last executing test programs: 1.841764322s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='raid5', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='4', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/chunk_size\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='4096', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='1:0', 0x3) write(r4, &(0x7f0000000500)='1:2', 0x3) write(r4, &(0x7f0000000540)='1:', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='0', 0x1) r6 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r6, &(0x7f0000000640)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r7, &(0x7f00000007c0)='active', 0x6) 1.646616057s ago: executing program 2 (id=3): openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x62, 0xa, 0xff00}, [@call={0x75, 0x0, 0x0, 0x700}, @exit, @map_fd, @jmp]}, &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) 1.453692982s ago: executing program 2 (id=5): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0xf, &(0x7f0000000400)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000002c0)=r4, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000700)="d80000001a0081044e81f782db4cb904021d08004f1e81f8d8150019001105142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aebfb0daa7b0cd39e4edbb57a5025ccca9e020000000000000040fad95667e006dcbd63951f215ce3bb9ad809d5e1cace81017f5b5cef443dc3ed0bffece0b42a9ecbee5de6ccd40dd6e4", 0xd8}], 0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r5 = dup(0xffffffffffffffff) inotify_rm_watch(r5, 0x0) ioctl$sock_TIOCINQ(r5, 0x541b, &(0x7f0000000040)) r6 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f00000001c0)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x800) bind$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) socket$netlink(0x10, 0x3, 0x13) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000200), 0xfffffd9d) 970.251625ms ago: executing program 1 (id=6): socket(0x11, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000001300), 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x18}, 0xc044) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'pimreg1\x00', &(0x7f0000000100)=@ethtool_rxfh_indir={0x39, 0x5, [0x0, 0x0, 0xd1, 0x8b, 0xc]}}) r1 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(0x4) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1}}], 0x1, 0x40440d1) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000040)={0xf000, 0x1000, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 941.607165ms ago: executing program 3 (id=4): syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r0 = socket$can_raw(0x1d, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000005480)={'wlan0\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x6e, &(0x7f0000000440)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd60122d1200383aff20010000000000000000000000000001ff020000000000000000000000000001010190780f000000606c0f42fff56c01fe8000000000000000000000000096a3e90bd0f001e4003bfc000000000000000000000000000001"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000900)={@broadcast, @empty, @void, {@ipv4={0x800, @igmp={{0xd, 0x4, 0x0, 0x6, 0x3c, 0x64, 0x0, 0x5, 0x2, 0x0, @empty, @empty, {[@generic={0xc7, 0x2}, @ssrr={0x89, 0x1b, 0x53, [@dev={0xac, 0x14, 0x14, 0x41}, @multicast1, @loopback, @loopback, @local, @broadcast]}]}}, {0x12, 0xf9, 0x0, @loopback}}}}}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c0000000a0601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000"/66], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)=0x0) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, 0x0, 0x0, 0x0) shutdown(r3, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0xffff, 0xffc0}, 0x90) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0xcf}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x22}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xdbd}}]}, 0x30}}, 0x48040) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = syz_io_uring_setup(0x7dd1, &(0x7f00000003c0)={0x0, 0x50b6, 0x2, 0x3, 0x167}, &(0x7f0000000500), &(0x7f0000000040), &(0x7f0000000000)) syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) io_uring_enter(r4, 0xfffffdff, 0xe875, 0x3, &(0x7f0000000240)={[0xfffffffffffffffc]}, 0x8) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv(r5, &(0x7f00000014c0)=[{&(0x7f0000000100)=""/179, 0xb3}], 0x1, 0x7, 0x8) ioctl$XFS_IOC_FSGROWFSDATA(r5, 0x400c586e, &(0x7f0000000000)={0x6, 0x8fe}) preadv(r5, &(0x7f0000002740)=[{&(0x7f0000001540)=""/4096, 0x1000}], 0x1, 0x4, 0xa) 388.25099ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='./mnt\x00', &(0x7f0000000080), &(0x7f00000000c0)='./mnt\x00', 0x6, 0x0) 344.560691ms ago: executing program 1 (id=7): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x2c) r1 = openat$random(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/QEMU0002:00/driver_override\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='tpm_crb_acpi\x00', 0xd) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/drivers/tpm_crb_acpi/bind\x00', 0x1, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000fedbdf25020202000900030073797a32000000000900010073797a32000000001400020077673000"/58], 0x40}, 0x1, 0x40030000000000, 0x0, 0x20040841}, 0x8000) write(r4, &(0x7f0000000500)='QEMU0002:00\x00', 0xc) setsockopt$inet_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000040), 0x3) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="0a0000001000010000000000000000000000000a38000000030a010400000000000000000100ffff0900030073797a31000000000c00048008000240000000000900010073797a310000000014000000110001000000000000004527c9fd18a7"], 0x60}}, 0x0) ioctl$UBLK_U_CMD_GET_DEV_INFO(r3, 0x80207502, &(0x7f0000000340)={0x0, 0xffff, 0x40, &(0x7f0000000240)}) 343.804891ms ago: executing program 3 (id=8): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001540)) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x1, r2}) 56.535079ms ago: executing program 0 (id=9): r0 = syz_open_dev$admmidi(&(0x7f0000000000), 0x2, 0x1a9882) read$midi(r0, 0x0, 0x0) 0s ago: executing program 3 (id=10): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8001}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=@newtfilter={0x40, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0x8001}, {0x3, 0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4, 0x8001}}]}}]}, 0x40}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f0000000800)='\x00', 0x1, 0x0, &(0x7f0000000900)={0x11, 0x300, r4, 0x1, 0x0, 0x6, @local}, 0x14) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.74' (ED25519) to the list of known hosts. [ 73.377296][ T5762] cgroup: Unknown subsys name 'net' [ 73.543644][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.919270][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.343181][ T5781] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.352828][ T5781] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.359471][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.360516][ T5781] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.368780][ T5783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.375528][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.382203][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.398295][ T5783] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.405419][ T5783] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.413127][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.417363][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.420753][ T5783] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.436739][ T5788] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.456421][ T5085] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.467368][ T5085] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.474490][ T5784] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.479121][ T5786] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.482587][ T5085] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.490424][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.503240][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.511857][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.523948][ T5786] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.541895][ T51] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.551911][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.890670][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 76.974126][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 77.059052][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.066686][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.076803][ T5777] bridge_slave_0: entered allmulticast mode [ 77.084220][ T5777] bridge_slave_0: entered promiscuous mode [ 77.108995][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.116265][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.124848][ T5777] bridge_slave_1: entered allmulticast mode [ 77.131747][ T5777] bridge_slave_1: entered promiscuous mode [ 77.143399][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 77.216723][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.256027][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.265721][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.274845][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.282097][ T5774] bridge_slave_0: entered allmulticast mode [ 77.289479][ T5774] bridge_slave_0: entered promiscuous mode [ 77.297143][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.304273][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.313333][ T5774] bridge_slave_1: entered allmulticast mode [ 77.320264][ T5774] bridge_slave_1: entered promiscuous mode [ 77.327442][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 77.389472][ T5777] team0: Port device team_slave_0 added [ 77.402509][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.421794][ T5777] team0: Port device team_slave_1 added [ 77.449606][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.499967][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.507345][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.533519][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.549667][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.556836][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.564202][ T5776] bridge_slave_0: entered allmulticast mode [ 77.573343][ T5776] bridge_slave_0: entered promiscuous mode [ 77.592377][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.599495][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.625670][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.645396][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.652913][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.661297][ T5776] bridge_slave_1: entered allmulticast mode [ 77.668184][ T5776] bridge_slave_1: entered promiscuous mode [ 77.679467][ T5774] team0: Port device team_slave_0 added [ 77.693476][ T5774] team0: Port device team_slave_1 added [ 77.763364][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.783335][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.790700][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.817384][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.828723][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.835854][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.845977][ T5775] bridge_slave_0: entered allmulticast mode [ 77.852865][ T5775] bridge_slave_0: entered promiscuous mode [ 77.862229][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.869656][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.876858][ T5775] bridge_slave_1: entered allmulticast mode [ 77.884103][ T5775] bridge_slave_1: entered promiscuous mode [ 77.893174][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.918958][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.925935][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.951981][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.000362][ T5776] team0: Port device team_slave_0 added [ 78.012902][ T5777] hsr_slave_0: entered promiscuous mode [ 78.019240][ T5777] hsr_slave_1: entered promiscuous mode [ 78.042388][ T5776] team0: Port device team_slave_1 added [ 78.052495][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.065712][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.131212][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.138476][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.164614][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.196511][ T5774] hsr_slave_0: entered promiscuous mode [ 78.202929][ T5774] hsr_slave_1: entered promiscuous mode [ 78.210375][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.218233][ T5774] Cannot create hsr debugfs directory [ 78.224347][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.234159][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.260477][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.284639][ T5775] team0: Port device team_slave_0 added [ 78.293727][ T5775] team0: Port device team_slave_1 added [ 78.349362][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.356350][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.384059][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.423710][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.432566][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.461156][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.538234][ T5781] Bluetooth: hci1: command tx timeout [ 78.555859][ T5776] hsr_slave_0: entered promiscuous mode [ 78.563395][ T5776] hsr_slave_1: entered promiscuous mode [ 78.569985][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.578239][ T5776] Cannot create hsr debugfs directory [ 78.607085][ T5781] Bluetooth: hci3: command tx timeout [ 78.612816][ T5781] Bluetooth: hci0: command tx timeout [ 78.613451][ T51] Bluetooth: hci2: command tx timeout [ 78.666169][ T5775] hsr_slave_0: entered promiscuous mode [ 78.672737][ T5775] hsr_slave_1: entered promiscuous mode [ 78.679585][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.687550][ T5775] Cannot create hsr debugfs directory [ 78.844373][ T5777] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.869143][ T5777] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.921525][ T5777] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.945964][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.960338][ T5777] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.981471][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.992311][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.024255][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.138620][ T5776] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.157712][ T5776] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.169159][ T5776] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.200157][ T5776] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.248382][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.262530][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.272337][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.284066][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.417789][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.434230][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.483986][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.494912][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.514100][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.527277][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.534566][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.545317][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.552437][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.583204][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.590391][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.601335][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.608500][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.679981][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.691255][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.724132][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.731313][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.768116][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.775547][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.809543][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.854737][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.861945][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.881443][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.888638][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.056556][ T5775] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 80.087505][ T5775] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 80.192727][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.242609][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.329173][ T5777] veth0_vlan: entered promiscuous mode [ 80.389995][ T5777] veth1_vlan: entered promiscuous mode [ 80.409570][ T5774] veth0_vlan: entered promiscuous mode [ 80.430513][ T5774] veth1_vlan: entered promiscuous mode [ 80.482641][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.508478][ T5777] veth0_macvtap: entered promiscuous mode [ 80.526809][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.540615][ T5774] veth0_macvtap: entered promiscuous mode [ 80.551243][ T5774] veth1_macvtap: entered promiscuous mode [ 80.559639][ T5777] veth1_macvtap: entered promiscuous mode [ 80.607999][ T51] Bluetooth: hci1: command tx timeout [ 80.616380][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.631483][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.642516][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.654890][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.675578][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.687644][ T51] Bluetooth: hci2: command tx timeout [ 80.689753][ T5781] Bluetooth: hci3: command tx timeout [ 80.693478][ T5786] Bluetooth: hci0: command tx timeout [ 80.712496][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.724032][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.736380][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.758395][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.767927][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.776658][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.786063][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.801726][ T5776] veth0_vlan: entered promiscuous mode [ 80.811467][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.821235][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.830195][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.838963][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.878764][ T5776] veth1_vlan: entered promiscuous mode [ 80.962311][ T5775] veth0_vlan: entered promiscuous mode [ 81.005532][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.026213][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.061347][ T5775] veth1_vlan: entered promiscuous mode [ 81.071003][ T5776] veth0_macvtap: entered promiscuous mode [ 81.113302][ T5776] veth1_macvtap: entered promiscuous mode [ 81.126571][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.140009][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.185933][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.205902][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.219738][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.234177][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.245194][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.256966][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.268977][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.278787][ T5775] veth0_macvtap: entered promiscuous mode [ 81.293046][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.298211][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.319996][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.330639][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.340597][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.351159][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.363069][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.375883][ T5776] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.384798][ T5776] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.394346][ T5776] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.403183][ T5776] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.427951][ T5775] veth1_macvtap: entered promiscuous mode [ 81.519117][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.531276][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.542723][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.553991][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.564323][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.582105][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.594075][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.642026][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.679140][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.697842][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.710196][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.720489][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.732261][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.745714][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.754671][ T5840] md/raid:md0: not clean -- starting background reconstruction [ 81.771177][ T5840] md/raid:md0: device ram0 operational as raid disk 0 [ 81.790091][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.810435][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.818377][ T5840] md/raid:md0: not enough operational devices (3/4 failed) [ 81.838702][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.857116][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.911265][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.936456][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.031285][ T1138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.042782][ T5840] md/raid:md0: failed to run raid set. [ 82.058574][ T5840] md: pers->run() failed ... [ 82.076154][ T1138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.135775][ T5849] netlink: 188 bytes leftover after parsing attributes in process `syz.2.5'. [ 82.192999][ T1138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.260989][ T1138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.396418][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.444526][ T5854] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.467031][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.505608][ T27] audit: type=1326 audit(1786130892.746:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecb859e0d9 code=0x7ffc0000 [ 82.664740][ T27] audit: type=1326 audit(1786130892.776:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.695296][ T5786] Bluetooth: hci1: command tx timeout [ 82.727855][ T27] audit: type=1326 audit(1786130892.776:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.752685][ T27] audit: type=1326 audit(1786130892.776:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.778828][ T5786] Bluetooth: hci0: command tx timeout [ 82.778873][ T5781] Bluetooth: hci3: command tx timeout [ 82.784232][ T5786] Bluetooth: hci2: command tx timeout [ 82.799922][ T27] audit: type=1326 audit(1786130892.776:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.824194][ T27] audit: type=1326 audit(1786130892.776:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.856603][ T27] audit: type=1326 audit(1786130892.776:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 82.964130][ T27] audit: type=1326 audit(1786130892.776:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 83.017219][ T27] audit: type=1326 audit(1786130892.776:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 83.107365][ T5862] jffs2: notice: (5862) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 83.109235][ T27] audit: type=1326 audit(1786130892.776:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5853 comm="syz.1.6" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fecb859dd6b code=0x7ffc0000 [ 83.272231][ T5775] ------------[ cut here ]------------ [ 83.278524][ T5775] kernel BUG at fs/jffs2/nodelist.c:462! [ 83.293449][ T5775] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 83.299562][ T5775] CPU: 1 PID: 5775 Comm: syz-executor Not tainted syzkaller #0 [ 83.307093][ T5775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.317129][ T5775] RIP: 0010:jffs2_del_ino_cache+0x2b8/0x2c0 [ 83.323024][ T5775] Code: 08 ff e9 51 ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 4f fe ff ff 4c 89 e7 e8 72 00 08 ff e9 42 fe ff ff e8 18 7e af fe <0f> 0b 66 0f 1f 44 00 00 66 0f 1f 00 55 41 57 41 56 41 55 41 54 53 [ 83.342624][ T5775] RSP: 0018:ffffc9000464fa98 EFLAGS: 00010293 [ 83.348681][ T5775] RAX: ffffffff82d7f368 RBX: ffff888023b62000 RCX: ffff88802899bc00 [ 83.356639][ T5775] RDX: 0000000000000000 RSI: ffff888023b62000 RDI: ffff88802528a000 [ 83.364609][ T5775] RBP: 0000000000000006 R08: ffff88802528a36b R09: 1ffff11004a5146d [ 83.372569][ T5775] R10: dffffc0000000000 R11: ffffed1004a5146e R12: ffff888023b62000 [ 83.380531][ T5775] R13: dffffc0000000000 R14: ffff888023b62020 R15: ffff88802528a000 [ 83.388487][ T5775] FS: 0000555559487500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 83.397424][ T5775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.403990][ T5775] CR2: 00007ffccd3e3fe4 CR3: 0000000060b42000 CR4: 00000000003506e0 [ 83.411954][ T5775] Call Trace: [ 83.415218][ T5775] [ 83.418162][ T5775] ? jffs2_do_clear_inode+0x314/0x390 [ 83.423524][ T5775] jffs2_do_clear_inode+0x31f/0x390 [ 83.428726][ T5775] ? jffs2_statfs+0x370/0x370 [ 83.433415][ T5775] evict+0x4b7/0x8a0 [ 83.437324][ T5775] ? xa_load+0x64/0x2e0 [ 83.441492][ T5775] ? proc_nr_inodes+0x230/0x230 [ 83.446364][ T5775] ? do_raw_spin_unlock+0x121/0x230 [ 83.451587][ T5775] ? do_raw_spin_unlock+0x121/0x230 [ 83.456802][ T5775] evict_inodes+0x64a/0x6e0 [ 83.461323][ T5775] ? clear_inode+0x150/0x150 [ 83.465942][ T5775] ? jffs2_sync_fs+0x97/0xa0 [ 83.470550][ T5775] generic_shutdown_super+0x97/0x2b0 [ 83.475931][ T5775] kill_mtd_super+0x23/0x70 [ 83.480445][ T5775] jffs2_kill_sb+0x96/0xb0 [ 83.484888][ T5775] deactivate_locked_super+0x97/0x100 [ 83.490371][ T5775] cleanup_mnt+0x3d7/0x460 [ 83.494802][ T5775] task_work_run+0x1d4/0x260 [ 83.499413][ T5775] ? task_work_cancel+0x220/0x220 [ 83.504455][ T5775] ? exit_to_user_mode_loop+0x3b/0x110 [ 83.509935][ T5775] exit_to_user_mode_loop+0xe6/0x110 [ 83.515241][ T5775] exit_to_user_mode_prepare+0xee/0x180 [ 83.520805][ T5775] syscall_exit_to_user_mode+0x1a/0x50 [ 83.526287][ T5775] do_syscall_64+0x61/0xb0 [ 83.530719][ T5775] ? clear_bhb_loop+0x40/0x90 [ 83.535422][ T5775] ? clear_bhb_loop+0x40/0x90 [ 83.540119][ T5775] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 83.546028][ T5775] RIP: 0033:0x7f3acb19f317 [ 83.550473][ T5775] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 83.570126][ T5775] RSP: 002b:00007ffe289275c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 83.578549][ T5775] RAX: 0000000000000000 RBX: 00007f3acb234474 RCX: 00007f3acb19f317 [ 83.586512][ T5775] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe28927680 [ 83.594468][ T5775] RBP: 00007ffe28927680 R08: 00007ffe28928680 R09: 00000000ffffffff [ 83.602431][ T5775] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe28928710 [ 83.610395][ T5775] R13: 00007f3acb234474 R14: 00000000000144b7 R15: 00007ffe28928750 [ 83.618370][ T5775] [ 83.621385][ T5775] Modules linked in: [ 83.632603][ T5775] ---[ end trace 0000000000000000 ]--- [ 83.638444][ T5775] RIP: 0010:jffs2_del_ino_cache+0x2b8/0x2c0 [ 83.644417][ T5775] Code: 08 ff e9 51 ff ff ff 44 89 e1 80 e1 07 80 c1 03 38 c1 0f 8c 4f fe ff ff 4c 89 e7 e8 72 00 08 ff e9 42 fe ff ff e8 18 7e af fe <0f> 0b 66 0f 1f 44 00 00 66 0f 1f 00 55 41 57 41 56 41 55 41 54 53 [ 83.665498][ T5775] RSP: 0018:ffffc9000464fa98 EFLAGS: 00010293 [ 83.673186][ T5775] RAX: ffffffff82d7f368 RBX: ffff888023b62000 RCX: ffff88802899bc00 [ 83.681307][ T5775] RDX: 0000000000000000 RSI: ffff888023b62000 RDI: ffff88802528a000 [ 83.689521][ T5775] RBP: 0000000000000006 R08: ffff88802528a36b R09: 1ffff11004a5146d [ 83.697572][ T5775] R10: dffffc0000000000 R11: ffffed1004a5146e R12: ffff888023b62000 [ 83.705587][ T5775] R13: dffffc0000000000 R14: ffff888023b62020 R15: ffff88802528a000 [ 83.714892][ T5775] FS: 0000555559487500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 83.724091][ T5775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.734745][ T5775] CR2: 00007ffccd3e3fe4 CR3: 0000000060b42000 CR4: 00000000003506e0 [ 83.748833][ T5775] Kernel panic - not syncing: Fatal exception [ 83.755171][ T5775] Kernel Offset: disabled [ 83.759500][ T5775] Rebooting in 86400 seconds..