last executing test programs: 11.978998634s ago: executing program 2 (id=4790): openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x4, 0x7) io_uring_register$auto(0xffffffffffffffff, 0x15, 0x0, 0x2) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D2\x00', 0x200000, 0x0) socket(0x10, 0x2, 0x0) pipe$auto(&(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_vcs_fops_vc_screen(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x101041, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$auto_IPVS_CMD_GET_SERVICE(r0, &(0x7f00000000c0)={0x0, 0x700, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r1, 0x1, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x2004400d}, 0x20048804) r2 = socket(0x2, 0x801, 0x100) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYRESDEC, @ANYBLOB="5e969daa66bae42346e8519f03bd3c998534e0ff61dce2c34fba89ce6815386cf1e0ac2c986de6a5536faeebe1d1bb50d3df3acc0176e5c7abc5df14a979ff74844db05433f2c4e1153ff367043e3db8cb2ad8b8ae83cce052b9eef23bfe103fe95872910818189af365b727c646c5cc39a5565b977a8b97dc73b52a338304a2", @ANYRES16], 0x18}}, 0x4000050) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r2, &(0x7f0000000b80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000840)={0x2f8, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@THERMAL_GENL_ATTR_TZ_TRIP_ID={0x8, 0x5, 0x5}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV_NAME={0x14, 0x12, 'macsec0\x00'}, @THERMAL_GENL_ATTR_CDEV={0x28d, 0xe, 0x0, 0x1, [@nested={0x183, 0x3d, 0x0, 0x1, [@nested={0x4, 0xbf}, @nested={0x4, 0x13e}, @generic="726367aae5fd54f85e55d1e11b9e2165df9e7f17f811857d70b72ebded492f539f0388a5ddd4d56e8bd2936d37486f30476d6c5741817fbca4eecab19a6a716f21a97bfee28e25779acd46434fbc35764f3b01e84aa7b004dcd48db90a28ea47c9cc0395374578a6a05188793697f7db58ef360b6c1e23d91818e2b07725a3bb4e9ec26e385775df33c050ba54b77b6d3e101bea00c5ffb41927358fc1342a06b2494ff2ba39aca9efbe87275c8267a975af", @typed={0x4, 0xf3}, @typed={0x8, 0xd6, 0x0, 0x0, @u32=0xec16}, @nested={0x4, 0x130}, @generic="d785c6d1df0bfe6464e0083247a581d12a806da004f6863c86390db1a6abdc418a6011a6d68342de7939df14172acd1760be1bb9f06c399d8535fb365495e90dd3da3db0509b9bc1a41ed08d26efc9e8ea2a2d919cdd6076025efae532e5f1e89c82b0594706da3f979c010baf215c078661da4968bf969837da1fa7eb3958931c3e870d6ef3d6105438c3a3ef795d3b6d504b2570ccad948279504bc4a0ae54a53a81ed92a73aec340a3b3801918321ad", @nested={0x4, 0x94}]}, @typed={0xbe, 0xe, 0x0, 0x0, @binary="f819c6005d9ee713b6e9fee7b777c933ebaa6eeb20d69b12dcab1745d36c2228946505c272b2f2fcba6acbd79e4e825bc40d7084344cc228bef818531c776fab93f9d62c374b9db004bced08caeb955d1d4a971bf504227f109c4dc5e175675a657facc346f9b5bb81cbee7866b74747de9e41b55824129d4bee9391549a9a619266bd06f8b8157a29b7c8de39f49ca63142271f5c58133d5f0e197cae9442524649428714e06e508cb1fa04abf0ac755565db32bb6407e0fc77"}, @generic="fbb8232aaf58c16980c34fccc63fe4b95db93cdedbefe6a78c45206bf994043388fc18a90edd863a1b90b7fbbc7bb2ed6df9902fa4b329c44e1b380bb0b094737620f6cb55"]}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0x3}, @THERMAL_GENL_ATTR_TZ_MODE={0x8, 0x9, 0x9}, @THERMAL_GENL_ATTR_TZ_TRIP_HYST={0x8, 0x8, 0x4}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_ID={0x8, 0x15, 0x7}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0xfffffff9}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_EFFICIENCY={0x8, 0x17, 0x7fff}]}, 0x2f8}, 0x1, 0x0, 0x0, 0x8880}, 0x40800) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 11.6419196s ago: executing program 0 (id=4791): r0 = openat$auto_ep0_operations_inode(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) write$auto(r0, &(0x7f0000000180)='k:\x1f\x8eF!D?B@\xa3\x86L\xd3=\x8e\xf9=y\xd7\tHB\xa9ngn\xa8\x86\xfcA.\xc4\x04\xd3\xe5J\xf9\xfasE\x85\xc3\x01\x11e\x90\x92\xcc\x82\xbb\x06\xe7Bg\x1b~\x9e\x05z\x10\xd7\"\xab\f\x1d\xcf\xa3\xee`M\xebhWp\xa4\xc5\x96\xd9\nD\x16X\f\x9e\xd4\x03z#\xef_G\xec\xba\r/\xc2\"A\x8e\x8fl\t\xc7_u\xed\xe6\xf0\x9bL\xc0L\xbb\xdd\x87\xb9W\xb5O}\xd3\xd3F\x0e\x9b\xc74\x13\xce1\xa5\x9fo\xdds\x90\xb5\xdc\x16\x02\xb1q\xc7\xee\x1b\x9d\xd5q\xa3&\xf7\xfb\xa1g\x10\xc6\xd2\x15', 0x60) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/001/001\x00', 0xa9202, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/platform/dummy_hcd.0/usb1/bConfigurationValue\x00', 0x63102, 0x0) setresuid$auto(0x2, 0x7, 0x8080) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x1f, 0x3, 0x4) ioctl$auto(0x3, 0x800442d3, 0x91) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/devices/virtual/fcloop/ctl/add_local_port\x00', 0xa001, 0x0) write$auto(r1, &(0x7f0000000500)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k\x92\xa3\x99\xc4 \xbcr^\x9f\x8a\a\xd7\x19\xc3k\xa2\xce\xdb\xab?\xec\x1f\x00\x068\xae\b\x1e~\xe0{\x1f\xf6^\x92\xdfDng', 0x80) setsockopt$auto(0xffffffffffffffff, 0x0, 0x8, 0xfffffffffffffffc, 0x0) shmctl$auto_IPC_RMID(0x6, 0x0, &(0x7f0000000780)={{0x6, 0x0, 0x0, 0x1, 0x80, 0x3, 0x8}, 0xfffffff8, 0x9, 0x800, 0x4, @inferred, @inferred=0xffffffffffffffff, 0x1000, 0x0, 0x0, 0x0}) r3 = socket(0x5, 0xa, 0x8001) getsockopt$auto(r3, 0x0, 0x482, 0x0, &(0x7f0000000800)=0x8) r4 = setfsgid$auto(r2) socket(0x21, 0x2, 0xa) r5 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ram5\x00', 0x14fa02, 0x0) sendfile$auto(0x3, r5, 0x0, 0x400000000006) keyctl$auto(0x1f, 0x1, 0x6, r4, 0x3ff) futex$auto(&(0x7f0000000880)=0x24000, 0x8, 0x4991, 0x0, &(0x7f00000008c0)=0x2, 0xc826) pidfd_open$auto(0x1, 0x0) 10.207703423s ago: executing program 1 (id=4796): unshare$auto(0x40000080) select$auto(0x3, &(0x7f0000000140)={[0x7e, 0x5d6c9667, 0x10000000000, 0xe, 0x2, 0x8, 0x4, 0x408e1c75, 0x5, 0x9, 0xfffffffffffffff3, 0xbf, 0xa, 0x10000, 0x59, 0x4]}, &(0x7f0000000280)={[0x8912, 0xb, 0xc000000000000000, 0xff, 0xf, 0x8, 0x582, 0xaee, 0x4, 0xa, 0x5, 0x3, 0x3, 0x7, 0x2a0, 0x13]}, &(0x7f0000000440)={[0x100000001, 0x44, 0x1000, 0x10a, 0x778, 0x3, 0x1, 0x3, 0x7, 0x0, 0x5, 0x80, 0xfffffffffffffffb, 0x3, 0xf47, 0x40000000]}, 0x0) unshare$auto(0x40000080) write$auto(0xffffffffffffffff, &(0x7f0000000380)='\xa3\xaa\xb1\xa6\x01\xc2B#\xb5\xa7\xee$\x8d\xc4\xe9h5\xf7\xb3\xfdld\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\x89C\xce\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4\xdb\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\x9e\x98\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xb8&t9-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc\x00'/149, 0xc65d) unshare$auto(0x40000080) setns(0xc9, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) pwrite64$auto(0xffffffffffffffff, 0x0, 0x2, 0x6) r0 = socket(0x10, 0x2, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f00000003c0)=""/20, 0xfffffcc4) ppoll$auto(&(0x7f0000000880)={0xffffffffffffffff, 0x7, 0x9}, 0x8, &(0x7f00000008c0)={0x0, 0xfffffffffffffffd}, 0x0, 0x8) socket(0xa, 0x2, 0x0) setsockopt$auto(0x3, 0x0, 0x12, 0xffffffffffffffff, 0x0) keyctl$auto(0x1f, 0x0, 0x6, 0x0, 0x8000000000000000) preadv$auto(0xffffffffffffffff, 0x0, 0x7, 0x7, 0x402) gettimeofday$auto(&(0x7f0000000080)={0x2, 0x2}, &(0x7f00000000c0)={0x5, 0x5}) sendfile$auto(0xffffffffffffffff, 0x3, 0x0, 0x400000000006) r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x191101, 0x0) write$auto_seq_oss_f_ops_seq_oss(r1, &(0x7f00000004c0)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba42933ae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d86de1e90f869f6a04ac10043676f3b2c7f1339b2d7468133fb8447d17846b6b78079ecc31d7d0f74caa4a3db1ac4d312bfdb34bd331f1f771a2396108561a52153d63a7b2a3a077a7e4c1a22bcb23e1f3e511fee310baa67904d2aad4d6671e8b77c7720e37e84e0efecb60a35f188cbe8b8b2fb3967b78aa482aabb103f23083baa9b2ae653731d5993db4054233dea4af25795e12eb4d6b046bdeea6adce8626e0def15dd32b0ec16a85d93e1dea980794033f4b46973062c64c0209f9d3efc6ea7704c8e8dfea8cdfbe2cb1e367bf634a1952190e0660994f79f0c622d47ee8f93ce1c2852db907ae68a29bcc960b26e0e634173287fd012c4bb3063c41d35c92e896b44080bc5a98e90907cd1d01cc0708019cc1c93c71f29bfe841c873ad2aa0565dfaeb86c8b8e58ea2075de2a562ba1b5dc4ca452df21f25453b7c7f9a3e31547f4e803cefbac3b94715f2ab1f9fc66570244472f2f29deb9bdf6dc5b18d54e3c2264f9598f2ea749d170a66d351acf003c3f37fe74a09a8a964ce2818e4b4efd1eb0e3bca5dfd2a053eeb5735b96d282d2e03866bd6581b5e5e541c74f0b92b932b234ac117342f156b4b23fc6dcbc92ada00ce404f54443b6e7fdac9acb79e5258a865ced633ff5356d13a3e9923bcd8e6d177c9fb8618f9393798d90d70c78207e40f95bb2b0a9308f29f4331bbdfc1021dface5a740473b462c47286fee1c9d0036c78134e108b5b218d3022fd277e1cdf0cdf8cd4b37d74c8dd47e00e50fcf8d336978a0e7624f94b8fdcd1c9459201231f343c7cb602083aa5", 0x2f8) mmap$auto(0x0, 0x8, 0x80004000000000df, 0x10004000eb1, 0xffffffffffffffff, 0x8000008000) lsm_list_modules$auto(0x0, 0x0, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop9\x00', 0x20082, 0x0) ioctl$auto_SG_GET_RESERVED_SIZE(r2, 0x4c0a, 0x0) ioctl$auto_SNDCTL_SEQ_SYNC(r1, 0x5101, 0x0) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000800)='/dev/snd/midiC2D2\x00', 0x1854c2, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffff7, 0x8000) close_range$auto(r0, r1, 0x0) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000840)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x1000, 0x0) 9.811451817s ago: executing program 2 (id=4797): mlockall$auto(0x8) syz_clone3(&(0x7f0000000280)={0x1000000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), {0x14}, &(0x7f00000000c0)=""/87, 0x57, &(0x7f0000000140)=""/214, &(0x7f0000000240)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) write$auto(0xffffffffffffffff, 0x0, 0x92bf) r0 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000000), 0x902, 0x0) prctl$auto_PR_SET_MM_START_STACK(0x8, 0x5, 0x0, 0x401, 0x100) (async) r1 = prctl$auto_PR_SET_MM_START_STACK(0x8, 0x5, 0x0, 0x401, 0x100) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event\x00', 0x20001, 0x0) (async) r3 = openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/set_event\x00', 0x20001, 0x0) write$auto(r3, &(0x7f0000000100)=':%(:-!]\x00\x00\x00\x00', 0xd40a) sendmsg$auto_SMC_PNETID_FLUSH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="bd700000dcdf2504000000"], 0x14}}, 0x20) (async) sendmsg$auto_SMC_PNETID_FLUSH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="bd700000dcdf2504000000"], 0x14}}, 0x20) ioctl$auto_RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000480)={0x3, 0x3, {0x3, 0x9f, 0x9, 0x7, 0x3, 0x6b, 0xfffffffd, 0xfffe, 0xfd}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00'}) unshare$auto(0x40000080) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r4, &(0x7f0000000800)='/Eev/audio1\x00VI\xa3\xaa\xb1\xce\xf4d\xab\x83\xcfJ;\x9dJ\xc6\xc0\'\xdb\xbd\xe9/\x93\n\xcd$ab\xb3k7V\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89\xcc\xd9\x92\xee\x069m\x05b\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\xdbE\x93}\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaYd\xb0\xf1\xcb\xd3\xdd\xe2\xae,\x95k\xfer\xa8[\x84\x0f>:\xc2\xfe\x0e=7\xe5\xdc\xe9\xab\x0e\xfd\xd7`\xbe\x7f*\x10\x04A\xd2\xc9\xbc\xea\xb0\xa1\x930|09\xc2\x97M\xfc\x1a\xa7\xa4\xd0\x96\x03\xb9 \xe5\x9a\x0e\v6o\xc3I\v\x8d\xf2\x1e\xc9w\xac]\xe6\xe9\'2\x01\xe0\xf3\xf7\t\xf72\x1b\xe6\x16\x01\xc4}\x18\xbe\xbd\xa8\xd2\x00\xaf\xd6\x05k\xa6\xf8\x80\xe6\x7f\xc1\x95$\t\x1f\xa1\x83\xce\x11\x88\x99y\x9b\xe5\xfe(\xa6\xd5Z`\x9b\xdc\xa2 \xc7\xcd.C\xd0\xe0\x88\xf3\xba\x8b\xd2V\xdbw\x8dc', 0x100000a3dd) (async) write$auto(r4, &(0x7f0000000800)='/Eev/audio1\x00VI\xa3\xaa\xb1\xce\xf4d\xab\x83\xcfJ;\x9dJ\xc6\xc0\'\xdb\xbd\xe9/\x93\n\xcd$ab\xb3k7V\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89\xcc\xd9\x92\xee\x069m\x05b\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\xdbE\x93}\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaYd\xb0\xf1\xcb\xd3\xdd\xe2\xae,\x95k\xfer\xa8[\x84\x0f>:\xc2\xfe\x0e=7\xe5\xdc\xe9\xab\x0e\xfd\xd7`\xbe\x7f*\x10\x04A\xd2\xc9\xbc\xea\xb0\xa1\x930|09\xc2\x97M\xfc\x1a\xa7\xa4\xd0\x96\x03\xb9 \xe5\x9a\x0e\v6o\xc3I\v\x8d\xf2\x1e\xc9w\xac]\xe6\xe9\'2\x01\xe0\xf3\xf7\t\xf72\x1b\xe6\x16\x01\xc4}\x18\xbe\xbd\xa8\xd2\x00\xaf\xd6\x05k\xa6\xf8\x80\xe6\x7f\xc1\x95$\t\x1f\xa1\x83\xce\x11\x88\x99y\x9b\xe5\xfe(\xa6\xd5Z`\x9b\xdc\xa2 \xc7\xcd.C\xd0\xe0\x88\xf3\xba\x8b\xd2V\xdbw\x8dc', 0x100000a3dd) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) socket(0x2b, 0x1, 0x0) (async) socket(0x2b, 0x1, 0x0) connect$auto(0x3, &(0x7f0000000300)=@tipc=@nameseq={0x1e, 0x1, 0x2, {0x2, 0x1}}, 0x54) r5 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r5, &(0x7f00000003c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) (async) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x40000011, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) (async) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) mprotect$auto(0x1ffffffff000, 0x100007, 0x0) (async) mprotect$auto(0x1ffffffff000, 0x100007, 0x0) utime$auto(0x0, &(0x7f00000004c0)={0xfffffffffffffff7, 0x1ff}) open(&(0x7f0000000500)='./bus\x00', 0x12ba7e, 0x45) (async) open(&(0x7f0000000500)='./bus\x00', 0x12ba7e, 0x45) 9.406809895s ago: executing program 0 (id=4798): r0 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, 0x0, 0xfd800, 0x0) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) write$auto_dynamic_events_ops_trace_dynevent(0xffffffffffffffff, &(0x7f0000000280)="65a90950735e7b19172f", 0xa) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x9) ioprio_get$auto(0x1, 0x0) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) move_pages$auto(0x0, 0x8000, 0x0, 0x0, 0x0, 0x4) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) msgctl$auto_IPC_STAT(0x5f, 0x2, 0x0) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/pci/00/03.0\x00', 0x0, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/platform/dummy_hcd.3/usb4/avoid_reset_quirk\x00', 0x129302, 0x0) pread64$auto(r2, 0x0, 0x810000003c, 0x8) pread64$auto(r1, 0x0, 0x2, 0x5) openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x82000, 0x0) bind$auto(0xffffffffffffffff, 0x0, 0x66) select$auto(0x2, &(0x7f0000000080)={[0x6, 0x2, 0x4, 0x1, 0x200000000005, 0x100000001, 0x9, 0x7, 0x1, 0x55, 0x9, 0x40, 0x8001, 0x7, 0x7, 0x3]}, &(0x7f0000000100)={[0x552, 0xfffffffffffffffa, 0x83, 0xf59a, 0x5, 0xfffffffffffffffe, 0x1ff, 0xf8ff, 0x8000000000002001, 0x102, 0x5, 0x5, 0x2, 0xaaa, 0xfffffffffffff000, 0x10000]}, &(0x7f0000000180)={[0x8, 0xb, 0x0, 0x80004d68, 0x1, 0x0, 0x6, 0x3, 0x4, 0x800000000005, 0x58c0a7f6, 0x3, 0x0, 0x400, 0xffffffff, 0xfffffffffffffffa]}, &(0x7f0000000700)={0xb, 0x273f4b52}) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0xe, 0x2, 0x16efae4c, 0x8000005092, 0x61f93bdb) r3 = openat$auto_proc_environ_operations_base(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/environ\x00', 0x0, 0x0) read$auto_proc_environ_operations_base(r3, &(0x7f00000003c0)=""/234, 0xea) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r4, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000500)={0x34, r5, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0xb8}, @NL80211_ATTR_KEY_DATA={0x16, 0x7, "1d22088e35286806af9eb14f344cae801f3e"}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x41) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) sendmsg$auto_NETDEV_CMD_BIND_RX(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000300", @ANYRES32, @ANYBLOB="34000280080003000b0000003c898f4d1a171d409b109ab008000300010000000800030082f0000008000100030000000800010001000080080003008d1a3d49363ec3f0bf4b5d77a5a71d0076b026783817f3fad361963cf6a0b3a36539046c725b8e26693e9cde7745a6c95903afa8cdd56e0bdae94ef4733c0b36f69b085477f190d1f7c967ffaf2fe4d258d4e3ac5dd642ac31802832c7ca673cea8fab82efbd0f324fd36162774a47702bb9a45a167d71decd6f54ce360e18f43fc1e53fd858123e3278252f7aac04ee433382470000000000000000", @ANYRES32=r0, @ANYBLOB="08000300", @ANYRES32=r0, @ANYBLOB], 0x84}, 0x1, 0x0, 0x0, 0x40001}, 0x40010) 8.709196822s ago: executing program 3 (id=4799): openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) r0 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card0\x00', 0x109801, 0x0) ioctl$auto(r0, 0x9210640b, 0xffffffffffffffff) unshare$auto(0x40000080) readv$auto(0x3, 0x0, 0x1) statmount$auto(&(0x7f0000000040)={0x81, @inferred, 0x5, 0xffffffff, 0xfffffffffffffff2}, &(0x7f0000000080)={0x0, 0x0, 0x38, 0xffffff01, 0x9, 0x8000000000000000, 0x8, 0x7, 0x9, 0x5, 0x5, 0x9, 0x3, 0x8, 0x5, 0xf, 0x0, 0x9, 0x10001, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe1, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000000000000]}, 0x800, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0xffffff7fffff0005, 0x8) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000db, 0xeb1, 0x400, 0x8000) socket(0x10, 0x2, 0x0) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="1b0026bd7400fddbdf250300000004000800100003800c0009"], 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000200bd7000fedbdf250200000800130001"], 0x24}, 0x1, 0x0, 0x0, 0x20048894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="72010000", @ANYBLOB="180027"], 0x1ac}}, 0x40000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000600)={{0x0, 0x2, &(0x7f0000000640)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) socket(0x1, 0x3, 0x0) madvise$auto(0x0, 0xfffffffffffeffff, 0x4e6d) prctl$auto(0x1000000003b, 0x1, 0x0, 0x5, 0x5) madvise$auto(0x0, 0x2003f2, 0x15) r1 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000680), 0x101802, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000006c0)={0x1, 0x1, 0x800000ff, 0xffffff71, 0x10000}) mmap$auto(0x0, 0x2020009, 0x2, 0xf8, 0xfffffffffffffffa, 0x8000) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000700)='/sys/firmware/memmap/2/type\x00', 0x18b740, 0x0) r3 = openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000740), 0x2002, 0x0) r4 = getpid() process_vm_readv$auto(r4, &(0x7f0000000780)={0x0, 0xfff}, 0x40000000001, &(0x7f00000007c0)={&(0x7f0000000800)="8c9700089d1b208365d5b5d112dbab029ed13881d2", 0x40000000001243}, 0x4, 0x0) ioctl$auto(r3, 0x400454ca, r2) 7.688608986s ago: executing program 1 (id=4800): madvise$auto(0x110c230000, 0x1, 0x9) r0 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/039/001\x00', 0x802, 0x0) ioctl$auto_USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000240)={0x23, 0x3, 0x2, 0x1, 0x800, 0x400007fb, &(0x7f0000000500)}) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, r0, 0x8000) getsockopt$auto_SO_TIMESTAMP_NEW(0xffffffffffffffff, 0x81, 0x3f, &(0x7f0000000000)='#\\\\&{,,[\'\x00', &(0x7f0000000040)=0x7) r1 = io_uring_setup$auto(0xfffffffd, 0x0) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x242000, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/pnp0/00:01/options\x00', 0x0, 0x0) ftruncate$auto(r1, 0x7) read$auto(r2, 0x0, 0x80000002) setrlimit$auto(0x7, &(0x7f00000000c0)={0x0, 0x2}) bpf$auto(0x0, &(0x7f0000000100)=@bpf_attr_0={0x9, 0xfce8, 0x200, 0x3, 0x7, 0xffffffffffffffff, 0xa, "2af051b26b658a20d8dc6b3662034b19", 0x0, 0xffffffffffffffff, 0x8000005, 0x7, 0x6, 0x6}, 0x10) madvise$auto(0x0, 0xffffffffffff0005, 0x17) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mincore$auto(0x1000, 0x1000000, 0x0) 7.594240336s ago: executing program 2 (id=4801): mmap$auto(0x2, 0x20009, 0x3fe, 0xeb1, 0x401, 0x7ffc) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) r0 = openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv$auto(r0, &(0x7f00000000c0)={0x0, 0x8}, 0x2, 0x3f8, 0xfffffffffffffffa) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/vm/dirty_background_ratio\x00', 0x141241, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/hugetlb.1GB.limit_in_bytes\x00', 0x10b142, 0x0) unshare$auto(0xb) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) mremap$auto(0x0, 0x5ac2, 0x4, 0x7, 0x100800000) io_uring_setup$auto(0x2, &(0x7f0000000280)={0x80000003, 0x9, 0x4002, 0x6, 0x4, 0x8, 0xffffffffffffffff, [0x0, 0x0, 0x5], {0x9, 0xfffffff9, 0xfffffffd, 0x29b, 0x100, 0x4, 0x101, 0x4000006, 0x2000}, {0x2, 0x1, 0x52, 0x3, 0x1, 0x6, 0x104, 0x3ff, 0x100000000}}) r2 = setfsgid$auto(0xee01) keyctl$auto(0x1f, 0x1, 0x6, r2, 0x3ff) fsconfig$auto(0xffffffffffffffff, 0x9, &(0x7f0000000300)='^V\'\f1`\xfaN\x8d\x06\x82\x92K\x0f\xb1\xe8Y\xa4\x0eFR\xfa\xd7\x18(\x81^\x17\xed\xa3\x8f*\x0f\x89\x0f\x1a\xe71\f\x17\x7fi9k\xbb\x81\x1e\x10\"\xdd\xd1\x9b\x03;\'\xeb\x1e\xd2H\xe6\x88\xf4\xdb\x9e\x12\x19\xb9k\xde\x89\x1dAw\xc0\x00\xc27\xa75+\xbe\xea0?\x1f\xb9&\xbaP\xd4\xba\xf9\xa4D\xd8\\=Li.\x024HI\x89t\x0f\xf7\x188R\xdb_\xd5?Sa\x193\x06[D\xbb)\xc8\xa9\x05z\xc40\x977\xbf\x1a&\xbf\x82zF\x7fc\xb4\xe6\x86\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000003c0), r2) mmap$auto(0x0, 0x83, 0xc00000072, 0x8b72, 0x1000000002, 0x5) sendmsg$auto_GTP_CMD_DELPDP(r1, 0x0, 0x894) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x45f1fdedc6398cd1}, 0x800) r3 = io_uring_setup$auto(0xb1, &(0x7f00000004c0)={0xe, 0x2, 0x9, 0x210001, 0x5, 0xc05, 0xffffffffffffffff, [0x536, 0x1001, 0x3], {0x9, 0x3, 0x2, 0x0, 0x4, 0x895, 0x3fdf, 0x70f, 0x5}, {0x3, 0x1d11, 0x54ed, 0x266fce73, 0x101, 0xff, 0x7ff, 0xa, 0xb}}) sendmsg$auto_NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYRES16=r3, @ANYRESDEC=0x0, @ANYBLOB="000329bd7000fedbdf250900000008000c000100008008000300", @ANYRES64=r0, @ANYRESHEX=0x0], 0x3c}, 0x1, 0x0, 0x0, 0x20000028}, 0x8004) close_range$auto(0x2, 0x8, 0x0) socket(0x2b, 0x1, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0xe) openat$auto_ep0_operations_inode(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) 7.583278109s ago: executing program 0 (id=4802): r0 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, 0x0, 0xfd800, 0x0) bind$auto(r0, 0x0, 0x6) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) write$auto_dynamic_events_ops_trace_dynevent(0xffffffffffffffff, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x9) ioprio_get$auto(0x1, 0x0) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) move_pages$auto(0x0, 0x8000, 0x0, 0x0, 0x0, 0x4) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) msgctl$auto_IPC_STAT(0x5f, 0x2, 0x0) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/pci/00/03.0\x00', 0x0, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/platform/dummy_hcd.3/usb4/avoid_reset_quirk\x00', 0x129302, 0x0) pread64$auto(r2, 0x0, 0x810000003c, 0x8) pread64$auto(r1, 0x0, 0x2, 0x5) openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x82000, 0x0) bind$auto(0xffffffffffffffff, 0x0, 0x66) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0xe, 0x2, 0x16efae4c, 0x8000005092, 0x61f93bdb) r3 = openat$auto_proc_environ_operations_base(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/environ\x00', 0x0, 0x0) read$auto_proc_environ_operations_base(r3, &(0x7f00000003c0)=""/234, 0xea) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r4, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000500)={0x38, r5, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0xb8}, @NL80211_ATTR_KEY_DATA={0x19, 0x7, "1d22088e35286806af9eb14f344cae801f3ec6adbf"}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x41) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) sendmsg$auto_NETDEV_CMD_BIND_RX(0xffffffffffffffff, 0x0, 0x40010) 6.428214007s ago: executing program 1 (id=4803): unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dmmidi2\x00', 0x224dc1, 0x0) unshare$auto(0x40000080) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/amidi2\x00', 0x551e43, 0x0) write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) write$auto(r1, 0x0, 0x7) unshare$auto(0x40000080) madvise$auto(0x800, 0x8000002003f0, 0x18) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x9, 0x616, 0xdd, 0x3) pwrite64$auto(0xffffffffffffffff, 0x0, 0x0, 0x6) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) getsockopt$auto_SO_OOBINLINE(r0, 0x4, 0xa, 0x0, &(0x7f0000000180)=0x6) setns(0xc9, 0x0) r2 = socket(0x24, 0x3, 0x4e3) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @empty}, 0x51) keyctl$auto(0x41803200, 0x0, 0x6, 0x0, 0x8000000000000001) chown$auto(0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x801, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video12\x00', 0x800, 0x0) connect$auto(0x3, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @local, 0x4}, 0x85ff) connect$auto(r2, &(0x7f0000000040)=@rc={0x1f, @none, 0x8}, 0x4) r3 = gettid() sched_getaffinity$auto(r3, 0xd06ffffc, &(0x7f0000000200)=0x152a) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0x22, 0x0, 0x0, 0x0, 0x100000080000000) mmap$auto(0x0, 0x40000b, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8) syz_clone(0x210e00, 0x0, 0x0, 0x0, 0x0, 0x0) 5.101091323s ago: executing program 3 (id=4804): fsconfig$auto(0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0) process_madvise$auto_MADV_PAGEOUT(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0), 0x3}, 0x1, 0x15, 0x5) prctl$auto(0x3e, 0x1, 0x0, 0x2, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socketpair$auto(0x1, 0x2, 0x900, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) select$auto(0xd, 0x0, &(0x7f0000000400)={[0x5, 0x200000000005, 0x7, 0x7, 0x0, 0x80000002, 0xc, 0x6, 0x800, 0xb80, 0xe34c, 0x4009, 0x4c3, 0xfffdfffffffff952, 0x7fff, 0x1000]}, 0x0, &(0x7f0000000080)={0xe969, 0x1000}) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) setsockopt$auto_SO_ATTACH_REUSEPORT_EBPF(r0, 0x3, 0x34, &(0x7f0000000240)='IOAM6\x00', 0x3) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) write$auto(0xffffffffffffffff, &(0x7f0000000180)='7\x00\xe6\xeaA\r\nW\xa6&\xff\xff\f\x00\x00\x00\xff\x00\x00\x00\x00\x00\x1f\xde\x00\x00\x00\x00\x00\x00\x00', 0x9) set_mempolicy$auto(0x6, 0x0, 0x9) socket$nl_generic(0x10, 0x3, 0x10) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0xe01, 0x0) setresgid$auto(0xffffffffffffffff, 0xee00, 0x0) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r1, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2T\xc0\x1d\xa4\x10r\xc4\xa2\xb1y\t\x05\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xed\rW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1', 0x100000001) ioctl$auto_TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000040)) write$auto(r1, &(0x7f0000000080)='S\x00\x00\x00\xfe\xff\xff\xff', 0x8587) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) write$auto(0xffffffffffffffff, 0x0, 0x84) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000000200), r0) openat$auto_hwsim_fops_rx_rssi_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy1/hwsim/rx_rssi\x00', 0x140, 0x0) 5.021820359s ago: executing program 0 (id=4805): r0 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, 0x0, 0xfd800, 0x0) bind$auto(r0, 0x0, 0x6) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) write$auto_dynamic_events_ops_trace_dynevent(0xffffffffffffffff, &(0x7f0000000280)="65a90950735e7b19172f", 0xa) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x9) ioprio_get$auto(0x1, 0x0) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) move_pages$auto(0x0, 0x8000, 0x0, 0x0, 0x0, 0x4) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) msgctl$auto_IPC_STAT(0x5f, 0x2, 0x0) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/pci/00/03.0\x00', 0x0, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/devices/platform/dummy_hcd.3/usb4/avoid_reset_quirk\x00', 0x129302, 0x0) pread64$auto(r1, 0x0, 0x2, 0x5) openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x82000, 0x0) bind$auto(0xffffffffffffffff, 0x0, 0x66) select$auto(0x2, &(0x7f0000000080)={[0x6, 0x2, 0x4, 0x1, 0x200000000005, 0x100000001, 0x9, 0x7, 0x1, 0x55, 0x9, 0x40, 0x8001, 0x7, 0x7, 0x3]}, &(0x7f0000000100)={[0x552, 0xfffffffffffffffa, 0x83, 0xf59a, 0x5, 0xfffffffffffffffe, 0x1ff, 0xf8ff, 0x8000000000002001, 0x102, 0x5, 0x5, 0x2, 0xaaa, 0xfffffffffffff000, 0x10000]}, &(0x7f0000000180)={[0x8, 0xb, 0x0, 0x80004d68, 0x1, 0x0, 0x6, 0x3, 0x4, 0x800000000005, 0x58c0a7f6, 0x3, 0x0, 0x400, 0xffffffff, 0xfffffffffffffffa]}, &(0x7f0000000700)={0xb, 0x273f4b52}) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0xe, 0x2, 0x16efae4c, 0x8000005092, 0x61f93bdb) r2 = openat$auto_proc_environ_operations_base(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/environ\x00', 0x0, 0x0) read$auto_proc_environ_operations_base(r2, &(0x7f00000003c0)=""/234, 0xea) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_SET_REG(r3, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000500)={0x38, 0x0, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0xb8}, @NL80211_ATTR_KEY_DATA={0x19, 0x7, "1d22088e35286806af9eb14f344cae801f3ec6adbf"}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x41) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 4.914338522s ago: executing program 2 (id=4806): r0 = socketcall$auto_SYS_SOCKETPAIR(0x8, &(0x7f0000000100)) mmap$auto(0x0, 0x2000d, 0x3bb, 0xeb1, r0, 0x10008000) r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$auto(r1, 0xc06855c8, r1) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r2 = socket(0xa, 0x3, 0x73) setsockopt$auto(r2, 0xff, 0x7, 0x0, 0x3) io_uring_setup$auto(0x6, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow\x00', 0x40, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000380)=""/11, 0xb) unshare$auto(0x40000080) setsockopt$auto(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x4) madvise$auto(0x0, 0x2003f2, 0x14) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) r4 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x121300, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) setsockopt$auto(0xffffffffffffffff, 0x2a, 0x42, 0x0, 0x8) getpid() r5 = open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) unlink$auto(&(0x7f0000000380)='./file0\x00') keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) bpf$auto_BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=@bpf_attr_4={0x0, r4, 0x80000001, r5}, 0x4) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 4.746680115s ago: executing program 1 (id=4807): pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) madvise$auto(0x0, 0x2000040080000004, 0xe) socket(0xa, 0x801, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x8d}, 0x7}, 0xb8ad, 0x0) mmap$auto(0x5, 0x400008, 0xdf, 0x9b72, 0x7, 0x800008000) r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmmsg$auto(r0, 0x0, 0x5, 0x311) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$auto_snd_pcm_f_ops_pcm1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/pcmC0D0c\x00', 0x42241, 0x0) ioctl$auto___SNDRV_PCM_IOCTL_SYNC_PTR322(r1, 0xc0844123, 0x0) bpf$auto(0x1c, 0x0, 0x92) r2 = landlock_create_ruleset$auto(&(0x7f0000000140)={0x9, 0x1, 0x9}, 0x9, 0x0) landlock_restrict_self$auto(r2, 0xb) r3 = socket(0x2b, 0x6, 0x6) setsockopt$auto(r3, 0xe, 0x12, 0x0, 0x52) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/input/event1\x00', 0x80000, 0x0) ioctl$auto_EVIOCREVOKE(r4, 0x40044591, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) getsockopt$auto_SO_MEMINFO(r1, 0x5, 0x37, &(0x7f0000000100)='/\\,*\'\x00', &(0x7f0000000180)=0x8) 3.919563028s ago: executing program 3 (id=4808): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) lsm_list_modules$auto(0x0, 0x0, 0x0) openat$auto_rfkill_fops_core(0xffffffffffffff9c, 0x0, 0x40, 0x0) r0 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snd/controlC2\x00', 0x80101, 0x0) r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0xc0c02, 0x0) ioctl$auto(r0, 0x80dc5521, r1) (fail_nth: 3) 3.549021895s ago: executing program 3 (id=4809): r0 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x4, 0x7) io_uring_register$auto(0xffffffffffffffff, 0x15, 0x0, 0x2) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) socket(0x2, 0x1, 0x106) open_by_handle_at$auto(r0, &(0x7f0000000080)={0xd, 0x8, "c1d6c1e61501d18721ecbf7628"}, 0x1) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D2\x00', 0x200000, 0x0) socket(0x10, 0x2, 0x0) pipe$auto(&(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_vcs_fops_vc_screen(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x101041, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) r1 = socket(0x2, 0x801, 0x100) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYRESDEC, @ANYBLOB="5e969daa66bae42346e8519f03bd3c998534e0ff61dce2c34fba89ce6815386cf1e0ac2c986de6a5536faeebe1d1bb50d3df3acc0176e5c7abc5df14a979ff74844db05433f2c4e1153ff367043e3db8cb2ad8b8ae83cce052b9eef23bfe103fe95872910818189af365b727c646c5cc39a5565b977a8b97dc73b52a338304a2", @ANYRES16], 0x18}}, 0x4000050) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r1, &(0x7f0000000b80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000840)={0x2fc, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@THERMAL_GENL_ATTR_TZ_TRIP_ID={0x8, 0x5, 0x5}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV_NAME={0x14, 0x12, 'macsec0\x00'}, @THERMAL_GENL_ATTR_CDEV={0x291, 0xe, 0x0, 0x1, [@nested={0x183, 0x3d, 0x0, 0x1, [@nested={0x4, 0xbf}, @nested={0x4, 0x13e}, @generic="726367aae5fd54f85e55d1e11b9e2165df9e7f17f811857d70b72ebded492f539f0388a5ddd4d56e8bd2936d37486f30476d6c5741817fbca4eecab19a6a716f21a97bfee28e25779acd46434fbc35764f3b01e84aa7b004dcd48db90a28ea47c9cc0395374578a6a05188793697f7db58ef360b6c1e23d91818e2b07725a3bb4e9ec26e385775df33c050ba54b77b6d3e101bea00c5ffb41927358fc1342a06b2494ff2ba39aca9efbe87275c8267a975af", @typed={0x4, 0xf3}, @typed={0x8, 0xd6, 0x0, 0x0, @u32=0xec16}, @nested={0x4, 0x130}, @generic="d785c6d1df0bfe6464e0083247a581d12a806da004f6863c86390db1a6abdc418a6011a6d68342de7939df14172acd1760be1bb9f06c399d8535fb365495e90dd3da3db0509b9bc1a41ed08d26efc9e8ea2a2d919cdd6076025efae532e5f1e89c82b0594706da3f979c010baf215c078661da4968bf969837da1fa7eb3958931c3e870d6ef3d6105438c3a3ef795d3b6d504b2570ccad948279504bc4a0ae54a53a81ed92a73aec340a3b3801918321ad", @nested={0x4, 0x94}]}, @typed={0xc3, 0xe, 0x0, 0x0, @binary="f819c6005d9ee713b6e9fee7b777c933ebaa6eeb20d69b12dcab1745d36c2228946505c272b2f2fcba6acbd79e4e825bc40d7084344cc228bef818531c776fab93f9d62c374b9db004bced08caeb955d1d4a971bf504227f109c4dc5e175675a657facc346f9b5bb81cbee7866b74747de9e41b55824129d4bee9391549a9a619266bd06f8b8157a29b7c8de39f49ca63142271f5c58133d5f0e197cae9442524649428714e06e508cb1fa04abf0ac755565db32bb6407e0fc77d55a37a0fc"}, @generic="fbb8232aaf58c16980c34fccc63fe4b95db93cdedbefe6a78c45206bf994043388fc18a90edd863a1b90b7fbbc7bb2ed6df9902fa4b329c44e1b380bb0b094737620f6cb55"]}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0x3}, @THERMAL_GENL_ATTR_TZ_MODE={0x8, 0x9, 0x9}, @THERMAL_GENL_ATTR_TZ_TRIP_HYST={0x8, 0x8, 0x4}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_ID={0x8, 0x15, 0x7}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0xfffffff9}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_EFFICIENCY={0x8, 0x17, 0x7fff}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x8880}, 0x40800) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 2.985805026s ago: executing program 0 (id=4810): openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101000, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) (async) unshare$auto(0x40000080) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/cuse\x00', 0xe40, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07) (async) sendfile$auto(0x1, 0x3, 0x0, 0x40000000c07) r0 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/011/001\x00', 0xa901, 0x0) ioctl$auto(r0, 0x5522, 0xf15) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/platform/vhci_hcd.0/status\x00', 0x101600, 0x0) read$auto(r1, &(0x7f0000000040)='\x04\x00\x86\xd2\x0f\x84\xe7\x05}\x88\x04\xc2&\x14^\v\x802\x89Y\xf2;\xe8\xf4a\xab\x01\xf5\x1f\xd5\xf5\x89lg\x0f+S\xbf\xa7\xc3\xd0\x1e\x18\xc2\xe8\x87\xa9\x9a4I;\xf6wP\'go\xf2\xf13\x91I\x819nz65-\x84\x11\x7f^\xed^\xbc\x17\x17\x82r\xa4\xf6\x86m\x81YI\xa7\xe7\x97%\x9d\bs\xc92\x1b\t\xf9q\a*\xf1\r\xc1\x18\xa7\x05m\xb1\xda\apU\xb8)b\x7f\xe9rQ\xc5N~,,\xad\xf0\x011\x8b`\xb8\x06\x01$\'\xb4\x03g\xe6\xf8\x18liR-\x97\xadX\x7f\v\xa4\xb5\xfa\xe0k\xa1\xc3\x89\x01\xb1J\xdcy!\x99\xf65\x9e\xcd\xe2[\xd78\x0e\xde-!u\x9bh\a\xbbHC\x91\xde\xd2\x9a}S\xf0\x85\x7f\x86/\xd7||\xf4\xca\xc9A\xac\xfb\x1f\xcb\xed\xbaF\xe5\xb2\xdc/Z\x1b\xc9\xb8\xc9\x83O2F\x91\a\x8c\xcd\xe57\xaa\x12\x03\xe4=\x85\xb3\xa7L', 0xc) unshare$auto(0x40000080) (async) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000001080)='/sys/devices/virtual/tty/ptmx/uevent\x00', 0x0, 0x0) (async) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000001080)='/sys/devices/virtual/tty/ptmx/uevent\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000040)=""/4096, 0x1000) (async) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000040)=""/4096, 0x1000) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dri/card2\x00', 0x20002, 0x0) (async) r3 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dri/card2\x00', 0x20002, 0x0) ioctl$auto(r3, 0x800064bb, r3) (async) ioctl$auto(r3, 0x800064bb, r3) add_key$auto_KEY_SPEC_SESSION_KEYRING(&(0x7f0000000440)='\x00\x00\x00\x00\x00\x00\x00\x00', 0x0, &(0x7f00000004c0), 0xff, 0xfffffffffffffffd) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) r4 = socket(0x11, 0x3, 0x9) sendmmsg$auto(r4, &(0x7f0000000000)={{&(0x7f0000001040), 0x5ac, &(0x7f00000010c0)={&(0x7f0000001100)='L\fX\x00\x00\x00\x00\x00\t3', 0x49}, 0x4, &(0x7f0000001140), 0x5, 0x11}, 0x5}, 0x2, 0x100) r5 = socket(0x28, 0x1, 0x0) sendmsg$auto_KSMBD_EVENT_SHARE_CONFIG_REQUEST(r5, &(0x7f00000011c0)={0x0, 0x0, 0x0}, 0x4000085) socket(0xa, 0x2, 0x3a) (async) r6 = socket(0xa, 0x2, 0x3a) r7 = io_uring_setup$auto(0x52, 0x0) syz_genetlink_get_family_id$auto_vdpa(0x0, r6) (async) r8 = syz_genetlink_get_family_id$auto_vdpa(0x0, r6) sendmsg$auto_VDPA_CMD_DEV_CONFIG_GET(r7, &(0x7f0000001200)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001280)={&(0x7f00000012c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg$auto_VDPA_CMD_MGMTDEV_GET(r5, &(0x7f0000001040)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001380)={&(0x7f00000013c0)=ANY=[@ANYBLOB="c5ed000d", @ANYRES16=r8, @ANYBLOB="000827bd7000fddbdf250200000006000d00722c0000"], 0x1c}, 0x1, 0x0, 0x0, 0x85}, 0x810) sendmsg$auto_VDPA_CMD_DEV_GET(r4, &(0x7f0000001500)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r8, @ANYBLOB="00022cbd7000fedbdf250500000088000a00e25a60297c63bcdf83292a07f74b14b23e43951e054364e3d8acbe3eb5e0503f6d106cba553573e0b11f721e0a9a8dac4be437f5a8a8063a50da072a0d249ded7a4020fc9f87b1296d67732b37f08d9435206dcd6d09d320c9bc2242b9732d610e996da50d0cabf047ce411100060000000c0014000300000000000000050001000000000008001100880000007ed801b21d929ea3842235d3b47e3d7d3902ac25152e46e9656ca8005d619ad18986e3c5ede83fc5c4027bf370ab91edd0334e1805e58999673578246e244bb1023ae5a98419f4d93de2fe5101"], 0xc0}, 0x1, 0x0, 0x0, 0x24048014}, 0x0) (async) sendmsg$auto_VDPA_CMD_DEV_GET(r4, &(0x7f0000001500)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r8, @ANYBLOB="00022cbd7000fedbdf250500000088000a00e25a60297c63bcdf83292a07f74b14b23e43951e054364e3d8acbe3eb5e0503f6d106cba553573e0b11f721e0a9a8dac4be437f5a8a8063a50da072a0d249ded7a4020fc9f87b1296d67732b37f08d9435206dcd6d09d320c9bc2242b9732d610e996da50d0cabf047ce411100060000000c0014000300000000000000050001000000000008001100880000007ed801b21d929ea3842235d3b47e3d7d3902ac25152e46e9656ca8005d619ad18986e3c5ede83fc5c4027bf370ab91edd0334e1805e58999673578246e244bb1023ae5a98419f4d93de2fe5101"], 0xc0}, 0x1, 0x0, 0x0, 0x24048014}, 0x0) 2.576266927s ago: executing program 2 (id=4811): openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x4, 0x7) io_uring_register$auto(0xffffffffffffffff, 0x15, 0x0, 0x2) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D2\x00', 0x200000, 0x0) socket(0x10, 0x2, 0x0) pipe$auto(&(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_vcs_fops_vc_screen(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x101041, 0x0) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ipvs(0x0, 0xffffffffffffffff) sendmsg$auto_IPVS_CMD_GET_SERVICE(r0, &(0x7f00000000c0)={0x0, 0x700, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r1, 0x1, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x2004400d}, 0x20048804) r2 = socket(0x2, 0x801, 0x100) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="5e969daa66bae42346e8519f03bd3c998534e0ff61dce2c34fba89ce6815386cf1e0ac2c986de6a5536faeebe1d1bb50d3df3acc0176e5c7abc5df14a979ff74844db05433f2c4e1153ff367043e3db8cb2ad8b8ae83cce052b9eef23bfe103fe95872910818189af365b727c646c5cc39a5565b977a8b97dc73b52a338304a2", @ANYRES16], 0x18}}, 0x4000050) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_TEMP(r2, &(0x7f0000000b80)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000840)={0x2fc, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@THERMAL_GENL_ATTR_TZ_TRIP_ID={0x8, 0x5, 0x5}, @THERMAL_GENL_ATTR_CDEV_CUR_STATE={0x8}, @THERMAL_GENL_ATTR_CDEV_NAME={0x14, 0x12, 'macsec0\x00'}, @THERMAL_GENL_ATTR_CDEV={0x291, 0xe, 0x0, 0x1, [@nested={0x183, 0x3d, 0x0, 0x1, [@nested={0x4, 0xbf}, @nested={0x4, 0x13e}, @generic="726367aae5fd54f85e55d1e11b9e2165df9e7f17f811857d70b72ebded492f539f0388a5ddd4d56e8bd2936d37486f30476d6c5741817fbca4eecab19a6a716f21a97bfee28e25779acd46434fbc35764f3b01e84aa7b004dcd48db90a28ea47c9cc0395374578a6a05188793697f7db58ef360b6c1e23d91818e2b07725a3bb4e9ec26e385775df33c050ba54b77b6d3e101bea00c5ffb41927358fc1342a06b2494ff2ba39aca9efbe87275c8267a975af", @typed={0x4, 0xf3}, @typed={0x8, 0xd6, 0x0, 0x0, @u32=0xec16}, @nested={0x4, 0x130}, @generic="d785c6d1df0bfe6464e0083247a581d12a806da004f6863c86390db1a6abdc418a6011a6d68342de7939df14172acd1760be1bb9f06c399d8535fb365495e90dd3da3db0509b9bc1a41ed08d26efc9e8ea2a2d919cdd6076025efae532e5f1e89c82b0594706da3f979c010baf215c078661da4968bf969837da1fa7eb3958931c3e870d6ef3d6105438c3a3ef795d3b6d504b2570ccad948279504bc4a0ae54a53a81ed92a73aec340a3b3801918321ad", @nested={0x4, 0x94}]}, @typed={0xc3, 0xe, 0x0, 0x0, @binary="f819c6005d9ee713b6e9fee7b777c933ebaa6eeb20d69b12dcab1745d36c2228946505c272b2f2fcba6acbd79e4e825bc40d7084344cc228bef818531c776fab93f9d62c374b9db004bced08caeb955d1d4a971bf504227f109c4dc5e175675a657facc346f9b5bb81cbee7866b74747de9e41b55824129d4bee9391549a9a619266bd06f8b8157a29b7c8de39f49ca63142271f5c58133d5f0e197cae9442524649428714e06e508cb1fa04abf0ac755565db32bb6407e0fc77d55a37a0fc"}, @generic="fbb8232aaf58c16980c34fccc63fe4b95db93cdedbefe6a78c45206bf994043388fc18a90edd863a1b90b7fbbc7bb2ed6df9902fa4b329c44e1b380bb0b094737620f6cb55"]}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0x3}, @THERMAL_GENL_ATTR_TZ_MODE={0x8, 0x9, 0x9}, @THERMAL_GENL_ATTR_TZ_TRIP_HYST={0x8, 0x8, 0x4}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_ID={0x8, 0x15, 0x7}, @THERMAL_GENL_ATTR_TZ_TRIP_TEMP={0x8, 0x7, 0xfffffff9}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_EFFICIENCY={0x8, 0x17, 0x7fff}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x8880}, 0x40800) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 2.325245675s ago: executing program 1 (id=4812): r0 = openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/event0\x00', 0x8802, 0x0) ioctl$auto_EVIOCGRAB(r0, 0x40044590, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3ffff8, 0x7, 0x20011, 0xdd, 0xffffffffffffffff) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) get_mempolicy$auto(0x0, 0x0, 0x400, 0x0, 0x1) pselect6$auto(0x6, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020008, 0x2, 0xfc, 0xfffffffffffffffa, 0x81) r1 = epoll_create$auto(0x1) capset$auto(0x0, 0x0) epoll_ctl$auto(r1, 0x1, 0x8000000000000000, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/wakeup_count\x00', 0xc0082, 0x0) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) openat$auto_hpet_fops_hpet(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) set_mempolicy$auto(0x8003, 0x0, 0x4) sendmsg$auto_NET_SHAPER_CMD_GROUP(r1, 0x0, 0x10) socket(0x1e, 0x2, 0xa457) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) mremap$auto(0x200000001000, 0x8, 0x37, 0x3, 0x110c230000) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000680)='.\x00', 0x2440, 0x2) getdents64$auto(r2, 0x0, 0x200c8) 1.679283062s ago: executing program 3 (id=4813): r0 = openat$auto_ep0_operations_inode(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) write$auto(r0, &(0x7f0000000180)='k:\x1f\x8eF!D?B@\xa3\x86L\xd3=\x8e\xf9=y\xd7\tHB\xa9ngn\xa8\x86\xfcA.\xc4\x04\xd3\xe5J\xf9\xfasE\x85\xc3\x01\x11e\x90\x92\xcc\x82\xbb\x06\xe7Bg\x1b~\x9e\x05z\x10\xd7\"\xab\f\x1d\xcf\xa3\xee`M\xebhWp\xa4\xc5\x96\xd9\nD\x16X\f\x9e\xd4\x03z#\xef_G\xec\xba\r/\xc2\"A\x8e\x8fl\t\xc7_u\xed\xe6\xf0\x9bL\xc0L\xbb\xdd\x87\xb9W\xb5O}\xd3\xd3F\x0e\x9b\xc74\x13\xce1\xa5\x9fo\xdds\x90\xb5\xdc\x16\x02\xb1q\xc7\xee\x1b\x9d\xd5q\xa3&\xf7\xfb\xa1g\x10\xc6\xd2\x15', 0x60) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) msgctl$auto_IPC_SET(0x1f6, 0x1, &(0x7f0000000240)={{0x4, 0xee01, 0xee00, 0x7, 0xff, 0x0, 0xe8}, &(0x7f00000000c0)=0x4, &(0x7f0000000140)=0x9, 0x8, 0x8, 0x4, 0x8, 0x62, 0x2, 0x2, 0x8, @inferred, @raw=0x5}) quotactl$auto(0xc, &(0x7f0000000080)='/dev/bus/usb/001/001\x00', r1, &(0x7f00000002c0)="ae7e9a88653ddef799bb4aeba521f16ed5206fb5e52ad2eb87c75b0a010c58bdc2f0a79886018b91bb0980e2bd3e70226c60338b530aae874d5ddeb8df86f19b74f8fee13aa15090fc59b1e28f1203e19263653484e7b44352") openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/001/001\x00', 0xa9202, 0x0) socket(0xa, 0x3, 0x73) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) setsockopt$auto(0x400000000000003, 0x29, 0x7, 0x0, 0x401) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/platform/dummy_hcd.0/usb1/bConfigurationValue\x00', 0x63102, 0x0) sendfile$auto(r2, r2, 0x0, 0x2) preadv$auto(0x40000000000003, &(0x7f0000000100)={0x0, 0x7}, 0x5, 0x8, 0x1000) unshare$auto(0x40000080) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) openat$auto_media_devnode_fops_mc_devnode(0xffffffffffffff9c, &(0x7f0000000340)='/dev/media8\x00', 0xa000, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) setsockopt$auto(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x8002) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/maps\x00', 0x80400, 0x0) adjtimex$auto(&(0x7f0000000540)={0x72, 0x0, 0xff, 0xfffffffffffffffb, 0x1, 0x0, 0xfffffffe, 0x0, 0x3ffbffffffffff, 0x1, 0x4007, {0x200, 0x3}, 0x80, 0x80, 0x20000, 0x5, 0x0, 0x7fff, 0x9, 0x18d, 0x200, 0xa, 0x2015}) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 757.212531ms ago: executing program 0 (id=4814): syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000000040), 0xffffffffffffffff) ioctl$auto_TIOCGDEV2(0xffffffffffffffff, 0x80045432, 0x0) mmap$auto(0x6, 0x400025, 0x100040000df, 0x9b72, 0xffffffffffffffff, 0x8000) r0 = socket(0x5, 0x80000, 0x4) connect$auto(r0, &(0x7f00000000c0)=@generic={0x1d}, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x3, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x2020009, 0x8000000000000003, 0x13, 0xffffffffffffffff, 0x8000) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_genetlink_get_family_id$auto_nl80211(0x0, r0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/system/node/node1/hugepages/hugepages-1048576kB/demote_size\x00', 0x103a42, 0x0) sendfile$auto(r2, r2, 0x0, 0x7) landlock_create_ruleset$auto(&(0x7f0000000080)={0xd1d, 0xfff, 0x7}, 0x0, 0x400) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x5) sendmsg$auto_CTRL_CMD_GETPOLICY(r1, 0x0, 0x0) sendmsg$auto_SMC_NETLINK_REMOVE_UEID(0xffffffffffffffff, 0x0, 0x4040) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x3, 0xf6f3, 0x8001, 0x8000000008010, 0x3, 0x5) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x88000001}, 0x6, 0x3, 0xffffffffffffffff, 0x2e) ioctl$auto_BLKFLSBUF(r3, 0x1261, 0x0) openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, 0x0, 0x42, 0x0) mmap$auto(0x4, 0xa00006, 0x2, 0x100000000040eb1, 0x602, 0x300000000000) socket(0x15, 0x5, 0x0) prctl$auto(0x1, 0x2, 0x0, 0x3, 0x1f8f) unshare$auto(0x40000080) 715.325642ms ago: executing program 2 (id=4815): r0 = openat$auto_ep0_operations_inode(0xffffffffffffff9c, &(0x7f0000000000), 0x8a001, 0x0) write$auto(r0, &(0x7f0000000180)='k:\x1f\x8eF!D?B@\xa3\x86L\xd3=\x8e\xf9=y\xd7\tHB\xa9ngn\xa8\x86\xfcA.\xc4\x04\xd3\xe5J\xf9\xfasE\x85\xc3\x01\x11e\x90\x92\xcc\x82\xbb\x06\xe7Bg\x1b~\x9e\x05z\x10\xd7\"\xab\f\x1d\xcf\xa3\xee`M\xebhWp\xa4\xc5\x96\xd9\nD\x16X\f\x9e\xd4\x03z#\xef_G\xec\xba\r/\xc2\"A\x8e\x8fl\t\xc7_u\xed\xe6\xf0\x9bL\xc0L\xbb\xdd\x87\xb9W\xb5O}\xd3\xd3F\x0e\x9b\xc74\x13\xce1\xa5\x9fo\xdds\x90\xb5\xdc\x16\x02\xb1q\xc7\xee\x1b\x9d\xd5q\xa3&\xf7\xfb\xa1g\x10\xc6\xd2\x15', 0x60) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/001/001\x00', 0xa9202, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/platform/dummy_hcd.0/usb1/bConfigurationValue\x00', 0x63102, 0x0) sendfile$auto(r1, r1, 0x0, 0x2) preadv$auto(0x40000000000003, &(0x7f0000000100)={0x0, 0x7}, 0x5, 0x8, 0x1000) unshare$auto(0x40000080) unshare$auto(0x40000080) r2 = openat$auto_vsock_device_ops_af_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0xb950791d70c396ea, 0x0) ioctl$auto_IOCTL_VM_SOCKETS_GET_LOCAL_CID(r2, 0x7b9, 0x0) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) setsockopt$auto(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x8002) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/maps\x00', 0x80400, 0x0) adjtimex$auto(&(0x7f0000000540)={0x72, 0x0, 0xff, 0xfffffffffffffffb, 0x1, 0x0, 0xfffffffe, 0x0, 0x3ffbffffffffff, 0x1, 0x4007, {0x200, 0x3}, 0x80, 0x80, 0x20000, 0x5, 0x0, 0x7fff, 0x9, 0x18d, 0x200, 0xa, 0x2015}) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 140.154505ms ago: executing program 1 (id=4816): ioctl$auto_USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000140)={0x2, 0x80, 0xffff, 0x5, &(0x7f0000000240)='#', 0x4b47, 0x3, 0x4080005, @stream_id=0x7, 0x2004c, 0xc, 0x0, [{0xbb, 0x4, 0x800}, {0x80000, 0x9, 0x5}, {0x1, 0x400058dc, 0x101}]}) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) r0 = socket(0xa, 0x2, 0x73) getsockopt$auto_SO_TIMESTAMPNS_NEW(r0, 0x0, 0x40, 0x0, &(0x7f0000000240)=0x54) unshare$auto(0x40000080) unshare$auto(0x40000080) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) settimeofday$auto(&(0x7f0000000540)={0x5e, 0x1}, &(0x7f0000000580)={0x1, 0xdb36}) shmctl$auto_IPC_RMID(0x4, 0x0, &(0x7f0000000300)={{0x6, 0xffffffffffffffff, 0x0, 0x1, 0x80, 0x3, 0x8}, 0x9, 0x1ff, 0x9, 0x2, @raw=0x2, @inferred=0xffffffffffffffff, 0xfffe, 0x0, &(0x7f00000001c0)="5e96d4c4c9f11b902b31b587288ce68456d3372d700a0df0db", 0x0}) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @empty}, 0x51) shutdown$auto(0x200000003, 0x0) rseq$auto(0x0, 0x20, 0x0, 0x8000006) r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x16bd00, 0x0) pread64$auto(r1, 0x0, 0x100000001, 0x400000000000100) rseq$auto(0x0, 0x6, 0x8, 0x10) sendmsg$auto_NET_SHAPER_CMD_GROUP(0xffffffffffffffff, 0x0, 0x14) socket(0x1, 0x1, 0x1) close_range$auto(0x2, 0x8, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x37f) r2 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/scsi/sg/device_strs\x00', 0x80, 0x0) read$auto_proc_iter_file_ops_compat_inode(r2, &(0x7f0000000280)=""/238, 0xee) r3 = openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000200), 0x20880, 0x0) ioctl$auto_I2C_RDWR(r3, 0x707, &(0x7f0000000380)="cc854acb13") keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 0s ago: executing program 3 (id=4817): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) (async) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = io_uring_setup$auto(0x6, 0x0) epoll_pwait2$auto(r0, &(0x7f0000000000)={0xf, 0x7}, 0xf, &(0x7f0000000040)={0x6a, 0x5225}, &(0x7f0000000080)={0x6}, 0x8) (async) epoll_pwait2$auto(r0, &(0x7f0000000000)={0xf, 0x7}, 0xf, &(0x7f0000000040)={0x6a, 0x5225}, &(0x7f0000000080)={0x6}, 0x8) unshare$auto(0x40000080) (async) unshare$auto(0x40000080) unshare$auto(0x40000080) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) sendmsg$auto_MACSEC_CMD_UPD_TXSA(r0, &(0x7f00000013c0)={&(0x7f0000000240), 0xc, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x20001000) (async) sendmsg$auto_MACSEC_CMD_UPD_TXSA(r0, &(0x7f00000013c0)={&(0x7f0000000240), 0xc, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x20001000) unshare$auto(0x40000080) (async) unshare$auto(0x40000080) mmap$auto(0x0, 0x3ffffe, 0x7, 0x11, 0xdd, 0x0) r1 = socket(0x2, 0x3, 0x1) sendmsg$auto(r1, &(0x7f00000004c0)={&(0x7f0000000240), 0x40, &(0x7f0000000400)={0x0, 0x9}, 0x3, 0x0, 0x3063, 0x6}, 0x4) r2 = openat$auto_drm_crtc_crc_data_fops_drm_debugfs_crc(0xffffffffffffff9c, 0x0, 0x115200, 0x0) shmctl$auto_SHM_LOCK(0xe11d, 0xb, &(0x7f00000000c0)={{0x2, 0xee01, 0x0, 0x1, 0x7, 0x10000, 0x8}, 0x0, 0x9, 0x8, 0xfffffffffffffffe, @inferred, @raw=0x1, 0xe6, 0x0, &(0x7f0000000140)="5e762ec88e0a69936ce4f80eb0cf4d981ea2dc7788d49b2ce1049bf3862469dc22d5a065b9ae9c88c2eae108ea09065b024c97dccf71eb109af819d362b8f6f3ba0dd5feaf321cb983379fd88b8463b9f843013a9db50bee261416530a3455a8fbe4af2d540dec794fc99139e5dfc8c2f556c39037a6bc6b87ab224b0ef7b9db007b7cfc86a5fb04f10983d7a60b0e69df9f60fe4d61f3cfc15356de916376e6e932886f12990551238cb85c5d32ca507381161988", &(0x7f0000000380)="29c769ec6de3d4d56f1383fb698aff17ac547a64bd3d70a4bb1cecc0ee4dd22fd95fa035a25f3e2cd128d0e9c91840c5a792e78ed4ba60756b3cfe0800b3200178005f08f6a71da8f95708e15275c06dec23e34da96ddfc0fc66636c4cec85dcd9"}) (async) shmctl$auto_SHM_LOCK(0xe11d, 0xb, &(0x7f00000000c0)={{0x2, 0xee01, 0x0, 0x1, 0x7, 0x10000, 0x8}, 0x0, 0x9, 0x8, 0xfffffffffffffffe, @inferred, @raw=0x1, 0xe6, 0x0, &(0x7f0000000140)="5e762ec88e0a69936ce4f80eb0cf4d981ea2dc7788d49b2ce1049bf3862469dc22d5a065b9ae9c88c2eae108ea09065b024c97dccf71eb109af819d362b8f6f3ba0dd5feaf321cb983379fd88b8463b9f843013a9db50bee261416530a3455a8fbe4af2d540dec794fc99139e5dfc8c2f556c39037a6bc6b87ab224b0ef7b9db007b7cfc86a5fb04f10983d7a60b0e69df9f60fe4d61f3cfc15356de916376e6e932886f12990551238cb85c5d32ca507381161988", &(0x7f0000000380)="29c769ec6de3d4d56f1383fb698aff17ac547a64bd3d70a4bb1cecc0ee4dd22fd95fa035a25f3e2cd128d0e9c91840c5a792e78ed4ba60756b3cfe0800b3200178005f08f6a71da8f95708e15275c06dec23e34da96ddfc0fc66636c4cec85dcd9"}) bind$auto(r2, 0x0, 0x6) pselect6$auto(0x1, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$auto(0x4, 0x4020009, 0xdf, 0xeb1, r1, 0x8000) (async) mmap$auto(0x4, 0x4020009, 0xdf, 0xeb1, r1, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000300)='/dev/nullb0\x00', 0x14be02, 0x0) preadv2$auto(r3, 0x0, 0x6, 0x3, 0x4, 0x2a) (async) preadv2$auto(r3, 0x0, 0x6, 0x3, 0x4, 0x2a) mprotect$auto(0x1000, 0x401000, 0x4) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x40000080) unshare$auto(0x9) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) move_pages$auto(0x0, 0x8000, 0x0, 0x0, 0x0, 0x4) (async) move_pages$auto(0x0, 0x8000, 0x0, 0x0, 0x0, 0x4) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) (async) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) msgctl$auto_IPC_STAT(0x5f, 0x2, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/net/netfilter/nf_log\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): tl+0xd3/0x230 [ 2057.361048][ T5223] __x64_sys_ioctl+0xb7/0x210 [ 2057.361095][ T5223] do_syscall_64+0x121/0x770 [ 2057.361156][ T5223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2057.361193][ T5223] RIP: 0033:0x7fa87939e1d9 [ 2057.361222][ T5223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2057.361258][ T5223] RSP: 002b:00007fa87a184028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2057.361292][ T5223] RAX: ffffffffffffffda RBX: 00007fa879626450 RCX: 00007fa87939e1d9 [ 2057.361315][ T5223] RDX: 0000000000000f15 RSI: 0000000080045515 RDI: 0000000000000007 [ 2057.361338][ T5223] RBP: 00007fa879435888 R08: 0000000000000000 R09: 0000000000000000 [ 2057.361360][ T5223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2057.361382][ T5223] R13: 00007fa8796264e8 R14: 00007fa879626450 R15: 00007ffd76f623d8 [ 2057.361430][ T5223] [ 2057.591520][ T5223] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2060.797570][ T5293] FAULT_INJECTION: forcing a failure. [ 2060.797570][ T5293] name failslab, interval 1, probability 0, space 0, times 0 [ 2060.797619][ T5293] CPU: 1 UID: 0 PID: 5293 Comm: syz.2.3976 Tainted: G L syzkaller #0 PREEMPT(full) [ 2060.797662][ T5293] Tainted: [L]=SOFTLOCKUP [ 2060.797674][ T5293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2060.797694][ T5293] Call Trace: [ 2060.797705][ T5293] [ 2060.797722][ T5293] dump_stack_lvl+0x100/0x190 [ 2060.797772][ T5293] should_fail_ex.cold+0x5/0xa [ 2060.797813][ T5293] should_failslab+0xc2/0x120 [ 2060.797867][ T5293] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2060.797911][ T5293] ? __lock_acquire+0x5c0/0x1f40 [ 2060.797961][ T5293] ? sk_prot_alloc+0x60/0x2a0 [ 2060.798013][ T5293] sk_prot_alloc+0x60/0x2a0 [ 2060.798060][ T5293] sk_alloc+0x36/0xe80 [ 2060.798095][ T5293] __vsock_create.constprop.0+0x3c/0xb70 [ 2060.798142][ T5293] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2060.798196][ T5293] vsock_create+0x126/0x510 [ 2060.798246][ T5293] __sock_create+0x339/0x860 [ 2060.798316][ T5293] __sys_socket+0x14d/0x260 [ 2060.798363][ T5293] ? __pfx___sys_socket+0x10/0x10 [ 2060.798430][ T5293] __x64_sys_socket+0x72/0xb0 [ 2060.798474][ T5293] ? lockdep_hardirqs_on+0x7d/0x110 [ 2060.798521][ T5293] do_syscall_64+0x121/0x770 [ 2060.798571][ T5293] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2060.798603][ T5293] RIP: 0033:0x7fa87939e1d9 [ 2060.798629][ T5293] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2060.798659][ T5293] RSP: 002b:00007fa87a1a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2060.798690][ T5293] RAX: ffffffffffffffda RBX: 00007fa879626360 RCX: 00007fa87939e1d9 [ 2060.798710][ T5293] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2060.798728][ T5293] RBP: 00007fa879435888 R08: 0000000000000000 R09: 0000000000000000 [ 2060.798747][ T5293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2060.798765][ T5293] R13: 00007fa8796263f8 R14: 00007fa879626360 R15: 00007ffd76f623d8 [ 2060.798804][ T5293] [ 2061.047422][ T5294] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2064.654229][ T5370] FAULT_INJECTION: forcing a failure. [ 2064.654229][ T5370] name fail_futex, interval 1, probability 0, space 0, times 0 [ 2064.654273][ T5370] CPU: 1 UID: 0 PID: 5370 Comm: syz.0.3985 Tainted: G L syzkaller #0 PREEMPT(full) [ 2064.654314][ T5370] Tainted: [L]=SOFTLOCKUP [ 2064.654326][ T5370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2064.654345][ T5370] Call Trace: [ 2064.654355][ T5370] [ 2064.654367][ T5370] dump_stack_lvl+0x100/0x190 [ 2064.654414][ T5370] should_fail_ex.cold+0x5/0xa [ 2064.654455][ T5370] get_futex_key+0x1d0/0x14f0 [ 2064.654492][ T5370] ? __pfx_get_futex_key+0x10/0x10 [ 2064.654523][ T5370] ? findintfep+0x268/0x370 [ 2064.654579][ T5370] futex_wake+0xf4/0x5e0 [ 2064.654626][ T5370] ? __pfx_futex_wake+0x10/0x10 [ 2064.654670][ T5370] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2064.654718][ T5370] ? do_vfs_ioctl+0x226/0x13e0 [ 2064.654759][ T5370] do_futex+0x2b2/0x440 [ 2064.654795][ T5370] ? __pfx_do_futex+0x10/0x10 [ 2064.654828][ T5370] ? __fget_files+0x34/0x3d0 [ 2064.654870][ T5370] ? find_held_lock+0x2b/0x80 [ 2064.654911][ T5370] __x64_sys_futex+0x34f/0x4d0 [ 2064.654943][ T5370] ? __fget_files+0x21f/0x3d0 [ 2064.654979][ T5370] ? __pfx___x64_sys_futex+0x10/0x10 [ 2064.655021][ T5370] do_syscall_64+0x121/0x770 [ 2064.655068][ T5370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2064.655123][ T5370] RIP: 0033:0x7f55a5b9e1d9 [ 2064.655147][ T5370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2064.655175][ T5370] RSP: 002b:00007f55a6a880e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2064.655202][ T5370] RAX: ffffffffffffffda RBX: 00007f55a5e26458 RCX: 00007f55a5b9e1d9 [ 2064.655222][ T5370] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f55a5e2645c [ 2064.655240][ T5370] RBP: 00007f55a5e26450 R08: 0000000000000001 R09: 0000000000000000 [ 2064.655258][ T5370] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 2064.655276][ T5370] R13: 00007f55a5e264e8 R14: 00007ffed08ed940 R15: 00007ffed08eda28 [ 2064.655314][ T5370] [ 2066.386308][ T5382] ubi0: attaching mtd0 [ 2066.396243][ T5382] ubi0: scanning is finished [ 2066.405668][ T5400] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2066.650524][ T5382] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2066.650561][ T5382] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2066.650592][ T5382] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2066.650620][ T5382] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2066.650649][ T5382] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2066.651014][ T5382] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2066.654131][ T5382] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2066.654256][ T5382] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2066.681993][ T5407] ubi0: background thread "ubi_bgt0d" started, PID 5407 [ 2066.683837][ T5387] ubi0: detaching mtd0 [ 2066.805765][ T5387] ubi0: mtd0 is detached [ 2067.650286][ T5411] ubi0: attaching mtd0 [ 2067.663771][ T5411] ubi0: scanning is finished [ 2067.894529][ T5411] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2067.894562][ T5411] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2067.894586][ T5411] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2067.894609][ T5411] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2067.894632][ T5411] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2067.894654][ T5411] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2067.894678][ T5411] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2067.894706][ T5411] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2067.896296][ T5414] ubi0: background thread "ubi_bgt0d" started, PID 5414 [ 2067.896360][ T5410] ubi0: detaching mtd0 [ 2067.964561][ T5410] ubi0: mtd0 is detached [ 2069.029382][ T5424] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2069.029610][ T5424] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2069.029788][ T5424] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2069.029952][ T5424] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2071.022397][T31991] Bluetooth: hci0: command 0x0c1a tx timeout [ 2071.092399][T31991] Bluetooth: hci1: command 0x0c1a tx timeout [ 2071.102111][ T4934] Bluetooth: hci4: command 0x0c1a tx timeout [ 2071.102253][T31991] Bluetooth: hci2: command 0x040f tx timeout [ 2072.614219][ T5480] netlink: 'syz.3.4001': attribute type 1 has an invalid length. [ 2072.944579][ T5486] netlink: 'syz.1.4002': attribute type 1 has an invalid length. [ 2075.328148][ T5538] ubi0: attaching mtd0 [ 2075.331438][ T5538] ubi0: scanning is finished [ 2075.476497][ T5538] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2075.480237][ T5538] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2075.480269][ T5538] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2075.480298][ T5538] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2075.480317][ T5538] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2075.480338][ T5538] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2075.480358][ T5538] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2075.480409][ T5538] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2075.480501][ T5544] ubi0: background thread "ubi_bgt0d" started, PID 5544 [ 2075.551794][ T5541] ubi0: detaching mtd0 [ 2075.577711][ T5541] ubi0: mtd0 is detached [ 2078.972052][ T5585] netlink: 'syz.3.4014': attribute type 1 has an invalid length. [ 2079.105575][ T5588] FAULT_INJECTION: forcing a failure. [ 2079.105575][ T5588] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2079.105626][ T5588] CPU: 0 UID: 0 PID: 5588 Comm: syz.1.4015 Tainted: G L syzkaller #0 PREEMPT(full) [ 2079.105674][ T5588] Tainted: [L]=SOFTLOCKUP [ 2079.105687][ T5588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2079.105720][ T5588] Call Trace: [ 2079.105732][ T5588] [ 2079.105746][ T5588] dump_stack_lvl+0x100/0x190 [ 2079.105801][ T5588] should_fail_ex.cold+0x5/0xa [ 2079.105855][ T5588] _copy_to_user+0x32/0xd0 [ 2079.105914][ T5588] simple_read_from_buffer+0xcb/0x170 [ 2079.105971][ T5588] proc_fail_nth_read+0x1af/0x230 [ 2079.106019][ T5588] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2079.106067][ T5588] ? rw_verify_area+0xce/0x6d0 [ 2079.106107][ T5588] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2079.106152][ T5588] vfs_read+0x1e4/0xb40 [ 2079.106196][ T5588] ? lock_acquire+0x1d1/0x380 [ 2079.106247][ T5588] ? __fget_files+0x34/0x3d0 [ 2079.106293][ T5588] ? __pfx_vfs_read+0x10/0x10 [ 2079.106333][ T5588] ? find_held_lock+0x2b/0x80 [ 2079.106375][ T5588] ? __fget_files+0x215/0x3d0 [ 2079.106428][ T5588] ? __fget_files+0x21f/0x3d0 [ 2079.106486][ T5588] ksys_read+0x12a/0x250 [ 2079.106529][ T5588] ? __pfx_ksys_read+0x10/0x10 [ 2079.106594][ T5588] do_syscall_64+0x121/0x770 [ 2079.106648][ T5588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2079.106682][ T5588] RIP: 0033:0x7ffbf495ea0e [ 2079.106707][ T5588] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2079.106739][ T5588] RSP: 002b:00007ffbf2bb3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2079.106769][ T5588] RAX: ffffffffffffffda RBX: 00007ffbf2bb46c0 RCX: 00007ffbf495ea0e [ 2079.106808][ T5588] RDX: 000000000000000f RSI: 00007ffbf2bb40a0 RDI: 0000000000000005 [ 2079.106837][ T5588] RBP: 00007ffbf2bb4090 R08: 0000000000000000 R09: 0000000000000000 [ 2079.106858][ T5588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2079.106879][ T5588] R13: 00007ffbf4c263f8 R14: 00007ffbf4c26360 R15: 00007ffe2a17e288 [ 2079.106934][ T5588] [ 2082.120760][ T5652] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2082.981555][ T5669] block2mtd: device name too long [ 2084.771243][ T5695] netlink: 'syz.2.4027': attribute type 1 has an invalid length. [ 2087.641401][ T5726] Process accounting resumed [ 2089.359485][ T5782] db_root: cannot open: Òÿ [ 2090.537399][ T5795] ubi0: attaching mtd0 [ 2090.549198][ T5795] ubi0: scanning is finished [ 2090.710721][ T5809] FAULT_INJECTION: forcing a failure. [ 2090.710721][ T5809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2090.710772][ T5809] CPU: 1 UID: 0 PID: 5809 Comm: syz.3.4041 Tainted: G L syzkaller #0 PREEMPT(full) [ 2090.710827][ T5809] Tainted: [L]=SOFTLOCKUP [ 2090.710841][ T5809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2090.710860][ T5809] Call Trace: [ 2090.710872][ T5809] [ 2090.710886][ T5809] dump_stack_lvl+0x100/0x190 [ 2090.710941][ T5809] should_fail_ex.cold+0x5/0xa [ 2090.710987][ T5809] _copy_to_user+0x32/0xd0 [ 2090.711047][ T5809] simple_read_from_buffer+0xcb/0x170 [ 2090.711099][ T5809] proc_fail_nth_read+0x1af/0x230 [ 2090.711151][ T5809] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2090.711200][ T5809] ? rw_verify_area+0xce/0x6d0 [ 2090.711241][ T5809] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2090.711291][ T5809] vfs_read+0x1e4/0xb40 [ 2090.711336][ T5809] ? lock_acquire+0x1d1/0x380 [ 2090.711388][ T5809] ? __fget_files+0x34/0x3d0 [ 2090.711435][ T5809] ? __pfx_vfs_read+0x10/0x10 [ 2090.711475][ T5809] ? find_held_lock+0x2b/0x80 [ 2090.711518][ T5809] ? __fget_files+0x215/0x3d0 [ 2090.711572][ T5809] ? __fget_files+0x21f/0x3d0 [ 2090.711634][ T5809] ksys_read+0x12a/0x250 [ 2090.711671][ T5809] ? __pfx_ksys_read+0x10/0x10 [ 2090.711718][ T5809] do_syscall_64+0x121/0x770 [ 2090.711769][ T5809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2090.711801][ T5809] RIP: 0033:0x7fe4aa55ea0e [ 2090.711832][ T5809] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2090.711860][ T5809] RSP: 002b:00007fe4ab3fcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2090.711887][ T5809] RAX: ffffffffffffffda RBX: 00007fe4ab3fd6c0 RCX: 00007fe4aa55ea0e [ 2090.711906][ T5809] RDX: 000000000000000f RSI: 00007fe4ab3fd0a0 RDI: 0000000000000002 [ 2090.711924][ T5809] RBP: 00007fe4ab3fd090 R08: 0000000000000000 R09: 0000000000000000 [ 2090.711942][ T5809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2090.711960][ T5809] R13: 00007fe4aa8264e8 R14: 00007fe4aa826450 R15: 00007ffc5d500558 [ 2090.712000][ T5809] [ 2090.947611][ T5795] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2090.947644][ T5795] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2090.947669][ T5795] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2090.947693][ T5795] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2090.947717][ T5795] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2090.947740][ T5795] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2090.947764][ T5795] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2090.947790][ T5795] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2090.947906][ T5804] ubi0: detaching mtd0 [ 2090.975569][ T5810] netlink: 'syz.0.4040': attribute type 1 has an invalid length. [ 2091.047535][ T5804] ubi0: mtd0 is detached [ 2099.172715][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2099.172784][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2100.937999][ T5966] ubi0: attaching mtd0 [ 2100.951098][ T5966] ubi0: scanning is finished [ 2101.082088][ T5966] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2101.082122][ T5966] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2101.082150][ T5966] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2101.082176][ T5966] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2101.082202][ T5966] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2101.082224][ T5966] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2101.082253][ T5966] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2101.082276][ T5966] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2101.082345][ T5972] ubi0: background thread "ubi_bgt0d" started, PID 5972 [ 2101.106127][ T5968] ubi0: detaching mtd0 [ 2101.163415][ T5968] ubi0: mtd0 is detached [ 2103.694545][ T5989] FAULT_INJECTION: forcing a failure. [ 2103.694545][ T5989] name failslab, interval 1, probability 0, space 0, times 0 [ 2103.694591][ T5989] CPU: 0 UID: 0 PID: 5989 Comm: syz.2.4066 Tainted: G L syzkaller #0 PREEMPT(full) [ 2103.694630][ T5989] Tainted: [L]=SOFTLOCKUP [ 2103.694640][ T5989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2103.694659][ T5989] Call Trace: [ 2103.694668][ T5989] [ 2103.694680][ T5989] dump_stack_lvl+0x100/0x190 [ 2103.694733][ T5989] should_fail_ex.cold+0x5/0xa [ 2103.694773][ T5989] should_failslab+0xc2/0x120 [ 2103.694837][ T5989] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2103.694882][ T5989] ? __pmd_alloc+0xbf/0x950 [ 2103.694936][ T5989] __pmd_alloc+0xbf/0x950 [ 2103.694988][ T5989] __handle_mm_fault+0xa9d/0x2f60 [ 2103.695030][ T5989] ? __pfx___handle_mm_fault+0x10/0x10 [ 2103.695061][ T5989] ? __pfx_mt_find+0x10/0x10 [ 2103.695127][ T5989] ? find_vma+0xbf/0x140 [ 2103.695165][ T5989] ? __pfx_find_vma+0x10/0x10 [ 2103.695209][ T5989] handle_mm_fault+0x363/0xa20 [ 2103.695251][ T5989] do_user_addr_fault+0x745/0x12f0 [ 2103.695299][ T5989] exc_page_fault+0x6f/0xd0 [ 2103.695344][ T5989] asm_exc_page_fault+0x26/0x30 [ 2103.695374][ T5989] RIP: 0010:__get_user_8+0x14/0x40 [ 2103.695411][ T5989] Code: ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <48> 8b 10 31 c0 0f 01 ca c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 [ 2103.695440][ T5989] RSP: 0018:ffffc90005bb7c70 EFLAGS: 00050283 [ 2103.695464][ T5989] RAX: 0000000000000008 RBX: 0000000000000000 RCX: 0000000000000000 [ 2103.695481][ T5989] RDX: 00007ffffffff000 RSI: ffffffff8260f7c1 RDI: ffffffff8c625580 [ 2103.695502][ T5989] RBP: dffffc0000000000 R08: 0000000000071172 R09: 00000000000001d9 [ 2103.695520][ T5989] R10: 0000000000000200 R11: 0000000000000000 R12: ffffffff9202a860 [ 2103.695540][ T5989] R13: 0000000040106183 R14: ffffffff92025340 R15: ffff8880581b50c0 [ 2103.695572][ T5989] ? __might_fault+0x111/0x140 [ 2103.695609][ T5989] do_vcc_ioctl+0x63d/0x730 [ 2103.695644][ T5989] sock_do_ioctl+0x118/0x280 [ 2103.695684][ T5989] ? __pfx_sock_do_ioctl+0x10/0x10 [ 2103.695729][ T5989] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2103.695781][ T5989] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2103.695827][ T5989] sock_ioctl+0x599/0x6b0 [ 2103.695872][ T5989] ? __pfx_sock_ioctl+0x10/0x10 [ 2103.695923][ T5989] ? __fget_files+0x21f/0x3d0 [ 2103.695969][ T5989] ? __pfx_sock_ioctl+0x10/0x10 [ 2103.696015][ T5989] __x64_sys_ioctl+0x18e/0x210 [ 2103.696053][ T5989] do_syscall_64+0x121/0x770 [ 2103.696101][ T5989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2103.696132][ T5989] RIP: 0033:0x7fa87939e1d9 [ 2103.696156][ T5989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2103.696184][ T5989] RSP: 002b:00007fa87a229028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2103.696211][ T5989] RAX: ffffffffffffffda RBX: 00007fa879625fa0 RCX: 00007fa87939e1d9 [ 2103.696231][ T5989] RDX: 0000000000000000 RSI: 0000000040106183 RDI: 0000000000000003 [ 2103.696249][ T5989] RBP: 00007fa87a229090 R08: 0000000000000000 R09: 0000000000000000 [ 2103.696267][ T5989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2103.696285][ T5989] R13: 00007fa879626038 R14: 00007fa879625fa0 R15: 00007ffd76f623d8 [ 2103.696325][ T5989] [ 2104.546869][ T6007] netlink: 'syz.2.4068': attribute type 1 has an invalid length. [ 2106.373624][ T6042] netlink: 'syz.0.4072': attribute type 1 has an invalid length. [ 2107.212233][ T6056] ubi0: attaching mtd0 [ 2107.219160][ T6056] ubi0: scanning is finished [ 2107.447477][ T6056] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2107.447510][ T6056] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2107.447535][ T6056] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2107.447557][ T6056] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2107.447587][ T6056] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2107.447610][ T6056] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2107.447634][ T6056] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2107.447663][ T6056] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2107.447755][ T6058] ubi0: detaching mtd0 [ 2107.534684][ T6058] ubi0: mtd0 is detached [ 2112.114363][ T6127] ubi0: attaching mtd0 [ 2112.121905][ T6127] ubi0: scanning is finished [ 2112.248984][ T6127] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2112.249025][ T6127] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2112.249069][ T6127] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2112.249101][ T6127] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2112.249121][ T6127] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2112.249141][ T6127] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2112.249161][ T6127] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2112.249184][ T6127] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2112.249268][ T6130] ubi0: background thread "ubi_bgt0d" started, PID 6130 [ 2112.249359][ T6128] ubi0: detaching mtd0 [ 2112.342114][ T6128] ubi0: mtd0 is detached [ 2114.150043][ T6162] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2116.067956][ T6173] FAULT_INJECTION: forcing a failure. [ 2116.067956][ T6173] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2116.067988][ T6173] CPU: 1 UID: 0 PID: 6173 Comm: syz.1.4089 Tainted: G L syzkaller #0 PREEMPT(full) [ 2116.068016][ T6173] Tainted: [L]=SOFTLOCKUP [ 2116.068024][ T6173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2116.068036][ T6173] Call Trace: [ 2116.068044][ T6173] [ 2116.068052][ T6173] dump_stack_lvl+0x100/0x190 [ 2116.068085][ T6173] should_fail_ex.cold+0x5/0xa [ 2116.068112][ T6173] _copy_to_user+0x32/0xd0 [ 2116.068149][ T6173] simple_read_from_buffer+0xcb/0x170 [ 2116.068181][ T6173] proc_fail_nth_read+0x1af/0x230 [ 2116.068209][ T6173] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2116.068238][ T6173] ? rw_verify_area+0xce/0x6d0 [ 2116.068263][ T6173] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2116.068290][ T6173] vfs_read+0x1e4/0xb40 [ 2116.068324][ T6173] ? lock_acquire+0x1d1/0x380 [ 2116.068355][ T6173] ? __fget_files+0x34/0x3d0 [ 2116.068384][ T6173] ? __pfx_vfs_read+0x10/0x10 [ 2116.068409][ T6173] ? find_held_lock+0x2b/0x80 [ 2116.068435][ T6173] ? __fget_files+0x215/0x3d0 [ 2116.068467][ T6173] ? __fget_files+0x21f/0x3d0 [ 2116.068503][ T6173] ksys_read+0x12a/0x250 [ 2116.068529][ T6173] ? __pfx_ksys_read+0x10/0x10 [ 2116.068563][ T6173] do_syscall_64+0x121/0x770 [ 2116.068599][ T6173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2116.068625][ T6173] RIP: 0033:0x7ffbf495ea0e [ 2116.068642][ T6173] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2116.068662][ T6173] RSP: 002b:00007ffbf2b92fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2116.068682][ T6173] RAX: ffffffffffffffda RBX: 00007ffbf2b936c0 RCX: 00007ffbf495ea0e [ 2116.068696][ T6173] RDX: 000000000000000f RSI: 00007ffbf2b930a0 RDI: 0000000000000002 [ 2116.068709][ T6173] RBP: 00007ffbf2b93090 R08: 0000000000000000 R09: 0000000000000000 [ 2116.068722][ T6173] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2116.068735][ T6173] R13: 00007ffbf4c264e8 R14: 00007ffbf4c26450 R15: 00007ffe2a17e288 [ 2116.068763][ T6173] [ 2119.094174][ T6201] Process accounting paused [ 2119.557529][ T6254] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2121.150074][ T6274] FAULT_INJECTION: forcing a failure. [ 2121.150074][ T6274] name failslab, interval 1, probability 0, space 0, times 0 [ 2121.150120][ T6274] CPU: 0 UID: 0 PID: 6274 Comm: syz.0.4105 Tainted: G L syzkaller #0 PREEMPT(full) [ 2121.150161][ T6274] Tainted: [L]=SOFTLOCKUP [ 2121.150174][ T6274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2121.150193][ T6274] Call Trace: [ 2121.150203][ T6274] [ 2121.150216][ T6274] dump_stack_lvl+0x100/0x190 [ 2121.150267][ T6274] should_fail_ex.cold+0x5/0xa [ 2121.150318][ T6274] should_failslab+0xc2/0x120 [ 2121.150373][ T6274] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2121.150448][ T6274] ? do_raw_spin_lock+0x128/0x260 [ 2121.150503][ T6274] ? fasync_helper+0x3d/0xd0 [ 2121.150549][ T6274] fasync_helper+0x3d/0xd0 [ 2121.150591][ T6274] snd_fasync_helper+0x18b/0x230 [ 2121.150730][ T6274] ? __pfx_snd_ctl_fasync+0x10/0x10 [ 2121.150814][ T6274] do_vfs_ioctl+0xfb2/0x13e0 [ 2121.150856][ T6274] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2121.150917][ T6274] ? __fget_files+0x34/0x3d0 [ 2121.150967][ T6274] ? find_held_lock+0x2b/0x80 [ 2121.151007][ T6274] ? hook_file_ioctl_common+0x140/0x440 [ 2121.151061][ T6274] ? __fget_files+0x21f/0x3d0 [ 2121.151119][ T6274] __x64_sys_ioctl+0x114/0x210 [ 2121.151163][ T6274] do_syscall_64+0x121/0x770 [ 2121.151223][ T6274] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2121.151258][ T6274] RIP: 0033:0x7f55a5b9e1d9 [ 2121.151285][ T6274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2121.151326][ T6274] RSP: 002b:00007f55a6b2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2121.151358][ T6274] RAX: ffffffffffffffda RBX: 00007f55a5e25fa0 RCX: 00007f55a5b9e1d9 [ 2121.151380][ T6274] RDX: 0000200000000080 RSI: 0000000000005452 RDI: 0000000000000003 [ 2121.151401][ T6274] RBP: 00007f55a6b2d090 R08: 0000000000000000 R09: 0000000000000000 [ 2121.151422][ T6274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2121.151443][ T6274] R13: 00007f55a5e26038 R14: 00007f55a5e25fa0 R15: 00007ffed08eda28 [ 2121.151486][ T6274] [ 2123.468666][ T6331] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2124.991274][ T6354] FAULT_INJECTION: forcing a failure. [ 2124.991274][ T6354] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2124.991323][ T6354] CPU: 1 UID: 0 PID: 6354 Comm: syz.2.4112 Tainted: G L syzkaller #0 PREEMPT(full) [ 2124.991366][ T6354] Tainted: [L]=SOFTLOCKUP [ 2124.991379][ T6354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2124.991399][ T6354] Call Trace: [ 2124.991411][ T6354] [ 2124.991424][ T6354] dump_stack_lvl+0x100/0x190 [ 2124.991485][ T6354] should_fail_ex.cold+0x5/0xa [ 2124.991543][ T6354] _copy_to_user+0x32/0xd0 [ 2124.991608][ T6354] simple_read_from_buffer+0xcb/0x170 [ 2124.991652][ T6354] proc_fail_nth_read+0x1af/0x230 [ 2124.991692][ T6354] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2124.991734][ T6354] ? rw_verify_area+0xce/0x6d0 [ 2124.991767][ T6354] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2124.991807][ T6354] vfs_read+0x1e4/0xb40 [ 2124.991845][ T6354] ? lock_acquire+0x1d1/0x380 [ 2124.991889][ T6354] ? __fget_files+0x34/0x3d0 [ 2124.991929][ T6354] ? __pfx_vfs_read+0x10/0x10 [ 2124.991965][ T6354] ? find_held_lock+0x2b/0x80 [ 2124.992005][ T6354] ? __fget_files+0x215/0x3d0 [ 2124.992053][ T6354] ? __fget_files+0x21f/0x3d0 [ 2124.992104][ T6354] ksys_read+0x12a/0x250 [ 2124.992139][ T6354] ? __pfx_ksys_read+0x10/0x10 [ 2124.992188][ T6354] do_syscall_64+0x121/0x770 [ 2124.992238][ T6354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2124.992269][ T6354] RIP: 0033:0x7fa87935ea0e [ 2124.992294][ T6354] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2124.992322][ T6354] RSP: 002b:00007fa87a1a4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2124.992351][ T6354] RAX: ffffffffffffffda RBX: 00007fa87a1a56c0 RCX: 00007fa87935ea0e [ 2124.992371][ T6354] RDX: 000000000000000f RSI: 00007fa87a1a50a0 RDI: 0000000000000009 [ 2124.992389][ T6354] RBP: 00007fa87a1a5090 R08: 0000000000000000 R09: 0000000000000000 [ 2124.992407][ T6354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2124.992426][ T6354] R13: 00007fa8796263f8 R14: 00007fa879626360 R15: 00007ffd76f623d8 [ 2124.992474][ T6354] [ 2125.342104][ T6358] netlink: 'syz.3.4114': attribute type 1 has an invalid length. [ 2125.667146][ T4934] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2125.682616][ T4934] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2125.683331][ T4934] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2125.684242][ T4934] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2125.684867][ T4934] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2126.178508][ T3182] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2126.342755][ T3182] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2126.474764][ T3182] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2126.672403][ T3182] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2127.719524][ T3182] bridge_slave_1: left allmulticast mode [ 2127.719556][ T3182] bridge_slave_1: left promiscuous mode [ 2127.719788][ T3182] bridge0: port 2(bridge_slave_1) entered disabled state [ 2127.734731][ T3182] bridge_slave_0: left allmulticast mode [ 2127.734800][ T3182] bridge_slave_0: left promiscuous mode [ 2127.740433][ T3182] bridge0: port 1(bridge_slave_0) entered disabled state [ 2127.812848][T31991] Bluetooth: hci1: command tx timeout [ 2127.897532][ T3182] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2127.899943][ T3182] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2127.910345][ T3182] bond0 (unregistering): Released all slaves [ 2128.333846][ T6360] bridge0: port 1(bridge_slave_0) entered blocking state [ 2128.334005][ T6360] bridge0: port 1(bridge_slave_0) entered disabled state [ 2128.334133][ T6360] bridge_slave_0: entered allmulticast mode [ 2128.335927][ T6360] bridge_slave_0: entered promiscuous mode [ 2128.385088][ T6360] bridge0: port 2(bridge_slave_1) entered blocking state [ 2128.385191][ T6360] bridge0: port 2(bridge_slave_1) entered disabled state [ 2128.385320][ T6360] bridge_slave_1: entered allmulticast mode [ 2128.420702][ T6360] bridge_slave_1: entered promiscuous mode [ 2128.487128][ T3182] hsr_slave_0: left promiscuous mode [ 2128.487900][ T3182] hsr_slave_1: left promiscuous mode [ 2128.490900][ T3182] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2128.490927][ T3182] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2128.524498][ T3182] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2128.524523][ T3182] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2128.554072][ T3182] veth1_macvtap: left promiscuous mode [ 2128.554113][ T3182] veth0_macvtap: left promiscuous mode [ 2128.554216][ T3182] veth1_vlan: left promiscuous mode [ 2128.554368][ T3182] veth0_vlan: left promiscuous mode [ 2129.008515][ T6441] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2129.033928][ T3182] team0 (unregistering): Port device team_slave_1 removed [ 2129.063900][ T3182] team0 (unregistering): Port device team_slave_0 removed [ 2129.293860][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2129.309630][ T6360] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2129.324259][ T6360] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2129.415497][ T6360] team0: Port device team_slave_0 added [ 2129.461851][ T6360] team0: Port device team_slave_1 added [ 2129.612028][ T6360] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2129.612050][ T6360] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2129.612086][ T6360] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2129.694384][ T6360] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2129.694406][ T6360] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2129.694445][ T6360] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2129.902367][T31991] Bluetooth: hci1: command tx timeout [ 2130.026768][ T6360] hsr_slave_0: entered promiscuous mode [ 2130.027734][ T6360] hsr_slave_1: entered promiscuous mode [ 2130.652601][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2131.981320][T31991] Bluetooth: hci1: command tx timeout [ 2132.603875][ T6504] ubi0: attaching mtd0 [ 2132.605293][ T6504] ubi0: scanning is finished [ 2132.853856][ T6504] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2132.854110][ T6504] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2132.854139][ T6504] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2132.854206][ T6504] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2132.854230][ T6504] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2132.854254][ T6504] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2132.854279][ T6504] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2132.854308][ T6504] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2132.856605][ T6515] ubi0: background thread "ubi_bgt0d" started, PID 6515 [ 2132.857251][ T6507] ubi0: detaching mtd0 [ 2132.962239][ T6507] ubi0: mtd0 is detached [ 2134.052357][T31991] Bluetooth: hci1: command tx timeout [ 2134.071570][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 2135.530346][ T6360] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2135.555529][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2135.836456][ T6360] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2135.851892][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2136.277996][ T6360] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2136.301815][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2136.529435][ T6360] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2136.546431][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2138.716027][ T6612] ubi0: attaching mtd0 [ 2138.748690][ T6612] ubi0: scanning is finished [ 2138.980673][ T6612] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2138.980711][ T6612] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2138.980739][ T6612] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2138.980765][ T6612] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2138.980790][ T6612] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2138.980815][ T6612] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2138.980840][ T6612] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2138.980868][ T6612] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2138.981000][ T6620] ubi0: background thread "ubi_bgt0d" started, PID 6620 [ 2139.000452][ T6609] ubi0: detaching mtd0 [ 2139.080022][ T6609] ubi0: mtd0 is detached [ 2139.599673][ T6360] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2139.682034][ T6360] 8021q: adding VLAN 0 to HW filter on device team0 [ 2139.717778][ T3182] bridge0: port 1(bridge_slave_0) entered blocking state [ 2139.717887][ T3182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2139.752684][ T3386] bridge0: port 2(bridge_slave_1) entered blocking state [ 2139.752835][ T3386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2140.628011][ T6648] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(1917.0.2191123878), cmd(3) [ 2142.233156][ T6360] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2142.350592][ T6360] veth0_vlan: entered promiscuous mode [ 2142.377181][ T6360] veth1_vlan: entered promiscuous mode [ 2142.442374][ T6360] veth0_macvtap: entered promiscuous mode [ 2142.537307][ T6360] veth1_macvtap: entered promiscuous mode [ 2142.953044][ T6675] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2143.340297][ T6360] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2143.846930][ T6360] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2144.352481][ T3182] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2144.381602][ T1384] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2144.385198][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2144.385278][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2144.539730][ T3386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2144.539762][ T3386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2144.651832][ T3182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2144.651866][ T3182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2145.176216][ T6706] netlink: 'syz.2.4144': attribute type 1 has an invalid length. [ 2146.963182][ T6730] netlink: 'syz.1.4146': attribute type 1 has an invalid length. [ 2147.067965][ T6734] blktrace: Concurrent blktraces are not allowed on nbd5 [ 2147.380945][ T6739] hub 1-0:1.0: USB hub found [ 2147.390455][ T6739] hub 1-0:1.0: 1 port detected [ 2150.540113][ T6774] Process accounting resumed [ 2153.529894][ T6833] net_ratelimit: 23 callbacks suppressed [ 2153.529927][ T6833] openvswitch: netlink: IP tunnel dst address not specified [ 2153.731925][ T6843] netlink: 'syz.1.4163': attribute type 1 has an invalid length. [ 2156.878767][ T6892] hub 1-0:1.0: USB hub found [ 2156.879240][ T6892] hub 1-0:1.0: 1 port detected [ 2159.005725][ T6936] netlink: 'syz.2.4176': attribute type 1 has an invalid length. [ 2160.097010][ T6944] random: crng reseeded on system resumption [ 2160.264167][ T6953] hub 1-0:1.0: USB hub found [ 2160.264598][ T6953] hub 1-0:1.0: 1 port detected [ 2160.613032][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2160.613103][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2160.654386][ T6969] netlink: 'syz.3.4180': attribute type 1 has an invalid length. [ 2163.546836][ T7009] hub 1-0:1.0: USB hub found [ 2163.560294][ T7009] hub 1-0:1.0: 1 port detected [ 2164.037157][ T7019] ubi0: attaching mtd0 [ 2164.038974][ T7019] ubi0: scanning is finished [ 2164.234110][ T7019] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2164.234153][ T7019] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2164.234174][ T7019] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2164.234193][ T7019] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2164.234213][ T7019] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2164.234249][ T7019] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2164.234268][ T7019] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2164.234291][ T7019] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2164.234383][ T7034] ubi0: background thread "ubi_bgt0d" started, PID 7034 [ 2164.239231][ T7024] ubi0: detaching mtd0 [ 2164.357323][ T7024] ubi0: mtd0 is detached [ 2167.181604][ T7060] hub 1-0:1.0: USB hub found [ 2167.182039][ T7060] hub 1-0:1.0: 1 port detected [ 2168.357828][ T7048] kexec: Could not allocate control_code_buffer [ 2169.363130][ T7087] FAULT_INJECTION: forcing a failure. [ 2169.363130][ T7087] name failslab, interval 1, probability 0, space 0, times 0 [ 2169.363182][ T7087] CPU: 1 UID: 0 PID: 7087 Comm: syz.3.4199 Tainted: G L syzkaller #0 PREEMPT(full) [ 2169.363227][ T7087] Tainted: [L]=SOFTLOCKUP [ 2169.363240][ T7087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2169.363261][ T7087] Call Trace: [ 2169.363282][ T7087] [ 2169.363296][ T7087] dump_stack_lvl+0x100/0x190 [ 2169.363354][ T7087] should_fail_ex.cold+0x5/0xa [ 2169.363401][ T7087] should_failslab+0xc2/0x120 [ 2169.363459][ T7087] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2169.363510][ T7087] ? do_fanotify_mark+0x2bd1/0x3dc0 [ 2169.363571][ T7087] do_fanotify_mark+0x2bd1/0x3dc0 [ 2169.363641][ T7087] ? __pfx_do_fanotify_mark+0x10/0x10 [ 2169.363705][ T7087] ? ksys_write+0x1ac/0x250 [ 2169.363751][ T7087] ? __pfx_ksys_write+0x10/0x10 [ 2169.363809][ T7087] __x64_sys_fanotify_mark+0xbd/0x160 [ 2169.363860][ T7087] ? do_syscall_64+0xae/0x770 [ 2169.363915][ T7087] ? lockdep_hardirqs_on+0x7d/0x110 [ 2169.363969][ T7087] do_syscall_64+0x121/0x770 [ 2169.364027][ T7087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2169.364064][ T7087] RIP: 0033:0x7fe4aa59e1d9 [ 2169.364094][ T7087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2169.364129][ T7087] RSP: 002b:00007fe4ab4a2028 EFLAGS: 00000246 ORIG_RAX: 000000000000012d [ 2169.364162][ T7087] RAX: ffffffffffffffda RBX: 00007fe4aa825fa0 RCX: 00007fe4aa59e1d9 [ 2169.364185][ T7087] RDX: 0000000000000009 RSI: 0000000000000065 RDI: 0001000000000000 [ 2169.364207][ T7087] RBP: 00007fe4ab4a2090 R08: 0000000000000000 R09: 0000000000000000 [ 2169.364229][ T7087] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 2169.364250][ T7087] R13: 00007fe4aa826038 R14: 00007fe4aa825fa0 R15: 00007ffc5d500558 [ 2169.364304][ T7087] [ 2170.336940][ T7101] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2170.827213][ T7115] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2170.839149][ T7114] netlink: 'syz.0.4202': attribute type 1 has an invalid length. [ 2173.328748][ T7151] ubi0: attaching mtd0 [ 2173.341367][ T7151] ubi0: scanning is finished [ 2173.531911][ T7151] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2173.531954][ T7151] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2173.531985][ T7151] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2173.532012][ T7151] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2173.537379][ T7151] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2173.537413][ T7151] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2173.537441][ T7151] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2173.537475][ T7151] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2173.537566][ T7150] ubi0: detaching mtd0 [ 2173.625829][ T7150] ubi0: mtd0 is detached [ 2177.233387][ T7208] netlink: 'syz.0.4215': attribute type 1 has an invalid length. [ 2177.874640][ T1069] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2178.258286][ T1069] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2178.437807][ T4934] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2178.450878][ T4934] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2178.464880][ T4934] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2178.465948][ T4934] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2178.466683][ T4934] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2178.686676][ T1069] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2178.837786][ T1069] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2179.607324][ T7248] netlink: 'syz.0.4218': attribute type 1 has an invalid length. [ 2180.409371][ T7265] IPVS: length: 8 != 13944 [ 2180.437724][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2180.611669][ T4934] Bluetooth: hci2: command tx timeout [ 2180.731057][ T1069] bridge_slave_1: left allmulticast mode [ 2180.731098][ T1069] bridge_slave_1: left promiscuous mode [ 2180.731997][ T1069] bridge0: port 2(bridge_slave_1) entered disabled state [ 2180.749922][ T1069] bridge_slave_0: left allmulticast mode [ 2180.750022][ T1069] bridge_slave_0: left promiscuous mode [ 2180.750722][ T1069] bridge0: port 1(bridge_slave_0) entered disabled state [ 2180.937681][ T1069] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2180.940058][ T1069] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2180.956680][ T1069] bond0 (unregistering): Released all slaves [ 2181.419742][ T7238] Process accounting paused [ 2181.567817][ T1069] hsr_slave_0: left promiscuous mode [ 2181.568643][ T1069] hsr_slave_1: left promiscuous mode [ 2181.569685][ T1069] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2181.569715][ T1069] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2181.602437][ T1069] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2181.602475][ T1069] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2181.644250][ T1069] veth1_macvtap: left promiscuous mode [ 2181.644301][ T1069] veth0_macvtap: left promiscuous mode [ 2181.644426][ T1069] veth1_vlan: left promiscuous mode [ 2181.644511][ T1069] veth0_vlan: left promiscuous mode [ 2182.187174][ T1069] team0 (unregistering): Port device team_slave_1 removed [ 2182.224326][ T1069] team0 (unregistering): Port device team_slave_0 removed [ 2182.602975][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2182.691248][ T4934] Bluetooth: hci2: command tx timeout [ 2183.494385][ T7212] bridge0: port 1(bridge_slave_0) entered blocking state [ 2183.494588][ T7212] bridge0: port 1(bridge_slave_0) entered disabled state [ 2183.494819][ T7212] bridge_slave_0: entered allmulticast mode [ 2183.497135][ T7212] bridge_slave_0: entered promiscuous mode [ 2183.530326][ T7212] bridge0: port 2(bridge_slave_1) entered blocking state [ 2183.530459][ T7212] bridge0: port 2(bridge_slave_1) entered disabled state [ 2183.530615][ T7212] bridge_slave_1: entered allmulticast mode [ 2183.557341][ T7212] bridge_slave_1: entered promiscuous mode [ 2184.393977][ T7212] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2184.400348][ T7212] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2184.508353][ T5278] 8021q: adding VLAN 0 to HW filter on device eth3 [ 2184.554489][ T7212] team0: Port device team_slave_0 added [ 2184.622727][ T7212] team0: Port device team_slave_1 added [ 2184.739912][ T7212] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2184.739940][ T7212] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2184.739983][ T7212] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2184.775630][ T4934] Bluetooth: hci2: command tx timeout [ 2184.847384][ T7212] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2184.847411][ T7212] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2184.847453][ T7212] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2185.284862][ T7212] hsr_slave_0: entered promiscuous mode [ 2185.285915][ T7212] hsr_slave_1: entered promiscuous mode [ 2185.286744][ T7212] debugfs: 'hsr0' already exists in 'hsr' [ 2185.286774][ T7212] Cannot create hsr debugfs directory [ 2185.900446][ T5278] 8021q: adding VLAN 0 to HW filter on device eth4 [ 2186.851478][ T4934] Bluetooth: hci2: command tx timeout [ 2189.596915][ T7212] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2189.610824][ T7212] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2189.619364][ T7212] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2189.641707][ T7212] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2189.828496][ T7212] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2189.841844][ T7212] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2189.901203][ T7212] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2189.923799][ T7212] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2192.377772][ T7212] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2192.903060][ T7212] 8021q: adding VLAN 0 to HW filter on device team0 [ 2193.447352][T18452] bridge0: port 1(bridge_slave_0) entered blocking state [ 2193.447486][T18452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2193.659124][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 2193.659255][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2194.886253][ T7581] ubi0: attaching mtd0 [ 2194.910346][ T7581] ubi0: scanning is finished [ 2195.211436][ T7581] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2195.211475][ T7581] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2195.211505][ T7581] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2195.211532][ T7581] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2195.211573][ T7581] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2195.211601][ T7581] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2195.211627][ T7581] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2195.211661][ T7581] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2195.211768][ T7594] ubi0: background thread "ubi_bgt0d" started, PID 7594 [ 2195.211907][ T7578] ubi0: detaching mtd0 [ 2195.316163][ T7578] ubi0: mtd0 is detached [ 2196.508740][ T7212] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2197.934024][ T7212] veth0_vlan: entered promiscuous mode [ 2198.856408][ T7212] veth1_vlan: entered promiscuous mode [ 2199.732919][ T7212] veth0_macvtap: entered promiscuous mode [ 2199.872079][ T7212] veth1_macvtap: entered promiscuous mode [ 2200.566250][ T7212] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2200.700101][ T7212] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2201.555489][ T3182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2201.555520][ T3182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2201.633928][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2201.633998][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2201.634054][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2201.634111][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2202.013466][ T3386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2202.013496][ T3386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2208.495576][ T7773] sd 0:0:1:0: PR command failed: 1026 [ 2208.495705][ T7773] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 2208.495795][ T7773] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 2209.801189][ T7780] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2209.816091][ T7780] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2209.817226][ T7780] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2209.818737][ T25] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2209.820330][ T7780] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2210.813048][ T7810] Line length is too long: Should be less than 4094 [ 2211.619545][ T7794] Process accounting resumed [ 2211.913828][ T7820] FAULT_INJECTION: forcing a failure. [ 2211.913828][ T7820] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2211.913879][ T7820] CPU: 0 UID: 0 PID: 7820 Comm: syz.3.4273 Tainted: G L syzkaller #0 PREEMPT(full) [ 2211.913935][ T7820] Tainted: [L]=SOFTLOCKUP [ 2211.913948][ T7820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2211.913970][ T7820] Call Trace: [ 2211.913982][ T7820] [ 2211.913996][ T7820] dump_stack_lvl+0x100/0x190 [ 2211.914050][ T7820] should_fail_ex.cold+0x5/0xa [ 2211.914089][ T7820] ? prepare_alloc_pages+0x16d/0x5b0 [ 2211.914149][ T7820] should_fail_alloc_page+0xeb/0x140 [ 2211.914205][ T7820] prepare_alloc_pages+0x1f0/0x5b0 [ 2211.914274][ T7820] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 2211.914327][ T7820] ? lock_acquire+0x1d1/0x380 [ 2211.914379][ T7820] ? is_bpf_text_address+0x25/0x1a0 [ 2211.914438][ T7820] ? find_held_lock+0x2b/0x80 [ 2211.914478][ T7820] ? is_bpf_text_address+0x8a/0x1a0 [ 2211.914531][ T7820] ? is_bpf_text_address+0x8a/0x1a0 [ 2211.914585][ T7820] ? bpf_ksym_find+0x124/0x1c0 [ 2211.914627][ T7820] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2211.914681][ T7820] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2211.914729][ T7820] ? kernel_text_address+0x8d/0x100 [ 2211.914776][ T7820] ? __kernel_text_address+0xd/0x30 [ 2211.914820][ T7820] ? unwind_get_return_address+0x59/0xa0 [ 2211.914872][ T7820] ? __lock_acquire+0x5c0/0x1f40 [ 2211.914939][ T7820] ? tomoyo_check_open_permission+0x1a2/0x3c0 [ 2211.914987][ T7820] ? look_up_lock_class+0x55/0x120 [ 2211.915040][ T7820] ? vma_is_special_huge+0x23f/0x2d0 [ 2211.915096][ T7820] ? __pfx_vma_is_special_huge+0x10/0x10 [ 2211.915152][ T7820] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2211.915209][ T7820] ? policy_nodemask+0xed/0x4f0 [ 2211.915269][ T7820] alloc_pages_mpol+0x201/0x550 [ 2211.915306][ T7820] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2211.915368][ T7820] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 2211.915415][ T7820] alloc_pages_noprof+0x1a/0x160 [ 2211.915469][ T7820] __pmd_alloc+0x3b/0x950 [ 2211.915525][ T7820] __handle_mm_fault+0xa9d/0x2f60 [ 2211.915572][ T7820] ? __pfx___handle_mm_fault+0x10/0x10 [ 2211.915606][ T7820] ? __pfx_mt_find+0x10/0x10 [ 2211.915665][ T7820] ? find_vma+0xbf/0x140 [ 2211.915709][ T7820] ? __pfx_find_vma+0x10/0x10 [ 2211.915760][ T7820] handle_mm_fault+0x363/0xa20 [ 2211.915805][ T7820] do_user_addr_fault+0x745/0x12f0 [ 2211.915857][ T7820] exc_page_fault+0x6f/0xd0 [ 2211.915914][ T7820] asm_exc_page_fault+0x26/0x30 [ 2211.915948][ T7820] RIP: 0010:rep_movs_alternative+0x30/0xa0 [ 2211.915990][ T7820] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 2211.916022][ T7820] RSP: 0018:ffffc90004b479e8 EFLAGS: 00050212 [ 2211.916050][ T7820] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000024 [ 2211.916071][ T7820] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90004b47a78 [ 2211.916092][ T7820] RBP: 0000000000000024 R08: 0000000000000001 R09: fffff52000968f53 [ 2211.916113][ T7820] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 2211.916133][ T7820] R13: ffffc90004b47a78 R14: 0000000000000000 R15: 0000000000007111 [ 2211.916177][ T7820] _copy_from_user+0x98/0xd0 [ 2211.916234][ T7820] sg_write+0x2af/0xdb0 [ 2211.916273][ T7820] ? aa_file_perm+0x7f3/0x14d0 [ 2211.916322][ T7820] ? __pfx_sg_write+0x10/0x10 [ 2211.916355][ T7820] ? _kstrtoull+0x144/0x200 [ 2211.916399][ T7820] ? __pfx_aa_file_perm+0x10/0x10 [ 2211.916445][ T7820] ? lock_acquire+0x1d1/0x380 [ 2211.916494][ T7820] ? __might_fault+0xc5/0x140 [ 2211.916565][ T7820] ? bpf_lsm_file_permission+0x9/0x10 [ 2211.916619][ T7820] ? security_file_permission+0x76/0x210 [ 2211.916664][ T7820] ? rw_verify_area+0xce/0x6d0 [ 2211.916705][ T7820] ? __pfx_sg_write+0x10/0x10 [ 2211.916738][ T7820] vfs_writev+0x5ed/0xdd0 [ 2211.916790][ T7820] ? __pfx_vfs_writev+0x10/0x10 [ 2211.916839][ T7820] ? lock_acquire+0x1d1/0x380 [ 2211.916888][ T7820] ? __fget_files+0x34/0x3d0 [ 2211.916956][ T7820] ? __fget_files+0x21f/0x3d0 [ 2211.917013][ T7820] ? do_writev+0x13e/0x340 [ 2211.917049][ T7820] do_writev+0x13e/0x340 [ 2211.917091][ T7820] ? __pfx_do_writev+0x10/0x10 [ 2211.917145][ T7820] do_syscall_64+0x121/0x770 [ 2211.917201][ T7820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2211.917236][ T7820] RIP: 0033:0x7fe4aa59e1d9 [ 2211.917263][ T7820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2211.917295][ T7820] RSP: 002b:00007fe4ab4a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 2211.917325][ T7820] RAX: ffffffffffffffda RBX: 00007fe4aa825fa0 RCX: 00007fe4aa59e1d9 [ 2211.917348][ T7820] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000003 [ 2211.917368][ T7820] RBP: 00007fe4ab4a2090 R08: 0000000000000000 R09: 0000000000000000 [ 2211.917389][ T7820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2211.917410][ T7820] R13: 00007fe4aa826038 R14: 00007fe4aa825fa0 R15: 00007ffc5d500558 [ 2211.917450][ T7820] [ 2212.604897][ T7837] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2213.520625][ T7846] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2213.525812][ T7846] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2213.528904][ T7846] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2213.533410][ T987] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2213.535243][ T7846] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 2217.442637][ T7904] hub 1-0:1.0: USB hub found [ 2217.452689][ T7904] hub 1-0:1.0: 1 port detected [ 2221.308015][ T7976] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[6360] was attempted by "ci-qemu-gce-upstream-auto/syz-executor exec"[7976] [ 2222.007439][ T7982] ubi0: attaching mtd0 [ 2222.016072][ T7982] ubi0: scanning is finished [ 2222.053522][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2222.053587][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2222.250809][ T7982] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2222.250848][ T7982] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2222.250869][ T7982] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2222.250888][ T7982] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2222.250909][ T7982] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2222.250928][ T7982] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2222.250949][ T7982] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2222.250972][ T7982] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2222.251674][ T7985] ubi0: background thread "ubi_bgt0d" started, PID 7985 [ 2222.252787][ T7981] ubi: mtd0 is already attached to ubi0 [ 2222.253023][ T7983] ubi0: detaching mtd0 [ 2222.350448][ T7983] ubi0: mtd0 is detached [ 2223.545792][ T8005] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2226.595737][ T8025] FAULT_INJECTION: forcing a failure. [ 2226.595737][ T8025] name fail_futex, interval 1, probability 0, space 0, times 0 [ 2226.595793][ T8025] CPU: 1 UID: 0 PID: 8025 Comm: syz.0.4301 Tainted: G L syzkaller #0 PREEMPT(full) [ 2226.595843][ T8025] Tainted: [L]=SOFTLOCKUP [ 2226.595856][ T8025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2226.595878][ T8025] Call Trace: [ 2226.595891][ T8025] [ 2226.595905][ T8025] dump_stack_lvl+0x100/0x190 [ 2226.595964][ T8025] should_fail_ex.cold+0x5/0xa [ 2226.596010][ T8025] get_futex_key+0x1d0/0x14f0 [ 2226.596054][ T8025] ? __pfx_get_futex_key+0x10/0x10 [ 2226.596092][ T8025] ? __destroy_inode+0x2cd/0x710 [ 2226.596139][ T8025] ? __pfx_sock_free_inode+0x10/0x10 [ 2226.596190][ T8025] ? destroy_inode+0x139/0x1c0 [ 2226.596231][ T8025] futex_wake+0xf4/0x5e0 [ 2226.596279][ T8025] ? lock_acquire+0x1d1/0x380 [ 2226.596336][ T8025] ? __pfx_futex_wake+0x10/0x10 [ 2226.596385][ T8025] ? iput.part.0+0x981/0x1050 [ 2226.596436][ T8025] do_futex+0x2b2/0x440 [ 2226.596478][ T8025] ? __pfx_do_futex+0x10/0x10 [ 2226.596514][ T8025] ? iput+0x3a/0x40 [ 2226.596546][ T8025] ? __sock_release+0x184/0x260 [ 2226.596597][ T8025] __x64_sys_futex+0x34f/0x4d0 [ 2226.596639][ T8025] ? __sys_socket+0xac/0x260 [ 2226.596690][ T8025] ? kernel_mbind+0x118/0x200 [ 2226.596733][ T8025] ? __pfx___x64_sys_futex+0x10/0x10 [ 2226.596775][ T8025] ? __pfx_kernel_mbind+0x10/0x10 [ 2226.596815][ T8025] ? kcov_ioctl+0x17a/0x760 [ 2226.596880][ T8025] do_syscall_64+0x121/0x770 [ 2226.596941][ T8025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2226.596979][ T8025] RIP: 0033:0x7f46c8f9e1d9 [ 2226.597008][ T8025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2226.597041][ T8025] RSP: 002b:00007f46c9db40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2226.597075][ T8025] RAX: ffffffffffffffda RBX: 00007f46c9226458 RCX: 00007f46c8f9e1d9 [ 2226.597099][ T8025] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f46c922645c [ 2226.597134][ T8025] RBP: 00007f46c9226450 R08: 0000000000000001 R09: 0000000000000000 [ 2226.597157][ T8025] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 2226.597180][ T8025] R13: 00007f46c92264e8 R14: 00007fff42550e60 R15: 00007fff42550f48 [ 2226.597224][ T8025] [ 2228.208453][ T8048] netlink: 'syz.1.4304': attribute type 1 has an invalid length. [ 2230.145701][ T8070] netlink: 'syz.3.4307': attribute type 1 has an invalid length. [ 2232.807793][ T8119] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2236.452399][ T8180] FAULT_INJECTION: forcing a failure. [ 2236.452399][ T8180] name failslab, interval 1, probability 0, space 0, times 0 [ 2236.452452][ T8180] CPU: 0 UID: 0 PID: 8180 Comm: syz.0.4322 Tainted: G L syzkaller #0 PREEMPT(full) [ 2236.452499][ T8180] Tainted: [L]=SOFTLOCKUP [ 2236.452513][ T8180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2236.452533][ T8180] Call Trace: [ 2236.452546][ T8180] [ 2236.452559][ T8180] dump_stack_lvl+0x100/0x190 [ 2236.452616][ T8180] should_fail_ex.cold+0x5/0xa [ 2236.452663][ T8180] should_failslab+0xc2/0x120 [ 2236.452720][ T8180] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2236.452769][ T8180] ? __lock_acquire+0x5c0/0x1f40 [ 2236.452823][ T8180] ? sk_prot_alloc+0x60/0x2a0 [ 2236.452881][ T8180] sk_prot_alloc+0x60/0x2a0 [ 2236.452943][ T8180] sk_alloc+0x36/0xe80 [ 2236.452981][ T8180] __vsock_create.constprop.0+0x3c/0xb70 [ 2236.453031][ T8180] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2236.453090][ T8180] vsock_create+0x126/0x510 [ 2236.453145][ T8180] __sock_create+0x339/0x860 [ 2236.453203][ T8180] __sys_socket+0x14d/0x260 [ 2236.453257][ T8180] ? __pfx___sys_socket+0x10/0x10 [ 2236.453322][ T8180] __x64_sys_socket+0x72/0xb0 [ 2236.453371][ T8180] ? lockdep_hardirqs_on+0x7d/0x110 [ 2236.453425][ T8180] do_syscall_64+0x121/0x770 [ 2236.453486][ T8180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2236.453524][ T8180] RIP: 0033:0x7f46c8f9e1d9 [ 2236.453554][ T8180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2236.453590][ T8180] RSP: 002b:00007f46c9dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2236.453624][ T8180] RAX: ffffffffffffffda RBX: 00007f46c9226360 RCX: 00007f46c8f9e1d9 [ 2236.453650][ T8180] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2236.453673][ T8180] RBP: 00007f46c9035888 R08: 0000000000000000 R09: 0000000000000000 [ 2236.453697][ T8180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2236.453719][ T8180] R13: 00007f46c92263f8 R14: 00007f46c9226360 R15: 00007fff42550f48 [ 2236.453768][ T8180] [ 2236.454030][ T8179] netlink: 'syz.2.4319': attribute type 1 has an invalid length. [ 2238.470034][ T8188] ubi0: attaching mtd0 [ 2238.482825][ T8188] ubi0: scanning is finished [ 2238.777729][ T8188] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2238.777767][ T8188] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2238.777937][ T8188] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2238.777968][ T8188] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2238.777996][ T8188] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2238.778024][ T8188] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2238.778051][ T8188] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2238.778084][ T8188] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2238.780230][ T8213] ubi0: background thread "ubi_bgt0d" started, PID 8213 [ 2238.831984][ T8197] ubi: mtd0 is already attached to ubi0 [ 2238.839428][ T8193] ubi0: detaching mtd0 [ 2238.905532][ T8193] ubi0: mtd0 is detached [ 2243.045242][ T8215] Process accounting paused [ 2244.598040][ T8272] netlink: 'syz.0.4333': attribute type 1 has an invalid length. [ 2245.022464][ T8269] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 2246.609865][ T8296] FAULT_INJECTION: forcing a failure. [ 2246.609865][ T8296] name failslab, interval 1, probability 0, space 0, times 0 [ 2246.609919][ T8296] CPU: 1 UID: 0 PID: 8296 Comm: syz.0.4336 Tainted: G L syzkaller #0 PREEMPT(full) [ 2246.609967][ T8296] Tainted: [L]=SOFTLOCKUP [ 2246.609981][ T8296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2246.610003][ T8296] Call Trace: [ 2246.610015][ T8296] [ 2246.610030][ T8296] dump_stack_lvl+0x100/0x190 [ 2246.610086][ T8296] should_fail_ex.cold+0x5/0xa [ 2246.610134][ T8296] should_failslab+0xc2/0x120 [ 2246.610191][ T8296] kmem_cache_alloc_noprof+0x92/0x6a0 [ 2246.610239][ T8296] ? __lock_acquire+0x5c0/0x1f40 [ 2246.610294][ T8296] ? sk_prot_alloc+0x60/0x2a0 [ 2246.610353][ T8296] sk_prot_alloc+0x60/0x2a0 [ 2246.610404][ T8296] sk_alloc+0x36/0xe80 [ 2246.610446][ T8296] __vsock_create.constprop.0+0x3c/0xb70 [ 2246.610496][ T8296] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2246.610563][ T8296] vsock_create+0x126/0x510 [ 2246.610619][ T8296] __sock_create+0x339/0x860 [ 2246.610677][ T8296] __sys_socket+0x14d/0x260 [ 2246.610731][ T8296] ? __pfx___sys_socket+0x10/0x10 [ 2246.610796][ T8296] __x64_sys_socket+0x72/0xb0 [ 2246.610848][ T8296] ? lockdep_hardirqs_on+0x7d/0x110 [ 2246.610905][ T8296] do_syscall_64+0x121/0x770 [ 2246.610960][ T8296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2246.611005][ T8296] RIP: 0033:0x7f46c8f9e1d9 [ 2246.611033][ T8296] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2246.611068][ T8296] RSP: 002b:00007f46c9dd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2246.611100][ T8296] RAX: ffffffffffffffda RBX: 00007f46c9226360 RCX: 00007f46c8f9e1d9 [ 2246.611124][ T8296] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2246.611145][ T8296] RBP: 00007f46c9035888 R08: 0000000000000000 R09: 0000000000000000 [ 2246.611166][ T8296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2246.611187][ T8296] R13: 00007f46c92263f8 R14: 00007f46c9226360 R15: 00007fff42550f48 [ 2246.611239][ T8296] [ 2246.739657][ T8295] netlink: 'syz.2.4343': attribute type 1 has an invalid length. [ 2248.777511][ T8329] FAULT_INJECTION: forcing a failure. [ 2248.777511][ T8329] name failslab, interval 1, probability 0, space 0, times 0 [ 2248.777571][ T8329] CPU: 1 UID: 0 PID: 8329 Comm: syz.2.4338 Tainted: G L syzkaller #0 PREEMPT(full) [ 2248.777622][ T8329] Tainted: [L]=SOFTLOCKUP [ 2248.777637][ T8329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2248.777659][ T8329] Call Trace: [ 2248.777673][ T8329] [ 2248.777688][ T8329] dump_stack_lvl+0x100/0x190 [ 2248.777748][ T8329] should_fail_ex.cold+0x5/0xa [ 2248.777797][ T8329] should_failslab+0xc2/0x120 [ 2248.777854][ T8329] __kmalloc_noprof+0xfc/0x840 [ 2248.777900][ T8329] ? rcu_is_watching+0x13/0xc0 [ 2248.777941][ T8329] ? tomoyo_realpath_from_path+0xb6/0x690 [ 2248.778014][ T8329] tomoyo_realpath_from_path+0xb6/0x690 [ 2248.778075][ T8329] tomoyo_path_number_perm+0x23c/0x580 [ 2248.778123][ T8329] ? tomoyo_path_number_perm+0x22e/0x580 [ 2248.778167][ T8329] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2248.778222][ T8329] ? __pfx_futex_wait+0x10/0x10 [ 2248.778286][ T8329] ? __lock_acquire+0x5c0/0x1f40 [ 2248.778369][ T8329] ? __fget_files+0x34/0x3d0 [ 2248.778419][ T8329] ? find_held_lock+0x2b/0x80 [ 2248.778466][ T8329] ? hook_file_ioctl_common+0x140/0x440 [ 2248.778520][ T8329] ? __fget_files+0x21f/0x3d0 [ 2248.778577][ T8329] security_file_ioctl+0xd3/0x230 [ 2248.778619][ T8329] __x64_sys_ioctl+0xb7/0x210 [ 2248.778665][ T8329] do_syscall_64+0x121/0x770 [ 2248.778726][ T8329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2248.778765][ T8329] RIP: 0033:0x7fa87939e1d9 [ 2248.778794][ T8329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2248.778829][ T8329] RSP: 002b:00007fa87a184028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2248.778864][ T8329] RAX: ffffffffffffffda RBX: 00007fa879626450 RCX: 00007fa87939e1d9 [ 2248.778888][ T8329] RDX: 0000000000000f15 RSI: 0000000080045515 RDI: 0000000000000007 [ 2248.778910][ T8329] RBP: 00007fa879435888 R08: 0000000000000000 R09: 0000000000000000 [ 2248.778932][ T8329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2248.778961][ T8329] R13: 00007fa8796264e8 R14: 00007fa879626450 R15: 00007ffd76f623d8 [ 2248.779008][ T8329] [ 2248.799040][ T8329] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2249.739736][ T4934] Bluetooth: hci1: command 0x0406 tx timeout [ 2250.720168][ T8339] ubi0: attaching mtd0 [ 2250.728473][ T8339] ubi0: scanning is finished [ 2250.886355][ T8362] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2250.925180][ T8339] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2250.925220][ T8339] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2250.925252][ T8339] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2250.925280][ T8339] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2250.925310][ T8339] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2250.925811][ T8339] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2250.925845][ T8339] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2250.925878][ T8339] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2250.925968][ T8346] ubi0: detaching mtd0 [ 2251.000466][ T8346] ubi0: mtd0 is detached [ 2253.952015][ T8394] syz.1.4349 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 2255.884165][ T8415] netlink: 'syz.3.4351': attribute type 1 has an invalid length. [ 2259.973523][ T8474] ubi0: attaching mtd0 [ 2259.983304][ T8474] ubi0: scanning is finished [ 2260.337834][ T8474] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2260.338092][ T8474] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2260.338127][ T8474] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2260.338155][ T8474] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2260.338184][ T8474] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2260.338240][ T8474] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2260.338268][ T8474] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2260.338301][ T8474] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2260.339910][ T8489] ubi0: background thread "ubi_bgt0d" started, PID 8489 [ 2260.339994][ T8479] ubi0: detaching mtd0 [ 2260.468875][ T8479] ubi0: mtd0 is detached [ 2263.965907][ T8526] netlink: 'syz.1.4365': attribute type 1 has an invalid length. [ 2266.309564][ T8553] hub 1-0:1.0: USB hub found [ 2266.311347][ T8553] hub 1-0:1.0: 1 port detected [ 2268.469827][ T8590] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2270.815988][ T8621] netlink: 'syz.0.4378': attribute type 1 has an invalid length. [ 2272.290212][ T8650] netlink: 'syz.0.4382': attribute type 1 has an invalid length. [ 2273.408710][ T8641] Process accounting resumed [ 2273.856214][ T8665] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2277.701480][ T8729] ubi0: attaching mtd0 [ 2277.723001][ T8729] ubi0: scanning is finished [ 2277.975819][ T8729] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2277.975861][ T8729] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2277.975893][ T8729] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2277.975922][ T8729] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2277.975952][ T8729] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2277.975983][ T8729] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2277.976013][ T8729] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2277.976048][ T8729] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2277.976287][ T8741] ubi0: background thread "ubi_bgt0d" started, PID 8741 [ 2277.981507][ T8722] ubi0: detaching mtd0 [ 2278.089396][ T8722] ubi0: mtd0 is detached [ 2280.882170][ T8760] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2283.503704][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2283.503790][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2283.727867][ T8798] netlink: 'syz.0.4401': attribute type 1 has an invalid length. [ 2288.005751][ T8877] netlink: 'syz.1.4413': attribute type 1 has an invalid length. [ 2290.207843][ T8900] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2291.415530][ T8931] ubi0: attaching mtd0 [ 2291.420282][ T8931] ubi0: scanning is finished [ 2291.605415][ T8931] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2291.605462][ T8931] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2291.605496][ T8931] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2291.605538][ T8931] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2291.605570][ T8931] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2291.605601][ T8931] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2291.605634][ T8931] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2291.605672][ T8931] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2291.605779][ T8933] ubi0: detaching mtd0 [ 2291.694568][ T8933] ubi0: mtd0 is detached [ 2292.989713][ T8955] netlink: 'syz.0.4426': attribute type 1 has an invalid length. [ 2293.664300][ T8963] blktrace: Concurrent blktraces are not allowed on nbd5 [ 2295.489068][ T8974] ubi0: attaching mtd0 [ 2295.507224][ T8974] ubi0: scanning is finished [ 2295.510081][ T8981] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2295.777220][ T8974] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2295.777258][ T8974] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2295.777287][ T8974] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2295.777343][ T8974] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2295.777371][ T8974] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2295.777397][ T8974] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2295.777425][ T8974] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2295.777458][ T8974] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2295.777539][ T8986] ubi0: background thread "ubi_bgt0d" started, PID 8986 [ 2295.779217][ T8983] ubi0: detaching mtd0 [ 2295.879299][ T8983] ubi0: mtd0 is detached [ 2296.929156][T31991] Bluetooth: hci1: unexpected event 0x02 length: 1021 > 255 [ 2297.226943][ T9001] blktrace: Concurrent blktraces are not allowed on nbd5 [ 2299.277246][ T9014] netlink: 'syz.1.4435': attribute type 1 has an invalid length. [ 2300.931280][T31991] Bluetooth: hci2: command 0x0406 tx timeout [ 2302.285013][ T9051] netlink: 'syz.2.4440': attribute type 1 has an invalid length. [ 2303.225033][ T9059] ubi0: attaching mtd0 [ 2303.240863][ T9059] ubi0: scanning is finished [ 2303.466906][ T9072] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2303.552995][ T9059] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2303.553033][ T9059] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2303.553065][ T9059] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2303.553094][ T9059] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2303.553141][ T9059] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2303.553168][ T9059] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2303.553196][ T9059] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2303.553229][ T9059] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2303.557478][ T9060] ubi0: detaching mtd0 [ 2303.699294][ T9060] ubi0: mtd0 is detached [ 2303.748199][ T9045] Process accounting paused [ 2304.744835][ T9095] netlink: 'syz.2.4447': attribute type 1 has an invalid length. [ 2304.980601][ T9098] netlink: 'syz.1.4448': attribute type 1 has an invalid length. [ 2312.146241][ T9185] ubi0: attaching mtd0 [ 2312.162582][ T9185] ubi0: scanning is finished [ 2312.463862][ T9185] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2312.463905][ T9185] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2312.463936][ T9185] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2312.463996][ T9185] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2312.464025][ T9185] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2312.464052][ T9185] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2312.464080][ T9185] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2312.464113][ T9185] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2312.464224][ T9198] ubi0: background thread "ubi_bgt0d" started, PID 9198 [ 2312.465864][ T9187] ubi0: detaching mtd0 [ 2312.505003][ T9187] ubi0: mtd0 is detached [ 2317.846587][ T9271] db_root: cannot open: z [ 2322.899675][ T9353] db_root: cannot open: z [ 2328.019540][ T61] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2328.066880][ T9430] ubi0: attaching mtd0 [ 2328.146590][ T9430] ubi0: scanning is finished [ 2328.461016][T31991] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2328.478507][T31991] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2328.489522][T31991] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2328.505536][T31991] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2328.506045][T31991] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2328.506335][ T9430] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2328.506368][ T9430] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2328.506401][ T9430] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2328.506426][ T9430] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2328.506451][ T9430] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2328.506477][ T9430] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2328.506512][ T9430] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2328.506545][ T9430] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2328.508477][ T9437] ubi0: detaching mtd0 [ 2328.624542][ T9437] ubi0: mtd0 is detached [ 2328.805209][ T61] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2329.126969][ T61] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2329.485697][ T61] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2330.241752][ T9465] db_root: cannot open: z [ 2330.611285][T31991] Bluetooth: hci0: command tx timeout [ 2331.217182][ T61] bridge_slave_1: left allmulticast mode [ 2331.217238][ T61] bridge_slave_1: left promiscuous mode [ 2331.217503][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 2331.245159][ T61] bridge_slave_0: left allmulticast mode [ 2331.245197][ T61] bridge_slave_0: left promiscuous mode [ 2331.248306][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 2331.805006][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2331.835800][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2331.841033][ T61] bond0 (unregistering): Released all slaves [ 2332.326533][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2332.691183][T31991] Bluetooth: hci0: command tx timeout [ 2333.226235][ T61] hsr_slave_0: left promiscuous mode [ 2333.226885][ T61] hsr_slave_1: left promiscuous mode [ 2333.227647][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2333.227669][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2333.228393][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2333.228412][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2333.282224][ T61] veth1_macvtap: left promiscuous mode [ 2333.282263][ T61] veth0_macvtap: left promiscuous mode [ 2333.282354][ T61] veth1_vlan: left promiscuous mode [ 2333.282412][ T61] veth0_vlan: left promiscuous mode [ 2334.025526][ T61] team0 (unregistering): Port device team_slave_1 removed [ 2334.056241][ T61] team0 (unregistering): Port device team_slave_0 removed [ 2334.771673][T31991] Bluetooth: hci0: command tx timeout [ 2335.648699][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2336.355145][ T9439] bridge0: port 1(bridge_slave_0) entered blocking state [ 2336.355358][ T9439] bridge0: port 1(bridge_slave_0) entered disabled state [ 2336.355529][ T9439] bridge_slave_0: entered allmulticast mode [ 2336.357773][ T9439] bridge_slave_0: entered promiscuous mode [ 2336.443474][ T9439] bridge0: port 2(bridge_slave_1) entered blocking state [ 2336.445216][ T9439] bridge0: port 2(bridge_slave_1) entered disabled state [ 2336.445393][ T9439] bridge_slave_1: entered allmulticast mode [ 2336.449129][ T9439] bridge_slave_1: entered promiscuous mode [ 2336.796152][ T9561] FAULT_INJECTION: forcing a failure. [ 2336.796152][ T9561] name failslab, interval 1, probability 0, space 0, times 0 [ 2336.796208][ T9561] CPU: 1 UID: 0 PID: 9561 Comm: syz.1.4509 Tainted: G L syzkaller #0 PREEMPT(full) [ 2336.796255][ T9561] Tainted: [L]=SOFTLOCKUP [ 2336.796269][ T9561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2336.796291][ T9561] Call Trace: [ 2336.796304][ T9561] [ 2336.796319][ T9561] dump_stack_lvl+0x100/0x190 [ 2336.796381][ T9561] should_fail_ex.cold+0x5/0xa [ 2336.796432][ T9561] should_failslab+0xc2/0x120 [ 2336.796491][ T9561] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 2336.796544][ T9561] ? __d_alloc+0x35/0xa50 [ 2336.796606][ T9561] __d_alloc+0x35/0xa50 [ 2336.796669][ T9561] d_alloc_parallel+0x105/0x14c0 [ 2336.796720][ T9561] ? lock_acquire+0x1d1/0x380 [ 2336.796775][ T9561] ? __d_lookup+0x73/0x4a0 [ 2336.796819][ T9561] ? __pfx_d_alloc_parallel+0x10/0x10 [ 2336.796862][ T9561] ? __d_lookup+0x25c/0x4a0 [ 2336.796911][ T9561] ? __d_lookup+0x266/0x4a0 [ 2336.796965][ T9561] lookup_open+0x6bb/0x1990 [ 2336.797025][ T9561] path_openat+0xa2c/0x2440 [ 2336.797085][ T9561] ? __pfx_path_openat+0x10/0x10 [ 2336.797160][ T9561] do_file_open+0x20e/0x430 [ 2336.797216][ T9561] ? __pfx_do_file_open+0x10/0x10 [ 2336.797302][ T9561] ? _raw_spin_unlock+0x28/0x50 [ 2336.797352][ T9561] ? alloc_fd+0x471/0x7a0 [ 2336.797414][ T9561] do_sys_openat2+0x10f/0x1e0 [ 2336.797453][ T9561] ? __pfx_do_sys_openat2+0x10/0x10 [ 2336.797491][ T9561] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2336.797563][ T9561] __x64_sys_openat+0x12d/0x210 [ 2336.797601][ T9561] ? __pfx___x64_sys_openat+0x10/0x10 [ 2336.797656][ T9561] do_syscall_64+0x121/0x770 [ 2336.797716][ T9561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2336.797754][ T9561] RIP: 0033:0x7fd135f9e1d9 [ 2336.797784][ T9561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2336.797819][ T9561] RSP: 002b:00007fd1335ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 2336.797853][ T9561] RAX: ffffffffffffffda RBX: 00007fd136226450 RCX: 00007fd135f9e1d9 [ 2336.797877][ T9561] RDX: 0000000000000800 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 2336.797900][ T9561] RBP: 00007fd136035888 R08: 0000000000000000 R09: 0000000000000000 [ 2336.797921][ T9561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2336.797943][ T9561] R13: 00007fd1362264e8 R14: 00007fd136226450 R15: 00007ffe16877858 [ 2336.797991][ T9561] [ 2336.855332][T31991] Bluetooth: hci0: command tx timeout [ 2337.255574][ T9439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2337.338069][ T5278] 8021q: adding VLAN 0 to HW filter on device eth3 [ 2337.344731][ T9439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2337.454332][ T9439] team0: Port device team_slave_0 added [ 2337.506946][ T9439] team0: Port device team_slave_1 added [ 2337.690600][ T9439] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2337.690628][ T9439] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2337.690665][ T9439] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2337.710548][ T9439] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2337.710610][ T9439] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2337.710724][ T9439] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2337.890139][ T9439] hsr_slave_0: entered promiscuous mode [ 2337.895810][ T9439] hsr_slave_1: entered promiscuous mode [ 2337.899091][ T9439] debugfs: 'hsr0' already exists in 'hsr' [ 2337.899173][ T9439] Cannot create hsr debugfs directory [ 2338.314107][ T9580] netlink: 'syz.0.4510': attribute type 1 has an invalid length. [ 2338.781221][ T9597] netlink: 'syz.1.4511': attribute type 1 has an invalid length. [ 2338.833244][ T9600] netlink: 'syz.3.4512': attribute type 1 has an invalid length. [ 2339.156832][ T5278] 8021q: adding VLAN 0 to HW filter on device eth4 [ 2341.538139][ T9439] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2341.555398][ T9439] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2341.674191][ T9439] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2341.691880][ T9439] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2341.694580][ T9439] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2341.708764][ T9439] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2341.830880][ T9439] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2341.858915][ T9439] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2344.934744][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2344.934822][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2345.022080][ T9439] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2345.355585][ T9738] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2345.399640][ T9439] 8021q: adding VLAN 0 to HW filter on device team0 [ 2345.514260][ T9741] netlink: 'syz.3.4522': attribute type 1 has an invalid length. [ 2345.682271][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 2345.682365][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2346.098803][T18452] bridge0: port 2(bridge_slave_1) entered blocking state [ 2346.098930][T18452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2346.244728][ T9752] db_root: cannot open: z [ 2349.146715][ T9788] ubi0: attaching mtd0 [ 2349.197821][ T9788] ubi0: scanning is finished [ 2349.632541][ T9788] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 2349.632581][ T9788] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 2349.632611][ T9788] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 2349.632647][ T9788] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 2349.632675][ T9788] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 2349.632702][ T9788] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 2349.632730][ T9788] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 602809963 [ 2349.632762][ T9788] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 2349.635272][ T9783] ubi0: detaching mtd0 [ 2349.751907][ T9783] ubi0: mtd0 is detached [ 2351.125522][ T9439] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2352.258231][ T9439] veth0_vlan: entered promiscuous mode [ 2352.745263][ T9439] veth1_vlan: entered promiscuous mode [ 2353.561014][ T9842] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2354.922819][ T9439] veth0_macvtap: entered promiscuous mode [ 2354.977918][ T9844] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2354.978140][ T9844] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2354.978220][ T9844] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 2355.025876][ T9844] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2355.026002][ T9844] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 2355.060848][ T9844] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2355.060995][ T9844] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 2355.094709][ T9844] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 2355.113864][ T9439] veth1_macvtap: entered promiscuous mode [ 2355.225238][ T9439] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2355.297708][ T9439] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2356.383854][ T9869] FAULT_INJECTION: forcing a failure. [ 2356.383854][ T9869] name failslab, interval 1, probability 0, space 0, times 0 [ 2356.383912][ T9869] CPU: 0 UID: 0 PID: 9869 Comm: syz.1.4539 Tainted: G L syzkaller #0 PREEMPT(full) [ 2356.383969][ T9869] Tainted: [L]=SOFTLOCKUP [ 2356.383982][ T9869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2356.384004][ T9869] Call Trace: [ 2356.384017][ T9869] [ 2356.384032][ T9869] dump_stack_lvl+0x100/0x190 [ 2356.384090][ T9869] should_fail_ex.cold+0x5/0xa [ 2356.384137][ T9869] should_failslab+0xc2/0x120 [ 2356.384209][ T9869] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 2356.384262][ T9869] ? __d_alloc+0x35/0xa50 [ 2356.384322][ T9869] __d_alloc+0x35/0xa50 [ 2356.384380][ T9869] d_alloc_pseudo+0x1c/0xc0 [ 2356.384421][ T9869] alloc_file_pseudo+0x118/0x290 [ 2356.384458][ T9869] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 2356.384495][ T9869] ? alloc_fd+0x471/0x7a0 [ 2356.384565][ T9869] sock_alloc_file+0x50/0x210 [ 2356.384611][ T9869] __sys_socket+0x1c0/0x260 [ 2356.384672][ T9869] ? __pfx___sys_socket+0x10/0x10 [ 2356.384739][ T9869] __x64_sys_socket+0x72/0xb0 [ 2356.384791][ T9869] ? lockdep_hardirqs_on+0x7d/0x110 [ 2356.384845][ T9869] do_syscall_64+0x121/0x770 [ 2356.384904][ T9869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2356.384945][ T9869] RIP: 0033:0x7fd135f9e1d9 [ 2356.384976][ T9869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2356.385012][ T9869] RSP: 002b:00007fd1339d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2356.385046][ T9869] RAX: ffffffffffffffda RBX: 00007fd136226360 RCX: 00007fd135f9e1d9 [ 2356.385069][ T9869] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2356.385090][ T9869] RBP: 00007fd136035888 R08: 0000000000000000 R09: 0000000000000000 [ 2356.385110][ T9869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2356.385143][ T9869] R13: 00007fd1362263f8 R14: 00007fd136226360 R15: 00007ffe16877858 [ 2356.385189][ T9869] [ 2356.663043][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2357.012461][ T4934] Bluetooth: hci4: command 0x0c1a tx timeout [ 2357.091375][ T4934] Bluetooth: hci0: command 0x0c1a tx timeout [ 2357.091449][ T4934] Bluetooth: hci2: command 0x0406 tx timeout [ 2357.091488][ T4934] Bluetooth: hci1: command 0x0406 tx timeout [ 2357.225135][T18452] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2357.226387][T18452] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2357.325599][ T3386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2357.325632][ T3386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2357.452246][ T3182] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2357.576898][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2357.576932][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2358.505456][ T9900] netlink: 'syz.1.4542': attribute type 1 has an invalid length. [ 2359.171310][T31991] Bluetooth: hci1: command 0x0406 tx timeout [ 2359.171363][T31991] Bluetooth: hci2: command 0x0406 tx timeout [ 2359.171453][T31991] Bluetooth: hci0: command 0x0c1a tx timeout [ 2361.275731][ T4934] Bluetooth: hci0: command 0x0c1a tx timeout [ 2361.322743][ T9928] db_root: cannot open: Bÿ [ 2363.124583][ T9951] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2363.159674][ T9951] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2363.160446][ T9951] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2363.160633][ T9951] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2363.474030][ T9957] FAULT_INJECTION: forcing a failure. [ 2363.474030][ T9957] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2363.474084][ T9957] CPU: 1 UID: 0 PID: 9957 Comm: syz.2.4550 Tainted: G L syzkaller #0 PREEMPT(full) [ 2363.474129][ T9957] Tainted: [L]=SOFTLOCKUP [ 2363.474141][ T9957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2363.474163][ T9957] Call Trace: [ 2363.474175][ T9957] [ 2363.474188][ T9957] dump_stack_lvl+0x100/0x190 [ 2363.474243][ T9957] should_fail_ex.cold+0x5/0xa [ 2363.474289][ T9957] _copy_to_user+0x32/0xd0 [ 2363.474350][ T9957] keyctl_capabilities+0x5a/0x160 [ 2363.474395][ T9957] __do_sys_keyctl+0x427/0x5a0 [ 2363.474433][ T9957] do_syscall_64+0x121/0x770 [ 2363.474493][ T9957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2363.474538][ T9957] RIP: 0033:0x7f1c3779e1d9 [ 2363.474567][ T9957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2363.474599][ T9957] RSP: 002b:00007f1c359b4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 2363.474632][ T9957] RAX: ffffffffffffffda RBX: 00007f1c37a26450 RCX: 00007f1c3779e1d9 [ 2363.474656][ T9957] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 000000000000001f [ 2363.474678][ T9957] RBP: 00007f1c359b4090 R08: 00000000000003ff R09: 0000000000000000 [ 2363.474699][ T9957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2363.474721][ T9957] R13: 00007f1c37a264e8 R14: 00007f1c37a26450 R15: 00007ffc0e4ba358 [ 2363.474766][ T9957] [ 2364.498925][ T9973] db_root: cannot open: z [ 2365.171528][ T4934] Bluetooth: hci2: command 0x0406 tx timeout [ 2365.171587][ T4934] Bluetooth: hci1: command 0x0406 tx timeout [ 2365.171641][ T4934] Bluetooth: hci4: command 0x0c1a tx timeout [ 2365.171731][T31991] Bluetooth: hci0: command 0x0c1a tx timeout [ 2369.924551][T10037] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2372.150457][T10087] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2378.877971][T10174] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2378.878709][T10174] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2378.878911][T10174] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2378.879135][T10174] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2380.931396][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 2380.931455][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 2380.931500][ T52] Bluetooth: hci4: command 0x0c1a tx timeout [ 2380.931593][T31991] Bluetooth: hci0: command 0x0c1a tx timeout [ 2381.305746][T10211] FAULT_INJECTION: forcing a failure. [ 2381.305746][T10211] name failslab, interval 1, probability 0, space 0, times 0 [ 2381.305803][T10211] CPU: 0 UID: 0 PID: 10211 Comm: syz.2.4586 Tainted: G L syzkaller #0 PREEMPT(full) [ 2381.305849][T10211] Tainted: [L]=SOFTLOCKUP [ 2381.305862][T10211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2381.305884][T10211] Call Trace: [ 2381.305896][T10211] [ 2381.305920][T10211] dump_stack_lvl+0x100/0x190 [ 2381.305977][T10211] should_fail_ex.cold+0x5/0xa [ 2381.306023][T10211] should_failslab+0xc2/0x120 [ 2381.306087][T10211] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 2381.306143][T10211] ? __d_alloc+0x35/0xa50 [ 2381.306206][T10211] __d_alloc+0x35/0xa50 [ 2381.306264][T10211] d_alloc_pseudo+0x1c/0xc0 [ 2381.306305][T10211] alloc_file_pseudo+0x118/0x290 [ 2381.306342][T10211] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 2381.306378][T10211] ? alloc_fd+0x471/0x7a0 [ 2381.306436][T10211] sock_alloc_file+0x50/0x210 [ 2381.306484][T10211] __sys_socket+0x1c0/0x260 [ 2381.306538][T10211] ? __pfx___sys_socket+0x10/0x10 [ 2381.306613][T10211] __x64_sys_socket+0x72/0xb0 [ 2381.306665][T10211] ? lockdep_hardirqs_on+0x7d/0x110 [ 2381.306718][T10211] do_syscall_64+0x121/0x770 [ 2381.306777][T10211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2381.306815][T10211] RIP: 0033:0x7f1c3779e1d9 [ 2381.306846][T10211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2381.306882][T10211] RSP: 002b:00007f1c351d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2381.306925][T10211] RAX: ffffffffffffffda RBX: 00007f1c37a26360 RCX: 00007f1c3779e1d9 [ 2381.306948][T10211] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2381.306970][T10211] RBP: 00007f1c37835888 R08: 0000000000000000 R09: 0000000000000000 [ 2381.306992][T10211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2381.307014][T10211] R13: 00007f1c37a263f8 R14: 00007f1c37a26360 R15: 00007ffc0e4ba358 [ 2381.307065][T10211] [ 2382.158434][T10218] FAULT_INJECTION: forcing a failure. [ 2382.158434][T10218] name failslab, interval 1, probability 0, space 0, times 0 [ 2382.158493][T10218] CPU: 0 UID: 0 PID: 10218 Comm: syz.1.4587 Tainted: G L syzkaller #0 PREEMPT(full) [ 2382.158538][T10218] Tainted: [L]=SOFTLOCKUP [ 2382.158550][T10218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2382.158569][T10218] Call Trace: [ 2382.158581][T10218] [ 2382.158594][T10218] dump_stack_lvl+0x100/0x190 [ 2382.158658][T10218] should_fail_ex.cold+0x5/0xa [ 2382.158706][T10218] should_failslab+0xc2/0x120 [ 2382.158764][T10218] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 2382.158820][T10218] ? __d_alloc+0x35/0xa50 [ 2382.158892][T10218] __d_alloc+0x35/0xa50 [ 2382.158952][T10218] d_alloc_pseudo+0x1c/0xc0 [ 2382.158993][T10218] alloc_file_pseudo+0x118/0x290 [ 2382.159031][T10218] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 2382.159068][T10218] ? alloc_fd+0x471/0x7a0 [ 2382.159130][T10218] sock_alloc_file+0x50/0x210 [ 2382.159177][T10218] __sys_socket+0x1c0/0x260 [ 2382.159230][T10218] ? __pfx___sys_socket+0x10/0x10 [ 2382.159297][T10218] __x64_sys_socket+0x72/0xb0 [ 2382.159349][T10218] ? lockdep_hardirqs_on+0x7d/0x110 [ 2382.159403][T10218] do_syscall_64+0x121/0x770 [ 2382.159464][T10218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2382.159499][T10218] RIP: 0033:0x7fd135f9e1d9 [ 2382.159526][T10218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2382.159561][T10218] RSP: 002b:00007fd1339d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 2382.159595][T10218] RAX: ffffffffffffffda RBX: 00007fd136226360 RCX: 00007fd135f9e1d9 [ 2382.159619][T10218] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000028 [ 2382.159641][T10218] RBP: 00007fd136035888 R08: 0000000000000000 R09: 0000000000000000 [ 2382.159663][T10218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2382.159699][T10218] R13: 00007fd1362263f8 R14: 00007fd136226360 R15: 00007ffe16877858 [ 2382.159747][T10218] [ 2383.336531][T10231] netlink: 'syz.3.4589': attribute type 1 has an invalid length. [ 2384.045897][T10229] db_root: cannot open: ÿÿ [ 2385.696396][T10259] netlink: 'syz.3.4593': attribute type 1 has an invalid length. [ 2389.609484][T10311] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2391.888539][T10339] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 2394.493121][T10353] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 2394.493448][T10353] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 2394.493734][T10353] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 2394.494033][T10353] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 2394.495114][T10365] kAFS: Invalid Command on /proc/fs/afs/cells file [ 2396.371355][T31991] Bluetooth: hci4: command 0x0c1a tx timeout [ 2396.532692][ T4934] Bluetooth: hci2: command 0x0406 tx timeout [ 2396.532752][ T4934] Bluetooth: hci1: command 0x0406 tx timeout [ 2396.532829][T31991] Bluetooth: hci0: command 0x0c1a tx timeout [ 2397.404398][T10423] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2397.496847][T10426] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2400.670097][T10464] db_root: cannot open: z [ 2402.728528][T10499] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2403.407145][T10510] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 2406.376038][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2406.376116][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2407.695754][T10572] netlink: 'syz.0.4639': attribute type 1 has an invalid length. [ 2409.804374][T10602] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2414.302269][T10668] netlink: 'syz.3.4652': attribute type 1 has an invalid length. [ 2416.363815][T10697] netlink: 'syz.3.4657': attribute type 1 has an invalid length. [ 2416.653761][T10699] netlink: 'syz.0.4658': attribute type 1 has an invalid length. [ 2422.613972][T10786] netlink: 'syz.2.4669': attribute type 1 has an invalid length. [ 2429.551723][T10877] netlink: 'syz.2.4682': attribute type 1 has an invalid length. [ 2432.283647][T10906] db_root: cannot open: z [ 2436.908549][T10968] blktrace: Concurrent blktraces are not allowed on nbd5 [ 2437.212567][T10975] netlink: 'syz.1.4693': attribute type 1 has an invalid length. [ 2437.314848][T10974] hub 1-0:1.0: USB hub found [ 2437.315832][T10974] hub 1-0:1.0: 1 port detected [ 2440.361502][T11007] db_root: cannot open: Ÿ [ 2442.589209][T11043] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2444.286924][T11073] netlink: 'syz.2.4707': attribute type 1 has an invalid length. [ 2444.909488][T11083] db_root: cannot open: z [ 2446.469454][T11107] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2450.782336][T11171] netlink: 'syz.1.4721': attribute type 1 has an invalid length. [ 2451.369278][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2451.386907][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2451.390409][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2451.426462][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2451.428341][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2451.490165][ T61] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2451.925580][ T61] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2452.370182][ T61] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2452.551839][ T61] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2453.130016][T11200] netlink: 'syz.2.4724': attribute type 1 has an invalid length. [ 2453.341674][T11206] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2453.399246][ T61] bridge_slave_1: left allmulticast mode [ 2453.399283][ T61] bridge_slave_1: left promiscuous mode [ 2453.400676][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 2453.434717][ T61] bridge_slave_0: left allmulticast mode [ 2453.434758][ T61] bridge_slave_0: left promiscuous mode [ 2453.435057][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 2453.491508][T31991] Bluetooth: hci1: command tx timeout [ 2453.710488][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2453.733544][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2453.735428][ T61] bond0 (unregistering): Released all slaves [ 2454.643773][ T61] hsr_slave_0: left promiscuous mode [ 2454.645937][ T61] hsr_slave_1: left promiscuous mode [ 2454.647272][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2454.647305][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2454.649802][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2454.649855][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2454.703573][ T61] veth1_macvtap: left promiscuous mode [ 2454.703616][ T61] veth0_macvtap: left promiscuous mode [ 2454.703741][ T61] veth1_vlan: left promiscuous mode [ 2454.703801][ T61] veth0_vlan: left promiscuous mode [ 2455.053204][ T61] team0 (unregistering): Port device team_slave_1 removed [ 2455.079836][ T61] team0 (unregistering): Port device team_slave_0 removed [ 2455.369019][T11175] bridge0: port 1(bridge_slave_0) entered blocking state [ 2455.369248][T11175] bridge0: port 1(bridge_slave_0) entered disabled state [ 2455.369409][T11175] bridge_slave_0: entered allmulticast mode [ 2455.374263][T11175] bridge_slave_0: entered promiscuous mode [ 2455.414287][T11175] bridge0: port 2(bridge_slave_1) entered blocking state [ 2455.414419][T11175] bridge0: port 2(bridge_slave_1) entered disabled state [ 2455.414620][T11175] bridge_slave_1: entered allmulticast mode [ 2455.448307][T11175] bridge_slave_1: entered promiscuous mode [ 2455.578619][T31991] Bluetooth: hci1: command tx timeout [ 2455.713543][T11175] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2455.752854][T11175] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2456.130883][T11175] team0: Port device team_slave_0 added [ 2456.147075][T11175] team0: Port device team_slave_1 added [ 2456.562266][T11249] Unable to find swap-space signature [ 2456.616426][T11175] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2456.616454][T11175] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2456.616496][T11175] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2456.889417][T11175] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2456.889447][T11175] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2456.889494][T11175] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2457.135019][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2457.539307][T11175] hsr_slave_0: entered promiscuous mode [ 2457.540507][T11175] hsr_slave_1: entered promiscuous mode [ 2457.652118][T31991] Bluetooth: hci1: command tx timeout [ 2459.176151][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2459.509002][T11287] db_root: cannot open: z [ 2459.731228][T31991] Bluetooth: hci1: command tx timeout [ 2461.758347][T11322] usb usb21: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2462.388703][T11345] netlink: 'syz.1.4737': attribute type 1 has an invalid length. [ 2462.979599][T11175] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2463.005112][T11175] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2463.006240][T11175] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2463.028535][T11175] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2463.082550][T11175] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2463.114097][T11175] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2463.115241][T11175] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2463.143170][T11175] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2464.476784][T11390] hub 1-0:1.0: USB hub found [ 2464.483733][T11390] hub 1-0:1.0: 1 port detected [ 2466.078200][T11175] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2466.114841][T11175] 8021q: adding VLAN 0 to HW filter on device team0 [ 2466.147351][ T3318] bridge0: port 1(bridge_slave_0) entered blocking state [ 2466.147614][ T3318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2466.195554][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 2466.195683][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2467.814735][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 2467.814811][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 2468.447595][T11175] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2468.686460][T11175] veth0_vlan: entered promiscuous mode [ 2468.747605][T11175] veth1_vlan: entered promiscuous mode [ 2468.883738][T11175] veth0_macvtap: entered promiscuous mode [ 2468.987008][T11175] veth1_macvtap: entered promiscuous mode [ 2469.794888][T11175] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2470.359033][T11175] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2470.772856][ T61] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2470.772929][ T61] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2470.772983][ T61] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2470.773040][ T61] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2471.715956][T18452] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2471.715992][T18452] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2472.062911][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2472.062947][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2472.918796][T11513] netlink: 'syz.0.4723': attribute type 1 has an invalid length. [ 2473.950163][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2473.963325][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2473.978310][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2473.994317][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2473.997974][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2474.848391][ T3318] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2475.153429][ T3318] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2475.705385][ T3318] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2476.010286][T11557] netlink: 'syz.2.4757': attribute type 1 has an invalid length. [ 2476.069499][ T3318] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2476.133081][T31991] Bluetooth: hci3: command tx timeout [ 2477.145917][ T3318] bridge_slave_1: left allmulticast mode [ 2477.145954][ T3318] bridge_slave_1: left promiscuous mode [ 2477.148012][ T3318] bridge0: port 2(bridge_slave_1) entered disabled state [ 2477.185344][ T3318] bridge_slave_0: left allmulticast mode [ 2477.185384][ T3318] bridge_slave_0: left promiscuous mode [ 2477.185662][ T3318] bridge0: port 1(bridge_slave_0) entered disabled state [ 2477.195086][T11567] netlink: 'syz.1.4758': attribute type 1 has an invalid length. [ 2477.507938][ T3318] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2477.538699][ T3318] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2477.540947][ T3318] bond0 (unregistering): Released all slaves [ 2477.753138][T11579] netlink: 'syz.0.4759': attribute type 1 has an invalid length. [ 2478.211252][T31991] Bluetooth: hci3: command tx timeout [ 2478.966358][T11522] bridge0: port 1(bridge_slave_0) entered blocking state [ 2478.966489][T11522] bridge0: port 1(bridge_slave_0) entered disabled state [ 2478.966655][T11522] bridge_slave_0: entered allmulticast mode [ 2478.973103][T11522] bridge_slave_0: entered promiscuous mode [ 2478.982702][T11522] bridge0: port 2(bridge_slave_1) entered blocking state [ 2478.983021][T11522] bridge0: port 2(bridge_slave_1) entered disabled state [ 2478.983715][T11522] bridge_slave_1: entered allmulticast mode [ 2479.003668][T11522] bridge_slave_1: entered promiscuous mode [ 2479.028600][ T5278] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2479.060635][ T3318] hsr_slave_0: left promiscuous mode [ 2479.070363][ T3318] hsr_slave_1: left promiscuous mode [ 2479.077945][ T3318] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2479.077979][ T3318] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2479.094591][ T3318] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2479.094616][ T3318] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2479.117308][ T3318] veth1_macvtap: left promiscuous mode [ 2479.117348][ T3318] veth0_macvtap: left promiscuous mode [ 2479.117445][ T3318] veth1_vlan: left promiscuous mode [ 2479.117504][ T3318] veth0_vlan: left promiscuous mode [ 2479.389525][ T3318] team0 (unregistering): Port device team_slave_1 removed [ 2479.424352][ T3318] team0 (unregistering): Port device team_slave_0 removed [ 2479.678718][T11522] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2479.696274][T11522] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2479.795841][T11522] team0: Port device team_slave_0 added [ 2479.799340][T11522] team0: Port device team_slave_1 added [ 2479.948842][T11522] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2479.948868][T11522] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2479.948918][T11522] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2480.027186][T11522] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2480.027215][T11522] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2480.027259][T11522] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2480.262498][T11522] hsr_slave_0: entered promiscuous mode [ 2480.267790][T11522] hsr_slave_1: entered promiscuous mode [ 2480.270384][T11522] debugfs: 'hsr0' already exists in 'hsr' [ 2480.270426][T11522] Cannot create hsr debugfs directory [ 2480.297191][T31991] Bluetooth: hci3: command tx timeout [ 2481.495899][ T5278] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2482.371246][T31991] Bluetooth: hci3: command tx timeout [ 2484.739671][T11522] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2484.763022][T11522] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2484.764472][T11522] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2484.791365][T11522] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2484.794617][T11522] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2484.824517][T11522] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2484.827361][T11522] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2484.852033][T11522] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2485.155175][T11522] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2485.386858][T11522] 8021q: adding VLAN 0 to HW filter on device team0 [ 2485.678113][T18452] bridge0: port 1(bridge_slave_0) entered blocking state [ 2485.678249][T18452] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2486.084170][T18452] bridge0: port 2(bridge_slave_1) entered blocking state [ 2486.084327][T18452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2488.117204][T11761] FAULT_INJECTION: forcing a failure. [ 2488.117204][T11761] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2488.125349][T11761] CPU: 1 UID: 0 PID: 11761 Comm: syz.1.4773 Tainted: G L syzkaller #0 PREEMPT(full) [ 2488.125402][T11761] Tainted: [L]=SOFTLOCKUP [ 2488.125415][T11761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2488.125437][T11761] Call Trace: [ 2488.125449][T11761] [ 2488.125464][T11761] dump_stack_lvl+0x100/0x190 [ 2488.125520][T11761] should_fail_ex.cold+0x5/0xa [ 2488.125561][T11761] ? prepare_alloc_pages+0x16d/0x5b0 [ 2488.125621][T11761] should_fail_alloc_page+0xeb/0x140 [ 2488.125690][T11761] prepare_alloc_pages+0x1f0/0x5b0 [ 2488.125762][T11761] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 2488.125832][T11761] ? free_unref_folios+0x81c/0x1790 [ 2488.125873][T11761] ? free_unref_folios+0x7e1/0x1790 [ 2488.125920][T11761] ? folios_put_refs+0x58a/0xaa0 [ 2488.125961][T11761] ? __lock_acquire+0x5c0/0x1f40 [ 2488.126020][T11761] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2488.126072][T11761] ? __css_rstat_updated+0x1ce/0x590 [ 2488.126112][T11761] ? lock_acquire+0x1d1/0x380 [ 2488.126165][T11761] ? do_raw_spin_lock+0x128/0x260 [ 2488.126205][T11761] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2488.126243][T11761] ? find_held_lock+0x2b/0x80 [ 2488.126299][T11761] ? __lock_acquire+0x5c0/0x1f40 [ 2488.126376][T11761] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2488.126434][T11761] ? policy_nodemask+0xed/0x4f0 [ 2488.126495][T11761] alloc_pages_mpol+0x201/0x550 [ 2488.126529][T11761] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 2488.126586][T11761] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 2488.126631][T11761] folio_alloc_mpol_noprof+0x36/0x260 [ 2488.126676][T11761] shmem_alloc_folio+0x135/0x160 [ 2488.126745][T11761] shmem_alloc_and_add_folio+0x371/0xd40 [ 2488.126797][T11761] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 2488.126838][T11761] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 2488.126880][T11761] ? __lock_acquire+0x5c0/0x1f40 [ 2488.126935][T11761] shmem_get_folio_gfp+0x75b/0x1980 [ 2488.126983][T11761] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 2488.127039][T11761] shmem_write_begin+0x1a4/0x420 [ 2488.127084][T11761] ? __pfx_shmem_write_begin+0x10/0x10 [ 2488.127128][T11761] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 2488.127181][T11761] generic_perform_write+0x292/0xa40 [ 2488.127249][T11761] ? __pfx_generic_perform_write+0x10/0x10 [ 2488.127306][T11761] ? mnt_put_write_access_file+0x4e/0x100 [ 2488.127358][T11761] ? file_update_time_flags+0x38c/0x520 [ 2488.127401][T11761] shmem_file_write_iter+0x10e/0x140 [ 2488.127451][T11761] iter_file_splice_write+0x830/0x10b0 [ 2488.127529][T11761] ? __pfx_iter_file_splice_write+0x10/0x10 [ 2488.127590][T11761] ? lock_acquire+0x1d1/0x380 [ 2488.127636][T11761] ? get_pid_task+0x2a/0x250 [ 2488.127712][T11761] ? __pfx_iter_file_splice_write+0x10/0x10 [ 2488.127771][T11761] do_splice+0x109c/0x1fa0 [ 2488.127826][T11761] ? __lock_acquire+0x5c0/0x1f40 [ 2488.127882][T11761] ? ksys_write+0x190/0x250 [ 2488.127931][T11761] ? lock_acquire+0x1d1/0x380 [ 2488.127989][T11761] ? __pfx_do_splice+0x10/0x10 [ 2488.128038][T11761] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 2488.128086][T11761] ? __fget_files+0x34/0x3d0 [ 2488.128135][T11761] ? find_held_lock+0x2b/0x80 [ 2488.128183][T11761] __do_splice+0x33b/0x370 [ 2488.128239][T11761] ? __pfx___do_splice+0x10/0x10 [ 2488.128304][T11761] __x64_sys_splice+0x187/0x250 [ 2488.128364][T11761] do_syscall_64+0x121/0x770 [ 2488.128427][T11761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2488.128464][T11761] RIP: 0033:0x7fd135f9e1d9 [ 2488.128495][T11761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2488.128529][T11761] RSP: 002b:00007fd136de0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2488.128565][T11761] RAX: ffffffffffffffda RBX: 00007fd136225fa0 RCX: 00007fd135f9e1d9 [ 2488.128589][T11761] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000004 [ 2488.128610][T11761] RBP: 00007fd136de0090 R08: 0000000080000001 R09: 0000000000000009 [ 2488.128632][T11761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2488.128654][T11761] R13: 00007fd136226038 R14: 00007fd136225fa0 R15: 00007ffe16877858 [ 2488.128722][T11761] [ 2490.659536][T11522] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2491.526950][T11522] veth0_vlan: entered promiscuous mode [ 2491.586207][T11522] veth1_vlan: entered promiscuous mode [ 2491.687537][T11522] veth0_macvtap: entered promiscuous mode [ 2491.816203][T11522] veth1_macvtap: entered promiscuous mode [ 2492.605976][T11522] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2493.433219][T11522] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2493.822338][ T61] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2493.823385][ T3386] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2493.823467][ T3386] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2493.823524][ T3386] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2494.115570][ T1069] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2494.115600][ T1069] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2494.237700][ T3386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2494.237734][ T3386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2498.191483][T11924] netlink: 'syz.2.4790': attribute type 1 has an invalid length. [ 2498.570661][T11937] vivid-007: ================= START STATUS ================= [ 2498.570758][T11937] vivid-007: Generate PTS: true [ 2498.570802][T11937] vivid-007: Generate SCR: true [ 2498.570873][T11937] tpg source WxH: 320x240 (Y'CbCr) [ 2498.570894][T11937] tpg field: 1 [ 2498.570907][T11937] tpg crop: (0,0)/320x240 [ 2498.570929][T11937] tpg compose: (0,0)/320x240 [ 2498.570949][T11937] tpg colorspace: 8 [ 2498.570962][T11937] tpg transfer function: 0/0 [ 2498.572450][T11937] tpg Y'CbCr encoding: 0/0 [ 2498.572472][T11937] tpg quantization: 0/0 [ 2498.572489][T11937] tpg RGB range: 0/2 [ 2498.572505][T11937] vivid-007: ================== END STATUS ================== [ 2498.727888][T11946] nvme_fcloop: unknown parameter or missing value '7' [ 2499.218106][T11950] db_root: cannot open: Bÿ [ 2505.776876][T12043] FAULT_INJECTION: forcing a failure. [ 2505.776876][T12043] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2505.776929][T12043] CPU: 1 UID: 0 PID: 12043 Comm: syz.3.4808 Tainted: G L syzkaller #0 PREEMPT(full) [ 2505.776974][T12043] Tainted: [L]=SOFTLOCKUP [ 2505.776987][T12043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2505.777007][T12043] Call Trace: [ 2505.777019][T12043] [ 2505.777033][T12043] dump_stack_lvl+0x100/0x190 [ 2505.777089][T12043] should_fail_ex.cold+0x5/0xa [ 2505.777136][T12043] _copy_to_user+0x32/0xd0 [ 2505.777198][T12043] simple_read_from_buffer+0xcb/0x170 [ 2505.777252][T12043] proc_fail_nth_read+0x1af/0x230 [ 2505.777305][T12043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2505.777361][T12043] ? rw_verify_area+0xce/0x6d0 [ 2505.777403][T12043] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2505.777449][T12043] vfs_read+0x1e4/0xb40 [ 2505.777494][T12043] ? lock_acquire+0x1d1/0x380 [ 2505.777547][T12043] ? __fget_files+0x34/0x3d0 [ 2505.777594][T12043] ? __pfx_vfs_read+0x10/0x10 [ 2505.777635][T12043] ? find_held_lock+0x2b/0x80 [ 2505.777678][T12043] ? __fget_files+0x215/0x3d0 [ 2505.777740][T12043] ? __fget_files+0x21f/0x3d0 [ 2505.777804][T12043] ksys_read+0x12a/0x250 [ 2505.777848][T12043] ? __pfx_ksys_read+0x10/0x10 [ 2505.777906][T12043] do_syscall_64+0x121/0x770 [ 2505.777965][T12043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2505.778002][T12043] RIP: 0033:0x7fe03df5ea0e [ 2505.778031][T12043] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2505.778064][T12043] RSP: 002b:00007fe03ee1dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2505.778098][T12043] RAX: ffffffffffffffda RBX: 00007fe03ee1e6c0 RCX: 00007fe03df5ea0e [ 2505.778120][T12043] RDX: 000000000000000f RSI: 00007fe03ee1e0a0 RDI: 0000000000000006 [ 2505.778142][T12043] RBP: 00007fe03ee1e090 R08: 0000000000000000 R09: 0000000000000000 [ 2505.778164][T12043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2505.778186][T12043] R13: 00007fe03e226038 R14: 00007fe03e225fa0 R15: 00007ffc14b4f378 [ 2505.778232][T12043] [ 2508.174898][T12085] hub 1-0:1.0: USB hub found [ 2508.176493][T12085] hub 1-0:1.0: 1 port detected [ 2509.110913][T12097] hub 1-0:1.0: USB hub found [ 2509.119919][T12097] hub 1-0:1.0: 1 port detected [ 2509.930553][T12118] BUG: unable to handle page fault for address: ffffc900164c9fe8 [ 2509.938382][T12118] #PF: supervisor write access in kernel mode [ 2509.944513][T12118] #PF: error_code(0x0002) - not-present page [ 2509.951173][T12118] PGD 13fe10067 P4D 13fe10067 PUD 1e2b7067 PMD 5e70f067 PTE 0 [ 2509.959013][T12118] Oops: Oops: 0002 [#1] SMP KASAN PTI [ 2509.964486][T12118] CPU: 1 UID: 0 PID: 12118 Comm: syz.1.4816 Tainted: G L syzkaller #0 PREEMPT(full) [ 2509.975556][T12118] Tainted: [L]=SOFTLOCKUP [ 2509.979993][T12118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2509.990113][T12118] RIP: 0010:write_comp_data+0x7c/0xa0 [ 2509.995579][T12118] Code: 00 8b bf 1c 17 00 00 48 8b 30 48 c1 e7 03 4c 8d 1c b5 00 00 00 00 4a 8d 14 dd 28 00 00 00 48 39 d7 72 1b 48 83 c6 01 48 89 30 <4c> 89 44 10 e0 4c 89 4c 10 e8 4c 89 54 10 f0 4a 89 4c d8 20 c3 cc [ 2510.015305][T12118] RSP: 0018:ffffc90006387e80 EFLAGS: 00050257 [ 2510.021460][T12118] RAX: ffffc900164ca000 RBX: 0000000000000000 RCX: ffffffff824a62f5 [ 2510.029533][T12118] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000400000 [ 2510.037832][T12118] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000002 [ 2510.045872][T12118] R10: 0000000000000001 R11: fffffffffffffffc R12: 0000000000000020 [ 2510.054049][T12118] R13: 0000000000000000 R14: 00007ffffffff000 R15: 0000000000000001 [ 2510.062122][T12118] FS: 00007fd1335ae6c0(0000) GS:ffff888122a4d000(0000) knlGS:0000000000000000 [ 2510.071570][T12118] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2510.078223][T12118] CR2: ffffc900164c9fe8 CR3: 000000007f53e000 CR4: 00000000003526f0 [ 2510.086269][T12118] Call Trace: [ 2510.089605][T12118] [ 2510.094664][T12118] rseq_register+0x115/0x350 [ 2510.099528][T12118] __x64_sys_rseq+0x1b8/0x2e0 [ 2510.104337][T12118] do_syscall_64+0x121/0x770 [ 2510.109020][T12118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2510.114975][T12118] RIP: 0033:0x7fd135f9e1d9 [ 2510.119443][T12118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2510.139450][T12118] RSP: 002b:00007fd1335ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000014e [ 2510.148112][T12118] RAX: ffffffffffffffda RBX: 00007fd136226450 RCX: 00007fd135f9e1d9 [ 2510.156346][T12118] RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000000 [ 2510.164374][T12118] RBP: 00007fd136035888 R08: 0000000000000000 R09: 0000000000000000 [ 2510.172419][T12118] R10: 0000000008000006 R11: 0000000000000246 R12: 0000000000000000 [ 2510.180712][T12118] R13: 00007fd1362264e8 R14: 00007fd136226450 R15: 00007ffe16877858 [ 2510.188795][T12118] [ 2510.192119][T12118] Modules linked in: [ 2510.199227][T12118] CR2: ffffc900164c9fe8 [ 2510.203464][T12118] ---[ end trace 0000000000000000 ]--- [ 2510.209063][T12118] RIP: 0010:write_comp_data+0x7c/0xa0 [ 2510.209127][T12118] Code: 00 8b bf 1c 17 00 00 48 8b 30 48 c1 e7 03 4c 8d 1c b5 00 00 00 00 4a 8d 14 dd 28 00 00 00 48 39 d7 72 1b 48 83 c6 01 48 89 30 <4c> 89 44 10 e0 4c 89 4c 10 e8 4c 89 54 10 f0 4a 89 4c d8 20 c3 cc [ 2510.209161][T12118] RSP: 0018:ffffc90006387e80 EFLAGS: 00050257 [ 2510.209190][T12118] RAX: ffffc900164ca000 RBX: 0000000000000000 RCX: ffffffff824a62f5 [ 2510.209213][T12118] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000400000 [ 2510.209233][T12118] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000002 [ 2510.209254][T12118] R10: 0000000000000001 R11: fffffffffffffffc R12: 0000000000000020 [ 2510.209275][T12118] R13: 0000000000000000 R14: 00007ffffffff000 R15: 0000000000000001 [ 2510.209296][T12118] FS: 00007fd1335ae6c0(0000) GS:ffff888122a4d000(0000) knlGS:0000000000000000 [ 2510.209327][T12118] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2510.209350][T12118] CR2: ffffc900164c9fe8 CR3: 000000007f53e000 CR4: 00000000003526f0 [ 2510.209375][T12118] Kernel panic - not syncing: Fatal exception [ 2510.312540][T12118] Kernel Offset: disabled [ 2510.316934][T12118] Rebooting in 86400 seconds..