last executing test programs: 2m1.415028986s ago: executing program 3 (id=8): r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200aaff020000000000000000000000000001042088be"], 0xfdef) 1m59.209767501s ago: executing program 3 (id=14): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000000980)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1m58.654101536s ago: executing program 3 (id=16): open(&(0x7f0000000000)='.\x00', 0x0, 0x12d) socket$netlink(0x10, 0x3, 0x0) inotify_init1(0x80000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x101040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000140)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d2f2f800000c0d23266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x2d, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x8, 0x0, 0x0, 0x3, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x9, 0x0, 0x0, 0x2}, {0xeda7, 0x4, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x9}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x20000000, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x2004cb, 0x200000003, 0x4100000000000000, 0xfffffffffffffff8, 0x0, 0xfffffffffffff2ab, 0x2000000000003ff, 0x2, 0xfffffffffffffffd], 0x0, 0x200306}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m57.644875843s ago: executing program 3 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 1m57.520268016s ago: executing program 3 (id=22): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000080)=0x2) ioctl$VIDIOC_DECODER_CMD(r1, 0xc0485660, &(0x7f0000000380)={0x1, 0x1, @start={0x775b4acb, 0x1}}) close_range(r0, 0xffffffffffffffff, 0x0) 1m55.75871415s ago: executing program 3 (id=31): timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x4, 0x100004, 0x0, {0x77359400}, {0x7, 0xc, 0x0, 0x0, 0x0, 0x0, "1000"}}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 1m55.326391168s ago: executing program 32 (id=31): timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x4, 0x100004, 0x0, {0x77359400}, {0x7, 0xc, 0x0, 0x0, 0x0, 0x0, "1000"}}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 32.648418266s ago: executing program 2 (id=307): syz_open_dev$sg(&(0x7f0000000080), 0x6f5e, 0xa0001) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000ef0000/0x1000)=nil, 0x1000, 0x580000e, 0x13, r3, 0x0) ioctl$FBIOBLANK(r3, 0x4611, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00'], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x408c0c0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, &(0x7f0000000500)={0x0, 0x9, 0x1ff}) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000001580)={r4, "2496c11f653555479c9ba0f494b098cb"}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 26.418390309s ago: executing program 2 (id=315): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mkdir(&(0x7f0000000300)='./file0\x00', 0x49) r0 = fanotify_init(0x1a, 0x800) fanotify_mark(r0, 0x441, 0x4800001a, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x6, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x19}}}, 0xa0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) 22.729231915s ago: executing program 2 (id=319): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005500)={0x0, 0x0, &(0x7f00000054c0)={&(0x7f00000016c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x55fdd7e50386e5c2}}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x108, 0xe, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0xf4, 0x3, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @redir={{0xa}, @void}}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1}]}, {0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xa8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa1, 0x1, "5609a4bfe10f2f993959b1a2a7e724c61d87534f1e187f6459d7137701bb74f0dd21a84f6469d64c1c761377b1d8b8552070792f9a42c0a1836c8d59e3f1f331bcd96f5ec9f24408a27bd67d5363340d0f7f04e148cc721f18d8bebf6d84dc34e28066bc0764f0e0c5427383a8a4685554897fe5935d656b82cc045d901d2b7394602ae7b5c60ecf537105df0d0d630a64796a44fe486e8618456b6dfd"}]}]}, {0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x4}]}]}]}, @NFT_MSG_DELSETELEM={0x14, 0xe, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x164}, 0x1, 0x0, 0x0, 0x4004800}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x68}}, 0x0) r1 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r1, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001640)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ce", 0x71}, {0x0, 0xf5}, {&(0x7f0000000e40), 0x6000}], 0x3}, 0x800) 19.984973731s ago: executing program 0 (id=321): r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef020140000000000001000000010902a1000201008032080b00020e030000090400"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB="002193000000930d19a3f6549a3391ae3771a72f732bc27950776f1d20c23f48faae66dc691e4edcf1da9b24b11cb12fa50836c2c48110fd07af1f655a3d48b697f649e11f58fe2514f71204a27a04e4ac3f361f44ae41ef0f349e3d579124dcb92bd6e7b714a9a7e3430ee5785fc6d49e0bc43c910e14cb79ee686a061331208e2ca93139992d973b6c4e653188268e33e7b1cf95158c36a3"], &(0x7f0000000800)={0x0, 0x3, 0x37, @string={0x37, 0x3, "ed0e82fb0f9a0e02ced95d028f99d671880f241b878cc52422cece2e396edf3a3bd607973818d63bf1576c0c3ca1df3634de824fa3"}}, &(0x7f0000000180)={0x0, 0xf, 0x17, {0x5, 0xf, 0x17, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x1, 0x4, 0x7}, @wireless={0xb, 0x10, 0x1, 0xc, 0x8, 0x3, 0x1, 0x6, 0x7}]}}, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x0, 0x9, 0x0, "5ed1667a", "a43f12c8"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xa5, 0x0, 0x8, 0x9, 0x5, 0xced, 0x9}}}, &(0x7f0000000e40)={0x84, &(0x7f0000000940)={0x0, 0x16, 0xf8, "4d524b261a44732d61f1d551a833fa33673d4b3d29663cb6312ed983229dbd7e2b9b7a5767b4b396d01a11a973cacdd2c46ee018e1bebc809cef5f455be7841347b28c474e6407bac7a6e1ce00a8527fb91233541256ab021e53b45c68c17dd295dc820434aa13a4361bc13f967a9bfec9fb0ba4b4301480b8d4d41d034fc38278fd245598e04fc144450400402aa21788b7913c676a8c8e57b8d0ebfa320627a2bbd0b4386f8037450d1dbc2662cee3c54df9fdc45adfd56f232233258e32cb86951900438360ceb3e9af4c36ddc7b54347b2d03be2525908d2b52afe8b88612f0b2ab7fbeab8b4f73e1d4bf868d6ace23297ef8294749b"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000a80)={0x0, 0x8, 0x1}, &(0x7f0000000ac0)={0x20, 0x0, 0x4, {0x7, 0x1}}, &(0x7f0000000b00)={0x20, 0x0, 0x4, {0x160, 0x10}}, &(0x7f0000000b40)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000bc0)={0x40, 0x9, 0x1}, &(0x7f0000000c00)={0x40, 0xb, 0x2, "eccc"}, &(0x7f0000000c40)={0x40, 0xf, 0x2, 0xfff1}, &(0x7f0000000c80)={0x40, 0x13, 0x6}, &(0x7f0000000cc0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000d00)={0x40, 0x19, 0x2, "5fcb"}, &(0x7f0000000d40)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000d80)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000380)={0x40, 0x1e, 0x1, 0x9}, &(0x7f0000000e00)={0x40, 0x21, 0x1, 0x8}}) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f00000001c0)=0x4162, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$vbi(&(0x7f0000000300), 0x1, 0x2) ppoll(&(0x7f0000000240)=[{r3, 0xbc}], 0x1, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000000)=0x1) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) r5 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$sierra_net(r5, 0x0, &(0x7f00000007c0)={0x1c, &(0x7f0000001080)=ANY=[@ANYBLOB="200f070000006eef80ed841625f1c1f7830661fe7521794f9599090b6b0879be43d2d3488c4398476d7a4d0930c84389343b4e5140f60ab071eca3dccf83edda8f76177e30fd172ad5b2a174f962e2212c4719b3e36b4c3801a1d8b8442a680143ffe4a0b440e17297214d4baa0bc54247da137c9394573d93ed16521cc67b1d674beb7a3825fd5882201367a2f23496070dd37e84ff3f32bf5b768a3c677e1816ed12a5a17770205f9e7ccd2ba5a2c79dfab286e0342f8b9ad8deeb049a5b5bdd6ea7f0f6f6199085de9870752bf211fc6a62c875476b259dc22f95f84f2fd3d45815f81d070163"], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000200)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYRES64=r4, @ANYRES16=r4, @ANYBLOB="6641af28010027bd7000fddbdf2501000000050004000000000008000600ac146bdc"], 0x24}, 0x1, 0x0, 0x0, 0x24815}, 0x4000000) sendmsg$FOU_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd7000fcdbdf2501000020ffff040002000000b3d99ab8dca63a6e4a5aeab2"], 0x1c}, 0x1, 0x0, 0x0, 0x40040021}, 0x40080) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01082fbd7000fddbdf250100000014000700fe8000000000000000000000000000aa050004000200000008000600e00000010400050008000600ffffffff0600010014f3fe1943f025354ae4d04e240000"], 0x4c}, 0x1, 0x0, 0x0, 0x811}, 0x4000040) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) syz_genetlink_get_family_id$l2tp(&(0x7f0000000f00), r6) 17.828119021s ago: executing program 4 (id=322): r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x50440, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000000c0)={0x5, [0xfff, 0x4b, 0x2, 0x56e, 0x5]}, &(0x7f0000000100)=0xe) mkdir(&(0x7f0000000200)='./file0\x00', 0xc7) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000340)='./file0\x00', &(0x7f0000000000)='vfat\x00', 0x8082, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x50440, 0x0) (async) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000000c0)={0x5, [0xfff, 0x4b, 0x2, 0x56e, 0x5]}, &(0x7f0000000100)=0xe) (async) mkdir(&(0x7f0000000200)='./file0\x00', 0xc7) (async) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000340)='./file0\x00', &(0x7f0000000000)='vfat\x00', 0x8082, 0x0) (async) 14.880252737s ago: executing program 0 (id=323): r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0x6, 0xfa00, {0x4, 0x0, 0x0, 0x3}}, 0x20) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000380)={0x10000001, 0x7, 0x6a, 0x10001, 0x0, 0xffffdffffffffffd, 0x10000003, 0x0, 0x0, 0x0, 0xff7ffffb, 0x1}) 14.555371828s ago: executing program 4 (id=324): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x81, 0x0, 0x2, 0x7fff7ffc}]}) syslog(0x4, 0xfffffffffffffffe, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) landlock_create_ruleset(0x0, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r1, 0x89e0, &(0x7f0000000080)={0x1}) ioctl$VIDIOC_S_AUDIO(r0, 0x40345622, &(0x7f0000000040)={0xeecd, "b4528ae0aaadd2a4c2daddbc9b551c40cecbfed791de8a6a0a382fd8ac291c8e", 0x3, 0x1}) 14.430686989s ago: executing program 1 (id=325): ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0xfffd, @empty}, {0x2, 0x4000, @loopback}, {0x2, 0x0, @private}, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) syz_open_dev$sg(&(0x7f0000000080), 0x6f5e, 0xa0001) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x3, &(0x7f0000000100)=[{0x4, 0xff, 0x2}, {0x8, 0x9, 0x5, 0x8005}, {0x40, 0x3, 0x6, 0x4a7c}]}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00', @ANYBLOB="010000000000000000000800000018000180140002"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x408c0c0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14.430504192s ago: executing program 4 (id=326): r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040), 0x40002, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000000)={r2, @in={{0x2, 0x4e27, @empty}}, 0x100, 0x601}, 0x90) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000080)={r2, @in={{0x2, 0x4e21, @private=0xa010101}}}, &(0x7f0000000140)=0x84) r3 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) r5 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040300880000001010203010902200001010080320904"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000800)='./dev/ttyUSB0\x00', 0x2, 0x0) fchdir(r4) close_range(r4, r4, 0x0) 13.918644246s ago: executing program 0 (id=327): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mkdir(&(0x7f0000000300)='./file0\x00', 0x49) r0 = fanotify_init(0x1a, 0x800) fanotify_mark(r0, 0x441, 0x4800001a, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x6, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x19}}}, 0xa0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) 13.555759796s ago: executing program 0 (id=328): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000640)="240000001e005f02140c00fffffffff80700000001000000000000000500e99c11e85637", 0x24) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) syz_genetlink_get_family_id$ipvs(0x0, r0) 11.080997547s ago: executing program 2 (id=329): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100"/46) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e0132004601000001") 8.901335495s ago: executing program 0 (id=330): syz_emit_vhci(&(0x7f00000024c0)=ANY=[@ANYBLOB="05c9"], 0xe) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x3, 0x55, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a00000007058202000200070503020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x1cf002, 0xc) syz_usb_disconnect(r0) 8.648581985s ago: executing program 2 (id=331): r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef020140000000000001000000010902a1000201008032080b00020e030000090400"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, &(0x7f0000000700)=ANY=[@ANYBLOB="002193000000930d19a3f6549a3391ae3771a72f732bc27950776f1d20c23f48faae66dc691e4edcf1da9b24b11cb12fa50836c2c48110fd07af1f655a3d48b697f649e11f58fe2514f71204a27a04e4ac3f361f44ae41ef0f349e3d579124dcb92bd6e7b714a9a7e3430ee5785fc6d49e0bc43c910e14cb79ee686a061331208e2ca93139992d973b6c4e653188268e33e7b1cf95158c36a3"], &(0x7f0000000800)={0x0, 0x3, 0x37, @string={0x37, 0x3, "ed0e82fb0f9a0e02ced95d028f99d671880f241b878cc52422cece2e396edf3a3bd607973818d63bf1576c0c3ca1df3634de824fa3"}}, &(0x7f0000000180)={0x0, 0xf, 0x17, {0x5, 0xf, 0x17, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x1, 0x4, 0x7}, @wireless={0xb, 0x10, 0x1, 0xc, 0x8, 0x3, 0x1, 0x6, 0x7}]}}, &(0x7f0000000880)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x0, 0x9, 0x0, "5ed1667a", "a43f12c8"}}, &(0x7f00000008c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xa5, 0x0, 0x8, 0x9, 0x5, 0xced, 0x9}}}, &(0x7f0000000e40)={0x84, &(0x7f0000000940)={0x0, 0x16, 0xf8, "4d524b261a44732d61f1d551a833fa33673d4b3d29663cb6312ed983229dbd7e2b9b7a5767b4b396d01a11a973cacdd2c46ee018e1bebc809cef5f455be7841347b28c474e6407bac7a6e1ce00a8527fb91233541256ab021e53b45c68c17dd295dc820434aa13a4361bc13f967a9bfec9fb0ba4b4301480b8d4d41d034fc38278fd245598e04fc144450400402aa21788b7913c676a8c8e57b8d0ebfa320627a2bbd0b4386f8037450d1dbc2662cee3c54df9fdc45adfd56f232233258e32cb86951900438360ceb3e9af4c36ddc7b54347b2d03be2525908d2b52afe8b88612f0b2ab7fbeab8b4f73e1d4bf868d6ace23297ef8294749b"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000a80)={0x0, 0x8, 0x1}, &(0x7f0000000ac0)={0x20, 0x0, 0x4, {0x7, 0x1}}, &(0x7f0000000b00)={0x20, 0x0, 0x4, {0x160, 0x10}}, &(0x7f0000000b40)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000bc0)={0x40, 0x9, 0x1}, &(0x7f0000000c00)={0x40, 0xb, 0x2, "eccc"}, &(0x7f0000000c40)={0x40, 0xf, 0x2, 0xfff1}, &(0x7f0000000c80)={0x40, 0x13, 0x6}, &(0x7f0000000cc0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000d00)={0x40, 0x19, 0x2, "5fcb"}, &(0x7f0000000d40)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000d80)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000380)={0x40, 0x1e, 0x1, 0x9}, &(0x7f0000000e00)={0x40, 0x21, 0x1, 0x8}}) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f00000001c0)=0x4162, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$vbi(&(0x7f0000000300), 0x1, 0x2) ppoll(&(0x7f0000000240)=[{r3, 0xbc}], 0x1, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000000)=0x1) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) r5 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) syz_usb_control_io$sierra_net(r5, 0x0, &(0x7f00000007c0)={0x1c, &(0x7f0000001080)=ANY=[@ANYBLOB="200f070000006eef80ed841625f1c1f7830661fe7521794f9599090b6b0879be43d2d3488c4398476d7a4d0930c84389343b4e5140f60ab071eca3dccf83edda8f76177e30fd172ad5b2a174f962e2212c4719b3e36b4c3801a1d8b8442a680143ffe4a0b440e17297214d4baa0bc54247da137c9394573d93ed16521cc67b1d674beb7a3825fd5882201367a2f23496070dd37e84ff3f32bf5b768a3c677e1816ed12a5a17770205f9e7ccd2ba5a2c79dfab286e0342f8b9ad8deeb049a5b5bdd6ea7f0f6f6199085de9870752bf211fc6a62c875476b259dc22f95f84f2fd3d45815f81d070163"], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000200)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYRES64=r4, @ANYRES16=r4, @ANYBLOB="6641af28010027bd7000fddbdf2501000000050004000000000008000600ac146bdc"], 0x24}, 0x1, 0x0, 0x0, 0x24815}, 0x4000000) sendmsg$FOU_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd7000fcdbdf2501000020ffff040002000000b3d99ab8dca63a6e4a5aeab2"], 0x1c}, 0x1, 0x0, 0x0, 0x40040021}, 0x40080) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01082fbd7000fddbdf250100000014000700fe8000000000000000000000000000aa050004000200000008000600e00000010400050008000600ffffffff0600010014f3fe1943f025354ae4d04e240000"], 0x4c}, 0x1, 0x0, 0x0, 0x811}, 0x4000040) setns(0xc9, 0x0) r6 = socket$netlink(0x10, 0x3, 0x4) write(r6, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) syz_genetlink_get_family_id$l2tp(&(0x7f0000000f00), r6) 7.782872439s ago: executing program 4 (id=332): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xac89}}, './file0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r3, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {}, {0x4, 0x14, 'syz0\x00'}}}, 0x28}, 0x1, 0x0, 0x0, 0x400c090}, 0x84) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x200, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000d00), 0x0, 0x40000020, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000380)=0x7, 0x4) 7.768201246s ago: executing program 1 (id=333): r0 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, 0x0, 0x0) r1 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000080)='#/}\x00') openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2103, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup(r2, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000340)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0x58) 7.098353423s ago: executing program 4 (id=334): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r0, &(0x7f0000001a40)=[{&(0x7f0000000500)="9d49fcbea84ffeb3313244942a4ed1513ea8ae49c7539a838ad65cadf41ee225814f1b496a75bd28329b42b272af34d6fc6d2ecb8853525ea19de9f2c39a54cb3a85d8483f2977a637334458569e7f34af67a522a7a245468378c3e6b9a256a3f5ad6d5fc6bed817c6e14d3192e7cb3485fdabe97c8f7b16792113cb6e55b1abf0b693", 0xfdef}], 0x1) 4.331153649s ago: executing program 1 (id=335): r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000840)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0x6, 0xfa00, {0x4, 0x0, 0x0, 0x3}}, 0x20) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0xc0884113, &(0x7f0000000380)={0x10000001, 0x7, 0x6a, 0x10001, 0x0, 0xffffdffffffffffd, 0x10000003, 0x0, 0x0, 0x0, 0xff7ffffb, 0x1}) 3.682663804s ago: executing program 0 (id=336): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) mkdir(&(0x7f0000000300)='./file0\x00', 0x49) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0xa8) fanotify_mark(0xffffffffffffffff, 0x441, 0x4800001a, r0, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x6, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x19}}}, 0xa0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x120) 1.950965365s ago: executing program 1 (id=337): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) writev(r0, &(0x7f0000001a40)=[{&(0x7f0000000500)="9d49fcbea84ffeb3313244942a4ed1513ea8ae49c7539a838ad65cadf41ee225814f1b496a75bd28329b42b272af34d6fc6d2ecb8853525ea19de9f2c39a54cb3a85d8483f2977a637334458569e7f34af67a522a7a245468378c3e6b9a256a3f5ad6d5fc6bed817c6e14d3192e7cb3485fdabe97c8f7b16792113cb6e55b1abf0b693", 0x83}], 0x1) 1.950739623s ago: executing program 4 (id=338): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000b5b30a40450c056055b5010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, &(0x7f0000000000)={0x40, 0x9, 0xc6, {0xc6, 0x22, "09d0930ba4e3a9ec44488164b492ea0557842ecd43eb59387f668b833c5905bed3fd6eb4a624fabfdcede1cea9da36f0c9d4656c866a2d084d82f272413fe1cb022797ca7817724b485f1bc8dab8e5491bf7bbac0845e52d65e7a9ba90b31dec42a13c3cc77a49238b404e855dfd130c944c4b29467e193b7be60b6088014dbf14431542cbedddb718a716782ba7cf68fe5682b40d52e20223b6be19c96bcc2a9c20612512e968c962c5799d0691db8ca79e59568a22546196ac213abdeeae2d8649df81"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xf0f8}}, &(0x7f0000000140)={0x0, 0x22, 0x26, {[@global=@item_4={0x3, 0x1, 0x8, "45ac8b35"}, @global=@item_012={0x2, 0x1, 0xa, "0681"}, @main=@item_4={0x3, 0x0, 0x8, "de23da03"}, @main=@item_4={0x3, 0x0, 0xb, "800c9967"}, @global=@item_012={0x2, 0x1, 0x9, "e6fc"}, @global=@item_4={0x3, 0x1, 0x3, "f5143446"}, @main=@item_012={0x0, 0x0, 0x9}, @local=@item_4={0x3, 0x2, 0x1, "22f17a47"}, @local=@item_012={0x2, 0x2, 0x4, "0f2a"}, @global=@item_012={0x2, 0x1, 0x2, "ec5e"}]}}, &(0x7f00000001c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x1, 0x2, 0x1, {0x22, 0x872}}}}, &(0x7f0000000400)={0x2c, &(0x7f0000000280)={0x20, 0xc, 0x6e, "7107d9a2a2cdddd724af5c72d67297105a1fdf35769d771082959fd3a82805deaa54faf2d6f15fe7c7f0c5340ed1cbc47b085c281df49353de7d53ecd314dc3e02ea94f5370419a09986ff086d21f38aec69ebf0ca7a57eb15452483992f26c266a40fcdf4c1aed2ca0420593e18"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0xf8}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x1a}, &(0x7f0000000380)={0x20, 0x1, 0x1, "02"}, &(0x7f00000003c0)={0x20, 0x3, 0x1, 0x40}}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000240)={0x1c, 0x0, 0x0, 0x0}) 738.591135ms ago: executing program 1 (id=339): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100"/46) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e0132004601000001") 733.809309ms ago: executing program 2 (id=340): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) (async) creat(&(0x7f0000000000)='./file0/../file0\x00', 0x80) socket$phonet_pipe(0x23, 0x5, 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet(0x2, 0x803, 0x6) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) (async) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r2 = userfaultfd(0x0) (async) r3 = socket$kcm(0x10, 0x2, 0x10) (async) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) (async) r6 = socket$xdp(0x2c, 0x3, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r8 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r9}, 0x10) (async) bind$xdp(r4, &(0x7f0000000240)={0x2c, 0x1, r5, 0x2000000, r6}, 0x10) (async) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) 0s ago: executing program 1 (id=341): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x15) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x0, &(0x7f0000000100)}) ioctl(r0, 0xc0384707, &(0x7f0000000200)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.97' (ED25519) to the list of known hosts. [ 91.676597][ T5578] cgroup: Unknown subsys name 'net' [ 91.920402][ T5578] cgroup: Unknown subsys name 'cpuset' [ 91.972894][ T5578] cgroup: Unknown subsys name 'rlimit' [ 92.193744][ T199] cfg80211: failed to load regulatory.db Setting up swapspace version 1, size = 127995904 bytes [ 94.135799][ T5578] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.837378][ T5595] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.865265][ T5595] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.886923][ T5599] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.911891][ T5599] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.927798][ T5599] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.953858][ T5599] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.956966][ T5606] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.979653][ T5602] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.980726][ T5599] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.999690][ T5599] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.016087][ T5602] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.018540][ T5602] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.021063][ T5599] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.021986][ T5599] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.023811][ T5599] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.025051][ T5599] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.029851][ T5606] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.039331][ T5602] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.039522][ T5602] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.079873][ T5595] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 99.106784][ T4906] Bluetooth: hci2: command tx timeout [ 99.185111][ T4906] Bluetooth: hci0: command tx timeout [ 99.185236][ T4906] Bluetooth: hci1: command tx timeout [ 99.264904][ T5595] Bluetooth: hci3: command tx timeout [ 99.612740][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.613016][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.613280][ T5594] bridge_slave_0: entered allmulticast mode [ 99.629490][ T5594] bridge_slave_0: entered promiscuous mode [ 99.693543][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.693830][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.694084][ T5594] bridge_slave_1: entered allmulticast mode [ 99.699040][ T5594] bridge_slave_1: entered promiscuous mode [ 99.738671][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.739006][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.739528][ T5592] bridge_slave_0: entered allmulticast mode [ 99.743928][ T5592] bridge_slave_0: entered promiscuous mode [ 99.826773][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.827058][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.827271][ T5592] bridge_slave_1: entered allmulticast mode [ 99.829842][ T5592] bridge_slave_1: entered promiscuous mode [ 99.975001][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.003690][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.004017][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.004501][ T5593] bridge_slave_0: entered allmulticast mode [ 100.007333][ T5593] bridge_slave_0: entered promiscuous mode [ 100.055607][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.056039][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.056334][ T5591] bridge_slave_0: entered allmulticast mode [ 100.059189][ T5591] bridge_slave_0: entered promiscuous mode [ 100.085172][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.095648][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.101296][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.102567][ T5593] bridge_slave_1: entered allmulticast mode [ 100.116379][ T5593] bridge_slave_1: entered promiscuous mode [ 100.131618][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.132098][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.136523][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.137294][ T5591] bridge_slave_1: entered allmulticast mode [ 100.152623][ T5591] bridge_slave_1: entered promiscuous mode [ 100.225155][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.335605][ T5594] team0: Port device team_slave_0 added [ 100.348635][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.384871][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.391193][ T5594] team0: Port device team_slave_1 added [ 100.409347][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.418848][ T5592] team0: Port device team_slave_0 added [ 100.434932][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.486052][ T5592] team0: Port device team_slave_1 added [ 100.582907][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.582925][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.582946][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.588611][ T5593] team0: Port device team_slave_0 added [ 100.650764][ T5591] team0: Port device team_slave_0 added [ 100.658253][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.658272][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.658306][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.678388][ T5593] team0: Port device team_slave_1 added [ 100.704217][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.704269][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.704345][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.739045][ T5591] team0: Port device team_slave_1 added [ 100.790377][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.790391][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.790411][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.899378][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.899392][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.899412][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.915076][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.915126][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.915195][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.001238][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.001251][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.001272][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.021736][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.021789][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.021873][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.184392][ T5595] Bluetooth: hci2: command tx timeout [ 101.262528][ T4906] Bluetooth: hci0: command tx timeout [ 101.262652][ T5595] Bluetooth: hci1: command tx timeout [ 101.342464][ T5595] Bluetooth: hci3: command tx timeout [ 101.427893][ T5594] hsr_slave_0: entered promiscuous mode [ 101.430612][ T5594] hsr_slave_1: entered promiscuous mode [ 101.479249][ T5592] hsr_slave_0: entered promiscuous mode [ 101.481023][ T5592] hsr_slave_1: entered promiscuous mode [ 101.491175][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 101.491535][ T5592] Cannot create hsr debugfs directory [ 101.634900][ T5593] hsr_slave_0: entered promiscuous mode [ 101.636673][ T5593] hsr_slave_1: entered promiscuous mode [ 101.638100][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 101.638126][ T5593] Cannot create hsr debugfs directory [ 101.720100][ T5591] hsr_slave_0: entered promiscuous mode [ 101.721921][ T5591] hsr_slave_1: entered promiscuous mode [ 101.735605][ T5591] debugfs: 'hsr0' already exists in 'hsr' [ 101.735629][ T5591] Cannot create hsr debugfs directory [ 102.700617][ T5594] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 102.768123][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.796874][ T5594] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 102.819154][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.830428][ T5594] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 102.869789][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.899358][ T5594] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 102.927465][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.107877][ T5593] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.151407][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.167553][ T5593] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.199009][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.202003][ T5593] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.251826][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.263180][ T5595] Bluetooth: hci2: command tx timeout [ 103.300971][ T5593] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.329596][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.346751][ T5595] Bluetooth: hci1: command tx timeout [ 103.346766][ T4906] Bluetooth: hci0: command tx timeout [ 103.423981][ T4906] Bluetooth: hci3: command tx timeout [ 103.566160][ T5592] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 103.609092][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.635997][ T5592] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 103.667816][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.689644][ T5592] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 103.735383][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.771406][ T5592] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 103.809518][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.971306][ T5591] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.010581][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.027370][ T5591] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.074316][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.090003][ T5591] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.127837][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.150015][ T5591] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.180039][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.280053][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.456679][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.536939][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.537120][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.580397][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.661611][ T1564] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.661910][ T1564] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.770627][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.826718][ T1564] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.826914][ T1564] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.871622][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.904303][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.904437][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.046834][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.085501][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.151046][ T158] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.151322][ T158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.238857][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.239064][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.343972][ T4906] Bluetooth: hci2: command tx timeout [ 105.345240][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.417796][ T3199] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.417975][ T3199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.423446][ T4906] Bluetooth: hci1: command tx timeout [ 105.423532][ T4906] Bluetooth: hci0: command tx timeout [ 105.496895][ T3199] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.497110][ T3199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.505681][ T5595] Bluetooth: hci3: command tx timeout [ 106.405639][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.836896][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.859845][ T5594] veth0_vlan: entered promiscuous mode [ 106.970480][ T5594] veth1_vlan: entered promiscuous mode [ 107.120429][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.291350][ T5593] veth0_vlan: entered promiscuous mode [ 107.319833][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.340610][ T5594] veth0_macvtap: entered promiscuous mode [ 107.388137][ T5594] veth1_macvtap: entered promiscuous mode [ 107.416171][ T5593] veth1_vlan: entered promiscuous mode [ 107.519207][ T5592] veth0_vlan: entered promiscuous mode [ 107.536678][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.580763][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.628221][ T5592] veth1_vlan: entered promiscuous mode [ 107.663873][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.699569][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.729598][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.763606][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.765374][ T5593] veth0_macvtap: entered promiscuous mode [ 107.787419][ T5591] veth0_vlan: entered promiscuous mode [ 107.858067][ T5593] veth1_macvtap: entered promiscuous mode [ 107.968932][ T5591] veth1_vlan: entered promiscuous mode [ 108.242428][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.276869][ T5592] veth0_macvtap: entered promiscuous mode [ 108.304929][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.358684][ T5592] veth1_macvtap: entered promiscuous mode [ 108.394976][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.400326][ T1022] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.400357][ T1022] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.415890][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.449870][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.491268][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.619610][ T5591] veth0_macvtap: entered promiscuous mode [ 108.637570][ T1518] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.637593][ T1518] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.702830][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.763980][ T5591] veth1_macvtap: entered promiscuous mode [ 108.827439][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.136433][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.139133][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.140147][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.147642][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.374641][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.446616][ T158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.446641][ T158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.517684][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.900380][ T158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.954824][ T158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.978989][ T158] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.996057][ T1564] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.996079][ T1564] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.022587][ T158] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.351024][ T5749] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 110.416933][ T1193] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.416955][ T1193] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.101005][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.101025][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.319044][ T1022] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.319066][ T1022] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.904621][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.904644][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.021392][ T5603] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 113.089112][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 113.089165][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 113.089191][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.089205][ T5595] Workqueue: hci2 hci_rx_work [ 113.089255][ T5595] Call Trace: [ 113.089264][ T5595] [ 113.089275][ T5595] dump_stack_lvl+0xe8/0x150 [ 113.089307][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 113.089334][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 113.089364][ T5595] ? rt_spin_unlock+0x163/0x200 [ 113.089397][ T5595] kobject_add_internal+0x62c/0xce0 [ 113.089433][ T5595] kobject_add+0x163/0x240 [ 113.089459][ T5595] ? rt_spin_unlock+0x157/0x200 [ 113.089495][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 113.089530][ T5595] ? get_device_parent+0x370/0x3a0 [ 113.089560][ T5595] device_add+0x3fa/0xb80 [ 113.089587][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 113.089630][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 113.089665][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 113.089692][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 113.089717][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 113.089748][ T5595] ? skb_pull_data+0xf0/0x200 [ 113.089776][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 113.089805][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 113.089836][ T5595] hci_event_packet+0x67a/0xf10 [ 113.089871][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 113.089903][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 113.089926][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 113.089961][ T5595] ? rt_spin_unlock+0x157/0x200 [ 113.090002][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 113.090034][ T5595] hci_rx_work+0x3ee/0x1020 [ 113.090077][ T5595] ? process_one_work+0x7fd/0x1480 [ 113.090110][ T5595] process_one_work+0xaaf/0x1480 [ 113.090158][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 113.090180][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 113.090218][ T5595] ? assign_work+0x3cf/0x5d0 [ 113.090247][ T5595] worker_thread+0xb05/0x10d0 [ 113.090283][ T5595] ? __kthread_parkme+0x71/0x1f0 [ 113.090321][ T5595] kthread+0x388/0x470 [ 113.090352][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 113.090376][ T5595] ? __pfx_kthread+0x10/0x10 [ 113.090408][ T5595] ret_from_fork+0x514/0xb70 [ 113.090444][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 113.090475][ T5595] ? __switch_to+0xc89/0x1420 [ 113.090505][ T5595] ? __pfx_kthread+0x10/0x10 [ 113.090537][ T5595] ret_from_fork_asm+0x1a/0x30 [ 113.090588][ T5595] [ 113.096721][ T5595] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 113.096772][ T5595] Bluetooth: hci2: failed to register connection device [ 113.448027][ T5603] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 113.448062][ T5603] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.789225][ T5781] Trying to write to read-only block-device nullb0 [ 113.958860][ T5603] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 114.550039][ T5580] usb 2-1: USB disconnect, device number 2 [ 114.666664][ T5792] device-mapper: ioctl: Invalid ioctl structure: uuid 0,, name , dev 29 [ 116.043472][ T5813] syzkaller0: entered promiscuous mode [ 116.043494][ T5813] syzkaller0: entered allmulticast mode [ 116.092766][ T5813] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 65487 [ 116.221418][ T5815] ======================================================= [ 116.221418][ T5815] WARNING: The mand mount option has been deprecated and [ 116.221418][ T5815] and is ignored by this kernel. Remove the mand [ 116.221418][ T5815] option from the mount to silence this warning. [ 116.221418][ T5815] ======================================================= [ 116.294168][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 116.294490][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 116.337789][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 116.338113][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 118.698160][ T5595] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 118.767691][ T5595] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 118.769844][ T5595] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 118.779655][ T5595] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 118.799386][ T5595] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 118.998249][ T5853] random: crng reseeded on system resumption [ 119.097689][ T1518] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.017728][ T1518] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.605144][ T5882] device-mapper: ioctl: Next dm_target_spec (offset 326) is not 8-byte aligned [ 120.605168][ T5882] device-mapper: ioctl: unable to find target [ 120.704276][ T1518] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.716266][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 120.716339][ T5595] CPU: 1 UID: 0 PID: 5595 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 120.716420][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.716460][ T5595] Workqueue: hci0 hci_rx_work [ 120.716564][ T5595] Call Trace: [ 120.716586][ T5595] [ 120.716616][ T5595] dump_stack_lvl+0xe8/0x150 [ 120.716700][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 120.716771][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 120.716857][ T5595] ? rt_spin_unlock+0x163/0x200 [ 120.716953][ T5595] kobject_add_internal+0x62c/0xce0 [ 120.717075][ T5595] kobject_add+0x163/0x240 [ 120.717140][ T5595] ? rt_spin_unlock+0x157/0x200 [ 120.717241][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 120.717361][ T5595] ? get_device_parent+0x370/0x3a0 [ 120.717457][ T5595] device_add+0x3fa/0xb80 [ 120.717530][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 120.717625][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 120.717729][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 120.717802][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 120.717868][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 120.717957][ T5595] ? skb_pull_data+0xf0/0x200 [ 120.718030][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 120.718104][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 120.718188][ T5595] hci_event_packet+0x67a/0xf10 [ 120.718274][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 120.718364][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 120.718426][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 120.718519][ T5595] ? rt_spin_unlock+0x157/0x200 [ 120.718617][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 120.718730][ T5595] hci_rx_work+0x3ee/0x1020 [ 120.718850][ T5595] ? process_one_work+0x7fd/0x1480 [ 120.718914][ T5595] process_one_work+0xaaf/0x1480 [ 120.719037][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 120.719096][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 120.719193][ T5595] ? assign_work+0x3cf/0x5d0 [ 120.719274][ T5595] worker_thread+0xb05/0x10d0 [ 120.719322][ T5595] ? __kthread_parkme+0x71/0x1f0 [ 120.719365][ T5595] kthread+0x388/0x470 [ 120.719397][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 120.719464][ T5595] ? __pfx_kthread+0x10/0x10 [ 120.719555][ T5595] ret_from_fork+0x514/0xb70 [ 120.719648][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 120.719732][ T5595] ? __switch_to+0xc89/0x1420 [ 120.719816][ T5595] ? __pfx_kthread+0x10/0x10 [ 120.719895][ T5595] ret_from_fork_asm+0x1a/0x30 [ 120.720030][ T5595] [ 120.720216][ T5595] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 120.720324][ T5595] Bluetooth: hci0: failed to register connection device [ 120.949384][ T5595] Bluetooth: hci3: command tx timeout [ 121.146980][ T5888] random: crng reseeded on system resumption [ 121.534983][ T1518] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.453164][ T38] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 122.604486][ T38] usb 3-1: not running at top speed; connect to a high speed hub [ 122.624319][ T38] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 122.624339][ T38] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 122.624377][ T38] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 122.624393][ T38] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.770702][ T38] gspca_main: spca501-2.14.0 probing 0000:0000 [ 123.033094][ T5595] Bluetooth: hci3: command tx timeout [ 123.066427][ T1518] bridge_slave_1: left allmulticast mode [ 123.066582][ T1518] bridge_slave_1: left promiscuous mode [ 123.076869][ T1518] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.247538][ T1518] bridge_slave_0: left allmulticast mode [ 123.247577][ T1518] bridge_slave_0: left promiscuous mode [ 123.248259][ T1518] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.379465][ T5907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.380205][ T5907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.381659][ T5907] netlink: 8 bytes leftover after parsing attributes in process `syz.2.51'. [ 123.501069][ T38] gspca_spca501: reg write: error -71 [ 123.501089][ T38] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 123.501183][ T38] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 123.549520][ T38] usb 3-1: USB disconnect, device number 2 [ 124.251538][ T5921] random: crng reseeded on system resumption [ 124.484340][ T1518] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 124.512937][ T199] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 124.692505][ T199] usb 2-1: Using ep0 maxpacket: 8 [ 124.695868][ T199] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 124.695935][ T199] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 124.695966][ T199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.742747][ T1518] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 124.819179][ T1518] bond0 (unregistering): Released all slaves [ 124.832376][ T199] usb 2-1: config 0 descriptor?? [ 125.107767][ T5595] Bluetooth: hci3: command tx timeout [ 125.428037][ T199] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 126.212066][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.222055][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.229933][ T5850] bridge_slave_0: entered allmulticast mode [ 126.245236][ T5850] bridge_slave_0: entered promiscuous mode [ 126.563660][ T5954] comedi comedi3: comedi_config --init_data is deprecated [ 126.594929][ T5704] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 126.783593][ T5704] usb 3-1: not running at top speed; connect to a high speed hub [ 126.789504][ T5704] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 126.789530][ T5704] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 126.789582][ T5704] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 126.789606][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.936837][ T5704] gspca_main: spca501-2.14.0 probing 0000:0000 [ 127.184920][ T5595] Bluetooth: hci3: command tx timeout [ 127.443829][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.448618][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.449265][ T5850] bridge_slave_1: entered allmulticast mode [ 127.461058][ T10] usb 2-1: USB disconnect, device number 3 [ 127.515283][ T5850] bridge_slave_1: entered promiscuous mode [ 127.550647][ T5252] 8021q: adding VLAN 0 to HW filter on device eth1 [ 127.631375][ T5947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.668414][ T5947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.717548][ T5947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.62'. [ 127.849671][ T5704] gspca_spca501: reg write: error -110 [ 127.849692][ T5704] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 127.849799][ T5704] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 127.978210][ T5704] usb 3-1: USB disconnect, device number 3 [ 128.214834][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.221872][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.479241][ T5850] team0: Port device team_slave_0 added [ 128.935318][ T5850] team0: Port device team_slave_1 added [ 129.043111][ T5704] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 129.192349][ T5704] usb 3-1: Using ep0 maxpacket: 8 [ 129.200688][ T5704] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.200741][ T5704] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 129.200765][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.322345][ T5704] usb 3-1: config 0 descriptor?? [ 129.761211][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.761227][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.761254][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.816762][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.816780][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.816805][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.874004][ T5704] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 130.498751][ T5595] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 130.855923][ T5704] usb 3-1: USB disconnect, device number 4 [ 130.983706][ T6016] overlay: filesystem on ./bus not supported as upperdir [ 131.105305][ T1518] hsr_slave_0: left promiscuous mode [ 131.147163][ T1518] hsr_slave_1: left promiscuous mode [ 131.151750][ T1518] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 131.176362][ T1518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 131.226438][ T1518] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 131.226468][ T1518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 131.498674][ T1518] veth1_macvtap: left promiscuous mode [ 131.498977][ T1518] veth0_macvtap: left promiscuous mode [ 131.547715][ T1518] veth1_vlan: left promiscuous mode [ 131.550809][ T1518] veth0_vlan: left promiscuous mode [ 131.763834][ T6026] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 131.763864][ T6026] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 131.879544][ T6026] vhci_hcd vhci_hcd.0: Device attached [ 132.094884][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 132.094912][ T5595] CPU: 1 UID: 0 PID: 5595 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 132.094939][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 132.094955][ T5595] Workqueue: hci1 hci_rx_work [ 132.094995][ T5595] Call Trace: [ 132.095008][ T5595] [ 132.095018][ T5595] dump_stack_lvl+0xe8/0x150 [ 132.095052][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 132.095080][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 132.095110][ T5595] ? rt_spin_unlock+0x163/0x200 [ 132.095145][ T5595] kobject_add_internal+0x62c/0xce0 [ 132.095182][ T5595] kobject_add+0x163/0x240 [ 132.095207][ T5595] ? rt_spin_unlock+0x157/0x200 [ 132.095243][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 132.095278][ T5595] ? get_device_parent+0x370/0x3a0 [ 132.095308][ T5595] device_add+0x3fa/0xb80 [ 132.095335][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 132.095372][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 132.095411][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 132.095438][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 132.095462][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 132.095493][ T5595] ? skb_pull_data+0xf0/0x200 [ 132.095520][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 132.095547][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 132.095577][ T5595] hci_event_packet+0x67a/0xf10 [ 132.095611][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 132.095642][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 132.095664][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 132.095699][ T5595] ? rt_spin_unlock+0x157/0x200 [ 132.095739][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 132.095771][ T5595] hci_rx_work+0x3ee/0x1020 [ 132.095813][ T5595] ? process_one_work+0x7fd/0x1480 [ 132.095837][ T5595] process_one_work+0xaaf/0x1480 [ 132.095893][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 132.095916][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 132.095955][ T5595] ? assign_work+0x3cf/0x5d0 [ 132.095984][ T5595] worker_thread+0xb05/0x10d0 [ 132.096021][ T5595] ? __kthread_parkme+0x71/0x1f0 [ 132.096081][ T5595] kthread+0x388/0x470 [ 132.096114][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 132.096137][ T5595] ? __pfx_kthread+0x10/0x10 [ 132.096169][ T5595] ret_from_fork+0x514/0xb70 [ 132.096205][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 132.096238][ T5595] ? __switch_to+0xc89/0x1420 [ 132.096269][ T5595] ? __pfx_kthread+0x10/0x10 [ 132.096301][ T5595] ret_from_fork_asm+0x1a/0x30 [ 132.096351][ T5595] [ 132.096500][ T5595] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 132.096542][ T5595] Bluetooth: hci1: failed to register connection device [ 132.148233][ T10] usb 33-1: new high-speed USB device number 2 using vhci_hcd [ 132.483986][ T6034] vhci_hcd: connection reset by peer [ 132.598601][ T1470] vhci_hcd vhci_hcd.0: stop threads [ 132.616876][ T1470] vhci_hcd vhci_hcd.0: release socket [ 132.674863][ T1470] vhci_hcd vhci_hcd.0: disconnect device [ 132.989421][ T6049] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 133.584577][ T1518] team0 (unregistering): Port device team_slave_1 removed [ 133.673617][ T1518] team0 (unregistering): Port device team_slave_0 removed [ 134.222822][ T5850] hsr_slave_0: entered promiscuous mode [ 134.225530][ T5850] hsr_slave_1: entered promiscuous mode [ 134.230444][ T5252] 8021q: adding VLAN 0 to HW filter on device eth2 [ 134.565191][ T6065] process 'syz.0.90' launched './file1' with NULL argv: empty string added [ 135.058040][ T5595] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 135.942332][ T199] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 136.092837][ T199] usb 1-1: Using ep0 maxpacket: 8 [ 136.156340][ T199] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.156393][ T199] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 136.156417][ T199] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.217036][ T199] usb 1-1: config 0 descriptor?? [ 136.481530][ T199] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 136.640909][ T5252] 8021q: adding VLAN 0 to HW filter on device eth3 [ 137.132336][ T199] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 137.285190][ T199] usb 3-1: not running at top speed; connect to a high speed hub [ 137.286454][ T199] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 137.286480][ T199] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 137.286531][ T199] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 137.286557][ T199] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.350317][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 137.589793][ T10] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 137.787797][ T6073] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 137.859199][ T5850] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 137.994711][ T5850] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 138.018625][ T6102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.019913][ T6102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.059651][ T5850] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 138.082625][ T199] gspca_spca501: reg write: error -71 [ 138.082646][ T199] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 138.082744][ T199] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 138.195949][ T199] usb 3-1: USB disconnect, device number 5 [ 138.205646][ T5850] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 138.251049][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.251202][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.276022][ T5850] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 138.365897][ T5850] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 138.380770][ T5850] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 138.518288][ T5850] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 138.808419][ T10] usb 1-1: USB disconnect, device number 2 [ 138.839080][ T6113] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 138.839110][ T6113] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 138.839223][ T6113] vhci_hcd vhci_hcd.0: Device attached [ 138.961126][ T6120] vhci_hcd: connection closed [ 138.965798][ T12] vhci_hcd vhci_hcd.1: stop threads [ 138.965825][ T12] vhci_hcd vhci_hcd.1: release socket [ 138.965867][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 139.408460][ T4906] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 139.408489][ T4906] CPU: 0 UID: 0 PID: 4906 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 139.408515][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 139.408529][ T4906] Workqueue: hci0 hci_rx_work [ 139.408565][ T4906] Call Trace: [ 139.408573][ T4906] [ 139.408581][ T4906] dump_stack_lvl+0xe8/0x150 [ 139.408609][ T4906] sysfs_create_dir_ns+0x271/0x2a0 [ 139.408631][ T4906] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 139.408654][ T4906] ? rt_spin_unlock+0x163/0x200 [ 139.408685][ T4906] kobject_add_internal+0x62c/0xce0 [ 139.408716][ T4906] kobject_add+0x163/0x240 [ 139.408736][ T4906] ? rt_spin_unlock+0x157/0x200 [ 139.408765][ T4906] ? __pfx_kobject_add+0x10/0x10 [ 139.408796][ T4906] ? get_device_parent+0x370/0x3a0 [ 139.408820][ T4906] device_add+0x3fa/0xb80 [ 139.408842][ T4906] hci_conn_add_sysfs+0xd5/0x210 [ 139.408872][ T4906] le_conn_complete_evt+0xfef/0x1580 [ 139.408902][ T4906] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 139.408924][ T4906] ? lockdep_hardirqs_on+0x7a/0x110 [ 139.408944][ T4906] ? rt_mutex_slowunlock+0x219/0x460 [ 139.408969][ T4906] ? skb_pull_data+0xf0/0x200 [ 139.408991][ T4906] hci_le_enh_conn_complete_evt+0x189/0x490 [ 139.409014][ T4906] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 139.409039][ T4906] hci_event_packet+0x67a/0xf10 [ 139.409067][ T4906] ? reacquire_held_locks+0x117/0x1a0 [ 139.409092][ T4906] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 139.409111][ T4906] ? __pfx_hci_event_packet+0x10/0x10 [ 139.409138][ T4906] ? rt_spin_unlock+0x157/0x200 [ 139.409171][ T4906] ? hci_send_to_monitor+0xe2/0x590 [ 139.409206][ T4906] hci_rx_work+0x3ee/0x1020 [ 139.409242][ T4906] ? process_one_work+0x7fd/0x1480 [ 139.409262][ T4906] process_one_work+0xaaf/0x1480 [ 139.409299][ T4906] ? __pfx_process_one_work+0x10/0x10 [ 139.409316][ T4906] ? do_raw_spin_lock+0x12b/0x2f0 [ 139.409347][ T4906] ? assign_work+0x3cf/0x5d0 [ 139.409371][ T4906] worker_thread+0xb05/0x10d0 [ 139.409405][ T4906] ? __kthread_parkme+0x71/0x1f0 [ 139.409435][ T4906] kthread+0x388/0x470 [ 139.409460][ T4906] ? __pfx_worker_thread+0x10/0x10 [ 139.409478][ T4906] ? __pfx_kthread+0x10/0x10 [ 139.409503][ T4906] ret_from_fork+0x514/0xb70 [ 139.409532][ T4906] ? __pfx_ret_from_fork+0x10/0x10 [ 139.409557][ T4906] ? __switch_to+0xc89/0x1420 [ 139.409581][ T4906] ? __pfx_kthread+0x10/0x10 [ 139.409607][ T4906] ret_from_fork_asm+0x1a/0x30 [ 139.409646][ T4906] [ 139.409946][ T4906] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 139.409984][ T4906] Bluetooth: hci0: failed to register connection device [ 139.764075][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 139.826357][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.867613][ T1518] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.867739][ T1518] bridge0: port 1(bridge_slave_0) entered forwarding state [ 140.090281][ T1518] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.090437][ T1518] bridge0: port 2(bridge_slave_1) entered forwarding state [ 140.140445][ T6141] FAULT_INJECTION: forcing a failure. [ 140.140445][ T6141] name failslab, interval 1, probability 0, space 0, times 1 [ 140.140481][ T6141] CPU: 1 UID: 0 PID: 6141 Comm: syz.1.103 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 140.140545][ T6141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 140.140558][ T6141] Call Trace: [ 140.140565][ T6141] [ 140.140574][ T6141] dump_stack_lvl+0xe8/0x150 [ 140.140610][ T6141] should_fail_ex+0x467/0x600 [ 140.140641][ T6141] should_failslab+0xa8/0x100 [ 140.140662][ T6141] __kmalloc_cache_noprof+0xa1/0x670 [ 140.140693][ T6141] ? dev_ethtool+0x13f/0x29d0 [ 140.140715][ T6141] ? dev_ethtool+0x13f/0x29d0 [ 140.140755][ T6141] dev_ethtool+0x13f/0x29d0 [ 140.140779][ T6141] ? __lock_acquire+0x6df/0x2e40 [ 140.140817][ T6141] ? __pfx_dev_ethtool+0x10/0x10 [ 140.140850][ T6141] ? lock_acquire+0x115/0x350 [ 140.140889][ T6141] ? dev_load+0x21/0x1f0 [ 140.140918][ T6141] ? dev_load+0x21/0x1f0 [ 140.140946][ T6141] dev_ioctl+0x392/0x1150 [ 140.140978][ T6141] sock_do_ioctl+0x23e/0x320 [ 140.141005][ T6141] ? __pfx_sock_do_ioctl+0x10/0x10 [ 140.141030][ T6141] ? lockdep_hardirqs_on+0x7a/0x110 [ 140.141063][ T6141] sock_ioctl+0x57d/0x7f0 [ 140.141087][ T6141] ? __pfx_sock_ioctl+0x10/0x10 [ 140.141113][ T6141] ? __fget_files+0x3a8/0x420 [ 140.141136][ T6141] ? __fget_files+0x2a/0x420 [ 140.141161][ T6141] ? bpf_lsm_file_ioctl+0x9/0x20 [ 140.141195][ T6141] ? __pfx_sock_ioctl+0x10/0x10 [ 140.141217][ T6141] __se_sys_ioctl+0xff/0x170 [ 140.141251][ T6141] do_syscall_64+0x17b/0x530 [ 140.141272][ T6141] ? irqentry_exit+0x10f/0x8f0 [ 140.141294][ T6141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.141315][ T6141] ? clear_bhb_loop+0x40/0x90 [ 140.141339][ T6141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.141360][ T6141] RIP: 0033:0x7fdbe42ae0d9 [ 140.141389][ T6141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.141406][ T6141] RSP: 002b:00007fdbe2506028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 140.141427][ T6141] RAX: ffffffffffffffda RBX: 00007fdbe4535fa0 RCX: 00007fdbe42ae0d9 [ 140.141443][ T6141] RDX: 0000200000000000 RSI: 0000000000008946 RDI: 0000000000000003 [ 140.141457][ T6141] RBP: 00007fdbe2506090 R08: 0000000000000000 R09: 0000000000000000 [ 140.141470][ T6141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 140.141482][ T6141] R13: 00007fdbe4536038 R14: 00007fdbe4535fa0 R15: 00007ffc6da2b888 [ 140.141517][ T6141] [ 140.574693][ T5252] 8021q: adding VLAN 0 to HW filter on device eth4 [ 141.402561][ T10] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 141.586383][ T10] usb 1-1: not running at top speed; connect to a high speed hub [ 141.587899][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 141.587925][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 141.587978][ T10] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 141.588002][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.712739][ T10] gspca_main: spca501-2.14.0 probing 0000:0000 [ 142.064804][ T5704] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 142.131109][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 142.237182][ T5704] usb 3-1: Using ep0 maxpacket: 8 [ 142.248049][ T5704] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 142.248101][ T5704] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 142.248125][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.297291][ T5704] usb 3-1: config 0 descriptor?? [ 142.435403][ T6176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.466280][ T6176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.547518][ T5704] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 142.590304][ T10] gspca_spca501: reg write: error -110 [ 142.590320][ T10] spca501 1-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 142.590386][ T10] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 142.929092][ T5850] veth0_vlan: entered promiscuous mode [ 142.953250][ T5850] veth1_vlan: entered promiscuous mode [ 143.025080][ T5850] veth0_macvtap: entered promiscuous mode [ 143.052992][ T5850] veth1_macvtap: entered promiscuous mode [ 143.120313][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 143.140810][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 143.167223][ T1193] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.168406][ T1193] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.168452][ T1193] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.168492][ T1193] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.620133][ T6144] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 143.798205][ T10] usb 1-1: USB disconnect, device number 3 [ 144.044642][ T1518] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.044664][ T1518] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.216989][ T4906] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 144.217017][ T4906] CPU: 0 UID: 0 PID: 4906 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 144.217043][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.217058][ T4906] Workqueue: hci1 hci_rx_work [ 144.217099][ T4906] Call Trace: [ 144.217108][ T4906] [ 144.217118][ T4906] dump_stack_lvl+0xe8/0x150 [ 144.217152][ T4906] sysfs_create_dir_ns+0x271/0x2a0 [ 144.217179][ T4906] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 144.217209][ T4906] ? rt_spin_unlock+0x163/0x200 [ 144.217243][ T4906] kobject_add_internal+0x62c/0xce0 [ 144.217281][ T4906] kobject_add+0x163/0x240 [ 144.217306][ T4906] ? rt_spin_unlock+0x157/0x200 [ 144.217343][ T4906] ? __pfx_kobject_add+0x10/0x10 [ 144.217378][ T4906] ? get_device_parent+0x370/0x3a0 [ 144.217408][ T4906] device_add+0x3fa/0xb80 [ 144.217446][ T4906] hci_conn_add_sysfs+0xd5/0x210 [ 144.217484][ T4906] le_conn_complete_evt+0xfef/0x1580 [ 144.217523][ T4906] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 144.217555][ T4906] ? lockdep_hardirqs_on+0x7a/0x110 [ 144.217580][ T4906] ? rt_mutex_slowunlock+0x219/0x460 [ 144.217612][ T4906] ? skb_pull_data+0xf0/0x200 [ 144.217640][ T4906] hci_le_enh_conn_complete_evt+0x189/0x490 [ 144.217669][ T4906] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 144.217701][ T4906] hci_event_packet+0x67a/0xf10 [ 144.217736][ T4906] ? reacquire_held_locks+0x117/0x1a0 [ 144.217768][ T4906] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 144.217792][ T4906] ? __pfx_hci_event_packet+0x10/0x10 [ 144.217827][ T4906] ? rt_spin_unlock+0x157/0x200 [ 144.217868][ T4906] ? hci_send_to_monitor+0xe2/0x590 [ 144.217901][ T4906] hci_rx_work+0x3ee/0x1020 [ 144.217945][ T4906] ? process_one_work+0x7fd/0x1480 [ 144.217969][ T4906] process_one_work+0xaaf/0x1480 [ 144.218018][ T4906] ? __pfx_process_one_work+0x10/0x10 [ 144.218039][ T4906] ? do_raw_spin_lock+0x12b/0x2f0 [ 144.218078][ T4906] ? assign_work+0x3cf/0x5d0 [ 144.218108][ T4906] worker_thread+0xb05/0x10d0 [ 144.218145][ T4906] ? __kthread_parkme+0x71/0x1f0 [ 144.218184][ T4906] kthread+0x388/0x470 [ 144.218215][ T4906] ? __pfx_worker_thread+0x10/0x10 [ 144.218240][ T4906] ? __pfx_kthread+0x10/0x10 [ 144.218273][ T4906] ret_from_fork+0x514/0xb70 [ 144.218309][ T4906] ? __pfx_ret_from_fork+0x10/0x10 [ 144.218342][ T4906] ? __switch_to+0xc89/0x1420 [ 144.218373][ T4906] ? __pfx_kthread+0x10/0x10 [ 144.218406][ T4906] ret_from_fork_asm+0x1a/0x30 [ 144.218466][ T4906] [ 144.218524][ T4906] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 144.218564][ T4906] Bluetooth: hci1: failed to register connection device [ 144.258207][ T1470] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.258271][ T1470] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.850562][ T5603] usb 3-1: USB disconnect, device number 6 [ 144.924192][ T6190] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 144.924220][ T6190] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 144.924317][ T6190] vhci_hcd vhci_hcd.0: Device attached [ 145.070032][ T6194] vhci_hcd: connection closed [ 145.091168][ T12] vhci_hcd vhci_hcd.0: stop threads [ 145.091196][ T12] vhci_hcd vhci_hcd.0: release socket [ 145.091242][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 145.115856][ T6197] warning: `syz.2.112' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 145.163673][ T6197] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 145.493048][ T6200] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 146.223216][ T822] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 146.384368][ T4906] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 146.384389][ T4906] CPU: 0 UID: 0 PID: 4906 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 146.384408][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.384419][ T4906] Workqueue: hci3 hci_rx_work [ 146.384450][ T4906] Call Trace: [ 146.384455][ T4906] [ 146.384463][ T4906] dump_stack_lvl+0xe8/0x150 [ 146.384488][ T4906] sysfs_create_dir_ns+0x271/0x2a0 [ 146.384507][ T4906] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 146.384528][ T4906] ? rt_spin_unlock+0x163/0x200 [ 146.384580][ T4906] kobject_add_internal+0x62c/0xce0 [ 146.384625][ T4906] kobject_add+0x163/0x240 [ 146.384652][ T4906] ? rt_spin_unlock+0x157/0x200 [ 146.384691][ T4906] ? __pfx_kobject_add+0x10/0x10 [ 146.384716][ T4906] ? get_device_parent+0x370/0x3a0 [ 146.384737][ T4906] device_add+0x3fa/0xb80 [ 146.384756][ T4906] hci_conn_add_sysfs+0xd5/0x210 [ 146.384783][ T4906] le_conn_complete_evt+0xfef/0x1580 [ 146.384810][ T4906] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 146.384829][ T4906] ? lockdep_hardirqs_on+0x7a/0x110 [ 146.384866][ T4906] ? rt_mutex_slowunlock+0x219/0x460 [ 146.384898][ T4906] ? skb_pull_data+0xf0/0x200 [ 146.384926][ T4906] hci_le_enh_conn_complete_evt+0x189/0x490 [ 146.384956][ T4906] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 146.384989][ T4906] hci_event_packet+0x67a/0xf10 [ 146.385026][ T4906] ? reacquire_held_locks+0x117/0x1a0 [ 146.385049][ T4906] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 146.385065][ T4906] ? __pfx_hci_event_packet+0x10/0x10 [ 146.385093][ T4906] ? rt_spin_unlock+0x157/0x200 [ 146.385125][ T4906] ? hci_send_to_monitor+0xe2/0x590 [ 146.385147][ T4906] hci_rx_work+0x3ee/0x1020 [ 146.385178][ T4906] ? process_one_work+0x7fd/0x1480 [ 146.385195][ T4906] process_one_work+0xaaf/0x1480 [ 146.385227][ T4906] ? __pfx_process_one_work+0x10/0x10 [ 146.385242][ T4906] ? do_raw_spin_lock+0x12b/0x2f0 [ 146.385269][ T4906] ? assign_work+0x3cf/0x5d0 [ 146.385289][ T4906] worker_thread+0xb05/0x10d0 [ 146.385314][ T4906] ? __kthread_parkme+0x71/0x1f0 [ 146.385340][ T4906] kthread+0x388/0x470 [ 146.385362][ T4906] ? __pfx_worker_thread+0x10/0x10 [ 146.385378][ T4906] ? __pfx_kthread+0x10/0x10 [ 146.385400][ T4906] ret_from_fork+0x514/0xb70 [ 146.385425][ T4906] ? __pfx_ret_from_fork+0x10/0x10 [ 146.385447][ T4906] ? __switch_to+0xc89/0x1420 [ 146.385468][ T4906] ? __pfx_kthread+0x10/0x10 [ 146.385491][ T4906] ret_from_fork_asm+0x1a/0x30 [ 146.385525][ T4906] [ 146.385569][ T4906] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 146.385600][ T4906] Bluetooth: hci3: failed to register connection device [ 146.688006][ T822] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 146.688041][ T822] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.926438][ T822] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 147.132856][ T5603] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 147.192471][ T199] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 147.302358][ T5603] usb 5-1: Using ep0 maxpacket: 8 [ 147.306699][ T5603] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 147.306750][ T5603] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 147.306775][ T5603] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.326366][ T5603] usb 5-1: config 0 descriptor?? [ 147.369287][ T199] usb 3-1: not running at top speed; connect to a high speed hub [ 147.370868][ T199] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 147.370894][ T199] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 147.370949][ T199] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 147.370973][ T199] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.460735][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 147.733915][ T5603] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 148.147326][ T6229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 148.154829][ T6229] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.372557][ T199] gspca_spca501: reg write: error -110 [ 148.372579][ T199] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 148.372677][ T199] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 149.077854][ T6209] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 149.109696][ T199] usb 3-1: USB disconnect, device number 7 [ 149.417913][ T6231] overlayfs: failed to resolve './bus': -2 [ 149.945442][ T6236] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 149.945470][ T6236] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 149.961992][ T6236] vhci_hcd vhci_hcd.0: Device attached [ 150.001097][ T822] usb 5-1: USB disconnect, device number 2 [ 150.109508][ T6238] vhci_hcd: connection closed [ 150.146492][ T12] vhci_hcd vhci_hcd.2: stop threads [ 150.146522][ T12] vhci_hcd vhci_hcd.2: release socket [ 150.146591][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 150.232338][ T5603] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 150.353282][ T6241] FAULT_INJECTION: forcing a failure. [ 150.353282][ T6241] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 150.353322][ T6241] CPU: 0 UID: 0 PID: 6241 Comm: syz.4.124 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 150.353345][ T6241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.353357][ T6241] Call Trace: [ 150.353365][ T6241] [ 150.353374][ T6241] dump_stack_lvl+0xe8/0x150 [ 150.353408][ T6241] should_fail_ex+0x467/0x600 [ 150.353449][ T6241] _copy_from_user+0x2d/0xb0 [ 150.353473][ T6241] __sys_sendto+0x2b5/0x5d0 [ 150.353510][ T6241] ? __pfx___sys_sendto+0x10/0x10 [ 150.353570][ T6241] ? do_user_addr_fault+0xc4a/0x1340 [ 150.353608][ T6241] __x64_sys_sendto+0xde/0x100 [ 150.353657][ T6241] do_syscall_64+0x17b/0x530 [ 150.353681][ T6241] ? irqentry_exit+0x10f/0x8f0 [ 150.353701][ T6241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.353723][ T6241] ? clear_bhb_loop+0x40/0x90 [ 150.353753][ T6241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.353769][ T6241] RIP: 0033:0x7f9795ebe90e [ 150.353783][ T6241] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 150.353814][ T6241] RSP: 002b:00007f9794154e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 150.353838][ T6241] RAX: ffffffffffffffda RBX: 00007f97941566c0 RCX: 00007f9795ebe90e [ 150.353856][ T6241] RDX: 0000000000000020 RSI: 00007f9794155000 RDI: 0000000000000003 [ 150.353869][ T6241] RBP: 0000000000000000 R08: 00007f9794154f04 R09: 000000000000000c [ 150.353882][ T6241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 150.353893][ T6241] R13: 00007f9794154f58 R14: 00007f9794155000 R15: 0000000000000000 [ 150.353932][ T6241] [ 151.190498][ T4906] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 151.190527][ T4906] CPU: 0 UID: 0 PID: 4906 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 151.190553][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 151.190568][ T4906] Workqueue: hci2 hci_rx_work [ 151.190610][ T4906] Call Trace: [ 151.190619][ T4906] [ 151.190628][ T4906] dump_stack_lvl+0xe8/0x150 [ 151.190662][ T4906] sysfs_create_dir_ns+0x271/0x2a0 [ 151.190689][ T4906] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 151.190718][ T4906] ? rt_spin_unlock+0x163/0x200 [ 151.190754][ T4906] kobject_add_internal+0x62c/0xce0 [ 151.190791][ T4906] kobject_add+0x163/0x240 [ 151.190811][ T4906] ? rt_spin_unlock+0x157/0x200 [ 151.190840][ T4906] ? __pfx_kobject_add+0x10/0x10 [ 151.190872][ T4906] ? get_device_parent+0x370/0x3a0 [ 151.190900][ T4906] device_add+0x3fa/0xb80 [ 151.190925][ T4906] hci_conn_add_sysfs+0xd5/0x210 [ 151.190960][ T4906] le_conn_complete_evt+0xfef/0x1580 [ 151.190995][ T4906] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 151.191019][ T4906] ? lockdep_hardirqs_on+0x7a/0x110 [ 151.191043][ T4906] ? rt_mutex_slowunlock+0x219/0x460 [ 151.191073][ T4906] ? skb_pull_data+0xf0/0x200 [ 151.191099][ T4906] hci_le_enh_conn_complete_evt+0x189/0x490 [ 151.191123][ T4906] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 151.191148][ T4906] hci_event_packet+0x67a/0xf10 [ 151.191183][ T4906] ? reacquire_held_locks+0x117/0x1a0 [ 151.191213][ T4906] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 151.191235][ T4906] ? __pfx_hci_event_packet+0x10/0x10 [ 151.191269][ T4906] ? rt_spin_unlock+0x157/0x200 [ 151.191308][ T4906] ? hci_send_to_monitor+0xe2/0x590 [ 151.191340][ T4906] hci_rx_work+0x3ee/0x1020 [ 151.191396][ T4906] ? process_one_work+0x7fd/0x1480 [ 151.191424][ T4906] process_one_work+0xaaf/0x1480 [ 151.191468][ T4906] ? __pfx_process_one_work+0x10/0x10 [ 151.191488][ T4906] ? do_raw_spin_lock+0x12b/0x2f0 [ 151.191525][ T4906] ? assign_work+0x3cf/0x5d0 [ 151.191554][ T4906] worker_thread+0xb05/0x10d0 [ 151.191586][ T4906] ? __kthread_parkme+0x71/0x1f0 [ 151.191621][ T4906] kthread+0x388/0x470 [ 151.191651][ T4906] ? __pfx_worker_thread+0x10/0x10 [ 151.191672][ T4906] ? __pfx_kthread+0x10/0x10 [ 151.191702][ T4906] ret_from_fork+0x514/0xb70 [ 151.191737][ T4906] ? __pfx_ret_from_fork+0x10/0x10 [ 151.191768][ T4906] ? __switch_to+0xc89/0x1420 [ 151.191795][ T4906] ? __pfx_kthread+0x10/0x10 [ 151.191824][ T4906] ret_from_fork_asm+0x1a/0x30 [ 151.191871][ T4906] [ 151.192002][ T4906] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 151.192044][ T4906] Bluetooth: hci2: failed to register connection device [ 151.717832][ T6256] overlayfs: failed to resolve './bus': -2 [ 151.981821][ T6269] netlink: 164 bytes leftover after parsing attributes in process `syz.0.132'. [ 152.280201][ T5580] usb 2-1: USB disconnect, device number 4 [ 152.772514][ T5580] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 152.932330][ T5580] usb 2-1: Using ep0 maxpacket: 8 [ 152.934968][ T5580] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 152.935022][ T5580] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 152.935048][ T5580] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.997688][ T5580] usb 2-1: config 0 descriptor?? [ 153.013189][ T6287] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 153.013218][ T6287] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 153.015798][ T6287] vhci_hcd vhci_hcd.0: Device attached [ 153.066510][ T6291] vhci_hcd: connection closed [ 153.070084][ T13] vhci_hcd vhci_hcd.4: stop threads [ 153.070291][ T13] vhci_hcd vhci_hcd.4: release socket [ 153.070333][ T13] vhci_hcd vhci_hcd.4: disconnect device [ 153.228534][ T5580] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 153.341822][ T4906] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 153.456633][ T6302] overlayfs: failed to resolve './bus': -2 [ 153.467954][ T6303] syz.2.138 uses obsolete (PF_INET,SOCK_PACKET) [ 154.041787][ T6318] FAULT_INJECTION: forcing a failure. [ 154.041787][ T6318] name failslab, interval 1, probability 0, space 0, times 0 [ 154.041825][ T6318] CPU: 1 UID: 0 PID: 6318 Comm: syz.4.141 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 154.041850][ T6318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 154.041863][ T6318] Call Trace: [ 154.041871][ T6318] [ 154.041882][ T6318] dump_stack_lvl+0xe8/0x150 [ 154.041916][ T6318] should_fail_ex+0x467/0x600 [ 154.041950][ T6318] should_failslab+0xa8/0x100 [ 154.041971][ T6318] ? mas_alloc_nodes+0x291/0x350 [ 154.041992][ T6318] kmem_cache_alloc_noprof+0x9e/0x680 [ 154.042024][ T6318] ? mas_alloc_nodes+0x291/0x350 [ 154.042052][ T6318] mas_alloc_nodes+0x291/0x350 [ 154.042077][ T6318] mas_preallocate+0x437/0x850 [ 154.042106][ T6318] ? mt_find+0x186/0x630 [ 154.042130][ T6318] ? __pfx_mas_preallocate+0x10/0x10 [ 154.042164][ T6318] ? __mas_set_range+0x11a/0x3a0 [ 154.042202][ T6318] vma_link+0x123/0x470 [ 154.042228][ T6318] ? __pfx_vma_link+0x10/0x10 [ 154.042264][ T6318] ? vma_set_pgoff+0x1e8/0x2d0 [ 154.042292][ T6318] insert_vm_struct+0x19d/0x270 [ 154.042322][ T6318] create_init_stack_vma+0x5c1/0x9b0 [ 154.042347][ T6318] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 154.042379][ T6318] ? __pfx_create_init_stack_vma+0x10/0x10 [ 154.042412][ T6318] ? rt_spin_unlock+0x157/0x200 [ 154.042446][ T6318] ? rt_spin_unlock+0x163/0x200 [ 154.042479][ T6318] alloc_bprm+0x50c/0x640 [ 154.042510][ T6318] do_execveat_common+0x172/0x670 [ 154.042546][ T6318] __x64_sys_execve+0x97/0xc0 [ 154.042576][ T6318] do_syscall_64+0x17b/0x530 [ 154.042598][ T6318] ? irqentry_exit+0x10f/0x8f0 [ 154.042618][ T6318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.042641][ T6318] ? clear_bhb_loop+0x40/0x90 [ 154.042669][ T6318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.042691][ T6318] RIP: 0033:0x7f9795efe0d9 [ 154.042711][ T6318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.042729][ T6318] RSP: 002b:00007f9794156028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 154.042752][ T6318] RAX: ffffffffffffffda RBX: 00007f9796185fa0 RCX: 00007f9795efe0d9 [ 154.042769][ T6318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 154.042782][ T6318] RBP: 00007f9794156090 R08: 0000000000000000 R09: 0000000000000000 [ 154.042795][ T6318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 154.042807][ T6318] R13: 00007f9796186038 R14: 00007f9796185fa0 R15: 00007ffd62bfc748 [ 154.042841][ T6318] [ 154.808223][ T5580] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 154.974407][ T5580] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 154.974441][ T5580] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.236168][ T5580] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 155.477970][ T10] usb 2-1: USB disconnect, device number 5 [ 155.479990][ T5580] usb 5-1: USB disconnect, device number 3 [ 156.061385][ T5595] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 156.541950][ T6368] netlink: 36 bytes leftover after parsing attributes in process `syz.4.150'. [ 156.575180][ T6365] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 156.575213][ T6365] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 156.594764][ T6365] vhci_hcd vhci_hcd.0: Device attached [ 156.620003][ T6374] vhci_hcd: connection closed [ 156.660920][ T13] vhci_hcd vhci_hcd.1: stop threads [ 156.660952][ T13] vhci_hcd vhci_hcd.1: release socket [ 156.660996][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 157.302440][ T822] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 157.462261][ T822] usb 1-1: Using ep0 maxpacket: 8 [ 157.469179][ T822] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 157.469231][ T822] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 157.469256][ T822] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.547355][ T822] usb 1-1: config 0 descriptor?? [ 157.771340][ T822] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 157.932314][ T5580] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 158.095895][ T5580] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 158.095929][ T5580] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.361614][ T5580] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 158.634088][ T5580] usb 5-1: USB disconnect, device number 4 [ 159.042486][ T5704] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 159.182341][ T5704] usb 3-1: device descriptor read/64, error -71 [ 159.423707][ T5704] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 159.562490][ T5704] usb 3-1: device descriptor read/64, error -71 [ 159.604543][ T6415] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 159.610705][ T6415] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 159.627447][ T6415] vhci_hcd vhci_hcd.0: Device attached [ 159.629310][ T6417] vhci_hcd: connection closed [ 159.629831][ T1022] vhci_hcd vhci_hcd.4: stop threads [ 159.629854][ T1022] vhci_hcd vhci_hcd.4: release socket [ 159.629884][ T1022] vhci_hcd vhci_hcd.4: disconnect device [ 159.676266][ T5704] usb usb3-port1: attempt power cycle [ 160.043195][ T5704] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 160.086134][ T5597] usb 1-1: USB disconnect, device number 4 [ 160.093137][ T5704] usb 3-1: device descriptor read/8, error -71 [ 160.343003][ T5704] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 160.364126][ T5704] usb 3-1: device descriptor read/8, error -71 [ 160.472666][ T5704] usb usb3-port1: unable to enumerate USB device [ 160.502391][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 160.684492][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 160.684532][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 160.684548][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 160.684579][ T10] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 160.684596][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.761752][ T10] usb 2-1: config 0 descriptor?? [ 161.363897][ T10] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 161.822418][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 161.912390][ T5704] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 161.974782][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 161.974806][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.075337][ T5704] usb 5-1: not running at top speed; connect to a high speed hub [ 162.079010][ T5704] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 162.079039][ T5704] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 162.079098][ T5704] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 162.079129][ T5704] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.165714][ T5704] gspca_main: spca501-2.14.0 probing 0000:0000 [ 162.249377][ T10] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 162.462478][ T10] usb 1-1: USB disconnect, device number 5 [ 162.671828][ T6451] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 162.671858][ T6451] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 162.692574][ T6451] vhci_hcd vhci_hcd.0: Device attached [ 162.694670][ T6454] vhci_hcd: connection closed [ 162.695187][ T1022] vhci_hcd vhci_hcd.2: stop threads [ 162.695213][ T1022] vhci_hcd vhci_hcd.2: release socket [ 162.740957][ T1022] vhci_hcd vhci_hcd.2: disconnect device [ 162.771261][ T6441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.797215][ T6441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.807321][ T6441] netlink: 8 bytes leftover after parsing attributes in process `syz.4.174'. [ 162.861959][ T5704] gspca_spca501: reg write: error -71 [ 162.861980][ T5704] spca501 5-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 162.862072][ T5704] spca501 5-1:1.0: probe with driver spca501 failed with error -22 [ 162.907387][ T5704] usb 5-1: USB disconnect, device number 5 [ 163.861356][ T10] usb 2-1: USB disconnect, device number 6 [ 163.977717][ T6465] netlink: 132 bytes leftover after parsing attributes in process `syz.2.183'. [ 164.631934][ T6485] can0: slcan on ttynull. [ 164.776993][ T5595] Bluetooth: Frame is too long (len 12, expected len 4) [ 164.806921][ T6492] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(10) [ 165.343886][ T6507] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 165.343919][ T6507] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 165.344038][ T6507] vhci_hcd vhci_hcd.0: Device attached [ 165.347492][ T6512] vhci_hcd: connection closed [ 165.370116][ T1470] vhci_hcd vhci_hcd.0: stop threads [ 165.370145][ T1470] vhci_hcd vhci_hcd.0: release socket [ 165.370184][ T1470] vhci_hcd vhci_hcd.0: disconnect device [ 165.393394][ T10] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 165.583955][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 165.585673][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 165.585698][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 165.585753][ T10] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 165.585783][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.735523][ T10] gspca_main: spca501-2.14.0 probing 0000:0000 [ 165.979830][ T6484] can0 (unregistered): slcan off ttynull. [ 166.295176][ T6529] Zero length message leads to an empty skb [ 166.426094][ T6504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.426973][ T6504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 166.474284][ T6504] netlink: 8 bytes leftover after parsing attributes in process `syz.2.191'. [ 166.656697][ T10] gspca_spca501: reg write: error -110 [ 166.656716][ T10] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 166.656810][ T10] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 166.694512][ T10] usb 3-1: USB disconnect, device number 12 [ 167.457444][ T5704] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 167.576537][ T6564] overlayfs: missing 'lowerdir' [ 167.612399][ T5704] usb 5-1: Using ep0 maxpacket: 8 [ 167.619018][ T5704] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 167.619073][ T5704] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 167.619090][ T5704] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.680794][ T5704] usb 5-1: config 0 descriptor?? [ 167.944660][ T5704] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 168.057019][ T6571] fuse: Bad value for 'fd' [ 168.072565][ T6572] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 168.072595][ T6572] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 168.077242][ T6572] vhci_hcd vhci_hcd.0: Device attached [ 168.102461][ T6573] vhci_hcd: connection closed [ 168.104198][ T3199] vhci_hcd vhci_hcd.0: stop threads [ 168.104224][ T3199] vhci_hcd vhci_hcd.0: release socket [ 168.104263][ T3199] vhci_hcd vhci_hcd.0: disconnect device [ 168.512333][ T5791] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 168.673442][ T5791] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 168.673488][ T5791] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 168.673544][ T5791] usb 2-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 168.673578][ T5791] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.717104][ T5791] usb 2-1: config 0 descriptor?? [ 169.130375][ T5791] hid-led 0003:1294:1320.0002: reserved main item tag 0xd [ 169.130417][ T5791] hid-led 0003:1294:1320.0002: reserved main item tag 0xe [ 169.191307][ T5791] hid-led 0003:1294:1320.0002: hidraw0: USB HID v0.00 Device [HID 1294:1320] on usb-dummy_hcd.1-1/input0 [ 169.263915][ T5791] hid-led 0003:1294:1320.0002: Riso Kagaku Webmail Notifier initialized [ 169.339786][ T5791] usb 2-1: USB disconnect, device number 7 [ 169.422500][ T199] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 169.466409][ T13] leds riso_kagaku0:blue: Setting an LED's brightness failed (-38) [ 169.507787][ T1033] leds riso_kagaku0:green: Setting an LED's brightness failed (-38) [ 169.527711][ T1022] leds riso_kagaku0:red: Setting an LED's brightness failed (-38) [ 169.574585][ T199] usb 1-1: not running at top speed; connect to a high speed hub [ 169.576213][ T199] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 169.576273][ T199] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 169.576364][ T199] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 169.576390][ T199] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.665463][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 170.217148][ T5791] usb 5-1: USB disconnect, device number 6 [ 170.317180][ T6593] overlayfs: missing 'lowerdir' [ 170.356688][ T6595] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 170.357328][ T6595] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 170.561287][ T199] gspca_spca501: reg write: error -71 [ 170.561307][ T199] spca501 1-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 170.561401][ T199] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 170.598653][ T199] usb 1-1: USB disconnect, device number 6 [ 170.815679][ T6604] fuse: Bad value for 'fd' [ 171.437446][ T6619] overlayfs: missing 'lowerdir' [ 171.602224][ T199] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 171.752239][ T199] usb 3-1: Using ep0 maxpacket: 8 [ 171.755706][ T199] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 171.755756][ T199] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 171.755780][ T199] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.817102][ T199] usb 3-1: config 0 descriptor?? [ 171.900656][ T6627] fuse: Bad value for 'fd' [ 172.041604][ T199] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 172.382351][ T199] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 172.535299][ T199] usb 2-1: not running at top speed; connect to a high speed hub [ 172.536671][ T199] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 172.536704][ T199] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 172.536756][ T199] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 172.536773][ T199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.552308][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 172.623954][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 172.728612][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 172.728647][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.063992][ T10] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 173.179399][ T10] usb 5-1: USB disconnect, device number 7 [ 173.296195][ T6634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.308918][ T6634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.332949][ T6634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.229'. [ 173.360398][ T199] gspca_spca501: reg write: error -71 [ 173.360429][ T199] spca501 2-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 173.360522][ T199] spca501 2-1:1.0: probe with driver spca501 failed with error -22 [ 173.408759][ T199] usb 2-1: USB disconnect, device number 8 [ 173.453016][ T6648] overlayfs: missing 'lowerdir' [ 173.625186][ T5595] Bluetooth: hci0: Invalid handle: 0x70bc > 0x0eff [ 174.418953][ T822] usb 3-1: USB disconnect, device number 13 [ 174.549682][ T4906] Bluetooth: hci2: Invalid handle: 0x70bc > 0x0eff [ 174.632554][ T10] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 174.743812][ T6680] sctp: [Deprecated]: syz.2.246 (pid 6680) Use of struct sctp_assoc_value in delayed_ack socket option. [ 174.743812][ T6680] Use struct sctp_sack_info instead [ 174.783212][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 174.788095][ T10] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 174.788123][ T10] usb 1-1: config 0 has no interface number 0 [ 174.788162][ T10] usb 1-1: config 0 interface 12 has no altsetting 0 [ 174.820522][ T10] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 174.820553][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.820574][ T10] usb 1-1: Product: syz [ 174.820589][ T10] usb 1-1: Manufacturer: syz [ 174.820604][ T10] usb 1-1: SerialNumber: syz [ 174.863093][ T10] usb 1-1: config 0 descriptor?? [ 175.585797][ T199] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 175.781340][ T199] usb 2-1: not running at top speed; connect to a high speed hub [ 175.791162][ T199] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 175.791191][ T199] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 175.791311][ T199] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 175.791336][ T199] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.923371][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 176.037352][ T6671] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 176.288463][ T10] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 176.288523][ T10] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 176.288587][ T10] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 176.288671][ T10] f81534 1-1:0.12: probe with driver f81534 failed with error -71 [ 176.346091][ T10] usb 1-1: USB disconnect, device number 7 [ 176.522600][ T5597] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 176.546203][ T6686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.546821][ T6686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.551834][ T6686] netlink: 8 bytes leftover after parsing attributes in process `syz.1.249'. [ 176.582802][ T199] gspca_spca501: reg write: error -71 [ 176.582822][ T199] spca501 2-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 176.582914][ T199] spca501 2-1:1.0: probe with driver spca501 failed with error -22 [ 176.615954][ T199] usb 2-1: USB disconnect, device number 9 [ 176.692254][ T5597] usb 3-1: Using ep0 maxpacket: 8 [ 176.696730][ T5597] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 176.696782][ T5597] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 176.696807][ T5597] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.697513][ T5595] Bluetooth: hci3: Invalid handle: 0x70bc > 0x0eff [ 176.745033][ T5597] usb 3-1: config 0 descriptor?? [ 176.987929][ T5597] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 177.423491][ T5597] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 177.578054][ T5597] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 177.578089][ T5597] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 177.578111][ T5597] usb 2-1: Product: syz [ 177.578127][ T5597] usb 2-1: Manufacturer: syz [ 177.578142][ T5597] usb 2-1: SerialNumber: syz [ 178.107522][ T5597] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 178.107595][ T5597] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 178.634027][ T5597] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 178.634091][ T5597] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 178.671167][ T5597] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 178.718718][ T5597] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -32 [ 178.747155][ T4906] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 178.747187][ T4906] CPU: 1 UID: 0 PID: 4906 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 178.747218][ T4906] Tainted: [L]=SOFTLOCKUP [ 178.747225][ T4906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 178.747256][ T4906] Workqueue: hci0 hci_rx_work [ 178.747299][ T4906] Call Trace: [ 178.747308][ T4906] [ 178.747317][ T4906] dump_stack_lvl+0xe8/0x150 [ 178.747349][ T4906] sysfs_create_dir_ns+0x271/0x2a0 [ 178.747386][ T4906] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 178.747416][ T4906] ? rt_spin_unlock+0x163/0x200 [ 178.747451][ T4906] kobject_add_internal+0x62c/0xce0 [ 178.747488][ T4906] kobject_add+0x163/0x240 [ 178.747513][ T4906] ? rt_spin_unlock+0x157/0x200 [ 178.747558][ T4906] ? __pfx_kobject_add+0x10/0x10 [ 178.747593][ T4906] ? get_device_parent+0x370/0x3a0 [ 178.747624][ T4906] device_add+0x3fa/0xb80 [ 178.747651][ T4906] hci_conn_add_sysfs+0xd5/0x210 [ 178.747688][ T4906] le_conn_complete_evt+0xfef/0x1580 [ 178.747726][ T4906] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 178.747753][ T4906] ? lockdep_hardirqs_on+0x7a/0x110 [ 178.747778][ T4906] ? rt_mutex_slowunlock+0x219/0x460 [ 178.747809][ T4906] ? skb_pull_data+0xf0/0x200 [ 178.747837][ T4906] hci_le_enh_conn_complete_evt+0x189/0x490 [ 178.747865][ T4906] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 178.747897][ T4906] hci_event_packet+0x67a/0xf10 [ 178.747931][ T4906] ? reacquire_held_locks+0x117/0x1a0 [ 178.747963][ T4906] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 178.747986][ T4906] ? __pfx_hci_event_packet+0x10/0x10 [ 178.748020][ T4906] ? rt_spin_unlock+0x157/0x200 [ 178.748061][ T4906] ? hci_send_to_monitor+0xe2/0x590 [ 178.748093][ T4906] hci_rx_work+0x3ee/0x1020 [ 178.748136][ T4906] ? process_one_work+0x7fd/0x1480 [ 178.748160][ T4906] process_one_work+0xaaf/0x1480 [ 178.748182][ T4906] ? irqentry_exit+0x218/0x8f0 [ 178.748227][ T4906] ? __pfx_process_one_work+0x10/0x10 [ 178.748248][ T4906] ? do_raw_spin_lock+0x12b/0x2f0 [ 178.748287][ T4906] ? assign_work+0x3cf/0x5d0 [ 178.748317][ T4906] worker_thread+0xb05/0x10d0 [ 178.748353][ T4906] ? __kthread_parkme+0x71/0x1f0 [ 178.748391][ T4906] kthread+0x388/0x470 [ 178.748422][ T4906] ? __pfx_worker_thread+0x10/0x10 [ 178.748444][ T4906] ? __pfx_kthread+0x10/0x10 [ 178.748476][ T4906] ret_from_fork+0x514/0xb70 [ 178.748510][ T4906] ? __pfx_ret_from_fork+0x10/0x10 [ 178.748541][ T4906] ? __switch_to+0xc89/0x1420 [ 178.748577][ T4906] ? __pfx_kthread+0x10/0x10 [ 178.748609][ T4906] ret_from_fork_asm+0x1a/0x30 [ 178.748660][ T4906] [ 178.748832][ T4906] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 178.748872][ T4906] Bluetooth: hci0: failed to register connection device [ 179.322332][ T10] usb 3-1: USB disconnect, device number 14 [ 179.551681][ T6735] binder: 6734:6735 unknown command 3 [ 179.551705][ T6735] binder: 6734:6735 ioctl c0306201 200000004a40 returned -22 [ 180.709043][ T6738] capability: warning: `syz.4.267' uses deprecated v2 capabilities in a way that may be insecure [ 180.785189][ T10] usb 2-1: USB disconnect, device number 10 [ 182.269626][ T6758] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 182.451269][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 182.451300][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 182.451331][ T5595] Tainted: [L]=SOFTLOCKUP [ 182.451339][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 182.451353][ T5595] Workqueue: hci2 hci_rx_work [ 182.451391][ T5595] Call Trace: [ 182.451400][ T5595] [ 182.451409][ T5595] dump_stack_lvl+0xe8/0x150 [ 182.451442][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 182.451473][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 182.451502][ T5595] ? rt_spin_unlock+0x163/0x200 [ 182.451537][ T5595] kobject_add_internal+0x62c/0xce0 [ 182.451575][ T5595] kobject_add+0x163/0x240 [ 182.451600][ T5595] ? rt_spin_unlock+0x157/0x200 [ 182.451636][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 182.451670][ T5595] ? get_device_parent+0x370/0x3a0 [ 182.451701][ T5595] device_add+0x3fa/0xb80 [ 182.451724][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 182.451763][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 182.451821][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 182.451848][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 182.451874][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 182.451905][ T5595] ? skb_pull_data+0xf0/0x200 [ 182.451933][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 182.451961][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 182.451993][ T5595] hci_event_packet+0x67a/0xf10 [ 182.452027][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 182.452060][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 182.452083][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 182.452116][ T5595] ? rt_spin_unlock+0x157/0x200 [ 182.452155][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 182.452188][ T5595] hci_rx_work+0x3ee/0x1020 [ 182.452241][ T5595] ? process_one_work+0x7fd/0x1480 [ 182.452272][ T5595] process_one_work+0xaaf/0x1480 [ 182.452318][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 182.452338][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 182.452376][ T5595] ? assign_work+0x3cf/0x5d0 [ 182.452404][ T5595] worker_thread+0xb05/0x10d0 [ 182.452441][ T5595] ? __kthread_parkme+0x71/0x1f0 [ 182.452479][ T5595] kthread+0x388/0x470 [ 182.452511][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 182.452534][ T5595] ? __pfx_kthread+0x10/0x10 [ 182.452565][ T5595] ret_from_fork+0x514/0xb70 [ 182.452601][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 182.452632][ T5595] ? __switch_to+0xc89/0x1420 [ 182.452662][ T5595] ? __pfx_kthread+0x10/0x10 [ 182.452693][ T5595] ret_from_fork_asm+0x1a/0x30 [ 182.452743][ T5595] [ 182.464618][ T5595] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 182.464669][ T5595] Bluetooth: hci2: failed to register connection device [ 183.870398][ T6772] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 184.677993][ T6777] netlink: 12 bytes leftover after parsing attributes in process `syz.0.278'. [ 184.695959][ T6778] netlink: 204 bytes leftover after parsing attributes in process `syz.4.279'. [ 184.782391][ T39] audit: type=1326 audit(1786529032.940:2): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=6774 comm="syz.4.279" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9795efe0d9 code=0x0 [ 185.056161][ T6777] Bluetooth: MGMT ver 1.23 [ 185.512269][ T5597] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 185.667714][ T5597] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 185.667749][ T5597] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.067670][ T5597] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 186.242306][ T5597] usb 2-1: USB disconnect, device number 11 [ 186.510611][ T6787] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 187.214318][ T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 187.413288][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 187.414294][ T10] usb 1-1: too many configurations: 36, using maximum allowed: 8 [ 187.444400][ T10] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 187.444442][ T10] usb 1-1: can't read configurations, error -61 [ 187.506841][ T4906] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 187.522334][ T199] usb 2-1: new low-speed USB device number 12 using dummy_hcd [ 187.582284][ T10] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 187.687675][ T199] usb 2-1: unable to get BOS descriptor or descriptor too short [ 187.708702][ T199] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 64, setting to 8 [ 187.772219][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 187.791074][ T10] usb 1-1: too many configurations: 36, using maximum allowed: 8 [ 187.817001][ T199] usb 2-1: string descriptor 0 read error: -22 [ 187.817171][ T199] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice= 0.40 [ 187.817197][ T199] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.947368][ T10] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 187.947410][ T10] usb 1-1: can't read configurations, error -61 [ 188.044243][ T6792] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 188.079842][ T10] usb usb1-port1: attempt power cycle [ 188.253294][ T199] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 188.443301][ T6802] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.443861][ T6802] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.484386][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 188.515700][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 188.516772][ T10] usb 1-1: too many configurations: 36, using maximum allowed: 8 [ 188.537133][ T10] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 188.537186][ T10] usb 1-1: can't read configurations, error -61 [ 188.662527][ T10] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 188.691473][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 188.692552][ T10] usb 1-1: too many configurations: 36, using maximum allowed: 8 [ 188.775861][ T10] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 188.775902][ T10] usb 1-1: can't read configurations, error -61 [ 188.776581][ T10] usb usb1-port1: unable to enumerate USB device [ 188.984077][ T5597] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 189.463066][ T5597] usb 5-1: device descriptor read/64, error -71 [ 189.712257][ T5597] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 189.848747][ T5597] usb 5-1: device descriptor read/64, error -71 [ 189.955410][ T5597] usb usb5-port1: attempt power cycle [ 190.138991][ T199] usb 2-1: USB disconnect, device number 12 [ 190.545293][ T5597] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 190.562989][ T5597] usb 5-1: device descriptor read/8, error -71 [ 190.816239][ T5597] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 190.839909][ T5597] usb 5-1: device descriptor read/8, error -71 [ 191.148020][ T5597] usb usb5-port1: unable to enumerate USB device [ 192.375749][ T5597] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 192.535547][ T6816] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 192.558605][ T5597] usb 5-1: config 1 interface 0 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 192.596300][ T5597] usb 5-1: New USB device found, idVendor=174c, idProduct=56aa, bcdDevice= 1.00 [ 192.596333][ T5597] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.596354][ T5597] usb 5-1: Product: syz [ 192.596369][ T5597] usb 5-1: Manufacturer: syz [ 192.596384][ T5597] usb 5-1: SerialNumber: syz [ 193.000176][ T6818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.014641][ T5597] scsi host1: uas [ 193.015221][ T6818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.106336][ T6827] ubi31: attaching mtd0 [ 193.158846][ T5597] usb 5-1: USB disconnect, device number 12 [ 193.344545][ T6828] Invalid logical block size (4608) [ 193.407201][ T6827] ubi31: scanning is finished [ 193.407226][ T6827] ubi31: empty MTD device detected [ 193.738213][ T5323] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 193.915398][ T5323] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 193.915435][ T5323] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.067518][ T199] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 194.212834][ T5323] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 194.425649][ T5323] usb 3-1: USB disconnect, device number 15 [ 195.823531][ T5603] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 195.997658][ T5603] usb 1-1: not running at top speed; connect to a high speed hub [ 196.044366][ T5603] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.044396][ T5603] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 196.044526][ T5603] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 196.044551][ T5603] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.263782][ T5603] gspca_main: spca501-2.14.0 probing 0000:0000 [ 197.056400][ T6847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.066322][ T6856] FAULT_INJECTION: forcing a failure. [ 197.066322][ T6856] name failslab, interval 1, probability 0, space 0, times 0 [ 197.066434][ T6856] CPU: 1 UID: 0 PID: 6856 Comm: syz.2.301 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 197.066465][ T6856] Tainted: [L]=SOFTLOCKUP [ 197.066472][ T6856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 197.066485][ T6856] Call Trace: [ 197.066494][ T6856] [ 197.066519][ T6856] dump_stack_lvl+0xe8/0x150 [ 197.066610][ T6856] should_fail_ex+0x467/0x600 [ 197.066649][ T6856] should_failslab+0xa8/0x100 [ 197.066689][ T6856] __kmalloc_noprof+0xfb/0x790 [ 197.066772][ T6856] ? tomoyo_encode+0x2ad/0x570 [ 197.066811][ T6856] ? tomoyo_encode+0x2ad/0x570 [ 197.066852][ T6856] tomoyo_encode+0x2ad/0x570 [ 197.066906][ T6856] tomoyo_realpath_from_path+0x5fa/0x640 [ 197.066973][ T6856] ? tomoyo_path_number_perm+0x219/0x5f0 [ 197.067002][ T6856] tomoyo_path_number_perm+0x246/0x5f0 [ 197.067076][ T6856] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 197.067129][ T6856] ? do_raw_spin_lock+0x12b/0x2f0 [ 197.067173][ T6856] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 197.067234][ T6856] ? lockdep_hardirqs_on+0x7a/0x110 [ 197.067301][ T6856] ? __fget_files+0x2a/0x420 [ 197.067331][ T6856] ? __fget_files+0x3a8/0x420 [ 197.067353][ T6856] ? __fget_files+0x2a/0x420 [ 197.067430][ T6856] security_file_ioctl+0xb9/0x260 [ 197.067474][ T6856] __se_sys_ioctl+0x47/0x170 [ 197.067507][ T6856] do_syscall_64+0x17b/0x530 [ 197.067552][ T6856] ? irqentry_exit+0x10f/0x8f0 [ 197.067605][ T6856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.067636][ T6856] ? clear_bhb_loop+0x40/0x90 [ 197.067664][ T6856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 197.067695][ T6856] RIP: 0033:0x7f61d574e0d9 [ 197.067773][ T6856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 197.067806][ T6856] RSP: 002b:00007f61d3985028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 197.067829][ T6856] RAX: ffffffffffffffda RBX: 00007f61d59d6090 RCX: 00007f61d574e0d9 [ 197.067846][ T6856] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000009 [ 197.067885][ T6856] RBP: 00007f61d3985090 R08: 0000000000000000 R09: 0000000000000000 [ 197.067932][ T6856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 197.067959][ T6856] R13: 00007f61d59d6128 R14: 00007f61d59d6090 R15: 00007fff46e76b88 [ 197.067995][ T6856] [ 197.071074][ T6847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.076661][ T6856] ERROR: Out of memory at tomoyo_realpath_from_path. [ 197.087114][ T6847] netlink: 8 bytes leftover after parsing attributes in process `syz.0.299'. [ 197.288555][ T5603] gspca_spca501: reg write: error -110 [ 197.288574][ T5603] spca501 1-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 197.288735][ T5603] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 197.468960][ T5603] usb 1-1: USB disconnect, device number 12 [ 197.548418][ T6863] device-mapper: ioctl: name not supplied when creating device [ 198.792928][ T5597] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 198.793264][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 198.965256][ T5597] usb 1-1: device descriptor read/64, error -32 [ 199.232267][ T5597] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 199.342648][ T199] usb 2-1: device descriptor read/64, error -110 [ 199.443201][ T5597] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 199.443293][ T5597] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.596291][ T6827] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 199.616117][ T199] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 199.785088][ T199] usb 2-1: device descriptor read/64, error -32 [ 199.844246][ T5597] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 199.899064][ T199] usb usb2-port1: attempt power cycle [ 200.063923][ T5597] usb 1-1: USB disconnect, device number 14 [ 200.130187][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 200.130327][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.235877][ T6827] raw-gadget.1 gadget.1: failed to queue suspend event [ 200.236085][ T6827] raw-gadget.1 gadget.1: failed to queue disconnect event [ 200.252283][ T199] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 200.462339][ T199] usb 2-1: device not accepting address 15, error -71 [ 202.402281][ T199] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 202.558568][ T199] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 202.558600][ T199] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.772284][ T5597] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 202.908716][ T199] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 202.923733][ T5597] usb 1-1: Using ep0 maxpacket: 16 [ 202.926491][ T5597] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 202.926522][ T5597] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.008613][ T5597] usb 1-1: config 0 descriptor?? [ 203.034255][ T5597] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 203.311497][ T5597] usb 1-1: Detected FT232B [ 203.318558][ T199] usb 5-1: USB disconnect, device number 13 [ 203.545467][ T5597] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 203.546022][ T5597] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 203.639259][ T5597] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 203.666456][ T5597] usb 1-1: USB disconnect, device number 15 [ 204.896181][ T5597] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 204.897032][ T5597] ftdi_sio 1-1:0.0: device disconnected [ 205.189350][ T6897] syz.1.311 (6897) used greatest stack depth: 19376 bytes left [ 205.394627][ T6900] netlink: 32 bytes leftover after parsing attributes in process `syz.1.313'. [ 205.394694][ T6900] netlink: 32 bytes leftover after parsing attributes in process `syz.1.313'. [ 207.250464][ T6904] loop8: detected capacity change from 0 to 8 [ 208.480230][ T6904] Dev loop8: unable to read RDB block 8 [ 208.480278][ T6904] loop8: unable to read partition table [ 208.480519][ T6904] loop8: partition table beyond EOD, truncated [ 208.480573][ T6904] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 208.668578][ T5704] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 209.020650][ T5786] Flush: task=udevd[5786] dev=loop8 state=2 [ 209.190221][ T5704] usb 5-1: Using ep0 maxpacket: 8 [ 211.072308][ T6916] binder: BINDER_SET_CONTEXT_MGR already set [ 211.072325][ T6916] binder: 6914:6916 ioctl 4018620d 200000004a80 returned -16 [ 211.493102][ T5704] usb 5-1: device descriptor read/all, error -71 [ 212.437387][ T5786] Teardown: task=udevd[5786] dev=loop8 state=2 [ 214.414674][ T199] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 214.842294][ T5704] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 214.966436][ T199] usb 1-1: not running at top speed; connect to a high speed hub [ 214.967966][ T199] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.967992][ T199] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 214.968045][ T199] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 214.968069][ T199] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.034804][ T5704] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 215.034837][ T5704] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.151221][ T199] gspca_main: spca501-2.14.0 probing 0000:0000 [ 216.545418][ T199] gspca_spca501: reg write: error -110 [ 216.545440][ T199] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 216.545538][ T199] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 218.800971][ T10] usb 1-1: USB disconnect, device number 16 [ 219.278262][ T5704] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 220.259714][ T5704] usb 5-1: USB disconnect, device number 15 [ 222.422308][ T5598] Bluetooth: hci2: command 0x0406 tx timeout [ 222.422354][ T5598] Bluetooth: hci0: command 0x0406 tx timeout [ 222.422624][ T5598] Bluetooth: hci1: command 0x0406 tx timeout [ 224.758408][ T6951] device-mapper: ioctl: name not supplied when creating device [ 225.204197][ T5704] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 226.012242][ T5323] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 226.249955][ T5323] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 226.249988][ T5323] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.282343][ T822] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 226.514408][ T822] usb 3-1: not running at top speed; connect to a high speed hub [ 226.516106][ T822] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 226.516131][ T822] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 226.516186][ T822] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 226.516210][ T822] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 226.609915][ T822] gspca_main: spca501-2.14.0 probing 0000:0000 [ 226.648814][ T5323] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 229.354689][ T5323] usb 1-1: USB disconnect, device number 17 [ 229.833577][ T822] gspca_spca501: reg write: error -110 [ 229.833599][ T822] spca501 3-1:1.0: Reg write failed for 0x05,0x22,0x04 [ 229.833697][ T822] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 229.874692][ T6956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.878334][ T6956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.885206][ T6956] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 232.892873][ T199] usb 3-1: USB disconnect, device number 16 [ 233.144469][ T6974] device-mapper: ioctl: name not supplied when creating device [ 233.169479][ T5603] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 233.826642][ T5603] usb 5-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 233.826675][ T5603] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.826696][ T5603] usb 5-1: Product: syz [ 233.826711][ T5603] usb 5-1: Manufacturer: syz [ 233.826726][ T5603] usb 5-1: SerialNumber: syz [ 233.884329][ T5603] usb 5-1: config 0 descriptor?? [ 234.144046][ T10] ------------[ cut here ]------------ [ 234.144082][ T10] faux_driver vkms: [drm] vblank wait timed out on crtc 0 [ 234.144112][ T10] WARNING: drivers/gpu/drm/drm_vblank.c:1329 at drm_crtc_wait_one_vblank+0x3bc/0x560, CPU#0: kworker/0:1/10 [ 234.144165][ T10] Modules linked in: [ 234.144193][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 234.144222][ T10] Tainted: [L]=SOFTLOCKUP [ 234.144229][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.144244][ T10] Workqueue: events drm_fb_helper_damage_work [ 234.144269][ T10] RIP: 0010:drm_crtc_wait_one_vblank+0x51a/0x560 [ 234.144305][ T10] Code: c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 f5 b6 aa fc 4d 8b 7d 00 4c 89 f7 4c 89 e6 4c 89 fa 89 d9 <67> 48 0f b9 3a 48 8b 3c 24 89 de e8 36 f4 ff ff b8 92 ff ff ff 49 [ 234.144323][ T10] RSP: 0018:ffffc900000f7840 EFLAGS: 00010246 [ 234.144342][ T10] RAX: 1ffff11004b26000 RBX: 0000000000000000 RCX: 0000000000000000 [ 234.144357][ T10] RDX: ffffffff8be3c600 RSI: ffffffff8be5a3a0 RDI: ffffffff8fdc0f10 [ 234.144373][ T10] RBP: ffffc900000f7928 R08: 0000000000000000 R09: 0000000000000000 [ 234.144387][ T10] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffffffff8be5a3a0 [ 234.144404][ T10] R13: ffff888025930000 R14: ffffffff8fdc0f10 R15: ffffffff8be3c600 [ 234.144421][ T10] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 234.144439][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 234.144454][ T10] CR2: 0000000000000000 CR3: 0000000040276000 CR4: 00000000003526f0 [ 234.144474][ T10] Call Trace: [ 234.144483][ T10] [ 234.144498][ T10] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 234.144534][ T10] ? rt_spin_unlock+0x157/0x200 [ 234.144565][ T10] ? __pfx_autoremove_wake_function+0x10/0x10 [ 234.144599][ T10] ? rt_spin_unlock+0x163/0x200 [ 234.144631][ T10] ? drm_vblank_get+0x147/0x280 [ 234.144667][ T10] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 234.144702][ T10] drm_fb_helper_damage_work+0x6cf/0xf00 [ 234.144749][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 234.144791][ T10] ? lock_acquire+0x115/0x350 [ 234.144837][ T10] ? rcu_is_watching+0x15/0xb0 [ 234.144865][ T10] ? process_one_work+0x7fd/0x1480 [ 234.144888][ T10] process_one_work+0xaaf/0x1480 [ 234.144934][ T10] ? __pfx_process_one_work+0x10/0x10 [ 234.144955][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 234.144993][ T10] ? assign_work+0x3cf/0x5d0 [ 234.145023][ T10] worker_thread+0xb3c/0x10d0 [ 234.145061][ T10] ? __kthread_parkme+0x71/0x1f0 [ 234.145100][ T10] kthread+0x388/0x470 [ 234.145130][ T10] ? __pfx_worker_thread+0x10/0x10 [ 234.145152][ T10] ? __pfx_kthread+0x10/0x10 [ 234.145185][ T10] ret_from_fork+0x514/0xb70 [ 234.145221][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 234.145253][ T10] ? __switch_to+0xc89/0x1420 [ 234.145283][ T10] ? __pfx_kthread+0x10/0x10 [ 234.145316][ T10] ret_from_fork_asm+0x1a/0x30 [ 234.145367][ T10] [ 234.145379][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 234.145398][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 234.145428][ T10] Tainted: [L]=SOFTLOCKUP [ 234.145435][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.145453][ T10] Workqueue: events drm_fb_helper_damage_work [ 234.145478][ T10] Call Trace: [ 234.145486][ T10] [ 234.145495][ T10] vpanic+0x56c/0xa60 [ 234.145519][ T10] ? __pfx__printk+0x10/0x10 [ 234.145546][ T10] ? __pfx_vpanic+0x10/0x10 [ 234.145565][ T10] ? is_bpf_text_address+0x292/0x2b0 [ 234.145591][ T10] ? is_bpf_text_address+0x26/0x2b0 [ 234.145627][ T10] panic+0xc5/0xd0 [ 234.145649][ T10] ? __pfx_panic+0x10/0x10 [ 234.145681][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 234.145728][ T10] __warn+0x315/0x4c0 [ 234.145748][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 234.145787][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 234.145822][ T10] __report_bug+0x276/0x570 [ 234.145849][ T10] ? drm_crtc_wait_one_vblank+0x3bc/0x560 [ 234.145888][ T10] ? __pfx___report_bug+0x10/0x10 [ 234.145923][ T10] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 234.145945][ T10] ? lockdep_hardirqs_on+0x7a/0x110 [ 234.145967][ T10] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 234.145993][ T10] report_bug_entry+0x19a/0x290 [ 234.146017][ T10] ? drm_crtc_wait_one_vblank+0x51a/0x560 [ 234.146049][ T10] ? drm_crtc_wait_one_vblank+0x51f/0x560 [ 234.146084][ T10] handle_bug+0xce/0x200 [ 234.146111][ T10] exc_invalid_op+0x1a/0x50 [ 234.146136][ T10] asm_exc_invalid_op+0x1a/0x20 [ 234.146159][ T10] RIP: 0010:drm_crtc_wait_one_vblank+0x51a/0x560 [ 234.146196][ T10] Code: c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 f5 b6 aa fc 4d 8b 7d 00 4c 89 f7 4c 89 e6 4c 89 fa 89 d9 <67> 48 0f b9 3a 48 8b 3c 24 89 de e8 36 f4 ff ff b8 92 ff ff ff 49 [ 234.146213][ T10] RSP: 0018:ffffc900000f7840 EFLAGS: 00010246 [ 234.146233][ T10] RAX: 1ffff11004b26000 RBX: 0000000000000000 RCX: 0000000000000000 [ 234.146248][ T10] RDX: ffffffff8be3c600 RSI: ffffffff8be5a3a0 RDI: ffffffff8fdc0f10 [ 234.146265][ T10] RBP: ffffc900000f7928 R08: 0000000000000000 R09: 0000000000000000 [ 234.146279][ T10] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffffffff8be5a3a0 [ 234.146295][ T10] R13: ffff888025930000 R14: ffffffff8fdc0f10 R15: ffffffff8be3c600 [ 234.146336][ T10] ? __pfx_drm_crtc_wait_one_vblank+0x10/0x10 [ 234.146370][ T10] ? rt_spin_unlock+0x157/0x200 [ 234.146398][ T10] ? __pfx_autoremove_wake_function+0x10/0x10 [ 234.146431][ T10] ? rt_spin_unlock+0x163/0x200 [ 234.146463][ T10] ? drm_vblank_get+0x147/0x280 [ 234.146501][ T10] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 234.146535][ T10] drm_fb_helper_damage_work+0x6cf/0xf00 [ 234.146570][ T10] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 234.146612][ T10] ? lock_acquire+0x115/0x350 [ 234.146658][ T10] ? rcu_is_watching+0x15/0xb0 [ 234.146685][ T10] ? process_one_work+0x7fd/0x1480 [ 234.146737][ T10] process_one_work+0xaaf/0x1480 [ 234.146786][ T10] ? __pfx_process_one_work+0x10/0x10 [ 234.146807][ T10] ? do_raw_spin_lock+0x12b/0x2f0 [ 234.146845][ T10] ? assign_work+0x3cf/0x5d0 [ 234.146874][ T10] worker_thread+0xb3c/0x10d0 [ 234.146910][ T10] ? __kthread_parkme+0x71/0x1f0 [ 234.146948][ T10] kthread+0x388/0x470 [ 234.146978][ T10] ? __pfx_worker_thread+0x10/0x10 [ 234.147000][ T10] ? __pfx_kthread+0x10/0x10 [ 234.147032][ T10] ret_from_fork+0x514/0xb70 [ 234.147065][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 234.147097][ T10] ? __switch_to+0xc89/0x1420 [ 234.147127][ T10] ? __pfx_kthread+0x10/0x10 [ 234.147160][ T10] ret_from_fork_asm+0x1a/0x30 [ 234.147210][ T10] [ 234.147877][ T10] Kernel Offset: disabled