last executing test programs: 7.447498649s ago: executing program 2 (id=565): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, 0x0, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x230}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8717, 0x10, 0x1, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x400, 0x2, 0x3b0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x4000, 0x4003bfff, 0x299}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x0, 0x1, 0x26d}}], 0x1, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000003c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x8, 0x89, {"00000000000000000000000000000001"}, 0x1119dff, 0xffffffff7fffffff, 0xcd41}}}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000540)='7', 0x1) fsopen(&(0x7f0000000580)='ceph\x00', 0x0) 7.057319559s ago: executing program 2 (id=567): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000500)='\xff\x00l\x1e\xa00x0}) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000d40)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000e40)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000f00)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000fc0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000001300000008000300", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x20}}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) bind$packet(r6, &(0x7f0000001000)={0x11, 0x300, r4, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r6, &(0x7f0000001040)="08021100000108021100000008004500002800", 0x13) sendmsg$NL80211_CMD_DEL_INTERFACE(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001100)={0x1c, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000006, 0x4d092, r1, 0x0) ftruncate(r1, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r7, &(0x7f0000000140)={&(0x7f00000003c0)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000800)='+', 0x1}], 0x1, &(0x7f0000000840)=[@sndrcv={0x30, 0x84, 0x1, {0x200, 0x56ce, 0x0, 0x400, 0x9, 0x1ff, 0x9, 0x6de4}}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0xb, 0xffff7ffe, 0xff}}], 0x50, 0x4014}, 0x2c0408d0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{0x100}, 'syz1\x00', 0x33}) r8 = syz_io_uring_setup(0xf08, &(0x7f00000001c0)={0x0, 0xfefffffe, 0x20, 0x3, 0x800000c5}, &(0x7f0000000240)=0x0, &(0x7f0000000280), &(0x7f00000002c0)=0x0) r11 = getpid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpriority(0x1, r11) syz_io_uring_submit(r9, 0x0, r10, &(0x7f0000000480)=@IORING_OP_SEND={0x1a, 0x1a, 0x0, r0, &(0x7f0000000380)="a3d82d2462d312c0a8797ab13a681715be6f21c3d0ced204183a35e879", &(0x7f0000000400)="4019fb5d56920175ff75176ebeb70e4c10c4104c1c68a0824621aeb65bd43bbda66951a7ce28b14cd67921ad859ed85e522322267d7fa57818e3103e1592649d1ef0e570dc63ce95d5ca6c67cbfcd3be1162d96baad94120aa8f03a12a4cf538ee94d69ec00091", 0x67, 0x4008001, 0x0, {0x0, 0x0, 0x2}}) io_uring_enter(r8, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 6.738243812s ago: executing program 3 (id=570): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001400000405cd0f9fbc643b000300000004000000020000000000000f0400000000005f00"], 0x0, 0x28}, 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff7}]}, &(0x7f0000000100)=0xc) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd(0x7) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000480)={0x1, r2}) 6.56119819s ago: executing program 3 (id=573): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000240007012ebd7000fbdbff25077c000004000180db33973ee6740cbb1a09583a89e31e3fcc73391fbd1ca26d4aa4851f5f2018dc051010d8bc439bec8c9638fd0de66082e944499095eeef58ace713d2ebaf742b8394a196d6e7e55e6263b9457624d70d4b067b64019d"], 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r1, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c000000580020002abd7000fbdbdf2500080001000200000008000100030000000800", @ANYRES32, @ANYBLOB="0800010002000000080001000100000008000100030000000800010004000000080001000200000008000200", @ANYRES16=r2, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x44000}, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="05000000050000000200000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f00000008c0)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff0}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x2}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x14, &(0x7f0000000a00)=ANY=[@ANYRESDEC], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55}, 0x94) r5 = openat$sndseq(0xffffff9c, &(0x7f00000005c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r5, 0xc0505350, &(0x7f0000000c00)={{0x0, 0x1}, {0xf}}) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000a80)={r4}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./tracefs\x00', &(0x7f0000000540)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./tracefs/dynamic_events\x00', 0x2, 0x0) writev(r6, &(0x7f0000000bc0)=[{&(0x7f0000000600)='#', 0x1}, {&(0x7f0000000640)='p', 0x1}, {&(0x7f0000000b80)="254572957a93d6e8939c8cde2cea31d38e33485343079cef1a52da2e3d92f45d0863ce367be397d89311482959466d312c9f9c3664f53275f808", 0x3a}], 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x42890}, 0x0) mount(0x0, &(0x7f0000000380)='./proc\x00', &(0x7f00000003c0)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0) pipe(&(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) write(r10, &(0x7f0000000cc0), 0x11000) io_setup(0x3fc, &(0x7f0000000d00)=0x0) io_submit(r11, 0x1, &(0x7f0000000d40)=[&(0x7f0000000d80)={0x0, 0x0, 0x0, 0x5, 0x0, r10, 0x0}]) vmsplice(r9, &(0x7f0000000dc0)=[{&(0x7f0000000e00), 0x3528a9c0}], 0x1, 0x0) write(r8, &(0x7f0000000480)='1', 0x1) 6.255604691s ago: executing program 2 (id=574): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r0 = io_uring_setup(0x4520, &(0x7f0000000380)={0x0, 0xdca4, 0x2000, 0x2, 0x2e6}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x4001}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000180)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r3, 0x0, 0x0) listen(r3, 0x5) write$tun(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c11223344000800000005000500000005"], 0x4a) r4 = syz_io_uring_setup(0x18d6, &(0x7f0000000040)={0x0, 0x3, 0x800, 0xfffffffc, 0xad, 0x0, r0}, &(0x7f0000000440), &(0x7f0000000500), &(0x7f0000000000)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c000000000101040000000000080000020000001400188008000240000000020800014000010000000100000000018008000100d500000108000200e00000010c00028005000100"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r4, 0x2, 0x0, 0xfe) r6 = syz_open_dev$vbi(&(0x7f0000002100), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000000)={0x3, 0x5, 0x1, 0x0, 0x2}) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240), 0xa000, 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r7, 0x80044d07, &(0x7f0000000040)) readv(r7, &(0x7f0000000680)=[{&(0x7f0000000280)=""/220, 0xdc}], 0x1) mmap$dsp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000009, 0x11, r7, 0x0) r8 = epoll_create(0x5) r9 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x1807, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000080)={0x80000000}) 6.181932589s ago: executing program 3 (id=576): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x0, 0xb007}, 0x4) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000840)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x8, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x946, 0x66, 0x12, 0xb, 0x29, 0x0, @rand_addr=0x64010101, @broadcast}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d5661f6865e030487"}}, 0xfce) 5.473107561s ago: executing program 3 (id=580): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mount$9p_virtio(0x0, 0x0, 0x0, 0x3200006, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) getpid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0xc2742, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r3 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r3, 0x12, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8932, &(0x7f0000000140)={'netdevsim0\x00', @ifru_hwaddr=@remote}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000003c0)=@newqdisc={0x64, 0x24, 0x3fe3aa0262d8c583, 0xffffffff, 0x3, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x34, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6a13}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x5}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x3}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xb064}]}}]}, 0x64}}, 0x2000400c) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x3e, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0xff, 0x0, @empty}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 4.834807796s ago: executing program 3 (id=581): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080), 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001400000405cd0f9fbc643b000300000004000000020000000000000f0400000000005f00"], 0x0, 0x28}, 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff7}]}, &(0x7f0000000100)=0xc) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd(0x7) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000480)={0x1, r2}) 4.570174923s ago: executing program 3 (id=583): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000693f0c104410017020050102030109022400010400aa0309042c0002c10db287"], 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000000c0)={0x44, &(0x7f0000000140)={0x0, 0x10, 0x1, "c4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000180), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f00000001c0)={0x1, 0xf8, 0x5, &(0x7f0000000200)={0x10, "810508c721720f0000000040000008b2c424000200"}}) 3.946781557s ago: executing program 2 (id=586): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff0000000705"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000001c0)={0x84, &(0x7f0000000280)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 3.002978713s ago: executing program 1 (id=590): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000480)="bad330fbc9b5544972e7a5ea07", 0xd, 0x40, &(0x7f00000004c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x10}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x3, 0x6, 0x5, 0xa8e, 0x5, 0x407c, 0x80, 0x9, 0x3, 0x8000, 0x8, 0x3, 0x8, 0x5, 0xbc0, 0x7, 0x9c09, 0xffff, 0x3, 0x0, 0xc, 0xcfa, 0x5, 0xa, 0x6407, 0x80, 0x849, 0x8b, 0xffffffff, 0x4, 0x2, 0xa4c, 0x0, 0x9, 0x5, 0x200, 0x1ff, 0x4d76, 0x4, 0xb32, 0x3ff, 0x8, 0x0, 0x71, 0x5, 0x1, 0x8, 0x0, 0x7, 0xeb, 0x6, 0x87, 0x8, 0x0, 0x9, 0x3ff, 0xb, 0xfffffff8, 0xb6d, 0x81, 0x1, 0x8, 0xa, 0x0, 0x9, 0x81, 0x8, 0x26b, 0x8, 0x85b4, 0x9, 0x7, 0xfffffffe, 0x6, 0x8, 0xffffffc0, 0x3, 0x3, 0x4, 0x4, 0x80000001, 0xc8ee, 0xbacb161, 0x3ff, 0xffff12d0, 0x2, 0xffff8000, 0x10, 0x1ff, 0x2, 0x5, 0x2, 0x8, 0x7, 0x4, 0x2, 0x0, 0x1, 0x5, 0xfffffffd, 0x6, 0x0, 0x9, 0x8, 0x5, 0x6, 0xfffffffe, 0x2, 0x834f, 0x9, 0x1ff, 0x2, 0x62cd, 0xf98, 0xd8, 0x6, 0x6, 0x9, 0x3, 0xfffff000, 0x40000000, 0x7, 0x81, 0x0, 0x5, 0x10, 0x100, 0x40, 0xc, 0x400, 0x9151, 0x6, 0x7, 0x2, 0xb, 0x7, 0x4, 0x4, 0x64, 0x9, 0x400, 0x2, 0x6, 0x7, 0x971, 0x0, 0x6, 0x3, 0xa46a, 0x8, 0x23, 0x2, 0x8, 0x7fff, 0x8, 0x1, 0x557, 0x2, 0x3ff, 0x3ff, 0x2, 0x1, 0x1, 0x5c, 0x6, 0x1ff, 0x9, 0xb, 0x6, 0x0, 0x7ff, 0x868f, 0x9, 0xffffffff, 0x0, 0xfffffffe, 0x100, 0x40, 0x6c8, 0x8, 0x4, 0x4, 0x4, 0x81, 0xdf, 0x8, 0x4, 0x6, 0x4, 0xc59e, 0x9, 0x891a, 0x4, 0x1, 0x67a, 0x5, 0xaa, 0x2, 0x8000, 0x4, 0x5, 0x2, 0xfff, 0x9, 0x4533afbb, 0xd, 0x0, 0x593c, 0x1, 0xd99b, 0x55aa77c9, 0x56a, 0x9, 0x8, 0x200, 0x10001, 0x5, 0x6, 0x1000, 0xa, 0x5, 0x6, 0x4, 0x1ff, 0x40, 0x2, 0x5dff, 0xfffffffe, 0x8, 0x1, 0x4, 0x4, 0x1ff, 0x101, 0xffff, 0x12, 0x5, 0xfffffffc, 0x7e94, 0x6, 0xca55, 0x2, 0x5, 0x401, 0x8, 0x4, 0x80000000, 0x3, 0x1, 0x7, 0x4, 0x2, 0x8, 0x16, 0x1]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) 2.73497049s ago: executing program 1 (id=591): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080), 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001400000405cd0f9fbc643b000300000004000000020000000000000f0400000000005f00"], 0x0, 0x28}, 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffff7}]}, &(0x7f0000000100)=0xc) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) write(0xffffffffffffffff, 0x0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd(0x7) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000480)={0x1, r2}) 2.614014753s ago: executing program 1 (id=592): r0 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000580)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress:NVMf:uuid:12345678-1234-1234-1234-123456789abc,host_traddr=127.0.0.1,traddr=127.0.0.1,trsvcid=4', 0x8d) 2.613788273s ago: executing program 0 (id=593): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x1c00000, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0xff) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) read$FUSE(r3, &(0x7f00000014c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r2, &(0x7f0000003500)={0x10, 0xfffffffffffffffe, r4}, 0x66) splice(r1, 0x0, r0, 0x0, 0x10, 0x7) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) set_mempolicy(0x4005, &(0x7f00000002c0)=0x2e8d, 0x6) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000300), 0x88002, 0x0) ftruncate(0xffffffffffffffff, 0x2007ffb) io_setup(0x5, &(0x7f0000000140)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 2.54201097s ago: executing program 1 (id=594): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000001700)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) r0 = io_uring_setup(0x1b14, &(0x7f00000000c0)={0x0, 0xda8b, 0x1000, 0x2, 0x2c4}) syz_io_uring_setup(0x111, &(0x7f0000000040)={0x0, 0x39c4, 0x800, 0x3, 0xbffffffe, 0x0, r0}, &(0x7f00000017c0), &(0x7f0000000000), 0x0) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, 0x0) io_pgetevents(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) syz_usb_connect(0x6, 0x0, 0x0, 0x0) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vxcan0\x00'}) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r1) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x14, r2, 0x20, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x2000011) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000002c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newtfilter={0x24, 0x11, 0x1, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x74, r4, {0x0, 0xa}, {0xfff1, 0x9}, {0x9, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x46}, 0x20004844) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) socket(0x15, 0x5, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004000) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010100}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e22}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x5064}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 2.45450647s ago: executing program 0 (id=595): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000500)={0xb, {'syz0\x00', 'syz0\x00', 'syz1\x00', 0x1d, 0x3, 0x56a, 0x42, 0xffffffff, 0x0, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135) write$UHID_DESTROY(r0, &(0x7f0000000640), 0x4) 2.148720261s ago: executing program 0 (id=596): socket$inet6_sctp(0xa, 0x1, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x41, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000001, 0x401d132, 0xffffffffffffffff, 0x0) unshare(0x2c020400) syz_open_dev$loop(0x0, 0x4, 0xc0981) syz_open_dev$dvb_frontend(0x0, 0x0, 0x882) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, 0x0, 0x2002c094) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x5, 0x4, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3a}, 0x0) syz_clone(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r1 = openat$dlm_plock(0xffffff9c, &(0x7f0000000000), 0x80000, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000000140)={0x1d, r3}, 0x10) sendmsg$can_bcm(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="010000004008000000080000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x80}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="010000000b0e00000300000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x80}, 0x1, 0x0, 0x0, 0x84}, 0x40011) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000003c0), 0x318, 0x0) madvise(&(0x7f000074b000/0x1000)=nil, 0x1000, 0xb) setpriority(0x2, 0x0, 0x2) 1.993384546s ago: executing program 0 (id=597): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000080)="000001", 0x3, 0x1be) pwrite64(r0, &(0x7f00000000c0)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000280)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f00000002c0)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000300)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000340)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(r0, &(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f00000003c0)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000400)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000440)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000480)='\x00\x00\x00\x00\x00\x00\a', 0x69, 0x1e8123) pwrite64(r0, &(0x7f00000004c0)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000540), 0xf, 0x102) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1.784169438s ago: executing program 0 (id=598): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) mount$9p_virtio(0x0, 0x0, 0x0, 0x3200006, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, 0x0) getpid() openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0xc2742, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4004000) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2716, 0x0, &(0x7f0000000000)) r3 = syz_io_uring_setup(0x264a, &(0x7f00000190c0)={0x0, 0x8847, 0x40, 0x2, 0x266}, &(0x7f0000019140), &(0x7f0000000180), &(0x7f00000191c0)) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r3, 0x12, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8932, &(0x7f0000000140)={'netdevsim0\x00', @ifru_hwaddr=@remote}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001480)={&(0x7f00000003c0)=@newqdisc={0x64, 0x24, 0x3fe3aa0262d8c583, 0xffffffff, 0x3, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x34, 0x8002, [@TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6a13}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x5}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x5}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x3}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xb064}]}}]}, 0x64}}, 0x2000400c) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x3e, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0xff, 0x0, @empty}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 1.616737005s ago: executing program 1 (id=599): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00'}) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000480)="bad330fbc9b5544972e7a5ea0756", 0xe, 0x40, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x10}, {0x0, 0xfff1}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x3, 0x6, 0x5, 0xa8e, 0x5, 0x407c, 0x80, 0x9, 0x3, 0x8000, 0x8, 0x3, 0x8, 0x5, 0xbc0, 0x7, 0x9c09, 0xffff, 0x3, 0x0, 0xc, 0xcfa, 0x5, 0xa, 0x6407, 0x80, 0x849, 0x8b, 0xffffffff, 0x4, 0x2, 0xa4c, 0x0, 0x9, 0x5, 0x200, 0x1ff, 0x4d76, 0x4, 0xb32, 0x3ff, 0x8, 0x0, 0x71, 0x5, 0x1, 0x8, 0x0, 0x7, 0xeb, 0x6, 0x87, 0x8, 0x0, 0x9, 0x3ff, 0xb, 0xfffffff8, 0xb6d, 0x81, 0x1, 0x8, 0xa, 0x0, 0x9, 0x81, 0x8, 0x26b, 0x8, 0x85b4, 0x9, 0x7, 0xfffffffe, 0x6, 0x8, 0xffffffc0, 0x3, 0x3, 0x4, 0x4, 0x80000001, 0xc8ee, 0xbacb161, 0x3ff, 0xffff12d0, 0x2, 0xffff8000, 0x10, 0x1ff, 0x2, 0x5, 0x2, 0x8, 0x7, 0x4, 0x2, 0x0, 0x1, 0x5, 0xfffffffd, 0x6, 0x0, 0x9, 0x8, 0x5, 0x6, 0xfffffffe, 0x2, 0x834f, 0x9, 0x1ff, 0x2, 0x62cd, 0xf98, 0xd8, 0x6, 0x6, 0x9, 0x3, 0xfffff000, 0x40000000, 0x7, 0x81, 0x0, 0x5, 0x10, 0x100, 0x40, 0xc, 0x400, 0x9151, 0x6, 0x7, 0x2, 0xb, 0x7, 0x4, 0x4, 0x64, 0x9, 0x400, 0x2, 0x6, 0x7, 0x971, 0x0, 0x6, 0x3, 0xa46a, 0x8, 0x23, 0x2, 0x8, 0x7fff, 0x8, 0x1, 0x557, 0x2, 0x3ff, 0x3ff, 0x2, 0x1, 0x1, 0x5c, 0x6, 0x1ff, 0x9, 0xb, 0x6, 0x0, 0x7ff, 0x868f, 0x9, 0xffffffff, 0x0, 0xfffffffe, 0x100, 0x40, 0x6c8, 0x8, 0x4, 0x4, 0x4, 0x81, 0xdf, 0x8, 0x4, 0x6, 0x4, 0xc59e, 0x9, 0x891a, 0x4, 0x1, 0x67a, 0x5, 0xaa, 0x2, 0x8000, 0x4, 0x5, 0x2, 0xfff, 0x9, 0x4533afbb, 0xd, 0x0, 0x593c, 0x1, 0xd99b, 0x55aa77c9, 0x56a, 0x9, 0x8, 0x200, 0x10001, 0x5, 0x6, 0x1000, 0xa, 0x5, 0x6, 0x4, 0x1ff, 0x40, 0x2, 0x5dff, 0xfffffffe, 0x8, 0x1, 0x4, 0x4, 0x1ff, 0x101, 0xffff, 0x12, 0x5, 0xfffffffc, 0x7e94, 0x6, 0xca55, 0x2, 0x5, 0x401, 0x8, 0x4, 0x80000000, 0x3, 0x1, 0x7, 0x4, 0x2, 0x8, 0x16, 0x1]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0xb3538085985bb3d6}, 0x0) 1.398276507s ago: executing program 0 (id=600): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000400), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000440)={&(0x7f0000000480)=[{0xd0, 0x4000, 0x0, 0x0}, {0x3, 0xa01, 0x0, 0x0}], 0x2}) 916.484247ms ago: executing program 1 (id=601): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000000c0)={0x14, 0x0, 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000140), 0x1, 0x2603) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000180)={0x0, 0x6, 0x4, &(0x7f00000001c0)={0x2, "1a9c66bf2f615e4200000000e21800"}}) 791.825029ms ago: executing program 2 (id=602): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x20000000, &(0x7f0000000000)={0x11, 0xf8, 0x0, 0x1, 0x6, 0x6, @multicast}, 0x14) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000000)=""/147) 0s ago: executing program 2 (id=603): r0 = syz_ublk_setup_io_uring(0x737c, &(0x7f0000000100)={0x0, 0x6a88, 0x80000, 0x1, 0x268}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000001900)={&(0x7f0000002000)={[{&(0x7f0000000240)="3a1e8d19289a91e9a49bf86aa937c8347b13b987b09975d217f09f79628c8ddaf76236d59ae9e67808e3865d9ba506916236da5bc13de76c45e94f34d728e877205343d201000000ef8ec42364f43158a34353b8223efd7b4a60c742fb6b5a1e5e331834d8d550703102ff0e", 0x6c, 0x1}, {&(0x7f0000000900)="fc07db8c5150d512baa80f1d0642c759b6a9726237ab3b030b5972c96a4bf6c2e4bcc8127cf4b826d3bd1dac564316c75867f4495003c29dcb8dc96abc30450d30992410856ea8c1cabdbe6b831a742912a26d62b37ea31d30c6167c5bcf91462d73178b11f64bee4bb57f0953ed82706d973c84478b01485bfb37799d143fc11ae8d0d51263cb4450b665da210988dc6e82a5897a012a086ca0b50a9173fa497468a993bf011b8d4a08f35abe0380b36933e23a29cd7e4e2386dcc34ae2c2e575e7762247bc8d3dab33d29d698f8b2b85e1930ee4b961f601257f3847ec59e0da5f580779bb625ea39bd6dee52d5c8cec4088365217375c838e50b510dd4232df592e6668a4112600630b01bf9aa264fdf1483f381113f2b5b83a538580eba18f00afbcf703efce2c1f7a620d5db470c672e0740a8533f4ca120b55efcb10a96ca2452e576d33f0db2d45c48f8680a150a4af981f438cd17ae25a482feceb9ff53fa01c882d8174842581277167a7a12e4eb4e3fa4d82ef6b4a77fc00b905fd398578b4a9c6ad46f420d0327815edc2cc26ca33169af3377ff52f7237a80762fd3b676273f9f6a446ea178501e488d47f513197d6902020db2dbb3403f90ce29f9cc892e67113294a9ec340d2b6b35d340ad511a41594b4058cdd230f40eee9644597833655f37f841a4d1aca3191f4d944088fd0ae3775182b4c6f53b8454c2b66a315c32c0f9a9258293a9c88e625b83cf5d36dfa0747016c7be5e47cc3eee931c87127b032673688cb2d48c66f7965b264a4ed30de563e85c3bdb6c67ff26d41bd403c4c819f4fe9703e6d24a4e6fadcd4472e65ac746abbf3cb1d236b7da92b3000e8f55547798a00618bf745a14867a1d8c8c3318dcdf7eeeb72672a8c5df76030d7b37456ad88f6cd3f16815e652dcfc8b76b6378d4bd8b8c62be221e5cf1374fa2be5cbdf53e60b38cacd119056a9e1ae11617266a5d677354932ab54896dd438d227e6cd65b360f228569797adb20101de8ba6e25821860541177ce4505dfe8746f5ae56b6b66fe2d971d5d6c09ce1284605d5f1f3a25df8ec57a055d82d7c790eb3c817e0b850a72d46bae800ea0cce2417b32216e1c741c5e6e5b0d2e5e3c90fa37b27bd40ae57570a849d07d40ad2a89a6338cb6c01319a1a649d8bebade60508f82f11564a8eb12526c32f6770f5873a8052ea09f801cb057833f28433ceb3f8cadd876bcb366c087696ef26b6911fce70b00b4dd86e17698d4a2f82399dbb7915dad475afc4927d8f0ff3e6b6bb50ba73f69b9dee6984fc0ed00aa5b2636eb5c3ea61a821b13e26073c20b8956922f8fd69f4f878f9f784bc659a6872648638a9b4beb84d8dbfc355904fc79d7901012eab64d5736c82783a2fff390c9d6ca2fae8ff5b4917541d444f40f38f58367a7dadb9bdd9ea634fa1a99d36c420b7a05a44937c027c3179af9578f19ae57b10b17ae393f88047fb60b4b48a1873ef66bc5d1e4aeee2acfbba365e33f025225af3d3f58f7192664590c8f680076031d092b4edad08b44aa967f8de14d8a8c97c5a7ad3d84b860305e7ed2d50b3b3c670e3b5e57da3b0902d60fbf35fcb037f2878e19545ba13029ae719b3763931944631e93cce1254c51effe87069c10c9ba0ed0e3700510c3c8194631bd7ea7b737aaf729daf74c0a3c36bacad5f1898ce35fc7fa99e6a03e7f60099ef30c724be8760960a0b01286e41a942efb7e4fea79f158933ad7f74005899350652c518b0567bf72ac1b964d4985e8d0cebb47353943046c1a821650986031352b5fdbb3df259c183b4e6a4a784e008437ee4d5823a16f01b0ab14bbeecde28f34d2a7d0d61de272e548610e6df931e66c58bf6ff8659047ea4502ffa19e01a844cbb472ac0b1aa8a65724b143c1c6155d7a85d7617d296574b95f50beaff40265a8de75c91944b33248f78ccbdfde8d73a2ee7cb79a2fa97acbf69a775de33e1d718cab6ea50262233ad111d8737feedce58e1cc077efd454dffac7f39bc8bc41e5fc60583c00e54718f02315344c3ca9ccd61b603cd897c85a13fc61bf76e20e11ddc91990383db74d4c60c6e8cefb095c1e6e33f477bd3d2692881fb9bc8c51945a067cd79ea0ed37201e18f588d1bcd0e25d3344d1785193b3e60d3686932bf5f2329278e91eee3695f9b00b233dbf82f10a43b5c5eb9fcaede2963fa8a60b5d36b1e3beed5b85898611f048d1de090c62b7e3c0d32fc91c11899210f82477362f899ea7f485fb7bbb44d4e69210e13a4e1b1986e6b58544fe59ab5d5a9981a08600dc05c760259b7d76eab706831b14009081e0c77ef2bb4c7643d62a272ffae1e4e87c6b135768f5c6551ac3c67e20c3b25aace45a593d60356be402e7ef52e8ab25ebc6c9a4e023a55e7329aa0acc72932600ea3e6aff79208194072247e4083d299b9a3071046315d2717fabdebf48d050a7aa8c99587d760f3784065f9d7662d15187439e6372e3781d40c329625d14154cba0ea5fdfae9375e27454f638819072a6dab709d9df01cc7015b85b581d592597383048f741459baaa164931cdda814c15659cb251d1fc2a6da3245a48afa23c5127327dc98b9a8498370a5b97681fa333804a5f695a0f7be0c7e0bf6b69cda3130f0812cc53a4051cbe70bcee2d40b59f2103ef8e76a7abe29288cff8a9a14b07780b3a576c43cc473b55c2e5d7ad6352adc654caba6f74bd9680ee6ad94978c456595a68976556c20891329270bd74548bb17eeea4f731fa6061742949294e513b830430e15453758e52e8413bad6bb31c86618c45ff60227ac53561bfd8584414fb689edb73b5af9d1c6b6ab775520acdc66a6a56e98e2660ebedb936dac125dc22992b667e41da82a825c3b651153202279620101e849ad012267ee855e0c13606849affb092aa0f6d627e9b66cb962ad150ef3bfd28b6b473679f01cef80a538b2e3b708bb8b7bf377f61c48640dc3e5f539be28123555407edb8caacf01c8413fe467791960e0cbcd2f2fee1b7c102459e0c7d5fc742db4062c631e305a13fecf0d225b64f52edf0be81dc678fa78d01914b47b415ab5147b87ac89781931cc9d8de5cca689935ccb07808813efec0d2149e3c7ef767a342e04dacf7a42adacfafd7990252cb7c00e874064ff0af76d7017b1b985bd691a35378c21b74e9a6d8d2d8cf1b2a885174a61a493c446c9c7cf12ff3f5367c2ebde01ec4635aad630a27a0d53aec7515b2d399df22a08bcabc453e8ad9a7ebe44e1bb9eab63b539d02a0b6a2a525a6e2b51a64a883f010333a6a9a6c71303d89ceb633cf42105730834fc6ff72812e1651e9ca7152563ba8b6fe12b38ecc7ce02195937611414f823c593cd240a869a5b88f06c0f41a9c8c22b1ef623e92f293c23ea88457543ac591bab3663709de8c0c0e3c477ef96a3ef13dc2cf4f24f37748386d2318b9b6d90acb1de6cb4d4cb5acdf209a6bcb01de7c3332eed8ab2f79f4381945ac944d06d29e6843429ab6d75f300e8e6296c52dca5e267f45e4e4534bf89116525768bbb12e6ebee7e0972b53882a26266e22b0fba28d4844d9c10940df8063c2009ac6f7e589944ab73f0e605051db39b8e65fe2f9cb9707354cd789dc1dc22e73dc0fceed2693dd4f363ecd8f5666556a57d9fe8ee5b603c7a06b1717da3c01c8040c9bd9450d2221cd5af5386ea9224cde1e9aeda5b08d99e119030b20a43278335e42e26491f5684e2405e44ce48c444376185d695a57db797bcb36785ca0b651a210bcb1a0f5e9a260f641d90e50ee7f0b1681f5b08eeebe51f4ac0f0a40884cf66d2cae4e8706e32af6aafcf464f5f8162da5ad9f0a21a153a265a9cd8b874f15ddc2aac385e6b8ec4ce637fafc6d9793a4de1bc70b8575f6392662f29303d6b21e9c83ddce97d2d411ccd5f9a5f9e4694dfc7622d49231dee3ce50c2a7b98bec88d9ff57b0dd0e8db9b8e701a1c0c06cda9621078bb25b81eeaefc48806393b50eb992ceead2b14cbffee36cb2dde9b3104908bfeeb3e0d991465272db3e102facd75d01e08c191512316017806d6581fdcacc3a449e4f8b3b13fdd203cfb0e9463ac3e09c03ae94ed9dea4245be43efa4806c3e38e04c9d3fbfce021fdfe14516cf000e80fdbd2e9630dffc4cb1e98b0caa2822d03272701629101c1fa71e025add816832bd040f3bbe1d62617c3103f47fe03c1a04e705c089200e35b477356f6978ed4773c65ae3a9259ee8271372c6cc25e956777a7b2af46a8e4f3733294d574553d1e9118205766ee0ebfe42c7efe16bd301c20e1b0d7ff0edb35cd3ef346ae3426f2048ddbe0468bb8ea9970720bac8d703e05602c6d2fe9496efc7930a42d964a24189bab1fd3c5edf46915d143538d8b2cf26fd45511435c31a989ae17e08f09f86df3461bc6c79e1fdee0bd2391fa1dba29659f4929523181a335d67875e17f283acb0dc8cee378aea2e92e212d2cb15e9db38710a5f18b521cd12ddca13498d6f1e1a2d9625246d77b9e0d4fc8604d62069d545716ce0c451bd856451b84b449e8d67a985d23368fdc6b9f0008e0f0114d7081a5c6250db94da73e55810d5a46828ecea0c6ead52782a9092d9c4cfc9c1ef92915b05c65439c9242e776d1ad3f8d770bc0403bb7dce434aab4308d341903b052e1481ae6938f4aff49d2ff3dae5ec04c50a7355e3ab720094e209ed631174eb4367d1f343ddbe75caca7e4dbdbccda3e9fdcdfa012d826c72260ae5e91738c3e113efd062b5f8b0fa9712077085a338ca1a4aba2ea884e59757a1dc83d064c303b27f14326cea76e5d191d07fea2f4f11dc9437e3d9860ef3888feac94d049b5ed8d46f9b1e9f3d4c75e0bc9ec7359b36547712f59fd4de5ce58a02fc6e48b0607f0801627da765b731fd6790ef357b07a689ec4e2ad3bb50318cfce99329c87ba757d60219e60df3b4e02a13b0a9c4a5059ea70e1e847ef4519649b6f10568acb90f8e8c34be416093e844cd87ef86c2705752773ec5d5cf569a3d4c4669ee9acd2022639bd19e272cac3b90469f77c34c77e22b9b3be82ed5da49f7c1ebad8ee618a8095ae0e26a0dd051612a6b57946906b91a574f8541efb4d5c53838f897538c1d323556d0c4b779dccefa993d394ff4dbcea47de892666b14c97ea0b1b7ba08fd170197b9507b9910fdcbae22c76b6e0dbdca740a31aea895b1d5edf6220f702a26ab6c9151cded312c5308b6999a37b3b52d7bb472854d938bc4c47bec4b893b2c8e3ab55c64d62a88dca3aa6dccf8e9ff5188799fd7d3d8092749290e9cc9a10781883a42ae497e809643055569dee2c031acc91fc67ff614eee81acf051d53c8dc306149079b24b8d40b32ffd1dd7c054514923de697be65375d35f82e501ca334c32a2787a2dedbdaae12736d0188202954c29eb63bae4f674fbad3259d5376060e20413fab7eb220add5bafc936b2133eb73bb2edd991250bcfcb39a2f5bf2e47b7efdae0988cd9da9f5fc9b0f09eb767f0113cc8bbb6c0a00c852bbfe5d13c3547186c25a45fab68366bb2b0feba989022c9b5a68fd2271b7f28a985fb1eb7c3f3ed5b0fb66527e78d6f4ef0a7257a817dfb75bb2d6496516e9c9896a9a69addd754c858dbd192ffd8e963706b8e4b074d20dfe4159fbed9fa65dece12b55e9c86e4a31a753c339765a05a2d4ad7a8e907cc3d29913cc8532a1de29d87900606ff83e00831dbd498a1f6f471713f39dba8c47d40a989301856bb207d33ffaacabcbc43b4d28ae9ab3", 0x1000, 0x2}]}, 0x2, 0x0, 0x2}, 0x1) syz_usb_connect(0x5, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003b0705a402104e302b7430102030109023600030007000309043ba7010202ff8309050c10200002040409043b71cdab72fa848000ffffff090904380101ffffff08090504"], &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000300)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) kernel console output (not intermixed with test programs): 131.486095][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 131.543874][ T5151] loop5: [ 133.046412][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.067329][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.226002][ T6267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.107'. [ 133.237863][ T6263] FAULT_INJECTION: forcing a failure. [ 133.237863][ T6263] name fail_futex, interval 1, probability 0, space 0, times 0 [ 133.257423][ T6263] CPU: 0 PID: 6263 Comm: syz.2.101 Not tainted syzkaller #0 [ 133.264783][ T6263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 133.274880][ T6263] Call Trace: [ 133.278205][ T6263] [ 133.281172][ T6263] dump_stack_lvl+0x18c/0x250 [ 133.285906][ T6263] ? alloc_file_pseudo+0x184/0x210 [ 133.291068][ T6263] ? __sys_socket+0x140/0x1b0 [ 133.295792][ T6263] ? show_regs_print_info+0x20/0x20 [ 133.301036][ T6263] ? load_image+0x420/0x420 [ 133.305651][ T6263] ? mark_lock+0x94/0x320 [ 133.310037][ T6263] should_fail_ex+0x394/0x4c0 [ 133.314794][ T6263] get_futex_key+0x134/0xf40 [ 133.319437][ T6263] ? futex_setup_timer+0xc0/0xc0 [ 133.324434][ T6263] futex_wake+0x127/0x4f0 [ 133.328825][ T6263] ? futex_wake_mark+0x150/0x150 [ 133.333823][ T6263] ? fd_install+0x60/0x4e0 [ 133.338294][ T6263] do_futex+0x35d/0x3e0 [ 133.342498][ T6263] ? __ia32_sys_get_robust_list+0x110/0x110 [ 133.348464][ T6263] ? __lock_acquire+0x7eb0/0x7eb0 [ 133.353568][ T6263] __se_sys_futex+0x3a9/0x440 [ 133.358296][ T6263] ? __x64_sys_futex+0xf0/0xf0 [ 133.363117][ T6263] ? __x64_sys_futex+0x21/0xf0 [ 133.367943][ T6263] do_syscall_64+0x55/0xb0 [ 133.372419][ T6263] ? clear_bhb_loop+0x40/0x90 [ 133.377155][ T6263] ? clear_bhb_loop+0x40/0x90 [ 133.381890][ T6263] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 133.387836][ T6263] RIP: 0033:0x7fba999a94d9 [ 133.392298][ T6263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.411973][ T6263] RSP: 002b:00007fba9a89e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 133.420438][ T6263] RAX: ffffffffffffffda RBX: 00007fba99c25fa8 RCX: 00007fba999a94d9 [ 133.428458][ T6263] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fba99c25fac [ 133.436474][ T6263] RBP: 00007fba99c25fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 133.444487][ T6263] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 133.452529][ T6263] R13: 00007fba99c26038 R14: 00007fff2fa500e0 R15: 00007fff2fa501c8 [ 133.460595][ T6263] [ 134.298972][ T23] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 134.348736][ T1206] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 134.558972][ T23] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 135.157763][ T27] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 135.229894][ T1206] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 135.246620][ T1206] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 135.262101][ T1206] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 135.276544][ T1206] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 135.308063][ T1206] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 135.327526][ T1206] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.399679][ T6263] ceph: No mds server is up or the cluster is laggy [ 135.573558][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 135.618668][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 135.711562][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 135.743091][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 135.774303][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 135.817778][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 136.144828][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 136.681682][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 136.690120][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 136.697798][ T5151] loop5: [ 136.801932][ T6288] netlink: 36 bytes leftover after parsing attributes in process `syz.3.106'. [ 137.186026][ T1206] [drm] Initialized gud 1.0.0 20200422 for 2-1:1.0 on minor 2 [ 138.338791][ T1206] gud 2-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 138.385167][ T1206] usb 2-1: USB disconnect, device number 5 [ 139.350539][ T6314] netlink: 8 bytes leftover after parsing attributes in process `syz.0.112'. [ 140.542102][ T6326] comedi comedi3: board detection failed [ 140.615213][ T6330] bridge0: port 3(netdevsim0) entered blocking state [ 140.625218][ T6330] bridge0: port 3(netdevsim0) entered disabled state [ 140.633366][ T6330] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 140.648695][ T6330] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 140.657895][ T6330] bridge0: port 3(netdevsim0) entered blocking state [ 140.664726][ T6330] bridge0: port 3(netdevsim0) entered forwarding state [ 145.196846][ T6356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.123'. [ 147.147615][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 147.557211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 148.216142][ T6374] comedi comedi3: board detection failed [ 148.293353][ T6377] bridge0: port 3(netdevsim0) entered blocking state [ 148.300588][ T6377] bridge0: port 3(netdevsim0) entered disabled state [ 148.311842][ T6377] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 148.324886][ T6377] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 148.334421][ T6377] bridge0: port 3(netdevsim0) entered blocking state [ 148.341305][ T6377] bridge0: port 3(netdevsim0) entered forwarding state [ 149.707601][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 150.117205][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 155.188296][ T6416] FAULT_INJECTION: forcing a failure. [ 155.188296][ T6416] name failslab, interval 1, probability 0, space 0, times 0 [ 155.201347][ T6416] CPU: 0 PID: 6416 Comm: syz.2.138 Not tainted syzkaller #0 [ 155.208688][ T6416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 155.218961][ T6416] Call Trace: [ 155.222283][ T6416] [ 155.225254][ T6416] dump_stack_lvl+0x18c/0x250 [ 155.229997][ T6416] ? show_regs_print_info+0x20/0x20 [ 155.235253][ T6416] ? load_image+0x420/0x420 [ 155.239815][ T6416] ? __lock_acquire+0x7eb0/0x7eb0 [ 155.244897][ T6416] should_fail_ex+0x394/0x4c0 [ 155.249637][ T6416] should_failslab+0x9/0x20 [ 155.254191][ T6416] slab_pre_alloc_hook+0x59/0x300 [ 155.259266][ T6416] ? ceph_alloc_options+0x4e/0x1d0 [ 155.264459][ T6416] __kmem_cache_alloc_node+0x53/0x260 [ 155.269887][ T6416] ? ceph_alloc_options+0x4e/0x1d0 [ 155.275076][ T6416] kmalloc_trace+0x2a/0xe0 [ 155.279583][ T6416] ceph_alloc_options+0x4e/0x1d0 [ 155.284586][ T6416] ceph_init_fs_context+0x68/0x4a0 [ 155.289759][ T6416] ? destroy_caches+0x80/0x80 [ 155.294518][ T6416] alloc_fs_context+0x618/0x7a0 [ 155.299453][ T6416] __se_sys_fsopen+0xa0/0x2c0 [ 155.304203][ T6416] do_syscall_64+0x55/0xb0 [ 155.308683][ T6416] ? clear_bhb_loop+0x40/0x90 [ 155.313423][ T6416] ? clear_bhb_loop+0x40/0x90 [ 155.318158][ T6416] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.324105][ T6416] RIP: 0033:0x7fba999a94d9 [ 155.328600][ T6416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.348268][ T6416] RSP: 002b:00007fba9a87d028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 155.356737][ T6416] RAX: ffffffffffffffda RBX: 00007fba99c26090 RCX: 00007fba999a94d9 [ 155.364779][ T6416] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 155.372808][ T6416] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 155.380833][ T6416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 155.388878][ T6416] R13: 00007fba99c26128 R14: 00007fba99c26090 R15: 00007fff2fa501c8 [ 155.396918][ T6416] [ 156.250908][ T6425] netlink: 8 bytes leftover after parsing attributes in process `syz.2.139'. [ 156.306760][ T6425] netlink: 20 bytes leftover after parsing attributes in process `syz.2.139'. [ 156.742972][ T6432] netlink: 4 bytes leftover after parsing attributes in process `syz.2.142'. [ 158.259529][ T6446] netlink: 8 bytes leftover after parsing attributes in process `syz.0.144'. [ 158.814858][ T6373] syz.1.128 (6373) used greatest stack depth: 20328 bytes left [ 159.161649][ T6457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.150'. [ 159.171285][ T6457] netlink: 20 bytes leftover after parsing attributes in process `syz.0.150'. [ 159.307180][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 33 (since boot) is 1105 jiffies old. [ 160.767640][ T6482] netlink: 8 bytes leftover after parsing attributes in process `syz.0.155'. [ 161.393227][ T6490] syz.2.156[6490]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 162.393001][ T6492] comedi comedi3: board detection failed [ 165.225522][ T6499] netlink: 8 bytes leftover after parsing attributes in process `syz.1.160'. [ 165.290086][ T6499] netlink: 20 bytes leftover after parsing attributes in process `syz.1.160'. [ 168.857891][ T27] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 169.017770][ T27] usb 1-1: device descriptor read/64, error -71 [ 169.297619][ T27] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 169.497927][ T27] usb 1-1: device descriptor read/64, error -71 [ 169.630837][ T27] usb usb1-port1: attempt power cycle [ 169.742692][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 169.966412][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 170.831104][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 170.867656][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 170.906908][ T27] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 170.947659][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 170.956007][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 171.017952][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 171.026329][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 171.037906][ T27] usb 1-1: device descriptor read/8, error -71 [ 171.107600][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 171.116293][ T5151] loop5: [ 172.080521][ T27] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 172.128047][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 172.137655][ T27] usb 1-1: device descriptor read/8, error -32 [ 172.258065][ T27] usb usb1-port1: unable to enumerate USB device [ 173.880381][ T9] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 174.068477][ T9] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 174.954037][ T6586] fido_id[6586]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 179.443041][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 179.462885][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 179.489296][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 179.528529][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 179.535761][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 179.555817][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 179.567689][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 179.607132][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 179.636830][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 179.651815][ T5151] loop5: [ 179.748218][ T6656] netlink: 8 bytes leftover after parsing attributes in process `syz.2.203'. [ 180.577679][ T6656] netlink: 20 bytes leftover after parsing attributes in process `syz.2.203'. [ 180.620617][ T6651] FAULT_INJECTION: forcing a failure. [ 180.620617][ T6651] name failslab, interval 1, probability 0, space 0, times 0 [ 180.746193][ T5932] syz.1.8 (5932) used greatest stack depth: 17512 bytes left [ 180.786578][ T6651] CPU: 0 PID: 6651 Comm: syz.1.198 Not tainted syzkaller #0 [ 180.793972][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 180.804093][ T6651] Call Trace: [ 180.807416][ T6651] [ 180.810400][ T6651] dump_stack_lvl+0x18c/0x250 [ 180.815157][ T6651] ? show_regs_print_info+0x20/0x20 [ 180.820434][ T6651] ? load_image+0x420/0x420 [ 180.825000][ T6651] ? __might_sleep+0xe0/0xe0 [ 180.829668][ T6651] ? __lock_acquire+0x7eb0/0x7eb0 [ 180.834756][ T6651] should_fail_ex+0x394/0x4c0 [ 180.839501][ T6651] should_failslab+0x9/0x20 [ 180.844055][ T6651] slab_pre_alloc_hook+0x59/0x300 [ 180.849143][ T6651] ? kvmalloc_node+0x70/0x180 [ 180.853884][ T6651] ? kvmalloc_node+0x70/0x180 [ 180.858633][ T6651] __kmem_cache_alloc_node+0x53/0x260 [ 180.864077][ T6651] ? kvmalloc_node+0x70/0x180 [ 180.868813][ T6651] __kmalloc_node+0xa6/0x240 [ 180.873462][ T6651] kvmalloc_node+0x70/0x180 [ 180.878033][ T6651] ceph_msg_new2+0x162/0x490 [ 180.882658][ T6651] msgpool_alloc+0x80/0x1b0 [ 180.887192][ T6651] ? ceph_msgpool_init+0x180/0x180 [ 180.892436][ T6651] mempool_init_node+0x1e9/0x480 [ 180.897443][ T6651] ? msgpool_alloc+0x1b0/0x1b0 [ 180.902246][ T6651] ? ceph_msgpool_init+0x180/0x180 [ 180.907394][ T6651] mempool_create+0x81/0xc0 [ 180.911958][ T6651] ceph_msgpool_init+0xa7/0x180 [ 180.916838][ T6651] ceph_osdc_init+0x591/0x8c0 [ 180.921584][ T6651] ceph_create_client+0x246/0x300 [ 180.926662][ T6651] ceph_get_tree+0x1ca/0x1800 [ 180.931374][ T6651] ? bpf_lsm_capable+0x9/0x10 [ 180.936082][ T6651] ? security_capable+0x89/0xb0 [ 180.940968][ T6651] vfs_get_tree+0x8c/0x280 [ 180.945426][ T6651] do_new_mount+0x24a/0xa60 [ 180.949969][ T6651] __se_sys_mount+0x2e7/0x3d0 [ 180.954705][ T6651] ? __x64_sys_mount+0xc0/0xc0 [ 180.959522][ T6651] ? lockdep_hardirqs_on+0x98/0x150 [ 180.964749][ T6651] ? __x64_sys_mount+0x20/0xc0 [ 180.969558][ T6651] do_syscall_64+0x55/0xb0 [ 180.974020][ T6651] ? clear_bhb_loop+0x40/0x90 [ 180.978735][ T6651] ? clear_bhb_loop+0x40/0x90 [ 180.983455][ T6651] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 180.989389][ T6651] RIP: 0033:0x7f90dfba94d9 [ 180.993836][ T6651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.013479][ T6651] RSP: 002b:00007f90e098d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 181.021941][ T6651] RAX: ffffffffffffffda RBX: 00007f90dfe25fa0 RCX: 00007f90dfba94d9 [ 181.029945][ T6651] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 181.037955][ T6651] RBP: 00007f90dfc3804e R08: 0000000000000000 R09: 0000000000000000 [ 181.045960][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 181.054135][ T6651] R13: 00007f90dfe26038 R14: 00007f90dfe25fa0 R15: 00007fffff835a78 [ 181.062177][ T6651] [ 181.133680][ T6665] comedi comedi3: board detection failed [ 182.797756][ T5793] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 182.947585][ T5793] usb 3-1: device descriptor read/64, error -71 [ 182.978058][ T5882] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 183.039896][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 183.066635][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 183.086658][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 183.100075][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 183.108569][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.117065][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.125440][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.133839][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 183.142256][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 183.149879][ T5882] usb 1-1: device descriptor read/64, error -71 [ 183.156725][ T5151] loop5: [ 183.227546][ T5793] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 183.498609][ T5882] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 183.807466][ T5882] usb 1-1: device descriptor read/64, error -71 [ 183.998608][ T5882] usb usb1-port1: attempt power cycle [ 184.088925][ T6692] netlink: 8 bytes leftover after parsing attributes in process `syz.3.213'. [ 184.117110][ T5793] usb 3-1: device descriptor read/64, error -71 [ 184.123723][ T6692] netlink: 20 bytes leftover after parsing attributes in process `syz.3.213'. [ 184.238024][ T5793] usb usb3-port1: attempt power cycle [ 184.460373][ T5905] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 184.467713][ T5882] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 184.508258][ T5882] usb 1-1: device descriptor read/8, error -71 [ 184.638192][ T6701] comedi comedi3: board detection failed [ 184.657836][ T5793] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 184.765008][ T5905] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 184.794328][ T5793] usb 3-1: device descriptor read/8, error -71 [ 185.117277][ T5793] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 185.254254][ T5793] usb 3-1: device descriptor read/8, error -71 [ 185.362297][ T1206] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 185.415179][ T6696] ceph: No mds server is up or the cluster is laggy [ 185.474089][ T5793] usb usb3-port1: unable to enumerate USB device [ 185.637124][ T5882] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 185.837339][ T5882] usb 1-1: device descriptor read/8, error -71 [ 185.983373][ T5882] usb usb1-port1: unable to enumerate USB device [ 187.147715][ T6722] netlink: 4 bytes leftover after parsing attributes in process `syz.3.222'. [ 188.355574][ T6738] syzkaller0: entered promiscuous mode [ 188.367102][ T6738] syzkaller0: entered allmulticast mode [ 188.447424][ T6743] comedi comedi3: board detection failed [ 188.633183][ T6741] FAULT_INJECTION: forcing a failure. [ 188.633183][ T6741] name failslab, interval 1, probability 0, space 0, times 0 [ 188.701332][ T6741] CPU: 1 PID: 6741 Comm: syz.2.227 Not tainted syzkaller #0 [ 188.708721][ T6741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 188.718829][ T6741] Call Trace: [ 188.722158][ T6741] [ 188.725133][ T6741] dump_stack_lvl+0x18c/0x250 [ 188.729878][ T6741] ? show_regs_print_info+0x20/0x20 [ 188.735146][ T6741] ? load_image+0x420/0x420 [ 188.739711][ T6741] ? __might_sleep+0xe0/0xe0 [ 188.744358][ T6741] ? __lock_acquire+0x7eb0/0x7eb0 [ 188.749443][ T6741] should_fail_ex+0x394/0x4c0 [ 188.754184][ T6741] should_failslab+0x9/0x20 [ 188.758763][ T6741] slab_pre_alloc_hook+0x59/0x300 [ 188.763841][ T6741] ? kvmalloc_node+0x70/0x180 [ 188.768592][ T6741] ? kvmalloc_node+0x70/0x180 [ 188.773362][ T6741] __kmem_cache_alloc_node+0x53/0x260 [ 188.778817][ T6741] ? kvmalloc_node+0x70/0x180 [ 188.783572][ T6741] __kmalloc_node+0xa6/0x240 [ 188.788233][ T6741] kvmalloc_node+0x70/0x180 [ 188.792802][ T6741] ceph_msg_new2+0x162/0x490 [ 188.797440][ T6741] msgpool_alloc+0x80/0x1b0 [ 188.802011][ T6741] ? ceph_msgpool_init+0x180/0x180 [ 188.807259][ T6741] mempool_init_node+0x1e9/0x480 [ 188.812257][ T6741] ? msgpool_alloc+0x1b0/0x1b0 [ 188.817064][ T6741] ? ceph_msgpool_init+0x180/0x180 [ 188.822220][ T6741] mempool_create+0x81/0xc0 [ 188.826818][ T6741] ceph_msgpool_init+0xa7/0x180 [ 188.831724][ T6741] ceph_osdc_init+0x591/0x8c0 [ 188.836467][ T6741] ceph_create_client+0x246/0x300 [ 188.841561][ T6741] ceph_get_tree+0x1ca/0x1800 [ 188.846296][ T6741] ? bpf_lsm_capable+0x9/0x10 [ 188.851019][ T6741] ? security_capable+0x89/0xb0 [ 188.855939][ T6741] vfs_get_tree+0x8c/0x280 [ 188.860424][ T6741] do_new_mount+0x24a/0xa60 [ 188.865000][ T6741] __se_sys_mount+0x2e7/0x3d0 [ 188.869750][ T6741] ? __x64_sys_mount+0xc0/0xc0 [ 188.874580][ T6741] ? lockdep_hardirqs_on+0x98/0x150 [ 188.879832][ T6741] ? __x64_sys_mount+0x20/0xc0 [ 188.884654][ T6741] do_syscall_64+0x55/0xb0 [ 188.889154][ T6741] ? clear_bhb_loop+0x40/0x90 [ 188.893922][ T6741] ? clear_bhb_loop+0x40/0x90 [ 188.898686][ T6741] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 188.904637][ T6741] RIP: 0033:0x7fba999a94d9 [ 188.909102][ T6741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.928759][ T6741] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 188.937226][ T6741] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 188.945368][ T6741] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 188.953394][ T6741] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 188.961415][ T6741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.969430][ T6741] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 188.977555][ T6741] [ 190.667623][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 191.017308][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 191.077262][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 191.345421][ T6745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.229'. [ 191.804679][ T6760] netlink: 24 bytes leftover after parsing attributes in process `syz.1.232'. [ 192.913033][ T6767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.236'. [ 193.584537][ T6778] FAULT_INJECTION: forcing a failure. [ 193.584537][ T6778] name failslab, interval 1, probability 0, space 0, times 0 [ 193.634948][ T6778] CPU: 0 PID: 6778 Comm: syz.0.238 Not tainted syzkaller #0 [ 193.642392][ T6778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 193.652465][ T6778] Call Trace: [ 193.655758][ T6778] [ 193.658709][ T6778] dump_stack_lvl+0x18c/0x250 [ 193.663414][ T6778] ? show_regs_print_info+0x20/0x20 [ 193.668830][ T6778] ? load_image+0x420/0x420 [ 193.673368][ T6778] ? __lock_acquire+0x7eb0/0x7eb0 [ 193.678446][ T6778] should_fail_ex+0x394/0x4c0 [ 193.683192][ T6778] should_failslab+0x9/0x20 [ 193.687730][ T6778] slab_pre_alloc_hook+0x59/0x300 [ 193.692794][ T6778] ? __kmem_cache_alloc_node+0x197/0x260 [ 193.698547][ T6778] kmem_cache_alloc+0x5a/0x2d0 [ 193.703337][ T6778] ? ceph_msg_new2+0x3a/0x490 [ 193.708067][ T6778] ceph_msg_new2+0x3a/0x490 [ 193.712616][ T6778] msgpool_alloc+0x80/0x1b0 [ 193.717149][ T6778] ? ceph_msgpool_init+0x180/0x180 [ 193.722306][ T6778] mempool_init_node+0x1e9/0x480 [ 193.727375][ T6778] ? msgpool_alloc+0x1b0/0x1b0 [ 193.732172][ T6778] ? ceph_msgpool_init+0x180/0x180 [ 193.737314][ T6778] mempool_create+0x81/0xc0 [ 193.741866][ T6778] ceph_msgpool_init+0xa7/0x180 [ 193.746744][ T6778] ceph_osdc_init+0x591/0x8c0 [ 193.751452][ T6778] ceph_create_client+0x246/0x300 [ 193.756499][ T6778] ceph_get_tree+0x1ca/0x1800 [ 193.761213][ T6778] ? bpf_lsm_capable+0x9/0x10 [ 193.765903][ T6778] ? security_capable+0x89/0xb0 [ 193.770773][ T6778] vfs_get_tree+0x8c/0x280 [ 193.775235][ T6778] do_new_mount+0x24a/0xa60 [ 193.779767][ T6778] __se_sys_mount+0x2e7/0x3d0 [ 193.784468][ T6778] ? __x64_sys_mount+0xc0/0xc0 [ 193.789275][ T6778] ? lockdep_hardirqs_on+0x98/0x150 [ 193.794498][ T6778] ? __x64_sys_mount+0x20/0xc0 [ 193.799282][ T6778] do_syscall_64+0x55/0xb0 [ 193.803717][ T6778] ? clear_bhb_loop+0x40/0x90 [ 193.808424][ T6778] ? clear_bhb_loop+0x40/0x90 [ 193.813163][ T6778] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 193.819105][ T6778] RIP: 0033:0x7efe177a94d9 [ 193.823562][ T6778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.843199][ T6778] RSP: 002b:00007efe159f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 193.851663][ T6778] RAX: ffffffffffffffda RBX: 00007efe17a25fa0 RCX: 00007efe177a94d9 [ 193.859676][ T6778] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 193.867675][ T6778] RBP: 00007efe1783804e R08: 0000000000000000 R09: 0000000000000000 [ 193.875681][ T6778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 193.883676][ T6778] R13: 00007efe17a26038 R14: 00007efe17a25fa0 R15: 00007ffdf70422f8 [ 193.891691][ T6778] [ 193.979469][ T6780] syzkaller0: entered promiscuous mode [ 193.985127][ T6780] syzkaller0: entered allmulticast mode [ 194.464615][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.471431][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.497976][ T5905] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 194.709604][ T5905] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 194.741857][ T5905] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 194.774151][ T5905] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 194.804566][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.838973][ T5905] usb 1-1: config 0 descriptor?? [ 195.911030][ T5905] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 195.924133][ T5905] cm6533_jd 0003:0D8C:0022.0003: unknown main item tag 0x0 [ 195.951218][ T5905] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0003/input/input10 [ 196.024246][ T5905] cm6533_jd 0003:0D8C:0022.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 196.149052][ T5905] usb 1-1: USB disconnect, device number 13 [ 196.170418][ T6810] FAULT_INJECTION: forcing a failure. [ 196.170418][ T6810] name failslab, interval 1, probability 0, space 0, times 0 [ 196.235244][ T6810] CPU: 1 PID: 6810 Comm: syz.2.249 Not tainted syzkaller #0 [ 196.242662][ T6810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 196.252858][ T6810] Call Trace: [ 196.256194][ T6810] [ 196.259173][ T6810] dump_stack_lvl+0x18c/0x250 [ 196.263923][ T6810] ? show_regs_print_info+0x20/0x20 [ 196.269182][ T6810] ? load_image+0x420/0x420 [ 196.273855][ T6810] ? __might_sleep+0xe0/0xe0 [ 196.278532][ T6810] ? __lock_acquire+0x7eb0/0x7eb0 [ 196.283616][ T6810] should_fail_ex+0x394/0x4c0 [ 196.288364][ T6810] should_failslab+0x9/0x20 [ 196.292912][ T6810] slab_pre_alloc_hook+0x59/0x300 [ 196.297955][ T6810] ? kvmalloc_node+0x70/0x180 [ 196.302742][ T6810] ? kvmalloc_node+0x70/0x180 [ 196.307456][ T6810] __kmem_cache_alloc_node+0x53/0x260 [ 196.312855][ T6810] ? kvmalloc_node+0x70/0x180 [ 196.317559][ T6810] __kmalloc_node+0xa6/0x240 [ 196.322177][ T6810] kvmalloc_node+0x70/0x180 [ 196.326716][ T6810] ceph_msg_new2+0x162/0x490 [ 196.331329][ T6810] msgpool_alloc+0x80/0x1b0 [ 196.335847][ T6810] ? ceph_msgpool_init+0x180/0x180 [ 196.341008][ T6810] mempool_init_node+0x1e9/0x480 [ 196.345969][ T6810] ? msgpool_alloc+0x1b0/0x1b0 [ 196.350745][ T6810] ? ceph_msgpool_init+0x180/0x180 [ 196.355886][ T6810] mempool_create+0x81/0xc0 [ 196.360428][ T6810] ceph_msgpool_init+0xa7/0x180 [ 196.365295][ T6810] ceph_osdc_init+0x591/0x8c0 [ 196.370002][ T6810] ceph_create_client+0x246/0x300 [ 196.375056][ T6810] ceph_get_tree+0x1ca/0x1800 [ 196.379765][ T6810] ? bpf_lsm_capable+0x9/0x10 [ 196.384550][ T6810] ? security_capable+0x89/0xb0 [ 196.389439][ T6810] vfs_get_tree+0x8c/0x280 [ 196.393881][ T6810] do_new_mount+0x24a/0xa60 [ 196.398413][ T6810] __se_sys_mount+0x2e7/0x3d0 [ 196.403138][ T6810] ? __x64_sys_mount+0xc0/0xc0 [ 196.407966][ T6810] ? lockdep_hardirqs_on+0x98/0x150 [ 196.413179][ T6810] ? __x64_sys_mount+0x20/0xc0 [ 196.417965][ T6810] do_syscall_64+0x55/0xb0 [ 196.422396][ T6810] ? clear_bhb_loop+0x40/0x90 [ 196.427106][ T6810] ? clear_bhb_loop+0x40/0x90 [ 196.431829][ T6810] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 196.437748][ T6810] RIP: 0033:0x7fba999a94d9 [ 196.442174][ T6810] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.461798][ T6810] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 196.470229][ T6810] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 196.478216][ T6810] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 196.486204][ T6810] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 196.494187][ T6810] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 196.502172][ T6810] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 196.510174][ T6810] [ 196.655705][ T6816] syzkaller0: entered promiscuous mode [ 196.667788][ T6816] syzkaller0: entered allmulticast mode [ 196.772181][ T6814] fido_id[6814]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 196.788529][ T6812] netlink: 4 bytes leftover after parsing attributes in process `syz.1.248'. [ 197.296405][ T6832] netlink: 36 bytes leftover after parsing attributes in process `syz.2.252'. [ 197.668630][ T5905] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 197.892431][ T5905] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 197.932982][ T5905] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 197.987796][ T5905] usb 3-1: config 0 interface 0 has no altsetting 0 [ 197.994687][ T5905] usb 3-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 198.037718][ T5905] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.097904][ T5905] usb 3-1: config 0 descriptor?? [ 198.181597][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 198.195172][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 198.225672][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 198.265108][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 198.288873][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 198.304932][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 198.335440][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 198.344461][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 37 (since boot) is 1009 jiffies old. [ 198.355943][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 198.396416][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 198.421885][ T5151] loop5: [ 198.533462][ T5905] usbhid 3-1:0.0: can't add hid device: -71 [ 198.786406][ T5905] usbhid: probe of 3-1:0.0 failed with error -71 [ 199.298387][ T5905] usb 3-1: USB disconnect, device number 12 [ 199.381885][ T5882] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 199.602703][ T6850] ceph: No mds server is up or the cluster is laggy [ 200.289575][ T6868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.262'. [ 200.437781][ T27] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 201.330871][ T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.342623][ T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 201.362213][ T27] usb 1-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 201.387047][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.433815][ T27] usb 1-1: config 0 descriptor?? [ 202.760541][ T27] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 202.777192][ T27] cm6533_jd 0003:0D8C:0022.0004: unknown main item tag 0x0 [ 202.788301][ T27] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0D8C:0022.0004/input/input11 [ 202.809794][ T27] cm6533_jd 0003:0D8C:0022.0004: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.0-1/input0 [ 202.932705][ T6150] syz.1.70 (6150) used greatest stack depth: 17448 bytes left [ 203.033129][ T5905] usb 1-1: USB disconnect, device number 14 [ 203.072440][ T6881] fido_id[6881]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 204.017150][ T5882] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 204.242460][ T6900] netlink: 4 bytes leftover after parsing attributes in process `syz.1.268'. [ 204.257284][ T5882] usb 4-1: Using ep0 maxpacket: 8 [ 204.274285][ T5882] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 204.291590][ T6901] comedi comedi3: board detection failed [ 204.301539][ T5882] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 204.332170][ T5882] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 204.430865][ T5882] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 204.438922][ T5905] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 204.441314][ T5882] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 204.467616][ T5882] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 204.476820][ T5882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.707970][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 204.714430][ T5905] usb 1-1: no configurations [ 204.720006][ T5905] usb 1-1: can't read configurations, error -22 [ 204.744774][ T5882] usb 4-1: usb_control_msg returned -32 [ 204.757570][ T5882] usbtmc 4-1:16.0: can't read capabilities [ 204.856007][ T6905] netlink: 4 bytes leftover after parsing attributes in process `syz.2.273'. [ 204.877640][ T5905] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 205.067541][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 205.467498][ T5882] usb 4-1: USB disconnect, device number 5 [ 205.741276][ T5905] usb 1-1: no configurations [ 205.745985][ T5905] usb 1-1: can't read configurations, error -22 [ 205.754098][ T5905] usb usb1-port1: attempt power cycle [ 206.253417][ T5905] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 206.419023][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 206.509091][ T5905] usb 1-1: no configurations [ 206.567953][ T5905] usb 1-1: can't read configurations, error -22 [ 206.779724][ T5804] Bluetooth: hci3: command 0x0406 tx timeout [ 206.785933][ T5804] Bluetooth: hci0: command 0x0406 tx timeout [ 206.792107][ T5097] Bluetooth: hci2: command 0x0406 tx timeout [ 206.802908][ T5804] Bluetooth: hci1: command 0x0406 tx timeout [ 206.877924][ T5905] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 206.960509][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 206.986223][ T5905] usb 1-1: no configurations [ 206.993929][ T5905] usb 1-1: can't read configurations, error -22 [ 207.000997][ T5905] usb usb1-port1: unable to enumerate USB device [ 207.041604][ T6919] FAULT_INJECTION: forcing a failure. [ 207.041604][ T6919] name failslab, interval 1, probability 0, space 0, times 0 [ 207.055090][ T6919] CPU: 0 PID: 6919 Comm: syz.3.277 Not tainted syzkaller #0 [ 207.062406][ T6919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 207.072488][ T6919] Call Trace: [ 207.075787][ T6919] [ 207.078767][ T6919] dump_stack_lvl+0x18c/0x250 [ 207.083478][ T6919] ? show_regs_print_info+0x20/0x20 [ 207.088703][ T6919] ? load_image+0x420/0x420 [ 207.093226][ T6919] ? __lock_acquire+0x7eb0/0x7eb0 [ 207.098296][ T6919] should_fail_ex+0x394/0x4c0 [ 207.103023][ T6919] should_failslab+0x9/0x20 [ 207.107563][ T6919] slab_pre_alloc_hook+0x59/0x300 [ 207.112654][ T6919] ? ceph_alloc_options+0x4e/0x1d0 [ 207.117815][ T6919] __kmem_cache_alloc_node+0x53/0x260 [ 207.123277][ T6919] ? ceph_alloc_options+0x4e/0x1d0 [ 207.128452][ T6919] kmalloc_trace+0x2a/0xe0 [ 207.132931][ T6919] ceph_alloc_options+0x4e/0x1d0 [ 207.137914][ T6919] ceph_init_fs_context+0x68/0x4a0 [ 207.143073][ T6919] ? destroy_caches+0x80/0x80 [ 207.147787][ T6919] alloc_fs_context+0x618/0x7a0 [ 207.152697][ T6919] __se_sys_fsopen+0xa0/0x2c0 [ 207.157442][ T6919] do_syscall_64+0x55/0xb0 [ 207.161891][ T6919] ? clear_bhb_loop+0x40/0x90 [ 207.166597][ T6919] ? clear_bhb_loop+0x40/0x90 [ 207.171310][ T6919] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 207.177244][ T6919] RIP: 0033:0x7f039f5a94d9 [ 207.181726][ T6919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.201381][ T6919] RSP: 002b:00007f03a0462028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 207.209837][ T6919] RAX: ffffffffffffffda RBX: 00007f039f825fa0 RCX: 00007f039f5a94d9 [ 207.217929][ T6919] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 207.225945][ T6919] RBP: 00007f039f63804e R08: 0000000000000000 R09: 0000000000000000 [ 207.233939][ T6919] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 207.242059][ T6919] R13: 00007f039f826038 R14: 00007f039f825fa0 R15: 00007ffc07dd1508 [ 207.250099][ T6919] [ 207.381455][ T6924] netlink: 19 bytes leftover after parsing attributes in process `syz.2.279'. [ 207.411517][ T6924] netlink: 19 bytes leftover after parsing attributes in process `syz.2.279'. [ 208.577676][ T6945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.282'. [ 208.724184][ T6942] netlink: 4 bytes leftover after parsing attributes in process `syz.3.284'. [ 211.009704][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 211.237238][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 211.252311][ T9] usb 4-1: no configurations [ 211.260560][ T9] usb 4-1: can't read configurations, error -22 [ 211.427111][ T9] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 211.617115][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 211.665093][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 211.786457][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 211.964916][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 212.032451][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 212.153482][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 212.267454][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 212.340186][ T9] usb 4-1: no configurations [ 212.344963][ T9] usb 4-1: can't read configurations, error -22 [ 212.351610][ T9] usb usb4-port1: attempt power cycle [ 212.378191][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 212.386536][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 212.395026][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 212.403076][ T5151] loop5: [ 212.486375][ T6986] netlink: 4 bytes leftover after parsing attributes in process `syz.0.296'. [ 213.463582][ T9] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 213.631871][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 213.648136][ T9] usb 4-1: no configurations [ 213.658800][ T9] usb 4-1: can't read configurations, error -22 [ 214.048422][ T7001] netlink: 4 bytes leftover after parsing attributes in process `syz.3.298'. [ 214.858368][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 214.889028][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 214.932113][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 214.974639][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 215.008909][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 215.028344][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 215.048565][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 215.067558][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 215.086195][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 215.094629][ T5151] loop5: [ 215.188168][ T7019] usb usb1: usbfs: process 7019 (syz.3.305) did not claim interface 0 before use [ 216.274219][ T1206] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 216.432016][ T7027] netlink: 'syz.3.308': attribute type 10 has an invalid length. [ 216.598009][ T1206] usb 3-1: Using ep0 maxpacket: 16 [ 216.623426][ T7027] team0: Port device geneve1 added [ 216.640801][ T1206] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.661096][ T7030] netlink: 'syz.3.308': attribute type 10 has an invalid length. [ 216.671204][ T1206] usb 3-1: config 0 has no interfaces? [ 216.700556][ T1206] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 216.751105][ T1206] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.787753][ T7030] team0: Failed to send options change via netlink (err -105) [ 216.807503][ T1206] usb 3-1: Product: syz [ 216.811797][ T1206] usb 3-1: Manufacturer: syz [ 216.816447][ T1206] usb 3-1: SerialNumber: syz [ 216.831087][ T7030] team0: Failed to send port change of device geneve1 via netlink (err -105) [ 216.868851][ T7030] team0: Port device geneve1 removed [ 216.890725][ T1206] usb 3-1: config 0 descriptor?? [ 216.921676][ T7030] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 218.594917][ T5879] usb 3-1: USB disconnect, device number 13 [ 218.860152][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 218.885244][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 218.908198][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 218.941379][ T7057] syzkaller0: entered promiscuous mode [ 218.950430][ T7057] syzkaller0: entered allmulticast mode [ 218.955197][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 218.983471][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 219.004556][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 219.027414][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 219.036853][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 219.061684][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 219.076119][ T5151] loop5: [ 221.544820][ T7083] FAULT_INJECTION: forcing a failure. [ 221.544820][ T7083] name failslab, interval 1, probability 0, space 0, times 0 [ 221.638539][ T7083] CPU: 0 PID: 7083 Comm: syz.2.324 Not tainted syzkaller #0 [ 221.645970][ T7083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 221.656069][ T7083] Call Trace: [ 221.659405][ T7083] [ 221.662386][ T7083] dump_stack_lvl+0x18c/0x250 [ 221.667145][ T7083] ? show_regs_print_info+0x20/0x20 [ 221.672414][ T7083] ? load_image+0x420/0x420 [ 221.676986][ T7083] ? __might_sleep+0xe0/0xe0 [ 221.681650][ T7083] ? __lock_acquire+0x7eb0/0x7eb0 [ 221.686741][ T7083] ? lock_chain_count+0x20/0x20 [ 221.691660][ T7083] should_fail_ex+0x394/0x4c0 [ 221.696410][ T7083] should_failslab+0x9/0x20 [ 221.700962][ T7083] slab_pre_alloc_hook+0x59/0x300 [ 221.706043][ T7083] ? init_rescuer+0x91/0x2d0 [ 221.710710][ T7083] __kmem_cache_alloc_node+0x53/0x260 [ 221.716148][ T7083] ? init_rescuer+0x91/0x2d0 [ 221.720819][ T7083] kmalloc_node_trace+0x26/0xe0 [ 221.725746][ T7083] init_rescuer+0x91/0x2d0 [ 221.730228][ T7083] alloc_workqueue+0xcf0/0x1380 [ 221.735303][ T7083] ? kvmalloc_node+0xb5/0x180 [ 221.740016][ T7083] ? mempool_init_node+0x3c4/0x480 [ 221.745151][ T7083] ? apply_workqueue_attrs+0x180/0x180 [ 221.750649][ T7083] ? mempool_create+0x81/0xc0 [ 221.755382][ T7083] ? mempool_create+0xb1/0xc0 [ 221.760093][ T7083] ? ceph_msgpool_init+0xd1/0x180 [ 221.765150][ T7083] ceph_osdc_init+0x5c3/0x8c0 [ 221.769891][ T7083] ceph_create_client+0x246/0x300 [ 221.774988][ T7083] ceph_get_tree+0x1ca/0x1800 [ 221.779738][ T7083] ? bpf_lsm_capable+0x9/0x10 [ 221.784482][ T7083] ? security_capable+0x89/0xb0 [ 221.789396][ T7083] vfs_get_tree+0x8c/0x280 [ 221.794067][ T7083] do_new_mount+0x24a/0xa60 [ 221.798648][ T7083] __se_sys_mount+0x2e7/0x3d0 [ 221.803409][ T7083] ? __x64_sys_mount+0xc0/0xc0 [ 221.808253][ T7083] ? lockdep_hardirqs_on+0x98/0x150 [ 221.813509][ T7083] ? __x64_sys_mount+0x20/0xc0 [ 221.818350][ T7083] do_syscall_64+0x55/0xb0 [ 221.822832][ T7083] ? clear_bhb_loop+0x40/0x90 [ 221.827575][ T7083] ? clear_bhb_loop+0x40/0x90 [ 221.832325][ T7083] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 221.838290][ T7083] RIP: 0033:0x7fba999a94d9 [ 221.842762][ T7083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.862437][ T7083] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 221.870919][ T7083] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 221.878955][ T7083] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 221.886984][ T7083] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 221.895019][ T7083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 221.903053][ T7083] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 221.911110][ T7083] [ 221.977595][ T5905] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 222.009531][ T7083] workqueue: Failed to allocate a rescuer for wq "ceph-watch-notify" [ 222.177517][ T5905] usb 4-1: Using ep0 maxpacket: 16 [ 222.184944][ T5905] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.228673][ T5905] usb 4-1: config 0 has no interfaces? [ 222.235959][ T7084] rxe_eth0 speed is unknown, defaulting to 1000 [ 222.255335][ T5905] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 222.283593][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.314964][ T5905] usb 4-1: Product: syz [ 222.330093][ T5905] usb 4-1: Manufacturer: syz [ 222.613815][ T5905] usb 4-1: SerialNumber: syz [ 222.934514][ T5905] usb 4-1: config 0 descriptor?? [ 223.132833][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 223.187424][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 223.237798][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 223.267379][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 223.300206][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 223.340107][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 223.367240][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 223.417392][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 223.453199][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 223.492604][ T5151] loop5: [ 225.692505][ T5793] usb 4-1: USB disconnect, device number 10 [ 229.258249][ T5793] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 230.267215][ T5793] usb 3-1: Using ep0 maxpacket: 32 [ 230.283611][ T5793] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.312644][ T5793] usb 3-1: config 0 has no interfaces? [ 230.329732][ T5793] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 230.356791][ T5793] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.378756][ T5793] usb 3-1: config 0 descriptor?? [ 232.311012][ T9] usb 3-1: USB disconnect, device number 14 [ 233.770160][ T27] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 233.974692][ T27] usb 3-1: Using ep0 maxpacket: 16 [ 233.995329][ T27] usb 3-1: config 157 has an invalid descriptor of length 0, skipping remainder of the config [ 234.006313][ T27] usb 3-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 234.030872][ T27] usb 3-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 234.040660][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.085823][ T27] usb 3-1: Product: syz [ 234.091520][ T27] usb 3-1: Manufacturer: syz [ 234.093527][ T7206] comedi comedi3: board detection failed [ 234.103212][ T27] usb 3-1: SerialNumber: syz [ 234.191690][ T7207] bridge0: port 3(netdevsim0) entered blocking state [ 234.199436][ T7207] bridge0: port 3(netdevsim0) entered disabled state [ 234.207610][ T7207] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 234.224150][ T7207] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 234.234447][ T7207] bridge0: port 3(netdevsim0) entered blocking state [ 234.241344][ T7207] bridge0: port 3(netdevsim0) entered forwarding state [ 235.186410][ T7209] netlink: 'syz.1.356': attribute type 10 has an invalid length. [ 235.305268][ T27] usb 3-1: USB disconnect, device number 15 [ 235.435843][ T7209] team0: Port device geneve1 added [ 235.468815][ T7213] netlink: 'syz.1.356': attribute type 10 has an invalid length. [ 235.599731][ T7213] team0: Failed to send options change via netlink (err -105) [ 235.642510][ T7213] team0: Failed to send port change of device geneve1 via netlink (err -105) [ 235.671032][ T7213] team0: Port device geneve1 removed [ 236.504131][ T7213] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 236.833439][ T7224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.359'. [ 237.491958][ T7238] syzkaller0: entered promiscuous mode [ 237.524184][ T7238] syzkaller0: entered allmulticast mode [ 237.965530][ T7253] FAULT_INJECTION: forcing a failure. [ 237.965530][ T7253] name failslab, interval 1, probability 0, space 0, times 0 [ 237.997289][ T7253] CPU: 1 PID: 7253 Comm: syz.2.369 Not tainted syzkaller #0 [ 238.004697][ T7253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 238.014819][ T7253] Call Trace: [ 238.018147][ T7253] [ 238.021124][ T7253] dump_stack_lvl+0x18c/0x250 [ 238.025864][ T7253] ? show_regs_print_info+0x20/0x20 [ 238.031115][ T7253] ? load_image+0x420/0x420 [ 238.035680][ T7253] ? __might_sleep+0xe0/0xe0 [ 238.040327][ T7253] ? __lock_acquire+0x7eb0/0x7eb0 [ 238.045409][ T7253] should_fail_ex+0x394/0x4c0 [ 238.050148][ T7253] should_failslab+0x9/0x20 [ 238.054698][ T7253] slab_pre_alloc_hook+0x59/0x300 [ 238.059776][ T7253] ? kvmalloc_node+0x70/0x180 [ 238.064511][ T7253] ? kvmalloc_node+0x70/0x180 [ 238.069242][ T7253] __kmem_cache_alloc_node+0x53/0x260 [ 238.074682][ T7253] ? kvmalloc_node+0x70/0x180 [ 238.079415][ T7253] __kmalloc_node+0xa6/0x240 [ 238.084069][ T7253] kvmalloc_node+0x70/0x180 [ 238.088674][ T7253] ceph_msg_new2+0x162/0x490 [ 238.093327][ T7253] msgpool_alloc+0x80/0x1b0 [ 238.097876][ T7253] ? ceph_msgpool_init+0x180/0x180 [ 238.103034][ T7253] mempool_init_node+0x1e9/0x480 [ 238.108030][ T7253] ? msgpool_alloc+0x1b0/0x1b0 [ 238.112839][ T7253] ? ceph_msgpool_init+0x180/0x180 [ 238.117989][ T7253] mempool_create+0x81/0xc0 [ 238.122563][ T7253] ceph_msgpool_init+0xa7/0x180 [ 238.127464][ T7253] ceph_osdc_init+0x591/0x8c0 [ 238.132200][ T7253] ceph_create_client+0x246/0x300 [ 238.137288][ T7253] ceph_get_tree+0x1ca/0x1800 [ 238.142020][ T7253] ? bpf_lsm_capable+0x9/0x10 [ 238.146748][ T7253] ? security_capable+0x89/0xb0 [ 238.151651][ T7253] vfs_get_tree+0x8c/0x280 [ 238.156128][ T7253] do_new_mount+0x24a/0xa60 [ 238.160696][ T7253] __se_sys_mount+0x2e7/0x3d0 [ 238.165432][ T7253] ? __x64_sys_mount+0xc0/0xc0 [ 238.170250][ T7253] ? lockdep_hardirqs_on+0x98/0x150 [ 238.175500][ T7253] ? __x64_sys_mount+0x20/0xc0 [ 238.180410][ T7253] do_syscall_64+0x55/0xb0 [ 238.184881][ T7253] ? clear_bhb_loop+0x40/0x90 [ 238.189624][ T7253] ? clear_bhb_loop+0x40/0x90 [ 238.194382][ T7253] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 238.200331][ T7253] RIP: 0033:0x7fba999a94d9 [ 238.204790][ T7253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.224447][ T7253] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 238.232915][ T7253] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 238.240964][ T7253] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 238.248988][ T7253] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 238.257009][ T7253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 238.265026][ T7253] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 238.273069][ T7253] [ 239.227069][ T9] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 239.421083][ T9] usb 1-1: no configurations [ 239.436173][ T9] usb 1-1: can't read configurations, error -22 [ 239.456200][ T7272] netlink: 4 bytes leftover after parsing attributes in process `syz.3.375'. [ 239.607166][ T9] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 240.356654][ T7281] syzkaller0: entered promiscuous mode [ 240.362376][ T7281] syzkaller0: entered allmulticast mode [ 240.401888][ T9] usb 1-1: no configurations [ 240.417034][ T9] usb 1-1: can't read configurations, error -22 [ 240.435282][ T9] usb usb1-port1: attempt power cycle [ 240.614205][ T7285] fuse: Bad value for 'fd' [ 240.688536][ T7289] FAULT_INJECTION: forcing a failure. [ 240.688536][ T7289] name failslab, interval 1, probability 0, space 0, times 0 [ 240.701414][ T7289] CPU: 0 PID: 7289 Comm: syz.3.381 Not tainted syzkaller #0 [ 240.708834][ T7289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 240.718954][ T7289] Call Trace: [ 240.722287][ T7289] [ 240.725250][ T7289] dump_stack_lvl+0x18c/0x250 [ 240.729977][ T7289] ? show_regs_print_info+0x20/0x20 [ 240.735213][ T7289] ? load_image+0x420/0x420 [ 240.739752][ T7289] ? __might_sleep+0xe0/0xe0 [ 240.744389][ T7289] ? __lock_acquire+0x7eb0/0x7eb0 [ 240.749453][ T7289] should_fail_ex+0x394/0x4c0 [ 240.754183][ T7289] should_failslab+0x9/0x20 [ 240.758717][ T7289] slab_pre_alloc_hook+0x59/0x300 [ 240.763775][ T7289] ? kvmalloc_node+0x70/0x180 [ 240.768499][ T7289] ? kvmalloc_node+0x70/0x180 [ 240.773261][ T7289] __kmem_cache_alloc_node+0x53/0x260 [ 240.778675][ T7289] ? kvmalloc_node+0x70/0x180 [ 240.783380][ T7289] __kmalloc_node+0xa6/0x240 [ 240.788049][ T7289] kvmalloc_node+0x70/0x180 [ 240.792600][ T7289] ceph_msg_new2+0x162/0x490 [ 240.797228][ T7289] msgpool_alloc+0x80/0x1b0 [ 240.801771][ T7289] ? ceph_msgpool_init+0x180/0x180 [ 240.806926][ T7289] mempool_init_node+0x1e9/0x480 [ 240.811903][ T7289] ? msgpool_alloc+0x1b0/0x1b0 [ 240.816696][ T7289] ? ceph_msgpool_init+0x180/0x180 [ 240.821834][ T7289] mempool_create+0x81/0xc0 [ 240.826385][ T7289] ceph_msgpool_init+0xa7/0x180 [ 240.831264][ T7289] ceph_osdc_init+0x591/0x8c0 [ 240.835983][ T7289] ceph_create_client+0x246/0x300 [ 240.841047][ T7289] ceph_get_tree+0x1ca/0x1800 [ 240.845759][ T7289] ? bpf_lsm_capable+0x9/0x10 [ 240.850464][ T7289] ? security_capable+0x89/0xb0 [ 240.855345][ T7289] vfs_get_tree+0x8c/0x280 [ 240.859802][ T7289] do_new_mount+0x24a/0xa60 [ 240.864341][ T7289] __se_sys_mount+0x2e7/0x3d0 [ 240.869051][ T7289] ? __x64_sys_mount+0xc0/0xc0 [ 240.873845][ T7289] ? lockdep_hardirqs_on+0x98/0x150 [ 240.879069][ T7289] ? __x64_sys_mount+0x20/0xc0 [ 240.883859][ T7289] do_syscall_64+0x55/0xb0 [ 240.888316][ T7289] ? clear_bhb_loop+0x40/0x90 [ 240.893040][ T7289] ? clear_bhb_loop+0x40/0x90 [ 240.897776][ T7289] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.903697][ T7289] RIP: 0033:0x7f039f5a94d9 [ 240.908134][ T7289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.927781][ T7289] RSP: 002b:00007f03a0462028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 240.936240][ T7289] RAX: ffffffffffffffda RBX: 00007f039f825fa0 RCX: 00007f039f5a94d9 [ 240.944281][ T7289] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 240.952287][ T7289] RBP: 00007f039f63804e R08: 0000000000000000 R09: 0000000000000000 [ 240.960292][ T7289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.968301][ T7289] R13: 00007f039f826038 R14: 00007f039f825fa0 R15: 00007ffc07dd1508 [ 240.976414][ T7289] [ 240.979530][ T5793] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 241.059964][ T7291] netlink: 72 bytes leftover after parsing attributes in process `syz.3.382'. [ 241.079119][ T9] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 241.121580][ T9] usb 1-1: no configurations [ 241.126279][ T9] usb 1-1: can't read configurations, error -22 [ 241.145494][ T7293] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 241.158408][ T5882] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 241.166804][ T7293] Cannot find map_set index 2 as target [ 241.179449][ T5793] usb 3-1: Using ep0 maxpacket: 32 [ 241.189937][ T5793] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 241.201055][ T5793] usb 3-1: config 0 has no interfaces? [ 241.206591][ T5793] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 241.223025][ T5793] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.235489][ T5793] usb 3-1: config 0 descriptor?? [ 241.287922][ T9] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 241.331260][ T9] usb 1-1: no configurations [ 241.335942][ T9] usb 1-1: can't read configurations, error -22 [ 241.352592][ T9] usb usb1-port1: unable to enumerate USB device [ 241.362069][ T5882] usb 2-1: config 4 has an invalid interface number: 44 but max is 0 [ 241.370771][ T5882] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 241.384985][ T5882] usb 2-1: config 4 has no interface number 0 [ 241.391453][ T5882] usb 2-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 241.419814][ T5882] usb 2-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 241.429687][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.438145][ T5882] usb 2-1: Product: syz [ 241.442358][ T5882] usb 2-1: Manufacturer: syz [ 241.448483][ T5882] usb 2-1: SerialNumber: syz [ 242.392972][ T5882] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 242.405231][ T5882] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 242.417354][ T5882] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 242.424400][ T5882] usb 2-1: media controller created [ 242.434032][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 242.510705][ T5882] DVB: Unable to find symbol dib7000p_attach() [ 242.517103][ T5882] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 242.609390][ T5882] rc_core: IR keymap rc-dib0700-rc5 not found [ 242.678669][ T5882] Registered IR keymap rc-empty [ 242.709368][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 242.719151][ T5882] dvb-usb: could not initialize remote control. [ 242.748749][ T5882] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 242.766344][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 242.860385][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 242.892283][ T5882] usb 2-1: USB disconnect, device number 6 [ 243.007993][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 243.144491][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 243.264715][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 243.280393][ T5882] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 243.370671][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 243.488071][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 243.496500][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 243.537133][ T5151] loop5: [ 243.562456][ T9] usb 3-1: USB disconnect, device number 16 [ 244.598306][ T7326] netlink: 72 bytes leftover after parsing attributes in process `syz.0.391'. [ 244.624716][ T7324] FAULT_INJECTION: forcing a failure. [ 244.624716][ T7324] name failslab, interval 1, probability 0, space 0, times 0 [ 244.681959][ T7324] CPU: 0 PID: 7324 Comm: syz.2.390 Not tainted syzkaller #0 [ 244.689352][ T7324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 244.699481][ T7324] Call Trace: [ 244.702811][ T7324] [ 244.705792][ T7324] dump_stack_lvl+0x18c/0x250 [ 244.710538][ T7324] ? show_regs_print_info+0x20/0x20 [ 244.715801][ T7324] ? load_image+0x420/0x420 [ 244.720366][ T7324] ? __might_sleep+0xe0/0xe0 [ 244.725020][ T7324] ? __lock_acquire+0x7eb0/0x7eb0 [ 244.730139][ T7324] should_fail_ex+0x394/0x4c0 [ 244.734919][ T7324] should_failslab+0x9/0x20 [ 244.739479][ T7324] slab_pre_alloc_hook+0x59/0x300 [ 244.744556][ T7324] ? alloc_workqueue+0x15a/0x1380 [ 244.749657][ T7324] __kmem_cache_alloc_node+0x53/0x260 [ 244.755089][ T7324] ? alloc_workqueue+0x15a/0x1380 [ 244.760194][ T7324] kmalloc_trace+0x2a/0xe0 [ 244.764674][ T7324] alloc_workqueue+0x15a/0x1380 [ 244.769580][ T7324] ? kvmalloc_node+0xb5/0x180 [ 244.774410][ T7324] ? msgpool_alloc+0x92/0x1b0 [ 244.779143][ T7324] ? ceph_msgpool_init+0x180/0x180 [ 244.784320][ T7324] ? mempool_init_node+0x3c4/0x480 [ 244.789504][ T7324] ? apply_workqueue_attrs+0x180/0x180 [ 244.795029][ T7324] ? msgpool_alloc+0x1b0/0x1b0 [ 244.799853][ T7324] ? ceph_msgpool_init+0x180/0x180 [ 244.805028][ T7324] ? mempool_create+0x81/0xc0 [ 244.809773][ T7324] ? mempool_create+0xb1/0xc0 [ 244.814508][ T7324] ? ceph_msgpool_init+0xd1/0x180 [ 244.819590][ T7324] ceph_osdc_init+0x5c3/0x8c0 [ 244.824361][ T7324] ceph_create_client+0x246/0x300 [ 244.829459][ T7324] ceph_get_tree+0x1ca/0x1800 [ 244.834199][ T7324] ? bpf_lsm_capable+0x9/0x10 [ 244.838927][ T7324] ? security_capable+0x89/0xb0 [ 244.843837][ T7324] vfs_get_tree+0x8c/0x280 [ 244.848314][ T7324] do_new_mount+0x24a/0xa60 [ 244.852882][ T7324] __se_sys_mount+0x2e7/0x3d0 [ 244.857613][ T7324] ? __x64_sys_mount+0xc0/0xc0 [ 244.862463][ T7324] ? lockdep_hardirqs_on+0x98/0x150 [ 244.867716][ T7324] ? __x64_sys_mount+0x20/0xc0 [ 244.872531][ T7324] do_syscall_64+0x55/0xb0 [ 244.877000][ T7324] ? clear_bhb_loop+0x40/0x90 [ 244.881819][ T7324] ? clear_bhb_loop+0x40/0x90 [ 244.886555][ T7324] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 244.892504][ T7324] RIP: 0033:0x7fba999a94d9 [ 244.896964][ T7324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 244.916624][ T7324] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 244.925124][ T7324] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 244.933154][ T7324] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 244.941165][ T7324] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 244.949175][ T7324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 244.957189][ T7324] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 244.965213][ T7324] [ 245.627679][ T5914] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 245.853469][ T5914] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 245.961708][ T5914] usb 3-1: can't read configurations, error -61 [ 246.250796][ T5914] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 246.699744][ T5914] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 247.237568][ T27] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 247.522813][ T5914] usb 3-1: can't read configurations, error -61 [ 247.530424][ T5914] usb usb3-port1: attempt power cycle [ 247.606272][ T7360] netlink: 72 bytes leftover after parsing attributes in process `syz.1.401'. [ 247.640770][ T7358] process 'syz.3.400' launched './file0' with NULL argv: empty string added [ 247.713635][ T27] usb 1-1: Using ep0 maxpacket: 32 [ 247.723904][ T27] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 247.735070][ T27] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 247.748578][ T27] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 247.786538][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.838583][ T27] usb 1-1: config 0 descriptor?? [ 247.958936][ T5914] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 248.005130][ T5914] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 248.813426][ T5914] usb 3-1: can't read configurations, error -61 [ 250.284142][ T5882] usb 1-1: USB disconnect, device number 23 [ 250.348003][ T7390] netlink: 72 bytes leftover after parsing attributes in process `syz.3.410'. [ 251.897882][ T27] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 252.718415][ T27] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 252.767256][ T27] usb 2-1: can't read configurations, error -61 [ 252.940318][ T27] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 253.185847][ T7426] netlink: 72 bytes leftover after parsing attributes in process `syz.2.420'. [ 253.205243][ T27] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 253.227955][ T27] usb 2-1: can't read configurations, error -61 [ 253.267786][ T27] usb usb2-port1: attempt power cycle [ 253.347246][ T5882] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 253.537078][ T5882] usb 1-1: Using ep0 maxpacket: 32 [ 253.549560][ T5882] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 253.570128][ T5882] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 253.592919][ T5882] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 253.629843][ T5882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.669516][ T5882] usb 1-1: config 0 descriptor?? [ 253.687580][ T27] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 253.731740][ T27] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 253.755358][ T27] usb 2-1: can't read configurations, error -61 [ 253.977695][ T27] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 254.041942][ T27] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 254.091758][ T27] usb 2-1: can't read configurations, error -61 [ 254.113398][ T27] usb usb2-port1: unable to enumerate USB device [ 255.912579][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.919649][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.406357][ T27] usb 1-1: USB disconnect, device number 24 [ 256.489311][ T7456] netlink: 8 bytes leftover after parsing attributes in process `syz.3.429'. [ 256.520588][ T7456] netlink: 48 bytes leftover after parsing attributes in process `syz.3.429'. [ 256.755888][ T7469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.435'. [ 257.217214][ T5882] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 257.429194][ T5882] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 257.450393][ T5882] usb 3-1: New USB device found, idVendor=0582, idProduct=004d, bcdDevice= 0.40 [ 257.459614][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.479061][ T5878] IPVS: starting estimator thread 0... [ 257.489028][ T5882] usb 3-1: Product: syz [ 257.493290][ T5882] usb 3-1: Manufacturer: syz [ 257.513956][ T5882] usb 3-1: SerialNumber: syz [ 257.518791][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 257.547454][ T7474] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 257.568255][ T7489] IPVS: using max 16 ests per chain, 38400 per kthread [ 257.630273][ T7491] netlink: 8 bytes leftover after parsing attributes in process `syz.1.443'. [ 257.646322][ T7491] netlink: 48 bytes leftover after parsing attributes in process `syz.1.443'. [ 257.717036][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 257.724536][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 257.756233][ T9] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 257.822996][ T9] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 257.832199][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.856305][ T5882] usb 3-1: Quirk or no altest; falling back to MIDI 1.0 [ 257.889739][ T5882] usb 3-1: invalid MIDI in EP 0 [ 257.896034][ T9] usb 4-1: config 0 descriptor?? [ 258.021156][ T5882] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 258.046775][ T5882] usb 3-1: USB disconnect, device number 21 [ 258.100969][ T6995] udevd[6995]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 258.493912][ T7496] netlink: 64 bytes leftover after parsing attributes in process `syz.1.445'. [ 258.928214][ T5793] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 258.951265][ T5882] IPVS: starting estimator thread 0... [ 259.016563][ T7517] netlink: 8 bytes leftover after parsing attributes in process `syz.2.452'. [ 259.031913][ T7517] netlink: 48 bytes leftover after parsing attributes in process `syz.2.452'. [ 259.057281][ T7514] IPVS: using max 16 ests per chain, 38400 per kthread [ 259.135454][ T5793] usb 1-1: not running at top speed; connect to a high speed hub [ 259.152713][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 512, setting to 64 [ 259.170326][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 259.183792][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 259.200478][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 259.212412][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 512, setting to 64 [ 259.234945][ T5793] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 259.258468][ T7523] Cannot find add_set index 0 as target [ 259.288227][ T5793] usb 1-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 259.298356][ T5793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.306402][ T5793] usb 1-1: Product: syz [ 259.327601][ T5793] usb 1-1: Manufacturer: syz [ 259.332345][ T5793] usb 1-1: SerialNumber: syz [ 259.350493][ T7498] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 259.354263][ T7523] Set syz1 is full, maxelem 2076 reached [ 259.367800][ T7498] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 259.375169][ T7498] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 259.386501][ T7498] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 259.394883][ T7498] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 259.408604][ T5793] usb 1-1: USB2VGA dongle found at address 25 [ 259.419133][ T5793] usb 1-1: Allocated 8 output buffers [ 259.424599][ T5793] usb 1-1: Not attached to USB 2.0 hub, deferring init [ 259.672750][ T7498] usb 1-1: Device not attached to USB 2.0 hub [ 260.024290][ T5882] usb 1-1: USB disconnect, device number 25 [ 260.237560][ T5793] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 260.255995][ T7541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.462'. [ 260.267727][ T7541] netlink: 36 bytes leftover after parsing attributes in process `syz.2.462'. [ 260.281584][ T5879] usb 4-1: USB disconnect, device number 11 [ 260.354245][ T7543] Cannot find map_set index 2 as target [ 260.427232][ T5793] usb 2-1: Using ep0 maxpacket: 16 [ 260.434803][ T5793] usb 2-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 260.450384][ T5793] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 260.467511][ T5793] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.475820][ T5793] usb 2-1: Product: syz [ 260.481436][ T5793] usb 2-1: Manufacturer: syz [ 260.490235][ T5793] usb 2-1: SerialNumber: syz [ 260.514875][ T7548] loop7: detected capacity change from 0 to 7 [ 260.540801][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 260.555244][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 260.567138][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 260.576615][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 260.588053][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 260.597325][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 260.611969][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 260.621234][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 260.643850][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 260.653144][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 260.667938][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 260.677239][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 260.935302][ T5793] usb 2-1: USB disconnect, device number 11 [ 262.258665][ T7578] __nla_validate_parse: 1 callbacks suppressed [ 262.258676][ T7578] netlink: 4 bytes leftover after parsing attributes in process `syz.1.474'. [ 262.298344][ T5879] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 262.306017][ T9] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 262.517076][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 262.525873][ T5879] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 262.542660][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 262.553693][ T5879] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 262.568391][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 262.585074][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.597491][ T5879] usb 1-1: config 0 descriptor?? [ 262.603921][ T9] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 262.613666][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.299811][ T7599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.481'. [ 263.316113][ T7599] netlink: 36 bytes leftover after parsing attributes in process `syz.1.481'. [ 263.707168][ T5879] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 263.917080][ T5879] usb 2-1: Using ep0 maxpacket: 16 [ 263.925000][ T5879] usb 2-1: config 157 has 0 interfaces, different from the descriptor's value: 1 [ 263.944129][ T5879] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 263.953998][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.970851][ T5879] usb 2-1: Product: syz [ 263.975351][ T5879] usb 2-1: Manufacturer: syz [ 263.985223][ T5879] usb 2-1: SerialNumber: syz [ 264.969614][ T5879] usb 2-1: USB disconnect, device number 12 [ 265.026567][ T9] usb 3-1: USB disconnect, device number 22 [ 265.117757][ T27] usb 1-1: USB disconnect, device number 26 [ 265.300747][ T7620] FAULT_INJECTION: forcing a failure. [ 265.300747][ T7620] name failslab, interval 1, probability 0, space 0, times 0 [ 265.336615][ T7620] CPU: 1 PID: 7620 Comm: syz.0.487 Not tainted syzkaller #0 [ 265.343983][ T7620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 265.354085][ T7620] Call Trace: [ 265.357380][ T7620] [ 265.360336][ T7620] dump_stack_lvl+0x18c/0x250 [ 265.365036][ T7620] ? show_regs_print_info+0x20/0x20 [ 265.370261][ T7620] ? load_image+0x420/0x420 [ 265.374789][ T7620] ? __might_sleep+0xe0/0xe0 [ 265.379410][ T7620] ? __lock_acquire+0x7eb0/0x7eb0 [ 265.384464][ T7620] should_fail_ex+0x394/0x4c0 [ 265.389168][ T7620] should_failslab+0x9/0x20 [ 265.393698][ T7620] slab_pre_alloc_hook+0x59/0x300 [ 265.398743][ T7620] kmem_cache_alloc+0x5a/0x2d0 [ 265.403518][ T7620] ? __kernfs_new_node+0xe5/0x7f0 [ 265.408600][ T7620] __kernfs_new_node+0xe5/0x7f0 [ 265.413488][ T7620] ? kernfs_add_one+0x149/0x6b0 [ 265.418357][ T7620] ? kernfs_new_node+0x260/0x260 [ 265.423314][ T7620] ? __kernfs_create_file+0x25d/0x2e0 [ 265.428733][ T7620] ? kernfs_put+0x309/0x360 [ 265.433268][ T7620] kernfs_new_node+0x14c/0x260 [ 265.438078][ T7620] kernfs_create_dir_ns+0x44/0x120 [ 265.443210][ T7620] internal_create_group+0x21d/0xd10 [ 265.448520][ T7620] ? platform_msi_write_msg+0xf0/0xf0 [ 265.453911][ T7620] ? sysfs_create_group+0x20/0x20 [ 265.458959][ T7620] ? device_add_attrs+0x725/0x830 [ 265.464031][ T7620] ? device_add_class_symlinks+0x240/0x240 [ 265.469851][ T7620] dpm_sysfs_add+0x6a/0x270 [ 265.474363][ T7620] device_add+0x55c/0xc40 [ 265.478716][ T7620] device_create+0x26a/0x300 [ 265.483327][ T7620] ? root_device_unregister+0x100/0x100 [ 265.488940][ T7620] ? vsnprintf+0x1ac7/0x1ba0 [ 265.493597][ T7620] bdi_register_va+0x97/0x6d0 [ 265.498339][ T7620] super_setup_bdi_name+0xf9/0x200 [ 265.503468][ T7620] ? ceph_get_tree+0xa50/0x1800 [ 265.508354][ T7620] ? vfs_get_tree+0x280/0x280 [ 265.513049][ T7620] ? sget_fc+0x852/0x930 [ 265.517308][ T7620] ? ceph_compare_super+0x9f0/0x9f0 [ 265.522537][ T7620] ceph_get_tree+0xa70/0x1800 [ 265.527282][ T7620] ? bpf_lsm_capable+0x9/0x10 [ 265.532012][ T7620] vfs_get_tree+0x8c/0x280 [ 265.536483][ T7620] do_new_mount+0x24a/0xa60 [ 265.541074][ T7620] __se_sys_mount+0x2e7/0x3d0 [ 265.545897][ T7620] ? __x64_sys_mount+0xc0/0xc0 [ 265.550713][ T7620] ? lockdep_hardirqs_on+0x98/0x150 [ 265.555963][ T7620] ? __x64_sys_mount+0x20/0xc0 [ 265.560790][ T7620] do_syscall_64+0x55/0xb0 [ 265.565269][ T7620] ? clear_bhb_loop+0x40/0x90 [ 265.570022][ T7620] ? clear_bhb_loop+0x40/0x90 [ 265.574780][ T7620] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 265.580704][ T7620] RIP: 0033:0x7efe177a94d9 [ 265.585135][ T7620] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.604777][ T7620] RSP: 002b:00007efe159f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 265.613260][ T7620] RAX: ffffffffffffffda RBX: 00007efe17a25fa0 RCX: 00007efe177a94d9 [ 265.621317][ T7620] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 265.629353][ T7620] RBP: 00007efe1783804e R08: 0000000000000000 R09: 0000000000000000 [ 265.637413][ T7620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.645443][ T7620] R13: 00007efe17a26038 R14: 00007efe17a25fa0 R15: 00007ffdf70422f8 [ 265.653496][ T7620] [ 265.808887][ T7631] netlink: 8 bytes leftover after parsing attributes in process `syz.1.490'. [ 265.817903][ T7631] netlink: 36 bytes leftover after parsing attributes in process `syz.1.490'. [ 265.862963][ T7632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.488'. [ 265.874104][ T7620] ceph: No mds server is up or the cluster is laggy [ 266.167266][ T7637] netlink: 36 bytes leftover after parsing attributes in process `syz.1.491'. [ 266.364682][ T7650] netlink: 'syz.2.495': attribute type 10 has an invalid length. [ 266.377346][ T7650] netlink: 40 bytes leftover after parsing attributes in process `syz.2.495'. [ 266.392234][ T7650] bond0: entered allmulticast mode [ 266.399690][ T7650] bond_slave_0: entered allmulticast mode [ 266.405666][ T7650] bond_slave_1: entered allmulticast mode [ 266.413363][ T7650] bridge0: port 4(bond0) entered blocking state [ 266.420593][ T7650] bridge0: port 4(bond0) entered disabled state [ 266.429494][ T7650] bond0: entered promiscuous mode [ 266.434796][ T7650] bond_slave_0: entered promiscuous mode [ 266.442361][ T7650] bond_slave_1: entered promiscuous mode [ 266.453049][ T7650] bridge0: port 4(bond0) entered blocking state [ 266.459820][ T7650] bridge0: port 4(bond0) entered forwarding state [ 266.507801][ T5879] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 266.684794][ T7658] netlink: 8 bytes leftover after parsing attributes in process `syz.3.499'. [ 266.694171][ T7658] netlink: 36 bytes leftover after parsing attributes in process `syz.3.499'. [ 266.710987][ T5879] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 266.726199][ T5879] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 266.740486][ T5879] usb 2-1: config 0 interface 0 has no altsetting 0 [ 266.747822][ T5879] usb 2-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 266.758045][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.769237][ T5879] usb 2-1: config 0 descriptor?? [ 266.905762][ T5882] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 266.905762][ T27] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 267.087622][ T27] usb 1-1: Using ep0 maxpacket: 16 [ 267.102688][ T27] usb 1-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 267.110199][ T5882] usb 3-1: config 4 has an invalid interface number: 44 but max is 0 [ 267.124223][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.126437][ T5882] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 267.145330][ T5882] usb 3-1: config 4 has no interface number 0 [ 267.153224][ T5882] usb 3-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 267.166490][ T27] usb 1-1: Product: syz [ 267.166512][ T27] usb 1-1: Manufacturer: syz [ 267.166529][ T27] usb 1-1: SerialNumber: syz [ 267.184801][ T5879] usbhid 2-1:0.0: can't add hid device: -71 [ 267.207098][ T5879] usbhid: probe of 2-1:0.0 failed with error -71 [ 267.226840][ T5879] usb 2-1: USB disconnect, device number 13 [ 267.244267][ T5882] usb 3-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 267.274406][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.297377][ T5882] usb 3-1: Product: syz [ 267.304861][ T5882] usb 3-1: Manufacturer: syz [ 267.316658][ T5882] usb 3-1: SerialNumber: syz [ 267.421033][ T27] usb 1-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 267.443284][ T27] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 267.466715][ T27] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 267.478220][ T27] usb 1-1: media controller created [ 267.521941][ T27] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 267.554773][ T27] zl10353_read_register: readreg error (reg=127, ret==-71) [ 267.609723][ T27] dvb_usb_gl861: probe of 1-1:157.0 failed with error -5 [ 267.621827][ T27] usb 1-1: USB disconnect, device number 27 [ 267.632120][ T7116] udevd[7116]: setting mode of /dev/bus/usb/001/027 to 020664 failed: No such file or directory [ 267.643395][ T7116] udevd[7116]: setting owner of /dev/bus/usb/001/027 to uid=0, gid=0 failed: No such file or directory [ 267.752851][ T5882] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 267.763250][ T5882] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 267.776548][ T5882] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 267.783724][ T5882] usb 3-1: media controller created [ 267.792541][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 267.844326][ T5882] DVB: Unable to find symbol dib7000p_attach() [ 267.850861][ T5882] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 267.957126][ T5882] rc_core: IR keymap rc-dib0700-rc5 not found [ 267.963286][ T5882] Registered IR keymap rc-empty [ 268.283837][ T7684] netlink: 8 bytes leftover after parsing attributes in process `syz.3.508'. [ 268.296820][ T7684] netlink: 36 bytes leftover after parsing attributes in process `syz.3.508'. [ 268.610043][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 268.625215][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 268.644343][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 268.663405][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 268.671552][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 268.686581][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 268.712297][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 268.729986][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 268.742998][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 268.780034][ T5151] loop5: [ 268.786565][ T7691] netlink: 36 bytes leftover after parsing attributes in process `syz.1.512'. [ 269.067338][ T9] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 269.137646][ T5905] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 269.269857][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 269.278028][ T7705] netlink: 36 bytes leftover after parsing attributes in process `syz.3.516'. [ 269.296182][ T2200] nvme nvme0: rdma_resolve_route failed (-110). [ 269.318242][ T7703] nvme nvme0: rdma connection establishment failed (-19) [ 269.328542][ T5905] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 269.340839][ T5905] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 269.341260][ T9] usb 1-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 269.367407][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.369226][ T5905] usb 2-1: config 0 interface 0 has no altsetting 0 [ 269.375514][ T9] usb 1-1: Product: syz [ 269.375534][ T9] usb 1-1: Manufacturer: syz [ 269.394093][ T9] usb 1-1: SerialNumber: syz [ 269.406734][ T5905] usb 2-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 269.428784][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.442369][ T5905] usb 2-1: config 0 descriptor?? [ 269.881165][ T5905] usbhid 2-1:0.0: can't add hid device: -71 [ 269.895740][ T5905] usbhid: probe of 2-1:0.0 failed with error -71 [ 269.926418][ T5905] usb 2-1: USB disconnect, device number 14 [ 270.610448][ T7712] netlink: 8 bytes leftover after parsing attributes in process `syz.3.519'. [ 270.637770][ T7712] netlink: 20 bytes leftover after parsing attributes in process `syz.3.519'. [ 271.111240][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 271.145131][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 271.178979][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 271.195101][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 271.209242][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 271.228616][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 271.239083][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 271.249082][ T7718] FAULT_INJECTION: forcing a failure. [ 271.249082][ T7718] name failslab, interval 1, probability 0, space 0, times 0 [ 271.268549][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 271.289738][ T7718] CPU: 0 PID: 7718 Comm: syz.1.522 Not tainted syzkaller #0 [ 271.294375][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 271.297069][ T7718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 271.297115][ T7718] Call Trace: [ 271.297125][ T7718] [ 271.297135][ T7718] dump_stack_lvl+0x18c/0x250 [ 271.297174][ T7718] ? show_regs_print_info+0x20/0x20 [ 271.297204][ T7718] ? load_image+0x420/0x420 [ 271.297233][ T7718] ? __might_sleep+0xe0/0xe0 [ 271.297262][ T7718] ? __lock_acquire+0x7eb0/0x7eb0 [ 271.297294][ T7718] should_fail_ex+0x394/0x4c0 [ 271.297326][ T7718] should_failslab+0x9/0x20 [ 271.297347][ T7718] slab_pre_alloc_hook+0x59/0x300 [ 271.297375][ T7718] kmem_cache_alloc+0x5a/0x2d0 [ 271.297395][ T7718] ? __kernfs_new_node+0xe5/0x7f0 [ 271.297434][ T7718] __kernfs_new_node+0xe5/0x7f0 [ 271.297472][ T7718] ? kernfs_new_node+0x260/0x260 [ 271.297518][ T7718] ? up_write+0x1be/0x410 [ 271.297546][ T7718] kernfs_new_node+0x14c/0x260 [ 271.297584][ T7718] __kernfs_create_file+0x4b/0x2e0 [ 271.297609][ T7718] sysfs_add_file_mode_ns+0x237/0x2f0 [ 271.297642][ T7718] internal_create_group+0x431/0xd10 [ 271.314902][ T5151] loop5: [ 271.315094][ T7718] ? kernfs_add_one+0x149/0x6b0 [ 271.412117][ T7718] ? sysfs_create_group+0x20/0x20 [ 271.417346][ T7718] ? up_write+0x1be/0x410 [ 271.421752][ T7718] sysfs_create_groups+0x59/0x120 [ 271.426828][ T7718] device_add_attrs+0xdf/0x830 [ 271.431636][ T7718] ? device_add_class_symlinks+0x240/0x240 [ 271.437505][ T7718] ? device_add_class_symlinks+0x21f/0x240 [ 271.443357][ T7718] device_add+0x51a/0xc40 [ 271.447730][ T7718] device_create+0x26a/0x300 [ 271.452389][ T7718] ? root_device_unregister+0x100/0x100 [ 271.457980][ T7718] ? vsnprintf+0x1ac7/0x1ba0 [ 271.462618][ T7718] bdi_register_va+0x97/0x6d0 [ 271.467360][ T7718] super_setup_bdi_name+0xf9/0x200 [ 271.472520][ T7718] ? ceph_get_tree+0xa50/0x1800 [ 271.477408][ T7718] ? vfs_get_tree+0x280/0x280 [ 271.482231][ T7718] ? sget_fc+0x852/0x930 [ 271.486508][ T7718] ? ceph_compare_super+0x9f0/0x9f0 [ 271.491754][ T7718] ceph_get_tree+0xa70/0x1800 [ 271.496463][ T7718] ? bpf_lsm_capable+0x9/0x10 [ 271.501188][ T7718] vfs_get_tree+0x8c/0x280 [ 271.505652][ T7718] do_new_mount+0x24a/0xa60 [ 271.510196][ T7718] __se_sys_mount+0x2e7/0x3d0 [ 271.514995][ T7718] ? __x64_sys_mount+0xc0/0xc0 [ 271.519794][ T7718] ? lockdep_hardirqs_on+0x98/0x150 [ 271.525024][ T7718] ? __x64_sys_mount+0x20/0xc0 [ 271.529827][ T7718] do_syscall_64+0x55/0xb0 [ 271.534279][ T7718] ? clear_bhb_loop+0x40/0x90 [ 271.539000][ T7718] ? clear_bhb_loop+0x40/0x90 [ 271.543716][ T7718] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 271.549642][ T7718] RIP: 0033:0x7f90dfba94d9 [ 271.554088][ T7718] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.573725][ T7718] RSP: 002b:00007f90e098d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 271.582183][ T7718] RAX: ffffffffffffffda RBX: 00007f90dfe25fa0 RCX: 00007f90dfba94d9 [ 271.590188][ T7718] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 271.598196][ T7718] RBP: 00007f90dfc3804e R08: 0000000000000000 R09: 0000000000000000 [ 271.606198][ T7718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 271.614211][ T7718] R13: 00007f90dfe26038 R14: 00007f90dfe25fa0 R15: 00007fffff835a78 [ 271.622226][ T7718] [ 271.680363][ T7718] ceph: No mds server is up or the cluster is laggy [ 273.019539][ T7694] dib0700: tx buffer length is larger than 4. Not supported. [ 273.057435][ T5882] dvb-usb: could not initialize remote control. [ 273.063828][ T5882] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 273.088234][ T7734] netlink: 36 bytes leftover after parsing attributes in process `syz.3.528'. [ 273.112094][ T9] usb 1-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 273.131578][ T5882] usb 3-1: USB disconnect, device number 23 [ 273.169025][ T9] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 273.218523][ T5882] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 273.247098][ T9] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 273.282155][ T9] usb 1-1: media controller created [ 273.288619][ T7737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.529'. [ 273.331412][ T7737] netlink: 20 bytes leftover after parsing attributes in process `syz.1.529'. [ 273.365098][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 273.398387][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 273.431280][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 273.481789][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 273.504597][ T9] zl10353_read_register: readreg error (reg=127, ret==-71) [ 273.537111][ T5914] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 273.542505][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 273.606917][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 273.639258][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 273.739531][ T9] dvb_usb_gl861: probe of 1-1:157.0 failed with error -5 [ 274.265727][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 274.475866][ T9] usb 1-1: USB disconnect, device number 28 [ 274.497024][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 274.505535][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 274.513095][ T5151] loop5: [ 274.551756][ T5914] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 274.641545][ T5914] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 274.691233][ T5914] usb 4-1: config 0 interface 0 has no altsetting 0 [ 274.720007][ T5914] usb 4-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 274.730273][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.743253][ T5914] usb 4-1: config 0 descriptor?? [ 275.193706][ T5914] usbhid 4-1:0.0: can't add hid device: -71 [ 275.201570][ T5914] usbhid: probe of 4-1:0.0 failed with error -71 [ 275.241695][ T5914] usb 4-1: USB disconnect, device number 12 [ 275.343574][ T5793] wacom 0003:056A:0042.0005: Unknown device_type for 'syz0'. Assuming pen. [ 275.378032][ T5793] wacom 0003:056A:0042.0005: hidraw0: USB HID vffffff.ff Gamepad [syz0] on syz0 [ 275.421925][ T5793] input: Wacom Intuos2 6x8 Pen as /devices/virtual/misc/uhid/0003:056A:0042.0005/input/input14 [ 275.516796][ T28] audit: type=1326 audit(1794532417.052:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 275.628931][ T7764] fido_id[7764]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 275.650497][ T28] audit: type=1326 audit(1794532417.092:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 275.731611][ T28] audit: type=1326 audit(1794532417.092:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 275.803716][ T28] audit: type=1326 audit(1794532417.102:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 275.861567][ T28] audit: type=1326 audit(1794532417.102:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 275.974702][ T28] audit: type=1326 audit(1794532417.102:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 276.061726][ T28] audit: type=1326 audit(1794532417.102:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 276.141608][ T28] audit: type=1326 audit(1794532417.112:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 276.187197][ T28] audit: type=1326 audit(1794532417.112:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 276.198922][ T5793] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 276.253801][ T28] audit: type=1326 audit(1794532417.112:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7766 comm="syz.0.538" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7efe177a94d9 code=0x7ffc0000 [ 276.357175][ T5882] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 276.471488][ T5793] usb 1-1: config 4 has an invalid interface number: 44 but max is 0 [ 276.506839][ T5793] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 276.531207][ T5793] usb 1-1: config 4 has no interface number 0 [ 276.554764][ T5793] usb 1-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 276.580372][ T5882] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 276.652047][ T5793] usb 1-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 276.755665][ T5793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 277.005021][ T5793] usb 1-1: Product: syz [ 277.105419][ T5793] usb 1-1: Manufacturer: syz [ 277.250279][ T5793] usb 1-1: SerialNumber: syz [ 277.394665][ T5882] usb 3-1: config 0 interface 0 has no altsetting 0 [ 277.402351][ T5882] usb 3-1: New USB device found, idVendor=17ef, idProduct=6062, bcdDevice= 0.00 [ 277.411513][ T5882] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.434127][ T5882] usb 3-1: config 0 descriptor?? [ 277.443773][ T7771] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 277.879563][ T5793] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 277.886750][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 277.915068][ T5793] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 277.917781][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x3 [ 277.941937][ T5793] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 277.960632][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x1 [ 277.970830][ T5793] usb 1-1: media controller created [ 277.976223][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.001695][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.006116][ T5793] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 278.023392][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.046006][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.075399][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.100344][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x7 [ 278.122832][ T5882] lenovo 0003:17EF:6062.0006: unknown main item tag 0x0 [ 278.149942][ T5882] lenovo 0003:17EF:6062.0006: hidraw0: USB HID v0.01 Device [HID 17ef:6062] on usb-dummy_hcd.2-1/input0 [ 278.264824][ T5793] DVB: Unable to find symbol dib7000p_attach() [ 278.288204][ T5793] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 278.479788][ T5793] rc_core: IR keymap rc-dib0700-rc5 not found [ 278.490498][ T5793] Registered IR keymap rc-empty [ 278.654512][ T7794] FAULT_INJECTION: forcing a failure. [ 278.654512][ T7794] name failslab, interval 1, probability 0, space 0, times 0 [ 278.667677][ T7794] CPU: 0 PID: 7794 Comm: syz.3.546 Not tainted syzkaller #0 [ 278.675022][ T7794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 278.685122][ T7794] Call Trace: [ 278.688449][ T7794] [ 278.691422][ T7794] dump_stack_lvl+0x18c/0x250 [ 278.696207][ T7794] ? show_regs_print_info+0x20/0x20 [ 278.701466][ T7794] ? load_image+0x420/0x420 [ 278.706040][ T7794] ? __lock_acquire+0x7eb0/0x7eb0 [ 278.711129][ T7794] should_fail_ex+0x394/0x4c0 [ 278.715875][ T7794] should_failslab+0x9/0x20 [ 278.720421][ T7794] slab_pre_alloc_hook+0x59/0x300 [ 278.725510][ T7794] ? ceph_alloc_options+0x4e/0x1d0 [ 278.730678][ T7794] __kmem_cache_alloc_node+0x53/0x260 [ 278.736091][ T7794] ? ceph_alloc_options+0x4e/0x1d0 [ 278.741280][ T7794] kmalloc_trace+0x2a/0xe0 [ 278.745773][ T7794] ceph_alloc_options+0x4e/0x1d0 [ 278.750768][ T7794] ceph_init_fs_context+0x68/0x4a0 [ 278.755935][ T7794] ? destroy_caches+0x80/0x80 [ 278.760661][ T7794] alloc_fs_context+0x618/0x7a0 [ 278.765574][ T7794] __se_sys_fsopen+0xa0/0x2c0 [ 278.770318][ T7794] do_syscall_64+0x55/0xb0 [ 278.774776][ T7794] ? clear_bhb_loop+0x40/0x90 [ 278.779532][ T7794] ? clear_bhb_loop+0x40/0x90 [ 278.784274][ T7794] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 278.790248][ T7794] RIP: 0033:0x7f039f5a94d9 [ 278.794710][ T7794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.814369][ T7794] RSP: 002b:00007f03a0462028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 278.822833][ T7794] RAX: ffffffffffffffda RBX: 00007f039f825fa0 RCX: 00007f039f5a94d9 [ 278.830865][ T7794] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 278.838885][ T7794] RBP: 00007f039f63804e R08: 0000000000000000 R09: 0000000000000000 [ 278.846902][ T7794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.854941][ T7794] R13: 00007f039f826038 R14: 00007f039f825fa0 R15: 00007ffc07dd1508 [ 278.862975][ T7794] [ 278.965109][ T7797] program syz.1.547 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 279.357579][ T5914] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 279.540927][ T5914] usb 2-1: unable to get BOS descriptor or descriptor too short [ 279.553377][ T5914] usb 2-1: not running at top speed; connect to a high speed hub [ 279.563864][ T5914] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 279.574867][ T5914] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 279.584543][ T5914] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 279.599410][ T5914] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00 [ 279.609260][ T5914] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 279.617893][ T5914] usb 2-1: Product: syz [ 279.622117][ T5914] usb 2-1: Manufacturer: syz [ 279.644760][ T5914] usb 2-1: Found UVC 1.00 device syz (8086:0ad2) [ 279.838785][ T5914] usb 2-1: Failed to query (GET_INFO) UVC control 5 on unit 3: -71 (exp. 1). [ 279.848571][ T5914] usb 2-1: Failed to query (GET_INFO) UVC control 11 on unit 3: -71 (exp. 1). [ 279.860159][ T5914] usb 2-1: No streaming interface found for terminal 2. [ 279.868674][ T5914] usb 2-1: Failed to create links for entity 3 [ 279.875152][ T5914] usb 2-1: Failed to register entities (-22). [ 279.898072][ T5914] usb 2-1: USB disconnect, device number 15 [ 280.054689][ T7804] netlink: 36 bytes leftover after parsing attributes in process `syz.3.550'. [ 280.112078][ T5882] usb 3-1: USB disconnect, device number 24 [ 280.397973][ T27] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 280.599121][ T27] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 280.627625][ T27] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 280.658986][ T7820] FAULT_INJECTION: forcing a failure. [ 280.658986][ T7820] name failslab, interval 1, probability 0, space 0, times 0 [ 280.671863][ T7820] CPU: 0 PID: 7820 Comm: syz.2.556 Not tainted syzkaller #0 [ 280.679189][ T7820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 280.689276][ T7820] Call Trace: [ 280.692585][ T7820] [ 280.695540][ T7820] dump_stack_lvl+0x18c/0x250 [ 280.700281][ T7820] ? show_regs_print_info+0x20/0x20 [ 280.705553][ T7820] ? load_image+0x420/0x420 [ 280.710112][ T7820] ? __lock_acquire+0x7eb0/0x7eb0 [ 280.715205][ T7820] should_fail_ex+0x394/0x4c0 [ 280.719945][ T7820] should_failslab+0x9/0x20 [ 280.724493][ T7820] slab_pre_alloc_hook+0x59/0x300 [ 280.729576][ T7820] ? ceph_alloc_options+0x4e/0x1d0 [ 280.734762][ T7820] __kmem_cache_alloc_node+0x53/0x260 [ 280.740188][ T7820] ? ceph_alloc_options+0x4e/0x1d0 [ 280.745365][ T7820] kmalloc_trace+0x2a/0xe0 [ 280.749873][ T7820] ceph_alloc_options+0x4e/0x1d0 [ 280.754874][ T7820] ceph_init_fs_context+0x68/0x4a0 [ 280.760050][ T7820] ? destroy_caches+0x80/0x80 [ 280.764782][ T7820] alloc_fs_context+0x618/0x7a0 [ 280.769706][ T7820] __se_sys_fsopen+0xa0/0x2c0 [ 280.774449][ T7820] do_syscall_64+0x55/0xb0 [ 280.778917][ T7820] ? clear_bhb_loop+0x40/0x90 [ 280.783633][ T7820] ? clear_bhb_loop+0x40/0x90 [ 280.788390][ T7820] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 280.794353][ T7820] RIP: 0033:0x7fba999a94d9 [ 280.798839][ T7820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.818500][ T7820] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 280.826976][ T7820] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 280.835015][ T7820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 280.843037][ T7820] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 280.851174][ T7820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.859209][ T7820] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 280.867253][ T7820] [ 280.878660][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 280.898292][ T27] usb 4-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 280.910776][ T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 280.943475][ T27] usb 4-1: config 0 descriptor?? [ 281.128403][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 281.151525][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 281.175975][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 281.200885][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 281.214703][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 281.230069][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 281.240295][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 281.269117][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 281.280122][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 281.302238][ T5151] loop5: [ 281.396461][ T27] usbhid 4-1:0.0: can't add hid device: -71 [ 281.427818][ T27] usbhid: probe of 4-1:0.0 failed with error -71 [ 281.474027][ T27] usb 4-1: USB disconnect, device number 13 [ 282.089416][ T7841] FAULT_INJECTION: forcing a failure. [ 282.089416][ T7841] name failslab, interval 1, probability 0, space 0, times 0 [ 282.102431][ T7841] CPU: 0 PID: 7841 Comm: syz.2.565 Not tainted syzkaller #0 [ 282.109774][ T7841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 282.119886][ T7841] Call Trace: [ 282.123221][ T7841] [ 282.126201][ T7841] dump_stack_lvl+0x18c/0x250 [ 282.131048][ T7841] ? show_regs_print_info+0x20/0x20 [ 282.136310][ T7841] ? load_image+0x420/0x420 [ 282.140867][ T7841] ? __lock_acquire+0x7eb0/0x7eb0 [ 282.145979][ T7841] should_fail_ex+0x394/0x4c0 [ 282.150740][ T7841] should_failslab+0x9/0x20 [ 282.155330][ T7841] slab_pre_alloc_hook+0x59/0x300 [ 282.160409][ T7841] ? ceph_alloc_options+0x4e/0x1d0 [ 282.165580][ T7841] __kmem_cache_alloc_node+0x53/0x260 [ 282.171021][ T7841] ? ceph_alloc_options+0x4e/0x1d0 [ 282.176247][ T7841] kmalloc_trace+0x2a/0xe0 [ 282.180734][ T7841] ceph_alloc_options+0x4e/0x1d0 [ 282.185743][ T7841] ceph_init_fs_context+0x68/0x4a0 [ 282.190916][ T7841] ? destroy_caches+0x80/0x80 [ 282.195655][ T7841] alloc_fs_context+0x618/0x7a0 [ 282.200590][ T7841] __se_sys_fsopen+0xa0/0x2c0 [ 282.205356][ T7841] do_syscall_64+0x55/0xb0 [ 282.209832][ T7841] ? clear_bhb_loop+0x40/0x90 [ 282.214555][ T7841] ? clear_bhb_loop+0x40/0x90 [ 282.219288][ T7841] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 282.225238][ T7841] RIP: 0033:0x7fba999a94d9 [ 282.229703][ T7841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.249378][ T7841] RSP: 002b:00007fba9a89e028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 282.257843][ T7841] RAX: ffffffffffffffda RBX: 00007fba99c25fa0 RCX: 00007fba999a94d9 [ 282.265915][ T7841] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 282.273954][ T7841] RBP: 00007fba99a3804e R08: 0000000000000000 R09: 0000000000000000 [ 282.282004][ T7841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 282.290094][ T7841] R13: 00007fba99c26038 R14: 00007fba99c25fa0 R15: 00007fff2fa501c8 [ 282.298140][ T7841] [ 282.475262][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 282.507804][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 282.536492][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 282.573468][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 282.596200][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 282.617804][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 282.637669][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 282.661288][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 282.690917][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 282.712314][ T7845] netlink: 4 bytes leftover after parsing attributes in process `syz.2.567'. [ 282.717255][ T5151] loop5: [ 283.002562][ T7858] input: syz0 as /devices/virtual/input/input18 [ 283.104083][ T5793] dvb-usb: could not initialize remote control. [ 283.136802][ T5793] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 283.190263][ T5793] usb 1-1: USB disconnect, device number 29 [ 283.278904][ T5793] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 283.400277][ T7870] netlink: 36 bytes leftover after parsing attributes in process `syz.2.574'. [ 283.447928][ T7872] FAULT_INJECTION: forcing a failure. [ 283.447928][ T7872] name failslab, interval 1, probability 0, space 0, times 0 [ 283.461149][ T7872] CPU: 0 PID: 7872 Comm: syz.0.575 Not tainted syzkaller #0 [ 283.468466][ T7872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 283.478546][ T7872] Call Trace: [ 283.481909][ T7872] [ 283.484854][ T7872] dump_stack_lvl+0x18c/0x250 [ 283.489562][ T7872] ? show_regs_print_info+0x20/0x20 [ 283.494895][ T7872] ? load_image+0x420/0x420 [ 283.499424][ T7872] ? __lock_acquire+0x7eb0/0x7eb0 [ 283.504477][ T7872] should_fail_ex+0x394/0x4c0 [ 283.509203][ T7872] should_failslab+0x9/0x20 [ 283.513740][ T7872] slab_pre_alloc_hook+0x59/0x300 [ 283.518787][ T7872] ? ceph_alloc_options+0x4e/0x1d0 [ 283.523932][ T7872] __kmem_cache_alloc_node+0x53/0x260 [ 283.529326][ T7872] ? ceph_alloc_options+0x4e/0x1d0 [ 283.534460][ T7872] kmalloc_trace+0x2a/0xe0 [ 283.538907][ T7872] ceph_alloc_options+0x4e/0x1d0 [ 283.543888][ T7872] ceph_init_fs_context+0x68/0x4a0 [ 283.549046][ T7872] ? destroy_caches+0x80/0x80 [ 283.553748][ T7872] alloc_fs_context+0x618/0x7a0 [ 283.558637][ T7872] __se_sys_fsopen+0xa0/0x2c0 [ 283.563389][ T7872] do_syscall_64+0x55/0xb0 [ 283.567842][ T7872] ? clear_bhb_loop+0x40/0x90 [ 283.572568][ T7872] ? clear_bhb_loop+0x40/0x90 [ 283.577287][ T7872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 283.583445][ T7872] RIP: 0033:0x7efe177a94d9 [ 283.588011][ T7872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 283.607757][ T7872] RSP: 002b:00007efe159f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 283.616202][ T7872] RAX: ffffffffffffffda RBX: 00007efe17a25fa0 RCX: 00007efe177a94d9 [ 283.624233][ T7872] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000580 [ 283.632266][ T7872] RBP: 00007efe1783804e R08: 0000000000000000 R09: 0000000000000000 [ 283.640274][ T7872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 283.648270][ T7872] R13: 00007efe17a26038 R14: 00007efe17a25fa0 R15: 00007ffdf70422f8 [ 283.656319][ T7872] [ 283.686246][ T7876] syzkaller1: entered promiscuous mode [ 283.712844][ T7876] syzkaller1: entered allmulticast mode [ 283.871954][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 283.886426][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 283.902178][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 283.916982][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 283.924302][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 283.943535][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 283.957563][ T5905] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 283.959619][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 283.976786][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 284.009682][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 284.027072][ T5151] loop5: [ 284.085098][ T7884] syzkaller0: entered promiscuous mode [ 284.092769][ T7884] syzkaller0: entered allmulticast mode [ 284.172209][ T5905] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 284.217520][ T27] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 284.232122][ T5905] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 284.245792][ T5905] usb 3-1: config 0 interface 0 has no altsetting 0 [ 284.253335][ T5905] usb 3-1: New USB device found, idVendor=0b05, idProduct=1807, bcdDevice= 0.00 [ 284.263929][ T5905] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.275296][ T5905] usb 3-1: config 0 descriptor?? [ 284.407886][ T27] usb 2-1: Using ep0 maxpacket: 8 [ 284.436245][ T27] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 284.462808][ T27] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 284.480477][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.515693][ T27] usb 2-1: Product: syz [ 284.536569][ T27] usb 2-1: Manufacturer: syz [ 284.560525][ T27] usb 2-1: SerialNumber: syz [ 284.575301][ T27] usb 2-1: config 0 descriptor?? [ 284.589037][ T27] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 284.723323][ T5905] usbhid 3-1:0.0: can't add hid device: -71 [ 284.736496][ T5905] usbhid: probe of 3-1:0.0 failed with error -71 [ 284.779320][ T5905] usb 3-1: USB disconnect, device number 25 [ 285.167148][ T5882] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 285.383086][ T5882] usb 4-1: config 4 has an invalid interface number: 44 but max is 0 [ 285.392251][ T5882] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 285.409261][ T5882] usb 4-1: config 4 has no interface number 0 [ 285.415454][ T5882] usb 4-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 285.437749][ T27] gspca_zc3xx: reg_w_i err -71 [ 285.451144][ T5882] usb 4-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 285.477161][ T5882] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.485248][ T5882] usb 4-1: Product: syz [ 285.498325][ T5882] usb 4-1: Manufacturer: syz [ 285.502997][ T5882] usb 4-1: SerialNumber: syz [ 285.848761][ T9] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 285.925744][ T5882] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 285.948207][ T5882] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 285.968343][ T5882] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 285.975815][ T5882] usb 4-1: media controller created [ 285.989594][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 286.039526][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 286.050154][ T9] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 286.063365][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 286.068872][ T27] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 286.078244][ T9] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 286.092398][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.110046][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 286.122504][ T27] gspca_zc3xx: probe of 2-1:0.0 failed with error -71 [ 286.138378][ T5882] DVB: Unable to find symbol dib7000p_attach() [ 286.146472][ T27] usb 2-1: USB disconnect, device number 16 [ 286.155038][ T5882] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 286.162165][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 286.178746][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 286.216714][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 286.248842][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 286.277647][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 286.285993][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 286.312086][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 286.332631][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 286.353650][ T5151] loop5: [ 286.377338][ T5882] rc_core: IR keymap rc-dib0700-rc5 not found [ 286.383866][ T5882] Registered IR keymap rc-empty [ 286.563484][ T7912] syzkaller0: entered promiscuous mode [ 286.569991][ T7912] syzkaller0: entered allmulticast mode [ 287.083353][ T7925] netlink: 4 bytes leftover after parsing attributes in process `syz.1.594'. [ 287.122871][ T9] wacom 0003:056A:0042.0007: Unknown device_type for 'syz0'. Assuming pen. [ 287.141523][ T9] wacom 0003:056A:0042.0007: hidraw0: USB HID vffffff.ff Gamepad [syz0] on syz0 [ 287.162715][ T9] input: Wacom Intuos2 6x8 Pen as /devices/virtual/misc/uhid/0003:056A:0042.0007/input/input20 [ 287.341929][ T7928] fido_id[7928]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 287.597217][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 287.628375][ T5151] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 287.645298][ T5151] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 287.673033][ T5151] ldm_validate_privheads(): Cannot find PRIVHEAD 3. [ 287.699433][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 287.737006][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 287.751715][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 287.777091][ T5151] ldm_parse_tocblock(): Cannot find TOCBLOCK, database may be corrupt. [ 287.811611][ T5151] ldm_validate_tocblocks(): Failed to find a valid TOCBLOCK. [ 287.866769][ T5151] loop5: [ 288.221993][ T7937] syzkaller0: entered promiscuous mode [ 288.242779][ T7937] syzkaller0: entered allmulticast mode [ 288.577686][ T5879] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 288.660968][ T5905] usb 3-1: USB disconnect, device number 26 [ 288.793214][ T5879] usb 1-1: Using ep0 maxpacket: 32 [ 288.810002][ T5879] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 288.857695][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.904131][ T5879] usb 1-1: config 0 descriptor?? [ 289.087840][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 289.169858][ T5879] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 289.211929][ T5879] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 289.224063][ T5879] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 289.347847][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 289.380269][ T9] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 289.406408][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.430196][ T9] usb 2-1: Product: syz [ 289.434480][ T9] usb 2-1: Manufacturer: syz [ 289.453013][ T9] usb 2-1: SerialNumber: syz [ 289.878193][ T5905] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 290.071060][ T5905] usb 3-1: unable to get BOS descriptor or descriptor too short [ 290.081595][ T5905] usb 3-1: config 0 has an invalid interface number: 59 but max is 2 [ 290.091070][ T5905] usb 3-1: config 0 has an invalid interface number: 59 but max is 2 [ 290.100655][ T5905] usb 3-1: config 0 has an invalid descriptor of length 128, skipping remainder of the config [ 290.112525][ T5905] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 290.124083][ T5905] usb 3-1: config 0 has no interface number 0 [ 290.132787][ T5905] usb 3-1: too many endpoints for config 0 interface 59 altsetting 113: 205, using maximum allowed: 30 [ 290.152128][ T5905] usb 3-1: config 0 interface 59 altsetting 113 has 0 endpoint descriptors, different from the interface descriptor's value: 205 [ 290.166186][ T5905] usb 3-1: config 0 interface 59 has no altsetting 0 [ 290.174204][ T5905] usb 3-1: config 0 interface 59 has no altsetting 1 [ 290.185820][ T5905] usb 3-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 290.196225][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.206397][ T5905] usb 3-1: Product: syz [ 290.211872][ T5905] usb 3-1: Manufacturer: syz [ 290.216684][ T5905] usb 3-1: SerialNumber: syz [ 290.230329][ T5905] usb 3-1: config 0 descriptor?? [ 290.993928][ T5905] usb 3-1: bad CDC descriptors [ 291.030012][ T5905] usb 3-1: bad CDC descriptors [ 291.045702][ T5905] cdc_acm 3-1:0.59: Zero length descriptor references [ 291.069000][ T5905] cdc_acm: probe of 3-1:0.59 failed with error -22 [ 291.094688][ T5905] usb 3-1: USB disconnect, device number 27 [ 291.181324][ T7940] ------------[ cut here ]------------ [ 291.187115][ T7940] usb 4-1: BOGUS control dir, pipe 80000e80 doesn't match bRequestType c0 [ 291.208900][ T7940] WARNING: CPU: 1 PID: 7940 at drivers/usb/core/urb.c:413 usb_submit_urb+0x108d/0x17a0 [ 291.219830][ T7940] Modules linked in: [ 291.223788][ T7940] CPU: 1 PID: 7940 Comm: syz.0.600 Not tainted syzkaller #0 [ 291.232255][ T7940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 291.243530][ T7940] RIP: 0010:usb_submit_urb+0x108d/0x17a0 [ 291.250581][ T7940] Code: fc ff df 41 0f b6 44 05 00 84 c0 0f 85 18 06 00 00 45 0f b6 07 48 c7 c7 00 6b 8b 8b 48 8b 34 24 4c 89 e2 89 e9 e8 f3 2b e9 fa <0f> 0b 48 bd 00 00 00 00 00 fc ff df e9 91 f4 ff ff 44 89 f1 80 e1 [ 291.271544][ T7940] RSP: 0018:ffffc9001962f878 EFLAGS: 00010246 [ 291.278798][ T7940] RAX: 7e8fe68c6dae6d00 RBX: ffff8880256b9400 RCX: 0000000000080000 [ 291.286867][ T7940] RDX: ffffc9000cac1000 RSI: 0000000000003878 RDI: 0000000000003879 [ 291.296062][ T7940] RBP: 0000000080000e80 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 291.305556][ T7940] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff88801dfb5050 [ 291.314803][ T7940] R13: 1ffff1100fe9b6af R14: ffff88807acde0f8 R15: ffff88807f4db578 [ 291.323963][ T7940] FS: 00007efe159f66c0(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 291.334126][ T7940] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 291.342231][ T7940] CR2: 00007f40f9c9c4d0 CR3: 000000001c6e2000 CR4: 00000000003506e0 [ 291.351398][ T7940] Call Trace: [ 291.354741][ T7940] [ 291.358344][ T7940] ? __init_swait_queue_head+0xa8/0x140 [ 291.363974][ T7940] usb_start_wait_urb+0x140/0x580 [ 291.369685][ T7940] ? usb_api_blocking_completion+0xb0/0xb0 [ 291.375593][ T7940] usb_control_msg+0x235/0x3e0 [ 291.381054][ T7940] dib0700_i2c_xfer+0xb98/0xf60 [ 291.385998][ T7940] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 291.393184][ T7940] ? dib0700_set_gpio+0x1f0/0x1f0 [ 291.398896][ T7940] __i2c_transfer+0x891/0x2090 [ 291.403752][ T7940] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 291.410571][ T7940] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 291.416801][ T7940] ? i2c_cmd+0x110/0x110 [ 291.421803][ T7940] i2c_transfer+0x261/0x3a0 [ 291.426398][ T7940] ? __i2c_transfer+0x2090/0x2090 [ 291.432616][ T7940] ? __might_fault+0xc6/0x120 [ 291.438480][ T7940] ? __might_fault+0xaa/0x120 [ 291.443227][ T7940] ? _copy_from_user+0xa5/0xe0 [ 291.449254][ T7940] i2cdev_ioctl_rdwr+0x3b0/0x690 [ 291.454284][ T7940] i2cdev_ioctl+0x6a0/0x840 [ 291.459968][ T7940] ? i2cdev_write+0x120/0x120 [ 291.464727][ T7940] ? bpf_lsm_file_ioctl+0x9/0x10 [ 291.470821][ T7940] ? security_file_ioctl+0x80/0xa0 [ 291.476010][ T7940] ? i2cdev_write+0x120/0x120 [ 291.481956][ T7940] __se_sys_ioctl+0xfd/0x170 [ 291.486630][ T7940] do_syscall_64+0x55/0xb0 [ 291.492249][ T7940] ? clear_bhb_loop+0x40/0x90 [ 291.498150][ T7940] ? clear_bhb_loop+0x40/0x90 [ 291.502909][ T7940] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 291.510177][ T7940] RIP: 0033:0x7efe177a94d9 [ 291.514658][ T7940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 291.535471][ T7940] RSP: 002b:00007efe159f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 291.545104][ T7940] RAX: ffffffffffffffda RBX: 00007efe17a25fa0 RCX: 00007efe177a94d9 [ 291.554312][ T7940] RDX: 0000200000000440 RSI: 0000000000000707 RDI: 0000000000000004 [ 291.563478][ T7940] RBP: 00007efe1783804e R08: 0000000000000000 R09: 0000000000000000 [ 291.572655][ T7940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 291.582128][ T7940] R13: 00007efe17a26038 R14: 00007efe17a25fa0 R15: 00007ffdf70422f8 [ 291.591461][ T7940] [ 291.594543][ T7940] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 291.601868][ T7940] CPU: 1 PID: 7940 Comm: syz.0.600 Not tainted syzkaller #0 [ 291.609206][ T7940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 291.619319][ T7940] Call Trace: [ 291.622644][ T7940] [ 291.625628][ T7940] dump_stack_lvl+0x18c/0x250 [ 291.630373][ T7940] ? show_regs_print_info+0x20/0x20 [ 291.635640][ T7940] ? load_image+0x420/0x420 [ 291.640217][ T7940] panic+0x2ca/0x720 [ 291.644188][ T7940] ? bpf_jit_dump+0xd0/0xd0 [ 291.648771][ T7940] __warn+0x2e0/0x470 [ 291.652802][ T7940] ? usb_submit_urb+0x108d/0x17a0 [ 291.657885][ T7940] ? usb_submit_urb+0x108d/0x17a0 [ 291.663007][ T7940] report_bug+0x2be/0x4f0 [ 291.667405][ T7940] ? usb_submit_urb+0x108d/0x17a0 [ 291.672525][ T7940] ? usb_submit_urb+0x108d/0x17a0 [ 291.677610][ T7940] ? usb_submit_urb+0x108f/0x17a0 [ 291.682691][ T7940] handle_bug+0xcf/0x120 [ 291.686995][ T7940] exc_invalid_op+0x1a/0x50 [ 291.691567][ T7940] asm_exc_invalid_op+0x1a/0x20 [ 291.696482][ T7940] RIP: 0010:usb_submit_urb+0x108d/0x17a0 [ 291.702204][ T7940] Code: fc ff df 41 0f b6 44 05 00 84 c0 0f 85 18 06 00 00 45 0f b6 07 48 c7 c7 00 6b 8b 8b 48 8b 34 24 4c 89 e2 89 e9 e8 f3 2b e9 fa <0f> 0b 48 bd 00 00 00 00 00 fc ff df e9 91 f4 ff ff 44 89 f1 80 e1 [ 291.721874][ T7940] RSP: 0018:ffffc9001962f878 EFLAGS: 00010246 [ 291.728004][ T7940] RAX: 7e8fe68c6dae6d00 RBX: ffff8880256b9400 RCX: 0000000000080000 [ 291.736007][ T7940] RDX: ffffc9000cac1000 RSI: 0000000000003878 RDI: 0000000000003879 [ 291.744012][ T7940] RBP: 0000000080000e80 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 291.752024][ T7940] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff88801dfb5050 [ 291.760062][ T7940] R13: 1ffff1100fe9b6af R14: ffff88807acde0f8 R15: ffff88807f4db578 [ 291.768087][ T7940] ? usb_submit_urb+0x108d/0x17a0 [ 291.773174][ T7940] ? __init_swait_queue_head+0xa8/0x140 [ 291.778758][ T7940] usb_start_wait_urb+0x140/0x580 [ 291.783821][ T7940] ? usb_api_blocking_completion+0xb0/0xb0 [ 291.789829][ T7940] usb_control_msg+0x235/0x3e0 [ 291.794656][ T7940] dib0700_i2c_xfer+0xb98/0xf60 [ 291.799559][ T7940] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 291.805579][ T7940] ? dib0700_set_gpio+0x1f0/0x1f0 [ 291.810633][ T7940] __i2c_transfer+0x891/0x2090 [ 291.815443][ T7940] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 291.821690][ T7940] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 291.827915][ T7940] ? i2c_cmd+0x110/0x110 [ 291.832203][ T7940] i2c_transfer+0x261/0x3a0 [ 291.836768][ T7940] ? __i2c_transfer+0x2090/0x2090 [ 291.841822][ T7940] ? __might_fault+0xc6/0x120 [ 291.846526][ T7940] ? __might_fault+0xaa/0x120 [ 291.851250][ T7940] ? _copy_from_user+0xa5/0xe0 [ 291.856050][ T7940] i2cdev_ioctl_rdwr+0x3b0/0x690 [ 291.861119][ T7940] i2cdev_ioctl+0x6a0/0x840 [ 291.865654][ T7940] ? i2cdev_write+0x120/0x120 [ 291.870386][ T7940] ? bpf_lsm_file_ioctl+0x9/0x10 [ 291.875356][ T7940] ? security_file_ioctl+0x80/0xa0 [ 291.880504][ T7940] ? i2cdev_write+0x120/0x120 [ 291.885211][ T7940] __se_sys_ioctl+0xfd/0x170 [ 291.889879][ T7940] do_syscall_64+0x55/0xb0 [ 291.894356][ T7940] ? clear_bhb_loop+0x40/0x90 [ 291.899104][ T7940] ? clear_bhb_loop+0x40/0x90 [ 291.903829][ T7940] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 291.909764][ T7940] RIP: 0033:0x7efe177a94d9 [ 291.914232][ T7940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 291.933906][ T7940] RSP: 002b:00007efe159f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 291.942375][ T7940] RAX: ffffffffffffffda RBX: 00007efe17a25fa0 RCX: 00007efe177a94d9 [ 291.950390][ T7940] RDX: 0000200000000440 RSI: 0000000000000707 RDI: 0000000000000004 [ 291.958396][ T7940] RBP: 00007efe1783804e R08: 0000000000000000 R09: 0000000000000000 [ 291.966394][ T7940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 291.974391][ T7940] R13: 00007efe17a26038 R14: 00007efe17a25fa0 R15: 00007ffdf70422f8 [ 291.982500][ T7940] [ 291.986136][ T7940] Kernel Offset: disabled [ 291.990575][ T7940] Rebooting in 86400 seconds..