last executing test programs: 18.651282837s ago: executing program 2 (id=1029): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FE_SET_PROPERTY(0xffffffffffffffff, 0x40086f52, &(0x7f0000000000)={0x2, &(0x7f0000000540)=[{0x3d, '\x00', @buffer={"a2640912951700", 0x20}, 0x8000}, {0x36, '\x00', @st={0x4, [{0x6, @uvalue=0xffffffffffffffff}, {0x1, @svalue=0x81}, {0x3, @uvalue=0x401}, {0x0, @uvalue=0x7fffffff}]}, 0x2}]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000090}, 0x4004000) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000040)=0xa0000) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000d06010200000000000000000500000211000300686173683a69702c706f727400000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40048110) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x60042, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460e02fab7ff7f00000000000002000300fffeffffdf020000000000004000000000000000030300ef0000000000000000080038000100040004000d000300000000800000000000000000000007000000000000000800000000004000050000000000000002"], 0x78) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_SEQ_SYNC(r1, 0x5101) 16.94885576s ago: executing program 1 (id=1034): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}}, 0x1c}}, 0x24040810) 15.39905877s ago: executing program 1 (id=1037): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) 14.932291901s ago: executing program 3 (id=1038): pread64(0xffffffffffffffff, 0x0, 0x0, 0x4eb) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) openat$panthor(0xffffff9c, 0x0, 0x2, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000240)={r1, 0xc89, 0xa, 0xfffffffa, 0x3, [], [0x5, 0x5, 0xfffffffd, 0x2], [0xe, 0x7, 0xffffffff, 0x8000], [0xfffffffffffffffb, 0xa679, 0x1, 0x7f]}) 14.1810162s ago: executing program 0 (id=1040): r0 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000080)) 14.112274123s ago: executing program 2 (id=1041): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000180), 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcdf, 0x1, 0x0}, &(0x7f00000000c0)=0x40) 11.597013166s ago: executing program 4 (id=1042): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000380)={0xa, 0x5, 0x400200, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0), 0x3) getsockopt$bt_hci(r0, 0x11a, 0x1, 0x0, &(0x7f0000000040)) 11.594796316s ago: executing program 0 (id=1052): socket$pppoe(0x18, 0x1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0xca5da0ab7138f769) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x4, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000140)='mountproto\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x5, 0x7f, 0x9, 0x100000004, 0xffffffffffffffff, 0x400000, 0x3, 0xfffffffffbfffffc, 0xffff, 0x7fffffffffffffff, 0xc1, 0x2, 0x6, 0x5, 0x8000000000000001, 0x5], 0xd5d5c004, 0x1354}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01"], 0x0, 0x2a}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) 11.591803196s ago: executing program 3 (id=1053): socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b000000000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000f07d860b02ffed56c8e87181fef57148d14b0a4b887c94260d313a440ca0b91ed6af131ac2b0014a6b9eba5fe8ea4afa0d6682156bc4645fd0aceba49cd181cf2d73d1ce1905d190a753e008d971bb355240448cfd4f920f1c57fbe3cac8703adacbe7c2c57a2ed867c0b72616c25090bfd49317b803b058f8f6ebf30d29e9e5d09b583518a5324d4301e0d406642e5aca31e4c412a8a5722be8c72132220e7ead1ccfd8b263fcf5a678012a55b723a470f618c82834ec951d95395826500cf5cfa826c0a1df000000000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x12, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(0x0, 0x13b) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) openat$dsp1(0xffffffffffffff9c, 0x0, 0x9640, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f00000003c0)=[{{&(0x7f0000000540)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) 11.218965545s ago: executing program 1 (id=1043): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402) ioctl$FE_GET_PROPERTY(r1, 0x80086f53, &(0x7f0000000380)={0x3, &(0x7f00000001c0)=[{0x11, '\x00', @buffer={"994ac804080000000000000000cc0086f000800000000000faff00", 0x20}, 0xffff16c8}, {0x30, '\x00', @buffer={"01bafa6c508131f7c158db180015b4d676632457dad1eea8176fd41e95e7c393", 0x20}, 0x7f}, {0x46, '\x00', @data=0xd8f, 0x3}]}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ptrace(0xffffffffffffffff, r0) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x74, r3, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @local}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1}, @NLBL_MGMT_A_IPV6MASK={0xfd8f, 0x6, @rand_addr=' \x01\x00'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private1}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x29}]}, 0x74}, 0x1, 0x0, 0x0, 0x4004854}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan1\x00'}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000340)={0x6, "1803c8098000000000000000000000000000000000000000f34100"}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x0, 0x800, 0x0, 0x100001, 0x400}, 0x0, &(0x7f0000000240)={0x1f, 0x2, 0xffff, 0x3, 0x40000040004, 0x80000000000000, 0x6a9, 0x1}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) splice(r7, 0x0, r6, 0x0, 0xffff, 0x0) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000000100)) read$FUSE(r5, &(0x7f0000001600)={0x2020}, 0x2020) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c00090005"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x21) 9.416774871s ago: executing program 0 (id=1044): r0 = add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)='keyring\x00', r0) 9.351749583s ago: executing program 4 (id=1045): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x85}, 0x4c040) 9.267072345s ago: executing program 3 (id=1046): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) 9.030047391s ago: executing program 2 (id=1047): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) shmget(0x1, 0x2000, 0x200, &(0x7f0000ffc000/0x2000)=nil) 7.982839058s ago: executing program 4 (id=1048): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) socket$packet(0x11, 0x3, 0x300) r1 = add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='n\f', 0x2, 0xffffffffffffffff) request_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)='keyring\x00', r1) 7.823103092s ago: executing program 0 (id=1049): pread64(0xffffffffffffffff, 0x0, 0x0, 0x4eb) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, 0x0) openat$panthor(0xffffff9c, 0x0, 0x2, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000780)={0x0, 0x0, 0x4, 0x0, 0x2, [], [0x0, 0x0, 0x400, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1, 0x0, 0x7]}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000300)) 7.531412099s ago: executing program 2 (id=1050): io_setup(0x202, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0001}]}) readv(r1, &(0x7f00000004c0)=[{&(0x7f0000000380)=""/109, 0x6d}], 0x1) setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 7.528608749s ago: executing program 3 (id=1051): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FE_SET_PROPERTY(0xffffffffffffffff, 0x40086f52, &(0x7f0000000000)={0x2, &(0x7f0000000540)=[{0x3d, '\x00', @buffer={"a2640912951700", 0x20}, 0x8000}, {0x36, '\x00', @st={0x4, [{0x6, @uvalue=0xffffffffffffffff}, {0x1, @svalue=0x81}, {0x3, @uvalue=0x401}, {0x0, @uvalue=0x7fffffff}]}, 0x2}]}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000090}, 0x4004000) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000040)=0xa0000) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000d06010200000000000000000500000211000300686173683a69702c706f727400000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40048110) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x60042, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460e02fab7ff7f00000000000002000300fffeffffdf020000000000004000000000000000030300ef0000000000000000080038000100040004000d000300000000800000000000000000000007000000000000000800000000004000050000000000000002"], 0x78) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_SEQ_SYNC(r1, 0x5101) 6.890656385s ago: executing program 1 (id=1054): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) dup2(r0, r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write$vga_arbiter(r1, &(0x7f00000000c0)=@other={'lock', ' ', 'none'}, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) 6.327202369s ago: executing program 4 (id=1055): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) dup2(r0, r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) 6.248215321s ago: executing program 0 (id=1056): socket$pppoe(0x18, 0x1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0xca5da0ab7138f769) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x4, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000140)='mountproto\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r2, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000000c0)={[0x5, 0x7f, 0x9, 0x100000004, 0xffffffffffffffff, 0x400000, 0x3, 0xfffffffffbfffffc, 0xffff, 0x7fffffffffffffff, 0xc1, 0x2, 0x6, 0x5, 0x8000000000000001, 0x5], 0xd5d5c004, 0x1354}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01"], 0x0, 0x2a}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.328674255s ago: executing program 1 (id=1057): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000005c0)={@in={{0x2, 0x4e21, @loopback}}, 0x0, 0x0, 0x28, 0x0, "e83ae75240c2d6d8ec87bb53fab0910000000000000007a5922406b64cddaeb9d339ba3c35dc0a08df8e61740b7cf2d4e499d58654a4cf0fa0ce1f830c3079cffcfd00"}, 0xd8) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r1, 0x402, 0x5) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f02feff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008004f0fffeffe809005300fff5dd000000100001000a0c10000000000000000000", 0x58}], 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0xa, 0x0, 0x0) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r1, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000000)=' ', 0x100120}], 0x20000304}, 0xd0eb38dff8c09541) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x5, &(0x7f0000000740)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f0000000040)="f7edadfffeffff00f5ffffff00", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0xffffffffffffff32) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) r4 = socket(0x1d, 0x2, 0x6) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) syz_ublk_setup_io_uring(0x1d, &(0x7f00000002c0)={0x0, 0x30b1, 0x20, 0x2, 0x158}, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x6a, 0x1, 0x0, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x102) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/graphics/fbcon/rotate\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='1', 0x1) sendmsg$sock(r5, &(0x7f0000002a00)={&(0x7f0000000140)=@pptp={0x18, 0x2, {0x3, @empty}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000000340)="8718811656aa191aa92aaec59cafda6bc93abc55f0ca69242f3d345dbc42b18dd082d074b7232a2ffb3154953913ff6faa6101976248504311b1d15bf41fb9c9c09f99a12b916644fa12527f8b79aefacb11719de60cc74a097f752459fc9adf9c75777170eec399797ff2bfaeb36e2a3a34da6d0386370b7140ee218c726e6c77256b4fadf3e36f03931a51d9583e6adac643d77b8d484748566903e4f032e6ce99157c44ad8799b291dbe0313a3f088f982195583cd3e26ab7ea4454e0fd4b61c7eb09770d475ea935a954311883dc8ccdf0dc3e4393ca250e4eb9bb30e3c519a8a844d150b46b7e79", 0xea}, {&(0x7f00000004c0)="5d5931c7", 0x4}, {&(0x7f0000001740)="e0f6d51f9225cabd40cd40f133d88de1dac03276fb51ed5380d7c7be7d892d8746bcf0fab3553d7248c8ac1a44960ad421a8982a2b102b42f248ec822bd42fc62906507fba53c30bb05c65cdc39f3bdb03b447de7cc9d23401d32bf85844d71b3774617063eb20fe4ed5ea5fa9f67289de83515c3f953b9120abebd165c7aadd1e904328c5b0675c2025f4aaa666fcfe9f75404455d26bfe7f0b38413afa84415b75f37da7e062af3db917333c4bad5fa278d58fa8c6abd347f401e54fb1f64cbdbdc7", 0xc3}, {&(0x7f0000001840)="9daf8c5e2c41172a8f3042e10867ad4efe9a992353548542cd0fe57780a4f2906abc6b9809fa4af5c984757a407c59eec2f4c319c71a9a9d7c322f4f2a10d1c85c1b4b0fabde6d7559c34d84bbc3ea9ed9ac2d59760f4fddd14c9008cd08e29c4ced6887d70c2c3ef5a26dcf6655f4bb56c17b2d7104a6e6d528b7621abdfa60a6654915ab01d1aa", 0x88}, {&(0x7f0000001900)="2585458423e65291640af63360f4f9cc963c3836d5df8f3cc7beb310d95a2dc6508f0a9a12b1bcad2940b49a654b625447a8809a74f3f7d4d239bb54353b610149c03e5a1945a16f20959f0ca8fe5e47efb8", 0x52}, {&(0x7f0000001980)="2e601e38d4f8e0d49bafd2c1b9ed8ff960ee29ebb3e345aee9946b69c3df0f1dea04d0e1d39e5a", 0x27}, {&(0x7f00000019c0)="3a815641b8bc474c63fb886675f29892b679ed7aa79c6f8a0c0790ca7af0917a03c9e784370de24414aa02e4c18dcd4412bdc288d2c2f1a7e5f6ff95b3b01ac0e0b6e8dda2aca88d558b183a778e0ab2002067257ad5e22d8c2aa5d8d73be7495ad866763d8bf07d06ec6463da1d1b34e600998c63437511f25ef28aac4f2ba6786ccd993647ebabc3a2467312236e49e52745176b4ee12720d1563ecfc142ceb9fe0d378a2428606604853c3d3e61a0e9b64a425fd784f9845a43844aa4396c0bec72d391c6b7e540c054659084fb646751c87b921e24f6fdd5ee583f488301138ece341ac85c2f334a302d3db7f0d32334321dd9aff8aec3134a5cd9b738c717bdc602744aaf0bb0bcb3386605a442f77eaa1cf11f19687158a52fcd71f03707f7bd434d129bee954448cbc4fe32edf0f6478e659abd1ffd2cdd3f306eed6fbde84d6a4e7e95389be7dc4e47a9fdd87da8efb3653f5c35ec81cd2f6506bf4c9309881474786f7b51df7f2a1ba44bcdc0db7c5907a8485c1610e7ae59a4a290ae267cf27a2638392aba788d2828825af6a27c9e61936236bb6e80b4e86be6bbcea0ea30b645fb0e8196e1a61ba00ed3d68706efd4d71291e83d11b27b32e0ce70500b3ffeb699ff27f55ee96b20ccf1ce26a96c33382b00faebc2260ff9734e8aed964d9f7970b65a07cb21b933414f9850c70409fa5898f6f2fd400798e5b623b33ecd2f8b6ca6d704c8e5c2251a8c0fbf3e6077684283ddea78086da166a58bb7bc043537c1888906f8b2d7cbd03826c049b26a7c73b9266a3d29a060ae05afaae4d788c588e60bb10f23ed190358d980c75c883983661a6f8537156b103859d4e9a870ac8cbf3074e74221fd9876c681842fb1e3027c83e2aafa1bac1f4e97a85fb466eaed5d0618f4a83c26e9b44d70ae4eb46cce1d2f2a4f2c3d43e96210df7f1e4a0a20b7c2d3a9f842f31de7dc35c6640598728839266fb8e103e968ab3dfe447bc555187e4ca1ebcf9666c6ce09dc6f8373c78c5e19800b3896c7445e9bbfdfb31ee3eea3415fd4497d425875d005029c80a19087b1469ae3fb02fb4ea6885229325abe9c7c2e3a7e6839cf6d6ef59ea5b484f0001b891389fc9126788193d0262e4d8244324f088c6906cef654334f225a2dbe5e775f37fa5bcce4c6f4f4637bc6aba70357987ae09033d239e1c7be8780734cfa560ee9db25e11a169f833ca737443422cda7eb3cb9ad07b603f1dbc88915fd18d6a4b4b41234a06d83c5d1424cd198c1ccad6ff84d9a0f45de36c44e2409ea89e35825172995a69c9bdbfccc4aa569040b7997d63a1b670b0092e45ea6400d388f030efe0240b1f064493add7514c468b9518a5c2cd0aa44279605ecc4216b2965fbfa90712615ec4afc5796bbacf246d7a7a933bbf1bde7da3a217215559f5c24f54840303910f96000bb47978e22276857613af1ced98354965c293cc442fcae2fa96c5f36a91f78aef4543eb4abe65f05f43355ee604c21eec608522f486e06585f01ffb791bc8da1d2c9921088c62999186b3cab65348ef9fe5ed35fa29901979f12c647578578aef749f3264b50c33bd10ef6b1f1da5400fba4e9bb211e9ad5158da35e38bf7207261389129e0410897c80854a5b60b6362f4db506f803fef54ed0a75249b92ab5bf89d70b149c9907453f1a826e2764f7633550b0bfd88a428e02e672753cf5a80291ea66708220d2250b977806337494fa1edff197a612b36d377c7b6752a3dbfdf0d92127841e0e3720792674859b98b0c364d8dc1c9604e5ed1c1d029c66f9842c93cc1873061c383b5e171646c0c50654ba20c84996203865235a7916819812217f55428f9d99ff40d32604b2fce831671cca13c5676a3e8afa9a4cfc0c01a2e5ec40d389cddba1dd44582d62c18f3e536a2397390cc47c136d38f90bbce02330b892fc1fc83b16074b95b4c57b1654accee42766d9d6c4cd9f1c2a726d24262af26cff536da2627e9471548df3c22a8040477016634884d74c691150551ab2f6f95c0a4f9b78d6df04798c2b81e83d40fd23066aaa82e26a2135980eaba09f9a7a84d38d80757e47afee28782dd1708ca6e87f4726d587384038e58af846d647f078b2635482acbad18bc04689672a21f9c4ab0bdc432561b620c30f619765fb68cedde7952dda20088429022f4b572b6ca105a876141a3a7c0f087b8ffba27b697e88819b217d6535ce9ea1ad8785d642eb7ea88a982a7166e8134fae537fec140e10ea6d119df97cb88127362e74b83b8b9df77f161cd11655518e637dd7d6e28d4a00906efe6ee147bb4ea1180a5ff4fa8faa4f72a8763ef4b52d736f6b92607acb866bcd0a1abb00694b61342d795a3adb06abcca46236262ee22fc58bbd91c90e9ab07bb4c082b29da049537885559cf60be73a8b9c265bff04da793230664974c9a57c90d81c120fed0ea64488569ba26d63950321a6e8ae9b8053e4f99e45ed90d0a2550c839b989cc127948b4de87bb059a253530d1b45eafc49f1012d0e614512228240e325482707c4cdb6ab27a6672a2430c1937ec01eaa31dc4292dd23257b9c20b1b383427d0f8a19826c00259b350858f9e19d20417caa775ff8696f9cb6c2b8a398da6eaee75f17e3c5f02ba6ee52feba167e55e820bb5b088553fea313b7517ae92c9b125369d291f6aad6e121c9d322c85b5d3de7b33a89b437892c444eb27c9c42a7b116a5d7885d744032f0a95805b508fd764d031a1ab92dc4a9e24da9e8ba6488f0726d19f6e029021b5e2c8f21f97cbd5a806d84301751bcbe47fe42d731db217a1a2e2501158daf4ea06a4930f546857d1235d136f555ef1010c5149793fb76a15eabd424410f5c50d8547aa17695ebeeb6731e8de8573817292f8157cd9946c6d33989ef2533780cc8f48da4757c33f3c8a65f473a7eb527dda96ce0afbcf7edf01bbe832b112549fa02d460e9980d3bc3e5d109fb1f647a1de1c22a85a1e3aaa9a6cc7124a3744ce0dc236fc35beacf464d5a7fb1a3d8c1d4c873073e4080843378e7c8a98afc75b82ef2cd8af1a82a0df6e43b107e2b71029e2f09f067fc0bc56d8a7c7532df14c56ebf1864af9256059592eb966e5ead448ea2d5bd362f33a4c2bb55a5562443bffe1fc03d0cf2eb6d4943fb832b2993895d9b7169b5cb5f728bcc792ba6fc0b30f07481cbe60995ea86c1867be0141b1caa8505315e92e6b240ae2b71d05c9bdcb4274bbec1dda567e96865ee4fa90ccc8c15fd54143535422ff9732ade622052b4cba8b3cc9d203f066aef3899fd1e8858cda9b6856a429a0c2fb5e3dcec18bde1cb12c95e587741d4145cc918a1f5ec4f0f57fc8235cf6257711ff276cfbd1d7034d045ca8cdff39ba8f97f85e9876e621d07940b83f194140306a7580a02e6048a0685ff5f2bb610ba79a6ccb07711d9dfa550cd6fb7b52678513c361960795a9810a711a979b53ccc82e6e5cf96d67d1157f3d35d7ab61c7958dcc2154c004249b953121e4fefffca40a9a4fa37fb117908edd81e455440da39a55a0c4a5d5d8064ccc7f3b213ac1580b1b5d34059e36c10c47398203ac10e1ffabb1304c574af3a0d2ed4e0e9cd5a6858367a3ee8869ce2af46b24f1281df488ef16b08395cae0f79116eb6a2c66011c5e69daa1e958bfd84d447b84e65077f7de8e79e89d289c2f03b037c776c43240bd3ecfcddd1795f0e3f00b62315f9566c26697a4a66f186ece771ec4381e55a762b8ef9ed9ec802698b9160197c8acd2df892b17bfb079383c8ff4b97f35c3e855c7fe8ab52e53ac37cec4f467494e68bcb16aa79e53ac93e5e08329d87307370a1b037423c841db28bbb531f82adf1265a31af73faecd4b3dda3a3c7109b2afbb484ea15734988fad39752c7d6c874caa519b366edde03fa95032c3c397bebb7d1cb0ee98c6771cbc9d2b81f9d298ab390c998ae19fbd1c056c99db5ccada58d5868579267496d713c6279a2a522ffbe7d7a393d0747daefa1311f98567c6274b884f565d4cd17c44471e1416e408bb7c2f1ce9a931657e48e6a313f10eb825f910403490fd7bb208322b6bc2697b4f5676ec9b1051c3721ebe4689f8b7be7a6163236076063459a211cb31b3cf50f38d94be0aeb9477bce07acd166836cc3672b171a0a49a5bd19ed0a9957c7a83f1a71743cc97665ae981bf42e235bd15dff2dc102fa893d364c732e6b8a0ea622ea405ecda7770dcae83f6bafeec87c2d770fe1a012900181e036cf37b8cb17438206b66aefa07ace8759ff4d6282506e407b1c2b8c45932fd1694cb852b48bb721d1324569829d0f82754288f4ec200f6f8227a016c071efa41dd080ba2e248967a3a56999db219d80908b51796de5cca4b9b5754bb61034b20ee7865f738f22bc8003e252e63899dfb7f7858e56eff1418b024bb106a3dacb7daea4f34d2fe63e7396c978f84ae4e9f5630b83168ef0eb6fa657504ee8cb7dd33bf7e97fd40ad8111e6b92b56fdd5709d7bf7a7b4dbaf5d6836a753ab6cc5016c0fb366e02eaac4ec9a1ec940b96f91c6a82059bebb312076e520e42d573ed98d117431db23d8369a70b69ec0f291ebe6071ec70681c4e783a4c6c7079765579a0842b7995a92509c15d9c19248549df82672a14099c9f02ee62bcd4da3d4b74a945c2f668db3957259611c70fd18ed99ce9408228fb58d1087482ee9f4f9a3ec8620aa2dd476aa1319b9b039524cd48c197905659203deb8dbbdde3631b7017e2532741e1b071be6c1b6329ba0acab63a23bfdb5f47f3888fed6eba570463b16f1623b7e1a3820a24b165add76430951b6471a0f2bc3ea6ca2831c266bb204b6e06b0a6164d6d65a9e35f9728d86daef2d44d65e248c25d06844060cd3322c9eb192dba07057ce7a41efd8b929b5bba48ff0b21f0627cb05212b0c44f2c191bd327a99d50e11b81d11f582a79f65ed10070a3bf045854b69fae6bcd32aa4b3b717baee17fa1f69959e805b4eb487e024a0607983cfdd53d24cba642d63d735379da2ed353240e143fb8d8218272593fa2cca193546808fa59201f4efe5c45bc4526f8e6a5123cb79fb0eb8fb9878e06edb72a86d055564c42432c9d85755b9c7f7a63a899dc26f3567c5b58b2eb75706444d578af212b8ee9f961f6598b73166f8dd74a92801926cef96f0bcad97aa539640343c75126a9ab3b71d69c7c820015d593962a5a60e4106404525fe64bac9de7739672bb0722daf49a6fccdbe654355247dd879fc8c63f596a79faadeb194e79701dab48917f325524a1665d18095f3c4c3a082ed51279cb0bfaa839217c26563e378d3b51c2d8216d40f6f6ca9ac8e9f077c9dc6a72223264dbaa89b323faebf7fc9c75777a03cf23bc803c5e3efd80750a82e94c9ede115fb2d8cf59ded67f751a87662c7c664dfbae946f0b2a57e6e953d1d8d1b006c30d2e781c1aa52e31966103f48b76040b2065060e012e8a1930c02ff65e18aade5d5023ce54de03aa8e6d4439df155512503695fd5f1eb6263a3e53e8785124fbc070c7e8650f00af100046eb52219b50e70f5b651842074307e18a31f25745473e06fb69c44498a62bedb76746eea0ed47686ed0fd2dffc5285447e479743d3e1e547a96912178f42da7247b2758b3ad14c17e5d5e5b30713151c02d53b6309802fc0596f2336ed1dc3ff747d5a03baa8d71b5c9849082d7fd5585faa0fba537b9951864a5bc6e154fd2bf8c3a70f76292320ecc529f3c28a6ff02195d1b98005bb557dbf7a73d", 0x1000}], 0x7}, 0x4000810) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8115}, 0x200000c0) socket$inet_tcp(0x2, 0x1, 0x0) mount(&(0x7f0000000480)=@loop={'/dev/loop', 0x0}, &(0x7f0000000640)='./cgroup\x00', &(0x7f0000000000)='proc\x00', 0x100c458, 0x0) syz_open_dev$video(&(0x7f0000000440), 0x8, 0x133100) 4.832045178s ago: executing program 4 (id=1058): socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x42, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b000000000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000f07d860b02ffed56c8e87181fef57148d14b0a4b887c94260d313a440ca0b91ed6af131ac2b0014a6b9eba5fe8ea4afa0d6682156bc4645fd0aceba49cd181cf2d73d1ce1905d190a753e008d971bb355240448cfd4f920f1c57fbe3cac8703adacbe7c2c57a2ed867c0b72616c25090bfd49317b803b058f8f6ebf30d29e9e5d09b583518a5324d4301e0d406642e5aca31e4c412a8a5722be8c72132220e7ead1ccfd8b263fcf5a678012a55b723a470f618c82834ec951d95395826500cf5cfa826c0a1df000000000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x12, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(0x0, 0x13b) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) openat$dsp1(0xffffffffffffff9c, 0x0, 0x9640, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f00000003c0)=[{{&(0x7f0000000540)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) 3.031637593s ago: executing program 0 (id=1059): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r2, &(0x7f0000000180), 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r3, &(0x7f0000000280)='0', 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcdf, 0x1, 0x0}, &(0x7f00000000c0)=0x40) 2.447350648s ago: executing program 3 (id=1060): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x85}, 0x4c040) 1.340848616s ago: executing program 2 (id=1061): r0 = add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)='keyring\x00', r0) 1.027187974s ago: executing program 4 (id=1062): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) 690.327783ms ago: executing program 3 (id=1063): shmget(0x1, 0x2000, 0x200, &(0x7f0000ffc000/0x2000)=nil) 571.845475ms ago: executing program 1 (id=1064): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f00000002c0), 0x0, 0x40402) 0s ago: executing program 2 (id=1065): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) r1 = add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='n\f', 0x2, 0xffffffffffffffff) request_key(&(0x7f00000002c0)='asymmetric\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)='keyring\x00', r1) kernel console output (not intermixed with test programs): nterface with an up link [ 67.442160][ T4517] syz.4.70 (4517) used greatest stack depth: 20816 bytes left [ 67.652556][ T4534] device syzkaller0 entered promiscuous mode [ 67.985517][ T4541] bond0: invalid ARP target specified [ 68.528381][ T4550] netlink: 88 bytes leftover after parsing attributes in process `syz.3.85'. [ 68.775023][ T4557] FAULT_INJECTION: forcing a failure. [ 68.775023][ T4557] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 68.789120][ T4557] CPU: 1 PID: 4557 Comm: syz.3.87 Not tainted syzkaller #0 [ 68.796334][ T4557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 68.806413][ T4557] Call Trace: [ 68.809698][ T4557] [ 68.812630][ T4557] dump_stack_lvl+0x188/0x250 [ 68.817405][ T4557] ? show_regs_print_info+0x20/0x20 [ 68.822608][ T4557] ? load_image+0x410/0x410 [ 68.827128][ T4557] ? mark_lock+0x94/0x320 [ 68.831473][ T4557] should_fail+0x383/0x4b0 [ 68.835897][ T4557] prepare_alloc_pages+0x1e3/0x5b0 [ 68.841023][ T4557] __alloc_pages+0x11b/0x480 [ 68.845624][ T4557] ? zone_statistics+0x170/0x170 [ 68.850574][ T4557] ? rcu_lock_acquire+0x30/0x30 [ 68.855432][ T4557] ? alloc_pages+0x452/0x560 [ 68.860030][ T4557] __get_free_pages+0x8/0x30 [ 68.864619][ T4557] __tlb_remove_page_size+0x1f2/0x3f0 [ 68.869996][ T4557] unmap_page_range+0xfcf/0x2410 [ 68.874968][ T4557] unmap_vmas+0x131/0x250 [ 68.879302][ T4557] ? unmap_page_range+0x2410/0x2410 [ 68.884496][ T4557] ? __mutex_lock_common+0x435/0x2400 [ 68.889873][ T4557] ? exit_mm_release+0x16/0x30 [ 68.894645][ T4557] exit_mmap+0x3b9/0x640 [ 68.898890][ T4557] ? vm_brk+0x20/0x20 [ 68.902888][ T4557] ? uprobe_clear_state+0x2f6/0x460 [ 68.908093][ T4557] __mmput+0x115/0x390 [ 68.912167][ T4557] exit_mm+0x632/0x7b0 [ 68.916241][ T4557] ? perf_pmu_migrate_context+0xb70/0xb70 [ 68.922597][ T4557] ? do_exit+0x2110/0x2110 [ 68.927052][ T4557] ? __ia32_sys_timer_delete+0x40/0x40 [ 68.932602][ T4557] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 68.938072][ T4557] ? tty_audit_exit+0x149/0x1f0 [ 68.942938][ T4557] do_exit+0x5b8/0x2110 [ 68.947108][ T4557] ? put_task_struct+0x80/0x80 [ 68.951879][ T4557] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 68.957870][ T4557] ? _raw_spin_lock_irq+0xb7/0xf0 [ 68.962909][ T4557] do_group_exit+0x12c/0x2f0 [ 68.967505][ T4557] ? lockdep_hardirqs_on+0x94/0x140 [ 68.972715][ T4557] get_signal+0x7eb/0x12e0 [ 68.977146][ T4557] arch_do_signal_or_restart+0xe6/0x12a0 [ 68.982790][ T4557] ? sock_do_ioctl+0x1b4/0x320 [ 68.987660][ T4557] ? futex_exit_release+0x1c0/0x1c0 [ 68.992861][ T4557] ? get_sigframe_size+0x10/0x10 [ 68.997798][ T4557] ? __context_tracking_exit+0x4c/0x80 [ 69.003266][ T4557] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 69.009251][ T4557] ? exit_to_user_mode_loop+0x3b/0x130 [ 69.014713][ T4557] exit_to_user_mode_loop+0x9e/0x130 [ 69.020000][ T4557] exit_to_user_mode_prepare+0xee/0x180 [ 69.025553][ T4557] syscall_exit_to_user_mode+0x16/0x40 [ 69.031016][ T4557] do_syscall_64+0x58/0xa0 [ 69.035432][ T4557] ? clear_bhb_loop+0x30/0x80 [ 69.040106][ T4557] ? clear_bhb_loop+0x30/0x80 [ 69.044785][ T4557] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 69.050696][ T4557] RIP: 0033:0x7f455295b159 [ 69.055111][ T4557] Code: Unable to access opcode bytes at RIP 0x7f455295b12f. [ 69.062476][ T4557] RSP: 002b:00007f4550bb30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 69.070887][ T4557] RAX: fffffffffffffe00 RBX: 00007f4552be2fa8 RCX: 00007f455295b159 [ 69.078859][ T4557] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4552be2fa8 [ 69.086829][ T4557] RBP: 00007f4552be2fa0 R08: 0000000000000000 R09: 0000000000000000 [ 69.094802][ T4557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 69.102769][ T4557] R13: 00007f4552be3038 R14: 00007ffc88731d90 R15: 00007ffc88731e78 [ 69.110752][ T4557] [ 69.113817][ C1] vkms_vblank_simulate: vblank timer overrun [ 69.164922][ T4568] netlink: 'syz.4.90': attribute type 1 has an invalid length. [ 69.893045][ T4581] netlink: 'syz.4.96': attribute type 2 has an invalid length. [ 70.153408][ T4600] jffs2: notice: (4600) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 70.453709][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 70.473707][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #202!!! [ 70.593710][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #30a!!! [ 71.216909][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.223733][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.294069][ T4581] process 'syz.4.96' launched './file0' with NULL argv: empty string added [ 71.367172][ T4612] loop9: detected capacity change from 0 to 7 [ 71.380037][ T4179] Dev loop9: unable to read RDB block 7 [ 71.387268][ T4179] loop9: unable to read partition table [ 71.387966][ T4611] netlink: 44 bytes leftover after parsing attributes in process `syz.2.107'. [ 71.394034][ T4179] loop9: partition table beyond EOD, truncated [ 71.533962][ T4612] Dev loop9: unable to read RDB block 7 [ 71.539694][ T4612] loop9: unable to read partition table [ 71.547269][ T4612] loop9: partition table beyond EOD, truncated [ 71.579028][ T4612] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 71.663942][ T4199] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 71.769129][ T4628] capability: warning: `syz.0.114' uses deprecated v2 capabilities in a way that may be insecure [ 72.119563][ T4199] usb 5-1: config 0 has an invalid interface number: 205 but max is 0 [ 72.129379][ T4199] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 72.146956][ T4199] usb 5-1: config 0 has no interface number 0 [ 72.158056][ T4199] usb 5-1: config 0 interface 205 has no altsetting 0 [ 72.241816][ T4647] netlink: 84 bytes leftover after parsing attributes in process `syz.3.121'. [ 72.257765][ T4647] netlink: 84 bytes leftover after parsing attributes in process `syz.3.121'. [ 72.344317][ T4199] usb 5-1: New USB device found, idVendor=1822, idProduct=3202, bcdDevice=13.4a [ 72.371508][ T4199] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.383616][ T4199] usb 5-1: Product: syz [ 72.409342][ T4199] usb 5-1: Manufacturer: syz [ 72.448852][ T4199] usb 5-1: SerialNumber: syz [ 72.469677][ T4199] usb 5-1: config 0 descriptor?? [ 72.535352][ T4199] dvb-usb: found a 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' in warm state. [ 72.559723][ T4199] dvb-usb: bulk message failed: -22 (3/0) [ 72.659386][ T4199] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 72.704373][ T4199] dvbdev: DVB: registering new adapter (TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device) [ 72.745151][ T4199] usb 5-1: media controller created [ 72.766105][ T4199] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 72.809908][ T4199] dvb-usb: bulk message failed: -22 (6/0) [ 72.821289][ T4199] dvb-usb: no frontend was attached by 'TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device' [ 72.888733][ T4199] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input5 [ 72.944125][ T4199] dvb-usb: schedule remote query interval to 150 msecs. [ 72.952032][ T4199] dvb-usb: bulk message failed: -22 (3/0) [ 73.059213][ T4676] netlink: 'syz.2.132': attribute type 10 has an invalid length. [ 73.393721][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.413721][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.433706][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.453716][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.473716][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.493716][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.533716][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 73.919135][ T4441] dvb-usb: bulk message failed: -22 (1/0) [ 73.953591][ T4199] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 73.972323][ T4441] dvb-usb: error while querying for an remote control event. [ 74.453766][ T4199] usb 5-1: USB disconnect, device number 2 [ 74.586050][ T4199] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 76.114716][ T4441] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 76.347291][ T1110] cfg80211: failed to load regulatory.db [ 76.423872][ T4441] usb 3-1: Using ep0 maxpacket: 8 [ 76.564933][ T4441] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 76.580366][ T4441] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 76.603567][ T4441] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 76.624063][ T4441] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 76.643736][ T4441] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 76.668545][ T4441] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.953937][ T4441] usb 3-1: GET_CAPABILITIES returned 0 [ 76.960011][ T4441] usbtmc 3-1:16.0: can't read capabilities [ 77.113728][ T4764] using random self ethernet address [ 77.128866][ T4764] using random host ethernet address [ 77.166552][ T4437] usb 3-1: USB disconnect, device number 3 [ 77.250714][ T4754] mmap: syz.4.162 (4754) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 80.067877][ T4860] FAULT_INJECTION: forcing a failure. [ 80.067877][ T4860] name failslab, interval 1, probability 0, space 0, times 1 [ 80.080687][ T4860] CPU: 1 PID: 4860 Comm: syz.2.205 Not tainted syzkaller #0 [ 80.087989][ T4860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.098137][ T4860] Call Trace: [ 80.101427][ T4860] [ 80.104378][ T4860] dump_stack_lvl+0x188/0x250 [ 80.109075][ T4860] ? show_regs_print_info+0x20/0x20 [ 80.114287][ T4860] ? load_image+0x410/0x410 [ 80.118793][ T4860] ? __might_sleep+0xf0/0xf0 [ 80.123366][ T4860] ? __lock_acquire+0x7b50/0x7b50 [ 80.128376][ T4860] ? __up_read+0x2b4/0x6b0 [ 80.132777][ T4860] should_fail+0x383/0x4b0 [ 80.137180][ T4860] should_failslab+0x5/0x20 [ 80.141672][ T4860] slab_pre_alloc_hook+0x51/0xc0 [ 80.146602][ T4860] kmem_cache_alloc_trace+0x47/0x290 [ 80.151899][ T4860] ? ipv6_add_addr+0x42b/0xe10 [ 80.156681][ T4860] ipv6_add_addr+0x42b/0xe10 [ 80.161297][ T4860] ? ipv6_count_addresses+0x170/0x170 [ 80.166690][ T4860] addrconf_add_linklocal+0x26a/0x6d0 [ 80.172073][ T4860] ? inet6_addr_del+0x5a0/0x5a0 [ 80.176921][ T4860] ? __local_bh_enable_ip+0x136/0x1c0 [ 80.182305][ T4860] ? lockdep_hardirqs_on+0x94/0x140 [ 80.187514][ T4860] ? __local_bh_enable_ip+0x136/0x1c0 [ 80.192900][ T4860] ? _local_bh_enable+0xa0/0xa0 [ 80.197767][ T4860] ? do_raw_spin_unlock+0x11d/0x230 [ 80.202978][ T4860] ? ipv6_generate_stable_address+0x2ab/0x610 [ 80.209052][ T4860] ? ipv6_generate_stable_address+0x4c1/0x610 [ 80.215136][ T4860] addrconf_addr_gen+0x536/0x6b0 [ 80.220079][ T4860] ? ip6_route_add+0x100/0x130 [ 80.224855][ T4860] ? addrconf_sysctl_register+0x1b0/0x1b0 [ 80.230579][ T4860] ? addrconf_add_dev+0x295/0x3c0 [ 80.235607][ T4860] ? l3mdev_fib_table+0x130/0x130 [ 80.240652][ T4860] ? addrconf_permanent_addr+0x971/0xa30 [ 80.246379][ T4860] ? addrconf_permanent_addr+0x971/0xa30 [ 80.252031][ T4860] addrconf_init_auto_addrs+0x6ec/0xab0 [ 80.257590][ T4860] ? addrconf_dad_run+0x1d0/0x1d0 [ 80.262623][ T4860] ? lock_chain_count+0x20/0x20 [ 80.267486][ T4860] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 80.273479][ T4860] ? tls_dev_event+0x697/0xe90 [ 80.278244][ T4860] ? lockdep_hardirqs_on+0x94/0x140 [ 80.283446][ T4860] ? __local_bh_enable_ip+0x136/0x1c0 [ 80.288830][ T4860] ? addrconf_link_ready+0x117/0x170 [ 80.294136][ T4860] addrconf_notify+0xa6b/0xf20 [ 80.298908][ T4860] raw_notifier_call_chain+0xcb/0x160 [ 80.304299][ T4860] __dev_notify_flags+0x194/0x300 [ 80.309372][ T4860] ? __dev_change_flags+0x6a0/0x6a0 [ 80.314590][ T4860] ? __dev_change_flags+0x4ce/0x6a0 [ 80.319800][ T4860] ? devinet_ioctl+0x256/0x1ba0 [ 80.324662][ T4860] ? dev_get_flags+0x1c0/0x1c0 [ 80.329454][ T4860] dev_change_flags+0xda/0x1a0 [ 80.334236][ T4860] devinet_ioctl+0x810/0x1ba0 [ 80.338939][ T4860] inet_ioctl+0x2fa/0x460 [ 80.343267][ T4860] ? inet_shutdown+0x370/0x370 [ 80.348030][ T4860] ? kfree+0xef/0x2a0 [ 80.352016][ T4860] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 80.357473][ T4860] sock_do_ioctl+0xfb/0x320 [ 80.362023][ T4860] ? sock_show_fdinfo+0xb0/0xb0 [ 80.366886][ T4860] sock_ioctl+0x48a/0x700 [ 80.371216][ T4860] ? sock_poll+0x420/0x420 [ 80.375630][ T4860] ? bpf_lsm_file_ioctl+0x5/0x10 [ 80.380560][ T4860] ? security_file_ioctl+0x7c/0xa0 [ 80.385664][ T4860] ? sock_poll+0x420/0x420 [ 80.390071][ T4860] __se_sys_ioctl+0xfa/0x170 [ 80.394689][ T4860] do_syscall_64+0x4c/0xa0 [ 80.399091][ T4860] ? clear_bhb_loop+0x30/0x80 [ 80.403752][ T4860] ? clear_bhb_loop+0x30/0x80 [ 80.408416][ T4860] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.414301][ T4860] RIP: 0033:0x7f77f39b0159 [ 80.418705][ T4860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.438314][ T4860] RSP: 002b:00007f77f1c08028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.446720][ T4860] RAX: ffffffffffffffda RBX: 00007f77f3c37fa0 RCX: 00007f77f39b0159 [ 80.454677][ T4860] RDX: 00002000000000c0 RSI: 0000000000008914 RDI: 0000000000000004 [ 80.462633][ T4860] RBP: 00007f77f3a47024 R08: 0000000000000000 R09: 0000000000000000 [ 80.470588][ T4860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.478541][ T4860] R13: 00007f77f3c38038 R14: 00007f77f3c37fa0 R15: 00007ffd89169788 [ 80.486510][ T4860] [ 80.534197][ T4868] netlink: 60 bytes leftover after parsing attributes in process `syz.3.209'. [ 80.666108][ T4874] FAULT_INJECTION: forcing a failure. [ 80.666108][ T4874] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 80.679554][ T4874] CPU: 1 PID: 4874 Comm: syz.0.210 Not tainted syzkaller #0 [ 80.686848][ T4874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 80.697262][ T4874] Call Trace: [ 80.700553][ T4874] [ 80.703490][ T4874] dump_stack_lvl+0x188/0x250 [ 80.708195][ T4874] ? show_regs_print_info+0x20/0x20 [ 80.713398][ T4874] ? load_image+0x410/0x410 [ 80.717917][ T4874] ? uncharge_page+0x490/0x490 [ 80.722691][ T4874] should_fail+0x383/0x4b0 [ 80.727120][ T4874] prepare_alloc_pages+0x1e3/0x5b0 [ 80.732250][ T4874] __alloc_pages+0x11b/0x480 [ 80.736855][ T4874] ? zone_statistics+0x170/0x170 [ 80.741810][ T4874] ? rcu_lock_acquire+0x30/0x30 [ 80.746675][ T4874] ? alloc_pages+0x452/0x560 [ 80.751297][ T4874] __get_free_pages+0x8/0x30 [ 80.755940][ T4874] __tlb_remove_page_size+0x1f2/0x3f0 [ 80.761350][ T4874] unmap_page_range+0xfcf/0x2410 [ 80.766325][ T4874] unmap_vmas+0x131/0x250 [ 80.770661][ T4874] ? unmap_page_range+0x2410/0x2410 [ 80.775867][ T4874] ? __mutex_lock_common+0x435/0x2400 [ 80.781245][ T4874] ? exit_mm_release+0x16/0x30 [ 80.786025][ T4874] exit_mmap+0x3b9/0x640 [ 80.790285][ T4874] ? vm_brk+0x20/0x20 [ 80.794300][ T4874] ? uprobe_clear_state+0x2f6/0x460 [ 80.799509][ T4874] __mmput+0x115/0x390 [ 80.803621][ T4874] exit_mm+0x632/0x7b0 [ 80.807693][ T4874] ? perf_pmu_migrate_context+0xb70/0xb70 [ 80.813418][ T4874] ? do_exit+0x2110/0x2110 [ 80.817833][ T4874] ? __ia32_sys_timer_delete+0x40/0x40 [ 80.823299][ T4874] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 80.828877][ T4874] ? tty_audit_exit+0x149/0x1f0 [ 80.833735][ T4874] do_exit+0x5b8/0x2110 [ 80.837902][ T4874] ? put_task_struct+0x80/0x80 [ 80.842670][ T4874] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 80.848760][ T4874] ? _raw_spin_lock_irq+0xb7/0xf0 [ 80.853789][ T4874] do_group_exit+0x12c/0x2f0 [ 80.858386][ T4874] ? lockdep_hardirqs_on+0x94/0x140 [ 80.863629][ T4874] get_signal+0x7eb/0x12e0 [ 80.868067][ T4874] arch_do_signal_or_restart+0xe6/0x12a0 [ 80.873716][ T4874] ? futex_exit_release+0x1c0/0x1c0 [ 80.878921][ T4874] ? get_sigframe_size+0x10/0x10 [ 80.883867][ T4874] ? __context_tracking_exit+0x4c/0x80 [ 80.889343][ T4874] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 80.895337][ T4874] ? exit_to_user_mode_loop+0x3b/0x130 [ 80.900806][ T4874] exit_to_user_mode_loop+0x9e/0x130 [ 80.906102][ T4874] exit_to_user_mode_prepare+0xee/0x180 [ 80.911653][ T4874] syscall_exit_to_user_mode+0x16/0x40 [ 80.917118][ T4874] do_syscall_64+0x58/0xa0 [ 80.921540][ T4874] ? clear_bhb_loop+0x30/0x80 [ 80.926227][ T4874] ? clear_bhb_loop+0x30/0x80 [ 80.930915][ T4874] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 80.936831][ T4874] RIP: 0033:0x7f4c120ef159 [ 80.941258][ T4874] Code: Unable to access opcode bytes at RIP 0x7f4c120ef12f. [ 80.948707][ T4874] RSP: 002b:00007f4c103470e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 80.957127][ T4874] RAX: fffffffffffffe00 RBX: 00007f4c12376fa8 RCX: 00007f4c120ef159 [ 80.965127][ T4874] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4c12376fa8 [ 80.973193][ T4874] RBP: 00007f4c12376fa0 R08: 0000000000000000 R09: 0000000000000000 [ 80.981172][ T4874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 80.989208][ T4874] R13: 00007f4c12377038 R14: 00007ffe31eaa690 R15: 00007ffe31eaa778 [ 80.997198][ T4874] [ 81.308341][ T1110] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 81.363114][ T4900] jffs2: notice: (4900) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 81.709350][ T1110] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 81.721813][ T1110] usb 5-1: config 1 has an invalid descriptor of length 52, skipping remainder of the config [ 81.758168][ T1110] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 81.783175][ T1110] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 81.963972][ T1110] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 81.993727][ T1110] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 82.010244][ T1110] usb 5-1: Product: syz [ 82.023729][ T1110] usb 5-1: Manufacturer: syz [ 82.053612][ T4936] netlink: 'syz.3.231': attribute type 5 has an invalid length. [ 82.102064][ T4936] device ip6erspan0 entered promiscuous mode [ 82.111929][ T1110] cdc_wdm 5-1:1.0: skipping garbage [ 82.123438][ T1110] cdc_wdm 5-1:1.0: skipping garbage [ 82.131594][ T1110] cdc_wdm: probe of 5-1:1.0 failed with error -22 [ 82.148028][ T4938] syz.2.232 uses obsolete (PF_INET,SOCK_PACKET) [ 82.406475][ T4367] usb 5-1: USB disconnect, device number 3 [ 83.888608][ T4951] crypto_alloc_aead failed rc=-4 [ 84.023449][ T4984] netlink: 144 bytes leftover after parsing attributes in process `syz.3.244'. [ 84.077208][ T4984] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 84.659673][ T4193] Bluetooth: Wrong link type (-22) [ 84.771031][ T5034] netlink: 20 bytes leftover after parsing attributes in process `syz.2.262'. [ 84.844432][ T1110] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 85.106455][ T5053] autofs4:pid:5053:autofs_fill_super: called with bogus options [ 85.254167][ T1110] usb 5-1: Using ep0 maxpacket: 8 [ 85.274568][ T5058] Invalid ELF header magic: != ELF [ 85.276982][ T5059] tmpfs: Unknown parameter 'usrquota' [ 85.285277][ T5058] ======================================================= [ 85.285277][ T5058] WARNING: The mand mount option has been deprecated and [ 85.285277][ T5058] and is ignored by this kernel. Remove the mand [ 85.285277][ T5058] option from the mount to silence this warning. [ 85.285277][ T5058] ======================================================= [ 85.404031][ T1110] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 85.415690][ T4441] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 85.443180][ T1110] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 85.464449][ T1110] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 85.474904][ T1110] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.489446][ T1110] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 85.500141][ T1110] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.774325][ T1110] usb 5-1: GET_CAPABILITIES returned 0 [ 85.794030][ T4441] usb 2-1: config 0 has no interfaces? [ 85.799686][ T4441] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 85.810578][ T1110] usbtmc 5-1:16.0: can't read capabilities [ 85.819384][ T4441] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.838404][ T4441] usb 2-1: config 0 descriptor?? [ 86.096090][ T4367] usb 2-1: USB disconnect, device number 2 [ 86.142053][ T4370] usb 5-1: USB disconnect, device number 4 [ 86.206462][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.258549][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.306698][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.354695][ T4441] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 86.374852][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.425841][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.477852][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.532170][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.582303][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.589526][ T5085] device syzkaller0 entered promiscuous mode [ 86.634875][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.667511][ T4441] usb 3-1: Using ep0 maxpacket: 32 [ 86.682145][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.733477][ T5090] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[5091] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5090] [ 86.787165][ T5075] nvme nvme0: failed to connect socket: -512 [ 86.823874][ T4441] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 86.878801][ T4441] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 86.931547][ T5075] nvme nvme0: failed to connect socket: -512 [ 87.059853][ T5075] nvme nvme0: failed to connect socket: -512 [ 87.083967][ T4441] usb 3-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 87.106533][ T4441] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.114933][ T4441] usb 3-1: Product: syz [ 87.133973][ T4367] Bluetooth: hci2: command 0x201b tx timeout [ 87.141823][ T4441] usb 3-1: Manufacturer: syz [ 87.155820][ T4441] usb 3-1: SerialNumber: syz [ 87.175052][ T4441] usb 3-1: config 0 descriptor?? [ 87.180956][ T5103] netlink: 20 bytes leftover after parsing attributes in process `syz.0.287'. [ 87.201360][ T5073] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 87.817170][ T5073] udc-core: couldn't find an available UDC or it's busy [ 88.292752][ T5073] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 88.332742][ T5073] udc-core: couldn't find an available UDC or it's busy [ 88.393805][ T5135] tmpfs: Unknown parameter 'quota' [ 88.413996][ T5073] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 88.466433][ T4437] usb 3-1: USB disconnect, device number 4 [ 88.957493][ T5166] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 89.129752][ T5173] overlayfs: failed to resolve './file2': -2 [ 92.372517][ T5222] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 93.040298][ T5244] netlink: 'syz.2.334': attribute type 1 has an invalid length. [ 93.103815][ T5244] netlink: 'syz.2.334': attribute type 2 has an invalid length. [ 93.708399][ T4367] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 93.720951][ T5269] netlink: 52 bytes leftover after parsing attributes in process `syz.3.342'. [ 93.969243][ T4367] usb 3-1: Using ep0 maxpacket: 8 [ 94.093996][ T4367] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 94.110199][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 94.134763][ T4367] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 94.171359][ T4367] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 94.215265][ T4367] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 94.229783][ T4367] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.517232][ T4367] usb 3-1: GET_CAPABILITIES returned 0 [ 94.523174][ T4367] usbtmc 3-1:16.0: can't read capabilities [ 94.724255][ T4367] usb 3-1: USB disconnect, device number 5 [ 94.857153][ T5181] Set syz0 is full, maxelem 65536 reached [ 96.294084][ T23] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 96.574504][ T23] usb 2-1: Using ep0 maxpacket: 32 [ 96.714379][ T23] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 96.789580][ T23] usb 2-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 96.979088][ T23] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 97.043082][ T5325] netlink: 8 bytes leftover after parsing attributes in process `syz.3.369'. [ 97.305343][ T23] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 97.324699][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.343287][ T23] usb 2-1: Product: syz [ 97.353398][ T23] usb 2-1: Manufacturer: syz [ 97.370077][ T23] usb 2-1: SerialNumber: syz [ 97.453248][ T23] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 97.467789][ T23] imon 2-1:155.0: unable to initialize intf0, err -19 [ 97.488080][ T23] imon:imon_probe: failed to initialize context! [ 97.505824][ T23] imon 2-1:155.0: unable to register, err -19 [ 97.815247][ T5351] netlink: 16 bytes leftover after parsing attributes in process `syz.0.380'. [ 99.128634][ T5368] overlayfs: overlapping lowerdir path [ 99.574368][ T4372] usb 2-1: USB disconnect, device number 3 [ 99.770095][ T5333] ODEBUG: Out of memory. ODEBUG disabled [ 100.102473][ T5389] capability: warning: `syz.4.396' uses 32-bit capabilities (legacy support in use) [ 100.362063][ T5406] FAULT_INJECTION: forcing a failure. [ 100.362063][ T5406] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 100.447850][ T5406] CPU: 0 PID: 5406 Comm: syz.2.402 Not tainted syzkaller #0 [ 100.455203][ T5406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.465273][ T5406] Call Trace: [ 100.468561][ T5406] [ 100.471502][ T5406] dump_stack_lvl+0x188/0x250 [ 100.476202][ T5406] ? show_regs_print_info+0x20/0x20 [ 100.481421][ T5406] ? load_image+0x410/0x410 [ 100.485942][ T5406] ? __lock_acquire+0x7b50/0x7b50 [ 100.490977][ T5406] ? __vmalloc_node_range+0x2dd/0x8b0 [ 100.496353][ T5406] ? vzalloc+0x75/0x80 [ 100.500447][ T5406] should_fail+0x383/0x4b0 [ 100.504884][ T5406] prepare_alloc_pages+0x1e3/0x5b0 [ 100.510067][ T5406] __alloc_pages+0x11b/0x480 [ 100.514690][ T5406] ? zone_statistics+0x170/0x170 [ 100.519657][ T5406] ? alloc_pages+0x452/0x560 [ 100.524266][ T5406] __vmalloc_node_range+0x4b1/0x8b0 [ 100.529493][ T5406] ? n_tty_open+0x19/0x150 [ 100.533922][ T5406] vzalloc+0x75/0x80 [ 100.537826][ T5406] ? n_tty_open+0x19/0x150 [ 100.542253][ T5406] n_tty_open+0x19/0x150 [ 100.546503][ T5406] tty_ldisc_setup+0x1a3/0x250 [ 100.551282][ T5406] tty_init_dev+0x239/0x470 [ 100.555810][ T5406] ptmx_open+0xe1/0x2c0 [ 100.559980][ T5406] ? pty_start+0x140/0x140 [ 100.564413][ T5406] chrdev_open+0x585/0x5f0 [ 100.568844][ T5406] ? cd_forget+0x160/0x160 [ 100.573277][ T5406] ? fsnotify_perm+0x3a7/0x560 [ 100.578052][ T5406] ? cd_forget+0x160/0x160 [ 100.582477][ T5406] do_dentry_open+0x7f7/0xf90 [ 100.587164][ T5406] ? vfs_open+0x2b/0x80 [ 100.591340][ T5406] path_openat+0x2718/0x2fb0 [ 100.595975][ T5406] ? __kasan_slab_alloc+0xa9/0xc0 [ 100.601030][ T5406] ? do_filp_open+0x400/0x400 [ 100.605738][ T5406] do_filp_open+0x1df/0x400 [ 100.610255][ T5406] ? vfs_tmpfile+0x300/0x300 [ 100.614865][ T5406] ? _raw_spin_unlock+0x24/0x40 [ 100.619721][ T5406] ? alloc_fd+0x59e/0x650 [ 100.624049][ T5406] do_sys_openat2+0x14b/0x500 [ 100.628715][ T5406] ? __lock_acquire+0x7b50/0x7b50 [ 100.633728][ T5406] ? do_sys_open+0xe0/0xe0 [ 100.638130][ T5406] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 100.644100][ T5406] ? lock_chain_count+0x20/0x20 [ 100.648942][ T5406] __x64_sys_openat+0x135/0x160 [ 100.653784][ T5406] do_syscall_64+0x4c/0xa0 [ 100.658377][ T5406] ? clear_bhb_loop+0x30/0x80 [ 100.663051][ T5406] ? clear_bhb_loop+0x30/0x80 [ 100.667720][ T5406] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.673617][ T5406] RIP: 0033:0x7f77f39b0159 [ 100.678030][ T5406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.697623][ T5406] RSP: 002b:00007f77f1c08028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 100.706032][ T5406] RAX: ffffffffffffffda RBX: 00007f77f3c37fa0 RCX: 00007f77f39b0159 [ 100.714013][ T5406] RDX: 0000000000002000 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 100.721970][ T5406] RBP: 00007f77f3a47024 R08: 0000000000000000 R09: 0000000000000000 [ 100.730029][ T5406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.737984][ T5406] R13: 00007f77f3c38038 R14: 00007f77f3c37fa0 R15: 00007ffd89169788 [ 100.745954][ T5406] [ 100.764121][ T5406] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 101.118214][ T26] audit: type=1326 audit(1788634525.513:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 101.176116][ T5431] 9pnet_virtio: no channels available for device syz [ 101.217551][ T26] audit: type=1326 audit(1788634525.553:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 101.599341][ T26] audit: type=1326 audit(1788634525.553:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 101.988681][ T26] audit: type=1326 audit(1788634525.553:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 102.065398][ T26] audit: type=1326 audit(1788634525.553:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 102.089810][ T26] audit: type=1326 audit(1788634525.553:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 102.116930][ T26] audit: type=1326 audit(1788634525.553:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5432 comm="syz.3.414" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f455295b159 code=0x7ffc0000 [ 103.519115][ T26] audit: type=1800 audit(1788634527.913:9): pid=5483 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.436" name="syzkaller0" dev="sda1" ino=2048 res=0 errno=0 [ 104.970260][ T5541] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 107.430429][ T4373] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 107.587466][ T5602] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 107.782658][ T5614] jffs2: notice: (5614) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 107.844095][ T4373] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.860608][ T4373] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 107.885354][ T5614] overlayfs: failed to resolve './file1': -2 [ 108.023979][ T4373] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 108.046326][ T4373] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.071781][ T4373] usb 5-1: Product: syz [ 108.076494][ T4373] usb 5-1: Manufacturer: syz [ 108.081104][ T4373] usb 5-1: SerialNumber: syz [ 108.140591][ T4373] cdc_mbim 5-1:1.0: skipping garbage [ 108.342340][ T5590] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 109.019876][ T5590] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 109.053913][ T4373] cdc_mbim 5-1:1.0: setting tx_max = 16384 [ 109.076001][ T4373] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 109.130263][ T5626] netlink: 4 bytes leftover after parsing attributes in process `syz.3.489'. [ 109.139365][ T4373] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, e6:2a:16:6c:26:d1 [ 109.232587][ T5626] team0 (unregistering): Port device team_slave_0 removed [ 109.255316][ T5626] team0 (unregistering): Port device team_slave_1 removed [ 109.283932][ C0] cdc_mbim 5-1:1.0: nonzero urb status received: -71 [ 109.291321][ C0] cdc_mbim 5-1:1.0: wdm_int_callback - 0 bytes [ 109.298391][ C0] cdc_mbim 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 109.309221][ T4199] usb 5-1: USB disconnect, device number 5 [ 109.323158][ T4199] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 109.839103][ T5657] netlink: 4 bytes leftover after parsing attributes in process `syz.2.499'. [ 109.848452][ T5657] device bridge_slave_1 left promiscuous mode [ 109.855526][ T5657] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.006886][ T4367] Bluetooth: hci5: command 0x1003 tx timeout [ 110.013092][ T4193] Bluetooth: hci5: sending frame failed (-49) [ 110.317693][ T5657] device bridge_slave_0 left promiscuous mode [ 110.326356][ T5657] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.935911][ T5709] tmpfs: Unknown parameter 'quota' [ 112.094467][ T4372] Bluetooth: hci5: command 0x1001 tx timeout [ 112.101382][ T4193] Bluetooth: hci5: sending frame failed (-49) [ 114.174519][ T4372] Bluetooth: hci5: command 0x1009 tx timeout [ 115.831252][ T5725] overlayfs: overlapping lowerdir path [ 116.824645][ T23] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 117.094276][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 117.233261][ T23] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 117.263860][ T23] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 117.293761][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 117.314337][ T23] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 117.343807][ T23] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 117.374045][ T23] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 117.410555][ T23] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 117.430949][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.498892][ T23] usb 4-1: config 0 descriptor?? [ 117.851764][ T23] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 118.140632][ T4372] usb 4-1: USB disconnect, device number 3 [ 118.220033][ T4372] usblp0: removed [ 119.203752][ C1] sched: RT throttling activated [ 124.921608][ T5757] loop4: detected capacity change from 0 to 4096 [ 125.071075][ T5757] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 125.498008][ T5765] loop1: detected capacity change from 0 to 64 [ 126.208944][ T5757] fscrypt: Error allocating hmac(sha512): -2 [ 126.245930][ T5757] EXT4-fs (loop4): Error processing option "test_dummy_encryption" [-2] [ 128.400124][ T5774] loop1: detected capacity change from 0 to 512 [ 128.493999][ T5774] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 128.534247][ T5774] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 128.565187][ T5772] loop4: detected capacity change from 0 to 2048 [ 128.565408][ T5774] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 128.747837][ T5772] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 128.876809][ T5774] EXT4-fs (loop1): 1 truncate cleaned up [ 128.882549][ T5774] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,nomblk_io_submit,,errors=continue. Quota mode: none. [ 129.005571][ T5772] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 129.518360][ T5772] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 129.684848][ T5779] loop3: detected capacity change from 0 to 2048 [ 129.911951][ T5779] NILFS (loop3): invalid segment: Magic number mismatch [ 129.956875][ T5779] NILFS (loop3): trying rollback from an earlier position [ 130.262609][ T5779] NILFS (loop3): recovery complete [ 130.341186][ T5782] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 132.661632][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.669123][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.790576][ T5794] loop0: detected capacity change from 0 to 512 [ 134.114973][ T5794] EXT4-fs (loop0): 1 truncate cleaned up [ 134.120930][ T5794] EXT4-fs (loop0): mounted filesystem without journal. Opts: errors=remount-ro,. Quota mode: none. [ 134.597859][ T26] audit: type=1800 audit(1788634557.998:10): pid=5794 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.552" name="file0" dev="loop0" ino=13 res=0 errno=0 [ 134.850765][ T5800] loop3: detected capacity change from 0 to 64 [ 135.350898][ T5800] Bad inode number on dev loop3: 2 is out of range [ 137.273423][ T5808] loop4: detected capacity change from 0 to 256 [ 137.416806][ T5808] exfat: Deprecated parameter 'namecase' [ 137.454204][ T5808] exfat: Deprecated parameter 'utf8' [ 137.483448][ T5808] exfat: Deprecated parameter 'namecase' [ 137.509895][ T5808] exfat: Deprecated parameter 'namecase' [ 137.676615][ T5808] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0x89b2d127, utbl_chksum : 0xe619d30d) [ 139.535039][ T5811] loop2: detected capacity change from 0 to 64 [ 140.078776][ T5811] BFS-fs: bfs_readdir(): Bad f_pos=00000002 for loop2:00000002 [ 140.162136][ T5815] loop1: detected capacity change from 0 to 128 [ 140.454696][ T5815] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 140.512269][ T5815] hpfs: filesystem error: improperly stopped [ 140.574016][ T5815] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 140.634132][ T5815] hpfs: You really don't want any checks? You are crazy... [ 140.686787][ T5815] hpfs: Code page index out of array [ 140.692211][ T5815] hpfs: code page support is disabled [ 140.742825][ T5815] hpfs: hpfs_map_4sectors(): unaligned read [ 140.793370][ T5815] hpfs: hpfs_map_4sectors(): unaligned read [ 140.822090][ T5815] hpfs: filesystem error: unable to find root dir [ 141.212405][ T5819] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 141.385404][ T5819] cramfs: wrong magic [ 141.393103][ T5818] loop0: detected capacity change from 0 to 1024 [ 141.532901][ T5818] EXT4-fs (loop0): Ignoring removed bh option [ 141.750784][ T5818] EXT4-fs (loop0): mounted filesystem without journal. Opts: nojournal_checksum,nombcache,barrier,norecovery,debug_want_extra_isize=0x0000000000000080,lazytime,nodelalloc,usrquota,noauto_da_alloc,bh,init_itable,,errors=continue. Quota mode: writeback. [ 144.467587][ T5831] loop3: detected capacity change from 0 to 4096 [ 144.591586][ T5831] EXT4-fs (loop3): Ignoring removed nobh option [ 144.754895][ T5833] loop4: detected capacity change from 0 to 2048 [ 145.024098][ T5833] EXT4-fs (loop4): mounted filesystem without journal. Opts: quota,auto_da_alloc=0x0000000000000005,errors=remount-ro,sysvgroups,. Quota mode: writeback. [ 145.366715][ T5833] EXT4-fs (loop4): shut down requested (2) [ 145.929557][ T5831] fscrypt: Error allocating hmac(sha512): -2 [ 145.975477][ T5831] EXT4-fs (loop3): Error processing option "test_dummy_encryption" [-2] [ 147.692302][ T5848] loop3: detected capacity change from 0 to 64 [ 149.066091][ T5850] loop0: detected capacity change from 0 to 1024 [ 149.319393][ T5850] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 149.860769][ T5850] EXT4-fs (loop0): shut down requested (2) [ 150.137881][ T5855] loop3: detected capacity change from 0 to 128 [ 150.323317][ T5855] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 150.454608][ T5855] ext4 filesystem being mounted at /126/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 151.433466][ T5861] loop1: detected capacity change from 0 to 128 [ 152.059547][ T26] audit: type=1800 audit(1788634575.458:11): pid=5861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.575" name="file1" dev="loop1" ino=1048591 res=0 errno=0 [ 152.318559][ T5866] loop4: detected capacity change from 0 to 64 [ 152.362442][ T5855] fscrypt: Error allocating hmac(sha512): -2 [ 153.861894][ T5863] loop0: detected capacity change from 0 to 4096 [ 154.063195][ T5863] ntfs3: loop0: Different NTFS' sector size (2048) and media sector size (512) [ 154.481037][ T5876] loop2: detected capacity change from 0 to 128 [ 154.635216][ T5876] EXT4-fs (loop2): Test dummy encryption mode enabled [ 154.798574][ T5876] EXT4-fs (loop2): mounted filesystem without journal. Opts: test_dummy_encryption=v1,max_dir_size_kb=0x0000000000000002,,errors=continue. Quota mode: none. [ 154.910752][ T5876] ext4 filesystem being mounted at /107/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 156.540095][ T5878] loop1: detected capacity change from 0 to 4096 [ 156.560632][ T5881] loop3: detected capacity change from 0 to 4096 [ 156.727459][ T5878] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 156.765853][ T5881] ntfs3: loop3: Different NTFS' sector size (1024) and media sector size (512) [ 157.066396][ T5889] loop4: detected capacity change from 0 to 512 [ 157.228249][ T5889] EXT4-fs (loop4): Ignoring removed bh option [ 157.292329][ T5889] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 157.330339][ T5881] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 157.410241][ T5881] ntfs3: loop3: Failed to load $Extend. [ 157.612412][ T5878] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 157.645020][ T5889] EXT4-fs (loop4): mounted filesystem without journal. Opts: barrier=0x0000000000000081,minixdf,bh,delalloc,dioread_nolock,noquota,,errors=continue. Quota mode: writeback. [ 157.914784][ T5889] ext4 filesystem being mounted at /112/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 162.931045][ T5913] loop1: detected capacity change from 0 to 4096 [ 163.025620][ T5913] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 164.512509][ T5913] fscrypt: Error allocating hmac(sha512): -2 [ 164.530237][ T5913] EXT4-fs (loop1): Error processing option "test_dummy_encryption" [-2] [ 165.269072][ T5919] loop0: detected capacity change from 0 to 2048 [ 165.444400][ T5919] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 165.599563][ T5919] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 166.075154][ T5919] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 166.798776][ T5925] loop4: detected capacity change from 0 to 2048 [ 167.040033][ T5925] NILFS (loop4): invalid segment: Magic number mismatch [ 167.089751][ T5925] NILFS (loop4): trying rollback from an earlier position [ 167.352399][ T5925] NILFS (loop4): recovery complete [ 167.392359][ T5931] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 170.087591][ T5934] loop0: detected capacity change from 0 to 2048 [ 170.368080][ T5934] NILFS (loop0): invalid segment: Magic number mismatch [ 170.408388][ T5934] NILFS (loop0): trying rollback from an earlier position [ 170.708376][ T5934] NILFS (loop0): recovery complete [ 170.757662][ T5940] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 173.965323][ T5946] loop0: detected capacity change from 0 to 128 [ 174.070657][ T5946] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 174.134180][ T5946] hpfs: filesystem error: improperly stopped [ 174.181220][ T5946] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 174.223978][ T5946] hpfs: You really don't want any checks? You are crazy... [ 174.231326][ T5946] hpfs: Code page index out of array [ 174.289503][ T5946] hpfs: code page support is disabled [ 174.319825][ T5946] hpfs: hpfs_map_4sectors(): unaligned read [ 174.374246][ T5946] hpfs: hpfs_map_4sectors(): unaligned read [ 174.380318][ T5946] hpfs: filesystem error: unable to find root dir [ 174.868485][ T5946] hpfs: hpfs_map_4sectors(): unaligned read [ 175.700727][ T4373] Bluetooth: hci2: command 0x0406 tx timeout [ 175.732224][ T4373] Bluetooth: hci0: command 0x0406 tx timeout [ 175.740758][ T4373] Bluetooth: hci1: command 0x0406 tx timeout [ 175.771013][ T4373] Bluetooth: hci4: command 0x0406 tx timeout [ 175.791698][ T4373] Bluetooth: hci3: command 0x0406 tx timeout [ 177.263051][ T5950] loop3: detected capacity change from 0 to 4096 [ 177.384123][ T5950] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 177.741275][ T5953] loop1: detected capacity change from 0 to 4096 [ 177.863936][ T5953] ntfs3: loop1: Different NTFS' sector size (1024) and media sector size (512) [ 178.346467][ T5953] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 178.426125][ T5953] ntfs3: loop1: Failed to load $Extend. [ 178.806913][ T5950] fscrypt: Error allocating hmac(sha512): -2 [ 178.834431][ T5950] EXT4-fs (loop3): Error processing option "test_dummy_encryption" [-2] [ 179.048136][ T5953] ntfs3: loop1: MftZone: unavailable [ 179.217783][ T5965] ntfs3: loop1: MftZone: unavailable [ 179.223256][ T5965] ntfs3: loop1: no free space to extend mft [ 183.946666][ T5980] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 184.126765][ T5980] cramfs: wrong magic [ 184.481872][ T5978] loop4: detected capacity change from 0 to 4096 [ 184.643896][ T5978] ntfs3: loop4: Different NTFS' sector size (2048) and media sector size (512) [ 185.252695][ T5986] loop3: detected capacity change from 0 to 128 [ 185.414062][ T5986] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 185.478938][ T5986] hpfs: filesystem error: improperly stopped [ 185.539837][ T5986] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 185.583876][ T5986] hpfs: You really don't want any checks? You are crazy... [ 185.633843][ T5986] hpfs: Code page index out of array [ 185.671784][ T5986] hpfs: code page support is disabled [ 185.714651][ T5986] hpfs: hpfs_map_4sectors(): unaligned read [ 185.720875][ T5986] hpfs: hpfs_map_4sectors(): unaligned read [ 185.770628][ T5986] hpfs: filesystem error: unable to find root dir [ 186.196177][ T5986] hpfs: hpfs_map_4sectors(): unaligned read [ 187.932134][ T5993] loop3: detected capacity change from 0 to 512 [ 188.067165][ T5993] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 188.154370][ T5993] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 188.315457][ T5993] EXT4-fs (loop3): 1 truncate cleaned up [ 188.321388][ T5993] EXT4-fs (loop3): mounted filesystem without journal. Opts: acl,errors=remount-ro,. Quota mode: none. [ 190.785470][ T6002] loop2: detected capacity change from 0 to 4096 [ 190.874406][ T6002] EXT4-fs (loop2): Ignoring removed nobh option [ 191.953890][ T6002] EXT4-fs (loop2): Test dummy encryption mode enabled [ 191.971868][ T6002] EXT4-fs (loop2): Ignoring removed bh option [ 192.068032][ T6002] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpid,nobh,nodioread_nolock,test_dummy_encryption,lazytime,nojournal_checksum,minixdf,bh,,errors=continue. Quota mode: writeback. [ 193.160448][ T6002] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 193.908019][ T6016] loop4: detected capacity change from 0 to 1024 [ 194.104327][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.111020][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.708579][ T26] audit: type=1800 audit(1788634618.108:12): pid=6016 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.625" name="file1" dev="loop4" ino=20 res=0 errno=0 [ 195.282416][ T6019] loop0: detected capacity change from 0 to 4096 [ 195.424027][ T6019] ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512) [ 195.762025][ T6019] ntfs3: loop0: Mark volume as dirty due to NTFS errors [ 195.800488][ T6019] ntfs3: loop0: Failed to load $Extend. [ 196.202472][ T6019] ntfs3: loop0: MftZone: unavailable [ 196.246661][ T6019] ntfs3: loop0: MftZone: unavailable [ 196.285471][ T6019] ntfs3: loop0: no free space to extend mft [ 196.368800][ T6019] ntfs3: loop0: MftZone: unavailable [ 196.404009][ T6019] ntfs3: loop0: no free space to extend mft [ 196.457746][ T6028] ntfs3: loop0: MftZone: unavailable [ 196.463207][ T6028] ntfs3: loop0: no free space to extend mft [ 196.822295][ T6027] loop2: detected capacity change from 0 to 2048 [ 197.159249][ T6029] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 198.021699][ T6036] loop1: detected capacity change from 0 to 256 [ 199.233013][ T6033] loop3: detected capacity change from 0 to 4096 [ 199.403744][ T6033] ntfs3: loop3: Different NTFS' sector size (2048) and media sector size (512) [ 209.872625][ T6055] netlink: 'syz.3.637': attribute type 1 has an invalid length. [ 210.290560][ T6051] loop1: detected capacity change from 0 to 4096 [ 210.368052][ T6051] EXT4-fs (loop1): Ignoring removed nobh option [ 210.383940][ T6051] EXT4-fs (loop1): Test dummy encryption mode enabled [ 210.402744][ T6051] EXT4-fs (loop1): Ignoring removed bh option [ 210.435172][ T6051] EXT4-fs: error -4 creating inode table initialization thread [ 210.465605][ T6051] EXT4-fs (loop1): mount failed [ 210.756390][ T6071] netlink: 'syz.1.643': attribute type 10 has an invalid length. [ 210.787698][ T6071] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 210.896371][ T6076] loop3: detected capacity change from 0 to 2048 [ 210.972301][ T6078] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 211.622171][ T6092] bond0: invalid ARP target specified [ 212.595095][ T6094] loop0: detected capacity change from 0 to 2048 [ 212.649557][ T6097] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 212.720224][ T6094] attempt to access beyond end of device [ 212.720224][ T6094] loop0: rw=0, want=2198922592330, limit=2048 [ 212.737362][ T6094] NILFS (loop0): I/O error reading meta-data file (ino=6, block-offset=1) [ 212.790995][ T6099] jffs2: notice: (6099) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 212.857056][ T6101] netlink: 20 bytes leftover after parsing attributes in process `syz.3.654'. [ 212.893964][ T6101] Unknown options in mask b7f2 [ 212.920665][ T6089] loop2: detected capacity change from 0 to 32768 [ 213.062389][ T6089] XFS (loop2): Mounting V5 Filesystem [ 213.224004][ T6089] XFS (loop2): Ending clean mount [ 213.305849][ T6125] netlink: 'syz.0.657': attribute type 1 has an invalid length. [ 213.648251][ T6125] 8021q: adding VLAN 0 to HW filter on device bond1 [ 213.655967][ T6133] loop3: detected capacity change from 0 to 64 [ 213.859585][ T6133] Trying to free block not in datazone [ 213.906974][ T6137] loop0: detected capacity change from 0 to 512 [ 213.934514][ T4190] XFS (loop2): Unmounting Filesystem [ 214.128747][ T6137] EXT4-fs error (device loop0): ext4_validate_block_bitmap:429: comm syz.0.661: bg 0: block 5: invalid block bitmap [ 214.195926][ T6137] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 214.236270][ T6137] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.661: invalid indirect mapped block 3 (level 2) [ 214.278090][ T6137] EXT4-fs (loop0): 1 orphan inode deleted [ 214.319692][ T6137] EXT4-fs (loop0): 1 truncate cleaned up [ 214.361098][ T6137] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,,errors=continue. Quota mode: writeback. [ 214.661400][ T6139] loop4: detected capacity change from 0 to 32768 [ 214.687026][ T6145] loop0: detected capacity change from 0 to 2048 [ 214.720398][ T6147] loop2: detected capacity change from 0 to 2048 [ 214.761457][ T6145] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 214.792412][ T6145] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 214.808847][ T6147] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 214.828387][ T6139] JBD2: Ignoring recovery information on journal [ 214.940962][ T6143] loop3: detected capacity change from 0 to 32768 [ 214.999710][ T6139] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 215.129996][ T6143] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.665 (6143) [ 215.240760][ T6139] syz.4.664 (6139) used greatest stack depth: 20624 bytes left [ 215.289358][ T6143] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 215.313681][ T6143] BTRFS info (device loop3): setting nodatasum [ 215.333727][ T6143] BTRFS info (device loop3): force zlib compression, level 3 [ 215.382866][ T6143] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 215.406945][ T6143] BTRFS info (device loop3): use lzo compression, level 0 [ 215.423289][ T4196] ocfs2: Unmounting device (7,4) on (node local) [ 215.442018][ T6143] BTRFS info (device loop3): turning on flush-on-commit [ 215.471394][ T6143] BTRFS info (device loop3): enabling auto defrag [ 215.481432][ T6143] BTRFS info (device loop3): max_inline at 4096 [ 215.493770][ T6143] BTRFS info (device loop3): using free space tree [ 215.500309][ T6143] BTRFS info (device loop3): has skinny extents [ 215.651398][ T6150] loop1: detected capacity change from 0 to 40427 [ 215.681894][ T6150] F2FS-fs (loop1): build fault injection attr: rate: 0, type: 0x4 [ 215.696809][ T6150] F2FS-fs (loop1): invalid crc value [ 215.735972][ T6150] F2FS-fs (loop1): Found nat_bits in checkpoint [ 215.831984][ T6169] loop4: detected capacity change from 0 to 1024 [ 216.012980][ T6143] BTRFS info (device loop3): enabling ssd optimizations [ 216.029387][ T6150] F2FS-fs (loop1): Cannot turn on quotas: -2 on 1 [ 216.051095][ T6153] loop2: detected capacity change from 0 to 32768 [ 216.124899][ T6150] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 216.391302][ T6153] find_entry called with index = 0 [ 216.403394][ T6153] read_mapping_page failed! [ 216.411215][ T6153] ERROR: (device loop2): txCommit: [ 216.411215][ T6153] [ 216.424554][ T6186] jffs2: notice: (6186) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 216.431682][ T6150] attempt to access beyond end of device [ 216.431682][ T6150] loop1: rw=2049, want=45104, limit=40427 [ 217.580164][ T6190] netlink: 'syz.0.676': attribute type 10 has an invalid length. [ 217.605335][ T6190] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 218.074512][ T6181] loop4: detected capacity change from 0 to 32768 [ 218.205463][ T6181] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.670 (6181) [ 218.452990][ T6181] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 218.509454][ T6181] BTRFS info (device loop4): setting nodatasum [ 218.516971][ T6181] BTRFS info (device loop4): force zlib compression, level 3 [ 218.524755][ T6181] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 218.534145][ T6181] BTRFS info (device loop4): use lzo compression, level 0 [ 218.541377][ T6181] BTRFS info (device loop4): turning on flush-on-commit [ 218.550031][ T6181] BTRFS info (device loop4): enabling auto defrag [ 218.556662][ T6181] BTRFS info (device loop4): max_inline at 4096 [ 218.563508][ T6181] BTRFS info (device loop4): using free space tree [ 218.570594][ T6181] BTRFS info (device loop4): has skinny extents [ 218.736867][ T6219] loop3: detected capacity change from 0 to 512 [ 218.782544][ T6220] netlink: 'syz.2.674': attribute type 1 has an invalid length. [ 219.007654][ T6219] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.678: bg 0: block 5: invalid block bitmap [ 219.040811][ T6181] BTRFS info (device loop4): enabling ssd optimizations [ 219.129467][ T6219] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 219.146345][ T6220] 8021q: adding VLAN 0 to HW filter on device bond1 [ 219.168514][ T6219] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.678: invalid indirect mapped block 3 (level 2) [ 219.247097][ T6219] EXT4-fs (loop3): 1 orphan inode deleted [ 219.252973][ T6219] EXT4-fs (loop3): 1 truncate cleaned up [ 219.262559][ T6219] EXT4-fs (loop3): mounted filesystem without journal. Opts: nodiscard,,errors=continue. Quota mode: writeback. [ 223.906255][ T6259] loop2: detected capacity change from 0 to 32768 [ 223.989695][ T6259] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.684 (6259) [ 224.021611][ T6259] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 224.037111][ T6259] BTRFS info (device loop2): setting nodatasum [ 224.043411][ T6259] BTRFS info (device loop2): force zlib compression, level 3 [ 224.062785][ T6259] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 224.074242][ T6259] BTRFS info (device loop2): use lzo compression, level 0 [ 224.083811][ T6259] BTRFS info (device loop2): turning on flush-on-commit [ 224.093137][ T6259] BTRFS info (device loop2): enabling auto defrag [ 224.101709][ T6259] BTRFS info (device loop2): max_inline at 4096 [ 224.139422][ T6259] BTRFS info (device loop2): using free space tree [ 224.159489][ T6259] BTRFS info (device loop2): has skinny extents [ 224.386582][ T6259] BTRFS error (device loop2): open_ctree failed: -12 [ 224.386783][ T4721] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by udevd (4721) [ 225.664884][ T6300] netlink: 'syz.3.689': attribute type 10 has an invalid length. [ 226.278298][ T6300] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 228.441006][ T6312] loop3: detected capacity change from 0 to 32768 [ 228.772613][ T6312] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 228.900210][ T6312] BTRFS info (device loop3): setting nodatasum [ 228.995527][ T6312] BTRFS info (device loop3): force zlib compression, level 3 [ 229.100553][ T6312] BTRFS info (device loop3): setting incompat feature flag for COMPRESS_LZO (0x8) [ 229.242252][ T6312] BTRFS info (device loop3): use lzo compression, level 0 [ 229.249513][ T6312] BTRFS info (device loop3): turning on flush-on-commit [ 229.256614][ T6312] BTRFS info (device loop3): enabling auto defrag [ 229.263079][ T6312] BTRFS info (device loop3): max_inline at 4096 [ 229.269469][ T6312] BTRFS info (device loop3): using free space tree [ 229.277639][ T6312] BTRFS info (device loop3): has skinny extents [ 229.516366][ T6338] nvme nvme0: failed to connect socket: -512 [ 229.653736][ T6312] BTRFS info (device loop3): enabling ssd optimizations [ 230.709481][ T6338] nvme nvme0: failed to connect socket: -512 [ 230.944259][ T6388] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 231.313585][ T4721] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop3 scanned by udevd (4721) [ 232.710584][ T6433] nvme nvme0: failed to connect socket: -512 [ 232.829187][ T6433] nvme nvme0: failed to connect socket: -512 [ 232.930377][ T6433] nvme nvme0: failed to connect socket: -512 [ 233.013968][ T6433] nvme nvme0: failed to connect socket: -512 [ 233.101727][ T6425] loop2: detected capacity change from 0 to 32768 [ 233.868849][ T6433] nvme nvme0: failed to connect socket: -512 [ 234.340702][ T6464] netlink: 20 bytes leftover after parsing attributes in process `syz.1.739'. [ 234.340833][ T6464] Unknown options in mask b7f2 [ 234.362923][ T6463] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 234.417789][ C0] vkms_vblank_simulate: vblank timer overrun [ 236.337677][ T6509] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 236.592176][ T6516] FAULT_INJECTION: forcing a failure. [ 236.592176][ T6516] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 236.648330][ T6516] CPU: 0 PID: 6516 Comm: syz.1.760 Not tainted syzkaller #0 [ 236.656253][ T6516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.666746][ T6516] Call Trace: [ 236.670035][ T6516] [ 236.672955][ T6516] dump_stack_lvl+0x188/0x250 [ 236.677626][ T6516] ? show_regs_print_info+0x20/0x20 [ 236.682823][ T6516] ? load_image+0x410/0x410 [ 236.687339][ T6516] ? __lock_acquire+0x7b50/0x7b50 [ 236.692369][ T6516] ? __vmalloc_node_range+0x2dd/0x8b0 [ 236.697750][ T6516] ? vzalloc+0x75/0x80 [ 236.701818][ T6516] should_fail+0x383/0x4b0 [ 236.706230][ T6516] prepare_alloc_pages+0x1e3/0x5b0 [ 236.711336][ T6516] __alloc_pages+0x11b/0x480 [ 236.715919][ T6516] ? zone_statistics+0x170/0x170 [ 236.720850][ T6516] ? alloc_pages+0x452/0x560 [ 236.725433][ T6516] __vmalloc_node_range+0x4b1/0x8b0 [ 236.730759][ T6516] ? n_tty_open+0x19/0x150 [ 236.735173][ T6516] vzalloc+0x75/0x80 [ 236.739066][ T6516] ? n_tty_open+0x19/0x150 [ 236.743471][ T6516] n_tty_open+0x19/0x150 [ 236.747802][ T6516] tty_ldisc_setup+0x1a3/0x250 [ 236.752565][ T6516] tty_init_dev+0x239/0x470 [ 236.757063][ T6516] ptmx_open+0xe1/0x2c0 [ 236.761214][ T6516] ? pty_start+0x140/0x140 [ 236.765620][ T6516] chrdev_open+0x585/0x5f0 [ 236.770038][ T6516] ? cd_forget+0x160/0x160 [ 236.774449][ T6516] ? fsnotify_perm+0x3a7/0x560 [ 236.779292][ T6516] ? cd_forget+0x160/0x160 [ 236.783692][ T6516] do_dentry_open+0x7f7/0xf90 [ 236.788638][ T6516] ? vfs_open+0x2b/0x80 [ 236.792785][ T6516] path_openat+0x2718/0x2fb0 [ 236.797481][ T6516] ? __kasan_slab_alloc+0xa9/0xc0 [ 236.802533][ T6516] ? do_filp_open+0x400/0x400 [ 236.807228][ T6516] do_filp_open+0x1df/0x400 [ 236.811725][ T6516] ? vfs_tmpfile+0x300/0x300 [ 236.816318][ T6516] ? _raw_spin_unlock+0x24/0x40 [ 236.821157][ T6516] ? alloc_fd+0x59e/0x650 [ 236.825582][ T6516] do_sys_openat2+0x14b/0x500 [ 236.830266][ T6516] ? __lock_acquire+0x7b50/0x7b50 [ 236.835280][ T6516] ? do_sys_open+0xe0/0xe0 [ 236.839682][ T6516] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 236.845652][ T6516] ? lock_chain_count+0x20/0x20 [ 236.850492][ T6516] __x64_sys_openat+0x135/0x160 [ 236.855333][ T6516] do_syscall_64+0x4c/0xa0 [ 236.859734][ T6516] ? clear_bhb_loop+0x30/0x80 [ 236.864429][ T6516] ? clear_bhb_loop+0x30/0x80 [ 236.869138][ T6516] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 236.875032][ T6516] RIP: 0033:0x7fc11a916159 [ 236.879453][ T6516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.899661][ T6516] RSP: 002b:00007fc118b6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 236.908076][ T6516] RAX: ffffffffffffffda RBX: 00007fc11ab9dfa0 RCX: 00007fc11a916159 [ 236.916065][ T6516] RDX: 0000000000002000 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 236.924055][ T6516] RBP: 00007fc11a9ad024 R08: 0000000000000000 R09: 0000000000000000 [ 236.932014][ T6516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 236.939971][ T6516] R13: 00007fc11ab9e038 R14: 00007fc11ab9dfa0 R15: 00007ffe4bfdbdb8 [ 236.947944][ T6516] [ 236.950990][ C0] vkms_vblank_simulate: vblank timer overrun [ 237.006299][ T6516] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 239.019322][ T6575] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 242.732473][ T6629] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 244.922241][ T6691] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 245.413887][ T4361] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 245.873873][ T4361] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.476444][ T4361] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 246.673920][ T4361] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 246.689946][ T4361] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.709282][ T4361] usb 2-1: Product: syz [ 246.719393][ T4361] usb 2-1: Manufacturer: syz [ 246.730852][ T4361] usb 2-1: SerialNumber: syz [ 246.820511][ T6731] netlink: 4 bytes leftover after parsing attributes in process `syz.3.850'. [ 246.830448][ T6731] device bridge_slave_1 left promiscuous mode [ 246.837280][ T6731] bridge0: port 2(bridge_slave_1) entered disabled state [ 246.864465][ T6731] device bridge_slave_0 left promiscuous mode [ 247.020535][ T6731] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.747681][ T4361] cdc_mbim 2-1:1.0: skipping garbage [ 247.764658][ T6707] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 248.130312][ T6707] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 248.147064][ T4361] cdc_mbim 2-1:1.0: setting tx_max = 16384 [ 248.165338][ T4361] cdc_mbim 2-1:1.0: cdc-wdm0: USB WDM device [ 248.210290][ T4361] cdc_mbim 2-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, 2e:f5:b1:44:1c:fe [ 248.433920][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.440818][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.463723][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.470517][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.493797][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.500562][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.533849][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.540677][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.573826][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.580633][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.613871][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.620744][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.653740][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.660504][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.693782][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.700646][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.723870][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.730745][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.763897][ C0] cdc_mbim 2-1:1.0: nonzero urb status received: -71 [ 248.770705][ C0] cdc_mbim 2-1:1.0: wdm_int_callback - 0 bytes [ 248.902859][ T6400] usb 2-1: USB disconnect, device number 4 [ 248.950189][ T6400] cdc_mbim 2-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 251.989984][ T6793] syz.3.875 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 252.084364][ T6793] CPU: 1 PID: 6793 Comm: syz.3.875 Not tainted syzkaller #0 [ 252.092081][ T6793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 252.102266][ T6793] Call Trace: [ 252.105632][ T6793] [ 252.108592][ T6793] dump_stack_lvl+0x188/0x250 [ 252.113383][ T6793] ? show_regs_print_info+0x20/0x20 [ 252.118697][ T6793] ? load_image+0x410/0x410 [ 252.123386][ T6793] ? local_lock_release+0x170/0x170 [ 252.128628][ T6793] ? __rwlock_init+0x140/0x140 [ 252.133524][ T6793] dump_header+0xd9/0x780 [ 252.138076][ T6793] oom_kill_process+0x20e/0x3d0 [ 252.143020][ T6793] out_of_memory+0xdb2/0x1190 [ 252.147741][ T6793] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 252.153557][ T6793] ? mutex_lock_io_nested+0x60/0x60 [ 252.158982][ T6793] ? unregister_oom_notifier+0x20/0x20 [ 252.164643][ T6793] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 252.170381][ T6793] ? mem_cgroup_oom_trylock+0x210/0x210 [ 252.176083][ T6793] ? do_raw_spin_unlock+0x11d/0x230 [ 252.181470][ T6793] try_charge_memcg+0x1075/0x15b0 [ 252.186804][ T6793] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 252.192727][ T6793] ? rcu_lock_acquire+0x30/0x30 [ 252.198032][ T6793] obj_cgroup_charge_pages+0x87/0x190 [ 252.203517][ T6793] ? __memcg_kmem_charge_page+0x380/0x380 [ 252.209564][ T6793] __memcg_kmem_charge_page+0x2fe/0x380 [ 252.215364][ T6793] __alloc_pages+0x222/0x480 [ 252.220234][ T6793] ? zone_statistics+0x170/0x170 [ 252.225342][ T6793] ? alloc_pages+0x452/0x560 [ 252.230099][ T6793] pte_alloc_one+0x7b/0x310 [ 252.234731][ T6793] ? rcu_lock_release+0x20/0x20 [ 252.239699][ T6793] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 252.246381][ T6793] ? __traceiter_lock_release+0xa0/0xa0 [ 252.252249][ T6793] __pte_alloc+0x21/0x150 [ 252.256731][ T6793] ? walk_to_pmd+0x19c/0x240 [ 252.261398][ T6793] vm_insert_pages+0x604/0x700 [ 252.266508][ T6793] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 252.272448][ T6793] ? rb_commit+0x6f7/0x750 [ 252.277030][ T6793] ? skb_advance_to_frag+0x240/0x240 [ 252.282637][ T6793] tcp_zerocopy_receive+0x113c/0x1fa0 [ 252.288320][ T6793] ? tcp_enable_tx_delay+0x70/0x70 [ 252.293531][ T6793] ? trace_event_raw_event_lock+0x1d9/0x250 [ 252.299559][ T6793] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 252.305297][ T6793] ? mark_lock+0x94/0x320 [ 252.310101][ T6793] ? _local_bh_enable+0xa0/0xa0 [ 252.315264][ T6793] tcp_getsockopt+0x1d5c/0x2530 [ 252.320209][ T6793] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 252.325890][ T6793] ? aa_label_sk_perm+0x3e6/0x540 [ 252.331211][ T6793] ? aa_sk_perm+0x910/0x910 [ 252.335950][ T6793] ? __might_sleep+0xf0/0xf0 [ 252.340737][ T6793] ? rcu_lock_release+0x9/0x20 [ 252.345591][ T6793] ? __lock_acquire+0x7b50/0x7b50 [ 252.350743][ T6793] ? aa_sk_perm+0x7dc/0x910 [ 252.355603][ T6793] ? aa_af_perm+0x340/0x340 [ 252.360210][ T6793] ? aa_sock_opt_perm+0x74/0x100 [ 252.365270][ T6793] ? sock_common_getsockopt+0x29/0xa0 [ 252.370757][ T6793] ? sock_recv_errqueue+0x580/0x580 [ 252.376130][ T6793] __sys_getsockopt+0x1b0/0x230 [ 252.381169][ T6793] __x64_sys_getsockopt+0xb1/0xc0 [ 252.386678][ T6793] do_syscall_64+0x4c/0xa0 [ 252.391187][ T6793] ? clear_bhb_loop+0x30/0x80 [ 252.395970][ T6793] ? clear_bhb_loop+0x30/0x80 [ 252.400685][ T6793] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 252.406621][ T6793] RIP: 0033:0x7f455295b159 [ 252.411125][ T6793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.430816][ T6793] RSP: 002b:00007f4550bb3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 252.439388][ T6793] RAX: ffffffffffffffda RBX: 00007f4552be2fa0 RCX: 00007f455295b159 [ 252.447375][ T6793] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 252.455373][ T6793] RBP: 00007f45529f2024 R08: 00002000000000c0 R09: 0000000000000000 [ 252.463427][ T6793] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 252.471478][ T6793] R13: 00007f4552be3038 R14: 00007f4552be2fa0 R15: 00007ffc88731e78 [ 252.479771][ T6793] [ 252.773804][ T6793] memory: usage 0kB, limit 0kB, failcnt 19 [ 252.781583][ T6793] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 252.824376][ T6793] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 252.831432][ T6793] Memory cgroup stats for /syz3/test: [ 252.833217][ T6793] anon 0 [ 252.833217][ T6793] file 0 [ 252.833217][ T6793] kernel_stack 0 [ 252.833217][ T6793] pagetables 0 [ 252.833217][ T6793] percpu 0 [ 252.833217][ T6793] sock 0 [ 252.833217][ T6793] shmem 0 [ 252.833217][ T6793] file_mapped 0 [ 252.833217][ T6793] file_dirty 0 [ 252.833217][ T6793] file_writeback 0 [ 252.833217][ T6793] swapcached 0 [ 252.833217][ T6793] anon_thp 0 [ 252.833217][ T6793] file_thp 0 [ 252.833217][ T6793] shmem_thp 0 [ 252.833217][ T6793] inactive_anon 0 [ 252.833217][ T6793] active_anon 0 [ 252.833217][ T6793] inactive_file 0 [ 252.833217][ T6793] active_file 0 [ 252.833217][ T6793] unevictable 0 [ 252.833217][ T6793] slab_reclaimable 0 [ 252.833217][ T6793] slab_unreclaimable 0 [ 252.833217][ T6793] slab 0 [ 252.833217][ T6793] workingset_refault_anon 0 [ 252.833217][ T6793] workingset_refault_file 0 [ 252.833217][ T6793] workingset_activate_anon 0 [ 252.833217][ T6793] workingset_activate_file 0 [ 252.927578][ C0] vkms_vblank_simulate: vblank timer overrun [ 253.324002][ T6793] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.875,pid=6790,uid=0 [ 253.404623][ T6793] Memory cgroup out of memory: Killed process 6793 (syz.3.875) total-vm:102244kB, anon-rss:1424kB, file-rss:22672kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 254.894305][ T23] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 255.295061][ T23] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.338759][ T23] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 255.544786][ T23] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 255.556025][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.562449][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.590331][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.621111][ T23] usb 3-1: Product: syz [ 255.673076][ T23] usb 3-1: Manufacturer: syz [ 255.678963][ T23] usb 3-1: SerialNumber: syz [ 255.829542][ T23] cdc_mbim 3-1:1.0: skipping garbage [ 256.237849][ T6810] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 256.940556][ T6810] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 256.974086][ T23] cdc_mbim 3-1:1.0: setting tx_max = 16384 [ 257.020491][ T23] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device [ 257.218957][ T23] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, ea:54:c0:40:68:03 [ 257.884162][ T1110] usb 3-1: USB disconnect, device number 6 [ 257.924005][ T1110] cdc_mbim 3-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM [ 258.676058][ T6838] FAULT_INJECTION: forcing a failure. [ 258.676058][ T6838] name failslab, interval 1, probability 0, space 0, times 0 [ 258.690148][ T6838] CPU: 1 PID: 6838 Comm: syz.4.891 Not tainted syzkaller #0 [ 258.697529][ T6838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.707777][ T6838] Call Trace: [ 258.711178][ T6838] [ 258.714271][ T6838] dump_stack_lvl+0x188/0x250 [ 258.719068][ T6838] ? show_regs_print_info+0x20/0x20 [ 258.724387][ T6838] ? load_image+0x410/0x410 [ 258.729227][ T6838] ? mark_lock+0x94/0x320 [ 258.733706][ T6838] should_fail+0x383/0x4b0 [ 258.738316][ T6838] should_failslab+0x5/0x20 [ 258.742940][ T6838] slab_pre_alloc_hook+0x51/0xc0 [ 258.748122][ T6838] kmem_cache_alloc_node+0x47/0x2c0 [ 258.753390][ T6838] ? __alloc_skb+0xf4/0x750 [ 258.757966][ T6838] ? inet6_rt_notify+0x290/0x290 [ 258.763091][ T6838] __alloc_skb+0xf4/0x750 [ 258.767732][ T6838] inet6_rt_notify+0xe0/0x290 [ 258.772560][ T6838] fib6_add+0x1e9a/0x3ee0 [ 258.777507][ T6838] ? fib6_update_sernum_stub+0x110/0x110 [ 258.783289][ T6838] ? do_raw_spin_lock+0x128/0x2f0 [ 258.788591][ T6838] ? __rwlock_init+0x140/0x140 [ 258.793556][ T6838] ? ip6_route_add+0x71/0x130 [ 258.798392][ T6838] ip6_route_add+0x86/0x130 [ 258.803125][ T6838] addrconf_add_dev+0x295/0x3c0 [ 258.808154][ T6838] ? l3mdev_fib_table+0x130/0x130 [ 258.813585][ T6838] ? addrconf_permanent_addr+0x971/0xa30 [ 258.819459][ T6838] ? addrconf_permanent_addr+0x971/0xa30 [ 258.825247][ T6838] addrconf_init_auto_addrs+0x633/0xab0 [ 258.830988][ T6838] ? addrconf_dad_run+0x1d0/0x1d0 [ 258.836212][ T6838] ? lock_chain_count+0x20/0x20 [ 258.841178][ T6838] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 258.847408][ T6838] ? tls_dev_event+0x697/0xe90 [ 258.852318][ T6838] ? lockdep_hardirqs_on+0x94/0x140 [ 258.857741][ T6838] ? __local_bh_enable_ip+0x136/0x1c0 [ 258.863298][ T6838] ? addrconf_link_ready+0x117/0x170 [ 258.868762][ T6838] addrconf_notify+0xa6b/0xf20 [ 258.873834][ T6838] raw_notifier_call_chain+0xcb/0x160 [ 258.879331][ T6838] __dev_notify_flags+0x194/0x300 [ 258.884564][ T6838] ? __dev_change_flags+0x6a0/0x6a0 [ 258.889901][ T6838] ? __dev_change_flags+0x4ce/0x6a0 [ 258.895345][ T6838] ? devinet_ioctl+0x256/0x1ba0 [ 258.900435][ T6838] ? dev_get_flags+0x1c0/0x1c0 [ 258.905604][ T6838] dev_change_flags+0xda/0x1a0 [ 258.910584][ T6838] devinet_ioctl+0x810/0x1ba0 [ 258.915614][ T6838] inet_ioctl+0x2fa/0x460 [ 258.920226][ T6838] ? inet_shutdown+0x370/0x370 [ 258.925110][ T6838] ? kfree+0xef/0x2a0 [ 258.929529][ T6838] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 258.935257][ T6838] sock_do_ioctl+0xfb/0x320 [ 258.939967][ T6838] ? sock_show_fdinfo+0xb0/0xb0 [ 258.945249][ T6838] sock_ioctl+0x48a/0x700 [ 258.949783][ T6838] ? sock_poll+0x420/0x420 [ 258.954600][ T6838] ? bpf_lsm_file_ioctl+0x5/0x10 [ 258.959608][ T6838] ? security_file_ioctl+0x7c/0xa0 [ 258.964843][ T6838] ? sock_poll+0x420/0x420 [ 258.969462][ T6838] __se_sys_ioctl+0xfa/0x170 [ 258.974298][ T6838] do_syscall_64+0x4c/0xa0 [ 258.978781][ T6838] ? clear_bhb_loop+0x30/0x80 [ 258.983536][ T6838] ? clear_bhb_loop+0x30/0x80 [ 258.988389][ T6838] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 258.994431][ T6838] RIP: 0033:0x7fad31f22159 [ 258.999056][ T6838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.018709][ T6838] RSP: 002b:00007fad3017a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 259.027233][ T6838] RAX: ffffffffffffffda RBX: 00007fad321a9fa0 RCX: 00007fad31f22159 [ 259.035311][ T6838] RDX: 00002000000000c0 RSI: 0000000000008914 RDI: 0000000000000004 [ 259.043422][ T6838] RBP: 00007fad31fb9024 R08: 0000000000000000 R09: 0000000000000000 [ 259.051544][ T6838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 259.059670][ T6838] R13: 00007fad321aa038 R14: 00007fad321a9fa0 R15: 00007ffdbfa487c8 [ 259.067962][ T6838] [ 264.883981][ T1110] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 265.255174][ T1110] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.295795][ T1110] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 265.514126][ T1110] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 265.545021][ T1110] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.553114][ T1110] usb 4-1: Product: syz [ 265.595937][ T1110] usb 4-1: Manufacturer: syz [ 265.600614][ T1110] usb 4-1: SerialNumber: syz [ 265.822451][ T1110] cdc_mbim 4-1:1.0: skipping garbage [ 266.349935][ T6882] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 267.049415][ T6882] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 267.124563][ T1110] cdc_mbim 4-1:1.0: setting tx_max = 16384 [ 267.147215][ T1110] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 267.344965][ T1110] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 66:5f:d7:06:bd:07 [ 268.255355][ T1110] usb 4-1: USB disconnect, device number 4 [ 268.294979][ T1110] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 272.394920][ T6936] syz.4.924 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 272.544459][ T6936] CPU: 1 PID: 6936 Comm: syz.4.924 Not tainted syzkaller #0 [ 272.551840][ T6936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 272.562227][ T6936] Call Trace: [ 272.565596][ T6936] [ 272.568744][ T6936] dump_stack_lvl+0x188/0x250 [ 272.573699][ T6936] ? show_regs_print_info+0x20/0x20 [ 272.579000][ T6936] ? load_image+0x410/0x410 [ 272.583664][ T6936] ? local_lock_release+0x170/0x170 [ 272.589117][ T6936] ? __rwlock_init+0x140/0x140 [ 272.594189][ T6936] dump_header+0xd9/0x780 [ 272.598652][ T6936] oom_kill_process+0x20e/0x3d0 [ 272.603702][ T6936] out_of_memory+0xdb2/0x1190 [ 272.608611][ T6936] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 272.614475][ T6936] ? mutex_lock_io_nested+0x60/0x60 [ 272.619917][ T6936] ? unregister_oom_notifier+0x20/0x20 [ 272.625803][ T6936] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 272.631483][ T6936] ? mem_cgroup_oom_trylock+0x210/0x210 [ 272.637430][ T6936] ? do_raw_spin_unlock+0x11d/0x230 [ 272.643362][ T6936] try_charge_memcg+0x1075/0x15b0 [ 272.648865][ T6936] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 272.654875][ T6936] ? rcu_lock_acquire+0x30/0x30 [ 272.660400][ T6936] obj_cgroup_charge_pages+0x87/0x190 [ 272.665848][ T6936] ? __memcg_kmem_charge_page+0x380/0x380 [ 272.671906][ T6936] __memcg_kmem_charge_page+0x2fe/0x380 [ 272.677736][ T6936] __alloc_pages+0x222/0x480 [ 272.682429][ T6936] ? zone_statistics+0x170/0x170 [ 272.687710][ T6936] ? alloc_pages+0x452/0x560 [ 272.692582][ T6936] pte_alloc_one+0x7b/0x310 [ 272.697169][ T6936] ? rcu_lock_release+0x20/0x20 [ 272.702175][ T6936] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 272.709015][ T6936] ? __traceiter_lock_release+0xa0/0xa0 [ 272.714802][ T6936] __pte_alloc+0x21/0x150 [ 272.719216][ T6936] ? walk_to_pmd+0x19c/0x240 [ 272.724006][ T6936] vm_insert_pages+0x604/0x700 [ 272.729193][ T6936] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 272.735198][ T6936] ? rb_commit+0x6f7/0x750 [ 272.739788][ T6936] ? skb_advance_to_frag+0x240/0x240 [ 272.745405][ T6936] tcp_zerocopy_receive+0x113c/0x1fa0 [ 272.751374][ T6936] ? tcp_enable_tx_delay+0x70/0x70 [ 272.756537][ T6936] ? trace_event_raw_event_lock+0x1d9/0x250 [ 272.762603][ T6936] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 272.768548][ T6936] ? mark_lock+0x94/0x320 [ 272.773544][ T6936] ? _local_bh_enable+0xa0/0xa0 [ 272.778673][ T6936] tcp_getsockopt+0x1d5c/0x2530 [ 272.783805][ T6936] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 272.789603][ T6936] ? aa_label_sk_perm+0x3e6/0x540 [ 272.794856][ T6936] ? aa_sk_perm+0x910/0x910 [ 272.799908][ T6936] ? __might_sleep+0xf0/0xf0 [ 272.804628][ T6936] ? rcu_lock_release+0x9/0x20 [ 272.809615][ T6936] ? __lock_acquire+0x7b50/0x7b50 [ 272.814965][ T6936] ? aa_sk_perm+0x7dc/0x910 [ 272.819618][ T6936] ? aa_af_perm+0x340/0x340 [ 272.824427][ T6936] ? aa_sock_opt_perm+0x74/0x100 [ 272.829626][ T6936] ? sock_common_getsockopt+0x29/0xa0 [ 272.835061][ T6936] ? sock_recv_errqueue+0x580/0x580 [ 272.840404][ T6936] __sys_getsockopt+0x1b0/0x230 [ 272.845548][ T6936] __x64_sys_getsockopt+0xb1/0xc0 [ 272.850811][ T6936] do_syscall_64+0x4c/0xa0 [ 272.855287][ T6936] ? clear_bhb_loop+0x30/0x80 [ 272.860047][ T6936] ? clear_bhb_loop+0x30/0x80 [ 272.864901][ T6936] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 272.870939][ T6936] RIP: 0033:0x7fad31f22159 [ 272.875536][ T6936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 272.895194][ T6936] RSP: 002b:00007fad3017a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 272.903726][ T6936] RAX: ffffffffffffffda RBX: 00007fad321a9fa0 RCX: 00007fad31f22159 [ 272.911813][ T6936] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 272.919918][ T6936] RBP: 00007fad31fb9024 R08: 00002000000000c0 R09: 0000000000000000 [ 272.928141][ T6936] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 272.936238][ T6936] R13: 00007fad321aa038 R14: 00007fad321a9fa0 R15: 00007ffdbfa487c8 [ 272.944590][ T6936] [ 273.035000][ T6936] memory: usage 0kB, limit 0kB, failcnt 19 [ 273.045797][ T6936] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 273.053421][ T6936] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 273.151345][ T6936] Memory cgroup stats for /syz4/test: [ 273.151799][ T6936] anon 0 [ 273.151799][ T6936] file 0 [ 273.151799][ T6936] kernel_stack 0 [ 273.151799][ T6936] pagetables 0 [ 273.151799][ T6936] percpu 0 [ 273.151799][ T6936] sock 0 [ 273.151799][ T6936] shmem 0 [ 273.151799][ T6936] file_mapped 0 [ 273.151799][ T6936] file_dirty 0 [ 273.151799][ T6936] file_writeback 0 [ 273.151799][ T6936] swapcached 0 [ 273.151799][ T6936] anon_thp 0 [ 273.151799][ T6936] file_thp 0 [ 273.151799][ T6936] shmem_thp 0 [ 273.151799][ T6936] inactive_anon 0 [ 273.151799][ T6936] active_anon 0 [ 273.151799][ T6936] inactive_file 0 [ 273.151799][ T6936] active_file 0 [ 273.151799][ T6936] unevictable 0 [ 273.151799][ T6936] slab_reclaimable 0 [ 273.151799][ T6936] slab_unreclaimable 0 [ 273.151799][ T6936] slab 0 [ 273.151799][ T6936] workingset_refault_anon 0 [ 273.151799][ T6936] workingset_refault_file 0 [ 273.151799][ T6936] workingset_activate_anon 0 [ 273.151799][ T6936] workingset_activate_file 0 [ 273.245601][ C0] vkms_vblank_simulate: vblank timer overrun [ 274.683882][ T6936] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz4/test,task_memcg=/syz4/test,task=syz.4.924,pid=6934,uid=0 [ 274.779538][ T6936] Memory cgroup out of memory: Killed process 6936 (syz.4.924) total-vm:102376kB, anon-rss:1428kB, file-rss:22736kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 279.744537][ C0] hrtimer: interrupt took 519554 ns [ 280.035280][ T6997] syz.1.946 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 280.093446][ T6997] CPU: 0 PID: 6997 Comm: syz.1.946 Not tainted syzkaller #0 [ 280.100918][ T6997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.111244][ T6997] Call Trace: [ 280.114596][ T6997] [ 280.117602][ T6997] dump_stack_lvl+0x188/0x250 [ 280.122478][ T6997] ? show_regs_print_info+0x20/0x20 [ 280.127881][ T6997] ? load_image+0x410/0x410 [ 280.132613][ T6997] ? local_lock_release+0x170/0x170 [ 280.137922][ T6997] ? __rwlock_init+0x140/0x140 [ 280.142923][ T6997] dump_header+0xd9/0x780 [ 280.147566][ T6997] oom_kill_process+0x20e/0x3d0 [ 280.152529][ T6997] out_of_memory+0xdb2/0x1190 [ 280.157388][ T6997] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 280.163315][ T6997] ? mutex_lock_io_nested+0x60/0x60 [ 280.168766][ T6997] ? unregister_oom_notifier+0x20/0x20 [ 280.174558][ T6997] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 280.180383][ T6997] ? mem_cgroup_oom_trylock+0x210/0x210 [ 280.186159][ T6997] ? do_raw_spin_unlock+0x11d/0x230 [ 280.191638][ T6997] try_charge_memcg+0x1075/0x15b0 [ 280.197042][ T6997] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 280.203015][ T6997] ? rcu_lock_acquire+0x30/0x30 [ 280.208494][ T6997] obj_cgroup_charge_pages+0x87/0x190 [ 280.214503][ T6997] ? __memcg_kmem_charge_page+0x380/0x380 [ 280.220520][ T6997] __memcg_kmem_charge_page+0x2fe/0x380 [ 280.226269][ T6997] __alloc_pages+0x222/0x480 [ 280.231144][ T6997] ? zone_statistics+0x170/0x170 [ 280.236293][ T6997] ? alloc_pages+0x452/0x560 [ 280.241172][ T6997] pte_alloc_one+0x7b/0x310 [ 280.245884][ T6997] ? rcu_lock_release+0x20/0x20 [ 280.250821][ T6997] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 280.257578][ T6997] ? __traceiter_lock_release+0xa0/0xa0 [ 280.263444][ T6997] __pte_alloc+0x21/0x150 [ 280.267944][ T6997] ? walk_to_pmd+0x19c/0x240 [ 280.272648][ T6997] vm_insert_pages+0x604/0x700 [ 280.278005][ T6997] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 280.283954][ T6997] ? rb_commit+0x6f7/0x750 [ 280.288491][ T6997] ? skb_advance_to_frag+0x240/0x240 [ 280.294257][ T6997] tcp_zerocopy_receive+0x113c/0x1fa0 [ 280.300096][ T6997] ? tcp_enable_tx_delay+0x70/0x70 [ 280.305371][ T6997] ? trace_event_raw_event_lock+0x1d9/0x250 [ 280.311399][ T6997] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 280.317402][ T6997] ? mark_lock+0x94/0x320 [ 280.322409][ T6997] ? _local_bh_enable+0xa0/0xa0 [ 280.327705][ T6997] tcp_getsockopt+0x1d5c/0x2530 [ 280.332815][ T6997] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 280.338566][ T6997] ? aa_label_sk_perm+0x3e6/0x540 [ 280.344149][ T6997] ? aa_sk_perm+0x910/0x910 [ 280.349129][ T6997] ? __might_sleep+0xf0/0xf0 [ 280.354011][ T6997] ? rcu_lock_release+0x9/0x20 [ 280.358898][ T6997] ? __lock_acquire+0x7b50/0x7b50 [ 280.364155][ T6997] ? aa_sk_perm+0x7dc/0x910 [ 280.368997][ T6997] ? aa_af_perm+0x340/0x340 [ 280.373665][ T6997] ? aa_sock_opt_perm+0x74/0x100 [ 280.378798][ T6997] ? sock_common_getsockopt+0x29/0xa0 [ 280.384344][ T6997] ? sock_recv_errqueue+0x580/0x580 [ 280.389724][ T6997] __sys_getsockopt+0x1b0/0x230 [ 280.394746][ T6997] __x64_sys_getsockopt+0xb1/0xc0 [ 280.400009][ T6997] do_syscall_64+0x4c/0xa0 [ 280.404589][ T6997] ? clear_bhb_loop+0x30/0x80 [ 280.409376][ T6997] ? clear_bhb_loop+0x30/0x80 [ 280.414148][ T6997] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 280.420133][ T6997] RIP: 0033:0x7fc11a916159 [ 280.424702][ T6997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.444454][ T6997] RSP: 002b:00007fc118b6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 280.453144][ T6997] RAX: ffffffffffffffda RBX: 00007fc11ab9dfa0 RCX: 00007fc11a916159 [ 280.461181][ T6997] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 280.470357][ T6997] RBP: 00007fc11a9ad024 R08: 00002000000000c0 R09: 0000000000000000 [ 280.478428][ T6997] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 280.486535][ T6997] R13: 00007fc11ab9e038 R14: 00007fc11ab9dfa0 R15: 00007ffe4bfdbdb8 [ 280.494917][ T6997] [ 280.498448][ C0] vkms_vblank_simulate: vblank timer overrun [ 280.584007][ C0] vkms_vblank_simulate: vblank timer overrun [ 280.709789][ C0] vkms_vblank_simulate: vblank timer overrun [ 280.735228][ C0] vkms_vblank_simulate: vblank timer overrun [ 280.792860][ C0] vkms_vblank_simulate: vblank timer overrun [ 281.103873][ T6997] memory: usage 0kB, limit 0kB, failcnt 19 [ 281.113918][ T6997] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 281.174376][ T6997] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 281.181399][ T6997] Memory cgroup stats for /syz1/test: [ 281.181916][ T6997] anon 0 [ 281.181916][ T6997] file 0 [ 281.181916][ T6997] kernel_stack 0 [ 281.181916][ T6997] pagetables 0 [ 281.181916][ T6997] percpu 0 [ 281.181916][ T6997] sock 0 [ 281.181916][ T6997] shmem 0 [ 281.181916][ T6997] file_mapped 0 [ 281.181916][ T6997] file_dirty 0 [ 281.181916][ T6997] file_writeback 0 [ 281.181916][ T6997] swapcached 0 [ 281.181916][ T6997] anon_thp 0 [ 281.181916][ T6997] file_thp 0 [ 281.181916][ T6997] shmem_thp 0 [ 281.181916][ T6997] inactive_anon 0 [ 281.181916][ T6997] active_anon 0 [ 281.181916][ T6997] inactive_file 0 [ 281.181916][ T6997] active_file 0 [ 281.181916][ T6997] unevictable 0 [ 281.181916][ T6997] slab_reclaimable 0 [ 281.181916][ T6997] slab_unreclaimable 0 [ 281.181916][ T6997] slab 0 [ 281.181916][ T6997] workingset_refault_anon 0 [ 281.181916][ T6997] workingset_refault_file 0 [ 281.181916][ T6997] workingset_activate_anon 0 [ 281.181916][ T6997] workingset_activate_file 0 [ 282.024302][ T6997] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.946,pid=6994,uid=0 [ 282.096108][ T6997] Memory cgroup out of memory: Killed process 6997 (syz.1.946) total-vm:102244kB, anon-rss:1428kB, file-rss:22720kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 287.948873][ T7056] syz.1.966 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 288.084479][ T7056] CPU: 1 PID: 7056 Comm: syz.1.966 Not tainted syzkaller #0 [ 288.091906][ T7056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 288.102023][ T7056] Call Trace: [ 288.105359][ T7056] [ 288.108447][ T7056] dump_stack_lvl+0x188/0x250 [ 288.113318][ T7056] ? show_regs_print_info+0x20/0x20 [ 288.118592][ T7056] ? load_image+0x410/0x410 [ 288.123176][ T7056] ? local_lock_release+0x170/0x170 [ 288.128460][ T7056] ? __rwlock_init+0x140/0x140 [ 288.133403][ T7056] dump_header+0xd9/0x780 [ 288.137836][ T7056] oom_kill_process+0x20e/0x3d0 [ 288.142808][ T7056] out_of_memory+0xdb2/0x1190 [ 288.148049][ T7056] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 288.153867][ T7056] ? mutex_lock_io_nested+0x60/0x60 [ 288.159255][ T7056] ? unregister_oom_notifier+0x20/0x20 [ 288.165005][ T7056] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 288.170617][ T7056] ? mem_cgroup_oom_trylock+0x210/0x210 [ 288.176373][ T7056] ? do_raw_spin_unlock+0x11d/0x230 [ 288.181718][ T7056] try_charge_memcg+0x1075/0x15b0 [ 288.186975][ T7056] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 288.192909][ T7056] ? rcu_lock_acquire+0x30/0x30 [ 288.198113][ T7056] obj_cgroup_charge_pages+0x87/0x190 [ 288.203534][ T7056] ? __memcg_kmem_charge_page+0x380/0x380 [ 288.209427][ T7056] __memcg_kmem_charge_page+0x2fe/0x380 [ 288.215309][ T7056] __alloc_pages+0x222/0x480 [ 288.219967][ T7056] ? zone_statistics+0x170/0x170 [ 288.225068][ T7056] ? alloc_pages+0x452/0x560 [ 288.229829][ T7056] pte_alloc_one+0x7b/0x310 [ 288.234358][ T7056] ? rcu_lock_release+0x20/0x20 [ 288.239273][ T7056] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 288.246067][ T7056] ? __traceiter_lock_release+0xa0/0xa0 [ 288.251856][ T7056] __pte_alloc+0x21/0x150 [ 288.256263][ T7056] ? walk_to_pmd+0x19c/0x240 [ 288.261045][ T7056] vm_insert_pages+0x604/0x700 [ 288.266087][ T7056] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 288.271980][ T7056] ? rb_commit+0x6f7/0x750 [ 288.276471][ T7056] ? skb_advance_to_frag+0x240/0x240 [ 288.282047][ T7056] tcp_zerocopy_receive+0x113c/0x1fa0 [ 288.287756][ T7056] ? tcp_enable_tx_delay+0x70/0x70 [ 288.292902][ T7056] ? trace_event_raw_event_lock+0x1d9/0x250 [ 288.298905][ T7056] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 288.304693][ T7056] ? mark_lock+0x94/0x320 [ 288.309473][ T7056] ? _local_bh_enable+0xa0/0xa0 [ 288.314513][ T7056] tcp_getsockopt+0x1d5c/0x2530 [ 288.319605][ T7056] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 288.325362][ T7056] ? aa_label_sk_perm+0x3e6/0x540 [ 288.330522][ T7056] ? aa_sk_perm+0x910/0x910 [ 288.335570][ T7056] ? __might_sleep+0xf0/0xf0 [ 288.340217][ T7056] ? rcu_lock_release+0x9/0x20 [ 288.345164][ T7056] ? __lock_acquire+0x7b50/0x7b50 [ 288.350416][ T7056] ? aa_sk_perm+0x7dc/0x910 [ 288.355029][ T7056] ? aa_af_perm+0x340/0x340 [ 288.359707][ T7056] ? aa_sock_opt_perm+0x74/0x100 [ 288.364855][ T7056] ? sock_common_getsockopt+0x29/0xa0 [ 288.370276][ T7056] ? sock_recv_errqueue+0x580/0x580 [ 288.375553][ T7056] __sys_getsockopt+0x1b0/0x230 [ 288.380574][ T7056] __x64_sys_getsockopt+0xb1/0xc0 [ 288.385852][ T7056] do_syscall_64+0x4c/0xa0 [ 288.390324][ T7056] ? clear_bhb_loop+0x30/0x80 [ 288.395077][ T7056] ? clear_bhb_loop+0x30/0x80 [ 288.399876][ T7056] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 288.405858][ T7056] RIP: 0033:0x7fc11a916159 [ 288.410375][ T7056] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 288.429991][ T7056] RSP: 002b:00007fc118b6e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 288.438441][ T7056] RAX: ffffffffffffffda RBX: 00007fc11ab9dfa0 RCX: 00007fc11a916159 [ 288.446447][ T7056] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 288.454493][ T7056] RBP: 00007fc11a9ad024 R08: 00002000000000c0 R09: 0000000000000000 [ 288.462528][ T7056] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 288.470589][ T7056] R13: 00007fc11ab9e038 R14: 00007fc11ab9dfa0 R15: 00007ffe4bfdbdb8 [ 288.478727][ T7056] [ 288.601601][ T7056] memory: usage 0kB, limit 0kB, failcnt 55 [ 288.609368][ T7056] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 288.625530][ T7056] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 288.637487][ T7056] Memory cgroup stats for /syz1/test: [ 288.639449][ T7056] anon 0 [ 288.639449][ T7056] file 0 [ 288.639449][ T7056] kernel_stack 0 [ 288.639449][ T7056] pagetables 0 [ 288.639449][ T7056] percpu 0 [ 288.639449][ T7056] sock 0 [ 288.639449][ T7056] shmem 0 [ 288.639449][ T7056] file_mapped 0 [ 288.639449][ T7056] file_dirty 0 [ 288.639449][ T7056] file_writeback 0 [ 288.639449][ T7056] swapcached 0 [ 288.639449][ T7056] anon_thp 0 [ 288.639449][ T7056] file_thp 0 [ 288.639449][ T7056] shmem_thp 0 [ 288.639449][ T7056] inactive_anon 0 [ 288.639449][ T7056] active_anon 0 [ 288.639449][ T7056] inactive_file 0 [ 288.639449][ T7056] active_file 0 [ 288.639449][ T7056] unevictable 0 [ 288.639449][ T7056] slab_reclaimable 0 [ 288.639449][ T7056] slab_unreclaimable 0 [ 288.639449][ T7056] slab 0 [ 288.639449][ T7056] workingset_refault_anon 0 [ 288.639449][ T7056] workingset_refault_file 0 [ 288.639449][ T7056] workingset_activate_anon 0 [ 288.639449][ T7056] workingset_activate_file 0 [ 289.219362][ T7056] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.966,pid=7053,uid=0 [ 289.369448][ T7056] Memory cgroup out of memory: Killed process 7056 (syz.1.966) total-vm:102376kB, anon-rss:1436kB, file-rss:22720kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 299.548528][ T7133] syz.2.997 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 299.626070][ T7133] CPU: 1 PID: 7133 Comm: syz.2.997 Not tainted syzkaller #0 [ 299.633559][ T7133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 299.643695][ T7133] Call Trace: [ 299.647079][ T7133] [ 299.650153][ T7133] dump_stack_lvl+0x188/0x250 [ 299.655123][ T7133] ? show_regs_print_info+0x20/0x20 [ 299.660594][ T7133] ? load_image+0x410/0x410 [ 299.665293][ T7133] ? local_lock_release+0x170/0x170 [ 299.671024][ T7133] ? __rwlock_init+0x140/0x140 [ 299.676051][ T7133] dump_header+0xd9/0x780 [ 299.680536][ T7133] oom_kill_process+0x20e/0x3d0 [ 299.685595][ T7133] out_of_memory+0xdb2/0x1190 [ 299.690429][ T7133] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 299.696268][ T7133] ? mutex_lock_io_nested+0x60/0x60 [ 299.701735][ T7133] ? unregister_oom_notifier+0x20/0x20 [ 299.707610][ T7133] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 299.713292][ T7133] ? mem_cgroup_oom_trylock+0x210/0x210 [ 299.719254][ T7133] ? do_raw_spin_unlock+0x11d/0x230 [ 299.724620][ T7133] try_charge_memcg+0x1075/0x15b0 [ 299.730124][ T7133] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 299.736234][ T7133] ? rcu_lock_acquire+0x30/0x30 [ 299.741777][ T7133] obj_cgroup_charge_pages+0x87/0x190 [ 299.747221][ T7133] ? __memcg_kmem_charge_page+0x380/0x380 [ 299.753315][ T7133] __memcg_kmem_charge_page+0x2fe/0x380 [ 299.759100][ T7133] __alloc_pages+0x222/0x480 [ 299.763826][ T7133] ? zone_statistics+0x170/0x170 [ 299.769133][ T7133] ? alloc_pages+0x452/0x560 [ 299.773973][ T7133] pte_alloc_one+0x7b/0x310 [ 299.778579][ T7133] ? rcu_lock_release+0x20/0x20 [ 299.783608][ T7133] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 299.790469][ T7133] ? __traceiter_lock_release+0xa0/0xa0 [ 299.796212][ T7133] __pte_alloc+0x21/0x150 [ 299.800640][ T7133] ? walk_to_pmd+0x19c/0x240 [ 299.805715][ T7133] vm_insert_pages+0x604/0x700 [ 299.810968][ T7133] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 299.816994][ T7133] ? rb_commit+0x6f7/0x750 [ 299.821612][ T7133] ? skb_advance_to_frag+0x240/0x240 [ 299.827222][ T7133] tcp_zerocopy_receive+0x113c/0x1fa0 [ 299.833155][ T7133] ? tcp_enable_tx_delay+0x70/0x70 [ 299.838341][ T7133] ? trace_event_raw_event_lock+0x1d9/0x250 [ 299.844425][ T7133] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 299.850393][ T7133] ? mark_lock+0x94/0x320 [ 299.855387][ T7133] ? _local_bh_enable+0xa0/0xa0 [ 299.860481][ T7133] tcp_getsockopt+0x1d5c/0x2530 [ 299.865644][ T7133] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 299.871437][ T7133] ? aa_label_sk_perm+0x3e6/0x540 [ 299.876666][ T7133] ? aa_sk_perm+0x910/0x910 [ 299.881704][ T7133] ? __might_sleep+0xf0/0xf0 [ 299.886444][ T7133] ? rcu_lock_release+0x9/0x20 [ 299.891446][ T7133] ? __lock_acquire+0x7b50/0x7b50 [ 299.896748][ T7133] ? aa_sk_perm+0x7dc/0x910 [ 299.901433][ T7133] ? aa_af_perm+0x340/0x340 [ 299.906270][ T7133] ? aa_sock_opt_perm+0x74/0x100 [ 299.911399][ T7133] ? sock_common_getsockopt+0x29/0xa0 [ 299.916839][ T7133] ? sock_recv_errqueue+0x580/0x580 [ 299.922208][ T7133] __sys_getsockopt+0x1b0/0x230 [ 299.927706][ T7133] __x64_sys_getsockopt+0xb1/0xc0 [ 299.932903][ T7133] do_syscall_64+0x4c/0xa0 [ 299.937388][ T7133] ? clear_bhb_loop+0x30/0x80 [ 299.942160][ T7133] ? clear_bhb_loop+0x30/0x80 [ 299.947030][ T7133] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 299.953079][ T7133] RIP: 0033:0x7f77f39b0159 [ 299.957632][ T7133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.977342][ T7133] RSP: 002b:00007f77f1c08028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 299.985901][ T7133] RAX: ffffffffffffffda RBX: 00007f77f3c37fa0 RCX: 00007f77f39b0159 [ 299.993991][ T7133] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 300.002184][ T7133] RBP: 00007f77f3a47024 R08: 00002000000000c0 R09: 0000000000000000 [ 300.010327][ T7133] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 300.018368][ T7133] R13: 00007f77f3c38038 R14: 00007f77f3c37fa0 R15: 00007ffd89169788 [ 300.026635][ T7133] [ 300.164265][ T7133] memory: usage 0kB, limit 0kB, failcnt 19 [ 300.181940][ T7133] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 300.233060][ T7133] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 300.272724][ T7133] Memory cgroup stats for /syz2/test: [ 300.284618][ T7133] anon 0 [ 300.284618][ T7133] file 0 [ 300.284618][ T7133] kernel_stack 0 [ 300.284618][ T7133] pagetables 0 [ 300.284618][ T7133] percpu 0 [ 300.284618][ T7133] sock 0 [ 300.284618][ T7133] shmem 0 [ 300.284618][ T7133] file_mapped 0 [ 300.284618][ T7133] file_dirty 0 [ 300.284618][ T7133] file_writeback 0 [ 300.284618][ T7133] swapcached 0 [ 300.284618][ T7133] anon_thp 0 [ 300.284618][ T7133] file_thp 0 [ 300.284618][ T7133] shmem_thp 0 [ 300.284618][ T7133] inactive_anon 0 [ 300.284618][ T7133] active_anon 0 [ 300.284618][ T7133] inactive_file 0 [ 300.284618][ T7133] active_file 0 [ 300.284618][ T7133] unevictable 0 [ 300.284618][ T7133] slab_reclaimable 0 [ 300.284618][ T7133] slab_unreclaimable 0 [ 300.284618][ T7133] slab 0 [ 300.284618][ T7133] workingset_refault_anon 0 [ 300.284618][ T7133] workingset_refault_file 0 [ 300.284618][ T7133] workingset_activate_anon 0 [ 300.284618][ T7133] workingset_activate_file 0 [ 300.378025][ C0] vkms_vblank_simulate: vblank timer overrun [ 301.717658][ T7133] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.997,pid=7131,uid=0 [ 301.774836][ T7133] Memory cgroup out of memory: Killed process 7133 (syz.2.997) total-vm:102244kB, anon-rss:1432kB, file-rss:22672kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 304.620028][ T7169] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1009'. [ 308.994667][ T7188] syz.4.1019 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 309.144523][ T7188] CPU: 0 PID: 7188 Comm: syz.4.1019 Not tainted syzkaller #0 [ 309.152040][ T7188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 309.162218][ T7188] Call Trace: [ 309.165638][ T7188] [ 309.168745][ T7188] dump_stack_lvl+0x188/0x250 [ 309.173529][ T7188] ? show_regs_print_info+0x20/0x20 [ 309.178873][ T7188] ? load_image+0x410/0x410 [ 309.183636][ T7188] ? local_lock_release+0x170/0x170 [ 309.189014][ T7188] ? __rwlock_init+0x140/0x140 [ 309.193930][ T7188] dump_header+0xd9/0x780 [ 309.198523][ T7188] oom_kill_process+0x20e/0x3d0 [ 309.203654][ T7188] out_of_memory+0xdb2/0x1190 [ 309.208545][ T7188] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 309.214379][ T7188] ? mutex_lock_io_nested+0x60/0x60 [ 309.219943][ T7188] ? unregister_oom_notifier+0x20/0x20 [ 309.225679][ T7188] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 309.231452][ T7188] ? mem_cgroup_oom_trylock+0x210/0x210 [ 309.237346][ T7188] ? do_raw_spin_unlock+0x11d/0x230 [ 309.242737][ T7188] try_charge_memcg+0x1075/0x15b0 [ 309.248247][ T7188] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 309.254164][ T7188] ? rcu_lock_acquire+0x30/0x30 [ 309.259666][ T7188] obj_cgroup_charge_pages+0x87/0x190 [ 309.265186][ T7188] ? __memcg_kmem_charge_page+0x380/0x380 [ 309.271348][ T7188] __memcg_kmem_charge_page+0x2fe/0x380 [ 309.277014][ T7188] __alloc_pages+0x222/0x480 [ 309.281802][ T7188] ? zone_statistics+0x170/0x170 [ 309.287107][ T7188] ? alloc_pages+0x452/0x560 [ 309.291871][ T7188] pte_alloc_one+0x7b/0x310 [ 309.296531][ T7188] ? rcu_lock_release+0x20/0x20 [ 309.301623][ T7188] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 309.308371][ T7188] ? __traceiter_lock_release+0xa0/0xa0 [ 309.314127][ T7188] __pte_alloc+0x21/0x150 [ 309.318608][ T7188] ? walk_to_pmd+0x19c/0x240 [ 309.323488][ T7188] vm_insert_pages+0x604/0x700 [ 309.328589][ T7188] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 309.334702][ T7188] ? rb_commit+0x6f7/0x750 [ 309.339211][ T7188] ? skb_advance_to_frag+0x240/0x240 [ 309.344838][ T7188] tcp_zerocopy_receive+0x113c/0x1fa0 [ 309.350742][ T7188] ? tcp_enable_tx_delay+0x70/0x70 [ 309.355977][ T7188] ? trace_event_raw_event_lock+0x1d9/0x250 [ 309.362154][ T7188] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 309.367957][ T7188] ? mark_lock+0x94/0x320 [ 309.372963][ T7188] ? _local_bh_enable+0xa0/0xa0 [ 309.378162][ T7188] tcp_getsockopt+0x1d5c/0x2530 [ 309.383302][ T7188] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 309.389001][ T7188] ? aa_label_sk_perm+0x3e6/0x540 [ 309.394342][ T7188] ? aa_sk_perm+0x910/0x910 [ 309.399252][ T7188] ? __might_sleep+0xf0/0xf0 [ 309.404078][ T7188] ? rcu_lock_release+0x9/0x20 [ 309.409134][ T7188] ? __lock_acquire+0x7b50/0x7b50 [ 309.414210][ T7188] ? preempt_schedule_irq+0xe6/0x160 [ 309.419668][ T7188] ? aa_sk_perm+0x7dc/0x910 [ 309.424497][ T7188] ? aa_af_perm+0x340/0x340 [ 309.429211][ T7188] ? aa_sock_opt_perm+0x74/0x100 [ 309.434485][ T7188] ? sock_common_getsockopt+0x29/0xa0 [ 309.439998][ T7188] ? sock_recv_errqueue+0x580/0x580 [ 309.445466][ T7188] __sys_getsockopt+0x1b0/0x230 [ 309.450467][ T7188] __x64_sys_getsockopt+0xb1/0xc0 [ 309.455857][ T7188] do_syscall_64+0x4c/0xa0 [ 309.460411][ T7188] ? clear_bhb_loop+0x30/0x80 [ 309.465263][ T7188] ? clear_bhb_loop+0x30/0x80 [ 309.470085][ T7188] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 309.476048][ T7188] RIP: 0033:0x7fad31f22159 [ 309.480584][ T7188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 309.500321][ T7188] RSP: 002b:00007fad3017a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 309.508961][ T7188] RAX: ffffffffffffffda RBX: 00007fad321a9fa0 RCX: 00007fad31f22159 [ 309.517057][ T7188] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 309.525090][ T7188] RBP: 00007fad31fb9024 R08: 00002000000000c0 R09: 0000000000000000 [ 309.533145][ T7188] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 309.541223][ T7188] R13: 00007fad321aa038 R14: 00007fad321a9fa0 R15: 00007ffdbfa487c8 [ 309.549766][ T7188] [ 309.553160][ C0] vkms_vblank_simulate: vblank timer overrun [ 311.101740][ T7188] memory: usage 0kB, limit 0kB, failcnt 55 [ 311.112248][ T7188] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 312.284614][ T7188] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 312.385272][ T7188] Memory cgroup stats for /syz4/test: [ 312.394480][ T7188] anon 0 [ 312.394480][ T7188] file 0 [ 312.394480][ T7188] kernel_stack 0 [ 312.394480][ T7188] pagetables 0 [ 312.394480][ T7188] percpu 0 [ 312.394480][ T7188] sock 0 [ 312.394480][ T7188] shmem 0 [ 312.394480][ T7188] file_mapped 0 [ 312.394480][ T7188] file_dirty 0 [ 312.394480][ T7188] file_writeback 0 [ 312.394480][ T7188] swapcached 0 [ 312.394480][ T7188] anon_thp 0 [ 312.394480][ T7188] file_thp 0 [ 312.394480][ T7188] shmem_thp 0 [ 312.394480][ T7188] inactive_anon 0 [ 312.394480][ T7188] active_anon 0 [ 312.394480][ T7188] inactive_file 0 [ 312.394480][ T7188] active_file 0 [ 312.394480][ T7188] unevictable 0 [ 312.394480][ T7188] slab_reclaimable 0 [ 312.394480][ T7188] slab_unreclaimable 0 [ 312.394480][ T7188] slab 0 [ 312.394480][ T7188] workingset_refault_anon 0 [ 312.394480][ T7188] workingset_refault_file 0 [ 312.394480][ T7188] workingset_activate_anon 0 [ 312.394480][ T7188] workingset_activate_file 0 [ 313.394829][ T7188] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz4/test,task_memcg=/syz4/test,task=syz.4.1019,pid=7187,uid=0 [ 313.921646][ T7188] Memory cgroup out of memory: Killed process 7188 (syz.4.1019) total-vm:102244kB, anon-rss:1420kB, file-rss:22736kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 316.992253][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.999281][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 321.294036][ T23] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 321.695581][ T23] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 321.714107][ T23] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 321.763817][ T23] usb 2-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 321.773025][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.911456][ T23] spcp8x5 2-1:1.0: SPCP8x5 converter detected [ 322.005376][ T23] usb 2-1: SPCP8x5 converter now attached to ttyUSB0 [ 322.688088][ T1110] usb 2-1: USB disconnect, device number 5 [ 322.696032][ T7241] syz.2.1041 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 322.753952][ T7241] CPU: 1 PID: 7241 Comm: syz.2.1041 Not tainted syzkaller #0 [ 322.761496][ T7241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.771709][ T7241] Call Trace: [ 322.775102][ T7241] [ 322.778090][ T7241] dump_stack_lvl+0x188/0x250 [ 322.782936][ T7241] ? show_regs_print_info+0x20/0x20 [ 322.788325][ T7241] ? load_image+0x410/0x410 [ 322.793189][ T7241] ? local_lock_release+0x170/0x170 [ 322.798487][ T7241] ? __rwlock_init+0x140/0x140 [ 322.803478][ T7241] dump_header+0xd9/0x780 [ 322.808231][ T7241] oom_kill_process+0x20e/0x3d0 [ 322.813203][ T7241] out_of_memory+0xdb2/0x1190 [ 322.817963][ T7241] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 322.823866][ T7241] ? mutex_lock_io_nested+0x60/0x60 [ 322.829344][ T7241] ? unregister_oom_notifier+0x20/0x20 [ 322.835120][ T7241] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 322.840958][ T7241] ? mem_cgroup_oom_trylock+0x210/0x210 [ 322.846733][ T7241] ? do_raw_spin_unlock+0x11d/0x230 [ 322.852198][ T7241] try_charge_memcg+0x1075/0x15b0 [ 322.857623][ T7241] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 322.863599][ T7241] ? rcu_lock_acquire+0x30/0x30 [ 322.869099][ T7241] obj_cgroup_charge_pages+0x87/0x190 [ 322.874655][ T7241] ? __memcg_kmem_charge_page+0x380/0x380 [ 322.880729][ T7241] __memcg_kmem_charge_page+0x2fe/0x380 [ 322.886469][ T7241] __alloc_pages+0x222/0x480 [ 322.891329][ T7241] ? zone_statistics+0x170/0x170 [ 322.896508][ T7241] ? alloc_pages+0x452/0x560 [ 322.901358][ T7241] pte_alloc_one+0x7b/0x310 [ 322.906050][ T7241] ? rcu_lock_release+0x20/0x20 [ 322.911020][ T7241] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 322.917783][ T7241] ? __traceiter_lock_release+0xa0/0xa0 [ 322.923647][ T7241] __pte_alloc+0x21/0x150 [ 322.928173][ T7241] ? walk_to_pmd+0x19c/0x240 [ 322.932865][ T7241] vm_insert_pages+0x604/0x700 [ 322.938192][ T7241] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 322.944167][ T7241] ? rb_commit+0x6f7/0x750 [ 322.948694][ T7241] ? skb_advance_to_frag+0x240/0x240 [ 322.954448][ T7241] tcp_zerocopy_receive+0x113c/0x1fa0 [ 322.960270][ T7241] ? tcp_enable_tx_delay+0x70/0x70 [ 322.965568][ T7241] ? trace_event_raw_event_lock+0x1d9/0x250 [ 322.971654][ T7241] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 322.977465][ T7241] ? mark_lock+0x94/0x320 [ 322.982483][ T7241] ? _local_bh_enable+0xa0/0xa0 [ 322.987827][ T7241] tcp_getsockopt+0x1d5c/0x2530 [ 322.993070][ T7241] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 322.998814][ T7241] ? aa_label_sk_perm+0x3e6/0x540 [ 323.004276][ T7241] ? aa_sk_perm+0x910/0x910 [ 323.009132][ T7241] ? __might_sleep+0xf0/0xf0 [ 323.014037][ T7241] ? rcu_lock_release+0x9/0x20 [ 323.018929][ T7241] ? __lock_acquire+0x7b50/0x7b50 [ 323.024168][ T7241] ? aa_sk_perm+0x7dc/0x910 [ 323.029049][ T7241] ? aa_af_perm+0x340/0x340 [ 323.033694][ T7241] ? aa_sock_opt_perm+0x74/0x100 [ 323.038812][ T7241] ? sock_common_getsockopt+0x29/0xa0 [ 323.044345][ T7241] ? sock_recv_errqueue+0x580/0x580 [ 323.049741][ T7241] __sys_getsockopt+0x1b0/0x230 [ 323.054740][ T7241] __x64_sys_getsockopt+0xb1/0xc0 [ 323.059988][ T7241] do_syscall_64+0x4c/0xa0 [ 323.065071][ T7241] ? clear_bhb_loop+0x30/0x80 [ 323.069886][ T7241] ? clear_bhb_loop+0x30/0x80 [ 323.074650][ T7241] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 323.080626][ T7241] RIP: 0033:0x7f77f39b0159 [ 323.085176][ T7241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.105027][ T7241] RSP: 002b:00007f77f1c08028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 323.113654][ T7241] RAX: ffffffffffffffda RBX: 00007f77f3c37fa0 RCX: 00007f77f39b0159 [ 323.121677][ T7241] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 323.129731][ T7241] RBP: 00007f77f3a47024 R08: 00002000000000c0 R09: 0000000000000000 [ 323.137802][ T7241] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 323.145892][ T7241] R13: 00007f77f3c38038 R14: 00007f77f3c37fa0 R15: 00007ffd89169788 [ 323.154272][ T7241] [ 323.201419][ T1110] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 323.214579][ T1110] spcp8x5 2-1:1.0: device disconnected [ 323.654343][ T7241] memory: usage 0kB, limit 0kB, failcnt 55 [ 323.660339][ T7241] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 323.813837][ T7241] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 323.820950][ T7241] Memory cgroup stats for /syz2/test: [ 323.821610][ T7241] anon 0 [ 323.821610][ T7241] file 0 [ 323.821610][ T7241] kernel_stack 0 [ 323.821610][ T7241] pagetables 0 [ 323.821610][ T7241] percpu 0 [ 323.821610][ T7241] sock 0 [ 323.821610][ T7241] shmem 0 [ 323.821610][ T7241] file_mapped 0 [ 323.821610][ T7241] file_dirty 0 [ 323.821610][ T7241] file_writeback 0 [ 323.821610][ T7241] swapcached 0 [ 323.821610][ T7241] anon_thp 0 [ 323.821610][ T7241] file_thp 0 [ 323.821610][ T7241] shmem_thp 0 [ 323.821610][ T7241] inactive_anon 0 [ 323.821610][ T7241] active_anon 0 [ 323.821610][ T7241] inactive_file 0 [ 323.821610][ T7241] active_file 0 [ 323.821610][ T7241] unevictable 0 [ 323.821610][ T7241] slab_reclaimable 0 [ 323.821610][ T7241] slab_unreclaimable 0 [ 323.821610][ T7241] slab 0 [ 323.821610][ T7241] workingset_refault_anon 0 [ 323.821610][ T7241] workingset_refault_file 0 [ 323.821610][ T7241] workingset_activate_anon 0 [ 323.821610][ T7241] workingset_activate_file 0 [ 323.917064][ C0] vkms_vblank_simulate: vblank timer overrun [ 324.600483][ T7250] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1053'. [ 325.298048][ T7241] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.1041,pid=7239,uid=0 [ 325.572238][ T7241] Memory cgroup out of memory: Killed process 7241 (syz.2.1041) total-vm:102376kB, anon-rss:1440kB, file-rss:22672kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 326.726767][ T7258] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1043'. [ 329.314229][ T4352] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 329.614526][ T4352] usb 3-1: Using ep0 maxpacket: 32 [ 329.755233][ T4352] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 329.775809][ T4352] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 329.821726][ T4352] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 329.875142][ T4352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 329.935108][ T4352] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 329.996034][ T4352] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 330.074867][ T4352] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 330.138746][ T4352] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.406485][ T4352] usb 3-1: config 0 descriptor?? [ 330.874715][ T4352] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 7 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 331.803482][ T7288] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1058'. [ 331.816617][ T7288] device bridge_slave_1 left promiscuous mode [ 331.826937][ T7288] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.488354][ T7288] device bridge_slave_0 left promiscuous mode [ 332.512210][ T7288] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.862996][ T7292] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 333.661816][ T7294] syz.0.1059 invoked oom-killer: gfp_mask=0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), order=0, oom_score_adj=1000 [ 333.723778][ T7294] CPU: 1 PID: 7294 Comm: syz.0.1059 Not tainted syzkaller #0 [ 333.731254][ T7294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 333.741391][ T7294] Call Trace: [ 333.744773][ T7294] [ 333.747849][ T7294] dump_stack_lvl+0x188/0x250 [ 333.752823][ T7294] ? show_regs_print_info+0x20/0x20 [ 333.758094][ T7294] ? load_image+0x410/0x410 [ 333.762720][ T7294] ? local_lock_release+0x170/0x170 [ 333.768063][ T7294] ? __rwlock_init+0x140/0x140 [ 333.773005][ T7294] dump_header+0xd9/0x780 [ 333.777404][ T7294] oom_kill_process+0x20e/0x3d0 [ 333.782363][ T7294] out_of_memory+0xdb2/0x1190 [ 333.787111][ T7294] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 333.792839][ T7294] ? mutex_lock_io_nested+0x60/0x60 [ 333.798164][ T7294] ? unregister_oom_notifier+0x20/0x20 [ 333.803985][ T7294] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 333.809625][ T7294] ? mem_cgroup_oom_trylock+0x210/0x210 [ 333.815392][ T7294] ? do_raw_spin_unlock+0x11d/0x230 [ 333.820710][ T7294] try_charge_memcg+0x1075/0x15b0 [ 333.826097][ T7294] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 333.831974][ T7294] ? rcu_lock_acquire+0x30/0x30 [ 333.837201][ T7294] obj_cgroup_charge_pages+0x87/0x190 [ 333.842592][ T7294] ? __memcg_kmem_charge_page+0x380/0x380 [ 333.848510][ T7294] __memcg_kmem_charge_page+0x2fe/0x380 [ 333.854245][ T7294] __alloc_pages+0x222/0x480 [ 333.858908][ T7294] ? zone_statistics+0x170/0x170 [ 333.864178][ T7294] ? alloc_pages+0x452/0x560 [ 333.868905][ T7294] pte_alloc_one+0x7b/0x310 [ 333.873436][ T7294] ? rcu_lock_release+0x20/0x20 [ 333.878357][ T7294] ? trace_event_raw_event_lock_acquire+0x21b/0x2b0 [ 333.885172][ T7294] ? __traceiter_lock_release+0xa0/0xa0 [ 333.890849][ T7294] __pte_alloc+0x21/0x150 [ 333.895242][ T7294] ? walk_to_pmd+0x19c/0x240 [ 333.899994][ T7294] vm_insert_pages+0x604/0x700 [ 333.904989][ T7294] tcp_zerocopy_vm_insert_batch+0xc0/0x1f0 [ 333.910906][ T7294] ? rb_commit+0x6f7/0x750 [ 333.915555][ T7294] ? skb_advance_to_frag+0x240/0x240 [ 333.921013][ T7294] tcp_zerocopy_receive+0x113c/0x1fa0 [ 333.926711][ T7294] ? tcp_enable_tx_delay+0x70/0x70 [ 333.931900][ T7294] ? trace_event_raw_event_lock+0x1d9/0x250 [ 333.937950][ T7294] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 333.943856][ T7294] ? mark_lock+0x94/0x320 [ 333.948649][ T7294] ? _local_bh_enable+0xa0/0xa0 [ 333.953688][ T7294] tcp_getsockopt+0x1d5c/0x2530 [ 333.958836][ T7294] ? tcp_bpf_bypass_getsockopt+0x40/0x40 [ 333.964581][ T7294] ? aa_label_sk_perm+0x3e6/0x540 [ 333.969741][ T7294] ? aa_sk_perm+0x910/0x910 [ 333.974542][ T7294] ? __might_sleep+0xf0/0xf0 [ 333.979335][ T7294] ? rcu_lock_release+0x9/0x20 [ 333.984259][ T7294] ? __lock_acquire+0x7b50/0x7b50 [ 333.989435][ T7294] ? aa_sk_perm+0x7dc/0x910 [ 333.994079][ T7294] ? aa_af_perm+0x340/0x340 [ 333.998790][ T7294] ? aa_sock_opt_perm+0x74/0x100 [ 334.003823][ T7294] ? sock_common_getsockopt+0x29/0xa0 [ 334.009240][ T7294] ? sock_recv_errqueue+0x580/0x580 [ 334.014567][ T7294] __sys_getsockopt+0x1b0/0x230 [ 334.019590][ T7294] __x64_sys_getsockopt+0xb1/0xc0 [ 334.024717][ T7294] do_syscall_64+0x4c/0xa0 [ 334.029157][ T7294] ? clear_bhb_loop+0x30/0x80 [ 334.033893][ T7294] ? clear_bhb_loop+0x30/0x80 [ 334.038701][ T7294] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 334.044672][ T7294] RIP: 0033:0x7f4c120ef159 [ 334.049335][ T7294] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.069129][ T7294] RSP: 002b:00007f4c10347028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 334.077602][ T7294] RAX: ffffffffffffffda RBX: 00007f4c12376fa0 RCX: 00007f4c120ef159 [ 334.085626][ T7294] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000004 [ 334.093689][ T7294] RBP: 00007f4c12186024 R08: 00002000000000c0 R09: 0000000000000000 [ 334.101792][ T7294] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 334.109799][ T7294] R13: 00007f4c12377038 R14: 00007f4c12376fa0 R15: 00007ffe31eaa778 [ 334.118014][ T7294] [ 334.354708][ T23] usb 3-1: USB disconnect, device number 7 [ 334.375180][ T7294] memory: usage 0kB, limit 0kB, failcnt 55 [ 334.403110][ T7294] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 334.417125][ T23] usblp0: removed [ 335.394548][ T7294] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 335.424651][ T7294] Memory cgroup stats for /syz0/test: [ 335.425242][ T7294] anon 0 [ 335.425242][ T7294] file 0 [ 335.425242][ T7294] kernel_stack 0 [ 335.425242][ T7294] pagetables 0 [ 335.425242][ T7294] percpu 0 [ 335.425242][ T7294] sock 0 [ 335.425242][ T7294] shmem 0 [ 335.425242][ T7294] file_mapped 0 [ 335.425242][ T7294] file_dirty 0 [ 335.425242][ T7294] file_writeback 0 [ 335.425242][ T7294] swapcached 0 [ 335.425242][ T7294] anon_thp 0 [ 335.425242][ T7294] file_thp 0 [ 335.425242][ T7294] shmem_thp 0 [ 335.425242][ T7294] inactive_anon 0 [ 335.425242][ T7294] active_anon 0 [ 335.425242][ T7294] inactive_file 0 [ 335.425242][ T7294] active_file 0 [ 335.425242][ T7294] unevictable 0 [ 335.425242][ T7294] slab_reclaimable 0 [ 335.425242][ T7294] slab_unreclaimable 0 [ 335.425242][ T7294] slab 0 [ 335.425242][ T7294] workingset_refault_anon 0 [ 335.425242][ T7294] workingset_refault_file 0 [ 335.425242][ T7294] workingset_activate_anon 0 [ 335.425242][ T7294] workingset_activate_file 0 [ 335.786007][ T7304] ================================================================== [ 335.795235][ T7304] BUG: KASAN: use-after-free in dvb_device_open+0xc5/0x360 [ 335.802576][ T7304] Read of size 8 at addr ffff88802a3a8218 by task syz.1.1064/7304 [ 335.810486][ T7304] [ 335.812932][ T7304] CPU: 1 PID: 7304 Comm: syz.1.1064 Not tainted syzkaller #0 [ 335.820437][ T7304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 335.830637][ T7304] Call Trace: [ 335.833968][ T7304] [ 335.836990][ T7304] dump_stack_lvl+0x188/0x250 [ 335.841887][ T7304] ? show_regs_print_info+0x20/0x20 [ 335.847216][ T7304] ? _printk+0xda/0x130 [ 335.851524][ T7304] ? dvb_device_open+0xc5/0x360 [ 335.856515][ T7304] ? load_image+0x410/0x410 [ 335.861166][ T7304] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 335.866967][ T7304] print_address_description+0x60/0x2d0 [ 335.872675][ T7304] ? dvb_device_open+0xc5/0x360 [ 335.877599][ T7304] kasan_report+0xdf/0x130 [ 335.882162][ T7304] ? dvb_device_open+0xc5/0x360 [ 335.887295][ T7304] dvb_device_open+0xc5/0x360 [ 335.892489][ T7304] chrdev_open+0x585/0x5f0 [ 335.897070][ T7304] ? cd_forget+0x160/0x160 [ 335.901744][ T7304] ? fsnotify_perm+0x3a7/0x560 [ 335.906670][ T7304] ? cd_forget+0x160/0x160 [ 335.911172][ T7304] do_dentry_open+0x7f7/0xf90 [ 335.916040][ T7304] ? vfs_open+0x2b/0x80 [ 335.920544][ T7304] path_openat+0x2718/0x2fb0 [ 335.925406][ T7304] ? ring_buffer_unlock_commit+0x472/0x5f0 [ 335.931344][ T7304] ? trace_event_buffer_lock_reserve+0xed/0x6a0 [ 335.938180][ T7304] ? do_filp_open+0x400/0x400 [ 335.943059][ T7304] ? trace_event_raw_event_lock+0x1d9/0x250 [ 335.949240][ T7304] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 335.955194][ T7304] do_filp_open+0x1df/0x400 [ 335.960004][ T7304] ? vfs_tmpfile+0x300/0x300 [ 335.965078][ T7304] ? _raw_spin_unlock+0x24/0x40 [ 335.970101][ T7304] ? alloc_fd+0x59e/0x650 [ 335.974666][ T7304] do_sys_openat2+0x14b/0x500 [ 335.979492][ T7304] ? __lock_acquire+0x7b50/0x7b50 [ 335.984732][ T7304] ? do_sys_open+0xe0/0xe0 [ 335.989369][ T7304] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 335.995478][ T7304] ? lock_chain_count+0x20/0x20 [ 336.000588][ T7304] __x64_sys_openat+0x135/0x160 [ 336.006328][ T7304] do_syscall_64+0x4c/0xa0 [ 336.010811][ T7304] ? clear_bhb_loop+0x30/0x80 [ 336.015571][ T7304] ? clear_bhb_loop+0x30/0x80 [ 336.020427][ T7304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 336.026475][ T7304] RIP: 0033:0x7fc11a8d698e [ 336.031103][ T7304] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 336.050757][ T7304] RSP: 002b:00007fc118b6db28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 336.059282][ T7304] RAX: ffffffffffffffda RBX: 00007fc118b6e6c0 RCX: 00007fc11a8d698e [ 336.067710][ T7304] RDX: 0000000000040402 RSI: 00007fc118b6dc00 RDI: ffffffffffffff9c [ 336.075810][ T7304] RBP: 00007fc118b6dc00 R08: 0000000000000000 R09: 0000000000000000 [ 336.083932][ T7304] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 336.092056][ T7304] R13: 00007fc11ab9e038 R14: 00007fc11ab9dfa0 R15: 00007ffe4bfdbdb8 [ 336.100479][ T7304] [ 336.103634][ T7304] [ 336.106113][ T7304] Allocated by task 1: [ 336.110423][ T7304] __kasan_kmalloc+0xaf/0xe0 [ 336.115073][ T7304] dvb_register_device+0x300/0x1dc0 [ 336.120353][ T7304] dvb_register_frontend+0x629/0x900 [ 336.125772][ T7304] vidtv_bridge_probe+0x9c1/0xf30 [ 336.130928][ T7304] platform_probe+0x137/0x1c0 [ 336.135753][ T7304] really_probe+0x276/0xc70 [ 336.140377][ T7304] __driver_probe_device+0x1f5/0x390 [ 336.145722][ T7304] driver_probe_device+0x4f/0x420 [ 336.150829][ T7304] __driver_attach+0x45d/0x660 [ 336.155699][ T7304] bus_for_each_dev+0x182/0x1f0 [ 336.160676][ T7304] bus_add_driver+0x324/0x5d0 [ 336.165499][ T7304] driver_register+0x32d/0x430 [ 336.170422][ T7304] vidtv_bridge_init+0x45/0x80 [ 336.175235][ T7304] do_one_initcall+0x272/0x730 [ 336.180071][ T7304] do_initcall_level+0x13d/0x1f0 [ 336.185100][ T7304] do_initcalls+0x4b/0x90 [ 336.189548][ T7304] kernel_init_freeable+0x3d5/0x560 [ 336.194904][ T7304] kernel_init+0x19/0x1b0 [ 336.199423][ T7304] ret_from_fork+0x1f/0x30 [ 336.204262][ T7304] [ 336.204836][ T7294] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null) [ 336.206632][ T7304] Freed by task 7254: [ 336.206680][ T7304] kasan_set_track+0x4b/0x70 [ 336.206724][ T7304] kasan_set_free_info+0x1f/0x40 [ 336.206765][ T7304] ____kasan_slab_free+0xd5/0x110 [ 336.206807][ T7304] slab_free_freelist_hook+0xec/0x170 [ 336.206852][ T7304] kfree+0xef/0x2a0 [ 336.206891][ T7304] dvb_device_open+0x2d2/0x360 [ 336.246599][ T7304] chrdev_open+0x585/0x5f0 [ 336.251112][ T7304] do_dentry_open+0x7f7/0xf90 [ 336.255903][ T7304] path_openat+0x2718/0x2fb0 [ 336.260642][ T7304] do_filp_open+0x1df/0x400 [ 336.265306][ T7304] do_sys_openat2+0x14b/0x500 [ 336.270075][ T7304] __x64_sys_openat+0x135/0x160 [ 336.274996][ T7304] do_syscall_64+0x4c/0xa0 [ 336.279503][ T7304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 336.285118][ T7294] ,cpuset= [ 336.285484][ T7304] [ 336.285536][ T7294] test [ 336.288594][ T7304] The buggy address belongs to the object at ffff88802a3a8200 [ 336.288594][ T7304] which belongs to the cache kmalloc-256 of size 256 [ 336.288646][ T7304] The buggy address is located 24 bytes inside of [ 336.288646][ T7304] 256-byte region [ffff88802a3a8200, ffff88802a3a8300) [ 336.321702][ T7304] The buggy address belongs to the page: [ 336.327401][ T7304] page:ffffea0000a8ea00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a3a8 [ 336.337638][ T7304] head:ffffea0000a8ea00 order:1 compound_mapcount:0 [ 336.339991][ T7294] ,mems_allowed=0-1 [ 336.344330][ T7304] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 336.344409][ T7304] raw: 00fff00000010200 ffffea0000a83f80 0000000300000002 ffff888016c41b40 [ 336.344459][ T7304] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 336.344504][ T7304] page dumped because: kasan: bad access detected [ 336.344555][ T7304] page_owner tracks the page as allocated [ 336.344601][ T7304] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2835, ts 10239891559, free_ts 0 [ 336.344667][ T7304] get_page_from_freelist+0x24f6/0x2670 [ 336.344733][ T7304] __alloc_pages+0x1ee/0x480 [ 336.344794][ T7304] new_slab+0xc0/0x4b0 [ 336.344857][ T7304] ___slab_alloc+0x807/0xdd0 [ 336.344878][ T7304] kmem_cache_alloc_trace+0xf9/0x290 [ 336.344899][ T7304] kthread+0x10a/0x520 [ 336.344920][ T7304] ret_from_fork+0x1f/0x30 [ 336.344944][ T7304] page_owner free stack trace missing [ 336.344962][ T7304] [ 336.344980][ T7304] Memory state around the buggy address: [ 336.405701][ T7294] ,oom_memcg= [ 336.411114][ T7304] ffff88802a3a8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 336.411137][ T7304] ffff88802a3a8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 336.411159][ T7304] >ffff88802a3a8200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 336.411181][ T7304] ^ [ 336.411205][ T7304] ffff88802a3a8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 336.411232][ T7304] ffff88802a3a8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 336.411259][ T7304] ================================================================== [ 336.411286][ T7304] Disabling lock debugging due to kernel taint [ 336.638043][ T7304] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 336.645440][ T7304] CPU: 0 PID: 7304 Comm: syz.1.1064 Tainted: G B syzkaller #0 [ 336.654306][ T7304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 336.664609][ T7304] Call Trace: [ 336.668040][ T7304] [ 336.671144][ T7304] dump_stack_lvl+0x188/0x250 [ 336.675952][ T7304] ? show_regs_print_info+0x20/0x20 [ 336.681401][ T7304] ? load_image+0x410/0x410 [ 336.686842][ T7304] panic+0x2f8/0x850 [ 336.690832][ T7304] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 336.697217][ T7304] ? bpf_jit_dump+0xd0/0xd0 [ 336.702024][ T7304] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 336.708088][ T7304] ? _raw_spin_unlock+0x40/0x40 [ 336.713132][ T7304] ? dvb_device_open+0xc5/0x360 [ 336.718162][ T7304] check_panic_on_warn+0x80/0xa0 [ 336.723275][ T7304] ? dvb_device_open+0xc5/0x360 [ 336.728191][ T7304] end_report+0x6d/0xf0 [ 336.732437][ T7304] kasan_report+0x102/0x130 [ 336.737105][ T7304] ? dvb_device_open+0xc5/0x360 [ 336.742286][ T7304] dvb_device_open+0xc5/0x360 [ 336.747083][ T7304] chrdev_open+0x585/0x5f0 [ 336.751685][ T7304] ? cd_forget+0x160/0x160 [ 336.756390][ T7304] ? fsnotify_perm+0x3a7/0x560 [ 336.761255][ T7304] ? cd_forget+0x160/0x160 [ 336.765763][ T7304] do_dentry_open+0x7f7/0xf90 [ 336.770656][ T7304] ? vfs_open+0x2b/0x80 [ 336.775126][ T7304] path_openat+0x2718/0x2fb0 [ 336.780007][ T7304] ? ring_buffer_unlock_commit+0x472/0x5f0 [ 336.785947][ T7304] ? trace_event_buffer_lock_reserve+0xed/0x6a0 [ 336.792603][ T7304] ? do_filp_open+0x400/0x400 [ 336.797478][ T7304] ? trace_event_raw_event_lock+0x1d9/0x250 [ 336.803603][ T7304] ? perf_trace_lock_acquire+0x3f0/0x3f0 [ 336.809496][ T7304] do_filp_open+0x1df/0x400 [ 336.814362][ T7304] ? vfs_tmpfile+0x300/0x300 [ 336.819445][ T7304] ? _raw_spin_unlock+0x24/0x40 [ 336.824474][ T7304] ? alloc_fd+0x59e/0x650 [ 336.828986][ T7304] do_sys_openat2+0x14b/0x500 [ 336.833808][ T7304] ? __lock_acquire+0x7b50/0x7b50 [ 336.839041][ T7304] ? do_sys_open+0xe0/0xe0 [ 336.843742][ T7304] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 336.849857][ T7304] ? lock_chain_count+0x20/0x20 [ 336.855000][ T7304] __x64_sys_openat+0x135/0x160 [ 336.860196][ T7304] do_syscall_64+0x4c/0xa0 [ 336.864671][ T7304] ? clear_bhb_loop+0x30/0x80 [ 336.869431][ T7304] ? clear_bhb_loop+0x30/0x80 [ 336.874293][ T7304] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 336.880336][ T7304] RIP: 0033:0x7fc11a8d698e [ 336.884918][ T7304] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 336.904592][ T7304] RSP: 002b:00007fc118b6db28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 336.913125][ T7304] RAX: ffffffffffffffda RBX: 00007fc118b6e6c0 RCX: 00007fc11a8d698e [ 336.921209][ T7304] RDX: 0000000000040402 RSI: 00007fc118b6dc00 RDI: ffffffffffffff9c [ 336.929331][ T7304] RBP: 00007fc118b6dc00 R08: 0000000000000000 R09: 0000000000000000 [ 336.937460][ T7304] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 336.945527][ T7304] R13: 00007fc11ab9e038 R14: 00007fc11ab9dfa0 R15: 00007ffe4bfdbdb8 [ 336.953853][ T7304] [ 336.957252][ T7304] Kernel Offset: disabled [ 336.961678][ T7304] Rebooting in 86400 seconds..