440][ T4174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.407358][ T5749] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 73.478326][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.479284][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.479299][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.479489][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517060][ T4174] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517099][ T4174] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517129][ T4174] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517156][ T4174] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517185][ T4174] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.517214][ T4174] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.602792][ T5759] use of bytesused == 0 is deprecated and will be removed in the future, [ 73.602808][ T5759] use the actual size instead. [ 73.625046][ T5749] usb 1-1: Using ep0 maxpacket: 8 [ 73.633792][ T5749] usb 1-1: unable to get BOS descriptor or descriptor too short [ 73.633889][ T5749] usb 1-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 73.659394][ T5749] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 73.659446][ T5749] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 73.659466][ T5749] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 73.699582][ T5749] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.699597][ T5749] usb 1-1: Product: syz [ 73.699605][ T5749] usb 1-1: Manufacturer: syz [ 73.699612][ T5749] usb 1-1: SerialNumber: syz [ 73.797685][ T4929] Bluetooth: hci0: command tx timeout [ 73.820045][ T5767] netlink: 'syz.3.4': attribute type 11 has an invalid length. [ 73.877447][ T4929] Bluetooth: hci1: command tx timeout [ 73.921141][ T5771] FAULT_INJECTION: forcing a failure. [ 73.921141][ T5771] name failslab, interval 1, probability 0, space 0, times 1 [ 73.921189][ T5771] CPU: 0 UID: 0 PID: 5771 Comm: syz.3.11 Not tainted syzkaller #0 PREEMPT(full) [ 73.921214][ T5771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 73.921240][ T5771] Call Trace: [ 73.921251][ T5771] [ 73.921262][ T5771] dump_stack_lvl+0xe8/0x150 [ 73.921292][ T5771] should_fail_ex+0x3eb/0x540 [ 73.921317][ T5771] should_failslab+0xa8/0x100 [ 73.921339][ T5771] __kvmalloc_node_noprof+0x171/0x820 [ 73.921362][ T5771] ? seq_read_iter+0x1ea/0xca0 [ 73.921379][ T5771] ? seq_read_iter+0x1ea/0xca0 [ 73.921404][ T5771] seq_read_iter+0x1ea/0xca0 [ 73.921438][ T5771] seq_read+0x367/0x480 [ 73.921466][ T5771] ? __pfx_seq_read+0x10/0x10 [ 73.921481][ T5771] ? __mutex_trylock_common+0x15f/0x270 [ 73.921509][ T5771] ? apparmor_file_permission+0x1fb/0x2b0 [ 73.921537][ T5771] ? __pfx_seq_read+0x10/0x10 [ 73.921554][ T5771] proc_reg_read+0x1e9/0x2e0 [ 73.921575][ T5771] ? __pfx_proc_reg_read+0x10/0x10 [ 73.921593][ T5771] vfs_read+0x213/0xa80 [ 73.921617][ T5771] ? __pfx___mutex_lock+0x10/0x10 [ 73.921637][ T5771] ? __pfx_vfs_read+0x10/0x10 [ 73.921657][ T5771] ? __fget_files+0x2a/0x420 [ 73.921674][ T5771] ? __fget_files+0x3a2/0x420 [ 73.921689][ T5771] ? __fget_files+0x2a/0x420 [ 73.921711][ T5771] ? fdget+0x1ac/0x250 [ 73.921735][ T5771] ksys_read+0x150/0x270 [ 73.921757][ T5771] ? __pfx_ksys_read+0x10/0x10 [ 73.921787][ T5771] do_syscall_64+0x166/0x520 [ 73.921803][ T5771] ? trace_irq_disable+0x3b/0x140 [ 73.921820][ T5771] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.921839][ T5771] ? clear_bhb_loop+0x70/0xc0 [ 73.921860][ T5771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.921880][ T5771] RIP: 0033:0x7fb641d9e1d9 [ 73.921904][ T5771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.921919][ T5771] RSP: 002b:00007fb642c8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 73.921944][ T5771] RAX: ffffffffffffffda RBX: 00007fb642025fa0 RCX: 00007fb641d9e1d9 [ 73.921958][ T5771] RDX: 0000000000002020 RSI: 00002000000005c0 RDI: 0000000000000003 [ 73.921970][ T5771] RBP: 00007fb641e35888 R08: 0000000000000000 R09: 0000000000000000 [ 73.921982][ T5771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.921993][ T5771] R13: 00007fb642026038 R14: 00007fb642025fa0 R15: 00007fffca9a33a8 [ 73.922023][ T5771] [ 73.961838][ T4929] Bluetooth: hci2: command tx timeout [ 74.037076][ T4929] Bluetooth: hci3: command tx timeout [ 74.090293][ T5755] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 74.215054][ T5749] usb 1-1: can't set first interface for hiFace device. [ 74.215084][ T5749] snd-usb-hiface 1-1:1.0: probe with driver snd-usb-hiface failed with error -5 [ 74.235071][ T5749] usb 1-1: USB disconnect, device number 2 [ 74.342727][ T5755] usb 2-1: unable to get BOS descriptor or descriptor too short [ 74.342774][ T5755] usb 2-1: New USB device found: idVendor=0582, idProduct=004c, bcdDevice=0.40 [ 74.354076][ T5755] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 74.382343][ T5755] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.382367][ T5755] usb 2-1: Product: syz [ 74.382380][ T5755] usb 2-1: Manufacturer: syz [ 74.382392][ T5755] usb 2-1: SerialNumber: syz [ 74.553652][ T5789] syz.3.16 uses obsolete (PF_INET,SOCK_PACKET) [ 74.616099][ T5755] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 74.657089][ T5749] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 74.816937][ T5749] usb 1-1: Using ep0 maxpacket: 8 [ 74.828850][ T5749] usb 1-1: unable to get BOS descriptor or descriptor too short [ 74.828899][ T5749] usb 1-1: New USB device found: idVendor=249c, idProduct=9006, bcdDevice=0.40 [ 74.831258][ T5749] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 74.831327][ T5749] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 74.831347][ T5749] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 74.834760][ T5749] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.834782][ T5749] usb 1-1: Product: syz [ 74.834795][ T5749] usb 1-1: Manufacturer: syz [ 74.834832][ T5749] usb 1-1: SerialNumber: syz [ 75.420049][ T5755] usb 2-1: failed to enable PITCH for EP 0x82 [ 75.423770][ T5755] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 75.423793][ T5755] usb 2-1: clock source 0 is not valid, cannot use [ 75.425822][ T5755] usb 2-1: 2:1: cannot get freq (v2/v3): err -71 [ 75.433135][ T5755] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 75.668949][ T5755] usb 2-1: USB disconnect, device number 2 [ 75.763553][ T5801] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 75.781012][ T46] usb 1-1: USB disconnect, device number 3 [ 75.852093][ T5804] FAULT_INJECTION: forcing a failure. [ 75.852093][ T5804] name failslab, interval 1, probability 0, space 0, times 0 [ 75.852120][ T5804] CPU: 1 UID: 0 PID: 5804 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) [ 75.852142][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 75.852153][ T5804] Call Trace: [ 75.852161][ T5804] [ 75.852169][ T5804] dump_stack_lvl+0xe8/0x150 [ 75.852195][ T5804] should_fail_ex+0x3eb/0x540 [ 75.852219][ T5804] should_failslab+0xa8/0x100 [ 75.852240][ T5804] __kmalloc_cache_noprof+0x9e/0x600 [ 75.852262][ T5804] ? bpf_prog_alloc_no_stats+0xd8/0x550 [ 75.852280][ T5804] ? bpf_prog_alloc_no_stats+0xd8/0x550 [ 75.852307][ T5804] bpf_prog_alloc_no_stats+0xd8/0x550 [ 75.852324][ T5804] ? bpf_prog_alloc+0x2a/0x1a0 [ 75.852344][ T5804] bpf_prog_alloc+0x3c/0x1a0 [ 75.852365][ T5804] bpf_prog_create_from_user+0xa7/0x440 [ 75.852386][ T5804] ? __pfx_seccomp_check_filter+0x10/0x10 [ 75.852409][ T5804] do_seccomp+0x791/0xdc0 [ 75.852434][ T5804] ? __se_sys_futex+0x3a8/0x450 [ 75.852454][ T5804] ? __pfx_do_seccomp+0x10/0x10 [ 75.852476][ T5804] ? rcu_is_watching+0x16/0xb0 [ 75.852503][ T5804] do_syscall_64+0x166/0x520 [ 75.852520][ T5804] ? trace_irq_disable+0x3b/0x140 [ 75.852537][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.852557][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 75.852578][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.852596][ T5804] RIP: 0033:0x7fb641d9e1d9 [ 75.852612][ T5804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.852626][ T5804] RSP: 002b:00007fb642c8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000013d [ 75.852646][ T5804] RAX: ffffffffffffffda RBX: 00007fb642025fa0 RCX: 00007fb641d9e1d9 [ 75.852659][ T5804] RDX: 00002000000000c0 RSI: 000000000000000a RDI: 0000000000000001 [ 75.852671][ T5804] RBP: 00007fb641e35888 R08: 0000000000000000 R09: 0000000000000000 [ 75.852683][ T5804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.852695][ T5804] R13: 00007fb642026038 R14: 00007fb642025fa0 R15: 00007fffca9a33a8 [ 75.852725][ T5804] [ 75.890951][ T4929] Bluetooth: hci0: command tx timeout [ 75.961524][ T4929] Bluetooth: hci1: command tx timeout [ 76.048600][ T4929] Bluetooth: hci2: command tx timeout [ 76.057794][ T5808] netlink: 112 bytes leftover after parsing attributes in process `syz.3.21'. [ 76.131686][ T4929] Bluetooth: hci3: command tx timeout [ 76.162616][ T5810] udevd[5810]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 76.700546][ T154] IPVS: starting estimator thread 0... [ 76.703640][ T5830] IPVS: rr: UDP [::1]:8080 - no destination available [ 76.787994][ T5749] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 76.789966][ T5831] IPVS: using max 32 ests per chain, 76800 per kthread [ 76.803212][ T5835] FAULT_INJECTION: forcing a failure. [ 76.803212][ T5835] name failslab, interval 1, probability 0, space 0, times 0 [ 76.803237][ T5835] CPU: 0 UID: 0 PID: 5835 Comm: syz.3.30 Not tainted syzkaller #0 PREEMPT(full) [ 76.803258][ T5835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.803268][ T5835] Call Trace: [ 76.803276][ T5835] [ 76.803283][ T5835] dump_stack_lvl+0xe8/0x150 [ 76.803308][ T5835] should_fail_ex+0x3eb/0x540 [ 76.803333][ T5835] should_failslab+0xa8/0x100 [ 76.803353][ T5835] __kmalloc_cache_noprof+0x9e/0x600 [ 76.803374][ T5835] ? alloc_netdev_mqs+0xc4a/0x1240 [ 76.803393][ T5835] ? alloc_netdev_mqs+0xc4a/0x1240 [ 76.803412][ T5835] ? __xdp_rxq_info_reg+0x171/0x280 [ 76.803435][ T5835] alloc_netdev_mqs+0xc4a/0x1240 [ 76.803461][ T5835] tun_set_iff+0x51d/0xf20 [ 76.803487][ T5835] __tun_chr_ioctl+0x7e5/0x1e70 [ 76.803528][ T5835] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 76.803545][ T5835] ? __fget_files+0x2a/0x420 [ 76.803568][ T5835] ? __fget_files+0x2a/0x420 [ 76.803590][ T5835] ? bpf_lsm_file_ioctl+0x9/0x20 [ 76.803609][ T5835] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 76.803627][ T5835] __se_sys_ioctl+0xfc/0x170 [ 76.803649][ T5835] do_syscall_64+0x166/0x520 [ 76.803666][ T5835] ? trace_irq_disable+0x3b/0x140 [ 76.803683][ T5835] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.803703][ T5835] ? clear_bhb_loop+0x70/0xc0 [ 76.803723][ T5835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.803741][ T5835] RIP: 0033:0x7fb641d9e1d9 [ 76.803759][ T5835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.803773][ T5835] RSP: 002b:00007fb642c8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.803793][ T5835] RAX: ffffffffffffffda RBX: 00007fb642025fa0 RCX: 00007fb641d9e1d9 [ 76.803807][ T5835] RDX: 0000200000000200 RSI: 00000000400454ca RDI: 0000000000000004 [ 76.803819][ T5835] RBP: 00007fb641e35888 R08: 0000000000000000 R09: 0000000000000000 [ 76.803830][ T5835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.803840][ T5835] R13: 00007fb642026038 R14: 00007fb642025fa0 R15: 00007fffca9a33a8 [ 76.803871][ T5835] [ 76.949223][ T5749] usb 3-1: Using ep0 maxpacket: 32 [ 76.960465][ T5749] usb 3-1: New USB device found: idVendor=046d, idProduct=c31c, bcdDevice=0.40 [ 76.962748][ T5749] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.962775][ T5749] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 76.962808][ T5749] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.996774][ T5749] usb 3-1: config 0 descriptor?? [ 77.032989][ T5749] hub 3-1:0.0: USB hub found [ 77.227795][ T5749] hub 3-1:0.0: 1 port detected [ 77.509599][ T5843] FAULT_INJECTION: forcing a failure. [ 77.509599][ T5843] name failslab, interval 1, probability 0, space 0, times 0 [ 77.509629][ T5843] CPU: 1 UID: 0 PID: 5843 Comm: syz.1.33 Not tainted syzkaller #0 PREEMPT(full) [ 77.509649][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.509660][ T5843] Call Trace: [ 77.509667][ T5843] [ 77.509675][ T5843] dump_stack_lvl+0xe8/0x150 [ 77.509702][ T5843] should_fail_ex+0x3eb/0x540 [ 77.509725][ T5843] should_failslab+0xa8/0x100 [ 77.509745][ T5843] __kmalloc_cache_noprof+0x9e/0x600 [ 77.509765][ T5843] ? alloc_mnt_ns+0xae/0x2c0 [ 77.509780][ T5843] ? alloc_mnt_ns+0xae/0x2c0 [ 77.509804][ T5843] alloc_mnt_ns+0xae/0x2c0 [ 77.509825][ T5843] open_detached_copy+0x95/0x540 [ 77.509842][ T5843] ? do_getname+0x151/0x250 [ 77.509863][ T5843] vfs_open_tree+0x34f/0x3c0 [ 77.509883][ T5843] ? __pfx_vfs_open_tree+0x10/0x10 [ 77.509911][ T5843] __x64_sys_open_tree+0x93/0x110 [ 77.509932][ T5843] do_syscall_64+0x166/0x520 [ 77.509950][ T5843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.509971][ T5843] ? clear_bhb_loop+0x70/0xc0 [ 77.509990][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.510008][ T5843] RIP: 0033:0x7efe8a59e1d9 [ 77.510025][ T5843] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.510039][ T5843] RSP: 002b:00007efe8b4f1028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 77.510057][ T5843] RAX: ffffffffffffffda RBX: 00007efe8a825fa0 RCX: 00007efe8a59e1d9 [ 77.510070][ T5843] RDX: 0000000000089901 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 77.510086][ T5843] RBP: 00007efe8a635888 R08: 0000000000000000 R09: 0000000000000000 [ 77.510098][ T5843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.510109][ T5843] R13: 00007efe8a826038 R14: 00007efe8a825fa0 R15: 00007fff5eeaffb8 [ 77.510141][ T5843] [ 77.757973][ T5837] workqueue: work func _RNvXs8_NtCsbuTvttuFvbr_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCswPamI0U300_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ enqueued on deprecated workqueue. Use system_{percpu|dfl}_wq instead. [ 77.760735][ T5838] syz.3.31 (5838) used greatest stack depth: 19248 bytes left [ 77.866350][ T5749] hub 3-1:0.0: activate --> -90 [ 78.176911][ T1225] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 78.285342][ T5736] usb 3-1: USB disconnect, device number 2 [ 78.338564][ T1225] usb 2-1: New USB device found: idVendor=04b4, idProduct=ed81, bcdDevice=0.40 [ 78.339513][ T1225] usb 2-1: config 1 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 78.339552][ T1225] usb 2-1: config 1 interface 0 has no altsetting 0 [ 78.342214][ T1225] usb 2-1: string descriptor 0 read error: -22 [ 78.342325][ T1225] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.346477][ T5856] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 78.368550][ T5755] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 78.557384][ T5755] usb 1-1: New USB device found: idVendor=091e, idProduct=0003, bcdDevice=0.01 [ 78.558349][ T5755] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 78.558394][ T5755] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 78.558406][ T5755] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 78.559983][ T5755] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 78.560003][ T5755] usb 1-1: Product: syz [ 78.560017][ T5755] usb 1-1: Manufacturer: syz [ 78.564553][ T5864] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 78.634371][ T5755] garmin_gps 1-1:1.0: Garmin GPS usb/tty converter detected [ 78.650426][ T5755] usb 1-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 78.822959][ T58] usb 1-1: USB disconnect, device number 4 [ 78.852511][ T58] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 78.853549][ T58] garmin_gps 1-1:1.0: device disconnected [ 79.012198][ T1225] cypress 0003:04B4:ED81.0001: unknown main item tag 0x5 [ 79.012259][ T1225] cypress 0003:04B4:ED81.0001: unknown main item tag 0x0 [ 79.012275][ T1225] cypress 0003:04B4:ED81.0001: unknown main item tag 0x1 [ 79.012290][ T1225] cypress 0003:04B4:ED81.0001: unknown global tag 0xc [ 79.012297][ T1225] cypress 0003:04B4:ED81.0001: item 0 0 1 12 parsing failed [ 79.012710][ T1225] cypress 0003:04B4:ED81.0001: parse failed [ 79.012793][ T1225] cypress 0003:04B4:ED81.0001: probe with driver cypress failed with error -22 [ 79.214150][ T1225] usb 2-1: USB disconnect, device number 3 [ 79.337121][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.421658][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.516705][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.608632][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.647676][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.648979][ T54] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.649747][ T54] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.651316][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.651875][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.808091][ T5736] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 79.809101][ T1225] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 79.839831][ T12] bridge_slave_1: left allmulticast mode [ 79.839866][ T12] bridge_slave_1: left promiscuous mode [ 79.840808][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.871411][ T12] bridge_slave_0: left allmulticast mode [ 79.871434][ T12] bridge_slave_0: left promiscuous mode [ 79.871699][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.978463][ T5736] usb 1-1: Using ep0 maxpacket: 16 [ 79.978624][ T1225] usb 4-1: Using ep0 maxpacket: 16 [ 79.979446][ T5736] usb 1-1: New USB device found: idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 79.980780][ T1225] usb 4-1: New USB device found: idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 79.985132][ T1225] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 79.985161][ T1225] usb 4-1: config 0 interface 0 has no altsetting 0 [ 79.994967][ T5891] xs_local_setup_socket: unhandled error (13) connecting to /var/run/gssproxy.sock [ 80.008388][ T5736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.008410][ T5736] usb 1-1: Product: syz [ 80.008423][ T5736] usb 1-1: Manufacturer: syz [ 80.008436][ T5736] usb 1-1: SerialNumber: syz [ 80.070650][ T1225] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.070674][ T1225] usb 4-1: Product: syz [ 80.070687][ T1225] usb 4-1: Manufacturer: syz [ 80.070700][ T1225] usb 4-1: SerialNumber: syz [ 80.111190][ T5736] usb 1-1: config 0 descriptor?? [ 80.119994][ T1225] usb 4-1: config 0 descriptor?? [ 80.142796][ T5736] usb 1-1: selecting invalid altsetting 1 [ 80.142815][ T5736] technisat-usb2: could not set alternate setting to 0 [ 80.324371][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 80.340930][ T5736] technisat-usb2: firmware version: 0.0 [ 80.340973][ T5736] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 80.375710][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 80.382905][ T12] bond0 (unregistering): Released all slaves [ 80.405326][ T1225] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input5 [ 80.467615][ T5904] netlink: 14 bytes leftover after parsing attributes in process `syz.1.53'. [ 80.671273][ T1225] rc_core: IR keymap rc-imon-pad not found [ 80.671292][ T1225] Registered IR keymap rc-empty [ 80.671571][ T1225] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 80.671590][ T1225] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 80.771512][ T1225] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 80.773859][ T5736] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 80.777866][ T5736] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 80.777926][ T5736] usb 1-1: media controller created [ 80.778404][ T5736] technisat-usb2: i2c-error: out failed 53 = -22 [ 80.778514][ T5736] dvb-usb: MAC address reading failed. [ 80.783396][ T1225] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input6 [ 80.796615][ T1225] imon 4-1:0.0: iMON device (15c2:0041) on usb<4:2> initialized [ 80.854124][ T5736] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 80.944144][ T5880] technisat-usb2: i2c-error: out failed 41 = -22 [ 81.070390][ T5273] 8021q: adding VLAN 0 to HW filter on device eth1 [ 81.119470][ T5736] DVB: Unable to find symbol stv090x_attach() [ 81.120753][ T5736] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 81.198065][ T5736] rc_core: IR keymap rc-technisat-usb2 not found [ 81.198083][ T5736] Registered IR keymap rc-empty [ 81.199867][ T5736] rc rc1: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1 [ 81.206131][ T5736] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc1/input7 [ 81.211580][ C0] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 81.212270][ T1225] usb 4-1: USB disconnect, device number 2 [ 81.244245][ T5736] dvb-usb: schedule remote query interval to 100 msecs. [ 81.256205][ T5736] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 81.277893][ T5736] usb 1-1: USB disconnect, device number 5 [ 81.303831][ T12] hsr_slave_0: left promiscuous mode [ 81.305050][ T12] hsr_slave_1: left promiscuous mode [ 81.317919][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 81.317950][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 81.322119][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 81.322136][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 81.361688][ T12] veth1_macvtap: left promiscuous mode [ 81.361721][ T12] veth0_macvtap: left promiscuous mode [ 81.361840][ T12] veth1_vlan: left promiscuous mode [ 81.361888][ T12] veth0_vlan: left promiscuous mode [ 81.513838][ T5736] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 81.641839][ T27] cfg80211: failed to load regulatory.db [ 81.717516][ T54] Bluetooth: hci2: command tx timeout [ 82.134615][ T5944] sg_write: data in/out 469212/136 bytes for SCSI command 0x0-- guessing data in; [ 82.134615][ T5944] program syz.3.60 not setting count and/or reply_len properly [ 82.212833][ T32] audit: type=1326 audit(1791501991.280:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5941 comm="syz.0.59" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6ec4f9e1d9 code=0x0 [ 82.321977][ T5951] kvm: user requested TSC rate below hardware speed [ 82.365910][ T12] team0 (unregistering): Port device team_slave_1 removed [ 82.402693][ T12] team0 (unregistering): Port device team_slave_0 removed [ 82.545958][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 82.629851][ T5736] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 82.784557][ T5736] usb 2-1: unable to get BOS descriptor or descriptor too short [ 82.784604][ T5736] usb 2-1: New USB device found: idVendor=1235, idProduct=0010, bcdDevice=0.40 [ 82.789502][ T5736] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.789524][ T5736] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 82.794259][ T5736] usb 2-1: string descriptor 0 read error: -22 [ 82.794389][ T5736] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.810141][ T5736] usb 2-1: selecting invalid altsetting 1 [ 82.810828][ T5736] usb 2-1: unit 3 not found! [ 83.029706][ T5736] usb 2-1: unit 0 not found! [ 83.156477][ T5977] FAULT_INJECTION: forcing a failure. [ 83.156477][ T5977] name failslab, interval 1, probability 0, space 0, times 0 [ 83.156509][ T5977] CPU: 0 UID: 0 PID: 5977 Comm: syz.0.66 Tainted: G L syzkaller #0 PREEMPT(full) [ 83.156534][ T5977] Tainted: [L]=SOFTLOCKUP [ 83.156542][ T5977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.156552][ T5977] Call Trace: [ 83.156560][ T5977] [ 83.156568][ T5977] dump_stack_lvl+0xe8/0x150 [ 83.156602][ T5977] should_fail_ex+0x3eb/0x540 [ 83.156627][ T5977] should_failslab+0xa8/0x100 [ 83.156648][ T5977] __kmalloc_noprof+0xf9/0x710 [ 83.156668][ T5977] ? sk_prot_alloc+0xe7/0x210 [ 83.156685][ T5977] ? sk_prot_alloc+0xe7/0x210 [ 83.156709][ T5977] sk_prot_alloc+0xe7/0x210 [ 83.156725][ T5977] ? sk_alloc+0x27/0x390 [ 83.156745][ T5977] sk_alloc+0x3a/0x390 [ 83.156767][ T5977] pppol2tp_create+0x32/0x210 [ 83.156788][ T5977] pppox_create+0x131/0x1b0 [ 83.156812][ T5977] __sock_create+0x4b5/0xac0 [ 83.156839][ T5977] __sys_socket+0xd6/0x1b0 [ 83.156860][ T5977] __x64_sys_socket+0x7a/0x90 [ 83.156880][ T5977] do_syscall_64+0x166/0x520 [ 83.156898][ T5977] ? trace_irq_disable+0x3b/0x140 [ 83.156915][ T5977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.156935][ T5977] ? clear_bhb_loop+0x70/0xc0 [ 83.156956][ T5977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.156975][ T5977] RIP: 0033:0x7f6ec4f9e1d9 [ 83.156994][ T5977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.157019][ T5977] RSP: 002b:00007f6ec5e3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 83.157040][ T5977] RAX: ffffffffffffffda RBX: 00007f6ec5225fa0 RCX: 00007f6ec4f9e1d9 [ 83.157054][ T5977] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000018 [ 83.157065][ T5977] RBP: 00007f6ec5035888 R08: 0000000000000000 R09: 0000000000000000 [ 83.157077][ T5977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.157088][ T5977] R13: 00007f6ec5226038 R14: 00007f6ec5225fa0 R15: 00007ffc2f7d9d68 [ 83.157117][ T5977] [ 83.249824][ T5736] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 83.266932][ T5736] usb 2-1: USB disconnect, device number 4 [ 83.338245][ T5882] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.338405][ T5882] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.338531][ T5882] bridge_slave_0: entered allmulticast mode [ 83.340045][ T5882] bridge_slave_0: entered promiscuous mode [ 83.344017][ T5882] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.344214][ T5882] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.344404][ T5882] bridge_slave_1: entered allmulticast mode [ 83.347905][ T5882] bridge_slave_1: entered promiscuous mode [ 83.392025][ T5882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.395827][ T5882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.434780][ T5882] team0: Port device team_slave_0 added [ 83.440796][ T5882] team0: Port device team_slave_1 added [ 83.497582][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.497597][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.497618][ T5882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.510142][ T5882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.510156][ T5882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.510179][ T5882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.644444][ T5882] hsr_slave_0: entered promiscuous mode [ 83.645373][ T5882] hsr_slave_1: entered promiscuous mode [ 83.646095][ T5882] debugfs: 'hsr0' already exists in 'hsr' [ 83.646113][ T5882] Cannot create hsr debugfs directory [ 83.803345][ T54] Bluetooth: hci2: command tx timeout [ 83.832842][ T5988] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 84.119053][ T5998] syzkaller1: entered promiscuous mode [ 84.119083][ T5998] syzkaller1: entered allmulticast mode [ 84.539318][ T5882] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.548179][ T5882] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.552974][ T5882] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.583763][ T5882] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.584722][ T5882] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.604289][ T5882] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.605206][ T5882] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.631174][ T5882] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.812595][ T5882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.860976][ T5882] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.873603][ T1049] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.873695][ T1049] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.885692][ T1049] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.885787][ T1049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.423111][ T6059] sit0: entered promiscuous mode [ 85.437401][ T6059] netlink: 'syz.3.83': attribute type 1 has an invalid length. [ 85.437423][ T6059] netlink: 1 bytes leftover after parsing attributes in process `syz.3.83'. [ 85.645967][ T5882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.714690][ T5882] veth0_vlan: entered promiscuous mode [ 85.734578][ T5882] veth1_vlan: entered promiscuous mode [ 85.779825][ T5882] veth0_macvtap: entered promiscuous mode [ 85.785952][ T5882] veth1_macvtap: entered promiscuous mode [ 85.843261][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.860358][ T5882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.877603][ T54] Bluetooth: hci2: command tx timeout [ 85.919327][ T4174] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.919367][ T4174] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.919398][ T4174] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.919425][ T4174] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.001581][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.001600][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.051232][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.051251][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.421063][ T6097] netlink: 12 bytes leftover after parsing attributes in process `syz.3.91'. [ 86.647235][ T46] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 86.807937][ T46] usb 2-1: New USB device found: idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 86.809138][ T46] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.834192][ T46] usb 2-1: config 0 descriptor?? [ 87.050491][ T46] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 87.317460][ T46] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 1 [ 87.317485][ T46] [drm] Initialized udl on minor 1 [ 87.709496][ T5749] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 87.736973][ T58] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 87.857875][ T5749] usb 4-1: New USB device found: idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 87.861386][ T5749] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.861408][ T5749] usb 4-1: Product: syz [ 87.861421][ T5749] usb 4-1: Manufacturer: syz [ 87.861434][ T5749] usb 4-1: SerialNumber: syz [ 87.864742][ T5749] usb 4-1: config 0 descriptor?? [ 87.882427][ T5749] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 87.889640][ T58] usb 1-1: Using ep0 maxpacket: 8 [ 87.899895][ T58] usb 1-1: New USB device found: idVendor=0518, idProduct=0002, bcdDevice=0.00 [ 87.949640][ T58] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 87.949671][ T58] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 87.949694][ T58] usb 1-1: config 0 interface 0 has no altsetting 0 [ 87.949725][ T58] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.955592][ T58] usb 1-1: config 0 descriptor?? [ 87.957372][ T54] Bluetooth: hci2: command tx timeout [ 88.121916][ T6143] warning: `syz.2.104' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 88.394267][ T58] input: HID 0518:0002 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0518:0002.0002/input/input8 [ 88.521235][ T58] ezkey 0003:0518:0002.0002: input,hiddev0,hidraw0: USB HID v0.01 Device [HID 0518:0002] on usb-dummy_hcd.0-1/input0 [ 88.587989][ T10] usb 1-1: USB disconnect, device number 6 [ 88.664114][ T6155] fido_id[6155]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 89.092002][ T5749] gspca_stk1135: reg_w 0xd err -71 [ 89.093069][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093083][ T5749] gspca_stk1135: Sensor write failed [ 89.093108][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093116][ T5749] gspca_stk1135: Sensor write failed [ 89.093140][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093149][ T5749] gspca_stk1135: Sensor read failed [ 89.093173][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093180][ T5749] gspca_stk1135: Sensor read failed [ 89.093185][ T5749] gspca_stk1135: Detected sensor type unknown (0x0) [ 89.093218][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093226][ T5749] gspca_stk1135: Sensor read failed [ 89.093251][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093259][ T5749] gspca_stk1135: Sensor read failed [ 89.093282][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093290][ T5749] gspca_stk1135: Sensor write failed [ 89.093313][ T5749] gspca_stk1135: serial bus timeout: status=0x00 [ 89.093321][ T5749] gspca_stk1135: Sensor write failed [ 89.093395][ T5749] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 89.117459][ T5749] usb 4-1: USB disconnect, device number 3 [ 89.427615][ T5736] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 89.577437][ T5736] usb 1-1: New USB device found: idVendor=0506, idProduct=4601, bcdDevice=1.00 [ 89.578365][ T5736] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 89.578389][ T5736] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 89.578424][ T5736] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.758579][ T5749] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 89.918322][ T5749] usb 3-1: New USB device found: idVendor=06b9, idProduct=4061, bcdDevice=1.00 [ 89.920012][ T5749] usb 3-1: config 1 has an invalid interface number: 27 but max is 1 [ 89.920035][ T5749] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.920052][ T5749] usb 3-1: config 1 has 3 interfaces, different from the descriptor's value: 2 [ 89.920069][ T5749] usb 3-1: config 1 has no interface number 2 [ 89.920112][ T5749] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x87 has invalid maxpacket 64 [ 89.920124][ T5749] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 89.920145][ T5749] usb 3-1: config 1 interface 1 has no altsetting 0 [ 89.923336][ T5749] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.923356][ T5749] usb 3-1: Product: syz [ 89.923370][ T5749] usb 3-1: Manufacturer: syz [ 89.923383][ T5749] usb 3-1: SerialNumber: syz [ 90.353281][ T6164] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 90.481666][ T6178] FAULT_INJECTION: forcing a failure. [ 90.481666][ T6178] name failslab, interval 1, probability 0, space 0, times 0 [ 90.481699][ T6178] CPU: 1 UID: 0 PID: 6178 Comm: syz.3.118 Tainted: G L syzkaller #0 PREEMPT(full) [ 90.481727][ T6178] Tainted: [L]=SOFTLOCKUP [ 90.481734][ T6178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.481745][ T6178] Call Trace: [ 90.481753][ T6178] [ 90.481760][ T6178] dump_stack_lvl+0xe8/0x150 [ 90.481777][ T6178] should_fail_ex+0x3eb/0x540 [ 90.481791][ T6178] should_failslab+0xa8/0x100 [ 90.481802][ T6178] ? vm_area_dup+0x28/0x760 [ 90.481812][ T6178] kmem_cache_alloc_noprof+0x9c/0x600 [ 90.481832][ T6178] ? vm_area_dup+0x28/0x760 [ 90.481857][ T6178] vm_area_dup+0x28/0x760 [ 90.481874][ T6178] ? dup_mmap+0x875/0x1dc0 [ 90.481895][ T6178] dup_mmap+0x87d/0x1dc0 [ 90.481922][ T6178] ? __pfx_dup_mmap+0x10/0x10 [ 90.481933][ T6178] ? do_raw_spin_lock+0x12b/0x2f0 [ 90.481951][ T6178] ? lock_acquire+0x115/0x350 [ 90.481975][ T6178] copy_mm+0x115/0x470 [ 90.481998][ T6178] copy_process+0x1ea2/0x4430 [ 90.482039][ T6178] ? copy_process+0xd11/0x4430 [ 90.482070][ T6178] ? __pfx_copy_process+0x10/0x10 [ 90.482087][ T6178] kernel_clone+0x2d7/0x940 [ 90.482101][ T6178] ? __pfx_kernel_clone+0x10/0x10 [ 90.482119][ T6178] ? do_futex+0x3e7/0x4e0 [ 90.482145][ T6178] __x64_sys_clone+0x1b6/0x230 [ 90.482168][ T6178] ? __pfx___x64_sys_clone+0x10/0x10 [ 90.482200][ T6178] ? __pfx___se_sys_futex+0x10/0x10 [ 90.482217][ T6178] ? __pfx_ksys_write+0x10/0x10 [ 90.482234][ T6178] do_syscall_64+0x166/0x520 [ 90.482244][ T6178] ? trace_irq_disable+0x3b/0x140 [ 90.482253][ T6178] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.482264][ T6178] ? clear_bhb_loop+0x70/0xc0 [ 90.482284][ T6178] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.482304][ T6178] RIP: 0033:0x7fb641d9e1d9 [ 90.482321][ T6178] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.482336][ T6178] RSP: 002b:00007fb642c8cfd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 90.482356][ T6178] RAX: ffffffffffffffda RBX: 00007fb642025fa0 RCX: 00007fb641d9e1d9 [ 90.482367][ T6178] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000004000 [ 90.482374][ T6178] RBP: 00007fb641e35888 R08: 0000000000000000 R09: 0000000000000000 [ 90.482380][ T6178] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 90.482386][ T6178] R13: 00007fb642026038 R14: 00007fb642025fa0 R15: 00007fffca9a33a8 [ 90.482403][ T6178] [ 90.836321][ T5736] pegasus 1-1:1.0: can't reset MAC [ 90.836642][ T5736] pegasus 1-1:1.0: probe with driver pegasus failed with error -5 [ 90.855592][ T5736] usb 1-1: USB disconnect, device number 7 [ 90.988925][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43200 failed (-71)! [ 90.988982][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43100 failed (-71)! [ 90.989011][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43000 failed (-71)! [ 90.989042][ C0] ATM dev 0: usbatm_complete: urb 0xffff88802b45f700 failed (-71)! [ 91.097207][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43200 failed (-71)! [ 91.097261][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43100 failed (-71)! [ 91.097299][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43000 failed (-71)! [ 91.097319][ C0] ATM dev 0: usbatm_complete: urb 0xffff88802b45f700 failed (-71)! [ 91.167019][ T5682] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 91.191015][ T5749] speedtch 3-1:1.27: speedtch_bind: failed to claim interface 0 (-16)! [ 91.191046][ T5749] speedtch 3-1:1.27: usbatm_usb_probe: bind failed: -16! [ 91.191096][ T5749] speedtch 3-1:1.27: probe with driver speedtch failed with error -16 [ 91.213258][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43200 failed (-71)! [ 91.213307][ C0] ATM dev 0: usbatm_complete: urb 0xffff888035b43100 failed (-71)! [ 91.240477][ T5749] usb 3-1: USB disconnect, device number 3 [ 91.337012][ T5682] usb 4-1: Using ep0 maxpacket: 8 [ 91.338500][ T5682] usb 4-1: New USB device found: idVendor=0582, idProduct=0025, bcdDevice=0.40 [ 91.339323][ T5682] usb 4-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 91.339336][ T5682] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 91.339347][ T5682] usb 4-1: config 1 has no interface number 0 [ 91.339368][ T5682] usb 4-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0x31, changing to 0x1 [ 91.339381][ T5682] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 91.340936][ T5682] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.340949][ T5682] usb 4-1: Product: syz [ 91.340956][ T5682] usb 4-1: Manufacturer: syz [ 91.340963][ T5682] usb 4-1: SerialNumber: syz [ 91.773639][ T6202] FAULT_INJECTION: forcing a failure. [ 91.773639][ T6202] name failslab, interval 1, probability 0, space 0, times 0 [ 91.773670][ T6202] CPU: 0 UID: 0 PID: 6202 Comm: syz.2.128 Tainted: G L syzkaller #0 PREEMPT(full) [ 91.773699][ T6202] Tainted: [L]=SOFTLOCKUP [ 91.773706][ T6202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.773718][ T6202] Call Trace: [ 91.773725][ T6202] [ 91.773734][ T6202] dump_stack_lvl+0xe8/0x150 [ 91.773759][ T6202] should_fail_ex+0x3eb/0x540 [ 91.773784][ T6202] should_failslab+0xa8/0x100 [ 91.773806][ T6202] __kmalloc_noprof+0xf9/0x710 [ 91.773826][ T6202] ? __list_lru_init+0x114/0x680 [ 91.773843][ T6202] ? __list_lru_init+0x114/0x680 [ 91.773869][ T6202] __list_lru_init+0x114/0x680 [ 91.773889][ T6202] ? __rhashtable_init_noprof+0x869/0xbd0 [ 91.773913][ T6202] xfs_init_buftarg+0x143/0x2f0 [ 91.773936][ T6202] xfs_alloc_buftarg+0x252/0x330 [ 91.773959][ T6202] xfs_open_devices+0x1b6/0x570 [ 91.773986][ T6202] xfs_fs_fill_super+0x388/0x15a0 [ 91.774005][ T6202] ? setup_bdev_super+0x586/0x680 [ 91.774027][ T6202] get_tree_bdev_flags+0x430/0x4f0 [ 91.774047][ T6202] ? __pfx_xfs_fs_fill_super+0x10/0x10 [ 91.774065][ T6202] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 91.774095][ T6202] vfs_get_tree+0x92/0x2a0 [ 91.774116][ T6202] do_new_mount+0x325/0xb00 [ 91.774142][ T6202] ? __pfx_do_new_mount+0x10/0x10 [ 91.774163][ T6202] ? ns_capable+0x84/0xe0 [ 91.774184][ T6202] ? path_mount+0x647/0x1050 [ 91.774206][ T6202] ? user_path_at+0xd4/0x160 [ 91.774227][ T6202] __se_sys_mount+0x31d/0x420 [ 91.774252][ T6202] ? __pfx___se_sys_mount+0x10/0x10 [ 91.774278][ T6202] ? __x64_sys_mount+0x20/0xc0 [ 91.774299][ T6202] do_syscall_64+0x166/0x520 [ 91.774317][ T6202] ? trace_irq_disable+0x3b/0x140 [ 91.774334][ T6202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.774353][ T6202] ? clear_bhb_loop+0x70/0xc0 [ 91.774375][ T6202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.774394][ T6202] RIP: 0033:0x7f4ae339e1d9 [ 91.774411][ T6202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.774426][ T6202] RSP: 002b:00007f4ae4240028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 91.774446][ T6202] RAX: ffffffffffffffda RBX: 00007f4ae3625fa0 RCX: 00007f4ae339e1d9 [ 91.774460][ T6202] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000140 [ 91.774473][ T6202] RBP: 00007f4ae3435888 R08: 0000000000000000 R09: 0000000000000000 [ 91.774486][ T6202] R10: 0000000000200001 R11: 0000000000000246 R12: 0000000000000000 [ 91.774497][ T6202] R13: 00007f4ae3626038 R14: 00007f4ae3625fa0 R15: 00007ffc598431c8 [ 91.774536][ T6202] [ 92.074744][ T5736] usb 4-1: USB disconnect, device number 4 [ 92.358679][ T46] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffff92 [ 92.362386][ T46] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 92.381165][ T46] usb 2-1: USB disconnect, device number 5 [ 92.486888][ T58] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 92.650752][ T58] usb 3-1: New USB device found: idVendor=05f9, idProduct=ffff, bcdDevice=1.00 [ 92.652711][ T58] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 92.652738][ T58] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 92.655843][ T58] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.655864][ T58] usb 3-1: Product: syz [ 92.655876][ T58] usb 3-1: Manufacturer: syz [ 92.655889][ T58] usb 3-1: SerialNumber: syz [ 92.665900][ T6212] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 92.666020][ T6212] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 92.671078][ T58] usbserial_generic 3-1:1.0: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 92.671095][ T58] usbserial_generic 3-1:1.0: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 92.671133][ T58] usbserial_generic 3-1:1.0: generic converter detected [ 92.680989][ T58] usb 3-1: generic converter now attached to ttyUSB0 [ 92.847624][ T46] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 92.893304][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.893684][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894030][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894122][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894275][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894324][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894462][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.894660][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895019][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895111][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895549][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895591][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895895][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.895985][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.896133][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.896501][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.896601][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.896776][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.896851][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.897002][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.902892][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.902987][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903151][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903218][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903334][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903380][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903561][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.903870][ C1] generic ttyUSB0: usb_serial_generic_write_bulk_callback - nonzero urb status: -71 [ 92.912261][ T5682] usb 3-1: USB disconnect, device number 4 [ 92.928972][ T5682] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 92.931319][ T5682] usbserial_generic 3-1:1.0: device disconnected [ 93.023049][ T46] usb 2-1: New USB device found: idVendor=18d1, idProduct=1eaf, bcdDevice=0.00 [ 93.024143][ T46] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 93.024166][ T46] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 93.036095][ T46] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.036116][ T46] usb 2-1: Product: syz [ 93.036129][ T46] usb 2-1: Manufacturer: syz [ 93.036142][ T46] usb 2-1: SerialNumber: syz [ 93.410531][ T6243] FAULT_INJECTION: forcing a failure. [ 93.410531][ T6243] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 93.410563][ T6243] CPU: 0 UID: 0 PID: 6243 Comm: syz.0.145 Tainted: G L syzkaller #0 PREEMPT(full) [ 93.410590][ T6243] Tainted: [L]=SOFTLOCKUP [ 93.410597][ T6243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.410608][ T6243] Call Trace: [ 93.410616][ T6243] [ 93.410624][ T6243] dump_stack_lvl+0xe8/0x150 [ 93.410651][ T6243] should_fail_ex+0x3eb/0x540 [ 93.410676][ T6243] prepare_alloc_pages+0x21e/0x5f0 [ 93.410703][ T6243] __alloc_frozen_pages_noprof+0x17a/0x400 [ 93.410728][ T6243] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 93.410757][ T6243] ? policy_nodemask+0x2cc/0x8e0 [ 93.410782][ T6243] alloc_pages_mpol+0x21e/0x390 [ 93.410807][ T6243] folio_alloc_mpol_noprof+0x39/0x160 [ 93.410829][ T6243] shmem_alloc_and_add_folio+0x43e/0xf60 [ 93.410850][ T6243] ? filemap_get_entry+0xcd/0x3f0 [ 93.410876][ T6243] ? filemap_map_pages+0x1d1/0x2170 [ 93.410896][ T6243] ? __pfx_filemap_get_entry+0x10/0x10 [ 93.410915][ T6243] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 93.410951][ T6243] shmem_get_folio_gfp+0x594/0x1330 [ 93.410988][ T6243] shmem_fault+0x179/0x390 [ 93.411023][ T6243] __do_fault+0x138/0x2a0 [ 93.411043][ ** replaying previous printk message ** [ 93.411043][ T6243] ? do_pte_missing+0x139f/0x3570 [ 93.411061][ T6243] do_pte_missing+0x21d2/0x3570 [ 93.411091][ T6243] ? handle_mm_fault+0xf1/0x3750 [ 93.411115][ T6243] handle_mm_fault+0x1a53/0x3750 [ 93.411145][ T6243] ? handle_mm_fault+0xf1/0x3750 [ 93.411175][ T6243] ? __pfx_handle_mm_fault+0x10/0x10 [ 93.411195][ T6243] ? follow_page_pte+0x748/0xf10 [ 93.411224][ T6243] ? __pfx_follow_page_pte+0x10/0x10 [ 93.411256][ T6243] __get_user_pages+0x1670/0x2750 [ 93.411312][ T6243] populate_vma_page_range+0x311/0x3f0 [ 93.411336][ T6243] ? __pfx_populate_vma_page_range+0x10/0x10 [ 93.411360][ T6243] ? down_read+0x2b9/0x320 [ 93.411383][ T6243] __mm_populate+0x25f/0x390 [ 93.411405][ T6243] ? __pfx___mm_populate+0x10/0x10 [ 93.411434][ T6243] vm_mmap_pgoff+0x353/0x4e0 [ 93.411459][ T6243] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 93.411481][ T6243] ? rcu_is_watching+0x16/0xb0 [ 93.411504][ T6243] ? ksys_mmap_pgoff+0xf3/0x760 [ 93.411523][ T6243] ? __x64_sys_mmap+0x7f/0x140 [ 93.411545][ T6243] do_syscall_64+0x166/0x520 [ 93.411563][ T6243] ? trace_irq_disable+0x3b/0x140 [ 93.411579][ T6243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.411600][ T6243] ? clear_bhb_loop+0x70/0xc0 [ 93.411620][ T6243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.411639][ T6243] RIP: 0033:0x7f6ec4f9e1d9 [ 93.411657][ T6243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.411672][ T6243] RSP: 002b:00007f6ec5e3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 93.411692][ T6243] RAX: ffffffffffffffda RBX: 00007f6ec5225fa0 RCX: 00007f6ec4f9e1d9 [ 93.411707][ T6243] RDX: b635773f06ebbeef RSI: 0000000000b36000 RDI: 0000200000000000 [ 93.411720][ T6243] RBP: 00007f6ec5035888 R08: ffffffffffffffff R09: 0000000000000000 [ 93.411733][ T6243] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 93.411744][ T6243] R13: 00007f6ec5226038 R14: 00007f6ec5225fa0 R15: 00007ffc2f7d9d68 [ 93.411777][ T6243] [ 93.553994][ T6245] [ 93.755649][ T6245] ====================================================== [ 93.762648][ T6245] WARNING: possible circular locking dependency detected [ 93.769687][ T6245] syzkaller #0 Tainted: G L [ 93.775741][ T6245] ------------------------------------------------------ [ 93.782737][ T6245] syz.3.146/6245 is trying to acquire lock: [ 93.788609][ T6245] ffff88807e3e2460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 93.797303][ T6245] [ 93.797303][ T6245] but task is already holding lock: [ 93.804650][ T6245] ffff88805c9258e0 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: vfs_fileattr_set+0x162/0xd10 [ 93.814986][ T6245] [ 93.814986][ T6245] which lock already depends on the new lock. [ 93.814986][ T6245] [ 93.825376][ T6245] [ 93.825376][ T6245] the existing dependency chain (in reverse order) is: [ 93.834373][ T6245] [ 93.834373][ T6245] -> #3 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}: [ 93.843050][ T6245] down_read+0x45/0x320 [ 93.847720][ T6245] lookup_slow+0x46/0x80 [ 93.852476][ T6245] ovl_lookup_single+0x323/0xe90 [ 93.857922][ T6245] ovl_lookup_layer+0x377/0x440 [ 93.863283][ T6245] ovl_lookup+0x9ae/0x1c80 [ 93.868210][ T6245] lookup_open+0x94b/0x1970 [ 93.873220][ T6245] path_openat+0x673/0x1da0 [ 93.878229][ T6245] do_file_open+0x23e/0x4a0 [ 93.883241][ T6245] do_sys_openat2+0x115/0x200 [ 93.888424][ T6245] __x64_sys_openat+0x138/0x170 [ 93.893778][ T6245] do_syscall_64+0x166/0x520 [ 93.898876][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.905276][ T6245] [ 93.905276][ T6245] -> #2 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}: [ 93.913081][ T6245] __d_alloc_parallel+0xc32/0x1700 [ 93.918708][ T6245] __lookup_slow+0x82/0x2f0 [ 93.923717][ T6245] lookup_slow+0x59/0x80 [ 93.928465][ T6245] link_path_walk+0xd22/0x1910 [ 93.933732][ T6245] path_openat+0x1c4/0x1da0 [ 93.938743][ T6245] do_file_open+0x23e/0x4a0 [ 93.943759][ T6245] do_sys_openat2+0x115/0x200 [ 93.948942][ T6245] __x64_sys_openat+0x138/0x170 [ 93.954299][ T6245] do_syscall_64+0x166/0x520 [ 93.959395][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.965796][ T6245] [ 93.965796][ T6245] -> #1 (&type->i_mutex_dir_key#5){++++}-{4:4}: [ 93.974214][ T6245] down_write+0x91/0x200 [ 93.978966][ T6245] lookup_open+0x246/0x1970 [ 93.983974][ T6245] path_openat+0x673/0x1da0 [ 93.988983][ T6245] do_file_open+0x23e/0x4a0 [ 93.993989][ T6245] do_sys_openat2+0x115/0x200 [ 93.999173][ T6245] __x64_sys_openat+0x138/0x170 [ 94.004533][ T6245] do_syscall_64+0x166/0x520 [ 94.009632][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.016030][ T6245] [ 94.016030][ T6245] -> #0 (sb_writers#5){.+.+}-{0:0}: [ 94.023403][ T6245] __lock_acquire+0x164c/0x2de0 [ 94.028766][ T6245] lock_acquire+0x115/0x350 [ 94.033783][ T6245] sb_start_write+0x48/0x1c0 [ 94.038886][ T6245] mnt_want_write+0x41/0x90 [ 94.043901][ T6245] ovl_fileattr_set+0xe4/0x390 [ 94.049185][ T6245] vfs_fileattr_set+0xa2b/0xd10 [ 94.054545][ T6245] ioctl_setflags+0x305/0x370 [ 94.059731][ T6245] do_vfs_ioctl+0x9f2/0x1530 [ 94.064830][ T6245] __se_sys_ioctl+0x82/0x170 [ 94.069934][ T6245] do_syscall_64+0x166/0x520 [ 94.075035][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.081436][ T6245] [ 94.081436][ T6245] other info that might help us debug this: [ 94.081436][ T6245] [ 94.091648][ T6245] Chain exists of: [ 94.091648][ T6245] sb_writers#5 --> DCACHE_PAR_LOOKUP --> &ovl_i_mutex_dir_key[depth] [ 94.091648][ T6245] [ 94.105637][ T6245] Possible unsafe locking scenario: [ 94.105637][ T6245] [ 94.113075][ T6245] CPU0 CPU1 [ 94.118425][ T6245] ---- ---- [ 94.123771][ T6245] lock(&ovl_i_mutex_dir_key[depth]); [ 94.129218][ T6245] lock(DCACHE_PAR_LOOKUP); [ 94.136313][ T6245] lock(&ovl_i_mutex_dir_key[depth]); [ 94.144275][ T6245] rlock(sb_writers#5); [ 94.148543][ T6245] [ 94.148543][ T6245] *** DEADLOCK *** [ 94.148543][ T6245] [ 94.156671][ T6245] locks held by syz.3.146/6245: 2, last CPU#1: [ 94.162810][ T6245] #0: ffff88807c8f0460 (sb_writers#17){.+.+}-{0:0}, at: mnt_want_write_file+0x60/0x200 [ 94.172557][ T6245] #1: ffff88805c9258e0 (&ovl_i_mutex_dir_key[depth]){++++}-{4:4}, at: vfs_fileattr_set+0x162/0xd10 [ 94.183330][ T6245] [ 94.183330][ T6245] stack backtrace: [ 94.190861][ T6245] CPU: 1 UID: 0 PID: 6245 Comm: syz.3.146 Tainted: G L syzkaller #0 PREEMPT(full) [ 94.201696][ T6245] Tainted: [L]=SOFTLOCKUP [ 94.206000][ T6245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.216040][ T6245] Call Trace: [ 94.219317][ T6245] [ 94.222249][ T6245] dump_stack_lvl+0xe8/0x150 [ 94.226840][ T6245] print_circular_bug+0x2e2/0x300 [ 94.231861][ T6245] check_noncircular+0x12f/0x150 [ 94.236793][ T6245] __lock_acquire+0x164c/0x2de0 [ 94.241646][ T6245] ? kick_process+0xeb/0x160 [ 94.246229][ T6245] ? task_work_add+0x38b/0x420 [ 94.250989][ T6245] lock_acquire+0x115/0x350 [ 94.255482][ T6245] ? mnt_want_write+0x41/0x90 [ 94.260154][ T6245] sb_start_write+0x48/0x1c0 [ 94.264738][ T6245] ? mnt_want_write+0x41/0x90 [ 94.269402][ T6245] mnt_want_write+0x41/0x90 [ 94.273895][ T6245] ovl_fileattr_set+0xe4/0x390 [ 94.278646][ T6245] ? __pfx_ovl_fileattr_set+0x10/0x10 [ 94.284007][ T6245] ? bpf_lsm_capable+0x9/0x20 [ 94.288674][ T6245] ? security_capable+0x7e/0x2c0 [ 94.293602][ T6245] ? fscrypt_prepare_setflags+0x62/0x3c0 [ 94.299234][ T6245] vfs_fileattr_set+0xa2b/0xd10 [ 94.304080][ T6245] ? mnt_get_write_access+0x66/0x280 [ 94.309358][ T6245] ? __pfx_vfs_fileattr_set+0x10/0x10 [ 94.314726][ T6245] ? mnt_want_write_file+0x172/0x200 [ 94.320002][ T6245] ioctl_setflags+0x305/0x370 [ 94.324669][ T6245] ? __pfx_ioctl_setflags+0x10/0x10 [ 94.329856][ T6245] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.335476][ T6245] ? tomoyo_path_number_perm+0x219/0x5f0 [ 94.341102][ T6245] do_vfs_ioctl+0x9f2/0x1530 [ 94.345681][ T6245] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 94.350700][ T6245] ? do_futex+0x3e7/0x4e0 [ 94.355031][ T6245] ? __fget_files+0x2a/0x420 [ 94.359609][ T6245] ? __fget_files+0x2a/0x420 [ 94.364186][ T6245] ? __fget_files+0x2a/0x420 [ 94.368761][ T6245] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.373692][ T6245] __se_sys_ioctl+0x82/0x170 [ 94.378272][ T6245] do_syscall_64+0x166/0x520 [ 94.382850][ T6245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.388908][ T6245] ? clear_bhb_loop+0x70/0xc0 [ 94.393569][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.399448][ T6245] RIP: 0033:0x7fb641d9e1d9 [ 94.403850][ T6245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.423445][ T6245] RSP: 002b:00007fb642c8d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.431845][ T6245] RAX: ffffffffffffffda RBX: 00007fb642025fa0 RCX: 00007fb641d9e1d9 [ 94.439809][ T6245] RDX: 0000200000000000 RSI: 0000000040086602 RDI: 0000000000000003 [ 94.447765][ T6245] RBP: 00007fb641e35888 R08: 0000000000000000 R09: 0000000000000000 [ 94.455728][ T6245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.463690][ T6245] R13: 00007fb642026038 R14: 00007fb642025fa0 R15: 00007fffca9a33a8 [ 94.471660][ T6245] [ 94.478096][ T46] usb 2-1: failed to set cport flags for port 0 [ 94.478144][ T46] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 94.481492][ T46] es2_ap_driver 2-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 95.542727][ T5736] usb 2-1: USB disconnect, device number 6