last executing test programs: 10.630477283s ago: executing program 2 (id=1817): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'syzkaller0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) write(r0, &(0x7f0000000480)="ffffffffeefc3f19a9935e894305000f32ffffff070200112233445500112233445500", 0x23) 10.498385219s ago: executing program 2 (id=1818): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x1a) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x48043) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xbbe, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r3, 0x0, r0, 0x0, 0x317e, 0x4) 9.554026183s ago: executing program 2 (id=1824): syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) syz_usb_connect_ath9k(0x3, 0x5a, 0xfffffffffffffffe, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x700, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x801}) 8.866915846s ago: executing program 2 (id=1838): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d0005007e0500000603000003000000fcffffff05010905a10105091901290a150025017501950a8102950175068103c0"], 0x135) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e010203010902"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\x00\x00\x00g\x00!'], 0xc) 6.114423834s ago: executing program 3 (id=1856): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock2(&(0x7f000051a000/0x3000)=nil, 0x3000, 0x1) r2 = syz_open_dev$usbfs(0x0, 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) msync(&(0x7f0000bc9000/0x2000)=nil, 0x2000, 0x4) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) listen(0xffffffffffffffff, 0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) 5.610444057s ago: executing program 0 (id=1859): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mount$9p_virtio(0x0, 0x0, &(0x7f0000000b40), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c00058008000100667470"], 0x90}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) 5.496211653s ago: executing program 0 (id=1861): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3aee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d320f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c16af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf700"/1664], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000029000000040000003a00000000000000100000000000000029000000", @ANYRES32=r0], 0x30}, 0x4004000) 5.396116517s ago: executing program 0 (id=1862): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x50, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}]}, 0x50}}, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x14, r2, 0x301}, 0x14}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x28c032, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x8) mlock(&(0x7f0000000000/0x4000)=nil, 0x4000) preadv(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000100)=""/230, 0xe6}], 0x1, 0x5f0e, 0x0) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x2}, 0x4) setsockopt$packet_int(r0, 0x107, 0x16, 0x0, 0x0) 3.750113914s ago: executing program 3 (id=1865): syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) syz_usb_connect_ath9k(0x3, 0x5a, 0xfffffffffffffffe, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000180)={0x700, 0x1, &(0x7f00000000c0)=[r0], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x801}) 3.695464657s ago: executing program 0 (id=1867): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f00000027c0)={0x2020}, 0x2020) 2.580961689s ago: executing program 0 (id=1869): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x1a) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xfffffffe, @loopback, 0x5}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x48043) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000100001000000000000000071ff9aee24", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2a}}, 0x7, 0x1, 0xbbe, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r2, 0x0, r0, 0x0, 0x317e, 0x4) 2.261322754s ago: executing program 1 (id=1871): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mount$9p_virtio(0x0, 0x0, &(0x7f0000000b40), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c00058008000100667470"], 0x90}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) 2.261041234s ago: executing program 3 (id=1872): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3aee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d320f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c16af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf700"/1664], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000029000000040000003a00000000000000100000000000000029000000", @ANYRES32=r0], 0x30}, 0x4004000) 2.195624207s ago: executing program 1 (id=1873): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x4, 0x0, [{0xffff1000, 0x9e, &(0x7f0000000440)=""/158}, {0x200000, 0x7e, &(0x7f0000000500)=""/126}, {0x2, 0x4c, &(0x7f0000000580)=""/76}, {0xf000, 0x89, &(0x7f0000000280)=""/137}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, &(0x7f0000010000), &(0x7f0000020000), &(0x7f0000018000)}) write(r1, &(0x7f0000010000)="000002000000000080", 0x9) write(r1, &(0x7f0000018000)="000001", 0x3) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000600)={0x1, r1}) write$tun(r1, &(0x7f0000000800)=ANY=[], 0x10) 2.194974927s ago: executing program 3 (id=1874): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'pimreg\x00', 0x5005}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(r0, &(0x7f0000002240)={@void, @val={0x1, 0x0, 0xd, 0x6, 0x16, 0x20a}, @ipv4=@generic={{0x6, 0x4, 0x2, 0x16, 0x222, 0x67, 0x0, 0x9, 0x6, 0x0, @empty, @broadcast, {[@end]}}, "465835170fa06ded05427a07dab063fd416d24e0689d552734f601503f4d395e7794229315d4d39f6453b5b0e5c4dcba679704b8245844ad9a2df7cc05734f08c63ab32f66f8ea4dec60fca3e11c64a5fdcb41dc8291282d4a0a6af9727ea119edaa53714fd2a7580edf4ff0356e360ecb0d38182fceed1ab2f6644125d5b71317c22f61205aa6554478e03cf7392e0d8e54a557f12d0db842a1e05c2d4de2d3aa4a681afee8eb9f08acc29c75e5698887c7fc925dbcfc2fb8512da9d621f4c33a51d14be564816e16d2d1cf77e7441af104aece606f6597699104233cb55c01074f73deafca015512bfa39941c6d256879c7ce230d27ba2736821a57bf96825d88cfbdddd5e48f7fad1114783079b98df132a85a5c8882be087b9d4040d603e82ad4d1b373b1a5cb484cc563bf07ec7f6415223e5bee1b60b2cd4ded9b1608f5137a2199c82672d0d73bd6f03112691fa97cf2bd22eb53cb1729e33e4d4907af29ba773a7961582dab8af2c737a67175b00f62745cdc0389040171dfe3c1b0f3e104a357fcf014cc9e75196cb9dbbe2f44828c488be7ecc64819f8cca5341ebbaf5aacb9a7ab2308540a720a940136c03ad463fbc394742ba12753dcf32256905bbb51629904978e7f09dcc4c754380629faa4409054f458c33c98dc2efcb1f3a46fda15d14f51ce09b4a6424e11078d70a848e0d011fe3328ee913009ec1de6a058b0075375917b501"}}, 0x22c) 2.063677003s ago: executing program 1 (id=1875): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) 2.063334203s ago: executing program 3 (id=1876): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000140)={[{@test_dummy_encryption_v1}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}]}, 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==") syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x20020c0, 0x0, 0x1, 0x0, &(0x7f0000001a00)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9}, [@generic={0x73, 0x1, 0x1, 0x2e}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0xffe0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x22, &(0x7f0000000300)=0x20, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000300), 0x6) socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e02000000000000000000000000000010040000"], 0x0, 0x37}, 0x28) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) 1.942587958s ago: executing program 1 (id=1877): r0 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, r0, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 1.856981742s ago: executing program 1 (id=1878): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'syzkaller0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) write(r0, &(0x7f0000000480)="ffffffffeefc3f19a9935e894305000f32ffffff070200112233445500112233445500ff0000", 0x26) 909.887577ms ago: executing program 0 (id=1879): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f00000027c0)={0x2020}, 0x2020) 815.244782ms ago: executing program 2 (id=1881): syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) syz_usb_connect_ath9k(0x3, 0x5a, 0xfffffffffffffffe, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) fsopen(&(0x7f0000000340)='befs\x00', 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000180)={0x700, 0x1, &(0x7f00000000c0)=[r0], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x801}) 810.867502ms ago: executing program 3 (id=1882): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000140)={[{@rodir}, {@uni_xlate}, {@utf8}, {@shortname_lower}, {@shortname_lower}, {@utf8}, {@rodir}, {@utf8}, {@fat=@tz_utc}, {@fat=@codepage={'codepage', 0x3d, '950'}}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@utf8no}, {@numtail}, {@utf8no}, {@utf8no}]}, 0x3, 0x29e, &(0x7f0000000800)="$eJzs3c1qa1UUAOB1mn8dJANHItwDOnB0ufUJWuQKYkFQIqgDLd5ckCRcaCHQKsaOfAKfQPBtnIgv4AMoztqBeOT0JGnSnqSmlqTo9026utZe2ftk79JOsvv5a8P+sxfHz8++/jWazSR29mIvLpLoxE5MfRulfvm9PA8APHAXWRZ/ZIVGkTpZHFGL8u+rOxtZIABw7+Z//297LQDAZnz48Sfv7R8cPP0gTZsRw+9G3SSKr0V9/3l8GYPoxZNox58R2UwRv/PuwdOoprlOvDEcj7p55/Czn86LPyf2f4u47N+NdnTK+3fTwlz/eNStxUuT+fcG0Xv/h2jHK+X9b5X0R7ceb74+t/7H0Y6fv4gXMYhnk2ef9n+zm6ZvZ9+ff/Vpns37k/Go25iNm4yubHhrAAAAAAAAAAAAAAAAAAAAAAD4D3ucznQW79+ZXvxfFJuT8Qv1FfcDjefu53mSpmmWXO+vxqvVqG7ruQEAAAAAAAAAAAAAAAAAAOAhOT457R8OBr2jNYKPbpYqsZCZfqy/pD3+Wsw0ImKt2ReCR+t2RWWytEEScW1MPSJWtNeicdl5+1yV5aX8BW6UWvl6ekdJNfqHP2Z325TrQTLLtOZLj6KYK8+0imAu828nHTTjMpierv5hctvmNssOybKg8s/Xk5Ucv+Xt9bLTmysZ3Foxe/3lO711WXtJKYmI2uzNXP06tXvZwaufFAAAAAAAAAAAAAAAAAAAYMOuPvRbUjzbwoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAuu/v//GsF40nyjlLUjTk77WSXPVGNS2vIjAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8D/wdwAAAP//h9dhCg==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, &(0x7f0000000100)=0x0, 0x0, 0x0) syz_io_uring_submit(r0, 0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0, 0x80000080, 0x1}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x100000001) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000001, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x18, 0x0, 0x1, @dev={0xfe, 0x80, '\x00', 0x2c}, @remote, {[@hopopts={0x2f, 0x1, '\x00', [@enc_lim={0x4, 0x1, 0x7f}, @enc_lim, @jumbo={0xc2, 0x4, 0xc}]}]}}}}}, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000080)={'ah\x00'}, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) close(r4) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) 693.037767ms ago: executing program 1 (id=1883): syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) syz_usb_connect_ath9k(0x3, 0x5a, 0xfffffffffffffffe, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000180)={0x700, 0x1, &(0x7f00000000c0)=[r0], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0), 0x0, 0x801}) 508.186966ms ago: executing program 4 (id=1885): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x4, 0x0, [{0xffff1000, 0x9e, &(0x7f0000000440)=""/158}, {0x200000, 0x7e, &(0x7f0000000500)=""/126}, {0x2, 0x4c, &(0x7f0000000580)=""/76}, {0xf000, 0x89, &(0x7f0000000280)=""/137}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, &(0x7f0000010000), &(0x7f0000020000), &(0x7f0000018000)}) write(r1, &(0x7f0000010000)="000002000000000080", 0x9) write(r1, &(0x7f0000018000)="000001", 0x3) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000600)={0x1, r1}) write$tun(r1, &(0x7f0000000800)=ANY=[], 0x10) 193.26373ms ago: executing program 4 (id=1886): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3aee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d320f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c16af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf700"/1664], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, &(0x7f0000000100), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000029000000040000003a00000000000000100000000000000029000000", @ANYRES32=r0], 0x30}, 0x4004000) 159.600652ms ago: executing program 4 (id=1887): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) 86.563165ms ago: executing program 4 (id=1888): writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$poke(0x4, r0, &(0x7f0000000040), 0x22600) 86.333945ms ago: executing program 4 (id=1889): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000000)={0x0, 0x0}, 0x10) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000980)=0x7e) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000540)=0x9) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0xef) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000001c0)=0x40) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x7e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) 48.238177ms ago: executing program 4 (id=1890): r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b00010100000009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=1891): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400010005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r1}, 0xc) 0s ago: executing program 2 (id=1892): syz_io_uring_setup(0x3bd4, 0x0, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) listen(0xffffffffffffffff, 0x5) r0 = io_uring_setup(0x54a0, &(0x7f0000000000)={0x0, 0x70e6, 0x2, 0xfffffffe, 0xf2}) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffe}, 0x1c) ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000140)) setsockopt(0xffffffffffffffff, 0x800, 0x4, &(0x7f0000000840)="fb12a245899fe5ba135c709da069cb9f844100ec91f431d91c68301044ae7b6709114952418c057d9754a0e6559c9cce2fa80c618b8c88d59d95f27691ed32190b564ecb35cb86e861385b78a2f76d9db236156318128ab10214cb234666d5ae585ebe1779a26396f17cb246eb1e48ddf06c4a018e3bd561704277f32ceb171ddfeef4fa3e2d84a92f20e97c23e30b4164614f5519e0410406f4b89c83d929947256cf58f1b84fb7c1d862e273035107216a941f99dfe37b8261f42ec3", 0xbd) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x20, 0x2, 0x2, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, [@CTA_EXPECT_HELP_NAME={0xa, 0x6, 'Q.931\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={0xffffffffffffffff, &(0x7f0000000640), &(0x7f0000000680)=@tcp}, 0x20) sendto(0xffffffffffffffff, &(0x7f0000000800)="01", 0xfdef, 0x2d, 0x0, 0x0) kernel console output (not intermixed with test programs): ommand 0x0419 tx timeout [ 38.158374][ T4332] Bluetooth: hci1: command 0x0419 tx timeout [ 38.158395][ T4332] Bluetooth: hci4: command 0x0419 tx timeout [ 38.163965][ T4680] binder: cannot allocate buffer: vma cleared, target dead or dying [ 38.163992][ T4680] binder: 4678:4680 transaction reply to 4678:4680 failed 6/29189/-3, size 0-0 line 3247 [ 38.164529][ T4682] Bluetooth: MGMT ver 1.22 [ 38.165379][ T4680] binder: send failed reply for transaction 5 to 4678:4680 [ 38.168128][ T4336] Bluetooth: hci3: command 0x0419 tx timeout [ 38.173910][ T1516] binder: undelivered TRANSACTION_ERROR: 29189 [ 38.186756][ T1516] binder: undelivered TRANSACTION_ERROR: 29190 [ 38.294223][ T4688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.339822][ T4688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.378337][ T4694] FAULT_INJECTION: forcing a failure. [ 38.378337][ T4694] name failslab, interval 1, probability 0, space 0, times 0 [ 38.382596][ T4694] CPU: 1 PID: 4694 Comm: syz.1.93 Not tainted syzkaller #0 [ 38.383877][ T4694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 38.385637][ T4694] Call trace: [ 38.386209][ T4694] dump_backtrace+0x1c4/0x1f0 [ 38.387071][ T4694] show_stack+0x2c/0x3c [ 38.387777][ T4694] __dump_stack+0x30/0x40 [ 38.388546][ T4694] dump_stack_lvl+0xf4/0x15c [ 38.389345][ T4694] dump_stack+0x1c/0x5c [ 38.390091][ T4694] should_fail_ex+0x3cc/0x524 [ 38.390922][ T4694] __should_failslab+0xc0/0x11c [ 38.391770][ T4694] should_failslab+0x10/0x28 [ 38.392567][ T4694] __kmem_cache_alloc_node+0x7c/0x318 [ 38.393596][ T4694] kmalloc_trace+0x48/0x94 [ 38.394436][ T4694] alloc_tty_struct+0xb8/0x670 [ 38.395269][ T4694] tty_init_dev+0x60/0x3f4 [ 38.396055][ T4694] ptmx_open+0xfc/0x2d4 [ 38.396798][ T4694] chrdev_open+0x3d0/0x51c [ 38.397605][ T4694] do_dentry_open+0x738/0xf8c [ 38.398398][ T4694] vfs_open+0x7c/0x90 [ 38.399078][ T4694] path_openat+0x1fc0/0x27a0 [ 38.399918][ T4694] do_filp_open+0x198/0x38c [ 38.400714][ T4694] do_sys_openat2+0x134/0x3fc [ 38.401518][ T4694] __arm64_sys_openat+0x11c/0x150 [ 38.402450][ T4694] invoke_syscall+0x98/0x290 [ 38.403265][ T4694] el0_svc_common+0x13c/0x258 [ 38.404096][ T4694] do_el0_svc+0x5c/0x134 [ 38.404816][ T4694] el0_svc+0x58/0x128 [ 38.405530][ T4694] el0t_64_sync_handler+0x84/0xf0 [ 38.406408][ T4694] el0t_64_sync+0x18c/0x190 [ 38.553928][ T4688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.556777][ T4688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.585771][ T4703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.588869][ T4703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.019499][ T39] Bluetooth: hci5: Frame reassembly failed (-84) [ 39.177006][ T4734] FAULT_INJECTION: forcing a failure. [ 39.177006][ T4734] name failslab, interval 1, probability 0, space 0, times 0 [ 39.188927][ T4734] CPU: 0 PID: 4734 Comm: syz.2.110 Not tainted syzkaller #0 [ 39.190238][ T4734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.192101][ T4734] Call trace: [ 39.192716][ T4734] dump_backtrace+0x1c4/0x1f0 [ 39.193548][ T4734] show_stack+0x2c/0x3c [ 39.194289][ T4734] __dump_stack+0x30/0x40 [ 39.195050][ T4734] dump_stack_lvl+0xf4/0x15c [ 39.195826][ T4734] dump_stack+0x1c/0x5c [ 39.196564][ T4734] should_fail_ex+0x3cc/0x524 [ 39.197335][ T4734] __should_failslab+0xc0/0x11c [ 39.198139][ T4734] should_failslab+0x10/0x28 [ 39.198877][ T4734] __kmem_cache_alloc_node+0x7c/0x318 [ 39.199793][ T4734] kmalloc_trace+0x48/0x94 [ 39.200549][ T4734] nf_nat_register_fn+0x270/0x4e8 [ 39.201421][ T4734] nf_nat_ipv4_register_fn+0x5c/0x78 [ 39.202345][ T4734] iptable_nat_table_init+0xe0/0x2f0 [ 39.203261][ T4734] xt_find_table_lock+0x2c8/0x394 [ 39.204159][ T4734] xt_request_find_table_lock+0x38/0x114 [ 39.205176][ T4734] do_ipt_get_ctl+0x728/0x13d0 [ 39.206062][ T4734] nf_getsockopt+0x254/0x274 [ 39.206987][ T4734] ip_getsockopt+0x23c/0x344 [ 39.207805][ T4734] sctp_getsockopt+0x134/0x970 [ 39.208706][ T4734] sock_common_getsockopt+0xa8/0xc4 [ 39.209680][ T4734] __sys_getsockopt+0x1e0/0x474 [ 39.210529][ T4734] __arm64_sys_getsockopt+0xc0/0xdc [ 39.211420][ T4734] invoke_syscall+0x98/0x290 [ 39.212262][ T4734] el0_svc_common+0x13c/0x258 [ 39.213101][ T4734] do_el0_svc+0x5c/0x134 [ 39.213856][ T4734] el0_svc+0x58/0x128 [ 39.214572][ T4734] el0t_64_sync_handler+0x84/0xf0 [ 39.215428][ T4734] el0t_64_sync+0x18c/0x190 [ 39.376280][ T4744] FAULT_INJECTION: forcing a failure. [ 39.376280][ T4744] name failslab, interval 1, probability 0, space 0, times 0 [ 39.387758][ T4744] CPU: 0 PID: 4744 Comm: syz.2.113 Not tainted syzkaller #0 [ 39.389045][ T4744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 39.390810][ T4744] Call trace: [ 39.391367][ T4744] dump_backtrace+0x1c4/0x1f0 [ 39.392209][ T4744] show_stack+0x2c/0x3c [ 39.392872][ T4744] __dump_stack+0x30/0x40 [ 39.393564][ T4744] dump_stack_lvl+0xf4/0x15c [ 39.394337][ T4744] dump_stack+0x1c/0x5c [ 39.395014][ T4744] should_fail_ex+0x3cc/0x524 [ 39.395793][ T4744] __should_failslab+0xc0/0x11c [ 39.396627][ T4744] should_failslab+0x10/0x28 [ 39.397436][ T4744] kmem_cache_alloc+0x88/0x310 [ 39.398260][ T4744] vm_area_alloc+0x2c/0xe8 [ 39.399044][ T4744] mmap_region+0xb38/0x1860 [ 39.399852][ T4744] do_mmap+0xa64/0x1210 [ 39.400556][ T4744] vm_mmap_pgoff+0x194/0x298 [ 39.401323][ T4744] ksys_mmap_pgoff+0xd0/0x5a0 [ 39.402133][ T4744] __arm64_sys_mmap+0x108/0x120 [ 39.403003][ T4744] invoke_syscall+0x98/0x290 [ 39.403794][ T4744] el0_svc_common+0x13c/0x258 [ 39.404625][ T4744] do_el0_svc+0x5c/0x134 [ 39.405377][ T4744] el0_svc+0x58/0x128 [ 39.406085][ T4744] el0t_64_sync_handler+0x84/0xf0 [ 39.406961][ T4744] el0t_64_sync+0x18c/0x190 [ 39.641840][ T4336] Bluetooth: hci4: hardware error 0x04 [ 39.859424][ T4770] binder: 4769:4770 ioctl c0306201 20000080 returned -14 [ 39.862225][ T4770] binder: 4769:4770 tried to acquire reference to desc 0, got 1 instead [ 39.863802][ T4770] binder: 4769:4770 ioctl c0306201 200003c0 returned -14 [ 39.865581][ T4373] binder: release 4769:4770 transaction 11 out, still active [ 39.867088][ T4373] binder: undelivered TRANSACTION_COMPLETE [ 39.875186][ T4373] binder: send failed reply for transaction 11, target dead [ 39.894458][ T4772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.897425][ T4772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.396768][ T4781] 9pnet_virtio: no channels available for device syz [ 40.609033][ T4795] IPVS: sync thread started: state = MASTER, mcast_ifn = macsec0, syncid = 3, id = 0 [ 40.615598][ T4796] netlink: 'syz.2.135': attribute type 10 has an invalid length. [ 40.625158][ T4796] team0: Port device netdevsim0 added [ 40.730825][ T4802] tipc: Started in network mode [ 40.741406][ T4802] tipc: Node identity ac14142f, cluster identity 4711 [ 40.747913][ T4802] tipc: Enabled bearer , priority 10 [ 40.753010][ T4802] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 40.809199][ T4805] gadgetfs expected dummy_udc controller not usbip-vudc [ 40.812799][ T4805] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 40.816802][ T4805] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 41.039793][ T4330] Bluetooth: hci5: command 0x1003 tx timeout [ 41.041412][ T4332] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 41.049828][ T1516] psci: CPU1 killed (polled 0 ms) [ 41.079537][ T4373] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 41.192464][ T4820] tap0: tun_chr_ioctl cmd 1074025678 [ 41.193544][ T4820] tap0: group set to 8388641 [ 41.262276][ T4373] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 41.264086][ T4373] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 41.265862][ T4373] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 41.281815][ T4373] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 41.283589][ T4373] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 41.284916][ T4373] usb 1-1: Product: syz [ 41.285584][ T4373] usb 1-1: Manufacturer: syz [ 41.286332][ T4373] usb 1-1: SerialNumber: syz [ 41.368351][ T4824] 9pnet_virtio: no channels available for device syz [ 41.484985][ T4827] ======================================================= [ 41.484985][ T4827] WARNING: The mand mount option has been deprecated and [ 41.484985][ T4827] and is ignored by this kernel. Remove the mand [ 41.484985][ T4827] option from the mount to silence this warning. [ 41.484985][ T4827] ======================================================= [ 41.504829][ T4827] jffs2: notice: (4827) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 41.513518][ T4373] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 41.745609][ T4376] usb 1-1: USB disconnect, device number 3 [ 41.749356][ T4376] usblp0: removed [ 41.838511][ T4336] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 41.861862][ T4846] xt_hashlimit: size too large, truncated to 1048576 [ 41.867762][ T4374] tipc: Node number set to 2886997039 [ 42.014909][ T4849] batman_adv: batadv0: Adding interface: syzkaller0 [ 42.024246][ T4849] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 42.051654][ T4849] batman_adv: batadv0: Interface activated: syzkaller0 [ 42.070134][ T4848] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 42.130254][ T4848] batman_adv: batadv0: Removing interface: syzkaller0 [ 42.245871][ T4855] random: crng reseeded on system resumption [ 42.561882][ T4860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.575096][ T4860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.589388][ T4336] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 42.769484][ T4863] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 42.824230][ T4863] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 44.084015][ T4887] device syzkaller0 entered promiscuous mode [ 44.671964][ T4906] netlink: 24 bytes leftover after parsing attributes in process `syz.1.184'. [ 44.952443][ T4920] bridge0: port 2(bridge_slave_1) entered listening state [ 44.998636][ T4920] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.392402][ T4931] FAULT_INJECTION: forcing a failure. [ 45.392402][ T4931] name failslab, interval 1, probability 0, space 0, times 0 [ 45.411413][ T4931] CPU: 0 PID: 4931 Comm: syz.3.194 Not tainted syzkaller #0 [ 45.412697][ T4931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 45.414456][ T4931] Call trace: [ 45.415055][ T4931] dump_backtrace+0x1c4/0x1f0 [ 45.415853][ T4931] show_stack+0x2c/0x3c [ 45.416613][ T4931] __dump_stack+0x30/0x40 [ 45.417379][ T4931] dump_stack_lvl+0xf4/0x15c [ 45.418199][ T4931] dump_stack+0x1c/0x5c [ 45.418902][ T4931] should_fail_ex+0x3cc/0x524 [ 45.419751][ T4931] __should_failslab+0xc0/0x11c [ 45.420559][ T4931] should_failslab+0x10/0x28 [ 45.421320][ T4931] __kmem_cache_alloc_node+0x7c/0x318 [ 45.422242][ T4931] __kmalloc+0xc4/0x180 [ 45.423030][ T4931] alloc_workqueue+0x164/0xeec [ 45.423876][ T4931] nci_register_device+0x1f8/0x7e4 [ 45.424756][ T4931] virtual_ncidev_open+0x6c/0xd8 [ 45.425614][ T4931] misc_open+0x310/0x388 [ 45.426370][ T4931] chrdev_open+0x3d0/0x51c [ 45.427153][ T4931] do_dentry_open+0x738/0xf8c [ 45.427995][ T4931] vfs_open+0x7c/0x90 [ 45.428746][ T4931] path_openat+0x1fc0/0x27a0 [ 45.429600][ T4931] do_filp_open+0x198/0x38c [ 45.430412][ T4931] do_sys_openat2+0x134/0x3fc [ 45.431245][ T4931] __arm64_sys_openat+0x11c/0x150 [ 45.432183][ T4931] invoke_syscall+0x98/0x290 [ 45.433015][ T4931] el0_svc_common+0x13c/0x258 [ 45.433877][ T4931] do_el0_svc+0x5c/0x134 [ 45.434573][ T4931] el0_svc+0x58/0x128 [ 45.435277][ T4931] el0t_64_sync_handler+0x84/0xf0 [ 45.436183][ T4931] el0t_64_sync+0x18c/0x190 [ 45.437025][ C0] vkms_vblank_simulate: vblank timer overrun [ 45.825122][ C0] IPv4: Oversized IP packet from 172.20.20.170 [ 46.047520][ T4944] process 'syz.1.200' launched './file0' with NULL argv: empty string added [ 46.056867][ T4944] FAULT_INJECTION: forcing a failure. [ 46.056867][ T4944] name failslab, interval 1, probability 0, space 0, times 0 [ 46.081848][ T4944] CPU: 0 PID: 4944 Comm: syz.1.200 Not tainted syzkaller #0 [ 46.083161][ T4944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 46.084860][ T4944] Call trace: [ 46.085442][ T4944] dump_backtrace+0x1c4/0x1f0 [ 46.086250][ T4944] show_stack+0x2c/0x3c [ 46.087003][ T4944] __dump_stack+0x30/0x40 [ 46.087785][ T4944] dump_stack_lvl+0xf4/0x15c [ 46.088586][ T4944] dump_stack+0x1c/0x5c [ 46.089297][ T4944] should_fail_ex+0x3cc/0x524 [ 46.090140][ T4944] __should_failslab+0xc0/0x11c [ 46.091018][ T4944] should_failslab+0x10/0x28 [ 46.091834][ T4944] kmem_cache_alloc+0x88/0x310 [ 46.092686][ T4944] getname_kernel+0x68/0x2bc [ 46.093477][ T4944] kern_path+0x2c/0x6c [ 46.094219][ T4944] tomoyo_realpath_nofollow+0x98/0x128 [ 46.095184][ T4944] tomoyo_find_next_domain+0x208/0x160c [ 46.096131][ T4944] tomoyo_bprm_check_security+0xdc/0x130 [ 46.097078][ T4944] security_bprm_check+0x6c/0xa8 [ 46.097926][ T4944] bprm_execve+0x8b8/0x1588 [ 46.098684][ T4944] do_execveat_common+0x668/0x7fc [ 46.099523][ T4944] __arm64_sys_execve+0x98/0xb0 [ 46.100457][ T4944] invoke_syscall+0x98/0x290 [ 46.101334][ T4944] el0_svc_common+0x13c/0x258 [ 46.102183][ T4944] do_el0_svc+0x5c/0x134 [ 46.102951][ T4944] el0_svc+0x58/0x128 [ 46.103666][ T4944] el0t_64_sync_handler+0x84/0xf0 [ 46.104591][ T4944] el0t_64_sync+0x18c/0x190 [ 46.329768][ T4950] binder: 4948:4950 tried to acquire reference to desc 0, got 1 instead [ 46.340765][ T4950] binder: 4948:4950 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 46.370756][ T4950] binder: 4950 RLIMIT_NICE not set [ 46.371715][ T4950] binder: 4950 RLIMIT_NICE not set [ 46.384274][ T4374] binder: release 4948:4950 transaction 16 out, still active [ 46.385477][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 46.434144][ T4376] binder: release 4948:4950 transaction 16 in, still active [ 46.435583][ T4376] binder: send failed reply for transaction 16, target dead [ 47.746814][ T5013] Cannot find add_set index 0 as target [ 48.282474][ T5022] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.321009][ T5026] null_blk: disk nullb1 created [ 48.484470][ T5032] FAULT_INJECTION: forcing a failure. [ 48.484470][ T5032] name failslab, interval 1, probability 0, space 0, times 0 [ 48.494227][ T5032] CPU: 0 PID: 5032 Comm: syz.2.225 Not tainted syzkaller #0 [ 48.495490][ T5032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 48.497530][ T5032] Call trace: [ 48.498200][ T5032] dump_backtrace+0x1c4/0x1f0 [ 48.499102][ T5032] show_stack+0x2c/0x3c [ 48.499897][ T5032] __dump_stack+0x30/0x40 [ 48.500724][ T5032] dump_stack_lvl+0xf4/0x15c [ 48.501580][ T5032] dump_stack+0x1c/0x5c [ 48.502323][ T5032] should_fail_ex+0x3cc/0x524 [ 48.503216][ T5032] __should_failslab+0xc0/0x11c [ 48.504156][ T5032] should_failslab+0x10/0x28 [ 48.505038][ T5032] __kmem_cache_alloc_node+0x7c/0x318 [ 48.506025][ T5032] kmalloc_trace+0x48/0x94 [ 48.506831][ T5032] sctp_add_bind_addr+0x9c/0x2e8 [ 48.507679][ T5032] sctp_copy_local_addr_list+0x2d4/0x474 [ 48.508683][ T5032] sctp_copy_one_addr+0xb0/0x33c [ 48.509551][ T5032] sctp_bind_addr_copy+0xa8/0x39c [ 48.510474][ T5032] sctp_assoc_set_bind_addr_from_ep+0x128/0x184 [ 48.511528][ T5032] sctp_connect_new_asoc+0x28c/0x5f4 [ 48.512441][ T5032] sctp_sendmsg+0x10f4/0x20f4 [ 48.513225][ T5032] inet_sendmsg+0x154/0x27c [ 48.514029][ T5032] __sys_sendto+0x324/0x440 [ 48.514817][ T5032] __arm64_sys_sendto+0xe4/0x104 [ 48.515662][ T5032] invoke_syscall+0x98/0x290 [ 48.516452][ T5032] el0_svc_common+0x13c/0x258 [ 48.517278][ T5032] do_el0_svc+0x5c/0x134 [ 48.518105][ T5032] el0_svc+0x58/0x128 [ 48.518869][ T5032] el0t_64_sync_handler+0x84/0xf0 [ 48.519685][ T5032] el0t_64_sync+0x18c/0x190 [ 48.921771][ T5022] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 48.940491][ T5019] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 48.973911][ T5022] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.355786][ T5048] capability: warning: `syz.2.233' uses 32-bit capabilities (legacy support in use) [ 49.428876][ T5022] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.435440][ T5022] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.443475][ T5022] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.447620][ T5022] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 49.537924][ T4376] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 49.719491][ T4376] usb 1-1: Using ep0 maxpacket: 8 [ 49.721952][ T4376] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 49.723388][ T4376] usb 1-1: config 0 has no interface number 0 [ 49.724480][ T4376] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 49.731208][ T4376] usb 1-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 49.732802][ T4376] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 49.734923][ T4376] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 49.736656][ T4376] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.750746][ T4376] usb 1-1: config 0 descriptor?? [ 49.755950][ T4376] ldusb 1-1:0.55: Interrupt in endpoint not found [ 49.870560][ T5058] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.876681][ T5058] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.983468][ T4376] usb 1-1: USB disconnect, device number 4 [ 50.264471][ T5066] Invalid auth_tok structure returned from key query [ 50.276723][ T5066] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 50.289807][ T5066] One or more global auth toks could not properly register; rc = [-22] [ 50.308896][ T5066] Error parsing options; rc = [-22] [ 50.470603][ T5076] netlink: 52 bytes leftover after parsing attributes in process `syz.3.241'. [ 50.524171][ T5069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.241'. [ 50.570203][ T5069] CIFS: Attempting to mount \\127.0.0.1\share [ 50.593540][ T5078] netlink: 'syz.1.244': attribute type 24 has an invalid length. [ 50.614494][ T5078] netlink: 'syz.1.244': attribute type 1 has an invalid length. [ 50.644400][ T5078] netlink: 220 bytes leftover after parsing attributes in process `syz.1.244'. [ 50.647125][ T5075] hub 1-0:1.0: USB hub found [ 50.664780][ T5075] hub 1-0:1.0: 1 port detected [ 50.991005][ T5092] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 51.129635][ T5069] CIFS: VFS: Error connecting to socket. Aborting operation. [ 51.133146][ T5069] CIFS: VFS: cifs_mount failed w/return code = -4 [ 51.505320][ T5113] netlink: 20 bytes leftover after parsing attributes in process `syz.1.262'. [ 51.515657][ T5112] IPv6: NLM_F_REPLACE set, but no existing node found! [ 51.730775][ T5121] FAULT_INJECTION: forcing a failure. [ 51.730775][ T5121] name failslab, interval 1, probability 0, space 0, times 0 [ 51.733003][ T5121] CPU: 0 PID: 5121 Comm: syz.0.265 Not tainted syzkaller #0 [ 51.734219][ T5121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 51.735968][ T5121] Call trace: [ 51.736540][ T5121] dump_backtrace+0x1c4/0x1f0 [ 51.737353][ T5121] show_stack+0x2c/0x3c [ 51.738133][ T5121] __dump_stack+0x30/0x40 [ 51.738938][ T5121] dump_stack_lvl+0xf4/0x15c [ 51.739748][ T5121] dump_stack+0x1c/0x5c [ 51.740475][ T5121] should_fail_ex+0x3cc/0x524 [ 51.741333][ T5121] __should_failslab+0xc0/0x11c [ 51.742185][ T5121] should_failslab+0x10/0x28 [ 51.743002][ T5121] kmem_cache_alloc+0x88/0x310 [ 51.743921][ T5121] mas_alloc_nodes+0x284/0x758 [ 51.744820][ T5121] mas_preallocate+0x13c/0x310 [ 51.745744][ T5121] vma_link+0xd0/0x288 [ 51.746450][ T5121] insert_vm_struct+0x264/0x380 [ 51.747375][ T5121] alloc_bprm+0x460/0x63c [ 51.748229][ T5121] do_execveat_common+0x16c/0x7fc [ 51.749200][ T5121] __arm64_sys_execve+0x98/0xb0 [ 51.750057][ T5121] invoke_syscall+0x98/0x290 [ 51.750883][ T5121] el0_svc_common+0x13c/0x258 [ 51.751726][ T5121] do_el0_svc+0x5c/0x134 [ 51.752523][ T5121] el0_svc+0x58/0x128 [ 51.753204][ T5121] el0t_64_sync_handler+0x84/0xf0 [ 51.754091][ T5121] el0t_64_sync+0x18c/0x190 [ 52.562557][ T5168] kAFS: Invalid Command on /proc/fs/afs/cells file [ 53.123261][ T5200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.135592][ T5200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.222289][ T4336] block nbd3: Receive control failed (result -32) [ 54.230689][ T5207] block nbd3: shutting down sockets [ 54.871554][ T5251] netlink: 52 bytes leftover after parsing attributes in process `syz.1.321'. [ 55.387739][ T5271] netlink: 8 bytes leftover after parsing attributes in process `syz.2.329'. [ 55.742735][ T5288] misc userio: Invalid payload size [ 55.934573][ T5293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.949951][ T5293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.245800][ T5304] device syzkaller0 entered promiscuous mode [ 56.568901][ T5317] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 56.570253][ T5317] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 56.611045][ T5317] vhci_hcd vhci_hcd.0: Device attached [ 56.623545][ T5319] vhci_hcd: connection closed [ 56.625017][ T4381] vhci_hcd: stop threads [ 56.628688][ T4381] vhci_hcd: release socket [ 56.629498][ T4381] vhci_hcd: disconnect device [ 56.650826][ T5324] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 56.676315][ T5329] netlink: 12 bytes leftover after parsing attributes in process `syz.3.356'. [ 56.809087][ T5336] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 56.810428][ T5336] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 56.831685][ T5336] vhci_hcd vhci_hcd.0: Device attached [ 56.950695][ T5350] ieee802154 phy0 wpan0: encryption failed: -22 [ 57.096761][ T4376] usb 4-1: new low-speed USB device number 2 using vhci_hcd [ 57.112951][ T5359] netlink: 'syz.4.369': attribute type 10 has an invalid length. [ 57.138600][ T5359] device macvlan0 entered promiscuous mode [ 57.159006][ T5359] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 57.338508][ T5368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.340084][ T5368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.366044][ T5338] vhci_hcd: connection reset by peer [ 57.368565][ T11] vhci_hcd: stop threads [ 57.369322][ T11] vhci_hcd: release socket [ 57.370996][ T11] vhci_hcd: disconnect device [ 57.984964][ T5386] FAULT_INJECTION: forcing a failure. [ 57.984964][ T5386] name failslab, interval 1, probability 0, space 0, times 0 [ 58.005227][ T5386] CPU: 0 PID: 5386 Comm: syz.4.382 Not tainted syzkaller #0 [ 58.006677][ T5386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 58.008541][ T5386] Call trace: [ 58.009117][ T5386] dump_backtrace+0x1c4/0x1f0 [ 58.009961][ T5386] show_stack+0x2c/0x3c [ 58.010672][ T5386] __dump_stack+0x30/0x40 [ 58.011423][ T5386] dump_stack_lvl+0xf4/0x15c [ 58.012278][ T5386] dump_stack+0x1c/0x5c [ 58.013043][ T5386] should_fail_ex+0x3cc/0x524 [ 58.013842][ T5386] __should_failslab+0xc0/0x11c [ 58.014737][ T5386] should_failslab+0x10/0x28 [ 58.015537][ T5386] kmem_cache_alloc_node+0x8c/0x344 [ 58.016423][ T5386] alloc_vmap_area+0x13c/0x169c [ 58.017271][ T5386] __get_vm_area_node+0x178/0x31c [ 58.018110][ T5386] __vmalloc_node_range+0x1d4/0xe70 [ 58.019027][ T5386] vmalloc+0x9c/0xd4 [ 58.019705][ T5386] bpf_jit_alloc_exec+0x20/0x30 [ 58.020537][ T5386] bpf_jit_binary_alloc+0xd8/0x1e8 [ 58.021425][ T5386] bpf_int_jit_compile+0xd2c/0x1090 [ 58.022295][ T5386] bpf_prog_select_runtime+0x3c4/0x698 [ 58.023263][ T5386] bpf_prepare_filter+0xd60/0xebc [ 58.024122][ T5386] bpf_prog_create_from_user+0x2cc/0x464 [ 58.025186][ T5386] do_seccomp+0x900/0xea4 [ 58.025943][ T5386] prctl_set_seccomp+0x60/0x7c [ 58.026784][ T5386] __arm64_sys_prctl+0x4e8/0xfe0 [ 58.027613][ T5386] invoke_syscall+0x98/0x290 [ 58.028446][ T5386] el0_svc_common+0x13c/0x258 [ 58.029314][ T5386] do_el0_svc+0x5c/0x134 [ 58.030102][ T5386] el0_svc+0x58/0x128 [ 58.030847][ T5386] el0t_64_sync_handler+0x84/0xf0 [ 58.031787][ T5386] el0t_64_sync+0x18c/0x190 [ 58.032625][ C0] vkms_vblank_simulate: vblank timer overrun [ 58.056249][ T5390] binder: 5387:5390 unknown command 1074553619 [ 58.061932][ T5390] binder: 5387:5390 ioctl c0306201 20000040 returned -22 [ 58.161208][ T5386] syz.4.382: vmalloc error: size 4096, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz4,mems_allowed=0 [ 58.164040][ T5386] CPU: 0 PID: 5386 Comm: syz.4.382 Not tainted syzkaller #0 [ 58.165303][ T5386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 58.167183][ T5386] Call trace: [ 58.167758][ T5386] dump_backtrace+0x1c4/0x1f0 [ 58.168626][ T5386] show_stack+0x2c/0x3c [ 58.169369][ T5386] __dump_stack+0x30/0x40 [ 58.170159][ T5386] dump_stack_lvl+0xf4/0x15c [ 58.170949][ T5386] dump_stack+0x1c/0x5c [ 58.171711][ T5386] warn_alloc+0x214/0x324 [ 58.172455][ T5386] __vmalloc_node_range+0x24c/0xe70 [ 58.173381][ T5386] vmalloc+0x9c/0xd4 [ 58.174116][ T5386] bpf_jit_alloc_exec+0x20/0x30 [ 58.175016][ T5386] bpf_jit_binary_alloc+0xd8/0x1e8 [ 58.176061][ T5386] bpf_int_jit_compile+0xd2c/0x1090 [ 58.176967][ T5386] bpf_prog_select_runtime+0x3c4/0x698 [ 58.178022][ T5386] bpf_prepare_filter+0xd60/0xebc [ 58.178945][ T5386] bpf_prog_create_from_user+0x2cc/0x464 [ 58.179968][ T5386] do_seccomp+0x900/0xea4 [ 58.180772][ T5386] prctl_set_seccomp+0x60/0x7c [ 58.181593][ T5386] __arm64_sys_prctl+0x4e8/0xfe0 [ 58.182470][ T5386] invoke_syscall+0x98/0x290 [ 58.183365][ T5386] el0_svc_common+0x13c/0x258 [ 58.184211][ T5386] do_el0_svc+0x5c/0x134 [ 58.184934][ T5386] el0_svc+0x58/0x128 [ 58.185665][ T5386] el0t_64_sync_handler+0x84/0xf0 [ 58.186541][ T5386] el0t_64_sync+0x18c/0x190 [ 58.201863][ T5386] Mem-Info: [ 58.204024][ T5386] active_anon:4889 inactive_anon:0 isolated_anon:0 [ 58.204024][ T5386] active_file:6225 inactive_file:12572 isolated_file:0 [ 58.204024][ T5386] unevictable:768 dirty:64 writeback:0 [ 58.204024][ T5386] slab_reclaimable:18813 slab_unreclaimable:96666 [ 58.204024][ T5386] mapped:29270 shmem:954 pagetables:599 [ 58.204024][ T5386] sec_pagetables:0 bounce:0 [ 58.204024][ T5386] kernel_misc_reclaimable:0 [ 58.204024][ T5386] free:1435905 free_pcp:815 free_cma:7360 [ 58.254424][ T5386] Node 0 active_anon:19660kB inactive_anon:0kB active_file:24900kB inactive_file:50288kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:117080kB dirty:256kB writeback:0kB shmem:3816kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:8064kB pagetables:2396kB sec_pagetables:0kB all_unreclaimable? no [ 58.297321][ T5386] Node 0 DMA free:3076864kB boost:0kB min:20664kB low:25828kB high:30992kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:29440kB [ 58.311004][ T5386] lowmem_reserve[]: 0 0 3550 3550 3550 [ 58.312269][ T5386] Node 0 Normal free:2666508kB boost:0kB min:24388kB low:30484kB high:36580kB reserved_highatomic:0KB active_anon:19608kB inactive_anon:0kB active_file:24900kB inactive_file:50288kB unevictable:3072kB writepending:256kB present:5242880kB managed:3639600kB mlocked:0kB bounce:0kB free_pcp:3832kB local_pcp:3832kB free_cma:0kB [ 58.325088][ T5386] lowmem_reserve[]: 0 0 0 0 0 [ 58.325975][ T5386] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 0*1024kB 0*2048kB 751*4096kB (MC) = 3076864kB [ 58.334400][ T5386] Node 0 Normal: 291*4kB (UME) 650*8kB (UME) 459*16kB (UME) 514*32kB (UME) 201*64kB (UME) 28*128kB (UME) 6*256kB (UME) 10*512kB (UM) 6*1024kB (UM) 3*2048kB (UM) 635*4096kB (UM) = 2666508kB [ 58.343350][ T5386] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 58.350532][ T5386] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 58.359400][ T5386] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 58.363102][ T5386] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 58.370408][ T5386] 19751 total pagecache pages [ 58.371238][ T5386] 0 pages in swap cache [ 58.375367][ T5386] Free swap = 124740kB [ 58.376107][ T5386] Total swap = 124996kB [ 58.378045][ T5386] 2097152 pages RAM [ 58.378738][ T5386] 0 pages HighMem/MovableOnly [ 58.382299][ T5386] 417204 pages reserved [ 58.383056][ T5386] 8192 pages cma reserved [ 58.386147][ T5386] 0 pages hwpoisoned [ 58.458780][ T5397] syz.4.386 (5397): attempted to duplicate a private mapping with mremap. This is not supported. [ 58.572489][ T5399] Zero length message leads to an empty skb [ 58.977299][ T5384] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 58.985628][ T5384] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 59.022242][ T5384] Bluetooth: hci0: Suspend notifier action (1) failed: -4 [ 59.042704][ T5384] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 59.050987][ T5384] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 59.060479][ T5384] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 59.070826][ T5384] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 59.076892][ T5384] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 59.085591][ T5384] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 59.097444][ T5384] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 59.102004][ T5384] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 59.124198][ T5384] Bluetooth: hci3: Suspend notifier action (1) failed: -4 [ 59.258916][ T5409] netlink: 'syz.2.390': attribute type 10 has an invalid length. [ 59.260411][ T5409] netlink: 40 bytes leftover after parsing attributes in process `syz.2.390'. [ 59.292456][ T5409] FAULT_INJECTION: forcing a failure. [ 59.292456][ T5409] name failslab, interval 1, probability 0, space 0, times 0 [ 59.294939][ T5409] CPU: 0 PID: 5409 Comm: syz.2.390 Not tainted syzkaller #0 [ 59.296189][ T5409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 59.297941][ T5409] Call trace: [ 59.298524][ T5409] dump_backtrace+0x1c4/0x1f0 [ 59.299316][ T5409] show_stack+0x2c/0x3c [ 59.300057][ T5409] __dump_stack+0x30/0x40 [ 59.300838][ T5409] dump_stack_lvl+0xf4/0x15c [ 59.301669][ T5409] dump_stack+0x1c/0x5c [ 59.302373][ T5409] should_fail_ex+0x3cc/0x524 [ 59.303205][ T5409] __should_failslab+0xc0/0x11c [ 59.304103][ T5409] should_failslab+0x10/0x28 [ 59.304928][ T5409] __kmem_cache_alloc_node+0x7c/0x318 [ 59.305877][ T5409] __kmalloc+0xc4/0x180 [ 59.306624][ T5409] fib_create_info+0x8b0/0x1e98 [ 59.307458][ T5409] fib_table_insert+0xb0/0x13fc [ 59.308268][ T5409] fib_magic+0x26c/0x344 [ 59.309018][ T5409] fib_add_ifaddr+0x114/0x500 [ 59.309914][ T5409] fib_netdev_event+0x360/0x4a0 [ 59.310898][ T5409] raw_notifier_call_chain+0xd8/0x168 [ 59.311833][ T5409] dev_open+0x184/0x228 [ 59.312581][ T5409] team_add_slave+0x530/0x20cc [ 59.313406][ T5409] do_setlink+0xb14/0x2158 [ 59.314192][ T5409] rtnl_setlink+0x314/0x408 [ 59.314987][ T5409] rtnetlink_rcv_msg+0x694/0xcc4 [ 59.315854][ T5409] netlink_rcv_skb+0x220/0x3ec [ 59.316712][ T5409] rtnetlink_rcv+0x28/0x38 [ 59.317481][ T5409] netlink_unicast+0x5fc/0x80c [ 59.318312][ T5409] netlink_sendmsg+0x6f0/0x9d8 [ 59.319179][ T5409] ____sys_sendmsg+0x588/0x90c [ 59.319993][ T5409] __sys_sendmsg+0x288/0x374 [ 59.320789][ T5409] __arm64_sys_sendmsg+0x80/0x94 [ 59.321657][ T5409] invoke_syscall+0x98/0x290 [ 59.322437][ T5409] el0_svc_common+0x13c/0x258 [ 59.323344][ T5409] do_el0_svc+0x5c/0x134 [ 59.324079][ T5409] el0_svc+0x58/0x128 [ 59.324750][ T5409] el0t_64_sync_handler+0x84/0xf0 [ 59.325626][ T5409] el0t_64_sync+0x18c/0x190 [ 59.326538][ C0] vkms_vblank_simulate: vblank timer overrun [ 59.433686][ T5420] ERROR: device name not specified. [ 59.492688][ T5423] binder: 5421:5423 tried to acquire reference to desc 0, got 1 instead [ 59.499757][ T5423] binder: 5421:5423 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 59.510700][ T5423] binder: 5423 RLIMIT_NICE not set [ 59.515277][ T5423] binder: 5423 RLIMIT_NICE not set [ 59.520378][ T5423] binder: release 5421:5423 transaction 30 out, still active [ 59.521950][ T5423] binder: release 5421:5423 transaction 23 in, still active [ 59.531281][ T5423] binder: undelivered TRANSACTION_COMPLETE [ 59.553375][ T5409] team0: Device ipvlan1 failed to register rx_handler [ 59.574386][ T1516] binder: release 5421:5423 transaction 23 out, still active [ 59.575836][ T1516] binder: undelivered TRANSACTION_COMPLETE [ 59.577233][ T1516] binder: send failed reply for transaction 30, target dead [ 59.578632][ T1516] binder: send failed reply for transaction 23, target dead [ 59.619940][ T5409] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 59.637771][ T5414] netlink: 'syz.3.393': attribute type 1 has an invalid length. [ 59.662959][ T5422] netlink: 4 bytes leftover after parsing attributes in process `syz.3.393'. [ 59.681841][ T5422] bond1: (slave bridge1): making interface the new active one [ 59.693424][ T5422] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 59.940459][ T27] audit: type=1326 audit(315.929:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5437 comm="syz.3.402" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffffb9179368 code=0x0 [ 60.608517][ T4374] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 60.786489][ T4374] usb 1-1: Using ep0 maxpacket: 8 [ 60.799062][ T4374] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 60.800849][ T4374] usb 1-1: config 179 has no interface number 0 [ 60.802282][ T4374] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 60.804185][ T4374] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 60.805972][ T4374] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 60.819898][ T4374] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 60.821892][ T4374] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 60.824308][ T4374] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 60.825986][ T4374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.845786][ T5452] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 60.872573][ T4374] xpad: probe of 1-1:179.65 failed with error -5 [ 60.899694][ T5466] 9pnet_virtio: no channels available for device syz [ 60.937980][ T5470] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 61.012159][ T5470] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 61.036404][ T4336] Bluetooth: hci1: command 0x0c1a tx timeout [ 61.037665][ T4336] Bluetooth: hci0: command 0x0c1a tx timeout [ 61.052955][ T5475] 9pnet_virtio: no channels available for device syz [ 61.079068][ T1516] usb 1-1: USB disconnect, device number 5 [ 61.116214][ T48] Bluetooth: hci3: command 0x0c1a tx timeout [ 61.117344][ T48] Bluetooth: hci2: command 0x0c1a tx timeout [ 61.223084][ T5483] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.225480][ T5482] bridge0: port 3(team0) entered blocking state [ 61.238829][ T5483] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.242580][ T5484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.245000][ T5482] bridge0: port 3(team0) entered disabled state [ 61.251385][ T5484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.258245][ T5482] device team0 entered promiscuous mode [ 61.259289][ T5482] device team_slave_0 entered promiscuous mode [ 61.260583][ T5482] device team_slave_1 entered promiscuous mode [ 61.853262][ T5504] null_blk: disk rnullb0 created [ 62.113710][ T5519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.440'. [ 62.145151][ T5520] netlink: 'syz.4.441': attribute type 1 has an invalid length. [ 62.164848][ T5520] netlink: 'syz.4.441': attribute type 2 has an invalid length. [ 62.174295][ T5519] bond0: (slave macvlan0): Opening slave failed [ 62.239138][ T4376] vhci_hcd: vhci_device speed not set [ 62.417723][ T5526] FAULT_INJECTION: forcing a failure. [ 62.417723][ T5526] name failslab, interval 1, probability 0, space 0, times 0 [ 62.420166][ T5526] CPU: 0 PID: 5526 Comm: syz.4.444 Not tainted syzkaller #0 [ 62.421406][ T5526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 62.423025][ T5526] Call trace: [ 62.423561][ T5526] dump_backtrace+0x1c4/0x1f0 [ 62.424363][ T5526] show_stack+0x2c/0x3c [ 62.425084][ T5526] __dump_stack+0x30/0x40 [ 62.425901][ T5526] dump_stack_lvl+0xf4/0x15c [ 62.426757][ T5526] dump_stack+0x1c/0x5c [ 62.427454][ T5526] should_fail_ex+0x3cc/0x524 [ 62.428257][ T5526] __should_failslab+0xc0/0x11c [ 62.429096][ T5526] should_failslab+0x10/0x28 [ 62.429859][ T5526] __kmem_cache_alloc_node+0x7c/0x318 [ 62.430856][ T5526] kmalloc_trace+0x48/0x94 [ 62.431624][ T5526] assoc_array_insert+0x300/0x257c [ 62.432491][ T5526] key_link+0x130/0x424 [ 62.433235][ T5526] look_up_user_keyrings+0x3f0/0x550 [ 62.434155][ T5526] lookup_user_key+0x2b4/0xf94 [ 62.435007][ T5526] __arm64_sys_add_key+0x3d4/0x520 [ 62.435925][ T5526] invoke_syscall+0x98/0x290 [ 62.436795][ T5526] el0_svc_common+0x13c/0x258 [ 62.437703][ T5526] do_el0_svc+0x5c/0x134 [ 62.438518][ T5526] el0_svc+0x58/0x128 [ 62.439224][ T5526] el0t_64_sync_handler+0x84/0xf0 [ 62.440157][ T5526] el0t_64_sync+0x18c/0x190 [ 63.118492][ T4336] Bluetooth: hci0: command 0x0406 tx timeout [ 63.119657][ T4336] Bluetooth: hci1: command 0x0406 tx timeout [ 63.197971][ T48] Bluetooth: hci2: command 0x0406 tx timeout [ 63.199159][ T48] Bluetooth: hci3: command 0x0406 tx timeout [ 63.666615][ T5589] lo speed is unknown, defaulting to 1000 [ 63.711470][ T5593] jffs2: notice: (5593) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 63.824693][ T5546] X25: received unknown 00 with LCI 000 [ 64.008312][ T5616] device-mapper: ioctl: unable to find target [ 64.479533][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.480807][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.971182][ T5667] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 65.012195][ T5668] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 65.032209][ T5668] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.070815][ T5668] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.072985][ T5668] device bridge_slave_0 left promiscuous mode [ 65.074176][ T5668] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.211809][ T5668] device bridge_slave_1 left promiscuous mode [ 65.213697][ T5668] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.288538][ T5668] bond0: (slave bond_slave_0): Releasing backup interface [ 65.374957][ T5668] bond0: (slave bond_slave_1): Releasing backup interface [ 65.470432][ T5695] nvme_fabrics: missing parameter 'traddr=%s' [ 65.542940][ T5668] team0: Port device team_slave_0 removed [ 65.574465][ T5668] team0: Port device team_slave_1 removed [ 65.584897][ T5668] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 65.597087][ T5668] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 65.609382][ T5668] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 65.620121][ T5668] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 65.672840][ T5668] bond0: (slave macvlan0): Releasing backup interface [ 66.192081][ T4336] Bluetooth: hci2: Malformed LE Event: 0x0d [ 66.392191][ T5719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.408811][ T5719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.542993][ T5724] team0: Device is already in use. [ 67.198656][ T5753] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 67.233030][ T5754] ubi0: attaching mtd0 [ 67.239291][ T5754] ubi0: scanning is finished [ 67.243194][ T5754] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 67.281224][ T5757] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 67.297685][ T5754] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 67.514754][ T5764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.530524][ T5764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.580569][ T5768] batman_adv: batadv0: Adding interface: syzkaller0 [ 67.596999][ T5768] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.609329][ T5768] batman_adv: batadv0: Interface activated: syzkaller0 [ 67.617700][ T5766] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 67.657025][ T5766] batman_adv: batadv0: Removing interface: syzkaller0 [ 67.762025][ T5764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.764644][ T5764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.029036][ T5785] device syzkaller0 entered promiscuous mode [ 68.059085][ T5785] 0: reclassify loop, rule prio 0, protocol 700 [ 68.288090][ T5796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.530'. [ 68.417717][ T5802] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 68.594698][ T5815] overlayfs: unrecognized mount option "workdir=" or missing value [ 68.930909][ T5835] netlink: 8 bytes leftover after parsing attributes in process `syz.0.541'. [ 68.953954][ T5839] 9pnet_virtio: no channels available for device syz [ 69.205986][ T27] audit: type=1400 audit(325.180:3): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=5834 comm="syz.1.545" [ 69.599245][ T7] cfg80211: failed to load regulatory.db [ 69.936374][ T4336] Bluetooth: hci3: unexpected event for opcode 0x0c46 [ 70.006667][ T5877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.558'. [ 70.020774][ T5877] netlink: 12 bytes leftover after parsing attributes in process `syz.4.558'. [ 70.037258][ T5877] netlink: 'syz.4.558': attribute type 19 has an invalid length. [ 70.059701][ T5879] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 70.060933][ T5879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 70.070503][ T5877] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.072393][ T5877] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.074028][ T5877] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.075624][ T5877] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 70.089984][ T5879] vhci_hcd vhci_hcd.0: Device attached [ 70.108089][ T5879] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(5) [ 70.109289][ T5879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 70.123063][ T5879] vhci_hcd vhci_hcd.0: Device attached [ 70.138210][ T5879] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(7) [ 70.139445][ T5879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 70.154178][ T5879] vhci_hcd vhci_hcd.0: Device attached [ 70.173238][ T5879] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(9) [ 70.174472][ T5879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 70.183590][ T5879] vhci_hcd vhci_hcd.0: Device attached [ 70.193683][ T5879] vhci_hcd vhci_hcd.0: pdev(3) rhport(4) sockfd(11) [ 70.194932][ T5879] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 70.237452][ T5879] vhci_hcd vhci_hcd.0: Device attached [ 70.240042][ T5888] vhci_hcd: connection closed [ 70.240156][ T4392] vhci_hcd: stop threads [ 70.241591][ T4392] vhci_hcd: release socket [ 70.242525][ T4392] vhci_hcd: disconnect device [ 70.243411][ T5886] vhci_hcd: connection closed [ 70.244302][ T5884] vhci_hcd: connection closed [ 70.247602][ T4392] vhci_hcd: stop threads [ 70.249023][ T4392] vhci_hcd: release socket [ 70.250221][ T5882] vhci_hcd: connection closed [ 70.250358][ T5880] vhci_hcd: connection closed [ 70.254560][ T4392] vhci_hcd: disconnect device [ 70.258308][ T4392] vhci_hcd: stop threads [ 70.259076][ T4392] vhci_hcd: release socket [ 70.267348][ T4392] vhci_hcd: disconnect device [ 70.268471][ T4392] vhci_hcd: stop threads [ 70.269239][ T4392] vhci_hcd: release socket [ 70.270181][ T4392] vhci_hcd: disconnect device [ 70.271168][ T4392] vhci_hcd: stop threads [ 70.271870][ T4392] vhci_hcd: release socket [ 70.272644][ T4392] vhci_hcd: disconnect device [ 70.286506][ T7] vhci_hcd: vhci_device speed not set [ 70.491677][ T5898] netlink: 40 bytes leftover after parsing attributes in process `syz.1.563'. [ 70.860164][ T5921] binder: 5919:5921 got transaction to invalid handle, 1 [ 70.862869][ T5921] binder: 5921:5919 cannot find target node [ 70.873285][ T5921] binder: 5919:5921 transaction async to 0:0 failed 31/29201/-22, size 0-0 line 3062 [ 70.891157][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 70.897241][ T5926] netlink: 8 bytes leftover after parsing attributes in process `syz.3.575'. [ 71.381799][ T5959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.383469][ T5959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.567566][ T5969] netlink: 4 bytes leftover after parsing attributes in process `syz.1.594'. [ 71.579452][ T5969] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 71.640554][ T5973] CIFS: Attempting to mount \\1#7.0.0.1\Ë7Ì [ 71.642804][ T5973] CIFS: VFS: No username specified [ 71.669761][ T5969] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 71.777580][ T5983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.779226][ T5983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.915632][ T5995] jffs2: notice: (5995) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 72.159971][ T4336] Bluetooth: hci0: Unknown advertising packet type: 0x600 [ 72.160044][ T4336] Bluetooth: hci0: Malformed LE Event: 0x0d [ 72.170514][ T6018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.172443][ T6018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.178751][ T6018] FAULT_INJECTION: forcing a failure. [ 72.178751][ T6018] name fail_futex, interval 1, probability 0, space 0, times 1 [ 72.181341][ T6018] CPU: 0 PID: 6018 Comm: syz.1.610 Not tainted syzkaller #0 [ 72.182593][ T6018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 72.184402][ T6018] Call trace: [ 72.185008][ T6018] dump_backtrace+0x1c4/0x1f0 [ 72.185831][ T6018] show_stack+0x2c/0x3c [ 72.186590][ T6018] __dump_stack+0x30/0x40 [ 72.187378][ T6018] dump_stack_lvl+0xf4/0x15c [ 72.188246][ T6018] dump_stack+0x1c/0x5c [ 72.188966][ T6018] should_fail_ex+0x3cc/0x524 [ 72.189748][ T6018] should_fail+0x14/0x24 [ 72.190509][ T6018] get_futex_key+0x904/0xfb0 [ 72.191302][ T6018] futex_wait_setup+0xbc/0x320 [ 72.192150][ T6018] futex_wait+0x164/0x424 [ 72.192927][ T6018] do_futex+0x2e8/0x340 [ 72.193664][ T6018] __arm64_sys_futex+0x390/0x414 [ 72.194573][ T6018] invoke_syscall+0x98/0x290 [ 72.195449][ T6018] el0_svc_common+0x13c/0x258 [ 72.196333][ T6018] do_el0_svc+0x5c/0x134 [ 72.197100][ T6018] el0_svc+0x58/0x128 [ 72.197784][ T6018] el0t_64_sync_handler+0x84/0xf0 [ 72.198651][ T6018] el0t_64_sync+0x18c/0x190 [ 72.314908][ T4376] atkbd serio0: keyboard reset failed on [ 72.782124][ T6028] FAULT_INJECTION: forcing a failure. [ 72.782124][ T6028] name failslab, interval 1, probability 0, space 0, times 0 [ 72.785448][ T6028] CPU: 0 PID: 6028 Comm: syz.1.615 Not tainted syzkaller #0 [ 72.786714][ T6028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 72.788746][ T6028] Call trace: [ 72.789435][ T6028] dump_backtrace+0x1c4/0x1f0 [ 72.790325][ T6028] show_stack+0x2c/0x3c [ 72.791161][ T6028] __dump_stack+0x30/0x40 [ 72.791996][ T6028] dump_stack_lvl+0xf4/0x15c [ 72.792793][ T6028] dump_stack+0x1c/0x5c [ 72.793498][ T6028] should_fail_ex+0x3cc/0x524 [ 72.794354][ T6028] __should_failslab+0xc0/0x11c [ 72.795203][ T6028] should_failslab+0x10/0x28 [ 72.796017][ T6028] slab_pre_alloc_hook+0x6c/0x31c [ 72.796915][ T6028] kmem_cache_alloc_lru+0x60/0x284 [ 72.797794][ T6028] __d_alloc+0x40/0x68c [ 72.798533][ T6028] d_alloc_pseudo+0x28/0x8c [ 72.799340][ T6028] alloc_file_pseudo+0xd8/0x1f4 [ 72.800229][ T6028] __shmem_file_setup+0x1a0/0x26c [ 72.801106][ T6028] shmem_zero_setup+0x98/0x140 [ 72.801938][ T6028] mmap_region+0xf98/0x1860 [ 72.802764][ T6028] do_mmap+0xa64/0x1210 [ 72.803532][ T6028] vm_mmap_pgoff+0x194/0x298 [ 72.804281][ T6028] ksys_mmap_pgoff+0xd0/0x5a0 [ 72.805129][ T6028] __arm64_sys_mmap+0x108/0x120 [ 72.805917][ T6028] invoke_syscall+0x98/0x290 [ 72.806739][ T6028] el0_svc_common+0x13c/0x258 [ 72.807571][ T6028] do_el0_svc+0x5c/0x134 [ 72.808315][ T6028] el0_svc+0x58/0x128 [ 72.809003][ T6028] el0t_64_sync_handler+0x84/0xf0 [ 72.809872][ T6028] el0t_64_sync+0x18c/0x190 [ 72.810765][ C0] vkms_vblank_simulate: vblank timer overrun [ 72.822693][ T4336] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 73.379917][ T5894] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 73.517914][ T6041] input: syz1 as /devices/virtual/input/input4 [ 73.898435][ T6052] netlink: 36 bytes leftover after parsing attributes in process `syz.1.625'. [ 73.913582][ T6052] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.915166][ T6052] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.399972][ T6046] tipc: Started in network mode [ 74.401458][ T6046] tipc: Node identity 9ed9b6a2578b, cluster identity 4711 [ 74.412943][ T6046] tipc: Enabled bearer , priority 0 [ 74.440248][ T6046] syzkaller0: MTU too low for tipc bearer [ 74.446718][ T6046] tipc: Disabling bearer [ 74.923528][ T6072] nvme_tcp: queue 0: bad type returned 0 [ 74.999431][ T6082] device-mapper: table: 248:0: thin-pool: target type may not be included in a read-only table (-EINVAL) [ 75.001427][ T6082] device-mapper: ioctl: error adding target to table [ 75.213826][ T6093] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.265910][ T6093] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.387211][ T6086] jffs2: notice: (6086) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 75.527894][ T6112] netlink: 6256 bytes leftover after parsing attributes in process `syz.1.645'. [ 75.874226][ T6125] netlink: 48 bytes leftover after parsing attributes in process `syz.2.653'. [ 75.880248][ T6124] batman_adv: batadv0: Adding interface: syzkaller0 [ 75.883576][ T4336] Bluetooth: unknown link type 3 [ 75.887464][ T6124] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.933018][ T6124] batman_adv: batadv0: Interface activated: syzkaller0 [ 75.949679][ T6120] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 76.016777][ T6120] batman_adv: batadv0: Removing interface: syzkaller0 [ 76.059863][ T6133] netlink: 12 bytes leftover after parsing attributes in process `syz.2.657'. [ 76.061421][ T6133] bridge_slave_0: default FDB implementation only supports local addresses [ 76.445330][ T4374] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 76.538711][ T6155] FAULT_INJECTION: forcing a failure. [ 76.538711][ T6155] name failslab, interval 1, probability 0, space 0, times 0 [ 76.541044][ T6155] CPU: 0 PID: 6155 Comm: syz.4.668 Not tainted syzkaller #0 [ 76.542514][ T6155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 76.544554][ T6155] Call trace: [ 76.545149][ T6155] dump_backtrace+0x1c4/0x1f0 [ 76.546031][ T6155] show_stack+0x2c/0x3c [ 76.546851][ T6155] __dump_stack+0x30/0x40 [ 76.547700][ T6155] dump_stack_lvl+0xf4/0x15c [ 76.548526][ T6155] dump_stack+0x1c/0x5c [ 76.549268][ T6155] should_fail_ex+0x3cc/0x524 [ 76.550131][ T6155] __should_failslab+0xc0/0x11c [ 76.551025][ T6155] should_failslab+0x10/0x28 [ 76.551847][ T6155] kmem_cache_alloc+0x88/0x310 [ 76.552696][ T6155] __kernfs_new_node+0xec/0x5fc [ 76.553582][ T6155] kernfs_new_node+0x120/0x230 [ 76.554430][ T6155] __kernfs_create_file+0x60/0x2e0 [ 76.555321][ T6155] sysfs_add_file_mode_ns+0x1e8/0x2a4 [ 76.556264][ T6155] internal_create_group+0x3e8/0xb24 [ 76.557197][ T6155] sysfs_create_groups+0x60/0x134 [ 76.558067][ T6155] device_add_attrs+0xdc/0x6f8 [ 76.558901][ T6155] device_add+0x5ac/0xe4c [ 76.559686][ T6155] netdev_register_kobject+0x170/0x2f4 [ 76.560638][ T6155] register_netdevice+0xf28/0x1650 [ 76.561543][ T6155] mif6_add+0x36c/0xa94 [ 76.562292][ T6155] ip6_mroute_setsockopt+0xbe4/0xcf4 [ 76.563253][ T6155] do_ipv6_setsockopt+0x2d0/0x3174 [ 76.564165][ T6155] ipv6_setsockopt+0x6c/0x1a0 [ 76.565021][ T6155] rawv6_setsockopt+0x204/0x4a8 [ 76.566005][ T6155] sock_common_setsockopt+0xb0/0xcc [ 76.567089][ T6155] __sys_setsockopt+0x2fc/0x50c [ 76.568095][ T6155] __arm64_sys_setsockopt+0xc0/0xdc [ 76.569193][ T6155] invoke_syscall+0x98/0x290 [ 76.570037][ T6155] el0_svc_common+0x13c/0x258 [ 76.570866][ T6155] do_el0_svc+0x5c/0x134 [ 76.571624][ T6155] el0_svc+0x58/0x128 [ 76.572341][ T6155] el0t_64_sync_handler+0x84/0xf0 [ 76.573223][ T6155] el0t_64_sync+0x18c/0x190 [ 76.574124][ C0] vkms_vblank_simulate: vblank timer overrun [ 76.625893][ T4374] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 76.627733][ T4374] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 76.629401][ T4374] usb 1-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 76.637304][ T4374] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.648422][ T4374] idmouse 1-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 76.781804][ T6161] batman_adv: batadv0: Adding interface: veth0 [ 76.783072][ T6161] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 76.803660][ T6161] batman_adv: batadv0: Interface activated: veth0 [ 76.817015][ T6164] batman_adv: batadv0: Interface deactivated: veth0 [ 76.818238][ T6164] batman_adv: batadv0: Removing interface: veth0 [ 76.819806][ T6164] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.821372][ T6164] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.837736][ T6164] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.843042][ T6164] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.921614][ T6174] 9pnet_virtio: no channels available for device syz [ 77.144940][ T6187] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 77.156792][ T6188] zram0: detected capacity change from 0 to 8 [ 77.402682][ T4336] Bluetooth: hci3: unexpected event for opcode 0x0c5a [ 77.428675][ T6213] netlink: 16 bytes leftover after parsing attributes in process `syz.2.688'. [ 77.446026][ T6213] device bond0 entered promiscuous mode [ 77.447197][ T6213] device bond_slave_0 entered promiscuous mode [ 77.448538][ T6213] device bond_slave_1 entered promiscuous mode [ 77.476513][ T6213] device gretap0 entered promiscuous mode [ 77.506356][ T6213] device hsr1 entered promiscuous mode [ 77.508103][ T4392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 77.608586][ T6219] 8021q: VLANs not supported on hsr0 [ 77.916179][ T48] Bluetooth: hci1: command 0x0409 tx timeout [ 78.041509][ T6240] netlink: 128 bytes leftover after parsing attributes in process `syz.2.700'. [ 78.047618][ T6240] netlink: 16 bytes leftover after parsing attributes in process `syz.2.700'. [ 78.051904][ T6240] netlink: 16 bytes leftover after parsing attributes in process `syz.2.700'. [ 78.076262][ T48] Bluetooth: hci0: command 0x0401 tx timeout [ 78.278950][ T1516] usb 1-1: USB disconnect, device number 6 [ 78.282856][ T1516] idmouse 1-1:1.0: disconnected [ 78.308560][ T6262] netlink: 'syz.2.711': attribute type 2 has an invalid length. [ 78.310103][ T6262] netlink: 'syz.2.711': attribute type 8 has an invalid length. [ 78.311621][ T6262] netlink: 132 bytes leftover after parsing attributes in process `syz.2.711'. [ 78.518737][ T6274] netlink: 'syz.2.716': attribute type 1 has an invalid length. [ 78.673795][ T6280] netlink: 20 bytes leftover after parsing attributes in process `syz.4.720'. [ 78.681238][ T6280] netlink: 'syz.4.720': attribute type 1 has an invalid length. [ 78.912368][ T6297] netlink: 71 bytes leftover after parsing attributes in process `syz.0.728'. [ 79.119492][ T6312] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 79.423697][ T6313] tap0: tun_chr_ioctl cmd 1074025677 [ 79.427731][ T6313] tap0: linktype set to 519 [ 79.434260][ T4336] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 79.959140][ T6355] netlink: 703 bytes leftover after parsing attributes in process `syz.1.754'. [ 81.122183][ T6419] netlink: 56 bytes leftover after parsing attributes in process `syz.0.787'. [ 81.125985][ T6419] netlink: 32 bytes leftover after parsing attributes in process `syz.0.787'. [ 81.456797][ T6430] netlink: 774 bytes leftover after parsing attributes in process `syz.2.791'. [ 81.572845][ T6437] netlink: 'syz.4.796': attribute type 26 has an invalid length. [ 81.582479][ T6437] netlink: 64899 bytes leftover after parsing attributes in process `syz.4.796'. [ 82.041361][ T6465] ksmbd: Unknown IPC event: 4, ignore. [ 82.224988][ T6474] netlink: 8 bytes leftover after parsing attributes in process `syz.0.813'. [ 82.433009][ T6487] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 82.456599][ T6487] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 82.468383][ T6487] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 82.476853][ T6487] netlink: 'syz.1.820': attribute type 29 has an invalid length. [ 82.744913][ T6507] netlink: 163 bytes leftover after parsing attributes in process `syz.1.829'. [ 82.860985][ T6512] netlink: 'syz.2.832': attribute type 29 has an invalid length. [ 83.176234][ T6533] netlink: 16 bytes leftover after parsing attributes in process `syz.2.841'. [ 83.532127][ T6555] validate_nla: 3 callbacks suppressed [ 83.532141][ T6555] netlink: 'syz.2.854': attribute type 29 has an invalid length. [ 83.564900][ T6555] netlink: 'syz.2.854': attribute type 29 has an invalid length. [ 83.612583][ T6556] netlink: 'syz.2.854': attribute type 29 has an invalid length. [ 83.616576][ T6557] netlink: 'syz.2.854': attribute type 29 has an invalid length. [ 83.656300][ T6563] netlink: 8 bytes leftover after parsing attributes in process `syz.3.857'. [ 83.993050][ T6584] netlink: 'syz.4.867': attribute type 1 has an invalid length. [ 84.219262][ T6598] netlink: 'syz.2.875': attribute type 6 has an invalid length. [ 84.630398][ T6625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.888'. [ 85.063629][ T6652] sch_tbf: peakrate 7 is lower than or equals to rate 8819666052540920421 ! [ 85.380490][ T6670] netlink: 'syz.1.910': attribute type 12 has an invalid length. [ 85.382021][ T6670] netlink: 132 bytes leftover after parsing attributes in process `syz.1.910'. [ 85.576749][ T6682] netlink: 80 bytes leftover after parsing attributes in process `syz.4.917'. [ 85.729392][ T6692] tap0: tun_chr_ioctl cmd 1074025677 [ 85.731351][ T6692] tap0: linktype set to 516 [ 85.749658][ T6692] tap0: tun_chr_ioctl cmd 1074812118 [ 86.025702][ T6711] netlink: 60 bytes leftover after parsing attributes in process `syz.2.930'. [ 86.027360][ T6711] netlink: 60 bytes leftover after parsing attributes in process `syz.2.930'. [ 86.075288][ T6711] netlink: 60 bytes leftover after parsing attributes in process `syz.2.930'. [ 86.091490][ T6717] netlink: 60 bytes leftover after parsing attributes in process `syz.2.930'. [ 86.748144][ T6759] netlink: 28 bytes leftover after parsing attributes in process `syz.2.954'. [ 86.757532][ T6760] netlink: 60 bytes leftover after parsing attributes in process `syz.1.955'. [ 86.759021][ T6760] netlink: 60 bytes leftover after parsing attributes in process `syz.1.955'. [ 94.595182][ T6831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.631437][ T6831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.823924][ T6843] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.846172][ T6843] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.953229][ T6847] input: syz1 as /devices/virtual/input/input5 [ 95.314157][ T6858] __nla_validate_parse: 2 callbacks suppressed [ 95.314168][ T6858] netlink: 52 bytes leftover after parsing attributes in process `syz.3.999'. [ 95.566259][ T6866] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 95.737214][ T6881] FAULT_INJECTION: forcing a failure. [ 95.737214][ T6881] name failslab, interval 1, probability 0, space 0, times 0 [ 95.740036][ T6881] CPU: 0 PID: 6881 Comm: syz.3.1009 Not tainted syzkaller #0 [ 95.741478][ T6881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 95.743490][ T6881] Call trace: [ 95.744040][ T6881] dump_backtrace+0x1c4/0x1f0 [ 95.744939][ T6881] show_stack+0x2c/0x3c [ 95.745696][ T6881] __dump_stack+0x30/0x40 [ 95.746456][ T6881] dump_stack_lvl+0xf4/0x15c [ 95.747334][ T6881] dump_stack+0x1c/0x5c [ 95.748061][ T6881] should_fail_ex+0x3cc/0x524 [ 95.748893][ T6881] __should_failslab+0xc0/0x11c [ 95.749747][ T6881] should_failslab+0x10/0x28 [ 95.750552][ T6881] __kmem_cache_alloc_node+0x7c/0x318 [ 95.751610][ T6881] __kmalloc_node_track_caller+0xb8/0x174 [ 95.752594][ T6881] kmemdup+0x5c/0x98 [ 95.753283][ T6881] key_alloc+0x2b0/0xdec [ 95.754082][ T6881] keyring_alloc+0x68/0xe0 [ 95.754884][ T6881] join_session_keyring+0x120/0x3e0 [ 95.755798][ T6881] lookup_user_key+0x3f8/0xf94 [ 95.756655][ T6881] __arm64_sys_add_key+0x3d4/0x520 [ 95.757561][ T6881] invoke_syscall+0x98/0x290 [ 95.758390][ T6881] el0_svc_common+0x13c/0x258 [ 95.759209][ T6881] do_el0_svc+0x5c/0x134 [ 95.759952][ T6881] el0_svc+0x58/0x128 [ 95.760639][ T6881] el0t_64_sync_handler+0x84/0xf0 [ 95.761526][ T6881] el0t_64_sync+0x18c/0x190 [ 95.762388][ C0] vkms_vblank_simulate: vblank timer overrun [ 95.849759][ T6882] ubi0: attaching mtd0 [ 95.850813][ T6882] ubi0: scanning is finished [ 95.857724][ T6882] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 95.949643][ T6882] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 96.053722][ T6893] 9pnet_virtio: no channels available for device syz [ 96.076943][ T6896] binder: 6894:6896 tried to acquire reference to desc 0, got 1 instead [ 96.094016][ T6895] batman_adv: batadv0: Adding interface: syzkaller0 [ 96.095464][ T6895] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.101366][ T7] binder: release 6894:6896 transaction 36 out, still active [ 96.105656][ T7] binder: undelivered TRANSACTION_COMPLETE [ 96.120952][ T6895] batman_adv: batadv0: Interface activated: syzkaller0 [ 96.125554][ T7] binder: send failed reply for transaction 36, target dead [ 96.153158][ T6892] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 96.217862][ T6892] batman_adv: batadv0: Removing interface: syzkaller0 [ 96.611476][ T6920] FAULT_INJECTION: forcing a failure. [ 96.611476][ T6920] name failslab, interval 1, probability 0, space 0, times 0 [ 96.614556][ T6920] CPU: 0 PID: 6920 Comm: syz.0.1027 Not tainted syzkaller #0 [ 96.615949][ T6920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 96.617803][ T6920] Call trace: [ 96.618418][ T6920] dump_backtrace+0x1c4/0x1f0 [ 96.619334][ T6920] show_stack+0x2c/0x3c [ 96.620204][ T6920] __dump_stack+0x30/0x40 [ 96.620977][ T6920] dump_stack_lvl+0xf4/0x15c [ 96.621793][ T6920] dump_stack+0x1c/0x5c [ 96.622513][ T6920] should_fail_ex+0x3cc/0x524 [ 96.623335][ T6920] __should_failslab+0xc0/0x11c [ 96.624257][ T6920] should_failslab+0x10/0x28 [ 96.625160][ T6920] __kmem_cache_alloc_node+0x7c/0x318 [ 96.626109][ T6920] __kmalloc_node_track_caller+0xb8/0x174 [ 96.627145][ T6920] kmemdup+0x5c/0x98 [ 96.627851][ T6920] key_alloc+0x2b0/0xdec [ 96.628576][ T6920] keyring_alloc+0x68/0xe0 [ 96.629571][ T6920] join_session_keyring+0x120/0x3e0 [ 96.630535][ T6920] lookup_user_key+0x3f8/0xf94 [ 96.631393][ T6920] __arm64_sys_add_key+0x3d4/0x520 [ 96.632296][ T6920] invoke_syscall+0x98/0x290 [ 96.633102][ T6920] el0_svc_common+0x13c/0x258 [ 96.633928][ T6920] do_el0_svc+0x5c/0x134 [ 96.634750][ T6920] el0_svc+0x58/0x128 [ 96.635385][ T6920] el0t_64_sync_handler+0x84/0xf0 [ 96.636317][ T6920] el0t_64_sync+0x18c/0x190 [ 96.865017][ T6930] Could not find key with description: [syz] [ 96.885867][ T6930] process_request_key_err: No key [ 96.886846][ T6930] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 96.910706][ T6930] One or more global auth toks could not properly register; rc = [-2] [ 96.923368][ T6930] Error parsing options; rc = [-2] [ 97.301787][ T6950] batman_adv: batadv0: Adding interface: syzkaller0 [ 97.314717][ T6950] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 97.436260][ T6950] batman_adv: batadv0: Interface activated: syzkaller0 [ 97.607834][ T6946] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 97.642414][ T6946] batman_adv: batadv0: Removing interface: syzkaller0 [ 97.803527][ T6977] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 98.236477][ T7000] binder: 6999:7000 tried to acquire reference to desc 0, got 1 instead [ 98.243049][ T7000] binder: 6999:7000 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 98.255881][ T7000] binder: 7000 RLIMIT_NICE not set [ 98.756395][ T7032] Could not find key with description: [syz] [ 98.787837][ T7032] process_request_key_err: No key [ 98.804457][ T7032] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 98.848759][ T7032] One or more global auth toks could not properly register; rc = [-2] [ 98.882129][ T7032] Error parsing options; rc = [-2] [ 99.901694][ T4376] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 100.024506][ T7111] binder: 7108:7111 tried to acquire reference to desc 0, got 1 instead [ 100.032940][ T7111] binder: 7108:7111 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 100.055283][ T7111] binder: 7111 RLIMIT_NICE not set [ 100.081364][ T4376] usb 1-1: Using ep0 maxpacket: 8 [ 100.083740][ T4376] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 100.085256][ T4376] usb 1-1: config 0 has no interface number 0 [ 100.086373][ T4376] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 100.088019][ T4376] usb 1-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 100.094065][ T4376] usb 1-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 100.096026][ T4376] usb 1-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.105876][ T4376] usb 1-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 100.107673][ T4376] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.109053][ T4376] usb 1-1: Product: syz [ 100.112250][ T4376] usb 1-1: Manufacturer: syz [ 100.113129][ T4376] usb 1-1: SerialNumber: syz [ 100.118713][ T4376] usb 1-1: config 0 descriptor?? [ 100.126570][ T4376] iowarrior 1-1:0.186: no interrupt-in endpoint found [ 100.692864][ T7155] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 100.697054][ T7155] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 100.706430][ T7155] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 100.716359][ T7155] One or more global auth toks could not properly register; rc = [-22] [ 100.727732][ T7078] jffs2: notice: (7078) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 100.732235][ T7155] Error parsing options; rc = [-22] [ 101.555687][ T7210] binder: 7208:7210 got transaction to invalid handle, 1 [ 101.568829][ T7210] binder: 7210:7208 cannot find target node [ 101.573345][ T7210] binder: 7208:7210 transaction call to 0:0 failed 48/29201/-22, size 72-0 line 3062 [ 101.595800][ T7210] binder: 7208:7210 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 101.607836][ T7210] binder: 7210 RLIMIT_NICE not set [ 101.746074][ T7225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1109'. [ 101.871093][ T7228] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 101.875166][ T7228] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 101.883096][ T7228] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 101.886970][ T7228] One or more global auth toks could not properly register; rc = [-22] [ 101.891168][ T7228] Error parsing options; rc = [-22] [ 102.017700][ T7216] tipc: Enabled bearer , priority 0 [ 102.023489][ T7216] syzkaller0: MTU too low for tipc bearer [ 102.025179][ T7216] tipc: Disabling bearer [ 102.342490][ T1516] binder: undelivered TRANSACTION_ERROR: 29201 [ 102.393530][ T4376] usb 1-1: USB disconnect, device number 7 [ 103.395178][ T7314] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 103.428782][ T7314] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 103.468929][ T7314] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 103.500038][ T7314] One or more global auth toks could not properly register; rc = [-22] [ 103.516187][ T7314] Error parsing options; rc = [-22] [ 104.101641][ T7366] binder: 7364:7366 got transaction to invalid handle, 1 [ 104.104314][ T7366] binder: 7366:7364 cannot find target node [ 104.105270][ T7366] binder: 7364:7366 transaction call to 0:0 failed 52/29201/-22, size 72-0 line 3062 [ 104.109595][ T7366] binder: 7364:7366 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 104.128040][ T7366] binder: 7366 RLIMIT_NICE not set [ 104.329892][ T7385] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 104.340461][ T7385] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 104.343773][ T7385] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 104.346075][ T7385] One or more global auth toks could not properly register; rc = [-22] [ 104.359863][ T7385] Error parsing options; rc = [-22] [ 104.843344][ T7415] infiniband syz1: set active [ 104.855846][ T4376] lo speed is unknown, defaulting to 1000 [ 104.925870][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 105.852003][ T7479] binder: tried to use weak ref as strong ref [ 105.855452][ T7479] binder: 7477:7479 Acquire 1 refcount change on invalid ref 0 ret -22 [ 105.861933][ T7479] binder: 7477:7479 got transaction to invalid handle, 1 [ 105.864438][ T7479] binder: 7479:7477 cannot find target node [ 105.867309][ T7479] binder: 7477:7479 transaction call to 0:0 failed 55/29201/-22, size 72-0 line 3062 [ 105.871421][ T7479] binder: 7477:7479 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 105.882159][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 106.279703][ T7507] binder: 7507:7506 cannot find target node [ 106.366468][ T7511] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 106.374894][ T7511] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 106.394644][ T7511] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 106.409788][ T7511] One or more global auth toks could not properly register; rc = [-22] [ 106.419753][ T7511] Error parsing options; rc = [-22] [ 106.973235][ T7540] binder_user_error: 6 callbacks suppressed [ 106.973250][ T7540] binder: tried to use weak ref as strong ref [ 106.987320][ T7540] binder: 7539:7540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 106.998688][ T7540] binder: 7539:7540 got transaction to invalid handle, 1 [ 107.005989][ T7540] binder_debug: 2 callbacks suppressed [ 107.006004][ T7540] binder: 7540:7539 cannot find target node [ 107.019065][ T7540] binder: 7539:7540 transaction call to 0:0 failed 61/29201/-22, size 72-0 line 3062 [ 107.027421][ T7540] binder: 7539:7540 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 107.058103][ T7540] binder: 7540 RLIMIT_NICE not set [ 107.069866][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 107.594469][ T7572] binder: 7571:7572 tried to acquire reference to desc 0, got 1 instead [ 107.601312][ T7572] binder_alloc: 7571: binder_alloc_buf, no vma [ 107.603570][ T7572] binder: cannot allocate buffer: vma cleared, target dead or dying [ 107.603608][ T7572] binder: 7571:7572 transaction call to 7571:0 failed 66/29189/-3, size 72-0 line 3247 [ 107.610484][ T7572] binder: 7571:7572 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 107.625553][ T7572] binder: 7572 RLIMIT_NICE not set [ 107.785553][ T7584] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 107.795153][ T7584] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 107.813317][ T7584] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 107.826882][ T7584] One or more global auth toks could not properly register; rc = [-22] [ 107.833561][ T7584] Error parsing options; rc = [-22] [ 108.402206][ T7] binder: undelivered TRANSACTION_ERROR: 29189 [ 108.881098][ T7636] binder: 7635:7636 tried to acquire reference to desc 0, got 1 instead [ 108.886813][ T7636] binder_alloc: 7635: binder_alloc_buf, no vma [ 108.889203][ T7636] binder: cannot allocate buffer: vma cleared, target dead or dying [ 108.889240][ T7636] binder: 7635:7636 transaction call to 7635:0 failed 71/29189/-3, size 72-0 line 3247 [ 108.894104][ T7636] binder: 7635:7636 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 109.167848][ T7648] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 109.184019][ T7648] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 109.200507][ T7648] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 109.208308][ T7648] One or more global auth toks could not properly register; rc = [-22] [ 109.217603][ T7648] Error parsing options; rc = [-22] [ 109.528912][ T7660] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1245'. [ 109.663992][ T7665] netlink: 'syz.4.1247': attribute type 29 has an invalid length. [ 109.677821][ T7665] netlink: 'syz.4.1247': attribute type 29 has an invalid length. [ 109.697164][ T7] binder: undelivered TRANSACTION_ERROR: 29189 [ 109.730965][ T7669] netlink: 'syz.4.1247': attribute type 29 has an invalid length. [ 110.019459][ T7689] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 110.028118][ T7689] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 110.060233][ T7689] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 110.079675][ T7689] One or more global auth toks could not properly register; rc = [-22] [ 110.087431][ T7689] Error parsing options; rc = [-22] [ 110.452839][ T7707] binder_alloc: 7706: binder_alloc_buf, no vma [ 110.457490][ T7707] binder: cannot allocate buffer: vma cleared, target dead or dying [ 111.153183][ T7740] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 111.192605][ T7740] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 111.213267][ T7740] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 111.227851][ T7740] One or more global auth toks could not properly register; rc = [-22] [ 111.239843][ T7740] Error parsing options; rc = [-22] [ 112.244517][ T7787] infiniband syz1: set active [ 112.265081][ T7789] binder_user_error: 4 callbacks suppressed [ 112.265090][ T7789] binder: tried to use weak ref as strong ref [ 112.282051][ T7789] binder: 7786:7789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 112.297435][ T7789] binder: 7786:7789 got transaction to invalid handle, 1 [ 112.315789][ T7] lo speed is unknown, defaulting to 1000 [ 112.318674][ T7789] binder_debug: 2 callbacks suppressed [ 112.318688][ T7789] binder: 7789:7786 cannot find target node [ 112.328366][ T7789] binder: 7786:7789 transaction call to 0:0 failed 79/29201/-22, size 72-0 line 3062 [ 112.358124][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 112.499624][ T7802] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 112.516473][ T7802] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 112.531328][ T7802] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 112.541902][ T7802] One or more global auth toks could not properly register; rc = [-22] [ 112.582422][ T7802] Error parsing options; rc = [-22] [ 112.670631][ T7807] infiniband syz1: set active [ 112.676559][ T7] lo speed is unknown, defaulting to 1000 [ 112.999309][ T7833] binder: tried to use weak ref as strong ref [ 113.009619][ T7833] binder: 7832:7833 Acquire 1 refcount change on invalid ref 0 ret -22 [ 113.018085][ T7833] binder: 7832:7833 got transaction to invalid handle, 1 [ 113.022324][ T7833] binder: 7833:7832 cannot find target node [ 113.029610][ T7833] binder: 7832:7833 transaction call to 0:0 failed 82/29201/-22, size 72-0 line 3062 [ 113.047186][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.288885][ T7852] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 113.302156][ T7852] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 113.314465][ T7852] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 113.324526][ T7852] One or more global auth toks could not properly register; rc = [-22] [ 113.334974][ T7852] Error parsing options; rc = [-22] [ 113.485236][ T7864] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1325'. [ 113.583994][ T7870] binder: tried to use weak ref as strong ref [ 113.587660][ T7870] binder: 7868:7870 Acquire 1 refcount change on invalid ref 0 ret -22 [ 113.603908][ T7870] binder: 7868:7870 got transaction to invalid handle, 1 [ 113.611500][ T7872] netlink: 'syz.0.1329': attribute type 29 has an invalid length. [ 113.615339][ T7870] binder: 7870:7868 cannot find target node [ 113.622933][ T7870] binder: 7868:7870 transaction call to 0:0 failed 85/29201/-22, size 72-0 line 3062 [ 113.626096][ T7872] netlink: 'syz.0.1329': attribute type 29 has an invalid length. [ 113.631327][ T7872] netlink: 'syz.0.1329': attribute type 29 has an invalid length. [ 113.637204][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 113.642514][ T7872] netlink: 'syz.0.1329': attribute type 29 has an invalid length. [ 113.900523][ T7889] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 113.920109][ T7889] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 113.934347][ T7889] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 113.939951][ T7889] One or more global auth toks could not properly register; rc = [-22] [ 113.949287][ T7889] Error parsing options; rc = [-22] [ 114.100994][ T7899] netlink: 'syz.0.1339': attribute type 21 has an invalid length. [ 114.108246][ T7899] IPv6: NLM_F_CREATE should be specified when creating new route [ 114.183683][ T7904] binder: BINDER_SET_CONTEXT_MGR already set [ 114.218358][ T7904] binder: 7902:7904 ioctl 4018620d 20004a80 returned -16 [ 114.230510][ T7904] binder: 7902:7904 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 114.622908][ T7926] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 114.628065][ T7926] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 114.647064][ T7926] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 114.656371][ T7926] One or more global auth toks could not properly register; rc = [-22] [ 114.660546][ T7926] Error parsing options; rc = [-22] [ 115.315306][ T7962] infiniband syz1: set active [ 115.339595][ T7] lo speed is unknown, defaulting to 1000 [ 115.534362][ T7974] binder: BINDER_SET_CONTEXT_MGR already set [ 115.545819][ T7974] binder: 7973:7974 ioctl 4018620d 20004a80 returned -16 [ 115.588743][ T7980] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1371'. [ 117.096186][ T8073] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1394'. [ 117.207342][ T8082] binder: BINDER_SET_CONTEXT_MGR already set [ 117.232280][ T8082] binder: 8079:8082 ioctl 4018620d 20004a80 returned -16 [ 117.516352][ T8048] tipc: Enabling of bearer rejected, failed to enable media [ 117.794523][ T8111] infiniband syz1: set active [ 117.836732][ T1516] lo speed is unknown, defaulting to 1000 [ 118.728176][ T8171] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 118.736393][ T8171] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 118.746012][ T8171] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 118.755376][ T8171] One or more global auth toks could not properly register; rc = [-22] [ 118.763086][ T8171] Error parsing options; rc = [-22] [ 118.915584][ T8170] tipc: Enabling of bearer rejected, failed to enable media [ 119.668569][ T8216] netlink: 55631 bytes leftover after parsing attributes in process `syz.4.1425'. [ 119.866431][ T8232] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 119.941160][ T8232] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 119.963161][ T8232] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 119.982290][ T8232] One or more global auth toks could not properly register; rc = [-22] [ 119.993567][ T8232] Error parsing options; rc = [-22] [ 120.737450][ T8274] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1438'. [ 120.919743][ T8260] tipc: Enabling of bearer rejected, failed to enable media [ 121.563054][ T8321] ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [0] [ 121.590078][ T8321] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] [ 121.620274][ T8321] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 121.650135][ T8321] One or more global auth toks could not properly register; rc = [-22] [ 121.696206][ T8321] Error parsing options; rc = [-22] [ 121.903314][ T8341] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1450'. [ 122.886497][ T8383] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1464'. [ 123.112986][ T8377] loop1: detected capacity change from 0 to 4096 [ 123.173040][ T8351] tipc: Enabling of bearer rejected, failed to enable media [ 123.314172][ T8414] binder: BINDER_SET_CONTEXT_MGR already set [ 123.315773][ T8377] ntfs3: loop1: Failed to load $MFT. [ 123.327142][ T8414] binder: 8405:8414 ioctl 4018620d 20004a80 returned -16 [ 123.351035][ T8414] binder_user_error: 5 callbacks suppressed [ 123.351043][ T8414] binder: 8405:8414 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 123.380527][ T8414] binder: 8414 RLIMIT_NICE not set [ 123.448135][ T8377] netlink: 'syz.1.1461': attribute type 10 has an invalid length. [ 123.466466][ T8377] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.467945][ T8377] bridge0: port 2(bridge_slave_1) entered listening state [ 123.469303][ T8377] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.470490][ T8377] bridge0: port 1(bridge_slave_0) entered listening state [ 123.509542][ T8427] loop1: detected capacity change from 0 to 128 [ 123.520635][ T8377] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 123.544216][ T6828] udevd[6828]: incorrect ext4 checksum on /dev/loop1 [ 123.562799][ T8427] EXT4-fs (loop1): VFS: Found ext4 filesystem with unknown checksum algorithm. [ 123.833946][ T8441] infiniband syz1: set active [ 123.840132][ T4376] lo speed is unknown, defaulting to 1000 [ 123.954017][ T8448] capability: warning: `syz.0.1473' uses deprecated v2 capabilities in a way that may be insecure [ 124.111174][ T8454] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1476'. [ 124.118839][ T8456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.130630][ T8456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.244866][ T8463] loop1: detected capacity change from 0 to 256 [ 125.496206][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 125.498194][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 125.905801][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.906963][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 125.948190][ T8467] CIFS: Attempting to mount \\127.0.0.1\share [ 125.949388][ T8467] CIFS: VFS: No username specified [ 126.574471][ T8482] FAULT_INJECTION: forcing a failure. [ 126.574471][ T8482] name failslab, interval 1, probability 0, space 0, times 0 [ 126.577113][ T8482] CPU: 0 PID: 8482 Comm: syz.0.1488 Not tainted syzkaller #0 [ 126.578346][ T8482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 126.580138][ T8482] Call trace: [ 126.580714][ T8482] dump_backtrace+0x1c4/0x1f0 [ 126.581687][ T8482] show_stack+0x2c/0x3c [ 126.582551][ T8482] __dump_stack+0x30/0x40 [ 126.583386][ T8482] dump_stack_lvl+0xf4/0x15c [ 126.584339][ T8482] dump_stack+0x1c/0x5c [ 126.585066][ T8482] should_fail_ex+0x3cc/0x524 [ 126.585908][ T8482] __should_failslab+0xc0/0x11c [ 126.586769][ T8482] should_failslab+0x10/0x28 [ 126.587678][ T8482] kmem_cache_alloc+0x88/0x310 [ 126.588563][ T8482] __sigqueue_alloc+0x3e0/0x4e4 [ 126.589409][ T8482] __send_signal_locked+0x1d8/0xc88 [ 126.590359][ T8482] do_notify_parent+0x9bc/0xbe4 [ 126.591222][ T8482] release_task+0x11d0/0x1510 [ 126.592039][ T8482] do_exit+0x10bc/0x19ac [ 126.592817][ T8482] do_group_exit+0x198/0x238 [ 126.593603][ T8482] get_signal+0x11f4/0x133c [ 126.594398][ T8482] do_notify_resume+0x364/0x2c84 [ 126.595245][ T8482] el0_svc+0x98/0x128 [ 126.595960][ T8482] el0t_64_sync_handler+0x84/0xf0 [ 126.596869][ T8482] el0t_64_sync+0x18c/0x190 [ 126.686118][ T8483] Could not find key with description: [syz] [ 126.687291][ T8483] process_request_key_err: No key [ 126.688213][ T8483] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 126.689925][ T8483] One or more global auth toks could not properly register; rc = [-2] [ 126.750624][ T8483] Error parsing options; rc = [-2] [ 126.762226][ T8487] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1490'. [ 126.767525][ T8488] binder: BINDER_SET_CONTEXT_MGR already set [ 126.771819][ T8488] binder: 8486:8488 ioctl 4018620d 20004a80 returned -16 [ 126.782389][ T8488] binder: 8486:8488 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 126.797126][ T8488] binder: 8488 RLIMIT_NICE not set [ 127.002427][ T8468] tipc: Enabling of bearer rejected, failed to enable media [ 127.006670][ T8497] mmap: syz.2.1484 (8497) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 127.405869][ T8508] device bridge_slave_1 left promiscuous mode [ 127.407395][ T8508] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.574754][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 127.576272][ C0] bridge0: topology change detected, propagating [ 127.578509][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 127.579778][ C0] bridge0: topology change detected, propagating [ 128.940457][ T8523] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1501'. [ 129.130716][ T8536] Could not find key with description: [syz] [ 129.132083][ T8536] process_request_key_err: No key [ 129.155714][ T8536] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 129.184025][ T8536] One or more global auth toks could not properly register; rc = [-2] [ 129.201052][ T8536] Error parsing options; rc = [-2] [ 129.548351][ T8543] binder: BINDER_SET_CONTEXT_MGR already set [ 129.557563][ T8543] binder: 8542:8543 ioctl 4018620d 20004a80 returned -16 [ 129.572395][ T8543] binder: 8542:8543 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 129.592506][ T8543] binder: 8543 RLIMIT_NICE not set [ 130.986238][ T8578] Could not find key with description: [syz] [ 130.994786][ T8578] process_request_key_err: No key [ 130.995655][ T8578] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 131.011669][ T8578] One or more global auth toks could not properly register; rc = [-2] [ 131.026870][ T8578] Error parsing options; rc = [-2] [ 131.040081][ T8580] binder: 8579:8580 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 131.056196][ T8580] binder: 8579:8580 got transaction to invalid handle, 1 [ 131.060773][ T8580] binder: 8580:8579 cannot find target node [ 131.065368][ T8580] binder: 8579:8580 transaction call to 0:0 failed 97/29201/-22, size 72-0 line 3062 [ 131.072465][ T8580] binder: 8579:8580 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 131.084762][ T8580] binder: 8580 RLIMIT_NICE not set [ 131.244224][ T8588] tipc: Started in network mode [ 131.248728][ T8588] tipc: Node identity e0000002, cluster identity 4711 [ 131.252446][ T8588] tipc: Enabling of bearer rejected, failed to enable media [ 131.858274][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 131.947636][ T8615] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1536'. [ 132.135458][ T8627] Could not find key with description: [syz] [ 132.156440][ T8627] process_request_key_err: No key [ 132.157370][ T8627] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 132.176846][ T8627] One or more global auth toks could not properly register; rc = [-2] [ 132.185322][ T8627] Error parsing options; rc = [-2] [ 132.522420][ T8640] binder: 8639:8640 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 132.571127][ T8640] binder: 8639:8640 got transaction to invalid handle, 1 [ 132.584917][ T8640] binder: 8640:8639 cannot find target node [ 132.595205][ T8640] binder: 8639:8640 transaction call to 0:0 failed 100/29201/-22, size 72-0 line 3062 [ 132.608212][ T8640] binder: 8639:8640 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 132.629124][ T8640] binder: 8640 RLIMIT_NICE not set [ 133.334047][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 133.524848][ T8671] infiniband syz1: set active [ 133.529652][ T7] lo speed is unknown, defaulting to 1000 [ 133.787091][ T8685] Could not find key with description: [syz] [ 133.797939][ T8685] process_request_key_err: No key [ 133.804467][ T8685] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 133.818866][ T8685] One or more global auth toks could not properly register; rc = [-2] [ 133.828530][ T8685] Error parsing options; rc = [-2] [ 133.951011][ T8691] binder: 8691:8690 cannot find target node [ 133.957113][ T8691] binder: 8690:8691 transaction call to 0:0 failed 105/29201/-22, size 72-0 line 3062 [ 134.429175][ T8700] infiniband syz1: set active [ 134.467883][ T1516] lo speed is unknown, defaulting to 1000 [ 134.774017][ T1516] binder: undelivered TRANSACTION_ERROR: 29201 [ 134.999322][ T8714] loop4: detected capacity change from 0 to 16 [ 135.049780][ T8714] erofs: (device loop4): mounted with root inode @ nid 36. [ 135.432569][ T8732] Could not find key with description: [syz] [ 135.444067][ T8732] process_request_key_err: No key [ 135.445256][ T8732] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 135.452252][ T8733] binder_user_error: 4 callbacks suppressed [ 135.452263][ T8733] binder: 8731:8733 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 135.466306][ T8733] binder: 8731:8733 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 135.474108][ T8732] One or more global auth toks could not properly register; rc = [-2] [ 135.481359][ T8732] Error parsing options; rc = [-2] [ 135.485920][ T8733] binder: 8733 RLIMIT_NICE not set [ 136.382531][ T8748] binder: 8746:8748 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 136.392353][ T8748] binder: 8746:8748 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 136.394332][ T8748] binder: 8748 RLIMIT_NICE not set [ 136.409190][ T8751] overlayfs: missing 'workdir' [ 137.941023][ T8750] CIFS: Attempting to mount \\127.0.0.1\share [ 137.942281][ T8750] CIFS: VFS: No username specified [ 138.119577][ T8760] infiniband syz1: set down [ 138.373491][ T8760] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.375056][ T8760] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.485990][ T8776] Could not find key with description: [syz] [ 138.499864][ T8776] process_request_key_err: No key [ 138.500810][ T8776] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 138.526432][ T8776] One or more global auth toks could not properly register; rc = [-2] [ 138.545764][ T8776] Error parsing options; rc = [-2] [ 139.399946][ T8760] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.401536][ T8760] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.403103][ T8760] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.404625][ T8760] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.562250][ T1516] lo speed is unknown, defaulting to 1000 [ 139.563902][ T1516] lo speed is unknown, defaulting to 1000 [ 139.858922][ T8796] binder: 8793:8796 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 139.874242][ T8796] binder: 8793:8796 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 139.884407][ T8796] binder: 8796 RLIMIT_NICE not set [ 141.905021][ T8820] loop2: detected capacity change from 0 to 512 [ 141.948393][ T8820] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 141.949977][ T8820] System zones: 1-12 [ 142.011469][ T8820] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #12: comm syz.2.1612: missing EA_INODE flag [ 142.052229][ T8820] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1612: error while reading EA inode 12 err=-117 [ 142.064022][ T8820] EXT4-fs (loop2): 1 orphan inode deleted [ 142.070512][ T8820] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 143.218965][ T8820] sched: RT throttling activated [ 145.378117][ T4339] EXT4-fs (loop2): unmounting filesystem. [ 145.599354][ T8843] binder: 8838:8843 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 145.602724][ T8844] overlayfs: upper fs does not support file handles, falling back to index=off. [ 145.612040][ T8843] binder: 8838:8843 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 145.614133][ T8843] binder: 8843 RLIMIT_NICE not set [ 145.941917][ T1516] wiimote 0005:057E:0306.0001: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 145.948635][ T8860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.951552][ T1516] wiimote 0005:057E:0306.0001: New device registered [ 145.978302][ T8860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.011847][ T8859] wiimote 0005:057E:0306.0001: Device removed [ 148.176847][ T1516] wiimote 0005:057E:0306.0001: detected device: Nintendo Wii Remote (Gen 1) [ 148.206940][ T1516] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input7 [ 149.184955][ T1516] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input8 [ 149.200100][ T1516] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input6 [ 150.615466][ T8863] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.622015][ T8863] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.625323][ T8863] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.626982][ T8863] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.787793][ T8863] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 150.789376][ T8863] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 150.790856][ T8863] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 150.792514][ T8863] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 151.096711][ T8898] loop4: detected capacity change from 0 to 256 [ 151.135146][ T8898] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 151.704186][ T8917] loop4: detected capacity change from 0 to 32768 [ 151.708623][ T8917] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.1648 (8917) [ 151.718474][ T8917] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 151.720364][ T8917] BTRFS info (device loop4): using crc32c (crc32c-generic) checksum algorithm [ 151.721896][ T8917] BTRFS info (device loop4): setting nodatasum [ 151.722913][ T8917] BTRFS info (device loop4): force zlib compression, level 3 [ 151.724192][ T8917] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_LZO (0x8) [ 151.725856][ T8917] BTRFS info (device loop4): use lzo compression, level 0 [ 151.727017][ T8917] BTRFS info (device loop4): turning on flush-on-commit [ 151.728147][ T8917] BTRFS info (device loop4): enabling auto defrag [ 151.729237][ T8917] BTRFS info (device loop4): max_inline at 4096 [ 151.730289][ T8917] BTRFS info (device loop4): using free space tree [ 151.824487][ T8917] BTRFS info (device loop4): enabling ssd optimizations [ 152.814227][ T8939] tmpfs: Unknown parameter 'usrquota' [ 153.082761][ T4340] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 153.122979][ T8948] batman_adv: batadv0: Adding interface: syzkaller0 [ 153.124184][ T8948] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 153.187391][ T8948] batman_adv: batadv0: Interface activated: syzkaller0 [ 153.228147][ T8945] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 153.302601][ T8945] batman_adv: batadv0: Removing interface: syzkaller0 [ 153.443863][ T8963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1656'. [ 153.484518][ T8967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.505116][ T8967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.560932][ T48] Bluetooth: hci1: command 0x0406 tx timeout [ 153.562336][ T48] Bluetooth: hci2: command 0x0406 tx timeout [ 153.563485][ T48] Bluetooth: hci0: command 0x0406 tx timeout [ 155.034640][ T8993] Device name cannot be null; rc = [-22] [ 155.218590][ T9002] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1670'. [ 155.656637][ T9008] tipc: Enabled bearer , priority 0 [ 155.661060][ T9008] syzkaller0: MTU too low for tipc bearer [ 155.671598][ T9008] tipc: Disabling bearer [ 157.083991][ T9027] batman_adv: batadv0: Adding interface: syzkaller0 [ 157.085193][ T9027] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.101162][ T9027] batman_adv: batadv0: Interface activated: syzkaller0 [ 157.108535][ T9025] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 157.150572][ T9025] batman_adv: batadv0: Removing interface: syzkaller0 [ 158.577832][ T1516] wiimote 0005:057E:0306.0002: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 158.583353][ T1516] wiimote 0005:057E:0306.0002: New device registered [ 158.646523][ T9052] tipc: Enabled bearer , priority 0 [ 158.686441][ T9042] tipc: Disabling bearer [ 159.667680][ T8950] wiimote 0005:057E:0306.0002: detected device: Nintendo Wii Remote (Gen 1) [ 159.672384][ T8950] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input10 [ 159.693247][ T8950] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input11 [ 159.698986][ T8950] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input9 [ 159.747901][ T1516] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 159.927339][ T1516] usb 1-1: Using ep0 maxpacket: 16 [ 159.932737][ T1516] usb 1-1: config 0 has no interfaces? [ 159.935358][ T1516] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 159.936967][ T1516] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.942723][ T1516] usb 1-1: Product: syz [ 159.943471][ T1516] usb 1-1: Manufacturer: syz [ 159.944381][ T1516] usb 1-1: SerialNumber: syz [ 159.952574][ T1516] usb 1-1: config 0 descriptor?? [ 159.993767][ T9078] batman_adv: batadv0: Adding interface: syzkaller0 [ 159.995018][ T9078] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 160.014496][ T9082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.016478][ T9078] batman_adv: batadv0: Interface activated: syzkaller0 [ 160.022889][ T9082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.027911][ T9076] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 160.109005][ T9076] batman_adv: batadv0: Removing interface: syzkaller0 [ 160.895166][ T9095] tipc: Enabled bearer , priority 0 [ 160.900387][ T9094] tipc: Disabling bearer [ 162.093681][ T4374] usb 1-1: USB disconnect, device number 8 [ 162.159966][ T9057] wiimote 0005:057E:0306.0002: Device removed [ 162.412526][ T9124] batman_adv: batadv0: Adding interface: syzkaller0 [ 162.413774][ T9124] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 162.453402][ T9124] batman_adv: batadv0: Interface activated: syzkaller0 [ 162.464487][ T9120] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 162.527412][ T9120] batman_adv: batadv0: Removing interface: syzkaller0 [ 162.533656][ T9133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.546049][ T9133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.881840][ T9139] tipc: Started in network mode [ 162.884428][ T9139] tipc: Node identity 3a5ac7314537, cluster identity 4711 [ 162.889501][ T9139] tipc: Enabled bearer , priority 0 [ 162.911899][ T9137] tipc: Disabling bearer [ 163.477993][ T9158] loop4: detected capacity change from 0 to 4096 [ 163.489694][ T9158] ntfs3: loop4: Failed to load $MFT. [ 163.517866][ T9158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1725'. [ 163.672668][ T9163] batman_adv: batadv0: Adding interface: syzkaller0 [ 163.674225][ T9163] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 163.681729][ T9163] batman_adv: batadv0: Interface activated: syzkaller0 [ 163.689864][ T9162] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 163.728699][ T9162] batman_adv: batadv0: Removing interface: syzkaller0 [ 163.866201][ T9165] tipc: Enabled bearer , priority 0 [ 163.870008][ T9165] syzkaller0: MTU too low for tipc bearer [ 163.877800][ T9170] binder: 9169:9170 ioctl c0306201 0 returned -14 [ 163.879177][ T9165] tipc: Disabling bearer [ 163.884282][ T9170] binder: 9169:9170 got transaction to invalid handle, 1 [ 163.888182][ T9170] binder: 9170:9169 cannot find target node [ 163.890573][ T9170] binder: 9169:9170 transaction call to 0:0 failed 113/29201/-22, size 72-0 line 3062 [ 163.894887][ T9170] binder: 9169:9170 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 163.901824][ T9170] binder: 9170 RLIMIT_NICE not set [ 163.998379][ T9173] loop3: detected capacity change from 0 to 128 [ 164.027121][ T9173] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 164.137713][ T11] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 164.244284][ T9180] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1734'. [ 165.751058][ T4377] binder: undelivered TRANSACTION_ERROR: 29201 [ 165.760808][ T9180] CIFS: Attempting to mount \\127.0.0.1\share [ 165.761988][ T9180] CIFS: VFS: No username specified [ 165.942415][ T9189] loop1: detected capacity change from 0 to 1024 [ 165.973509][ T9189] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 165.990455][ T9189] EXT4-fs (loop1): barriers disabled [ 165.993279][ T9189] JBD2: no valid journal superblock found [ 165.995525][ T9189] EXT4-fs (loop1): error loading journal [ 166.118656][ T9193] batman_adv: batadv0: Adding interface: syzkaller0 [ 166.126548][ T9193] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.133567][ T9193] batman_adv: batadv0: Interface activated: syzkaller0 [ 166.140984][ T9192] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 167.056875][ T9192] batman_adv: batadv0: Removing interface: syzkaller0 [ 167.223120][ T9211] binder: 9210:9211 ioctl c0306201 0 returned -14 [ 167.231085][ T9211] binder: 9210:9211 got transaction to invalid handle, 1 [ 167.234983][ T9211] binder: 9211:9210 cannot find target node [ 167.237337][ T9211] binder: 9210:9211 transaction call to 0:0 failed 117/29201/-22, size 72-0 line 3062 [ 167.241764][ T9211] binder: 9210:9211 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 167.248620][ T9211] binder: 9211 RLIMIT_NICE not set [ 167.545988][ T9221] Error parsing options; rc = [-22] [ 167.986652][ T9234] batman_adv: batadv0: Adding interface: syzkaller0 [ 167.989147][ T9234] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.998091][ T9234] batman_adv: batadv0: Interface activated: syzkaller0 [ 168.014875][ T9232] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 168.046552][ T8950] binder: undelivered TRANSACTION_ERROR: 29201 [ 168.066289][ T9232] batman_adv: batadv0: Removing interface: syzkaller0 [ 168.139674][ T9241] tipc: Enabled bearer , priority 0 [ 168.154632][ T9241] syzkaller0: MTU too low for tipc bearer [ 168.165481][ T9241] tipc: Disabling bearer [ 168.333266][ T9250] Error parsing options; rc = [-22] [ 168.655614][ T9255] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.657147][ T9255] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.988343][ T9264] loop4: detected capacity change from 0 to 136 [ 169.185971][ T9255] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 169.213737][ T9255] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 169.247273][ T9266] binder: 9265:9266 ioctl c0306201 0 returned -14 [ 169.265794][ T9266] binder: 9265:9266 got transaction to invalid handle, 1 [ 169.271602][ T9266] binder: 9266:9265 cannot find target node [ 169.278977][ T9266] binder: 9265:9266 transaction call to 0:0 failed 121/29201/-22, size 72-0 line 3062 [ 169.290592][ T9266] binder: 9265:9266 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 169.301143][ T9266] binder: 9266 RLIMIT_NICE not set [ 169.381447][ T9255] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.385551][ T9255] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.387325][ T9255] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.389142][ T9255] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.689689][ T9271] batman_adv: batadv0: Adding interface: syzkaller0 [ 169.692509][ T9271] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 169.705534][ T9271] batman_adv: batadv0: Interface activated: syzkaller0 [ 169.709943][ T9269] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 169.731744][ T9270] loop2: detected capacity change from 0 to 8192 [ 169.754616][ T9269] batman_adv: batadv0: Removing interface: syzkaller0 [ 169.873018][ T4374] wiimote 0005:057E:0306.0003: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 169.874902][ T4374] wiimote 0005:057E:0306.0003: New device registered [ 169.885378][ T9276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 169.892304][ T9275] batman_adv: batadv0: Adding interface: syzkaller0 [ 169.894716][ T9275] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 169.913554][ T9276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 169.925742][ T9274] wiimote 0005:057E:0306.0003: Device removed [ 169.933601][ T9275] batman_adv: batadv0: Interface activated: syzkaller0 [ 169.940674][ T9273] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 169.984635][ T9273] batman_adv: batadv0: Removing interface: syzkaller0 [ 170.059447][ T4317] binder: undelivered TRANSACTION_ERROR: 29201 [ 170.515055][ T9294] Error parsing options; rc = [-22] [ 170.911431][ T4374] wiimote 0005:057E:0306.0003: detected device: Nintendo Wii Remote (Gen 1) [ 170.916196][ T4374] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input13 [ 170.926498][ T4374] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input14 [ 170.932934][ T4374] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0003/input/input12 [ 171.215020][ T9307] binder: 9306:9307 got transaction to invalid handle, 1 [ 171.216524][ T9307] binder: 9307:9306 cannot find target node [ 171.217893][ T9307] binder: 9306:9307 transaction call to 0:0 failed 125/29201/-22, size 72-0 line 3062 [ 171.220023][ T9307] binder: 9306:9307 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 171.224993][ T9307] binder: 9307 RLIMIT_NICE not set [ 171.399439][ T9310] lo speed is unknown, defaulting to 1000 [ 172.031847][ T9331] binfmt_misc: register: failed to install interpreter file ./cgroup [ 172.049720][ T8950] binder: undelivered TRANSACTION_ERROR: 29201 [ 172.184137][ T9336] loop3: detected capacity change from 0 to 256 [ 173.183968][ T9361] loop2: detected capacity change from 0 to 128 [ 173.201703][ T9360] batman_adv: batadv0: Adding interface: syzkaller0 [ 173.209837][ T9360] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 173.228297][ T9361] EXT4-fs (loop2): Test dummy encryption mode enabled [ 173.239997][ T9360] batman_adv: batadv0: Interface activated: syzkaller0 [ 173.246425][ T9358] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 173.248340][ T9361] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 173.284212][ T9361] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-ce" [ 173.361705][ T9358] batman_adv: batadv0: Removing interface: syzkaller0 [ 174.356860][ T9369] binder: 9368:9369 got transaction to invalid handle, 1 [ 174.366725][ T9369] binder: 9369:9368 cannot find target node [ 174.368959][ T9369] binder: 9368:9369 transaction call to 0:0 failed 129/29201/-22, size 72-0 line 3062 [ 174.378116][ T9369] binder: 9368:9369 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 174.426543][ T4339] EXT4-fs (loop2): unmounting filesystem. [ 174.428344][ T9369] binder: 9369 RLIMIT_NICE not set [ 175.152722][ T8950] binder: undelivered TRANSACTION_ERROR: 29201 [ 175.289801][ T9389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.295726][ T9389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.831268][ T4336] Bluetooth: hci3: unexpected event for opcode 0x041c [ 176.545383][ T9413] binder: 9409:9413 got transaction to invalid handle, 1 [ 176.568754][ T9413] binder: 9413:9409 cannot find target node [ 176.569889][ T9413] binder: 9409:9413 transaction call to 0:0 failed 133/29201/-22, size 72-0 line 3062 [ 176.576562][ T9413] binder: 9409:9413 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 176.596582][ T9413] binder: 9413 RLIMIT_NICE not set [ 176.609219][ T9418] batman_adv: batadv0: Adding interface: syzkaller0 [ 176.610465][ T9418] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 176.615232][ T9418] batman_adv: batadv0: Interface activated: syzkaller0 [ 176.626344][ T9416] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 176.681825][ T9416] batman_adv: batadv0: Removing interface: syzkaller0 [ 177.123860][ T4317] wiimote 0005:057E:0306.0004: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 177.125771][ T4317] wiimote 0005:057E:0306.0004: New device registered [ 177.128866][ T9445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.141371][ T9445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.165382][ T9443] wiimote 0005:057E:0306.0004: Device removed [ 177.182802][ T9446] fido_id[9446]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 177.193818][ T9448] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1840'. [ 177.252362][ T9450] batman_adv: batadv0: Adding interface: syzkaller0 [ 177.253933][ T9450] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 177.260939][ T9450] batman_adv: batadv0: Interface activated: syzkaller0 [ 177.263794][ T9449] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 177.300792][ T9449] batman_adv: batadv0: Removing interface: syzkaller0 [ 177.345766][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 177.505318][ T9453] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1843'. [ 177.512529][ T9453] device bridge_slave_1 left promiscuous mode [ 177.513793][ T9453] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.540664][ T9453] device bridge_slave_0 left promiscuous mode [ 177.542010][ T9453] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.398140][ T4317] wiimote 0005:057E:0306.0004: detected device: Nintendo Wii Remote (Gen 1) [ 178.402008][ T4317] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0004/input/input16 [ 178.417103][ T4317] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0004/input/input17 [ 178.426323][ T4317] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0004/input/input15 [ 179.262876][ T9481] batman_adv: batadv0: Adding interface: syzkaller0 [ 179.269623][ T9481] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 179.276335][ T9482] binder: 9480:9482 got transaction to invalid handle, 1 [ 179.280615][ T9482] binder: 9482:9480 cannot find target node [ 179.282941][ T9482] binder: 9480:9482 transaction call to 0:0 failed 137/29201/-22, size 72-0 line 3062 [ 179.285298][ T9481] batman_adv: batadv0: Interface activated: syzkaller0 [ 179.289846][ T9482] binder: 9480:9482 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 179.294788][ T9479] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 179.309998][ T9482] binder: 9482 RLIMIT_NICE not set [ 179.338230][ T9479] batman_adv: batadv0: Removing interface: syzkaller0 [ 180.090554][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 180.654052][ T9508] IPVS: Error connecting to the multicast addr [ 182.135012][ T9510] CIFS: Attempting to mount \\127.0.0.1\share [ 182.136415][ T9510] CIFS: VFS: No username specified [ 182.239057][ T9513] batman_adv: batadv0: Adding interface: syzkaller0 [ 182.240244][ T9513] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.313409][ T9513] batman_adv: batadv0: Interface activated: syzkaller0 [ 182.330474][ T9512] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 182.337635][ T9520] binder: 9519:9520 got transaction to invalid handle, 1 [ 182.344224][ T9520] binder: 9520:9519 cannot find target node [ 182.352443][ T9520] binder: 9519:9520 transaction call to 0:0 failed 141/29201/-22, size 72-0 line 3062 [ 182.354406][ T9520] binder: 9519:9520 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 182.357128][ T9520] binder: 9520 RLIMIT_NICE not set [ 182.376148][ T9512] batman_adv: batadv0: Removing interface: syzkaller0 [ 183.353371][ T8950] binder: undelivered TRANSACTION_ERROR: 29201 [ 183.809761][ T9540] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.812901][ T9540] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.835066][ T9540] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 183.932362][ T9545] loop3: detected capacity change from 0 to 128 [ 183.948386][ T9545] EXT4-fs (loop3): Test dummy encryption mode enabled [ 183.982098][ T9545] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 184.113200][ T9551] batman_adv: batadv0: Adding interface: syzkaller0 [ 184.115303][ T9551] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 184.960409][ T48] Bluetooth: hci3: command 0x0406 tx timeout [ 184.981538][ T9551] batman_adv: batadv0: Interface activated: syzkaller0 [ 184.991877][ T9550] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 185.136497][ T4328] EXT4-fs (loop3): unmounting filesystem. [ 185.139308][ T9550] batman_adv: batadv0: Removing interface: syzkaller0 [ 185.217378][ T9558] binder: 9555:9558 got transaction to invalid handle, 1 [ 185.218667][ T9558] binder: 9558:9555 cannot find target node [ 185.219677][ T9558] binder: 9555:9558 transaction call to 0:0 failed 145/29201/-22, size 72-0 line 3062 [ 185.227105][ T9561] loop4: detected capacity change from 0 to 256 [ 185.245644][ T9558] binder: 9555:9558 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 185.285157][ T9558] binder: 9558 RLIMIT_NICE not set [ 185.292805][ T9564] loop3: detected capacity change from 0 to 256 [ 185.921951][ T9583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.928202][ T9583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.006063][ T8950] binder: undelivered TRANSACTION_ERROR: 29201 [ 186.011590][ T9587] [ 186.012297][ T9587] ============================= [ 186.013203][ T9587] WARNING: suspicious RCU usage [ 186.014146][ T9587] syzkaller #0 Not tainted [ 186.014911][ T9587] ----------------------------- [ 186.015680][ T9587] net/netfilter/nf_conntrack_netlink.c:3389 suspicious rcu_dereference_check() usage! [ 186.017281][ T9587] [ 186.017281][ T9587] other info that might help us debug this: [ 186.017281][ T9587] [ 186.019089][ T9587] [ 186.019089][ T9587] rcu_scheduler_active = 2, debug_locks = 1 [ 186.020415][ T9587] 2 locks held by syz.2.1892/9587: [ 186.021272][ T9587] #0: ffff80001ca2a418 (nfnl_subsys_ctnetlink_exp){+.+.}-{3:3}, at: nfnetlink_rcv_msg+0x888/0xf88 [ 186.023118][ T9587] #1: ffff8000153a4898 (nf_conntrack_expect_lock){+.-.}-{2:2}, at: nf_ct_expect_iterate_net+0x48/0x260 [ 186.025142][ T9587] [ 186.025142][ T9587] stack backtrace: [ 186.026161][ T9587] CPU: 0 PID: 9587 Comm: syz.2.1892 Not tainted syzkaller #0 [ 186.027303][ T9587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 186.029017][ T9587] Call trace: [ 186.029601][ T9587] dump_backtrace+0x1c4/0x1f0 [ 186.030463][ T9587] show_stack+0x2c/0x3c [ 186.031183][ T9587] __dump_stack+0x30/0x40 [ 186.031952][ T9587] dump_stack_lvl+0xf4/0x15c [ 186.032699][ T9587] dump_stack+0x1c/0x5c [ 186.033427][ T9587] lockdep_rcu_suspicious+0x20c/0x3cc [ 186.034322][ T9587] expect_iter_name+0x128/0x12c [ 186.035221][ T9587] nf_ct_expect_iterate_net+0x104/0x260 [ 186.036207][ T9587] ctnetlink_del_expect+0x400/0x59c [ 186.037170][ T9587] nfnetlink_rcv_msg+0xaac/0xf88 [ 186.038038][ T9587] netlink_rcv_skb+0x220/0x3ec [ 186.038899][ T9587] nfnetlink_rcv+0x210/0x1c54 [ 186.039756][ T9587] netlink_unicast+0x5fc/0x80c [ 186.040658][ T9587] netlink_sendmsg+0x6f0/0x9d8 [ 186.041524][ T9587] ____sys_sendmsg+0x588/0x90c [ 186.042378][ T9587] __sys_sendmsg+0x288/0x374 [ 186.043162][ T9587] __arm64_sys_sendmsg+0x80/0x94 [ 186.044022][ T9587] invoke_syscall+0x98/0x290 [ 186.044840][ T9587] el0_svc_common+0x13c/0x258 [ 186.045700][ T9587] do_el0_svc+0x5c/0x134 [ 186.046499][ T9587] el0_svc+0x58/0x128 [ 186.047208][ T9587] el0t_64_sync_handler+0x84/0xf0 [ 186.048083][ T9587] el0t_64_sync+0x18c/0x190 [ 187.304306][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 187.305451][ T2065] ieee802154 phy1 wpan1: encryption failed: -22