last executing test programs: 6.635302437s ago: executing program 3 (id=172): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r0, 0x4, 0x42000) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) close(0x3) syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd018009050202100202000009058202"], 0x0) 4.472791913s ago: executing program 3 (id=174): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x5000) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) write$binfmt_aout(r1, 0x0, 0xffffffdb) 3.266611282s ago: executing program 3 (id=177): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 3.055991642s ago: executing program 3 (id=179): r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x31, 0x0, &(0x7f0000000040)) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x12000) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) linkat(r1, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x1000) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180), 0x181899, 0x0) 2.918793812s ago: executing program 2 (id=180): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r0, 0x7a5, 0x0) 2.849598349s ago: executing program 2 (id=181): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r1, 0xc0984124, 0x0) (fail_nth: 3) ioctl$SNDRV_PCM_IOCTL_REWIND(r1, 0x40084146, 0x0) 2.729289837s ago: executing program 3 (id=183): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x5c}}, 0x0) unshare(0x8020400) unshare(0x8000200) unshare(0x28000200) unshare(0x8000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000080)}, 0x1) 2.344212408s ago: executing program 2 (id=185): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xffff7ffc, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x2) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0xefe, &(0x7f0000000140)={0x0, 0xcc19, 0x10806}, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73"], 0x38}}, 0x0) r4 = syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="52010000ead4a320d118af1e6309010203010902240001f60720400904a67602ab52634a"], 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000f40)={0x14, 0x0, &(0x7f0000000f00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000001240)={0x24, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0x5, 0x2, "80c1"}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x240088c1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x50) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r6, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000800) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) (async) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0xffff7ffc, @loopback}, 0x1c) (async) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) shutdown(r0, 0x2) (async) socket$kcm(0x10, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_io_uring_setup(0xefe, &(0x7f0000000140)={0x0, 0xcc19, 0x10806}, 0x0, 0x0, 0x0) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73"], 0x38}}, 0x0) (async) syz_usb_connect(0x2, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="52010000ead4a320d118af1e6309010203010902240001f60720400904a67602ab52634a"], 0x0) (async) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000f40)={0x14, 0x0, &(0x7f0000000f00)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f0000001240)={0x24, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0}, 0x0) (async) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000200)={0x40, 0x5, 0x2, "80c1"}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x240088c1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x50) (async) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x28, r6, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000800) (async) 2.138629687s ago: executing program 3 (id=186): io_setup(0x2, &(0x7f0000002400)=0x0) io_submit(r0, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2000000000, 0x4, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x300, 0x2}]) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$RTC_WKALM_SET(r1, 0x40187013, &(0x7f0000000080)={0x1}) clock_nanosleep(0xa, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x46, &(0x7f0000000100)=ANY=[@ANYBLOB="120150025e000000f0030703010005800200040f008109050a0000020981000705a1662cbf3609050100000001010200"/70], &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0}) 2.063786398s ago: executing program 1 (id=187): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 1.983904587s ago: executing program 1 (id=188): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c000780080006"], 0x5c}}, 0x20084884) (fail_nth: 3) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 1.797199737s ago: executing program 1 (id=189): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf688", 0x80}, {&(0x7f0000000380)}], 0x2}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000580)}], 0x1}}], 0x2, 0x20000044) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000340)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000680)=0x5) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x4840}, 0x20020084) sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10010002}, 0xc, &(0x7f0000000c80)={&(0x7f00000006c0)=ANY=[@ANYBLOB="7c0100", @ANYRES16=r2, @ANYRESHEX=r0, @ANYRESDEC, @ANYRES32=0xffffffffffffffff, @ANYRES8=r2, @ANYRES16=0x0, @ANYBLOB="400001801400020070696d367265673000000000000000001400020073797a5f74756e00000000000000000014000200697036677265746170300000000000003000018008000100", @ANYRES8=r2, @ANYBLOB="080003000300000008", @ANYRES32, @ANYBLOB="140002"], 0x17c}, 0x1, 0x0, 0x0, 0x4008004}, 0x20000080) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$fuse(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYRES16=r4, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3be", 0x6) r6 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r9 = socket(0x10, 0x3, 0x0) ioprio_get$pid(0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r9, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x2d, 0x0, 0x8f, 0xd, 0x5f, @empty, @remote, 0x1, 0x7800, 0x10, 0x81}}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010320000000000000000c0000000800040001"], 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000780)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r9, &(0x7f0000002740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002700)={&(0x7f0000001400)=ANY=[@ANYBLOB="e247532b", @ANYRES16=r2, @ANYBLOB="00022bbd7000ffdbdf250800000074010280080002000008000076000500ce73e59dbe721249c50ea485519b876098558b2d52d2c62f19e0371c5f85a830a5d6d43ecfe1f04366f9c4a52b2578232e77b7c83dc0e79c6a08bc2b91be4a526a8152434cdf93ec9037cf3f48f44f1a48a692e4c0d3911ee96b4e92f7041feaca67bc5f43f2d87c651bcea69a1be5804b260000ac000380280001800a000200212e282d2a00000008000100ffffff7f080002002c2f3a00080002007d5b2a002c00018008000100ea8a3962080001000100000008000100030000000800010009000000050002000000000024000180040003000500020000000000040003000500020000000000080001000300000030000180040003000800010005000000040003000400030007000200267b0000050002000000000008000100ffffff7f04000100040004003c00050014f44634715138dd6cb8809360a5f171376898c18edbf47fcbeeb5450e1d74218142573f327c84de3b21463309cfe5be4fccb1d80c3cd6861810028004100500697cf60918f360c04de153b7806146afb1c98c4603f8903234c0527a33c4ea8624af4b937abd26f46481d33ea6a7f0854e6122c10c4751f917d54b2753ff6296b037a500ed059760f001f58f0016f88a16de1bf273d9b28320db7fdb2d18d4e3005d5b352303d0b05ef250cef2686b47bbef6e0f0480727a56de1667c6c360f981f30ab4cfbed17159dca637a8e8ffb43808e3b6d645cd1928af0d9c793131a4869ab0b68f7420bee01e0bd9651820321afd9464d6d7b20dee93f81517d8eb78afb3653d6739950b6c55443c1b0adb236015a96e976215e8256934e3c05228abfeba528120a54411e4bdc6e6b1e168dec147efa7159c8573b0b45b13319de3b8410fdc7b1f7b3d74213e4cc94c96451577d5cb88001d134a8bb59db3fb723ac315cd9832e01ede107d5a05eb26628bc967243e2e819d9812cac520fc606ad634c8310fa57444e6efd5d2bb8f9206dbac4dccf5bbad1c939407d83cdd2e58f65fb88c51b3e5478c3ca8e5ad7b17d0e303c6b91619348af80e3d9d06c456196557c5d0b9851f3ad146974d52cc3d6c89ab7f2e5d89a03a9feaa6cc487d083937f87a313d4cc1cdb19fe15247037850eeed15a7cd3a811a541962548d7e6c571fa56717c04004e204bfbe9091729afa3b7d43d2ecc87455e5b4b89d17a959d6bceaecbbc9bd08b14af451f200834cc1539ab30f79beaaba5ce725ca96bd1c05d8782a65bef6bdb0bca587280ec1ec6188877af9257a89ca4e3e2e300785dd40dd7a87c90da9f5b99da7aa31a60fea630afb51f1c217fecfd4231e9bce266c68bacafce3a81d69a3e3cc1c9aaade4b2c1cae4104089693ce1c7eaaba5e7f428994452944d50daf0edce1765a90bd3e7407a72944d254ac7679c0fcfb5fe03f025707b2114d90d65a7e5c9011dcac6c469fb3b9e892c5cc7033e91ce375a5cb9f0339e3242e4a8f389b90eb9b5c489401c34dd79623b0257451d27a602e741b4d34ee4a70dcf03d51cab20cb32280e6d79edb94d527c4c1765d5b9dd4f85835faf3bc714e87bc8745c73e915ed5bf92588af5f2cf72a003d5ca72a35f8f7ab47e65da3564c60932ca783c0631a3fcd53c38f276bfca94cd70bdab397f3d259ad8da383bdf378cb31fd6bb94736d2290b9643d8f3037a50b0ba1c310de156661130e09b6a472e2bc43e1b8e0e5828008d4477c12eb8bbeb9ef17948177aedc7c2ee55ebd1e802712d1423ebdf784aa16889e0c1bf4ccd62bc2586796140e8b3078381c75c177b2728a86f71b01e68643cacbbe2bf040cf2e6f6d4921b00d3d17427b67e5c98d0609b36008bcd87207aba74b5105d9e0dc6722cca26928798aa08a607bd9284a09f8b1b0f9b728dc4545fe50faa86089117b35600850127779994c2f64ab4d5a46ff93bdf4a8f0a035c5bfa673eaced827f727306e0ad9dcdef8c9510526301b336db474acc5eb6207caa36b7b81029e472386e4db9193af1053f5e1a00a3700ce77d22f7c3ccbf2d71fd5551d0a28a8ace298d38e58ab1cc6f94da350f958ed3f5656fff2b611616128b4aec11830621c9c192a068377a29e86e04d72e1d0e2486f76959ebc8f399a3e04b65f57e3980af1600f706fc57d61ebf30325d5289ec18fc96903993c23f9ee3b738a0e37d8758247aea592e92853eefe95c8a2d40eaa73113b89e4cc8e596a33f1bc6bee6021d426320bc31a57b59040ed7595dbe68feb430443fcf9e5b7ffa83289c0ab7df67f7172acf517091c479c06020cf6f1606bf992f0192dbee3c038ffe84d3d1327b7327dd9d81d956cd5c8f88a971919675f92b71b0a662270dfbc16289b4ae140a8be87ef0cf4607d55ff91b6ec5ef3dc99ed39f08eb41396e8f2d0767531fcc145d42dcd50342328d21392c66b92e42ff2aad664ed2e6aae1f8342961f6bf8f01521c9a351468c16df8d8fe325df3995e615563137267378dbbed3c331ab65afb92d21ce1ef9b4d372183cf13f8f6f4b29c81ba3e3dce70d1b4f3192560dcda9cd308c7ae1aea3850cfd442a2f801a95b863ff8e8a156a3027357aa7b42e92c7998aa5bc0192a80a884f91afdaec1572f21665f00347c56d3d2f4c086a62b1125243ab9a570b85163038c5a74a375eef8106698daedc9d4ce7135b32f34cc61fcfd943b3a0276ad6263b9fe5b2da431ddb183b39b14a2541142019fe6378f6808a2c34214383f1c3fa4038f050e553d9f258b83e17e939a57ba5f93a17756f6e12f9f58a02052dade217567bc4d078fb5402c9d5bdf16ae8e779867d9544b9db572218e13ec90c6377708869c73a9f66a58acd8f8fb34e57b94b0910e6c4265c1bcaf0e7c4e737c76dbc5fddfa327adc81e8a95d9a10d1d4a9c836471ae73b52e3fd56744e00a2e15abf9f2aeb434d2400cc23428c430fcb39babe5d5a919db6afe36a82062db3f01174a85c789777013e2f28614b3a2de60e3eafe99272f607d20187d4b580a9b06140552231082440dbbc4644d77a047451a4c2d3df23ade03630abfb77d72f8c4b7cdcfe0601f739310b6328802f81d40a17f80bd312fc18440e23fe5309ffb5810196afda4a08e1c48e6f311b293bf06b2ccaf89bcddcd24b6405ad562005804282a8063008d6db68a4ea0fb7c1e9eee5e200a3b9d7f8302ed1dca1f3525d3fb1e0031e97aeab196d0e3d2248603aec208e9924b3a87b47242c79da83ef31a3564b01f56fd9a0c04a54bb7f9bd87e1fb93e32d40ff6f3c0b1afb5f992bd38a3e73b8fa2d9fe172dfcb96143a2b9afc1649d55bf96e4346345c9707588185aee59c99ee43c942684cc0514a1a979a58eafe438da08dd46302e60fe465b000da0ff4b30ee7801bd1fcfeea46bb09d8dc40092d3ab30feb2f171673628f27aff117195cef154f9b9664436bf3611e10856c2c524912c98c991c3d7c765ba283909249bc6d3f7e884ee2fa9ff264619763de5ce0900118b5c5a257029c73ca0406b2830d4142ffabd5ed8b4f2b489f46dec949eb49c53f628a6b5ac588a3721980f2a84c8b27efdf5d4486a0b8eec18947160cbdf67968e2f3546a23081a53923342c587ee90906826da0dc6b91c3bd94ad485085196adf48b2ba40debd84c98560370fbaf7a588f248c27a8472eafca61f1c6eb924e693d96e4f149b9f0daf1c2732ed061df9354adaee1359ff29d76f143a62da84a862f1424ebdecd989e040134b0ec1320c82bac818d7be98572cd4b66835924ad6b454a11d2662f26b537ee883a0bdbfef7e23b2be95aac36c024639cb2ff22983f1b0684aaeb8c564c4d219cb6a229d28a49a08c0ec39139fe80f4848d4855846edf056efb67eb4a7efc9d87e3af13a0835cc37166cb500424115910feb04b438dddbf48e84b0698cb880b869709cba9e4a2f5ab119d4d8b9b8f6a226238f9bc57a1539e36c685e97ebce1673f67ab9b19f70f3c3b5d34babe02a8f61f6501ab7e6d9cdd1a68ac2b1c93dd72ff156b52241bbb156a450967f6eb86b4337b373cf9eb8201a9f1c78c5483b5700208d51d391ac477d8d36e300479b3cb5cb11b9c6747c6f0767eddcef5a7ac65f3b57495e48233b970a3c88b207fff9517ee3d12900426b77ced150558fd0bcf2f8d86b49ede1505b7e6a05ab1b14e385d95f53a324e1697c2e0a33dbc7f09f0369142ebdaa757d6d5e50623f095382fe03442a7a6ed4c968be339414ad880e9379c3fe5a040dc04593222e5234b3ca6a51e62239ba263e9f4d95a87b41528627dedc58aef2431f2b4dbbc14b940f427e8e01c95368dbf331797e8f00f3c11a3dedf68784496844e3e293af770e29b3e57cf68b450ef99664ec7d10eceb4c53c0360b80157544b282c35a13b61fb6d275e38da9ac4be7705dae2f87b7177de2ef0bea3171c472018a252d089159ba9c23df8724df02c7f2e9ad0edc1d247cc79534b51bc048e21d4b72f9b1998307c316e455c229a7fadd7c76c7c152386836090c7588591b4805e5fc40bc4dfcafed2bac1cbefe235b3064f61e77b4c84247d08cf65988eefecf7cd52e330a4bdb2a01ddeebc91aeecc43a5a38d9427f1d9e90c03651ad3437eca026568ac1e864f04426c399b2aea52ae6a8868e81d11d376a2710d5a05c6de4d34a1002aac17b1eb61a0760495f5b8dcde4131f861eaedaada02b2a6eed709cdf6a8d1d77103b09eec3463d7575a058fb61973b9e41e6a7eed6b7ffc11246100219edbf51017d5c3ec4eb445df06ad337332de7cc36d81f43129d2bf3dba599893287e93fadb9a4057fa7b0ac86fe566ef384c4f45f6f2d929d9839c350f68aa8bdf9babc48b3debee64e6d019a16b3c3d634ab7ad75a36b46c9a7703e4585182cc0c472f0aa3ab6ebc804427123c62a4027505048953af0db8fdf050ab6ad9be9ada1fbe5005f812e245bcce055d063769b21d8e84123a6658274c05b5ea84ce76e3ebe042796f1d73915f51f09fafba7277ac1a91a557e81c910d8793ff00a950ae31a996b4a310ca7ab4f981c5ea13de7decc99b607e88ca49c50abfdcc9ec1d465229daa0acdef1cba69942b6d85b12ffa1cbff1ecf83b1c1a1418235e5ec1e90e96f520b50f9d4f8f0bae850e55e98c16801a488a43a1b1c9936a00f9521f2f5787bdb7956ad44dcf093cfced61307c187dc01c8f791fc072bf915cbe23802a2fcd21d1354aa8929dd47bce65a7726cde6a6099b7314c96663e2464c98771ee9ebca30aacf19411546c2eb55b600b154c35facec93b759eef1099a14c788d10a065fbe25778e95dcddf3179e5486cd76f7433b189a2cc7fe0605b022a979301a4ca19548281fbc1a50f3009367fa963735234979837b92fceb7b99f585abfb2ec4a8ca7ed00305db9030e3c463f7c8c863faebdd852f072302a2f85141c042118838a5c6615c7687db73f783162324f789d24679306c144378dbd02f57ffb19dc08a2ff062f5474b7450e6ad1b8e72ac12ba8d8a76780aaa994d27cc242f6f9a6b297cc23ebf427b66f8912ddd7a34117b9629b526f7d96f4ade046cae41a0253898180ab6bbd7397ca0996dc744cf3d413db8c4012b6189ebef8dcde97465e51ee82365da37ff0ec3544d1984cca405b621a24fede2b76d09226884dee8879a93711951f2125e099a7807f082ba0c96fe66ceecb81427ce9f2de9a2471180873340f619d6807a35ffa01b64e67faedb9424fbccfc95ba341e344c51153406de673fc7f4e73ffbd724feb8fc9a872001334dfc7a8c8801f62c3c9abc83fed1e787b3ffe3f06875c4f20800ff89ab72609f0d4bdf2dba83c38c905e7b528c0710d7cb4bb696a4fe7494687b7feaca765eb8512f86d87f8754d2074fe7576c3ca455a86f309b40f2bea31b1311e002ad5b64078afb4a0808078626d45a1afbc0863b5536d69418c27f088c95ddc7c14041f038b6e78e687c797affd57f59e5d4b9ad944909bed6245243d340732b8136cde6c270c89ff55499446463e33b76c11c80919bf9fd32bea801d9f13e97e6aa0f77943911e2ee198903af43e928855d08681c792396413e04165c13441a6ddf662e3cdb692ea0e7de1846edb4db046999a6c5cecbe63eab00f709890251c788ca3d132c5aab412dece0be127f846b922760f27273082265dee944daef435075c92bc2cb990fb8667bc9a32ba978b9c6bf01355574ffe9d4d3b68c23c575e8c43c332144ce3129a1e9ef2e5d002be5f83a0682d0008ade5a1884b5ccb2de20349f9e4186f460a264f5619c6c55d22314369409cdec57c190e37b7da9eb7e3ff2495881ce6742a85b3a5a040001000400050008000200ffffff7f0c00018008000100", @ANYRES32=r11, @ANYBLOB="34010280300103805800018004000300080001002aab137b08000100000100000d000200736b63697068657200000000040003000500020000000000080001000200000008000100080000000800010000010000090002002d7d5d25000000002c000180080001000200000005000200000000000400030005000200000000000800010003000000040003000c0001800800010000000000440001800d000200736b6369706865720000000004000300040003000800010008000000080002002d2926000b0002002e992e2d7d2a00000800010040000000040003003c00018004000300040003000c0002007d7d2d2b7b5b2c00080001000500000004000300040003000a00020040285e8e2c0000000800010001000000100001800400030004000300040003000c000180060002005d2a0000"], 0x12e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r12, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYRESDEC=r3, @ANYRESOCT, @ANYRESOCT=r9], 0x6f4}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.614338922s ago: executing program 0 (id=190): r0 = socket(0x40000000015, 0x805, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01010000000000000000010000000900030073797a31000000000900010073797a3100000000280004801400030069705f7670693000000000000000000008000140000000050800024058eec9d728000000000a050000000000000000000100000808000240000000010900010073797a3100000000140000001100010000000000000000000000000a5a1d57e43d0d3a32b3116a4a589372a4ee68264ddc0e3b9454dd8fcf31eefa"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x4a7, @loopback, 0x62a5}, {0xa, 0x4e24, 0x80, @empty, 0x8}, 0xffffffffffffffff, 0x8}}, 0x48) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000440)={0x7}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) ftruncate(0xffffffffffffffff, 0xfffffffffffeffff) getsockopt(r0, 0x114, 0x2718, 0x0, &(0x7f00000000c0)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010008030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000084000000060a010400000000000000000100000108000b40000000005c000480340001800b000100657874686472000024000280080001400000000a0800034000000002080004400000002d0500020007000000240001800a0001007265646972000000140002800800024000000002080001400000000b0900010073797a30"], 0x1d4}}, 0x0) 1.372949883s ago: executing program 0 (id=191): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)=0x9) r0 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0xfffffffffffffffc, 0x804e5) r1 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x7ff, 0x240002) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r2, 0x541c, &(0x7f0000000100)={0xd, 0x4}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f00000000c0)={0x1, 0x1, 0x80000001, 0x10000, 'syz0\x00', 0x8}) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r0, 0xc0984124, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0x40084146, 0x0) 1.181771354s ago: executing program 0 (id=192): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0x0, 0x9, 0x82, 0x0, 0x3, 0x80007f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x3, 0x2, 0x0, 0x59d, 0x0, 0xd, 0x2a9, 0x4, 0x7, 0x24, 0x3c5b, 0x1, 0xff, 0xb8e, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0x100000b, 0x3, 0x7fff, 0x0, 0x400, 0x800242, 0x1, 0xa, 0x0, 0x71, 0x2, 0x6, 0xe8, 0x2, 0x5, 0x3e, 0x8f, 0xff, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x4007, 0x7, 0x8, 0xd0, 0x1], [0x10000007, 0xffff, 0x12f, 0x6, 0x13, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xf, 0x2bf, 0x5, 0x1000, 0xfffffffc, 0x0, 0xa, 0x7, 0x5, 0x2f, 0x7, 0x312, 0xffffffff, 0x0, 0xfffffffe, 0x8, 0x20000004, 0x8000, 0x9, 0x3fe, 0x401, 0xfff, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x4, 0x1, 0x2, 0x2, 0x20009, 0x4, 0x9, 0x5, 0x6, 0x6, 0xb, 0xa, 0x4, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x4, 0x3, 0x8000, 0xffffffff, 0xffff, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x40000100, 0x8d2, 0x1, 0x5, 0x7, 0x6, 0x1, 0xb, 0x20003, 0x5, 0x1006, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x3, 0x1, 0xb, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x7, 0x4, 0xb, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc4f, 0x950bfaf, 0x1000, 0xa6, 0x7, 0x53cf697b, 0xfffffff9, 0x4, 0x9, 0xbf, 0x10002, 0x403, 0x7ff, 0x5, 0x0, 0x1, 0x10001, 0x0, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaae9, 0x4, 0x101], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x5, 0x0, 0x1003, 0x80ceb, 0x1ff, 0x5129, 0x7, 0x5, 0x1004, 0x101, 0x10000, 0x1, 0x7ffc, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x4, 0x60a7, 0x6, 0x8, 0xefffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x201, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x3, 0xfffffffe, 0xffff, 0x0, 0x1, 0x10080, 0x6, 0x5, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x21, 0x6c18, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x4, @ipv4={'\x00', '\xff\xff', @remote}, 0x40000}, 0x1c) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, 0x0, &(0x7f00000001c0)=0xb00) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r3, 0x84, 0x65, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e20, @broadcast}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e20, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x30000000}], 0x6c) sendto$inet6(r1, &(0x7f0000000180)="af4fd73a", 0xffffffffffffff19, 0x840, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000340)=0x20000000, 0x4) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000140)=ANY=[]) 1.140069191s ago: executing program 1 (id=193): ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000140)=0x2000) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000140)=ANY=[]) 1.055966488s ago: executing program 0 (id=194): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$inet6_tcp(0xa, 0x1, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000100)="2e1221b23bb6", 0x6}], 0x1) 977.262603ms ago: executing program 1 (id=195): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2140, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=@delpolicy={0x5c, 0x14, 0x1, 0x70bd2b, 0x25dfdbfb, {{@in=@empty, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x80, 0x7, 0x0, 0xa}}, [@mark={0xc, 0x15, {0x0, 0x100}}]}, 0x5c}}, 0x4004040) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.time\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x13, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x60, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 627.68854ms ago: executing program 2 (id=196): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 615.442786ms ago: executing program 0 (id=197): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000080)=[@clear_death], 0xf, 0x0, &(0x7f0000000140)="73339386520335989a9ea356e85266"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r2, 0x40082102, &(0x7f0000000000)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) quotactl_fd$Q_SYNC(r2, 0xffffffff80000102, 0x0, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, &(0x7f00000000c0)="0100000002", 0x5, 0xffffffffffffffff) sendmsg$NFT_BATCH(r3, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a14000000140a0303000000000000000007000008cc000000000a0102000000000000000002000009b600060099fcd9d4e952f52faa3d050fc717bc93950f3e752f6b900ab6667f02f6f4ff22312d5780e57e9a433e66830d2c09e38319a4f5a2948ea05db5220c4f3654fff999e7bd0c520e3dcad350e14d0bfee16f23b986318e6a28ea585c58f24d5bc320ae407d01d124d2610f2b9d8de5a657ed26341093a8630d302fbf331b464a5af8a44b9b80862aad221389028c2d1108c6e7b09dd613b90d7faf92e5f2eb12a12c462b80633cd160213b0158288b9d9d7aeff400006c0100000b0a010100000000000000000100000a08000f40000000070900018cb80073797a30000000000900010073797a31000000004800118007000100637400003c00028008000140d679c8970500030001000000080002400000001008000240000000070500030001000000080002400000000a05000300000000005800128034000180090001006861736800000000240002800800044000000003080003400000001c08000740000000010800074000000000100001800b00010064796e7365740000100001800a0001ed00717565756500000008000c400000000008000640000000000c000b4000000000000000040c00104000000000000000056d000d40bc7f31f75782b64005783f978062293dae03ad8029f2b6189e351634a3ffceb76ab06921e2f71cef13fe24b5c36138d92589df79b2f0096538bb23061633517e83648ae3a06f296b8579b7281e36d9f0d4cfc7f7ae4ea55731bc71adda76d0b0082196b6abf2f08b59000000140000001100010000000000000000000300000a0c374aafc413ba56674af5b95eed173bd0436fb589df9dcc58451629082d483d700c6f173f354db6f379639bc19756e890c090a7f629466af437c085e737816a0e01c833c9e03bdd885109cebc7636924d2082b419dba9b9b97ca5139cc1800528b84065e23f288641ea5c4bc3998f24aec5bd342d5ba33d7cb8a4cc461efa8baf6c8e7d6a77a1928a01"], 0x274}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) 442.519706ms ago: executing program 2 (id=198): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) fallocate(r0, 0x0, 0xe0ae, 0x10) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYRESOCT=0x0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000800040000', @ANYRESDEC]) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f00000003c0)={0x0, 0x0, 0x8, 0xfffffffffffffffe}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x288}]}) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x81, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r5, 0x80045017, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x800c5012, &(0x7f0000000340)) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)={0x20, r8, 0x1, 0x70bd27, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) write$cgroup_devices(r6, &(0x7f0000000200)=ANY=[@ANYBLOB='c '], 0x11) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./cgroup.net/devices.allow\x00', &(0x7f0000000040), &(0x7f0000000080), 0x2, 0x0) 156.940392ms ago: executing program 1 (id=199): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000000000000400', @ANYRESDEC]) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189002, 0x40) write$cgroup_devices(r0, &(0x7f0000000200)=ANY=[@ANYBLOB='c '], 0x11) (fail_nth: 3) 156.40399ms ago: executing program 0 (id=200): syz_open_dev$usbfs(&(0x7f0000000040), 0xffffffffffffffff, 0x40000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000001240)={0x3, 0x0, [{0x4000000a, 0xb, 0x6, 0x7, 0x4, 0x7, 0xb}, {0x2, 0x7, 0x4, 0x8, 0x7ff, 0x7fffffff, 0xa16}, {0x40000000, 0x80000000, 0x1, 0x4, 0x9, 0x8, 0x4}]}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="28000000120009000000000000010000ed0000000c0000000000000000fa"], 0x28}], 0x1}, 0x0) listen(r3, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r3, 0x60}], 0x1, 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=201): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='illinois', 0x8) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.77' (ED25519) to the list of known hosts. [ 89.397373][ T5595] cgroup: Unknown subsys name 'net' [ 89.636812][ T5595] cgroup: Unknown subsys name 'cpuset' [ 89.692394][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.755781][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 92.098801][ T969] cfg80211: failed to load regulatory.db [ 95.579868][ T5610] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.596874][ T5610] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.599849][ T5610] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.613108][ T5610] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.616720][ T5610] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.709815][ T61] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 95.735653][ T61] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 95.738703][ T61] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 95.773374][ T5617] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 95.773786][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 95.800366][ T5617] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 95.817720][ T5617] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 95.832474][ T5619] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 95.854603][ T5622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 95.854916][ T5622] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 95.858705][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 95.859222][ T5619] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 95.860294][ T5617] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 95.874657][ T4924] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 95.898019][ T5619] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.734183][ T5610] Bluetooth: hci0: command tx timeout [ 97.972835][ T5610] Bluetooth: hci2: command tx timeout [ 98.051641][ T5610] Bluetooth: hci3: command tx timeout [ 98.052372][ T5610] Bluetooth: hci1: command tx timeout [ 98.137374][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.138818][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.139056][ T5608] bridge_slave_0: entered allmulticast mode [ 98.143531][ T5608] bridge_slave_0: entered promiscuous mode [ 98.213569][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.213870][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.214154][ T5608] bridge_slave_1: entered allmulticast mode [ 98.216839][ T5608] bridge_slave_1: entered promiscuous mode [ 98.409546][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.409859][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.410071][ T5611] bridge_slave_0: entered allmulticast mode [ 98.425307][ T5611] bridge_slave_0: entered promiscuous mode [ 98.452436][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.507752][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.508117][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.508349][ T5611] bridge_slave_1: entered allmulticast mode [ 98.510939][ T5611] bridge_slave_1: entered promiscuous mode [ 98.550631][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.551046][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.551287][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.552744][ T5612] bridge_slave_0: entered allmulticast mode [ 98.582519][ T5612] bridge_slave_0: entered promiscuous mode [ 98.660742][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.661048][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.661256][ T5612] bridge_slave_1: entered allmulticast mode [ 98.684326][ T5612] bridge_slave_1: entered promiscuous mode [ 98.685633][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.685872][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.686074][ T5613] bridge_slave_0: entered allmulticast mode [ 98.688651][ T5613] bridge_slave_0: entered promiscuous mode [ 98.777275][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.777514][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.777715][ T5613] bridge_slave_1: entered allmulticast mode [ 98.780321][ T5613] bridge_slave_1: entered promiscuous mode [ 98.814718][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.819222][ T5608] team0: Port device team_slave_0 added [ 98.883181][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.888801][ T5608] team0: Port device team_slave_1 added [ 98.908775][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.976966][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.986268][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.055806][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.059347][ T5611] team0: Port device team_slave_0 added [ 99.072881][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.072933][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.072990][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.159302][ T5611] team0: Port device team_slave_1 added [ 99.161055][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.161069][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.161097][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.218832][ T5612] team0: Port device team_slave_0 added [ 99.279423][ T5612] team0: Port device team_slave_1 added [ 99.289111][ T5613] team0: Port device team_slave_0 added [ 99.340356][ T5613] team0: Port device team_slave_1 added [ 99.349144][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.349158][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.349181][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.427956][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.427971][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.427992][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.486942][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.486958][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.486980][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.570710][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.570726][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.570753][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 99.811752][ T5610] Bluetooth: hci0: command tx timeout [ 99.864431][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 99.864447][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.864469][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 99.890304][ T5608] hsr_slave_0: entered promiscuous mode [ 99.914151][ T5608] hsr_slave_1: entered promiscuous mode [ 99.946797][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 99.946817][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 99.946849][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.051858][ T5610] Bluetooth: hci2: command tx timeout [ 100.100513][ T5611] hsr_slave_0: entered promiscuous mode [ 100.108638][ T5611] hsr_slave_1: entered promiscuous mode [ 100.110217][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 100.110307][ T5611] Cannot create hsr debugfs directory [ 100.132060][ T61] Bluetooth: hci3: command tx timeout [ 100.132232][ T5610] Bluetooth: hci1: command tx timeout [ 100.216382][ T5612] hsr_slave_0: entered promiscuous mode [ 100.218337][ T5612] hsr_slave_1: entered promiscuous mode [ 100.219807][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 100.219839][ T5612] Cannot create hsr debugfs directory [ 100.279196][ T5613] hsr_slave_0: entered promiscuous mode [ 100.280965][ T5613] hsr_slave_1: entered promiscuous mode [ 100.293994][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 100.294016][ T5613] Cannot create hsr debugfs directory [ 101.210320][ T5608] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 101.268221][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.290362][ T5608] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 101.326631][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.343629][ T5608] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 101.377142][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.409389][ T5608] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 101.428559][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.588250][ T5611] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 101.626167][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.646758][ T5611] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 101.678421][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.690971][ T5611] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 101.720284][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.751881][ T5611] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 101.793182][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.891661][ T5610] Bluetooth: hci0: command tx timeout [ 101.967805][ T5612] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.010806][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.032619][ T5612] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.072709][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.079899][ T5612] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.106621][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.142280][ T5610] Bluetooth: hci2: command tx timeout [ 102.143906][ T5612] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.177989][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.221867][ T61] Bluetooth: hci3: command tx timeout [ 102.222003][ T5610] Bluetooth: hci1: command tx timeout [ 102.349471][ T5613] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 102.388470][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.411252][ T5613] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 102.449474][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.473039][ T5613] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 102.506725][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.530238][ T5613] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 102.557788][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.649332][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.799715][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.863471][ T1424] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.864409][ T1424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.930200][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.952958][ T1424] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.956742][ T1424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.103342][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.188153][ T1424] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.188352][ T1424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.237831][ T1424] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.237997][ T1424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.258754][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.359994][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.413406][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.518574][ T90] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.518783][ T90] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.589975][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.619142][ T90] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.619328][ T90] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.717486][ T1284] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.717663][ T1284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.766334][ T1284] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.766468][ T1284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.985028][ T5610] Bluetooth: hci0: command tx timeout [ 104.213669][ T5610] Bluetooth: hci2: command tx timeout [ 104.296763][ T5610] Bluetooth: hci1: command tx timeout [ 104.296800][ T5610] Bluetooth: hci3: command tx timeout [ 104.648092][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.189005][ T5608] veth0_vlan: entered promiscuous mode [ 105.236449][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.349252][ T5608] veth1_vlan: entered promiscuous mode [ 105.386105][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.544709][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.646406][ T5611] veth0_vlan: entered promiscuous mode [ 105.649949][ T5608] veth0_macvtap: entered promiscuous mode [ 105.701331][ T5608] veth1_macvtap: entered promiscuous mode [ 105.740291][ T5611] veth1_vlan: entered promiscuous mode [ 105.780515][ T5612] veth0_vlan: entered promiscuous mode [ 105.852527][ T5612] veth1_vlan: entered promiscuous mode [ 105.861035][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.920029][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.944030][ T5613] veth0_vlan: entered promiscuous mode [ 105.989546][ T68] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.015765][ T68] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.038153][ T68] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.039490][ T5611] veth0_macvtap: entered promiscuous mode [ 106.066712][ T5613] veth1_vlan: entered promiscuous mode [ 106.069274][ T68] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.103216][ T5611] veth1_macvtap: entered promiscuous mode [ 106.288336][ T5612] veth0_macvtap: entered promiscuous mode [ 106.383553][ T5612] veth1_macvtap: entered promiscuous mode [ 106.414441][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.547769][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.628746][ T5613] veth0_macvtap: entered promiscuous mode [ 106.645255][ T68] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.653631][ T68] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.658065][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.714730][ T1424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.714752][ T1424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.742876][ T1284] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.764226][ T5613] veth1_macvtap: entered promiscuous mode [ 106.775810][ T1284] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.794353][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.907887][ T44] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.911177][ T1284] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.911201][ T1284] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.936990][ T44] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.006559][ T68] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.036792][ T68] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.133796][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.295965][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.620140][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.636052][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.738128][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.753322][ T1424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.753397][ T1424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.850058][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.249080][ T5759] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2'. [ 108.293468][ T5759] bridge_slave_1: left allmulticast mode [ 108.293546][ T5759] bridge_slave_1: left promiscuous mode [ 108.294835][ T5759] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.328196][ T5760] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 109.073549][ T5759] bridge_slave_0: left allmulticast mode [ 109.073578][ T5759] bridge_slave_0: left promiscuous mode [ 109.073844][ T5759] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.303847][ T1284] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.303867][ T1284] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.571627][ T90] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.571648][ T90] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.656673][ T2355] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.656696][ T2355] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.777796][ T5764] capability: warning: `syz.1.6' uses deprecated v2 capabilities in a way that may be insecure [ 109.890125][ T1415] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.890147][ T1415] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.945577][ T5764] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 109.945618][ T5764] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 110.039391][ T1415] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.039415][ T1415] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.579683][ T5768] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 110.882918][ T32] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 111.211639][ T32] usb 2-1: Using ep0 maxpacket: 32 [ 111.232193][ T32] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 111.232255][ T32] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 111.232286][ T32] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 111.232316][ T32] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 111.232342][ T32] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 111.332145][ T32] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 111.332181][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.332201][ T32] usb 2-1: Product: syz [ 111.332218][ T32] usb 2-1: Manufacturer: syz [ 111.332234][ T32] usb 2-1: SerialNumber: syz [ 111.361571][ T969] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 111.511550][ T969] usb 3-1: Using ep0 maxpacket: 16 [ 111.514002][ T969] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 111.514034][ T969] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.514058][ T969] usb 3-1: config 0 has no interface number 0 [ 111.514124][ T969] usb 3-1: config 0 interface 251 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 111.514148][ T969] usb 3-1: config 0 interface 251 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 111.517007][ T969] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 111.517039][ T969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.517061][ T969] usb 3-1: Product: syz [ 111.517077][ T969] usb 3-1: Manufacturer: syz [ 111.517093][ T969] usb 3-1: SerialNumber: syz [ 111.644064][ T969] usb 3-1: config 0 descriptor?? [ 111.756332][ T969] asix 3-1:0.251: probe with driver asix failed with error -22 [ 111.908936][ T32] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 111.919629][ T32] imon 2-1:155.0: unable to initialize intf0, err -90 [ 111.919655][ T32] imon:imon_probe: failed to initialize context! [ 111.919669][ T32] imon 2-1:155.0: unable to register, err -19 [ 112.285031][ T969] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 112.312497][ T32] usb 2-1: USB disconnect, device number 2 [ 112.534577][ T969] usb 4-1: config 0 has no interfaces? [ 112.534619][ T969] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 112.534643][ T969] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.630358][ T969] usb 4-1: config 0 descriptor?? [ 113.073575][ T5783] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 113.227403][ T5783] usb 1-1: Using ep0 maxpacket: 16 [ 113.247709][ T5783] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 113.247838][ T5783] usb 1-1: config 0 has no interface number 0 [ 113.247884][ T5783] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 113.247911][ T5783] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 113.290332][ T5783] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 113.290366][ T5783] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.290388][ T5783] usb 1-1: Product: syz [ 113.290405][ T5783] usb 1-1: Manufacturer: syz [ 113.290422][ T5783] usb 1-1: SerialNumber: syz [ 113.360363][ T5783] usb 1-1: config 0 descriptor?? [ 113.368416][ T5785] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 113.368599][ T5785] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 113.473220][ T969] usb 4-1: USB disconnect, device number 2 [ 113.595090][ T5782] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 113.595287][ T5782] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 113.895483][ T5783] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 113.895520][ T5783] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 113.895830][ T5783] asix 1-1:0.251: probe with driver asix failed with error -5 [ 114.028933][ T5783] usb 1-1: USB disconnect, device number 2 [ 114.167246][ T5342] usb 3-1: USB disconnect, device number 2 [ 114.706982][ T5796] IPv4: Oversized IP packet from 172.20.20.24 [ 114.740551][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 114.747197][ T5342] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 114.938995][ T5342] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 114.939037][ T5342] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.939079][ T5342] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 114.939106][ T5342] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.057207][ T5806] netlink: 'syz.0.15': attribute type 10 has an invalid length. [ 115.173723][ T5783] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 115.227412][ T5806] veth1_virt_wifi: entered promiscuous mode [ 115.290489][ T5342] hub 3-1:4.0: USB hub found [ 115.331573][ T5783] usb 4-1: Using ep0 maxpacket: 32 [ 115.348757][ T5783] usb 4-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 115.348794][ T5783] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.348815][ T5783] usb 4-1: Product: syz [ 115.348830][ T5783] usb 4-1: Manufacturer: syz [ 115.348846][ T5783] usb 4-1: SerialNumber: syz [ 115.423434][ T5783] usb 4-1: config 0 descriptor?? [ 115.449581][ T5342] hub 3-1:4.0: 2 ports detected [ 115.449655][ T5342] usb 3-1: selecting invalid altsetting 1 [ 115.449668][ T5342] hub 3-1:4.0: Using single TT (err -22) [ 115.860741][ T5342] hub 3-1:4.0: hub_hub_status failed (err = -71) [ 115.860772][ T5342] hub 3-1:4.0: config failed, can't get hub status (err -71) [ 116.077550][ T5783] peak_usb 4-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 116.077585][ T5783] peak_usb 4-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 116.167691][ T5342] usb 3-1: USB disconnect, device number 3 [ 116.483151][ T5783] peak_usb 4-1:0.0: probe with driver peak_usb failed with error -71 [ 116.537603][ T5783] usb 4-1: USB disconnect, device number 3 [ 116.945465][ T10] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 117.125146][ T5833] FAULT_INJECTION: forcing a failure. [ 117.125146][ T5833] name failslab, interval 1, probability 0, space 0, times 1 [ 117.125214][ T5833] CPU: 0 UID: 0 PID: 5833 Comm: syz.3.23 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 117.125242][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 117.125266][ T5833] Call Trace: [ 117.125279][ T5833] [ 117.125288][ T5833] dump_stack_lvl+0xe8/0x150 [ 117.125318][ T5833] should_fail_ex+0x46b/0x600 [ 117.125347][ T5833] should_failslab+0xa8/0x100 [ 117.125377][ T5833] __kmalloc_noprof+0xdf/0x7b0 [ 117.125404][ T5833] ? do_handle_open+0x4f2/0x970 [ 117.125428][ T5833] do_handle_open+0x4f2/0x970 [ 117.125450][ T5833] ? __pfx_do_handle_open+0x10/0x10 [ 117.125471][ T5833] ? ksys_write+0x248/0x270 [ 117.125500][ T5833] ? __pfx_ksys_write+0x10/0x10 [ 117.125545][ T5833] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.125572][ T5833] do_syscall_64+0x15f/0xf80 [ 117.125591][ T5833] ? trace_irq_disable+0x3b/0x140 [ 117.125623][ T5833] ? clear_bhb_loop+0x40/0x90 [ 117.125653][ T5833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.125677][ T5833] RIP: 0033:0x7f7d0187ce59 [ 117.125710][ T5833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.125729][ T5833] RSP: 002b:00007f7cfface028 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 117.125761][ T5833] RAX: ffffffffffffffda RBX: 00007f7d01af5fa0 RCX: 00007f7d0187ce59 [ 117.125780][ T5833] RDX: 0000000000101c40 RSI: 0000200000000040 RDI: 000000000000000b [ 117.125795][ T5833] RBP: 00007f7cfface090 R08: 0000000000000000 R09: 0000000000000000 [ 117.125811][ T5833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 117.125825][ T5833] R13: 00007f7d01af6038 R14: 00007f7d01af5fa0 R15: 00007ffdc580cf28 [ 117.125862][ T5833] [ 117.137643][ T10] usb 1-1: unable to get BOS descriptor or descriptor too short [ 117.138395][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 117.378873][ T10] usb 1-1: New USB device found, idVendor=1235, idProduct=8004, bcdDevice= 0.40 [ 117.378909][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.378931][ T10] usb 1-1: Product: syz [ 117.378947][ T10] usb 1-1: Manufacturer: syz [ 117.378964][ T10] usb 1-1: SerialNumber: syz [ 117.858666][ T10] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 117.946828][ T10] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 118.618436][ T10] usb 1-1: USB disconnect, device number 3 [ 119.194386][ T5857] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 119.659477][ T5868] FAULT_INJECTION: forcing a failure. [ 119.659477][ T5868] name failslab, interval 1, probability 0, space 0, times 0 [ 119.659514][ T5868] CPU: 1 UID: 0 PID: 5868 Comm: syz.2.33 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 119.659539][ T5868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.659557][ T5868] Call Trace: [ 119.659564][ T5868] [ 119.659573][ T5868] dump_stack_lvl+0xe8/0x150 [ 119.659603][ T5868] should_fail_ex+0x46b/0x600 [ 119.659632][ T5868] should_failslab+0xa8/0x100 [ 119.659662][ T5868] __kmalloc_noprof+0xdf/0x7b0 [ 119.659690][ T5868] ? tomoyo_encode+0x28b/0x550 [ 119.659725][ T5868] tomoyo_encode+0x28b/0x550 [ 119.659758][ T5868] tomoyo_realpath_from_path+0x58d/0x5d0 [ 119.659798][ T5868] ? tomoyo_path_number_perm+0x219/0x630 [ 119.659826][ T5868] tomoyo_path_number_perm+0x246/0x630 [ 119.659855][ T5868] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 119.659880][ T5868] ? __lock_acquire+0x6b5/0x2d10 [ 119.659905][ T5868] ? do_raw_spin_lock+0x12b/0x2f0 [ 119.659965][ T5868] ? __fget_files+0x2a/0x420 [ 119.659991][ T5868] ? __fget_files+0x2a/0x420 [ 119.660012][ T5868] ? __fget_files+0x3a6/0x420 [ 119.660034][ T5868] ? __fget_files+0x2a/0x420 [ 119.660060][ T5868] security_file_ioctl+0xc3/0x2a0 [ 119.660089][ T5868] __se_sys_ioctl+0x47/0x170 [ 119.660120][ T5868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.660142][ T5868] do_syscall_64+0x15f/0xf80 [ 119.660161][ T5868] ? clear_bhb_loop+0x40/0x90 [ 119.660186][ T5868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.660205][ T5868] RIP: 0033:0x7fad70a8ce59 [ 119.660225][ T5868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.660241][ T5868] RSP: 002b:00007fad6ecde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 119.660262][ T5868] RAX: ffffffffffffffda RBX: 00007fad70d05fa0 RCX: 00007fad70a8ce59 [ 119.660276][ T5868] RDX: 0000200000000240 RSI: 00000000810c5701 RDI: 0000000000000003 [ 119.660289][ T5868] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 119.660311][ T5868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 119.660322][ T5868] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 119.660351][ T5868] [ 119.660447][ T5868] ERROR: Out of memory at tomoyo_realpath_from_path. [ 120.092782][ T5862] netlink: 12 bytes leftover after parsing attributes in process `syz.1.32'. [ 120.190146][ T5861] netlink: 40 bytes leftover after parsing attributes in process `syz.1.32'. [ 120.701602][ T5701] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 120.851654][ T5701] usb 4-1: Using ep0 maxpacket: 16 [ 120.854465][ T5701] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 120.854500][ T5701] usb 4-1: config 0 has no interface number 0 [ 120.854560][ T5701] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 120.854590][ T5701] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 120.859686][ T5701] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 120.859724][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.859748][ T5701] usb 4-1: Product: syz [ 120.859766][ T5701] usb 4-1: Manufacturer: syz [ 120.859783][ T5701] usb 4-1: SerialNumber: syz [ 120.979654][ T5701] usb 4-1: config 0 descriptor?? [ 120.980514][ T5882] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 121.024010][ T5882] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 121.320840][ T5891] FAULT_INJECTION: forcing a failure. [ 121.320840][ T5891] name failslab, interval 1, probability 0, space 0, times 0 [ 121.320875][ T5891] CPU: 0 UID: 0 PID: 5891 Comm: syz.2.38 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 121.320897][ T5891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 121.320910][ T5891] Call Trace: [ 121.320917][ T5891] [ 121.320926][ T5891] dump_stack_lvl+0xe8/0x150 [ 121.320959][ T5891] should_fail_ex+0x46b/0x600 [ 121.320989][ T5891] should_failslab+0xa8/0x100 [ 121.321019][ T5891] __kmalloc_noprof+0xdf/0x7b0 [ 121.321047][ T5891] ? tomoyo_encode+0x28b/0x550 [ 121.321088][ T5891] tomoyo_encode+0x28b/0x550 [ 121.321123][ T5891] tomoyo_realpath_from_path+0x58d/0x5d0 [ 121.321161][ T5891] ? tomoyo_path_number_perm+0x219/0x630 [ 121.321187][ T5891] tomoyo_path_number_perm+0x246/0x630 [ 121.321216][ T5891] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 121.321240][ T5891] ? __lock_acquire+0x6b5/0x2d10 [ 121.321271][ T5891] ? do_raw_spin_lock+0x12b/0x2f0 [ 121.321326][ T5891] ? __fget_files+0x2a/0x420 [ 121.321352][ T5891] ? __fget_files+0x2a/0x420 [ 121.321373][ T5891] ? __fget_files+0x3a6/0x420 [ 121.321395][ T5891] ? __fget_files+0x2a/0x420 [ 121.321421][ T5891] security_file_ioctl+0xc3/0x2a0 [ 121.321449][ T5891] __se_sys_ioctl+0x47/0x170 [ 121.321481][ T5891] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.321504][ T5891] do_syscall_64+0x15f/0xf80 [ 121.321522][ T5891] ? trace_irq_disable+0x3b/0x140 [ 121.321550][ T5891] ? clear_bhb_loop+0x40/0x90 [ 121.321574][ T5891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.321603][ T5891] RIP: 0033:0x7fad70a8ce59 [ 121.321622][ T5891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.321639][ T5891] RSP: 002b:00007fad6ecde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 121.321660][ T5891] RAX: ffffffffffffffda RBX: 00007fad70d05fa0 RCX: 00007fad70a8ce59 [ 121.321674][ T5891] RDX: 0000000000000000 RSI: 000000000000125d RDI: 0000000000000003 [ 121.321686][ T5891] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 121.321697][ T5891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.321709][ T5891] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 121.321738][ T5891] [ 121.359769][ T5891] ERROR: Out of memory at tomoyo_realpath_from_path. [ 121.603903][ T5882] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 121.604182][ T5882] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 121.775324][ T5898] netlink: 48 bytes leftover after parsing attributes in process `syz.2.41'. [ 121.820365][ T5701] asix 4-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 121.820403][ T5701] asix 4-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -32 [ 121.820731][ T5701] asix 4-1:0.251: probe with driver asix failed with error -5 [ 121.965556][ T5701] usb 4-1: USB disconnect, device number 4 [ 122.601993][ T5912] ======================================================= [ 122.601993][ T5912] WARNING: The mand mount option has been deprecated and [ 122.601993][ T5912] and is ignored by this kernel. Remove the mand [ 122.601993][ T5912] option from the mount to silence this warning. [ 122.601993][ T5912] ======================================================= [ 122.653332][ T5701] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 122.805277][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 122.827315][ T5701] usb 1-1: unable to get BOS descriptor or descriptor too short [ 122.845424][ T5701] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 122.845472][ T5701] usb 1-1: can't read configurations, error -61 [ 122.971629][ T5701] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 123.131592][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 123.140720][ T5701] usb 1-1: unable to get BOS descriptor or descriptor too short [ 123.159999][ T5701] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 123.160439][ T5701] usb 1-1: can't read configurations, error -61 [ 123.181255][ T5342] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 123.201151][ T5701] usb usb1-port1: attempt power cycle [ 123.371569][ T5342] usb 4-1: Using ep0 maxpacket: 32 [ 123.373616][ T5342] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 123.373655][ T5342] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 123.373685][ T5342] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 123.373702][ T5342] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.434106][ T5342] usb 4-1: config 0 descriptor?? [ 123.447459][ T5342] hub 4-1:0.0: USB hub found [ 123.601590][ T5701] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 123.622479][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 123.633262][ T5701] usb 1-1: unable to get BOS descriptor or descriptor too short [ 123.648374][ T5701] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 123.648419][ T5701] usb 1-1: can't read configurations, error -61 [ 123.692892][ T5342] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 123.920688][ T5701] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 123.933767][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 123.955765][ T5701] usb 1-1: unable to get BOS descriptor or descriptor too short [ 123.956095][ T5912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.973473][ T5701] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 123.973555][ T5701] usb 1-1: can't read configurations, error -61 [ 123.974653][ T5701] usb usb1-port1: unable to enumerate USB device [ 124.033417][ T5912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.251300][ T5911] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.253963][ T5911] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.316388][ T5342] hid-generic 0003:046D:C31C.0001: unknown main item tag 0x0 [ 124.392681][ T5342] hid-generic 0003:046D:C31C.0001: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.3-1/input0 [ 125.047511][ T5911] usb 4-1: reset high-speed USB device number 5 using dummy_hcd [ 125.516015][ T5915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.516700][ T5915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.519965][ T5912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.540944][ T5912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.589036][ T5913] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 126.715363][ T5941] ntfs3(nullb0): Primary boot signature is not NTFS. [ 126.815903][ T5941] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 126.991616][ T32] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 127.141602][ T32] usb 2-1: Using ep0 maxpacket: 8 [ 127.149350][ T32] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 127.149384][ T32] usb 2-1: config 0 has no interface number 0 [ 127.149436][ T32] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 127.149464][ T32] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.191573][ T5701] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 127.241144][ T32] usb 2-1: config 0 descriptor?? [ 127.353375][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 127.360926][ T5701] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 127.361065][ T5701] usb 1-1: config 0 has no interface number 0 [ 127.361249][ T5701] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 127.361288][ T5701] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 127.408219][ T5701] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 127.408258][ T5701] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.408280][ T5701] usb 1-1: Product: syz [ 127.408314][ T5701] usb 1-1: Manufacturer: syz [ 127.408332][ T5701] usb 1-1: SerialNumber: syz [ 127.417373][ T32] viperboard 2-1:0.143: version 0.00 found at bus 002 address 003 [ 127.559497][ T5701] usb 1-1: config 0 descriptor?? [ 127.568670][ T5947] raw-gadget.6 gadget.0: fail, usb_ep_enable returned -22 [ 127.607130][ T5947] raw-gadget.6 gadget.0: fail, usb_ep_enable returned -22 [ 127.843451][ T5947] raw-gadget.6 gadget.0: fail, usb_ep_enable returned -22 [ 127.843721][ T5947] raw-gadget.6 gadget.0: fail, usb_ep_enable returned -22 [ 128.045628][ T5701] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 128.045663][ T5701] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -32 [ 128.045939][ T5701] asix 1-1:0.251: probe with driver asix failed with error -5 [ 128.062625][ T32] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 128.062718][ T32] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 128.191376][ T5701] usb 1-1: USB disconnect, device number 8 [ 128.417105][ T5952] FAULT_INJECTION: forcing a failure. [ 128.417105][ T5952] name failslab, interval 1, probability 0, space 0, times 0 [ 128.419002][ T5952] CPU: 0 UID: 0 PID: 5952 Comm: syz.1.53 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 128.419037][ T5952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 128.419049][ T5952] Call Trace: [ 128.419058][ T5952] [ 128.419068][ T5952] dump_stack_lvl+0xe8/0x150 [ 128.419099][ T5952] should_fail_ex+0x46b/0x600 [ 128.419129][ T5952] should_failslab+0xa8/0x100 [ 128.419158][ T5952] __kmalloc_cache_noprof+0x84/0x690 [ 128.419187][ T5952] ? cma_alloc_port+0xb9/0x680 [ 128.419215][ T5952] cma_alloc_port+0xb9/0x680 [ 128.419243][ T5952] rdma_bind_addr_dst+0x297c/0x3610 [ 128.419266][ T5952] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 128.419303][ T5952] ? reacquire_held_locks+0x104/0x190 [ 128.419331][ T5952] ? rt_spin_lock+0x1e0/0x400 [ 128.419364][ T5952] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 128.419397][ T5952] ? rt_spin_unlock+0x14f/0x200 [ 128.419435][ T5952] rdma_resolve_addr+0x66c/0x2160 [ 128.419464][ T5952] ? do_raw_spin_lock+0x12b/0x2f0 [ 128.419497][ T5952] ? __pfx_rdma_resolve_addr+0x10/0x10 [ 128.419555][ T5952] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 128.419592][ T5952] ? mutex_lock_nested+0x152/0x1d0 [ 128.419619][ T5952] ? ucma_resolve_ip+0x302/0x490 [ 128.419654][ T5952] ucma_resolve_ip+0x338/0x490 [ 128.419689][ T5952] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 128.419740][ T5952] ucma_write+0x257/0x2f0 [ 128.419774][ T5952] ? __pfx_ucma_write+0x10/0x10 [ 128.419806][ T5952] ? rw_verify_area+0x25b/0x4e0 [ 128.419842][ T5952] vfs_writev+0x4c6/0x9a0 [ 128.419871][ T5952] ? __pfx_ucma_write+0x10/0x10 [ 128.419906][ T5952] ? __pfx_vfs_writev+0x10/0x10 [ 128.419946][ T5952] ? __fget_files+0x2a/0x420 [ 128.419990][ T5952] ? __fget_files+0x3a6/0x420 [ 128.420016][ T5952] ? __fget_files+0x2a/0x420 [ 128.420052][ T5952] do_writev+0x15a/0x2e0 [ 128.420080][ T5952] ? __pfx_do_writev+0x10/0x10 [ 128.420113][ T5952] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.420139][ T5952] do_syscall_64+0x15f/0xf80 [ 128.420161][ T5952] ? trace_irq_disable+0x3b/0x140 [ 128.420194][ T5952] ? clear_bhb_loop+0x40/0x90 [ 128.420223][ T5952] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.420247][ T5952] RIP: 0033:0x7f7ca6cece59 [ 128.420270][ T5952] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.420290][ T5952] RSP: 002b:00007f7ca4f3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 128.420315][ T5952] RAX: ffffffffffffffda RBX: 00007f7ca6f65fa0 RCX: 00007f7ca6cece59 [ 128.420332][ T5952] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000010 [ 128.420346][ T5952] RBP: 00007f7ca4f3e090 R08: 0000000000000000 R09: 0000000000000000 [ 128.420361][ T5952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.420375][ T5952] R13: 00007f7ca6f66038 R14: 00007f7ca6f65fa0 R15: 00007fffde76c778 [ 128.420412][ T5952] [ 128.421699][ T32] usb 2-1: USB disconnect, device number 3 [ 129.856462][ T5969] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:32768 [ 130.261648][ T5923] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 130.434765][ T5923] usb 2-1: device descriptor read/64, error -71 [ 130.484617][ T5911] usbhid 4-1:0.0: reset_resume error -32 [ 130.540701][ T5980] FAULT_INJECTION: forcing a failure. [ 130.540701][ T5980] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 130.540733][ T5980] CPU: 1 UID: 0 PID: 5980 Comm: syz.0.61 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 130.540752][ T5980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 130.540762][ T5980] Call Trace: [ 130.540769][ T5980] [ 130.540776][ T5980] dump_stack_lvl+0xe8/0x150 [ 130.540804][ T5980] should_fail_ex+0x46b/0x600 [ 130.540831][ T5980] prepare_alloc_pages+0x22a/0x6b0 [ 130.540864][ T5980] __alloc_frozen_pages_noprof+0x12f/0x380 [ 130.540894][ T5980] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 130.540924][ T5980] ? __pfx_policy_nodemask+0x10/0x10 [ 130.540951][ T5980] ? __lock_acquire+0x6b5/0x2d10 [ 130.540974][ T5980] alloc_pages_mpol+0xd1/0x380 [ 130.541003][ T5980] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 130.541032][ T5980] vma_alloc_folio_noprof+0xe1/0x1e0 [ 130.541060][ T5980] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 130.541088][ T5980] ? __pte_offset_map+0x29/0x200 [ 130.541115][ T5980] do_pte_missing+0x822/0x2940 [ 130.541148][ T5980] ? handle_mm_fault+0xed/0x14c0 [ 130.541174][ T5980] handle_mm_fault+0xdb5/0x14c0 [ 130.541200][ T5980] ? handle_mm_fault+0xed/0x14c0 [ 130.541227][ T5980] ? __pfx_handle_mm_fault+0x10/0x10 [ 130.541251][ T5980] ? follow_page_pte+0xbc8/0xe40 [ 130.541291][ T5980] ? __pfx_follow_page_pte+0x10/0x10 [ 130.541321][ T5980] __get_user_pages+0x168f/0x2570 [ 130.541366][ T5980] get_user_pages_unlocked+0x1e2/0x710 [ 130.541433][ T5980] hva_to_pfn+0x365/0xf20 [ 130.541479][ T5980] ? __pfx_hva_to_pfn+0x10/0x10 [ 130.541526][ T5980] ? xas_start+0x396/0x780 [ 130.541545][ T5980] ? xa_load+0x60/0x210 [ 130.541569][ T5980] ? kvm_follow_pfn+0x21a/0x3c0 [ 130.541595][ T5980] __kvm_faultin_pfn+0xaa/0x100 [ 130.541625][ T5980] kvm_mmu_faultin_pfn+0x735/0x15b0 [ 130.541657][ T5980] ? __pfx_kvm_mmu_faultin_pfn+0x10/0x10 [ 130.541685][ T5980] kvm_tdp_page_fault+0x273/0x370 [ 130.541710][ T5980] kvm_mmu_do_page_fault+0x33d/0x690 [ 130.541737][ T5980] ? __pfx_kvm_mmu_do_page_fault+0x10/0x10 [ 130.541764][ T5980] ? __lock_acquire+0x6b5/0x2d10 [ 130.541792][ T5980] kvm_mmu_page_fault+0x22d/0xb90 [ 130.541820][ T5980] ? __pfx_handle_ept_violation+0x10/0x10 [ 130.541845][ T5980] vmx_handle_exit+0xff8/0x16f0 [ 130.541865][ T5980] ? vcpu_run+0x4982/0x7860 [ 130.541893][ T5980] vcpu_run+0x5c77/0x7860 [ 130.541909][ T5980] ? segmented_read+0x2d0/0x3f0 [ 130.541936][ T5980] ? vcpu_run+0x4982/0x7860 [ 130.541992][ T5980] ? __pfx_vcpu_run+0x10/0x10 [ 130.542009][ T5980] ? __asan_memcpy+0x40/0x70 [ 130.542030][ T5980] ? complete_emulated_mmio+0x53e/0x900 [ 130.542065][ T5980] kvm_arch_vcpu_ioctl_run+0x11e6/0x20d0 [ 130.542093][ T5980] ? kvm_arch_vcpu_ioctl_run+0x2e8/0x20d0 [ 130.542111][ T5980] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 130.542155][ T5980] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 130.542182][ T5980] ? lockdep_hardirqs_on+0x7a/0x110 [ 130.542209][ T5980] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 130.542235][ T5980] ? _mutex_lock_killable+0x152/0x1d0 [ 130.542256][ T5980] ? kvm_vcpu_ioctl+0x283/0xfe0 [ 130.542289][ T5980] kvm_vcpu_ioctl+0xa65/0xfe0 [ 130.542318][ T5980] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 130.542358][ T5980] ? __fget_files+0x2a/0x420 [ 130.542381][ T5980] ? __fget_files+0x2a/0x420 [ 130.542400][ T5980] ? __fget_files+0x3a6/0x420 [ 130.542419][ T5980] ? __fget_files+0x2a/0x420 [ 130.542442][ T5980] ? bpf_lsm_file_ioctl+0x9/0x20 [ 130.542461][ T5980] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 130.542486][ T5980] __se_sys_ioctl+0xff/0x170 [ 130.542511][ T5980] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.542529][ T5980] do_syscall_64+0x15f/0xf80 [ 130.542545][ T5980] ? trace_irq_disable+0x3b/0x140 [ 130.542569][ T5980] ? clear_bhb_loop+0x40/0x90 [ 130.542590][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.542607][ T5980] RIP: 0033:0x7f83c286ce59 [ 130.542624][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.542639][ T5980] RSP: 002b:00007f83c0abe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 130.542657][ T5980] RAX: ffffffffffffffda RBX: 00007f83c2ae5fa0 RCX: 00007f83c286ce59 [ 130.542669][ T5980] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 130.542680][ T5980] RBP: 00007f83c0abe090 R08: 0000000000000000 R09: 0000000000000000 [ 130.542691][ T5980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 130.542701][ T5980] R13: 00007f83c2ae6038 R14: 00007f83c2ae5fa0 R15: 00007ffcc344eea8 [ 130.542727][ T5980] [ 131.148129][ T5701] usb 4-1: USB disconnect, device number 5 [ 131.160555][ T5923] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 131.302596][ T5923] usb 2-1: device descriptor read/64, error -71 [ 131.412136][ T5923] usb usb2-port1: attempt power cycle [ 131.645444][ T5997] 9p: Could not find request transport: rd [ 131.751647][ T5923] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 131.773247][ T5923] usb 2-1: device descriptor read/8, error -71 [ 131.871720][ T5701] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 131.957930][ T6004] process 'syz.0.68' launched '/dev/fd/7' with NULL argv: empty string added [ 132.031551][ T5701] usb 4-1: Using ep0 maxpacket: 16 [ 132.043871][ T5701] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 132.043895][ T5701] usb 4-1: config 0 has no interface number 0 [ 132.043928][ T5701] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 132.043947][ T5701] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 132.051697][ T5923] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 132.101052][ T5923] usb 2-1: device descriptor read/8, error -71 [ 132.129839][ T5701] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 132.129876][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.129898][ T5701] usb 4-1: Product: syz [ 132.129913][ T5701] usb 4-1: Manufacturer: syz [ 132.129928][ T5701] usb 4-1: SerialNumber: syz [ 132.150225][ T5701] usb 4-1: config 0 descriptor?? [ 132.174333][ T5990] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 132.175461][ T5990] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 132.212721][ T5923] usb usb2-port1: unable to enumerate USB device [ 132.381990][ T5990] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 132.382289][ T5990] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 132.589791][ T5701] asix 4-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 132.589818][ T5701] asix 4-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 132.590083][ T5701] asix 4-1:0.251: probe with driver asix failed with error -5 [ 132.782174][ T5923] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 132.819140][ T9] usb 4-1: USB disconnect, device number 6 [ 132.911604][ T5923] usb 1-1: device descriptor read/64, error -71 [ 133.032525][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.048083][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.137951][ T6015] syzkaller1: entered promiscuous mode [ 133.137984][ T6015] syzkaller1: entered allmulticast mode [ 133.161866][ T5923] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 133.291625][ T5923] usb 1-1: device descriptor read/64, error -71 [ 133.351588][ T5597] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 133.416980][ T5923] usb usb1-port1: attempt power cycle [ 133.521531][ T5597] usb 2-1: Using ep0 maxpacket: 8 [ 133.528271][ T5597] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 133.528306][ T5597] usb 2-1: config 0 has no interface number 0 [ 133.528354][ T5597] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 133.528380][ T5597] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 133.528410][ T5597] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 133.528440][ T5597] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 133.528486][ T5597] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 133.528512][ T5597] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.618166][ T5597] usb 2-1: config 0 descriptor?? [ 133.657310][ T6026] fuse: Bad value for 'group_id' [ 133.657336][ T6026] fuse: Bad value for 'group_id' [ 133.793803][ T5923] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 133.816826][ T5923] usb 1-1: device descriptor read/8, error -71 [ 133.900970][ T5597] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 133.918175][ T5597] usb 2-1: USB disconnect, device number 8 [ 133.959848][ T5597] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 134.062740][ T5923] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 134.084859][ T5923] usb 1-1: device descriptor read/8, error -71 [ 134.188380][ T38] audit: type=1800 audit(1778982530.179:2): pid=6032 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.78" name="file0" dev="overlay" ino=96 res=0 errno=0 [ 134.218152][ T5923] usb usb1-port1: unable to enumerate USB device [ 134.975546][ T6047] syzkaller1: entered promiscuous mode [ 134.975575][ T6047] syzkaller1: entered allmulticast mode [ 135.144316][ T5597] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 135.362474][ T5597] usb 2-1: Using ep0 maxpacket: 16 [ 135.383242][ T5597] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 135.383274][ T5597] usb 2-1: config 0 has no interface number 0 [ 135.383373][ T5597] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 135.383398][ T5597] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 135.432422][ T5597] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 135.432461][ T5597] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.432482][ T5597] usb 2-1: Product: syz [ 135.432498][ T5597] usb 2-1: Manufacturer: syz [ 135.432514][ T5597] usb 2-1: SerialNumber: syz [ 135.455932][ T5597] usb 2-1: config 0 descriptor?? [ 135.460315][ T6043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 135.461202][ T6043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 135.687912][ T6043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 135.688602][ T6043] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 135.762057][ T32] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 135.895832][ T5597] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 135.895870][ T5597] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 135.896187][ T5597] asix 2-1:0.251: probe with driver asix failed with error -5 [ 135.982067][ T32] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 135.982104][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.982128][ T32] usb 3-1: Product: syz [ 135.982147][ T32] usb 3-1: Manufacturer: syz [ 135.982165][ T32] usb 3-1: SerialNumber: syz [ 136.060496][ T32] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 136.119082][ T5597] usb 2-1: USB disconnect, device number 9 [ 136.287742][ T5701] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 136.408298][ T6058] syzkaller1: entered promiscuous mode [ 136.417316][ T6058] syzkaller1: entered allmulticast mode [ 136.496066][ C1] usb 3-1: ath9k_htc: over RX MAX_PKT_NUM [ 136.985809][ T6066] FAULT_INJECTION: forcing a failure. [ 136.985809][ T6066] name failslab, interval 1, probability 0, space 0, times 0 [ 136.985849][ T6066] CPU: 0 UID: 0 PID: 6066 Comm: syz.1.88 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 136.985872][ T6066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 136.985886][ T6066] Call Trace: [ 136.985896][ T6066] [ 136.985906][ T6066] dump_stack_lvl+0xe8/0x150 [ 136.985944][ T6066] should_fail_ex+0x46b/0x600 [ 136.985979][ T6066] should_failslab+0xa8/0x100 [ 136.986009][ T6066] __kmalloc_cache_noprof+0x84/0x690 [ 136.986038][ T6066] ? vhost_task_create+0x123/0x380 [ 136.986062][ T6066] vhost_task_create+0x123/0x380 [ 136.986084][ T6066] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 136.986113][ T6066] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 136.986144][ T6066] ? __pfx_vhost_task_create+0x10/0x10 [ 136.986187][ T6066] ? __pfx_vhost_task_fn+0x10/0x10 [ 136.986214][ T6066] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 136.986245][ T6066] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.986275][ T6066] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 136.986304][ T6066] ? mutex_lock_nested+0x152/0x1d0 [ 136.986327][ T6066] ? kvm_mmu_post_init_vm+0x8f/0x2d0 [ 136.986361][ T6066] kvm_mmu_post_init_vm+0x147/0x2d0 [ 136.986393][ T6066] kvm_arch_vcpu_ioctl_run+0x106/0x20d0 [ 136.986416][ T6066] ? ktime_get+0x1f5/0x220 [ 136.986454][ T6066] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 136.986478][ T6066] ? do_raw_spin_lock+0x12b/0x2f0 [ 136.986516][ T6066] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 136.986547][ T6066] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.986577][ T6066] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 136.986606][ T6066] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 136.986639][ T6066] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 136.986665][ T6066] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 136.986697][ T6066] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.986727][ T6066] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 136.986756][ T6066] ? rt_write_unlock+0x190/0x230 [ 136.986786][ T6066] kvm_vcpu_ioctl+0xa65/0xfe0 [ 136.986822][ T6066] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 136.986870][ T6066] ? __fget_files+0x2a/0x420 [ 136.986895][ T6066] ? __fget_files+0x2a/0x420 [ 136.986916][ T6066] ? __fget_files+0x3a6/0x420 [ 136.986938][ T6066] ? __fget_files+0x2a/0x420 [ 136.986963][ T6066] ? bpf_lsm_file_ioctl+0x9/0x20 [ 136.986984][ T6066] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 136.987012][ T6066] __se_sys_ioctl+0xff/0x170 [ 136.987041][ T6066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.987062][ T6066] do_syscall_64+0x15f/0xf80 [ 136.987080][ T6066] ? trace_irq_disable+0x3b/0x140 [ 136.987113][ T6066] ? clear_bhb_loop+0x40/0x90 [ 136.987138][ T6066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.987158][ T6066] RIP: 0033:0x7f7ca6cece59 [ 136.987186][ T6066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.987203][ T6066] RSP: 002b:00007f7ca4f1d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 136.987224][ T6066] RAX: ffffffffffffffda RBX: 00007f7ca6f66090 RCX: 00007f7ca6cece59 [ 136.987238][ T6066] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000d [ 136.987250][ T6066] RBP: 00007f7ca4f1d090 R08: 0000000000000000 R09: 0000000000000000 [ 136.987263][ T6066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.987275][ T6066] R13: 00007f7ca6f66128 R14: 00007f7ca6f66090 R15: 00007fffde76c778 [ 136.987303][ T6066] [ 137.420514][ T5701] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 137.493377][ T5701] ath9k_htc: Failed to initialize the device [ 138.169818][ T5701] usb 3-1: ath9k_htc: USB layer deinitialized [ 138.414724][ T6075] FAULT_INJECTION: forcing a failure. [ 138.414724][ T6075] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 138.414768][ T6075] CPU: 1 UID: 0 PID: 6075 Comm: syz.3.91 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 138.414796][ T6075] Tainted: [L]=SOFTLOCKUP [ 138.414804][ T6075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 138.414816][ T6075] Call Trace: [ 138.414824][ T6075] [ 138.414833][ T6075] dump_stack_lvl+0xe8/0x150 [ 138.414865][ T6075] should_fail_ex+0x46b/0x600 [ 138.414895][ T6075] _copy_from_user+0x2d/0xb0 [ 138.414926][ T6075] do_sys_poll+0x2a0/0xf50 [ 138.414960][ T6075] ? __lock_acquire+0x6b5/0x2d10 [ 138.414978][ T6075] ? __pfx_do_sys_poll+0x10/0x10 [ 138.415003][ T6075] ? aa_file_perm+0x192/0x15f0 [ 138.415100][ T6075] ? set_user_sigmask+0xcd/0x1c0 [ 138.415129][ T6075] ? __pfx_set_user_sigmask+0x10/0x10 [ 138.415154][ T6075] ? rt_mutex_slowunlock+0x1cb/0x300 [ 138.415179][ T6075] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 138.415211][ T6075] __se_sys_ppoll+0x209/0x2b0 [ 138.415232][ T6075] ? fput+0xa0/0xd0 [ 138.415259][ T6075] ? __pfx___se_sys_ppoll+0x10/0x10 [ 138.415283][ T6075] ? __pfx_ksys_write+0x10/0x10 [ 138.415321][ T6075] ? __x64_sys_ppoll+0x20/0xc0 [ 138.415345][ T6075] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.415370][ T6075] do_syscall_64+0x15f/0xf80 [ 138.415394][ T6075] ? clear_bhb_loop+0x40/0x90 [ 138.415422][ T6075] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.415445][ T6075] RIP: 0033:0x7f7d0187ce59 [ 138.415469][ T6075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.415488][ T6075] RSP: 002b:00007f7cffaad028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 138.415512][ T6075] RAX: ffffffffffffffda RBX: 00007f7d01af6090 RCX: 00007f7d0187ce59 [ 138.415528][ T6075] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 138.415544][ T6075] RBP: 00007f7cffaad090 R08: 0000000000000000 R09: 0000000000000000 [ 138.415561][ T6075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 138.415582][ T6075] R13: 00007f7d01af6128 R14: 00007f7d01af6090 R15: 00007ffdc580cf28 [ 138.415610][ T6075] [ 138.764946][ T6079] netlink: 44 bytes leftover after parsing attributes in process `syz.1.90'. [ 139.110325][ T6083] FAULT_INJECTION: forcing a failure. [ 139.110325][ T6083] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 139.110363][ T6083] CPU: 0 UID: 0 PID: 6083 Comm: syz.1.94 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 139.110390][ T6083] Tainted: [L]=SOFTLOCKUP [ 139.110396][ T6083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 139.110408][ T6083] Call Trace: [ 139.110414][ T6083] [ 139.110423][ T6083] dump_stack_lvl+0xe8/0x150 [ 139.110452][ T6083] should_fail_ex+0x46b/0x600 [ 139.110481][ T6083] _copy_from_user+0x2d/0xb0 [ 139.110513][ T6083] vhost_net_ioctl+0x1c1/0x17d0 [ 139.110546][ T6083] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 139.110573][ T6083] ? __fget_files+0x2a/0x420 [ 139.110599][ T6083] ? __fget_files+0x2a/0x420 [ 139.110621][ T6083] ? __fget_files+0x3a6/0x420 [ 139.110643][ T6083] ? __fget_files+0x2a/0x420 [ 139.110669][ T6083] ? bpf_lsm_file_ioctl+0x9/0x20 [ 139.110690][ T6083] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 139.110714][ T6083] __se_sys_ioctl+0xff/0x170 [ 139.110742][ T6083] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.110763][ T6083] do_syscall_64+0x15f/0xf80 [ 139.110781][ T6083] ? trace_irq_disable+0x3b/0x140 [ 139.110809][ T6083] ? clear_bhb_loop+0x40/0x90 [ 139.110832][ T6083] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.110851][ T6083] RIP: 0033:0x7f7ca6cece59 [ 139.110869][ T6083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.110885][ T6083] RSP: 002b:00007f7ca4f3e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 139.110906][ T6083] RAX: ffffffffffffffda RBX: 00007f7ca6f65fa0 RCX: 00007f7ca6cece59 [ 139.110919][ T6083] RDX: 0000200000000000 RSI: 000000004008af30 RDI: 0000000000000003 [ 139.110932][ T6083] RBP: 00007f7ca4f3e090 R08: 0000000000000000 R09: 0000000000000000 [ 139.110943][ T6083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 139.110955][ T6083] R13: 00007f7ca6f66038 R14: 00007f7ca6f65fa0 R15: 00007fffde76c778 [ 139.110982][ T6083] [ 139.850350][ T5597] usb 3-1: USB disconnect, device number 4 [ 139.965503][ T6093] netlink: 'syz.2.97': attribute type 1 has an invalid length. [ 139.965531][ T6093] netlink: 244 bytes leftover after parsing attributes in process `syz.2.97'. [ 140.411633][ T5597] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 140.581692][ T5597] usb 3-1: Using ep0 maxpacket: 8 [ 140.697401][ T5923] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 140.807940][ T5597] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 140.807973][ T5597] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 140.838322][ T5597] usb 3-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 140.838350][ T5597] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 140.838365][ T5597] usb 3-1: Product: syz [ 140.838377][ T5597] usb 3-1: Manufacturer: syz [ 140.838389][ T5597] usb 3-1: SerialNumber: syz [ 140.897471][ T6103] syz.0.101: vmalloc error: size 9223372036854775807, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 140.899853][ T6103] CPU: 1 UID: 0 PID: 6103 Comm: syz.0.101 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 140.899891][ T6103] Tainted: [L]=SOFTLOCKUP [ 140.899901][ T6103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 140.899916][ T6103] Call Trace: [ 140.899926][ T6103] [ 140.899937][ T6103] dump_stack_lvl+0xe8/0x150 [ 140.899979][ T6103] warn_alloc+0x24c/0x270 [ 140.900026][ T6103] ? __pfx_warn_alloc+0x10/0x10 [ 140.900086][ T6103] __vmalloc_node_range_noprof+0x132/0x1750 [ 140.900136][ T6103] ? kasan_quarantine_put+0xbb/0x1f0 [ 140.900192][ T6103] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 140.900236][ T6103] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 140.900291][ T6103] ? lockdep_hardirqs_on+0x7a/0x110 [ 140.900335][ T6103] ? dvb_dvr_do_ioctl+0x12e/0x220 [ 140.900378][ T6103] vmalloc_noprof+0xb2/0xe0 [ 140.900415][ T6103] ? dvb_dvr_do_ioctl+0x12e/0x220 [ 140.900459][ T6103] dvb_dvr_do_ioctl+0x12e/0x220 [ 140.900507][ T6103] dvb_usercopy+0x199/0x2e0 [ 140.900541][ T6103] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 140.900581][ T6103] ? __pfx_dvb_usercopy+0x10/0x10 [ 140.900631][ T6103] ? __fget_files+0x3a6/0x420 [ 140.900662][ T6103] ? __fget_files+0x2a/0x420 [ 140.900698][ T6103] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 140.900737][ T6103] dvb_dvr_ioctl+0x29/0x40 [ 140.900778][ T6103] __se_sys_ioctl+0xff/0x170 [ 140.900820][ T6103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.900850][ T6103] do_syscall_64+0x15f/0xf80 [ 140.900876][ T6103] ? clear_bhb_loop+0x40/0x90 [ 140.900909][ T6103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.900937][ T6103] RIP: 0033:0x7f83c286ce59 [ 140.900964][ T6103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.900986][ T6103] RSP: 002b:00007f83c0abe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.901013][ T6103] RAX: ffffffffffffffda RBX: 00007f83c2ae5fa0 RCX: 00007f83c286ce59 [ 140.901033][ T6103] RDX: 7fffffffffffffff RSI: 0000000000006f2d RDI: 0000000000000003 [ 140.901050][ T6103] RBP: 00007f83c2902d6f R08: 0000000000000000 R09: 0000000000000000 [ 140.901067][ T6103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.901084][ T6103] R13: 00007f83c2ae6038 R14: 00007f83c2ae5fa0 R15: 00007ffcc344eea8 [ 140.901125][ T6103] [ 140.901151][ T6103] Mem-Info: [ 140.901168][ T6103] active_anon:11167 inactive_anon:0 isolated_anon:0 [ 140.901168][ T6103] active_file:0 inactive_file:51822 isolated_file:0 [ 140.901168][ T6103] unevictable:768 dirty:373 writeback:0 [ 140.901168][ T6103] slab_reclaimable:11307 slab_unreclaimable:95532 [ 140.901168][ T6103] mapped:27982 shmem:6773 pagetables:1185 [ 140.901168][ T6103] sec_pagetables:0 bounce:0 [ 140.901168][ T6103] kernel_misc_reclaimable:0 [ 140.901168][ T6103] free:1335519 free_pcp:2200 free_cma:0 [ 140.901246][ T6103] Node 0 active_anon:44668kB inactive_anon:0kB active_file:0kB inactive_file:207096kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:111928kB dirty:1488kB writeback:0kB shmem:25556kB kernel_stack:12488kB pagetables:4592kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 140.901325][ T6103] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 140.902548][ T6103] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 140.902645][ T6103] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 140.902695][ T6103] Node 0 DMA32 free:1391784kB boost:0kB min:3912kB low:6436kB high:8960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44668kB inactive_anon:0kB active_file:0kB inactive_file:207096kB unevictable:1536kB writepending:1488kB zspages:0kB present:3129332kB managed:2552752kB mlocked:0kB bounce:0kB free_pcp:8788kB local_pcp:5360kB free_cma:0kB [ 140.902775][ T6103] lowmem_reserve[]: 0 0 0 0 0 [ 140.902832][ T6103] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:896kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:4kB free_cma:0kB [ 140.902908][ T6103] lowmem_reserve[]: 0 0 0 0 0 [ 140.902956][ T6103] Node 1 Normal free:3934932kB boost:0kB min:6372kB low:10480kB high:14588kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111096kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 140.903054][ T6103] lowmem_reserve[]: 0 0 0 0 0 [ 140.903096][ T6103] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 140.903409][ T6103] Node 0 DMA32: 1604*4kB (UE) 1063*8kB (UE) 567*16kB (U) 164*32kB (UE) 48*64kB (UE) 44*128kB (UME) 74*256kB (UME) 17*512kB (M) 5*1024kB (M) 3*2048kB (UME) 321*4096kB (M) = 1391672kB [ 140.903653][ T6103] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 140.903790][ T6103] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 8*16kB (UM) 11*32kB (UM) 7*64kB (UM) 8*128kB (UM) 3*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 0*2048kB 959*4096kB (M) = 3934932kB [ 140.903987][ T6103] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 140.904010][ T6103] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 140.904032][ T6103] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 140.904054][ T6103] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 140.904075][ T6103] 58566 total pagecache pages [ 140.904094][ T6103] 0 pages in swap cache [ 140.904105][ T6103] Free swap = 124996kB [ 140.904116][ T6103] Total swap = 124996kB [ 140.904129][ T6103] 2097051 pages RAM [ 140.904139][ T6103] 0 pages HighMem/MovableOnly [ 140.904149][ T6103] 427025 pages reserved [ 140.904160][ T6103] 0 pages cma reserved [ 140.981217][ T5923] usb 2-1: Using ep0 maxpacket: 32 [ 141.093846][ T5923] usb 2-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 141.114789][ T5923] usb 2-1: New USB device strings: Mfr=10, Product=2, SerialNumber=3 [ 141.114820][ T5923] usb 2-1: Product: syz [ 141.114836][ T5923] usb 2-1: Manufacturer: syz [ 141.114851][ T5923] usb 2-1: SerialNumber: syz [ 141.704844][ T5923] usb 2-1: config 0 descriptor?? [ 141.756701][ T5597] usb 3-1: unit 5 not found! [ 141.756824][ T5597] usb 3-1: unit 16 not found! [ 141.978063][ T5923] usb 2-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 142.111946][ T5597] usb 3-1: USB disconnect, device number 5 [ 142.394522][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 142.661712][ T5923] usb 2-1: reset high-speed USB device number 10 using dummy_hcd [ 142.797771][ T6125] FAULT_INJECTION: forcing a failure. [ 142.797771][ T6125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 142.797814][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.3.110 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 142.797846][ T6125] Tainted: [L]=SOFTLOCKUP [ 142.797854][ T6125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 142.797868][ T6125] Call Trace: [ 142.797877][ T6125] [ 142.797887][ T6125] dump_stack_lvl+0xe8/0x150 [ 142.797919][ T6125] should_fail_ex+0x46b/0x600 [ 142.797954][ T6125] _copy_from_iter+0x1d3/0x1670 [ 142.797992][ T6125] ? rcu_is_watching+0x15/0xb0 [ 142.798022][ T6125] ? __alloc_skb+0x27d/0x7d0 [ 142.798053][ T6125] ? __pfx__copy_from_iter+0x10/0x10 [ 142.798082][ T6125] ? kmem_cache_alloc_node_noprof+0x27c/0x6e0 [ 142.798142][ T6125] skb_copy_datagram_from_iter+0xf5/0x710 [ 142.798167][ T6125] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 142.798202][ T6125] ? iov_iter_single_seg_count+0xc9/0x2f0 [ 142.798241][ T6125] tun_get_user+0xc5b/0x4400 [ 142.798282][ T6125] ? rt_mutex_slowunlock+0x3e1/0x8b0 [ 142.798314][ T6125] ? rt_spin_lock+0x1e0/0x400 [ 142.798347][ T6125] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 142.798378][ T6125] ? __pfx_tun_get_user+0x10/0x10 [ 142.798402][ T6125] ? rt_spin_unlock+0x14f/0x200 [ 142.798436][ T6125] ? rt_spin_unlock+0x160/0x200 [ 142.798469][ T6125] ? save_netdev_trace_buffer+0x4ba/0x5f0 [ 142.798503][ T6125] ? ref_tracker_alloc+0x332/0x4a0 [ 142.798531][ T6125] ? tun_get+0x157/0x2f0 [ 142.798555][ T6125] ? vfs_write+0x629/0xba0 [ 142.798585][ T6125] ? ksys_write+0x156/0x270 [ 142.798617][ T6125] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 142.798653][ T6125] ? tun_get+0x1c/0x2f0 [ 142.798686][ T6125] ? tun_get+0x1c/0x2f0 [ 142.798711][ T6125] ? tun_get+0x1c/0x2f0 [ 142.798743][ T6125] tun_chr_write_iter+0x119/0x210 [ 142.798772][ T6125] vfs_write+0x629/0xba0 [ 142.798814][ T6125] ? __pfx_vfs_write+0x10/0x10 [ 142.798858][ T6125] ? __fget_files+0x2a/0x420 [ 142.798896][ T6125] ksys_write+0x156/0x270 [ 142.798931][ T6125] ? __pfx_ksys_write+0x10/0x10 [ 142.798973][ T6125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.798999][ T6125] do_syscall_64+0x15f/0xf80 [ 142.799020][ T6125] ? trace_irq_disable+0x3b/0x140 [ 142.799053][ T6125] ? clear_bhb_loop+0x40/0x90 [ 142.799082][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.799115][ T6125] RIP: 0033:0x7f7d0187ce59 [ 142.799137][ T6125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.799157][ T6125] RSP: 002b:00007f7cfface028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 142.799182][ T6125] RAX: ffffffffffffffda RBX: 00007f7d01af5fa0 RCX: 00007f7d0187ce59 [ 142.799199][ T6125] RDX: 0000000000000042 RSI: 0000200000000100 RDI: 0000000000000003 [ 142.799214][ T6125] RBP: 00007f7cfface090 R08: 0000000000000000 R09: 0000000000000000 [ 142.799230][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 142.799244][ T6125] R13: 00007f7d01af6038 R14: 00007f7d01af5fa0 R15: 00007ffdc580cf28 [ 142.799281][ T6125] [ 143.400737][ T5923] usb 2-1: [UEAGLE-ATM] interface 1 not found [ 143.400774][ T5923] ueagle-atm 2-1:0.0: usbatm_usb_probe: bind failed: -19! [ 143.445791][ T5923] usb 2-1: USB disconnect, device number 10 [ 143.672262][ T6142] FAULT_INJECTION: forcing a failure. [ 143.672262][ T6142] name failslab, interval 1, probability 0, space 0, times 0 [ 143.672301][ T6142] CPU: 1 UID: 0 PID: 6142 Comm: syz.2.114 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 143.672327][ T6142] Tainted: [L]=SOFTLOCKUP [ 143.672333][ T6142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 143.672344][ T6142] Call Trace: [ 143.672350][ T6142] [ 143.672359][ T6142] dump_stack_lvl+0xe8/0x150 [ 143.672392][ T6142] should_fail_ex+0x46b/0x600 [ 143.672429][ T6142] should_failslab+0xa8/0x100 [ 143.672466][ T6142] __kmalloc_noprof+0xdf/0x7b0 [ 143.672498][ T6142] ? tomoyo_encode+0x28b/0x550 [ 143.672534][ T6142] tomoyo_encode+0x28b/0x550 [ 143.672572][ T6142] tomoyo_realpath_from_path+0x58d/0x5d0 [ 143.672618][ T6142] ? tomoyo_path_number_perm+0x219/0x630 [ 143.672645][ T6142] tomoyo_path_number_perm+0x246/0x630 [ 143.672672][ T6142] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 143.672697][ T6142] ? __lock_acquire+0x6b5/0x2d10 [ 143.672718][ T6142] ? do_raw_spin_lock+0x12b/0x2f0 [ 143.672771][ T6142] ? __fget_files+0x2a/0x420 [ 143.672796][ T6142] ? __fget_files+0x2a/0x420 [ 143.672818][ T6142] ? __fget_files+0x3a6/0x420 [ 143.672839][ T6142] ? __fget_files+0x2a/0x420 [ 143.672865][ T6142] security_file_ioctl+0xc3/0x2a0 [ 143.672891][ T6142] __se_sys_ioctl+0x47/0x170 [ 143.672919][ T6142] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.672940][ T6142] do_syscall_64+0x15f/0xf80 [ 143.672958][ T6142] ? trace_irq_disable+0x3b/0x140 [ 143.672986][ T6142] ? clear_bhb_loop+0x40/0x90 [ 143.673010][ T6142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.673043][ T6142] RIP: 0033:0x7fad70a8ce59 [ 143.673061][ T6142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.673078][ T6142] RSP: 002b:00007fad6ecde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 143.673098][ T6142] RAX: ffffffffffffffda RBX: 00007fad70d05fa0 RCX: 00007fad70a8ce59 [ 143.673112][ T6142] RDX: 0000200000000040 RSI: 0000000000003b85 RDI: 0000000000000003 [ 143.673125][ T6142] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 143.673136][ T6142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 143.673147][ T6142] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 143.673177][ T6142] [ 143.673208][ T6142] ERROR: Out of memory at tomoyo_realpath_from_path. [ 144.561639][ T5597] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 144.652673][ T6159] FAULT_INJECTION: forcing a failure. [ 144.652673][ T6159] name failslab, interval 1, probability 0, space 0, times 0 [ 144.652706][ T6159] CPU: 1 UID: 0 PID: 6159 Comm: syz.2.121 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 144.652729][ T6159] Tainted: [L]=SOFTLOCKUP [ 144.652736][ T6159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 144.652746][ T6159] Call Trace: [ 144.652752][ T6159] [ 144.652760][ T6159] dump_stack_lvl+0xe8/0x150 [ 144.652786][ T6159] should_fail_ex+0x46b/0x600 [ 144.652813][ T6159] should_failslab+0xa8/0x100 [ 144.652840][ T6159] kmem_cache_alloc_lru_noprof+0x8b/0x680 [ 144.652864][ T6159] ? __d_alloc+0x37/0x6f0 [ 144.652890][ T6159] __d_alloc+0x37/0x6f0 [ 144.652916][ T6159] d_alloc+0x4b/0x190 [ 144.652936][ T6159] ? lookup_one_qstr_excl+0xc4/0x360 [ 144.652961][ T6159] lookup_one_qstr_excl+0xd8/0x360 [ 144.652987][ T6159] filename_create+0x20e/0x370 [ 144.653017][ T6159] ? __pfx_filename_create+0x10/0x10 [ 144.653044][ T6159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.653078][ T6159] filename_mkdirat+0xd2/0x520 [ 144.653108][ T6159] ? __pfx_filename_mkdirat+0x10/0x10 [ 144.653136][ T6159] ? do_getname+0x151/0x250 [ 144.653154][ T6159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.653172][ T6159] __se_sys_mkdirat+0x35/0x150 [ 144.653198][ T6159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.653216][ T6159] do_syscall_64+0x15f/0xf80 [ 144.653232][ T6159] ? trace_irq_disable+0x3b/0x140 [ 144.653257][ T6159] ? clear_bhb_loop+0x40/0x90 [ 144.653278][ T6159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.653295][ T6159] RIP: 0033:0x7fad70a8ce59 [ 144.653311][ T6159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.653325][ T6159] RSP: 002b:00007fad6ecde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 144.653343][ T6159] RAX: ffffffffffffffda RBX: 00007fad70d05fa0 RCX: 00007fad70a8ce59 [ 144.653355][ T6159] RDX: 0000000000000062 RSI: 0000200000000900 RDI: ffffffffffffff9c [ 144.653367][ T6159] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 144.653378][ T6159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.653388][ T6159] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 144.653413][ T6159] [ 144.824944][ T5597] usb 4-1: config 0 has no interfaces? [ 144.824994][ T5597] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 144.825022][ T5597] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.938141][ T5597] usb 4-1: config 0 descriptor?? [ 145.189504][ T5597] usb 4-1: USB disconnect, device number 7 [ 145.521566][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 145.651694][ T9] usb 3-1: device descriptor read/64, error -71 [ 145.891707][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 146.049455][ T9] usb 3-1: device descriptor read/64, error -71 [ 146.151696][ T5342] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 146.154578][ T9] usb usb3-port1: attempt power cycle [ 146.333629][ T5342] usb 4-1: Using ep0 maxpacket: 8 [ 146.344974][ T5342] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 146.345013][ T5342] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.345029][ T5342] usb 4-1: Product: syz [ 146.345041][ T5342] usb 4-1: Manufacturer: syz [ 146.345052][ T5342] usb 4-1: SerialNumber: syz [ 146.401807][ T5342] usb 4-1: config 0 descriptor?? [ 146.521585][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 146.553719][ T9] usb 3-1: device descriptor read/8, error -71 [ 146.633753][ T5342] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 146.811606][ T9] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 146.832712][ T9] usb 3-1: device descriptor read/8, error -71 [ 146.931540][ T32] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 146.952056][ T9] usb usb3-port1: unable to enumerate USB device [ 147.085784][ T32] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 147.085825][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 147.085856][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 147.085885][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 147.090063][ T32] usb 1-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 147.090099][ T32] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.090124][ T32] usb 1-1: Product: syz [ 147.090141][ T32] usb 1-1: Manufacturer: syz [ 147.090157][ T32] usb 1-1: SerialNumber: syz [ 147.195435][ T32] usb 1-1: config 0 descriptor?? [ 147.208490][ T32] iguanair 1-1:0.0: failed to get version [ 147.209072][ T32] iguanair 1-1:0.0: probe with driver iguanair failed with error -90 [ 147.500210][ T32] usb 1-1: USB disconnect, device number 13 [ 147.848881][ T6181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.849530][ T6181] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.061838][ T32] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 148.082860][ T5342] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 148.109644][ T5342] usb 4-1: USB disconnect, device number 8 [ 148.214354][ T32] usb 2-1: Using ep0 maxpacket: 32 [ 148.225685][ T32] usb 2-1: config 0 has an invalid interface number: 153 but max is 0 [ 148.225728][ T32] usb 2-1: config 0 has no interface number 0 [ 148.264531][ T32] usb 2-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 148.264570][ T32] usb 2-1: New USB device strings: Mfr=10, Product=2, SerialNumber=3 [ 148.264594][ T32] usb 2-1: Product: syz [ 148.264611][ T32] usb 2-1: Manufacturer: syz [ 148.264629][ T32] usb 2-1: SerialNumber: syz [ 148.323820][ T32] usb 2-1: config 0 descriptor?? [ 148.501563][ T822] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 148.565283][ T32] usb 2-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 148.661712][ T822] usb 1-1: Using ep0 maxpacket: 16 [ 148.664897][ T822] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 148.664954][ T822] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 148.664982][ T822] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.680359][ T822] usb 1-1: config 0 descriptor?? [ 149.214239][ T822] mcp2221 0003:04D8:00DD.0002: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 149.261571][ T32] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 149.265627][ T5342] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 149.440063][ T5342] usb 3-1: Using ep0 maxpacket: 16 [ 149.449790][ T5342] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 149.449820][ T5342] usb 3-1: config 0 has no interface number 0 [ 149.449869][ T5342] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 149.449899][ T5342] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 149.491259][ T5342] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 149.491294][ T5342] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.491315][ T5342] usb 3-1: Product: syz [ 149.516603][ T5342] usb 3-1: Manufacturer: syz [ 149.516627][ T5342] usb 3-1: SerialNumber: syz [ 149.562491][ T5342] usb 3-1: config 0 descriptor?? [ 149.597727][ T6215] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 149.597963][ T6215] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 149.844080][ T32] ueagle-atm 2-1:0.153: usbatm_usb_probe: bind failed: -19! [ 149.850736][ T6215] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 149.851073][ T6215] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 149.908560][ T32] usb 2-1: USB disconnect, device number 11 [ 150.080061][ T5342] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 150.080106][ T5342] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 150.080408][ T5342] asix 3-1:0.251: probe with driver asix failed with error -5 [ 150.157588][ T822] usb 1-1: USB disconnect, device number 14 [ 150.294719][ T5783] usb 3-1: USB disconnect, device number 10 [ 150.312859][ T6230] netlink: 20 bytes leftover after parsing attributes in process `syz.3.149'. [ 150.642559][ T5342] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 150.817553][ T5342] usb 4-1: Using ep0 maxpacket: 8 [ 150.839460][ T5342] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 150.852757][ T5342] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 150.852794][ T5342] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 150.852818][ T5342] usb 4-1: Product: syz [ 150.852835][ T5342] usb 4-1: Manufacturer: syz [ 150.852852][ T5342] usb 4-1: SerialNumber: syz [ 151.149703][ T5342] usb 4-1: Handspring Visor / Palm OS: No valid connect info available [ 151.149732][ T5342] usb 4-1: Handspring Visor / Palm OS: port 143, is for Remote File System use [ 151.149756][ T5342] usb 4-1: Handspring Visor / Palm OS: port 223, is for unknown use [ 151.149778][ T5342] usb 4-1: Handspring Visor / Palm OS: Number of ports: 2 [ 151.452221][ T5342] usb 4-1: palm_os_3_probe - error -110 getting bytes available request [ 151.452327][ T5342] visor 4-1:1.0: Handspring Visor / Palm OS converter detected [ 151.508820][ T5342] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 151.543423][ T6255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.544034][ T6255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.589145][ T5342] usb 4-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 151.631544][ T822] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 151.708420][ T5701] usb 4-1: USB disconnect, device number 9 [ 151.781546][ T822] usb 2-1: Using ep0 maxpacket: 16 [ 151.789864][ T822] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 151.789896][ T822] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 151.798225][ T822] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 151.798321][ T822] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.798398][ T822] usb 2-1: Product: syz [ 151.798427][ T822] usb 2-1: Manufacturer: syz [ 151.798477][ T822] usb 2-1: SerialNumber: syz [ 151.900023][ T822] usb 2-1: 0:2 : does not exist [ 151.913422][ T5701] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 152.107882][ T5701] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 152.144759][ T5701] visor 4-1:1.0: device disconnected [ 152.153490][ T822] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 152.331573][ T32] usb 3-1: new low-speed USB device number 11 using dummy_hcd [ 152.369129][ T822] usb 2-1: USB disconnect, device number 12 [ 152.411881][ T9] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 152.435982][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 152.494784][ T32] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 152.494818][ T32] usb 3-1: config 0 has no interface number 0 [ 152.494862][ T32] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 152.494884][ T32] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 152.494913][ T32] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 152.494932][ T32] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.499690][ T32] usb 3-1: config 0 descriptor?? [ 152.579750][ T32] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 152.594358][ T9] usb 1-1: too many endpoints for config 0 interface 0 altsetting 4: 129, using maximum allowed: 30 [ 152.594408][ T9] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 152.594437][ T9] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 152.594462][ T9] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 152.594491][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 152.594526][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0725, bcdDevice= 0.00 [ 152.594549][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.621604][ T5701] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 152.685288][ T9] usb 1-1: config 0 descriptor?? [ 152.719605][ T6263] FAULT_INJECTION: forcing a failure. [ 152.719605][ T6263] name failslab, interval 1, probability 0, space 0, times 0 [ 152.719648][ T6263] CPU: 0 UID: 0 PID: 6263 Comm: syz.2.159 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 152.719680][ T6263] Tainted: [L]=SOFTLOCKUP [ 152.719692][ T6263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 152.719706][ T6263] Call Trace: [ 152.719716][ T6263] [ 152.719726][ T6263] dump_stack_lvl+0xe8/0x150 [ 152.719760][ T6263] should_fail_ex+0x46b/0x600 [ 152.719797][ T6263] should_failslab+0xa8/0x100 [ 152.719833][ T6263] kmem_cache_alloc_noprof+0x87/0x680 [ 152.719867][ T6263] ? alloc_empty_file+0x5b/0x1d0 [ 152.719900][ T6263] alloc_empty_file+0x5b/0x1d0 [ 152.719928][ T6263] path_openat+0x11b/0x38a0 [ 152.719971][ T6263] ? try_to_take_rt_mutex+0x840/0xb00 [ 152.720003][ T6263] ? arch_stack_walk+0xfb/0x150 [ 152.720048][ T6263] ? __lock_acquire+0x6b5/0x2d10 [ 152.720079][ T6263] ? __pfx_path_openat+0x10/0x10 [ 152.720115][ T6263] ? kasan_save_track+0x4f/0x80 [ 152.720145][ T6263] ? kasan_save_track+0x3e/0x80 [ 152.720173][ T6263] ? __kasan_slab_alloc+0x6c/0x80 [ 152.720211][ T6263] ? kmem_cache_alloc_noprof+0x33b/0x680 [ 152.720251][ T6263] ? do_raw_spin_lock+0x12b/0x2f0 [ 152.720295][ T6263] do_file_open+0x23e/0x4a0 [ 152.720327][ T6263] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 152.720366][ T6263] ? __pfx_do_file_open+0x10/0x10 [ 152.720397][ T6263] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 152.720451][ T6263] ? alloc_fd+0x64e/0x6c0 [ 152.720490][ T6263] do_sys_openat2+0x113/0x200 [ 152.720522][ T6263] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.720551][ T6263] ? ksys_write+0x248/0x270 [ 152.720586][ T6263] ? __pfx_ksys_write+0x10/0x10 [ 152.720624][ T6263] __x64_sys_openat+0x138/0x170 [ 152.720656][ T6263] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.720681][ T6263] do_syscall_64+0x15f/0xf80 [ 152.720704][ T6263] ? trace_irq_disable+0x3b/0x140 [ 152.720740][ T6263] ? clear_bhb_loop+0x40/0x90 [ 152.720769][ T6263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.720793][ T6263] RIP: 0033:0x7fad70a4d68e [ 152.720816][ T6263] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 152.720836][ T6263] RSP: 002b:00007fad6ecddb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 152.720863][ T6263] RAX: ffffffffffffffda RBX: 00007fad6ecde6c0 RCX: 00007fad70a4d68e [ 152.720881][ T6263] RDX: 0000000000000002 RSI: 00007fad6ecddc00 RDI: ffffffffffffff9c [ 152.720897][ T6263] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 152.720913][ T6263] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.720928][ T6263] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 152.720964][ T6263] [ 152.795314][ T32] usb 3-1: USB disconnect, device number 11 [ 152.870496][ T5701] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 152.886500][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 152.886542][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 152.886645][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 152.898594][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 152.898627][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 152.898724][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 152.948629][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 152.948664][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 152.948750][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.138577][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.138612][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 153.138650][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.140425][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.140452][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 153.140493][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.142572][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.142637][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 153.142718][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.166628][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.166661][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 153.166950][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.202034][ T5701] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 153.202068][ T5701] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 153.202157][ T5701] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.266991][ T5701] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 153.267052][ T5701] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 153.267077][ T5701] usb 4-1: Product: syz [ 153.267130][ T5701] usb 4-1: Manufacturer: syz [ 153.267173][ T5701] usb 4-1: SerialNumber: syz [ 153.446162][ T5701] usb 4-1: config 0 descriptor?? [ 153.468486][ T5701] yurex 4-1:0.0: Could not find endpoints [ 153.592923][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 153.593057][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 153.628522][ T9] usb 1-1: USB disconnect, device number 15 [ 153.811685][ T5701] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 153.973617][ T5701] usb 2-1: Using ep0 maxpacket: 16 [ 153.975920][ T5701] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 153.975944][ T5701] usb 2-1: config 0 has no interface number 0 [ 153.975977][ T5701] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 153.975997][ T5701] usb 2-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 153.978737][ T5701] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 153.978762][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.978838][ T5701] usb 2-1: Product: syz [ 153.978851][ T5701] usb 2-1: Manufacturer: syz [ 153.978862][ T5701] usb 2-1: SerialNumber: syz [ 154.073578][ T32] usb 4-1: USB disconnect, device number 10 [ 154.092871][ T5701] usb 2-1: config 0 descriptor?? [ 154.093575][ T6273] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 154.093751][ T6273] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 154.191876][ T5783] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 154.304656][ T6273] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 154.305016][ T6273] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 154.360041][ T5783] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 154.360119][ T5783] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.360139][ T5783] usb 3-1: Product: syz [ 154.360153][ T5783] usb 3-1: Manufacturer: syz [ 154.360166][ T5783] usb 3-1: SerialNumber: syz [ 154.497283][ T5783] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 154.528658][ T5701] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 154.528713][ T5701] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -61 [ 154.531054][ T5701] asix 2-1:0.251: probe with driver asix failed with error -5 [ 154.661937][ T32] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 154.694421][ T6283] pimreg3: entered allmulticast mode [ 154.734958][ T5783] usb 2-1: USB disconnect, device number 13 [ 154.881533][ C1] usb 3-1: ath9k_htc: over RX MAX_PKT_NUM [ 155.402654][ T5342] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 155.531662][ T5342] usb 1-1: device descriptor read/64, error -71 [ 155.821684][ T5342] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 155.971688][ T5342] usb 1-1: device descriptor read/64, error -71 [ 155.975603][ T5923] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 156.052460][ T32] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 156.052913][ T32] ath9k_htc: Failed to initialize the device [ 156.085606][ T5342] usb usb1-port1: attempt power cycle [ 156.110680][ T32] usb 3-1: ath9k_htc: USB layer deinitialized [ 156.152042][ T5923] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 156.152080][ T5923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.152103][ T5923] usb 2-1: Product: syz [ 156.152119][ T5923] usb 2-1: Manufacturer: syz [ 156.152135][ T5923] usb 2-1: SerialNumber: syz [ 156.248006][ T5923] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 156.280169][ T5597] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 156.344877][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 156.507983][ T5342] usb 1-1: new low-speed USB device number 18 using dummy_hcd [ 156.531909][ T5342] usb 1-1: device descriptor read/8, error -71 [ 156.673689][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 156.679086][ T9] usb 4-1: config 0 has an invalid interface number: 196 but max is 0 [ 156.679191][ T9] usb 4-1: config 0 has no interface number 0 [ 156.679284][ T9] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 156.679388][ T9] usb 4-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 156.679412][ T9] usb 4-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 156.679435][ T9] usb 4-1: config 0 interface 196 has no altsetting 0 [ 156.746859][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 156.746994][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.747019][ T9] usb 4-1: Product: syz [ 156.747036][ T9] usb 4-1: Manufacturer: syz [ 156.747053][ T9] usb 4-1: SerialNumber: syz [ 156.919595][ T5342] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 156.933680][ T5342] usb 1-1: device descriptor read/8, error -71 [ 156.974715][ T9] usb 4-1: config 0 descriptor?? [ 157.008603][ T6298] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 157.045352][ T5342] usb usb1-port1: unable to enumerate USB device [ 158.044691][ T5597] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 158.044887][ T5597] ath9k_htc: Failed to initialize the device [ 158.207012][ T37] usb 3-1: USB disconnect, device number 12 [ 158.678405][ T6307] Zero length message leads to an empty skb [ 158.816038][ T6310] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 158.821349][ T6311] FAULT_INJECTION: forcing a failure. [ 158.821349][ T6311] name failslab, interval 1, probability 0, space 0, times 0 [ 158.845850][ T6311] CPU: 1 UID: 0 PID: 6311 Comm: syz.0.176 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 158.845891][ T6311] Tainted: [L]=SOFTLOCKUP [ 158.845899][ T6311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 158.845914][ T6311] Call Trace: [ 158.845924][ T6311] [ 158.845934][ T6311] dump_stack_lvl+0xe8/0x150 [ 158.845970][ T6311] should_fail_ex+0x46b/0x600 [ 158.846008][ T6311] should_failslab+0xa8/0x100 [ 158.846046][ T6311] __kmalloc_noprof+0xdf/0x7b0 [ 158.846081][ T6311] ? tomoyo_encode+0x28b/0x550 [ 158.846124][ T6311] tomoyo_encode+0x28b/0x550 [ 158.846168][ T6311] tomoyo_realpath_from_path+0x58d/0x5d0 [ 158.846215][ T6311] ? tomoyo_domain+0xd7/0x130 [ 158.846246][ T6311] ? tomoyo_path_number_perm+0x219/0x630 [ 158.846278][ T6311] tomoyo_path_number_perm+0x246/0x630 [ 158.846314][ T6311] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 158.846346][ T6311] ? __lock_acquire+0x6b5/0x2d10 [ 158.846379][ T6311] ? do_raw_spin_lock+0x12b/0x2f0 [ 158.846448][ T6311] ? __fget_files+0x2a/0x420 [ 158.846480][ T6311] ? __fget_files+0x2a/0x420 [ 158.846508][ T6311] ? __fget_files+0x3a6/0x420 [ 158.846535][ T6311] ? __fget_files+0x2a/0x420 [ 158.846569][ T6311] security_file_ioctl+0xc3/0x2a0 [ 158.846601][ T6311] __se_sys_ioctl+0x47/0x170 [ 158.846638][ T6311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.846665][ T6311] do_syscall_64+0x15f/0xf80 [ 158.846689][ T6311] ? trace_irq_disable+0x3b/0x140 [ 158.846722][ T6311] ? clear_bhb_loop+0x40/0x90 [ 158.846751][ T6311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.846776][ T6311] RIP: 0033:0x7f83c286ce59 [ 158.846799][ T6311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.846820][ T6311] RSP: 002b:00007f83c0a9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 158.846846][ T6311] RAX: ffffffffffffffda RBX: 00007f83c2ae6090 RCX: 00007f83c286ce59 [ 158.846864][ T6311] RDX: 0000200000000140 RSI: 00000000c028aa05 RDI: 0000000000000003 [ 158.846880][ T6311] RBP: 00007f83c0a9d090 R08: 0000000000000000 R09: 0000000000000000 [ 158.846895][ T6311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.846910][ T6311] R13: 00007f83c2ae6128 R14: 00007f83c2ae6090 R15: 00007ffcc344eea8 [ 158.846947][ T6311] [ 159.020055][ T6311] ERROR: Out of memory at tomoyo_realpath_from_path. [ 159.145978][ T5342] usb 2-1: USB disconnect, device number 14 [ 159.231366][ T9] ipheth 4-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 159.231851][ T9] ipheth 4-1:0.196: probe with driver ipheth failed with error -71 [ 159.239480][ T5342] usb 2-1: ath9k_htc: USB layer deinitialized [ 159.320432][ T9] usb 4-1: USB disconnect, device number 11 [ 159.483991][ T6318] random: crng reseeded on system resumption [ 159.715705][ T6323] FAULT_INJECTION: forcing a failure. [ 159.715705][ T6323] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 159.716701][ T6323] CPU: 0 UID: 0 PID: 6323 Comm: syz.2.181 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 159.716737][ T6323] Tainted: [L]=SOFTLOCKUP [ 159.716745][ T6323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 159.716758][ T6323] Call Trace: [ 159.716767][ T6323] [ 159.716776][ T6323] dump_stack_lvl+0xe8/0x150 [ 159.716811][ T6323] should_fail_ex+0x46b/0x600 [ 159.716846][ T6323] _copy_to_user+0x31/0xb0 [ 159.716884][ T6323] simple_read_from_buffer+0xe1/0x170 [ 159.716918][ T6323] proc_fail_nth_read+0x1be/0x230 [ 159.716952][ T6323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.716984][ T6323] ? rw_verify_area+0x2ac/0x4e0 [ 159.717016][ T6323] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 159.717048][ T6323] vfs_read+0x212/0xa80 [ 159.717097][ T6323] ? __pfx_vfs_read+0x10/0x10 [ 159.717132][ T6323] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 159.717169][ T6323] ? lockdep_hardirqs_on+0x7a/0x110 [ 159.717205][ T6323] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 159.717242][ T6323] ? mutex_lock_nested+0x152/0x1d0 [ 159.717269][ T6323] ? fdget_pos+0x252/0x320 [ 159.717306][ T6323] ksys_read+0x156/0x270 [ 159.717345][ T6323] ? __pfx_ksys_read+0x10/0x10 [ 159.717376][ T6323] ? __pfx_snd_pcm_ioctl+0x10/0x10 [ 159.717409][ T6323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.717434][ T6323] do_syscall_64+0x15f/0xf80 [ 159.717455][ T6323] ? trace_irq_disable+0x3b/0x140 [ 159.717489][ T6323] ? clear_bhb_loop+0x40/0x90 [ 159.717518][ T6323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.717541][ T6323] RIP: 0033:0x7fad70a4d68e [ 159.717563][ T6323] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 159.717582][ T6323] RSP: 002b:00007fad6ecddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 159.717607][ T6323] RAX: ffffffffffffffda RBX: 00007fad6ecde6c0 RCX: 00007fad70a4d68e [ 159.717624][ T6323] RDX: 000000000000000f RSI: 00007fad6ecde0a0 RDI: 0000000000000006 [ 159.717639][ T6323] RBP: 00007fad6ecde090 R08: 0000000000000000 R09: 0000000000000000 [ 159.717654][ T6323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 159.717668][ T6323] R13: 00007fad70d06038 R14: 00007fad70d05fa0 R15: 00007ffe6bb4cf28 [ 159.717703][ T6323] [ 160.362055][ T6336] tipc: Enabling of bearer rejected, failed to enable media [ 160.631957][ T9] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 160.751727][ T32] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 160.823032][ T9] usb 3-1: config 246 has an invalid interface number: 166 but max is 0 [ 160.823075][ T9] usb 3-1: config 246 has an invalid descriptor of length 0, skipping remainder of the config [ 160.823097][ T9] usb 3-1: config 246 has no interface number 0 [ 160.823153][ T9] usb 3-1: config 246 interface 166 altsetting 118 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 160.823186][ T9] usb 3-1: config 246 interface 166 has no altsetting 0 [ 160.826874][ T9] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 9.63 [ 160.826900][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.826916][ T9] usb 3-1: Product: syz [ 160.826928][ T9] usb 3-1: Manufacturer: syz [ 160.826939][ T9] usb 3-1: SerialNumber: syz [ 160.881587][ T32] usb 4-1: device descriptor read/64, error -71 [ 161.123023][ T32] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 161.252713][ T32] usb 4-1: device descriptor read/64, error -71 [ 161.362040][ T32] usb usb4-port1: attempt power cycle [ 161.544568][ T9] usb 3-1: Limiting number of CPorts to U8_MAX [ 161.581001][ T9] usb 3-1: Not enough endpoints found in device, aborting! [ 161.712382][ T32] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 161.732330][ T32] usb 4-1: device descriptor read/8, error -71 [ 161.773834][ T9] usb 3-1: USB disconnect, device number 13 [ 161.904877][ T6358] kvm_intel: kvm [6357]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0xa [ 161.972950][ T32] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 161.992889][ T32] usb 4-1: device descriptor read/8, error -71 [ 162.106129][ T32] usb usb4-port1: unable to enumerate USB device [ 162.128822][ T6369] binder: 6364:6369 ioctl 40082102 200000000000 returned -22 [ 162.169449][ T6365] netlink: 324 bytes leftover after parsing attributes in process `syz.0.197'. [ 162.427352][ T6373] FAULT_INJECTION: forcing a failure. [ 162.427352][ T6373] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 162.427392][ T6373] CPU: 0 UID: 0 PID: 6373 Comm: syz.1.199 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 162.427431][ T6373] Tainted: [L]=SOFTLOCKUP [ 162.427439][ T6373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.427453][ T6373] Call Trace: [ 162.427462][ T6373] [ 162.427472][ T6373] dump_stack_lvl+0xe8/0x150 [ 162.427505][ T6373] should_fail_ex+0x46b/0x600 [ 162.427560][ T6373] _copy_to_user+0x31/0xb0 [ 162.427600][ T6373] simple_read_from_buffer+0xe1/0x170 [ 162.427634][ T6373] proc_fail_nth_read+0x1be/0x230 [ 162.427667][ T6373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 162.427701][ T6373] ? rw_verify_area+0x2ac/0x4e0 [ 162.427732][ T6373] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 162.427766][ T6373] vfs_read+0x212/0xa80 [ 162.427807][ T6373] ? __pfx_vfs_read+0x10/0x10 [ 162.427840][ T6373] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.427878][ T6373] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.427915][ T6373] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 162.427954][ T6373] ? mutex_lock_nested+0x152/0x1d0 [ 162.427983][ T6373] ? fdget_pos+0x252/0x320 [ 162.428020][ T6373] ksys_read+0x156/0x270 [ 162.428053][ T6373] ? __pfx_ksys_read+0x10/0x10 [ 162.428093][ T6373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.428118][ T6373] do_syscall_64+0x15f/0xf80 [ 162.428138][ T6373] ? trace_irq_disable+0x3b/0x140 [ 162.428171][ T6373] ? clear_bhb_loop+0x40/0x90 [ 162.428198][ T6373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.428220][ T6373] RIP: 0033:0x7f7ca6cad68e [ 162.428240][ T6373] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 162.428259][ T6373] RSP: 002b:00007f7ca4f3dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 162.428295][ T6373] RAX: ffffffffffffffda RBX: 00007f7ca4f3e6c0 RCX: 00007f7ca6cad68e [ 162.428311][ T6373] RDX: 000000000000000f RSI: 00007f7ca4f3e0a0 RDI: 0000000000000004 [ 162.428324][ T6373] RBP: 00007f7ca4f3e090 R08: 0000000000000000 R09: 0000000000000000 [ 162.428346][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 162.428359][ T6373] R13: 00007f7ca6f66038 R14: 00007f7ca6f65fa0 R15: 00007fffde76c778 [ 162.428392][ T6373] [ 162.643498][ T61] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 162.643531][ T61] CPU: 0 UID: 0 PID: 61 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 162.643566][ T61] Tainted: [L]=SOFTLOCKUP [ 162.643575][ T61] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026[ 162.643575][ T61] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.643591][ T61] Workqueue: hci1 hci_rx_work [ 162.643633][ T61] Call Trace: [ 162.643643][ T61] [ 162.643654][ T61] dump_stack_lvl+0xe8/0x150 [ 162.643702][ T61] sysfs_create_dir_ns+0x271/0x2a0 [ 162.643751][ T61] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 162.643787][ T61] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 162.643820][ T61] ? rt_spin_unlock+0x160/0x200 [ 162.643855][ T61] kobject_add_internal+0x631/0xd10 [ 162.643896][ T61] kobject_add+0x163/0x240 [ 162.643931][ T61] ? __pfx_kobject_add+0x10/0x10 [ 162.643969][ T61] ? get_device_parent+0x370/0x3a0 [ 162.644008][ T61] device_add+0x408/0xb90 [ 162.644047][ T61] hci_conn_add_sysfs+0xd5/0x210 [ 162.644088][ T61] le_conn_complete_evt+0x10e6/0x16b0 [ 162.644131][ T61] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 162.644162][ T61] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.644202][ T61] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.644243][ T61] ? skb_pull_data+0xfb/0x200 [ 162.644274][ T61] hci_le_conn_complete_evt+0x187/0x470 [ 162.644311][ T61] hci_event_packet+0x659/0xef0 [ 162.644367][ T61] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 162.644396][ T61] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 162.644423][ T61] ? __pfx_hci_event_packet+0x10/0x10 [ 162.644460][ T61] ? rt_spin_unlock+0x14f/0x200 [ 162.644495][ T61] ? hci_send_to_monitor+0xe2/0x590 [ 162.644523][ T61] hci_rx_work+0x3ee/0x1040 [ 162.644574][ T61] ? process_one_work+0x8be/0x1630 [ 162.644599][ T61] process_one_work+0x98b/0x1630 [ 162.644641][ T61] ? __pfx_process_one_work+0x10/0x10 [ 162.644664][ T61] ? do_raw_spin_lock+0x12b/0x2f0 [ 162.644704][ T61] worker_thread+0xb49/0x1140 [ 162.644751][ T61] kthread+0x388/0x470 [ 162.644773][ T61] ? __pfx_worker_thread+0x10/0x10 [ 162.644798][ T61] ? __pfx_kthread+0x10/0x10 [ 162.644819][ T61] ret_from_fork+0x514/0xb70 [ 162.644845][ T61] ? __pfx_ret_from_fork+0x10/0x10 [ 162.644885][ T61] ? __switch_to+0xc79/0x1410 [ 162.644918][ T61] ? __pfx_kthread+0x10/0x10 [ 162.644955][ T61] ret_from_fork_asm+0x1a/0x30 [ 162.644993][ T61] [ 162.648926][ T61] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 162.648978][ T61] Bluetooth: hci1: failed to register connection device [ 162.802762][ T61] ================================================================== [ 162.802782][ T61] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x902/0x1560 [ 162.802835][ T61] Read of size 8 at addr ffff88803f7b3500 by task kworker/u9:0/61 [ 162.802856][ T61] [ 162.802877][ T61] CPU: 0 UID: 0 PID: 61 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 162.802910][ T61] Tainted: [L]=SOFTLOCKUP [ 162.802920][ T61] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.802936][ T61] Workqueue: hci1 hci_rx_work [ 162.802973][ T61] Call Trace: [ 162.802982][ T61] [ 162.802993][ T61] dump_stack_lvl+0xe8/0x150 [ 162.803023][ T61] print_address_description+0x55/0x1e0 [ 162.803057][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.803088][ T61] print_report+0x58/0x70 [ 162.803117][ T61] kasan_report+0x117/0x150 [ 162.803154][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.803187][ T61] l2cap_connect_cfm+0x902/0x1560 [ 162.803216][ T61] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 162.803240][ T61] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.803271][ T61] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.803301][ T61] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 162.803333][ T61] ? mutex_lock_nested+0x152/0x1d0 [ 162.803355][ T61] ? hci_connect_cfm+0x2c/0x140 [ 162.803376][ T61] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 162.803401][ T61] hci_connect_cfm+0x95/0x140 [ 162.803423][ T61] le_conn_complete_evt+0x1134/0x16b0 [ 162.803451][ T61] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 162.803474][ T61] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.803504][ T61] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.803533][ T61] ? skb_pull_data+0xfb/0x200 [ 162.803554][ T61] hci_le_conn_complete_evt+0x187/0x470 [ 162.803579][ T61] hci_event_packet+0x659/0xef0 [ 162.803611][ T61] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 162.803635][ T61] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 162.803655][ T61] ? __pfx_hci_event_packet+0x10/0x10 [ 162.803683][ T61] ? rt_spin_unlock+0x14f/0x200 [ 162.803711][ T61] ? hci_send_to_monitor+0xe2/0x590 [ 162.803736][ T61] hci_rx_work+0x3ee/0x1040 [ 162.803771][ T61] ? process_one_work+0x8be/0x1630 [ 162.803796][ T61] process_one_work+0x98b/0x1630 [ 162.803840][ T61] ? __pfx_process_one_work+0x10/0x10 [ 162.803864][ T61] ? do_raw_spin_lock+0x12b/0x2f0 [ 162.803899][ T61] worker_thread+0xb49/0x1140 [ 162.803937][ T61] kthread+0x388/0x470 [ 162.803956][ T61] ? __pfx_worker_thread+0x10/0x10 [ 162.803986][ T61] ? __pfx_kthread+0x10/0x10 [ 162.804005][ T61] ret_from_fork+0x514/0xb70 [ 162.804029][ T61] ? __pfx_ret_from_fork+0x10/0x10 [ 162.804050][ T61] ? __switch_to+0xc79/0x1410 [ 162.804081][ T61] ? __pfx_kthread+0x10/0x10 [ 162.804100][ T61] ret_from_fork_asm+0x1a/0x30 [ 162.804132][ T61] [ 162.804139][ T61] [ 162.804144][ T61] Allocated by task 61: [ 162.804154][ T61] kasan_save_track+0x3e/0x80 [ 162.804178][ T61] __kasan_kmalloc+0x93/0xb0 [ 162.804201][ T61] __kmalloc_cache_noprof+0x3a6/0x690 [ 162.804228][ T61] l2cap_chan_create+0x51/0x7a0 [ 162.804253][ T61] l2cap_sock_new_connection_cb+0x191/0x2f0 [ 162.804281][ T61] l2cap_connect_cfm+0x368/0x1560 [ 162.804304][ T61] hci_connect_cfm+0x95/0x140 [ 162.804323][ T61] le_conn_complete_evt+0x1134/0x16b0 [ 162.804344][ T61] hci_le_conn_complete_evt+0x187/0x470 [ 162.804363][ T61] hci_event_packet+0x659/0xef0 [ 162.804390][ T61] hci_rx_work+0x3ee/0x1040 [ 162.804416][ T61] process_one_work+0x98b/0x1630 [ 162.804438][ T61] worker_thread+0xb49/0x1140 [ 162.804462][ T61] kthread+0x388/0x470 [ 162.804477][ T61] ret_from_fork+0x514/0xb70 [ 162.804496][ T61] ret_from_fork_asm+0x1a/0x30 [ 162.804519][ T61] [ 162.804523][ T61] Freed by task 6370: [ 162.804533][ T61] kasan_save_track+0x3e/0x80 [ 162.804559][ T61] kasan_save_free_info+0x46/0x50 [ 162.804577][ T61] __kasan_slab_free+0x5c/0x80 [ 162.804600][ T61] kfree+0x1c5/0x6c0 [ 162.804620][ T61] l2cap_sock_cleanup_listen+0xf0/0x440 [ 162.804645][ T61] l2cap_sock_release+0x6e/0x270 [ 162.804668][ T61] __sock_release+0xb9/0x250 [ 162.804686][ T61] sock_close+0x1c/0x30 [ 162.804703][ T61] __fput+0x461/0xa70 [ 162.804722][ T61] task_work_run+0x1d9/0x270 [ 162.804740][ T61] exit_to_user_mode_loop+0xf3/0x4d0 [ 162.804768][ T61] do_syscall_64+0x33e/0xf80 [ 162.804784][ T61] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.804809][ T61] [ 162.804814][ T61] The buggy address belongs to the object at ffff88803f7b3000 [ 162.804814][ T61] which belongs to the cache kmalloc-2k of size 2048 [ 162.804831][ T61] The buggy address is located 1280 bytes inside of [ 162.804831][ T61] freed 2048-byte region [ffff88803f7b3000, ffff88803f7b3800) [ 162.804851][ T61] [ 162.804856][ T61] The buggy address belongs to the physical page: [ 162.804876][ T61] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f7b0 [ 162.804895][ T61] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 162.804910][ T61] flags: 0x80000000000040(head|node=0|zone=1) [ 162.804926][ T61] page_type: f5(slab) [ 162.804945][ T61] raw: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 162.804962][ T61] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 162.804980][ T61] head: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 162.804997][ T61] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 162.805015][ T61] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 162.805032][ T61] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 162.805042][ T61] page dumped because: kasan: bad access detected [ 162.805056][ T61] page_owner tracks the page as allocated [ 162.805063][ T61] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 68, tgid 68 (kworker/u8:4), ts 112770102536, free_ts 111114933568 [ 162.805095][ T61] post_alloc_hook+0x1f9/0x250 [ 162.805120][ T61] get_page_from_freelist+0x27d6/0x2850 [ 162.805149][ T61] __alloc_frozen_pages_noprof+0x18d/0x380 [ 162.805177][ T61] allocate_slab+0x74/0x5e0 [ 162.805196][ T61] refill_objects+0x33c/0x3d0 [ 162.805213][ T61] __pcs_replace_empty_main+0x373/0x720 [ 162.805233][ T61] __kmalloc_noprof+0x530/0x7b0 [ 162.805257][ T61] ___neigh_create+0x724/0x2360 [ 162.805278][ T61] ip6_finish_output2+0x729/0x1430 [ 162.805299][ T61] ip6_output+0x340/0x550 [ 162.805322][ T61] ndisc_send_skb+0xd0b/0x1670 [ 162.805346][ T61] addrconf_dad_completed+0x6e3/0xe60 [ 162.805362][ T61] addrconf_dad_work+0xdc4/0x1680 [ 162.805378][ T61] process_one_work+0x98b/0x1630 [ 162.805400][ T61] worker_thread+0xb49/0x1140 [ 162.805424][ T61] kthread+0x388/0x470 [ 162.805444][ T61] page last free pid 5773 tgid 5770 stack trace: [ 162.805454][ T61] __free_frozen_pages+0x1075/0x11b0 [ 162.805479][ T61] __folio_put+0x2eb/0x3a0 [ 162.805506][ T61] skb_release_data+0x544/0xa60 [ 162.805532][ T61] __kfree_skb+0x5d/0x210 [ 162.805555][ T61] tcp_ack+0x284f/0x7e00 [ 162.805573][ T61] tcp_rcv_established+0x1533/0x2920 [ 162.805591][ T61] tcp_v4_do_rcv+0x959/0x13f0 [ 162.805614][ T61] __release_sock+0x285/0x3d0 [ 162.805629][ T61] release_sock+0x1be/0x290 [ 162.805650][ T61] sk_wait_data+0x214/0x4d0 [ 162.805665][ T61] tcp_recvmsg_locked+0xe0a/0x3770 [ 162.805687][ T61] tcp_recvmsg+0xf6/0x530 [ 162.805707][ T61] sock_recvmsg_nosec+0xee/0x140 [ 162.805726][ T61] __sys_recvfrom+0x298/0x420 [ 162.805750][ T61] __x64_sys_recvfrom+0xde/0x100 [ 162.805774][ T61] do_syscall_64+0x15f/0xf80 [ 162.805790][ T61] [ 162.805794][ T61] Memory state around the buggy address: [ 162.805810][ T61] ffff88803f7b3400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.805823][ T61] ffff88803f7b3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.805835][ T61] >ffff88803f7b3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.805845][ T61] ^ [ 162.805854][ T61] ffff88803f7b3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.805867][ T61] ffff88803f7b3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 162.805877][ T61] ================================================================== [ 162.805924][ T61] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 162.805947][ T61] CPU: 0 UID: 0 PID: 61 Comm: kworker/u9:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 162.805980][ T61] Tainted: [L]=SOFTLOCKUP [ 162.805989][ T61] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.806005][ T61] Workqueue: hci1 hci_rx_work [ 162.806044][ T61] Call Trace: [ 162.806054][ T61] [ 162.806065][ T61] vpanic+0x56c/0xa60 [ 162.806099][ T61] ? __pfx_vpanic+0x10/0x10 [ 162.806132][ T61] panic+0xc5/0xd0 [ 162.806158][ T61] ? __pfx_panic+0x10/0x10 [ 162.806186][ T61] ? preempt_schedule_thunk+0x16/0x40 [ 162.806219][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.806244][ T61] ? preempt_schedule_thunk+0x16/0x40 [ 162.806274][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.806299][ T61] check_panic_on_warn+0x89/0xb0 [ 162.806322][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.806346][ T61] end_report+0x73/0x170 [ 162.806374][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.806397][ T61] kasan_report+0x128/0x150 [ 162.806426][ T61] ? l2cap_connect_cfm+0x902/0x1560 [ 162.806454][ T61] l2cap_connect_cfm+0x902/0x1560 [ 162.806483][ T61] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 162.806508][ T61] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.806538][ T61] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.806568][ T61] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 162.806597][ T61] ? mutex_lock_nested+0x152/0x1d0 [ 162.806620][ T61] ? hci_connect_cfm+0x2c/0x140 [ 162.806641][ T61] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 162.806665][ T61] hci_connect_cfm+0x95/0x140 [ 162.806687][ T61] le_conn_complete_evt+0x1134/0x16b0 [ 162.806715][ T61] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 162.806738][ T61] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 162.806768][ T61] ? lockdep_hardirqs_on+0x7a/0x110 [ 162.806798][ T61] ? skb_pull_data+0xfb/0x200 [ 162.806826][ T61] hci_le_conn_complete_evt+0x187/0x470 [ 162.806853][ T61] hci_event_packet+0x659/0xef0 [ 162.806886][ T61] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 162.806910][ T61] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 162.806931][ T61] ? __pfx_hci_event_packet+0x10/0x10 [ 162.806960][ T61] ? rt_spin_unlock+0x14f/0x200 [ 162.806988][ T61] ? hci_send_to_monitor+0xe2/0x590 [ 162.807014][ T61] hci_rx_work+0x3ee/0x1040 [ 162.807054][ T61] ? process_one_work+0x8be/0x1630 [ 162.807080][ T61] process_one_work+0x98b/0x1630 [ 162.807114][ T61] ? __pfx_process_one_work+0x10/0x10 [ 162.807139][ T61] ? do_raw_spin_lock+0x12b/0x2f0 [ 162.807173][ T61] worker_thread+0xb49/0x1140 [ 162.807211][ T61] kthread+0x388/0x470 [ 162.807229][ T61] ? __pfx_worker_thread+0x10/0x10 [ 162.807255][ T61] ? __pfx_kthread+0x10/0x10 [ 162.807274][ T61] ret_from_fork+0x514/0xb70 [ 162.807298][ T61] ? __pfx_ret_from_fork+0x10/0x10 [ 162.807321][ T61] ? __switch_to+0xc79/0x1410 [ 162.807352][ T61] ? __pfx_kthread+0x10/0x10 [ 162.807371][ T61] ret_from_fork_asm+0x1a/0x30 [ 162.807404][ T61] [ 162.808266][ T61] Kernel Offset: disabled