last executing test programs: 9.218941014s ago: executing program 1 (id=447): connect$auto(0x3, 0x0, 0x54) r0 = prctl$auto_PR_SCHED_CORE_GET(0x2, 0x0, 0x0, 0x401, 0x0) mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000) close_range$auto(0x2, 0xa, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) keyctl$auto_KEY_SPEC_THREAD_KEYRING(0x3, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x3, 0x3b) r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) write$auto(r2, &(0x7f0000000280)='S\x00\x00\x00\xfe\xff\xff\xff\xdf\xac\x9f*~\x9e\xf4\x14\xd2d2i\a*\x93\xda\xec\xfe\xb6HI\x8bMJ}\x8d\xc1\x94D\xdbSt/\xdd\xb5\fnW{\xb0^:\x80\xb5\xdd\x8d\x1e\x96\xdf\xcb\xac\xbfB\xb3\xba\x9a\x02\xeaZ\xb9Rg2\x87\x9e\x9c\xb3\xac\x16\xa3g\xad\xf7<\xc5c\xfa2\x97,O\xb2\xe3\xad\xe0v\x13\x03\x00\x00\x00\xce*\xee\xcdX\x1dM\xe3\x8cT\xc6\x1dj\xe8\xc1\xc0\x85c\xf6\r^\xa2\b\x9c\xb9\xff\x89i\x04\xc8\r\x14p\xad\v,O\xb8\x9b\xd8\xe0\x964/\x8fQ\xaf\x13\xd7\xf14\x85\xe8\x0f\'\xc4\xe3\x1c\x92', 0x808585) select$auto(0xe, &(0x7f00000000c0)={[0xa, 0xffff, 0x4, 0x9, 0x1000000000800006, 0x1ff, 0x6, 0x3, 0x3, 0x4618ecd2, 0x3, 0x3fd, 0x6, 0x10009a8f, 0x9, 0x1]}, 0x0, 0x0, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) ioctl$auto_TUNDETACHFILTER(r1, 0x401054d6, &(0x7f0000000180)={0x6, &(0x7f0000000040)={0x7f, 0x37, 0x9}}) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40602, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xf15a}, 0x1, 0x4000000008, 0x5) landlock_create_ruleset$auto(0x0, 0x100000000, 0x7) write$auto(r2, 0x0, 0x5add) pwrite64$auto(r0, 0x0, 0x34afd519, 0xfffffffffffffffa) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/system/memory/memory15/online\x00', 0xa001, 0x0) write$auto(r3, &(0x7f0000000140)='0[.[\x00', 0xcd04) mmap$auto(0x0, 0x4, 0x4000000000df, 0x78, 0x4, 0x300000000000) socket(0x2, 0x1, 0x106) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$auto(r4, &(0x7f0000000040)=@generic={0x10, "26300628afe90504fc2bbe91f2eb"}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) 8.184066702s ago: executing program 2 (id=448): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r0) r1 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/ext4/sda1/mb_best_avail_max_trim_order\x00', 0xa401, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ram14\x00', 0x165103, 0x0) r2 = socket(0x2, 0x1, 0x106) bind$auto(r2, &(0x7f0000000040)=@in={0x2, 0x3, @broadcast}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000100)=""/92, 0x5c) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r3, 0x0, 0x400000000006) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) read$auto(r1, 0x0, 0x80) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) r4 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/fs/netfs/cookies\x00', 0xd00, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/rpc/nfs4.idtoname/channel\x00', 0x8f3b7a51b80ebd01, 0x0) socket(0xa, 0x1, 0x84) openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0) r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) socket(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x40001, 0x0) ioctl$auto_KVM_CREATE_VM(r5, 0x5457, 0x0) read$auto_proc_iter_file_ops_compat_inode(r4, &(0x7f0000000180)=""/249, 0xf9) unshare$auto(0x40000080) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) 7.638517293s ago: executing program 1 (id=450): r0 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtd0\x00', 0x2, 0x0) ioctl$auto_MEMERASE64(r0, 0x40104d14, 0x0) 7.358513938s ago: executing program 1 (id=451): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r0, r0, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) pipe2$auto(0x0, 0x80) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r1, 0x0, 0x400000000006) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) unshare$auto(0x40000080) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/debug/block/loop15/hctx0/sched_tags\x00', 0x169100, 0x0) pread64$auto(r3, 0x0, 0x5000f42a, 0x100) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504000000040010"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) io_setup$auto(0xffff, 0x0) madvise$auto(0x0, 0x200007, 0x19) 5.927006676s ago: executing program 2 (id=454): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r0, r0, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r1, 0x0, 0x400000000006) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) unshare$auto(0x40000080) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/debug/block/loop15/hctx0/sched_tags\x00', 0x169100, 0x0) pread64$auto(r3, 0x0, 0x5000f42a, 0x100) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504000000040010"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) io_setup$auto(0xffff, 0x0) madvise$auto(0x0, 0x200007, 0x19) 5.201056559s ago: executing program 1 (id=457): connect$auto(0x3, 0x0, 0x54) r0 = prctl$auto_PR_SCHED_CORE_GET(0x2, 0x0, 0x0, 0x401, 0x0) mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000) close_range$auto(0x2, 0xa, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) keyctl$auto_KEY_SPEC_THREAD_KEYRING(0x3, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x3, 0x3b) r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) write$auto(r2, &(0x7f0000000280)='S\x00\x00\x00\xfe\xff\xff\xff\xdf\xac\x9f*~\x9e\xf4\x14\xd2d2i\a*\x93\xda\xec\xfe\xb6HI\x8bMJ}\x8d\xc1\x94D\xdbSt/\xdd\xb5\fnW{\xb0^:\x80\xb5\xdd\x8d\x1e\x96\xdf\xcb\xac\xbfB\xb3\xba\x9a\x02\xeaZ\xb9Rg2\x87\x9e\x9c\xb3\xac\x16\xa3g\xad\xf7<\xc5c\xfa2\x97,O\xb2\xe3\xad\xe0v\x13\x03\x00\x00\x00\xce*\xee\xcdX\x1dM\xe3\x8cT\xc6\x1dj\xe8\xc1\xc0\x85c\xf6\r^\xa2\b\x9c\xb9\xff\x89i\x04\xc8\r\x14p\xad\v,O\xb8\x9b\xd8\xe0\x964/\x8fQ\xaf\x13\xd7\xf14\x85\xe8\x0f\'\xc4\xe3\x1c\x92', 0x808585) select$auto(0xe, &(0x7f00000000c0)={[0xa, 0xffff, 0x4, 0x9, 0x1000000000800006, 0x1ff, 0x6, 0x3, 0x3, 0x4618ecd2, 0x3, 0x3fd, 0x6, 0x10009a8f, 0x9, 0x1]}, 0x0, 0x0, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) ioctl$auto_TUNDETACHFILTER(r1, 0x401054d6, &(0x7f0000000180)={0x6, &(0x7f0000000040)={0x7f, 0x37, 0x9}}) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40602, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xf15a}, 0x1, 0x4000000008, 0x5) landlock_create_ruleset$auto(0x0, 0x100000000, 0x7) write$auto(r2, 0x0, 0x5add) pwrite64$auto(r0, 0x0, 0x34afd519, 0xfffffffffffffffa) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/system/memory/memory15/online\x00', 0xa001, 0x0) write$auto(r3, &(0x7f0000000140)='0[.[\x00', 0xcd04) mmap$auto(0x0, 0x4, 0x4000000000df, 0x78, 0x4, 0x300000000000) socket(0x2, 0x1, 0x106) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$auto(r4, &(0x7f0000000040)=@generic={0x10, "26300628afe90504fc2bbe91f2eb"}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) 4.958489105s ago: executing program 3 (id=459): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$auto_percpu_stats_fops_(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$auto(0x20, 0x400108, 0x3, 0x9b72, 0xffffffffffffffff, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r0 = io_uring_setup$auto(0x406, 0x0) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, r0, 0x0) getrandom$auto(0x0, 0x6000000, 0x3) io_uring_enter$auto(0x3, 0xa84, 0x80000001, 0xa, 0x0, 0x46) io_uring_enter$auto(r0, 0x7, 0x7ffffffb, 0x3, 0x0, 0x3) io_uring_enter$auto(0x3, 0x5, 0x5f3, 0x3, 0x0, 0x2) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1\x00', 0x40000, 0x0) r1 = openat$auto_generic(0xffffffffffffff9c, &(0x7f00000032c0)='/proc/kmsg\x00', 0x20080, 0x0) poll$auto(&(0x7f0000000040)={r1, 0x1000, 0x1c9}, 0x2, 0x7) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, 0x0, 0x82, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/bridge/bridge-nf-pass-vlan-input-dev\x00', 0x202, 0x0) sendfile$auto(r2, r2, 0x0, 0x200) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x800, 0x0) mmap$auto(0x0, 0xe883, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) mmap$auto(0xfffffffffffffffc, 0x40000a, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x3, 0x2) 4.42080421s ago: executing program 0 (id=460): write$auto(0xca, &(0x7f00000000c0)='\x04>9\x1d!\xe0\x00\x94\xf2\xa2\x00\x00', 0x7e) landlock_restrict_self$auto(0xffffffffffffffff, 0x1) 4.162662511s ago: executing program 0 (id=461): close_range$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x7) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x1, 0x3446) gettid() preadv2$auto(0xffffffffffffffff, 0x0, 0x6, 0x3, 0x4, 0x2e) getdents$auto(0xffffffffffffffff, 0x0, 0x400018) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0x8000, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram10\x00', 0x14fe02, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x101880, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptyy4\x00', 0x204c81, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x2c402, 0x0) r1 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000980)='/dev/ttye9\x00', 0x102, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) write$auto(0x3, 0x0, 0x100082) sendfile$auto(r1, r0, 0x0, 0x10000) close_range$auto(0x2, 0xa, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) keyctl$auto(0x200000000000020, 0xffffffffffffffff, 0x5, 0x5, 0x8) bpf$auto(0x8000000, 0x0, 0x5) r2 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000040), 0x20904, 0x0) readv$auto(r2, &(0x7f0000000a80)={0x0, 0x2}, 0x2) pipe$auto(&(0x7f0000000140)=0xffffffffffffffff) fcntl$auto_F_ADD_SEALS(r3, 0x409, 0x4) preadv$auto(r2, &(0x7f0000000240)={&(0x7f0000000180)="8312b651eb61adc8c72a08516a716a9b3444a6462dd65bf50238ba4eb284b9d1fddd490eb57a141897132b7bbfa0094d619ea8f13192cbe84973a03abd5b5812ff021f11fc009c25cae1842dbcfb0016a0ff4bb2641d8d41aac8411e354fd006b259fe39ac0b33891bd75661d1b3ca9aab73aa7e0b5eafe575939481644cc4a830d0cfdea34a65c9372190f14d18771cc4610b79784045", 0x2}, 0x7, 0x4, 0x6) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffff6, 0x8000) r4 = socket(0x10, 0x3, 0x9) write$auto(r4, 0x0, 0x5) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/devices.deny\x00', 0x8ea182, 0x0) 3.432528595s ago: executing program 1 (id=462): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/pci0000:00/0000:00:03.0/enable\x00', 0x182b02, 0x0) sendfile$auto(r0, r0, 0x0, 0x3) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x5, 0x84) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda\x00', 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) r1 = open$dir(0x0, 0x10000, 0x6) r2 = prctl$auto(0x41, 0x3, 0x0, 0x0, 0x0) pwritev$auto(r1, 0x0, 0x2, 0xfffffffffffff274, 0x6) msgget$auto(0xc, 0x77d9) sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{&(0x7f0000000300)="276ebd6cbb1ac5364623272e23af2b50f2ebad835c9d7840f79ffa7504d577141a2c16c434925b3c00c8067f716ba2efac5afb4b91cfd18d70395257e05f5cc55b521c692e181ada3cd0ec7302f3056482f4d2b83137e26d61afb328d630eae031149e93129e9a2eae3bd896b0ecab0e3977252f1b7ec1c5dff9a156892c2f8678d15ea110ef4170893623e36fe44e1a8b134a0dec152e282b86f13962d639bd3649cd05a67c52b32dbb8fdd244cd0d783372ebdd79f83a87059240565ed14277260319a6730e35bd2db9ffee60a", 0x12, 0x0, 0x9, 0x0, 0x3, 0xb}, 0x800009}, 0x5, 0x20000000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto_USBDEVFS_RELEASEINTERFACE(r2, 0x80045510, &(0x7f0000000040)=0xffffffff) sendto$auto(0x3, 0x0, 0x1, 0x101, 0x0, 0x1c) ioctl$auto(r1, 0x541b, 0x38) syslog$auto(0x3, &(0x7f0000000400)='..\x00k\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\x00\x80\x00\x00\x00\x00\x00\x00j<\v\xf47\n\xa7\xd2\x8b\x11e1\xb3\xfdd\x04\xa9 1\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87\xa1\xea\xbb\xfb\x0e\x84HH\xdes~\xd3>O\xc4\v\x9b\xb7\xf2=\x95\xe3;,\x99\xca\xaa\xa0\xa2\xa9\xae\xc5\xean\x90\xbf\xe7Ha\xc4J\x184!h\xb2\x060\x1d\x8e\x9f\x13\xd9F#<\xc6\xad7\x8f^Z\xc4Q*\x93\xc4\xd8\xb1\"\xe1D(\xcf}\x9fNv\x9f,\xba\xa2\x86\xa1\x8df#%\x1c=\x99\xdc7\x80K\xa3}W\x17\x8be\x9e4t\x99dF\x96w\xe7\x8c\xfc\xba\x7fa\x04\xd1\xac\xe2\xa1\x96\xc2mz`\xcb\xcc\xff\x19O@E|\f^\xb12 =\xfd\x9a\bS\x87S\xf6\xda\xee\xd4\xf6\x1f\xa4\n\x90\xea>\xd5UK\"\xab\xce\x19@\\?{\x98\xe3j\xdd\xda\x8b\x13\xb5N\x13I\xc7\nO\x18\x7f\x8dI\xd5F\xe3\xf3\xd8\xe3\x9a^\xcb\xcb-\x06\xa8', 0x5) r3 = syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/user\x00') getdents$auto(r3, 0x0, 0xa2b0) msync$auto(0x0, 0x2000000005, 0x6) msgrcv$auto(0x0, 0x0, 0xff9, 0x0, 0x3) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) sysfs$auto(0x2, 0x8, 0x0) r4 = fsopen$auto(0x0, 0x1) fsconfig$auto(r4, 0x3, &(0x7f0000000000)='Q**\x00', &(0x7f0000000040), 0x0) syz_genetlink_get_family_id$auto_net_dm(&(0x7f0000000180), 0xffffffffffffffff) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/net/dev_snmp6/virt_wifi0\x00', 0x103200, 0x0) madvise$auto(0x110c230000, 0x8031ca, 0x9) 3.432145279s ago: executing program 3 (id=463): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r0) r1 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/ext4/sda1/mb_best_avail_max_trim_order\x00', 0xa401, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ram14\x00', 0x165103, 0x0) r2 = socket(0x2, 0x1, 0x106) bind$auto(r2, &(0x7f0000000040)=@in={0x2, 0x3, @broadcast}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f0000000100)=""/92, 0x5c) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r3, 0x0, 0x400000000006) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) read$auto(r1, 0x0, 0x80) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, 0x0) r4 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/fs/netfs/cookies\x00', 0xd00, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/rpc/nfs4.idtoname/channel\x00', 0x8f3b7a51b80ebd01, 0x0) socket(0xa, 0x1, 0x84) openat$auto_loop_ctl_fops_loop(0xffffffffffffff9c, &(0x7f0000000440), 0x20100, 0x0) r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) socket(0x2c, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x40001, 0x0) ioctl$auto_KVM_CREATE_VM(r5, 0x5457, 0x0) read$auto_proc_iter_file_ops_compat_inode(r4, &(0x7f0000000180)=""/249, 0xf9) unshare$auto(0x40000080) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) 3.429687162s ago: executing program 0 (id=470): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r0, r0, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) pipe2$auto(0x0, 0x80) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r1, 0x0, 0x400000000006) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) unshare$auto(0x40000080) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/debug/block/loop15/hctx0/sched_tags\x00', 0x169100, 0x0) pread64$auto(r3, 0x0, 0x5000f42a, 0x100) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504000000040010"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) io_setup$auto(0xffff, 0x0) madvise$auto(0x0, 0x200007, 0x19) 3.189938362s ago: executing program 2 (id=464): r0 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$auto_USB_RAW_IOCTL_INIT(r0, 0x41015500, &(0x7f00000011c0)={"44cb9bf73ee4f7d17375d0a20200fc097204973ce5c568f45cf3a37f00073e797cd85f3cc60300259f0f496b564d7480859a383753a492b262cd2e665fea37decc05000020000000001eee4def7500006344c1b5ba8cd74d78b58200020000001000000001000004000000004000", "780700e6cfac240fa640711402b4c630c35601fb47fa4a933119c64d9db23ef32ce561acad10f499363cd61be3b68dcaf3e5f074ce961d6ade73a2d540e5282df56757d500000000000000000000000000000000000000000000000000000000000800000000000000000000000300", 0x8}) 2.854795977s ago: executing program 2 (id=465): r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) sendfile$auto(0x1, 0xffffffffffffffff, 0x0, 0x8fb5) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'veth1_to_bond\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_ila(&(0x7f0000000440), r4) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r6) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_ILA_CMD_ADD(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)={0x38, r5, 0x201, 0x70bd28, 0x25dfdc03, {}, [@ILA_ATTR_IFINDEX={0x8, 0x4, r7}, @ILA_ATTR_IDENT_TYPE={0x5, 0x8, 0x9}, @ILA_ATTR_IFINDEX={0x8, 0x4, r7}, @ILA_ATTR_LOCATOR={0xc, 0x1, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x38) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r8) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)={0x28, r9, 0xd0d58b333228212f, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x80000000}, @NL80211_ATTR_FILS_ERP_USERNAME={0x4}]}, 0x28}}, 0x4000000) r11 = socket(0x1d, 0x2, 0x6) r12 = socket(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$auto(r11, &(0x7f0000000040)=@can={0x1d, r13, 0xfd}, 0x6a) sendmsg$auto_NET_SHAPER_CMD_CAP_GET2(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x54, 0x0, 0x8, 0x70bd27, 0x25dfdbfe, {}, [@NET_SHAPER_A_CAPS_IFINDEX={0x8}, @NET_SHAPER_A_CAPS_IFINDEX={0x8}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r2}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r7}, @NET_SHAPER_A_CAPS_IFINDEX={0x8}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r10}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r13}, @NET_SHAPER_A_CAPS_IFINDEX={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x1) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$auto_ila(&(0x7f0000000440), r15) r17 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r17) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_ILA_CMD_ADD(r14, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000000c0)={0x54, r16, 0x201, 0x70bd28, 0x25dfdc03, {}, [@ILA_ATTR_IDENT_TYPE={0x5, 0x8, 0x8}, @ILA_ATTR_LOCATOR={0xc, 0x1, 0x40000000000001c}, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x9}, @ILA_ATTR_IFINDEX={0x8, 0x4, r18}, @ILA_ATTR_IDENT_TYPE={0x5, 0x8, 0x9}, @ILA_ATTR_IFINDEX={0x8, 0x4, r18}, @ILA_ATTR_LOCATOR={0xc, 0x1, 0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x8080}, 0x38) sendmsg$auto_NET_SHAPER_CMD_CAP_GET2(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@NET_SHAPER_A_CAPS_IFINDEX={0x8}, @NET_SHAPER_A_CAPS_IFINDEX={0x8}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r13}, @NET_SHAPER_A_CAPS_IFINDEX={0x8, 0x1, r18}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000) r19 = syz_genetlink_get_family_id$auto_ovs_ct_limit(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$auto_OVS_CT_LIMIT_CMD_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB=' .\x00\x00', @ANYRES16=r19, @ANYBLOB="01002ebd5100fbcbdf25010012ea03000180072e01"], 0x2e20}, 0x1, 0x60000000, 0x0, 0x2000c041}, 0x4) 2.249073294s ago: executing program 3 (id=466): mmap$auto(0x0, 0x20009, 0x386, 0xeb1, 0x401, 0x8000) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x101e81, 0x0) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty0\x00', 0x4000, 0x0) socket(0x11, 0x5, 0x100) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) memfd_create$auto(0x0, 0x7) close_range$auto(0x2, 0x8, 0x0) r2 = socket(0x2a, 0x2, 0x1) connect$auto(r2, &(0x7f00000000c0)=@qipcrtr={0x2a, 0x3, 0xfffffffe}, 0x52) openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0x10002}, 0x1) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system/memory/memory12/power/control\x00', 0x100, 0x0) socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) pipe$auto(0x0) mincore$auto(0x0, 0x1, 0x0) setsockopt$auto(0x3, 0x1, 0x35, 0x0, 0x9) close_range$auto(0x2, 0x8, 0x0) r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x0, 0x0) ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$auto(0x3, 0x4048aec9, r3) close_range$auto(r0, 0xa, 0x0) mkdir$auto(0x0, 0x7f) select$auto(0x2, &(0x7f0000000080)={[0x10000, 0x0, 0x8, 0xfffffffffffffbff, 0x3, 0x2, 0x9, 0x6, 0x4, 0x7, 0x1, 0x1, 0xa692, 0x0, 0xfffffffffffffffa, 0xfffffffeffffffff]}, &(0x7f0000000100)={[0xf, 0xcb59792, 0x5, 0x9, 0x3, 0xa3b, 0x4, 0xffff, 0xfffffffeffffffff, 0x9, 0x2, 0x200, 0x56beecf4, 0xc9a, 0x2, 0xfffffffffffffffa]}, &(0x7f00000002c0)={[0x8, 0x80, 0x3, 0x0, 0xf, 0xff, 0x2ed, 0x6, 0x7fff, 0x9, 0x6, 0x8, 0x1000, 0x6, 0x8, 0x10000]}, &(0x7f0000000380)={0x7c, 0x4488}) 1.955088801s ago: executing program 2 (id=467): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mremap$auto(0x0, 0x500000000, 0x4, 0x7, 0x100000000) madvise$auto(0x0, 0x200007, 0x19) io_uring_setup$auto(0x2, &(0x7f0000000080)={0x80000003, 0x9, 0x4002, 0x6, 0x4, 0x8, 0xffffffffffffffff, [], {0x9, 0x6, 0xf, 0x29f, 0x100, 0x7f, 0x101, 0x4000006, 0x2000}, {0x100, 0x1, 0x52, 0x5, 0x1, 0x40, 0x104, 0x8, 0x100000000}}) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/module/ueagle_atm/parameters/sync_wait\x00', 0x1e2142, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/net/lapb3/threaded\x00', 0x8a801, 0x0) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, 0x200000401, 0x12000000000c004) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sda\x00', 0x443001f86cb35905, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) set_mempolicy$auto(0x3, &(0x7f0000000000)=0x7, 0x9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) io_uring_setup$auto(0x401, 0x0) bpf$auto_BPF_PROG_LOAD(0x5, &(0x7f0000000080)=@enable_stats={0x7}, 0x6) openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) mlockall$auto(0x7) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000140), 0xe0180, 0x0) ioctl$auto_KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) mremap$auto(0x4000, 0xb8, 0x13fd4, 0x3, 0xfffff000) io_uring_setup$auto(0x9, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) sendfile$auto(r2, r2, 0x0, 0x3) write$auto(r0, &(0x7f0000000000)='1\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000d36a7dfe2a716048d6ef506605836d", @ANYRES16=r3, @ANYBLOB="00022cbd7000fbdbdf25300000000500a20004000000"], 0x1c}}, 0x5) process_vm_writev$auto(0x0, &(0x7f0000000280)={0x0, 0x600000000}, 0x1, &(0x7f0000000340)={0x0, 0x9249}, 0x8, 0x0) sendfile$auto(r0, r0, 0x0, 0x8000) 825.048944ms ago: executing program 3 (id=468): openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000340), 0x8100, 0x0) ioctl$auto(0x3, 0x541b, 0x7f) 600.327781ms ago: executing program 0 (id=469): r0 = openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/input/mice\x00', 0x2800, 0x0) read$auto_mousedev_fops_mousedev(r0, 0x0, 0x0) 569.087509ms ago: executing program 3 (id=471): connect$auto(0x3, 0x0, 0x54) r0 = prctl$auto_PR_SCHED_CORE_GET(0x2, 0x0, 0x0, 0x401, 0x0) mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000) close_range$auto(0x2, 0xa, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/platform/vhci_hcd.0/usbip_debug\x00', 0x8002, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) keyctl$auto_KEY_SPEC_THREAD_KEYRING(0x3, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x3, 0x3b) r2 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) write$auto(r2, &(0x7f0000000280)='S\x00\x00\x00\xfe\xff\xff\xff\xdf\xac\x9f*~\x9e\xf4\x14\xd2d2i\a*\x93\xda\xec\xfe\xb6HI\x8bMJ}\x8d\xc1\x94D\xdbSt/\xdd\xb5\fnW{\xb0^:\x80\xb5\xdd\x8d\x1e\x96\xdf\xcb\xac\xbfB\xb3\xba\x9a\x02\xeaZ\xb9Rg2\x87\x9e\x9c\xb3\xac\x16\xa3g\xad\xf7<\xc5c\xfa2\x97,O\xb2\xe3\xad\xe0v\x13\x03\x00\x00\x00\xce*\xee\xcdX\x1dM\xe3\x8cT\xc6\x1dj\xe8\xc1\xc0\x85c\xf6\r^\xa2\b\x9c\xb9\xff\x89i\x04\xc8\r\x14p\xad\v,O\xb8\x9b\xd8\xe0\x964/\x8fQ\xaf\x13\xd7\xf14\x85\xe8\x0f\'\xc4\xe3\x1c\x92', 0x808585) select$auto(0xe, &(0x7f00000000c0)={[0xa, 0xffff, 0x4, 0x9, 0x1000000000800006, 0x1ff, 0x6, 0x3, 0x3, 0x4618ecd2, 0x3, 0x3fd, 0x6, 0x10009a8f, 0x9, 0x1]}, 0x0, 0x0, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) ioctl$auto_TUNDETACHFILTER(r1, 0x401054d6, &(0x7f0000000180)={0x6, &(0x7f0000000040)={0x7f, 0x37, 0x9}}) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40602, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xf15a}, 0x1, 0x4000000008, 0x5) landlock_create_ruleset$auto(0x0, 0x100000000, 0x7) write$auto(r2, 0x0, 0x5add) pwrite64$auto(r0, 0x0, 0x34afd519, 0xfffffffffffffffa) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/system/memory/memory15/online\x00', 0xa001, 0x0) write$auto(r3, &(0x7f0000000140)='0[.[\x00', 0xcd04) mmap$auto(0x0, 0x4, 0x4000000000df, 0x78, 0x4, 0x300000000000) socket(0x2, 0x1, 0x106) r4 = socket$nl_generic(0x10, 0x3, 0x10) bind$auto(r4, &(0x7f0000000040)=@generic={0x10, "26300628afe90504fc2bbe91f2eb"}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) 405.903884ms ago: executing program 2 (id=472): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mremap$auto(0x0, 0x500000000, 0x4, 0x7, 0x100000000) madvise$auto(0x0, 0x200007, 0x19) io_uring_setup$auto(0x2, &(0x7f0000000080)={0x80000003, 0x9, 0x4002, 0x6, 0x4, 0x8, 0xffffffffffffffff, [], {0x9, 0x6, 0xf, 0x29f, 0x100, 0x7f, 0x101, 0x4000006, 0x2000}, {0x100, 0x1, 0x52, 0x5, 0x1, 0x40, 0x104, 0x8, 0x100000000}}) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/module/ueagle_atm/parameters/sync_wait\x00', 0x1e2142, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/net/lapb3/threaded\x00', 0x8a801, 0x0) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, 0x200000401, 0x12000000000c004) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sda\x00', 0x443001f86cb35905, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) set_mempolicy$auto(0x3, &(0x7f0000000000)=0x7, 0x9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) io_uring_setup$auto(0x401, 0x0) bpf$auto_BPF_PROG_LOAD(0x5, &(0x7f0000000080)=@enable_stats={0x7}, 0x6) write$auto_qrtr_tun_ops_tun(0xffffffffffffffff, &(0x7f0000000300)="01000000d80746ebe4fa29705e2e6540f64b000003000000a7e9ce67feffffffb096b449", 0x24) mlockall$auto(0x7) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000140), 0xe0180, 0x0) ioctl$auto_KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) mremap$auto(0x4000, 0xb8, 0x13fd4, 0x3, 0xfffff000) io_uring_setup$auto(0x9, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) sendfile$auto(r2, r2, 0x0, 0x3) write$auto(r0, &(0x7f0000000000)='1\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000d36a7dfe2a716048d6ef506605836d", @ANYRES16=r3, @ANYBLOB="00022cbd7000fbdbdf25300000000500a20004000000"], 0x1c}}, 0x5) process_vm_writev$auto(0x0, &(0x7f0000000280)={0x0, 0x600000000}, 0x1, &(0x7f0000000340)={0x0, 0x9249}, 0x8, 0x0) sendfile$auto(r0, r0, 0x0, 0x8000) 274.824395ms ago: executing program 0 (id=473): r0 = openat$auto_proc_pid_cmdline_ops_base(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/cmdline\x00', 0x101000, 0x0) preadv$auto(r0, &(0x7f00000003c0)={&(0x7f0000000340), 0xc36}, 0x1, 0x77f7, 0x1) 220.890227ms ago: executing program 3 (id=474): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r0, r0, 0x0, 0x8) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) pipe2$auto(0x0, 0x80) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r1, 0x0, 0x400000000006) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) unshare$auto(0x40000080) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000500)='/sys/kernel/debug/block/loop15/hctx0/sched_tags\x00', 0x169100, 0x0) pread64$auto(r3, 0x0, 0x5000f42a, 0x100) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504000000040010"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) sendmsg$auto_HWSIM_CMD_NEW_RADIO(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) io_setup$auto(0xffff, 0x0) madvise$auto(0x0, 0x200007, 0x19) 139.483842ms ago: executing program 1 (id=475): mmap$auto(0x0, 0x2020009, 0x70000000000000, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x3, 0x202000c, 0x3, 0xeb1, 0xfffffffffffffffa, 0x4) r0 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c3300, 0x0) ioctl$auto_USB_RAW_IOCTL_CONFIGURE(r0, 0x5509, 0x0) mmap$auto(0x0, 0x8000400005, 0x400000000006, 0xfff, 0x2, 0x7) r1 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) sysfs$auto(0x2, 0x10000000000002d, 0x0) ioctl$auto_IOCTL_VMCI_VERSION2(r1, 0x7a7, 0x0) ioctl$auto_IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, 0x6) ioctl$auto_IOCTL_VMCI_CTX_ADD_NOTIFICATION(r1, 0x7af, 0x0) ioctl$auto_IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r1, 0x7b0, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0x2b, 0x1, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/platform/vivid.0/video4linux/video62/name\x00', 0x100, 0x0) close_range$auto(0x2, 0x8, 0x0) r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x0, 0x0) ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$auto(0x3, 0x4048aec9, r2) sysfs$auto(0x2, 0x100000000000028, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(r4, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB='5\x00\x00\x00', @ANYRES16, @ANYBLOB="010025bd700002dcdf2503"], 0x1c}, 0x1, 0x0, 0x0, 0x200400f0}, 0x800) r5 = fsopen$auto(0x0, 0x1) socket(0x1d, 0x3, 0x5) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0x3, &(0x7f0000000000)={{0x0, 0xa13, 0x0, 0x106, 0x0, 0x6c, 0x697c}, 0xed71390}, 0x9a6, 0xff00) fsconfig$auto(r5, 0x8, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000001f00), 0xffffffffffffffff) mmap$auto(0x80000001, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) bpf$auto(0x0, 0x0, 0x5) 0s ago: executing program 0 (id=476): r0 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) write$auto_console_fops_tty_io(r0, &(0x7f0000000100)="c80d1b5d399b394d", 0x8) kernel console output (not intermixed with test programs): /0xa0 [ 138.274990][ T6263] sysfs_kf_seq_show+0x217/0x3f0 [ 138.305197][ T6263] seq_read_iter+0x32f/0x1270 [ 138.340774][ T6263] kernfs_fop_read_iter+0x46c/0x610 [ 138.370069][ T6263] vfs_read+0x82e/0xb40 [ 138.380333][ T6263] ksys_read+0x12a/0x250 [ 138.386124][ T6263] do_syscall_64+0x115/0x840 [ 138.392631][ T6263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.403404][ T6263] page last free pid 4997 tgid 4997 stack trace: [ 138.410357][ T6263] __free_frozen_pages+0x79f/0x1090 [ 138.430342][ T6263] qlist_free_all+0x47/0xf0 [ 138.446520][ T6263] kasan_quarantine_reduce+0x1a0/0x1f0 [ 138.463692][ T6263] __kasan_slab_alloc+0x69/0x90 [ 138.477451][ T6263] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 138.496336][ T6263] __alloc_skb+0x140/0x710 [ 138.563750][ T6263] netlink_alloc_large_skb+0x69/0x150 [ 138.585082][ T6263] netlink_sendmsg+0x680/0xda0 [ 138.606723][ T6263] ____sys_sendmsg+0xa4d/0xbe0 [ 138.623260][ T6263] ___sys_sendmsg+0x190/0x1e0 [ 138.640404][ T6263] __sys_sendmsg+0x160/0x210 [ 138.653646][ T6263] do_syscall_64+0x115/0x840 [ 138.669619][ T6263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.379606][ T6298] ======================================================= [ 140.379606][ T6298] WARNING: The mand mount option has been deprecated and [ 140.379606][ T6298] and is ignored by this kernel. Remove the mand [ 140.379606][ T6298] option from the mount to silence this warning. [ 140.379606][ T6298] ======================================================= [ 140.441917][ T6303] netlink: 28 bytes leftover after parsing attributes in process `syz.2.87'. [ 140.580990][ T6303] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.588700][ T6303] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 140.608385][ T6303] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.622750][ T6303] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 142.172433][ T6314] ubi0: attaching mtd0 [ 142.211290][ T6314] ubi0: scanning is finished [ 142.807177][ T6328] netlink: 8 bytes leftover after parsing attributes in process `syz.1.92'. [ 142.816239][ T6305] syz.2.88 uses obsolete (PF_INET,SOCK_PACKET) [ 142.830465][ T6314] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 143.585650][ T6340] netlink: zone id is out of range [ 143.615586][ T6340] netlink: zone id is out of range [ 143.642579][ T6340] netlink: zone id is out of range [ 143.652944][ T6340] netlink: zone id is out of range [ 143.660086][ T6340] netlink: zone id is out of range [ 143.677697][ T6340] netlink: zone id is out of range [ 143.727815][ T6340] netlink: zone id is out of range [ 143.737994][ T6340] netlink: zone id is out of range [ 143.745126][ T6340] netlink: zone id is out of range [ 143.750387][ T6340] netlink: zone id is out of range [ 143.935270][ T6355] random: crng reseeded on system resumption [ 144.554451][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.99'. [ 145.916117][ T6387] futex_wake_op: syz.2.100 tries to shift op by -2048; fix this program [ 146.484586][ T6397] random: crng reseeded on system resumption [ 146.647556][ T6390] ubi0: attaching mtd0 [ 146.659851][ T6382] netlink: 330 bytes leftover after parsing attributes in process `syz.3.101'. [ 146.732996][ T6390] ubi0: scanning is finished [ 146.993448][ T6390] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 147.518984][ T6407] FAULT_INJECTION: forcing a failure. [ 147.518984][ T6407] name failslab, interval 1, probability 0, space 0, times 1 [ 147.560557][ T6407] CPU: 1 UID: 0 PID: 6407 Comm: syz.1.105 Not tainted syzkaller #0 PREEMPT(full) [ 147.560602][ T6407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 147.560629][ T6407] Call Trace: [ 147.560640][ T6407] [ 147.560653][ T6407] dump_stack_lvl+0x100/0x190 [ 147.560705][ T6407] should_fail_ex.cold+0x5/0xa [ 147.560766][ T6407] should_failslab+0xc2/0x120 [ 147.560817][ T6407] __kmalloc_cache_node_noprof+0x94/0x6c0 [ 147.560867][ T6407] ? alloc_shrinker_info+0x192/0x470 [ 147.560918][ T6407] alloc_shrinker_info+0x192/0x470 [ 147.560967][ T6407] ? __pfx_mem_cgroup_css_online+0x10/0x10 [ 147.561011][ T6407] mem_cgroup_css_online+0xa4/0xbf0 [ 147.561057][ T6407] ? __pfx_mem_cgroup_css_online+0x10/0x10 [ 147.561100][ T6407] online_css+0xb2/0x350 [ 147.561141][ T6407] cgroup_apply_control_enable+0xa8d/0xdd0 [ 147.561204][ T6407] cgroup_mkdir+0x57f/0x1330 [ 147.561260][ T6407] ? __pfx_cgroup_mkdir+0x10/0x10 [ 147.561312][ T6407] kernfs_iop_mkdir+0x111/0x190 [ 147.561344][ T6407] ? bpf_lsm_inode_mkdir+0x9/0x10 [ 147.561397][ T6407] vfs_mkdir+0x361/0x850 [ 147.561457][ T6407] filename_mkdirat+0x48b/0x5e0 [ 147.561500][ T6407] ? __pfx_filename_mkdirat+0x10/0x10 [ 147.561538][ T6407] ? strncpy_from_user+0x19d/0x2d0 [ 147.561589][ T6407] ? do_getname+0x191/0x390 [ 147.561635][ T6407] __x64_sys_mkdir+0x6b/0x90 [ 147.561672][ T6407] do_syscall_64+0x115/0x840 [ 147.561699][ T6407] ? clear_bhb_loop+0x40/0x90 [ 147.561736][ T6407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 147.561764][ T6407] RIP: 0033:0x7fbe7e19de59 [ 147.561796][ T6407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 147.561824][ T6407] RSP: 002b:00007fbe7f0a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 147.561855][ T6407] RAX: ffffffffffffffda RBX: 00007fbe7e425fa0 RCX: 00007fbe7e19de59 [ 147.561875][ T6407] RDX: 0000000000000000 RSI: 00000000000008cd RDI: 0000200000000000 [ 147.561892][ T6407] RBP: 00007fbe7e233e6f R08: 0000000000000000 R09: 0000000000000000 [ 147.561910][ T6407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 147.561926][ T6407] R13: 00007fbe7e426038 R14: 00007fbe7e425fa0 R15: 00007ffda8825178 [ 147.561965][ T6407] [ 147.910177][ T6404] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 147.993461][ T6404] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 148.074848][ T6404] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 148.092250][ T6404] page_type: f5(slab) [ 148.105925][ T6404] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 148.129486][ T6404] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 148.159991][ T6404] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 148.251784][ T6404] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 148.282717][ T6404] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 148.298943][ T6404] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 148.343681][ T6404] page dumped because: unmovable page [ 148.349306][ T6404] page_owner tracks the page as allocated [ 148.355770][ T6404] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 148.377924][ T6404] post_alloc_hook+0xfd/0x120 [ 148.383246][ T6404] get_page_from_freelist+0xf48/0x3530 [ 148.388992][ T6404] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 148.395688][ T6404] new_slab+0xa2/0x650 [ 148.400357][ T6404] refill_objects+0xe3/0x410 [ 148.405117][ T6404] __pcs_replace_empty_main+0x376/0x680 [ 148.410935][ T6404] __kmalloc_cache_noprof+0x479/0x6c0 [ 148.416739][ T6404] uevent_show+0x166/0x3a0 [ 148.421403][ T6404] dev_attr_show+0x52/0xa0 [ 148.427727][ T6404] sysfs_kf_seq_show+0x217/0x3f0 [ 148.433534][ T6404] seq_read_iter+0x32f/0x1270 [ 148.438460][ T6404] kernfs_fop_read_iter+0x46c/0x610 [ 148.445319][ T6404] vfs_read+0x82e/0xb40 [ 148.449576][ T6404] ksys_read+0x12a/0x250 [ 148.453933][ T6404] do_syscall_64+0x115/0x840 [ 148.458745][ T6404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.465163][ T6404] page last free pid 4997 tgid 4997 stack trace: [ 148.471696][ T6404] __free_frozen_pages+0x79f/0x1090 [ 148.478720][ T6404] qlist_free_all+0x47/0xf0 [ 148.500669][ T6404] kasan_quarantine_reduce+0x1a0/0x1f0 [ 148.518727][ T6404] __kasan_slab_alloc+0x69/0x90 [ 148.528857][ T6404] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 148.543300][ T6404] __alloc_skb+0x140/0x710 [ 148.551963][ T6404] netlink_alloc_large_skb+0x69/0x150 [ 148.562094][ T6404] netlink_sendmsg+0x680/0xda0 [ 148.573954][ T6404] ____sys_sendmsg+0xa4d/0xbe0 [ 148.579157][ T6404] ___sys_sendmsg+0x190/0x1e0 [ 148.586097][ T6404] __sys_sendmsg+0x160/0x210 [ 148.598519][ T6404] do_syscall_64+0x115/0x840 [ 148.605165][ T6404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.945923][ T6451] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 150.007267][ T6451] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 150.017396][ T6451] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 150.025134][ T6451] page_type: f5(slab) [ 150.029298][ T6451] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 150.038588][ T6451] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 150.047898][ T6451] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 150.056962][ T6451] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 150.065940][ T6451] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 150.075523][ T6451] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 150.107267][ T6451] page dumped because: unmovable page [ 150.125509][ T6451] page_owner tracks the page as allocated [ 150.143105][ T6451] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 150.185204][ T6451] post_alloc_hook+0xfd/0x120 [ 150.193166][ T6451] get_page_from_freelist+0xf48/0x3530 [ 150.208071][ T6451] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 150.221729][ T6451] new_slab+0xa2/0x650 [ 150.226771][ T6451] refill_objects+0xe3/0x410 [ 150.231545][ T6451] __pcs_replace_empty_main+0x376/0x680 [ 150.243653][ T6451] __kmalloc_cache_noprof+0x479/0x6c0 [ 150.253667][ T6451] uevent_show+0x166/0x3a0 [ 150.263753][ T6451] dev_attr_show+0x52/0xa0 [ 150.273720][ T6451] sysfs_kf_seq_show+0x217/0x3f0 [ 150.289115][ T6451] seq_read_iter+0x32f/0x1270 [ 150.303720][ T6451] kernfs_fop_read_iter+0x46c/0x610 [ 150.309217][ T6451] vfs_read+0x82e/0xb40 [ 150.318525][ T6451] ksys_read+0x12a/0x250 [ 150.333895][ T6451] do_syscall_64+0x115/0x840 [ 150.338737][ T6451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.350351][ T6451] page last free pid 4997 tgid 4997 stack trace: [ 150.385887][ T6451] __free_frozen_pages+0x79f/0x1090 [ 150.406885][ T6451] qlist_free_all+0x47/0xf0 [ 150.416606][ T6451] kasan_quarantine_reduce+0x1a0/0x1f0 [ 150.424128][ T6451] __kasan_slab_alloc+0x69/0x90 [ 150.429135][ T6451] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 150.435692][ T6451] __alloc_skb+0x140/0x710 [ 150.440213][ T6451] netlink_alloc_large_skb+0x69/0x150 [ 150.445829][ T6451] netlink_sendmsg+0x680/0xda0 [ 150.450690][ T6451] ____sys_sendmsg+0xa4d/0xbe0 [ 150.455678][ T6451] ___sys_sendmsg+0x190/0x1e0 [ 150.460467][ T6451] __sys_sendmsg+0x160/0x210 [ 150.465321][ T6451] do_syscall_64+0x115/0x840 [ 150.469977][ T6451] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.093341][ T6468] netlink: 8 bytes leftover after parsing attributes in process `syz.2.116'. [ 153.060062][ T6490] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 153.129760][ T6490] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.187936][ T6490] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.242689][ T6490] page_type: f5(slab) [ 153.258959][ T6490] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 153.288956][ T6490] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 153.343402][ T6490] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 153.356291][ T6490] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 153.379107][ T6490] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.401612][ T6490] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.445607][ T6490] page dumped because: unmovable page [ 153.477948][ T6490] page_owner tracks the page as allocated [ 153.501795][ T6490] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 153.605930][ T6490] post_alloc_hook+0xfd/0x120 [ 153.622659][ T6490] get_page_from_freelist+0xf48/0x3530 [ 153.646436][ T6490] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 153.663712][ T6490] new_slab+0xa2/0x650 [ 153.669989][ T6490] refill_objects+0xe3/0x410 [ 153.683827][ T6490] __pcs_replace_empty_main+0x376/0x680 [ 153.703159][ T6490] __kmalloc_cache_noprof+0x479/0x6c0 [ 153.720195][ T6490] uevent_show+0x166/0x3a0 [ 153.731854][ T6490] dev_attr_show+0x52/0xa0 [ 153.741985][ T6490] sysfs_kf_seq_show+0x217/0x3f0 [ 153.761451][ T6490] seq_read_iter+0x32f/0x1270 [ 153.777579][ T6490] kernfs_fop_read_iter+0x46c/0x610 [ 153.796848][ T6490] vfs_read+0x82e/0xb40 [ 153.808865][ T6490] ksys_read+0x12a/0x250 [ 153.822205][ T6490] do_syscall_64+0x115/0x840 [ 153.833028][ T6490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.849336][ T6490] page last free pid 4997 tgid 4997 stack trace: [ 153.878719][ T6490] __free_frozen_pages+0x79f/0x1090 [ 153.896814][ T6490] qlist_free_all+0x47/0xf0 [ 153.911785][ T6490] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.927401][ T6490] __kasan_slab_alloc+0x69/0x90 [ 153.943460][ T6490] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 153.958928][ T6490] __alloc_skb+0x140/0x710 [ 153.977121][ T6490] netlink_alloc_large_skb+0x69/0x150 [ 154.000331][ T6490] netlink_sendmsg+0x680/0xda0 [ 154.016943][ T6490] ____sys_sendmsg+0xa4d/0xbe0 [ 154.033192][ T6490] ___sys_sendmsg+0x190/0x1e0 [ 154.051522][ T6490] __sys_sendmsg+0x160/0x210 [ 154.067607][ T6490] do_syscall_64+0x115/0x840 [ 154.081811][ T6490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.530936][ T6545] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 156.590924][ T6545] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 156.651642][ T6545] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 156.709149][ T6545] page_type: f5(slab) [ 156.748101][ T6545] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 156.810098][ T6545] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 156.870602][ T6545] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 156.933872][ T6545] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 156.980189][ T6545] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 157.003600][ T6545] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 157.056678][ T6545] page dumped because: unmovable page [ 157.089149][ T6545] page_owner tracks the page as allocated [ 157.127233][ T6545] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 157.226695][ T6545] post_alloc_hook+0xfd/0x120 [ 157.246494][ T6545] get_page_from_freelist+0xf48/0x3530 [ 157.264246][ T6545] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 157.284891][ T6545] new_slab+0xa2/0x650 [ 157.296128][ T6545] refill_objects+0xe3/0x410 [ 157.310128][ T6545] __pcs_replace_empty_main+0x376/0x680 [ 157.337118][ T6545] __kmalloc_cache_noprof+0x479/0x6c0 [ 157.357743][ T6545] uevent_show+0x166/0x3a0 [ 157.375659][ T6545] dev_attr_show+0x52/0xa0 [ 157.394429][ T6545] sysfs_kf_seq_show+0x217/0x3f0 [ 157.412100][ T6545] seq_read_iter+0x32f/0x1270 [ 157.426345][ T6545] kernfs_fop_read_iter+0x46c/0x610 [ 157.436373][ T6545] vfs_read+0x82e/0xb40 [ 157.446768][ T6545] ksys_read+0x12a/0x250 [ 157.460406][ T6545] do_syscall_64+0x115/0x840 [ 157.470069][ T6545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.490880][ T6545] page last free pid 4997 tgid 4997 stack trace: [ 157.499079][ T6552] syz.3.125 (6552) used greatest stack depth: 18560 bytes left [ 157.508559][ T6545] __free_frozen_pages+0x79f/0x1090 [ 157.517023][ T6545] qlist_free_all+0x47/0xf0 [ 157.527139][ T6545] kasan_quarantine_reduce+0x1a0/0x1f0 [ 157.544270][ T6545] __kasan_slab_alloc+0x69/0x90 [ 157.556110][ T6545] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 157.582935][ T6545] __alloc_skb+0x140/0x710 [ 157.595779][ T6545] netlink_alloc_large_skb+0x69/0x150 [ 157.609078][ T6545] netlink_sendmsg+0x680/0xda0 [ 157.624685][ T6545] ____sys_sendmsg+0xa4d/0xbe0 [ 157.672525][ T6545] ___sys_sendmsg+0x190/0x1e0 [ 157.688854][ T6545] __sys_sendmsg+0x160/0x210 [ 157.697819][ T6545] do_syscall_64+0x115/0x840 [ 157.709986][ T6545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.182884][ T6560] ubi0: attaching mtd0 [ 158.205966][ T6560] ubi0: scanning is finished [ 158.271956][ T6565] netlink: 8 bytes leftover after parsing attributes in process `syz.3.127'. [ 158.524642][ T6560] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 158.548251][ T6560] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 158.586040][ T6560] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 158.615228][ T6560] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 158.643040][ T6560] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 158.661270][ T6560] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 158.696925][ T6560] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1488380749 [ 158.736172][ T6560] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 158.771205][ T6579] ubi0: background thread "ubi_bgt0d" started, PID 6579 [ 158.785102][ T6564] ubi0: detaching mtd0 [ 158.846921][ T6564] ubi0: mtd0 is detached [ 159.740552][ T6574] process 'syz.1.129' launched './file0' with NULL argv: empty string added [ 160.500899][ T6591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.131'. [ 160.669759][ T6597] mtrr: base(0x4000000) is not aligned on a size(0x0000) boundary [ 161.135666][ T6604] netlink: 12 bytes leftover after parsing attributes in process `syz.2.133'. [ 162.362510][ T6626] ubi0: attaching mtd0 [ 162.421005][ T6626] ubi0: scanning is finished [ 162.725057][ T6626] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 162.773729][ T6626] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 162.805913][ T6626] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 162.843115][ T6626] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 162.872685][ T6626] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 162.897484][ T6626] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 162.926722][ T6626] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1488380749 [ 162.965345][ T6626] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 163.014004][ T6631] ubi0: detaching mtd0 [ 163.026685][ T6648] ubi0: background thread "ubi_bgt0d" started, PID 6648 [ 163.062566][ T6631] ubi0: mtd0 is detached [ 163.227494][ T6643] netlink: 8 bytes leftover after parsing attributes in process `syz.0.140'. [ 164.182471][ T6669] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 164.270273][ T6669] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 164.280908][ T6669] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 164.288995][ T6669] page_type: f5(slab) [ 164.293307][ T6669] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 164.303921][ T6669] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 164.325978][ T6669] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 164.350452][ T6669] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 164.375150][ T6669] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 164.395497][ T6669] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 164.433163][ T6669] page dumped because: unmovable page [ 164.464358][ T6669] page_owner tracks the page as allocated [ 164.483914][ T6669] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 164.538073][ T6669] post_alloc_hook+0xfd/0x120 [ 164.551111][ T6669] get_page_from_freelist+0xf48/0x3530 [ 164.564303][ T6669] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 164.579562][ T6669] new_slab+0xa2/0x650 [ 164.601724][ T6669] refill_objects+0xe3/0x410 [ 164.632268][ T6669] __pcs_replace_empty_main+0x376/0x680 [ 164.667972][ T6669] __kmalloc_cache_noprof+0x479/0x6c0 [ 164.683692][ T6669] uevent_show+0x166/0x3a0 [ 164.699835][ T6669] dev_attr_show+0x52/0xa0 [ 164.728214][ T6669] sysfs_kf_seq_show+0x217/0x3f0 [ 164.750685][ T6669] seq_read_iter+0x32f/0x1270 [ 164.772585][ T6669] kernfs_fop_read_iter+0x46c/0x610 [ 164.779466][ T6669] vfs_read+0x82e/0xb40 [ 164.784109][ T6669] ksys_read+0x12a/0x250 [ 164.788464][ T6669] do_syscall_64+0x115/0x840 [ 164.793127][ T6669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.807327][ T6669] page last free pid 4997 tgid 4997 stack trace: [ 164.835247][ T6669] __free_frozen_pages+0x79f/0x1090 [ 164.853361][ T6669] qlist_free_all+0x47/0xf0 [ 164.891433][ T6669] kasan_quarantine_reduce+0x1a0/0x1f0 [ 164.914064][ T6669] __kasan_slab_alloc+0x69/0x90 [ 164.934570][ T6669] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 164.950775][ T6669] __alloc_skb+0x140/0x710 [ 164.969979][ T6669] netlink_alloc_large_skb+0x69/0x150 [ 164.994023][ T6669] netlink_sendmsg+0x680/0xda0 [ 164.999124][ T6669] ____sys_sendmsg+0xa4d/0xbe0 [ 165.004576][ T6669] ___sys_sendmsg+0x190/0x1e0 [ 165.013950][ T6669] __sys_sendmsg+0x160/0x210 [ 165.030595][ T6669] do_syscall_64+0x115/0x840 [ 165.044835][ T6669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.197633][ T6712] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 167.219792][ T6712] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 167.250731][ T6712] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 167.272088][ T6712] page_type: f5(slab) [ 167.283714][ T6712] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 167.303727][ T6717] loop6: detected capacity change from 0 to 2097152 [ 167.303871][ T6712] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 167.351152][ T6712] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 167.383125][ T6712] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 167.419849][ T6712] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 167.434924][ T6712] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 167.445383][ T6712] page dumped because: unmovable page [ 167.470920][ T6712] page_owner tracks the page as allocated [ 167.485216][ T6712] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 167.512749][ T6712] post_alloc_hook+0xfd/0x120 [ 167.518137][ T6712] get_page_from_freelist+0xf48/0x3530 [ 167.523917][ T6712] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 167.529965][ T6712] new_slab+0xa2/0x650 [ 167.534568][ T6712] refill_objects+0xe3/0x410 [ 167.539286][ T6712] __pcs_replace_empty_main+0x376/0x680 [ 167.545142][ T6712] __kmalloc_cache_noprof+0x479/0x6c0 [ 167.550868][ T6712] uevent_show+0x166/0x3a0 [ 167.555777][ T6712] dev_attr_show+0x52/0xa0 [ 167.560325][ T6712] sysfs_kf_seq_show+0x217/0x3f0 [ 167.572320][ T6712] seq_read_iter+0x32f/0x1270 [ 167.591259][ T6712] kernfs_fop_read_iter+0x46c/0x610 [ 167.608968][ T6712] vfs_read+0x82e/0xb40 [ 167.624193][ T6712] ksys_read+0x12a/0x250 [ 167.637792][ T6712] do_syscall_64+0x115/0x840 [ 167.654023][ T6712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.675337][ T6712] page last free pid 4997 tgid 4997 stack trace: [ 167.691881][ T6712] __free_frozen_pages+0x79f/0x1090 [ 167.701993][ T6712] qlist_free_all+0x47/0xf0 [ 167.710356][ T6712] kasan_quarantine_reduce+0x1a0/0x1f0 [ 167.721354][ T6712] __kasan_slab_alloc+0x69/0x90 [ 167.735080][ T6712] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 167.747429][ T6712] __alloc_skb+0x140/0x710 [ 167.758245][ T6712] netlink_alloc_large_skb+0x69/0x150 [ 167.769682][ T6712] netlink_sendmsg+0x680/0xda0 [ 167.769784][ T6709] netlink: 4 bytes leftover after parsing attributes in process `syz.3.150'. [ 167.780057][ T6712] ____sys_sendmsg+0xa4d/0xbe0 [ 167.800602][ T6712] ___sys_sendmsg+0x190/0x1e0 [ 167.817327][ T6712] __sys_sendmsg+0x160/0x210 [ 167.822594][ T6712] do_syscall_64+0x115/0x840 [ 167.828690][ T6712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.362190][ T6732] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 168.379985][ T6732] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 168.390672][ T6732] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 168.403525][ T6732] page_type: f5(slab) [ 168.413301][ T6732] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 168.433775][ T6732] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 168.443135][ T6732] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 168.452544][ T6732] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 168.461954][ T6732] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 168.472276][ T6732] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 168.481305][ T6732] page dumped because: unmovable page [ 168.488689][ T6732] page_owner tracks the page as allocated [ 168.494807][ T6732] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 168.524699][ T6732] post_alloc_hook+0xfd/0x120 [ 168.535080][ T6732] get_page_from_freelist+0xf48/0x3530 [ 168.548341][ T6732] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 168.562312][ T6732] new_slab+0xa2/0x650 [ 168.571251][ T6732] refill_objects+0xe3/0x410 [ 168.576337][ T6732] __pcs_replace_empty_main+0x376/0x680 [ 168.582022][ T6732] __kmalloc_cache_noprof+0x479/0x6c0 [ 168.587963][ T6732] uevent_show+0x166/0x3a0 [ 168.592505][ T6732] dev_attr_show+0x52/0xa0 [ 168.597570][ T6732] sysfs_kf_seq_show+0x217/0x3f0 [ 168.602642][ T6732] seq_read_iter+0x32f/0x1270 [ 168.609846][ T6732] kernfs_fop_read_iter+0x46c/0x610 [ 168.615508][ T6732] vfs_read+0x82e/0xb40 [ 168.619871][ T6732] ksys_read+0x12a/0x250 [ 168.626579][ T6732] do_syscall_64+0x115/0x840 [ 168.631325][ T6732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.637872][ T6732] page last free pid 4997 tgid 4997 stack trace: [ 168.645027][ T6732] __free_frozen_pages+0x79f/0x1090 [ 168.650374][ T6732] qlist_free_all+0x47/0xf0 [ 168.655482][ T6732] kasan_quarantine_reduce+0x1a0/0x1f0 [ 168.661109][ T6732] __kasan_slab_alloc+0x69/0x90 [ 168.673517][ T6732] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 168.680945][ T6732] __alloc_skb+0x140/0x710 [ 168.685731][ T6732] netlink_alloc_large_skb+0x69/0x150 [ 168.691723][ T6732] netlink_sendmsg+0x680/0xda0 [ 168.697579][ T6732] ____sys_sendmsg+0xa4d/0xbe0 [ 168.703127][ T6732] ___sys_sendmsg+0x190/0x1e0 [ 168.710252][ T6732] __sys_sendmsg+0x160/0x210 [ 168.715576][ T6732] do_syscall_64+0x115/0x840 [ 168.721076][ T6732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.867373][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.0.154'. [ 170.492548][ T6759] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 170.524890][ T6759] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 170.564196][ T6759] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 170.571852][ T6759] page_type: f5(slab) [ 170.575990][ T6759] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 170.584717][ T6759] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 170.593704][ T6759] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 170.623437][ T6759] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 170.669295][ T6759] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 170.717583][ T6759] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 170.766255][ T6759] page dumped because: unmovable page [ 170.783665][ T6759] page_owner tracks the page as allocated [ 170.815869][ T6759] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 170.875018][ T6759] post_alloc_hook+0xfd/0x120 [ 170.894511][ T6759] get_page_from_freelist+0xf48/0x3530 [ 170.903763][ T6759] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 170.924786][ T6759] new_slab+0xa2/0x650 [ 170.940987][ T6759] refill_objects+0xe3/0x410 [ 170.969877][ T6759] __pcs_replace_empty_main+0x376/0x680 [ 171.011413][ T6759] __kmalloc_cache_noprof+0x479/0x6c0 [ 171.034304][ T6759] uevent_show+0x166/0x3a0 [ 171.066178][ T6759] dev_attr_show+0x52/0xa0 [ 171.080551][ T6759] sysfs_kf_seq_show+0x217/0x3f0 [ 171.107707][ T6759] seq_read_iter+0x32f/0x1270 [ 171.121212][ T6759] kernfs_fop_read_iter+0x46c/0x610 [ 171.140760][ T6759] vfs_read+0x82e/0xb40 [ 171.156536][ T6759] ksys_read+0x12a/0x250 [ 171.165117][ T6759] do_syscall_64+0x115/0x840 [ 171.175506][ T6759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.186224][ T6759] page last free pid 4997 tgid 4997 stack trace: [ 171.202673][ T6759] __free_frozen_pages+0x79f/0x1090 [ 171.210061][ T6759] qlist_free_all+0x47/0xf0 [ 171.218325][ T6759] kasan_quarantine_reduce+0x1a0/0x1f0 [ 171.226135][ T6759] __kasan_slab_alloc+0x69/0x90 [ 171.237530][ T6759] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 171.246197][ T6759] __alloc_skb+0x140/0x710 [ 171.252383][ T6759] netlink_alloc_large_skb+0x69/0x150 [ 171.261847][ T6759] netlink_sendmsg+0x680/0xda0 [ 171.274991][ T6759] ____sys_sendmsg+0xa4d/0xbe0 [ 171.283937][ T6759] ___sys_sendmsg+0x190/0x1e0 [ 171.300027][ T6759] __sys_sendmsg+0x160/0x210 [ 171.315083][ T6759] do_syscall_64+0x115/0x840 [ 171.331693][ T6759] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.076582][ T6780] netlink: 20 bytes leftover after parsing attributes in process `syz.1.163'. [ 172.406718][ T6786] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 172.428109][ T6786] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 172.454246][ T6786] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 172.498874][ T6786] page_type: f5(slab) [ 172.529507][ T6786] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 172.574846][ T6786] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 172.616973][ T6786] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 172.643306][ T6786] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 172.685616][ T6786] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 172.696180][ T6786] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 172.705679][ T6786] page dumped because: unmovable page [ 172.711226][ T6786] page_owner tracks the page as allocated [ 172.717509][ T6786] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 172.759041][ T6786] post_alloc_hook+0xfd/0x120 [ 172.771713][ T6786] get_page_from_freelist+0xf48/0x3530 [ 172.783751][ T6786] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 172.798960][ T6786] new_slab+0xa2/0x650 [ 172.816402][ T6786] refill_objects+0xe3/0x410 [ 172.832891][ T6786] __pcs_replace_empty_main+0x376/0x680 [ 172.857519][ T6786] __kmalloc_cache_noprof+0x479/0x6c0 [ 172.869848][ T6786] uevent_show+0x166/0x3a0 [ 172.884152][ T6786] dev_attr_show+0x52/0xa0 [ 172.894122][ T6786] sysfs_kf_seq_show+0x217/0x3f0 [ 172.908210][ T6786] seq_read_iter+0x32f/0x1270 [ 172.913868][ T6786] kernfs_fop_read_iter+0x46c/0x610 [ 172.919716][ T6786] vfs_read+0x82e/0xb40 [ 172.933907][ T6786] ksys_read+0x12a/0x250 [ 172.947598][ T6786] do_syscall_64+0x115/0x840 [ 172.967953][ T6786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.996410][ T6786] page last free pid 4997 tgid 4997 stack trace: [ 173.003774][ T6786] __free_frozen_pages+0x79f/0x1090 [ 173.021604][ T6786] qlist_free_all+0x47/0xf0 [ 173.030064][ T6786] kasan_quarantine_reduce+0x1a0/0x1f0 [ 173.042066][ T6786] __kasan_slab_alloc+0x69/0x90 [ 173.053221][ T6786] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 173.064539][ T6786] __alloc_skb+0x140/0x710 [ 173.072493][ T6786] netlink_alloc_large_skb+0x69/0x150 [ 173.089009][ T6786] netlink_sendmsg+0x680/0xda0 [ 173.104825][ T6786] ____sys_sendmsg+0xa4d/0xbe0 [ 173.129930][ T6786] ___sys_sendmsg+0x190/0x1e0 [ 173.161873][ T6786] __sys_sendmsg+0x160/0x210 [ 173.173935][ T6786] do_syscall_64+0x115/0x840 [ 173.186351][ T6786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.791075][ T6794] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 173.804695][ T6794] File: /dev/sda PID: 6794 Comm: syz.3.166 [ 174.094379][ T6803] netlink: 'syz.0.167': attribute type 22 has an invalid length. [ 174.113772][ T6803] netlink: 330 bytes leftover after parsing attributes in process `syz.0.167'. [ 174.272747][ T6795] zram: Removed device: zram0 [ 176.442011][ T6844] netlink: 28 bytes leftover after parsing attributes in process `syz.0.177'. [ 176.603375][ T6844] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 176.794236][ T6844] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 176.846155][ T6844] bond0 (unregistering): Released all slaves [ 176.910165][ T6836] netlink: 8 bytes leftover after parsing attributes in process `syz.1.174'. [ 177.802283][ T6862] random: crng reseeded on system resumption [ 179.259187][ T6884] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 179.277757][ T6876] netlink: 16 bytes leftover after parsing attributes in process `syz.1.180'. [ 179.321618][ T6884] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 179.376088][ T6884] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 179.409864][ T6884] page_type: f5(slab) [ 179.430988][ T6884] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 179.481461][ T6884] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 179.495426][ T6884] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 179.533794][ T6884] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 179.594611][ T6884] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 179.666291][ T6884] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 179.713705][ T6884] page dumped because: unmovable page [ 179.746991][ T6884] page_owner tracks the page as allocated [ 179.784713][ T6884] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 179.824420][ T6884] post_alloc_hook+0xfd/0x120 [ 179.831469][ T6884] get_page_from_freelist+0xf48/0x3530 [ 179.869504][ T6884] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 179.898771][ T6884] new_slab+0xa2/0x650 [ 179.903278][ T6897] Line length is too long: Should be less than 4094 [ 179.918427][ T6884] refill_objects+0xe3/0x410 [ 179.940712][ T6884] __pcs_replace_empty_main+0x376/0x680 [ 179.968349][ T6884] __kmalloc_cache_noprof+0x479/0x6c0 [ 180.041429][ T6884] uevent_show+0x166/0x3a0 [ 180.047673][ T6884] dev_attr_show+0x52/0xa0 [ 180.052223][ T6884] sysfs_kf_seq_show+0x217/0x3f0 [ 180.057354][ T6884] seq_read_iter+0x32f/0x1270 [ 180.063680][ T6884] kernfs_fop_read_iter+0x46c/0x610 [ 180.068967][ T6884] vfs_read+0x82e/0xb40 [ 180.074001][ T6884] ksys_read+0x12a/0x250 [ 180.078363][ T6884] do_syscall_64+0x115/0x840 [ 180.083030][ T6884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.089175][ T6884] page last free pid 4997 tgid 4997 stack trace: [ 180.095612][ T6884] __free_frozen_pages+0x79f/0x1090 [ 180.102330][ T6884] qlist_free_all+0x47/0xf0 [ 180.107009][ T6884] kasan_quarantine_reduce+0x1a0/0x1f0 [ 180.112560][ T6884] __kasan_slab_alloc+0x69/0x90 [ 180.117920][ T6884] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 180.124020][ T6884] __alloc_skb+0x140/0x710 [ 180.128493][ T6884] netlink_alloc_large_skb+0x69/0x150 [ 180.134025][ T6884] netlink_sendmsg+0x680/0xda0 [ 180.139177][ T6884] ____sys_sendmsg+0xa4d/0xbe0 [ 180.149235][ T6884] ___sys_sendmsg+0x190/0x1e0 [ 180.173699][ T6884] __sys_sendmsg+0x160/0x210 [ 180.186168][ T6884] do_syscall_64+0x115/0x840 [ 180.203336][ T6884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.632495][ T6893] netlink: 12 bytes leftover after parsing attributes in process `syz.1.184'. [ 181.351306][ T6905] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.677831][ T6924] futex_wake_op: syz.3.188 tries to shift op by -2048; fix this program [ 182.725467][ T6924] 0x000000000001-0x000000020000 : "" [ 182.801086][ T6924] ftl_cs: FTL header corrupt! [ 183.695660][ T6930] netlink: 8 bytes leftover after parsing attributes in process `syz.1.189'. [ 184.329271][ T30] audit: type=1800 audit(1843104539.590:2): pid=6945 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.192" name="dbroot" dev="configfs" ino=16424 res=0 errno=0 [ 185.137539][ T6968] netlink: 25 bytes leftover after parsing attributes in process `syz.1.195'. [ 186.388370][ T6980] netlink: 8 bytes leftover after parsing attributes in process `syz.1.197'. [ 186.609169][ T6975] netlink: 8 bytes leftover after parsing attributes in process `syz.3.196'. [ 187.380958][ T6996] netlink: 28 bytes leftover after parsing attributes in process `syz.2.199'. [ 187.455017][ T6995] warning: `syz.2.199' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 187.657820][ T6996] bond0: (slave bond_slave_0): Releasing backup interface [ 188.358970][ T7003] netlink: 8 bytes leftover after parsing attributes in process `syz.2.200'. [ 189.032226][ T7015] netlink: 8 bytes leftover after parsing attributes in process `syz.0.203'. [ 189.933991][ T7035] netlink: 28 bytes leftover after parsing attributes in process `syz.2.205'. [ 190.003057][ T7038] netlink: 'syz.2.205': attribute type 19 has an invalid length. [ 190.017360][ T7038] netlink: 334 bytes leftover after parsing attributes in process `syz.2.205'. [ 190.272357][ T7035] macvtap0: entered promiscuous mode [ 190.280141][ T7035] macvtap0: entered allmulticast mode [ 190.295960][ T7035] veth0_macvtap: entered allmulticast mode [ 191.985983][ T7050] vivid-007: ================= START STATUS ================= [ 192.020607][ T7050] vivid-007: Generate PTS: true [ 192.041930][ T7050] vivid-007: Generate SCR: true [ 192.047883][ T7050] tpg source WxH: 320x240 (Y'CbCr) [ 192.059196][ T7050] tpg field: 1 [ 192.069329][ T7050] tpg crop: (0,0)/320x240 [ 192.078834][ T7050] tpg compose: (0,0)/320x240 [ 192.105919][ T7050] tpg colorspace: 8 [ 192.113960][ T7050] tpg transfer function: 0/0 [ 192.130318][ T7050] tpg Y'CbCr encoding: 0/0 [ 192.135883][ T7050] tpg quantization: 0/0 [ 192.145185][ T7050] tpg RGB range: 0/2 [ 192.165164][ T7050] vivid-007: ================== END STATUS ================== [ 193.015399][ T7064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.210'. [ 193.152102][ T7074] sg_write: data in/out 1047291210/23213 bytes for SCSI command 0x68-- guessing data in; [ 193.152102][ T7074] program syz.3.212 not setting count and/or reply_len properly [ 193.219328][ T7074] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 193.234846][ T7074] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 193.261116][ T7074] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 193.274931][ T7074] page_type: f5(slab) [ 193.284286][ T7074] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 193.309563][ T7074] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 193.329208][ T7074] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 193.360875][ T7074] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 193.390521][ T7074] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 193.413777][ T7074] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 193.432987][ T7074] page dumped because: unmovable page [ 193.456501][ T7074] page_owner tracks the page as allocated [ 193.474771][ T7074] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 193.515371][ T7074] post_alloc_hook+0xfd/0x120 [ 193.523394][ T7074] get_page_from_freelist+0xf48/0x3530 [ 193.535184][ T7074] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 193.546848][ T7074] new_slab+0xa2/0x650 [ 193.555833][ T7074] refill_objects+0xe3/0x410 [ 193.563698][ T7074] __pcs_replace_empty_main+0x376/0x680 [ 193.575188][ T7074] __kmalloc_cache_noprof+0x479/0x6c0 [ 193.591304][ T7074] uevent_show+0x166/0x3a0 [ 193.596220][ T7074] dev_attr_show+0x52/0xa0 [ 193.606399][ T7074] sysfs_kf_seq_show+0x217/0x3f0 [ 193.616529][ T7074] seq_read_iter+0x32f/0x1270 [ 193.628197][ T7074] kernfs_fop_read_iter+0x46c/0x610 [ 193.639788][ T7074] vfs_read+0x82e/0xb40 [ 193.648001][ T7074] ksys_read+0x12a/0x250 [ 193.657086][ T7074] do_syscall_64+0x115/0x840 [ 193.662957][ T7074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.669261][ T7074] page last free pid 4997 tgid 4997 stack trace: [ 193.675843][ T7074] __free_frozen_pages+0x79f/0x1090 [ 193.681350][ T7074] qlist_free_all+0x47/0xf0 [ 193.686122][ T7074] kasan_quarantine_reduce+0x1a0/0x1f0 [ 193.691851][ T7074] __kasan_slab_alloc+0x69/0x90 [ 193.697907][ T7074] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 193.704105][ T7074] __alloc_skb+0x140/0x710 [ 193.708620][ T7074] netlink_alloc_large_skb+0x69/0x150 [ 193.717465][ T7074] netlink_sendmsg+0x680/0xda0 [ 193.722314][ T7074] ____sys_sendmsg+0xa4d/0xbe0 [ 193.727316][ T7074] ___sys_sendmsg+0x190/0x1e0 [ 193.732179][ T7074] __sys_sendmsg+0x160/0x210 [ 193.736949][ T7074] do_syscall_64+0x115/0x840 [ 193.741730][ T7074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.211262][ T7089] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 194.241617][ T7089] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 194.272981][ T7089] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 194.283509][ T7089] page_type: f5(slab) [ 194.287943][ T7089] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 194.297403][ T7089] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 194.310692][ T7089] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 194.320912][ T7089] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 194.330382][ T7089] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 194.340040][ T7089] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 194.375955][ T7089] page dumped because: unmovable page [ 194.391791][ T7089] page_owner tracks the page as allocated [ 194.399943][ T7089] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 194.449133][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.454039][ T7089] post_alloc_hook+0xfd/0x120 [ 194.460668][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.467070][ T7089] get_page_from_freelist+0xf48/0x3530 [ 194.478422][ T7089] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 194.486070][ T7089] new_slab+0xa2/0x650 [ 194.493928][ T7089] refill_objects+0xe3/0x410 [ 194.508865][ T7089] __pcs_replace_empty_main+0x376/0x680 [ 194.529264][ T7089] __kmalloc_cache_noprof+0x479/0x6c0 [ 194.539384][ T7089] uevent_show+0x166/0x3a0 [ 194.549525][ T7089] dev_attr_show+0x52/0xa0 [ 194.556684][ T7089] sysfs_kf_seq_show+0x217/0x3f0 [ 194.563072][ T7089] seq_read_iter+0x32f/0x1270 [ 194.568523][ T7089] kernfs_fop_read_iter+0x46c/0x610 [ 194.574361][ T7089] vfs_read+0x82e/0xb40 [ 194.578871][ T7089] ksys_read+0x12a/0x250 [ 194.583323][ T7089] do_syscall_64+0x115/0x840 [ 194.588221][ T7089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.594608][ T7089] page last free pid 4997 tgid 4997 stack trace: [ 194.601166][ T7089] __free_frozen_pages+0x79f/0x1090 [ 194.606743][ T7089] qlist_free_all+0x47/0xf0 [ 194.611613][ T7089] kasan_quarantine_reduce+0x1a0/0x1f0 [ 194.621187][ T7089] __kasan_slab_alloc+0x69/0x90 [ 194.626415][ T7089] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 194.632594][ T7089] __alloc_skb+0x140/0x710 [ 194.637406][ T7089] netlink_alloc_large_skb+0x69/0x150 [ 194.643077][ T7089] netlink_sendmsg+0x680/0xda0 [ 194.648171][ T7089] ____sys_sendmsg+0xa4d/0xbe0 [ 194.653191][ T7089] ___sys_sendmsg+0x190/0x1e0 [ 194.658445][ T7089] __sys_sendmsg+0x160/0x210 [ 194.664519][ T7089] do_syscall_64+0x115/0x840 [ 194.669269][ T7089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 194.709126][ T7095] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 194.732243][ T7095] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 194.741081][ T7095] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 194.748836][ T7095] page_type: f5(slab) [ 194.762761][ T7095] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 194.772632][ T7084] netlink: 8 bytes leftover after parsing attributes in process `syz.3.213'. [ 194.777239][ T7095] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 194.811734][ T7095] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 194.845865][ T7095] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 194.875219][ T7095] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 194.891590][ T7095] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 194.910805][ T7095] page dumped because: unmovable page [ 194.924911][ T7095] page_owner tracks the page as allocated [ 194.937579][ T7095] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 194.982824][ T7095] post_alloc_hook+0xfd/0x120 [ 194.992427][ T7095] get_page_from_freelist+0xf48/0x3530 [ 195.004342][ T7095] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 195.010384][ T7095] new_slab+0xa2/0x650 [ 195.015087][ T7095] refill_objects+0xe3/0x410 [ 195.019820][ T7095] __pcs_replace_empty_main+0x376/0x680 [ 195.026620][ T7095] __kmalloc_cache_noprof+0x479/0x6c0 [ 195.032123][ T7095] uevent_show+0x166/0x3a0 [ 195.036940][ T7095] dev_attr_show+0x52/0xa0 [ 195.041505][ T7095] sysfs_kf_seq_show+0x217/0x3f0 [ 195.051738][ T7095] seq_read_iter+0x32f/0x1270 [ 195.063591][ T7095] kernfs_fop_read_iter+0x46c/0x610 [ 195.074064][ T7095] vfs_read+0x82e/0xb40 [ 195.084507][ T7095] ksys_read+0x12a/0x250 [ 195.092179][ T7095] do_syscall_64+0x115/0x840 [ 195.097775][ T7095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.104038][ T7095] page last free pid 4997 tgid 4997 stack trace: [ 195.110469][ T7095] __free_frozen_pages+0x79f/0x1090 [ 195.116078][ T7095] qlist_free_all+0x47/0xf0 [ 195.120709][ T7095] kasan_quarantine_reduce+0x1a0/0x1f0 [ 195.128123][ T7095] __kasan_slab_alloc+0x69/0x90 [ 195.133121][ T7095] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 195.139642][ T7095] __alloc_skb+0x140/0x710 [ 195.145035][ T7095] netlink_alloc_large_skb+0x69/0x150 [ 195.150570][ T7095] netlink_sendmsg+0x680/0xda0 [ 195.156077][ T7095] ____sys_sendmsg+0xa4d/0xbe0 [ 195.160990][ T7095] ___sys_sendmsg+0x190/0x1e0 [ 195.166416][ T7095] __sys_sendmsg+0x160/0x210 [ 195.171123][ T7095] do_syscall_64+0x115/0x840 [ 195.176115][ T7095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.886673][ T7116] netlink: 8 bytes leftover after parsing attributes in process `syz.2.217'. [ 196.484489][ T7122] netlink: 8 bytes leftover after parsing attributes in process `syz.3.219'. [ 198.760050][ T7144] bond0: option slaves: interface -Âô]àæ©=,Dço does not exist! [ 199.078207][ T7150] ubi0: attaching mtd0 [ 199.098870][ T7150] ubi0: scanning is finished [ 199.373612][ T7150] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 199.390966][ T7150] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 199.406401][ T7150] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 199.437094][ T7150] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 199.477302][ T7150] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 199.500176][ T7150] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 199.531108][ T7150] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1488380749 [ 199.558761][ T7150] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 199.596215][ T7146] ubi0: detaching mtd0 [ 199.600512][ T7161] ubi0: background thread "ubi_bgt0d" started, PID 7161 [ 199.629540][ T7146] ubi0: mtd0 is detached [ 200.051984][ T7169] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 200.082809][ T7169] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 200.115253][ T7169] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 200.147575][ T7169] page_type: f5(slab) [ 200.159106][ T7169] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 200.193043][ T7169] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 200.236523][ T7169] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 200.270900][ T7169] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 200.296819][ T7169] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 200.344722][ T7169] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 200.383713][ T7169] page dumped because: unmovable page [ 200.395794][ T7169] page_owner tracks the page as allocated [ 200.417337][ T7169] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 200.488160][ T7169] post_alloc_hook+0xfd/0x120 [ 200.505749][ T7169] get_page_from_freelist+0xf48/0x3530 [ 200.533683][ T7169] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 200.544051][ T7169] new_slab+0xa2/0x650 [ 200.554434][ T7169] refill_objects+0xe3/0x410 [ 200.564042][ T7169] __pcs_replace_empty_main+0x376/0x680 [ 200.576280][ T7169] __kmalloc_cache_noprof+0x479/0x6c0 [ 200.585379][ T7169] uevent_show+0x166/0x3a0 [ 200.592179][ T7169] dev_attr_show+0x52/0xa0 [ 200.602701][ T7169] sysfs_kf_seq_show+0x217/0x3f0 [ 200.614334][ T7169] seq_read_iter+0x32f/0x1270 [ 200.625629][ T7169] kernfs_fop_read_iter+0x46c/0x610 [ 200.644753][ T7169] vfs_read+0x82e/0xb40 [ 200.662502][ T7169] ksys_read+0x12a/0x250 [ 200.693652][ T7169] do_syscall_64+0x115/0x840 [ 200.708150][ T7169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.721738][ T7169] page last free pid 4997 tgid 4997 stack trace: [ 200.728467][ T7181] sg_write: data in/out 1047291210/23213 bytes for SCSI command 0x68-- guessing data in; [ 200.728467][ T7181] program syz.1.228 not setting count and/or reply_len properly [ 200.747438][ T7169] __free_frozen_pages+0x79f/0x1090 [ 200.752811][ T7169] qlist_free_all+0x47/0xf0 [ 200.759347][ T7169] kasan_quarantine_reduce+0x1a0/0x1f0 [ 200.767987][ T7169] __kasan_slab_alloc+0x69/0x90 [ 200.774280][ T7169] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 200.780449][ T7169] __alloc_skb+0x140/0x710 [ 200.785516][ T7169] netlink_alloc_large_skb+0x69/0x150 [ 200.791148][ T7169] netlink_sendmsg+0x680/0xda0 [ 200.796675][ T7169] ____sys_sendmsg+0xa4d/0xbe0 [ 200.801711][ T7169] ___sys_sendmsg+0x190/0x1e0 [ 200.809788][ T7169] __sys_sendmsg+0x160/0x210 [ 200.812783][ T7173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.226'. [ 200.818437][ T7169] do_syscall_64+0x115/0x840 [ 200.831266][ T7169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.854665][ T7179] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 200.873723][ T7179] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 200.899288][ T7179] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 200.925294][ T7179] page_type: f5(slab) [ 200.943217][ T7179] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 200.981972][ T7179] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 201.009897][ T7179] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 201.039966][ T7179] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 201.068297][ T7179] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 201.096188][ T7179] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 201.120661][ T7179] page dumped because: unmovable page [ 201.130795][ T7179] page_owner tracks the page as allocated [ 201.141505][ T7179] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 201.164992][ T7179] post_alloc_hook+0xfd/0x120 [ 201.176586][ T7179] get_page_from_freelist+0xf48/0x3530 [ 201.186712][ T7179] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 201.198987][ T7179] new_slab+0xa2/0x650 [ 201.206265][ T7179] refill_objects+0xe3/0x410 [ 201.211389][ T7179] __pcs_replace_empty_main+0x376/0x680 [ 201.220083][ T7179] __kmalloc_cache_noprof+0x479/0x6c0 [ 201.226096][ T7179] uevent_show+0x166/0x3a0 [ 201.231393][ T7179] dev_attr_show+0x52/0xa0 [ 201.237033][ T7179] sysfs_kf_seq_show+0x217/0x3f0 [ 201.242281][ T7179] seq_read_iter+0x32f/0x1270 [ 201.250175][ T7179] kernfs_fop_read_iter+0x46c/0x610 [ 201.264005][ T7179] vfs_read+0x82e/0xb40 [ 201.268820][ T7179] ksys_read+0x12a/0x250 [ 201.275114][ T7179] do_syscall_64+0x115/0x840 [ 201.279927][ T7179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.286468][ T7179] page last free pid 4997 tgid 4997 stack trace: [ 201.293321][ T7179] __free_frozen_pages+0x79f/0x1090 [ 201.299140][ T7179] qlist_free_all+0x47/0xf0 [ 201.309283][ T7179] kasan_quarantine_reduce+0x1a0/0x1f0 [ 201.323678][ T7179] __kasan_slab_alloc+0x69/0x90 [ 201.336786][ T7179] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 201.356247][ T7179] __alloc_skb+0x140/0x710 [ 201.375196][ T7179] netlink_alloc_large_skb+0x69/0x150 [ 201.393619][ T7179] netlink_sendmsg+0x680/0xda0 [ 201.405040][ T7179] ____sys_sendmsg+0xa4d/0xbe0 [ 201.423592][ T7179] ___sys_sendmsg+0x190/0x1e0 [ 201.429671][ T7179] __sys_sendmsg+0x160/0x210 [ 201.439904][ T7179] do_syscall_64+0x115/0x840 [ 201.448041][ T7179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.067437][ T7198] netlink: 8 bytes leftover after parsing attributes in process `syz.1.230'. [ 204.605616][ T7228] netlink: 8 bytes leftover after parsing attributes in process `syz.2.235'. [ 204.748019][ T7231] random: crng reseeded on system resumption [ 204.801957][ T7231] binder: 7229:7231 ioctl c018620c 200000000040 returned -22 [ 205.245297][ T7239] sg_write: data in/out 1047291210/23213 bytes for SCSI command 0x68-- guessing data in; [ 205.245297][ T7239] program syz.0.238 not setting count and/or reply_len properly [ 205.323787][ T7237] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 205.343186][ T7237] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 205.357602][ T7237] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 205.375506][ T7237] page_type: f5(slab) [ 205.389949][ T7237] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 205.410591][ T7237] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 205.433987][ T7237] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 205.508437][ T7237] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 205.555048][ T7237] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 205.582014][ T7237] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 205.597936][ T7237] page dumped because: unmovable page [ 205.615540][ T7237] page_owner tracks the page as allocated [ 205.633872][ T7237] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 205.685646][ T7237] post_alloc_hook+0xfd/0x120 [ 205.690865][ T7237] get_page_from_freelist+0xf48/0x3530 [ 205.704876][ T7237] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 205.713821][ T7237] new_slab+0xa2/0x650 [ 205.722200][ T7237] refill_objects+0xe3/0x410 [ 205.729046][ T7237] __pcs_replace_empty_main+0x376/0x680 [ 205.738540][ T7237] __kmalloc_cache_noprof+0x479/0x6c0 [ 205.746906][ T7237] uevent_show+0x166/0x3a0 [ 205.757219][ T7237] dev_attr_show+0x52/0xa0 [ 205.787579][ T7237] sysfs_kf_seq_show+0x217/0x3f0 [ 205.803831][ T7237] seq_read_iter+0x32f/0x1270 [ 205.820107][ T7237] kernfs_fop_read_iter+0x46c/0x610 [ 205.841965][ T7237] vfs_read+0x82e/0xb40 [ 205.859389][ T7237] ksys_read+0x12a/0x250 [ 205.877342][ T7237] do_syscall_64+0x115/0x840 [ 205.892755][ T7237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.909023][ T7237] page last free pid 4997 tgid 4997 stack trace: [ 205.933495][ T7237] __free_frozen_pages+0x79f/0x1090 [ 205.950623][ T7237] qlist_free_all+0x47/0xf0 [ 205.963715][ T7237] kasan_quarantine_reduce+0x1a0/0x1f0 [ 205.993467][ T7237] __kasan_slab_alloc+0x69/0x90 [ 206.006561][ T7237] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 206.033726][ T7237] __alloc_skb+0x140/0x710 [ 206.052096][ T7237] netlink_alloc_large_skb+0x69/0x150 [ 206.072822][ T7237] netlink_sendmsg+0x680/0xda0 [ 206.089119][ T7237] ____sys_sendmsg+0xa4d/0xbe0 [ 206.105370][ T7237] ___sys_sendmsg+0x190/0x1e0 [ 206.112940][ T7237] __sys_sendmsg+0x160/0x210 [ 206.125950][ T7237] do_syscall_64+0x115/0x840 [ 206.138607][ T7237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.099076][ T7262] futex_wake_op: syz.2.241 tries to shift op by -2048; fix this program [ 207.127033][ T7251] netlink: 8 bytes leftover after parsing attributes in process `syz.0.240'. [ 208.263318][ T30] audit: type=1800 audit(2147483651.430:3): pid=7265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.242" name="features" dev="configfs" ino=18827 res=0 errno=0 [ 208.564020][ T7235] random: crng reseeded on system resumption [ 209.926604][ T7293] sg_read: process 287 (syz.0.247) changed security contexts after opening file descriptor, this is not allowed. [ 210.046689][ T7293] net_ratelimit: 5 callbacks suppressed [ 210.046718][ T7293] openvswitch: netlink: Flow key attribute not present in set flow. [ 210.377228][ T7290] ubi0: attaching mtd0 [ 210.417151][ T7290] ubi0: scanning is finished [ 210.420277][ T7305] sg_write: data in/out 1047291210/23213 bytes for SCSI command 0x68-- guessing data in; [ 210.420277][ T7305] program syz.1.248 not setting count and/or reply_len properly [ 210.461821][ T7307] capability: warning: `syz.0.250' uses deprecated v2 capabilities in a way that may be insecure [ 210.507244][ T7298] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 210.537043][ T7298] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 210.617700][ T7298] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 210.665464][ T7298] page_type: f5(slab) [ 210.690235][ T7298] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 210.712036][ T7298] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 210.721502][ T7298] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 210.749336][ T7298] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 210.758702][ T7290] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 210.768133][ T7298] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 210.780987][ T7290] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 210.803265][ T7298] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 210.812722][ T7290] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 210.820243][ T7298] page dumped because: unmovable page [ 210.838686][ T7298] page_owner tracks the page as allocated [ 210.855261][ T7290] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 210.862926][ T7298] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 210.903373][ T7290] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 210.913790][ T7298] post_alloc_hook+0xfd/0x120 [ 210.931083][ T7290] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 210.934004][ T7298] get_page_from_freelist+0xf48/0x3530 [ 210.955502][ T7290] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1488380749 [ 210.964040][ T7298] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 210.988071][ T7298] new_slab+0xa2/0x650 [ 210.992885][ T7290] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 210.996842][ T7298] refill_objects+0xe3/0x410 [ 211.008957][ T7298] __pcs_replace_empty_main+0x376/0x680 [ 211.014668][ T7298] __kmalloc_cache_noprof+0x479/0x6c0 [ 211.020286][ T7298] uevent_show+0x166/0x3a0 [ 211.024891][ T7298] dev_attr_show+0x52/0xa0 [ 211.031870][ T7298] sysfs_kf_seq_show+0x217/0x3f0 [ 211.047552][ T7298] seq_read_iter+0x32f/0x1270 [ 211.052522][ T7298] kernfs_fop_read_iter+0x46c/0x610 [ 211.052901][ T7311] ubi0: background thread "ubi_bgt0d" started, PID 7311 [ 211.058447][ T7298] vfs_read+0x82e/0xb40 [ 211.070866][ T7296] ubi0: detaching mtd0 [ 211.086642][ T7298] ksys_read+0x12a/0x250 [ 211.091144][ T7298] do_syscall_64+0x115/0x840 [ 211.096840][ T7298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.103906][ T7298] page last free pid 4997 tgid 4997 stack trace: [ 211.110525][ T7298] __free_frozen_pages+0x79f/0x1090 [ 211.116479][ T7307] syz.0.250 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 211.142464][ T7296] ubi0: mtd0 is detached [ 211.153684][ T7298] qlist_free_all+0x47/0xf0 [ 211.162819][ T7298] kasan_quarantine_reduce+0x1a0/0x1f0 [ 211.175696][ T7298] __kasan_slab_alloc+0x69/0x90 [ 211.187214][ T7298] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 211.203725][ T7298] __alloc_skb+0x140/0x710 [ 211.220751][ T7298] netlink_alloc_large_skb+0x69/0x150 [ 211.244282][ T7298] netlink_sendmsg+0x680/0xda0 [ 211.283180][ T7298] ____sys_sendmsg+0xa4d/0xbe0 [ 211.303709][ T7298] ___sys_sendmsg+0x190/0x1e0 [ 211.312384][ T7298] __sys_sendmsg+0x160/0x210 [ 211.333767][ T7298] do_syscall_64+0x115/0x840 [ 211.362321][ T7298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.057085][ T7326] netlink: 8 bytes leftover after parsing attributes in process `syz.1.252'. [ 212.553727][ T30] audit: type=1800 audit(2147483655.720:4): pid=7335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.254" name="trace_pipe" dev="tracefs" ino=3777 res=0 errno=0 [ 213.172683][ T7344] netlink: 8 bytes leftover after parsing attributes in process `syz.2.255'. [ 215.436635][ T7371] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 215.472213][ T7371] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 215.517930][ T7371] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 215.543069][ T7371] page_type: f5(slab) [ 215.571888][ T7371] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 215.593709][ T7371] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 215.613198][ T7371] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 215.632550][ T7371] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 215.657407][ T7371] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 215.675515][ T7371] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 215.691778][ T7371] page dumped because: unmovable page [ 215.701923][ T7371] page_owner tracks the page as allocated [ 215.717134][ T7371] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 215.763371][ T7371] post_alloc_hook+0xfd/0x120 [ 215.778559][ T7371] get_page_from_freelist+0xf48/0x3530 [ 215.794607][ T7371] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 215.814678][ T7371] new_slab+0xa2/0x650 [ 215.826388][ T7371] refill_objects+0xe3/0x410 [ 215.840247][ T7371] __pcs_replace_empty_main+0x376/0x680 [ 215.861919][ T7371] __kmalloc_cache_noprof+0x479/0x6c0 [ 215.877019][ T7371] uevent_show+0x166/0x3a0 [ 215.886638][ T7371] dev_attr_show+0x52/0xa0 [ 215.900387][ T7371] sysfs_kf_seq_show+0x217/0x3f0 [ 215.916173][ T7371] seq_read_iter+0x32f/0x1270 [ 215.927752][ T7371] kernfs_fop_read_iter+0x46c/0x610 [ 215.940509][ T7371] vfs_read+0x82e/0xb40 [ 215.959326][ T7371] ksys_read+0x12a/0x250 [ 215.977001][ T7371] do_syscall_64+0x115/0x840 [ 215.993277][ T7371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.018880][ T7371] page last free pid 4997 tgid 4997 stack trace: [ 216.044285][ T7371] __free_frozen_pages+0x79f/0x1090 [ 216.081636][ T7371] qlist_free_all+0x47/0xf0 [ 216.099298][ T7371] kasan_quarantine_reduce+0x1a0/0x1f0 [ 216.132513][ T7371] __kasan_slab_alloc+0x69/0x90 [ 216.152884][ T7373] netlink: 8 bytes leftover after parsing attributes in process `syz.1.260'. [ 216.161990][ T7371] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 216.180430][ T7371] __alloc_skb+0x140/0x710 [ 216.200926][ T7371] netlink_alloc_large_skb+0x69/0x150 [ 216.229877][ T7371] netlink_sendmsg+0x680/0xda0 [ 216.248259][ T7371] ____sys_sendmsg+0xa4d/0xbe0 [ 216.269843][ T7371] ___sys_sendmsg+0x190/0x1e0 [ 216.282966][ T7371] __sys_sendmsg+0x160/0x210 [ 216.296427][ T7371] do_syscall_64+0x115/0x840 [ 216.306557][ T7371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.666824][ T7390] ACPI: \_SB_.LNKS: No IRQ available. Try pci=noacpi or acpi=off [ 216.748038][ T7390] pci 0000:00:01.3: PCI INT A: no GSI [ 217.116733][ T7396] netlink: 28 bytes leftover after parsing attributes in process `syz.3.263'. [ 218.146614][ T7418] netlink: 8 bytes leftover after parsing attributes in process `syz.3.267'. [ 218.189471][ T7405] netlink: 8 bytes leftover after parsing attributes in process `syz.0.265'. [ 218.919420][ T7425] netlink: 8 bytes leftover after parsing attributes in process `syz.1.268'. [ 220.362918][ T7444] netlink: 'syz.3.271': attribute type 1 has an invalid length. [ 220.510790][ T7444] syz.3.271 (7444): /proc/7442/oom_adj is deprecated, please use /proc/7442/oom_score_adj instead. [ 221.376302][ T7457] sg_write: data in/out 1047291210/23213 bytes for SCSI command 0x68-- guessing data in; [ 221.376302][ T7457] program syz.1.274 not setting count and/or reply_len properly [ 221.438037][ T7454] netlink: 8 bytes leftover after parsing attributes in process `syz.3.273'. [ 221.466688][ T7457] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 221.505070][ T7457] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 221.528435][ T7457] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 221.552294][ T7457] page_type: f5(slab) [ 221.572175][ T7457] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 221.596805][ T7457] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 221.616386][ T7457] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 221.637882][ T7457] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 221.660524][ T7457] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 221.683336][ T7457] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 221.705849][ T7457] page dumped because: unmovable page [ 221.720709][ T7457] page_owner tracks the page as allocated [ 221.738409][ T7457] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 221.809625][ T7457] post_alloc_hook+0xfd/0x120 [ 221.825614][ T7457] get_page_from_freelist+0xf48/0x3530 [ 221.837686][ T7457] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 221.849055][ T7457] new_slab+0xa2/0x650 [ 221.857192][ T7457] refill_objects+0xe3/0x410 [ 221.862949][ T7457] __pcs_replace_empty_main+0x376/0x680 [ 221.872311][ T7457] __kmalloc_cache_noprof+0x479/0x6c0 [ 221.922545][ T7457] uevent_show+0x166/0x3a0 [ 221.951691][ T7457] dev_attr_show+0x52/0xa0 [ 221.971834][ T7457] sysfs_kf_seq_show+0x217/0x3f0 [ 221.996338][ T7457] seq_read_iter+0x32f/0x1270 [ 222.016367][ T7457] kernfs_fop_read_iter+0x46c/0x610 [ 222.033235][ T7457] vfs_read+0x82e/0xb40 [ 222.048303][ T7457] ksys_read+0x12a/0x250 [ 222.072550][ T7457] do_syscall_64+0x115/0x840 [ 222.091670][ T7457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.104642][ T7457] page last free pid 4997 tgid 4997 stack trace: [ 222.125633][ T7457] __free_frozen_pages+0x79f/0x1090 [ 222.146461][ T7457] qlist_free_all+0x47/0xf0 [ 222.157382][ T7457] kasan_quarantine_reduce+0x1a0/0x1f0 [ 222.173723][ T7457] __kasan_slab_alloc+0x69/0x90 [ 222.188252][ T7457] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 222.207171][ T7457] __alloc_skb+0x140/0x710 [ 222.223102][ T7457] netlink_alloc_large_skb+0x69/0x150 [ 222.240398][ T7457] netlink_sendmsg+0x680/0xda0 [ 222.250582][ T7457] ____sys_sendmsg+0xa4d/0xbe0 [ 222.262581][ T7457] ___sys_sendmsg+0x190/0x1e0 [ 222.278726][ T7457] __sys_sendmsg+0x160/0x210 [ 222.290146][ T7457] do_syscall_64+0x115/0x840 [ 222.300240][ T7457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.553378][ T7463] smpboot: CPU 1 is now offline [ 222.980032][ T7476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.276'. [ 225.989080][ T7495] netlink: 8 bytes leftover after parsing attributes in process `syz.0.279'. [ 226.508375][ T7507] netlink: 8 bytes leftover after parsing attributes in process `syz.1.281'. [ 229.115357][ T7540] netlink: 8 bytes leftover after parsing attributes in process `syz.2.287'. [ 231.495432][ T7584] netlink: 8 bytes leftover after parsing attributes in process `syz.3.294'. [ 234.617016][ T7631] vivid-007: ================= START STATUS ================= [ 234.775042][ T5630] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 234.805095][ T7631] vivid-007: Enable Output Cropping: true [ 234.950954][ T7631] vivid-007: Enable Output Composing: true [ 235.044271][ T7631] vivid-007: Enable Output Scaler: true [ 235.138304][ T7631] vivid-007: Tx RGB Quantization Range: Automatic [ 235.257447][ T7631] vivid-007: Transmit Mode: HDMI [ 235.341479][ T7634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.301'. [ 235.352718][ T7631] vivid-007: Hotplug Present: 0x00000000 [ 235.488760][ T7631] vivid-007: RxSense Present: 0x00000000 [ 235.595312][ T7631] vivid-007: EDID Present: 0x00000000 [ 235.667202][ T7631] vivid-007: ================== END STATUS ================== [ 235.926344][ T7629] Process accounting resumed [ 236.153920][ T7635] syz.2.299(7635): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 236.611317][ T7658] netlink: 8 bytes leftover after parsing attributes in process `syz.0.303'. [ 236.835985][ T4941] Bluetooth: hci2: command 0x0c1a tx timeout [ 238.918454][ T5630] Bluetooth: hci2: command 0x0c1a tx timeout [ 239.284559][ T7675] netlink: 8 bytes leftover after parsing attributes in process `syz.2.306'. [ 239.559673][ T7684] ubi0: attaching mtd0 [ 239.586714][ T7684] ubi0: scanning is finished [ 239.790023][ T7684] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 239.872308][ T7684] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 239.927124][ T7684] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 239.983996][ T7684] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 240.060019][ T7684] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 240.127324][ T7684] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 240.196683][ T7684] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1488380749 [ 240.273770][ T7684] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 240.350535][ T7681] ubi0: detaching mtd0 [ 240.359571][ T7692] ubi0: background thread "ubi_bgt0d" started, PID 7692 [ 240.451704][ T7681] ubi0: mtd0 is detached [ 240.958760][ T7699] netlink: 8 bytes leftover after parsing attributes in process `syz.1.311'. [ 242.567986][ T7723] FAULT_INJECTION: forcing a failure. [ 242.567986][ T7723] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 242.693193][ T7721] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5634] was attempted by "ci-qemu-gce-upstream-auto/syz-executor exec"[7721] [ 242.752055][ T7723] CPU: 0 UID: 0 PID: 7723 Comm: syz.2.315 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.752093][ T7723] Tainted: [L]=SOFTLOCKUP [ 242.752101][ T7723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 242.752129][ T7723] Call Trace: [ 242.752137][ T7723] [ 242.752146][ T7723] dump_stack_lvl+0x100/0x190 [ 242.752179][ T7723] should_fail_ex.cold+0x5/0xa [ 242.752206][ T7723] ? prepare_alloc_pages+0x16d/0x5f0 [ 242.752243][ T7723] should_fail_alloc_page+0xeb/0x140 [ 242.752280][ T7723] prepare_alloc_pages+0x1f0/0x5f0 [ 242.752319][ T7723] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 242.752353][ T7723] ? rcu_is_watching+0x12/0xc0 [ 242.752382][ T7723] ? trace_mm_page_alloc+0x164/0x1c0 [ 242.752418][ T7723] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 242.752449][ T7723] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 242.752481][ T7723] ? stack_trace_save+0x8e/0xc0 [ 242.752514][ T7723] ? __pfx_stack_trace_save+0x10/0x10 [ 242.752555][ T7723] ? stack_depot_save_flags+0x27/0x9d0 [ 242.752590][ T7723] ? is_bpf_text_address+0x94/0x1a0 [ 242.752625][ T7723] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 242.752658][ T7723] ? __kasan_slab_alloc+0x89/0x90 [ 242.752689][ T7723] ? kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 242.752718][ T7723] ? alloc_vmap_area+0x640/0x2bb0 [ 242.752747][ T7723] ? __get_vm_area_node+0x1ca/0x330 [ 242.752779][ T7723] ? __vmalloc_node_range_noprof+0x228/0x1630 [ 242.752816][ T7723] ? __kvmalloc_node_noprof+0x3d3/0x970 [ 242.752844][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 242.752880][ T7723] ? do_syscall_64+0x115/0x840 [ 242.752922][ T7723] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.752970][ T7723] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 242.753005][ T7723] ? policy_nodemask+0xed/0x4f0 [ 242.753046][ T7723] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 242.753091][ T7723] __kasan_populate_vmalloc+0xf0/0x210 [ 242.753127][ T7723] alloc_vmap_area+0x95d/0x2bb0 [ 242.753168][ T7723] ? kasan_save_track+0x14/0x30 [ 242.753199][ T7723] ? __kasan_kmalloc+0xaa/0xb0 [ 242.753228][ T7723] ? __pfx_alloc_vmap_area+0x10/0x10 [ 242.753262][ T7723] ? preempt_schedule_thunk+0x16/0x40 [ 242.753287][ T7723] ? __get_vm_area_node+0x101/0x330 [ 242.753325][ T7723] __get_vm_area_node+0x1ca/0x330 [ 242.753368][ T7723] __vmalloc_node_range_noprof+0x228/0x1630 [ 242.753408][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 242.753446][ T7723] ? __pfx_try_to_wake_up+0x10/0x10 [ 242.753472][ T7723] ? futex_hash+0x311/0x400 [ 242.753496][ T7723] ? plist_check_list+0x1b8/0x280 [ 242.753531][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 242.753578][ T7723] ? alloc_pages_mpol+0x25a/0x540 [ 242.753617][ T7723] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 242.753663][ T7723] ? rcu_is_watching+0x12/0xc0 [ 242.753700][ T7723] __kvmalloc_node_noprof+0x3d3/0x970 [ 242.753731][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 242.753770][ T7723] ? _copy_from_user+0x59/0xd0 [ 242.753804][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 242.753847][ T7723] __do_sys_listmount+0x289/0xee0 [ 242.753885][ T7723] ? __pfx_do_futex+0x10/0x10 [ 242.753912][ T7723] ? __pfx_do_sendfile+0x10/0x10 [ 242.753951][ T7723] ? __fget_files+0x21f/0x3d0 [ 242.753973][ T7723] ? __pfx___do_sys_listmount+0x10/0x10 [ 242.754030][ T7723] do_syscall_64+0x115/0x840 [ 242.754051][ T7723] ? clear_bhb_loop+0x40/0x90 [ 242.754081][ T7723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.754105][ T7723] RIP: 0033:0x7f3149b9de59 [ 242.754127][ T7723] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.754150][ T7723] RSP: 002b:00007f314aaba028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ca [ 242.754173][ T7723] RAX: ffffffffffffffda RBX: 00007f3149e26090 RCX: 00007f3149b9de59 [ 242.754189][ T7723] RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000200000000080 [ 242.754205][ T7723] RBP: 00007f3149c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 242.754220][ T7723] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 242.754234][ T7723] R13: 00007f3149e26128 R14: 00007f3149e26090 R15: 00007ffeec19ab58 [ 242.754265][ T7723] [ 243.657794][ T4941] Bluetooth: hci2: unexpected event for opcode 0x7c89 [ 244.981432][ T7731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.316'. [ 245.830230][ T7723] syz.2.315: vmalloc error: size 8000000, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 245.922207][ T7723] CPU: 0 UID: 0 PID: 7723 Comm: syz.2.315 Tainted: G L syzkaller #0 PREEMPT(full) [ 245.922246][ T7723] Tainted: [L]=SOFTLOCKUP [ 245.922255][ T7723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 245.922270][ T7723] Call Trace: [ 245.922277][ T7723] [ 245.922286][ T7723] dump_stack_lvl+0x100/0x190 [ 245.922321][ T7723] warn_alloc.cold+0x94/0xa8 [ 245.922346][ T7723] ? __pfx_warn_alloc+0x10/0x10 [ 245.922374][ T7723] ? lockdep_hardirqs_on+0x78/0x100 [ 245.922416][ T7723] ? __get_vm_area_node+0x2cd/0x330 [ 245.922462][ T7723] ? __get_vm_area_node+0x208/0x330 [ 245.922503][ T7723] __vmalloc_node_range_noprof+0xccd/0x1630 [ 245.922542][ T7723] ? __pfx_try_to_wake_up+0x10/0x10 [ 245.922572][ T7723] ? plist_check_list+0x1b8/0x280 [ 245.922607][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 245.922649][ T7723] ? alloc_pages_mpol+0x25a/0x540 [ 245.922687][ T7723] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 245.922732][ T7723] ? rcu_is_watching+0x12/0xc0 [ 245.922768][ T7723] __kvmalloc_node_noprof+0x3d3/0x970 [ 245.922799][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 245.922838][ T7723] ? _copy_from_user+0x59/0xd0 [ 245.922872][ T7723] ? __do_sys_listmount+0x289/0xee0 [ 245.922915][ T7723] __do_sys_listmount+0x289/0xee0 [ 245.922953][ T7723] ? __pfx_do_futex+0x10/0x10 [ 245.922982][ T7723] ? __pfx_do_sendfile+0x10/0x10 [ 245.923020][ T7723] ? __fget_files+0x21f/0x3d0 [ 245.923043][ T7723] ? __pfx___do_sys_listmount+0x10/0x10 [ 245.923100][ T7723] do_syscall_64+0x115/0x840 [ 245.923121][ T7723] ? clear_bhb_loop+0x40/0x90 [ 245.923150][ T7723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.923175][ T7723] RIP: 0033:0x7f3149b9de59 [ 245.923204][ T7723] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.923227][ T7723] RSP: 002b:00007f314aaba028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ca [ 245.923251][ T7723] RAX: ffffffffffffffda RBX: 00007f3149e26090 RCX: 00007f3149b9de59 [ 245.923267][ T7723] RDX: 00000000000f4240 RSI: 0000000000000000 RDI: 0000200000000080 [ 245.923282][ T7723] RBP: 00007f3149c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 245.923297][ T7723] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 245.923311][ T7723] R13: 00007f3149e26128 R14: 00007f3149e26090 R15: 00007ffeec19ab58 [ 245.923341][ T7723] [ 246.403127][ T7723] Mem-Info: [ 246.410953][ T7723] active_anon:6866 inactive_anon:18 isolated_anon:0 [ 246.410953][ T7723] active_file:633 inactive_file:43888 isolated_file:0 [ 246.410953][ T7723] unevictable:2642 dirty:974 writeback:13 [ 246.410953][ T7723] slab_reclaimable:10851 slab_unreclaimable:92243 [ 246.410953][ T7723] mapped:30053 shmem:3246 pagetables:1157 [ 246.410953][ T7723] sec_pagetables:0 bounce:0 [ 246.410953][ T7723] kernel_misc_reclaimable:0 [ 246.410953][ T7723] free:1329301 free_pcp:19440 free_cma:0 [ 246.509967][ T7723] Node 0 active_anon:27440kB inactive_anon:68kB active_file:2532kB inactive_file:175304kB unevictable:9032kB isolated(anon):0kB isolated(file):0kB mapped:120260kB dirty:3812kB writeback:180kB shmem:11408kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:2048kB kernel_stack:11616kB pagetables:4484kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 246.560332][ T7723] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 246.598251][ T7723] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 246.668109][ T7723] lowmem_reserve[]: 0 2476 2477 2477 2477 [ 246.684487][ T7723] Node 0 DMA32 free:1389240kB boost:0kB min:34052kB low:42564kB high:51076kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30248kB inactive_anon:68kB active_file:2532kB inactive_file:175356kB unevictable:9032kB writepending:3836kB zspages:612kB present:3129332kB managed:2535508kB mlocked:7460kB bounce:0kB free_pcp:48852kB local_pcp:48852kB free_cma:0kB [ 246.767961][ T7723] lowmem_reserve[]: 0 0 1 1 1 [ 246.773277][ T7723] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1028kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 246.869059][ T7723] lowmem_reserve[]: 0 0 0 0 0 [ 246.887377][ T7723] Node 1 Normal free:3915368kB boost:0kB min:55832kB low:69788kB high:83744kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:23016kB local_pcp:23016kB free_cma:0kB [ 247.066459][ T7723] lowmem_reserve[]: 0 0 0 0 0 [ 247.091515][ T7723] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 247.149472][ T7746] netlink: 8 bytes leftover after parsing attributes in process `syz.3.318'. [ 247.188874][ T7723] Node 0 DMA32: 2748*4kB (UME) 1474*8kB (UM) 866*16kB (UM) 540*32kB (UM) 251*64kB (UME) 73*128kB (UME) 28*256kB (UME) 53*512kB (UME) 22*1024kB (M) 3*2048kB (ME) 306*4096kB (UM) = 1395680kB [ 247.292470][ T7723] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 247.387597][ T7723] Node 1 Normal: 32*4kB (UM) 27*8kB (UM) 33*16kB (UM) 32*32kB (UM) 34*64kB (UM) 27*128kB (UM) 15*256kB (UM) 13*512kB (UM) 10*1024kB (UM) 6*2048kB (UM) 946*4096kB (M) = 3915368kB [ 247.504545][ T7723] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 247.556428][ T7723] Node 0 hugepages_total=6 hugepages_free=4 hugepages_surp=4 hugepages_size=2048kB [ 247.622613][ T7723] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 247.632784][ T7751] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 247.673825][ T7751] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 247.682526][ T7723] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 247.738948][ T7723] 46397 total pagecache pages [ 247.746036][ T7751] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 247.778073][ T7723] 5 pages in swap cache [ 247.806728][ T7751] page_type: f5(slab) [ 247.816381][ T7723] Free swap = 124692kB [ 247.832663][ T7751] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 247.846912][ T7723] Total swap = 124996kB [ 247.876104][ T7723] 2097051 pages RAM [ 247.894194][ T7751] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 247.906392][ T7723] 0 pages HighMem/MovableOnly [ 247.937419][ T7723] 431302 pages reserved [ 247.950578][ T7751] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 247.968424][ T7723] 0 pages cma reserved [ 248.012435][ T7751] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 248.076756][ T7751] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 248.128746][ T7751] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 248.208543][ T7751] page dumped because: unmovable page [ 248.251316][ T7751] page_owner tracks the page as allocated [ 248.309799][ T7751] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 248.411721][ T7754] can: request_module (can-proto-5) failed. [ 248.436193][ T7751] post_alloc_hook+0xfd/0x120 [ 248.463148][ T7751] get_page_from_freelist+0xf48/0x3530 [ 248.484538][ T7751] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 248.502268][ T7751] new_slab+0xa2/0x650 [ 248.516308][ T7751] refill_objects+0xe3/0x410 [ 248.533457][ T7751] __pcs_replace_empty_main+0x376/0x680 [ 248.552258][ T7751] __kmalloc_cache_noprof+0x479/0x6c0 [ 248.559564][ T7751] uevent_show+0x166/0x3a0 [ 248.569241][ T7751] dev_attr_show+0x52/0xa0 [ 248.578096][ T7751] sysfs_kf_seq_show+0x217/0x3f0 [ 248.594666][ T7751] seq_read_iter+0x32f/0x1270 [ 248.603815][ T7751] kernfs_fop_read_iter+0x46c/0x610 [ 248.619828][ T7751] vfs_read+0x82e/0xb40 [ 248.624448][ T7751] ksys_read+0x12a/0x250 [ 248.632556][ T7751] do_syscall_64+0x115/0x840 [ 248.642480][ T7751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.657498][ T7751] page last free pid 4997 tgid 4997 stack trace: [ 248.678941][ T7751] __free_frozen_pages+0x79f/0x1090 [ 248.690562][ T7751] qlist_free_all+0x47/0xf0 [ 248.702533][ T7751] kasan_quarantine_reduce+0x1a0/0x1f0 [ 248.717561][ T7751] __kasan_slab_alloc+0x69/0x90 [ 248.726995][ T7751] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 248.743305][ T7751] __alloc_skb+0x140/0x710 [ 248.753451][ T7751] netlink_alloc_large_skb+0x69/0x150 [ 248.769993][ T7751] netlink_sendmsg+0x680/0xda0 [ 248.785199][ T7751] ____sys_sendmsg+0xa4d/0xbe0 [ 248.799623][ T7751] ___sys_sendmsg+0x190/0x1e0 [ 248.815301][ T7751] __sys_sendmsg+0x160/0x210 [ 248.831716][ T7751] do_syscall_64+0x115/0x840 [ 248.853184][ T7751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.355099][ T7769] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 249.417767][ T7769] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 249.490375][ T7769] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 249.523405][ T7769] page_type: f5(slab) [ 249.543388][ T7769] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 249.578999][ T7769] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 249.608440][ T7769] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 249.628406][ T7769] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 249.659742][ T7769] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 249.689957][ T7769] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 249.720701][ T7769] page dumped because: unmovable page [ 249.739337][ T7769] page_owner tracks the page as allocated [ 249.758782][ T7769] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 249.832906][ T7769] post_alloc_hook+0xfd/0x120 [ 249.848845][ T7769] get_page_from_freelist+0xf48/0x3530 [ 249.867883][ T7769] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 249.896581][ T7769] new_slab+0xa2/0x650 [ 249.911485][ T7769] refill_objects+0xe3/0x410 [ 249.926740][ T7769] __pcs_replace_empty_main+0x376/0x680 [ 249.938597][ T7769] __kmalloc_cache_noprof+0x479/0x6c0 [ 249.958552][ T7769] uevent_show+0x166/0x3a0 [ 249.975461][ T7769] dev_attr_show+0x52/0xa0 [ 250.002029][ T7769] sysfs_kf_seq_show+0x217/0x3f0 [ 250.020301][ T7769] seq_read_iter+0x32f/0x1270 [ 250.039377][ T7769] kernfs_fop_read_iter+0x46c/0x610 [ 250.053629][ T7769] vfs_read+0x82e/0xb40 [ 250.067725][ T7769] ksys_read+0x12a/0x250 [ 250.080083][ T7769] do_syscall_64+0x115/0x840 [ 250.090642][ T7769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 250.103714][ T7769] page last free pid 4997 tgid 4997 stack trace: [ 250.125192][ T7769] __free_frozen_pages+0x79f/0x1090 [ 250.144416][ T7769] qlist_free_all+0x47/0xf0 [ 250.159465][ T7769] kasan_quarantine_reduce+0x1a0/0x1f0 [ 250.188800][ T7769] __kasan_slab_alloc+0x69/0x90 [ 250.213703][ T7769] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 250.241569][ T7769] __alloc_skb+0x140/0x710 [ 250.264461][ T7769] netlink_alloc_large_skb+0x69/0x150 [ 250.286138][ T7769] netlink_sendmsg+0x680/0xda0 [ 250.297123][ T4941] Bluetooth: hci3: Malformed HCI Event: 0x22 [ 250.312769][ T7769] ____sys_sendmsg+0xa4d/0xbe0 [ 250.327957][ T7769] ___sys_sendmsg+0x190/0x1e0 [ 250.344425][ T7769] __sys_sendmsg+0x160/0x210 [ 250.361445][ T7769] do_syscall_64+0x115/0x840 [ 250.379138][ T7769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 251.015927][ T7781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.325'. [ 251.121312][ T7802] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 251.178801][ T7802] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 251.249547][ T7802] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 251.300955][ T7802] page_type: f5(slab) [ 251.334493][ T7802] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 251.399669][ T7802] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 251.461052][ T7802] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 251.520711][ T7802] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 251.567636][ T7802] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 251.618462][ T7802] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 251.667556][ T7802] page dumped because: unmovable page [ 251.688803][ T7802] page_owner tracks the page as allocated [ 251.720403][ T7802] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 251.821361][ T7802] post_alloc_hook+0xfd/0x120 [ 251.838017][ T7806] ubi0: attaching mtd0 [ 251.842239][ T7802] get_page_from_freelist+0xf48/0x3530 [ 251.856631][ T7802] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 251.866053][ T7806] ubi0: scanning is finished [ 251.875791][ T7802] new_slab+0xa2/0x650 [ 251.890184][ T7802] refill_objects+0xe3/0x410 [ 251.900307][ T7802] __pcs_replace_empty_main+0x376/0x680 [ 251.913072][ T7802] __kmalloc_cache_noprof+0x479/0x6c0 [ 251.927912][ T7802] uevent_show+0x166/0x3a0 [ 251.938041][ T7802] dev_attr_show+0x52/0xa0 [ 251.952326][ T7802] sysfs_kf_seq_show+0x217/0x3f0 [ 251.979793][ T7802] seq_read_iter+0x32f/0x1270 [ 251.995204][ T7802] kernfs_fop_read_iter+0x46c/0x610 [ 252.013785][ T7802] vfs_read+0x82e/0xb40 [ 252.030539][ T7802] ksys_read+0x12a/0x250 [ 252.046756][ T7802] do_syscall_64+0x115/0x840 [ 252.064675][ T7802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.078699][ T7802] page last free pid 4997 tgid 4997 stack trace: [ 252.093255][ T7802] __free_frozen_pages+0x79f/0x1090 [ 252.104975][ T7802] qlist_free_all+0x47/0xf0 [ 252.115380][ T7802] kasan_quarantine_reduce+0x1a0/0x1f0 [ 252.130755][ T7802] __kasan_slab_alloc+0x69/0x90 [ 252.147557][ T7802] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 252.164211][ T7802] __alloc_skb+0x140/0x710 [ 252.172237][ T7802] netlink_alloc_large_skb+0x69/0x150 [ 252.185026][ T7802] netlink_sendmsg+0x680/0xda0 [ 252.193487][ T7802] ____sys_sendmsg+0xa4d/0xbe0 [ 252.205372][ T7802] ___sys_sendmsg+0x190/0x1e0 [ 252.221655][ T7802] __sys_sendmsg+0x160/0x210 [ 252.240632][ T7802] do_syscall_64+0x115/0x840 [ 252.274698][ T7802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.506399][ T7806] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 252.570086][ T7806] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 252.624631][ T7806] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 252.682418][ T7806] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 252.745409][ T7806] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 252.799102][ T7806] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 252.837410][ T7826] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 252.872991][ T7806] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1488380749 [ 252.904747][ T7826] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 252.937266][ T7806] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 252.960300][ T7826] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 253.009626][ T7800] ubi0: detaching mtd0 [ 253.016535][ T7820] ubi0: background thread "ubi_bgt0d" started, PID 7820 [ 253.036305][ T7826] page_type: f5(slab) [ 253.063636][ T7826] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 253.089486][ T7800] ubi0: mtd0 is detached [ 253.122303][ T7826] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 253.192989][ T7826] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 253.247894][ T7826] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 253.323353][ T7826] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 253.403418][ T7826] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 253.470121][ T7826] page dumped because: unmovable page [ 253.509538][ T7826] page_owner tracks the page as allocated [ 253.541741][ T7826] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 253.657383][ T7826] post_alloc_hook+0xfd/0x120 [ 253.683061][ T7826] get_page_from_freelist+0xf48/0x3530 [ 253.715354][ T7826] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 253.748109][ T7826] new_slab+0xa2/0x650 [ 253.766749][ T7826] refill_objects+0xe3/0x410 [ 253.786297][ T7826] __pcs_replace_empty_main+0x376/0x680 [ 253.811381][ T7826] __kmalloc_cache_noprof+0x479/0x6c0 [ 253.837550][ T7826] uevent_show+0x166/0x3a0 [ 253.856715][ T7826] dev_attr_show+0x52/0xa0 [ 253.874389][ T7826] sysfs_kf_seq_show+0x217/0x3f0 [ 253.897620][ T7826] seq_read_iter+0x32f/0x1270 [ 253.918851][ T7826] kernfs_fop_read_iter+0x46c/0x610 [ 253.943242][ T7826] vfs_read+0x82e/0xb40 [ 253.964608][ T7826] ksys_read+0x12a/0x250 [ 253.984851][ T7826] do_syscall_64+0x115/0x840 [ 254.011733][ T7826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.047115][ T7826] page last free pid 4997 tgid 4997 stack trace: [ 254.073662][ T7826] __free_frozen_pages+0x79f/0x1090 [ 254.094909][ T7826] qlist_free_all+0x47/0xf0 [ 254.115876][ T7826] kasan_quarantine_reduce+0x1a0/0x1f0 [ 254.141542][ T7826] __kasan_slab_alloc+0x69/0x90 [ 254.169347][ T7826] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 254.202296][ T7826] __alloc_skb+0x140/0x710 [ 254.225248][ T7826] netlink_alloc_large_skb+0x69/0x150 [ 254.252160][ T7826] netlink_sendmsg+0x680/0xda0 [ 254.273845][ T7826] ____sys_sendmsg+0xa4d/0xbe0 [ 254.296559][ T7826] ___sys_sendmsg+0x190/0x1e0 [ 254.315351][ T7826] __sys_sendmsg+0x160/0x210 [ 254.336122][ T7826] do_syscall_64+0x115/0x840 [ 254.358338][ T7826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.173333][ T7848] netlink: 8 bytes leftover after parsing attributes in process `syz.3.339'. [ 255.191337][ T4941] Bluetooth: hci3: unexpected event 0x2c length: 1022 > 17 [ 255.653322][ T7868] binder: 7867:7868 ioctl c018620b 0 returned -14 [ 255.878270][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.890590][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.073829][ T7897] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 257.126920][ T7897] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 257.207540][ T7897] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 257.254855][ T7897] page_type: f5(slab) [ 257.277130][ T7897] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 257.325640][ T7897] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 257.366025][ T7897] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 257.406532][ T7897] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 257.456503][ T7897] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 257.503484][ T7897] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 257.547426][ T7897] page dumped because: unmovable page [ 257.577377][ T7897] page_owner tracks the page as allocated [ 257.602768][ T7897] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 257.690512][ T7897] post_alloc_hook+0xfd/0x120 [ 257.716624][ T7897] get_page_from_freelist+0xf48/0x3530 [ 257.757452][ T7897] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 257.784705][ T7897] new_slab+0xa2/0x650 [ 257.803027][ T7897] refill_objects+0xe3/0x410 [ 257.825120][ T7897] __pcs_replace_empty_main+0x376/0x680 [ 257.846670][ T7897] __kmalloc_cache_noprof+0x479/0x6c0 [ 257.871171][ T7897] uevent_show+0x166/0x3a0 [ 257.890423][ T7897] dev_attr_show+0x52/0xa0 [ 257.911693][ T7897] sysfs_kf_seq_show+0x217/0x3f0 [ 257.933296][ T7897] seq_read_iter+0x32f/0x1270 [ 257.952924][ T7897] kernfs_fop_read_iter+0x46c/0x610 [ 257.988471][ T7897] vfs_read+0x82e/0xb40 [ 258.017927][ T7897] ksys_read+0x12a/0x250 [ 258.042758][ T7897] do_syscall_64+0x115/0x840 [ 258.066003][ T7897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.096704][ T7897] page last free pid 4997 tgid 4997 stack trace: [ 258.130504][ T7897] __free_frozen_pages+0x79f/0x1090 [ 258.166555][ T7897] qlist_free_all+0x47/0xf0 [ 258.183935][ T7897] kasan_quarantine_reduce+0x1a0/0x1f0 [ 258.219747][ T7897] __kasan_slab_alloc+0x69/0x90 [ 258.241048][ T7897] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 258.269148][ T7897] __alloc_skb+0x140/0x710 [ 258.291595][ T7897] netlink_alloc_large_skb+0x69/0x150 [ 258.322008][ T7897] netlink_sendmsg+0x680/0xda0 [ 258.341680][ T7897] ____sys_sendmsg+0xa4d/0xbe0 [ 258.368230][ T7897] ___sys_sendmsg+0x190/0x1e0 [ 258.395046][ T7897] __sys_sendmsg+0x160/0x210 [ 258.423161][ T7897] do_syscall_64+0x115/0x840 [ 258.440684][ T7897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.538993][ T7912] netlink: 8 bytes leftover after parsing attributes in process `syz.1.360'. [ 260.860465][ T4941] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 261.102606][ T7972] netlink: 8 bytes leftover after parsing attributes in process `syz.1.382'. [ 262.114735][ T30] audit: type=1804 audit(2147483705.280:5): pid=8007 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.391" name="/newroot/sys/kernel/tracing/set_event" dev="tracefs" ino=37 res=1 errno=0 [ 262.917540][ T4941] Bluetooth: hci1: command 0x0c1a tx timeout [ 263.850872][ T8034] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 263.901843][ T8034] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 263.966999][ T8034] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 264.002642][ T8034] page_type: f5(slab) [ 264.021773][ T8034] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 264.078788][ T8034] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 264.119769][ T8034] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 264.160965][ T8034] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 264.200777][ T8034] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 264.237585][ T8034] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 264.288316][ T8034] page dumped because: unmovable page [ 264.309723][ T8034] page_owner tracks the page as allocated [ 264.335255][ T8034] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 264.430002][ T8034] post_alloc_hook+0xfd/0x120 [ 264.461578][ T8034] get_page_from_freelist+0xf48/0x3530 [ 264.487833][ T8034] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 264.529311][ T8034] new_slab+0xa2/0x650 [ 264.546935][ T8034] refill_objects+0xe3/0x410 [ 264.566642][ T8034] __pcs_replace_empty_main+0x376/0x680 [ 264.593970][ T8034] __kmalloc_cache_noprof+0x479/0x6c0 [ 264.625483][ T8034] uevent_show+0x166/0x3a0 [ 264.638829][ T8034] dev_attr_show+0x52/0xa0 [ 264.651843][ T8042] netlink: 8 bytes leftover after parsing attributes in process `syz.0.402'. [ 264.665347][ T8034] sysfs_kf_seq_show+0x217/0x3f0 [ 264.684998][ T8034] seq_read_iter+0x32f/0x1270 [ 264.700001][ T8034] kernfs_fop_read_iter+0x46c/0x610 [ 264.723241][ T8034] vfs_read+0x82e/0xb40 [ 264.742513][ T8034] ksys_read+0x12a/0x250 [ 264.761130][ T8034] do_syscall_64+0x115/0x840 [ 264.784643][ T8034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.812084][ T8034] page last free pid 4997 tgid 4997 stack trace: [ 264.842529][ T8034] __free_frozen_pages+0x79f/0x1090 [ 264.865471][ T8034] qlist_free_all+0x47/0xf0 [ 264.885667][ T8034] kasan_quarantine_reduce+0x1a0/0x1f0 [ 264.909466][ T8034] __kasan_slab_alloc+0x69/0x90 [ 264.932321][ T8034] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 264.960653][ T8034] __alloc_skb+0x140/0x710 [ 264.983715][ T8034] netlink_alloc_large_skb+0x69/0x150 [ 264.993713][ T5630] Bluetooth: hci1: command 0x0c1a tx timeout [ 265.017462][ T8034] netlink_sendmsg+0x680/0xda0 [ 265.038174][ T8034] ____sys_sendmsg+0xa4d/0xbe0 [ 265.061225][ T8034] ___sys_sendmsg+0x190/0x1e0 [ 265.084650][ T8034] __sys_sendmsg+0x160/0x210 [ 265.106257][ T8034] do_syscall_64+0x115/0x840 [ 265.125415][ T8034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.160397][ T8040] Process accounting paused [ 267.152067][ T8088] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 267.219094][ T8088] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 267.241972][ T8070] netlink: 8 bytes leftover after parsing attributes in process `syz.1.412'. [ 267.253851][ T8088] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 267.274748][ T8088] page_type: f5(slab) [ 267.293672][ T8088] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 267.337633][ T8088] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 267.374628][ T8088] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 267.417822][ T8088] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 267.460106][ T8088] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 267.506233][ T8088] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 267.541425][ T8088] page dumped because: unmovable page [ 267.568759][ T8088] page_owner tracks the page as allocated [ 267.591749][ T8088] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 267.677589][ T8088] post_alloc_hook+0xfd/0x120 [ 267.699107][ T8088] get_page_from_freelist+0xf48/0x3530 [ 267.740972][ T8088] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 267.765151][ T8088] new_slab+0xa2/0x650 [ 267.782040][ T8088] refill_objects+0xe3/0x410 [ 267.798447][ T8088] __pcs_replace_empty_main+0x376/0x680 [ 267.813682][ T8085] netlink: 8 bytes leftover after parsing attributes in process `syz.0.417'. [ 267.824355][ T8088] __kmalloc_cache_noprof+0x479/0x6c0 [ 267.845121][ T8088] uevent_show+0x166/0x3a0 [ 267.859966][ T8088] dev_attr_show+0x52/0xa0 [ 267.867834][ T8088] sysfs_kf_seq_show+0x217/0x3f0 [ 267.892368][ T8088] seq_read_iter+0x32f/0x1270 [ 267.920434][ T8088] kernfs_fop_read_iter+0x46c/0x610 [ 267.943420][ T8088] vfs_read+0x82e/0xb40 [ 267.963591][ T8088] ksys_read+0x12a/0x250 [ 267.982348][ T8088] do_syscall_64+0x115/0x840 [ 268.003204][ T8088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.029797][ T8088] page last free pid 4997 tgid 4997 stack trace: [ 268.060048][ T8088] __free_frozen_pages+0x79f/0x1090 [ 268.085116][ T8088] qlist_free_all+0x47/0xf0 [ 268.103611][ T8088] kasan_quarantine_reduce+0x1a0/0x1f0 [ 268.120881][ T8088] __kasan_slab_alloc+0x69/0x90 [ 268.139946][ T8088] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 268.169795][ T8088] __alloc_skb+0x140/0x710 [ 268.184769][ T8088] netlink_alloc_large_skb+0x69/0x150 [ 268.201979][ T8088] netlink_sendmsg+0x680/0xda0 [ 268.219203][ T8088] ____sys_sendmsg+0xa4d/0xbe0 [ 268.237313][ T8088] ___sys_sendmsg+0x190/0x1e0 [ 268.254406][ T8088] __sys_sendmsg+0x160/0x210 [ 268.272893][ T8088] do_syscall_64+0x115/0x840 [ 268.295701][ T8088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.939229][ T8109] netlink: 8 bytes leftover after parsing attributes in process `syz.2.422'. [ 268.958511][ T8112] aoe: invalid device specification [ 269.320373][ T8117] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 269.341231][ T8117] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 269.365083][ T8117] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 269.386619][ T8117] page_type: f5(slab) [ 269.402559][ T8117] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 269.432765][ T8117] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 269.460497][ T8117] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 269.495263][ T8117] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 269.540964][ T8117] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 269.584946][ T8117] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 269.610859][ T8117] page dumped because: unmovable page [ 269.635611][ T8117] page_owner tracks the page as allocated [ 269.653238][ T8117] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 269.730815][ T8117] post_alloc_hook+0xfd/0x120 [ 269.746117][ T8117] get_page_from_freelist+0xf48/0x3530 [ 269.763651][ T8117] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 269.790487][ T8117] new_slab+0xa2/0x650 [ 269.805853][ T8117] refill_objects+0xe3/0x410 [ 269.820891][ T8117] __pcs_replace_empty_main+0x376/0x680 [ 269.838763][ T8117] __kmalloc_cache_noprof+0x479/0x6c0 [ 269.857847][ T8117] uevent_show+0x166/0x3a0 [ 269.872395][ T8117] dev_attr_show+0x52/0xa0 [ 269.883326][ T8117] sysfs_kf_seq_show+0x217/0x3f0 [ 269.894218][ T8117] seq_read_iter+0x32f/0x1270 [ 269.906826][ T8117] kernfs_fop_read_iter+0x46c/0x610 [ 269.919000][ T8117] vfs_read+0x82e/0xb40 [ 269.928584][ T8117] ksys_read+0x12a/0x250 [ 269.938558][ T8117] do_syscall_64+0x115/0x840 [ 269.949795][ T8117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.962840][ T8117] page last free pid 4997 tgid 4997 stack trace: [ 269.976959][ T8117] __free_frozen_pages+0x79f/0x1090 [ 269.993218][ T8117] qlist_free_all+0x47/0xf0 [ 270.001131][ T8117] kasan_quarantine_reduce+0x1a0/0x1f0 [ 270.023613][ T8117] __kasan_slab_alloc+0x69/0x90 [ 270.032025][ T8117] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 270.049769][ T8117] __alloc_skb+0x140/0x710 [ 270.060520][ T8117] netlink_alloc_large_skb+0x69/0x150 [ 270.072384][ T8117] netlink_sendmsg+0x680/0xda0 [ 270.084920][ T8117] ____sys_sendmsg+0xa4d/0xbe0 [ 270.096487][ T8117] ___sys_sendmsg+0x190/0x1e0 [ 270.106585][ T8117] __sys_sendmsg+0x160/0x210 [ 270.118206][ T8117] do_syscall_64+0x115/0x840 [ 270.129790][ T8117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.002850][ T8137] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 271.058488][ T8137] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 271.126760][ T8137] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 271.169565][ T8137] page_type: f5(slab) [ 271.187220][ T8137] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 271.229167][ T8137] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 271.259874][ T8137] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 271.287783][ T8137] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 271.332023][ T8137] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 271.377403][ T8137] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 271.408316][ T8137] page dumped because: unmovable page [ 271.428960][ T8137] page_owner tracks the page as allocated [ 271.450036][ T8137] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 271.532614][ T8137] post_alloc_hook+0xfd/0x120 [ 271.554293][ T8137] get_page_from_freelist+0xf48/0x3530 [ 271.572613][ T8137] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 271.595749][ T8137] new_slab+0xa2/0x650 [ 271.609834][ T8137] refill_objects+0xe3/0x410 [ 271.626804][ T8137] __pcs_replace_empty_main+0x376/0x680 [ 271.647799][ T8137] __kmalloc_cache_noprof+0x479/0x6c0 [ 271.676469][ T8137] uevent_show+0x166/0x3a0 [ 271.696979][ T8137] dev_attr_show+0x52/0xa0 [ 271.712147][ T8137] sysfs_kf_seq_show+0x217/0x3f0 [ 271.731506][ T8137] seq_read_iter+0x32f/0x1270 [ 271.748717][ T8137] kernfs_fop_read_iter+0x46c/0x610 [ 271.764836][ T8137] vfs_read+0x82e/0xb40 [ 271.780934][ T8137] ksys_read+0x12a/0x250 [ 271.801821][ T8137] do_syscall_64+0x115/0x840 [ 271.819760][ T8137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.842015][ T8137] page last free pid 4997 tgid 4997 stack trace: [ 271.855254][ T8152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.435'. [ 271.869026][ T8137] __free_frozen_pages+0x79f/0x1090 [ 271.883581][ T8137] qlist_free_all+0x47/0xf0 [ 271.901201][ T8137] kasan_quarantine_reduce+0x1a0/0x1f0 [ 271.927033][ T8137] __kasan_slab_alloc+0x69/0x90 [ 271.945863][ T8137] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 271.977224][ T8137] __alloc_skb+0x140/0x710 [ 272.002168][ T8137] netlink_alloc_large_skb+0x69/0x150 [ 272.029409][ T8137] netlink_sendmsg+0x680/0xda0 [ 272.049741][ T8137] ____sys_sendmsg+0xa4d/0xbe0 [ 272.069646][ T8137] ___sys_sendmsg+0x190/0x1e0 [ 272.087412][ T8137] __sys_sendmsg+0x160/0x210 [ 272.102160][ T8137] do_syscall_64+0x115/0x840 [ 272.114472][ T8137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.155286][ T8159] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 272.182348][ T8159] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 272.219458][ T8159] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 272.266615][ T8159] page_type: f5(slab) [ 272.293021][ T8159] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 272.332798][ T8159] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 272.384970][ T8159] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 272.424280][ T8159] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 272.472497][ T8159] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 272.522006][ T8159] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 272.562987][ T8159] page dumped because: unmovable page [ 272.578974][ T8159] page_owner tracks the page as allocated [ 272.601130][ T8159] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 272.697084][ T8159] post_alloc_hook+0xfd/0x120 [ 272.716423][ T8159] get_page_from_freelist+0xf48/0x3530 [ 272.732482][ T8159] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 272.755544][ T8159] new_slab+0xa2/0x650 [ 272.769914][ T8159] refill_objects+0xe3/0x410 [ 272.783908][ T8159] __pcs_replace_empty_main+0x376/0x680 [ 272.806113][ T8159] __kmalloc_cache_noprof+0x479/0x6c0 [ 272.831045][ T8159] uevent_show+0x166/0x3a0 [ 272.859889][ T8159] dev_attr_show+0x52/0xa0 [ 272.880700][ T8159] sysfs_kf_seq_show+0x217/0x3f0 [ 272.896712][ T8159] seq_read_iter+0x32f/0x1270 [ 272.911210][ T8159] kernfs_fop_read_iter+0x46c/0x610 [ 272.931348][ T8159] vfs_read+0x82e/0xb40 [ 272.944800][ T8159] ksys_read+0x12a/0x250 [ 272.960187][ T8159] do_syscall_64+0x115/0x840 [ 272.975151][ T8159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.981437][ T8164] netlink: 8 bytes leftover after parsing attributes in process `syz.1.437'. [ 272.997717][ T8159] page last free pid 4997 tgid 4997 stack trace: [ 273.016204][ T8159] __free_frozen_pages+0x79f/0x1090 [ 273.037704][ T8159] qlist_free_all+0x47/0xf0 [ 273.056442][ T8159] kasan_quarantine_reduce+0x1a0/0x1f0 [ 273.072227][ T8159] __kasan_slab_alloc+0x69/0x90 [ 273.091150][ T8159] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 273.110000][ T8159] __alloc_skb+0x140/0x710 [ 273.124749][ T8159] netlink_alloc_large_skb+0x69/0x150 [ 273.144191][ T8159] netlink_sendmsg+0x680/0xda0 [ 273.163120][ T8159] ____sys_sendmsg+0xa4d/0xbe0 [ 273.181236][ T8159] ___sys_sendmsg+0x190/0x1e0 [ 273.195555][ T8159] __sys_sendmsg+0x160/0x210 [ 273.209491][ T8159] do_syscall_64+0x115/0x840 [ 273.229710][ T8159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.414256][ T8189] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 274.439373][ T8189] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 274.487649][ T8189] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 274.502818][ T8192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.443'. [ 274.526100][ T8189] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 275.032777][ T8207] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 275.089719][ T8207] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 275.137151][ T8207] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 275.178370][ T8207] page_type: f5(slab) [ 275.208449][ T8207] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 275.261143][ T8207] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 275.316162][ T8207] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 275.367583][ T8207] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 275.410229][ T8207] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 275.450460][ T8207] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 275.493149][ T8207] page dumped because: unmovable page [ 275.528730][ T8207] page_owner tracks the page as allocated [ 275.556770][ T8207] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 275.638338][ T8207] post_alloc_hook+0xfd/0x120 [ 275.653874][ T8207] get_page_from_freelist+0xf48/0x3530 [ 275.677633][ T8207] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 275.726584][ T8207] new_slab+0xa2/0x650 [ 275.742458][ T8207] refill_objects+0xe3/0x410 [ 275.760552][ T8207] __pcs_replace_empty_main+0x376/0x680 [ 275.787510][ T8207] __kmalloc_cache_noprof+0x479/0x6c0 [ 275.812580][ T8207] uevent_show+0x166/0x3a0 [ 275.845226][ T8207] dev_attr_show+0x52/0xa0 [ 275.865567][ T8207] sysfs_kf_seq_show+0x217/0x3f0 [ 275.895500][ T8207] seq_read_iter+0x32f/0x1270 [ 275.917752][ T8207] kernfs_fop_read_iter+0x46c/0x610 [ 275.936146][ T8207] vfs_read+0x82e/0xb40 [ 275.951159][ T8207] ksys_read+0x12a/0x250 [ 275.976158][ T8207] do_syscall_64+0x115/0x840 [ 275.991909][ T8207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.005020][ T8207] page last free pid 4997 tgid 4997 stack trace: [ 276.025376][ T8207] __free_frozen_pages+0x79f/0x1090 [ 276.033324][ T8207] qlist_free_all+0x47/0xf0 [ 276.052018][ T8207] kasan_quarantine_reduce+0x1a0/0x1f0 [ 276.063792][ T8207] __kasan_slab_alloc+0x69/0x90 [ 276.076033][ T8207] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 276.092403][ T8207] __alloc_skb+0x140/0x710 [ 276.098891][ T8207] netlink_alloc_large_skb+0x69/0x150 [ 276.111930][ T8207] netlink_sendmsg+0x680/0xda0 [ 276.117037][ T4941] Bluetooth: hci0: command 0x0c1a tx timeout [ 276.129803][ T8207] ____sys_sendmsg+0xa4d/0xbe0 [ 276.142346][ T8207] ___sys_sendmsg+0x190/0x1e0 [ 276.153154][ T8207] __sys_sendmsg+0x160/0x210 [ 276.164219][ T8207] do_syscall_64+0x115/0x840 [ 276.174170][ T8207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.237101][ T8222] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 276.290744][ T8222] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 276.332805][ T8222] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 276.384121][ T8222] page_type: f5(slab) [ 276.410391][ T8222] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 276.458173][ T8222] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 276.516315][ T4941] Bluetooth: hci3: command 0x0c1a tx timeout [ 276.522473][ T5630] Bluetooth: hci1: command 0x0c1a tx timeout [ 276.529920][ T8222] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 276.582145][ T8222] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 276.597243][ T4941] Bluetooth: hci2: command 0x0c1a tx timeout [ 276.651456][ T8222] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 276.726210][ T8222] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 276.778758][ T8222] page dumped because: unmovable page [ 276.807042][ T8222] page_owner tracks the page as allocated [ 276.827303][ T8222] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 276.888030][ T8222] post_alloc_hook+0xfd/0x120 [ 276.903081][ T8222] get_page_from_freelist+0xf48/0x3530 [ 276.932193][ T8222] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 276.948519][ T8222] new_slab+0xa2/0x650 [ 276.960100][ T8222] refill_objects+0xe3/0x410 [ 276.974330][ T8222] __pcs_replace_empty_main+0x376/0x680 [ 276.988092][ T8222] __kmalloc_cache_noprof+0x479/0x6c0 [ 277.001583][ T8222] uevent_show+0x166/0x3a0 [ 277.011673][ T8222] dev_attr_show+0x52/0xa0 [ 277.030810][ T8222] sysfs_kf_seq_show+0x217/0x3f0 [ 277.041180][ T8231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.451'. [ 277.054724][ T8222] seq_read_iter+0x32f/0x1270 [ 277.066971][ T8222] kernfs_fop_read_iter+0x46c/0x610 [ 277.090684][ T8222] vfs_read+0x82e/0xb40 [ 277.106055][ T8222] ksys_read+0x12a/0x250 [ 277.120284][ T8222] do_syscall_64+0x115/0x840 [ 277.136876][ T8222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.158082][ T8222] page last free pid 4997 tgid 4997 stack trace: [ 277.179704][ T8222] __free_frozen_pages+0x79f/0x1090 [ 277.197854][ T8222] qlist_free_all+0x47/0xf0 [ 277.211639][ T8222] kasan_quarantine_reduce+0x1a0/0x1f0 [ 277.228677][ T8222] __kasan_slab_alloc+0x69/0x90 [ 277.246051][ T8222] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 277.270970][ T8222] __alloc_skb+0x140/0x710 [ 277.285085][ T8222] netlink_alloc_large_skb+0x69/0x150 [ 277.302200][ T8222] netlink_sendmsg+0x680/0xda0 [ 277.318634][ T8222] ____sys_sendmsg+0xa4d/0xbe0 [ 277.331304][ T8222] ___sys_sendmsg+0x190/0x1e0 [ 277.339505][ T8222] __sys_sendmsg+0x160/0x210 [ 277.346998][ T8222] do_syscall_64+0x115/0x840 [ 277.351758][ T8222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.942857][ T8243] netlink: 8 bytes leftover after parsing attributes in process `syz.2.454'. [ 279.049145][ T8255] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 279.093068][ T8255] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 279.127190][ T8255] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 279.157914][ T8255] page_type: f5(slab) [ 279.170861][ T8255] raw: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 279.201152][ T8255] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 279.229470][ T8255] head: 00fff00000000040 ffff88813fe45140 dead000000000100 dead000000000122 [ 279.258797][ T8255] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 279.286576][ T8255] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 279.326808][ T8255] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 279.367030][ T8255] page dumped because: unmovable page [ 279.391427][ T8255] page_owner tracks the page as allocated [ 279.424001][ T8255] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (udevd), ts 58320867398, free_ts 58298886347 [ 279.517372][ T8255] post_alloc_hook+0xfd/0x120 [ 279.543089][ T8255] get_page_from_freelist+0xf48/0x3530 [ 279.572933][ T8255] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 279.609770][ T8255] new_slab+0xa2/0x650 [ 279.643108][ T8255] refill_objects+0xe3/0x410 [ 279.668978][ T8255] __pcs_replace_empty_main+0x376/0x680 [ 279.679238][ T4941] Bluetooth: hci3: Unable to find connection for big 0xe0 [ 279.711075][ T8255] __kmalloc_cache_noprof+0x479/0x6c0 [ 279.756692][ T8255] uevent_show+0x166/0x3a0 [ 279.785379][ T8255] dev_attr_show+0x52/0xa0 [ 279.813725][ T8255] sysfs_kf_seq_show+0x217/0x3f0 [ 279.846278][ T8255] seq_read_iter+0x32f/0x1270 [ 279.877559][ T8255] kernfs_fop_read_iter+0x46c/0x610 [ 279.914478][ T8255] vfs_read+0x82e/0xb40 [ 279.938377][ T8255] ksys_read+0x12a/0x250 [ 279.962393][ T8255] do_syscall_64+0x115/0x840 [ 279.985223][ T8255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.013184][ T8255] page last free pid 4997 tgid 4997 stack trace: [ 280.053234][ T8255] __free_frozen_pages+0x79f/0x1090 [ 280.078428][ T8255] qlist_free_all+0x47/0xf0 [ 280.099473][ T8255] kasan_quarantine_reduce+0x1a0/0x1f0 [ 280.141332][ T8255] __kasan_slab_alloc+0x69/0x90 [ 280.162824][ T8255] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 280.189854][ T8255] __alloc_skb+0x140/0x710 [ 280.212479][ T8255] netlink_alloc_large_skb+0x69/0x150 [ 280.236124][ T8255] netlink_sendmsg+0x680/0xda0 [ 280.250534][ T8255] ____sys_sendmsg+0xa4d/0xbe0 [ 280.267744][ T8255] ___sys_sendmsg+0x190/0x1e0 [ 280.280892][ T8255] __sys_sendmsg+0x160/0x210 [ 280.298410][ T8255] do_syscall_64+0x115/0x840 [ 280.314654][ T8255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.199664][ T8281] netlink: 8 bytes leftover after parsing attributes in process `syz.0.470'. [ 284.107434][ T8330] ================================================================== [ 284.107460][ T8330] BUG: KASAN: vmalloc-out-of-bounds in sys_fillrect+0x174a/0x1910 [ 284.107497][ T8330] Write of size 8 at addr ffffc90004a49000 by task syz.0.476/8330 [ 284.107517][ T8330] [ 284.107532][ T8330] CPU: 0 UID: 0 PID: 8330 Comm: syz.0.476 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.107578][ T8330] Tainted: [L]=SOFTLOCKUP [ 284.107589][ T8330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 284.107605][ T8330] Call Trace: [ 284.107613][ T8330] [ 284.107622][ T8330] dump_stack_lvl+0x100/0x190 [ 284.107651][ T8330] print_report+0x13d/0x4b0 [ 284.107688][ T8330] ? _raw_spin_lock_irqsave+0x52/0x60 [ 284.107726][ T8330] ? sys_fillrect+0x174a/0x1910 [ 284.107755][ T8330] kasan_report+0xdf/0x1c0 [ 284.107789][ T8330] ? sys_fillrect+0x174a/0x1910 [ 284.107822][ T8330] sys_fillrect+0x174a/0x1910 [ 284.107857][ T8330] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 284.107899][ T8330] bit_clear+0x17d/0x220 [ 284.107922][ T8330] ? __pfx_bit_clear+0x10/0x10 [ 284.107945][ T8330] ? fb_get_color_depth+0x120/0x250 [ 284.107981][ T8330] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 284.108021][ T8330] __fbcon_clear+0x633/0x760 [ 284.108058][ T8330] ? __pfx_bit_clear+0x10/0x10 [ 284.108086][ T8330] fbcon_scroll+0x48b/0x650 [ 284.108130][ T8330] con_scroll+0x464/0x690 [ 284.108162][ T8330] csi_ECMA.constprop.0+0x1238/0x3b60 [ 284.108196][ T8330] ? find_held_lock+0x2b/0x80 [ 284.108227][ T8330] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 284.108265][ T8330] do_con_write+0x3660/0x4a30 [ 284.108305][ T8330] ? __pfx_do_con_write+0x10/0x10 [ 284.108345][ T8330] con_write+0x23/0xb0 [ 284.108375][ T8330] n_tty_write+0x431/0x1160 [ 284.108418][ T8330] ? __pfx_n_tty_write+0x10/0x10 [ 284.108454][ T8330] ? __kasan_kmalloc+0xaa/0xb0 [ 284.108484][ T8330] ? __pfx_woken_wake_function+0x10/0x10 [ 284.108511][ T8330] ? rcu_is_watching+0x12/0xc0 [ 284.108541][ T8330] ? file_tty_write.isra.0+0x694/0x890 [ 284.108571][ T8330] ? kfree+0x1e5/0x6c0 [ 284.108592][ T8330] ? __pfx_n_tty_write+0x10/0x10 [ 284.108630][ T8330] file_tty_write.isra.0+0x4d2/0x890 [ 284.108665][ T8330] redirected_tty_write+0xd4/0x120 [ 284.108696][ T8330] vfs_write+0x6ac/0x1050 [ 284.108718][ T8330] ? __pfx_redirected_tty_write+0x10/0x10 [ 284.108751][ T8330] ? __pfx_vfs_write+0x10/0x10 [ 284.108772][ T8330] ? find_held_lock+0x2b/0x80 [ 284.108811][ T8330] ksys_write+0x12a/0x250 [ 284.108832][ T8330] ? __pfx_ksys_write+0x10/0x10 [ 284.108859][ T8330] do_syscall_64+0x115/0x840 [ 284.108880][ T8330] ? clear_bhb_loop+0x40/0x90 [ 284.108907][ T8330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.108932][ T8330] RIP: 0033:0x7f9e8779de59 [ 284.108950][ T8330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.108975][ T8330] RSP: 002b:00007f9e88602028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 284.108998][ T8330] RAX: ffffffffffffffda RBX: 00007f9e87a25fa0 RCX: 00007f9e8779de59 [ 284.109015][ T8330] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000003 [ 284.109029][ T8330] RBP: 00007f9e87833e6f R08: 0000000000000000 R09: 0000000000000000 [ 284.109053][ T8330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 284.109068][ T8330] R13: 00007f9e87a26038 R14: 00007f9e87a25fa0 R15: 00007ffe27eb9378 [ 284.109093][ T8330] [ 284.109101][ T8330] [ 284.109108][ T8330] The buggy address belongs to a vmalloc virtual mapping [ 284.109130][ T8330] Memory state around the buggy address: [ 284.109143][ T8330] ffffc90004a48f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 284.109160][ T8330] ffffc90004a48f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 284.109177][ T8330] >ffffc90004a49000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 284.109191][ T8330] ^ [ 284.109203][ T8330] ffffc90004a49080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 284.109220][ T8330] ffffc90004a49100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 284.109233][ T8330] ================================================================== [ 284.128769][ T8330] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 284.128793][ T8330] CPU: 0 UID: 0 PID: 8330 Comm: syz.0.476 Tainted: G L syzkaller #0 PREEMPT(full) [ 284.128829][ T8330] Tainted: [L]=SOFTLOCKUP [ 284.128837][ T8330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 284.128853][ T8330] Call Trace: [ 284.128860][ T8330] [ 284.128872][ T8330] dump_stack_lvl+0x100/0x190 [ 284.128905][ T8330] vpanic+0x552/0x970 [ 284.128927][ T8330] ? __pfx_vpanic+0x10/0x10 [ 284.128951][ T8330] ? mark_held_locks+0x40/0x70 [ 284.128993][ T8330] ? sys_fillrect+0x174a/0x1910 [ 284.129022][ T8330] panic+0xd1/0xe0 [ 284.129044][ T8330] ? __pfx_panic+0x10/0x10 [ 284.129068][ T8330] ? sys_fillrect+0x174a/0x1910 [ 284.129097][ T8330] ? preempt_schedule_common+0x42/0xc0 [ 284.129145][ T8330] check_panic_on_warn.cold+0x19/0x34 [ 284.129172][ T8330] end_report.part.0+0x3a/0x90 [ 284.129207][ T8330] kasan_report.cold+0xe/0x18 [ 284.129244][ T8330] ? sys_fillrect+0x174a/0x1910 [ 284.129278][ T8330] sys_fillrect+0x174a/0x1910 [ 284.129314][ T8330] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 284.129356][ T8330] bit_clear+0x17d/0x220 [ 284.129379][ T8330] ? __pfx_bit_clear+0x10/0x10 [ 284.129403][ T8330] ? fb_get_color_depth+0x120/0x250 [ 284.129440][ T8330] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 284.129480][ T8330] __fbcon_clear+0x633/0x760 [ 284.129518][ T8330] ? __pfx_bit_clear+0x10/0x10 [ 284.129543][ T8330] fbcon_scroll+0x48b/0x650 [ 284.129581][ T8330] con_scroll+0x464/0x690 [ 284.129613][ T8330] csi_ECMA.constprop.0+0x1238/0x3b60 [ 284.129672][ T8330] ? find_held_lock+0x2b/0x80 [ 284.129703][ T8330] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 284.129741][ T8330] do_con_write+0x3660/0x4a30 [ 284.129782][ T8330] ? __pfx_do_con_write+0x10/0x10 [ 284.129822][ T8330] con_write+0x23/0xb0 [ 284.129853][ T8330] n_tty_write+0x431/0x1160 [ 284.129896][ T8330] ? __pfx_n_tty_write+0x10/0x10 [ 284.129933][ T8330] ? __kasan_kmalloc+0xaa/0xb0 [ 284.129964][ T8330] ? __pfx_woken_wake_function+0x10/0x10 [ 284.129991][ T8330] ? rcu_is_watching+0x12/0xc0 [ 284.130020][ T8330] ? file_tty_write.isra.0+0x694/0x890 [ 284.130051][ T8330] ? kfree+0x1e5/0x6c0 [ 284.130073][ T8330] ? __pfx_n_tty_write+0x10/0x10 [ 284.130111][ T8330] file_tty_write.isra.0+0x4d2/0x890 [ 284.130152][ T8330] redirected_tty_write+0xd4/0x120 [ 284.130183][ T8330] vfs_write+0x6ac/0x1050 [ 284.130206][ T8330] ? __pfx_redirected_tty_write+0x10/0x10 [ 284.130239][ T8330] ? __pfx_vfs_write+0x10/0x10 [ 284.130261][ T8330] ? find_held_lock+0x2b/0x80 [ 284.130301][ T8330] ksys_write+0x12a/0x250 [ 284.130323][ T8330] ? __pfx_ksys_write+0x10/0x10 [ 284.130350][ T8330] do_syscall_64+0x115/0x840 [ 284.130371][ T8330] ? clear_bhb_loop+0x40/0x90 [ 284.130399][ T8330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.130424][ T8330] RIP: 0033:0x7f9e8779de59 [ 284.130444][ T8330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.130468][ T8330] RSP: 002b:00007f9e88602028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 284.130492][ T8330] RAX: ffffffffffffffda RBX: 00007f9e87a25fa0 RCX: 00007f9e8779de59 [ 284.130509][ T8330] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000003 [ 284.130524][ T8330] RBP: 00007f9e87833e6f R08: 0000000000000000 R09: 0000000000000000 [ 284.130540][ T8330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 284.130556][ T8330] R13: 00007f9e87a26038 R14: 00007f9e87a25fa0 R15: 00007ffe27eb9378 [ 284.130581][ T8330] [ 284.130666][ T8330] Kernel Offset: disabled