last executing test programs: 1m27.431729678s ago: executing program 0 (id=2206): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES64, @ANYRESHEX=0x0], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002c40)={0x34, &(0x7f0000002c80)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000002cc0)={0x2c, &(0x7f0000002d00)=ANY=[@ANYBLOB="400f02"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="000c01000000a8"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000040)={@local, @empty, @void, {@llc_tr={0x11, {@llc={0x42, 0x42, "03", "6c404000000062cf004ab77f8437"}}}}}, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000180), 0x0, 0x0) read$msr(r4, &(0x7f0000002d40)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f000001bd40)=0x7) r5 = openat$userio(0xffffffffffffff9c, &(0x7f000001bd80), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r5, &(0x7f000001bdc0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r5, &(0x7f000001be00), 0x2) bpf$MAP_CREATE(0x0, &(0x7f000001be40)=ANY=[@ANYBLOB="12000000050000000800000008"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r6, &(0x7f000001be80)={0x0, 0x0, &(0x7f000001bec0)={&(0x7f000001bf00)=ANY=[@ANYBLOB="24000000021401002abd700002dcdf2508000100000000e4a30000000000003200000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f000001bf40)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) pselect6(0x40, &(0x7f000001bf80)={0x8, 0x80, 0x401, 0x6, 0x6, 0x5, 0x401}, 0x0, 0x0, 0x0, 0x0) 1m23.643591324s ago: executing program 0 (id=2213): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0xa) r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, &(0x7f0000000100)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000001c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() openat$vim2m(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000300)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000019300)=0x7) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000019340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r5, 0x5760, 0x21) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000019380)={0x1, &(0x7f00000193c0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1m21.333426805s ago: executing program 0 (id=2216): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, 0x0, 0x0) 1m17.238683277s ago: executing program 0 (id=2225): socket$igmp(0x2, 0x3, 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x100) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000200)='./file0/../file0\x00', &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x18d883, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x89901) move_mount(r0, &(0x7f00000003c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/../file0\x00', 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='mountinfo\x00') read$FUSE(r1, &(0x7f0000000480)={0x2020}, 0x2020) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TPROXY_FAMILY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xc4}}, 0x0) 1m16.131931168s ago: executing program 0 (id=2227): r0 = syz_open_dev$dri(&(0x7f0000019e00), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000019e40)={0x9, 0x7, 0x20ffd}) 1m14.923138942s ago: executing program 0 (id=2231): openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./mnt\x00', 0x149000, 0x3a) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086604, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffe4e}, 0x94) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000019c0), 0x1414c0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000001a00)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001a40)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000001a80)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000001ac0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001b40)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001bc0), 0x318, 0x0) recvmmsg(r3, &(0x7f0000001c00), 0x10106, 0x2, 0x0) getrlimit(0xe, &(0x7f0000001c40)) sched_setaffinity(0x0, 0x8, &(0x7f0000001c80)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$pidfd(0xffffffffffffff9c, 0x0, 0x8000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_ethernet(0x56, &(0x7f0000001cc0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbb000d010000e02602000034efc1a37fc5d806f5866f9efbbd6f84b780f1dc9a61026d379ac2909dfc6030a6cae488e2de295e83061b7a29831a4f2fafcbf0a7647a"], &(0x7f0000001d40)={0x1, 0x3, [0xb0b, 0x11c, 0x916, 0xed5]}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000001d80)='utf8', &(0x7f0000001dc0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000001e00)='./sec/tomoyo/profile\x00', 0x1, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001e40), r5) sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001ec0)={&(0x7f0000001f00)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) 1m14.332664379s ago: executing program 32 (id=2231): openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./mnt\x00', 0x149000, 0x3a) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086604, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffe4e}, 0x94) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000019c0), 0x1414c0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000001a00)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001a40)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000001a80)=0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000001ac0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000001b40)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001bc0), 0x318, 0x0) recvmmsg(r3, &(0x7f0000001c00), 0x10106, 0x2, 0x0) getrlimit(0xe, &(0x7f0000001c40)) sched_setaffinity(0x0, 0x8, &(0x7f0000001c80)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$pidfd(0xffffffffffffff9c, 0x0, 0x8000, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_ethernet(0x56, &(0x7f0000001cc0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbb000d010000e02602000034efc1a37fc5d806f5866f9efbbd6f84b780f1dc9a61026d379ac2909dfc6030a6cae488e2de295e83061b7a29831a4f2fafcbf0a7647a"], &(0x7f0000001d40)={0x1, 0x3, [0xb0b, 0x11c, 0x916, 0xed5]}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000001d80)='utf8', &(0x7f0000001dc0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000001e00)='./sec/tomoyo/profile\x00', 0x1, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001e40), r5) sendmsg$NLBL_MGMT_C_ADDDEF(r5, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001ec0)={&(0x7f0000001f00)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) 32.477163802s ago: executing program 5 (id=2233): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000002c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000200)=@gcm_256={{0x303}, "db8f01077bb7694c", "d27382a20caeda620e80868c9d637c7096767ffaeb7c6f8d76cb589f6f48a279", "00000001", "411f50fcc44b4fcd"}, 0x38) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./sys/module/acpi/parameters/debug_level\x00', 0x2, 0x0) write(r1, &(0x7f0000000080)='0xf', 0x3) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000000540)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x55) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) mount(0x0, &(0x7f0000000240)='./security\x00', &(0x7f0000000280)='securityfs\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) write$P9_RSYMLINK(r2, &(0x7f0000000400)={0x14, 0x11, 0x2, {0xa9, 0x0, 0x1}}, 0x14) sendmsg$NL80211_CMD_ADD_TX_TS(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='>n\x00\'', @ANYRESOCT=0x0, @ANYBLOB="010025bd7000fcdbdf256900000008000300", @ANYRES32=r6, @ANYBLOB="17268c9a1b831c08e5abf85a"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x48890) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000600)) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./proc\x00', 0x0) mount(0x0, &(0x7f00000006c0)='./proc\x00', &(0x7f0000000700)='proc\x00', 0x4000, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000780)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x48000082, 0x100000f, 0x20010, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2f2e01, 0x0) statfs(&(0x7f00000007c0)='./proc/thread-self/fail-nth\x00', &(0x7f0000000800)=""/175) syz_open_procfs(0xffffffffffffffff, &(0x7f00000008c0)='numa_maps\x00') r8 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r8, &(0x7f0000000900)={0x2, 0x4e23, @multicast1}, 0x10) 23.038664369s ago: executing program 5 (id=2233): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000002c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000200)=@gcm_256={{0x303}, "db8f01077bb7694c", "d27382a20caeda620e80868c9d637c7096767ffaeb7c6f8d76cb589f6f48a279", "00000001", "411f50fcc44b4fcd"}, 0x38) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./sys/module/acpi/parameters/debug_level\x00', 0x2, 0x0) write(r1, &(0x7f0000000080)='0xf', 0x3) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000000540)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x55) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) mount(0x0, &(0x7f0000000240)='./security\x00', &(0x7f0000000280)='securityfs\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) write$P9_RSYMLINK(r2, &(0x7f0000000400)={0x14, 0x11, 0x2, {0xa9, 0x0, 0x1}}, 0x14) sendmsg$NL80211_CMD_ADD_TX_TS(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='>n\x00\'', @ANYRESOCT=0x0, @ANYBLOB="010025bd7000fcdbdf256900000008000300", @ANYRES32=r6, @ANYBLOB="17268c9a1b831c08e5abf85a"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x48890) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000600)) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./proc\x00', 0x0) mount(0x0, &(0x7f00000006c0)='./proc\x00', &(0x7f0000000700)='proc\x00', 0x4000, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000780)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x48000082, 0x100000f, 0x20010, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2f2e01, 0x0) statfs(&(0x7f00000007c0)='./proc/thread-self/fail-nth\x00', &(0x7f0000000800)=""/175) syz_open_procfs(0xffffffffffffffff, &(0x7f00000008c0)='numa_maps\x00') r8 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r8, &(0x7f0000000900)={0x2, 0x4e23, @multicast1}, 0x10) 17.397036467s ago: executing program 5 (id=2233): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000002c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000380), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000200)=@gcm_256={{0x303}, "db8f01077bb7694c", "d27382a20caeda620e80868c9d637c7096767ffaeb7c6f8d76cb589f6f48a279", "00000001", "411f50fcc44b4fcd"}, 0x38) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./sys/module/acpi/parameters/debug_level\x00', 0x2, 0x0) write(r1, &(0x7f0000000080)='0xf', 0x3) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r3, &(0x7f0000000540)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x55) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) mount(0x0, &(0x7f0000000240)='./security\x00', &(0x7f0000000280)='securityfs\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) write$P9_RSYMLINK(r2, &(0x7f0000000400)={0x14, 0x11, 0x2, {0xa9, 0x0, 0x1}}, 0x14) sendmsg$NL80211_CMD_ADD_TX_TS(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='>n\x00\'', @ANYRESOCT=0x0, @ANYBLOB="010025bd7000fcdbdf256900000008000300", @ANYRES32=r6, @ANYBLOB="17268c9a1b831c08e5abf85a"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x48890) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000600)) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./proc\x00', 0x0) mount(0x0, &(0x7f00000006c0)='./proc\x00', &(0x7f0000000700)='proc\x00', 0x4000, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000780)='27', 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x48000082, 0x100000f, 0x20010, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2f2e01, 0x0) statfs(&(0x7f00000007c0)='./proc/thread-self/fail-nth\x00', &(0x7f0000000800)=""/175) syz_open_procfs(0xffffffffffffffff, &(0x7f00000008c0)='numa_maps\x00') r8 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r8, &(0x7f0000000900)={0x2, 0x4e23, @multicast1}, 0x10) 10.807938597s ago: executing program 1 (id=2512): prlimit64(0x0, 0xe, &(0x7f0000000bc0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000c00)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000c40)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000c80)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000cc0), 0x0, 0x0) read$msr(r3, &(0x7f0000000d00)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000019d00)=0x7) futex(0x0, 0xd, 0x20000002, 0x0, 0x0, 0x400000) bind$inet(0xffffffffffffffff, &(0x7f0000019d40)={0x2, 0x4e20, @loopback}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000019d80)={0x0, 0x0, &(0x7f0000019dc0)={&(0x7f0000019e00)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x40000}}, 0xb8}}, 0x2c000010) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000019ec0)={0x0, 0x0, &(0x7f0000019f00)={&(0x7f0000019f40)=ANY=[@ANYBLOB="c40000001900010000000000fcffffffe00000020000000000000000000000000000000000000000000000000000000000000000000000000a0000008700", @ANYRES32=0x0, @ANYRES32=0x0], 0xc4}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000019fc0)={0x0, 0x0, &(0x7f000001a000)={&(0x7f000001a040)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x4, {{@in6=@private2={0xfc, 0x2, '\x00', 0xfa}, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20}, {}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x987a3a9f32358a4c) listen(0xffffffffffffffff, 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) get_robust_list(r1, &(0x7f000001a240)=&(0x7f000001a280)={0x0, 0x0, &(0x7f000001a2c0)={&(0x7f000001a300)={&(0x7f000001a340)}}}, &(0x7f000001a380)=0x18) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x70bd28, 0x25dfdbfc, {0xa, 0x10, 0x14, 0x0, 0x8, 0x0, 0x0, 0x3, 0x17}, [@FIB_RULE_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e21, 0x4e22}}, @FRA_SRC={0x14, 0x2, @private0}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10000050}, 0x20048800) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x5c, 0x10, 0x439, 0x3, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}]}}}]}, 0x5c}}, 0x0) 9.696899052s ago: executing program 1 (id=2513): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000040)={'pcl812\x00', [0x140, 0x4, 0x1, 0x2, 0x1, 0x2, 0x8002, 0x1002, 0x20000040, 0xd72d, 0x8, 0xffffffff, 0x2009, 0x6, 0x4ce, 0xfffffffe, 0xfc, 0xed, 0x6, 0x408, 0x4, 0x40000000, 0xe, 0xffffffff, 0xffe, 0x20002f, 0xaf, 0x0, 0xffffffff, 0x7ff]}) ioctl$COMEDI_CHANINFO(r0, 0x80306403, &(0x7f0000027500)={0x1bb, 0x0, 0x0, 0x0}) 8.491216479s ago: executing program 3 (id=2519): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r5 = landlock_create_ruleset(&(0x7f00000000c0)={0xa019, 0x1, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r5, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0xa101, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000340)={0x0, 0x0, 0x3, 0x0, 0x15, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_procfs(0x0, &(0x7f0000000380)='fd/3\x00') close_range(r6, 0xffffffffffffffff, 0x400000000000000) 7.161888109s ago: executing program 3 (id=2521): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x2000c0c4}, 0xc000) 6.527480207s ago: executing program 4 (id=2522): mkdirat(0xffffffffffffff9c, &(0x7f0000002340)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000002380)='./proc\x00', 0x0, 0x40ce, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002400)='./proc/thread-self/fail-nth\x00', 0x202, 0x150) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = accept$phonet_pipe(r0, &(0x7f0000000040), &(0x7f0000000080)=0x5c536571e7782e61) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1}, './proc\x00'}) write(r0, &(0x7f0000002440)='27', 0x2) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x402080, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r2, 0x80045113, &(0x7f0000000140)) mount$9p_unix(&(0x7f0000002480)='./proc/thread-self/fail-nth\x00', &(0x7f00000024c0)='./proc\x00', &(0x7f0000002500), 0x800000, &(0x7f0000002540)) 6.266385434s ago: executing program 4 (id=2525): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r5 = landlock_create_ruleset(&(0x7f00000000c0)={0xa019, 0x1, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r5, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0xa101, 0x0) ioctl$TCSETS(r7, 0x40045431, &(0x7f0000000340)={0x0, 0x0, 0x3, 0x0, 0x15, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_procfs(0x0, &(0x7f0000000380)='fd/3\x00') close_range(r6, 0xffffffffffffffff, 0x400000000000000) 6.079565496s ago: executing program 1 (id=2526): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x47, &(0x7f0000019200)=0x7) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(0xffffffffffffffff, 0x3b8b, &(0x7f0000019300)={0x10, 0x1}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(0xffffffffffffffff, 0x3b8b, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000000301110200000000000000000000000508000840000000e9"], 0x1c}}, 0x40040) 5.345058611s ago: executing program 1 (id=2527): r0 = syz_open_dev$video(&(0x7f0000000480), 0x485, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x4040942c, &(0x7f0000000140)={0x0, 0x0, [0x5, 0x0, 0x6, 0x91, 0x3, 0xf29]}) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000640)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000680)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000006c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f0000000800), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000840)='./trace\x00', 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000880)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) sigaltstack(&(0x7f00000008c0)={0x0, 0x2}, 0x0) write(r3, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./trace/trace\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000940), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={0x30, r5, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x20000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/module/usb_storage/parameters/delay_use\x00', 0x1, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000600)='loginuid\x00') read$FUSE(r7, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/module/usb_storage/parameters/delay_use\x00', 0x0, 0x400) write$tun(r6, &(0x7f0000000500)=ANY=[], 0x12) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1, 0x8, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x9}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) 5.073529069s ago: executing program 2 (id=2528): socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_ublk_setup_io_uring(0x1d, 0x0, 0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, 0x0, r6, r7, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r8 = landlock_create_ruleset(&(0x7f00000000c0)={0xa019, 0x1, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r8, 0x0) socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0xa101, 0x0) ioctl$TCSETS(r10, 0x40045431, &(0x7f0000000340)={0x0, 0x0, 0x3, 0x0, 0x15, "0062ba7d82000000000000000000f7fffeff00"}) syz_open_pts(r10, 0x8182) close_range(r9, 0xffffffffffffffff, 0x400000000000000) 4.421874465s ago: executing program 4 (id=2529): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000480), 0x88002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000004c0)=0xd) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1000000201002) r1 = syz_io_uring_setup(0xf00, &(0x7f00000000c0)={0x0, 0x1, 0x10000, 0x41, 0x2e9}, &(0x7f0000000180)=0x0, 0x0, &(0x7f00000003c0)=0x0) syz_io_uring_submit(r2, 0x0, r3, &(0x7f0000000600)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 3.585761246s ago: executing program 3 (id=2530): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x7}, {0xd, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x0) write$tun(r0, &(0x7f00000002c0)=ANY=[], 0x46) 3.34018349s ago: executing program 3 (id=2531): mkdirat(0xffffffffffffff9c, &(0x7f0000004840)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000004880)='./dev\x00', &(0x7f00000048c0)='devtmpfs\x00', 0x10083, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000004900)='./mnt\x00', 0x1ff) mount(&(0x7f0000004940)=@filename='./dev/sda1\x00', &(0x7f0000004980)='./mnt\x00', &(0x7f00000049c0)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004a40)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000004a80)=@v2={0x2, @aes256, 0x8, '\x00', @c}) 3.242978921s ago: executing program 3 (id=2532): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x43f10000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) close(0x3) openat(0xffffffffffffff9c, 0x0, 0x105042, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000600), 0x400000000000159, 0x40840) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f00000002c0)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000340)='./file0\x00', 0xdafbe5d6891b6e4) sync() ptrace(0x10, r1) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x0, &(0x7f0000000bc0)=""/4101) 3.104713454s ago: executing program 4 (id=2533): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0xdc}}, 0x40000) 2.892185652s ago: executing program 4 (id=2534): bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0), 0x7ff}, 0x38) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000640)={0xffffffffffffffff, &(0x7f0000000680)}, 0x20) 2.800174945s ago: executing program 2 (id=2535): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x48700, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x10) write(r1, &(0x7f00000003c0)='3', 0x4e) syz_usbip_server_init(0x1) r2 = syz_open_dev$sndmidi(&(0x7f0000000200), 0x2, 0x141102) writev(r2, &(0x7f0000000240)=[{&(0x7f0000000280)="94", 0xf000}, {0x0}], 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e24, @empty}, 0x10) r3 = socket$inet(0x2, 0x2, 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000400)={0x2, 0x1bd, @loopback}, 0x10) listen(r4, 0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000640)='xfrm0\x00', 0x10) syz_open_dev$vim2m(0x0, 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f00000006c0)={0xf0f01d, 0x5}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffe, @dev={0xfe, 0x80, '\x00', 0x3b}, 0x3d}, 0x1c) sendto$inet6(r5, &(0x7f0000000740)="046bf184b7b7f1a55a5a9c11a44b7193cf786d2f6e3e7d299a814d1a26591bf94e10", 0xfffffffffffffd33, 0x0, 0x0, 0x0) 2.769165535s ago: executing program 4 (id=2536): setns(0xc9, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_netdev_private(r0, 0x8948, &(0x7f00000004c0)="f53a") r1 = socket(0x8, 0x5, 0x5) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f0000000000)="90") ioctl$sock_SIOCOUTQNSD(r1, 0x40106183, &(0x7f0000000080)) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000040)={'veth1_vlan\x00', {0x2, 0x0, @multicast1}}) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_SET_SREGS2(0xffffffffffffffff, 0x4140aecd, &(0x7f0000000100)={{0x2000, 0xffff1000, 0xf000, 0x9, 0x7f, 0xe3, 0xa, 0xff, 0x0, 0xb, 0x0, 0xb}, {0xd000, 0xd000, 0x10, 0x3, 0x5, 0x7, 0x46, 0x6, 0x1, 0x4, 0xaf, 0xfc}, {0xf000, 0x200000, 0x8, 0x4, 0x10, 0x81, 0x4, 0x13, 0x5, 0x4, 0x92, 0x80}, {0x10000, 0x60000, 0xc, 0x7, 0x7f, 0x7, 0xfe, 0xfd, 0xfa, 0x29, 0xd, 0x9}, {0xeeee8000, 0x0, 0xf, 0x10, 0x5, 0x2, 0xa, 0xf1, 0x2, 0x6e, 0x0, 0x8}, {0x8000000, 0x1000, 0xe, 0x2, 0x7, 0x2, 0x5, 0x2, 0x1, 0xd, 0x6, 0xa}, {0x10001, 0x4, 0xc, 0x0, 0xcd, 0x5, 0x5, 0x26, 0x8, 0x6, 0xff, 0x6}, {0xffc, 0xffff1000, 0xd, 0xe, 0x13, 0x3e, 0x3, 0x0, 0x7f, 0x1, 0x0, 0x8}, {0x1ffe, 0x5}, {0x80a0000, 0x1}, 0x80000003, 0x0, 0x6000, 0x2021a5, 0x1, 0xb800, 0x8000900, 0x1, [0x30, 0x2, 0x1, 0x1]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000002c0)={[0x43400078, 0x1000000000, 0x5, 0x41, 0x3000000, 0x3, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x2, 0x0, 0x3], 0x10000, 0x202}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000380)={{0x1000, 0xe000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x8, 0x6, 0x40}, {0x4, 0x10000, 0x4, 0xff, 0xff, 0x0, 0x0, 0x0, 0x7, 0xff}, {0x1, 0x8080000, 0xc, 0x5, 0x4, 0xc4, 0x0, 0xf0, 0x6a, 0x3, 0x0, 0xfc}, {0x1, 0xeeee8000, 0x6, 0x0, 0x81, 0x0, 0x9, 0x0, 0x8, 0x2, 0x6}, {0x6000, 0xffff1000, 0xf, 0x0, 0x0, 0x4, 0x7, 0x0, 0x1, 0x3c}, {0x100000, 0x0, 0xf, 0x78, 0x5, 0x40, 0x2, 0x0, 0x40, 0xfe, 0x5, 0x4}, {0x4, 0xa000, 0xd, 0x3, 0x3, 0x2, 0xa1, 0x20, 0x0, 0x3}, {0x10000, 0x54000, 0xc, 0x0, 0x0, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0x2}, {0xdddd0000, 0x3}, {0x30000, 0xfffe}, 0xddf8ffdb, 0x0, 0x0, 0x110, 0x0, 0x0, 0xd000, [0x3, 0x0, 0x40000000001]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 2.090655197s ago: executing program 1 (id=2537): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000140)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x47, &(0x7f0000019200)=0x7) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(0xffffffffffffffff, 0x3b8b, &(0x7f0000019300)={0x10, 0x1}) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(0xffffffffffffffff, 0x3b8b, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000000301110200000000000000000000000508000840000000e9"], 0x1c}}, 0x40040) 1.345885444s ago: executing program 2 (id=2538): socket$inet6_sctp(0xa, 0x5, 0x84) socket$packet(0x11, 0x2, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000020000000000000000"], &(0x7f0000000500)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f00000005c0)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.304844222s ago: executing program 3 (id=2539): mq_notify(0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f00000001c0)={0xd, 0x0, 0x6, 0x5, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000140)={0x2, 0x0, 0x1, 0x7, 0x4}) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f0000000180)={0x2, 0x1, 0x3, 0x4, 0x4}) 558.381816ms ago: executing program 1 (id=2540): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x2000c0c4}, 0xc000) 376.058598ms ago: executing program 2 (id=2541): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=@newtfilter={0x34, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x7}, {0xd, 0xffff}, {0x300, 0x3}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x0) write$tun(r0, &(0x7f00000002c0)=ANY=[], 0x46) 118.982907ms ago: executing program 2 (id=2542): mkdirat(0xffffffffffffff9c, &(0x7f0000004840)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000004880)='./dev\x00', &(0x7f00000048c0)='devtmpfs\x00', 0x10083, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000004900)='./mnt\x00', 0x1ff) mount(&(0x7f0000004940)=@filename='./dev/sda1\x00', &(0x7f0000004980)='./mnt\x00', &(0x7f00000049c0)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000004a40)='./mnt\x00', 0x0, 0x21) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000004a80)=@v2={0x2, @aes256, 0x8, '\x00', @c}) 0s ago: executing program 2 (id=2543): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000480), 0x88002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000004c0)=0xd) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x1000000201002) r1 = syz_io_uring_setup(0xf00, &(0x7f00000000c0)={0x0, 0x1, 0x10000, 0x41, 0x2e9}, &(0x7f0000000180)=0x0, 0x0, &(0x7f00000003c0)=0x0) syz_io_uring_submit(r2, 0x0, r3, &(0x7f0000000600)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) kernel console output (not intermixed with test programs): s: Mfr=1, Product=2, SerialNumber=3 [ 1198.176891][ T5893] usb 1-1: Product: syz [ 1198.176904][ T5893] usb 1-1: Manufacturer: syz [ 1198.176918][ T5893] usb 1-1: SerialNumber: syz [ 1198.199252][ T5893] usb 1-1: config 0 descriptor?? [ 1198.205204][ T5893] hub 1-1:0.132: Interface 132 is not authorized for usage [ 1198.205948][ T5893] usbtest 1-1:0.132: Interface 132 is not authorized for usage [ 1198.206154][ T5893] bcm5974 1-1:0.132: Interface 132 is not authorized for usage [ 1199.071435][ T5893] usbhid 1-1:0.132: Interface 132 is not authorized for usage [ 1199.113456][ T5893] usb 1-1: USB disconnect, device number 67 [ 1199.159465][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1199.946883][T13999] usb 3-1: New USB device found: idVendor=056a, idProduct=00b1, bcdDevice=0.00 [ 1199.991860][T13999] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1199.991894][T13999] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1199.991926][T13999] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1200.036047][T14864] FAULT_INJECTION: forcing a failure. [ 1200.036047][T14864] name failslab, interval 1, probability 5, space 0, times 9965 [ 1200.036079][T14864] CPU: 1 UID: 0 PID: 14864 Comm: syz.4.2122 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1200.036109][T14864] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1200.036117][T14864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1200.036129][T14864] Call Trace: [ 1200.036136][T14864] [ 1200.036144][T14864] dump_stack_lvl+0x100/0x190 [ 1200.036181][T14864] should_fail_ex.cold+0x5/0xa [ 1200.036212][T14864] should_failslab+0xc2/0x120 [ 1200.036234][T14864] __kmalloc_noprof+0xfc/0x840 [ 1200.036262][T14864] ? rcu_is_watching+0x13/0xc0 [ 1200.036284][T14864] ? tomoyo_encode2+0xfb/0x3c0 [ 1200.036309][T14864] tomoyo_encode2+0xfb/0x3c0 [ 1200.036332][T14864] tomoyo_encode+0x29/0x50 [ 1200.036350][T14864] tomoyo_realpath_from_path+0x18c/0x690 [ 1200.036390][T14864] tomoyo_path_number_perm+0x23c/0x580 [ 1200.036419][T14864] ? tomoyo_path_number_perm+0x22e/0x580 [ 1200.036447][T14864] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1200.036476][T14864] ? lock_acquire+0x1d1/0x380 [ 1200.036525][T14864] ? current_check_access_path+0x25c/0x420 [ 1200.036553][T14864] ? __pfx_current_check_access_path+0x10/0x10 [ 1200.036580][T14864] ? configfs_lookup+0x6e/0x7d0 [ 1200.036604][T14864] ? lookup_one_qstr_excl+0xaf/0x250 [ 1200.036635][T14864] tomoyo_path_mkdir+0x9b/0xe0 [ 1200.036658][T14864] ? __pfx_tomoyo_path_mkdir+0x10/0x10 [ 1200.036682][T14864] ? lock_acquire+0x1d1/0x380 [ 1200.036713][T14864] security_path_mkdir+0x154/0x2e0 [ 1200.036736][T14864] filename_mkdirat+0x168/0x5e0 [ 1200.036764][T14864] ? __pfx_filename_mkdirat+0x10/0x10 [ 1200.036789][T14864] ? strncpy_from_user+0x19d/0x2d0 [ 1200.036820][T14864] ? do_getname+0x191/0x390 [ 1200.036849][T14864] __x64_sys_mkdirat+0x89/0xc0 [ 1200.036874][T14864] do_syscall_64+0x123/0x790 [ 1200.036906][T14864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1200.036927][T14864] RIP: 0033:0x7f045d19f559 [ 1200.036944][T14864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1200.036962][T14864] RSP: 002b:00007f045e149028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 1200.036983][T14864] RAX: ffffffffffffffda RBX: 00007f045d425fa0 RCX: 00007f045d19f559 [ 1200.036996][T14864] RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c [ 1200.037009][T14864] RBP: 00007f045e149090 R08: 0000000000000000 R09: 0000000000000000 [ 1200.037022][T14864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1200.037033][T14864] R13: 00007f045d426038 R14: 00007f045d425fa0 R15: 00007ffecb1f69e8 [ 1200.037062][T14864] [ 1200.037080][T14864] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1200.117744][T13999] usb 3-1: config 0 descriptor?? [ 1200.206660][ T29] audit: type=1400 audit(1793226315.389:1520): avc: denied { write } for pid=14863 comm="syz.4.2122" name="functions" dev="configfs" ino=9627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1200.596311][T14847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1200.611979][T14847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1200.632638][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1200.926817][T13999] wacom 0003:056A:00B1.000F: Unknown device_type for 'HID 056a:00b1'. Assuming pen. [ 1201.023212][T13999] wacom 0003:056A:00B1.000F: hidraw0: USB HID v0.00 Device [HID 056a:00b1] on usb-dummy_hcd.2-1/input0 [ 1201.114398][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1201.247990][T13999] input: Wacom Intuos3 6x8 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:056A:00B1.000F/input/input36 [ 1201.908917][T13999] usb 3-1: USB disconnect, device number 60 [ 1202.070702][ T5821] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.138002][T14869] fido_id[14869]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 1202.290470][T14873] device-mapper: table: 248:8: adding target device ram1 caused an alignment inconsistency: physical_block_size=4096, logical_block_size=512, alignment_offset=0, start=512 [ 1202.290513][T14873] device-mapper: table: 248:8: adding target device ram1 caused an alignment inconsistency: physical_block_size=4096, logical_block_size=512, alignment_offset=0, start=512 [ 1202.565866][T14881] FAULT_INJECTION: forcing a failure. [ 1202.565866][T14881] name failslab, interval 1, probability 5, space 0, times 9964 [ 1202.565902][T14881] CPU: 1 UID: 0 PID: 14881 Comm: syz.0.2127 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1202.565934][T14881] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1202.565943][T14881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1202.565957][T14881] Call Trace: [ 1202.565965][T14881] [ 1202.565974][T14881] dump_stack_lvl+0x100/0x190 [ 1202.566013][T14881] should_fail_ex.cold+0x5/0xa [ 1202.566046][T14881] should_failslab+0xc2/0x120 [ 1202.566069][T14881] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 1202.566101][T14881] ? __x64_sys_creat+0xcc/0x120 [ 1202.566127][T14881] ? do_syscall_64+0x123/0x790 [ 1202.566161][T14881] ? __d_alloc+0x34/0xad0 [ 1202.566195][T14881] __d_alloc+0x34/0xad0 [ 1202.566225][T14881] __d_alloc_parallel+0x105/0x15e0 [ 1202.566252][T14881] ? lock_acquire+0x1d1/0x380 [ 1202.566279][T14881] ? __d_lookup+0x73/0x4a0 [ 1202.566299][T14881] ? __pfx___d_alloc_parallel+0x10/0x10 [ 1202.566318][T14881] ? __d_lookup+0x25c/0x4a0 [ 1202.566342][T14881] ? __d_lookup+0x266/0x4a0 [ 1202.566369][T14881] lookup_open+0x69a/0x1940 [ 1202.566411][T14881] path_openat+0xe75/0x23f0 [ 1202.566439][T14881] ? __pfx_path_openat+0x10/0x10 [ 1202.566472][T14881] do_file_open+0x20e/0x430 [ 1202.566498][T14881] ? __pfx_do_file_open+0x10/0x10 [ 1202.566542][T14881] ? _raw_spin_unlock+0x28/0x50 [ 1202.566568][T14881] ? alloc_fd+0x471/0x7a0 [ 1202.566601][T14881] do_sys_openat2+0x163/0x1d0 [ 1202.566627][T14881] ? __pfx_do_sys_openat2+0x10/0x10 [ 1202.566651][T14881] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1202.566689][T14881] ? __x64_sys_futex+0x34f/0x4d0 [ 1202.566720][T14881] ? __x64_sys_futex+0x358/0x4d0 [ 1202.566748][T14881] __x64_sys_creat+0xcc/0x120 [ 1202.566775][T14881] ? __pfx___x64_sys_creat+0x10/0x10 [ 1202.566809][T14881] ? do_syscall_64+0xae/0x790 [ 1202.566837][T14881] do_syscall_64+0x123/0x790 [ 1202.566868][T14881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1202.566887][T14881] RIP: 0033:0x7fe97e59f559 [ 1202.566904][T14881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1202.566924][T14881] RSP: 002b:00007fe97f44b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 1202.566946][T14881] RAX: ffffffffffffffda RBX: 00007fe97e826090 RCX: 00007fe97e59f559 [ 1202.566960][T14881] RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000200000000580 [ 1202.566975][T14881] RBP: 00007fe97e636b20 R08: 0000000000000000 R09: 0000000000000000 [ 1202.566990][T14881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1202.567005][T14881] R13: 00007fe97e826128 R14: 00007fe97e826090 R15: 00007ffeef351aa8 [ 1202.567037][T14881] [ 1202.626448][T13999] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1203.667062][ T5821] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.694196][T13999] usb 3-1: New USB device found: idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1203.697060][T13999] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1203.697083][T13999] usb 3-1: Product: syz [ 1203.697096][T13999] usb 3-1: Manufacturer: syz [ 1203.697110][T13999] usb 3-1: SerialNumber: syz [ 1203.699832][T13999] usb 3-1: config 0 descriptor?? [ 1203.706246][T13999] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1204.659668][T13999] gspca_sq905c: sq905c_command: usb_control_msg failed (-110) [ 1204.659693][T13999] sq905c 3-1:0.0: Get version command failed [ 1204.659752][T13999] sq905c 3-1:0.0: probe with driver sq905c failed with error -110 [ 1204.690223][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1204.724435][ T5821] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1205.754651][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1206.976835][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.043196][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.321334][ T5893] usb 3-1: USB disconnect, device number 61 [ 1207.496858][ T29] audit: type=1400 audit(1793226322.849:1521): avc: denied { create } for pid=14913 comm="syz.1.2136" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 1207.602702][T14922] FAULT_INJECTION: forcing a failure. [ 1207.602702][T14922] name failslab, interval 1, probability 5, space 0, times 9963 [ 1207.602767][T14922] CPU: 0 UID: 0 PID: 14922 Comm: syz.0.2130 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1207.602798][T14922] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1207.602806][T14922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1207.602818][T14922] Call Trace: [ 1207.602825][T14922] [ 1207.602834][T14922] dump_stack_lvl+0x100/0x190 [ 1207.602871][T14922] should_fail_ex.cold+0x5/0xa [ 1207.602902][T14922] should_failslab+0xc2/0x120 [ 1207.602923][T14922] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1207.602953][T14922] ? __pmd_alloc+0xbf/0x950 [ 1207.602990][T14922] __pmd_alloc+0xbf/0x950 [ 1207.603021][T14922] __handle_mm_fault+0xa9d/0x2f60 [ 1207.603049][T14922] ? __pfx___handle_mm_fault+0x10/0x10 [ 1207.603068][T14922] ? __pfx_mt_find+0x10/0x10 [ 1207.603108][T14922] ? find_vma+0xbf/0x140 [ 1207.603132][T14922] ? __pfx_find_vma+0x10/0x10 [ 1207.603158][T14922] handle_mm_fault+0x363/0xa20 [ 1207.603184][T14922] do_user_addr_fault+0x745/0x12f0 [ 1207.603221][T14922] exc_page_fault+0x6f/0xd0 [ 1207.603250][T14922] asm_exc_page_fault+0x26/0x30 [ 1207.603271][T14922] RIP: 0010:__put_user_8+0xd/0x20 [ 1207.603299][T14922] Code: ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <48> 89 01 31 c9 0f 01 ca e9 46 f7 03 00 66 0f 1f 44 00 00 0f 01 ca [ 1207.603318][T14922] RSP: 0018:ffffc900039ef8a0 EFLAGS: 00050246 [ 1207.603335][T14922] RAX: ffffffffa0400790 RBX: 0000000000000000 RCX: 0000000000000000 [ 1207.603347][T14922] RDX: ffff888020334b00 RSI: ffffffff82694c81 RDI: ffffffff8c833580 [ 1207.603361][T14922] RBP: ffffc900039efb50 R08: 0000000000059b76 R09: 00000000000001d3 [ 1207.603374][T14922] R10: 0000000000000200 R11: 0000000000000000 R12: 000000000000003f [ 1207.603386][T14922] R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90003457000 [ 1207.603406][T14922] ? 0xffffffffa0400790 [ 1207.603423][T14922] ? __might_fault+0x111/0x140 [ 1207.603448][T14922] bpf_prog_get_info_by_fd+0x2742/0x3130 [ 1207.603474][T14922] ? trace_sched_exit_tp+0x120/0x160 [ 1207.603506][T14922] ? __schedule+0x1270/0x6990 [ 1207.603544][T14922] ? __pfx_bpf_prog_get_info_by_fd+0x10/0x10 [ 1207.603569][T14922] ? __lock_acquire+0x5c0/0x1f40 [ 1207.603598][T14922] ? __pfx___schedule+0x10/0x10 [ 1207.603644][T14922] ? __fget_files+0x21f/0x3d0 [ 1207.603675][T14922] __sys_bpf+0x4128/0x4b60 [ 1207.603703][T14922] ? finish_task_switch.isra.0+0x149/0x10d0 [ 1207.603743][T14922] ? __pfx___sys_bpf+0x10/0x10 [ 1207.603770][T14922] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1207.603796][T14922] ? lockdep_hardirqs_on+0x7d/0x110 [ 1207.603825][T14922] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1207.603854][T14922] ? rcu_is_watching+0x13/0xc0 [ 1207.603876][T14922] ? trace_sched_exit_tp+0x120/0x160 [ 1207.603929][T14922] ? __pfx___schedule+0x10/0x10 [ 1207.603974][T14922] ? fput+0xea/0x100 [ 1207.603997][T14922] ? fput+0x7c/0x100 [ 1207.604019][T14922] ? ksys_write+0x1ac/0x250 [ 1207.604042][T14922] ? __x64_sys_bpf+0xce/0x140 [ 1207.604058][T14922] __x64_sys_bpf+0xce/0x140 [ 1207.604077][T14922] ? do_syscall_64+0xae/0x790 [ 1207.604107][T14922] do_syscall_64+0x123/0x790 [ 1207.604139][T14922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1207.604159][T14922] RIP: 0033:0x7fe97e59f559 [ 1207.604174][T14922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1207.604192][T14922] RSP: 002b:00007fe97f42a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1207.604210][T14922] RAX: ffffffffffffffda RBX: 00007fe97e826180 RCX: 00007fe97e59f559 [ 1207.604222][T14922] RDX: 0000000000000010 RSI: 0000200000000640 RDI: 000000000000000f [ 1207.604234][T14922] RBP: 00007fe97f42a090 R08: 0000000000000000 R09: 0000000000000000 [ 1207.604245][T14922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1207.604257][T14922] R13: 00007fe97e826218 R14: 00007fe97e826180 R15: 00007ffeef351aa8 [ 1207.604300][T14922] [ 1207.775494][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1208.003359][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1208.807964][T13999] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1208.886355][T14928] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2138'. [ 1208.886752][T14928] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2138'. [ 1209.404487][T14931] IPv6: NLM_F_CREATE should be specified when creating new route [ 1209.424103][T14931] comedi comedi2: comedi_config --init_data is deprecated [ 1209.796916][T13999] usb 3-1: device descriptor read/64, error -71 [ 1209.818409][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1210.053384][T13999] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1210.237660][T14936] netlink: 'syz.1.2142': attribute type 21 has an invalid length. [ 1210.237746][T14936] netlink: 'syz.1.2142': attribute type 6 has an invalid length. [ 1210.237761][T14936] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2142'. [ 1210.293777][T13999] usb 3-1: device descriptor read/64, error -71 [ 1210.414310][T13999] usb usb3-port1: attempt power cycle [ 1210.556589][T14951] FAULT_INJECTION: forcing a failure. [ 1210.556589][T14951] name failslab, interval 1, probability 5, space 0, times 9962 [ 1210.556640][T14951] CPU: 0 UID: 0 PID: 14951 Comm: syz.2.2143 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1210.556670][T14951] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1210.556678][T14951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1210.556693][T14951] Call Trace: [ 1210.556700][T14951] [ 1210.556709][T14951] dump_stack_lvl+0x100/0x190 [ 1210.556746][T14951] should_fail_ex.cold+0x5/0xa [ 1210.556776][T14951] should_failslab+0xc2/0x120 [ 1210.556797][T14951] kmem_cache_alloc_noprof+0x92/0x6a0 [ 1210.556824][T14951] ? netlink_deliver_tap+0x103/0xb50 [ 1210.556844][T14951] ? skb_clone+0x187/0x3f0 [ 1210.556869][T14951] skb_clone+0x187/0x3f0 [ 1210.556890][T14951] netlink_deliver_tap+0x82f/0xb50 [ 1210.556917][T14951] netlink_unicast+0x708/0x950 [ 1210.556943][T14951] ? __pfx_netlink_unicast+0x10/0x10 [ 1210.556973][T14951] netlink_sendmsg+0x9ac/0x10c0 [ 1210.556999][T14951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1210.557028][T14951] ? selinux_socket_sendmsg+0x198/0x2f0 [ 1210.557058][T14951] ? ____sys_sendmsg+0xa99/0xc30 [ 1210.557083][T14951] ____sys_sendmsg+0xa99/0xc30 [ 1210.557107][T14951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1210.557132][T14951] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1210.557165][T14951] ? lock_acquire+0x1d1/0x380 [ 1210.557191][T14951] ? get_pid_task+0x2a/0x250 [ 1210.557224][T14951] ___sys_sendmsg+0x190/0x1e0 [ 1210.557251][T14951] ? __pfx____sys_sendmsg+0x10/0x10 [ 1210.557278][T14951] ? get_pid_task+0x106/0x250 [ 1210.557318][T14951] ? find_held_lock+0x2b/0x80 [ 1210.557357][T14951] __sys_sendmsg+0x160/0x210 [ 1210.557378][T14951] ? __pfx___sys_sendmsg+0x10/0x10 [ 1210.557414][T14951] do_syscall_64+0x123/0x790 [ 1210.557448][T14951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1210.557468][T14951] RIP: 0033:0x7f3fdcd9f559 [ 1210.557486][T14951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1210.557504][T14951] RSP: 002b:00007f3fddcf4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1210.557525][T14951] RAX: ffffffffffffffda RBX: 00007f3fdd025fa0 RCX: 00007f3fdcd9f559 [ 1210.557539][T14951] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1210.557551][T14951] RBP: 00007f3fddcf4090 R08: 0000000000000000 R09: 0000000000000000 [ 1210.557563][T14951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1210.557574][T14951] R13: 00007f3fdd026038 R14: 00007f3fdd025fa0 R15: 00007ffcfaa86848 [ 1210.557601][T14951] [ 1210.685196][T14953] FAULT_INJECTION: forcing a failure. [ 1210.685196][T14953] name failslab, interval 1, probability 5, space 0, times 9961 [ 1210.685277][T14953] CPU: 1 UID: 0 PID: 14953 Comm: syz.0.2140 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1210.685303][T14953] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1210.685310][T14953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1210.685321][T14953] Call Trace: [ 1210.685328][T14953] [ 1210.685335][T14953] dump_stack_lvl+0x100/0x190 [ 1210.685369][T14953] should_fail_ex.cold+0x5/0xa [ 1210.685396][T14953] should_failslab+0xc2/0x120 [ 1210.685416][T14953] __kmalloc_noprof+0xfc/0x840 [ 1210.685441][T14953] ? tomoyo_encode2+0xfb/0x3c0 [ 1210.685463][T14953] tomoyo_encode2+0xfb/0x3c0 [ 1210.685486][T14953] tomoyo_encode+0x29/0x50 [ 1210.685501][T14953] tomoyo_realpath_from_path+0x18c/0x690 [ 1210.685525][T14953] tomoyo_path_number_perm+0x23c/0x580 [ 1210.685551][T14953] ? tomoyo_path_number_perm+0x22e/0x580 [ 1210.685579][T14953] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1210.685613][T14953] ? __lock_acquire+0x5c0/0x1f40 [ 1210.685649][T14953] ? __fget_files+0x34/0x3d0 [ 1210.685670][T14953] ? find_held_lock+0x2b/0x80 [ 1210.685688][T14953] ? hook_file_ioctl_common+0x140/0x440 [ 1210.685715][T14953] ? __fget_files+0x21f/0x3d0 [ 1210.685738][T14953] security_file_ioctl+0xd3/0x230 [ 1210.685765][T14953] __x64_sys_ioctl+0xb7/0x210 [ 1210.685793][T14953] do_syscall_64+0x123/0x790 [ 1210.685823][T14953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1210.685841][T14953] RIP: 0033:0x7fe97e59f559 [ 1210.685856][T14953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1210.685872][T14953] RSP: 002b:00007fe97f46c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1210.685890][T14953] RAX: ffffffffffffffda RBX: 00007fe97e825fa0 RCX: 00007fe97e59f559 [ 1210.685901][T14953] RDX: 0000200000000680 RSI: 00000000c040565f RDI: 0000000000000003 [ 1210.685912][T14953] RBP: 00007fe97f46c090 R08: 0000000000000000 R09: 0000000000000000 [ 1210.685922][T14953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1210.685932][T14953] R13: 00007fe97e826038 R14: 00007fe97e825fa0 R15: 00007ffeef351aa8 [ 1210.685957][T14953] [ 1210.685973][T14953] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1210.737192][T11793] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1210.795045][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1210.894718][T11793] usb 4-1: New USB device found: idVendor=045a, idProduct=5210, bcdDevice=1.01 [ 1210.901685][T11793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1210.901710][T11793] usb 4-1: Product: syz [ 1210.901724][T11793] usb 4-1: Manufacturer: syz [ 1210.901738][T11793] usb 4-1: SerialNumber: syz [ 1210.913540][T11793] ums-karma 4-1:1.0: USB Mass Storage device detected [ 1211.009076][T11793] ums-karma 4-1:1.0: This device (045a,5210,0101 S 06 P f5) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller) [ 1211.009076][T11793] Please send a copy of this message to and [ 1211.188910][T11793] ums-karma 4-1:1.0: probe with driver ums-karma failed with error -5 [ 1211.205472][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1211.208125][T11793] usb 4-1: USB disconnect, device number 67 [ 1211.443198][ T5881] usb 2-1: new full-speed USB device number 67 using dummy_hcd [ 1211.465283][T14977] comedi comedi2: pcl711: I/O base address or length out of range [ 1211.580462][ T5881] usb 2-1: device descriptor read/64, error -71 [ 1212.224562][ T5881] usb 2-1: new full-speed USB device number 68 using dummy_hcd [ 1212.237714][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1212.423556][ T5881] usb 2-1: device descriptor read/64, error -71 [ 1212.459440][T14995] netlink: 'syz.2.2153': attribute type 1 has an invalid length. [ 1212.479035][T14995] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1212.506393][T14995] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2153'. [ 1212.523920][T14995] bond2: (slave gretap1): making interface the new active one [ 1212.527442][T14995] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1212.533723][ T5881] usb usb2-port1: attempt power cycle [ 1212.641594][T15002] netlink: 'syz.3.2155': attribute type 2 has an invalid length. [ 1212.641619][T15002] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2155'. [ 1213.814400][ T5881] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 1213.834612][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.835753][ T5881] usb 2-1: device descriptor read/8, error -71 [ 1214.779000][T12495] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1214.849378][ T5881] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 1214.886678][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1215.958879][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1216.130094][T15019] Bluetooth: (null): Invalid header checksum [ 1216.219063][ T5881] usb 2-1: device descriptor read/8, error -71 [ 1216.393609][ T5881] usb usb2-port1: unable to enumerate USB device [ 1216.398869][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1216.503825][T15024] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2162'. [ 1217.033696][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1217.073301][ T5893] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 1217.203211][ T5893] usb 1-1: device descriptor read/64, error -71 [ 1217.443687][ T5893] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 1217.573620][ T5893] usb 1-1: device descriptor read/64, error -71 [ 1218.034712][T12495] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1218.035383][ T5893] usb usb1-port1: attempt power cycle [ 1218.147968][T15047] FAULT_INJECTION: forcing a failure. [ 1218.147968][T15047] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1218.148017][T15047] CPU: 0 UID: 0 PID: 15047 Comm: syz.1.2169 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1218.148048][T15047] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1218.148055][T15047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1218.148066][T15047] Call Trace: [ 1218.148073][T15047] [ 1218.148082][T15047] dump_stack_lvl+0x100/0x190 [ 1218.148118][T15047] should_fail_ex.cold+0x5/0xa [ 1218.148146][T15047] should_fail_alloc_page+0xeb/0x140 [ 1218.148168][T15047] prepare_alloc_pages+0x1f0/0x5b0 [ 1218.148187][T15047] __alloc_frozen_pages_noprof+0x1b1/0x3280 [ 1218.148205][T15047] ? __pfx_get_page_from_freelist+0x10/0x10 [ 1218.148222][T15047] ? rcu_is_watching+0x13/0xc0 [ 1218.148235][T15047] ? trace_mm_page_alloc+0x164/0x1c0 [ 1218.148255][T15047] ? __alloc_frozen_pages_noprof+0x306/0x3280 [ 1218.148273][T15047] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1218.148289][T15047] ? tick_program_event+0xb0/0x140 [ 1218.148309][T15047] ? hrtimer_reprogram+0x165/0x6c0 [ 1218.148323][T15047] ? find_held_lock+0x2b/0x80 [ 1218.148336][T15047] ? __schedule+0x3083/0x6990 [ 1218.148352][T15047] ? __schedule+0x3083/0x6990 [ 1218.148369][T15047] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1218.148387][T15047] ? __schedule+0x1270/0x6990 [ 1218.148416][T15047] alloc_pages_bulk_noprof+0x5f0/0x1480 [ 1218.148432][T15047] ? preempt_schedule_irq+0x79/0x90 [ 1218.148458][T15047] ? policy_nodemask+0xed/0x5e0 [ 1218.148472][T15047] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 1218.148497][T15047] __kasan_populate_vmalloc+0xf0/0x210 [ 1218.148518][T15047] alloc_vmap_area+0x963/0x2bc0 [ 1218.148541][T15047] ? kasan_save_track+0x14/0x30 [ 1218.148559][T15047] ? __kasan_kmalloc+0xaa/0xb0 [ 1218.148576][T15047] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1218.148595][T15047] ? __get_vm_area_node+0x124/0x350 [ 1218.148615][T15047] __get_vm_area_node+0x1ed/0x350 [ 1218.148636][T15047] __vmalloc_node_range_noprof+0x2ad/0x1440 [ 1218.148649][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.148664][T15047] ? preempt_schedule_irq+0x79/0x90 [ 1218.148682][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.148701][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.148719][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.148737][T15047] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1218.148750][T15047] ? memcpy_and_pad+0x46/0x90 [ 1218.148766][T15047] ? kasan_check_range+0x64/0x1e0 [ 1218.148782][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.148796][T15047] __vmalloc_node_noprof+0xad/0xf0 [ 1218.148808][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.148823][T15047] copy_process+0x80b/0x84c0 [ 1218.148846][T15047] ? __pfx_copy_process+0x10/0x10 [ 1218.148861][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.148879][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.148901][T15047] kernel_clone+0x176/0x9d0 [ 1218.148915][T15047] ? find_held_lock+0x2b/0x80 [ 1218.148928][T15047] ? __pfx_kernel_clone+0x10/0x10 [ 1218.148948][T15047] ? ksys_write+0x190/0x250 [ 1218.148959][T15047] ? lock_acquire+0x1d1/0x380 [ 1218.148978][T15047] __do_sys_clone+0xd9/0x120 [ 1218.148992][T15047] ? __pfx___do_sys_clone+0x10/0x10 [ 1218.149006][T15047] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1218.149031][T15047] ? ksys_write+0x1ac/0x250 [ 1218.149042][T15047] ? __pfx_ksys_write+0x10/0x10 [ 1218.149057][T15047] do_syscall_64+0x123/0x790 [ 1218.149077][T15047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.149090][T15047] RIP: 0033:0x7f581d79f559 [ 1218.149101][T15047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1218.149113][T15047] RSP: 002b:00007f581e62efd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1218.149125][T15047] RAX: ffffffffffffffda RBX: 00007f581da26090 RCX: 00007f581d79f559 [ 1218.149133][T15047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ea2e1000 [ 1218.149140][T15047] RBP: 00007f581e62f090 R08: 0000000000000000 R09: 0000000000000000 [ 1218.149147][T15047] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 1218.149154][T15047] R13: 00007f581da26128 R14: 00007f581da26090 R15: 00007fff4305c4d8 [ 1218.149170][T15047] [ 1218.149945][T15047] syz.1.2169: vmalloc error: size 32768, align 0x8000, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1218.151216][T15047] CPU: 0 UID: 0 PID: 15047 Comm: syz.1.2169 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1218.151243][T15047] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1218.151252][T15047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1218.151263][T15047] Call Trace: [ 1218.151269][T15047] [ 1218.151276][T15047] dump_stack_lvl+0x100/0x190 [ 1218.151300][T15047] warn_alloc.cold+0x9e/0xb2 [ 1218.151314][T15047] ? __pfx_warn_alloc+0x10/0x10 [ 1218.151329][T15047] ? lockdep_hardirqs_on+0x7d/0x110 [ 1218.151348][T15047] ? __get_vm_area_node+0x2f0/0x350 [ 1218.151370][T15047] ? __get_vm_area_node+0x22b/0x350 [ 1218.151391][T15047] __vmalloc_node_range_noprof+0xdc6/0x1440 [ 1218.151403][T15047] ? preempt_schedule_irq+0x79/0x90 [ 1218.151422][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.151445][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.151463][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.151480][T15047] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1218.151493][T15047] ? memcpy_and_pad+0x46/0x90 [ 1218.151509][T15047] ? kasan_check_range+0x64/0x1e0 [ 1218.151525][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.151538][T15047] __vmalloc_node_noprof+0xad/0xf0 [ 1218.151550][T15047] ? kernel_clone+0x176/0x9d0 [ 1218.151566][T15047] copy_process+0x80b/0x84c0 [ 1218.151588][T15047] ? __pfx_copy_process+0x10/0x10 [ 1218.151603][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.151621][T15047] ? irqentry_exit+0x202/0xab0 [ 1218.151643][T15047] kernel_clone+0x176/0x9d0 [ 1218.151656][T15047] ? find_held_lock+0x2b/0x80 [ 1218.151669][T15047] ? __pfx_kernel_clone+0x10/0x10 [ 1218.151687][T15047] ? ksys_write+0x190/0x250 [ 1218.151697][T15047] ? lock_acquire+0x1d1/0x380 [ 1218.151715][T15047] __do_sys_clone+0xd9/0x120 [ 1218.151730][T15047] ? __pfx___do_sys_clone+0x10/0x10 [ 1218.151744][T15047] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1218.151769][T15047] ? ksys_write+0x1ac/0x250 [ 1218.151779][T15047] ? __pfx_ksys_write+0x10/0x10 [ 1218.151794][T15047] do_syscall_64+0x123/0x790 [ 1218.151814][T15047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.151826][T15047] RIP: 0033:0x7f581d79f559 [ 1218.151835][T15047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1218.151847][T15047] RSP: 002b:00007f581e62efd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 1218.151857][T15047] RAX: ffffffffffffffda RBX: 00007f581da26090 RCX: 00007f581d79f559 [ 1218.151865][T15047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000ea2e1000 [ 1218.151872][T15047] RBP: 00007f581e62f090 R08: 0000000000000000 R09: 0000000000000000 [ 1218.151879][T15047] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000001 [ 1218.151886][T15047] R13: 00007f581da26128 R14: 00007f581da26090 R15: 00007fff4305c4d8 [ 1218.151901][T15047] [ 1218.151930][T15047] Mem-Info: [ 1218.151939][T15047] active_anon:46803 inactive_anon:531 isolated_anon:0 [ 1218.151939][T15047] active_file:16843 inactive_file:49885 isolated_file:0 [ 1218.151939][T15047] unevictable:33795 dirty:272 writeback:0 [ 1218.151939][T15047] slab_reclaimable:14041 slab_unreclaimable:110763 [ 1218.151939][T15047] mapped:45654 shmem:74240 pagetables:1518 [ 1218.151939][T15047] sec_pagetables:0 bounce:0 [ 1218.151939][T15047] kernel_misc_reclaimable:0 [ 1218.151939][T15047] free:1197515 free_pcp:6588 free_cma:0 [ 1218.152001][T15047] Node 0 active_anon:187212kB inactive_anon:96kB active_file:67372kB inactive_file:199340kB unevictable:120844kB isolated(anon):0kB isolated(file):0kB mapped:182616kB dirty:1088kB writeback:0kB shmem:280596kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12920kB pagetables:5952kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1218.152850][T15047] Node 1 active_anon:0kB inactive_anon:2028kB active_file:0kB inactive_file:200kB unevictable:14336kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:16364kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1218.152912][T15047] Node 0 DMA free:15296kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:64kB local_pcp:64kB free_cma:0kB [ 1218.153251][T15047] lowmem_reserve[]: 0 2447 2449 2449 2449 [ 1218.153662][T15047] Node 0 DMA32 free:843516kB boost:0kB min:33784kB low:42228kB high:50672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:187212kB inactive_anon:96kB active_file:67372kB inactive_file:199340kB unevictable:120844kB writepending:1088kB zspages:296kB present:3129332kB managed:2506532kB mlocked:4108kB bounce:0kB free_pcp:26288kB local_pcp:10276kB free_cma:0kB [ 1218.154725][T15047] lowmem_reserve[]: 0 0 1 1 1 [ 1218.156854][T15047] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1764kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1218.157315][T15047] lowmem_reserve[]: 0 0 0 0 0 [ 1218.157576][T15047] Node 1 Normal free:3931248kB boost:0kB min:56088kB low:70108kB high:84128kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:2028kB active_file:0kB inactive_file:200kB unevictable:14336kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1218.158163][T15047] lowmem_reserve[]: 0 0 0 0 0 [ 1218.158954][T15047] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15296kB [ 1218.161589][T15047] Node 0 DMA32: 995*4kB (UE) 1238*8kB (UME) 4994*16kB (UME) 2961*32kB (UME) 1136*64kB (UM) 425*128kB (UM) 150*256kB (UM) 48*512kB (UM) 34*1024kB (UM) 6*2048kB (UME) 102*4096kB (UM) = 843516kB [ 1218.171793][T15047] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1218.175186][T15047] Node 1 Normal: 8*4kB (U) 6*8kB (U) 6*16kB (UM) 8*32kB (U) 5*64kB (U) 3*128kB (U) 2*256kB (UM) 1*512kB (M) 1*1024kB (U) 2*2048kB (UM) 958*4096kB (M) = 3931248kB [ 1218.179942][T15047] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1218.180891][T15047] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1218.182048][T15047] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1218.196557][T15047] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1218.196847][T15047] 140986 total pagecache pages [ 1218.197467][T15047] 22 pages in swap cache [ 1218.197474][T15047] Free swap = 172kB [ 1218.197481][T15047] Total swap = 124996kB [ 1218.197488][T15047] 2097051 pages RAM [ 1218.197494][T15047] 0 pages HighMem/MovableOnly [ 1218.197500][T15047] 438361 pages reserved [ 1218.198204][T15047] 0 pages cma reserved [ 1218.378998][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1218.644376][ T5893] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 1218.878599][ T5893] usb 1-1: device descriptor read/8, error -71 [ 1219.128435][ T5893] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 1219.211250][ T5893] usb 1-1: device descriptor read/8, error -71 [ 1219.316091][ T5893] usb usb1-port1: unable to enumerate USB device [ 1219.442544][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.864061][T15053] openvswitch: netlink: Flow actions attr not present in new flow. [ 1220.064155][T15053] ceph: No mds server is up or the cluster is laggy [ 1220.077934][ T5893] libceph: mon0 (1)[c::]:6789 connect error [ 1220.400290][T15061] comedi comedi2: pcl711: I/O base address or length out of range [ 1220.473662][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1221.698821][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1221.714320][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1221.849242][T15068] netlink: set zone limit has 4 unknown bytes [ 1222.713528][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.433894][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.911324][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1224.242662][T15092] overlayfs: conflicting options: userxattr,redirect_dir=on [ 1224.366076][T15093] gadgetfs: bound to dummy_udc driver [ 1224.653361][ T5893] usb 1-1: new full-speed USB device number 72 using dummy_hcd [ 1224.653778][ C0] gadgetfs: connected [ 1224.654097][ T5893] gadgetfs: disconnected [ 1224.815622][ C0] gadgetfs: connected [ 1224.838560][ T5893] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a0, bcdDevice=1.00 [ 1224.840304][ T5893] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1224.840627][ T5893] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1224.931782][ C0] gadgetfs: configuration #1 [ 1225.030187][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1226.158378][T12495] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1226.352384][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1226.483549][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1227.245036][T15102] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 1227.299175][T15093] gadgetfs: suspended from state 3 [ 1227.299224][T15093] gadgetfs: disconnected [ 1227.302059][ T5893] usb 1-1: USB disconnect, device number 72 [ 1227.355045][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1227.665009][T15108] FAULT_INJECTION: forcing a failure. [ 1227.665009][T15108] name failslab, interval 1, probability 5, space 0, times 9960 [ 1227.665031][T15108] CPU: 0 UID: 0 PID: 15108 Comm: syz.3.2181 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1227.665051][T15108] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1227.665057][T15108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1227.665065][T15108] Call Trace: [ 1227.665070][T15108] [ 1227.665076][T15108] dump_stack_lvl+0x100/0x190 [ 1227.665100][T15108] should_fail_ex.cold+0x5/0xa [ 1227.665120][T15108] should_failslab+0xc2/0x120 [ 1227.665134][T15108] __kmalloc_cache_noprof+0x91/0x6d0 [ 1227.665151][T15108] ? hook_capable+0x1bc/0x500 [ 1227.665168][T15108] ? resv_map_alloc+0x46/0x400 [ 1227.665181][T15108] resv_map_alloc+0x46/0x400 [ 1227.665194][T15108] hugetlbfs_get_inode+0x324/0x740 [ 1227.665212][T15108] ? security_capable+0x80/0x260 [ 1227.665231][T15108] hugetlb_file_setup+0x3cc/0x5b0 [ 1227.665246][T15108] newseg+0xaf0/0xed0 [ 1227.665268][T15108] ? __pfx_newseg+0x10/0x10 [ 1227.665294][T15108] ? down_write+0x141/0x1f0 [ 1227.665308][T15108] ? __pfx_do_recvmmsg+0x10/0x10 [ 1227.665329][T15108] ipcget+0xe7/0xe70 [ 1227.665340][T15108] ? __pfx_do_futex+0x10/0x10 [ 1227.665357][T15108] ? __pfx_ipcget+0x10/0x10 [ 1227.665369][T15108] ? __x64_sys_futex+0x34f/0x4d0 [ 1227.665384][T15108] ? __x64_sys_futex+0x358/0x4d0 [ 1227.665401][T15108] __x64_sys_shmget+0x13b/0x1b0 [ 1227.665414][T15108] ? __pfx___x64_sys_shmget+0x10/0x10 [ 1227.665433][T15108] do_syscall_64+0x123/0x790 [ 1227.665454][T15108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1227.665467][T15108] RIP: 0033:0x7f4ec0f9f559 [ 1227.665478][T15108] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1227.665490][T15108] RSP: 002b:00007f4ec1f28028 EFLAGS: 00000246 ORIG_RAX: 000000000000001d [ 1227.665503][T15108] RAX: ffffffffffffffda RBX: 00007f4ec1225fa0 RCX: 00007f4ec0f9f559 [ 1227.665511][T15108] RDX: 0000000000000880 RSI: 0000000000003000 RDI: 0000000000000000 [ 1227.665519][T15108] RBP: 00007f4ec1036b20 R08: 0000000000000000 R09: 0000000000000000 [ 1227.665526][T15108] R10: 0000200000ffa000 R11: 0000000000000246 R12: 0000000000000000 [ 1227.665534][T15108] R13: 00007f4ec1226038 R14: 00007f4ec1225fa0 R15: 00007fffb5b87cb8 [ 1227.665550][T15108] [ 1228.589794][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.592606][ T9383] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.592992][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.596970][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.616920][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.617255][ T101] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.617765][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.643967][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.673543][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1230.840693][T15131] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1230.840726][T15131] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1230.894191][T15131] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1230.894227][T15131] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1232.384651][T13999] net_ratelimit: 1 callbacks suppressed [ 1232.384672][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1232.725428][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1232.823453][T12495] usb 2-1: new full-speed USB device number 71 using dummy_hcd [ 1233.674685][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1233.774181][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1233.871184][T12495] usb 2-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 1233.871225][T12495] usb 2-1: too many configurations: 29, using maximum allowed: 8 [ 1233.896172][T12495] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1233.896214][T12495] usb 2-1: can't read configurations, error -71 [ 1234.063218][ T9] usb 4-1: new full-speed USB device number 68 using dummy_hcd [ 1234.348596][ T9] usb 4-1: New USB device found: idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1234.349407][ T9] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 1234.349424][ T9] usb 4-1: config 0 has no interface number 0 [ 1234.349444][ T9] usb 4-1: config 0 interface 12 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1234.349461][ T9] usb 4-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1234.349477][ T9] usb 4-1: config 0 interface 12 has no altsetting 0 [ 1234.351013][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1234.351031][ T9] usb 4-1: Product: syz [ 1234.351040][ T9] usb 4-1: Manufacturer: syz [ 1234.351049][ T9] usb 4-1: SerialNumber: syz [ 1234.936250][ T9] usb 4-1: config 0 descriptor?? [ 1234.965695][T15152] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1234.965809][T15152] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1234.984732][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1235.027789][ T9] f81534 4-1:0.12: unsupported endpoint max packet size [ 1235.177434][T15152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1235.183012][T15152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1235.197131][T13999] usb 4-1: USB disconnect, device number 68 [ 1236.203518][ T5881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.227540][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.230150][T12495] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.233226][ T42] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.261833][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1237.156416][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1237.977425][ T5894] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 1238.317055][T11793] net_ratelimit: 1 callbacks suppressed [ 1238.317077][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1238.383176][ T5894] usb 1-1: device descriptor read/64, error -71 [ 1238.633497][ T5894] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 1239.630673][ T5894] usb 1-1: device descriptor read/64, error -71 [ 1239.630837][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1239.658549][T12495] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1239.733398][ T5894] usb usb1-port1: attempt power cycle [ 1239.809493][ T5893] usb 4-1: new full-speed USB device number 69 using dummy_hcd [ 1240.073498][ T5894] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 1240.095506][ T5894] usb 1-1: device descriptor read/8, error -71 [ 1240.828298][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1241.084907][ T5894] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 1241.163533][T15206] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=15206 comm=syz.2.2204 [ 1241.581674][ T5894] usb 1-1: device not accepting address 76, error -71 [ 1241.583192][ T5894] usb usb1-port1: unable to enumerate USB device [ 1242.567526][ T5821] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1242.667140][ T5893] usb 4-1: New USB device found: idVendor=0424, idProduct=7850, bcdDevice=0.00 [ 1242.667186][ T5893] usb 4-1: too many configurations: 29, using maximum allowed: 8 [ 1242.667922][ T5893] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1242.667958][ T5893] usb 4-1: can't read configurations, error -71 [ 1242.713926][ T5727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1243.430767][ T29] audit: type=1400 audit(1793226358.779:1522): avc: denied { bind } for pid=15211 comm="syz.2.2215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1243.593457][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1244.503777][T11793] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1244.653462][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1244.673806][T11793] usb 2-1: New USB device found: idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1244.675958][T11793] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1244.675985][T11793] usb 2-1: Product: syz [ 1244.675999][T11793] usb 2-1: SerialNumber: syz [ 1244.678202][T11793] usb 2-1: config 0 descriptor?? [ 1244.960669][T11793] usb 2-1: USB disconnect, device number 73 [ 1245.674028][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1245.753672][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1246.552278][ T5894] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1246.713817][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1248.490502][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1249.465006][ T5894] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1249.513880][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1250.464082][ T6111] bond0: (slave netdevsim1): Releasing backup interface [ 1251.142663][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1251.550787][ T5623] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1251.560926][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1251.573899][ T5623] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1251.582162][ T5623] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1251.598639][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1251.641771][T13036] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1251.654788][T13036] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1251.656263][T13036] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1251.658641][T13036] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1251.659043][T13036] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1251.684100][ T29] audit: type=1400 audit(1793226367.009:1523): avc: denied { mounton } for pid=15263 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 1251.983566][ T42] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1251.984334][T15273] FAULT_INJECTION: forcing a failure. [ 1251.984334][T15273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1251.984362][T15273] CPU: 1 UID: 0 PID: 15273 Comm: syz.1.2224 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1251.984389][T15273] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1251.984397][T15273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1251.984408][T15273] Call Trace: [ 1251.984415][T15273] [ 1251.984423][T15273] dump_stack_lvl+0x100/0x190 [ 1251.984460][T15273] should_fail_ex.cold+0x5/0xa [ 1251.984489][T15273] _copy_from_user+0x2e/0xd0 [ 1251.984512][T15273] drm_ioctl+0x520/0xc60 [ 1251.984538][T15273] ? __pfx_drm_mode_create_dumb_ioctl+0x10/0x10 [ 1251.984563][T15273] ? __pfx_drm_ioctl+0x10/0x10 [ 1251.984580][T15273] ? __fget_files+0x34/0x3d0 [ 1251.984613][T15273] ? selinux_file_ioctl+0x1e0/0x290 [ 1251.984642][T15273] ? selinux_file_ioctl+0x1e7/0x290 [ 1251.984670][T15273] ? __pfx_drm_ioctl+0x10/0x10 [ 1251.984687][T15273] __x64_sys_ioctl+0x18e/0x210 [ 1251.984715][T15273] do_syscall_64+0x123/0x790 [ 1251.984742][T15273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1251.984760][T15273] RIP: 0033:0x7f581d79f559 [ 1251.984776][T15273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1251.984795][T15273] RSP: 002b:00007f581e650028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1251.984815][T15273] RAX: ffffffffffffffda RBX: 00007f581da25fa0 RCX: 00007f581d79f559 [ 1251.984827][T15273] RDX: 0000200000019e40 RSI: 00000000c02064b2 RDI: 0000000000000003 [ 1251.984840][T15273] RBP: 00007f581e650090 R08: 0000000000000000 R09: 0000000000000000 [ 1251.984851][T15273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1251.984863][T15273] R13: 00007f581da26038 R14: 00007f581da25fa0 R15: 00007fff4305c4d8 [ 1251.984890][T15273] [ 1252.215062][ T5821] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.278374][T11793] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1252.473673][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.570975][T11793] usb 3-1: New USB device found: idVendor=06cd, idProduct=010f, bcdDevice=1.00 [ 1252.616943][T11793] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1252.617000][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1252.617028][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1252.617053][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 1252.617087][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 1252.617111][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 1252.617134][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 1252.617156][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 1252.617179][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 1252.617202][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 1252.617225][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 1252.793797][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 1252.793838][T11793] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1252.793860][T11793] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1252.793883][T11793] usb 3-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 1252.804133][ T1418] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1252.938574][T11793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1252.938604][T11793] usb 3-1: Product: syz [ 1252.938620][T11793] usb 3-1: Manufacturer: syz [ 1252.938636][T11793] usb 3-1: SerialNumber: syz [ 1252.949501][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.949607][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.949699][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.949792][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.949888][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.949974][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.950062][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.950153][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.950237][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.950324][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.950411][T15275] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1252.951887][T11793] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 1252.954472][T11793] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 7 [ 1252.961599][T11793] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1252.964424][T11793] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 1252.967169][T11793] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1253.113234][ T1418] netdevsim netdevsim0 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.163739][ T62] netdevsim netdevsim0 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.167652][T15287] Option 'dnserror' to dns_resolver key: bad/missing value [ 1253.209197][ T29] audit: type=1326 audit(1793226368.559:1524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.209253][ T29] audit: type=1326 audit(1793226368.559:1525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.209293][ T29] audit: type=1326 audit(1793226368.559:1526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.209337][ T29] audit: type=1326 audit(1793226368.559:1527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.220631][ T29] audit: type=1326 audit(1793226368.569:1528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.220684][ T29] audit: type=1326 audit(1793226368.569:1529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.220722][ T29] audit: type=1326 audit(1793226368.569:1530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.226777][ T29] audit: type=1326 audit(1793226368.579:1531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.226826][ T29] audit: type=1326 audit(1793226368.579:1532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15281 comm="syz.1.2237" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f581d79f559 code=0x7ffc0000 [ 1253.294558][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1253.753268][ T5623] Bluetooth: hci2: command tx timeout [ 1254.012157][ T5893] usb 3-1: USB disconnect, device number 65 [ 1254.313371][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1254.666676][ T5893] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1254.767552][ T5893] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1254.805801][ T5893] keyspan 3-1:1.0: device disconnected [ 1255.003257][T12495] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1255.186288][T12495] usb 4-1: Using ep0 maxpacket: 32 [ 1255.191599][T12495] usb 4-1: New USB device found: idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1255.224003][T12495] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1255.224068][T12495] usb 4-1: config 0 has no interface number 0 [ 1255.224207][T12495] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1255.272618][T12495] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1255.272654][T12495] usb 4-1: Product: syz [ 1255.272722][T12495] usb 4-1: Manufacturer: syz [ 1255.272764][T12495] usb 4-1: SerialNumber: syz [ 1255.380443][T12495] usb 4-1: config 0 descriptor?? [ 1255.381587][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1255.513584][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1255.833282][ T5623] Bluetooth: hci2: command tx timeout [ 1256.045179][ T6111] bond1 (unregistering): (slave gretap1): Releasing backup interface [ 1256.079954][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.145821][ T6111] bond0 (unregistering): Released all slaves [ 1256.197204][ T6111] bond1 (unregistering): (slave bond2): Releasing backup interface [ 1256.197959][ T6111] bond1 (unregistering): Released all slaves [ 1256.212946][ T6111] bond2 (unregistering): Released all slaves [ 1256.222244][ T6111] bond3 (unregistering): Released all slaves [ 1256.319327][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1256.319363][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1256.357430][ T6111] : left promiscuous mode [ 1256.403466][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1257.319973][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1257.320012][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1257.320036][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1257.320055][T12495] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1257.320278][T12495] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1257.422939][T12495] usb 4-1: USB disconnect, device number 71 [ 1257.433763][T11793] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1257.660620][T15263] Failed to initialize the IGMP autojoin socket (err -2) [ 1257.750257][ T6111] tipc: Left network mode [ 1257.796674][ T5894] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1257.817273][T15340] FAULT_INJECTION: forcing a failure. [ 1257.817273][T15340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1257.817306][T15340] CPU: 1 UID: 0 PID: 15340 Comm: syz.3.2248 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1257.817336][T15340] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1257.817344][T15340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1257.817356][T15340] Call Trace: [ 1257.817363][T15340] [ 1257.817372][T15340] dump_stack_lvl+0x100/0x190 [ 1257.817409][T15340] should_fail_ex.cold+0x5/0xa [ 1257.817439][T15340] _copy_to_user+0x32/0xd0 [ 1257.817464][T15340] simple_read_from_buffer+0xcb/0x170 [ 1257.817490][T15340] proc_fail_nth_read+0x1af/0x230 [ 1257.817516][T15340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1257.817542][T15340] ? rw_verify_area+0xce/0x6d0 [ 1257.817568][T15340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1257.817590][T15340] vfs_read+0x1e4/0xb40 [ 1257.817619][T15340] ? lock_acquire+0x1d1/0x380 [ 1257.817644][T15340] ? __fget_files+0x34/0x3d0 [ 1257.817666][T15340] ? __pfx_vfs_read+0x10/0x10 [ 1257.817693][T15340] ? find_held_lock+0x2b/0x80 [ 1257.817716][T15340] ? __fget_files+0x215/0x3d0 [ 1257.817742][T15340] ? __fget_files+0x21f/0x3d0 [ 1257.817772][T15340] ksys_read+0x12a/0x250 [ 1257.817800][T15340] ? __pfx_ksys_read+0x10/0x10 [ 1257.817836][T15340] do_syscall_64+0x123/0x790 [ 1257.817869][T15340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1257.817889][T15340] RIP: 0033:0x7f4ec0f5fd8e [ 1257.817906][T15340] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1257.817925][T15340] RSP: 002b:00007f4ec1f27fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1257.817945][T15340] RAX: ffffffffffffffda RBX: 00007f4ec1f286c0 RCX: 00007f4ec0f5fd8e [ 1257.817958][T15340] RDX: 000000000000000f RSI: 00007f4ec1f280a0 RDI: 0000000000000005 [ 1257.817976][T15340] RBP: 00007f4ec1f28090 R08: 0000000000000000 R09: 0000000000000000 [ 1257.817988][T15340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1257.818000][T15340] R13: 00007f4ec1226038 R14: 00007f4ec1225fa0 R15: 00007fffb5b87cb8 [ 1257.818025][T15340] [ 1257.917107][ T5623] Bluetooth: hci2: command tx timeout [ 1258.024204][ T5894] usb 2-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1258.024244][ T5894] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 1258.059005][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.059052][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.059076][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.124138][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.124190][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.124214][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.553400][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1258.558435][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.558492][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.558520][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.629194][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.629246][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.629273][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.707380][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1258.710239][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.710299][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.710328][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.752629][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.752679][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.752707][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.753591][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.753629][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.753653][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.754420][ T5894] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1258.754458][ T5894] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1258.754483][ T5894] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1258.756124][ T5894] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1258.756146][ T5894] usb 2-1: Product: syz [ 1258.756161][ T5894] usb 2-1: Manufacturer: syz [ 1258.756176][ T5894] usb 2-1: SerialNumber: syz [ 1258.797561][ T5894] usb 2-1: config 0 descriptor?? [ 1259.612443][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1259.627559][ T5894] yurex 2-1:0.0: USB YUREX device now attached to Yurex #0 [ 1259.720920][ T5894] usb 2-1: USB disconnect, device number 74 [ 1259.729950][T15328] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2243'. [ 1259.761015][ T5894] yurex 2-1:0.0: USB YUREX #0 now disconnected [ 1259.770461][T15292] udevd[15292]: setting mode of /dev/bus/usb/002/074 to 020664 failed: No such file or directory [ 1259.770553][T15292] udevd[15292]: setting owner of /dev/bus/usb/002/074 to uid=0, gid=0 failed: No such file or directory [ 1259.832103][ T29] kauditd_printk_skb: 1072 callbacks suppressed [ 1259.832124][ T29] audit: type=1400 audit(1793226375.179:2605): avc: denied { write } for pid=15323 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1259.971726][ T29] audit: type=1400 audit(1793226375.319:2606): avc: denied { write } for pid=15355 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1259.993211][ T5623] Bluetooth: hci2: command tx timeout [ 1260.633511][T13999] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1260.989526][T12495] libceph: mon0 (1)[c::]:6789 connect error [ 1261.175676][T15364] ceph: No mds server is up or the cluster is laggy [ 1261.304200][T12495] libceph: mon0 (1)[c::]:6789 connect error [ 1263.363035][T15263] bridge0: port 1(bridge_slave_0) entered blocking state [ 1263.376399][T15263] bridge0: port 1(bridge_slave_0) entered disabled state [ 1263.376548][T15263] bridge_slave_0: entered allmulticast mode [ 1263.445923][T15263] bridge_slave_0: entered promiscuous mode [ 1263.447984][T15263] bridge0: port 2(bridge_slave_1) entered blocking state [ 1263.448058][T15263] bridge0: port 2(bridge_slave_1) entered disabled state [ 1263.448156][T15263] bridge_slave_1: entered allmulticast mode [ 1264.081754][T15263] bridge_slave_1: entered promiscuous mode [ 1264.340764][T15263] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1264.433371][T15263] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1264.573578][ T6111] hsr_slave_0: left promiscuous mode [ 1264.576302][ T6111] hsr_slave_1: left promiscuous mode [ 1264.765518][ T29] audit: type=1400 audit(1793226380.119:2607): avc: denied { write } for pid=15386 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1264.876725][ T29] audit: type=1400 audit(1793226380.229:2608): avc: denied { write } for pid=15399 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1265.214292][ T29] audit: type=1400 audit(1793226380.569:2609): avc: denied { write } for pid=15406 comm="syz.1.2255" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1265.214503][T15407] random: crng reseeded on system resumption [ 1265.349417][T12495] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1265.419592][ T29] audit: type=1400 audit(1793226380.769:2610): avc: denied { ioctl } for pid=15406 comm="syz.1.2255" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x3314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1265.503404][T12495] usb 4-1: Using ep0 maxpacket: 32 [ 1265.506796][T12495] usb 4-1: New USB device found: idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1265.578513][T12495] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 1265.578689][T12495] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1265.578739][T12495] usb 4-1: config 0 has no interface number 0 [ 1265.578911][T12495] usb 4-1: config 0 interface 67 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1265.641726][T12495] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1265.641783][T12495] usb 4-1: Product: syz [ 1265.641829][T12495] usb 4-1: Manufacturer: syz [ 1265.641880][T12495] usb 4-1: SerialNumber: syz [ 1265.690778][ T5894] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1265.691728][T12495] usb 4-1: config 0 descriptor?? [ 1265.717418][T12495] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1265.717595][T12495] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -22 [ 1266.208940][T15423] FAULT_INJECTION: forcing a failure. [ 1266.208940][T15423] name failslab, interval 1, probability 5, space 0, times 9958 [ 1266.208970][T15423] CPU: 1 UID: 0 PID: 15423 Comm: syz.2.2260 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1266.208993][T15423] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1266.209000][T15423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1266.209009][T15423] Call Trace: [ 1266.209014][T15423] [ 1266.209020][T15423] dump_stack_lvl+0x100/0x190 [ 1266.209050][T15423] should_fail_ex.cold+0x5/0xa [ 1266.209075][T15423] should_failslab+0xc2/0x120 [ 1266.209097][T15423] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 1266.209127][T15423] ? selinux_socket_create+0xe7/0x590 [ 1266.209151][T15423] ? sock_alloc_inode+0x26/0x2c0 [ 1266.209177][T15423] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1266.209205][T15423] sock_alloc_inode+0x26/0x2c0 [ 1266.209230][T15423] ? __pfx_sock_alloc_inode+0x10/0x10 [ 1266.209254][T15423] alloc_inode+0x68/0x250 [ 1266.209285][T15423] sock_alloc+0x42/0x240 [ 1266.209308][T15423] __sock_create+0xc2/0x860 [ 1266.209334][T15423] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1266.209372][T15423] __sys_socketpair+0x170/0x580 [ 1266.209401][T15423] ? __pfx___sys_socketpair+0x10/0x10 [ 1266.209427][T15423] ? xfd_validate_state+0x129/0x190 [ 1266.209448][T15423] __x64_sys_socketpair+0x96/0x100 [ 1266.209465][T15423] ? lockdep_hardirqs_on+0x7d/0x110 [ 1266.209484][T15423] do_syscall_64+0x123/0x790 [ 1266.209505][T15423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1266.209518][T15423] RIP: 0033:0x7f3fdcda0dfa [ 1266.209530][T15423] Code: 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 35 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1266.209543][T15423] RSP: 002b:00007f3fddcf3f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 1266.209556][T15423] RAX: ffffffffffffffda RBX: 00007f3fdd025f00 RCX: 00007f3fdcda0dfa [ 1266.209564][T15423] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 1266.209572][T15423] RBP: 00007f3fdce36b20 R08: 0000000000000000 R09: 0000000000000000 [ 1266.209579][T15423] R10: 00007f3fddcf3f88 R11: 0000000000000246 R12: 0000000000000001 [ 1266.209587][T15423] R13: 00007f3fdd026038 R14: 00007f3fdd025fa0 R15: 00007ffcfaa86848 [ 1266.209603][T15423] [ 1266.209675][T15423] socket: no more sockets [ 1267.806070][T15431] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 1267.806090][T15431] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1267.807923][T15431] vhci_hcd vhci_hcd.0: Device attached [ 1268.463193][ T29] audit: type=1400 audit(1793226383.259:2611): avc: denied { create } for pid=15430 comm="syz.2.2262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1268.463321][ T29] audit: type=1400 audit(1793226383.269:2612): avc: denied { write } for pid=15430 comm="syz.2.2262" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1268.765699][T15434] vhci_hcd: connection closed [ 1268.833440][ T6013] vhci_hcd vhci_hcd.1: stop threads [ 1268.833543][ T6013] vhci_hcd vhci_hcd.1: release socket [ 1268.833670][ T6013] vhci_hcd vhci_hcd.1: disconnect device [ 1268.866870][ T5881] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1269.393774][T15441] overlayfs: conflicting options: userxattr,redirect_dir=on [ 1269.654946][T15443] gadgetfs: bound to dummy_udc driver [ 1269.747322][T13999] usb 4-1: USB disconnect, device number 72 [ 1269.945485][T11793] usb 1-1: new full-speed USB device number 77 using dummy_hcd [ 1269.946157][ C1] gadgetfs: connected [ 1269.951546][T11793] gadgetfs: disconnected [ 1270.093677][ C1] gadgetfs: connected [ 1270.095301][T11793] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a0, bcdDevice=1.00 [ 1270.095977][T11793] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1270.096049][T11793] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1270.289981][ C1] gadgetfs: configuration #1 [ 1272.368837][T15263] team0: Port device team_slave_0 added [ 1272.389370][T15440] gadgetfs: suspended from state 3 [ 1272.389419][T15440] gadgetfs: disconnected [ 1272.401990][T13999] usb 1-1: USB disconnect, device number 77 [ 1272.520423][T15263] team0: Port device team_slave_1 added [ 1273.279340][ T29] audit: type=1400 audit(1793226388.629:2613): avc: denied { write } for pid=15458 comm="syz.4.2266" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 1273.283049][T15460] FAULT_INJECTION: forcing a failure. [ 1273.283049][T15460] name failslab, interval 1, probability 5, space 0, times 9956 [ 1273.308632][T15460] CPU: 0 UID: 0 PID: 15460 Comm: syz.4.2266 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1273.308657][T15460] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1273.308662][T15460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1273.308670][T15460] Call Trace: [ 1273.308686][T15460] [ 1273.308692][T15460] dump_stack_lvl+0x100/0x190 [ 1273.308720][T15460] should_fail_ex.cold+0x5/0xa [ 1273.308740][T15460] should_failslab+0xc2/0x120 [ 1273.308754][T15460] __kmalloc_noprof+0xfc/0x840 [ 1273.308773][T15460] ? iter_file_splice_write+0x1d8/0x10b0 [ 1273.308792][T15460] iter_file_splice_write+0x1d8/0x10b0 [ 1273.308813][T15460] ? __pfx___might_resched+0x10/0x10 [ 1273.308829][T15460] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1273.308846][T15460] ? shmem_file_splice_read+0x2b6/0xd80 [ 1273.308858][T15460] ? shmem_file_splice_read+0x71f/0xd80 [ 1273.308879][T15460] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1273.308896][T15460] direct_splice_actor+0x192/0x690 [ 1273.308912][T15460] splice_direct_to_actor+0x341/0xa30 [ 1273.308929][T15460] ? __pfx_direct_splice_actor+0x10/0x10 [ 1273.308947][T15460] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1273.308964][T15460] ? lock_acquire+0x1d1/0x380 [ 1273.308982][T15460] do_splice_direct+0x174/0x240 [ 1273.308998][T15460] ? __pfx_do_splice_direct+0x10/0x10 [ 1273.309012][T15460] ? selinux_file_permission+0x30/0x6a0 [ 1273.309032][T15460] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1273.309048][T15460] ? bpf_lsm_file_permission+0x9/0x10 [ 1273.309065][T15460] ? security_file_permission+0x76/0x210 [ 1273.309085][T15460] ? rw_verify_area+0xce/0x6d0 [ 1273.309103][T15460] do_sendfile+0xadc/0xe20 [ 1273.309124][T15460] ? __pfx_do_sendfile+0x10/0x10 [ 1273.309140][T15460] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1273.309160][T15460] ? __fget_files+0x21f/0x3d0 [ 1273.309180][T15460] __x64_sys_sendfile64+0x1d8/0x220 [ 1273.309197][T15460] ? ksys_write+0x1ac/0x250 [ 1273.309210][T15460] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1273.309229][T15460] do_syscall_64+0x123/0x790 [ 1273.309250][T15460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1273.309263][T15460] RIP: 0033:0x7f045d19f559 [ 1273.309275][T15460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1273.309288][T15460] RSP: 002b:00007f045e149028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1273.309301][T15460] RAX: ffffffffffffffda RBX: 00007f045d425fa0 RCX: 00007f045d19f559 [ 1273.309309][T15460] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 1273.309316][T15460] RBP: 00007f045e149090 R08: 0000000000000000 R09: 0000000000000000 [ 1273.309323][T15460] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000001 [ 1273.309330][T15460] R13: 00007f045d426038 R14: 00007f045d425fa0 R15: 00007ffecb1f69e8 [ 1273.309346][T15460] [ 1273.395620][T11793] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1273.586095][T11793] usb 4-1: device descriptor read/64, error -71 [ 1274.164363][T15470] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2271'. [ 1274.406991][T15263] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1274.407009][T15263] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1274.407034][T15263] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1274.682543][T15263] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1274.682560][T15263] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1274.682582][T15263] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1274.923526][T11793] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1275.044715][T15263] hsr_slave_0: entered promiscuous mode [ 1275.045595][T15263] hsr_slave_1: entered promiscuous mode [ 1275.060371][T15263] debugfs: 'hsr0' already exists in 'hsr' [ 1275.060394][T15263] Cannot create hsr debugfs directory [ 1275.072505][T11793] usb 4-1: device descriptor read/64, error -71 [ 1275.173514][T11793] usb usb4-port1: attempt power cycle [ 1275.273860][ T5894] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1275.312863][T15473] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 1275.312891][T15473] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1275.312950][T15473] vhci_hcd vhci_hcd.0: Device attached [ 1275.608027][T11793] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1275.873232][T11793] usb 4-1: device descriptor read/8, error -71 [ 1276.050889][ T5881] usb 41-1: new low-speed USB device number 3 using vhci_hcd [ 1276.375838][T15474] vhci_hcd: connection reset by peer [ 1276.448283][ T12] vhci_hcd vhci_hcd.4: stop threads [ 1276.448345][ T12] vhci_hcd vhci_hcd.4: release socket [ 1276.448445][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 1277.407166][ T29] audit: type=1400 audit(1793226392.759:2614): avc: denied { ioctl } for pid=15485 comm="syz.4.2276" path="socket:[46503]" dev="sockfs" ino=46503 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1277.470855][T15492] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=15492 comm=syz.3.2274 [ 1279.594332][ T6013] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1279.594389][ T6013] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1279.673555][T15263] netdevsim netdevsim5 netdevsim1: renamed from eth7 [ 1279.680727][T15263] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1279.681563][T15263] netdevsim netdevsim5 netdevsim2: renamed from eth8 [ 1279.716548][T15263] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1279.717903][T15514] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2280'. [ 1279.722786][T15263] netdevsim netdevsim5 netdevsim3: renamed from eth9 [ 1279.751770][T15512] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 1279.758145][T15263] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1279.759567][ T5891] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1279.823261][ T5891] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1280.002089][ T29] audit: type=1400 audit(1793226395.349:2615): avc: denied { write } for pid=15503 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1280.657949][T15532] netlink: 'syz.3.2282': attribute type 1 has an invalid length. [ 1280.657963][T15532] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2282'. [ 1280.688517][T15532] 8021q: VLANs not supported on tunl0 [ 1281.243559][ T5881] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 1281.359688][ T29] audit: type=1400 audit(1793226396.709:2616): avc: denied { write } for pid=15540 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1281.420627][T15263] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1281.478093][T15263] 8021q: adding VLAN 0 to HW filter on device team0 [ 1281.517542][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 1281.517628][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1281.701591][T15549] FAULT_INJECTION: forcing a failure. [ 1281.701591][T15549] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1281.701641][T15549] CPU: 0 UID: 0 PID: 15549 Comm: syz.2.2284 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1281.701672][T15549] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1281.701681][T15549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1281.701693][T15549] Call Trace: [ 1281.701701][T15549] [ 1281.701709][T15549] dump_stack_lvl+0x100/0x190 [ 1281.701746][T15549] should_fail_ex.cold+0x5/0xa [ 1281.701777][T15549] should_fail_alloc_page+0xeb/0x140 [ 1281.701801][T15549] prepare_alloc_pages+0x1f0/0x5b0 [ 1281.701822][T15549] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1281.701854][T15549] __alloc_frozen_pages_noprof+0x1b1/0x3280 [ 1281.701881][T15549] ? rcu_is_watching+0x13/0xc0 [ 1281.701903][T15549] ? trace_sched_exit_tp+0x120/0x160 [ 1281.701933][T15549] ? __schedule+0x1270/0x6990 [ 1281.701955][T15549] ? __schedule+0x1270/0x6990 [ 1281.701984][T15549] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1281.702005][T15549] ? rcu_is_watching+0x13/0xc0 [ 1281.702025][T15549] ? __pfx___schedule+0x10/0x10 [ 1281.702049][T15549] ? preempt_schedule_irq+0x79/0x90 [ 1281.702074][T15549] ? irqentry_exit+0x202/0xab0 [ 1281.702097][T15549] ? lockdep_hardirqs_on+0x7d/0x110 [ 1281.702134][T15549] ? alloc_pages_mpol+0xe9/0x560 [ 1281.702154][T15549] alloc_pages_mpol+0x201/0x560 [ 1281.702173][T15549] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1281.702191][T15549] ? filemap_get_read_batch+0x534/0x920 [ 1281.702218][T15549] folio_alloc_noprof+0x22/0x250 [ 1281.702240][T15549] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 1281.702261][T15549] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 1281.702282][T15549] ? page_cache_sync_ra+0x1bc/0xb40 [ 1281.702307][T15549] filemap_get_pages+0x891/0x2080 [ 1281.702337][T15549] ? lock_acquire+0x1d1/0x380 [ 1281.702358][T15549] ? finish_task_switch.isra.0+0x149/0x10d0 [ 1281.702380][T15549] ? find_held_lock+0x2b/0x80 [ 1281.702396][T15549] ? __pfx_filemap_get_pages+0x10/0x10 [ 1281.702423][T15549] ? __pfx___might_resched+0x10/0x10 [ 1281.702442][T15549] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1281.702468][T15549] filemap_splice_read+0x469/0xc80 [ 1281.702493][T15549] ? __x64_sys_sendfile64+0x1d8/0x220 [ 1281.702511][T15549] ? do_syscall_64+0x123/0x790 [ 1281.702534][T15549] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.702562][T15549] ? __pfx_filemap_splice_read+0x10/0x10 [ 1281.702591][T15549] ? __pfx___schedule+0x10/0x10 [ 1281.702630][T15549] ? do_splice_read+0x1de/0x370 [ 1281.702651][T15549] ? __pfx_filemap_splice_read+0x10/0x10 [ 1281.702676][T15549] do_splice_read+0x285/0x370 [ 1281.702697][T15549] splice_direct_to_actor+0x29d/0xa30 [ 1281.702738][T15549] ? __pfx_direct_splice_actor+0x10/0x10 [ 1281.702763][T15549] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1281.702785][T15549] ? __pfx_direct_splice_actor+0x10/0x10 [ 1281.702809][T15549] do_splice_direct+0x174/0x240 [ 1281.702830][T15549] ? __pfx_do_splice_direct+0x10/0x10 [ 1281.702848][T15549] ? selinux_file_permission+0x30/0x6a0 [ 1281.702875][T15549] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1281.702898][T15549] ? rw_verify_area+0xce/0x6d0 [ 1281.702923][T15549] do_sendfile+0xadc/0xe20 [ 1281.702951][T15549] ? __pfx_do_sendfile+0x10/0x10 [ 1281.702975][T15549] ? irqentry_exit+0x202/0xab0 [ 1281.702998][T15549] ? lockdep_hardirqs_on+0x7d/0x110 [ 1281.703022][T15549] ? irqentry_exit+0x202/0xab0 [ 1281.703050][T15549] __x64_sys_sendfile64+0x1d8/0x220 [ 1281.703072][T15549] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1281.703099][T15549] do_syscall_64+0x123/0x790 [ 1281.703127][T15549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1281.703145][T15549] RIP: 0033:0x7f3fdcd9f559 [ 1281.703162][T15549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1281.703180][T15549] RSP: 002b:00007f3fddcb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1281.703197][T15549] RAX: ffffffffffffffda RBX: 00007f3fdd026180 RCX: 00007f3fdcd9f559 [ 1281.703208][T15549] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000007 [ 1281.703218][T15549] RBP: 00007f3fddcb2090 R08: 0000000000000000 R09: 0000000000000000 [ 1281.703227][T15549] R10: 0001000000201005 R11: 0000000000000246 R12: 0000000000000001 [ 1281.703237][T15549] R13: 00007f3fdd026218 R14: 00007f3fdd026180 R15: 00007ffcfaa86848 [ 1281.703259][T15549] [ 1281.703987][ T29] audit: type=1400 audit(1793226397.029:2617): avc: denied { mount } for pid=15546 comm="syz.2.2284" name="/" dev="ramfs" ino=46721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 1282.226013][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 1282.226093][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1283.755304][T15545] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2283'. [ 1283.996950][T15565] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=15565 comm=syz.4.2287 [ 1285.388055][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1286.573836][ T29] audit: type=1400 audit(1793226401.579:2618): avc: denied { write } for pid=15575 comm="syz.4.2290" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1287.396606][T15263] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1288.891085][T15604] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 1289.051340][T15609] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1289.779445][T15263] veth0_vlan: entered promiscuous mode [ 1289.827276][T15263] veth1_vlan: entered promiscuous mode [ 1289.923662][ T5881] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1290.074156][ T5881] usb 4-1: New USB device found: idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1290.074998][ T5881] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 1290.075015][ T5881] usb 4-1: config 0 has no interface number 0 [ 1290.075035][ T5881] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1290.077483][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1290.077506][ T5881] usb 4-1: Product: syz [ 1290.077519][ T5881] usb 4-1: Manufacturer: syz [ 1290.077528][ T5881] usb 4-1: SerialNumber: syz [ 1290.142635][ T5881] usb 4-1: config 0 descriptor?? [ 1290.176853][ T5881] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 1290.252569][T15263] veth0_macvtap: entered promiscuous mode [ 1290.300379][T15263] veth1_macvtap: entered promiscuous mode [ 1290.358535][ T49] usb 4-1: USB disconnect, device number 77 [ 1290.370337][ T49] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 1290.585081][T15263] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1290.686163][T15263] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1290.831433][T15263] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1290.867080][T15263] wireguard: wg0: Could not create IPv4 socket [ 1290.899872][T15263] wireguard: wg1: Could not create IPv4 socket [ 1290.946907][T15263] wireguard: wg2: Could not create IPv4 socket [ 1292.125795][T15652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2313'. [ 1292.427738][T15634] syz.2.2305 (15634): drop_caches: 2 [ 1293.159538][T15666] Failed to initialize the IGMP autojoin socket (err -2) [ 1293.347542][T13036] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1293.353854][T13036] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1293.370187][T13036] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1293.370659][T13036] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1293.370931][T13036] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1293.702619][ T29] audit: type=1400 audit(1793226409.049:2619): avc: denied { mount } for pid=15679 comm="syz.1.2322" name="/" dev="hugetlbfs" ino=47891 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 1293.741507][ T29] audit: type=1400 audit(1793226409.089:2620): avc: denied { mounton } for pid=15679 comm="syz.1.2322" path="/455/file0" dev="hugetlbfs" ino=47891 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=dir permissive=1 [ 1293.741916][T15681] overlayfs: workdir and upperdir must reside under the same mount [ 1293.821120][T15682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2321'. [ 1293.836058][T15682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2321'. [ 1294.047592][T15667] Failed to initialize the IGMP autojoin socket (err -2) [ 1294.061990][ T29] audit: type=1400 audit(1793226409.399:2621): avc: denied { unmount } for pid=5615 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 1294.484356][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1294.710993][T15710] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 1295.115917][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1295.436111][ T5623] Bluetooth: hci2: command tx timeout [ 1295.444324][T15667] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.467285][T15737] ªªªªª»: renamed from dummy0 (while UP) [ 1295.467422][T15737] FAULT_INJECTION: forcing a failure. [ 1295.467422][T15737] name failslab, interval 1, probability 5, space 0, times 9955 [ 1295.467455][T15737] CPU: 0 UID: 0 PID: 15737 Comm: syz.4.2342 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1295.467490][T15737] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1295.467500][T15737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1295.467513][T15737] Call Trace: [ 1295.467522][T15737] [ 1295.467531][T15737] dump_stack_lvl+0x100/0x190 [ 1295.467571][T15737] should_fail_ex.cold+0x5/0xa [ 1295.467606][T15737] should_failslab+0xc2/0x120 [ 1295.467631][T15737] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 1295.467666][T15737] ? kstrdup_const+0x63/0x80 [ 1295.467725][T15737] kstrdup+0x51/0xe0 [ 1295.467749][T15737] kstrdup_const+0x63/0x80 [ 1295.467771][T15737] kernfs_rename_ns+0x75/0xb50 [ 1295.467794][T15737] ? _raw_read_unlock_irqrestore+0x3b/0x80 [ 1295.467832][T15737] sysfs_rename_dir_ns+0x6a/0xa0 [ 1295.467862][T15737] kobject_rename+0x15a/0x260 [ 1295.467891][T15737] ? __pfx_kobject_rename+0x10/0x10 [ 1295.467920][T15737] ? kernfs_put+0x3f/0x60 [ 1295.467955][T15737] device_rename+0x130/0x250 [ 1295.467990][T15737] netif_change_name+0x284/0x830 [ 1295.468019][T15737] ? __pfx_netif_change_name+0x10/0x10 [ 1295.468044][T15737] ? mark_held_locks+0x40/0x70 [ 1295.468078][T15737] dev_change_name+0xb2/0x260 [ 1295.468106][T15737] dev_ifsioc+0x16b3/0x1f70 [ 1295.468136][T15737] ? __pfx_dev_ifsioc+0x10/0x10 [ 1295.468159][T15737] ? __pfx___mutex_lock+0x10/0x10 [ 1295.468192][T15737] ? bpf_lsm_capable+0x9/0x10 [ 1295.468217][T15737] dev_ioctl+0x223/0x10e0 [ 1295.468243][T15737] sock_do_ioctl+0x1a0/0x280 [ 1295.468271][T15737] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1295.468297][T15737] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1295.468338][T15737] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1295.468368][T15737] ? ioctl_has_perm.constprop.0.isra.0+0x37d/0x530 [ 1295.468404][T15737] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1295.468443][T15737] sock_ioctl+0x599/0x6b0 [ 1295.468473][T15737] ? __pfx_sock_ioctl+0x10/0x10 [ 1295.468506][T15737] ? selinux_file_ioctl+0x1e0/0x290 [ 1295.468537][T15737] ? selinux_file_ioctl+0x1e7/0x290 [ 1295.468570][T15737] ? __pfx_sock_ioctl+0x10/0x10 [ 1295.468599][T15737] __x64_sys_ioctl+0x18e/0x210 [ 1295.468633][T15737] do_syscall_64+0x123/0x790 [ 1295.468668][T15737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1295.468697][T15737] RIP: 0033:0x7f045d19f559 [ 1295.468715][T15737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1295.468734][T15737] RSP: 002b:00007f045e149028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1295.468754][T15737] RAX: ffffffffffffffda RBX: 00007f045d425fa0 RCX: 00007f045d19f559 [ 1295.468767][T15737] RDX: 0000200000001900 RSI: 0000000000008923 RDI: 0000000000000007 [ 1295.468778][T15737] RBP: 00007f045d236b20 R08: 0000000000000000 R09: 0000000000000000 [ 1295.468789][T15737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1295.468801][T15737] R13: 00007f045d426038 R14: 00007f045d425fa0 R15: 00007ffecb1f69e8 [ 1295.468829][T15737] [ 1295.796076][T15667] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.909711][T15753] FAULT_INJECTION: forcing a failure. [ 1295.909711][T15753] name failslab, interval 1, probability 5, space 0, times 9954 [ 1295.909744][T15753] CPU: 0 UID: 0 PID: 15753 Comm: syz.4.2347 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1295.909773][T15753] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1295.909782][T15753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1295.909794][T15753] Call Trace: [ 1295.909802][T15753] [ 1295.909812][T15753] dump_stack_lvl+0x100/0x190 [ 1295.909847][T15753] should_fail_ex.cold+0x5/0xa [ 1295.909876][T15753] should_failslab+0xc2/0x120 [ 1295.909898][T15753] __kmalloc_cache_noprof+0x91/0x6d0 [ 1295.909923][T15753] ? lockdep_init_map_type+0x5c/0x250 [ 1295.909953][T15753] ? snd_seq_prioq_new+0x3f/0x110 [ 1295.909981][T15753] snd_seq_prioq_new+0x3f/0x110 [ 1295.910003][T15753] snd_seq_queue_alloc+0x153/0x540 [ 1295.910028][T15753] snd_seq_ioctl_create_queue+0xa9/0x370 [ 1295.910058][T15753] snd_seq_ioctl+0x219/0x410 [ 1295.910085][T15753] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 1295.910128][T15753] ? selinux_file_ioctl+0x1e0/0x290 [ 1295.910160][T15753] ? selinux_file_ioctl+0x1e7/0x290 [ 1295.910191][T15753] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 1295.910219][T15753] __x64_sys_ioctl+0x18e/0x210 [ 1295.910263][T15753] do_syscall_64+0x123/0x790 [ 1295.910300][T15753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1295.910324][T15753] RIP: 0033:0x7f045d19f559 [ 1295.910343][T15753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1295.910365][T15753] RSP: 002b:00007f045e149028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1295.910387][T15753] RAX: ffffffffffffffda RBX: 00007f045d425fa0 RCX: 00007f045d19f559 [ 1295.910401][T15753] RDX: 00002000000001c0 RSI: 00000000c08c5332 RDI: 0000000000000003 [ 1295.910417][T15753] RBP: 00007f045d236b20 R08: 0000000000000000 R09: 0000000000000000 [ 1295.910430][T15753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1295.910442][T15753] R13: 00007f045d426038 R14: 00007f045d425fa0 R15: 00007ffecb1f69e8 [ 1295.910472][T15753] [ 1296.118318][T15667] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1296.274251][T15667] netdevsim netdevsim5 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1296.379835][T15764] batadv1: entered promiscuous mode [ 1296.379860][T15764] batadv1: entered allmulticast mode [ 1296.810021][ T29] audit: type=1400 audit(1793226412.159:2622): avc: denied { write } for pid=15761 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1296.881314][ T29] audit: type=1400 audit(1793226412.229:2623): avc: denied { listen } for pid=15793 comm="syz.1.2359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1296.989458][T15795] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1296.998485][ T6013] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1297.014815][ T6013] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1297.054474][ T29] audit: type=1400 audit(1793226412.409:2624): avc: denied { write } for pid=15803 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1297.091982][ T6013] netdevsim netdevsim5 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1297.145923][ T6013] netdevsim netdevsim5 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1297.147136][T15667] netdevsim netdevsim5 netdevsim1: renamed from eth7 [ 1297.220661][T15667] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1297.221515][T15667] netdevsim netdevsim5 netdevsim2: renamed from eth8 [ 1297.250730][T15667] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1297.260459][T15667] netdevsim netdevsim5 netdevsim3: renamed from eth9 [ 1297.275394][T15667] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1297.514414][ T5623] Bluetooth: hci2: command tx timeout [ 1298.544320][ T29] audit: type=1400 audit(1793226413.899:2625): avc: denied { write } for pid=15852 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1298.605255][T15892] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2386'. [ 1298.618861][T15892] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2386'. [ 1298.757759][T15899] netlink: 'syz.2.2387': attribute type 4 has an invalid length. [ 1298.757780][T15899] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2387'. [ 1298.796709][ T29] audit: type=1400 audit(1793226414.149:2626): avc: denied { write } for pid=15901 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1299.218664][T15667] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1299.227277][T15667] wireguard: wg0: Could not create IPv4 socket [ 1299.230892][T15667] wireguard: wg1: Could not create IPv4 socket [ 1299.234392][T15667] wireguard: wg2: Could not create IPv4 socket [ 1299.500243][ T29] audit: type=1400 audit(1793226414.849:2627): avc: denied { write } for pid=15917 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1299.581436][ T29] audit: type=1400 audit(1793226414.929:2628): avc: denied { write } for pid=15947 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1299.607234][ T5623] Bluetooth: hci2: command tx timeout [ 1299.746567][ T29] audit: type=1400 audit(1793226415.099:2629): avc: denied { mounton } for pid=15953 comm="syz.2.2402" path="/proc/1643/task" dev="proc" ino=48953 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 1299.851648][T15962] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2404'. [ 1299.952059][ T29] audit: type=1400 audit(1793226415.289:2630): avc: denied { setattr } for pid=15965 comm="syz.2.2405" name="[kvm-gmem]" dev="guest_memfd" ino=49045 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1300.067743][ T29] audit: type=1400 audit(1793226415.419:2631): avc: denied { write } for pid=15952 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.183322][ T29] audit: type=1400 audit(1793226415.539:2632): avc: denied { write } for pid=15983 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.570269][ T29] audit: type=1400 audit(1793226415.919:2633): avc: denied { write } for pid=15993 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.676026][ T29] audit: type=1400 audit(1793226416.029:2634): avc: denied { write } for pid=16014 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1300.948074][T16031] syzkaller0: entered promiscuous mode [ 1300.948099][T16031] syzkaller0: entered allmulticast mode [ 1301.241031][T15873] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1301.263615][ T29] audit: type=1400 audit(1793226416.599:2635): avc: denied { write } for pid=16032 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1301.360122][T16044] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2426'. [ 1301.824979][T16072] block nbd3: shutting down sockets [ 1301.861307][T16078] syzkaller0: entered promiscuous mode [ 1301.861333][T16078] syzkaller0: entered allmulticast mode [ 1302.440300][T13036] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1302.447439][T13036] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1302.457304][T13036] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1302.471850][T13036] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1302.481287][T13036] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1302.688573][T16120] device-mapper: table: 248:9: clone: Gap in table (-EINVAL) [ 1302.688599][T16120] device-mapper: ioctl: error adding target to table [ 1303.051301][T16148] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1303.315426][T16167] device-mapper: raid: Ignoring chunk size parameter for RAID 1 [ 1303.315448][T16167] device-mapper: raid: Choosing default region size of 4MiB [ 1303.370931][T16107] Failed to initialize the IGMP autojoin socket (err -2) [ 1303.454278][T16173] syzkaller0: entered promiscuous mode [ 1303.454301][T16173] syzkaller0: entered allmulticast mode [ 1303.605983][T16167] md: pers->run() failed ... [ 1303.606652][T16167] device-mapper: table: 248:10: raid: Failed to run raid array (-EINVAL) [ 1303.606676][T16167] device-mapper: ioctl: error adding target to table [ 1303.964178][ T5727] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1304.074662][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1304.111307][T16107] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1304.133234][ T5727] usb 3-1: Using ep0 maxpacket: 32 [ 1304.134951][ T5727] usb 3-1: New USB device found: idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1304.135889][ T5727] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1304.144966][ T5727] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1304.144993][ T5727] usb 3-1: Product: syz [ 1304.145008][ T5727] usb 3-1: Manufacturer: syz [ 1304.145022][ T5727] usb 3-1: SerialNumber: syz [ 1304.171963][ T5727] usb 3-1: config 0 descriptor?? [ 1304.174708][T16186] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1304.182531][ T5727] hub 3-1:0.0: bad descriptor, ignoring hub [ 1304.182555][ T5727] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1304.273151][ T5881] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1304.389751][T16107] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1304.433150][ T5881] usb 4-1: Using ep0 maxpacket: 8 [ 1304.433702][ T5881] usb 4-1: New USB device found: idVendor=0525, idProduct=d292, bcdDevice=0.07 [ 1304.435811][ T5881] usb 4-1: config index 0 descriptor too short (expected 5924, got 36) [ 1304.435836][ T5881] usb 4-1: config 250 has an invalid interface number: 228 but max is -1 [ 1304.435857][ T5881] usb 4-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 1304.435877][ T5881] usb 4-1: config 250 has no interface number 0 [ 1304.435912][ T5881] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 1304.435936][ T5881] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1304.435958][ T5881] usb 4-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1304.435978][ T5881] usb 4-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0 [ 1304.435999][ T5881] usb 4-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 1304.436022][ T5881] usb 4-1: config 250 interface 228 has no altsetting 0 [ 1304.437316][ T5881] usb 4-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 1304.437339][ T5881] usb 4-1: Product: syz [ 1304.437353][ T5881] usb 4-1: SerialNumber: syz [ 1304.564734][T13036] Bluetooth: hci2: command tx timeout [ 1304.585493][ T5881] hub 4-1:250.228: bad descriptor, ignoring hub [ 1304.585519][ T5881] hub 4-1:250.228: probe with driver hub failed with error -5 [ 1304.590885][T16107] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1304.758006][ T12] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1304.760671][T16107] netdevsim netdevsim5 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1304.969278][T16186] usb 3-1: reset high-speed USB device number 66 using dummy_hcd [ 1305.119390][ T101] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.133968][ T50] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.144373][T16213] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1305.190247][ T12] netdevsim netdevsim5 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.293563][ T5881] usblp 4-1:250.228: usblp1: USB Bidirectional printer dev 78 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 1305.304421][ T12] netdevsim netdevsim5 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.331560][T16107] netdevsim netdevsim5 netdevsim1: renamed from eth7 [ 1305.402298][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1305.417981][T16107] netdevsim netdevsim5 netdevsim2: renamed from eth8 [ 1305.437881][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1305.445622][T16107] netdevsim netdevsim5 netdevsim3: renamed from eth9 [ 1305.474557][T16107] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1305.846593][ T29] kauditd_printk_skb: 12 callbacks suppressed [ 1305.846616][ T29] audit: type=1400 audit(1793226421.199:2648): avc: denied { write } for pid=16224 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1306.057037][ T29] audit: type=1400 audit(1793226421.409:2649): avc: denied { write } for pid=16249 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1306.071555][ T50] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.143272][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.164683][ T101] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.244164][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.264310][ T101] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.307265][ T9] usb 4-1: USB disconnect, device number 78 [ 1306.334884][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.338107][ T9] usblp1: removed [ 1306.381349][ T1418] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.443232][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.472413][ T12] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.546071][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.594687][ T1418] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.633755][T13036] Bluetooth: hci2: command tx timeout [ 1306.639502][T16107] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1306.641713][T16107] wireguard: wg0: Could not create IPv4 socket [ 1306.671908][ T29] audit: type=1400 audit(1793226422.019:2650): avc: denied { write } for pid=16281 comm="syz.3.2481" name="attr_allow_any_host" dev="configfs" ino=50995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1306.671958][ T29] audit: type=1400 audit(1793226422.019:2651): avc: denied { open } for pid=16281 comm="syz.3.2481" path="/522/config/nvmet/subsystems/testsubsys/attr_allow_any_host" dev="configfs" ino=50995 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 1306.674628][T16186] raw-gadget.0 gadget.2: failed to queue resume event [ 1306.706707][T16282] nvmet: adding nsid 1 to subsystem testsubsys [ 1306.709605][ T29] audit: type=1400 audit(1793226422.059:2652): avc: denied { write } for pid=16281 comm="syz.3.2481" name="namespaces" dev="configfs" ino=19390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1306.716283][T16282] nvmet: failed to open block device /dev/nullb: (-2) [ 1306.721030][ T29] audit: type=1400 audit(1793226422.059:2653): avc: denied { write } for pid=16281 comm="syz.3.2481" name="ports" dev="configfs" ino=3590 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1306.730832][ T12] raw-gadget.0 gadget.2: failed to queue suspend event [ 1306.735924][T16107] wireguard: wg1: Could not create IPv4 socket [ 1306.738765][ T29] audit: type=1400 audit(1793226422.089:2654): avc: denied { write } for pid=16281 comm="syz.3.2481" name="subsystems" dev="configfs" ino=51004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1306.740740][ T29] audit: type=1400 audit(1793226422.089:2655): avc: denied { create } for pid=16281 comm="syz.3.2481" name="testsubsys" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 1306.755298][T16107] wireguard: wg2: Could not create IPv4 socket [ 1306.773372][ T29] audit: type=1400 audit(1793226422.119:2656): avc: denied { write } for pid=16281 comm="syz.3.2481" name="subsystems" dev="configfs" ino=51004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 1306.846953][T16186] raw-gadget.0 gadget.2: failed to queue disconnect event [ 1306.938231][ T9] usb 3-1: USB disconnect, device number 66 [ 1307.060558][ T29] audit: type=1400 audit(1793226422.419:2657): avc: denied { write } for pid=16264 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1307.735173][T16336] FAULT_INJECTION: forcing a failure. [ 1307.735173][T16336] name failslab, interval 1, probability 5, space 0, times 9953 [ 1307.735207][T16336] CPU: 0 UID: 0 PID: 16336 Comm: syz.2.2494 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1307.735236][T16336] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1307.735245][T16336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1307.735256][T16336] Call Trace: [ 1307.735264][T16336] [ 1307.735272][T16336] dump_stack_lvl+0x100/0x190 [ 1307.735310][T16336] should_fail_ex.cold+0x5/0xa [ 1307.735341][T16336] should_failslab+0xc2/0x120 [ 1307.735361][T16336] __kmalloc_cache_noprof+0x91/0x6d0 [ 1307.735387][T16336] ? alloc_vfsmnt+0x72/0x840 [ 1307.735423][T16336] alloc_vfsmnt+0x72/0x840 [ 1307.735450][T16336] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1307.735487][T16336] clone_mnt+0x4b/0x9c0 [ 1307.735516][T16336] ? clone_mnt+0x244/0x9c0 [ 1307.735548][T16336] copy_tree+0xf8/0xc50 [ 1307.735572][T16336] ? _raw_spin_unlock+0x28/0x50 [ 1307.735598][T16336] ? clone_mnt+0x570/0x9c0 [ 1307.735632][T16336] __do_loopback+0x338/0x540 [ 1307.735662][T16336] create_new_namespace+0x497/0xf60 [ 1307.735696][T16336] ? __pfx_create_new_namespace+0x10/0x10 [ 1307.735727][T16336] ? strncpy_from_user+0x19d/0x2d0 [ 1307.735760][T16336] ? vfs_open_tree+0x91e/0xb60 [ 1307.735783][T16336] vfs_open_tree+0x91e/0xb60 [ 1307.735808][T16336] ? _raw_spin_unlock+0x28/0x50 [ 1307.735833][T16336] ? __pfx_vfs_open_tree+0x10/0x10 [ 1307.735866][T16336] __x64_sys_open_tree+0xbe/0x150 [ 1307.735893][T16336] do_syscall_64+0x123/0x790 [ 1307.735924][T16336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1307.735944][T16336] RIP: 0033:0x7f3fdcd9f559 [ 1307.735961][T16336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1307.735980][T16336] RSP: 002b:00007f3fddcf4028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ac [ 1307.735999][T16336] RAX: ffffffffffffffda RBX: 00007f3fdd025fa0 RCX: 00007f3fdcd9f559 [ 1307.736013][T16336] RDX: 0000000000009902 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 1307.736027][T16336] RBP: 00007f3fdce36b20 R08: 0000000000000000 R09: 0000000000000000 [ 1307.736039][T16336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1307.736050][T16336] R13: 00007f3fdd026038 R14: 00007f3fdd025fa0 R15: 00007ffcfaa86848 [ 1307.736085][T16336] [ 1308.801403][ T5623] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1308.863171][T16347] tipc: Enabled bearer , priority 0 [ 1308.865460][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1308.867243][ T5623] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1308.871315][T16347] tipc: Resetting bearer [ 1308.892176][ T5623] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1308.898561][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1308.961643][T16344] tipc: Disabling bearer [ 1308.993705][T16339] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2495'. [ 1309.113260][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1309.294935][T16361] gadgetfs: bound to dummy_udc driver [ 1309.941109][T11793] usb 1-1: new full-speed USB device number 78 using dummy_hcd [ 1309.941512][ C1] gadgetfs: connected [ 1309.942017][T11793] gadgetfs: disconnected [ 1311.303552][T13036] Bluetooth: hci2: command tx timeout [ 1311.383344][ C1] gadgetfs: connected [ 1311.384162][T11793] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a0, bcdDevice=1.00 [ 1311.384452][T11793] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1311.384482][T11793] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1311.387046][ C1] gadgetfs: configuration #1 [ 1311.412426][T16358] gadgetfs: suspended from state 3 [ 1311.412508][T16358] gadgetfs: disconnected [ 1311.415467][ T9] usb 1-1: USB disconnect, device number 78 [ 1311.882168][T16349] Failed to initialize the IGMP autojoin socket (err -2) [ 1312.128761][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 1312.128780][ T29] audit: type=1400 audit(1793226427.479:2662): avc: denied { write } for pid=16368 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1313.040237][ T29] audit: type=1400 audit(1793226428.389:2663): avc: denied { write } for pid=16398 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1313.353174][T13036] Bluetooth: hci2: command tx timeout [ 1313.441311][T16349] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.677477][ T5893] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1313.801693][T11793] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1313.970584][T11793] usb 3-1: New USB device found: idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1314.028174][T11793] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1314.028239][T11793] usb 3-1: Product: syz [ 1314.028281][T11793] usb 3-1: Manufacturer: syz [ 1314.028319][T11793] usb 3-1: SerialNumber: syz [ 1314.097416][T11793] usb 3-1: config 0 descriptor?? [ 1315.046348][T11793] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1315.249933][T11793] gspca_sq905c: sq905c_read: usb_control_msg failed (-32) [ 1315.249953][T11793] sq905c 3-1:0.0: Reading version command failed [ 1315.250013][T11793] sq905c 3-1:0.0: probe with driver sq905c failed with error -32 [ 1315.280469][T11793] usb 3-1: USB disconnect, device number 67 [ 1315.435995][T13036] Bluetooth: hci2: command tx timeout [ 1315.613303][ T29] audit: type=1400 audit(1793226430.959:2664): avc: denied { write } for pid=16408 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1315.614541][T16349] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1315.849075][ T29] audit: type=1400 audit(1793226431.199:2665): avc: denied { write } for pid=16435 comm="syz.3.2514" name="md0" dev="tmpfs" ino=2995 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1315.880245][T16349] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1315.907022][T16434] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2508'. [ 1315.920310][T16436] Failed to initialize the IGMP autojoin socket (err -2) [ 1315.930365][ T29] audit: type=1400 audit(1793226431.279:2666): avc: denied { write } for pid=16437 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1316.003214][T16349] netdevsim netdevsim5 eth6 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1316.291149][T16453] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 1316.291177][T16453] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1316.291237][T16453] vhci_hcd vhci_hcd.0: Device attached [ 1317.533549][T13036] Bluetooth: hci2: command tx timeout [ 1317.579912][T16455] vhci_hcd: connection closed [ 1317.598360][ T5891] vhci_hcd vhci_hcd.4: stop threads [ 1317.598390][ T5891] vhci_hcd vhci_hcd.4: release socket [ 1317.598949][ T5891] vhci_hcd vhci_hcd.4: disconnect device [ 1317.641794][ T5891] netdevsim netdevsim5 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1317.641872][ T5891] netdevsim netdevsim5 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1317.653516][T16276] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 1318.153556][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1318.348323][ T29] audit: type=1400 audit(1793226433.699:2667): avc: denied { write } for pid=16445 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1318.383593][T16471] 9pnet_fd: p9_fd_create_unix (16471): problem connecting socket: ./proc/thread-self/fail-nth: -2 [ 1318.394047][ T1418] netdevsim netdevsim5 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1318.398979][ T101] netdevsim netdevsim5 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1318.421691][T16349] netdevsim netdevsim5 netdevsim1: renamed from eth7 [ 1318.544257][T16349] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1318.552053][T16349] netdevsim netdevsim5 netdevsim2: renamed from eth8 [ 1318.576697][T16349] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1318.583982][T16349] netdevsim netdevsim5 netdevsim3: renamed from eth9 [ 1318.614522][T16349] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1318.615206][T16482] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 1318.678688][T16479] syzkaller0: entered promiscuous mode [ 1318.678712][T16479] syzkaller0: entered allmulticast mode [ 1318.708639][T16479] tipc: Enabled bearer , priority 0 [ 1319.404880][T16479] tipc: Resetting bearer [ 1319.418810][T16477] tipc: Resetting bearer [ 1319.459012][ T29] audit: type=1400 audit(1793226434.809:2668): avc: denied { write } for pid=16484 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1319.506497][T16477] tipc: Disabling bearer [ 1321.969835][ T29] audit: type=1400 audit(1793226437.319:2669): avc: denied { write } for pid=16499 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1322.019600][T16544] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 1322.019623][T16544] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1322.019664][T16544] vhci_hcd vhci_hcd.0: Device attached [ 1322.871428][T16545] vhci_hcd: connection closed [ 1322.956667][T15537] vhci_hcd vhci_hcd.2: stop threads [ 1322.956727][T15537] vhci_hcd vhci_hcd.2: release socket [ 1322.956806][T15537] vhci_hcd vhci_hcd.2: disconnect device [ 1323.073144][ T49] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 1323.073204][ T49] usb 37-1: enqueue for inactive port 0 [ 1323.143227][ T49] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 1323.370013][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1324.269392][ T29] audit: type=1400 audit(1793226439.619:2670): avc: denied { write } for pid=16558 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1324.289982][T16349] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 1324.299249][T16349] wireguard: wg0: Could not create IPv4 socket [ 1324.306462][T16349] wireguard: wg1: Could not create IPv4 socket [ 1324.311466][T16349] wireguard: wg2: Could not create IPv4 socket [ 1324.324791][T11793] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1324.484966][T11793] usb 4-1: Using ep0 maxpacket: 32 [ 1324.487414][T11793] usb 4-1: New USB device found: idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1324.511396][T11793] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1324.516025][T11793] usb 4-1: config 0 descriptor?? [ 1324.540391][T11793] as10x_usb: device has been detected [ 1324.540820][T11793] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1324.688108][T11793] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1324.757037][T16560] ------------[ cut here ]------------ [ 1324.757052][T16560] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 1324.757060][T16560] WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x93f/0x1c10, CPU#1: syz.3.2539/16560 [ 1324.778699][T16560] Modules linked in: [ 1324.782635][T16560] CPU: 1 UID: 0 PID: 16560 Comm: syz.3.2539 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1324.793745][T16560] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1324.799563][T16560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1324.809638][T16560] RIP: 0010:__mutex_lock+0x946/0x1c10 [ 1324.815043][T16560] Code: 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 75 12 00 00 44 8b 05 4d 95 7c 06 45 85 c0 75 13 48 8d 3d c1 a3 7f 06 48 c7 c6 60 fd 0f 8c <67> 48 0f b9 3a 90 e9 1b f8 ff ff 4d 8d a7 f0 0a 00 00 4c 89 e7 e8 [ 1324.834713][T16560] RSP: 0018:ffffc90004377a40 EFLAGS: 00010246 [ 1324.840796][T16560] RAX: 0000000000000003 RBX: ffff88803095cb30 RCX: 1ffffffff24d4328 [ 1324.848818][T16560] RDX: 0000000000000000 RSI: ffffffff8c0ffd60 RDI: ffffffff926d27c0 [ 1324.856920][T16560] RBP: ffffc90004377bb0 R08: 0000000000000000 R09: 0000000000000000 [ 1324.864923][T16560] R10: ffffffff926a1947 R11: 0000000000000000 R12: 0000000000000000 [ 1324.872886][T16560] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000200000000 [ 1324.880894][T16560] FS: 00007f4ec1f286c0(0000) GS:ffff888122590000(0000) knlGS:0000000000000000 [ 1324.889869][T16560] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1324.896451][T16560] CR2: 00007f65286cf000 CR3: 00000000696a8000 CR4: 00000000003526f0 [ 1324.904425][T16560] Call Trace: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1324.907695][T16560] [ 1324.910602][T16560] ? as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1324.916240][T16560] ? __mutex_lock+0x267/0x1c10 [ 1324.920985][T16560] ? dmx_ts_feed_start_filtering+0x50/0x220 [ 1324.926945][T16560] ? __pfx___mutex_lock+0x10/0x10 [ 1324.932249][T16560] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1324.938283][T16560] ? _raw_spin_lock_irq+0x45/0x50 [ 1324.943369][T16560] ? as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1324.949066][T16560] as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1324.954599][T16560] ? __pfx_as102_dvb_dmx_start_feed+0x10/0x10 [ 1324.960694][T16560] dmx_ts_feed_start_filtering+0xf6/0x220 [ 1324.966473][T16560] dvb_dmxdev_start_feed+0x273/0x3f0 [ 1324.971780][T16560] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 1324.977305][T16560] ? dvb_dmxdev_add_pid+0x2a4/0x4f0 [ 1324.982948][T16560] dvb_demux_do_ioctl+0xe64/0x1200 [ 1324.988176][T16560] dvb_usercopy+0x167/0x340 [ 1324.992688][T16560] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1324.998284][T16560] ? __pfx_dvb_usercopy+0x10/0x10 [ 1325.003342][T16560] ? __fget_files+0x34/0x3d0 [ 1325.007953][T16560] ? selinux_file_ioctl+0x1e0/0x290 [ 1325.013226][T16560] dvb_demux_ioctl+0x29/0x40 [ 1325.017848][T16560] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1325.023183][T16560] __x64_sys_ioctl+0x18e/0x210 [ 1325.027966][T16560] do_syscall_64+0x123/0x790 [ 1325.032577][T16560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1325.038717][T16560] RIP: 0033:0x7f4ec0f9f559 [ 1325.043300][T16560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1325.063109][T16560] RSP: 002b:00007f4ec1f28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1325.072024][T16560] RAX: ffffffffffffffda RBX: 00007f4ec1225fa0 RCX: 00007f4ec0f9f559 [ 1325.080497][T16560] RDX: 00002000000001c0 RSI: 0000000040146f2c RDI: 0000000000000004 [ 1325.088569][T16560] RBP: 00007f4ec1036b20 R08: 0000000000000000 R09: 0000000000000000 [ 1325.096676][T16560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1325.104686][T16560] R13: 00007f4ec1226038 R14: 00007f4ec1225fa0 R15: 00007fffb5b87cb8 [ 1325.112683][T16560] [ 1325.115896][T16560] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1325.123185][T16560] CPU: 1 UID: 0 PID: 16560 Comm: syz.3.2539 Tainted: G L Y syzkaller #0 PREEMPT(full) [ 1325.134260][T16560] Tainted: [L]=SOFTLOCKUP, [Y]=FORCED_BIND [ 1325.140068][T16560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1325.150149][T16560] Call Trace: [ 1325.153434][T16560] [ 1325.156367][T16560] dump_stack_lvl+0x100/0x190 [ 1325.161068][T16560] vpanic+0x2dc/0x6f8 [ 1325.165096][T16560] panic+0xd1/0xe0 [ 1325.168825][T16560] ? __pfx_panic+0x10/0x10 [ 1325.173262][T16560] check_panic_on_warn.cold+0x19/0x34 [ 1325.178646][T16560] ? __mutex_lock+0x93f/0x1c10 [ 1325.183421][T16560] __warn.cold+0x191/0x321 [ 1325.187860][T16560] __report_bug+0x30f/0x440 [ 1325.192397][T16560] ? __mutex_lock+0x93f/0x1c10 [ 1325.197170][T16560] ? __pfx___report_bug+0x10/0x10 [ 1325.202221][T16560] report_bug_entry+0xe2/0x290 [ 1325.206998][T16560] ? __mutex_lock+0x946/0x1c10 [ 1325.211793][T16560] handle_bug+0x1cd/0x2a0 [ 1325.216147][T16560] exc_invalid_op+0x17/0x50 [ 1325.220665][T16560] asm_exc_invalid_op+0x1a/0x20 [ 1325.225505][T16560] RIP: 0010:__mutex_lock+0x946/0x1c10 [ 1325.230867][T16560] Code: 0f b6 14 11 38 d0 7c 08 84 d2 0f 85 75 12 00 00 44 8b 05 4d 95 7c 06 45 85 c0 75 13 48 8d 3d c1 a3 7f 06 48 c7 c6 60 fd 0f 8c <67> 48 0f b9 3a 90 e9 1b f8 ff ff 4d 8d a7 f0 0a 00 00 4c 89 e7 e8 [ 1325.250919][T16560] RSP: 0018:ffffc90004377a40 EFLAGS: 00010246 [ 1325.256987][T16560] RAX: 0000000000000003 RBX: ffff88803095cb30 RCX: 1ffffffff24d4328 [ 1325.264944][T16560] RDX: 0000000000000000 RSI: ffffffff8c0ffd60 RDI: ffffffff926d27c0 [ 1325.272900][T16560] RBP: ffffc90004377bb0 R08: 0000000000000000 R09: 0000000000000000 [ 1325.280853][T16560] R10: ffffffff926a1947 R11: 0000000000000000 R12: 0000000000000000 [ 1325.288805][T16560] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000200000000 [ 1325.296766][T16560] ? as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1325.302395][T16560] ? __mutex_lock+0x267/0x1c10 [ 1325.307140][T16560] ? dmx_ts_feed_start_filtering+0x50/0x220 [ 1325.313029][T16560] ? __pfx___mutex_lock+0x10/0x10 [ 1325.318042][T16560] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1325.324016][T16560] ? _raw_spin_lock_irq+0x45/0x50 [ 1325.329033][T16560] ? as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1325.334659][T16560] as102_dvb_dmx_start_feed+0x7d/0x2e0 [ 1325.340112][T16560] ? __pfx_as102_dvb_dmx_start_feed+0x10/0x10 [ 1325.346169][T16560] dmx_ts_feed_start_filtering+0xf6/0x220 [ 1325.351890][T16560] dvb_dmxdev_start_feed+0x273/0x3f0 [ 1325.357164][T16560] dvb_dmxdev_filter_start+0x1b6/0xdd0 [ 1325.362617][T16560] ? dvb_dmxdev_add_pid+0x2a4/0x4f0 [ 1325.367807][T16560] dvb_demux_do_ioctl+0xe64/0x1200 [ 1325.372927][T16560] dvb_usercopy+0x167/0x340 [ 1325.377421][T16560] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1325.382958][T16560] ? __pfx_dvb_usercopy+0x10/0x10 [ 1325.387972][T16560] ? __fget_files+0x34/0x3d0 [ 1325.392556][T16560] ? selinux_file_ioctl+0x1e0/0x290 [ 1325.397749][T16560] dvb_demux_ioctl+0x29/0x40 [ 1325.402338][T16560] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1325.407610][T16560] __x64_sys_ioctl+0x18e/0x210 [ 1325.412366][T16560] do_syscall_64+0x123/0x790 [ 1325.416950][T16560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1325.422833][T16560] RIP: 0033:0x7f4ec0f9f559 [ 1325.427233][T16560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1325.446826][T16560] RSP: 002b:00007f4ec1f28028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1325.455224][T16560] RAX: ffffffffffffffda RBX: 00007f4ec1225fa0 RCX: 00007f4ec0f9f559 [ 1325.463177][T16560] RDX: 00002000000001c0 RSI: 0000000040146f2c RDI: 0000000000000004 [ 1325.471137][T16560] RBP: 00007f4ec1036b20 R08: 0000000000000000 R09: 0000000000000000 [ 1325.479089][T16560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1325.487043][T16560] R13: 00007f4ec1226038 R14: 00007f4ec1225fa0 R15: 00007fffb5b87cb8 [ 1325.495005][T16560] [ 1325.498215][T16560] Kernel Offset: disabled [ 1325.502514][T16560] Rebooting in 86400 seconds..