last executing test programs: 3.1960205s ago: executing program 3 (id=2143): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x70bd2c, 0x0, {{@in=@loopback, @in=@empty, 0x0, 0x5, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0xfffffffd, 0x32}, @in=@local, {0x1, 0x3, 0x9, 0x9, 0x2, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x5f, 0xa}, {0x1}, 0x100, 0x0, 0x2, 0x0, 0x0, 0x23}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, &(0x7f0000000140)="0e0412b60f0c0df0f2747782bb714a766118ff5aa329fa94da4900", 0xfdef) openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zone_size\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='4\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000001000)="53464f5a05abbf5900"/4096, 0x1000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='./dev/nullb1\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)='zonefs\x00', 0x0, 0x0) 2.924858837s ago: executing program 3 (id=2146): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x0, 0xff}, {}, @raw32={[0x0, 0x100]}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r1, &(0x7f0000000200), 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000c00)) 2.731754281s ago: executing program 3 (id=2150): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x2, 0x0, @ioapic={0x8000000, 0x11, 0x10001, 0xfffffffe, 0x0, [{0x2, 0xc, 0x87, '\x00', 0x8}, {0x8, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x67}, {0x0, 0x5, 0xd4, '\x00', 0x9}, {0x7, 0x9, 0xe, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x2, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7c, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0xf, 0x6, 0x2, '\x00', 0xb}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0x10, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x2}]}}) 2.687538423s ago: executing program 1 (id=2151): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x40003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0x4, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80000000, 0x7, 0x3, 0x7}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 2.686845603s ago: executing program 0 (id=2152): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004ea", @ANYRES32=r0, @ANYRESDEC], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001340)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x11, 0x148, 0x250, 0x0, 0x318, 0x2a8, 0x2a8, 0x318, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1e8, 0x250, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'veth0_vlan\x00', {0xb, 0x2, 0x2f, 0xb2, 0x6, 0x8, 0x8, 0x18}, {0xf2}}}, @common=@unspec=@state={{0x28}, {0x3}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1, 0xb, 0xb, 0x4468, 'syz1\x00', 'syz0\x00', {0x9}}}}, {{@uncond, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x6, 0xf93b, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x410) 2.512770787s ago: executing program 3 (id=2153): openat$kvm(0xffffffffffffff9c, 0x0, 0x280, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_usb_connect$uac3(0x3, 0x100, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x582, 0x5, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xee, 0x3, 0x1, 0x9, 0x40, 0x2, {0x8, 0xb, 0x2, 0x0, 0x1, 0xa440c52f05515fab, 0x30, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x9, 0x2e, 0x3}, [@cluster_info_segment={0x6, 0x20, 0x1, 0xb7, 0xd}, @cluster_info_segment={0x6, 0x20, 0x0, 0x86, 0x3}, @selector_unit={0xd, 0x24, 0xc, 0x7, 0x8, "1325e95f65780bb8"}, @multiply_unit={0xb, 0x24, 0xd, 0x2, 0xb, 0x800, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x2, 0x3, 0x6, '\\('}, @as_header={0x17, 0x24, 0x1, 0xc, 0x6, 0x1, 0x5, 0x9, 0x9, 0x4, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x8, 0x7, 0xaf, 0x6}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0xd, 0x1, 0x5, 0x10, "e78cb988b00511"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0xf1, 0x4, 0x7, 0x9, '|', "02"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2d, 0x10, 0x8, 0x2, 0xe6}]}, {{0x9, 0x5, 0x1, 0x9, 0x220, 0x45, 0x9, 0x5, {0xa, 0x25, 0x25, 0x8, 0xb8, 0xa60b}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x9, 0x22bc, 0x1, "dd"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x4}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x3, 0xd, 0xf5, {0xa, 0x25, 0x25, 0xd, 0x2, 0xdb}}}}}}}}]}}, &(0x7f0000000740)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0xd0, 0x9, 0xe, 0x10, 0x4}, 0x51, &(0x7f0000000240)={0x5, 0xf, 0x51, 0x5, [@wireless={0xb, 0x10, 0x1, 0x8, 0x1, 0x4, 0x1, 0x4, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x2, 0x8, 0x6}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0x9, 0xf000, 0x9, [0x60, 0xff00c0, 0xff3f50]}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "aef0492ffb483cb5f32c6cfc0c2f7029"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x49, 0x77, 0x3, 0x2, 0xc}]}, 0xa, [{0x1b, &(0x7f00000002c0)=@string={0x1b, 0x3, "5aec5d50f428ebe193bce2de30dbb1bf5c310e826b8c45f409"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x43e}}, {0xd0, &(0x7f0000000340)=@string={0xd0, 0x3, "09cb5e382381d326fc06bed058d04148e5856d5e9d4fb13075b0c0f87e788779c2ebe16b5faafd236aeb547f98b3e93b51d82c1ef1508394c2546da7fcb62b9644e54825113310d367108028d542d40494466afbe0ad4e8f1c947f6a5c0a00d3bd9f04570afe626f36c299c616e5cf8af7670495827963d459055a11183f5297cb972720d20881a606650ee4a99bebcaffe9ba6730f70d9fc97308fef40b3f35fa07cd450f6aa1e4845495a66632eeb0a479956cd7c3581052c6ce827f9c7c92841545f21329e850663fb3849867"}}, {0xa4, &(0x7f0000000440)=@string={0xa4, 0x3, "e67b3cfb15cb64499b5156563cdb1a0a3b4446df4ccf4f56ae271f70db7d7052a35a9b06916055709cc401ff8d080a2c0b49181d4ea41bfc2d6f9f9bcb2d84a88779bedea083a51adb24f1e67ca96d8ddf182efe7eeb703febbc50cbe418698e23fad553c16d6f86726731bf0f083a29b44e01226107bf0fdb08d860853a25869f8546258743019598c41024320a08e0ffe5429df62bc6782b8b99204fc52d4921a8"}}, {0x5, &(0x7f0000000500)=@string={0x5, 0x3, 'ptS'}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x413}}, {0xe0, &(0x7f0000000580)=@string={0xe0, 0x3, "2eb09d16b93854b09355a4aa6521ebb7305c5195171b61c48ef3753a4f248ea8a934564460c47843f2c487748e2353e9d940084c8ca497ffc71028326713b9a7ff154ffe065e979bc9f5e3dcfad9f5f077be2fc5bf5d55532b6c25b11a0e6ae370b99ba77beacc49c499e6097482d904b9f8e6939fd510b90a79b88f584ec7738e6c85e1c59e81eb335459e086a1dfed114b3333abfc3be2ede85f654855bb6c7b1545a6d6c2c4960fe808796383adebdb6ec29ad81aa0c00c044b22e0dcb4849c1e2fe3a476b32a9b4d2e3330055820fa40f6b0ddbe1c6950995eaa2058"}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x457}}]}) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0xa, 0x3, 0x3a) getsockopt$MRT6(r0, 0x29, 0x24, 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 2.495058728s ago: executing program 1 (id=2154): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000340)={'adq12b\x00', [0x100, 0x1f, 0x1, 0x1fc, 0x8, 0xfd, 0x3, 0x20000000, 0xa, 0x2000000e, 0x2, 0xb51, 0x1, 0x0, 0x6, 0x2, 0x12, 0xa, 0x7, 0x402, 0x3, 0x3, 0x7, 0x2, 0xfffffff4, 0x5, 0x4, 0x423b, 0x2, 0x7, 0xa]}) r0 = syz_open_dev$video(&(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000080)={0xa, 0x1, 0x0, {0x1}}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x8a, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) io_uring_register$IORING_REGISTER_ZCRX_IFQ(0xffffffffffffffff, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={0x0}, &(0x7f0000000300)={&(0x7f0000002000), 0x0, 0x1}}, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x19, 0x0, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df4bb84674d78e", 0xf}], 0x1}}], 0x1, 0x20008000) recvmsg(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) 1.553915371s ago: executing program 1 (id=2158): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"568139cb5050a7a31ebfc4330c2bf68f86101d9a301cbe14b15f4f23031ceb319db01a783479d6b9a1201fb1cc7235f57f4251316b05b60536a1611da4d3a6a06d308650343e59d307e34d8c2ec3ef05629a47f994dd2e9f8b9ce05b338ae7db5267bc4082bd43ca93b78947a7c79e82df466d4fee2b222f1ebde976d2272a4f52329796330ee917cc4f5b36c45ac1ecdaaf3dffe03c40b7c209e44cfeb08aad00e1b48da4289228d7d82d4f6a661942ace64f115d3cc6ac80f74420c390d89e7ab2133567aa41047d775e333184cc0b468ec5eb9bc3cb0fa00516e5452bf32a9e760f07efd5a5e5eb37eaff28ef92bb59498369808bdd310a4a95a5414a8ff450411ff67d3167eec8372455a19c0c5a608adfebded6974660fd85308a07860e16f62963da37448d6e1218f2092fb3d1662804623b63a07f3e5e881df9a5ac27ce3f1519003118aa6170ff423eb292dc70147bde37963f72d0642660e7107753167886fc10e108631a9ea4d6752145b8646187ba7e152b6bcbcedd6b83fb9435d5c8e8d5d25a3f173745eab94a4a296572d459a50d622c8769dc57a7cdf7efe9f259dc36f538d1836362f1bcb2c4ebceae7e3655d5e98ba481906f3f4bd03710005994eca8cbf8302dc8e2c21736b697b5f868e8af96fa8bbb1ae56571616a70ce05970d1e4142f303f7586fd2fc6f0ee3dce1db6524dd6aa28faab046e074df38c96b89aa3f24ce0728f16539744b7867e19c856e670e8b799d52da435bb07beea683a52e4d13602e7d4675a798a12c898ad5b00caa34313ff8fb6c3407cf815eca9795cffd9a24959653cc816851048ebf0772bebdd3ff9b8cfbd2c65c30e41586b00a14943e4815361789158139d440c4f627edb8ed59e1ca0bb0c60106e09635fa9335677337c554db885f75b8f9fffffff1ea9796f8258de36636346ab768856bbdfc51843a53701423d75c1f43be24469aa03d366bbfb81218b31e5c0ad716efea52175c2fa78317cafb16ee173eb5e9428509ca4c8f9bf798adc7da1758a9c0334e44200c0578495ff805fce84456205caa70f0976a8603f84cb542d0df1416602321c587556785af525ddf5548b4f51113c52a7a17042faf6c8c02d8d1835e0f67f60ab392c20fc12188db029e45bb77cfccc423671d52ec5a92d08c2bb27a676b66f3b89ac084d99e3f516426a015268a1f3fb91b13c8baba49a0765a305c13cd1f47b3ea7a6393182759b614a08d36192a8b68abef6e5c16849452c74af3a9f854e1f2bc1c2eac2f055f8ffd8fdaa6bb04a68850c585f433c0e6b8dba1401fce5aab11d75d2323d8079891175096e31013c80a3763511c86f2fbc31a33458c52059ebe253dcd3e837fed39765a11842028df450479dd56e1325cd8d088ff12a8f7dd23f200"}) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0x7fff}, {0x400000b1, 0x0, 0x89}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r3, 0x0, 0x0) 1.432292474s ago: executing program 2 (id=2159): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r0, 0x2285, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x0, 0xff}, {}, @raw32={[0x0, 0x100]}}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote}], 0x38) write$sndseq(r1, &(0x7f0000000200), 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000c00)) 1.381393055s ago: executing program 2 (id=2160): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}, @TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(0xffffffffffffffff) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.126592672s ago: executing program 2 (id=2161): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c000280"], 0x48}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1.052649043s ago: executing program 2 (id=2162): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x40003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0x4, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80000000, 0x7, 0x3, 0x7}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 1.002820775s ago: executing program 0 (id=2163): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x16e) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000340)='r:s/p ./file0:0\f', 0x10) 935.889066ms ago: executing program 3 (id=2164): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) setns(0xc9, 0x20000000) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000527000/0x2000)=nil, 0x2000, 0x3) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a, 0xfffffffe, 0x4}, 0x9c) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x4, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000001c0)={0x1}) 792.2744ms ago: executing program 0 (id=2165): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, &(0x7f0000000140)="0e0412b60f0c0df0f2747782bb714a766118ff5aa329fa94da4900", 0xfdef) openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zone_size\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='4\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000001000)="53464f5a05abbf5900"/4096, 0x1000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='./dev/nullb1\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)='zonefs\x00', 0x0, 0x0) 718.127682ms ago: executing program 2 (id=2166): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x633, 0x70bd2c, 0x0, {{@in=@loopback, @in=@empty, 0x0, 0x5, 0x0, 0xfffd, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0xfffffffd, 0x32}, @in=@local, {0x1, 0x3, 0x9, 0x9, 0x2, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x5f, 0xa}, {0x1}, 0x100, 0x0, 0x2, 0x0, 0x0, 0x23}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20040}, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000004c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0xffff, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x3, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x39}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev/nullb1\x00', 0x2, 0x0) pwrite64(r2, &(0x7f0000001000)="53464f5a05abbf5900"/4096, 0x1000, 0x0) close(r2) 658.814933ms ago: executing program 0 (id=2167): r0 = socket$packet(0x11, 0x3, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xffffffff, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x28, 0x3, 0x8, 0x5, 0x0, 0x0, {}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_UNACK={0x8, 0xb, 0x1, 0x0, 0x5}]}]}, 0x28}}, 0x0) write(r0, &(0x7f0000000000)="0100000000", 0x5) 592.609855ms ago: executing program 2 (id=2168): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000340)={'adq12b\x00', [0x100, 0x1f, 0x1, 0x1fc, 0x8, 0xfd, 0x3, 0x20000000, 0xa, 0x2000000e, 0x2, 0xb51, 0x1, 0x0, 0x6, 0x2, 0x12, 0xa, 0x7, 0x402, 0x3, 0x3, 0x7, 0x2, 0xfffffff4, 0x5, 0x4, 0x423b, 0x2, 0x7, 0xa]}) r0 = syz_open_dev$video(&(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f0000000080)={0xa, 0x1, 0x0, {0x1}}) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x8a, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) io_uring_register$IORING_REGISTER_ZCRX_IFQ(0xffffffffffffffff, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x2, &(0x7f0000000200)={0x0}, &(0x7f0000000300)={&(0x7f0000002000), 0x0, 0x1}}, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x19, 0x0, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="00000000b99b5c65df4bb84674d78e", 0xf}], 0x1}}], 0x1, 0x20008000) recvmsg(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) 529.332947ms ago: executing program 0 (id=2169): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000300)={0x2, 0x12c, @ioapic={0xffff1000, 0x8000, 0xfffff5ab, 0x7fffffff, 0x0, [{0x1, 0x81, 0xfd, '\x00', 0x4}, {0x7, 0x1, 0x1, '\x00', 0x6}, {0x7, 0x3, 0xe, '\x00', 0x3b}, {0x4a, 0xe, 0xd6, '\x00', 0x86}, {0xd, 0x2, 0x10, '\x00', 0x2}, {0xd, 0x1, 0xf9, '\x00', 0x3}, {0x2, 0xa, 0x27, '\x00', 0x6}, {0x8, 0xd, 0x2a, '\x00', 0x8}, {0x1, 0x0, 0xa, '\x00', 0x2}, {0x8, 0xd6, 0x3, '\x00', 0x8}, {0x9e, 0x6, 0x3}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x45, 0x51, 0x6}, {0xe, 0xfc, 0x0, '\x00', 0x1}, {0x8, 0x2, 0x6, '\x00', 0x4}, {0xd, 0x1b, 0x1, '\x00', 0x3}, {0x2, 0xa, 0xd2, '\x00', 0x8}, {0xa, 0x0, 0xcb, '\x00', 0x6}, {0x0, 0x7, 0x4, '\x00', 0x1a}, {0xb, 0x8, 0x81, '\x00', 0xda}, {0x3, 0x87, 0x6, '\x00', 0x7}, {0x40, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x21, 0x1, '\x00', 0x7}, {0x8, 0x9, 0x2, '\x00', 0x6}]}}) 528.228276ms ago: executing program 1 (id=2170): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c000280"], 0x48}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 434.585039ms ago: executing program 1 (id=2171): add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="85", 0x1, 0xffffffffffffffff) r0 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05604, &(0x7f0000000400)={0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x10002, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000080)=0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xb, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004800}, 0x4010) close(r1) 356.267451ms ago: executing program 0 (id=2172): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004ea", @ANYRES32=r0, @ANYRESDEC], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001340)=@raw={'raw\x00', 0x8, 0x3, 0x3b0, 0x0, 0x11, 0x148, 0x250, 0x0, 0x318, 0x2a8, 0x2a8, 0x318, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1e8, 0x250, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'veth0_vlan\x00', {0xb, 0x2, 0x2f, 0xb2, 0x6, 0x8, 0x8, 0x18}, {0xf2}}}, @common=@unspec=@state={{0x28}, {0x3}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1, 0xb, 0xb, 0x4468, 'syz1\x00', 'syz0\x00', {0x9}}}}, {{@uncond, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x6, 0xf93b, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x410) 321.729802ms ago: executing program 1 (id=2173): openat$kvm(0xffffffffffffff9c, 0x0, 0x280, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_usb_connect$uac3(0x3, 0x100, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x582, 0x5, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xee, 0x3, 0x1, 0x9, 0x40, 0x2, {0x8, 0xb, 0x2, 0x0, 0x1, 0xa440c52f05515fab, 0x30, 0x3}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x9, 0x2e, 0x3}, [@cluster_info_segment={0x6, 0x20, 0x1, 0xb7, 0xd}, @cluster_info_segment={0x6, 0x20, 0x0, 0x86, 0x3}, @selector_unit={0xd, 0x24, 0xc, 0x7, 0x8, "1325e95f65780bb8"}, @multiply_unit={0xb, 0x24, 0xd, 0x2, 0xb, 0x800, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x2, 0x3, 0x6, '\\('}, @as_header={0x17, 0x24, 0x1, 0xc, 0x6, 0x1, 0x5, 0x9, 0x9, 0x4, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0x8, 0x7, 0xaf, 0x6}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0xd, 0x1, 0x5, 0x10, "e78cb988b00511"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0xf1, 0x4, 0x7, 0x9, '|', "02"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2d, 0x10, 0x8, 0x2, 0xe6}]}, {{0x9, 0x5, 0x1, 0x9, 0x220, 0x45, 0x9, 0x5, {0xa, 0x25, 0x25, 0x8, 0xb8, 0xa60b}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x9, 0x22bc, 0x1, "dd"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x4}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x3, 0xd, 0xf5, {0xa, 0x25, 0x25, 0xd, 0x2, 0xdb}}}}}}}}]}}, &(0x7f0000000740)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0xd0, 0x9, 0xe, 0x10, 0x4}, 0x51, &(0x7f0000000240)={0x5, 0xf, 0x51, 0x5, [@wireless={0xb, 0x10, 0x1, 0x8, 0x1, 0x4, 0x1, 0x4, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0x2, 0x8, 0x6}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0x9, 0xf000, 0x9, [0x60, 0xff00c0, 0xff3f50]}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "aef0492ffb483cb5f32c6cfc0c2f7029"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x49, 0x77, 0x3, 0x2, 0xc}]}, 0xa, [{0x1b, &(0x7f00000002c0)=@string={0x1b, 0x3, "5aec5d50f428ebe193bce2de30dbb1bf5c310e826b8c45f409"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x43e}}, {0xd0, &(0x7f0000000340)=@string={0xd0, 0x3, "09cb5e382381d326fc06bed058d04148e5856d5e9d4fb13075b0c0f87e788779c2ebe16b5faafd236aeb547f98b3e93b51d82c1ef1508394c2546da7fcb62b9644e54825113310d367108028d542d40494466afbe0ad4e8f1c947f6a5c0a00d3bd9f04570afe626f36c299c616e5cf8af7670495827963d459055a11183f5297cb972720d20881a606650ee4a99bebcaffe9ba6730f70d9fc97308fef40b3f35fa07cd450f6aa1e4845495a66632eeb0a479956cd7c3581052c6ce827f9c7c92841545f21329e850663fb3849867"}}, {0xa4, &(0x7f0000000440)=@string={0xa4, 0x3, "e67b3cfb15cb64499b5156563cdb1a0a3b4446df4ccf4f56ae271f70db7d7052a35a9b06916055709cc401ff8d080a2c0b49181d4ea41bfc2d6f9f9bcb2d84a88779bedea083a51adb24f1e67ca96d8ddf182efe7eeb703febbc50cbe418698e23fad553c16d6f86726731bf0f083a29b44e01226107bf0fdb08d860853a25869f8546258743019598c41024320a08e0ffe5429df62bc6782b8b99204fc52d4921a8"}}, {0x5, &(0x7f0000000500)=@string={0x5, 0x3, 'ptS'}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x413}}, {0xe0, &(0x7f0000000580)=@string={0xe0, 0x3, "2eb09d16b93854b09355a4aa6521ebb7305c5195171b61c48ef3753a4f248ea8a934564460c47843f2c487748e2353e9d940084c8ca497ffc71028326713b9a7ff154ffe065e979bc9f5e3dcfad9f5f077be2fc5bf5d55532b6c25b11a0e6ae370b99ba77beacc49c499e6097482d904b9f8e6939fd510b90a79b88f584ec7738e6c85e1c59e81eb335459e086a1dfed114b3333abfc3be2ede85f654855bb6c7b1545a6d6c2c4960fe808796383adebdb6ec29ad81aa0c00c044b22e0dcb4849c1e2fe3a476b32a9b4d2e3330055820fa40f6b0ddbe1c6950995eaa2058"}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x810}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x457}}]}) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x3, 0x3a) sendmsg$IPSET_CMD_SWAP(r0, 0x0, 0x800) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 0s ago: executing program 3 (id=2174): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write(r0, &(0x7f0000000500)='transport=tcp,traddr=127.0.0.1,trsvcid=8009,nqn=t', 0x31) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e71858"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) sendmsg$NL80211_CMD_AUTHENTICATE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002abd7000010000002500000008000300", @ANYRES32=r3, @ANYBLOB="08003500000000000a0006000802110002020200"/32], 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x40000) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16, @ANYBLOB="0100fcffffff000000002f00000010000380040004"], 0x3c}}, 0x0) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x918) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r5 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x1) ioctl$BLKTRACESETUP(r5, 0xc0481273, 0x0) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/mapper/control\x00', 0x0, 0x0) sendto$inet(r6, &(0x7f0000000800)="d120711c8da24bebb6099fd9f66cb50e1c5de10f622bedc8bd1154a1bc14f6b06b546a47f76f256de2a3d1befb3c045d4e36d85d80e75582e4bac95ea62f6893fda9c664c0c3307047eab9eb28f7447b341c84c4a5e8d72dd82bac34f40c1c9cd595fe138e58ab8036687ee12f12cc1849f45c6a6fca6cb7e9df7b224d61e9da7b18ccfdac1c9bad22f6896e38dc267a2b7e3e43a1e7f21f4d234b85e5add43a0b84767784516ceeec245c7721607e37b5d1f1d8b85493d69f24416b52c31ac4b9610bc6897e9ba5dcedc3c3d58cbd6a576dc894e4684b2b33890692f14542b07e99638f547a0a460e93f3243c0f09e1569bc12ce2529486d18a8509e2b6d7d5461cbfbc93c0ff1568b7a2eee9c1d437e983994c27ea13fb3de8461dfefb4a1df2dae36c1d1a96a860ef9e65ca9c816b1d9661942d09a1462c16e7629677fc10f8b6aed0638a457f8ab0d1c66f7d17a774993cc3112bfff26285088e30ba11ee54aef402bd8e56ae3f5db68ad5764950d7e57562baa9857a497abe6d4776fda105cd04edaf086e7de08a9b4f0f4ba8efdf9c32b530723f343e2d5b68fae20596cc9b0b41bf6b8a536de03f55a88a1216e41196c1986399f6c36af648a78f34f911dd78a0cd3c20c482edd8092bf8cabe8ea4b4778106257aab2b5f8489aa9bcd3212d9b370fb0f3a20f01a8b4f0a523994674f7ab1b81ac3b056a10c831e1a20504aed9e9544cceeeedb45622b2c99f0c959ead1a12fe41162e77d7878d31b95f93abab6ef4420e56eeae888b5a55b3e45e8d1c18fe36289963f6d06a01b48d2785ac5aa3a902643909d24bb21df6b3f537362c5be7e360ff2ceb7a3e27c90e9c7e6b5c9655d17b5fc025efffbe5c82e4c35be562dab5714c093fe729ecc27b4a5412d6cd1e017671e1a39baa94bd44cd7dd2a85d4058a5238aae8417f77dea698a601f37960e3871ff718835f3e5d3ab25060b0299798637e1a153362c526e8abe225251944e3d05e424b255a73a87eee6d47e86b39f309a3fe0f266b15d345d75ba160931db34870359a9760b024c64c71567a9b631b5c5e6c75003924455ebe0bded3cc1ea707e70dcec26c0256cff24123a5f3291a6b122f46982645f05351d420744f3cd5c0ff25ab5204353e7203c2cf9e1e3b6f536f747cd9cdf855d9d8a978263c992a711d8a63aa15aafc9e6d3a87a7fccf16f7ce15a70771f8b5b15b122ff685bd939fc795bca065b6b3796c6133ddb47958549e43205dfb4502ba082fa1db71c453b7035ff9c80f1f38454b06d65a767327437e057ccf32a55ccc0386ae8d0f19851503097158bf961f533fd569121e7852460c2885493d712db1e9a6521d3f8046d7c134a4eaaaab16fdcd2045e0ce9ebe2c4a1daf939c5814ad4bf25af7f0d9b6d4933f4e1f711304b3e10911d1d3d252f176cb9d957a6646f16157b316e525b6883d9dc11e8a4b3a296f54cd773666146b71de557552a1fc67ac6ae2f0e213ed9d58eb397291f0037ff7054ba17a75b680ec5ea934fda0037185dc753f9a2e7690448900cbe42031ea40272329df575cdbc7be96e6c82fca4de95bd81cebc8bd04d21477d2330ae97e0b46e4d1256acff686440d3574804badb427172321d45fc73f87ccd502568448a3daf131bed44eeaf671659ae357f2b0a010b110ea9cb7b7e0a3c09eae9de4af3f664b6d0c462978e3baac53d44f7fe73af59fce70352e4f496a28802e069f79e7a7fd80c89694066bbfa743b7d260bb3ffa8d17c0e606dc4783d758df71a4ec8b75782efc7b2cee7f7b80cd9750ba9d59e3fc8a31b75971e88e4ffdd4d7a0f841c207dcae7d8834a352d124e4b033e50c9479e6bb1a3673adbd04b0e9fa1fead4f3524d2ad61d919c6811a4876536dada9866debf2ebe27b587f60ae521674fe2dc5710a2b58bd4fcba8a39ef297ef0f51ffaef48865e44e8958103e91effbd8e0c01cc460634d03419ac9e17245d3a522bbb340dfa2bcf1b3297126ab2f34e6f84c5365e9028ce3bbb6099cd57305cf11c002ecae8456b745a1b7a44e0f660eb27b7ade0019485cc87aa3297644f40c26f5cd12ba0e5f00da05b120988c9ec486dd25347c98acd9269c723c631c0a8a989836e451c4d98656588b763ef17abc21555048ae72984e1c35309fd3b3da8723a038748829030f8f0d43f63b7a3f972c2f51b0384fe659a6ed78c6e01898a9f94df475cf4554a69473d7cd0fbae010652754885794781915c50a008fea86adc2fea4327e1abb0d0ea8882b88c1818e4eb6a3ab1112034f2531c70702b12c9a795f23d36583ec872bed914842953ee45c29731555df1d0223e0bd4a4e586ab2770fde4e033a48cbb6d8b3e8e1ba355409ecd35aac47b182ec56794b36d23782be5c36064d5216c583c8745baff4270831545df8627c30d2a0a41e4aa0f2ddfbcc444a3769d056699445add3d80e25a87a740813cfa966c351bd5cf9354357e136090f327a790ca545e3ec9794a7a64829aba424393064409caff6c0f55a0b7bb73263fa1419f0927a26202a7e2ea7d0ebea810ce71fa74eba543a88fe29eddef1191665132d447cfc2ee06920d7a70319c15a8ddf1fac109118af44e30b7edfb9469352e8c568e0569b43012adea34e0545ee7be54d02a2c50b71fd2732971fbe0769bf20a8309c34250f1481124548baf72a0bbbf8ce11b43e2bdc5b80f5f83bfa9524b8cd19f8e26eef5cfc3cf5a9f7abe27bafdc540f5cc1213a3c5f57eeda77d8c6468eb309f25d04cb61abd065582f66615efa91d26e275776e38f038907e058e66e46baca3ac0d2a03a9ccbcecbd908aa9aa6d3a8046e271019bbb358542db4e7c67cab29fcc2e408286a3a402d996ef845075cc86b5f80c21a9a66c8083c9852b88ff7b9e2545444d05b68bde7321064135c66c91d1d4fa66f623aded6b90d3b0b362081447b74c3058cee74bc165d92fdbff66b097e5b53753b523f9b50b5ac42b89602692c8ede465dc7a035098f31d581038525872b26b4f555d6fe4dca66a4e85c81a00901ad6766d9c34f1fc7920f0701d779acfbff2d29bc3e96bf6ce951009f62859bfb3b973b916b2f8082fcc930e62fbdfc7f6f3782dac8a8abee60866ae952a7d4ecb9fbbddd96a57e12e9e849dde84bc964078c9e3649c47bf2cbe54b81bdcfff6faa1c22735fb27af5beb58b58eeaae80b10f8955f42de9a170bd4d3728a80b85718ca5f0fcd453778613f77ff8780761e1ada5ffce8ac639fac4a5bcce080dfbb20b631a2a81c6634facee952985df0aef537be4724f221698a3469c60b1ebaf117a4850aa542eedccce47209723ea164ba165d6e147dcb58d80c0a554c5ef605f00b2b838beb4f74eedcb6f932a26ffd843841c98ee29903935bc6138dab55a1a9555cd641c17f4ab1865c2706d5ea920fd75535cadc5574dabf43840df66a161cc6d42cd5fff13d3c08fd21307b34d0de47061b5aa1b2d37bb222113cbb00fd9a3dead0d01e8727c3ad890dae6e19d213fc82dd8bae0f3d339218d6020d5adde519c1d6f130ee87beb4b35d35fbfbdbbb2b122aaf4a47afbe8bcf743b4d9a45074dee4f56feb115c6d838d2df4bb1f28378223dda351dfdceefe281f1d485417fc6bac5451802c4fea6ec3e2b07d856aebfc9caba88754c934189b38d5930a0d991f37d130dfacc04311811ca7935db0ac367ed6ec307c693498fabf63512a99d1450ad9baddcb3addf58c2b0abdfb8209a61e39bb883922d7ed460eb9706a4cddf90ffb0c0f2fd26ffc29f30aafafc110b803bacfadeaa55f7b6dd7b725abd978cb5c9f1e139e8729ab5be9d7c51bd9b582903c826b59d7fe49f0f8a5cfa13173c0ea6406430f4b8fcc5a746c3e627a29f93c1cf1de8fdccbbfa1abdb77fc7397ac6562c9b75a14c4a93e05fbef94a0b0ed5f07da0add7d8cf5415e2d1f72762f6cc7d4a2fdd4478ef61ef3237ccf97c8a28b6f802dd11ac21c18b8aa4387bee4145c8d35857f7d608cddacdbb489cce0e0cf489c11aceba3a2899fe2a778262c133197d357e24022eaa686e756451997ee1365bad2506a0d7b3a29272c05ea569c32522964b68f61b39172c7c433d83fd113949ff4d88fe099c49439057007e623d19f001ed7e5116d16cbeec35fbdc7c26c5e1d22a8d3190b5cdadfb9c1290a616257e8bc7ab9ec7f1291c1ce704c3f4fada37bd3a01f47ce0020d838241b8b6ebb4ef07aba47a36edd1a1fa5a7e4b68f59d88e977c4408f1043529c758f7d0f65d5934e689a8418d300e098497f9e9eb08122721040608fde91e6b9c51600df3babf06eddd9d0d5e0849117a2d56e6912271efd034906ab00aeaa33255737675b08c58f2a90cf253f6ff9a4765c68712ec176e2959b89feeecfd818992db69fe4fe357848c9837d976e95e9f632ad74ebd263c4d53cafc1a2e5a5f8ba6baf87ce48250cc2ebeed9ba82fe447553d6d797ad6a30940a58e89d2afbb1bdc2f43eb266515cb43c3fda37c7412be6f5c0382cf792755e80cfdaca6ec5ff8d1f9ddff939c3ecae2ebe59a27046e3d6a6e6088374e886526ae51e73f76e3eb67429149286881470e7d15d3fa0aded4ba2dc2a9a877d72a9c9134e97c968b89f185dec58a65e8be69ec4031e50ee4d88869afd3b12c061f8be823af65e733b45d10c5458a2626c6a82db163e6c0e3877507e39d2f3d2b60c5dce7fd57ae18b2aca017d1f629b5ff1bc35cc524772806ac7e6cb291a26ae7cf74cc94fed27696bbfc72ec74b6cec83d1d62def3e7ed152943c8c9052aed3502188d7937a308d01592979e2360231095e1c11a0d51d62f236e5c83eb64b022e6f1da065352726b053a51c907b05b2387a0316b36ae6344e8bc0f1334c276c1b7e76587425e1b8ae59c6f3519a2d109950bf6a4328d42a41268e7f1644e6e8f34f0661fc34f317427c00b92da60b23ef58762e359063b16c4a613a5dec85c5ad7ee16d96834104fdca1519449a896ae0faefe4bb56a59ea46b9474a24a888909282f79d0bc4c8a60292ca122b9ae981d87868354026b5a3019d6073e906fac6e5effcb184bff908a300759eec20b7e5a7684ac4187653c097623071a984c0324323b561fa4e3e81fd7d75c90bc588f48f1102fca208560e90a4e77bff9cd7d3ce451a4bfc5f843f76363782880c17cbd3107695c2491e3527fc24ba10133058a1ff92cb05b1832ca299e40d104357592fd944d105ed9ad7318d4d3ee175d9b4dc268e1e69b837f61f51bb5ff78c47035aeec1db71a1fe7eb5bdeb2d5b55f024d4922525fe9219e95e0be5cc74b51a9d4d228b0f4fa89687b1943a85687e69f2e4831135931522174507923a0bf493a01dd591934d7bf380abe023200e70fe7ebb0d5aa43714622ae324b8dbe763726b7c771d1ea17a013214621b0160b300102f2a5fa7ac23121de593e789db6b4e0843fbc3f7bc6293b33666aa1e16c34a5377dc52c65ba3ff44467528bbd691422a1e83549a70df26c7eaad5027f612e513dcb3c067e3d5bdb41e56ea72a22563800180a9010ce0e7f9465ad466bfb46cdda7ba0ece44dbfccbd63ecd1ae3c5124b1bfec4b6422db730ab0f4c76af7b2b26cefb6d43a37c8456d4a479c1f5af3d16d23e04820656cd613ae71ac089e5c14a1be767f97f7a7214114d5c0e8d7f66850695ad3276d5c13d58bb8fd03024d7008e2828df61c1139bc1025e4136c4a1f09316ef47e3f6590ad3551bc7fc81b54b88835cd4f16905d91c1b153dc2df799389b2b18d327ab87593cb151c2955", 0x1000, 0x4800, &(0x7f0000001800)={0x2, 0x4e23, @multicast2}, 0x10) ioctl(r6, 0xc138fd08, &(0x7f0000003000)="0400000000000000000000003801") memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x6) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FIBMAP(r7, 0x1261, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xfffffffffffffe6b, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x7}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xc004}, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r0, 0xc01064c7, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0], 0x1, 0x80000, 0x0, 0xffffffffffffffff}) setsockopt$RDS_FREE_MR(r8, 0x114, 0x3, &(0x7f0000000740)={{0x4, 0x9}, 0x1c}, 0x10) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x58}}]}, &(0x7f0000000240)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): im0: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.116339][ T9966] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.125268][ T9966] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.134009][ T9966] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.675331][ T8] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 541.857615][ T8] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 541.871629][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 541.886182][ T9977] binder: 9976:9977 ioctl c00c6211 0 returned -14 [ 542.060693][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 542.082143][ T8] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 542.110007][ T8] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 542.119583][ T8] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 542.365550][ T8] usb 4-1: Manufacturer: syz [ 542.444480][ T8] usb 4-1: config 0 descriptor?? [ 543.036965][ T28] audit: type=1400 audit(1788160850.958:85): apparmor="STATUS" operation="profile_load" profile="unconfined" name=223A6F pid=9970 comm="syz.3.1224" [ 543.245376][ T5782] Bluetooth: hci1: unexpected cc 0x203e length: 2 > 1 [ 543.253557][ T5782] Bluetooth: hci1: unexpected event for opcode 0x203e [ 543.258727][ T8] appleir 0003:05AC:8243.0006: unknown main item tag 0x0 [ 544.027674][ T8] appleir 0003:05AC:8243.0006: No inputs registered, leaving [ 544.066613][ T8] appleir 0003:05AC:8243.0006: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 544.328685][ T9996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1231'. [ 544.338109][ T9996] bridge_slave_1: left allmulticast mode [ 544.343823][ T9996] bridge_slave_1: left promiscuous mode [ 544.354445][ T9996] bridge0: port 2(bridge_slave_1) entered disabled state [ 544.834195][T10001] EXT4-fs warning (device sda1): ext4_dirblock_csum_verify:406: inode #1262: comm syz.0.1231: No space for directory leaf checksum. Please run e2fsck -D. [ 544.858134][T10001] EXT4-fs error (device sda1): ext4_empty_dir:3139: inode #1262: comm syz.0.1231: Directory block failed checksum [ 545.277445][ T5873] usb 4-1: USB disconnect, device number 13 [ 545.519286][ T9996] bridge_slave_0: left allmulticast mode [ 545.563055][ T9996] bridge_slave_0: left promiscuous mode [ 545.609910][ T9996] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.849425][T10007] tipc: MTU too low for tipc bearer [ 546.026104][T10019] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.034910][T10019] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.043692][T10019] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.052464][T10019] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.130872][T10023] binder: 10022:10023 ioctl c00c6211 0 returned -14 [ 547.441687][ T5782] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 547.450420][ T5782] Bluetooth: hci1: Injecting HCI hardware error event [ 547.460270][ T5779] Bluetooth: hci1: hardware error 0x00 [ 548.208716][T10051] tipc: MTU too low for tipc bearer [ 549.525508][ T5779] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 549.749841][T10068] binder: 10066:10068 ioctl c00c6211 0 returned -14 [ 550.961261][T10083] tipc: MTU too low for tipc bearer [ 551.848839][T10103] binder: 10101:10103 ioctl c00c6211 0 returned -14 [ 554.749575][T10137] binder: 10136:10137 ioctl c00c6211 0 returned -14 [ 558.244817][T10159] binder: 10158:10159 ioctl c00c6211 0 returned -14 [ 559.406582][ T9553] syz.0.1095 (9553) used greatest stack depth: 17864 bytes left [ 561.545217][ T5861] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 561.768961][ T5861] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 561.777846][ T5861] usb 3-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 561.805243][ T5861] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 561.855522][ T5861] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 561.920306][ T5861] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 561.965760][ T5861] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 562.130597][ T5861] usb 3-1: Product: syz [ 562.134856][ T5861] usb 3-1: Manufacturer: syz [ 562.193277][ T5861] cdc_wdm: probe of 3-1:1.0 failed with error -22 [ 562.472977][T10188] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 563.018288][ T5873] usb 3-1: USB disconnect, device number 13 [ 563.304043][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.310502][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.485581][ T56] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 568.727023][ T56] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 568.747317][T10246] capability: warning: `syz.0.1302' uses deprecated v2 capabilities in a way that may be insecure [ 568.775369][ T56] usb 4-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 568.795906][ T56] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 568.835545][ T56] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 568.870458][ T56] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 568.879790][ T56] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 568.922285][ T56] usb 4-1: Product: syz [ 568.932158][ T56] usb 4-1: Manufacturer: syz [ 568.945710][ T56] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 569.066150][T10249] binder: 10248:10249 ioctl c00c6211 0 returned -14 [ 570.241397][ T5873] usb 4-1: USB disconnect, device number 14 [ 574.183108][T10278] binder: 10277:10278 ioctl c00c6211 0 returned -14 [ 575.273014][T10286] Set syz1 is full, maxelem 6117 reached [ 575.335846][T10288] tipc: Enabled bearer , priority 0 [ 575.387663][T10287] tipc: Disabling bearer [ 576.970621][T10301] zonefs (nullb1) ERROR: Not a zoned block device [ 579.020956][T10326] binder: 10325:10326 ioctl c00c6211 0 returned -14 [ 580.026077][T10333] tipc: Enabled bearer , priority 0 [ 580.128040][T10332] tipc: Disabling bearer [ 581.831803][ T5782] Bluetooth: hci0: command 0x0406 tx timeout [ 582.410959][T10365] binder: 10362:10365 ioctl c00c6211 0 returned -14 [ 583.357774][T10368] tipc: Enabled bearer , priority 0 [ 583.433139][T10367] tipc: Disabling bearer [ 585.985649][ T5810] kernel read not supported for file /video9 (pid: 5810 comm: kworker/0:3) [ 586.508481][T10392] lo speed is unknown, defaulting to 1000 [ 586.860774][T10399] binder: 10397:10399 ioctl c00c6211 0 returned -14 [ 587.743949][T10405] tipc: Enabled bearer , priority 0 [ 587.824159][T10403] tipc: Disabling bearer [ 587.867965][T10407] syzkaller1: entered promiscuous mode [ 587.879198][T10407] syzkaller1: entered allmulticast mode [ 588.084681][T10415] comedi comedi1: comedi_parport: I/O port conflict (0xfffffffffffff000,3) [ 590.813785][T10445] syzkaller0: entered promiscuous mode [ 590.822429][T10445] syzkaller0: entered allmulticast mode [ 590.843596][T10445] tipc: Enabled bearer , priority 0 [ 590.886619][T10443] tipc: Resetting bearer [ 590.994160][T10443] tipc: Disabling bearer [ 593.149039][T10465] siw: device registration error -23 [ 593.179766][T10465] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1379'. [ 594.029877][T10469] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1381'. [ 594.133041][T10471] syzkaller0: entered promiscuous mode [ 594.145849][T10471] syzkaller0: entered allmulticast mode [ 594.168051][T10471] tipc: Enabled bearer , priority 0 [ 594.182069][T10470] tipc: Resetting bearer [ 594.240490][T10470] tipc: Disabling bearer [ 596.220013][T10487] netlink: 'syz.0.1388': attribute type 14 has an invalid length. [ 596.275241][T10487] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1388'. [ 596.306332][T10487] netlink: 'syz.0.1388': attribute type 14 has an invalid length. [ 596.314224][T10487] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1388'. [ 596.773316][T10504] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1391'. [ 597.830239][T10519] tipc: Enabling of bearer rejected, failed to enable media [ 598.235187][ T5861] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 598.435753][ T5861] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 598.460710][ T5861] usb 2-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 598.481190][ T5861] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 598.507533][ T5861] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 598.549308][ T5861] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 598.560380][ T5861] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 598.593461][ T5861] usb 2-1: Product: syz [ 598.601835][ T5861] usb 2-1: Manufacturer: syz [ 598.636253][ T5861] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 598.908600][T10546] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 599.120110][ T5861] usb 2-1: USB disconnect, device number 15 [ 599.171247][T10548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1400'. [ 599.186204][T10549] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1399'. [ 599.192459][T10548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1400'. [ 599.226216][T10548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1400'. [ 599.525389][T10557] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1402'. [ 600.483384][T10564] binder: 10559:10564 ioctl c018620c 2000000001c0 returned -1 [ 601.241301][T10555] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 601.418679][T10574] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 602.129374][ T5816] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 602.338087][ T5816] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 602.374983][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 602.412837][ T5816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 602.438898][ T5816] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 602.473657][ T5816] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 602.491866][ T5816] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 602.510217][ T5816] usb 2-1: Manufacturer: syz [ 602.529160][ T5816] usb 2-1: config 0 descriptor?? [ 602.724040][T10588] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1411'. [ 602.942939][ T28] audit: type=1400 audit(1788160908.865:86): apparmor="STATUS" operation="profile_replace" profile="unconfined" name=223A6F pid=10578 comm="syz.1.1409" [ 602.946902][ T5816] appleir 0003:05AC:8243.0007: unknown main item tag 0x0 [ 602.990256][ T5816] appleir 0003:05AC:8243.0007: No inputs registered, leaving [ 603.035816][ T5816] appleir 0003:05AC:8243.0007: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.1-1/input0 [ 603.185455][ T5873] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 603.252863][T10595] siw: device registration error -23 [ 603.288405][T10595] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1414'. [ 603.507758][ T5873] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 603.551698][ T5873] usb 4-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 603.672286][ T5873] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 603.911179][ T5873] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 604.074575][ T5873] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 604.099859][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 604.141820][ T5873] usb 4-1: Product: syz [ 604.153981][ T5873] usb 4-1: Manufacturer: syz [ 604.177507][ T5873] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 604.366234][ T5816] usb 2-1: reset high-speed USB device number 16 using dummy_hcd [ 604.413591][T10606] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1416'. [ 604.495830][T10608] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 604.985788][ T5861] usb 4-1: USB disconnect, device number 15 [ 605.686247][T10623] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1421'. [ 605.814996][T10611] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 605.971303][ T8] usb 2-1: USB disconnect, device number 16 [ 606.513319][T10635] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1424'. [ 607.777199][T10645] tipc: Enabling of bearer rejected, failed to enable media [ 608.265374][ T5816] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 608.357722][T10658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1428'. [ 608.498209][ T5816] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 608.544447][ T5816] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 608.607814][ T5816] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 608.647659][ T5816] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 608.705297][ T8] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 608.716634][ T5816] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 608.755162][ T5816] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 608.773591][ T5816] usb 1-1: Manufacturer: syz [ 608.804934][ T5816] usb 1-1: config 0 descriptor?? [ 608.889130][ T8] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 608.898233][ T8] usb 4-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 608.915662][ T8] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 608.945434][ T8] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 608.979250][ T8] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 608.989138][ T8] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 609.009445][ T8] usb 4-1: Product: syz [ 609.016429][ T8] usb 4-1: Manufacturer: syz [ 609.119906][T10670] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1433'. [ 609.475025][ T8] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 610.004842][ T28] audit: type=1400 audit(1788160915.925:87): apparmor="STATUS" operation="profile_replace" profile="unconfined" name=223A6F pid=10646 comm="syz.0.1427" [ 610.007302][T10661] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 610.333536][ T56] usb 4-1: USB disconnect, device number 16 [ 611.942189][T10682] binder: 10674:10682 ioctl c018620c 2000000001c0 returned -1 [ 611.976702][ T5816] usbhid 1-1:0.0: can't add hid device: -71 [ 611.982808][ T5816] usbhid: probe of 1-1:0.0 failed with error -71 [ 612.976678][ T5816] usb 1-1: USB disconnect, device number 13 [ 614.907432][T10692] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1441'. [ 615.424855][T10688] tipc: Enabling of bearer rejected, failed to enable media [ 616.155342][ T5861] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 616.399649][ T5861] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 616.408640][ T5861] usb 4-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 616.445170][ T5861] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 616.500372][ T5861] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 616.702103][ T5861] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 616.735361][ T5861] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 616.744992][ T5861] usb 4-1: Product: syz [ 616.754309][ T5861] usb 4-1: Manufacturer: syz [ 616.791356][ T5861] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 617.056774][T10716] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 617.496730][T10725] binder: 10722:10725 ioctl c018620c 2000000001c0 returned -1 [ 617.563382][ T5861] usb 4-1: USB disconnect, device number 17 [ 620.581114][T10760] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1454'. [ 620.605753][T10762] fuse: Bad value for 'fd' [ 620.744705][T10763] FAULT_INJECTION: forcing a failure. [ 620.744705][T10763] name failslab, interval 1, probability 0, space 0, times 0 [ 620.765631][T10763] CPU: 0 PID: 10763 Comm: syz.1.1453 Not tainted syzkaller #0 [ 620.773215][T10763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 620.783315][T10763] Call Trace: [ 620.786616][T10763] [ 620.789560][T10763] dump_stack_lvl+0x18c/0x250 [ 620.794274][T10763] ? show_regs_print_info+0x20/0x20 [ 620.799496][T10763] ? load_image+0x420/0x420 [ 620.804017][T10763] ? __might_sleep+0xe0/0xe0 [ 620.808635][T10763] ? __lock_acquire+0x7d80/0x7d80 [ 620.813682][T10763] ? lock_chain_count+0x20/0x20 [ 620.818555][T10763] should_fail_ex+0x394/0x4c0 [ 620.823256][T10763] should_failslab+0x9/0x20 [ 620.827870][T10763] slab_pre_alloc_hook+0x59/0x300 [ 620.832925][T10763] ? _raw_spin_unlock+0x40/0x40 [ 620.837794][T10763] ? __request_module+0x2d1/0x600 [ 620.842832][T10763] __kmem_cache_alloc_node+0x53/0x250 [ 620.848230][T10763] ? __request_module+0x2d1/0x600 [ 620.853268][T10763] kmalloc_trace+0x2a/0xe0 [ 620.857707][T10763] __request_module+0x2d1/0x600 [ 620.862575][T10763] ? module_enforce_rwx_sections+0x150/0x150 [ 620.868571][T10763] ? do_raw_spin_lock+0x11f/0x2b0 [ 620.873621][T10763] ? do_raw_spin_unlock+0x121/0x230 [ 620.878844][T10763] __sock_create+0x323/0x940 [ 620.883462][T10763] __sys_socketpair+0x1c1/0x550 [ 620.888331][T10763] __x64_sys_socketpair+0x9b/0xb0 [ 620.893369][T10763] do_syscall_64+0x55/0xb0 [ 620.897803][T10763] ? clear_bhb_loop+0x40/0x90 [ 620.902495][T10763] ? clear_bhb_loop+0x40/0x90 [ 620.907191][T10763] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 620.913123][T10763] RIP: 0033:0x7ffab039e159 [ 620.917562][T10763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 620.937271][T10763] RSP: 002b:00007ffab1359028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 620.945704][T10763] RAX: ffffffffffffffda RBX: 00007ffab0625fa0 RCX: 00007ffab039e159 [ 620.953690][T10763] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000002d [ 620.961674][T10763] RBP: 00007ffab0435024 R08: 0000000000000000 R09: 0000000000000000 [ 620.969660][T10763] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 620.977645][T10763] R13: 00007ffab0626038 R14: 00007ffab0625fa0 R15: 00007ffc2a71d948 [ 620.985649][T10763] [ 621.481723][T10782] binder: 10777:10782 ioctl c018620c 2000000001c0 returned -1 [ 623.621427][T10805] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 623.755732][T10823] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1465'. [ 624.493924][T10840] bridge1: entered promiscuous mode [ 624.500797][T10840] bridge1: entered allmulticast mode [ 624.517954][T10839] FAULT_INJECTION: forcing a failure. [ 624.517954][T10839] name failslab, interval 1, probability 0, space 0, times 0 [ 624.575322][T10839] CPU: 1 PID: 10839 Comm: syz.3.1468 Not tainted syzkaller #0 [ 624.580834][T10842] binder: 10841:10842 ioctl c018620c 2000000001c0 returned -1 [ 624.582848][T10839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 624.582864][T10839] Call Trace: [ 624.582873][T10839] [ 624.582883][T10839] dump_stack_lvl+0x18c/0x250 [ 624.611420][T10839] ? show_regs_print_info+0x20/0x20 [ 624.616683][T10839] ? load_image+0x420/0x420 [ 624.621253][T10839] ? __might_sleep+0xe0/0xe0 [ 624.625905][T10839] ? __lock_acquire+0x7d80/0x7d80 [ 624.630977][T10839] ? lock_chain_count+0x20/0x20 [ 624.635888][T10839] should_fail_ex+0x394/0x4c0 [ 624.640706][T10839] should_failslab+0x9/0x20 [ 624.645268][T10839] slab_pre_alloc_hook+0x59/0x300 [ 624.650351][T10839] ? _raw_spin_unlock+0x40/0x40 [ 624.655242][T10839] ? __request_module+0x2d1/0x600 [ 624.660279][T10839] __kmem_cache_alloc_node+0x53/0x250 [ 624.665670][T10839] ? __request_module+0x2d1/0x600 [ 624.670740][T10839] kmalloc_trace+0x2a/0xe0 [ 624.675216][T10839] __request_module+0x2d1/0x600 [ 624.680113][T10839] ? module_enforce_rwx_sections+0x150/0x150 [ 624.686134][T10839] ? do_raw_spin_lock+0x11f/0x2b0 [ 624.691308][T10839] ? do_raw_spin_unlock+0x121/0x230 [ 624.696560][T10839] __sock_create+0x323/0x940 [ 624.701209][T10839] __sys_socketpair+0x1c1/0x550 [ 624.706109][T10839] __x64_sys_socketpair+0x9b/0xb0 [ 624.711172][T10839] do_syscall_64+0x55/0xb0 [ 624.715636][T10839] ? clear_bhb_loop+0x40/0x90 [ 624.720348][T10839] ? clear_bhb_loop+0x40/0x90 [ 624.725068][T10839] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 624.731000][T10839] RIP: 0033:0x7fe4f919e159 [ 624.735451][T10839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.740545][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.755164][T10839] RSP: 002b:00007fe4fa052028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 624.755197][T10839] RAX: ffffffffffffffda RBX: 00007fe4f9425fa0 RCX: 00007fe4f919e159 [ 624.755220][T10839] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000002d [ 624.755233][T10839] RBP: 00007fe4f9235024 R08: 0000000000000000 R09: 0000000000000000 [ 624.755248][T10839] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 624.755264][T10839] R13: 00007fe4f9426038 R14: 00007fe4f9425fa0 R15: 00007ffe23ea6af8 [ 624.755297][T10839] [ 624.848134][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.209326][T10866] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1475'. [ 626.910064][T10896] tipc: Enabling of bearer rejected, failed to enable media [ 627.115971][ T5816] smpboot: CPU 1 is now offline [ 627.586987][ T8] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 627.799108][T10890] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 627.809540][ T8] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 627.830732][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 627.854343][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 627.892957][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 627.919205][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 627.948346][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 627.988929][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 628.013753][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 628.039747][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 628.075929][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 628.102081][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 628.111352][ T969] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 628.132946][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 628.178920][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 628.223140][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 628.251534][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 628.295271][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 628.306110][ T969] usb 2-1: Using ep0 maxpacket: 8 [ 628.332885][ T969] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 628.343135][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 628.368748][ T969] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 628.390455][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 628.423923][ T969] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 628.451899][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 628.474633][ T969] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 628.507016][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 628.538441][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 629.518777][ T969] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 629.555108][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 629.586071][ T969] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 629.635141][ T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 629.654428][ T969] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 629.675698][ T8] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 25222, setting to 1024 [ 629.693825][ T969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.712322][T10934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1487'. [ 629.725226][ T8] usb 3-1: config 0 interface 0 has no altsetting 0 [ 629.759958][ T8] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 629.775471][T10934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1487'. [ 629.804841][ T8] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 629.819394][T10934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1487'. [ 629.838621][ T8] usb 3-1: Product: syz [ 629.842831][ T8] usb 3-1: Manufacturer: syz [ 629.880882][ T8] usb 3-1: SerialNumber: syz [ 629.909468][ T8] usb 3-1: config 0 descriptor?? [ 629.941357][ T8] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 629.971178][ T969] usb 2-1: GET_CAPABILITIES returned 0 [ 630.016273][ T969] usbtmc 2-1:16.0: can't read capabilities [ 630.034929][ T8] usb 3-1: USB disconnect, device number 14 [ 630.094324][ T8] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 630.173184][ T969] usb 2-1: USB disconnect, device number 17 [ 630.699733][T10954] tipc: Enabling of bearer rejected, failed to enable media [ 632.159025][T10969] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1486'. [ 632.773306][T10984] fuse: Bad value for 'fd' [ 632.957245][T10991] tipc: Enabling of bearer rejected, failed to enable media [ 634.799837][T10997] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1504'. [ 636.084438][T11014] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1507'. [ 636.255997][T11018] netlink: 'syz.2.1510': attribute type 29 has an invalid length. [ 636.550870][T11030] tipc: Enabling of bearer rejected, failed to enable media [ 638.876282][T11036] siw: device registration error -23 [ 639.229824][T11033] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1515'. [ 639.653426][T11046] zonefs (nullb1) ERROR: Not a zoned block device [ 640.000357][T11052] netlink: 'syz.2.1521': attribute type 29 has an invalid length. [ 640.180755][T11059] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1522'. [ 641.837796][T11080] tipc: Enabling of bearer rejected, failed to enable media [ 642.372612][T11096] netlink: 'syz.3.1531': attribute type 29 has an invalid length. [ 642.536486][ T5810] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 642.762766][ T5810] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 642.805390][ T5810] usb 2-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 642.855258][ T5810] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 643.885314][ T5810] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 643.949932][ T5810] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 643.994162][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 644.043850][ T5810] usb 2-1: Product: syz [ 644.050768][T11116] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1535'. [ 644.087113][ T5810] usb 2-1: Manufacturer: syz [ 644.120647][ T5810] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 645.917812][T11091] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 645.939746][T11122] siw: device registration error -23 [ 645.961721][T11122] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1526'. [ 645.993652][T10610] usb 2-1: USB disconnect, device number 18 [ 646.480045][T11141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1541'. [ 646.545695][T11141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1541'. [ 646.554950][T11141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1541'. [ 649.323592][T11153] tipc: MTU too low for tipc bearer [ 649.351565][T11158] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1546'. [ 651.137622][T11163] Cannot find add_set index 0 as target [ 651.800946][T11169] FAULT_INJECTION: forcing a failure. [ 651.800946][T11169] name fail_futex, interval 1, probability 0, space 0, times 0 [ 651.874774][T11169] CPU: 0 PID: 11169 Comm: syz.2.1550 Not tainted syzkaller #0 [ 651.882288][T11169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 651.892361][T11169] Call Trace: [ 651.895652][T11169] [ 651.898616][T11169] dump_stack_lvl+0x18c/0x250 [ 651.903310][T11169] ? show_regs_print_info+0x20/0x20 [ 651.908515][T11169] ? load_image+0x420/0x420 [ 651.913018][T11169] ? mark_lock+0x94/0x320 [ 651.917354][T11169] should_fail_ex+0x394/0x4c0 [ 651.922050][T11169] get_futex_key+0x136/0x1030 [ 651.926728][T11169] ? futex_setup_timer+0xc0/0xc0 [ 651.931671][T11169] futex_wake+0x127/0x4f0 [ 651.936023][T11169] ? rcu_force_quiescent_state+0x220/0x220 [ 651.941835][T11169] ? fsnotify_destroy_marks+0x1d4/0x320 [ 651.947404][T11169] ? futex_wake_mark+0x150/0x150 [ 651.952338][T11169] ? locks_free_lock_context+0x42/0x70 [ 651.957811][T11169] do_futex+0x35d/0x3e0 [ 651.961984][T11169] ? __ia32_sys_get_robust_list+0x110/0x110 [ 651.967887][T11169] ? __sys_socketpair+0x113/0x550 [ 651.972911][T11169] __se_sys_futex+0x3a9/0x440 [ 651.977587][T11169] ? __x64_sys_futex+0xf0/0xf0 [ 651.982377][T11169] ? __x64_sys_futex+0x21/0xf0 [ 651.987159][T11169] do_syscall_64+0x55/0xb0 [ 651.991574][T11169] ? clear_bhb_loop+0x40/0x90 [ 651.996249][T11169] ? clear_bhb_loop+0x40/0x90 [ 652.000925][T11169] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 652.006817][T11169] RIP: 0033:0x7fd61599e159 [ 652.011248][T11169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 652.030851][T11169] RSP: 002b:00007fd61695b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 652.039270][T11169] RAX: ffffffffffffffda RBX: 00007fd615c25fa8 RCX: 00007fd61599e159 [ 652.047263][T11169] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd615c25fac [ 652.055241][T11169] RBP: 00007fd615c25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 652.063228][T11169] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 652.071219][T11169] R13: 00007fd615c26038 R14: 00007ffdfd2a0b70 R15: 00007ffdfd2a0c58 [ 652.079216][T11169] [ 652.328986][T11177] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 652.479269][T11187] siw: device registration error -23 [ 653.626965][T11186] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1554'. [ 654.021051][T11183] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1547'. [ 654.064911][T11189] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1554'. [ 654.103730][T11189] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1554'. [ 655.984183][T11200] SET target dimension over the limit! [ 656.182313][ T28] audit: type=1800 audit(1788160958.111:88): pid=11212 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1561" name="zone_nr_conv" dev="configfs" ino=24446 res=0 errno=0 [ 656.223554][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 656.278224][ T28] audit: type=1800 audit(1788160958.151:89): pid=11212 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1561" name="power" dev="configfs" ino=24448 res=0 errno=0 [ 656.445741][T11221] syzkaller0: entered promiscuous mode [ 656.477688][T11221] syzkaller0: entered allmulticast mode [ 656.485234][T10920] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 656.573613][T11223] FAULT_INJECTION: forcing a failure. [ 656.573613][T11223] name fail_futex, interval 1, probability 0, space 0, times 0 [ 656.600461][T11223] CPU: 0 PID: 11223 Comm: syz.2.1566 Not tainted syzkaller #0 [ 656.607978][T11223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 656.618030][T11223] Call Trace: [ 656.621310][T11223] [ 656.624246][T11223] dump_stack_lvl+0x18c/0x250 [ 656.628933][T11223] ? show_regs_print_info+0x20/0x20 [ 656.634236][T11223] ? load_image+0x420/0x420 [ 656.638753][T11223] ? mark_lock+0x94/0x320 [ 656.643095][T11223] should_fail_ex+0x394/0x4c0 [ 656.647798][T11223] get_futex_key+0x136/0x1030 [ 656.652502][T11223] ? futex_setup_timer+0xc0/0xc0 [ 656.657444][T11223] futex_wake+0x127/0x4f0 [ 656.661771][T11223] ? rcu_force_quiescent_state+0x220/0x220 [ 656.667580][T11223] ? fsnotify_destroy_marks+0x1d4/0x320 [ 656.673125][T11223] ? futex_wake_mark+0x150/0x150 [ 656.678056][T11223] ? locks_free_lock_context+0x42/0x70 [ 656.683535][T11223] do_futex+0x35d/0x3e0 [ 656.687694][T11223] ? __ia32_sys_get_robust_list+0x110/0x110 [ 656.693584][T11223] ? __sys_socketpair+0x113/0x550 [ 656.698612][T11223] __se_sys_futex+0x3a9/0x440 [ 656.703298][T11223] ? __x64_sys_futex+0xf0/0xf0 [ 656.708067][T11223] ? __x64_sys_futex+0x21/0xf0 [ 656.712843][T11223] do_syscall_64+0x55/0xb0 [ 656.717261][T11223] ? clear_bhb_loop+0x40/0x90 [ 656.721940][T11223] ? clear_bhb_loop+0x40/0x90 [ 656.726623][T11223] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 656.732518][T11223] RIP: 0033:0x7fd61599e159 [ 656.736934][T11223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 656.756556][T11223] RSP: 002b:00007fd61695b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 656.764970][T11223] RAX: ffffffffffffffda RBX: 00007fd615c25fa8 RCX: 00007fd61599e159 [ 656.772939][T11223] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd615c25fac [ 656.780907][T11223] RBP: 00007fd615c25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 656.788875][T11223] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 656.796885][T11223] R13: 00007fd615c26038 R14: 00007ffdfd2a0b70 R15: 00007ffdfd2a0c58 [ 656.804882][T11223] [ 656.845466][T10920] usb 1-1: Using ep0 maxpacket: 16 [ 656.943749][T10920] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 656.963068][T10920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.993372][T10920] usb 1-1: Product: syz [ 657.015294][T10920] usb 1-1: Manufacturer: syz [ 657.019939][T10920] usb 1-1: SerialNumber: syz [ 657.059002][T10920] usb 1-1: config 0 descriptor?? [ 657.066860][T10920] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 657.112030][T10920] usb 1-1: Detected FT-X [ 657.267969][T10920] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 658.753050][T10920] ftdi_sio 1-1:0.0: GPIO initialisation failed: -32 [ 658.773205][T11237] SET target dimension over the limit! [ 658.787242][T10920] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 661.460266][T11265] tipc: MTU too low for tipc bearer [ 661.484334][T10920] usb 1-1: USB disconnect, device number 14 [ 661.535519][T10920] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 661.595328][T10920] ftdi_sio 1-1:0.0: device disconnected [ 661.718366][T11276] 8021q: adding VLAN 0 to HW filter on device bond1 [ 662.275405][T10920] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 662.300490][T11296] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1585'. [ 662.498453][T10920] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 662.561382][T10920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 662.598182][ T28] audit: type=1800 audit(1788160962.525:90): pid=11304 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1587" name="zone_nr_conv" dev="configfs" ino=24769 res=0 errno=0 [ 662.635254][T10920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 662.685370][T10920] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 662.718130][ T28] audit: type=1800 audit(1788160962.525:91): pid=11304 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1587" name="power" dev="configfs" ino=24770 res=0 errno=0 [ 662.759458][T10920] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 662.795125][T10920] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 662.828715][T10920] usb 1-1: Manufacturer: syz [ 662.856395][T10920] usb 1-1: config 0 descriptor?? [ 662.885221][T10610] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 663.100022][T10610] usb 2-1: Using ep0 maxpacket: 16 [ 663.121387][T10610] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 664.319314][T10920] appleir 0003:05AC:8243.0008: unknown main item tag 0x0 [ 664.343942][T10610] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.357895][T10920] appleir 0003:05AC:8243.0008: No inputs registered, leaving [ 664.385182][T10610] usb 2-1: Product: syz [ 664.410911][T10920] appleir 0003:05AC:8243.0008: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 664.433629][T10610] usb 2-1: Manufacturer: syz [ 664.456020][T10610] usb 2-1: SerialNumber: syz [ 664.485969][T10610] usb 2-1: config 0 descriptor?? [ 664.508125][T11308] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 664.546219][T10610] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 664.574819][T10610] usb 2-1: Detected FT-X [ 664.749381][T10610] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 664.972770][T10610] ftdi_sio 2-1:0.0: GPIO initialisation failed: -32 [ 665.006452][T10610] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 666.371050][ T8] usb 2-1: USB disconnect, device number 19 [ 666.401013][ T8] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 667.420960][T10920] usb 1-1: USB disconnect, device number 15 [ 667.455164][ T8] ftdi_sio 2-1:0.0: device disconnected [ 669.070009][T11362] tipc: MTU too low for tipc bearer [ 669.585188][ T8] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 669.675207][T10610] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 669.766558][ T28] audit: type=1800 audit(1788160967.702:92): pid=11380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1608" name="zone_nr_conv" dev="configfs" ino=25076 res=0 errno=0 [ 669.797623][ T5782] Bluetooth: hci3: unexpected event for opcode 0x001b [ 669.804674][ T8] usb 2-1: config 1 has an invalid descriptor of length 168, skipping remainder of the config [ 669.834710][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 669.856360][ T28] audit: type=1800 audit(1788160967.722:93): pid=11380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1608" name="power" dev="configfs" ino=25077 res=0 errno=0 [ 669.876689][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 669.895104][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 669.916593][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 669.927425][T10610] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 669.938802][T10610] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 669.955204][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 669.975073][T10610] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 669.985334][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 670.005301][T10610] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 670.018613][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 670.039020][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 670.055585][T10610] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 670.065247][ T969] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 670.076448][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 670.095085][T10610] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 670.113681][T10610] usb 1-1: Manufacturer: syz [ 670.118449][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 670.135943][T10610] usb 1-1: config 0 descriptor?? [ 670.144614][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 670.175243][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 194, changing to 11 [ 670.195221][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 58790, setting to 1024 [ 670.217184][ T8] usb 2-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 670.246778][ T8] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 670.256211][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.264249][ T8] usb 2-1: Product: syz [ 670.268693][ T969] usb 3-1: Using ep0 maxpacket: 16 [ 670.289493][ T969] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 670.305416][ T8] usb 2-1: Manufacturer: syz [ 670.310131][ T969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.320196][ T8] usb 2-1: SerialNumber: syz [ 670.343906][ T969] usb 3-1: Product: syz [ 670.348555][T11371] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 670.365431][T11371] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 670.372724][ T969] usb 3-1: Manufacturer: syz [ 670.382935][T11371] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 670.390393][ T969] usb 3-1: SerialNumber: syz [ 670.413184][ T969] usb 3-1: config 0 descriptor?? [ 670.418768][T11371] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 670.561052][T10610] appleir 0003:05AC:8243.0009: unknown main item tag 0x0 [ 671.199376][ T969] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 671.961204][T11371] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 672.289381][T10610] appleir 0003:05AC:8243.0009: No inputs registered, leaving [ 672.306604][ T969] usb 3-1: Detected FT-X [ 672.311861][T11384] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1609'. [ 672.354491][ T969] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 672.383783][T10610] appleir 0003:05AC:8243.0009: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 672.416637][ T969] ftdi_sio 3-1:0.0: GPIO initialisation failed: -5 [ 672.438564][ T8] usb 2-1: can't set config #1, error -71 [ 672.457667][ T969] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 672.491208][T10610] usb 1-1: USB disconnect, device number 16 [ 672.501061][ T8] usb 2-1: USB disconnect, device number 20 [ 674.189414][T11395] tipc: MTU too low for tipc bearer [ 674.225246][ T969] usb 3-1: USB disconnect, device number 15 [ 674.267840][T11391] fido_id[11391]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 674.282710][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 674.329171][ T969] ftdi_sio 3-1:0.0: device disconnected [ 674.437927][T11403] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1614'. [ 674.566804][T11409] syzkaller0: entered promiscuous mode [ 674.572328][T11409] syzkaller0: entered allmulticast mode [ 674.646926][T11413] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1616'. [ 674.710286][T11409] tipc: Enabled bearer , priority 0 [ 674.738191][T11408] tipc: Resetting bearer [ 674.916305][T11408] tipc: Disabling bearer [ 674.936270][T11412] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1614'. [ 676.594316][T11429] siw: device registration error -23 [ 676.650578][T11426] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1620'. [ 676.681507][ T8] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 676.769175][ T28] audit: type=1800 audit(1788160974.702:94): pid=11434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1622" name="zone_nr_conv" dev="configfs" ino=25300 res=0 errno=0 [ 676.795963][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 676.832197][ T28] audit: type=1800 audit(1788160974.722:95): pid=11434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1622" name="power" dev="configfs" ino=25301 res=0 errno=0 [ 676.887013][ T8] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 676.899302][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 676.955188][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 676.965553][ T8] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 677.014625][ T8] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 677.023840][ T8] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 677.035080][ T8] usb 4-1: Manufacturer: syz [ 677.046645][ T8] usb 4-1: config 0 descriptor?? [ 677.095175][T10610] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 677.305712][T10610] usb 1-1: Using ep0 maxpacket: 16 [ 677.314280][T10610] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 677.323657][T10610] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.332052][T10610] usb 1-1: Product: syz [ 677.336551][T10610] usb 1-1: Manufacturer: syz [ 677.341212][T10610] usb 1-1: SerialNumber: syz [ 677.358662][T10610] usb 1-1: config 0 descriptor?? [ 677.373488][T10610] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 677.397574][T10610] usb 1-1: Detected FT-X [ 677.502510][ T8] appleir 0003:05AC:8243.000A: unknown main item tag 0x0 [ 677.517368][ T8] appleir 0003:05AC:8243.000A: No inputs registered, leaving [ 677.541684][ T8] appleir 0003:05AC:8243.000A: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 677.607870][T10610] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 677.816664][T10610] ftdi_sio 1-1:0.0: GPIO initialisation failed: -5 [ 677.824334][T10610] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 678.945127][T10610] usb 4-1: reset high-speed USB device number 18 using dummy_hcd [ 679.575446][T11443] tipc: MTU too low for tipc bearer [ 679.812115][T11363] usb 1-1: USB disconnect, device number 17 [ 679.828332][T11457] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1627'. [ 679.868026][T11363] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 679.892755][T11455] syzkaller0: entered promiscuous mode [ 679.903180][T11455] syzkaller0: entered allmulticast mode [ 679.929336][T11363] ftdi_sio 1-1:0.0: device disconnected [ 679.958040][T11459] tipc: Enabled bearer , priority 0 [ 680.020079][T11452] tipc: Resetting bearer [ 680.132136][T11452] tipc: Disabling bearer [ 680.495619][ T8] usb 4-1: USB disconnect, device number 18 [ 681.846766][T11465] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1630'. [ 682.209024][T11480] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1632'. [ 682.485029][ T8] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 682.670819][ T8] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 682.692971][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 682.717627][ T8] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 682.738646][ T8] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 682.765315][ T8] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 682.783892][ T8] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 682.800448][ T8] usb 4-1: Manufacturer: syz [ 682.819520][ T8] usb 4-1: config 0 descriptor?? [ 684.452390][T11484] tipc: MTU too low for tipc bearer [ 684.487939][ T28] audit: type=1800 audit(1788160982.422:96): pid=11489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1637" name="zone_nr_conv" dev="configfs" ino=25525 res=0 errno=0 [ 684.570078][ T28] audit: type=1800 audit(1788160982.442:97): pid=11489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1637" name="power" dev="configfs" ino=25526 res=0 errno=0 [ 684.663544][T11499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1638'. [ 684.785271][T10920] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 684.864298][T11502] syzkaller0: entered promiscuous mode [ 684.887336][T11502] syzkaller0: entered allmulticast mode [ 684.907231][T11502] tipc: Enabled bearer , priority 0 [ 684.965576][T10920] usb 2-1: Using ep0 maxpacket: 16 [ 685.769551][T11505] siw: device registration error -23 [ 686.211360][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.469925][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.746869][T10920] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 686.772080][T11504] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1641'. [ 686.802422][ T8] usbhid 4-1:0.0: can't add hid device: -71 [ 686.809446][T10920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 686.819141][T11501] tipc: Resetting bearer [ 686.841787][ T8] usbhid: probe of 4-1:0.0 failed with error -71 [ 686.862018][T10920] usb 2-1: Product: syz [ 686.887360][T10920] usb 2-1: Manufacturer: syz [ 686.905191][ T8] usb 4-1: USB disconnect, device number 19 [ 686.926389][T10920] usb 2-1: SerialNumber: syz [ 686.965948][T10920] usb 2-1: config 0 descriptor?? [ 686.983042][T11501] tipc: Disabling bearer [ 687.001780][T10920] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 687.030201][T10920] usb 2-1: Detected FT-X [ 687.036667][T11510] syzkaller0: entered promiscuous mode [ 687.052485][T11510] syzkaller0: entered allmulticast mode [ 687.202487][T10920] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 687.427732][T10920] ftdi_sio 2-1:0.0: GPIO initialisation failed: -5 [ 687.442897][T10920] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 689.635146][T10610] usb 2-1: USB disconnect, device number 21 [ 689.641360][T11521] tipc: MTU too low for tipc bearer [ 689.670435][T10610] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 689.732244][T10610] ftdi_sio 2-1:0.0: device disconnected [ 689.843183][T11533] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1649'. [ 690.305103][T10610] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 691.535174][T11536] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1651'. [ 691.587270][T11541] syzkaller0: entered promiscuous mode [ 691.621083][T11541] syzkaller0: entered allmulticast mode [ 691.665537][T11541] tipc: Enabled bearer , priority 0 [ 691.699230][T11538] tipc: Resetting bearer [ 691.720409][T10610] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 691.734275][T10610] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 691.762659][T10610] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 691.775546][T11538] tipc: Disabling bearer [ 691.794875][T10610] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 691.809384][T11544] syzkaller0: entered promiscuous mode [ 691.814911][T11544] syzkaller0: entered allmulticast mode [ 691.852082][T10610] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 691.874073][T10610] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 691.900013][T10610] usb 2-1: Manufacturer: syz [ 691.918936][T10610] usb 2-1: config 0 descriptor?? [ 694.617637][T10610] usbhid 2-1:0.0: can't add hid device: -71 [ 694.625771][T11559] tipc: MTU too low for tipc bearer [ 694.660245][T10610] usbhid: probe of 2-1:0.0 failed with error -71 [ 694.690658][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1660'. [ 694.712614][T10610] usb 2-1: USB disconnect, device number 22 [ 694.748756][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1660'. [ 696.331270][T11563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1660'. [ 696.359432][T11568] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1662'. [ 696.446857][T11566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1661'. [ 696.657301][T11584] syzkaller0: entered promiscuous mode [ 696.685327][T11584] syzkaller0: entered allmulticast mode [ 698.808810][T11583] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 698.885463][ T969] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 699.137205][ T969] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 699.179160][ T969] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 699.232140][ T969] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 699.285583][ T969] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 699.346154][ T969] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 699.376808][ T969] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 699.409446][ T969] usb 4-1: Manufacturer: syz [ 699.439134][ T969] usb 4-1: config 0 descriptor?? [ 699.802164][T11623] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1672'. [ 699.862248][T11623] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.871448][T11623] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.880488][T11623] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.889392][T11623] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 699.960302][T11628] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1672'. [ 700.012969][T11628] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1672'. [ 702.970257][T11633] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1675'. [ 703.951812][ T969] usbhid 4-1:0.0: can't add hid device: -71 [ 703.965326][T11637] tipc: MTU too low for tipc bearer [ 703.998439][ T969] usbhid: probe of 4-1:0.0 failed with error -71 [ 704.069623][ T969] usb 4-1: USB disconnect, device number 20 [ 704.191847][T11643] syzkaller0: entered promiscuous mode [ 704.225159][T11643] syzkaller0: entered allmulticast mode [ 705.045960][T11662] zonefs (nullb1) ERROR: Not a zoned block device [ 705.466251][T11670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1684'. [ 705.513655][T11670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1684'. [ 705.553698][T11670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1684'. [ 707.347347][T11678] tipc: MTU too low for tipc bearer [ 709.228197][T11692] syzkaller0: entered promiscuous mode [ 709.256475][T11692] syzkaller0: entered allmulticast mode [ 709.497442][T11701] zonefs (nullb1) ERROR: Not a zoned block device [ 711.258296][T11712] tipc: MTU too low for tipc bearer [ 713.343422][T11729] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1701'. [ 713.658692][T11743] syzkaller0: entered promiscuous mode [ 713.691743][T11743] syzkaller0: entered allmulticast mode [ 713.806189][T11746] zonefs (nullb1) ERROR: Not a zoned block device [ 713.870802][T10920] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 714.078995][T10920] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 715.520272][T10920] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 715.546466][T11753] tipc: MTU too low for tipc bearer [ 715.575425][T10920] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 715.619683][T10920] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 715.689584][T10920] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 715.723460][T10920] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 715.766979][T10920] usb 3-1: Product: syz [ 715.771211][T10920] usb 3-1: Manufacturer: syz [ 715.832799][T10920] cdc_wdm: probe of 3-1:1.0 failed with error -22 [ 716.128740][T11742] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 716.141639][T10920] usb 3-1: USB disconnect, device number 16 [ 716.157886][T11775] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1710'. [ 718.120083][T11783] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1712'. [ 718.256077][T11790] zonefs (nullb1) ERROR: Not a zoned block device [ 719.864662][T11793] tipc: MTU too low for tipc bearer [ 720.128213][T11811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1720'. [ 720.400437][T11815] FAULT_INJECTION: forcing a failure. [ 720.400437][T11815] name fail_futex, interval 1, probability 0, space 0, times 0 [ 720.432185][T11815] CPU: 0 PID: 11815 Comm: syz.0.1722 Not tainted syzkaller #0 [ 720.439707][T11815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 720.449871][T11815] Call Trace: [ 720.453164][T11815] [ 720.456115][T11815] dump_stack_lvl+0x18c/0x250 [ 720.460809][T11815] ? kasan_set_track+0x4e/0x70 [ 720.465589][T11815] ? slab_post_alloc_hook+0x6a/0x4d0 [ 720.470888][T11815] ? show_regs_print_info+0x20/0x20 [ 720.476102][T11815] ? load_image+0x420/0x420 [ 720.480600][T11815] ? __x64_sys_epoll_create1+0x37/0x40 [ 720.486082][T11815] should_fail_ex+0x394/0x4c0 [ 720.490778][T11815] get_futex_key+0x136/0x1030 [ 720.495486][T11815] ? futex_setup_timer+0xc0/0xc0 [ 720.500424][T11815] futex_wake+0x127/0x4f0 [ 720.504754][T11815] ? percpu_counter_add_batch+0x252/0x2a0 [ 720.510511][T11815] ? futex_wake_mark+0x150/0x150 [ 720.515540][T11815] do_futex+0x35d/0x3e0 [ 720.519779][T11815] ? fd_install+0x60/0x4e0 [ 720.524200][T11815] ? __ia32_sys_get_robust_list+0x110/0x110 [ 720.530095][T11815] __se_sys_futex+0x3a9/0x440 [ 720.534785][T11815] ? __x64_sys_futex+0xf0/0xf0 [ 720.539557][T11815] ? fd_install+0x60/0x4e0 [ 720.543976][T11815] ? __x64_sys_futex+0x21/0xf0 [ 720.548746][T11815] do_syscall_64+0x55/0xb0 [ 720.553158][T11815] ? clear_bhb_loop+0x40/0x90 [ 720.557831][T11815] ? clear_bhb_loop+0x40/0x90 [ 720.562510][T11815] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 720.568404][T11815] RIP: 0033:0x7effc5b9e159 [ 720.572818][T11815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.592424][T11815] RSP: 002b:00007effc6a770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 720.600924][T11815] RAX: ffffffffffffffda RBX: 00007effc5e25fa8 RCX: 00007effc5b9e159 [ 720.608907][T11815] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007effc5e25fac [ 720.616877][T11815] RBP: 00007effc5e25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 720.624867][T11815] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 720.632833][T11815] R13: 00007effc5e26038 R14: 00007ffde76dcda0 R15: 00007ffde76dce88 [ 720.640813][T11815] [ 720.924996][T10920] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 721.280568][T10920] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 722.416302][T11819] siw: device registration error -23 [ 722.427104][T10920] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 722.445730][T11819] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1724'. [ 722.500489][T10920] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 722.561739][T10920] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 722.617586][T10920] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 722.645932][T10920] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 722.676270][T11827] zonefs (nullb1) ERROR: Not a zoned block device [ 722.684801][T10920] usb 4-1: Product: syz [ 722.714729][T10920] usb 4-1: Manufacturer: syz [ 722.746102][T10920] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 724.360927][T11817] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 724.372993][ T969] usb 4-1: USB disconnect, device number 21 [ 724.419028][T11830] tipc: MTU too low for tipc bearer [ 724.598653][T11842] syzkaller0: entered promiscuous mode [ 724.610703][T11842] syzkaller0: entered allmulticast mode [ 724.636914][T11842] tipc: Enabled bearer , priority 0 [ 724.663977][T11839] tipc: Resetting bearer [ 724.719917][T11839] tipc: Disabling bearer [ 724.737530][T11846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1732'. [ 726.378686][T11849] siw: device registration error -23 [ 726.391878][T11849] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1735'. [ 728.112163][T11860] tipc: MTU too low for tipc bearer [ 728.308938][T11868] syzkaller0: entered promiscuous mode [ 728.314454][T11868] syzkaller0: entered allmulticast mode [ 728.362875][T11868] tipc: Enabled bearer , priority 0 [ 728.382749][T11873] zonefs (nullb1) ERROR: Not a zoned block device [ 728.403439][T11867] tipc: Resetting bearer [ 728.486375][T11867] tipc: Disabling bearer [ 728.645203][ T969] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 730.075601][T11879] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1748'. [ 730.236666][ T969] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 730.270966][ T969] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 730.321170][ T969] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 730.360889][ T969] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 730.400084][ T969] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 730.424989][ T969] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 730.451758][ T969] usb 2-1: Product: syz [ 730.463955][ T969] usb 2-1: Manufacturer: syz [ 730.481792][ T969] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 730.605595][T10610] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 730.750352][T11875] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 730.762225][ T969] usb 2-1: USB disconnect, device number 23 [ 730.813431][T11901] zonefs (nullb1) ERROR: Not a zoned block device [ 730.836741][T10610] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 730.855289][T10610] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 730.873280][T10610] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 730.893865][T10610] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.908872][T11903] syzkaller0: entered promiscuous mode [ 730.916980][T11890] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 730.926448][T11903] syzkaller0: entered allmulticast mode [ 730.937843][T10610] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 730.952637][T11903] tipc: Enabled bearer , priority 0 [ 730.990952][T11902] tipc: Resetting bearer [ 731.063523][T11902] tipc: Disabling bearer [ 731.147364][T11890] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 731.165167][T11890] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 731.184313][ T969] usb 3-1: USB disconnect, device number 17 [ 731.479466][T11890] CUSE: DEVNAME unspecified [ 733.060828][T11911] siw: device registration error -23 [ 733.070367][T11911] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1759'. [ 733.694868][ T28] audit: type=1800 audit(1788161028.615:98): pid=11934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1766" name="zone_nr_conv" dev="configfs" ino=27297 res=0 errno=0 [ 733.726205][ T5782] Bluetooth: hci2: unexpected event for opcode 0x001b [ 733.778275][ T28] audit: type=1800 audit(1788161028.655:99): pid=11934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1766" name="power" dev="configfs" ino=27298 res=0 errno=0 [ 733.994958][ T969] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 734.295601][ T969] usb 4-1: Using ep0 maxpacket: 16 [ 734.308402][ T969] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 734.324809][ T969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 734.344043][ T969] usb 4-1: Product: syz [ 734.353339][ T969] usb 4-1: Manufacturer: syz [ 734.363446][ T969] usb 4-1: SerialNumber: syz [ 734.377628][ T969] usb 4-1: config 0 descriptor?? [ 734.394237][ T969] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 734.410655][ T969] usb 4-1: Detected FT-X [ 734.595482][ T969] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 735.021243][ T969] ftdi_sio 4-1:0.0: GPIO initialisation failed: -32 [ 736.513122][ T969] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 736.572900][T11961] tipc: MTU too low for tipc bearer [ 736.580927][ T969] usb 4-1: USB disconnect, device number 22 [ 736.614698][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 736.661963][ T969] ftdi_sio 4-1:0.0: device disconnected [ 737.371983][ T28] audit: type=1800 audit(1788161032.295:100): pid=11987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1788" name="zone_nr_conv" dev="configfs" ino=27617 res=0 errno=0 [ 737.403747][ T5782] Bluetooth: hci2: unexpected event for opcode 0x001b [ 737.472858][ T28] audit: type=1800 audit(1788161032.325:101): pid=11987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1788" name="power" dev="configfs" ino=27618 res=0 errno=0 [ 737.675074][ T969] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 739.091574][T11991] tipc: MTU too low for tipc bearer [ 739.235504][ T969] usb 4-1: Using ep0 maxpacket: 16 [ 739.262822][ T969] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 739.303068][ T969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 739.330517][ T969] usb 4-1: Product: syz [ 739.351638][ T969] usb 4-1: Manufacturer: syz [ 739.363578][ T969] usb 4-1: SerialNumber: syz [ 739.369890][T12005] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1794'. [ 739.403405][ T969] usb 4-1: config 0 descriptor?? [ 739.434832][ T969] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 739.469814][ T969] usb 4-1: Detected FT-X [ 739.635693][ T969] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 739.985011][T10920] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 740.083379][ T969] ftdi_sio 4-1:0.0: GPIO initialisation failed: -32 [ 740.107427][ T969] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 740.134509][ T969] usb 4-1: USB disconnect, device number 23 [ 740.145430][T12021] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1801'. [ 740.172243][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 740.303822][ T969] ftdi_sio 4-1:0.0: device disconnected [ 740.309884][T10920] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 740.330469][T10920] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 740.348588][T10920] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 740.370970][T10920] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 740.380819][T10920] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 740.397483][T10920] usb 3-1: Product: syz [ 740.407204][T10920] usb 3-1: Manufacturer: syz [ 740.432287][T10920] cdc_wdm 3-1:1.0: skipping garbage [ 740.440179][T10920] cdc_wdm: probe of 3-1:1.0 failed with error -22 [ 740.812289][T12016] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 740.824006][ T969] usb 3-1: USB disconnect, device number 18 [ 742.161066][T12023] tipc: MTU too low for tipc bearer [ 742.411373][T12036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1806'. [ 742.717207][T12049] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1810'. [ 742.742894][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 742.752121][ T28] audit: type=1800 audit(1788161037.665:102): pid=12051 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1811" name="zone_nr_conv" dev="configfs" ino=27903 res=0 errno=0 [ 742.926742][ T28] audit: type=1800 audit(1788161037.685:103): pid=12051 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1811" name="power" dev="configfs" ino=27904 res=0 errno=0 [ 743.065010][T11363] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 743.265345][T11363] usb 1-1: Using ep0 maxpacket: 16 [ 743.273646][T11363] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 743.283676][T11363] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 743.298650][T11363] usb 1-1: Product: syz [ 743.312808][T11363] usb 1-1: Manufacturer: syz [ 743.327441][T11363] usb 1-1: SerialNumber: syz [ 743.353408][T11363] usb 1-1: config 0 descriptor?? [ 743.378988][T11363] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 743.404225][T11363] usb 1-1: Detected FT-X [ 743.699153][T11363] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 745.075576][T11363] ftdi_sio 1-1:0.0: GPIO initialisation failed: -5 [ 745.111849][T12058] tipc: MTU too low for tipc bearer [ 745.117762][T11363] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 745.283795][ T969] usb 1-1: USB disconnect, device number 18 [ 745.298657][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 745.334043][ T969] ftdi_sio 1-1:0.0: device disconnected [ 745.455328][T10920] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 745.484672][T12076] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1820'. [ 745.566594][T12078] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1821'. [ 745.701481][T10920] usb 3-1: device descriptor read/64, error -71 [ 745.974999][T10920] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 746.135059][T10920] usb 3-1: device descriptor read/64, error -71 [ 747.613531][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.620087][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.639729][T12087] tipc: MTU too low for tipc bearer [ 747.686093][T10920] usb usb3-port1: attempt power cycle [ 747.964514][T12104] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1833'. [ 748.126821][ T28] audit: type=1800 audit(1788161043.055:104): pid=12106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1834" name="zone_nr_conv" dev="configfs" ino=28105 res=0 errno=0 [ 748.165132][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 748.185191][T10920] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 748.203220][ T28] audit: type=1800 audit(1788161043.085:105): pid=12106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1834" name="power" dev="configfs" ino=28106 res=0 errno=0 [ 748.424992][T11363] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 748.446201][T10920] usb 3-1: device not accepting address 21, error -71 [ 748.604953][T11363] usb 1-1: Using ep0 maxpacket: 16 [ 749.956522][T11363] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 749.986071][T12115] tipc: MTU too low for tipc bearer [ 750.004266][T11363] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.032770][T11363] usb 1-1: Product: syz [ 750.053277][T11363] usb 1-1: Manufacturer: syz [ 750.075336][T11363] usb 1-1: SerialNumber: syz [ 750.107343][T11363] usb 1-1: config 0 descriptor?? [ 750.136385][T11363] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 750.178315][T11363] usb 1-1: Detected FT-X [ 750.314791][T11363] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 750.407608][T12132] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1846'. [ 750.695032][T10920] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 750.760085][T11363] ftdi_sio 1-1:0.0: GPIO initialisation failed: -5 [ 750.770175][T11363] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 750.844968][T10920] usb 4-1: device descriptor read/64, error -71 [ 752.145501][T12137] siw: device registration error -23 [ 752.295310][T11363] usb 1-1: USB disconnect, device number 19 [ 752.334141][T12136] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1848'. [ 752.356022][T11363] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 752.406529][T11363] ftdi_sio 1-1:0.0: device disconnected [ 752.513715][T12142] jffs2: notice: (12142) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 752.530422][T10920] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 752.684979][T10920] usb 4-1: device descriptor read/64, error -71 [ 753.552328][T10920] usb usb4-port1: attempt power cycle [ 754.120836][T12144] tipc: MTU too low for tipc bearer [ 754.465755][T12163] zonefs (nullb1) ERROR: Not a zoned block device [ 754.483004][T12162] syzkaller0: entered promiscuous mode [ 754.526157][T12162] syzkaller0: entered allmulticast mode [ 754.855111][ T8] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 756.230899][T12167] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1861'. [ 756.316616][ T28] audit: type=1800 audit(1788161051.245:106): pid=12170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1862" name="zone_nr_conv" dev="configfs" ino=28407 res=0 errno=0 [ 756.385305][ T28] audit: type=1800 audit(1788161051.275:107): pid=12170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1862" name="power" dev="configfs" ino=28412 res=0 errno=0 [ 756.537955][ T8] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 756.559115][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 756.580843][ T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.822687][ T8] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 756.851339][ T8] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 756.863685][ T8] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 756.875052][ T5810] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 756.887952][ T8] usb 3-1: Manufacturer: syz [ 756.905543][ T8] usb 3-1: config 0 descriptor?? [ 757.074990][ T5810] usb 2-1: Using ep0 maxpacket: 16 [ 757.088515][ T5810] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 757.102987][ T5810] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 757.120553][ T5810] usb 2-1: Product: syz [ 757.132148][ T5810] usb 2-1: Manufacturer: syz [ 757.145701][ T5810] usb 2-1: SerialNumber: syz [ 757.161199][ T5810] usb 2-1: config 0 descriptor?? [ 757.180226][ T5810] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 757.198560][ T5810] usb 2-1: Detected FT-X [ 757.338980][ T8] appleir 0003:05AC:8243.000B: unknown main item tag 0x0 [ 757.360786][ T8] appleir 0003:05AC:8243.000B: No inputs registered, leaving [ 757.380164][ T5810] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 757.401615][ T8] appleir 0003:05AC:8243.000B: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 757.825475][ T5810] ftdi_sio 2-1:0.0: GPIO initialisation failed: -5 [ 759.047093][ T5810] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 759.072478][ T8] usb 3-1: USB disconnect, device number 23 [ 759.087788][T12178] SET target dimension over the limit! [ 759.136470][ T5810] usb 2-1: USB disconnect, device number 24 [ 759.180645][ T5810] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 759.250603][T12177] fido_id[12177]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 759.277543][ T5810] ftdi_sio 2-1:0.0: device disconnected [ 759.317250][T12183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1865'. [ 762.350415][T12195] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1872'. [ 762.556140][ T28] audit: type=1800 audit(1788161057.485:108): pid=12202 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1874" name="zone_nr_conv" dev="configfs" ino=28584 res=0 errno=0 [ 762.597953][ T5782] Bluetooth: hci3: unexpected event for opcode 0x001b [ 762.657298][ T28] audit: type=1800 audit(1788161057.515:109): pid=12202 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1874" name="power" dev="configfs" ino=28585 res=0 errno=0 [ 762.695710][T12208] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1868'. [ 762.865022][T10920] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 762.872775][ T5810] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 763.055013][ T5810] usb 3-1: Using ep0 maxpacket: 16 [ 763.063657][T10920] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 763.699787][ T5810] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 764.234485][T12213] SET target dimension over the limit! [ 764.428281][T10920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 764.449471][ T5810] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.467835][ T5810] usb 3-1: Product: syz [ 764.474254][T10920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 764.497596][ T5810] usb 3-1: Manufacturer: syz [ 764.512053][ T5810] usb 3-1: SerialNumber: syz [ 764.518414][T10920] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 764.543585][ T5810] usb 3-1: config 0 descriptor?? [ 764.583449][ T5810] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 764.605029][T10920] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 764.627685][ T5810] usb 3-1: Detected FT-X [ 764.655036][T10920] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 764.685098][T10920] usb 4-1: Manufacturer: syz [ 764.710389][T10920] usb 4-1: config 0 descriptor?? [ 764.788540][T12215] binder: 12214:12215 ioctl c018620c 2000000001c0 returned -1 [ 764.808733][ T5810] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 764.992942][T12219] syzkaller0: entered promiscuous mode [ 765.011728][T12219] syzkaller0: entered allmulticast mode [ 765.182451][T10920] appleir 0003:05AC:8243.000C: unknown main item tag 0x0 [ 765.208969][T10920] appleir 0003:05AC:8243.000C: No inputs registered, leaving [ 765.250517][T10920] appleir 0003:05AC:8243.000C: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 765.263219][ T5810] ftdi_sio 3-1:0.0: GPIO initialisation failed: -5 [ 765.287204][ T5810] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 765.602466][T11363] usb 4-1: USB disconnect, device number 27 [ 766.452563][T12223] fido_id[12223]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 766.486211][T10920] usb 3-1: USB disconnect, device number 24 [ 766.504139][T12229] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1880'. [ 766.523885][T10920] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 766.668588][T10920] ftdi_sio 3-1:0.0: device disconnected [ 767.230947][T12240] SET target dimension over the limit! [ 768.773537][T12242] binder: 12241:12242 ioctl c018620c 2000000001c0 returned -1 [ 768.947566][T12246] syzkaller0: entered promiscuous mode [ 768.953098][T12246] syzkaller0: entered allmulticast mode [ 769.275485][ T5782] Bluetooth: hci2: unexpected event for opcode 0x001b [ 769.282814][ T28] audit: type=1800 audit(1788161064.195:110): pid=12252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1889" name="zone_nr_conv" dev="configfs" ino=28735 res=0 errno=0 [ 769.361608][ T28] audit: type=1800 audit(1788161064.245:111): pid=12252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1889" name="power" dev="configfs" ino=28736 res=0 errno=0 [ 769.585161][T10920] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 769.605141][T11363] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 769.664828][T12260] zonefs (nullb1) ERROR: Not a zoned block device [ 769.766661][T10920] usb 4-1: Using ep0 maxpacket: 16 [ 769.788016][T10920] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 769.808228][T11363] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 769.835049][T10920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.843188][T11363] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 769.873465][T10920] usb 4-1: Product: syz [ 770.005360][T11363] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 770.024978][T10920] usb 4-1: Manufacturer: syz [ 770.788874][T10920] usb 4-1: SerialNumber: syz [ 770.875263][T11363] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 770.890282][T10920] usb 4-1: config 0 descriptor?? [ 770.925358][T10920] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 770.933542][T10920] usb 4-1: Detected FT-X [ 770.965141][T11363] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 770.994702][T11363] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 771.028165][T11363] usb 1-1: Manufacturer: syz [ 771.065861][T11363] usb 1-1: config 0 descriptor?? [ 771.129325][T10920] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 771.511186][T11363] appleir 0003:05AC:8243.000D: unknown main item tag 0x0 [ 771.525959][T11363] appleir 0003:05AC:8243.000D: No inputs registered, leaving [ 771.561209][T10920] ftdi_sio 4-1:0.0: GPIO initialisation failed: -5 [ 771.577537][T11363] appleir 0003:05AC:8243.000D: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 771.609678][T10920] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 771.764591][T10920] usb 4-1: USB disconnect, device number 28 [ 771.811556][T10920] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 771.823019][T11363] usb 1-1: USB disconnect, device number 20 [ 771.898181][T10920] ftdi_sio 4-1:0.0: device disconnected [ 771.920583][T12276] fido_id[12276]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 773.796422][T12289] SET target dimension over the limit! [ 774.125606][T12304] syzkaller0: entered promiscuous mode [ 774.159294][T12304] syzkaller0: entered allmulticast mode [ 775.527992][T12321] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1901'. [ 775.685963][T12325] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1902'. [ 775.774383][T12327] syzkaller0: entered promiscuous mode [ 775.787389][T12327] syzkaller0: entered allmulticast mode [ 775.810455][T12327] tipc: Enabled bearer , priority 0 [ 775.863732][T12326] tipc: Resetting bearer [ 775.930089][T12326] tipc: Disabling bearer [ 777.656967][T12335] SET target dimension over the limit! [ 777.752508][T12340] syzkaller0: entered promiscuous mode [ 777.795767][T12340] syzkaller0: entered allmulticast mode [ 779.292008][T12353] zonefs (nullb1) ERROR: Not a zoned block device [ 779.319889][ T28] audit: type=1800 audit(1788161073.248:112): pid=12355 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1903" name="zone_nr_conv" dev="configfs" ino=28972 res=0 errno=0 [ 779.371486][ T5782] Bluetooth: hci2: unexpected event for opcode 0x001b [ 779.426813][ T28] audit: type=1800 audit(1788161073.288:113): pid=12355 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1903" name="power" dev="configfs" ino=28973 res=0 errno=0 [ 779.507047][T12357] tipc: Enabled bearer , priority 0 [ 779.559704][T12356] tipc: Disabling bearer [ 779.635017][T10920] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 779.834952][T10920] usb 4-1: Using ep0 maxpacket: 16 [ 780.733107][T10920] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 781.368550][T12364] SET target dimension over the limit! [ 781.380246][T10920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.406322][T10920] usb 4-1: Product: syz [ 781.419696][T10920] usb 4-1: Manufacturer: syz [ 781.435797][T10920] usb 4-1: SerialNumber: syz [ 781.456599][T10920] usb 4-1: config 0 descriptor?? [ 781.487001][T10920] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 781.525727][T10920] usb 4-1: Detected FT-X [ 783.121354][T10920] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 784.079606][T12372] tipc: MTU too low for tipc bearer [ 784.121896][T10920] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 784.167275][T10920] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 784.196573][T10920] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 784.258583][T10920] usb 4-1: USB disconnect, device number 29 [ 784.310735][T12382] zonefs (nullb1) ERROR: Not a zoned block device [ 784.345364][T10920] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 784.389332][T10920] ftdi_sio 4-1:0.0: device disconnected [ 784.526368][T12384] netlink: 'syz.0.1925': attribute type 14 has an invalid length. [ 784.534262][T12384] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1925'. [ 784.587202][T12385] netlink: 'syz.0.1925': attribute type 14 has an invalid length. [ 784.619571][T12385] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1925'. [ 784.675226][T12385] netlink: 'syz.0.1925': attribute type 14 has an invalid length. [ 784.683110][T12385] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1925'. [ 784.888592][T12393] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1926'. [ 786.847381][T12404] SET target dimension over the limit! [ 786.907403][T12408] syzkaller0: entered promiscuous mode [ 786.931691][T12408] syzkaller0: entered allmulticast mode [ 787.125337][ T28] audit: type=1800 audit(1788161080.058:114): pid=12414 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1931" name="zone_nr_conv" dev="configfs" ino=29144 res=0 errno=0 [ 787.161483][ T5782] Bluetooth: hci3: unexpected event for opcode 0x001b [ 787.244976][ T28] audit: type=1800 audit(1788161080.088:115): pid=12414 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1931" name="power" dev="configfs" ino=29145 res=0 errno=0 [ 787.424969][T10920] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 787.643879][T10920] usb 3-1: Using ep0 maxpacket: 16 [ 789.048142][T10920] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 789.085846][T12427] tipc: MTU too low for tipc bearer [ 789.097955][T10920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.144488][T10920] usb 3-1: Product: syz [ 789.161947][T10920] usb 3-1: Manufacturer: syz [ 789.188940][T10920] usb 3-1: SerialNumber: syz [ 789.216552][T10920] usb 3-1: config 0 descriptor?? [ 789.249078][T10920] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 789.296464][T10920] usb 3-1: Detected FT-X [ 789.306437][T12434] zonefs (nullb1) ERROR: Not a zoned block device [ 789.435021][T10920] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 789.679130][T12441] netlink: 'syz.0.1937': attribute type 14 has an invalid length. [ 789.719532][T12441] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1937'. [ 789.759547][T12443] netlink: 'syz.0.1937': attribute type 14 has an invalid length. [ 789.789631][T12443] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1937'. [ 789.835296][T12443] netlink: 'syz.0.1937': attribute type 14 has an invalid length. [ 789.851893][T10920] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 789.876693][T12443] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1937'. [ 790.054084][ T969] usb 3-1: USB disconnect, device number 25 [ 790.090724][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 790.147543][ T969] ftdi_sio 3-1:0.0: device disconnected [ 791.739249][T12455] SET target dimension over the limit! [ 791.974530][T12463] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1940'. [ 792.055683][T12465] binder: 12459:12465 ioctl c018620c 2000000001c0 returned -1 [ 792.831330][ T28] audit: type=1800 audit(1788161085.758:116): pid=12489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1949" name="zone_nr_conv" dev="configfs" ino=29441 res=0 errno=0 [ 792.862587][ T5782] Bluetooth: hci3: unexpected event for opcode 0x001b [ 792.905344][ T28] audit: type=1800 audit(1788161085.788:117): pid=12489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1949" name="power" dev="configfs" ino=29442 res=0 errno=0 [ 793.134987][ T5810] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 794.560458][T12493] SET target dimension over the limit! [ 794.715927][ T5810] usb 3-1: Using ep0 maxpacket: 16 [ 794.731984][ T5810] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 794.773977][ T5810] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 794.822955][ T5810] usb 3-1: Product: syz [ 794.837553][ T5810] usb 3-1: Manufacturer: syz [ 794.842278][ T5810] usb 3-1: SerialNumber: syz [ 795.902107][ T5810] usb 3-1: config 0 descriptor?? [ 795.937614][ T5810] usb 3-1: can't set config #0, error -71 [ 795.998621][ T5810] usb 3-1: USB disconnect, device number 26 [ 796.766207][T12505] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 797.243030][T12529] binder: 12527:12529 ioctl c018620c 2000000001c0 returned -1 [ 799.249823][T12544] SET target dimension over the limit! [ 800.428992][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 800.446781][ T28] audit: type=1800 audit(1788161092.355:118): pid=12555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1963" name="zone_nr_conv" dev="configfs" ino=29721 res=0 errno=0 [ 800.566234][ T28] audit: type=1800 audit(1788161092.375:119): pid=12555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1963" name="power" dev="configfs" ino=29723 res=0 errno=0 [ 800.734992][ T969] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 800.945341][ T969] usb 1-1: Using ep0 maxpacket: 16 [ 800.964121][ T969] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 801.592484][ T969] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.545580][ T969] usb 1-1: Product: syz [ 802.549778][ T969] usb 1-1: Manufacturer: syz [ 802.554371][ T969] usb 1-1: SerialNumber: syz [ 802.576710][T12571] tipc: MTU too low for tipc bearer [ 802.643620][ T969] usb 1-1: config 0 descriptor?? [ 802.685097][ T969] usb 1-1: can't set config #0, error -71 [ 802.725392][ T969] usb 1-1: USB disconnect, device number 21 [ 802.871348][T12580] binder: 12577:12580 ioctl c018620c 2000000001c0 returned -1 [ 802.907263][T12581] FAULT_INJECTION: forcing a failure. [ 802.907263][T12581] name failslab, interval 1, probability 0, space 0, times 0 [ 802.944990][T12581] CPU: 0 PID: 12581 Comm: syz.0.1972 Not tainted syzkaller #0 [ 802.952512][T12581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 802.962567][T12581] Call Trace: [ 802.966295][T12581] [ 802.969227][T12581] dump_stack_lvl+0x18c/0x250 [ 802.973913][T12581] ? show_regs_print_info+0x20/0x20 [ 802.979110][T12581] ? load_image+0x420/0x420 [ 802.983610][T12581] ? __might_sleep+0xe0/0xe0 [ 802.988201][T12581] ? __lock_acquire+0x7d80/0x7d80 [ 802.993235][T12581] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 802.999214][T12581] should_fail_ex+0x394/0x4c0 [ 803.003896][T12581] should_failslab+0x9/0x20 [ 803.008418][T12581] slab_pre_alloc_hook+0x59/0x300 [ 803.013443][T12581] ? lockdep_hardirqs_on+0x98/0x150 [ 803.018657][T12581] kmem_cache_alloc+0x5a/0x2c0 [ 803.023438][T12581] ? taskstats_exit+0x14d/0xce0 [ 803.028301][T12581] taskstats_exit+0x14d/0xce0 [ 803.032977][T12581] ? sysctl_delayacct+0x220/0x220 [ 803.037993][T12581] ? rcu_read_lock_any_held+0xb4/0x140 [ 803.043464][T12581] ? rcu_read_lock_bh_held+0x100/0x100 [ 803.048923][T12581] do_exit+0x8fc/0x2530 [ 803.053087][T12581] ? put_task_struct+0xc0/0xc0 [ 803.057853][T12581] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 803.063844][T12581] ? get_signal+0x100e/0x1390 [ 803.068520][T12581] ? lock_chain_count+0x20/0x20 [ 803.073373][T12581] do_group_exit+0x22d/0x2f0 [ 803.077979][T12581] ? lockdep_hardirqs_on+0x98/0x150 [ 803.083183][T12581] get_signal+0x12a6/0x1390 [ 803.087711][T12581] arch_do_signal_or_restart+0xc2/0x7b0 [ 803.093381][T12581] ? __ia32_sys_get_robust_list+0x110/0x110 [ 803.099293][T12581] ? get_sigframe_size+0x20/0x20 [ 803.104264][T12581] ? exit_to_user_mode_loop+0x3b/0x110 [ 803.109738][T12581] exit_to_user_mode_loop+0x70/0x110 [ 803.115122][T12581] exit_to_user_mode_prepare+0xee/0x180 [ 803.120706][T12581] syscall_exit_to_user_mode+0x1a/0x50 [ 803.126320][T12581] do_syscall_64+0x61/0xb0 [ 803.130737][T12581] ? clear_bhb_loop+0x40/0x90 [ 803.135411][T12581] ? clear_bhb_loop+0x40/0x90 [ 803.140086][T12581] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 803.145976][T12581] RIP: 0033:0x7effc5b9e159 [ 803.150390][T12581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 803.170194][T12581] RSP: 002b:00007effc6a770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 803.178616][T12581] RAX: fffffffffffffe00 RBX: 00007effc5e25fa8 RCX: 00007effc5b9e159 [ 803.186585][T12581] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007effc5e25fa8 [ 803.194575][T12581] RBP: 00007effc5e25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 803.202545][T12581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 803.210524][T12581] R13: 00007effc5e26038 R14: 00007ffde76dcda0 R15: 00007ffde76dce88 [ 803.218508][T12581] [ 804.767360][ T28] audit: type=1800 audit(1788161096.695:120): pid=12598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1978" name="zone_nr_conv" dev="configfs" ino=30026 res=0 errno=0 [ 804.806102][ T5782] Bluetooth: hci0: unexpected event for opcode 0x001b [ 804.868033][ T28] audit: type=1800 audit(1788161096.725:121): pid=12598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1978" name="power" dev="configfs" ino=30027 res=0 errno=0 [ 805.065105][T11363] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 805.274910][T11363] usb 1-1: Using ep0 maxpacket: 16 [ 805.984077][T11363] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 806.685950][T12602] tipc: MTU too low for tipc bearer [ 806.692046][T11363] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.731252][T11363] usb 1-1: Product: syz [ 806.748921][T11363] usb 1-1: Manufacturer: syz [ 806.753567][T11363] usb 1-1: SerialNumber: syz [ 806.795426][T11363] usb 1-1: config 0 descriptor?? [ 806.822039][T11363] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 806.853704][T11363] usb 1-1: Detected FT-X [ 806.918106][T12605] syzkaller0: entered promiscuous mode [ 806.936137][T12605] syzkaller0: entered allmulticast mode [ 807.034563][T11363] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 809.047546][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.053902][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.107941][T12611] SET target dimension over the limit! [ 810.119162][T11363] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 810.144418][T11363] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 810.205789][T11363] usb 1-1: USB disconnect, device number 22 [ 810.270793][T11363] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 810.316267][T12621] binder: 12615:12621 ioctl c018620c 2000000001c0 returned -1 [ 810.352059][T11363] ftdi_sio 1-1:0.0: device disconnected [ 810.419253][T12624] FAULT_INJECTION: forcing a failure. [ 810.419253][T12624] name fail_futex, interval 1, probability 0, space 0, times 0 [ 810.460428][T12624] CPU: 0 PID: 12624 Comm: syz.2.1986 Not tainted syzkaller #0 [ 810.468020][T12624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 810.478073][T12624] Call Trace: [ 810.481348][T12624] [ 810.484277][T12624] dump_stack_lvl+0x18c/0x250 [ 810.488968][T12624] ? show_regs_print_info+0x20/0x20 [ 810.494163][T12624] ? load_image+0x420/0x420 [ 810.498687][T12624] ? __lock_acquire+0x1336/0x7d80 [ 810.503740][T12624] should_fail_ex+0x394/0x4c0 [ 810.508426][T12624] get_futex_key+0x136/0x1030 [ 810.513107][T12624] ? futex_setup_timer+0xc0/0xc0 [ 810.518045][T12624] futex_wake+0x127/0x4f0 [ 810.522393][T12624] ? snd_vmidi_output_work+0x3d0/0x3e0 [ 810.527921][T12624] ? futex_wake_mark+0x150/0x150 [ 810.532886][T12624] do_futex+0x35d/0x3e0 [ 810.537043][T12624] ? __might_fault+0xaa/0x120 [ 810.541757][T12624] ? __ia32_sys_get_robust_list+0x110/0x110 [ 810.547652][T12624] ? __might_fault+0xc6/0x120 [ 810.552337][T12624] mm_release+0x184/0x3a0 [ 810.556672][T12624] ? exit_mm_release+0x30/0x30 [ 810.561457][T12624] ? lockdep_hardirqs_on+0x98/0x150 [ 810.566664][T12624] exit_mm+0xa4/0x340 [ 810.570650][T12624] ? sysctl_delayacct+0x220/0x220 [ 810.575688][T12624] ? do_exit+0x2530/0x2530 [ 810.580108][T12624] ? tty_audit_exit+0x14d/0x1f0 [ 810.584981][T12624] do_exit+0x909/0x2530 [ 810.589145][T12624] ? put_task_struct+0xc0/0xc0 [ 810.593918][T12624] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 810.599894][T12624] ? get_signal+0x100e/0x1390 [ 810.604569][T12624] ? lock_chain_count+0x20/0x20 [ 810.609422][T12624] do_group_exit+0x22d/0x2f0 [ 810.614015][T12624] ? lockdep_hardirqs_on+0x98/0x150 [ 810.619213][T12624] get_signal+0x12a6/0x1390 [ 810.623734][T12624] arch_do_signal_or_restart+0xc2/0x7b0 [ 810.629284][T12624] ? __ia32_sys_get_robust_list+0x110/0x110 [ 810.635173][T12624] ? get_sigframe_size+0x20/0x20 [ 810.640142][T12624] ? exit_to_user_mode_loop+0x3b/0x110 [ 810.645607][T12624] exit_to_user_mode_loop+0x70/0x110 [ 810.650904][T12624] exit_to_user_mode_prepare+0xee/0x180 [ 810.656456][T12624] syscall_exit_to_user_mode+0x1a/0x50 [ 810.661932][T12624] do_syscall_64+0x61/0xb0 [ 810.666348][T12624] ? clear_bhb_loop+0x40/0x90 [ 810.671023][T12624] ? clear_bhb_loop+0x40/0x90 [ 810.675719][T12624] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 810.681609][T12624] RIP: 0033:0x7fd61599e159 [ 810.686025][T12624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 810.705670][T12624] RSP: 002b:00007fd61695b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 810.714094][T12624] RAX: fffffffffffffe00 RBX: 00007fd615c25fa8 RCX: 00007fd61599e159 [ 810.722069][T12624] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd615c25fa8 [ 810.730044][T12624] RBP: 00007fd615c25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 810.738019][T12624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 810.746039][T12624] R13: 00007fd615c26038 R14: 00007ffdfd2a0b70 R15: 00007ffdfd2a0c58 [ 810.754018][T12624] [ 812.310456][T12638] syzkaller0: entered promiscuous mode [ 812.347212][T12638] syzkaller0: entered allmulticast mode [ 812.357896][ T5782] Bluetooth: hci2: unexpected event for opcode 0x001b [ 812.367294][ T28] audit: type=1800 audit(1788161104.285:122): pid=12643 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1993" name="zone_nr_conv" dev="configfs" ino=30240 res=0 errno=0 [ 812.466409][ T28] audit: type=1800 audit(1788161104.295:123): pid=12643 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1993" name="power" dev="configfs" ino=30241 res=0 errno=0 [ 812.654927][ T969] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 812.818449][T12651] binder: 12650:12651 ioctl c018620c 2000000001c0 returned -1 [ 812.837405][ T969] usb 4-1: Using ep0 maxpacket: 16 [ 812.846426][ T969] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 812.875020][ T969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.893355][ T969] usb 4-1: Product: syz [ 812.914972][ T969] usb 4-1: Manufacturer: syz [ 812.919617][ T969] usb 4-1: SerialNumber: syz [ 812.959618][ T969] usb 4-1: config 0 descriptor?? [ 812.975530][ T969] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 813.014205][ T969] usb 4-1: Detected FT-X [ 813.167729][ T969] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 813.826531][ T969] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 814.945318][ T969] usb 4-1: USB disconnect, device number 30 [ 814.952782][T12661] tipc: MTU too low for tipc bearer [ 814.987181][ T969] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 815.048553][ T969] ftdi_sio 4-1:0.0: device disconnected [ 817.626273][T12666] SET target dimension over the limit! [ 817.651613][T12670] syzkaller0: entered promiscuous mode [ 817.670466][T12670] syzkaller0: entered allmulticast mode [ 818.294765][ T28] audit: type=1800 audit(1788161110.215:124): pid=12688 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2012" name="zone_nr_conv" dev="configfs" ino=30534 res=0 errno=0 [ 818.345291][ T28] audit: type=1800 audit(1788161110.255:125): pid=12688 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2012" name="power" dev="configfs" ino=30535 res=0 errno=0 [ 818.495954][T12690] binder: 12689:12690 ioctl c018620c 2000000001c0 returned -1 [ 819.568536][ T969] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 819.775008][ T969] usb 2-1: Using ep0 maxpacket: 16 [ 821.231477][ T969] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 821.261617][T12697] SET target dimension over the limit! [ 821.289120][ T969] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.326247][T12701] syzkaller0: entered promiscuous mode [ 821.331778][T12701] syzkaller0: entered allmulticast mode [ 821.340215][ T969] usb 2-1: Product: syz [ 821.344396][ T969] usb 2-1: Manufacturer: syz [ 821.406038][ T969] usb 2-1: SerialNumber: syz [ 821.431802][ T969] usb 2-1: config 0 descriptor?? [ 821.474993][ T969] usb 2-1: can't set config #0, error -71 [ 821.500469][ T969] usb 2-1: USB disconnect, device number 25 [ 821.572159][T12707] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2019'. [ 821.633885][T12708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2019'. [ 821.695429][T12708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2019'. [ 822.895698][T12719] binder: 12714:12719 ioctl c018620c 2000000001c0 returned -1 [ 824.755180][T12723] tipc: MTU too low for tipc bearer [ 827.670520][T12731] SET target dimension over the limit! [ 827.999594][T12739] syzkaller0: entered promiscuous mode [ 828.037208][T12739] syzkaller0: entered allmulticast mode [ 830.064976][ T5810] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 831.597209][T12772] SET target dimension over the limit! [ 831.738756][T12777] zonefs (nullb1) ERROR: Not a zoned block device [ 831.785534][ T5810] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 831.835793][ T5810] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 831.915042][ T5810] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 831.954506][ T5810] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.116777][T12766] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 833.289646][ T5810] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 833.453047][ T5810] usb 4-1: USB disconnect, device number 31 [ 833.556241][T12794] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2042'. [ 833.601082][T12798] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2042'. [ 833.748733][T12798] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2042'. [ 833.782190][T12796] syzkaller0: entered promiscuous mode [ 833.819283][T12796] syzkaller0: entered allmulticast mode [ 834.055781][T12816] binder: 12808:12816 ioctl c018620c 2000000001c0 returned -1 [ 835.731452][T12819] SET target dimension over the limit! [ 835.954613][T12827] zonefs (nullb1) ERROR: Not a zoned block device [ 837.735564][T12843] syzkaller0: entered promiscuous mode [ 837.778251][T12843] syzkaller0: entered allmulticast mode [ 838.064870][T10920] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 839.409936][T12852] SET target dimension over the limit! [ 839.591618][T10920] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 839.605625][T12861] zonefs (nullb1) ERROR: Not a zoned block device [ 839.623570][T12863] binder: 12856:12863 ioctl c018620c 2000000001c0 returned -1 [ 839.645134][T10920] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 839.682200][T10920] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 839.728454][T10920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.769877][T12847] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 839.824462][T10920] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 840.047197][T12847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 840.089099][T12847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 840.130422][T10920] usb 4-1: USB disconnect, device number 32 [ 843.288187][T12887] SET target dimension over the limit! [ 843.352669][T12892] syzkaller0: entered promiscuous mode [ 843.515595][T12892] syzkaller0: entered allmulticast mode [ 844.421274][T12920] binder: 12914:12920 ioctl c018620c 2000000001c0 returned -1 [ 846.452320][T12929] SET target dimension over the limit! [ 846.901224][T12942] zonefs (nullb1) ERROR: Not a zoned block device [ 847.426351][T12964] binder: 12959:12964 ioctl c018620c 2000000001c0 returned -1 [ 848.920793][T12963] SET target dimension over the limit! [ 848.968867][T12969] FAULT_INJECTION: forcing a failure. [ 848.968867][T12969] name failslab, interval 1, probability 0, space 0, times 0 [ 849.020651][T12969] CPU: 0 PID: 12969 Comm: syz.1.2092 Not tainted syzkaller #0 [ 849.028155][T12969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 849.038330][T12969] Call Trace: [ 849.041661][T12969] [ 849.044600][T12969] dump_stack_lvl+0x18c/0x250 [ 849.049312][T12969] ? show_regs_print_info+0x20/0x20 [ 849.054514][T12969] ? load_image+0x420/0x420 [ 849.059016][T12969] ? __might_sleep+0xe0/0xe0 [ 849.063607][T12969] ? __lock_acquire+0x7d80/0x7d80 [ 849.068649][T12969] should_fail_ex+0x394/0x4c0 [ 849.073347][T12969] should_failslab+0x9/0x20 [ 849.077855][T12969] slab_pre_alloc_hook+0x59/0x300 [ 849.082887][T12969] kmem_cache_alloc+0x5a/0x2c0 [ 849.087653][T12969] ? mas_alloc_nodes+0x2f8/0x8c0 [ 849.092616][T12969] mas_alloc_nodes+0x2f8/0x8c0 [ 849.097399][T12969] mas_expected_entries+0x1f4/0x320 [ 849.102599][T12969] copy_mm+0x7ee/0x1e30 [ 849.106754][T12969] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 849.112734][T12969] ? __asan_memset+0x22/0x40 [ 849.117327][T12969] ? lockdep_init_map_type+0x9c/0x8e0 [ 849.122704][T12969] ? copy_signal+0x640/0x640 [ 849.127295][T12969] ? lockdep_init_map_type+0x9c/0x8e0 [ 849.132687][T12969] ? __init_rwsem+0x122/0x160 [ 849.137378][T12969] ? copy_signal+0x51f/0x640 [ 849.141966][T12969] copy_process+0x16c9/0x3da0 [ 849.146651][T12969] ? plist_add+0x3db/0x490 [ 849.151096][T12969] ? copy_process+0x98e/0x3da0 [ 849.155896][T12969] ? futex_wait+0x4a7/0x5c0 [ 849.160447][T12969] ? __pidfd_prepare+0x140/0x140 [ 849.165487][T12969] kernel_clone+0x24b/0x8a0 [ 849.170020][T12969] ? create_io_thread+0x190/0x190 [ 849.175067][T12969] ? do_futex+0x2ff/0x3e0 [ 849.179399][T12969] __x64_sys_clone+0x1b7/0x230 [ 849.184183][T12969] ? __ia32_sys_vfork+0x140/0x140 [ 849.189226][T12969] ? lock_chain_count+0x20/0x20 [ 849.194095][T12969] ? lockdep_hardirqs_on+0x98/0x150 [ 849.199299][T12969] do_syscall_64+0x55/0xb0 [ 849.203715][T12969] ? clear_bhb_loop+0x40/0x90 [ 849.208415][T12969] ? clear_bhb_loop+0x40/0x90 [ 849.213095][T12969] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 849.218993][T12969] RIP: 0033:0x7ffab039e159 [ 849.223431][T12969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.243074][T12969] RSP: 002b:00007ffab1358fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 849.251584][T12969] RAX: ffffffffffffffda RBX: 00007ffab0625fa0 RCX: 00007ffab039e159 [ 849.259555][T12969] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 849.267525][T12969] RBP: 00007ffab0435024 R08: 0000000000000000 R09: 0000000000000000 [ 849.275493][T12969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 849.283462][T12969] R13: 00007ffab0626038 R14: 00007ffab0625fa0 R15: 00007ffc2a71d948 [ 849.291446][T12969] [ 849.536930][T12976] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 849.567845][T12974] futex_wake_op: syz.1.2092 tries to shift op by 144; fix this program [ 849.628103][T12976] CPU: 0 PID: 12976 Comm: syz.3.2093 Not tainted syzkaller #0 [ 849.635626][T12976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 849.645679][T12976] Call Trace: [ 849.648957][T12976] [ 849.651893][T12976] dump_stack_lvl+0x18c/0x250 [ 849.656578][T12976] ? show_regs_print_info+0x20/0x20 [ 849.661798][T12976] ? load_image+0x420/0x420 [ 849.666322][T12976] sysfs_create_dir_ns+0x26e/0x2a0 [ 849.671461][T12976] ? __lock_acquire+0x7d80/0x7d80 [ 849.676501][T12976] ? sysfs_warn_dup+0xa0/0xa0 [ 849.681196][T12976] ? rcu_is_watching+0x15/0xb0 [ 849.685985][T12976] ? do_raw_spin_unlock+0x121/0x230 [ 849.691199][T12976] kobject_add_internal+0x617/0xc90 [ 849.696468][T12976] kobject_add+0x164/0x240 [ 849.700893][T12976] ? kobject_init+0x1d0/0x1d0 [ 849.705582][T12976] ? get_device_parent+0x366/0x390 [ 849.710737][T12976] device_add+0x3fa/0xc40 [ 849.715068][T12976] tty_register_device_attr+0x425/0x950 [ 849.720626][T12976] ? tty_register_device+0x30/0x30 [ 849.725757][T12976] ? tty_port_init+0x132/0x1a0 [ 849.730521][T12976] ? gsm_dlci_alloc+0x32a/0x630 [ 849.735370][T12976] ? __might_fault+0xaa/0x120 [ 849.740046][T12976] gsm_activate_mux+0x110/0x2a0 [ 849.744901][T12976] gsmld_ioctl+0xcec/0x1900 [ 849.749409][T12976] ? gsmld_write+0x120/0x120 [ 849.754126][T12976] ? __init_ldsem+0x150/0x150 [ 849.758807][T12976] ? __fget_files+0x28/0x460 [ 849.763405][T12976] ? gsmld_write+0x120/0x120 [ 849.767995][T12976] tty_ioctl+0x9b5/0xdc0 [ 849.772241][T12976] ? tty_get_icount+0xb0/0xb0 [ 849.776919][T12976] __se_sys_ioctl+0xfd/0x170 [ 849.781527][T12976] do_syscall_64+0x55/0xb0 [ 849.785959][T12976] ? clear_bhb_loop+0x40/0x90 [ 849.790647][T12976] ? clear_bhb_loop+0x40/0x90 [ 849.795326][T12976] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 849.801219][T12976] RIP: 0033:0x7fe4f919e159 [ 849.805635][T12976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.825256][T12976] RSP: 002b:00007fe4fa031028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 849.833684][T12976] RAX: ffffffffffffffda RBX: 00007fe4f9426090 RCX: 00007fe4f919e159 [ 849.841671][T12976] RDX: 0000200000000200 RSI: 0000000040204706 RDI: 0000000000000003 [ 849.849653][T12976] RBP: 00007fe4f9235024 R08: 0000000000000000 R09: 0000000000000000 [ 849.857623][T12976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 849.865590][T12976] R13: 00007fe4f9426128 R14: 00007fe4f9426090 R15: 00007ffe23ea6af8 [ 849.873589][T12976] [ 849.897383][T12974] futex_wake_op: syz.1.2092 tries to shift op by 144; fix this program [ 850.047521][T12976] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 850.376020][T12988] zonefs (nullb1) ERROR: Not a zoned block device [ 851.017745][ T5782] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 851.064654][T13000] mkiss: ax0: crc mode is auto. [ 851.523965][T13017] binder: 13014:13017 ioctl c018620c 2000000001c0 returned -1 [ 853.015639][T13016] SET target dimension over the limit! [ 855.045017][ T5782] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 855.053714][ T5782] Bluetooth: hci3: Injecting HCI hardware error event [ 855.063987][ T5782] Bluetooth: hci3: hardware error 0x00 [ 855.968008][T13025] tipc: MTU too low for tipc bearer [ 856.105837][T13032] zonefs (nullb1) ERROR: Not a zoned block device [ 856.784932][ T8] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 858.120322][ T5782] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 858.147125][ T8] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 858.199250][ T8] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 858.274156][ T8] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 859.445585][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.929301][T13061] zonefs (nullb1) ERROR: Not a zoned block device [ 859.936125][T13060] tipc: MTU too low for tipc bearer [ 859.987264][ T8] usb 4-1: can't set config #27, error -71 [ 860.034012][ T8] usb 4-1: USB disconnect, device number 33 [ 860.495076][ T8] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 860.707393][ T8] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 860.743235][ T8] usb 4-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 860.792586][ T8] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 860.834297][ T8] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 860.893277][ T8] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 861.024824][T11363] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 862.419926][ T8] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 862.471939][T13099] tipc: MTU too low for tipc bearer [ 862.479484][ T8] usb 4-1: Product: syz [ 862.497737][ T8] usb 4-1: Manufacturer: syz [ 862.522328][ T8] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 862.626775][T11363] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 862.652460][T13104] zonefs (nullb1) ERROR: Not a zoned block device [ 862.665368][T11363] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 862.713513][T11363] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 862.759517][T11363] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 862.809028][T13093] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 862.839662][T13111] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 862.857093][T11363] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 863.083221][T13093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 863.129503][T13093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 863.178384][T11363] usb 3-1: USB disconnect, device number 27 [ 863.234084][ T8] usb 4-1: USB disconnect, device number 34 [ 865.155066][T13136] tipc: MTU too low for tipc bearer [ 865.321519][T13143] zonefs (nullb1) ERROR: Not a zoned block device [ 865.610686][T13156] binder: 13148:13156 ioctl c018620c 2000000001c0 returned -1 [ 865.771979][T13164] syzkaller0: entered promiscuous mode [ 865.780422][T13164] syzkaller0: entered allmulticast mode [ 866.014914][T11363] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 866.114855][ T969] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 866.196492][T11363] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 866.205612][T11363] usb 1-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 866.219311][T11363] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 866.228797][T11363] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 866.243500][T11363] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 866.253429][T11363] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 866.261914][T11363] usb 1-1: Product: syz [ 866.266768][T11363] usb 1-1: Manufacturer: syz [ 866.274498][T11363] cdc_wdm: probe of 1-1:1.0 failed with error -22 [ 866.296318][ T969] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 866.310532][ T969] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 866.321486][ T969] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 866.350023][ T969] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 866.377219][T13166] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 866.407751][ T969] usb 4-1: Quirk or no altest; falling back to MIDI 1.0 [ 866.494676][T13170] zonefs (nullb1) ERROR: Not a zoned block device [ 866.548409][T13171] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 866.631755][T13166] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 866.671271][T13166] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 866.703950][ T969] usb 4-1: USB disconnect, device number 35 [ 866.822988][T11363] usb 1-1: USB disconnect, device number 23 [ 867.050479][T13183] syzkaller0: entered promiscuous mode [ 867.062613][T13183] syzkaller0: entered allmulticast mode [ 867.086163][T13183] tipc: Enabled bearer , priority 0 [ 867.107384][T13182] tipc: Resetting bearer [ 867.160276][T13182] tipc: Disabling bearer [ 867.415806][T13187] syzkaller0: entered promiscuous mode [ 867.443930][T13187] syzkaller0: entered allmulticast mode [ 867.606648][T13195] binder: 13191:13195 ioctl c018620c 2000000001c0 returned -1 [ 867.630935][T13194] zonefs (nullb1) ERROR: Not a zoned block device [ 868.274863][T11363] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 868.324964][ T969] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 868.437741][T13214] nvme nvme0: failed to connect socket: -101 [ 868.452145][T13216] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2174'. [ 868.462913][T11363] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 868.476080][T11363] usb 1-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 868.497420][T13214] [ 868.499785][T13214] ====================================================== [ 868.506797][T13214] WARNING: possible circular locking dependency detected [ 868.513815][T13214] syzkaller #0 Not tainted [ 868.518235][T13214] ------------------------------------------------------ [ 868.525327][T13214] syz.3.2174/13214 is trying to acquire lock: [ 868.531570][T13214] ffff88802cab60e0 (&type->s_umount_key#32){++++}-{3:3}, at: super_lock+0x189/0x390 [ 868.540979][T13214] [ 868.540979][T13214] but task is already holding lock: [ 868.548330][T13214] ffff8880200c8cc8 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580 [ 868.558526][T13214] [ 868.558526][T13214] which lock already depends on the new lock. [ 868.558526][T13214] [ 868.568918][T13214] [ 868.568918][T13214] the existing dependency chain (in reverse order) is: [ 868.577940][T13214] [ 868.577940][T13214] -> #4 (&bdev->bd_holder_lock){+.+.}-{3:3}: [ 868.586098][T13214] __mutex_lock+0x135/0xc80 [ 868.591211][T13214] bd_finish_claiming+0x229/0x3f0 [ 868.596768][T13214] blkdev_get_by_dev+0x469/0x610 [ 868.602329][T13214] bdev_open_by_dev+0x77/0x100 [ 868.607613][T13214] setup_bdev_super+0x59/0x660 [ 868.612979][T13214] mount_bdev+0x1ce/0x2c0 [ 868.617914][T13214] legacy_get_tree+0xea/0x180 [ 868.623111][T13214] vfs_get_tree+0x8c/0x280 [ 868.628042][T13214] do_new_mount+0x24a/0xa40 [ 868.633057][T13214] init_mount+0xde/0x130 [ 868.637876][T13214] do_mount_root+0x97/0x230 [ 868.642903][T13214] mount_root_generic+0x1a6/0x3e0 [ 868.648460][T13214] prepare_namespace+0xc2/0x100 [ 868.653825][T13214] kernel_init_freeable+0x41a/0x560 [ 868.659545][T13214] kernel_init+0x1d/0x1c0 [ 868.664415][T13214] ret_from_fork+0x48/0x80 [ 868.669370][T13214] ret_from_fork_asm+0x11/0x20 [ 868.674693][T13214] [ 868.674693][T13214] -> #3 (bdev_lock){+.+.}-{3:3}: [ 868.681838][T13214] __mutex_lock+0x135/0xc80 [ 868.686862][T13214] bd_prepare_to_claim+0x1d9/0x4a0 [ 868.692514][T13214] truncate_bdev_range+0x4e/0x260 [ 868.698052][T13214] blkdev_common_ioctl+0x1ff9/0x2580 [ 868.703853][T13214] blkdev_ioctl+0x512/0x730 [ 868.708869][T13214] __se_sys_ioctl+0xfd/0x170 [ 868.713978][T13214] do_syscall_64+0x55/0xb0 [ 868.718923][T13214] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 868.725332][T13214] [ 868.725332][T13214] -> #2 (mapping.invalidate_lock){++++}-{3:3}: [ 868.733668][T13214] down_write+0x97/0x200 [ 868.738428][T13214] set_blocksize+0x247/0x4b0 [ 868.743529][T13214] sb_min_blocksize+0xbe/0x190 [ 868.748804][T13214] ext4_fill_super+0x6e7/0x6870 [ 868.754196][T13214] get_tree_bdev+0x3e5/0x520 [ 868.759301][T13214] vfs_get_tree+0x8c/0x280 [ 868.764232][T13214] do_new_mount+0x24a/0xa40 [ 868.769267][T13214] init_mount+0xde/0x130 [ 868.774025][T13214] do_mount_root+0x97/0x230 [ 868.779044][T13214] mount_root_generic+0x1a6/0x3e0 [ 868.784582][T13214] prepare_namespace+0xc2/0x100 [ 868.789952][T13214] kernel_init_freeable+0x41a/0x560 [ 868.795663][T13214] kernel_init+0x1d/0x1c0 [ 868.800505][T13214] ret_from_fork+0x48/0x80 [ 868.805524][T13214] ret_from_fork_asm+0x11/0x20 [ 868.810803][T13214] [ 868.810803][T13214] -> #1 (&sb->s_type->i_mutex_key#8){++++}-{3:3}: [ 868.819520][T13214] down_write+0x97/0x200 [ 868.824297][T13214] set_blocksize+0x1ff/0x4b0 [ 868.829405][T13214] sb_min_blocksize+0xbe/0x190 [ 868.834681][T13214] ext4_fill_super+0x6e7/0x6870 [ 868.840048][T13214] get_tree_bdev+0x3e5/0x520 [ 868.845171][T13214] vfs_get_tree+0x8c/0x280 [ 868.850101][T13214] do_new_mount+0x24a/0xa40 [ 868.855138][T13214] init_mount+0xde/0x130 [ 868.859895][T13214] do_mount_root+0x97/0x230 [ 868.864915][T13214] mount_root_generic+0x1a6/0x3e0 [ 868.870459][T13214] prepare_namespace+0xc2/0x100 [ 868.875828][T13214] kernel_init_freeable+0x41a/0x560 [ 868.881541][T13214] kernel_init+0x1d/0x1c0 [ 868.886383][T13214] ret_from_fork+0x48/0x80 [ 868.891313][T13214] ret_from_fork_asm+0x11/0x20 [ 868.896593][T13214] [ 868.896593][T13214] -> #0 (&type->s_umount_key#32){++++}-{3:3}: [ 868.904845][T13214] __lock_acquire+0x37ef/0x7d80 [ 868.910211][T13214] lock_acquire+0x19e/0x420 [ 868.915229][T13214] down_read+0x46/0x2e0 [ 868.919899][T13214] super_lock+0x189/0x390 [ 868.924739][T13214] fs_bdev_sync+0xa4/0x170 [ 868.929695][T13214] blkdev_common_ioctl+0x8a9/0x2580 [ 868.935422][T13214] blkdev_ioctl+0x512/0x730 [ 868.940454][T13214] __se_sys_ioctl+0xfd/0x170 [ 868.945571][T13214] do_syscall_64+0x55/0xb0 [ 868.950504][T13214] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 868.956924][T13214] [ 868.956924][T13214] other info that might help us debug this: [ 868.956924][T13214] [ 868.967174][T13214] Chain exists of: [ 868.967174][T13214] &type->s_umount_key#32 --> bdev_lock --> &bdev->bd_holder_lock [ 868.967174][T13214] [ 868.980855][T13214] Possible unsafe locking scenario: [ 868.980855][T13214] [ 868.988303][T13214] CPU0 CPU1 [ 868.993672][T13214] ---- ---- [ 868.999054][T13214] lock(&bdev->bd_holder_lock); [ 869.003986][T13214] lock(bdev_lock); [ 869.010394][T13214] lock(&bdev->bd_holder_lock); [ 869.017844][T13214] rlock(&type->s_umount_key#32); [ 869.022973][T13214] [ 869.022973][T13214] *** DEADLOCK *** [ 869.022973][T13214] [ 869.031104][T13214] 1 lock held by syz.3.2174/13214: [ 869.036207][T13214] #0: ffff8880200c8cc8 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580 [ 869.046822][T13214] [ 869.046822][T13214] stack backtrace: [ 869.052714][T13214] CPU: 0 PID: 13214 Comm: syz.3.2174 Not tainted syzkaller #0 [ 869.060278][T13214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 869.070336][T13214] Call Trace: [ 869.073612][T13214] [ 869.076542][T13214] dump_stack_lvl+0x18c/0x250 [ 869.081221][T13214] ? load_image+0x420/0x420 [ 869.085721][T13214] ? show_regs_print_info+0x20/0x20 [ 869.091017][T13214] ? print_circular_bug+0x12b/0x1a0 [ 869.096214][T13214] check_noncircular+0x2fc/0x400 [ 869.101150][T13214] ? print_deadlock_bug+0x5d0/0x5d0 [ 869.106344][T13214] ? lockdep_lock+0xf5/0x230 [ 869.110928][T13214] ? _find_first_zero_bit+0xd6/0x100 [ 869.116212][T13214] __lock_acquire+0x37ef/0x7d80 [ 869.121091][T13214] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 869.127244][T13214] ? arch_stack_walk+0x160/0x190 [ 869.132189][T13214] ? verify_lock_unused+0x140/0x140 [ 869.137557][T13214] ? verify_lock_unused+0x140/0x140 [ 869.142764][T13214] ? stack_trace_save+0xaa/0x100 [ 869.147698][T13214] ? stack_trace_snprint+0xf0/0xf0 [ 869.152804][T13214] ? __stack_depot_save+0x1f/0x660 [ 869.157913][T13214] ? do_syscall_64+0x55/0xb0 [ 869.162498][T13214] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 869.168561][T13214] lock_acquire+0x19e/0x420 [ 869.173060][T13214] ? super_lock+0x189/0x390 [ 869.177660][T13214] ? __might_sleep+0xe0/0xe0 [ 869.182250][T13214] ? read_lock_is_recursive+0x20/0x20 [ 869.187632][T13214] ? __mutex_trylock_common+0x160/0x270 [ 869.193174][T13214] ? trace_raw_output_contention_end+0xd0/0xd0 [ 869.199336][T13214] down_read+0x46/0x2e0 [ 869.203504][T13214] ? super_lock+0x189/0x390 [ 869.208014][T13214] super_lock+0x189/0x390 [ 869.212348][T13214] ? end_current_label_crit_section+0x170/0x170 [ 869.218600][T13214] ? user_get_super+0x180/0x180 [ 869.223457][T13214] ? mutex_lock_nested+0x20/0x20 [ 869.228394][T13214] fs_bdev_sync+0xa4/0x170 [ 869.232807][T13214] ? fs_bdev_mark_dead+0x1f0/0x1f0 [ 869.237920][T13214] blkdev_common_ioctl+0x8a9/0x2580 [ 869.243118][T13214] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 869.248758][T13214] ? blkdev_bszset+0x1f0/0x1f0 [ 869.253515][T13214] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 869.258976][T13214] blkdev_ioctl+0x512/0x730 [ 869.263472][T13214] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 869.268940][T13214] ? bpf_lsm_file_ioctl+0x9/0x10 [ 869.273899][T13214] ? security_file_ioctl+0x80/0xa0 [ 869.279024][T13214] ? blkdev_compat_ptr_ioctl+0xd0/0xd0 [ 869.284478][T13214] __se_sys_ioctl+0xfd/0x170 [ 869.289067][T13214] do_syscall_64+0x55/0xb0 [ 869.293478][T13214] ? clear_bhb_loop+0x40/0x90 [ 869.298158][T13214] ? clear_bhb_loop+0x40/0x90 [ 869.302831][T13214] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 869.308719][T13214] RIP: 0033:0x7fe4f919e159 [ 869.313129][T13214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 869.332732][T13214] RSP: 002b:00007fe4fa052028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 869.341156][T13214] RAX: ffffffffffffffda RBX: 00007fe4f9425fa0 RCX: 00007fe4f919e159 [ 869.349121][T13214] RDX: 0000000000000000 RSI: 0000000000001261 RDI: 000000000000000a [ 869.357099][T13214] RBP: 00007fe4f9235024 R08: 0000000000000000 R09: 0000000000000000 [ 869.365146][T13214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 869.373108][T13214] R13: 00007fe4f9426038 R14: 00007fe4f9425fa0 R15: 00007ffe23ea6af8 [ 869.381078][T13214] [ 869.385659][T11363] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 869.396113][T11363] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 869.413017][T11363] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 869.422182][T11363] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 869.435028][ T969] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 869.448885][ T969] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 869.468143][T11363] usb 1-1: Product: syz [ 869.477747][T11363] usb 1-1: Manufacturer: syz [ 869.483633][ T969] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 869.498425][T11363] cdc_wdm: probe of 1-1:1.0 failed with error -22 [ 869.505755][ T969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 869.524214][T13212] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 869.541396][ T969] usb 2-1: Quirk or no altest; falling back to MIDI 1.0 [ 869.750641][T13212] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 869.766569][T13217] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 869.778070][T13212] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 869.791157][ T969] usb 2-1: USB disconnect, device number 26 [ 869.808775][T11363] usb 1-1: USB disconnect, device number 24 [ 870.489188][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.495898][ T1291] ieee802154 phy1 wpan1: encryption failed: -22