last executing test programs: 3.846375103s ago: executing program 2 (id=4679): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[], 0x48}, 0x0) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000b00)) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000001440), 0x0, 0x0, 0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f00008c4000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000080)={0x170003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x2, 0xffffffffefffff15, 0x3, 0x2, 0x1, 0x4]}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 7) 3.166640857s ago: executing program 1 (id=4680): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008200122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x20, 0x0, 0x4, {0x8, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001100)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000dc0)={0x20, 0x0, 0x4, {0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.134583627s ago: executing program 2 (id=4681): r0 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r1, &(0x7f0000001040)={0xc, {"a2e3ad21ed0d52f91b5d350887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d160890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc825d8e524b2451138e495bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546850a27af9544ae15a7e454dea05918b4fd42513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cfe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2691491abf8ab9c015073014d9e08d4338b8780bdecd436cf0541e4505bc3a45237f104b962102de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd735892892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5407000000e3ad038f2211f1033195563c7f93cd54b9094f226e78b271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005008000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546def271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652770711935f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f42f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599af40005b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fd30d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb84d9a88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678458fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000bd700", 0xfffffffffffffd71}}, 0x375) mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) r3 = socket(0x10, 0x2, 0x4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x4c) setresuid(0x0, r4, r4) mount$9p_virtio(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', &(0x7f00000002c0), 0x22000, &(0x7f0000000500)=ANY=[@ANYBLOB="7472616e733d76697274696f2c6c6f6f73652c667363616368652c6163636573733d636c69656e742c63616368657461673d2c63616368653d7265616461686561642c6163636573733d616e792c6d73697a653d3078303030303030303030303030303030302c736d61636b66736465663d746d706673002c646f6e745f6d6561737572652c736d61636b6673666c6f6f723d62696e666d745f6d697363002c7569643e75319eb9fd8351c1a2a3660843530ac33c79f1a132fd30bda8c606b16b0a4b7e7b25eaf298a6da96a42b95615fa7de0c92", @ANYRESDEC=r4, @ANYBLOB=',context=root,\x00']) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x8000800000000000, 0x4, 0xa75a, 0x8, 0x40000000000001a, 0x6, 0x9, 0xffffffffffffffff, 0x100fff}) r5 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r5, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x3, &(0x7f00000001c0)=0x4, 0x4) mount(&(0x7f0000000400)=@sr0, &(0x7f0000000440)='./file1\x00', &(0x7f0000000480)='qnx4\x00', 0x10040, &(0x7f00000004c0)='usrquota') landlock_restrict_self(r0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="130110038e3ac620940601001378e201030109021200010e061003090439d8001adaa808"], 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x301200, 0x0) r7 = fsopen(&(0x7f00000003c0)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)=0x0) syz_open_procfs(r8, &(0x7f0000000140)='net/protocols\x00') r9 = fsmount(r7, 0x1, 0x2) fchdir(r9) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) lseek(r0, 0xc, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r9, 0xc018937a, &(0x7f0000000180)={{0x1, 0x1, 0x18, r7, {0x9a}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r6, 0xc0189371, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 2.218559897s ago: executing program 0 (id=4686): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x4dc8aa39}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe0b5bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf000000}, 0x0) 2.121775096s ago: executing program 0 (id=4687): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x80000, 0x0) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000200)=0x1) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000848) ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f00000000c0)={0x8, 0x0, '\x00', {0x0, @reserved}}) 1.96219882s ago: executing program 2 (id=4688): r0 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) ioctl$FIBMAP(r0, 0x1, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', &(0x7f0000000040)={0xd0000, 0xc, 0x24}, 0x18) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) getsockopt$PNPIPE_INITSTATE(r2, 0x113, 0x4, 0x0, &(0x7f0000000040)) renameat2(r1, &(0x7f0000000480)='.\x00', r1, &(0x7f00000004c0)='./bus\x00', 0x6) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) (async) ioctl$FIBMAP(r0, 0x1, 0x0) (async) socket$alg(0x26, 0x5, 0x0) (async) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', &(0x7f0000000040)={0xd0000, 0xc, 0x24}, 0x18) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async) getsockopt$PNPIPE_INITSTATE(r2, 0x113, 0x4, 0x0, &(0x7f0000000040)) (async) renameat2(r1, &(0x7f0000000480)='.\x00', r1, &(0x7f00000004c0)='./bus\x00', 0x6) (async) 1.742500834s ago: executing program 0 (id=4689): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="d8000000150081044e81f782db44b9040a1d080206000000040000a118000200ff05000000000e1208000f0100810401a80016eaa400010000005f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5e835913b06218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f52eb4edbb57a5025ccca9e00360d8bcc00400040fad95667e00600000000d5e1cace81b341139fe3cd4032e8edb12d1d2eb0c0ed0bfffdccf85df947e5e0", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) (fail_nth: 7) 1.698645748s ago: executing program 0 (id=4690): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$OCFS2_IOC_MOVE_EXT(r0, 0x40406f06, &(0x7f0000000040)={0x200, 0xffffffffffffffff, 0x1, 0xb0bd, 0x5}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x501000, 0x0) listen(r0, 0x1) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000140)={0x1b, 0x80000000, 0xc, 0x7, 0x0, 0x81}) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000012c35b400304106098c600e500010902120001000000000904", @ANYRESDEC], 0x0) 1.48186696s ago: executing program 1 (id=4691): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x3, 0x0, [{0x4d0, 0x0, 0x6}, {0xb48, 0x0, 0xd}, {0xbe8, 0x0, 0x2}]}) 1.312375392s ago: executing program 2 (id=4692): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x5, 0x0) (async, rerun: 32) openat(0xffffffffffffff9c, 0x0, 0x80000, 0x8d) (rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) (async) r0 = userfaultfd(0x80001) (async) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x24}}], 0x400000000000179, 0x0, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x30}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) move_pages(0x0, 0x1, &(0x7f0000000000)=[&(0x7f0000ffe000/0x1000)=nil], 0x0, 0x0, 0x0) (async, rerun: 32) r2 = timerfd_create(0x8, 0x80000) (rerun: 32) timerfd_settime(r2, 0x3, &(0x7f0000000640)={{0x0, 0x3938700}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) read(r3, &(0x7f0000000240)=""/123, 0x7b) (async, rerun: 64) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0x0, 0x3, 0xc, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x100, 0x0, 0x800, 0x9, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x100000001, 0x2, 0x1ff, 0x0, 0xa}) (rerun: 64) 1.254541551s ago: executing program 2 (id=4693): link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 1.213647332s ago: executing program 2 (id=4694): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r1 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r2, 0x13) tkill(r2, 0x12) waitid(0x0, 0x0, 0x0, 0x8, 0x0) r3 = syz_pidfd_open(r1, 0x0) setns(r3, 0x4000000) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINFO(r4, 0xc0104811, 0x0) 1.080949161s ago: executing program 1 (id=4695): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x7, 0x200ffffd, 0x10000005, 0xfffffff2, 0x2, "4d6b000400", 0x9, 0x9}) 994.422806ms ago: executing program 1 (id=4696): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000a40)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000980)={@flat=@weak_handle={0x77682a85, 0x10a, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x21}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f0000000a00)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) (fail_nth: 7) 935.164274ms ago: executing program 1 (id=4697): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) (rerun: 32) sendmsg$NL802154_CMD_GET_INTERFACE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x404}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x58, r1, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x78085bde31928701) r3 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r0) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x60, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x3ff}, @NL802154_ATTR_SEC_ENABLED={0x5, 0x29, 0x1}, @NL802154_ATTR_SEC_OUT_KEY_ID={0x2c, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}]}]}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async, rerun: 32) write$nci(0xffffffffffffffff, &(0x7f0000000340)=@NCI_OP_CORE_RESET_RSP={0x0, 0x0, 0x2, 0x0, 0x3, {0x0, 0x0, 0x8}}, 0x6) (rerun: 32) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r0) sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x54, r4, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x3}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0xa}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x78}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0x10}, @IEEE802154_ATTR_CHANNELS={0x8, 0x14, 0x11}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x3}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), r0) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r5, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40019601}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r6, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xaaa0}]}, 0x1c}}, 0x4080) (async) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r0, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x2c, r4, 0x902, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000084}, 0x4008000) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_KEY(r7, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x5c, r4, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "0015b9d4766b9284b391e92e5133f9e2"}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS={0x24, 0x32, "8e65f476b075a764f0973c996118851c7724aaa60661b59f15d222e437f6a0b3"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x607c25fa5f701f10}, 0x4080) (async) sendmsg$NFC_CMD_LLC_SDREQ(r7, &(0x7f0000000c00)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000bc0)={&(0x7f00000008c0)={0x2c4, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@NFC_ATTR_LLC_SDP={0xac, 0x13, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [{0x11, 0x1, '802.15.4 MAC\x00'}]}, {0xc, 0x0, 0x0, 0x1, [{0x5, 0x1, ','}]}, {0x38, 0x0, 0x0, 0x1, [{0x4}, {0xc, 0x1, '[&+#,#-\x00'}, {0x5, 0x1, '*'}, {0xd, 0x1, 'nl802154\x00'}, {0x9, 0x1, '[%@)('}]}, {0x4c, 0x0, 0x0, 0x1, [{0x5, 0x1, '/'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0xd, 0x1, 'nl802154\x00'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0x8, 0x1, 'nfc\x00'}]}]}, @NFC_ATTR_LLC_SDP={0xcc, 0x13, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [{0x4}]}, {0x24, 0x0, 0x0, 0x1, [{0xb, 0x1, '].&[#%,'}, {0xd, 0x1, 'nl802154\x00'}, {0x4}]}, {0x10, 0x0, 0x0, 0x1, [{0xa, 0x1, ')./\xdf:/'}]}, {0x80, 0x0, 0x0, 0x1, [{0x4}, {0xa, 0x1, 'wpan3\x00'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0xe, 0x1, '(}]%\'+#(*\\'}, {0x8, 0x1, 'nfc\x00'}, {0xd, 0x1, 'nl802154\x00'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0x5, 0x1, ','}]}, {0xc, 0x0, 0x0, 0x1, [{0x6, 0x1, '*)'}]}]}, @NFC_ATTR_LLC_SDP={0x114, 0x13, 0x0, 0x1, [{0x4}, {0x18, 0x0, 0x0, 0x1, [{0x11, 0x1, '802.15.4 MAC\x00'}]}, {0x58, 0x0, 0x0, 0x1, [{0x8, 0x1, 'nfc\x00'}, {0xa, 0x1, 'wpan3\x00'}, {0xd, 0x1, 'nl802154\x00'}, {0xa, 0x1, 'wpan3\x00'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0xf, 0x1, '+(,@#-][}.{'}]}, {0x44, 0x0, 0x0, 0x1, [{0x8, 0x1, '\xcf[#,'}, {0x8, 0x1, 'nfc\x00'}, {0x8, 0x1, 'nfc\x00'}, {0x6, 0x1, '-%'}, {0xd, 0x1, '$\x19%V-#:,:'}, {0x9, 0x1, ')))^\xee'}, {0x4}]}, {0x58, 0x0, 0x0, 0x1, [{0xd, 0x1, 'nl802154\x00'}, {0x8, 0x1, 'nfc\x00'}, {0xa, 0x1, '$.-^-*'}, {0x8, 0x1, 'nfc\x00'}, {0x8, 0x1, '#@*]'}, {0x11, 0x1, '802.15.4 MAC\x00'}, {0xa, 0x1, 'wpan3\x00'}]}]}, @NFC_ATTR_LLC_SDP={0x24, 0x13, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [{0x8, 0x1, ')/\'}'}, {0x11, 0x1, '802.15.4 MAC\x00'}]}]}]}, 0x2c4}, 0x1, 0x0, 0x0, 0x20008040}, 0x40080) (async) r8 = socket$tipc(0x1e, 0x2, 0x0) (async) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x24, 0x0, 0x2, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40) (async) r9 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) (async) sendmsg$IEEE802154_LIST_PHY(r0, &(0x7f0000000e40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x14, r4, 0x400, 0x70bd28, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) semctl$SEM_INFO(0x0, 0x1, 0x13, &(0x7f0000000e80)=""/249) r10 = pidfd_getfd(0xffffffffffffffff, r8, 0x0) (async) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000fc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r10, &(0x7f0000001080)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001040)={&(0x7f0000001000)={0x3c, r11, 0x100, 0x70bd25, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000001100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(r10, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x70, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x4, 0x17}}}}, [@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3ff}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xb}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x40000000}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x18}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xff}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1e}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async, rerun: 64) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r10, &(0x7f0000001300)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x30, 0x3, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x820}]}, @CTA_TUPLE_MASTER={0x10, 0xe, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040000}, 0x4000) (rerun: 64) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000001440)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001400)={&(0x7f0000001380)={0x50, r6, 0x402, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc, 0x4, {0xfffffffffffe0406}}}, @NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xc, 0x4, {0xaaaaaaaaaaaa0302}}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x50}}, 0x8004) (async) syz_ublk_setup_io_uring(0x344b, &(0x7f0000001480)={0x0, 0xc4e7, 0x2, 0x2, 0x35a, 0x0, r10}, &(0x7f0000001500)=0x0, &(0x7f0000001540), &(0x7f0000001580)) syz_ublk_add_dev(r10, r13, 0x0, 0x0, &(0x7f00000018c0)={0x2e, 0x0, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0xbacdf12a87960da0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000001880)=@new_dev={0x2, 0x49b, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x80}}}, &(0x7f0000001940)) 796.890189ms ago: executing program 3 (id=4698): ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0xfffffffd, 'syz0\x00'}, 0x1, [0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x6, 0x0, 0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x22d3cef2, 0x10000000000009, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff3e5, 0x0, 0x0, 0x10000000, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000000, 0x1, 0x0, 0xbffffffffffffffe, 0x0, 0xd4, 0x2, 0x0, 0x0, 0x0, 0x8000000000000001, 0x0, 0xed9b, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0xa0000000000, 0xffffffffffffffff, 0x4, 0x0, 0x4, 0x5, 0x0, 0x0, 0x80000, 0xae, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x7, 0x0, 0x200000]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fedbdf25fc0000000000000000f1000000000000ac1414bb00000000000000ecffffffffffffff04000000000a0060803b"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x700, &(0x7f0000000180)={&(0x7f00000007c0)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x4048000) 678.590834ms ago: executing program 1 (id=4699): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008200122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x20, 0x0, 0x4, {0x8, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001100)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000dc0)={0x20, 0x0, 0x4, {0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 645.73563ms ago: executing program 3 (id=4700): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x2, 0x2) r1 = syz_open_dev$vim2m(&(0x7f00000006c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000200)={0x2b, 0x2, 0x0, "bc3e098e0000f4ba89591da86b97000000002b00030400"}) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000000)={0x0, 0x1, 0x808000, 0x0, 0x0, 0xfa000, 0x65f40}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f00000000c0)=0x1) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000fedbdf253b00000008000300", @ANYRES32=r5, @ANYBLOB="44003300202c0000ffffffffffff080211000001ffffffffffff91001631040008021100000000002d1a10001e0100000001000000090009001900000006009bcd5b6304080026008f090000bba9a9f3020e0442aae488f5725bb0c34e00605122393cc7ff04e972b0d2f623c8feaa8c482df16a9a43dc53f4cfec9e0f5cb68937e8a9"], 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x20000000) 577.184773ms ago: executing program 3 (id=4701): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0xd) 466.601852ms ago: executing program 3 (id=4702): link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 443.546459ms ago: executing program 3 (id=4703): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000000)={0x3, 0x0, [{0x4d0, 0x0, 0x6}, {0xb48, 0x0, 0xd}, {0xbe8, 0x0, 0x2}]}) 339.359501ms ago: executing program 0 (id=4704): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000a40)=[@reply_sg={0x40486312, {0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000980)={@flat=@weak_handle={0x77682a85, 0x10a, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x21}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f0000000a00)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 174.325861ms ago: executing program 0 (id=4705): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x7ffffffff000, 0x3, &(0x7f0000fee000/0x2000)=nil) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r7, 0x40045612, &(0x7f0000000080)=0x2) ioctl$VIDIOC_DECODER_CMD(r7, 0xc0485660, &(0x7f0000000380)={0x1, 0x1, @raw_data=[0x92ab, 0x5, 0xfffffffa, 0x9, 0x1, 0x10, 0x2, 0x5, 0x67c5, 0x9, 0x3, 0x1, 0x9, 0xa8, 0x7, 0x400]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000a40)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x18, &(0x7f0000000980)={@flat=@weak_handle={0x77682a85, 0x10a, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x21}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f0000000a00)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 0s ago: executing program 3 (id=4706): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x28f, 0xfff, 0x1}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f00000000c0)={0x2, 0x6}, 0x2) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="000089142460", @ANYRES64=r2], 0xb2) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x4a, &(0x7f0000000240)=0xc04, 0x4) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) memfd_create(0x0, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffff80000001, 0x1680a2) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/rcu_normal', 0x82802, 0x8) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000000080)={r7, 0x0, {0x0, 0x0, 0x0, 0x1, 0x8000, 0x0, 0x0, 0x1e, 0xc, "faf900000080149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d665f985881a350000ddffffff00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601a8ca5b07dce141802c4dacf162e43ac6126c370ec00000000a04100", [0xffffffff7ffffce8, 0xa]}}) setsockopt$sock_int(r5, 0x1, 0x2a, &(0x7f00000002c0)=0xfffe, 0x4) recvmmsg(r5, &(0x7f0000000200)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002002, 0x0) kernel console output (not intermixed with test programs): ferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 779.450306][T12921] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 779.580314][T12921] usb 4-1: device descriptor read/64, error -71 [ 779.645938][ T5624] usb 3-1: USB disconnect, device number 69 [ 779.682955][ T5626] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 779.722943][ T5626] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 779.732286][ T5626] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 779.736346][ T5626] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 779.738926][ T5626] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 779.859394][T12921] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 780.118934][T12921] usb 4-1: device descriptor read/64, error -71 [ 780.229638][T12921] usb usb4-port1: attempt power cycle [ 780.415761][ T37] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 780.465660][T18406] FAULT_INJECTION: forcing a failure. [ 780.465660][T18406] name failslab, interval 1, probability 0, space 0, times 0 [ 780.465698][T18406] CPU: 0 UID: 0 PID: 18406 Comm: syz.2.4504 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 780.465724][T18406] Tainted: [L]=SOFTLOCKUP [ 780.465731][T18406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 780.465743][T18406] Call Trace: [ 780.465751][T18406] [ 780.465760][T18406] dump_stack_lvl+0xe8/0x150 [ 780.465789][T18406] should_fail_ex+0x46b/0x600 [ 780.465823][T18406] should_failslab+0xa8/0x100 [ 780.465850][T18406] __kmalloc_noprof+0xdf/0x7b0 [ 780.465878][T18406] ? ovl_lookup_index+0x151/0x790 [ 780.465906][T18406] ovl_lookup_index+0x151/0x790 [ 780.465935][T18406] ? ovl_lookup_layer+0x377/0x450 [ 780.465958][T18406] ? __pfx_ovl_lookup_index+0x10/0x10 [ 780.465991][T18406] ovl_lookup+0x1411/0x1c80 [ 780.466047][T18406] ? __pfx_ovl_lookup+0x10/0x10 [ 780.466070][T18406] ? __pfx_from_kgid+0x10/0x10 [ 780.466091][T18406] ? __pfx_ovl_permission+0x10/0x10 [ 780.466113][T18406] ? inode_permission+0x346/0x5f0 [ 780.466136][T18406] ? bpf_lsm_inode_permission+0x9/0x20 [ 780.466160][T18406] ? security_inode_permission+0xb7/0x2e0 [ 780.466187][T18406] ? may_o_create+0x2d2/0x370 [ 780.466212][T18406] ? bpf_lsm_inode_create+0x9/0x20 [ 780.466239][T18406] path_openat+0x11d5/0x3960 [ 780.466305][T18406] ? __pfx_path_openat+0x10/0x10 [ 780.466349][T18406] ? do_raw_spin_lock+0x12b/0x2f0 [ 780.466379][T18406] do_file_open+0x23e/0x4a0 [ 780.466404][T18406] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 780.466439][T18406] ? __pfx_do_file_open+0x10/0x10 [ 780.466462][T18406] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 780.466509][T18406] ? alloc_fd+0x679/0x6f0 [ 780.466544][T18406] do_sys_openat2+0x115/0x200 [ 780.466570][T18406] ? __pfx_do_sys_openat2+0x10/0x10 [ 780.466594][T18406] ? ksys_write+0x248/0x270 [ 780.466623][T18406] ? __pfx_ksys_write+0x10/0x10 [ 780.466653][T18406] __x64_sys_openat+0x138/0x170 [ 780.466679][T18406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.466700][T18406] do_syscall_64+0x174/0x580 [ 780.466728][T18406] ? trace_irq_disable+0x3b/0x140 [ 780.466749][T18406] ? clear_bhb_loop+0x40/0x90 [ 780.466773][T18406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.466793][T18406] RIP: 0033:0x7f0f0c64ce59 [ 780.466812][T18406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 780.466829][T18406] RSP: 002b:00007f0f0a89e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 780.466851][T18406] RAX: ffffffffffffffda RBX: 00007f0f0c8c5fa0 RCX: 00007f0f0c64ce59 [ 780.466866][T18406] RDX: 0000000000103841 RSI: 0000200000000400 RDI: ffffffffffffff9c [ 780.466880][T18406] RBP: 00007f0f0a89e090 R08: 0000000000000000 R09: 0000000000000000 [ 780.466893][T18406] R10: 0000000000000186 R11: 0000000000000246 R12: 0000000000000002 [ 780.466905][T18406] R13: 00007f0f0c8c6038 R14: 00007f0f0c8c5fa0 R15: 00007ffc73aaea28 [ 780.466936][T18406] [ 780.544208][ T37] ath9k_htc: Failed to initialize the device [ 780.561871][T18409] FAULT_INJECTION: forcing a failure. [ 780.561871][T18409] name fail_futex, interval 1, probability 0, space 0, times 1 [ 780.561902][T18409] CPU: 1 UID: 0 PID: 18409 Comm: syz.0.4505 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 780.561922][T18409] Tainted: [L]=SOFTLOCKUP [ 780.561927][T18409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 780.561936][T18409] Call Trace: [ 780.561942][T18409] [ 780.561949][T18409] dump_stack_lvl+0xe8/0x150 [ 780.561972][T18409] should_fail_ex+0x46b/0x600 [ 780.561997][T18409] get_futex_key+0x8d1/0x1590 [ 780.562014][T18409] ? _parse_integer_limit+0x192/0x1e0 [ 780.562042][T18409] ? __pfx_get_futex_key+0x10/0x10 [ 780.562058][T18409] ? kstrtouint+0x6e/0xe0 [ 780.562084][T18409] futex_wake_op+0x156/0xdd0 [ 780.562109][T18409] ? __pfx_futex_wake_op+0x10/0x10 [ 780.562130][T18409] ? do_raw_spin_lock+0x12b/0x2f0 [ 780.562151][T18409] do_futex+0x3bd/0x420 [ 780.562169][T18409] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 780.562194][T18409] ? __pfx_do_futex+0x10/0x10 [ 780.562210][T18409] ? rt_mutex_slowunlock+0x1cb/0x300 [ 780.562226][T18409] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 780.562247][T18409] __se_sys_futex+0x3a8/0x450 [ 780.562269][T18409] ? ksys_write+0x248/0x270 [ 780.562289][T18409] ? __pfx___se_sys_futex+0x10/0x10 [ 780.562308][T18409] ? __pfx_ksys_write+0x10/0x10 [ 780.562330][T18409] ? __x64_sys_futex+0x21/0xf0 [ 780.562349][T18409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.562364][T18409] do_syscall_64+0x174/0x580 [ 780.562384][T18409] ? trace_irq_disable+0x3b/0x140 [ 780.562399][T18409] ? clear_bhb_loop+0x40/0x90 [ 780.562416][T18409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.562430][T18409] RIP: 0033:0x7f1aa1dfce59 [ 780.562445][T18409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 780.562457][T18409] RSP: 002b:00007f1aa0056028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 780.562472][T18409] RAX: ffffffffffffffda RBX: 00007f1aa2075fa0 RCX: 00007f1aa1dfce59 [ 780.562483][T18409] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000200000000180 [ 780.562492][T18409] RBP: 00007f1aa0056090 R08: 0000000000000000 R09: 00000000affffffa [ 780.562501][T18409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 780.562509][T18409] R13: 00007f1aa2076038 R14: 00007f1aa2075fa0 R15: 00007ffc24897c18 [ 780.562532][T18409] [ 780.570317][T12921] usb 4-1: new full-speed USB device number 86 using dummy_hcd [ 780.591027][T12921] usb 4-1: device descriptor read/8, error -71 [ 780.693304][ T5624] usb 3-1: ath9k_htc: USB layer deinitialized [ 780.841331][T12921] usb 4-1: new full-speed USB device number 87 using dummy_hcd [ 780.861063][T12921] usb 4-1: device descriptor read/8, error -71 [ 781.006426][T12921] usb usb4-port1: unable to enumerate USB device [ 781.347672][ T1242] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 781.526250][T18397] wg2 speed is unknown, defaulting to 1000 [ 781.550206][ T5624] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 781.692867][ T1242] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 781.710468][ T5624] usb 3-1: Using ep0 maxpacket: 32 [ 781.712157][ T5624] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 781.712206][ T5624] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 781.712246][ T5624] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 781.712270][ T5624] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.715634][ T5624] usb 3-1: config 0 descriptor?? [ 781.775711][ T5624] hub 3-1:0.0: bad descriptor, ignoring hub [ 781.775741][ T5624] hub 3-1:0.0: probe with driver hub failed with error -5 [ 781.777538][ T5624] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 781.970267][ T5626] Bluetooth: hci4: command tx timeout [ 782.431316][ T1242] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 782.704086][T18447] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4515'. [ 782.710179][ T9] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 782.860241][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 782.887547][ T9] usb 1-1: config 1 interface 0 altsetting 19 endpoint 0x1 has invalid maxpacket 31731, setting to 1024 [ 782.887581][ T9] usb 1-1: config 1 interface 0 altsetting 19 bulk endpoint 0x1 has invalid maxpacket 1024 [ 782.887606][ T9] usb 1-1: config 1 interface 0 has no altsetting 0 [ 782.893449][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 782.893607][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 782.893628][ T9] usb 1-1: Product: syz [ 782.893642][ T9] usb 1-1: Manufacturer: syz [ 782.893658][ T9] usb 1-1: SerialNumber: syz [ 782.905820][T18437] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 783.035055][ T1242] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 783.410410][T18397] bridge0: port 1(bridge_slave_0) entered blocking state [ 783.410706][T18397] bridge0: port 1(bridge_slave_0) entered disabled state [ 783.436176][T18397] bridge_slave_0: entered allmulticast mode [ 783.453164][T18397] bridge_slave_0: entered promiscuous mode [ 783.527018][T18397] bridge0: port 2(bridge_slave_1) entered blocking state [ 783.527557][T18397] bridge0: port 2(bridge_slave_1) entered disabled state [ 783.528222][T18397] bridge_slave_1: entered allmulticast mode [ 783.534318][T18397] bridge_slave_1: entered promiscuous mode [ 783.692971][ T9] usb 1-1: USB disconnect, device number 110 [ 783.784401][T18397] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 783.789368][T18397] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 783.967817][T18397] team0: Port device team_slave_0 added [ 783.984678][T18397] team0: Port device team_slave_1 added [ 784.052459][ T5626] Bluetooth: hci4: command tx timeout [ 784.172330][T18397] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 784.172342][T18397] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 784.172358][T18397] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 784.177396][T18397] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 784.177407][T18397] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 784.177423][T18397] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 784.233977][T18458] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 784.575860][T12921] usb 3-1: reset high-speed USB device number 70 using dummy_hcd [ 784.613179][T12921] usb 3-1: device reset changed ep0 maxpacket size! [ 784.647733][T12921] usb 3-1: USB disconnect, device number 70 [ 784.710277][ T5624] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 784.804975][T18397] hsr_slave_0: entered promiscuous mode [ 784.806180][T18397] hsr_slave_1: entered promiscuous mode [ 784.807133][T18397] debugfs: 'hsr0' already exists in 'hsr' [ 784.807157][T18397] Cannot create hsr debugfs directory [ 784.844175][ T5624] usb 1-1: device descriptor read/64, error -71 [ 784.960194][T12921] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 784.990510][ T1242] bridge_slave_1: left allmulticast mode [ 784.990534][ T1242] bridge_slave_1: left promiscuous mode [ 784.990724][ T1242] bridge0: port 2(bridge_slave_1) entered disabled state [ 785.080095][ T5624] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 785.092165][ T1242] bridge_slave_0: left allmulticast mode [ 785.092200][ T1242] bridge_slave_0: left promiscuous mode [ 785.092492][ T1242] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.110104][T12921] usb 3-1: Using ep0 maxpacket: 8 [ 785.118704][T12921] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 785.118730][T12921] usb 3-1: config 0 has no interfaces? [ 785.137771][T12921] usb 3-1: New USB device found, idVendor=0c45, idProduct=614a, bcdDevice=c4.6d [ 785.137801][T12921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.137822][T12921] usb 3-1: Product: syz [ 785.137837][T12921] usb 3-1: Manufacturer: syz [ 785.137852][T12921] usb 3-1: SerialNumber: syz [ 785.167276][T12921] usb 3-1: config 0 descriptor?? [ 785.211151][ T5624] usb 1-1: device descriptor read/64, error -71 [ 785.264226][ T1242] hsr0: left allmulticast mode [ 785.264244][ T1242] hsr_slave_0: left allmulticast mode [ 785.264260][ T1242] hsr_slave_1: left allmulticast mode [ 785.278997][ T1242] dvmrp8: left allmulticast mode [ 785.320658][ T5624] usb usb1-port1: attempt power cycle [ 785.462672][T18463] netlink: 'syz.2.4518': attribute type 5 has an invalid length. [ 785.678439][ T5624] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 785.692334][ T5624] usb 1-1: device descriptor read/8, error -71 [ 785.930059][ T5624] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 785.950609][ T5624] usb 1-1: device descriptor read/8, error -71 [ 786.010537][ T1242] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 786.060604][ T5624] usb usb1-port1: unable to enumerate USB device [ 786.090782][ T1242] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 786.130002][ T5626] Bluetooth: hci4: command tx timeout [ 786.151927][ T1242] .` (unregistering): (slave dummy0): Releasing backup interface [ 786.177202][ T1242] .` (unregistering): Released all slaves [ 786.293200][ T5624] usb 3-1: USB disconnect, device number 71 [ 786.420886][ T1242] tipc: Disabling bearer [ 786.444275][ T5730] wg2 speed is unknown, defaulting to 1000 [ 786.449195][ T5730] syz1: Port: 1 Link DOWN [ 786.485360][ T1242] tipc: Left network mode [ 787.039949][ T5779] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 787.216118][ T5709] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 787.256485][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 787.284964][ T5779] usb 4-1: not running at top speed; connect to a high speed hub [ 787.307250][ T5779] usb 4-1: config 5 has an invalid interface number: 167 but max is 0 [ 787.307279][ T5779] usb 4-1: config 5 has no interface number 0 [ 787.307323][ T5779] usb 4-1: config 5 interface 167 altsetting 255 endpoint 0xD has invalid wMaxPacketSize 0 [ 787.307348][ T5779] usb 4-1: config 5 interface 167 altsetting 255 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 787.307376][ T5779] usb 4-1: config 5 interface 167 has no altsetting 0 [ 787.314019][ T5779] usb 4-1: New USB device found, idVendor=1608, idProduct=021a, bcdDevice=25.fd [ 787.314048][ T5779] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 787.314069][ T5779] usb 4-1: Product: syz [ 787.314084][ T5779] usb 4-1: Manufacturer: syz [ 787.314098][ T5779] usb 4-1: SerialNumber: syz [ 787.328519][T18478] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 787.407431][ T5709] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 787.407515][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 787.484569][ T5709] usb 3-1: config 0 descriptor?? [ 787.506919][ T5709] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 787.595271][T18493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 787.596381][T18493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 788.217788][ T5626] Bluetooth: hci4: command tx timeout [ 788.416513][ T5709] usb 3-1: USB disconnect, device number 72 [ 788.746431][T12921] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 788.902201][T12921] usb 1-1: Using ep0 maxpacket: 32 [ 788.910163][T12921] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 788.910213][T12921] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 788.910257][T12921] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 788.910281][T12921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 788.925380][T12921] usb 1-1: config 0 descriptor?? [ 788.974059][T12921] hub 1-1:0.0: bad descriptor, ignoring hub [ 788.974106][T12921] hub 1-1:0.0: probe with driver hub failed with error -5 [ 788.990154][T12921] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 789.219473][T18519] FAULT_INJECTION: forcing a failure. [ 789.219473][T18519] name failslab, interval 1, probability 0, space 0, times 0 [ 789.219496][T18519] CPU: 1 UID: 0 PID: 18519 Comm: syz.2.4527 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 789.219512][T18519] Tainted: [L]=SOFTLOCKUP [ 789.219516][T18519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 789.219523][T18519] Call Trace: [ 789.219528][T18519] [ 789.219534][T18519] dump_stack_lvl+0xe8/0x150 [ 789.219560][T18519] should_fail_ex+0x46b/0x600 [ 789.219580][T18519] should_failslab+0xa8/0x100 [ 789.219598][T18519] __kmalloc_cache_noprof+0x84/0x690 [ 789.219621][T18519] ? fuse_dentry_init+0x51/0x100 [ 789.219651][T18519] fuse_dentry_init+0x51/0x100 [ 789.219676][T18519] __d_alloc+0x483/0x6f0 [ 789.219705][T18519] d_alloc_parallel+0xe6/0x1610 [ 789.219730][T18519] ? __d_lookup+0x66/0x780 [ 789.219756][T18519] ? __d_lookup+0x66/0x780 [ 789.219785][T18519] ? __d_lookup+0x66/0x780 [ 789.219801][T18519] ? __pfx_d_alloc_parallel+0x10/0x10 [ 789.219815][T18519] ? d_lookup+0x1f/0xc0 [ 789.219830][T18519] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 789.219847][T18519] path_openat+0xccb/0x3960 [ 789.219879][T18519] ? __pfx_path_openat+0x10/0x10 [ 789.219901][T18519] ? do_raw_spin_lock+0x12b/0x2f0 [ 789.219917][T18519] do_file_open+0x23e/0x4a0 [ 789.219930][T18519] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 789.219949][T18519] ? __pfx_do_file_open+0x10/0x10 [ 789.219962][T18519] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 789.219986][T18519] ? alloc_fd+0x679/0x6f0 [ 789.220004][T18519] do_sys_openat2+0x115/0x200 [ 789.220018][T18519] ? __pfx_do_sys_openat2+0x10/0x10 [ 789.220030][T18519] ? ksys_write+0x248/0x270 [ 789.220046][T18519] ? __pfx_ksys_write+0x10/0x10 [ 789.220064][T18519] __x64_sys_openat+0x138/0x170 [ 789.220077][T18519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 789.220089][T18519] do_syscall_64+0x174/0x580 [ 789.220104][T18519] ? trace_irq_disable+0x3b/0x140 [ 789.220116][T18519] ? clear_bhb_loop+0x40/0x90 [ 789.220129][T18519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 789.220139][T18519] RIP: 0033:0x7f0f0c64ce59 [ 789.220151][T18519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 789.220160][T18519] RSP: 002b:00007f0f0a87d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 789.220172][T18519] RAX: ffffffffffffffda RBX: 00007f0f0c8c6090 RCX: 00007f0f0c64ce59 [ 789.220180][T18519] RDX: 0000000003002a8d RSI: 0000200000000a80 RDI: ffffffffffffff9c [ 789.220193][T18519] RBP: 00007f0f0a87d090 R08: 0000000000000000 R09: 0000000000000000 [ 789.220205][T18519] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 789.220216][T18519] R13: 00007f0f0c8c6128 R14: 00007f0f0c8c6090 R15: 00007ffc73aaea28 [ 789.220247][T18519] [ 789.221241][ T1242] hsr_slave_0: left promiscuous mode [ 789.245558][ T1242] hsr_slave_1: left promiscuous mode [ 789.246674][ T1242] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 789.246699][ T1242] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 789.281787][ T1242] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 789.281814][ T1242] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 789.368907][ T1242] veth1_macvtap: left promiscuous mode [ 789.369006][ T1242] veth0_macvtap: left promiscuous mode [ 789.369959][ T1242] veth1_vlan: left promiscuous mode [ 789.375555][ T1242] veth0_vlan: left promiscuous mode [ 789.709849][ T5779] io_ti 4-1:5.167: required endpoints missing [ 789.737003][ T5779] usb 4-1: USB disconnect, device number 88 [ 790.440139][ T1242] team0 (unregistering): Port device team_slave_1 removed [ 790.490444][ T1242] team0 (unregistering): Port device team_slave_0 removed [ 791.022154][T18530] lo speed is unknown, defaulting to 1000 [ 791.028842][T18530] lo speed is unknown, defaulting to 1000 [ 791.134946][T13460] smbdirect: ib_dev[syz1] removed [ 791.231075][ T5779] usb 3-1: new low-speed USB device number 73 using dummy_hcd [ 791.379751][ T5779] usb 3-1: device descriptor read/64, error -71 [ 791.389197][T18530] lo speed is unknown, defaulting to 1000 [ 791.692032][T12921] usb 1-1: USB disconnect, device number 115 [ 791.719748][ T5779] usb 3-1: new low-speed USB device number 74 using dummy_hcd [ 791.860641][T18545] netlink: 'syz.0.4534': attribute type 21 has an invalid length. [ 791.941694][ T5779] usb 3-1: device descriptor read/64, error -71 [ 792.050279][ T5779] usb usb3-port1: attempt power cycle [ 792.100763][T12921] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 792.271551][T12921] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 792.271576][T12921] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 792.271595][T12921] usb 1-1: config 0 has no interface number 0 [ 792.271623][T12921] usb 1-1: config 0 interface 2 has no altsetting 0 [ 792.342978][T12921] usb 1-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 792.343009][T12921] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 792.343028][T12921] usb 1-1: Product: syz [ 792.343043][T12921] usb 1-1: Manufacturer: syz [ 792.343057][T12921] usb 1-1: SerialNumber: syz [ 792.399585][ T5779] usb 3-1: new low-speed USB device number 75 using dummy_hcd [ 792.421631][ T5779] usb 3-1: device descriptor read/8, error -71 [ 792.483589][T12921] usb 1-1: config 0 descriptor?? [ 792.700669][ T5779] usb 3-1: new low-speed USB device number 76 using dummy_hcd [ 792.763361][ T5779] usb 3-1: device descriptor read/8, error -71 [ 792.869825][ T5779] usb usb3-port1: unable to enumerate USB device [ 792.985729][T12921] usb 1-1: USB disconnect, device number 116 [ 793.043532][T12921] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 793.128756][T18530] infiniband sz1: set active [ 793.128883][T18530] infiniband sz1: added lo [ 793.175453][ T1242] IPVS: stop unused estimator thread 0... [ 793.220050][ T5779] lo speed is unknown, defaulting to 1000 [ 793.314509][T18397] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 793.387122][T18530] smbdirect: ib_dev[sz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 793.387164][T18530] smbdirect: ib_dev[sz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 793.387206][T18530] smbdirect: ib_dev[sz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 793.395164][T18397] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 793.448761][T18397] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 793.548320][T18397] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 793.559533][T18397] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 793.615648][T18397] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 793.628197][T18530] RDS/IB: sz1: added [ 793.632938][T18397] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 793.665491][T18530] smc: adding ib device sz1 with port count 1 [ 793.666011][T18530] smc: ib device sz1 port 1 has no pnetid [ 793.695533][T18397] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 793.736061][ T5780] lo speed is unknown, defaulting to 1000 [ 793.791042][T18530] lo speed is unknown, defaulting to 1000 [ 793.991864][T18576] FAULT_INJECTION: forcing a failure. [ 793.991864][T18576] name failslab, interval 1, probability 0, space 0, times 0 [ 793.991899][T18576] CPU: 0 UID: 0 PID: 18576 Comm: syz.0.4535 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 793.991926][T18576] Tainted: [L]=SOFTLOCKUP [ 793.991934][T18576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 793.991945][T18576] Call Trace: [ 793.991953][T18576] [ 793.991962][T18576] dump_stack_lvl+0xe8/0x150 [ 793.991989][T18576] should_fail_ex+0x46b/0x600 [ 793.992022][T18576] should_failslab+0xa8/0x100 [ 793.992049][T18576] __kmalloc_noprof+0xdf/0x7b0 [ 793.992074][T18576] ? sock_kmalloc+0xd6/0x160 [ 793.992092][T18576] ? __local_bh_enable+0x1e1/0x2f0 [ 793.992125][T18576] sock_kmalloc+0xd6/0x160 [ 793.992147][T18576] af_alg_alloc_areq+0x99/0x200 [ 793.992175][T18576] skcipher_recvmsg+0x321/0x1140 [ 793.992227][T18576] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 793.992252][T18576] ? __lock_acquire+0x6b5/0x2d10 [ 793.992280][T18576] ? aa_sock_msg_perm+0x122/0x200 [ 793.992304][T18576] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 793.992332][T18576] sock_recvmsg_nosec+0x130/0x170 [ 793.992359][T18576] ____sys_recvmsg+0x23d/0x4f0 [ 793.992387][T18576] ? __pfx_____sys_recvmsg+0x10/0x10 [ 793.992422][T18576] ? import_iovec+0x73/0xa0 [ 793.992448][T18576] ___sys_recvmsg+0x215/0x590 [ 793.992466][T18576] ? get_pid_task+0x20/0x1f0 [ 793.992491][T18576] ? __pfx____sys_recvmsg+0x10/0x10 [ 793.992513][T18576] ? __fget_files+0x2a/0x420 [ 793.992554][T18576] ? __fget_files+0x3a6/0x420 [ 793.992587][T18576] __x64_sys_recvmsg+0x1c0/0x2a0 [ 793.992610][T18576] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 793.992639][T18576] ? __pfx_ksys_write+0x10/0x10 [ 793.992675][T18576] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.992697][T18576] do_syscall_64+0x174/0x580 [ 793.992726][T18576] ? trace_irq_disable+0x3b/0x140 [ 793.992748][T18576] ? clear_bhb_loop+0x40/0x90 [ 793.992772][T18576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.992791][T18576] RIP: 0033:0x7f1aa1dfce59 [ 793.992809][T18576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.992826][T18576] RSP: 002b:00007f1aa0056028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 793.992846][T18576] RAX: ffffffffffffffda RBX: 00007f1aa2075fa0 RCX: 00007f1aa1dfce59 [ 793.992861][T18576] RDX: 0000000000000000 RSI: 000020000000b680 RDI: 0000000000000004 [ 793.992873][T18576] RBP: 00007f1aa0056090 R08: 0000000000000000 R09: 0000000000000000 [ 793.992886][T18576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 793.992898][T18576] R13: 00007f1aa2076038 R14: 00007f1aa2075fa0 R15: 00007ffc24897c18 [ 793.992929][T18576] [ 794.329493][T18581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4537'. [ 794.353242][T18579] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4536'. [ 794.385019][T18397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 794.454978][T18578] sg_write: data in/out 422876/114 bytes for SCSI command 0x0-- guessing data in; [ 794.454978][T18578] program syz.0.4536 not setting count and/or reply_len properly [ 794.477456][T18397] 8021q: adding VLAN 0 to HW filter on device team0 [ 794.512625][T13460] bridge0: port 1(bridge_slave_0) entered blocking state [ 794.512864][T13460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 794.577684][T15019] bridge0: port 2(bridge_slave_1) entered blocking state [ 794.577890][T15019] bridge0: port 2(bridge_slave_1) entered forwarding state [ 794.837111][T18591] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 795.135037][T18530] lo speed is unknown, defaulting to 1000 [ 795.262123][ T38] audit: type=1326 audit(2000000297.106:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18590 comm="syz.0.4540" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1aa1dfce59 code=0x0 [ 795.684983][T18397] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 795.785948][T18530] lo speed is unknown, defaulting to 1000 [ 795.823339][T18397] veth0_vlan: entered promiscuous mode [ 795.874085][T18397] veth1_vlan: entered promiscuous mode [ 795.966357][T18397] veth0_macvtap: entered promiscuous mode [ 796.030994][T18397] veth1_macvtap: entered promiscuous mode [ 796.052664][T18607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4542'. [ 796.086219][T18397] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 796.088436][T18607] AppArmor: change_hat: Invalid input '0x0000000+]' [ 796.131279][T18397] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 796.182925][T15004] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.231520][T15004] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.233723][T15004] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 796.248160][T15004] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 797.167932][T18530] lo speed is unknown, defaulting to 1000 [ 797.565452][T13460] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 797.565472][T13460] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 797.759285][ T5780] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 798.031847][T13441] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 798.031867][T13441] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.267566][T18626] FAULT_INJECTION: forcing a failure. [ 798.267566][T18626] name failslab, interval 1, probability 0, space 0, times 0 [ 798.267596][T18626] CPU: 0 UID: 0 PID: 18626 Comm: syz.3.4549 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 798.267617][T18626] Tainted: [L]=SOFTLOCKUP [ 798.267623][T18626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 798.267633][T18626] Call Trace: [ 798.267639][T18626] [ 798.267647][T18626] dump_stack_lvl+0xe8/0x150 [ 798.267671][T18626] should_fail_ex+0x46b/0x600 [ 798.267697][T18626] should_failslab+0xa8/0x100 [ 798.267718][T18626] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 798.267736][T18626] ? __alloc_skb+0x1d0/0x7d0 [ 798.267756][T18626] ? lockdep_hardirqs_on+0x7a/0x110 [ 798.267784][T18626] __alloc_skb+0x1d0/0x7d0 [ 798.267809][T18626] netlink_sendmsg+0x5d4/0xb40 [ 798.267833][T18626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.267848][T18626] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 798.267870][T18626] ? aa_sock_msg_perm+0x122/0x200 [ 798.267885][T18626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 798.267898][T18626] sock_sendmsg_nosec+0x13a/0x180 [ 798.267926][T18626] ____sys_sendmsg+0x55c/0x870 [ 798.267953][T18626] ? __pfx_____sys_sendmsg+0x10/0x10 [ 798.267981][T18626] ? import_iovec+0x73/0xa0 [ 798.268000][T18626] ___sys_sendmsg+0x2a5/0x360 [ 798.268021][T18626] ? __lock_acquire+0x6b5/0x2d10 [ 798.268041][T18626] ? __pfx____sys_sendmsg+0x10/0x10 [ 798.268091][T18626] ? __fget_files+0x2a/0x420 [ 798.268108][T18626] ? __fget_files+0x3a6/0x420 [ 798.268132][T18626] __x64_sys_sendmsg+0x1c3/0x2a0 [ 798.268159][T18626] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 798.268190][T18626] ? __pfx_ksys_write+0x10/0x10 [ 798.268218][T18626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.268235][T18626] do_syscall_64+0x174/0x580 [ 798.268257][T18626] ? trace_irq_disable+0x3b/0x140 [ 798.268275][T18626] ? clear_bhb_loop+0x40/0x90 [ 798.268294][T18626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.268310][T18626] RIP: 0033:0x7f85b5aece59 [ 798.268327][T18626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.268342][T18626] RSP: 002b:00007f85b3d3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 798.268360][T18626] RAX: ffffffffffffffda RBX: 00007f85b5d65fa0 RCX: 00007f85b5aece59 [ 798.268374][T18626] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 798.268385][T18626] RBP: 00007f85b3d3e090 R08: 0000000000000000 R09: 0000000000000000 [ 798.268394][T18626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 798.268404][T18626] R13: 00007f85b5d66038 R14: 00007f85b5d65fa0 R15: 00007ffc035b5508 [ 798.268437][T18626] [ 798.939225][T12921] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 799.169329][T12921] usb 4-1: device descriptor read/64, error -71 [ 799.200548][T18637] syzkaller1: entered promiscuous mode [ 799.200565][T18637] syzkaller1: entered allmulticast mode [ 799.409732][T12921] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 799.539234][T12921] usb 4-1: device descriptor read/64, error -71 [ 799.549374][ T5779] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 799.651983][T12921] usb usb4-port1: attempt power cycle [ 799.711705][ T5779] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 799.711735][ T5779] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 799.711793][ T5779] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 799.740970][ T5779] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 799.741001][ T5779] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 799.741070][ T5779] usb 1-1: Product: syz [ 799.741085][ T5779] usb 1-1: Manufacturer: syz [ 799.741100][ T5779] usb 1-1: SerialNumber: syz [ 800.019504][ T5779] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 117 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 800.059954][T12921] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 800.081546][T12921] usb 4-1: device descriptor read/8, error -71 [ 800.319928][T12921] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 800.339943][T12921] usb 4-1: device descriptor read/8, error -71 [ 800.460405][T12921] usb usb4-port1: unable to enumerate USB device [ 800.879192][ T5779] usb 2-1: new low-speed USB device number 85 using dummy_hcd [ 801.031902][ T5779] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 801.031957][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 801.031986][ T5779] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 801.032012][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 801.032035][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 801.033220][ T5779] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 801.033322][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 801.033352][ T5779] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 801.033378][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 801.033396][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 801.049349][ T5779] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 801.049394][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 801.049409][ T5779] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 801.049423][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 801.049436][ T5779] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 801.122984][ T5779] usb 2-1: string descriptor 0 read error: -22 [ 801.123892][ T5779] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 801.123919][ T5779] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.230288][ T5779] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux1 [ 801.430972][T12921] usb 2-1: USB disconnect, device number 85 [ 801.745141][T18676] FAULT_INJECTION: forcing a failure. [ 801.745141][T18676] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 801.745175][T18676] CPU: 0 UID: 0 PID: 18676 Comm: syz.3.4564 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 801.745201][T18676] Tainted: [L]=SOFTLOCKUP [ 801.745208][T18676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 801.745218][T18676] Call Trace: [ 801.745226][T18676] [ 801.745234][T18676] dump_stack_lvl+0xe8/0x150 [ 801.745262][T18676] should_fail_ex+0x46b/0x600 [ 801.745294][T18676] _copy_from_iter+0x1d3/0x1670 [ 801.745325][T18676] ? __pfx__copy_from_iter+0x10/0x10 [ 801.745342][T18676] ? sock_alloc_send_pskb+0x8a2/0x9a0 [ 801.745368][T18676] ? __pfx__copy_from_iter+0x10/0x10 [ 801.745394][T18676] copy_page_from_iter+0x220/0x2d0 [ 801.745419][T18676] skb_copy_datagram_from_iter+0x306/0x710 [ 801.745449][T18676] packet_sendmsg+0x35be/0x4fd0 [ 801.745489][T18676] ? __lock_acquire+0x6b5/0x2d10 [ 801.745518][T18676] ? __lock_acquire+0x6b5/0x2d10 [ 801.745554][T18676] ? __pfx_packet_sendmsg+0x10/0x10 [ 801.745577][T18676] ? aa_sk_perm+0x703/0x950 [ 801.745602][T18676] ? __pfx_aa_sk_perm+0x10/0x10 [ 801.745619][T18676] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 801.745645][T18676] ? aa_sock_msg_perm+0x122/0x200 [ 801.745666][T18676] ? __pfx_packet_sendmsg+0x10/0x10 [ 801.745686][T18676] sock_sendmsg_nosec+0x13a/0x180 [ 801.745712][T18676] __sys_sendto+0x402/0x590 [ 801.745748][T18676] ? __pfx___sys_sendto+0x10/0x10 [ 801.745798][T18676] ? ksys_write+0x248/0x270 [ 801.745827][T18676] ? __pfx_ksys_write+0x10/0x10 [ 801.745858][T18676] __x64_sys_sendto+0xde/0x100 [ 801.745886][T18676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.745908][T18676] do_syscall_64+0x174/0x580 [ 801.745936][T18676] ? trace_irq_disable+0x3b/0x140 [ 801.745959][T18676] ? clear_bhb_loop+0x40/0x90 [ 801.745983][T18676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.746002][T18676] RIP: 0033:0x7f85b5aece59 [ 801.746021][T18676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 801.746038][T18676] RSP: 002b:00007f85b3d3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 801.746076][T18676] RAX: ffffffffffffffda RBX: 00007f85b5d65fa0 RCX: 00007f85b5aece59 [ 801.746095][T18676] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 801.746108][T18676] RBP: 00007f85b3d3e090 R08: 0000200000000140 R09: 0000000000000014 [ 801.746120][T18676] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000002 [ 801.746132][T18676] R13: 00007f85b5d66038 R14: 00007f85b5d65fa0 R15: 00007ffc035b5508 [ 801.746162][T18676] [ 802.139275][T12921] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 802.169025][ T5780] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 802.326999][T12921] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 802.327027][T12921] usb 4-1: config 1 has no interface number 0 [ 802.327074][T12921] usb 4-1: config 1 interface 105 has no altsetting 0 [ 802.338244][T12921] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 802.338271][T12921] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 802.338288][T12921] usb 4-1: Product: syz [ 802.338300][T12921] usb 4-1: Manufacturer: syz [ 802.338313][T12921] usb 4-1: SerialNumber: syz [ 802.352472][ T5779] usb 1-1: USB disconnect, device number 117 [ 802.372492][ T5780] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 802.372521][ T5780] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 802.372546][ T5780] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 802.372567][ T5780] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 802.382042][ T5779] usblp0: removed [ 802.399080][ T5780] usb 3-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 802.399117][ T5780] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 802.399138][ T5780] usb 3-1: Product: syz [ 802.399152][ T5780] usb 3-1: Manufacturer: syz [ 802.399167][ T5780] usb 3-1: SerialNumber: syz [ 802.431398][ T5780] usb 3-1: config 0 descriptor?? [ 802.528299][T18684] netlink: 'syz.0.4568': attribute type 3 has an invalid length. [ 802.528320][T18684] netlink: 'syz.0.4568': attribute type 1 has an invalid length. [ 802.528332][T18684] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4568'. [ 802.528347][T18684] NCSI netlink: No device for ifindex 0 [ 802.608327][T18687] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4569'. [ 802.647441][ T5780] ums-isd200 3-1:0.0: USB Mass Storage device detected [ 802.775861][ T5780] scsi host1: usb-storage 3-1:0.0 [ 802.811196][ T5780] usb 3-1: USB disconnect, device number 78 [ 803.634244][T12921] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 803.635470][T12921] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 803.661555][T12921] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 803.714936][T12921] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 6a:51:20:01:9d:b8 [ 803.733652][T12921] usb 4-1: USB disconnect, device number 93 [ 803.748229][T12921] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 803.875518][ T5780] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 803.888948][ T9] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 803.935965][T18706] random: crng reseeded on system resumption [ 803.971092][T12921] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 803.971228][T12921] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 803.971355][T12921] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 804.022062][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 804.022091][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 804.022113][ T5780] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 804.022126][ T5780] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 804.079005][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 804.234003][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 804.263087][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 804.263121][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 804.263144][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 804.263169][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 804.263190][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 804.263211][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 29440, setting to 1024 [ 804.263235][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 1024 [ 804.271489][ T9] usb 2-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 804.271519][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.271541][ T9] usb 2-1: Product: syz [ 804.271556][ T9] usb 2-1: Manufacturer: syz [ 804.271572][ T9] usb 2-1: SerialNumber: syz [ 804.385057][ T5780] usb 1-1: config 0 descriptor?? [ 804.392295][ T9] usb 2-1: config 0 descriptor?? [ 804.428667][T18697] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 804.429563][T18697] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 804.488653][T18710] tipc: Started in network mode [ 804.488671][T18710] tipc: Node identity da9d92bf0e2a, cluster identity 4711 [ 804.489457][T18710] tipc: Enabled bearer , priority 0 [ 804.515813][ T9] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 804.561625][T18709] tipc: Resetting bearer [ 804.703995][ T5779] usb 2-1: USB disconnect, device number 86 [ 804.719867][T18708] tipc: Disabling bearer [ 804.828648][ T5780] hid_parser_main: 437 callbacks suppressed [ 804.828672][ T5780] playstation 0003:054C:0DF2.004F: unknown main item tag 0x0 [ 804.828704][ T5780] playstation 0003:054C:0DF2.004F: unknown main item tag 0x0 [ 804.828877][ T5780] playstation 0003:054C:0DF2.004F: unknown main item tag 0x0 [ 804.828912][ T5780] playstation 0003:054C:0DF2.004F: unknown main item tag 0x0 [ 804.828940][ T5780] playstation 0003:054C:0DF2.004F: unknown main item tag 0x0 [ 804.854520][ T5780] playstation 0003:054C:0DF2.004F: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 805.015844][ T5780] playstation 0003:054C:0DF2.004F: Invalid reportID received, expected 9 got 45 [ 805.015961][ T5780] playstation 0003:054C:0DF2.004F: Failed to retrieve DualSense pairing info: -22 [ 805.016023][ T5780] playstation 0003:054C:0DF2.004F: Failed to get MAC address from DualSense [ 805.016064][ T5780] playstation 0003:054C:0DF2.004F: Failed to create dualsense. [ 805.059118][ T5780] playstation 0003:054C:0DF2.004F: probe with driver playstation failed with error -22 [ 805.228904][T12921] usb 1-1: USB disconnect, device number 118 [ 805.365132][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805cb69000: rx timeout, send abort [ 805.443786][ T5730] hid-generic 0000:0000:0000.0050: unknown main item tag 0x0 [ 805.566596][ T5730] hid-generic 0000:0000:0000.0050: hidraw0: HID v0.00 Device [syz1] on syz0 [ 805.865285][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805cb69000: abort rx timeout. Force session deactivation [ 805.870208][ C0] vcan0: j1939_tp_rxtimer: 0xffff888038f3e000: rx timeout, send abort [ 805.985975][T18731] syzkaller1: entered promiscuous mode [ 805.986001][T18731] syzkaller1: entered allmulticast mode [ 806.169585][T18723] hid-generic 0000:0000:0000.0050: pid 18723 passed too short report [ 806.379829][ C0] vcan0: j1939_tp_rxtimer: 0xffff888038f3e000: abort rx timeout. Force session deactivation [ 806.379929][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805b57f400: rx timeout, send abort [ 806.472943][T18734] FAULT_INJECTION: forcing a failure. [ 806.472943][T18734] name failslab, interval 1, probability 0, space 0, times 0 [ 806.472979][T18734] CPU: 1 UID: 0 PID: 18734 Comm: syz.1.4582 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 806.473007][T18734] Tainted: [L]=SOFTLOCKUP [ 806.473015][T18734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 806.473026][T18734] Call Trace: [ 806.473034][T18734] [ 806.473043][T18734] dump_stack_lvl+0xe8/0x150 [ 806.473072][T18734] should_fail_ex+0x46b/0x600 [ 806.473105][T18734] should_failslab+0xa8/0x100 [ 806.473131][T18734] __kmalloc_node_track_caller_noprof+0xe2/0x7e0 [ 806.473157][T18734] ? vfs_parse_monolithic_sep+0x21d/0x360 [ 806.473188][T18734] kmemdup_nul+0x36/0xf0 [ 806.473210][T18734] vfs_parse_monolithic_sep+0x21d/0x360 [ 806.473236][T18734] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 806.473262][T18734] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 806.473291][T18734] ? kstrdup+0x81/0x100 [ 806.473311][T18734] ? v9fs_init_fs_context+0x174/0x500 [ 806.473337][T18734] ? alloc_fs_context+0x9e9/0xd50 [ 806.473371][T18734] do_new_mount+0x304/0xd30 [ 806.473391][T18734] ? apparmor_capable+0x126/0x170 [ 806.473420][T18734] ? security_capable+0x7e/0x2c0 [ 806.473438][T18734] ? __pfx_do_new_mount+0x10/0x10 [ 806.473460][T18734] ? ns_capable+0x89/0xe0 [ 806.473490][T18734] ? path_mount+0x690/0x10e0 [ 806.473510][T18734] ? user_path_at+0xd4/0x160 [ 806.473538][T18734] ? user_path_at+0xd4/0x160 [ 806.473563][T18734] __se_sys_mount+0x31d/0x420 [ 806.473592][T18734] ? __pfx___se_sys_mount+0x10/0x10 [ 806.473621][T18734] ? __x64_sys_mount+0x20/0xc0 [ 806.473642][T18734] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.473663][T18734] do_syscall_64+0x174/0x580 [ 806.473691][T18734] ? trace_irq_disable+0x3b/0x140 [ 806.473712][T18734] ? clear_bhb_loop+0x40/0x90 [ 806.473736][T18734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.473756][T18734] RIP: 0033:0x7fb51ba5ce59 [ 806.473774][T18734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.473791][T18734] RSP: 002b:00007fb519cae028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 806.473812][T18734] RAX: ffffffffffffffda RBX: 00007fb51bcd5fa0 RCX: 00007fb51ba5ce59 [ 806.473827][T18734] RDX: 0000200000000080 RSI: 0000200000000000 RDI: 0000000000000000 [ 806.473840][T18734] RBP: 00007fb519cae090 R08: 0000200000000180 R09: 0000000000000000 [ 806.473853][T18734] R10: 000000000121484b R11: 0000000000000246 R12: 0000000000000002 [ 806.473872][T18734] R13: 00007fb51bcd6038 R14: 00007fb51bcd5fa0 R15: 00007ffc1396ab58 [ 806.473902][T18734] [ 806.839914][T18738] sctp: [Deprecated]: syz.0.4584 (pid 18738) Use of int in maxseg socket option. [ 806.839914][T18738] Use struct sctp_assoc_value instead [ 806.877893][T18740] program syz.3.4585 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 806.879975][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805b57f400: abort rx timeout. Force session deactivation [ 807.010630][T18745] FAULT_INJECTION: forcing a failure. [ 807.010630][T18745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 807.010664][T18745] CPU: 1 UID: 0 PID: 18745 Comm: syz.2.4587 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 807.010691][T18745] Tainted: [L]=SOFTLOCKUP [ 807.010698][T18745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 807.010710][T18745] Call Trace: [ 807.010719][T18745] [ 807.010727][T18745] dump_stack_lvl+0xe8/0x150 [ 807.010754][T18745] should_fail_ex+0x46b/0x600 [ 807.010784][T18745] _copy_from_user+0x2d/0xb0 [ 807.010807][T18745] ___sys_sendmsg+0x1c6/0x360 [ 807.010837][T18745] ? __lock_acquire+0x6b5/0x2d10 [ 807.010861][T18745] ? __pfx____sys_sendmsg+0x10/0x10 [ 807.010912][T18745] ? __fget_files+0x2a/0x420 [ 807.010925][T18745] ? __fget_files+0x3a6/0x420 [ 807.010941][T18745] __x64_sys_sendmsg+0x1c3/0x2a0 [ 807.010959][T18745] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 807.010978][T18745] ? __pfx_ksys_write+0x10/0x10 [ 807.010997][T18745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.011009][T18745] do_syscall_64+0x174/0x580 [ 807.011024][T18745] ? trace_irq_disable+0x3b/0x140 [ 807.011036][T18745] ? clear_bhb_loop+0x40/0x90 [ 807.011049][T18745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.011060][T18745] RIP: 0033:0x7f0f0c64ce59 [ 807.011071][T18745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 807.011081][T18745] RSP: 002b:00007f0f0a89e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 807.011093][T18745] RAX: ffffffffffffffda RBX: 00007f0f0c8c5fa0 RCX: 00007f0f0c64ce59 [ 807.011106][T18745] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 807.011117][T18745] RBP: 00007f0f0a89e090 R08: 0000000000000000 R09: 0000000000000000 [ 807.011129][T18745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 807.011140][T18745] R13: 00007f0f0c8c6038 R14: 00007f0f0c8c5fa0 R15: 00007ffc73aaea28 [ 807.011156][T18745] [ 807.217252][T18751] netlink: 'syz.1.4589': attribute type 17 has an invalid length. [ 807.409899][T12921] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 807.562598][T12921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 807.562623][T12921] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 807.562650][T12921] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 807.562666][T12921] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 807.565504][T12921] usb 3-1: config 0 descriptor?? [ 807.628783][ T9] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 807.778714][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 807.783235][ T5779] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 807.783935][ T9] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 807.783986][ T9] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 807.784216][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 807.866899][T12921] ath6kl: Failed to submit usb control message: -71 [ 807.866948][T12921] ath6kl: unable to send the bmi data to the device: -71 [ 807.866962][T12921] ath6kl: Unable to send get target info: -71 [ 807.915162][T12921] ath6kl: Failed to init ath6kl core: -71 [ 807.946468][T12921] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 807.956261][T12921] usb 3-1: USB disconnect, device number 79 [ 808.028735][ T5779] usb 2-1: Using ep0 maxpacket: 32 [ 808.037411][ T5779] usb 2-1: config 1 has an invalid interface number: 236 but max is 0 [ 808.037439][ T5779] usb 2-1: config 1 has no interface number 0 [ 808.037483][ T5779] usb 2-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 808.037505][ T5779] usb 2-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 808.037527][ T5779] usb 2-1: config 1 interface 236 has no altsetting 0 [ 808.088163][ T5779] usb 2-1: config 1 has an invalid interface number: 236 but max is 0 [ 808.088181][ T5779] usb 2-1: config 1 has no interface number 0 [ 808.088208][ T5779] usb 2-1: config 1 interface 236 altsetting 2 endpoint 0x5 has invalid wMaxPacketSize 0 [ 808.088220][ T5779] usb 2-1: config 1 interface 236 altsetting 2 bulk endpoint 0x5 has invalid maxpacket 0 [ 808.088240][ T5779] usb 2-1: config 1 interface 236 has no altsetting 0 [ 808.129556][ T5779] usb 2-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=aa.6a [ 808.129583][ T5779] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.129603][ T5779] usb 2-1: Product: syz [ 808.129616][ T5779] usb 2-1: Manufacturer: syz [ 808.129629][ T5779] usb 2-1: SerialNumber: syz [ 808.196718][ T5779] ti_usb_3410_5052 2-1:1.236: TI USB 5052 2 port adapter converter detected [ 808.419761][ T37] usb 2-1: USB disconnect, device number 87 [ 808.529836][T18769] binder: 18767:18769 ioctl 5607 0 returned -22 [ 808.630078][ T1354] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.630156][ T1354] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.022190][T18772] FAULT_INJECTION: forcing a failure. [ 809.022190][T18772] name failslab, interval 1, probability 0, space 0, times 0 [ 809.022225][T18772] CPU: 0 UID: 0 PID: 18772 Comm: syz.1.4596 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 809.022252][T18772] Tainted: [L]=SOFTLOCKUP [ 809.022259][T18772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 809.022271][T18772] Call Trace: [ 809.022279][T18772] [ 809.022287][T18772] dump_stack_lvl+0xe8/0x150 [ 809.022316][T18772] should_fail_ex+0x46b/0x600 [ 809.022348][T18772] should_failslab+0xa8/0x100 [ 809.022375][T18772] __kmalloc_node_track_caller_noprof+0xe2/0x7e0 [ 809.022403][T18772] ? vfs_parse_monolithic_sep+0x21d/0x360 [ 809.022434][T18772] kmemdup_nul+0x36/0xf0 [ 809.022455][T18772] vfs_parse_monolithic_sep+0x21d/0x360 [ 809.022482][T18772] ? __pfx_shmem_next_opt+0x10/0x10 [ 809.022508][T18772] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 809.022537][T18772] ? rt_spin_unlock+0x160/0x200 [ 809.022568][T18772] ? alloc_fs_context+0x9e9/0xd50 [ 809.022602][T18772] path_mount+0xd2a/0x10e0 [ 809.022630][T18772] ? user_path_at+0xd4/0x160 [ 809.022657][T18772] __se_sys_mount+0x31d/0x420 [ 809.022685][T18772] ? __pfx___se_sys_mount+0x10/0x10 [ 809.022714][T18772] ? __x64_sys_mount+0x20/0xc0 [ 809.022736][T18772] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.022757][T18772] do_syscall_64+0x174/0x580 [ 809.022784][T18772] ? trace_irq_disable+0x3b/0x140 [ 809.022807][T18772] ? clear_bhb_loop+0x40/0x90 [ 809.022831][T18772] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.022850][T18772] RIP: 0033:0x7fb51ba5ce59 [ 809.022869][T18772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 809.022886][T18772] RSP: 002b:00007fb519cae028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 809.022907][T18772] RAX: ffffffffffffffda RBX: 00007fb51bcd5fa0 RCX: 00007fb51ba5ce59 [ 809.022922][T18772] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000000 [ 809.022936][T18772] RBP: 00007fb519cae090 R08: 0000200000000040 R09: 0000000000000000 [ 809.022949][T18772] R10: 0000000000086022 R11: 0000000000000246 R12: 0000000000000002 [ 809.022962][T18772] R13: 00007fb51bcd6038 R14: 00007fb51bcd5fa0 R15: 00007ffc1396ab58 [ 809.022991][T18772] [ 809.858813][T12921] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 810.008650][T12921] usb 4-1: Using ep0 maxpacket: 8 [ 810.022188][T12921] usb 4-1: New USB device found, idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 810.022219][T12921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 810.022240][T12921] usb 4-1: Product: syz [ 810.022254][T12921] usb 4-1: Manufacturer: syz [ 810.022269][T12921] usb 4-1: SerialNumber: syz [ 810.036500][T12921] usb 4-1: config 0 descriptor?? [ 810.074571][T12921] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 810.231560][T18784] netlink: 128 bytes leftover after parsing attributes in process `syz.1.4601'. [ 810.237888][T18784] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 810.464119][ T5730] usb 1-1: USB disconnect, device number 119 [ 810.485369][T12921] gspca_sn9c2028: read1 error -71 [ 810.485748][T12921] gspca_sn9c2028: read1 error -71 [ 810.485823][T12921] sn9c2028 4-1:0.0: probe with driver sn9c2028 failed with error -71 [ 810.508092][T12921] usb 4-1: USB disconnect, device number 94 [ 810.688739][ T37] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 810.848645][ T37] usb 2-1: Using ep0 maxpacket: 16 [ 810.861392][ T37] usb 2-1: config index 0 descriptor too short (expected 51443, got 18) [ 810.863640][ T37] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 810.863669][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.863690][ T37] usb 2-1: Product: syz [ 810.863705][ T37] usb 2-1: Manufacturer: syz [ 810.863720][ T37] usb 2-1: SerialNumber: syz [ 810.902565][ T5779] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 810.924158][ T37] r8152-cfgselector 2-1: Unknown version 0x0000 [ 810.924175][ T37] r8152-cfgselector 2-1: config 0 descriptor?? [ 811.062288][ T5779] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 811.062309][ T5779] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 811.062331][ T5779] usb 3-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 811.062344][ T5779] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.134699][ T5779] usb 3-1: config 0 descriptor?? [ 811.337932][ T37] r8152-cfgselector 2-1: Unknown version 0x0000 [ 811.346737][ T37] r8152-cfgselector 2-1: No union descriptors [ 811.373512][ T37] r8152-cfgselector 2-1: USB disconnect, device number 88 [ 811.418513][T12921] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 811.438547][ T5730] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 811.546476][ T5779] usbhid 3-1:0.0: can't add hid device: -71 [ 811.546600][ T5779] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 811.565501][ T5779] usb 3-1: USB disconnect, device number 80 [ 811.569621][T12921] usb 4-1: Using ep0 maxpacket: 16 [ 811.581173][T12921] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86 [ 811.581197][T12921] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 811.581211][T12921] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 0 [ 811.581223][T12921] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 811.581236][T12921] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 811.584886][T12921] usb 4-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 811.584921][T12921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.584941][T12921] usb 4-1: Product: syz [ 811.584955][T12921] usb 4-1: Manufacturer: syz [ 811.584971][T12921] usb 4-1: SerialNumber: syz [ 811.589474][ T5730] usb 1-1: Using ep0 maxpacket: 8 [ 811.595694][ T5730] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 811.595726][ T5730] usb 1-1: config 0 interface 0 has no altsetting 0 [ 811.595759][ T5730] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 811.595781][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.711560][ T5730] usb 1-1: config 0 descriptor?? [ 811.712316][T12921] usb 4-1: config 0 descriptor?? [ 811.725622][T12921] port100 4-1:0.0: NFC: Could not get supported command types [ 811.925526][T18803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.926008][T18803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.947626][ T5779] usb 4-1: USB disconnect, device number 95 [ 812.274501][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x3 [ 812.274538][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274565][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274591][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274618][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274645][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274672][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274698][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274725][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.274751][ T5730] kovaplus 0003:1E7D:2D50.0051: unknown main item tag 0x0 [ 812.294946][ T5730] kovaplus 0003:1E7D:2D50.0051: hidraw0: USB HID v0.04 Device [HID 1e7d:2d50] on usb-dummy_hcd.0-1/input0 [ 812.502188][T18805] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4608'. [ 812.585348][ T5730] usb 1-1: USB disconnect, device number 120 [ 812.758434][ T37] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 812.848591][T15009] wlan1: Trigger new scan to find an IBSS to join [ 812.908407][ T37] usb 4-1: Using ep0 maxpacket: 8 [ 812.910686][ T37] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 812.910736][ T37] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 812.910778][ T37] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 812.910809][ T37] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 812.974901][ T37] usbtmc 4-1:16.0: bulk endpoints not found [ 813.023323][T18824] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4614'. [ 813.228490][ T5779] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 813.319366][ T37] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 813.378432][ T5779] usb 2-1: Using ep0 maxpacket: 32 [ 813.380589][ T5779] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 813.380634][ T5779] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 813.380658][ T5779] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.386725][ T5779] usb 2-1: config 0 descriptor?? [ 813.435347][ T5779] hub 2-1:0.0: bad descriptor, ignoring hub [ 813.435501][ T5779] hub 2-1:0.0: probe with driver hub failed with error -5 [ 813.452094][ T5779] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 813.501998][ T37] usb 3-1: unable to get BOS descriptor or descriptor too short [ 813.502907][ T37] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 813.504623][ T37] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 813.504638][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 813.504648][ T37] usb 3-1: Product: syz [ 813.504656][ T37] usb 3-1: Manufacturer: syz [ 813.504664][ T37] usb 3-1: SerialNumber: syz [ 813.708391][ T5730] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 813.767571][ T37] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 813.860433][ T5730] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 813.860468][ T5730] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 813.860507][ T5730] usb 1-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 813.860531][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.865664][ T5730] usb 1-1: config 0 descriptor?? [ 814.391575][T18824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 814.392294][T18824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 814.452057][ T37] usb 3-1: parse_audio_format_rates_v2v3(): unable to retrieve sample rate range (clock 0) [ 814.473391][ T5730] usbhid 1-1:0.0: can't add hid device: -71 [ 814.473467][ T5730] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 814.503417][ T5730] usb 1-1: USB disconnect, device number 121 [ 814.543333][ T37] usb 3-1: USB disconnect, device number 81 [ 814.591504][ T5772] udevd[5772]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 815.319430][ T5780] usb 4-1: USB disconnect, device number 96 [ 815.371880][ T37] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 815.398334][ T5730] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 815.498425][ T37] usb 1-1: device descriptor read/64, error -71 [ 815.548249][ T5730] usb 3-1: Using ep0 maxpacket: 32 [ 815.550862][ T5730] usb 3-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 815.550895][ T5730] usb 3-1: config 0 interface 0 has no altsetting 0 [ 815.550918][ T5730] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 815.550932][ T5730] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 815.554470][ T5730] usb 3-1: config 0 descriptor?? [ 815.718280][ T5780] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 815.738228][ T37] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 815.869701][ T5780] usb 4-1: Using ep0 maxpacket: 8 [ 815.869861][ T37] usb 1-1: device descriptor read/64, error -71 [ 815.871755][ T5780] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 815.871787][ T5780] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 815.871903][ T5780] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 815.871929][ T5780] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 815.871984][ T5780] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 815.872008][ T5780] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 815.983158][ T37] usb usb1-port1: attempt power cycle [ 816.146453][ T5780] usb 4-1: GET_CAPABILITIES returned 0 [ 816.146492][ T5780] usbtmc 4-1:16.0: can't read capabilities [ 816.315689][ T5709] usb 2-1: reset high-speed USB device number 89 using dummy_hcd [ 816.322104][ T37] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 816.339034][ T37] usb 1-1: device descriptor read/8, error -71 [ 816.347852][T18845] FAULT_INJECTION: forcing a failure. [ 816.347852][T18845] name failslab, interval 1, probability 0, space 0, times 0 [ 816.347875][T18845] CPU: 1 UID: 0 PID: 18845 Comm: syz.3.4622 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 816.347893][T18845] Tainted: [L]=SOFTLOCKUP [ 816.347900][T18845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 816.347913][T18845] Call Trace: [ 816.347920][T18845] [ 816.347929][T18845] dump_stack_lvl+0xe8/0x150 [ 816.347959][T18845] should_fail_ex+0x46b/0x600 [ 816.347994][T18845] should_failslab+0xa8/0x100 [ 816.348018][T18845] __kmalloc_noprof+0xdf/0x7b0 [ 816.348031][T18845] ? tomoyo_encode+0x28b/0x550 [ 816.348049][T18845] tomoyo_encode+0x28b/0x550 [ 816.348071][T18845] tomoyo_realpath_from_path+0x58d/0x5d0 [ 816.348102][T18845] ? tomoyo_path_number_perm+0x219/0x630 [ 816.348132][T18845] tomoyo_path_number_perm+0x246/0x630 [ 816.348164][T18845] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 816.348192][T18845] ? __lock_acquire+0x6b5/0x2d10 [ 816.348209][T18845] ? do_raw_spin_lock+0x12b/0x2f0 [ 816.348235][T18845] ? __fget_files+0x2a/0x420 [ 816.348254][T18845] ? __fget_files+0x2a/0x420 [ 816.348276][T18845] ? __fget_files+0x3a6/0x420 [ 816.348297][T18845] ? __fget_files+0x2a/0x420 [ 816.348324][T18845] security_file_ioctl+0xc3/0x2a0 [ 816.348353][T18845] __se_sys_ioctl+0x47/0x170 [ 816.348372][T18845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.348384][T18845] do_syscall_64+0x174/0x580 [ 816.348399][T18845] ? trace_irq_disable+0x3b/0x140 [ 816.348413][T18845] ? clear_bhb_loop+0x40/0x90 [ 816.348437][T18845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.348457][T18845] RIP: 0033:0x7f85b5aece59 [ 816.348475][T18845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.348493][T18845] RSP: 002b:00007f85b3d3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 816.348514][T18845] RAX: ffffffffffffffda RBX: 00007f85b5d65fa0 RCX: 00007f85b5aece59 [ 816.348528][T18845] RDX: 0000000000000000 RSI: 0000000040015b0b RDI: 0000000000000004 [ 816.348534][T18845] RBP: 00007f85b3d3e090 R08: 0000000000000000 R09: 0000000000000000 [ 816.348541][T18845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 816.348553][T18845] R13: 00007f85b5d66038 R14: 00007f85b5d65fa0 R15: 00007ffc035b5508 [ 816.348570][T18845] [ 816.350345][T18845] ERROR: Out of memory at tomoyo_realpath_from_path. [ 816.352285][ T5780] usb 4-1: USB disconnect, device number 97 [ 816.435514][T18849] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 816.436360][T18849] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.569419][ T5709] usb 2-1: device firmware changed [ 816.570676][ T5709] usb 2-1: USB disconnect, device number 89 [ 816.580385][ T37] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 816.598848][ T37] usb 1-1: device descriptor read/8, error -71 [ 816.709469][ T37] usb usb1-port1: unable to enumerate USB device [ 816.878316][ T5709] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 816.945429][T18852] netlink: 188 bytes leftover after parsing attributes in process `syz.3.4624'. [ 817.033181][ T5709] usb 2-1: Using ep0 maxpacket: 32 [ 817.035414][ T5709] usb 2-1: config 127 has an invalid interface number: 167 but max is 0 [ 817.035440][ T5709] usb 2-1: config 127 has no interface number 0 [ 817.035485][ T5709] usb 2-1: config 127 interface 167 altsetting 13 bulk endpoint 0x9 has invalid maxpacket 64 [ 817.035512][ T5709] usb 2-1: config 127 interface 167 has no altsetting 0 [ 817.037808][ T5709] usb 2-1: New USB device found, idVendor=12d1, idProduct=1464, bcdDevice=b7.17 [ 817.037836][ T5709] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 817.037857][ T5709] usb 2-1: Product: syz [ 817.037872][ T5709] usb 2-1: Manufacturer: syz [ 817.037882][ T5709] usb 2-1: SerialNumber: syz [ 817.049683][T18848] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 817.260776][T18848] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.262369][T18848] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.288217][ T5780] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 817.418185][ T5780] usb 1-1: device descriptor read/64, error -71 [ 817.519822][ T5709] option 2-1:127.167: GSM modem (1-port) converter detected [ 817.534974][ T5709] usb 2-1: USB disconnect, device number 90 [ 817.566802][ T5709] option 2-1:127.167: device disconnected [ 817.658825][ T5780] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 817.788225][ T5780] usb 1-1: device descriptor read/64, error -71 [ 817.818173][T15004] wlan1: Trigger new scan to find an IBSS to join [ 817.898756][ T5780] usb usb1-port1: attempt power cycle [ 818.184766][ T5730] usbhid 3-1:0.0: can't add hid device: -71 [ 818.184890][ T5730] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 818.222675][ T5730] usb 3-1: USB disconnect, device number 82 [ 818.550841][T18876] FAULT_INJECTION: forcing a failure. [ 818.550841][T18876] name failslab, interval 1, probability 0, space 0, times 0 [ 818.550864][T18876] CPU: 0 UID: 0 PID: 18876 Comm: syz.0.4633 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 818.550880][T18876] Tainted: [L]=SOFTLOCKUP [ 818.550884][T18876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 818.550891][T18876] Call Trace: [ 818.550896][T18876] [ 818.550901][T18876] dump_stack_lvl+0xe8/0x150 [ 818.550916][T18876] should_fail_ex+0x46b/0x600 [ 818.550934][T18876] should_failslab+0xa8/0x100 [ 818.550949][T18876] kmem_cache_alloc_noprof+0x87/0x680 [ 818.550962][T18876] ? skb_clone+0x212/0x3a0 [ 818.550974][T18876] skb_clone+0x212/0x3a0 [ 818.550986][T18876] __netlink_deliver_tap+0x424/0x8b0 [ 818.551008][T18876] ? netlink_deliver_tap+0x2e/0x1b0 [ 818.551024][T18876] netlink_deliver_tap+0x19c/0x1b0 [ 818.551040][T18876] netlink_sendskb+0x68/0x140 [ 818.551055][T18876] netlink_rcv_skb+0x2b6/0x4b0 [ 818.551071][T18876] ? __pfx_genl_rcv_msg+0x10/0x10 [ 818.551084][T18876] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 818.551106][T18876] ? netlink_deliver_tap+0x2e/0x1b0 [ 818.551121][T18876] ? netlink_deliver_tap+0x2e/0x1b0 [ 818.551138][T18876] genl_rcv+0x28/0x40 [ 818.551149][T18876] netlink_unicast+0x780/0x920 [ 818.551169][T18876] netlink_sendmsg+0x813/0xb40 [ 818.551183][T18876] ? __pfx_netlink_sendmsg+0x10/0x10 [ 818.551195][T18876] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 818.551211][T18876] ? aa_sock_msg_perm+0x122/0x200 [ 818.551223][T18876] ? __pfx_netlink_sendmsg+0x10/0x10 [ 818.551233][T18876] sock_sendmsg_nosec+0x13a/0x180 [ 818.551246][T18876] ____sys_sendmsg+0x55c/0x870 [ 818.551266][T18876] ? __pfx_____sys_sendmsg+0x10/0x10 [ 818.551286][T18876] ? import_iovec+0x73/0xa0 [ 818.551300][T18876] ___sys_sendmsg+0x2a5/0x360 [ 818.551315][T18876] ? __lock_acquire+0x6b5/0x2d10 [ 818.551330][T18876] ? __pfx____sys_sendmsg+0x10/0x10 [ 818.551370][T18876] ? __fget_files+0x2a/0x420 [ 818.551382][T18876] ? __fget_files+0x3a6/0x420 [ 818.551399][T18876] __x64_sys_sendmsg+0x1c3/0x2a0 [ 818.551416][T18876] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 818.551436][T18876] ? __pfx_ksys_write+0x10/0x10 [ 818.551455][T18876] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.551467][T18876] do_syscall_64+0x174/0x580 [ 818.551482][T18876] ? trace_irq_disable+0x3b/0x140 [ 818.551494][T18876] ? clear_bhb_loop+0x40/0x90 [ 818.551507][T18876] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.551518][T18876] RIP: 0033:0x7f1aa1dfce59 [ 818.551528][T18876] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.551538][T18876] RSP: 002b:00007f1aa0056028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 818.551550][T18876] RAX: ffffffffffffffda RBX: 00007f1aa2075fa0 RCX: 00007f1aa1dfce59 [ 818.551558][T18876] RDX: 0000000004000044 RSI: 00002000000008c0 RDI: 0000000000000003 [ 818.551565][T18876] RBP: 00007f1aa0056090 R08: 0000000000000000 R09: 0000000000000000 [ 818.551572][T18876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 818.551578][T18876] R13: 00007f1aa2076038 R14: 00007f1aa2075fa0 R15: 00007ffc24897c18 [ 818.551595][T18876] [ 818.678103][ T5709] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 818.778107][ T37] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 818.932508][ T5709] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 818.932528][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 818.932539][ T5709] usb 3-1: Product: syz [ 818.932547][ T5709] usb 3-1: SerialNumber: syz [ 819.015948][T15004] wlan1: Creating new IBSS network, BSSID 36:9a:80:ba:fb:45 [ 819.033810][ T5709] usb 3-1: config 0 descriptor?? [ 819.070160][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 819.070195][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 819.070256][ T37] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 819.070269][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 819.077623][ T37] usb 2-1: config 0 descriptor?? [ 819.150824][ T37] hub 2-1:0.0: USB hub found [ 819.297170][ T37] hub 2-1:0.0: 1 port detected [ 819.313571][ T5709] hso 3-1:0.0: Failed to find BULK eps [ 819.592020][T18883] netlink: 108 bytes leftover after parsing attributes in process `syz.0.4636'. [ 819.678147][ T5730] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 819.828027][ T5730] usb 4-1: Using ep0 maxpacket: 32 [ 819.840223][ T5730] usb 4-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 819.840254][ T5730] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.840274][ T5730] usb 4-1: Product: syz [ 819.840289][ T5730] usb 4-1: Manufacturer: syz [ 819.840303][ T5730] usb 4-1: SerialNumber: syz [ 819.883422][ T5730] usb 4-1: config 0 descriptor?? [ 819.907401][ T5730] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 820.148701][ T5730] gspca_ov534_9: reg_w failed -71 [ 820.588068][ T5730] gspca_ov534_9: Unknown sensor 0000 [ 820.588215][ T5730] ov534_9 4-1:0.0: probe with driver ov534_9 failed with error -22 [ 820.612748][ T5730] usb 4-1: USB disconnect, device number 98 [ 820.709210][ T37] hub 2-1:0.0: hub_hub_status failed (err = -110) [ 820.709309][ T37] hub 2-1:0.0: config failed, can't get hub status (err -110) [ 820.716774][ T37] usbhid 2-1:0.0: can't add hid device: -32 [ 820.716899][ T37] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 820.932668][ T5779] usb 3-1: USB disconnect, device number 83 [ 820.958346][ T5730] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 821.008265][ T5626] Bluetooth: hci1: command 0x0406 tx timeout [ 821.128005][ T5730] usb 4-1: Using ep0 maxpacket: 32 [ 821.129988][ T5730] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 821.130017][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 821.134492][ T5730] usb 4-1: config 0 descriptor?? [ 821.138044][ T37] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 821.174981][ T5730] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 821.289994][ T37] usb 1-1: config 1 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 821.290030][ T37] usb 1-1: config 1 interface 0 has no altsetting 0 [ 821.292303][ T37] usb 1-1: New USB device found, idVendor=0c70, idProduct=f003, bcdDevice= 0.40 [ 821.292330][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.292351][ T37] usb 1-1: Product: syz [ 821.292366][ T37] usb 1-1: Manufacturer: syz [ 821.292381][ T37] usb 1-1: SerialNumber: syz [ 821.598409][ T37] usbhid 1-1:1.0: can't add hid device: -71 [ 821.600275][ T37] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 821.613781][ T37] usb 1-1: USB disconnect, device number 3 [ 821.688360][ T5730] gspca_vc032x: reg_r err -110 [ 821.688378][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688389][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688397][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688407][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688417][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688425][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688435][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688444][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688453][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688462][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688471][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688480][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688489][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688498][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688508][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688517][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688526][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688534][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 821.688542][ T5730] gspca_vc032x: Unknown sensor... [ 821.688620][ T5730] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 821.768933][ T5780] usb 2-1: reset full-speed USB device number 91 using dummy_hcd [ 821.769569][ T5780] usb 2-1: device reset changed ep0 maxpacket size! [ 821.772831][ T5780] usb 2-1: USB disconnect, device number 91 [ 822.078054][ T5780] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 822.189285][ T9] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 822.231177][ T5780] usb 2-1: unable to get BOS descriptor or descriptor too short [ 822.231925][ T5780] usb 2-1: not running at top speed; connect to a high speed hub [ 822.235536][ T5780] usb 2-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice= 0.40 [ 822.235565][ T5780] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.235585][ T5780] usb 2-1: Product: syz [ 822.235599][ T5780] usb 2-1: Manufacturer: syz [ 822.235609][ T5780] usb 2-1: SerialNumber: syz [ 822.368901][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 822.371731][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 822.371781][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 822.374751][ T9] usb 3-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 822.374779][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.374799][ T9] usb 3-1: Product: syz [ 822.374813][ T9] usb 3-1: Manufacturer: syz [ 822.374828][ T9] usb 3-1: SerialNumber: syz [ 822.440326][ T9] usb 3-1: config 0 descriptor?? [ 822.454226][ T9] port100 3-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 822.524714][ T5780] usb 2-1: Invalid firmware size=18. [ 822.540099][ T5780] usb 2-1: USB disconnect, device number 92 [ 822.573172][T18912] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4645'. [ 822.591484][T18912] fuse: Unknown parameter 'fdC0x000000000000000d' [ 822.647575][ T37] usb 3-1: USB disconnect, device number 84 [ 823.080931][T18917] Set syz1 is full, maxelem 2 reached [ 823.397853][ T37] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 823.468140][ T5780] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 823.547909][ T37] usb 2-1: Using ep0 maxpacket: 32 [ 823.551595][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 823.551628][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 823.551666][ T37] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 823.551689][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 823.556620][ T37] usb 2-1: config 0 descriptor?? [ 823.566085][ T37] hub 2-1:0.0: USB hub found [ 823.618501][ T5780] usb 3-1: Using ep0 maxpacket: 8 [ 823.625445][ T5780] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 823.625477][ T5780] usb 3-1: config 0 interface 0 has no altsetting 0 [ 823.625568][ T5780] usb 3-1: New USB device found, idVendor=1532, idProduct=011d, bcdDevice= 0.00 [ 823.625593][ T5780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 823.672710][ T5779] usb 4-1: USB disconnect, device number 99 [ 823.676516][ T5780] usb 3-1: config 0 descriptor?? [ 823.771845][ T37] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 824.011201][ T37] usbhid 2-1:0.0: can't add hid device: -71 [ 824.011467][ T37] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 824.040864][ T37] usb 2-1: USB disconnect, device number 93 [ 824.104239][ T5780] hid_parser_main: 23 callbacks suppressed [ 824.104262][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104293][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104320][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104346][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104388][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104414][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104441][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104473][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104499][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.104524][ T5780] hid-rmi 0003:1532:011D.0052: unknown main item tag 0x0 [ 824.131422][ T5780] hid-rmi 0003:1532:011D.0052: hidraw0: USB HID v0.08 Device [HID 1532:011d] on usb-dummy_hcd.2-1/input0 [ 824.173065][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 824.314946][ T37] usb 3-1: USB disconnect, device number 85 [ 824.349543][ T9] usb 1-1: config 39 has an invalid interface number: 111 but max is 1 [ 824.349572][ T9] usb 1-1: config 39 has an invalid interface number: 122 but max is 1 [ 824.349593][ T9] usb 1-1: config 39 has no interface number 0 [ 824.349610][ T9] usb 1-1: config 39 has no interface number 1 [ 824.349647][ T9] usb 1-1: config 39 interface 111 has no altsetting 0 [ 824.349657][ T9] usb 1-1: config 39 interface 122 has no altsetting 0 [ 824.353312][ T9] usb 1-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=81.96 [ 824.353409][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.353431][ T9] usb 1-1: Product: syz [ 824.353446][ T9] usb 1-1: Manufacturer: syz [ 824.353460][ T9] usb 1-1: SerialNumber: syz [ 824.577400][T18931] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4651'. [ 824.676710][ T9] usbhid 1-1:39.122: couldn't find an input interrupt endpoint [ 824.696224][ T9] usb 1-1: USB disconnect, device number 4 [ 825.061341][T18942] netlink: 92 bytes leftover after parsing attributes in process `syz.2.4656'. [ 825.127815][T12921] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 825.176013][T18944] FAT-fs (nbd2): unable to read boot sector [ 825.299006][T12921] usb 4-1: unable to get BOS descriptor or descriptor too short [ 825.300665][T12921] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 825.300680][T12921] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 825.300714][T12921] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 825.303826][T12921] usb 4-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 825.303842][T12921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.303860][T12921] usb 4-1: Product: syz [ 825.303867][T12921] usb 4-1: Manufacturer: syz [ 825.303875][T12921] usb 4-1: SerialNumber: syz [ 825.517758][ T37] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 825.668070][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 825.693099][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 825.693132][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 825.693173][ T37] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 825.693197][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 825.747752][ T37] usb 3-1: config 0 descriptor?? [ 825.754004][ T37] hub 3-1:0.0: USB hub found [ 825.942465][T18966] FAULT_INJECTION: forcing a failure. [ 825.942465][T18966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 825.943053][T18966] CPU: 1 UID: 0 PID: 18966 Comm: syz.0.4665 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 825.943082][T18966] Tainted: [L]=SOFTLOCKUP [ 825.943089][T18966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 825.943101][T18966] Call Trace: [ 825.943109][T18966] [ 825.943118][T18966] dump_stack_lvl+0xe8/0x150 [ 825.943150][T18966] should_fail_ex+0x46b/0x600 [ 825.943184][T18966] _copy_to_user+0x31/0xb0 [ 825.943210][T18966] simple_read_from_buffer+0xe1/0x170 [ 825.943239][T18966] proc_fail_nth_read+0x1be/0x230 [ 825.943264][T18966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 825.943291][T18966] ? rw_verify_area+0x2ac/0x4e0 [ 825.943316][T18966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 825.943341][T18966] vfs_read+0x212/0xa80 [ 825.943375][T18966] ? __pfx_vfs_read+0x10/0x10 [ 825.943403][T18966] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 825.943432][T18966] ? lockdep_hardirqs_on+0x7a/0x110 [ 825.943460][T18966] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 825.943488][T18966] ? mutex_lock_nested+0x152/0x1d0 [ 825.943509][T18966] ? fdget_pos+0x252/0x320 [ 825.943540][T18966] ksys_read+0x156/0x270 [ 825.943568][T18966] ? __pfx_ksys_read+0x10/0x10 [ 825.943603][T18966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.943624][T18966] do_syscall_64+0x174/0x580 [ 825.943651][T18966] ? trace_irq_disable+0x3b/0x140 [ 825.943673][T18966] ? clear_bhb_loop+0x40/0x90 [ 825.943697][T18966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.943716][T18966] RIP: 0033:0x7f1aa1dbd68e [ 825.943735][T18966] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 825.943759][T18966] RSP: 002b:00007f1aa0055fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 825.943780][T18966] RAX: ffffffffffffffda RBX: 00007f1aa00566c0 RCX: 00007f1aa1dbd68e [ 825.943795][T18966] RDX: 000000000000000f RSI: 00007f1aa00560a0 RDI: 0000000000000005 [ 825.943808][T18966] RBP: 00007f1aa0056090 R08: 0000000000000000 R09: 0000000000000000 [ 825.943821][T18966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 825.943833][T18966] R13: 00007f1aa2076038 R14: 00007f1aa2075fa0 R15: 00007ffc24897c18 [ 825.943865][T18966] [ 826.001907][T12921] usb 4-1: USB disconnect, device number 100 [ 826.113239][ T37] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 826.322550][ T5809] udevd[5809]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 826.430777][ T37] usbhid 3-1:0.0: can't add hid device: -71 [ 826.430894][ T37] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 826.468563][ T37] usb 3-1: USB disconnect, device number 86 [ 826.647702][T12921] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 826.809598][T12921] usb 4-1: Using ep0 maxpacket: 16 [ 826.812524][T12921] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 826.812555][T12921] usb 4-1: config 0 interface 0 has no altsetting 0 [ 826.816528][T12921] usb 4-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 826.816558][T12921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.816580][T12921] usb 4-1: Product: syz [ 826.816595][T12921] usb 4-1: Manufacturer: syz [ 826.816611][T12921] usb 4-1: SerialNumber: syz [ 826.830979][T12921] usb 4-1: config 0 descriptor?? [ 826.837812][ T5730] usb 2-1: new low-speed USB device number 94 using dummy_hcd [ 826.977816][ T5730] usb 2-1: device descriptor read/64, error -71 [ 827.088536][ C0] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 827.201393][T12921] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input52 [ 827.227640][ T5730] usb 2-1: new low-speed USB device number 95 using dummy_hcd [ 827.364043][ T5730] usb 2-1: device descriptor read/64, error -71 [ 827.365416][T18986] batadv_slave_1: entered promiscuous mode [ 827.479351][ T5730] usb usb2-port1: attempt power cycle [ 827.520877][T12921] imon:send_packet: packet tx failed (-71) [ 827.537903][T12921] imon 4-1:0.0: panel buttons/knobs setup failed [ 827.627561][T12921] rc_core: IR keymap rc-imon-pad not found [ 827.627589][T12921] Registered IR keymap rc-empty [ 827.633711][T12921] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 827.633726][T12921] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 827.635558][T12921] imon:send_packet: packet tx failed (-71) [ 827.637721][ T37] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 827.648680][T12921] imon 4-1:0.0: remote input dev register failed [ 827.648840][T12921] imon 4-1:0.0: imon_init_intf0: rc device setup failed [ 827.817228][T12921] imon 4-1:0.0: unable to initialize intf0, err 0 [ 827.817242][T12921] imon:imon_probe: failed to initialize context! [ 827.817250][T12921] imon 4-1:0.0: unable to register, err -19 [ 827.828125][T12921] usb 4-1: USB disconnect, device number 101 [ 827.837664][ T5730] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 827.855714][ T37] usb 3-1: unable to get BOS descriptor or descriptor too short [ 827.856917][ T37] usb 3-1: config 63 has an invalid interface number: 66 but max is 0 [ 827.856942][ T37] usb 3-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 827.856962][ T37] usb 3-1: config 63 has no interface number 0 [ 827.856991][ T37] usb 3-1: config 63 interface 66 has no altsetting 0 [ 827.859817][ T5730] usb 2-1: device descriptor read/8, error -71 [ 827.907393][ T37] usb 3-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 827.907556][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.907579][ T37] usb 3-1: Product: syz [ 827.907593][ T37] usb 3-1: Manufacturer: syz [ 827.907608][ T37] usb 3-1: SerialNumber: syz [ 828.107592][ T5730] usb 2-1: new low-speed USB device number 97 using dummy_hcd [ 828.129029][ T5730] usb 2-1: device descriptor read/8, error -71 [ 828.148627][T12921] usb 4-1: new full-speed USB device number 102 using dummy_hcd [ 828.151181][T18985] batadv_slave_1: left promiscuous mode [ 828.172182][ T37] uvcvideo 3-1:63.66: Found Unit with invalid ID 0 [ 828.172220][ T37] uvcvideo 3-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 828.172378][ T37] uvcvideo 3-1:63.66: No valid video chain found. [ 828.198404][ T37] usb 3-1: USB disconnect, device number 87 [ 828.238102][ T5730] usb usb2-port1: unable to enumerate USB device [ 828.319731][T12921] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 828.319766][T12921] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 828.319792][T12921] usb 4-1: config 0 interface 0 has no altsetting 0 [ 828.322122][T12921] usb 4-1: New USB device found, idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 828.322148][T12921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.322168][T12921] usb 4-1: Product: syz [ 828.322183][T12921] usb 4-1: Manufacturer: syz [ 828.322194][T12921] usb 4-1: SerialNumber: syz [ 828.327289][T12921] usb 4-1: config 0 descriptor?? [ 828.329437][T18970] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 828.584815][ C0] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 828.603812][T12921] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input54 [ 828.744075][T18992] batadv_slave_0: entered promiscuous mode [ 828.751946][T18991] batadv_slave_0: left promiscuous mode [ 828.898360][T12921] rc_core: IR keymap rc-imon-pad not found [ 828.898380][T12921] Registered IR keymap rc-empty [ 828.898454][T12921] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 828.898472][T12921] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 828.905613][T18997] FAULT_INJECTION: forcing a failure. [ 828.905613][T18997] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 828.905655][T18997] CPU: 1 UID: 0 PID: 18997 Comm: syz.2.4678 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 828.905684][T18997] Tainted: [L]=SOFTLOCKUP [ 828.905691][T18997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 828.905703][T18997] Call Trace: [ 828.905711][T18997] [ 828.905720][T18997] dump_stack_lvl+0xe8/0x150 [ 828.905748][T18997] should_fail_ex+0x46b/0x600 [ 828.905775][T18997] _copy_to_user+0x31/0xb0 [ 828.905789][T18997] procfs_procmap_ioctl+0xb8b/0xe10 [ 828.905805][T18997] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 828.905827][T18997] ? __fget_files+0x2a/0x420 [ 828.905852][T18997] ? __fget_files+0x2a/0x420 [ 828.905873][T18997] ? __fget_files+0x3a6/0x420 [ 828.905895][T18997] ? __fget_files+0x2a/0x420 [ 828.905921][T18997] ? bpf_lsm_file_ioctl+0x9/0x20 [ 828.905944][T18997] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 828.905955][T18997] __se_sys_ioctl+0xff/0x170 [ 828.905970][T18997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.905981][T18997] do_syscall_64+0x174/0x580 [ 828.906005][T18997] ? trace_irq_disable+0x3b/0x140 [ 828.906028][T18997] ? clear_bhb_loop+0x40/0x90 [ 828.906051][T18997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.906071][T18997] RIP: 0033:0x7f0f0c64ce59 [ 828.906089][T18997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.906105][T18997] RSP: 002b:00007f0f0a89e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 828.906118][T18997] RAX: ffffffffffffffda RBX: 00007f0f0c8c5fa0 RCX: 00007f0f0c64ce59 [ 828.906126][T18997] RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003 [ 828.906133][T18997] RBP: 00007f0f0a89e090 R08: 0000000000000000 R09: 0000000000000000 [ 828.906142][T18997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 828.906149][T18997] R13: 00007f0f0c8c6038 R14: 00007f0f0c8c5fa0 R15: 00007ffc73aaea28 [ 828.906174][T18997] [ 829.053221][T12921] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 829.075020][T12921] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input55 [ 829.087029][T12921] imon 4-1:0.0: iMON device (15c2:0045, intf0) on usb<4:102> initialized [ 829.242023][T12921] usb 4-1: USB disconnect, device number 102 [ 829.323045][T19000] FAULT_INJECTION: forcing a failure. [ 829.323045][T19000] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 829.323068][T19000] CPU: 0 UID: 0 PID: 19000 Comm: syz.2.4679 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 829.323084][T19000] Tainted: [L]=SOFTLOCKUP [ 829.323088][T19000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 829.323095][T19000] Call Trace: [ 829.323100][T19000] [ 829.323128][T19000] dump_stack_lvl+0xe8/0x150 [ 829.323147][T19000] should_fail_ex+0x46b/0x600 [ 829.323166][T19000] prepare_alloc_pages+0x22a/0x6b0 [ 829.323185][T19000] __alloc_frozen_pages_noprof+0x12f/0x380 [ 829.323202][T19000] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 829.323216][T19000] ? __alloc_frozen_pages_noprof+0x1de/0x380 [ 829.323231][T19000] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 829.323247][T19000] ? __pfx_policy_nodemask+0x10/0x10 [ 829.323264][T19000] __alloc_pages_noprof+0x10/0x100 [ 829.323278][T19000] alloc_pages_bulk_noprof+0x67e/0x890 [ 829.323293][T19000] ? alloc_pages_mpol+0x2ae/0x380 [ 829.323308][T19000] ? alloc_pages_noprof+0x161/0x2f0 [ 829.323324][T19000] __kasan_populate_vmalloc+0xc1/0x1d0 [ 829.323336][T19000] ? rt_spin_unlock+0x160/0x200 [ 829.323351][T19000] alloc_vmap_area+0xd47/0x1480 [ 829.323371][T19000] ? __pfx_alloc_vmap_area+0x10/0x10 [ 829.323383][T19000] ? __kmalloc_cache_node_noprof+0x27d/0x6c0 [ 829.323397][T19000] ? __get_vm_area_node+0x13f/0x300 [ 829.323408][T19000] ? copy_process+0x837/0x43d0 [ 829.323423][T19000] __get_vm_area_node+0x1f8/0x300 [ 829.323441][T19000] __vmalloc_node_range_noprof+0x36a/0x1750 [ 829.323454][T19000] ? copy_process+0x837/0x43d0 [ 829.323467][T19000] ? percpu_ref_get_many+0x19/0x140 [ 829.323496][T19000] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 829.323510][T19000] ? rcu_is_watching+0x15/0xb0 [ 829.323525][T19000] ? memcpy_and_pad+0x48/0x80 [ 829.323541][T19000] __vmalloc_node_noprof+0xc2/0x100 [ 829.323553][T19000] ? copy_process+0x837/0x43d0 [ 829.323567][T19000] ? copy_process+0x837/0x43d0 [ 829.323582][T19000] dup_task_struct+0x298/0x860 [ 829.323596][T19000] ? rt_spin_unlock+0x160/0x200 [ 829.323614][T19000] copy_process+0x837/0x43d0 [ 829.323644][T19000] ? __pfx_copy_process+0x10/0x10 [ 829.323666][T19000] vhost_task_create+0x1f9/0x380 [ 829.323678][T19000] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 829.323694][T19000] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 829.323710][T19000] ? __pfx_vhost_task_create+0x10/0x10 [ 829.323726][T19000] ? __pfx_vhost_task_fn+0x10/0x10 [ 829.323740][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.323755][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.323770][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.323784][T19000] ? mutex_lock_nested+0x152/0x1d0 [ 829.323796][T19000] ? kvm_mmu_post_init_vm+0x8f/0x2d0 [ 829.323814][T19000] kvm_mmu_post_init_vm+0x147/0x2d0 [ 829.323831][T19000] kvm_arch_vcpu_ioctl_run+0x106/0x20d0 [ 829.323850][T19000] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 829.323864][T19000] ? do_raw_spin_lock+0x12b/0x2f0 [ 829.323881][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.323896][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.323911][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.323925][T19000] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 829.323941][T19000] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 829.323954][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.323969][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.323996][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.324010][T19000] ? rt_write_unlock+0x190/0x230 [ 829.324024][T19000] kvm_vcpu_ioctl+0xa65/0xfe0 [ 829.324042][T19000] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 829.324067][T19000] ? __fget_files+0x2a/0x420 [ 829.324081][T19000] ? __fget_files+0x2a/0x420 [ 829.324093][T19000] ? __fget_files+0x3a6/0x420 [ 829.324108][T19000] ? __fget_files+0x2a/0x420 [ 829.324122][T19000] ? bpf_lsm_file_ioctl+0x9/0x20 [ 829.324137][T19000] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 829.324152][T19000] __se_sys_ioctl+0xff/0x170 [ 829.324167][T19000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.324179][T19000] do_syscall_64+0x174/0x580 [ 829.324193][T19000] ? trace_irq_disable+0x3b/0x140 [ 829.324205][T19000] ? clear_bhb_loop+0x40/0x90 [ 829.324218][T19000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.324229][T19000] RIP: 0033:0x7f0f0c64ce59 [ 829.324241][T19000] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.324250][T19000] RSP: 002b:00007f0f0a87d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 829.324263][T19000] RAX: ffffffffffffffda RBX: 00007f0f0c8c6090 RCX: 00007f0f0c64ce59 [ 829.324271][T19000] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 829.324278][T19000] RBP: 00007f0f0a87d090 R08: 0000000000000000 R09: 0000000000000000 [ 829.324285][T19000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 829.324291][T19000] R13: 00007f0f0c8c6128 R14: 00007f0f0c8c6090 R15: 00007ffc73aaea28 [ 829.324308][T19000] [ 829.324445][T19000] syz.2.4679: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 829.324483][T19000] CPU: 0 UID: 0 PID: 19000 Comm: syz.2.4679 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 829.324497][T19000] Tainted: [L]=SOFTLOCKUP [ 829.324501][T19000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 829.324507][T19000] Call Trace: [ 829.324511][T19000] [ 829.324516][T19000] dump_stack_lvl+0xe8/0x150 [ 829.324529][T19000] warn_alloc+0x24c/0x270 [ 829.324542][T19000] ? kasan_quarantine_put+0xbb/0x1f0 [ 829.324555][T19000] ? __pfx_warn_alloc+0x10/0x10 [ 829.324568][T19000] ? __get_vm_area_node+0x211/0x300 [ 829.324579][T19000] ? __get_vm_area_node+0x13f/0x300 [ 829.324590][T19000] ? copy_process+0x837/0x43d0 [ 829.324605][T19000] ? __get_vm_area_node+0x211/0x300 [ 829.324620][T19000] __vmalloc_node_range_noprof+0x38f/0x1750 [ 829.324632][T19000] ? percpu_ref_get_many+0x19/0x140 [ 829.324661][T19000] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 829.324675][T19000] ? rcu_is_watching+0x15/0xb0 [ 829.324689][T19000] ? memcpy_and_pad+0x48/0x80 [ 829.324705][T19000] __vmalloc_node_noprof+0xc2/0x100 [ 829.324717][T19000] ? copy_process+0x837/0x43d0 [ 829.324730][T19000] ? copy_process+0x837/0x43d0 [ 829.324746][T19000] dup_task_struct+0x298/0x860 [ 829.324760][T19000] ? rt_spin_unlock+0x160/0x200 [ 829.324773][T19000] copy_process+0x837/0x43d0 [ 829.324803][T19000] ? __pfx_copy_process+0x10/0x10 [ 829.324824][T19000] vhost_task_create+0x1f9/0x380 [ 829.324836][T19000] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 829.324850][T19000] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 829.324866][T19000] ? __pfx_vhost_task_create+0x10/0x10 [ 829.324882][T19000] ? __pfx_vhost_task_fn+0x10/0x10 [ 829.324895][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.324910][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.324924][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.324939][T19000] ? mutex_lock_nested+0x152/0x1d0 [ 829.324950][T19000] ? kvm_mmu_post_init_vm+0x8f/0x2d0 [ 829.324967][T19000] kvm_mmu_post_init_vm+0x147/0x2d0 [ 829.324984][T19000] kvm_arch_vcpu_ioctl_run+0x106/0x20d0 [ 829.325003][T19000] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 829.325016][T19000] ? do_raw_spin_lock+0x12b/0x2f0 [ 829.325033][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.325047][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.325062][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.325076][T19000] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 829.325092][T19000] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 829.325110][T19000] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 829.325125][T19000] ? lockdep_hardirqs_on+0x7a/0x110 [ 829.325139][T19000] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 829.325153][T19000] ? rt_write_unlock+0x190/0x230 [ 829.325167][T19000] kvm_vcpu_ioctl+0xa65/0xfe0 [ 829.325185][T19000] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 829.325210][T19000] ? __fget_files+0x2a/0x420 [ 829.325223][T19000] ? __fget_files+0x2a/0x420 [ 829.325234][T19000] ? __fget_files+0x3a6/0x420 [ 829.325246][T19000] ? __fget_files+0x2a/0x420 [ 829.325259][T19000] ? bpf_lsm_file_ioctl+0x9/0x20 [ 829.325273][T19000] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 829.325288][T19000] __se_sys_ioctl+0xff/0x170 [ 829.325302][T19000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.325313][T19000] do_syscall_64+0x174/0x580 [ 829.325327][T19000] ? trace_irq_disable+0x3b/0x140 [ 829.325339][T19000] ? clear_bhb_loop+0x40/0x90 [ 829.325351][T19000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.325362][T19000] RIP: 0033:0x7f0f0c64ce59 [ 829.325371][T19000] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.325380][T19000] RSP: 002b:00007f0f0a87d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 829.325390][T19000] RAX: ffffffffffffffda RBX: 00007f0f0c8c6090 RCX: 00007f0f0c64ce59 [ 829.325398][T19000] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 829.325404][T19000] RBP: 00007f0f0a87d090 R08: 0000000000000000 R09: 0000000000000000 [ 829.325411][T19000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 829.325417][T19000] R13: 00007f0f0c8c6128 R14: 00007f0f0c8c6090 R15: 00007ffc73aaea28 [ 829.325434][T19000] [ 829.325438][T19000] Mem-Info: [ 829.325444][T19000] active_anon:6497 inactive_anon:0 isolated_anon:0 [ 829.325444][T19000] active_file:0 inactive_file:55938 isolated_file:0 [ 829.325444][T19000] unevictable:768 dirty:179 writeback:0 [ 829.325444][T19000] slab_reclaimable:11927 slab_unreclaimable:99165 [ 829.325444][T19000] mapped:25972 shmem:1292 pagetables:1334 [ 829.325444][T19000] sec_pagetables:0 bounce:0 [ 829.325444][T19000] kernel_misc_reclaimable:0 [ 829.325444][T19000] free:1319054 free_pcp:4440 free_cma:0 [ 829.325472][T19000] Node 0 active_anon:25988kB inactive_anon:0kB active_file:0kB inactive_file:223556kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:103888kB dirty:712kB writeback:0kB shmem:3632kB kernel_stack:14488kB pagetables:5188kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 829.325499][T19000] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 829.325524][T19000] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 829.325554][T19000] lowmem_reserve[]: 0 2492 2492 2492 2492 [ 829.325572][T19000] Node 0 DMA32 free:1317476kB boost:0kB min:3912kB low:6436kB high:8960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25988kB inactive_anon:0kB active_file:0kB inactive_file:223556kB unevictable:1536kB writepending:712kB zspages:0kB present:3129332kB managed:2551952kB mlocked:0kB bounce:0kB free_pcp:16952kB local_pcp:4480kB free_cma:0kB [ 829.325603][T19000] lowmem_reserve[]: 0 0 0 0 0 [ 829.325619][T19000] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:856kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:4kB free_cma:0kB [ 829.325648][T19000] lowmem_reserve[]: 0 0 0 0 0 [ 829.325664][T19000] Node 1 Normal free:3943380kB boost:0kB min:6372kB low:10480kB high:14588kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111096kB mlocked:0kB bounce:0kB free_pcp:800kB local_pcp:800kB free_cma:0kB [ 829.325695][T19000] lowmem_reserve[]: 0 0 0 0 0 [ 829.325710][T19000] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 829.325769][T19000] Node 0 DMA32: 1425*4kB (UME) 800*8kB (UME) 130*16kB (UME) 136*32kB (UME) 267*64kB (UME) 147*128kB (UME) 91*256kB (UME) 27*512kB (UM) 19*1024kB (UM) 7*2048kB (UME) 291*4096kB (UM) = 1317284kB [ 829.325847][T19000] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 829.325895][T19000] Node 1 Normal: 3*4kB (UM) 9*8kB (UM) 12*16kB (UM) 10*32kB (UM) 6*64kB (UM) 6*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 0*2048kB 961*4096kB (M) = 3943380kB [ 829.325969][T19000] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 829.325982][T19000] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 829.325990][T19000] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 829.325999][T19000] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 829.326007][T19000] 57226 total pagecache pages [ 829.326012][T19000] 0 pages in swap cache [ 829.326016][T19000] Free swap = 124996kB [ 829.326020][T19000] Total swap = 124996kB [ 829.326025][T19000] 2097051 pages RAM [ 829.326029][T19000] 0 pages HighMem/MovableOnly [ 829.326033][T19000] 427235 pages reserved [ 829.326037][T19000] 0 pages cma reserved [ 829.987634][ T5730] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 830.157662][ T5730] usb 2-1: Using ep0 maxpacket: 32 [ 830.160370][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 830.160401][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 830.160440][ T5730] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 830.160463][ T5730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.164761][T19009] 9pnet_fd: Insufficient options for proto=fd [ 830.180598][ T5730] usb 2-1: config 0 descriptor?? [ 830.197446][ T5730] hub 2-1:0.0: USB hub found [ 830.491371][ T5730] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 830.707149][ T5730] usbhid 2-1:0.0: can't add hid device: -71 [ 830.707360][ T5730] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 830.749218][ T5730] usb 2-1: USB disconnect, device number 98 [ 830.773743][T12921] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 830.776855][T19017] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 830.776890][T19017] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 830.776932][T19017] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 830.851620][T19017] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 830.940478][T12921] usb 4-1: Using ep0 maxpacket: 32 [ 830.950298][T12921] usb 4-1: config 0 has no interfaces? [ 830.950333][T12921] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 830.950356][T12921] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.960833][T12921] usb 4-1: config 0 descriptor?? [ 831.066870][T19020] program syz.2.4688 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 831.074962][T19022] program syz.2.4688 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 831.081294][T19024] FAULT_INJECTION: forcing a failure. [ 831.081294][T19024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 831.081327][T19024] CPU: 0 UID: 0 PID: 19024 Comm: syz.0.4689 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 831.081354][T19024] Tainted: [L]=SOFTLOCKUP [ 831.081361][T19024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 831.081373][T19024] Call Trace: [ 831.081388][T19024] [ 831.081397][T19024] dump_stack_lvl+0xe8/0x150 [ 831.081423][T19024] should_fail_ex+0x46b/0x600 [ 831.081456][T19024] _copy_to_user+0x31/0xb0 [ 831.081480][T19024] simple_read_from_buffer+0xe1/0x170 [ 831.081508][T19024] proc_fail_nth_read+0x1be/0x230 [ 831.081534][T19024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 831.081560][T19024] ? rw_verify_area+0x2ac/0x4e0 [ 831.081585][T19024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 831.081609][T19024] vfs_read+0x212/0xa80 [ 831.081642][T19024] ? __pfx_vfs_read+0x10/0x10 [ 831.081670][T19024] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 831.081698][T19024] ? lockdep_hardirqs_on+0x7a/0x110 [ 831.081725][T19024] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 831.081753][T19024] ? mutex_lock_nested+0x152/0x1d0 [ 831.081773][T19024] ? fdget_pos+0x252/0x320 [ 831.081805][T19024] ksys_read+0x156/0x270 [ 831.081832][T19024] ? __pfx_ksys_read+0x10/0x10 [ 831.081865][T19024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.081886][T19024] do_syscall_64+0x174/0x580 [ 831.081915][T19024] ? clear_bhb_loop+0x40/0x90 [ 831.081938][T19024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.081958][T19024] RIP: 0033:0x7f1aa1dbd68e [ 831.081975][T19024] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 831.081992][T19024] RSP: 002b:00007f1aa0055fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 831.082012][T19024] RAX: ffffffffffffffda RBX: 00007f1aa00566c0 RCX: 00007f1aa1dbd68e [ 831.082027][T19024] RDX: 000000000000000f RSI: 00007f1aa00560a0 RDI: 0000000000000004 [ 831.082039][T19024] RBP: 00007f1aa0056090 R08: 0000000000000000 R09: 0000000000000000 [ 831.082054][T19024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 831.082067][T19024] R13: 00007f1aa2076038 R14: 00007f1aa2075fa0 R15: 00007ffc24897c18 [ 831.082097][T19024] [ 831.436448][ T5779] usb 4-1: USB disconnect, device number 103 [ 831.460119][T12921] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 831.632609][T12921] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 831.632637][T12921] usb 1-1: config 0 has no interface number 0 [ 831.632662][T12921] usb 1-1: too many endpoints for config 0 interface 49 altsetting 56: 52, using maximum allowed: 30 [ 831.632684][T12921] usb 1-1: config 0 interface 49 altsetting 56 has 0 endpoint descriptors, different from the interface descriptor's value: 52 [ 831.632698][T12921] usb 1-1: config 0 interface 49 has no altsetting 0 [ 831.635163][T12921] usb 1-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 831.635191][T12921] usb 1-1: New USB device strings: Mfr=0, Product=229, SerialNumber=0 [ 831.636418][T12921] usb 1-1: Product: syz [ 831.646217][T12921] usb 1-1: config 0 descriptor?? [ 831.800418][T19043] FAULT_INJECTION: forcing a failure. [ 831.800418][T19043] name failslab, interval 1, probability 0, space 0, times 0 [ 831.800441][T19043] CPU: 0 UID: 0 PID: 19043 Comm: syz.1.4696 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 831.800457][T19043] Tainted: [L]=SOFTLOCKUP [ 831.800461][T19043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 831.800468][T19043] Call Trace: [ 831.800473][T19043] [ 831.800479][T19043] dump_stack_lvl+0xe8/0x150 [ 831.800499][T19043] should_fail_ex+0x46b/0x600 [ 831.800518][T19043] should_failslab+0xa8/0x100 [ 831.800533][T19043] __kmalloc_cache_noprof+0x84/0x690 [ 831.800547][T19043] ? binder_alloc_new_buf+0x27d/0x3030 [ 831.800624][T19043] binder_alloc_new_buf+0x27d/0x3030 [ 831.800640][T19043] ? binder_debug+0x155/0x1d0 [ 831.800658][T19043] ? __pfx_binder_debug+0x10/0x10 [ 831.800674][T19043] ? __pfx_binder_alloc_new_buf+0x10/0x10 [ 831.800687][T19043] ? __kmalloc_cache_noprof+0x3a6/0x690 [ 831.800703][T19043] binder_transaction+0x2853/0x6fd0 [ 831.800736][T19043] ? __pfx_binder_transaction+0x10/0x10 [ 831.800750][T19043] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 831.800770][T19043] ? __lock_acquire+0x6b5/0x2d10 [ 831.800787][T19043] ? __lock_acquire+0x6b5/0x2d10 [ 831.800804][T19043] ? __lock_acquire+0x6b5/0x2d10 [ 831.800817][T19043] ? __lock_acquire+0x6b5/0x2d10 [ 831.800834][T19043] ? __might_fault+0xaf/0x130 [ 831.800847][T19043] ? __might_fault+0xaf/0x130 [ 831.800869][T19043] binder_ioctl_write_read+0xb37/0xa490 [ 831.800884][T19043] ? is_bpf_text_address+0x26/0x2b0 [ 831.800906][T19043] ? __kernel_text_address+0xd/0x30 [ 831.800928][T19043] ? __pfx_binder_ioctl_write_read+0x10/0x10 [ 831.800944][T19043] ? stack_depot_save_flags+0x33/0x810 [ 831.800964][T19043] ? do_raw_spin_lock+0x12b/0x2f0 [ 831.800983][T19043] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 831.800996][T19043] ? reacquire_held_locks+0x104/0x190 [ 831.801009][T19043] ? rt_spin_lock+0x1e0/0x400 [ 831.801021][T19043] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 831.801035][T19043] ? rt_spin_unlock+0x14f/0x200 [ 831.801052][T19043] ? binder_get_thread+0x177/0x6d0 [ 831.801067][T19043] binder_ioctl+0x426/0x1b10 [ 831.801081][T19043] ? tomoyo_path_number_perm+0x219/0x630 [ 831.801098][T19043] ? tomoyo_path_number_perm+0x219/0x630 [ 831.801115][T19043] ? do_vfs_ioctl+0x117b/0x1540 [ 831.801130][T19043] ? __pfx_binder_ioctl+0x10/0x10 [ 831.801144][T19043] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 831.801175][T19043] ? __fget_files+0x2a/0x420 [ 831.801188][T19043] ? __fget_files+0x2a/0x420 [ 831.801200][T19043] ? __fget_files+0x3a6/0x420 [ 831.801211][T19043] ? __fget_files+0x2a/0x420 [ 831.801224][T19043] ? bpf_lsm_file_ioctl+0x9/0x20 [ 831.801239][T19043] ? __pfx_binder_ioctl+0x10/0x10 [ 831.801253][T19043] __se_sys_ioctl+0xff/0x170 [ 831.801267][T19043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.801279][T19043] do_syscall_64+0x174/0x580 [ 831.801295][T19043] ? clear_bhb_loop+0x40/0x90 [ 831.801308][T19043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.801318][T19043] RIP: 0033:0x7fb51ba5ce59 [ 831.801335][T19043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.801344][T19043] RSP: 002b:00007fb519cae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 831.801356][T19043] RAX: ffffffffffffffda RBX: 00007fb51bcd5fa0 RCX: 00007fb51ba5ce59 [ 831.801364][T19043] RDX: 0000200000000240 RSI: 00000000c0306201 RDI: 0000000000000005 [ 831.801371][T19043] RBP: 00007fb519cae090 R08: 0000000000000000 R09: 0000000000000000 [ 831.801378][T19043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 831.801384][T19043] R13: 00007fb51bcd6038 R14: 00007fb51bcd5fa0 R15: 00007ffc1396ab58 [ 831.801400][T19043] [ 831.857370][ T5780] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 831.885327][T12921] ftdi_sio 1-1:0.49: FTDI USB Serial Device converter detected [ 831.891893][T12921] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 831.911965][T12921] usb 1-1: USB disconnect, device number 5 [ 831.920891][T12921] ftdi_sio 1-1:0.49: device disconnected [ 832.051301][ T5780] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 832.051333][ T5780] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 832.051371][ T5780] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 832.051392][ T5780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.274935][ T5780] usb 3-1: config 0 descriptor?? [ 832.517348][T12921] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 832.679071][T12921] usb 2-1: Using ep0 maxpacket: 32 [ 832.681092][T12921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 832.681122][T12921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 832.681161][T12921] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 832.681185][T12921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.690016][T12921] usb 2-1: config 0 descriptor?? [ 832.745446][T12921] hub 2-1:0.0: USB hub found [ 832.810934][ T5780] savu 0003:1E7D:2D5A.0053: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 832.949821][T19071] sg_write: data in/out 352256/136 bytes for SCSI command 0x0-- guessing data in; [ 832.949821][T19071] program syz.3.4706 not setting count and/or reply_len properly [ 832.955110][T12921] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 832.958667][T19068] binder: 19066:19068 ioctl c0306201 2000000001c0 returned -14 [ 833.029841][T19071] loop9: detected capacity change from 0 to 7 [ 833.034826][T15004] [ 833.034852][T15004] ====================================================== [ 833.034863][T15004] WARNING: possible circular locking dependency detected [ 833.034929][T15004] syzkaller #0 Tainted: G L [ 833.034947][T15004] ------------------------------------------------------ [ 833.034980][T15004] kworker/u8:54/15004 is trying to acquire lock: [ 833.034992][T15004] ffff888029dba3d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb8/0xe20 [ 833.035073][T15004] [ 833.035073][T15004] but task is already holding lock: [ 833.035081][T15004] ffffc90004c4fc40 ((work_completion)(&worker->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 833.035129][T15004] [ 833.035129][T15004] which lock already depends on the new lock. [ 833.035129][T15004] [ 833.035136][T15004] [ 833.035136][T15004] the existing dependency chain (in reverse order) is: [ 833.035140][T15004] [ 833.035140][T15004] -> #5 ((work_completion)(&worker->work)){+.+.}-{0:0}: [ 833.035175][T15004] process_one_work+0x8d7/0x1630 [ 833.035194][T15004] worker_thread+0xb49/0x1140 [ 833.035218][T15004] kthread+0x388/0x470 [ 833.035236][T15004] ret_from_fork+0x514/0xb70 [ 833.035262][T15004] ret_from_fork_asm+0x1a/0x30 [ 833.035285][T15004] [ 833.035285][T15004] -> #4 ((wq_completion)loop9){+.+.}-{0:0}: [ 833.035303][T15004] touch_wq_lockdep_map+0xcb/0x180 [ 833.035312][T15004] __flush_workqueue+0x14b/0x14f0 [ 833.035321][T15004] drain_workqueue+0xd3/0x390 [ 833.035329][T15004] lo_release+0x287/0x8f0 [ 833.035427][T15004] bdev_release+0x541/0x660 [ 833.035453][T15004] blkdev_release+0x15/0x20 [ 833.035463][T15004] __fput+0x461/0xa70 [ 833.035473][T15004] task_work_run+0x1d9/0x270 [ 833.035483][T15004] exit_to_user_mode_loop+0x193/0x680 [ 833.035494][T15004] do_syscall_64+0x353/0x580 [ 833.035510][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.035528][T15004] [ 833.035528][T15004] -> #3 (&disk->open_mutex#4){+.+.}-{4:4}: [ 833.035557][T15004] mutex_lock_nested+0x5a/0x1d0 [ 833.035578][T15004] bdev_open+0xe0/0xcc0 [ 833.035602][T15004] bdev_file_open_by_dev+0x1be/0x240 [ 833.035621][T15004] swsusp_check+0x56/0x490 [ 833.035631][T15004] software_resume+0x51/0x4c0 [ 833.035645][T15004] resume_store+0x333/0x4f0 [ 833.035653][T15004] kernfs_fop_write_iter+0x3b0/0x540 [ 833.035669][T15004] vfs_write+0x629/0xba0 [ 833.035691][T15004] ksys_write+0x156/0x270 [ 833.035713][T15004] do_syscall_64+0x174/0x580 [ 833.035738][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.035756][T15004] [ 833.035756][T15004] -> #2 (system_transition_mutex){+.+.}-{4:4}: [ 833.035775][T15004] mutex_lock_nested+0x5a/0x1d0 [ 833.035785][T15004] lock_system_sleep+0x49/0x70 [ 833.035795][T15004] disk_store+0xa7/0x500 [ 833.035807][T15004] kernfs_fop_write_iter+0x3b0/0x540 [ 833.035820][T15004] iter_file_splice_write+0x9a6/0x10f0 [ 833.035840][T15004] direct_splice_actor+0x104/0x160 [ 833.035862][T15004] splice_direct_to_actor+0x545/0xc80 [ 833.035883][T15004] do_splice_direct+0x19b/0x2a0 [ 833.035904][T15004] do_sendfile+0x547/0x7e0 [ 833.035921][T15004] __se_sys_sendfile64+0x144/0x1a0 [ 833.035931][T15004] do_syscall_64+0x174/0x580 [ 833.035944][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.035954][T15004] [ 833.035954][T15004] -> #1 (&of->mutex){+.+.}-{4:4}: [ 833.035967][T15004] mutex_lock_nested+0x5a/0x1d0 [ 833.035977][T15004] kernfs_seq_start+0x5c/0x420 [ 833.036000][T15004] seq_read_iter+0x3f8/0xe20 [ 833.036026][T15004] copy_splice_read+0x605/0xab0 [ 833.036046][T15004] splice_direct_to_actor+0x483/0xc80 [ 833.036068][T15004] do_splice_direct+0x19b/0x2a0 [ 833.036085][T15004] do_sendfile+0x547/0x7e0 [ 833.036094][T15004] __se_sys_sendfile64+0x144/0x1a0 [ 833.036103][T15004] do_syscall_64+0x174/0x580 [ 833.036115][T15004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.036124][T15004] [ 833.036124][T15004] -> #0 (&p->lock){+.+.}-{4:4}: [ 833.036139][T15004] __lock_acquire+0x15a5/0x2d10 [ 833.036158][T15004] lock_acquire+0x106/0x350 [ 833.036177][T15004] mutex_lock_nested+0x5a/0x1d0 [ 833.036197][T15004] seq_read_iter+0xb8/0xe20 [ 833.036222][T15004] lo_rw_aio+0xc80/0xf00 [ 833.036242][T15004] loop_process_work+0x92a/0x11b0 [ 833.036259][T15004] process_one_work+0x98b/0x1630 [ 833.036272][T15004] worker_thread+0xb49/0x1140 [ 833.036284][T15004] kthread+0x388/0x470 [ 833.036295][T15004] ret_from_fork+0x514/0xb70 [ 833.036313][T15004] ret_from_fork_asm+0x1a/0x30 [ 833.036335][T15004] [ 833.036335][T15004] other info that might help us debug this: [ 833.036335][T15004] [ 833.036342][T15004] Chain exists of: [ 833.036342][T15004] &p->lock --> (wq_completion)loop9 --> (work_completion)(&worker->work) [ 833.036342][T15004] [ 833.036399][T15004] Possible unsafe locking scenario: [ 833.036399][T15004] [ 833.036403][T15004] CPU0 CPU1 [ 833.036430][T15004] ---- ---- [ 833.036438][T15004] lock((work_completion)(&worker->work)); [ 833.036447][T15004] lock((wq_completion)loop9); [ 833.036458][T15004] lock((work_completion)(&worker->work)); [ 833.036472][T15004] lock(&p->lock); [ 833.036483][T15004] [ 833.036483][T15004] *** DEADLOCK *** [ 833.036483][T15004] [ 833.036489][T15004] 2 locks held by kworker/u8:54/15004: [ 833.036501][T15004] #0: ffff88806022e138 ((wq_completion)loop9){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 [ 833.036571][T15004] #1: ffffc90004c4fc40 ((work_completion)(&worker->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 [ 833.036597][T15004] [ 833.036597][T15004] stack backtrace: [ 833.036606][T15004] CPU: 1 UID: 0 PID: 15004 Comm: kworker/u8:54 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 833.036628][T15004] Tainted: [L]=SOFTLOCKUP [ 833.036635][T15004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 833.036648][T15004] Workqueue: loop9 loop_workfn [ 833.036673][T15004] Call Trace: [ 833.036681][T15004] [ 833.036690][T15004] dump_stack_lvl+0xe8/0x150 [ 833.036713][T15004] print_circular_bug+0x2e1/0x300 [ 833.036730][T15004] check_noncircular+0x12e/0x150 [ 833.036744][T15004] __lock_acquire+0x15a5/0x2d10 [ 833.036761][T15004] ? __bfs+0x153/0x290 [ 833.036774][T15004] ? __pfx_hlock_conflict+0x10/0x10 [ 833.036800][T15004] ? seq_read_iter+0xb8/0xe20 [ 833.036827][T15004] lock_acquire+0x106/0x350 [ 833.036848][T15004] ? seq_read_iter+0xb8/0xe20 [ 833.036875][T15004] ? seq_read_iter+0xb8/0xe20 [ 833.036890][T15004] ? seq_read_iter+0xb8/0xe20 [ 833.036904][T15004] mutex_lock_nested+0x5a/0x1d0 [ 833.036914][T15004] ? seq_read_iter+0xb8/0xe20 [ 833.036931][T15004] seq_read_iter+0xb8/0xe20 [ 833.036958][T15004] ? __lock_acquire+0x6b5/0x2d10 [ 833.036981][T15004] ? kernfs_fop_read_iter+0x149/0x6b0 [ 833.037007][T15004] ? __asan_memset+0x22/0x50 [ 833.037027][T15004] lo_rw_aio+0xc80/0xf00 [ 833.037045][T15004] ? __pfx_lo_rw_aio+0x10/0x10 [ 833.037060][T15004] ? kthread_associate_blkcg+0x490/0x600 [ 833.037071][T15004] ? rt_spin_unlock+0x160/0x200 [ 833.037083][T15004] loop_process_work+0x92a/0x11b0 [ 833.037113][T15004] ? __pfx_loop_process_work+0x10/0x10 [ 833.037137][T15004] ? add_lock_to_list+0xc7/0x100 [ 833.037160][T15004] ? lockdep_unlock+0x5d/0xd0 [ 833.037176][T15004] ? __lock_acquire+0x146e/0x2d10 [ 833.037204][T15004] ? process_one_work+0x8be/0x1630 [ 833.037227][T15004] ? process_one_work+0x8be/0x1630 [ 833.037261][T15004] ? process_one_work+0x8be/0x1630 [ 833.037286][T15004] process_one_work+0x98b/0x1630 [ 833.037319][T15004] ? __pfx_process_one_work+0x10/0x10 [ 833.037344][T15004] ? do_raw_spin_lock+0x12b/0x2f0 [ 833.037369][T15004] worker_thread+0xb49/0x1140 [ 833.037401][T15004] kthread+0x388/0x470 [ 833.037416][T15004] ? __pfx_worker_thread+0x10/0x10 [ 833.037453][T15004] ? __pfx_kthread+0x10/0x10 [ 833.037471][T15004] ret_from_fork+0x514/0xb70 [ 833.037490][T15004] ? __pfx_ret_from_fork+0x10/0x10 [ 833.037509][T15004] ? __switch_to+0xc79/0x1410 [ 833.037526][T15004] ? __pfx_kthread+0x10/0x10 [ 833.037545][T15004] ret_from_fork_asm+0x1a/0x30 [ 833.037572][T15004] [ 833.069737][ T9] usb 3-1: USB disconnect, device number 88 [ 833.178582][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 833.179428][T12921] usbhid 2-1:0.0: can't add hid device: -71 [ 833.179513][T12921] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 833.209594][T12921] usb 2-1: USB disconnect, device number 99 [ 833.509822][T19071] Dev loop9: unable to read RDB block 7 [ 833.509864][T19071] loop9: unable to read partition table [ 833.510006][T19071] loop9: partition table beyond EOD, truncated [ 833.511373][T19071] loop_reread_partitions: partition scan of loop9 (ъщ) failed (rc=-5)