last executing test programs: 10m58.178820643s ago: executing program 3 (id=1783): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/pci0000:00/0000:00:00.0/devspec\x00', 0x101000, 0x0) read$auto(0x3, 0x0, 0x80) 10m58.001065628s ago: executing program 3 (id=1786): r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv6/neigh/bond_slave_0/unres_qlen\x00', 0x189302, 0x0) write$auto_proc_sys_file_operations_proc_sysctl(r0, &(0x7f00000001c0)="cc", 0x1) 10m57.791844261s ago: executing program 3 (id=1790): r0 = openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$auto_qrtr_tun_ops_tun(r0, &(0x7f0000000300)="01000000d80746ebe4fa29705e2e6540f64b000000000000a7e9ce67b7d2ab52b096b449", 0x24) 10m57.588265543s ago: executing program 3 (id=1795): r0 = socket(0x2, 0x1, 0x106) setsockopt$auto(r0, 0x6, 0x4, &(0x7f0000000080)='*\x00', 0xe6) 10m57.452214691s ago: executing program 3 (id=1797): rseq$auto(&(0x7f0000000280)={0xe, 0x403, 0x7, 0x80b, 0x83, 0x2}, 0x20, 0x0, 0x8000006) tkill$auto(0x80000000000001, 0x7) 10m56.913359873s ago: executing program 3 (id=1806): r0 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x28900, 0x0) ioctl$auto(r0, 0x64d1, 0x40) 10m56.502258769s ago: executing program 32 (id=1806): r0 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x28900, 0x0) ioctl$auto(r0, 0x64d1, 0x40) 9m26.023457316s ago: executing program 4 (id=3013): mmap$auto(0x0, 0x2020009, 0x126, 0xf8, 0xffffffffffffffff, 0x8000) madvise$auto(0x0, 0xffffffffffff0001, 0x11) 9m25.765936702s ago: executing program 4 (id=3017): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop3\x00', 0x40000, 0x0) ioctl$auto_BLKGETDISKSEQ(r0, 0x80081280, &(0x7f0000000200)=0x79) 9m25.501356045s ago: executing program 4 (id=3020): r0 = openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto_ftrace_set_event_fops_trace_events(r0, &(0x7f0000000680)="7ebf56a6458f174ee83866d376d9c1f11646ab6b30353077704e3fd59c058c5014f2f85132734ab56002ffad8d708ae58c78877c8a05f93703ff88c2dd2377089c7ed1946a9bded6f25284f0161b497d71f2297c2a6f8c37c423197acc7ff92101ebd38ac89e751e5c75846f2532ca3f19c7e4eb452e480ee83edf9d698f8651", 0x80) 9m25.230406595s ago: executing program 4 (id=3024): r0 = socket(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'veth0_to_bridge\x00'}) 9m24.993668477s ago: executing program 4 (id=3026): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000340)='/proc/fs/cifs/LookupCacheEnabled\x00', 0x8a241, 0x0) writev$auto(r0, &(0x7f0000000200)={0x0, 0x5}, 0xa) 9m24.743532909s ago: executing program 4 (id=3030): openat$auto_ptdump_curknl_fops_(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) 9m9.556635664s ago: executing program 33 (id=3030): openat$auto_ptdump_curknl_fops_(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) 1.169790961s ago: executing program 1 (id=12490): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) capset$auto(0x0, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$auto(r0, 0x0, 0x10, 0x0, 0x17) 967.76388ms ago: executing program 2 (id=12494): r0 = openat$auto_vsock_device_ops_af_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x1c1e00, 0x0) close_range$auto(r0, 0xffffffffffffffff, 0x2) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000200), 0xa0080, 0x0) readv$auto(r0, &(0x7f0000000300)={0x0, 0x7}, 0x2) 834.515495ms ago: executing program 0 (id=12495): r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2c, r0, 0x13, 0x70bd2c, 0x25dfdbdd, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_WIPHY_TX_POWER_SETTING={0x8, 0x61, 0x1}, @NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004080}, 0x20040894) 823.198114ms ago: executing program 2 (id=12496): mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0xffffffffffffffff, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) r0 = epoll_create$auto(0x2) epoll_pwait$auto(r0, 0x0, 0x3, 0x0, 0x0, 0x8) 795.130393ms ago: executing program 5 (id=12497): close_range$auto(0x2, 0x8, 0x0) openat$auto_uprobe_events_ops_trace_uprobe(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/tracing/uprobe_events\x00', 0x2102, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/controlC2\x00', 0x2584, 0x0) ioctl$auto(0x3, 0x40045542, 0xb551) 726.429459ms ago: executing program 1 (id=12498): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x3, 0x3b) getsockopt$auto(r0, 0x29, 0x6, 0x0, 0x0) 697.942223ms ago: executing program 5 (id=12499): close_range$auto(0x2, 0x8, 0x0) r0 = io_uring_setup$auto(0x59, &(0x7f0000000200)={0x0, 0x1d, 0x3800, 0x2, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6, 0xfffffffffffffffd}, {0x100, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x9, 0x100000000}}) io_uring_register$auto(r0, 0x57b, &(0x7f0000000000)="a6d051376fc8eb3319da8383", 0x1) io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3) 622.95118ms ago: executing program 0 (id=12500): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x3, 0x0) r0 = socket(0x2b, 0x1, 0x1) setsockopt$auto(r0, 0x29, 0x20, 0x0, 0x20) 619.39662ms ago: executing program 2 (id=12501): r0 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="010035bd7040ffdbdf210a000000"], 0x14}, 0x1, 0x0, 0x0, 0x30000881}, 0xc040804) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB='R'], 0x1ac}}, 0x40000) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x4008) 501.715763ms ago: executing program 0 (id=12502): mmap$auto(0x0, 0x402000b, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r0, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x20, 0xf3, 0xb0}}) 464.752344ms ago: executing program 5 (id=12503): r0 = open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x130) mmap$auto(0x0, 0x1, 0x40006, 0x9b72, 0x2, 0x8000) fallocate$auto(r0, 0x0, 0x9, 0x2) cachestat$auto(r0, 0x0, 0x0, 0x0) 437.131538ms ago: executing program 2 (id=12504): sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="05000000", @ANYBLOB="010025bd7000f7dbdf250100003f06000200010000000500070058000000080009000800000008000a000800000014001f00000000000000000000000000000000011400200000000000000000000000ff"], 0x5c}, 0x1, 0x0, 0x0, 0x44000}, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYBLOB='_\x00\''], 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x40000) r0 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8) 394.535829ms ago: executing program 0 (id=12505): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff) recvfrom$auto(r0, &(0x7f0000000600), 0x4, 0x4, 0x0, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x14, r1, 0x301, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) 356.006191ms ago: executing program 1 (id=12506): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sysfs$auto(0x2, 0x4b, 0x0) fsopen$auto(0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) 341.506213ms ago: executing program 5 (id=12507): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x30, r1, 0x1, 0x74bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_COALESCE_TX_USECS_IRQ={0x8, 0x8, 0x8}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0x81}]}, 0x30}, 0x1, 0x0, 0x0, 0x4801}, 0x12) 276.928385ms ago: executing program 2 (id=12508): mmap$auto(0x0, 0x20008, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8000, 0x0) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0xf, 0x0, 0x20) 258.145107ms ago: executing program 1 (id=12509): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0x11, 0x3, 0x9) capset$auto(0x0, &(0x7f0000000000)={0x1, 0x6, 0x48}) sendmmsg$auto(r0, &(0x7f0000000300)={{&(0x7f0000000000), 0x5ac, &(0x7f0000000340)={&(0x7f0000000200)="4c0300000000000000a3677337f9", 0x49}, 0x5, 0x0, 0x5, 0x1}, 0x5}, 0x1d50, 0x100) 181.045962ms ago: executing program 5 (id=12510): openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000240)='/dev/fb0\x00', 0x2a082, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip_vti0\x00', 0x0}) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r1, r0, 0x0, 0x2, 0xffffffffffffffff, @relative_id=0x13, 0x6}, 0xf) 160.877779ms ago: executing program 0 (id=12511): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000840)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_DEL_PMK(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000880)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48880}, 0x80) 131.695344ms ago: executing program 2 (id=12512): close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/platform/dummy_hcd.4/usb5/5-0:1.0/usb5-port1/power/runtime_active_time\x00', 0x0, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/loop6\x00', 0x101282, 0x0) ioctl$auto_SG_GET_RESERVED_SIZE(r0, 0x4c06, 0x0) 127.264414ms ago: executing program 1 (id=12513): r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="07002cc47000dddbdf2501fffff508000300", @ANYRES32=r2], 0x20}, 0x1, 0x0, 0x0, 0x24004080}, 0x200408d4) 10.925245ms ago: executing program 5 (id=12514): r0 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="13002cbd7000dddbdf252500f0c908000300", @ANYRES32=r2], 0x2c}, 0x1, 0x0, 0x0, 0x24004080}, 0x20040894) 7.719589ms ago: executing program 0 (id=12515): mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = mq_open$auto(&(0x7f00000000c0)='\x12\xe6D\b\x9e\x00\x80\x8d\f\xb9w-\xbd!\x9eb\xed\xfb\x0f\xe5\x9dZ\xc2\xd1\x01wBV\x91\x8f_\xc0.\x84\xfe\x84\xd1se\x01\x06\x00\xb3\x13_Y&\xa9\x88\xe4\xa2\xb0V\x85\x92<\xb6\xdcT \\\xf2\v\xb1\xe2\xd8\xfa\xd8V\xe5\x00\xfa\xe9!\xc5<\xce\x18=\x06\xdagq\xb5\r\t\xb2\xde\x99\xd50\xbb\x192\x1c4\x86\xc0\xc1-\xd5\x10\xc3\xfc*[8\x89h\xc5\xba\xff\xc8u5 [ 683.214293][T25896] dump_stack_lvl+0x100/0x190 [ 683.214342][T25896] sysfs_warn_dup.cold+0x1c/0x28 [ 683.214397][T25896] sysfs_do_create_link_sd+0x113/0x140 [ 683.214460][T25896] sysfs_create_link+0x61/0xc0 [ 683.214515][T25896] device_add+0x675/0x1970 [ 683.214670][T25896] ? __pfx_device_add+0x10/0x10 [ 683.214724][T25896] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 683.214782][T25896] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 683.214908][T25896] wiphy_register+0x2151/0x3110 [ 683.214958][T25896] ? __pfx_wiphy_register+0x10/0x10 [ 683.214994][T25896] ? __asan_memset+0x23/0x50 [ 683.215034][T25896] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 683.215136][T25896] ieee80211_register_hw+0x3053/0x4580 [ 683.215261][T25896] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 683.215309][T25896] ? __pfx___debug_object_init+0x10/0x10 [ 683.215374][T25896] ? find_held_lock+0x2b/0x80 [ 683.215422][T25896] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 683.215475][T25896] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 683.215517][T25896] ? __hrtimer_setup+0x208/0x330 [ 683.215561][T25896] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 683.215646][T25896] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 683.215702][T25896] ? __asan_memcpy+0x3c/0x60 [ 683.215746][T25896] hwsim_new_radio_nl+0xc6b/0x13f0 [ 683.215800][T25896] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 683.215863][T25896] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 683.215966][T25896] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 683.216043][T25896] genl_family_rcv_msg_doit+0x214/0x300 [ 683.216094][T25896] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 683.216140][T25896] ? genl_get_cmd+0x3e7/0x760 [ 683.216192][T25896] ? bpf_lsm_capable+0x9/0x10 [ 683.216232][T25896] ? security_capable+0x80/0x260 [ 683.216273][T25896] ? ns_capable+0xd2/0xf0 [ 683.216328][T25896] genl_rcv_msg+0x560/0x800 [ 683.216378][T25896] ? __pfx_genl_rcv_msg+0x10/0x10 [ 683.216425][T25896] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 683.216490][T25896] netlink_rcv_skb+0x159/0x420 [ 683.216529][T25896] ? __pfx_genl_rcv_msg+0x10/0x10 [ 683.216576][T25896] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 683.216633][T25896] ? netlink_deliver_tap+0x1ae/0xcc0 [ 683.216683][T25896] genl_rcv+0x28/0x40 [ 683.216723][T25896] netlink_unicast+0x585/0x850 [ 683.216769][T25896] ? __pfx_netlink_unicast+0x10/0x10 [ 683.216821][T25896] netlink_sendmsg+0x8b0/0xda0 [ 683.216869][T25896] ? __pfx_netlink_sendmsg+0x10/0x10 [ 683.216915][T25896] ? apparmor_socket_sendmsg+0x15b/0x270 [ 683.217009][T25896] ____sys_sendmsg+0xa4d/0xbe0 [ 683.217046][T25896] ? __pfx_netlink_sendmsg+0x10/0x10 [ 683.217090][T25896] ? __pfx_____sys_sendmsg+0x10/0x10 [ 683.217147][T25896] ___sys_sendmsg+0x190/0x1e0 [ 683.217219][T25896] ? __pfx____sys_sendmsg+0x10/0x10 [ 683.217255][T25896] ? __lock_acquire+0x49f/0x1a40 [ 683.217364][T25896] __sys_sendmsg+0x160/0x210 [ 683.217416][T25896] ? __pfx___sys_sendmsg+0x10/0x10 [ 683.217490][T25896] do_syscall_64+0x115/0x840 [ 683.217533][T25896] ? clear_bhb_loop+0x40/0x90 [ 683.217578][T25896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.217615][T25896] RIP: 0033:0x7f91e199de99 [ 683.217653][T25896] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 683.217688][T25896] RSP: 002b:00007f91e28f9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 683.217723][T25896] RAX: ffffffffffffffda RBX: 00007f91e1c25fa0 RCX: 00007f91e199de99 [ 683.217746][T25896] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 683.217768][T25896] RBP: 00007f91e1a33eaf R08: 0000000000000000 R09: 0000000000000000 [ 683.217790][T25896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 683.217810][T25896] R13: 00007f91e1c26038 R14: 00007f91e1c25fa0 R15: 00007ffd04328e78 [ 683.217857][T25896] [ 683.637341][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 683.643835][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.023192][T25959] openvswitch: netlink: IPv4 tunnel dst address is zero [ 685.220233][T25968] netlink: NAT attribute has 5 unknown bytes [ 685.378268][T25976] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 685.505722][T14997] Bluetooth: hci1: unexpected event 0x0e length: 2 < 3 [ 685.536026][T25984] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9497'. [ 685.746264][T25992] IPVS: length: 131 != 8 [ 685.990050][T26003] netlink: 'syz.0.9507': attribute type 2 has an invalid length. [ 686.010194][T26003] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9507'. [ 686.415175][T26021] nbd: must specify a device to reconfigure [ 686.833363][T26044] openvswitch: netlink: Key type 261 is out of range max 32 [ 687.701330][T26084] NFSD: Failed to start, no listeners configured. [ 687.925975][T26103] debugfs: '!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' already exists in 'ieee80211' [ 689.604819][T26189] openvswitch: netlink: IPv4 tunnel dst address is zero [ 690.351277][T26201] netlink: NAT attribute has 5 unknown bytes [ 690.490300][T26208] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 690.512534][T26208] CPU: 1 UID: 0 PID: 26208 Comm: syz.5.9611 Tainted: G U L syzkaller #0 PREEMPT(full) [ 690.512613][T26208] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 690.512627][T26208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 690.512655][T26208] Call Trace: [ 690.512666][T26208] [ 690.512679][T26208] dump_stack_lvl+0x100/0x190 [ 690.512724][T26208] sysfs_warn_dup.cold+0x1c/0x28 [ 690.512778][T26208] sysfs_do_create_link_sd+0x113/0x140 [ 690.512837][T26208] sysfs_create_link+0x61/0xc0 [ 690.512898][T26208] device_add+0x675/0x1970 [ 690.512961][T26208] ? __pfx_device_add+0x10/0x10 [ 690.513017][T26208] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 690.513071][T26208] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 690.513129][T26208] wiphy_register+0x2151/0x3110 [ 690.513176][T26208] ? __pfx_wiphy_register+0x10/0x10 [ 690.513210][T26208] ? __asan_memset+0x23/0x50 [ 690.513245][T26208] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 690.513314][T26208] ieee80211_register_hw+0x3053/0x4580 [ 690.513385][T26208] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 690.513433][T26208] ? __pfx___debug_object_init+0x10/0x10 [ 690.513494][T26208] ? __rcu_read_unlock+0x26a/0x5e0 [ 690.513527][T26208] ? rcu_is_watching+0x12/0xc0 [ 690.513571][T26208] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 690.513625][T26208] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 690.513666][T26208] ? __hrtimer_setup+0x208/0x330 [ 690.513710][T26208] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 690.513788][T26208] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 690.513841][T26208] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 690.513906][T26208] hwsim_new_radio_nl+0xc6b/0x13f0 [ 690.513962][T26208] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 690.514027][T26208] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 690.514076][T26208] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 690.514133][T26208] genl_family_rcv_msg_doit+0x214/0x300 [ 690.514184][T26208] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 690.514230][T26208] ? genl_get_cmd+0x3e7/0x760 [ 690.514282][T26208] ? bpf_lsm_capable+0x9/0x10 [ 690.514321][T26208] ? security_capable+0x80/0x260 [ 690.514361][T26208] ? ns_capable+0xd2/0xf0 [ 690.514401][T26208] genl_rcv_msg+0x560/0x800 [ 690.514451][T26208] ? __pfx_genl_rcv_msg+0x10/0x10 [ 690.514496][T26208] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 690.514561][T26208] netlink_rcv_skb+0x159/0x420 [ 690.514601][T26208] ? __pfx_genl_rcv_msg+0x10/0x10 [ 690.514647][T26208] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 690.514703][T26208] ? netlink_deliver_tap+0x1ae/0xcc0 [ 690.514747][T26208] genl_rcv+0x28/0x40 [ 690.514786][T26208] netlink_unicast+0x585/0x850 [ 690.514831][T26208] ? __pfx_netlink_unicast+0x10/0x10 [ 690.514882][T26208] netlink_sendmsg+0x8b0/0xda0 [ 690.514936][T26208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 690.514981][T26208] ? apparmor_socket_sendmsg+0x15b/0x270 [ 690.515027][T26208] ____sys_sendmsg+0xa4d/0xbe0 [ 690.515061][T26208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 690.515103][T26208] ? __pfx_____sys_sendmsg+0x10/0x10 [ 690.515158][T26208] ___sys_sendmsg+0x190/0x1e0 [ 690.515197][T26208] ? __pfx____sys_sendmsg+0x10/0x10 [ 690.515232][T26208] ? __lock_acquire+0x49f/0x1a40 [ 690.515360][T26208] __sys_sendmsg+0x160/0x210 [ 690.515412][T26208] ? __pfx___sys_sendmsg+0x10/0x10 [ 690.515487][T26208] do_syscall_64+0x115/0x840 [ 690.515530][T26208] ? clear_bhb_loop+0x40/0x90 [ 690.515574][T26208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.515612][T26208] RIP: 0033:0x7f8e2c19de99 [ 690.515642][T26208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 690.515677][T26208] RSP: 002b:00007f8e2d012028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 690.515712][T26208] RAX: ffffffffffffffda RBX: 00007f8e2c425fa0 RCX: 00007f8e2c19de99 [ 690.515736][T26208] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 690.515759][T26208] RBP: 00007f8e2c233eaf R08: 0000000000000000 R09: 0000000000000000 [ 690.515781][T26208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 690.515802][T26208] R13: 00007f8e2c426038 R14: 00007f8e2c425fa0 R15: 00007ffeb703fc28 [ 690.515848][T26208] [ 691.138916][T26217] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 691.156680][T26217] CPU: 1 UID: 0 PID: 26217 Comm: syz.5.9604 Tainted: G U L syzkaller #0 PREEMPT(full) [ 691.156739][T26217] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 691.156750][T26217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 691.156769][T26217] Call Trace: [ 691.156780][T26217] [ 691.156793][T26217] dump_stack_lvl+0x100/0x190 [ 691.156839][T26217] sysfs_warn_dup.cold+0x1c/0x28 [ 691.156894][T26217] sysfs_do_create_link_sd+0x113/0x140 [ 691.156966][T26217] sysfs_create_link+0x61/0xc0 [ 691.157022][T26217] device_add+0x675/0x1970 [ 691.157086][T26217] ? __pfx_device_add+0x10/0x10 [ 691.157141][T26217] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 691.157197][T26217] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 691.157258][T26217] wiphy_register+0x2151/0x3110 [ 691.157306][T26217] ? __pfx_wiphy_register+0x10/0x10 [ 691.157342][T26217] ? __asan_memset+0x23/0x50 [ 691.157381][T26217] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 691.157450][T26217] ieee80211_register_hw+0x3053/0x4580 [ 691.157520][T26217] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 691.157569][T26217] ? __pfx___debug_object_init+0x10/0x10 [ 691.157630][T26217] ? find_held_lock+0x2b/0x80 [ 691.157674][T26217] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 691.157726][T26217] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 691.157768][T26217] ? __hrtimer_setup+0x208/0x330 [ 691.157811][T26217] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 691.157886][T26217] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 691.157953][T26217] ? __asan_memcpy+0x3c/0x60 [ 691.157995][T26217] hwsim_new_radio_nl+0xc6b/0x13f0 [ 691.158049][T26217] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 691.158108][T26217] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 691.158156][T26217] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 691.158214][T26217] genl_family_rcv_msg_doit+0x214/0x300 [ 691.158264][T26217] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 691.158311][T26217] ? genl_get_cmd+0x3e7/0x760 [ 691.158363][T26217] ? bpf_lsm_capable+0x9/0x10 [ 691.158402][T26217] ? security_capable+0x80/0x260 [ 691.158441][T26217] ? ns_capable+0xd2/0xf0 [ 691.158481][T26217] genl_rcv_msg+0x560/0x800 [ 691.158531][T26217] ? __pfx_genl_rcv_msg+0x10/0x10 [ 691.158578][T26217] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 691.158643][T26217] netlink_rcv_skb+0x159/0x420 [ 691.158680][T26217] ? __pfx_genl_rcv_msg+0x10/0x10 [ 691.158724][T26217] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 691.158760][T26217] ? rcu_is_watching+0x12/0xc0 [ 691.158818][T26217] ? __rcu_read_unlock+0x26a/0x5e0 [ 691.158851][T26217] ? rcu_is_watching+0x12/0xc0 [ 691.158911][T26217] genl_rcv+0x28/0x40 [ 691.158951][T26217] netlink_unicast+0x585/0x850 [ 691.158997][T26217] ? __pfx_netlink_unicast+0x10/0x10 [ 691.159050][T26217] netlink_sendmsg+0x8b0/0xda0 [ 691.159097][T26217] ? __pfx_netlink_sendmsg+0x10/0x10 [ 691.159144][T26217] ? apparmor_socket_sendmsg+0x15b/0x270 [ 691.159191][T26217] ____sys_sendmsg+0xa4d/0xbe0 [ 691.159225][T26217] ? __pfx_netlink_sendmsg+0x10/0x10 [ 691.159275][T26217] ? __pfx_____sys_sendmsg+0x10/0x10 [ 691.159308][T26217] ? futex_hash+0x311/0x400 [ 691.159353][T26217] ? plist_del+0x308/0x510 [ 691.159393][T26217] ___sys_sendmsg+0x190/0x1e0 [ 691.159436][T26217] ? __pfx____sys_sendmsg+0x10/0x10 [ 691.159472][T26217] ? __lock_acquire+0x49f/0x1a40 [ 691.159531][T26217] ? futex_wake+0x220/0x5e0 [ 691.159625][T26217] __sys_sendmsg+0x160/0x210 [ 691.159676][T26217] ? __pfx___sys_sendmsg+0x10/0x10 [ 691.159746][T26217] do_syscall_64+0x115/0x840 [ 691.159786][T26217] ? clear_bhb_loop+0x40/0x90 [ 691.159828][T26217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.159862][T26217] RIP: 0033:0x7f8e2c19de99 [ 691.159887][T26217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.159923][T26217] RSP: 002b:00007f8e2d012028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 691.159951][T26217] RAX: ffffffffffffffda RBX: 00007f8e2c425fa0 RCX: 00007f8e2c19de99 [ 691.159971][T26217] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 691.159989][T26217] RBP: 00007f8e2c233eaf R08: 0000000000000000 R09: 0000000000000000 [ 691.160008][T26217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 691.160025][T26217] R13: 00007f8e2c426038 R14: 00007f8e2c425fa0 R15: 00007ffeb703fc28 [ 691.160063][T26217] [ 691.607182][T26221] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 691.643725][T26221] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 691.654640][T26221] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 691.688455][ T10] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 691.708647][T26220] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 692.004783][T14997] Bluetooth: hci4: unexpected event 0x0e length: 2 < 3 [ 692.070591][T26241] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9617'. [ 692.288776][T26248] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 692.300390][T26248] CPU: 0 UID: 0 PID: 26248 Comm: syz.2.9623 Tainted: G U L syzkaller #0 PREEMPT(full) [ 692.300452][T26248] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 692.300466][T26248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 692.300486][T26248] Call Trace: [ 692.300497][T26248] [ 692.300510][T26248] dump_stack_lvl+0x100/0x190 [ 692.300557][T26248] sysfs_warn_dup.cold+0x1c/0x28 [ 692.300611][T26248] sysfs_do_create_link_sd+0x113/0x140 [ 692.300667][T26248] sysfs_create_link+0x61/0xc0 [ 692.300718][T26248] device_add+0x675/0x1970 [ 692.300775][T26248] ? __pfx_device_add+0x10/0x10 [ 692.300828][T26248] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 692.300895][T26248] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 692.300952][T26248] wiphy_register+0x2151/0x3110 [ 692.301002][T26248] ? __pfx_wiphy_register+0x10/0x10 [ 692.301038][T26248] ? __asan_memset+0x23/0x50 [ 692.301078][T26248] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 692.301142][T26248] ieee80211_register_hw+0x3053/0x4580 [ 692.301210][T26248] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 692.301256][T26248] ? __pfx___debug_object_init+0x10/0x10 [ 692.301318][T26248] ? find_held_lock+0x2b/0x80 [ 692.301364][T26248] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 692.301419][T26248] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 692.301458][T26248] ? __hrtimer_setup+0x208/0x330 [ 692.301501][T26248] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 692.301577][T26248] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 692.301637][T26248] ? __asan_memcpy+0x3c/0x60 [ 692.301680][T26248] hwsim_new_radio_nl+0xc6b/0x13f0 [ 692.301733][T26248] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 692.301795][T26248] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 692.301853][T26248] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 692.301911][T26248] genl_family_rcv_msg_doit+0x214/0x300 [ 692.301961][T26248] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 692.302009][T26248] ? genl_get_cmd+0x3e7/0x760 [ 692.302059][T26248] ? bpf_lsm_capable+0x9/0x10 [ 692.302099][T26248] ? security_capable+0x80/0x260 [ 692.302137][T26248] ? ns_capable+0xd2/0xf0 [ 692.302177][T26248] genl_rcv_msg+0x560/0x800 [ 692.302226][T26248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 692.302272][T26248] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 692.302335][T26248] netlink_rcv_skb+0x159/0x420 [ 692.302373][T26248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 692.302416][T26248] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 692.302470][T26248] ? netlink_deliver_tap+0x1ae/0xcc0 [ 692.302511][T26248] genl_rcv+0x28/0x40 [ 692.302549][T26248] netlink_unicast+0x585/0x850 [ 692.302593][T26248] ? __pfx_netlink_unicast+0x10/0x10 [ 692.302643][T26248] netlink_sendmsg+0x8b0/0xda0 [ 692.302690][T26248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.302735][T26248] ? apparmor_socket_sendmsg+0x15b/0x270 [ 692.302782][T26248] ____sys_sendmsg+0xa4d/0xbe0 [ 692.302815][T26248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 692.302868][T26248] ? __pfx_____sys_sendmsg+0x10/0x10 [ 692.302930][T26248] ___sys_sendmsg+0x190/0x1e0 [ 692.302969][T26248] ? __pfx____sys_sendmsg+0x10/0x10 [ 692.303009][T26248] ? __lock_acquire+0x49f/0x1a40 [ 692.303114][T26248] __sys_sendmsg+0x160/0x210 [ 692.303161][T26248] ? __pfx___sys_sendmsg+0x10/0x10 [ 692.303232][T26248] do_syscall_64+0x115/0x840 [ 692.303274][T26248] ? clear_bhb_loop+0x40/0x90 [ 692.303318][T26248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.303355][T26248] RIP: 0033:0x7f47ffb9de99 [ 692.303382][T26248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.303416][T26248] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 692.303449][T26248] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 692.303471][T26248] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 692.303490][T26248] RBP: 00007f47ffc33eaf R08: 0000000000000000 R09: 0000000000000000 [ 692.303510][T26248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.303530][T26248] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 692.303572][T26248] [ 692.771295][T26251] nbd: must specify a device to reconfigure [ 694.054450][T26313] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 694.072986][T26313] CPU: 1 UID: 0 PID: 26313 Comm: syz.1.9662 Tainted: G U L syzkaller #0 PREEMPT(full) [ 694.073041][T26313] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 694.073054][T26313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 694.073074][T26313] Call Trace: [ 694.073085][T26313] [ 694.073096][T26313] dump_stack_lvl+0x100/0x190 [ 694.073140][T26313] sysfs_warn_dup.cold+0x1c/0x28 [ 694.073189][T26313] sysfs_do_create_link_sd+0x113/0x140 [ 694.073256][T26313] sysfs_create_link+0x61/0xc0 [ 694.073308][T26313] device_add+0x675/0x1970 [ 694.073365][T26313] ? __pfx_device_add+0x10/0x10 [ 694.073416][T26313] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 694.073472][T26313] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 694.073530][T26313] wiphy_register+0x2151/0x3110 [ 694.073579][T26313] ? __pfx_wiphy_register+0x10/0x10 [ 694.073614][T26313] ? __asan_memset+0x23/0x50 [ 694.073652][T26313] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 694.073718][T26313] ieee80211_register_hw+0x3053/0x4580 [ 694.073789][T26313] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 694.073840][T26313] ? __pfx___debug_object_init+0x10/0x10 [ 694.073905][T26313] ? find_held_lock+0x2b/0x80 [ 694.073952][T26313] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 694.074008][T26313] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 694.074048][T26313] ? __hrtimer_setup+0x208/0x330 [ 694.074093][T26313] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 694.074172][T26313] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 694.074237][T26313] ? __asan_memcpy+0x3c/0x60 [ 694.074281][T26313] hwsim_new_radio_nl+0xc6b/0x13f0 [ 694.074336][T26313] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 694.074400][T26313] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 694.074449][T26313] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 694.074508][T26313] genl_family_rcv_msg_doit+0x214/0x300 [ 694.074560][T26313] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 694.074605][T26313] ? genl_get_cmd+0x3e7/0x760 [ 694.074657][T26313] ? bpf_lsm_capable+0x9/0x10 [ 694.074696][T26313] ? security_capable+0x80/0x260 [ 694.074736][T26313] ? ns_capable+0xd2/0xf0 [ 694.074777][T26313] genl_rcv_msg+0x560/0x800 [ 694.074828][T26313] ? __pfx_genl_rcv_msg+0x10/0x10 [ 694.074874][T26313] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 694.074940][T26313] netlink_rcv_skb+0x159/0x420 [ 694.074979][T26313] ? __pfx_genl_rcv_msg+0x10/0x10 [ 694.075046][T26313] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 694.075104][T26313] ? netlink_deliver_tap+0x1ae/0xcc0 [ 694.075149][T26313] genl_rcv+0x28/0x40 [ 694.075188][T26313] netlink_unicast+0x585/0x850 [ 694.075240][T26313] ? __pfx_netlink_unicast+0x10/0x10 [ 694.075288][T26313] netlink_sendmsg+0x8b0/0xda0 [ 694.075333][T26313] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.075376][T26313] ? apparmor_socket_sendmsg+0x15b/0x270 [ 694.075423][T26313] ____sys_sendmsg+0xa4d/0xbe0 [ 694.075458][T26313] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.075499][T26313] ? __pfx_____sys_sendmsg+0x10/0x10 [ 694.075555][T26313] ___sys_sendmsg+0x190/0x1e0 [ 694.075595][T26313] ? __pfx____sys_sendmsg+0x10/0x10 [ 694.075630][T26313] ? __lock_acquire+0x49f/0x1a40 [ 694.075737][T26313] __sys_sendmsg+0x160/0x210 [ 694.075787][T26313] ? __pfx___sys_sendmsg+0x10/0x10 [ 694.075860][T26313] do_syscall_64+0x115/0x840 [ 694.075902][T26313] ? clear_bhb_loop+0x40/0x90 [ 694.075945][T26313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.075980][T26313] RIP: 0033:0x7f0031f9de99 [ 694.076008][T26313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 694.076043][T26313] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 694.076076][T26313] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 694.076099][T26313] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 694.076121][T26313] RBP: 00007f0032033eaf R08: 0000000000000000 R09: 0000000000000000 [ 694.076143][T26313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 694.076163][T26313] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 694.076209][T26313] [ 695.810051][T26367] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 695.974414][T26369] nbd: illegal input index -1024 [ 696.233262][T26384] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9689'. [ 697.277779][T26440] netlink: 334 bytes leftover after parsing attributes in process `syz.2.9713'. [ 697.954490][T26466] netlink: 'syz.1.9727': attribute type 1 has an invalid length. [ 698.218061][T26480] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 698.389292][T26486] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 698.423906][T26486] CPU: 1 UID: 0 PID: 26486 Comm: syz.2.9738 Tainted: G U L syzkaller #0 PREEMPT(full) [ 698.423961][T26486] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 698.423972][T26486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 698.423990][T26486] Call Trace: [ 698.424000][T26486] [ 698.424011][T26486] dump_stack_lvl+0x100/0x190 [ 698.424050][T26486] sysfs_warn_dup.cold+0x1c/0x28 [ 698.424096][T26486] sysfs_do_create_link_sd+0x113/0x140 [ 698.424146][T26486] sysfs_create_link+0x61/0xc0 [ 698.424189][T26486] device_add+0x675/0x1970 [ 698.424241][T26486] ? __pfx_device_add+0x10/0x10 [ 698.424297][T26486] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 698.424344][T26486] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 698.424394][T26486] wiphy_register+0x2151/0x3110 [ 698.424433][T26486] ? __pfx_wiphy_register+0x10/0x10 [ 698.424462][T26486] ? __asan_memset+0x23/0x50 [ 698.424495][T26486] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 698.424551][T26486] ieee80211_register_hw+0x3053/0x4580 [ 698.424608][T26486] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 698.424648][T26486] ? __pfx___debug_object_init+0x10/0x10 [ 698.424699][T26486] ? find_held_lock+0x2b/0x80 [ 698.424737][T26486] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 698.424783][T26486] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 698.424816][T26486] ? __hrtimer_setup+0x208/0x330 [ 698.424851][T26486] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 698.424914][T26486] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 698.424957][T26486] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 698.425001][T26486] hwsim_new_radio_nl+0xc6b/0x13f0 [ 698.425045][T26486] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 698.425095][T26486] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 698.425135][T26486] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 698.425182][T26486] genl_family_rcv_msg_doit+0x214/0x300 [ 698.425222][T26486] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 698.425269][T26486] ? genl_get_cmd+0x3e7/0x760 [ 698.425315][T26486] ? bpf_lsm_capable+0x9/0x10 [ 698.425348][T26486] ? security_capable+0x80/0x260 [ 698.425381][T26486] ? ns_capable+0xd2/0xf0 [ 698.425413][T26486] genl_rcv_msg+0x560/0x800 [ 698.425454][T26486] ? __pfx_genl_rcv_msg+0x10/0x10 [ 698.425491][T26486] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 698.425543][T26486] netlink_rcv_skb+0x159/0x420 [ 698.425575][T26486] ? __pfx_genl_rcv_msg+0x10/0x10 [ 698.425613][T26486] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 698.425658][T26486] ? netlink_deliver_tap+0x1ae/0xcc0 [ 698.425692][T26486] genl_rcv+0x28/0x40 [ 698.425723][T26486] netlink_unicast+0x585/0x850 [ 698.425759][T26486] ? __pfx_netlink_unicast+0x10/0x10 [ 698.425803][T26486] netlink_sendmsg+0x8b0/0xda0 [ 698.425840][T26486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 698.425877][T26486] ? apparmor_socket_sendmsg+0x15b/0x270 [ 698.425915][T26486] ____sys_sendmsg+0xa4d/0xbe0 [ 698.425943][T26486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 698.425978][T26486] ? __pfx_____sys_sendmsg+0x10/0x10 [ 698.426023][T26486] ___sys_sendmsg+0x190/0x1e0 [ 698.426057][T26486] ? __pfx____sys_sendmsg+0x10/0x10 [ 698.426086][T26486] ? __lock_acquire+0x49f/0x1a40 [ 698.426172][T26486] __sys_sendmsg+0x160/0x210 [ 698.426214][T26486] ? __pfx___sys_sendmsg+0x10/0x10 [ 698.426279][T26486] do_syscall_64+0x115/0x840 [ 698.426314][T26486] ? clear_bhb_loop+0x40/0x90 [ 698.426351][T26486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.426380][T26486] RIP: 0033:0x7f47ffb9de99 [ 698.426405][T26486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.426434][T26486] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 698.426461][T26486] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 698.426480][T26486] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 698.426498][T26486] RBP: 00007f47ffc33eaf R08: 0000000000000000 R09: 0000000000000000 [ 698.426516][T26486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 698.426533][T26486] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 698.426570][T26486] [ 698.991748][T26497] syz_tun: tun_chr_ioctl cmd 35108 [ 699.065912][T26500] netlink: 'syz.5.9740': attribute type 1 has an invalid length. [ 699.699132][T26534] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9759'. [ 699.828076][T26540] netlink: 'syz.5.9762': attribute type 11 has an invalid length. [ 699.852886][T26540] netlink: 'syz.5.9762': attribute type 11 has an invalid length. [ 699.872802][T26540] netlink: 'syz.5.9762': attribute type 11 has an invalid length. [ 700.673584][T26577] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 701.088556][T26593] openvswitch: netlink: IP tunnel attribute has 3 unknown bytes. [ 701.384256][T26606] syz_tun: tun_chr_ioctl cmd 1074025684 [ 702.632475][T26663] nbd: illegal input index -1024 [ 702.799039][T26671] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 702.814497][T26671] CPU: 0 UID: 0 PID: 26671 Comm: syz.1.9820 Tainted: G U L syzkaller #0 PREEMPT(full) [ 702.814555][T26671] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 702.814569][T26671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 702.814590][T26671] Call Trace: [ 702.814601][T26671] [ 702.814613][T26671] dump_stack_lvl+0x100/0x190 [ 702.814659][T26671] sysfs_warn_dup.cold+0x1c/0x28 [ 702.814712][T26671] sysfs_do_create_link_sd+0x113/0x140 [ 702.814769][T26671] sysfs_create_link+0x61/0xc0 [ 702.814823][T26671] device_add+0x675/0x1970 [ 702.814886][T26671] ? __pfx_device_add+0x10/0x10 [ 702.814940][T26671] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 702.814996][T26671] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 702.815059][T26671] wiphy_register+0x2151/0x3110 [ 702.815106][T26671] ? __pfx_wiphy_register+0x10/0x10 [ 702.815142][T26671] ? __asan_memset+0x23/0x50 [ 702.815180][T26671] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 702.815250][T26671] ieee80211_register_hw+0x3053/0x4580 [ 702.815320][T26671] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 702.815375][T26671] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 702.815426][T26671] ? __hrtimer_setup+0x69/0x330 [ 702.815466][T26671] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 702.815521][T26671] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 702.815561][T26671] ? __hrtimer_setup+0x208/0x330 [ 702.815605][T26671] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 702.815683][T26671] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 702.815736][T26671] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 702.815791][T26671] hwsim_new_radio_nl+0xc6b/0x13f0 [ 702.815844][T26671] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 702.815908][T26671] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 702.815956][T26671] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 702.816013][T26671] genl_family_rcv_msg_doit+0x214/0x300 [ 702.816063][T26671] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 702.816109][T26671] ? genl_get_cmd+0x3e7/0x760 [ 702.816160][T26671] ? bpf_lsm_capable+0x9/0x10 [ 702.816198][T26671] ? security_capable+0x80/0x260 [ 702.816238][T26671] ? ns_capable+0xd2/0xf0 [ 702.816279][T26671] genl_rcv_msg+0x560/0x800 [ 702.816328][T26671] ? __pfx_genl_rcv_msg+0x10/0x10 [ 702.816381][T26671] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 702.816443][T26671] netlink_rcv_skb+0x159/0x420 [ 702.816481][T26671] ? __pfx_genl_rcv_msg+0x10/0x10 [ 702.816523][T26671] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 702.816576][T26671] ? netlink_deliver_tap+0x1ae/0xcc0 [ 702.816616][T26671] genl_rcv+0x28/0x40 [ 702.816652][T26671] netlink_unicast+0x585/0x850 [ 702.816697][T26671] ? __pfx_netlink_unicast+0x10/0x10 [ 702.816748][T26671] netlink_sendmsg+0x8b0/0xda0 [ 702.816795][T26671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 702.816841][T26671] ? apparmor_socket_sendmsg+0x15b/0x270 [ 702.816887][T26671] ____sys_sendmsg+0xa4d/0xbe0 [ 702.816920][T26671] ? __pfx_netlink_sendmsg+0x10/0x10 [ 702.816962][T26671] ? __pfx_____sys_sendmsg+0x10/0x10 [ 702.817017][T26671] ___sys_sendmsg+0x190/0x1e0 [ 702.817057][T26671] ? __pfx____sys_sendmsg+0x10/0x10 [ 702.817094][T26671] ? __lock_acquire+0x49f/0x1a40 [ 702.817204][T26671] __sys_sendmsg+0x160/0x210 [ 702.817255][T26671] ? __pfx___sys_sendmsg+0x10/0x10 [ 702.817330][T26671] do_syscall_64+0x115/0x840 [ 702.817384][T26671] ? clear_bhb_loop+0x40/0x90 [ 702.817430][T26671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 702.817465][T26671] RIP: 0033:0x7f0031f9de99 [ 702.817495][T26671] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 702.817530][T26671] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 702.817565][T26671] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 702.817589][T26671] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 702.817611][T26671] RBP: 00007f0032033eaf R08: 0000000000000000 R09: 0000000000000000 [ 702.817633][T26671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 702.817655][T26671] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 702.817699][T26671] [ 703.682513][T26697] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 703.694203][T26697] CPU: 0 UID: 0 PID: 26697 Comm: syz.2.9835 Tainted: G U L syzkaller #0 PREEMPT(full) [ 703.694257][T26697] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 703.694271][T26697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 703.694299][T26697] Call Trace: [ 703.694310][T26697] [ 703.694323][T26697] dump_stack_lvl+0x100/0x190 [ 703.694368][T26697] sysfs_warn_dup.cold+0x1c/0x28 [ 703.694415][T26697] sysfs_do_create_link_sd+0x113/0x140 [ 703.694465][T26697] sysfs_create_link+0x61/0xc0 [ 703.694508][T26697] device_add+0x675/0x1970 [ 703.694559][T26697] ? __pfx_device_add+0x10/0x10 [ 703.694602][T26697] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 703.694650][T26697] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 703.694699][T26697] wiphy_register+0x2151/0x3110 [ 703.694739][T26697] ? __pfx_wiphy_register+0x10/0x10 [ 703.694768][T26697] ? __asan_memset+0x23/0x50 [ 703.694801][T26697] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 703.694857][T26697] ieee80211_register_hw+0x3053/0x4580 [ 703.694915][T26697] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 703.694953][T26697] ? __pfx___debug_object_init+0x10/0x10 [ 703.695002][T26697] ? find_held_lock+0x2b/0x80 [ 703.695039][T26697] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 703.695082][T26697] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 703.695115][T26697] ? __hrtimer_setup+0x208/0x330 [ 703.695151][T26697] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 703.695215][T26697] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 703.695259][T26697] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 703.695317][T26697] hwsim_new_radio_nl+0xc6b/0x13f0 [ 703.695361][T26697] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 703.695412][T26697] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 703.695451][T26697] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 703.695497][T26697] genl_family_rcv_msg_doit+0x214/0x300 [ 703.695537][T26697] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 703.695573][T26697] ? genl_get_cmd+0x3e7/0x760 [ 703.695619][T26697] ? bpf_lsm_capable+0x9/0x10 [ 703.695650][T26697] ? security_capable+0x80/0x260 [ 703.695683][T26697] ? ns_capable+0xd2/0xf0 [ 703.695716][T26697] genl_rcv_msg+0x560/0x800 [ 703.695757][T26697] ? __pfx_genl_rcv_msg+0x10/0x10 [ 703.695795][T26697] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 703.695848][T26697] netlink_rcv_skb+0x159/0x420 [ 703.695880][T26697] ? __pfx_genl_rcv_msg+0x10/0x10 [ 703.695926][T26697] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 703.695980][T26697] ? netlink_deliver_tap+0x1ae/0xcc0 [ 703.696021][T26697] genl_rcv+0x28/0x40 [ 703.696058][T26697] netlink_unicast+0x585/0x850 [ 703.696102][T26697] ? __pfx_netlink_unicast+0x10/0x10 [ 703.696151][T26697] netlink_sendmsg+0x8b0/0xda0 [ 703.696196][T26697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 703.696241][T26697] ? apparmor_socket_sendmsg+0x15b/0x270 [ 703.696297][T26697] ____sys_sendmsg+0xa4d/0xbe0 [ 703.696334][T26697] ? __pfx_netlink_sendmsg+0x10/0x10 [ 703.696378][T26697] ? __pfx_____sys_sendmsg+0x10/0x10 [ 703.696432][T26697] ___sys_sendmsg+0x190/0x1e0 [ 703.696472][T26697] ? __pfx____sys_sendmsg+0x10/0x10 [ 703.696508][T26697] ? __lock_acquire+0x49f/0x1a40 [ 703.696618][T26697] __sys_sendmsg+0x160/0x210 [ 703.696669][T26697] ? __pfx___sys_sendmsg+0x10/0x10 [ 703.696744][T26697] do_syscall_64+0x115/0x840 [ 703.696788][T26697] ? clear_bhb_loop+0x40/0x90 [ 703.696831][T26697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.696879][T26697] RIP: 0033:0x7f47ffb9de99 [ 703.696909][T26697] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.696945][T26697] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 703.696979][T26697] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 703.697004][T26697] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 703.697026][T26697] RBP: 00007f47ffc33eaf R08: 0000000000000000 R09: 0000000000000000 [ 703.697048][T26697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 703.697069][T26697] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 703.697115][T26697] [ 704.518190][T26707] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE ùrõ£Ò„yù*›"¤l-ý¤ôy–ú„L̓÷ÓÄ]' [ 704.529568][T26707] CPU: 0 UID: 0 PID: 26707 Comm: syz.1.9848 Tainted: G U L syzkaller #0 PREEMPT(full) [ 704.529623][T26707] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 704.529637][T26707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 704.529665][T26707] Call Trace: [ 704.529676][T26707] [ 704.529689][T26707] dump_stack_lvl+0x100/0x190 [ 704.529733][T26707] sysfs_warn_dup.cold+0x1c/0x28 [ 704.529787][T26707] sysfs_do_create_link_sd+0x113/0x140 [ 704.529846][T26707] sysfs_create_link+0x61/0xc0 [ 704.529900][T26707] device_add+0x675/0x1970 [ 704.529959][T26707] ? __pfx_device_add+0x10/0x10 [ 704.530014][T26707] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 704.530068][T26707] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 704.530128][T26707] wiphy_register+0x2151/0x3110 [ 704.530176][T26707] ? __pfx_wiphy_register+0x10/0x10 [ 704.530212][T26707] ? __asan_memset+0x23/0x50 [ 704.530250][T26707] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 704.530319][T26707] ieee80211_register_hw+0x3053/0x4580 [ 704.530389][T26707] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 704.530438][T26707] ? __pfx___debug_object_init+0x10/0x10 [ 704.530500][T26707] ? find_held_lock+0x2b/0x80 [ 704.530546][T26707] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 704.530600][T26707] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 704.530640][T26707] ? __hrtimer_setup+0x208/0x330 [ 704.530694][T26707] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 704.530773][T26707] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 704.530828][T26707] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 704.530885][T26707] hwsim_new_radio_nl+0xc6b/0x13f0 [ 704.530938][T26707] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 704.530999][T26707] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 704.531044][T26707] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 704.531101][T26707] genl_family_rcv_msg_doit+0x214/0x300 [ 704.531148][T26707] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 704.531194][T26707] ? genl_get_cmd+0x3e7/0x760 [ 704.531246][T26707] ? bpf_lsm_capable+0x9/0x10 [ 704.531284][T26707] ? security_capable+0x80/0x260 [ 704.531323][T26707] ? ns_capable+0xd2/0xf0 [ 704.531362][T26707] genl_rcv_msg+0x560/0x800 [ 704.531409][T26707] ? __pfx_genl_rcv_msg+0x10/0x10 [ 704.531453][T26707] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 704.531517][T26707] netlink_rcv_skb+0x159/0x420 [ 704.531555][T26707] ? __pfx_genl_rcv_msg+0x10/0x10 [ 704.531601][T26707] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 704.531664][T26707] ? netlink_deliver_tap+0x1ae/0xcc0 [ 704.531708][T26707] genl_rcv+0x28/0x40 [ 704.531745][T26707] netlink_unicast+0x585/0x850 [ 704.531789][T26707] ? __pfx_netlink_unicast+0x10/0x10 [ 704.531840][T26707] netlink_sendmsg+0x8b0/0xda0 [ 704.531886][T26707] ? __pfx_netlink_sendmsg+0x10/0x10 [ 704.531931][T26707] ? apparmor_socket_sendmsg+0x15b/0x270 [ 704.531975][T26707] ____sys_sendmsg+0xa4d/0xbe0 [ 704.532008][T26707] ? __pfx_netlink_sendmsg+0x10/0x10 [ 704.532049][T26707] ? __pfx_____sys_sendmsg+0x10/0x10 [ 704.532102][T26707] ___sys_sendmsg+0x190/0x1e0 [ 704.532142][T26707] ? __pfx____sys_sendmsg+0x10/0x10 [ 704.532175][T26707] ? __lock_acquire+0x49f/0x1a40 [ 704.532283][T26707] __sys_sendmsg+0x160/0x210 [ 704.532331][T26707] ? __pfx___sys_sendmsg+0x10/0x10 [ 704.532403][T26707] do_syscall_64+0x115/0x840 [ 704.532446][T26707] ? clear_bhb_loop+0x40/0x90 [ 704.532492][T26707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.532528][T26707] RIP: 0033:0x7f0031f9de99 [ 704.532557][T26707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 704.532591][T26707] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 704.532625][T26707] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 704.532647][T26707] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 704.532678][T26707] RBP: 00007f0032033eaf R08: 0000000000000000 R09: 0000000000000000 [ 704.532698][T26707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 704.532720][T26707] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 704.532765][T26707] [ 705.353198][T26732] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 705.572708][T26744] netlink: 'syz.2.9858': attribute type 3 has an invalid length. [ 706.712543][T26794] openvswitch: netlink: IP tunnel attribute has 3 unknown bytes. [ 708.068460][T26859] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 708.869277][T26890] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 709.416620][T26916] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 710.234285][T26960] netlink: Conntrack attr has 5 unknown bytes [ 710.938827][T26995] openvswitch: netlink: IP tunnel dst address not specified [ 711.138948][T27003] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 711.542703][T27020] openvswitch: netlink: IP tunnel dst address not specified [ 711.714556][T27031] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 712.076164][T27053] netlink: Conntrack attr has 5 unknown bytes [ 712.173369][T27055] openvswitch: netlink: IP tunnel dst address not specified [ 712.199795][T27058] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 712.463905][T27069] netlink: Conntrack attr has 5 unknown bytes [ 714.491878][ T24] Process accounting resumed [ 714.852088][T27177] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10052'. [ 715.518223][T27212] netlink: 'syz.2.10072': attribute type 1 has an invalid length. [ 715.818909][ T24] Process accounting resumed [ 716.221250][T27245] netlink: 'syz.0.10088': attribute type 1 has an invalid length. [ 716.449099][ T24] Process accounting resumed [ 716.979268][T27275] netlink: 'syz.1.10100': attribute type 1 has an invalid length. [ 719.856316][T27415] random: crng reseeded on system resumption [ 720.450919][T27445] random: crng reseeded on system resumption [ 720.990573][T27471] random: crng reseeded on system resumption [ 723.375609][T27582] netlink: 'syz.2.10244': attribute type 1 has an invalid length. [ 723.976235][T27612] netlink: 'syz.0.10257': attribute type 1 has an invalid length. [ 725.301920][T27661] netlink: 'syz.0.10281': attribute type 1 has an invalid length. [ 725.519575][T14997] Bluetooth: hci0: ISO packet for unknown connection handle 4095 [ 730.012096][T14997] Bluetooth: hci2: ACL packet too small [ 730.231925][T27877] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 731.427121][T27932] netlink: del zone limit has 4 unknown bytes [ 731.443440][T27928] .^: entered promiscuous mode [ 731.518624][T27934] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 731.792999][T27946] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 732.382748][T27969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10428'. [ 732.406130][T27969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10428'. [ 732.957465][T27994] netlink: Invalid conntrack helper [ 733.378451][T28004] NFSD: Failed to start, no listeners configured. [ 733.530165][T28015] openvswitch: netlink: Flow actions attr not present in new flow. [ 733.792246][T28025] netlink: zone id is out of range [ 733.803106][T28025] netlink: zone id is out of range [ 733.813599][T28025] netlink: zone id is out of range [ 733.823703][T28025] netlink: zone id is out of range [ 733.849197][T28025] netlink: zone id is out of range [ 736.236134][T14997] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 736.263010][T28137] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 736.271486][T28137] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 736.282903][T28137] CPU: 0 UID: 0 PID: 28137 Comm: kworker/u11:1 Tainted: G U L syzkaller #0 PREEMPT(full) [ 736.282961][T28137] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 736.282975][T28137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 736.283009][T28137] Workqueue: hci4 hci_rx_work [ 736.283141][T28137] Call Trace: [ 736.283152][T28137] [ 736.283166][T28137] dump_stack_lvl+0x100/0x190 [ 736.283214][T28137] sysfs_warn_dup.cold+0x1c/0x28 [ 736.283268][T28137] sysfs_create_dir_ns+0x24b/0x2b0 [ 736.283324][T28137] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 736.283375][T28137] ? find_held_lock+0x2b/0x80 [ 736.283419][T28137] ? kobject_add_internal+0x25f/0x930 [ 736.283514][T28137] ? kobject_add_internal+0x25f/0x930 [ 736.283574][T28137] ? do_raw_spin_unlock+0x145/0x1e0 [ 736.283618][T28137] kobject_add_internal+0x2c8/0x930 [ 736.283681][T28137] kobject_add+0x16a/0x1e0 [ 736.283743][T28137] ? __pfx_kobject_add+0x10/0x10 [ 736.283794][T28137] ? class_to_subsys+0x10f/0x150 [ 736.283881][T28137] ? kobject_put+0xb9/0x640 [ 736.283945][T28137] ? _raw_spin_unlock+0x28/0x50 [ 736.283991][T28137] device_add+0x294/0x1970 [ 736.284047][T28137] ? __pfx_dev_set_name+0x10/0x10 [ 736.284087][T28137] ? __pfx_device_add+0x10/0x10 [ 736.284146][T28137] ? mgmt_send_event_skb+0x2fb/0x460 [ 736.284239][T28137] hci_conn_add_sysfs+0x1a3/0x260 [ 736.284333][T28137] le_conn_complete_evt+0x11eb/0x1f60 [ 736.284410][T28137] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 736.284450][T28137] ? __pfx_bt_warn+0x10/0x10 [ 736.284489][T28137] ? hci_event_packet+0x186/0xcd0 [ 736.284540][T28137] hci_le_conn_complete_evt+0x23c/0x3a0 [ 736.284585][T28137] ? skb_pull_data+0x15f/0x1e0 [ 736.284657][T28137] hci_le_meta_evt+0x34a/0x5f0 [ 736.284732][T28137] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 736.284781][T28137] hci_event_packet+0x51c/0xcd0 [ 736.284825][T28137] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 736.284871][T28137] ? __pfx_hci_event_packet+0x10/0x10 [ 736.284919][T28137] ? kcov_remote_start+0x384/0x670 [ 736.284970][T28137] ? lockdep_hardirqs_on+0x78/0x100 [ 736.285023][T28137] hci_rx_work+0x451/0xfc0 [ 736.285071][T28137] process_one_work+0xa23/0x1940 [ 736.285143][T28137] ? __pfx_process_one_work+0x10/0x10 [ 736.285208][T28137] ? __pfx_hci_rx_work+0x10/0x10 [ 736.285253][T28137] worker_thread+0x5ef/0xe50 [ 736.285315][T28137] ? __pfx_worker_thread+0x10/0x10 [ 736.285370][T28137] ? kthread+0x13a/0x450 [ 736.285415][T28137] ? __pfx_worker_thread+0x10/0x10 [ 736.285464][T28137] kthread+0x370/0x450 [ 736.285510][T28137] ? __pfx_kthread+0x10/0x10 [ 736.285562][T28137] ret_from_fork+0x72b/0xd50 [ 736.285608][T28137] ? __pfx_ret_from_fork+0x10/0x10 [ 736.285652][T28137] ? rcu_is_watching+0x12/0xc0 [ 736.285694][T28137] ? __switch_to+0x800/0x10f0 [ 736.285760][T28137] ? __switch_to_asm+0x39/0x70 [ 736.285814][T28137] ? __pfx_kthread+0x10/0x10 [ 736.285865][T28137] ret_from_fork_asm+0x1a/0x30 [ 736.285935][T28137] [ 736.606336][T28137] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 736.623775][T28137] Bluetooth: hci4: failed to register connection device [ 736.767249][T28143] netlink: 'syz.2.10510': attribute type 11 has an invalid length. [ 736.781403][T28143] netlink: 'syz.2.10510': attribute type 11 has an invalid length. [ 736.799077][ T30] audit: type=1326 audit(4294967426.132:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28141 comm="syz.0.10509" exe="/root/ci-qemu-gce-upstream-auto/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91e199de99 code=0x0 [ 736.828883][T28143] netlink: 'syz.2.10510': attribute type 11 has an invalid length. [ 737.473663][T28167] netlink: 3 bytes leftover after parsing attributes in process `syz.1.10520'. [ 737.504843][ T30] audit: type=1800 audit(4294967426.846:44): pid=28171 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10522" name="lu_gp_id" dev="configfs" ino=83928 res=0 errno=0 [ 738.287088][T28137] Bluetooth: hci4: command 0x2016 tx timeout [ 740.354665][T28137] Bluetooth: hci4: command 0x2016 tx timeout [ 740.592727][T28137] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 740.639597][T28317] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 740.648016][T28317] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 740.663921][T28317] CPU: 0 UID: 0 PID: 28317 Comm: kworker/u11:3 Tainted: G U L syzkaller #0 PREEMPT(full) [ 740.663978][T28317] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 740.663991][T28317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 740.664015][T28317] Workqueue: hci0 hci_rx_work [ 740.664057][T28317] Call Trace: [ 740.664068][T28317] [ 740.664081][T28317] dump_stack_lvl+0x100/0x190 [ 740.664123][T28317] sysfs_warn_dup.cold+0x1c/0x28 [ 740.664176][T28317] sysfs_create_dir_ns+0x24b/0x2b0 [ 740.664231][T28317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 740.664281][T28317] ? find_held_lock+0x2b/0x80 [ 740.664326][T28317] ? kobject_add_internal+0x25f/0x930 [ 740.664382][T28317] ? kobject_add_internal+0x25f/0x930 [ 740.664441][T28317] ? do_raw_spin_unlock+0x145/0x1e0 [ 740.664484][T28317] kobject_add_internal+0x2c8/0x930 [ 740.664547][T28317] kobject_add+0x16a/0x1e0 [ 740.664602][T28317] ? __pfx_kobject_add+0x10/0x10 [ 740.664655][T28317] ? class_to_subsys+0x10f/0x150 [ 740.664698][T28317] ? kobject_put+0xb9/0x640 [ 740.664749][T28317] ? _raw_spin_unlock+0x28/0x50 [ 740.664799][T28317] device_add+0x294/0x1970 [ 740.664865][T28317] ? __pfx_dev_set_name+0x10/0x10 [ 740.664905][T28317] ? __pfx_device_add+0x10/0x10 [ 740.664963][T28317] ? mgmt_send_event_skb+0x2fb/0x460 [ 740.665018][T28317] hci_conn_add_sysfs+0x1a3/0x260 [ 740.665069][T28317] le_conn_complete_evt+0x11eb/0x1f60 [ 740.665127][T28317] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 740.665165][T28317] ? __pfx_bt_warn+0x10/0x10 [ 740.665197][T28317] ? hci_event_packet+0x186/0xcd0 [ 740.665247][T28317] hci_le_conn_complete_evt+0x23c/0x3a0 [ 740.665292][T28317] ? skb_pull_data+0x15f/0x1e0 [ 740.665333][T28317] hci_le_meta_evt+0x34a/0x5f0 [ 740.665378][T28317] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 740.665426][T28317] hci_event_packet+0x51c/0xcd0 [ 740.665469][T28317] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 740.665515][T28317] ? __pfx_hci_event_packet+0x10/0x10 [ 740.665561][T28317] ? kcov_remote_start+0x384/0x670 [ 740.665611][T28317] ? lockdep_hardirqs_on+0x78/0x100 [ 740.665664][T28317] hci_rx_work+0x451/0xfc0 [ 740.665712][T28317] process_one_work+0xa23/0x1940 [ 740.665781][T28317] ? __pfx_process_one_work+0x10/0x10 [ 740.665853][T28317] ? __pfx_hci_rx_work+0x10/0x10 [ 740.665897][T28317] worker_thread+0x5ef/0xe50 [ 740.665961][T28317] ? __pfx_worker_thread+0x10/0x10 [ 740.666015][T28317] ? kthread+0x13a/0x450 [ 740.666060][T28317] ? __pfx_worker_thread+0x10/0x10 [ 740.666110][T28317] kthread+0x370/0x450 [ 740.666155][T28317] ? __pfx_kthread+0x10/0x10 [ 740.666204][T28317] ret_from_fork+0x72b/0xd50 [ 740.666249][T28317] ? __pfx_ret_from_fork+0x10/0x10 [ 740.666292][T28317] ? __switch_to+0x800/0x10f0 [ 740.666340][T28317] ? __switch_to_asm+0x39/0x70 [ 740.666386][T28317] ? __pfx_kthread+0x10/0x10 [ 740.666434][T28317] ret_from_fork_asm+0x1a/0x30 [ 740.666503][T28317] [ 740.667596][T28317] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 740.990770][T28317] Bluetooth: hci0: failed to register connection device [ 741.542033][T28337] net_ratelimit: 318 callbacks suppressed [ 741.542060][T28337] openvswitch: netlink: Port -2134900732 exceeds max allowable 65535 [ 741.566321][T28340] FAULT_INJECTION: forcing a failure. [ 741.566321][T28340] name failslab, interval 1, probability 0, space 0, times 0 [ 741.609021][T28340] CPU: 0 UID: 0 PID: 28340 Comm: syz.1.10609 Tainted: G U L syzkaller #0 PREEMPT(full) [ 741.609082][T28340] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 741.609095][T28340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 741.609117][T28340] Call Trace: [ 741.609128][T28340] [ 741.609140][T28340] dump_stack_lvl+0x100/0x190 [ 741.609186][T28340] should_fail_ex.cold+0x5/0xa [ 741.609227][T28340] should_failslab+0xc2/0x120 [ 741.609277][T28340] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 741.609322][T28340] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 741.609366][T28340] ? sock_alloc_inode+0x26/0x2c0 [ 741.609426][T28340] ? __pfx_sock_alloc_inode+0x10/0x10 [ 741.609490][T28340] sock_alloc_inode+0x26/0x2c0 [ 741.609546][T28340] ? __pfx_sock_alloc_inode+0x10/0x10 [ 741.609602][T28340] alloc_inode+0x68/0x250 [ 741.609661][T28340] sock_alloc+0x44/0x280 [ 741.609711][T28340] ? security_socket_create+0x7f/0x250 [ 741.609828][T28340] __sock_create+0xc2/0x860 [ 741.609865][T28340] ? lockdep_init_map_type+0x5c/0x250 [ 741.609908][T28340] smc_create+0x163/0x290 [ 741.609997][T28340] __sock_create+0x339/0x860 [ 741.610042][T28340] __sys_socket+0x14d/0x260 [ 741.610082][T28340] ? __pfx___sys_socket+0x10/0x10 [ 741.610134][T28340] __x64_sys_socket+0x72/0xb0 [ 741.610172][T28340] ? lockdep_hardirqs_on+0x78/0x100 [ 741.610215][T28340] do_syscall_64+0x115/0x840 [ 741.610257][T28340] ? clear_bhb_loop+0x40/0x90 [ 741.610301][T28340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.610338][T28340] RIP: 0033:0x7f0031f9de99 [ 741.610369][T28340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.610405][T28340] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 741.610439][T28340] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 741.610462][T28340] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 000000000000002b [ 741.610484][T28340] RBP: 00007f0032033eaf R08: 0000000000000000 R09: 0000000000000000 [ 741.610506][T28340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 741.610527][T28340] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 741.610572][T28340] [ 741.610643][T28340] socket: no more sockets [ 742.425307][T28317] Bluetooth: hci4: command 0x2016 tx timeout [ 742.665586][T14997] Bluetooth: hci0: command 0x0c1a tx timeout [ 744.494880][T14997] Bluetooth: hci4: command 0x2016 tx timeout [ 744.576360][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 744.582891][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 744.740011][T14997] Bluetooth: hci0: command 0x0c1a tx timeout [ 745.282538][T14997] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 745.334293][T14997] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 745.343911][T14997] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 745.354986][T14997] CPU: 0 UID: 0 PID: 14997 Comm: kworker/u11:2 Tainted: G U L syzkaller #0 PREEMPT(full) [ 745.355045][T14997] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 745.355059][T14997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 745.355082][T14997] Workqueue: hci2 hci_rx_work [ 745.355128][T14997] Call Trace: [ 745.355139][T14997] [ 745.355153][T14997] dump_stack_lvl+0x100/0x190 [ 745.355196][T14997] sysfs_warn_dup.cold+0x1c/0x28 [ 745.355249][T14997] sysfs_create_dir_ns+0x24b/0x2b0 [ 745.355300][T14997] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 745.355351][T14997] ? find_held_lock+0x2b/0x80 [ 745.355394][T14997] ? kobject_add_internal+0x25f/0x930 [ 745.355447][T14997] ? kobject_add_internal+0x25f/0x930 [ 745.355506][T14997] ? do_raw_spin_unlock+0x145/0x1e0 [ 745.355550][T14997] kobject_add_internal+0x2c8/0x930 [ 745.355611][T14997] kobject_add+0x16a/0x1e0 [ 745.355665][T14997] ? __pfx_kobject_add+0x10/0x10 [ 745.355717][T14997] ? class_to_subsys+0x10f/0x150 [ 745.355757][T14997] ? kobject_put+0xb9/0x640 [ 745.355806][T14997] ? _raw_spin_unlock+0x28/0x50 [ 745.355861][T14997] device_add+0x294/0x1970 [ 745.355919][T14997] ? __pfx_dev_set_name+0x10/0x10 [ 745.355959][T14997] ? __pfx_device_add+0x10/0x10 [ 745.356014][T14997] ? mgmt_send_event_skb+0x2fb/0x460 [ 745.356069][T14997] hci_conn_add_sysfs+0x1a3/0x260 [ 745.356121][T14997] le_conn_complete_evt+0x11eb/0x1f60 [ 745.356176][T14997] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 745.356216][T14997] ? __pfx_bt_warn+0x10/0x10 [ 745.356248][T14997] ? hci_event_packet+0x186/0xcd0 [ 745.356292][T14997] hci_le_conn_complete_evt+0x23c/0x3a0 [ 745.356333][T14997] ? skb_pull_data+0x15f/0x1e0 [ 745.356371][T14997] hci_le_meta_evt+0x34a/0x5f0 [ 745.356414][T14997] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 745.356460][T14997] hci_event_packet+0x51c/0xcd0 [ 745.356501][T14997] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 745.356547][T14997] ? __pfx_hci_event_packet+0x10/0x10 [ 745.356593][T14997] ? kcov_remote_start+0x384/0x670 [ 745.356645][T14997] ? lockdep_hardirqs_on+0x78/0x100 [ 745.356698][T14997] hci_rx_work+0x451/0xfc0 [ 745.356746][T14997] process_one_work+0xa23/0x1940 [ 745.356817][T14997] ? __pfx_process_one_work+0x10/0x10 [ 745.356894][T14997] ? __pfx_hci_rx_work+0x10/0x10 [ 745.356939][T14997] worker_thread+0x5ef/0xe50 [ 745.357004][T14997] ? __pfx_worker_thread+0x10/0x10 [ 745.357059][T14997] ? kthread+0x13a/0x450 [ 745.357103][T14997] ? __pfx_worker_thread+0x10/0x10 [ 745.357153][T14997] kthread+0x370/0x450 [ 745.357200][T14997] ? __pfx_kthread+0x10/0x10 [ 745.357246][T14997] ret_from_fork+0x72b/0xd50 [ 745.357293][T14997] ? __pfx_ret_from_fork+0x10/0x10 [ 745.357337][T14997] ? rcu_is_watching+0x12/0xc0 [ 745.357379][T14997] ? __switch_to+0x800/0x10f0 [ 745.357428][T14997] ? __switch_to_asm+0x39/0x70 [ 745.357472][T14997] ? __pfx_kthread+0x10/0x10 [ 745.357523][T14997] ret_from_fork_asm+0x1a/0x30 [ 745.357591][T14997] [ 745.357629][T14997] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 745.675947][T14997] Bluetooth: hci2: failed to register connection device [ 746.123358][T28497] netlink: 'syz.0.10670': attribute type 11 has an invalid length. [ 746.140537][T28497] netlink: 'syz.0.10670': attribute type 11 has an invalid length. [ 746.156663][T28497] netlink: 'syz.0.10670': attribute type 11 has an invalid length. [ 746.219640][T28501] netlink: 3 bytes leftover after parsing attributes in process `syz.2.10671'. [ 746.805548][T14997] Bluetooth: hci0: command 0x0c1a tx timeout [ 747.285550][T28539] openvswitch: netlink: ct_state flags aa1414ac unsupported [ 747.366433][T28137] Bluetooth: hci2: command 0x0c1a tx timeout [ 748.364814][T28137] Bluetooth: hci4: ACL packet too small [ 748.850176][T28604] FAULT_INJECTION: forcing a failure. [ 748.850176][T28604] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 748.869666][T28604] CPU: 0 UID: 0 PID: 28604 Comm: syz.1.10718 Tainted: G U L syzkaller #0 PREEMPT(full) [ 748.869738][T28604] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 748.869752][T28604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 748.869777][T28604] Call Trace: [ 748.869789][T28604] [ 748.869803][T28604] dump_stack_lvl+0x100/0x190 [ 748.869845][T28604] should_fail_ex.cold+0x5/0xa [ 748.869872][T28604] ? prepare_alloc_pages+0x16d/0x5f0 [ 748.869918][T28604] should_fail_alloc_page+0xeb/0x140 [ 748.869965][T28604] prepare_alloc_pages+0x1f0/0x5f0 [ 748.870040][T28604] ? unwind_get_return_address+0x59/0xa0 [ 748.870102][T28604] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 748.870156][T28604] ? stack_trace_save+0x8e/0xc0 [ 748.870202][T28604] ? __pfx_stack_trace_save+0x10/0x10 [ 748.870251][T28604] ? stack_depot_save_flags+0x27/0x9d0 [ 748.870428][T28604] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 748.870473][T28604] ? kasan_save_stack+0x30/0x50 [ 748.870515][T28604] ? kasan_save_track+0x14/0x30 [ 748.870556][T28604] ? __kasan_slab_alloc+0x89/0x90 [ 748.870605][T28604] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 748.870647][T28604] ? __pmd_alloc+0xbf/0x950 [ 748.870696][T28604] ? move_page_tables+0x2f7c/0x4610 [ 748.870745][T28604] ? copy_vma_and_data+0x25c/0x7c0 [ 748.870782][T28604] ? move_vma+0x574/0x1920 [ 748.870816][T28604] ? mremap_to+0x234/0x4c0 [ 748.870864][T28604] ? __do_sys_mremap+0x88c/0x1850 [ 748.870902][T28604] ? do_syscall_64+0x115/0x840 [ 748.870949][T28604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.871017][T28604] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 748.871072][T28604] ? policy_nodemask+0xed/0x4f0 [ 748.871136][T28604] alloc_pages_mpol+0x1fb/0x540 [ 748.871195][T28604] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 748.871257][T28604] alloc_pages_noprof+0x1a/0x160 [ 748.871291][T28604] pte_alloc_one+0x1c/0x3d0 [ 748.871346][T28604] __pte_alloc+0x6d/0x3e0 [ 748.871390][T28604] ? __pfx___pte_alloc+0x10/0x10 [ 748.871436][T28604] ? _raw_spin_unlock+0x28/0x50 [ 748.871468][T28604] ? __pmd_alloc+0x3fb/0x950 [ 748.871544][T28604] move_page_tables+0x2ec4/0x4610 [ 748.871591][T28604] ? __pfx_copy_vma+0x10/0x10 [ 748.871646][T28604] ? __pfx_move_page_tables+0x10/0x10 [ 748.871718][T28604] copy_vma_and_data+0x25c/0x7c0 [ 748.871774][T28604] ? __pfx_copy_vma_and_data+0x10/0x10 [ 748.871834][T28604] ? __vma_start_write+0x17f/0x280 [ 748.871892][T28604] ? __pfx___vma_start_write+0x10/0x10 [ 748.871960][T28604] move_vma+0x574/0x1920 [ 748.872005][T28604] ? __pfx_move_vma+0x10/0x10 [ 748.872049][T28604] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 748.872096][T28604] ? cap_mmap_addr+0x4b/0x120 [ 748.872194][T28604] ? bpf_lsm_mmap_addr+0x9/0x30 [ 748.872239][T28604] ? security_mmap_addr+0x71/0x1e0 [ 748.872304][T28604] ? __get_unmapped_area+0x255/0x3e0 [ 748.872359][T28604] ? vrm_set_new_addr+0x204/0x290 [ 748.872402][T28604] mremap_to+0x234/0x4c0 [ 748.872438][T28604] ? mas_walk+0x6ef/0x9b0 [ 748.872479][T28604] ? __pfx_mremap_to+0x10/0x10 [ 748.872528][T28604] __do_sys_mremap+0x88c/0x1850 [ 748.872579][T28604] ? __pfx___do_sys_mremap+0x10/0x10 [ 748.872614][T28604] ? ksys_write+0x190/0x250 [ 748.872658][T28604] ? __pfx_do_futex+0x10/0x10 [ 748.872706][T28604] ? __x64_sys_futex+0x34f/0x4d0 [ 748.872780][T28604] do_syscall_64+0x115/0x840 [ 748.872837][T28604] ? clear_bhb_loop+0x40/0x90 [ 748.872881][T28604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.872917][T28604] RIP: 0033:0x7f0031f9de99 [ 748.872947][T28604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 748.872981][T28604] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 748.873017][T28604] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 748.873040][T28604] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000000000 [ 748.873062][T28604] RBP: 00007f0032033eaf R08: 0000000100000000 R09: 0000000000000000 [ 748.873084][T28604] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 [ 748.873103][T28604] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 748.873141][T28604] [ 749.359705][T28137] Bluetooth: hci0: command 0x0c1a tx timeout [ 749.435550][T28137] Bluetooth: hci2: command 0x0c1a tx timeout [ 749.636698][T28137] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 749.684289][T14997] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 749.692871][T14997] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 749.702436][T14997] CPU: 0 UID: 0 PID: 14997 Comm: kworker/u11:2 Tainted: G U L syzkaller #0 PREEMPT(full) [ 749.702495][T14997] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 749.702508][T14997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 749.702529][T14997] Workqueue: hci1 hci_rx_work [ 749.702572][T14997] Call Trace: [ 749.702583][T14997] [ 749.702596][T14997] dump_stack_lvl+0x100/0x190 [ 749.702642][T14997] sysfs_warn_dup.cold+0x1c/0x28 [ 749.702699][T14997] sysfs_create_dir_ns+0x24b/0x2b0 [ 749.702755][T14997] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 749.702808][T14997] ? find_held_lock+0x2b/0x80 [ 749.702852][T14997] ? kobject_add_internal+0x25f/0x930 [ 749.702908][T14997] ? kobject_add_internal+0x25f/0x930 [ 749.702967][T14997] ? do_raw_spin_unlock+0x145/0x1e0 [ 749.703007][T14997] kobject_add_internal+0x2c8/0x930 [ 749.703071][T14997] kobject_add+0x16a/0x1e0 [ 749.703126][T14997] ? __pfx_kobject_add+0x10/0x10 [ 749.703180][T14997] ? class_to_subsys+0x10f/0x150 [ 749.703224][T14997] ? kobject_put+0xb9/0x640 [ 749.703274][T14997] ? _raw_spin_unlock+0x28/0x50 [ 749.703321][T14997] device_add+0x294/0x1970 [ 749.703378][T14997] ? __pfx_dev_set_name+0x10/0x10 [ 749.703415][T14997] ? __pfx_device_add+0x10/0x10 [ 749.703479][T14997] ? mgmt_send_event_skb+0x2fb/0x460 [ 749.703530][T14997] hci_conn_add_sysfs+0x1a3/0x260 [ 749.703588][T14997] le_conn_complete_evt+0x11eb/0x1f60 [ 749.703643][T14997] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 749.703684][T14997] ? __pfx_bt_warn+0x10/0x10 [ 749.703797][T14997] ? hci_event_packet+0x186/0xcd0 [ 749.703850][T14997] hci_le_conn_complete_evt+0x23c/0x3a0 [ 749.703894][T14997] ? skb_pull_data+0x15f/0x1e0 [ 749.703948][T14997] hci_le_meta_evt+0x34a/0x5f0 [ 749.703996][T14997] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 749.704046][T14997] hci_event_packet+0x51c/0xcd0 [ 749.704090][T14997] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 749.704136][T14997] ? __pfx_hci_event_packet+0x10/0x10 [ 749.704182][T14997] ? kcov_remote_start+0x384/0x670 [ 749.704234][T14997] ? lockdep_hardirqs_on+0x78/0x100 [ 749.704287][T14997] hci_rx_work+0x451/0xfc0 [ 749.704339][T14997] process_one_work+0xa23/0x1940 [ 749.704413][T14997] ? __pfx_process_one_work+0x10/0x10 [ 749.704493][T14997] ? __pfx_hci_rx_work+0x10/0x10 [ 749.704539][T14997] worker_thread+0x5ef/0xe50 [ 749.704607][T14997] ? __pfx_worker_thread+0x10/0x10 [ 749.704664][T14997] ? kthread+0x13a/0x450 [ 749.704711][T14997] ? __pfx_worker_thread+0x10/0x10 [ 749.704763][T14997] kthread+0x370/0x450 [ 749.704812][T14997] ? __pfx_kthread+0x10/0x10 [ 749.704864][T14997] ret_from_fork+0x72b/0xd50 [ 749.704909][T14997] ? __pfx_ret_from_fork+0x10/0x10 [ 749.705010][T14997] ? rcu_is_watching+0x12/0xc0 [ 749.705052][T14997] ? __switch_to+0x800/0x10f0 [ 749.705106][T14997] ? __switch_to_asm+0x39/0x70 [ 749.705154][T14997] ? __pfx_kthread+0x10/0x10 [ 749.705211][T14997] ret_from_fork_asm+0x1a/0x30 [ 749.705282][T14997] [ 749.705320][T14997] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 750.042411][T14997] Bluetooth: hci1: failed to register connection device [ 750.495728][T28633] .^: entered promiscuous mode [ 750.585528][T28639] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 750.708340][T28641] netlink: 'syz.5.10733': attribute type 11 has an invalid length. [ 750.716705][T28641] netlink: 'syz.5.10733': attribute type 11 has an invalid length. [ 750.724867][T28641] netlink: 'syz.5.10733': attribute type 11 has an invalid length. [ 751.339309][T14997] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 751.390100][T14997] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 751.398371][T14997] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 751.408445][T14997] CPU: 0 UID: 0 PID: 14997 Comm: kworker/u11:2 Tainted: G U L syzkaller #0 PREEMPT(full) [ 751.408501][T14997] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 751.408514][T14997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 751.408539][T14997] Workqueue: hci2 hci_rx_work [ 751.408580][T14997] Call Trace: [ 751.408591][T14997] [ 751.408603][T14997] dump_stack_lvl+0x100/0x190 [ 751.408646][T14997] sysfs_warn_dup.cold+0x1c/0x28 [ 751.408699][T14997] sysfs_create_dir_ns+0x24b/0x2b0 [ 751.408754][T14997] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 751.408813][T14997] ? find_held_lock+0x2b/0x80 [ 751.408858][T14997] ? kobject_add_internal+0x25f/0x930 [ 751.408913][T14997] ? kobject_add_internal+0x25f/0x930 [ 751.408971][T14997] ? do_raw_spin_unlock+0x145/0x1e0 [ 751.409013][T14997] kobject_add_internal+0x2c8/0x930 [ 751.409074][T14997] kobject_add+0x16a/0x1e0 [ 751.409128][T14997] ? __pfx_kobject_add+0x10/0x10 [ 751.409174][T14997] ? class_to_subsys+0x10f/0x150 [ 751.409212][T14997] ? kobject_put+0xb9/0x640 [ 751.409259][T14997] ? _raw_spin_unlock+0x28/0x50 [ 751.409306][T14997] device_add+0x294/0x1970 [ 751.409361][T14997] ? __pfx_dev_set_name+0x10/0x10 [ 751.409410][T14997] ? __pfx_device_add+0x10/0x10 [ 751.409465][T14997] ? mgmt_send_event_skb+0x2fb/0x460 [ 751.409518][T14997] hci_conn_add_sysfs+0x1a3/0x260 [ 751.409567][T14997] le_conn_complete_evt+0x11eb/0x1f60 [ 751.409619][T14997] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 751.409656][T14997] ? __pfx_bt_warn+0x10/0x10 [ 751.409685][T14997] ? hci_event_packet+0x186/0xcd0 [ 751.409734][T14997] hci_le_conn_complete_evt+0x23c/0x3a0 [ 751.409794][T14997] ? skb_pull_data+0x15f/0x1e0 [ 751.409834][T14997] hci_le_meta_evt+0x34a/0x5f0 [ 751.409878][T14997] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 751.409927][T14997] hci_event_packet+0x51c/0xcd0 [ 751.409967][T14997] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 751.410012][T14997] ? __pfx_hci_event_packet+0x10/0x10 [ 751.410055][T14997] ? kcov_remote_start+0x384/0x670 [ 751.410105][T14997] ? lockdep_hardirqs_on+0x78/0x100 [ 751.410155][T14997] hci_rx_work+0x451/0xfc0 [ 751.410200][T14997] process_one_work+0xa23/0x1940 [ 751.410268][T14997] ? __pfx_process_one_work+0x10/0x10 [ 751.410332][T14997] ? __pfx_hci_rx_work+0x10/0x10 [ 751.410377][T14997] worker_thread+0x5ef/0xe50 [ 751.410451][T14997] ? __pfx_worker_thread+0x10/0x10 [ 751.410504][T14997] ? kthread+0x13a/0x450 [ 751.410547][T14997] ? __pfx_worker_thread+0x10/0x10 [ 751.410594][T14997] kthread+0x370/0x450 [ 751.410640][T14997] ? __pfx_kthread+0x10/0x10 [ 751.410689][T14997] ret_from_fork+0x72b/0xd50 [ 751.410736][T14997] ? __pfx_ret_from_fork+0x10/0x10 [ 751.410779][T14997] ? rcu_is_watching+0x12/0xc0 [ 751.410822][T14997] ? __switch_to+0x800/0x10f0 [ 751.410877][T14997] ? __switch_to_asm+0x39/0x70 [ 751.410924][T14997] ? __pfx_kthread+0x10/0x10 [ 751.410974][T14997] ret_from_fork_asm+0x1a/0x30 [ 751.411045][T14997] [ 751.411080][T14997] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 751.748316][T28323] Bluetooth: hci1: command 0x0c1a tx timeout [ 751.769436][T14997] Bluetooth: hci2: failed to register connection device [ 751.810556][T14997] Bluetooth: hci2: command 0x0c1a tx timeout [ 752.435413][T28674] .^: entered promiscuous mode [ 752.612912][T28684] netlink: 'syz.1.10747': attribute type 11 has an invalid length. [ 752.626557][T28684] netlink: 'syz.1.10747': attribute type 11 has an invalid length. [ 752.646079][T28684] netlink: 'syz.1.10747': attribute type 11 has an invalid length. [ 753.544717][T28710] netlink: Invalid conntrack helper [ 753.811364][T14997] Bluetooth: hci1: command 0x0c1a tx timeout [ 753.890894][T14997] Bluetooth: hci2: command 0x0c1a tx timeout [ 755.309366][T28783] FAULT_INJECTION: forcing a failure. [ 755.309366][T28783] name failslab, interval 1, probability 0, space 0, times 0 [ 755.329936][T28783] CPU: 1 UID: 0 PID: 28783 Comm: syz.2.10797 Tainted: G U L syzkaller #0 PREEMPT(full) [ 755.329998][T28783] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 755.330012][T28783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 755.330033][T28783] Call Trace: [ 755.330044][T28783] [ 755.330057][T28783] dump_stack_lvl+0x100/0x190 [ 755.330104][T28783] should_fail_ex.cold+0x5/0xa [ 755.330150][T28783] should_failslab+0xc2/0x120 [ 755.330201][T28783] kmem_cache_alloc_noprof+0x91/0x6a0 [ 755.330249][T28783] ? __pmd_alloc+0xbf/0x950 [ 755.330308][T28783] __pmd_alloc+0xbf/0x950 [ 755.330365][T28783] move_page_tables+0x2f7c/0x4610 [ 755.330417][T28783] ? __pfx_copy_vma+0x10/0x10 [ 755.330473][T28783] ? __pfx_move_page_tables+0x10/0x10 [ 755.330544][T28783] copy_vma_and_data+0x25c/0x7c0 [ 755.330589][T28783] ? __pfx_copy_vma_and_data+0x10/0x10 [ 755.330644][T28783] ? __vma_start_write+0x17f/0x280 [ 755.330702][T28783] ? __pfx___vma_start_write+0x10/0x10 [ 755.330785][T28783] move_vma+0x574/0x1920 [ 755.330831][T28783] ? __pfx_move_vma+0x10/0x10 [ 755.330874][T28783] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 755.330927][T28783] ? cap_mmap_addr+0x4b/0x120 [ 755.330964][T28783] ? bpf_lsm_mmap_addr+0x9/0x30 [ 755.330997][T28783] ? security_mmap_addr+0x71/0x1e0 [ 755.331048][T28783] ? __get_unmapped_area+0x255/0x3e0 [ 755.331108][T28783] ? vrm_set_new_addr+0x204/0x290 [ 755.331150][T28783] mremap_to+0x234/0x4c0 [ 755.331186][T28783] ? mas_walk+0x6ef/0x9b0 [ 755.331230][T28783] ? __pfx_mremap_to+0x10/0x10 [ 755.331280][T28783] __do_sys_mremap+0x88c/0x1850 [ 755.331334][T28783] ? __pfx___do_sys_mremap+0x10/0x10 [ 755.331371][T28783] ? ksys_write+0x190/0x250 [ 755.331423][T28783] ? __pfx_do_futex+0x10/0x10 [ 755.331482][T28783] ? __x64_sys_futex+0x34f/0x4d0 [ 755.331546][T28783] do_syscall_64+0x115/0x840 [ 755.331590][T28783] ? clear_bhb_loop+0x40/0x90 [ 755.331634][T28783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.331671][T28783] RIP: 0033:0x7f47ffb9de99 [ 755.331701][T28783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.331737][T28783] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 755.331771][T28783] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 755.331796][T28783] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000000000 [ 755.331818][T28783] RBP: 00007f47ffc33eaf R08: 0000000100000000 R09: 0000000000000000 [ 755.331840][T28783] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 [ 755.331862][T28783] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 755.331908][T28783] [ 755.723406][T14997] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 755.732334][T14997] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 755.740218][T14997] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 755.754842][T14997] CPU: 0 UID: 0 PID: 14997 Comm: kworker/u11:2 Tainted: G U L syzkaller #0 PREEMPT(full) [ 755.754900][T14997] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 755.754913][T14997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 755.754936][T14997] Workqueue: hci4 hci_rx_work [ 755.754976][T14997] Call Trace: [ 755.754987][T14997] [ 755.755000][T14997] dump_stack_lvl+0x100/0x190 [ 755.755043][T14997] sysfs_warn_dup.cold+0x1c/0x28 [ 755.755096][T14997] sysfs_create_dir_ns+0x24b/0x2b0 [ 755.755151][T14997] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 755.755203][T14997] ? find_held_lock+0x2b/0x80 [ 755.755249][T14997] ? kobject_add_internal+0x25f/0x930 [ 755.755305][T14997] ? kobject_add_internal+0x25f/0x930 [ 755.755365][T14997] ? do_raw_spin_unlock+0x145/0x1e0 [ 755.755411][T14997] kobject_add_internal+0x2c8/0x930 [ 755.755481][T14997] kobject_add+0x16a/0x1e0 [ 755.755537][T14997] ? __pfx_kobject_add+0x10/0x10 [ 755.755589][T14997] ? class_to_subsys+0x10f/0x150 [ 755.755631][T14997] ? kobject_put+0xb9/0x640 [ 755.755680][T14997] ? _raw_spin_unlock+0x28/0x50 [ 755.755727][T14997] device_add+0x294/0x1970 [ 755.755785][T14997] ? __pfx_dev_set_name+0x10/0x10 [ 755.755825][T14997] ? __pfx_device_add+0x10/0x10 [ 755.755882][T14997] ? mgmt_send_event_skb+0x2fb/0x460 [ 755.755943][T14997] hci_conn_add_sysfs+0x1a3/0x260 [ 755.755994][T14997] le_conn_complete_evt+0x11eb/0x1f60 [ 755.756049][T14997] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 755.756088][T14997] ? __pfx_bt_warn+0x10/0x10 [ 755.756119][T14997] ? hci_event_packet+0x186/0xcd0 [ 755.756169][T14997] hci_le_conn_complete_evt+0x23c/0x3a0 [ 755.756213][T14997] ? skb_pull_data+0x15f/0x1e0 [ 755.756254][T14997] hci_le_meta_evt+0x34a/0x5f0 [ 755.756299][T14997] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 755.756348][T14997] hci_event_packet+0x51c/0xcd0 [ 755.756391][T14997] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 755.756437][T14997] ? __pfx_hci_event_packet+0x10/0x10 [ 755.756492][T14997] ? kcov_remote_start+0x384/0x670 [ 755.756544][T14997] ? lockdep_hardirqs_on+0x78/0x100 [ 755.756597][T14997] hci_rx_work+0x451/0xfc0 [ 755.756647][T14997] process_one_work+0xa23/0x1940 [ 755.756718][T14997] ? __pfx_process_one_work+0x10/0x10 [ 755.756783][T14997] ? __pfx_hci_rx_work+0x10/0x10 [ 755.756828][T14997] worker_thread+0x5ef/0xe50 [ 755.756891][T14997] ? __pfx_worker_thread+0x10/0x10 [ 755.756945][T14997] ? kthread+0x13a/0x450 [ 755.756991][T14997] ? __pfx_worker_thread+0x10/0x10 [ 755.757040][T14997] kthread+0x370/0x450 [ 755.757086][T14997] ? __pfx_kthread+0x10/0x10 [ 755.757137][T14997] ret_from_fork+0x72b/0xd50 [ 755.757182][T14997] ? __pfx_ret_from_fork+0x10/0x10 [ 755.757226][T14997] ? rcu_is_watching+0x12/0xc0 [ 755.757267][T14997] ? __switch_to+0x800/0x10f0 [ 755.757321][T14997] ? __switch_to_asm+0x39/0x70 [ 755.757368][T14997] ? __pfx_kthread+0x10/0x10 [ 755.757419][T14997] ret_from_fork_asm+0x1a/0x30 [ 755.757495][T14997] [ 755.757941][T14997] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 756.107034][T13629] Bluetooth: hci1: command 0x0c1a tx timeout [ 756.114928][T13629] Bluetooth: hci2: command 0x0c1a tx timeout [ 756.121284][T14997] Bluetooth: hci4: failed to register connection device [ 756.362969][T28804] device-mapper: ioctl: device name cannot be "control", ".", or ".." [ 758.199008][T28317] Bluetooth: hci4: command 0x2016 tx timeout [ 758.205884][T28137] Bluetooth: hci2: command 0x0c1a tx timeout [ 758.214465][T28137] Bluetooth: hci1: command 0x0c1a tx timeout [ 758.316751][T28892] netlink: 'syz.1.10848': attribute type 2 has an invalid length. [ 758.325487][T28890] openvswitch: netlink: IP tunnel dst address not specified [ 758.543115][T28317] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 758.569756][T28317] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 758.577868][T28317] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 758.589576][T28317] CPU: 0 UID: 0 PID: 28317 Comm: kworker/u11:3 Tainted: G U L syzkaller #0 PREEMPT(full) [ 758.589640][T28317] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 758.589656][T28317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 758.589682][T28317] Workqueue: hci1 hci_rx_work [ 758.589728][T28317] Call Trace: [ 758.589741][T28317] [ 758.589756][T28317] dump_stack_lvl+0x100/0x190 [ 758.589803][T28317] sysfs_warn_dup.cold+0x1c/0x28 [ 758.589863][T28317] sysfs_create_dir_ns+0x24b/0x2b0 [ 758.589930][T28317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 758.589992][T28317] ? find_held_lock+0x2b/0x80 [ 758.590043][T28317] ? kobject_add_internal+0x25f/0x930 [ 758.590107][T28317] ? kobject_add_internal+0x25f/0x930 [ 758.590173][T28317] ? do_raw_spin_unlock+0x145/0x1e0 [ 758.590229][T28317] kobject_add_internal+0x2c8/0x930 [ 758.590301][T28317] kobject_add+0x16a/0x1e0 [ 758.590360][T28317] ? __pfx_kobject_add+0x10/0x10 [ 758.590419][T28317] ? class_to_subsys+0x10f/0x150 [ 758.590465][T28317] ? kobject_put+0xb9/0x640 [ 758.590521][T28317] ? _raw_spin_unlock+0x28/0x50 [ 758.590574][T28317] device_add+0x294/0x1970 [ 758.590636][T28317] ? __pfx_dev_set_name+0x10/0x10 [ 758.590679][T28317] ? __pfx_device_add+0x10/0x10 [ 758.590744][T28317] ? mgmt_send_event_skb+0x2fb/0x460 [ 758.590805][T28317] hci_conn_add_sysfs+0x1a3/0x260 [ 758.590864][T28317] le_conn_complete_evt+0x11eb/0x1f60 [ 758.590922][T28317] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 758.590966][T28317] ? __pfx_bt_warn+0x10/0x10 [ 758.591007][T28317] ? hci_event_packet+0x186/0xcd0 [ 758.591069][T28317] hci_le_conn_complete_evt+0x23c/0x3a0 [ 758.591120][T28317] ? skb_pull_data+0x15f/0x1e0 [ 758.591166][T28317] hci_le_meta_evt+0x34a/0x5f0 [ 758.591227][T28317] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 758.591283][T28317] hci_event_packet+0x51c/0xcd0 [ 758.591332][T28317] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 758.591389][T28317] ? __pfx_hci_event_packet+0x10/0x10 [ 758.591447][T28317] ? kcov_remote_start+0x384/0x670 [ 758.591506][T28317] ? lockdep_hardirqs_on+0x78/0x100 [ 758.591565][T28317] hci_rx_work+0x451/0xfc0 [ 758.591619][T28317] process_one_work+0xa23/0x1940 [ 758.591699][T28317] ? __pfx_process_one_work+0x10/0x10 [ 758.591774][T28317] ? __pfx_hci_rx_work+0x10/0x10 [ 758.591824][T28317] worker_thread+0x5ef/0xe50 [ 758.591894][T28317] ? __pfx_worker_thread+0x10/0x10 [ 758.591953][T28317] ? kthread+0x13a/0x450 [ 758.592002][T28317] ? __pfx_worker_thread+0x10/0x10 [ 758.592059][T28317] kthread+0x370/0x450 [ 758.592116][T28317] ? __pfx_kthread+0x10/0x10 [ 758.592173][T28317] ret_from_fork+0x72b/0xd50 [ 758.592231][T28317] ? __pfx_ret_from_fork+0x10/0x10 [ 758.592284][T28317] ? __switch_to+0x800/0x10f0 [ 758.592347][T28317] ? __switch_to_asm+0x39/0x70 [ 758.592401][T28317] ? __pfx_kthread+0x10/0x10 [ 758.592458][T28317] ret_from_fork_asm+0x1a/0x30 [ 758.592534][T28317] [ 758.593195][T28317] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 758.910494][T28317] Bluetooth: hci1: failed to register connection device [ 759.500505][T28926] No such timeout policy "" [ 759.505647][T28926] netlink: Failed to associated timeout policy '' [ 759.646842][T28928] NFSD: Failed to start, no listeners configured. [ 760.260970][T28317] Bluetooth: hci4: command 0x2016 tx timeout [ 760.267199][T28137] Bluetooth: hci2: command 0x0c1a tx timeout [ 760.362337][T28963] netlink: set zone limit has 4 unknown bytes [ 760.491039][T28968] netlink: 'syz.5.10881': attribute type 1 has an invalid length. [ 760.545379][T28969] NFSD: Failed to start, no listeners configured. [ 760.579801][T28317] Bluetooth: hci1: command 0x0c1a tx timeout [ 760.626596][T28975] netlink: 'syz.0.10891': attribute type 1 has an invalid length. [ 760.825388][T28984] sd 0:0:1:0: PR command failed: 1026 [ 760.849095][T28984] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 760.856321][T28984] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 761.361850][T28317] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 761.369867][T28317] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 761.379555][T28317] CPU: 0 UID: 0 PID: 28317 Comm: kworker/u11:3 Tainted: G U L syzkaller #0 PREEMPT(full) [ 761.379607][T28317] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 761.379621][T28317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 761.379645][T28317] Workqueue: hci1 hci_rx_work [ 761.379688][T28317] Call Trace: [ 761.379699][T28317] [ 761.379712][T28317] dump_stack_lvl+0x100/0x190 [ 761.379753][T28317] sysfs_warn_dup.cold+0x1c/0x28 [ 761.379806][T28317] sysfs_create_dir_ns+0x24b/0x2b0 [ 761.379862][T28317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 761.379915][T28317] ? find_held_lock+0x2b/0x80 [ 761.379971][T28317] ? kobject_add_internal+0x25f/0x930 [ 761.380029][T28317] ? kobject_add_internal+0x25f/0x930 [ 761.380089][T28317] ? do_raw_spin_unlock+0x145/0x1e0 [ 761.380134][T28317] kobject_add_internal+0x2c8/0x930 [ 761.380197][T28317] kobject_add+0x16a/0x1e0 [ 761.380251][T28317] ? __pfx_kobject_add+0x10/0x10 [ 761.380303][T28317] ? class_to_subsys+0x10f/0x150 [ 761.380344][T28317] ? kobject_put+0xb9/0x640 [ 761.380394][T28317] ? _raw_spin_unlock+0x28/0x50 [ 761.380439][T28317] device_add+0x294/0x1970 [ 761.380498][T28317] ? __pfx_dev_set_name+0x10/0x10 [ 761.380537][T28317] ? __pfx_device_add+0x10/0x10 [ 761.380596][T28317] ? mgmt_send_event_skb+0x2fb/0x460 [ 761.380647][T28317] hci_conn_add_sysfs+0x1a3/0x260 [ 761.380699][T28317] le_conn_complete_evt+0x11eb/0x1f60 [ 761.380753][T28317] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 761.380793][T28317] ? __pfx_bt_warn+0x10/0x10 [ 761.380824][T28317] ? hci_event_packet+0x186/0xcd0 [ 761.380875][T28317] hci_le_conn_complete_evt+0x23c/0x3a0 [ 761.380920][T28317] ? skb_pull_data+0x15f/0x1e0 [ 761.380969][T28317] hci_le_meta_evt+0x34a/0x5f0 [ 761.381012][T28317] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 761.381062][T28317] hci_event_packet+0x51c/0xcd0 [ 761.381104][T28317] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 761.381151][T28317] ? __pfx_hci_event_packet+0x10/0x10 [ 761.381197][T28317] ? kcov_remote_start+0x384/0x670 [ 761.381248][T28317] ? lockdep_hardirqs_on+0x78/0x100 [ 761.381301][T28317] hci_rx_work+0x451/0xfc0 [ 761.381348][T28317] process_one_work+0xa23/0x1940 [ 761.381420][T28317] ? __pfx_process_one_work+0x10/0x10 [ 761.381486][T28317] ? __pfx_hci_rx_work+0x10/0x10 [ 761.381531][T28317] worker_thread+0x5ef/0xe50 [ 761.381595][T28317] ? __pfx_worker_thread+0x10/0x10 [ 761.381650][T28317] ? kthread+0x13a/0x450 [ 761.381694][T28317] ? __pfx_worker_thread+0x10/0x10 [ 761.381745][T28317] kthread+0x370/0x450 [ 761.381792][T28317] ? __pfx_kthread+0x10/0x10 [ 761.381843][T28317] ret_from_fork+0x72b/0xd50 [ 761.381889][T28317] ? __pfx_ret_from_fork+0x10/0x10 [ 761.381936][T28317] ? __switch_to+0x800/0x10f0 [ 761.382000][T28317] ? __switch_to_asm+0x39/0x70 [ 761.382048][T28317] ? __pfx_kthread+0x10/0x10 [ 761.382100][T28317] ret_from_fork_asm+0x1a/0x30 [ 761.382167][T28317] [ 761.382219][T28317] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 761.695212][T28317] Bluetooth: hci1: failed to register connection device [ 761.703194][T28317] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 761.711235][T28317] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 761.722180][T28317] CPU: 0 UID: 0 PID: 28317 Comm: kworker/u11:3 Tainted: G U L syzkaller #0 PREEMPT(full) [ 761.722240][T28317] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 761.722255][T28317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 761.722277][T28317] Workqueue: hci1 hci_rx_work [ 761.722319][T28317] Call Trace: [ 761.722330][T28317] [ 761.722343][T28317] dump_stack_lvl+0x100/0x190 [ 761.722389][T28317] sysfs_warn_dup.cold+0x1c/0x28 [ 761.722444][T28317] sysfs_create_dir_ns+0x24b/0x2b0 [ 761.722500][T28317] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 761.722551][T28317] ? find_held_lock+0x2b/0x80 [ 761.722597][T28317] ? kobject_add_internal+0x25f/0x930 [ 761.722652][T28317] ? kobject_add_internal+0x25f/0x930 [ 761.722712][T28317] ? do_raw_spin_unlock+0x145/0x1e0 [ 761.722755][T28317] kobject_add_internal+0x2c8/0x930 [ 761.722817][T28317] kobject_add+0x16a/0x1e0 [ 761.722881][T28317] ? __pfx_kobject_add+0x10/0x10 [ 761.722934][T28317] ? class_to_subsys+0x10f/0x150 [ 761.722976][T28317] ? kobject_put+0xb9/0x640 [ 761.723025][T28317] ? _raw_spin_unlock+0x28/0x50 [ 761.723072][T28317] device_add+0x294/0x1970 [ 761.723129][T28317] ? __pfx_dev_set_name+0x10/0x10 [ 761.723167][T28317] ? __pfx_device_add+0x10/0x10 [ 761.723224][T28317] ? mgmt_send_event_skb+0x2fb/0x460 [ 761.723278][T28317] hci_conn_add_sysfs+0x1a3/0x260 [ 761.723329][T28317] le_conn_complete_evt+0x11eb/0x1f60 [ 761.723382][T28317] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 761.723421][T28317] ? __pfx_bt_warn+0x10/0x10 [ 761.723452][T28317] ? hci_event_packet+0x186/0xcd0 [ 761.723503][T28317] hci_le_conn_complete_evt+0x23c/0x3a0 [ 761.723548][T28317] ? skb_pull_data+0x15f/0x1e0 [ 761.723589][T28317] hci_le_meta_evt+0x34a/0x5f0 [ 761.723639][T28317] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 761.723687][T28317] hci_event_packet+0x51c/0xcd0 [ 761.723728][T28317] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 761.723777][T28317] ? __pfx_hci_event_packet+0x10/0x10 [ 761.723823][T28317] ? kcov_remote_start+0x384/0x670 [ 761.723883][T28317] ? lockdep_hardirqs_on+0x78/0x100 [ 761.723937][T28317] hci_rx_work+0x451/0xfc0 [ 761.723986][T28317] process_one_work+0xa23/0x1940 [ 761.724057][T28317] ? __pfx_process_one_work+0x10/0x10 [ 761.724122][T28317] ? __pfx_hci_rx_work+0x10/0x10 [ 761.724167][T28317] worker_thread+0x5ef/0xe50 [ 761.724231][T28317] ? __pfx_worker_thread+0x10/0x10 [ 761.724285][T28317] ? kthread+0x13a/0x450 [ 761.724330][T28317] ? __pfx_worker_thread+0x10/0x10 [ 761.724380][T28317] kthread+0x370/0x450 [ 761.724427][T28317] ? __pfx_kthread+0x10/0x10 [ 761.724477][T28317] ret_from_fork+0x72b/0xd50 [ 761.724523][T28317] ? __pfx_ret_from_fork+0x10/0x10 [ 761.724570][T28317] ? __switch_to+0x800/0x10f0 [ 761.724624][T28317] ? __switch_to_asm+0x39/0x70 [ 761.724672][T28317] ? __pfx_kthread+0x10/0x10 [ 761.724723][T28317] ret_from_fork_asm+0x1a/0x30 [ 761.724793][T28317] [ 762.032723][T28317] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 762.046860][T28317] Bluetooth: hci1: failed to register connection device [ 762.354452][T28317] Bluetooth: hci4: command 0x2016 tx timeout [ 762.361990][T28137] Bluetooth: hci2: command 0x0c1a tx timeout [ 762.527758][T29015] NFSD: Failed to start, no listeners configured. [ 762.649447][T28323] Bluetooth: hci1: command 0x0c1a tx timeout [ 763.088109][T29048] netlink: Unknown nat attribute (0) [ 763.774638][T29079] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 763.803314][T29079] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 763.933817][T29084] openvswitch: netlink: Message has 4 unknown bytes. [ 764.115710][T29092] : entered promiscuous mode [ 764.159729][T28323] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 764.191577][T28323] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 764.205550][T28323] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 764.215524][T28323] CPU: 0 UID: 0 PID: 28323 Comm: kworker/u11:4 Tainted: G U L syzkaller #0 PREEMPT(full) [ 764.215582][T28323] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 764.215596][T28323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 764.215630][T28323] Workqueue: hci2 hci_rx_work [ 764.215676][T28323] Call Trace: [ 764.215687][T28323] [ 764.215700][T28323] dump_stack_lvl+0x100/0x190 [ 764.215744][T28323] sysfs_warn_dup.cold+0x1c/0x28 [ 764.215797][T28323] sysfs_create_dir_ns+0x24b/0x2b0 [ 764.215852][T28323] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 764.215904][T28323] ? find_held_lock+0x2b/0x80 [ 764.215948][T28323] ? kobject_add_internal+0x25f/0x930 [ 764.216005][T28323] ? kobject_add_internal+0x25f/0x930 [ 764.216064][T28323] ? do_raw_spin_unlock+0x145/0x1e0 [ 764.216108][T28323] kobject_add_internal+0x2c8/0x930 [ 764.216171][T28323] kobject_add+0x16a/0x1e0 [ 764.216227][T28323] ? __pfx_kobject_add+0x10/0x10 [ 764.216279][T28323] ? class_to_subsys+0x10f/0x150 [ 764.216322][T28323] ? kobject_put+0xb9/0x640 [ 764.216370][T28323] ? _raw_spin_unlock+0x28/0x50 [ 764.216418][T28323] device_add+0x294/0x1970 [ 764.216480][T28323] ? __pfx_dev_set_name+0x10/0x10 [ 764.216521][T28323] ? __pfx_device_add+0x10/0x10 [ 764.216581][T28323] ? mgmt_send_event_skb+0x2fb/0x460 [ 764.216645][T28323] hci_conn_add_sysfs+0x1a3/0x260 [ 764.216696][T28323] le_conn_complete_evt+0x11eb/0x1f60 [ 764.216753][T28323] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 764.216798][T28323] ? __pfx_bt_warn+0x10/0x10 [ 764.216829][T28323] ? hci_event_packet+0x186/0xcd0 [ 764.216881][T28323] hci_le_conn_complete_evt+0x23c/0x3a0 [ 764.216935][T28323] ? skb_pull_data+0x15f/0x1e0 [ 764.216978][T28323] hci_le_meta_evt+0x34a/0x5f0 [ 764.217024][T28323] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 764.217075][T28323] hci_event_packet+0x51c/0xcd0 [ 764.217117][T28323] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 764.217164][T28323] ? __pfx_hci_event_packet+0x10/0x10 [ 764.217211][T28323] ? kcov_remote_start+0x384/0x670 [ 764.217263][T28323] ? lockdep_hardirqs_on+0x78/0x100 [ 764.217316][T28323] hci_rx_work+0x451/0xfc0 [ 764.217365][T28323] process_one_work+0xa23/0x1940 [ 764.217437][T28323] ? __pfx_process_one_work+0x10/0x10 [ 764.217503][T28323] ? __pfx_hci_rx_work+0x10/0x10 [ 764.217548][T28323] worker_thread+0x5ef/0xe50 [ 764.217621][T28323] ? __pfx_worker_thread+0x10/0x10 [ 764.217677][T28323] ? kthread+0x13a/0x450 [ 764.217723][T28323] ? __pfx_worker_thread+0x10/0x10 [ 764.217772][T28323] kthread+0x370/0x450 [ 764.217818][T28323] ? __pfx_kthread+0x10/0x10 [ 764.217869][T28323] ret_from_fork+0x72b/0xd50 [ 764.217920][T28323] ? __pfx_ret_from_fork+0x10/0x10 [ 764.217971][T28323] ? __switch_to+0x800/0x10f0 [ 764.218024][T28323] ? __switch_to_asm+0x39/0x70 [ 764.218073][T28323] ? __pfx_kthread+0x10/0x10 [ 764.218123][T28323] ret_from_fork_asm+0x1a/0x30 [ 764.218193][T28323] [ 764.218257][T28323] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 764.533690][T28137] Bluetooth: hci4: command 0x2016 tx timeout [ 764.548929][T28323] Bluetooth: hci2: failed to register connection device [ 764.721455][T28323] Bluetooth: hci1: command 0x0c1a tx timeout [ 766.232801][T28323] Bluetooth: hci2: command 0x0c1a tx timeout [ 766.452373][T29179] nbd: couldn't find device at index 158 [ 766.791425][T28323] Bluetooth: hci1: command 0x0c1a tx timeout [ 767.389337][T29221] netlink: zone id is out of range [ 767.416028][T29221] netlink: get zone limit has 8 unknown bytes [ 767.865994][T29240] dyndbg: expected <4096 bytes into control [ 768.303056][T28323] Bluetooth: hci2: command 0x0c1a tx timeout [ 768.464860][T28323] Bluetooth: hci2: unexpected event 0x36 length: 123 > 7 [ 768.766207][T29281] syz_tun: tun_chr_ioctl cmd 2147767519 [ 768.860435][T28323] Bluetooth: hci1: command 0x0c1a tx timeout [ 770.373219][T28323] Bluetooth: hci2: command 0x0c1a tx timeout [ 770.935176][T28317] Bluetooth: hci1: command 0x0c1a tx timeout [ 772.443560][T28317] Bluetooth: hci2: command 0x0c1a tx timeout [ 773.002490][T28317] Bluetooth: hci1: command 0x0c1a tx timeout [ 774.105721][T29457] syz_tun: tun_chr_ioctl cmd 1074025681 [ 774.686088][T29478] netlink: 178 bytes leftover after parsing attributes in process `syz.1.11116'. [ 775.075029][T14997] Bluetooth: hci1: command 0x0c1a tx timeout [ 775.212888][T29494] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 776.300774][T29551] netlink: 'syz.2.11151': attribute type 2 has an invalid length. [ 777.889071][T29631] nfsd: Unknown parameter '' [ 777.954308][ T24] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 778.989573][T29683] vmstat_refresh: nr_hugetlb -1024 [ 779.208606][T29690] sctp: [Deprecated]: syz.0.11218 (pid 29690) Use of struct sctp_assoc_value in delayed_ack socket option. [ 779.208606][T29690] Use struct sctp_sack_info instead [ 780.237462][T29738] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11239'. [ 780.867223][T29776] &#$@\]\-: entered promiscuous mode [ 781.340675][T29795] openvswitch: netlink: Duplicate or invalid key (type 0). [ 782.634008][T14997] Bluetooth: hci0: unexpected event 0x3e length: 508 > 260 [ 782.634051][T14997] Bluetooth: hci0: unexpected subevent 0x02 length: 507 > 260 [ 782.651346][T14997] Bluetooth: hci0: Dropping invalid advertising data [ 782.660786][T14997] Bluetooth: hci0: unknown advertising packet type: 0xe9 [ 782.660821][T14997] Bluetooth: hci0: Dropping invalid advertising data [ 782.675030][T14997] Bluetooth: hci0: unknown advertising packet type: 0x79 [ 782.675100][T14997] Bluetooth: hci0: Malformed LE Event: 0x02 [ 782.734724][T29863] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 782.784236][T29863] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 782.815969][T29863] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 782.843188][ T24] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 782.865604][T29862] ACPI Error: Could not disable RealTimeClock events (20260408/evxfevnt-243) [ 783.577282][T29901] openvswitch: netlink: Key 4 has unexpected len 0 expected 12 [ 783.598234][T29903] netlink: 'syz.2.11319': attribute type 1 has an invalid length. [ 783.611196][T29903] nbd: error processing sock list [ 783.991474][T29923] openvswitch: netlink: VXLAN extension 64 out of range max 1 [ 785.121968][T29971] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 785.988830][T14997] Bluetooth: hci1: unexpected event 0x36 length: 123 > 7 [ 787.809083][T30090] netlink: 342 bytes leftover after parsing attributes in process `syz.2.11407'. [ 788.105185][T30100] openvswitch: netlink: Duplicate or invalid key (type 0). [ 788.274342][T30104] netlink: 'syz.5.11412': attribute type 11 has an invalid length. [ 788.493648][T30113] usb usb36: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 788.520365][T30113] vhci_hcd vhci_hcd.1: default hub control req: 0000 v0000 i0000 l0 [ 789.343613][T30140] futex_wake_op: syz.2.11428 tries to shift op by -2048; fix this program [ 789.373282][T30140] futex_wake_op: syz.2.11428 tries to shift op by -2048; fix this program [ 790.639570][T30184] nbd: couldn't find device at index 158 [ 791.043138][T30196] netlink: Unknown NAT attribute (type=262, max=9) [ 791.537685][T30211] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 794.807357][T30331] openvswitch: netlink: Missing valid actions attribute. [ 796.739229][T30404] NFSD: Failed to start, no listeners configured. [ 797.952475][T30441] NFSD: Failed to start, no listeners configured. [ 798.853503][T30469] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11576'. [ 800.606390][T30529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11602'. [ 802.165159][T30569] zswap: compressor û not available [ 802.867008][T30604] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11634'. [ 803.131847][T30616] sctp: [Deprecated]: syz.1.11638 (pid 30616) Use of struct sctp_assoc_value in delayed_ack socket option. [ 803.131847][T30616] Use struct sctp_sack_info instead [ 803.682298][T30634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11648'. [ 804.468686][T30663] FAULT_INJECTION: forcing a failure. [ 804.468686][T30663] name failslab, interval 1, probability 0, space 0, times 0 [ 804.488154][T30663] CPU: 0 UID: 0 PID: 30663 Comm: syz.5.11658 Tainted: G U L syzkaller #0 PREEMPT(full) [ 804.488216][T30663] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 804.488230][T30663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 804.488250][T30663] Call Trace: [ 804.488261][T30663] [ 804.488274][T30663] dump_stack_lvl+0x100/0x190 [ 804.488323][T30663] should_fail_ex.cold+0x5/0xa [ 804.488363][T30663] should_failslab+0xc2/0x120 [ 804.488416][T30663] __kmalloc_noprof+0xfc/0x820 [ 804.488463][T30663] ? sk_prot_alloc+0x10b/0x2a0 [ 804.488533][T30663] sk_prot_alloc+0x10b/0x2a0 [ 804.488570][T30663] sk_alloc+0x36/0xe80 [ 804.488617][T30663] alg_create+0x9e/0x150 [ 804.488746][T30663] __sock_create+0x339/0x860 [ 804.488791][T30663] __sys_socket+0x14d/0x260 [ 804.488832][T30663] ? __pfx___sys_socket+0x10/0x10 [ 804.488882][T30663] __x64_sys_socket+0x72/0xb0 [ 804.488920][T30663] ? lockdep_hardirqs_on+0x78/0x100 [ 804.488964][T30663] do_syscall_64+0x115/0x840 [ 804.489006][T30663] ? clear_bhb_loop+0x40/0x90 [ 804.489050][T30663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.489086][T30663] RIP: 0033:0x7f8e2c19de99 [ 804.489116][T30663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.489152][T30663] RSP: 002b:00007f8e2d012028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 804.489186][T30663] RAX: ffffffffffffffda RBX: 00007f8e2c425fa0 RCX: 00007f8e2c19de99 [ 804.489210][T30663] RDX: 0000000000000000 RSI: 0000000000080805 RDI: 0000000000000026 [ 804.489231][T30663] RBP: 00007f8e2c233eaf R08: 0000000000000000 R09: 0000000000000000 [ 804.489252][T30663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 804.489273][T30663] R13: 00007f8e2c426038 R14: 00007f8e2c425fa0 R15: 00007ffeb703fc28 [ 804.489315][T30663] [ 805.730627][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 805.737333][ T1321] ieee802154 phy1 wpan1: encryption failed: -22 [ 807.481601][T30755] FAULT_INJECTION: forcing a failure. [ 807.481601][T30755] name failslab, interval 1, probability 0, space 0, times 0 [ 807.494611][T30755] CPU: 0 UID: 0 PID: 30755 Comm: syz.2.11698 Tainted: G U L syzkaller #0 PREEMPT(full) [ 807.494671][T30755] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 807.494686][T30755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 807.494707][T30755] Call Trace: [ 807.494719][T30755] [ 807.494732][T30755] dump_stack_lvl+0x100/0x190 [ 807.494779][T30755] should_fail_ex.cold+0x5/0xa [ 807.494819][T30755] should_failslab+0xc2/0x120 [ 807.494871][T30755] __kmalloc_noprof+0xfc/0x820 [ 807.494918][T30755] ? sk_prot_alloc+0x10b/0x2a0 [ 807.494960][T30755] sk_prot_alloc+0x10b/0x2a0 [ 807.494998][T30755] sk_alloc+0x36/0xe80 [ 807.495049][T30755] alg_create+0x9e/0x150 [ 807.495091][T30755] __sock_create+0x339/0x860 [ 807.495142][T30755] __sys_socket+0x14d/0x260 [ 807.495182][T30755] ? __pfx___sys_socket+0x10/0x10 [ 807.495232][T30755] __x64_sys_socket+0x72/0xb0 [ 807.495269][T30755] ? lockdep_hardirqs_on+0x78/0x100 [ 807.495313][T30755] do_syscall_64+0x115/0x840 [ 807.495355][T30755] ? clear_bhb_loop+0x40/0x90 [ 807.495399][T30755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.495435][T30755] RIP: 0033:0x7f47ffb9de99 [ 807.495464][T30755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 807.495500][T30755] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 807.495534][T30755] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 807.495557][T30755] RDX: 0000000000000000 RSI: 0000000000080805 RDI: 0000000000000026 [ 807.495578][T30755] RBP: 00007f47ffc33eaf R08: 0000000000000000 R09: 0000000000000000 [ 807.495599][T30755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 807.495620][T30755] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 807.495664][T30755] [ 808.384978][T30780] netlink: 'syz.2.11708': attribute type 1 has an invalid length. [ 809.353516][T30825] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 810.185614][T30841] netlink: 342 bytes leftover after parsing attributes in process `syz.0.11735'. [ 810.586485][T30851] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 811.046539][T30869] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11746'. [ 812.060011][T30890] mac80211.ieee80211_default_rc_algo: string parameter too long [ 813.724440][T30949] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 814.883689][T30982] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 815.348929][T30993] netlink: 16 bytes leftover after parsing attributes in process `syz.5.11798'. [ 815.977411][T31009] netlink: 342 bytes leftover after parsing attributes in process `syz.5.11804'. [ 816.146070][T31011] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 816.472637][T31017] sctp: [Deprecated]: syz.5.11810 (pid 31017) Use of struct sctp_assoc_value in delayed_ack socket option. [ 816.472637][T31017] Use struct sctp_sack_info instead [ 817.683775][T31047] Device name cannot be null; rc = [-22] [ 818.751564][T31077] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 820.940688][T31135] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11860'. [ 822.215055][T31160] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 822.570777][T31173] program syz.2.11876 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 822.925945][T31191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11885'. [ 823.050462][T31195] bridge0: port 3(syz_tun) entered blocking state [ 823.062286][T31195] bridge0: port 3(syz_tun) entered disabled state [ 823.070541][T31195] syz_tun: entered allmulticast mode [ 823.084600][T31195] syz_tun: entered promiscuous mode [ 823.102110][T31195] bridge0: port 3(syz_tun) entered blocking state [ 823.111091][T31195] bridge0: port 3(syz_tun) entered forwarding state [ 823.201936][T31200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11889'. [ 823.583600][T31217] netlink: 21 bytes leftover after parsing attributes in process `syz.5.11897'. [ 823.721283][T31221] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11898'. [ 825.778379][T31292] ovs_: entered promiscuous mode [ 827.699310][T31367] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11959'. [ 829.467637][T31441] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11990'. [ 829.992690][T31466] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 830.679430][T31491] zswap: compressor FÛ not available [ 830.837405][ T30] audit: type=1800 audit(4295098594.609:45): pid=31510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.12021" name=22050820 dev="tmpfs" ino=15193 res=0 errno=0 [ 832.604179][T31568] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12045'. [ 832.729674][T31576] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12046'. [ 832.753833][T31576] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12046'. [ 833.565257][T31601] zswap: compressor û not available [ 834.564822][T31640] netlink: 2468 bytes leftover after parsing attributes in process `syz.2.12074'. [ 835.777256][T31685] block nbd1: Unsupported socket: should be TCP or UNIX. [ 838.061202][T31769] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 838.077560][T31769] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 838.526032][T31787] FAULT_INJECTION: forcing a failure. [ 838.526032][T31787] name failslab, interval 1, probability 0, space 0, times 0 [ 838.544925][T31787] CPU: 1 UID: 0 PID: 31787 Comm: syz.5.12136 Tainted: G U L syzkaller #0 PREEMPT(full) [ 838.544984][T31787] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 838.544998][T31787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 838.545019][T31787] Call Trace: [ 838.545030][T31787] [ 838.545043][T31787] dump_stack_lvl+0x100/0x190 [ 838.545088][T31787] should_fail_ex.cold+0x5/0xa [ 838.545131][T31787] should_failslab+0xc2/0x120 [ 838.545183][T31787] __kmalloc_noprof+0xfc/0x820 [ 838.545226][T31787] ? __lock_acquire+0x49f/0x1a40 [ 838.545285][T31787] ? sk_prot_alloc+0x10b/0x2a0 [ 838.545327][T31787] sk_prot_alloc+0x10b/0x2a0 [ 838.545373][T31787] sk_alloc+0x36/0xe80 [ 838.545421][T31787] pppol2tp_create+0x32/0x250 [ 838.545541][T31787] pppox_create+0x15c/0x2c0 [ 838.545637][T31787] __sock_create+0x339/0x860 [ 838.545682][T31787] __sys_socket+0x14d/0x260 [ 838.545722][T31787] ? __pfx___sys_socket+0x10/0x10 [ 838.545773][T31787] __x64_sys_socket+0x72/0xb0 [ 838.545811][T31787] ? lockdep_hardirqs_on+0x78/0x100 [ 838.545854][T31787] do_syscall_64+0x115/0x840 [ 838.545895][T31787] ? clear_bhb_loop+0x40/0x90 [ 838.545939][T31787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 838.545976][T31787] RIP: 0033:0x7f8e2c19de99 [ 838.546004][T31787] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 838.546039][T31787] RSP: 002b:00007f8e2d012028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 838.546072][T31787] RAX: ffffffffffffffda RBX: 00007f8e2c425fa0 RCX: 00007f8e2c19de99 [ 838.546095][T31787] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000018 [ 838.546116][T31787] RBP: 00007f8e2c233eaf R08: 0000000000000000 R09: 0000000000000000 [ 838.546141][T31787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 838.546162][T31787] R13: 00007f8e2c426038 R14: 00007f8e2c425fa0 R15: 00007ffeb703fc28 [ 838.546207][T31787] [ 840.809855][T31846] tunl0: entered allmulticast mode [ 841.829140][T31875] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 841.845228][T31875] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 842.345618][T31892] netlink: 342 bytes leftover after parsing attributes in process `syz.5.12180'. [ 842.937486][T31907] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12186'. [ 843.299093][T31917] device-mapper: ioctl: Unable to rename non-existent device, to uuid „ [ 844.221355][T31942] bridge0: port 4(batadv0) entered blocking state [ 844.246099][T31942] bridge0: port 4(batadv0) entered disabled state [ 844.252877][T31942] batadv0: entered allmulticast mode [ 844.302779][T31942] batadv0: entered promiscuous mode [ 844.332019][T31942] bridge0: port 4(batadv0) entered blocking state [ 844.338960][T31942] bridge0: port 4(batadv0) entered listening state [ 844.359288][T13689] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 844.369276][T13689] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 844.647042][T31950] bridge0: port 3(team0) entered blocking state [ 844.695045][T31950] bridge0: port 3(team0) entered disabled state [ 844.738513][T31950] team0: entered allmulticast mode [ 844.763675][T31950] team_slave_0: entered allmulticast mode [ 844.783827][T31950] team_slave_1: entered allmulticast mode [ 844.807171][T31950] team0: entered promiscuous mode [ 844.826164][T31950] team_slave_0: entered promiscuous mode [ 844.858943][T31950] team_slave_1: entered promiscuous mode [ 844.895542][T31950] bridge0: port 3(team0) entered blocking state [ 844.902065][T31950] bridge0: port 3(team0) entered forwarding state [ 845.474181][T31969] openvswitch: netlink: IPv4 tunnel dst address is zero [ 845.528152][T31972] bridge0: port 3(batadv0) entered blocking state [ 845.550056][T31972] bridge0: port 3(batadv0) entered disabled state [ 845.577570][T31972] batadv0: entered allmulticast mode [ 845.596403][T31972] batadv0: entered promiscuous mode [ 845.620383][T31972] bridge0: port 3(batadv0) entered blocking state [ 845.627147][T31972] bridge0: port 3(batadv0) entered forwarding state [ 845.758073][T31974] FAULT_INJECTION: forcing a failure. [ 845.758073][T31974] name failslab, interval 1, probability 0, space 0, times 0 [ 845.818645][T31974] CPU: 0 UID: 0 PID: 31974 Comm: syz.1.12214 Tainted: G U L syzkaller #0 PREEMPT(full) [ 845.818706][T31974] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 845.818721][T31974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 845.818742][T31974] Call Trace: [ 845.818754][T31974] [ 845.818767][T31974] dump_stack_lvl+0x100/0x190 [ 845.818823][T31974] should_fail_ex.cold+0x5/0xa [ 845.818862][T31974] should_failslab+0xc2/0x120 [ 845.818913][T31974] __kmalloc_noprof+0xfc/0x820 [ 845.818957][T31974] ? trace_kmalloc+0xeb/0x110 [ 845.819006][T31974] ? lsm_blob_alloc+0x68/0x90 [ 845.819071][T31974] lsm_blob_alloc+0x68/0x90 [ 845.819131][T31974] security_sk_alloc+0x2d/0x290 [ 845.819174][T31974] sk_prot_alloc+0x12a/0x2a0 [ 845.819212][T31974] sk_alloc+0x36/0xe80 [ 845.819260][T31974] packet_create+0x127/0x8e0 [ 845.819402][T31974] __sock_create+0x339/0x860 [ 845.819447][T31974] __sys_socket+0x14d/0x260 [ 845.819487][T31974] ? __pfx___sys_socket+0x10/0x10 [ 845.819538][T31974] __x64_sys_socket+0x72/0xb0 [ 845.819576][T31974] ? lockdep_hardirqs_on+0x78/0x100 [ 845.819619][T31974] do_syscall_64+0x115/0x840 [ 845.819661][T31974] ? clear_bhb_loop+0x40/0x90 [ 845.819705][T31974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.819742][T31974] RIP: 0033:0x7f0031f9de99 [ 845.819771][T31974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.819806][T31974] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 845.819846][T31974] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 845.819869][T31974] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0200000000000011 [ 845.819892][T31974] RBP: 00007f0032033eaf R08: 0000000000000000 R09: 0000000000000000 [ 845.819913][T31974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 845.819934][T31974] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 845.819978][T31974] [ 846.040957][T13689] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 846.051817][T13689] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 846.487564][T31986] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12220'. [ 849.179278][T32065] FAULT_INJECTION: forcing a failure. [ 849.179278][T32065] name failslab, interval 1, probability 0, space 0, times 0 [ 849.206281][T32065] CPU: 1 UID: 0 PID: 32065 Comm: syz.2.12252 Tainted: G U L syzkaller #0 PREEMPT(full) [ 849.206341][T32065] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 849.206354][T32065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 849.206375][T32065] Call Trace: [ 849.206386][T32065] [ 849.206399][T32065] dump_stack_lvl+0x100/0x190 [ 849.206446][T32065] should_fail_ex.cold+0x5/0xa [ 849.206486][T32065] should_failslab+0xc2/0x120 [ 849.206547][T32065] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 849.206594][T32065] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 849.206736][T32065] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 849.206777][T32065] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 849.206819][T32065] alloc_inode+0x68/0x250 [ 849.206875][T32065] new_inode+0x22/0x1c0 [ 849.206926][T32065] hugetlbfs_get_inode+0x39a/0x700 [ 849.206975][T32065] hugetlb_file_setup+0x15b/0x5b0 [ 849.207023][T32065] ksys_mmap_pgoff+0x242/0x610 [ 849.207077][T32065] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 849.207123][T32065] ? xfd_validate_state+0x129/0x190 [ 849.207171][T32065] __x64_sys_mmap+0x125/0x190 [ 849.207220][T32065] do_syscall_64+0x115/0x840 [ 849.207267][T32065] ? clear_bhb_loop+0x40/0x90 [ 849.207309][T32065] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.207345][T32065] RIP: 0033:0x7f47ffb9de99 [ 849.207373][T32065] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.207407][T32065] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 849.207440][T32065] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 849.207463][T32065] RDX: 00000000003ffffe RSI: 0000000000a00006 RDI: 0000000000000000 [ 849.207487][T32065] RBP: 00007f47ffc33eaf R08: 0000000000000602 R09: 0000300000000000 [ 849.207508][T32065] R10: 0000000000040eb1 R11: 0000000000000246 R12: 0000000000000000 [ 849.207529][T32065] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 849.207572][T32065] [ 850.266058][T32105] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12268'. [ 851.346431][T32142] bridge0: port 3(team0) entered blocking state [ 851.364490][T32142] bridge0: port 3(team0) entered disabled state [ 851.372635][T32142] team0: entered allmulticast mode [ 851.393870][T32142] team_slave_0: entered allmulticast mode [ 851.420535][T32142] team_slave_1: entered allmulticast mode [ 851.444506][T32142] team0: entered promiscuous mode [ 851.449726][T32142] team_slave_0: entered promiscuous mode [ 851.473753][T32142] team_slave_1: entered promiscuous mode [ 851.492502][T32142] bridge0: port 3(team0) entered blocking state [ 851.498987][T32142] bridge0: port 3(team0) entered forwarding state [ 852.732780][T32200] ovs_ÿþ: entered promiscuous mode [ 852.970024][T32210] loop6: detected capacity change from 0 to 8 [ 856.396010][T32343] usb usb39: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 856.404220][T32343] vhci_hcd vhci_hcd.3: invalid port number 108 [ 856.411003][T32343] vhci_hcd vhci_hcd.3: default hub control req: 2e2f v6966 i006c l48 [ 857.078367][T32366] netlink: 32 bytes leftover after parsing attributes in process `syz.5.12385'. [ 857.567603][ T30] audit: type=1800 audit(4295098621.474:46): pid=32391 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.12395" name=04 dev="tmpfs" ino=11287 res=0 errno=0 [ 858.150711][T32410] nbd: socks must be embedded in a SOCK_ITEM attr [ 858.637824][T32438] futex_wake_op: syz.0.12416 tries to shift op by -2048; fix this program [ 858.647130][T32438] futex_wake_op: syz.0.12416 tries to shift op by -2048; fix this program [ 859.876538][ C0] bridge0: port 4(batadv0) entered learning state [ 861.028912][T32528] netlink: 334 bytes leftover after parsing attributes in process `syz.5.12457'. [ 861.277086][T32538] FAULT_INJECTION: forcing a failure. [ 861.277086][T32538] name failslab, interval 1, probability 0, space 0, times 0 [ 861.290662][T32538] CPU: 0 UID: 0 PID: 32538 Comm: syz.1.12461 Tainted: G U L syzkaller #0 PREEMPT(full) [ 861.290720][T32538] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 861.290733][T32538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 861.290755][T32538] Call Trace: [ 861.290766][T32538] [ 861.290778][T32538] dump_stack_lvl+0x100/0x190 [ 861.290825][T32538] should_fail_ex.cold+0x5/0xa [ 861.290877][T32538] should_failslab+0xc2/0x120 [ 861.290929][T32538] kmem_cache_alloc_noprof+0x91/0x6a0 [ 861.290976][T32538] ? prepare_creds+0x2c/0x950 [ 861.291040][T32538] prepare_creds+0x2c/0x950 [ 861.291098][T32538] cap_task_prctl+0x449/0xa50 [ 861.291144][T32538] security_task_prctl+0xc2/0x160 [ 861.291207][T32538] __do_sys_prctl+0x9b/0x2270 [ 861.291264][T32538] ? __pfx___do_sys_prctl+0x10/0x10 [ 861.291329][T32538] do_syscall_64+0x115/0x840 [ 861.291377][T32538] ? clear_bhb_loop+0x40/0x90 [ 861.291421][T32538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 861.291458][T32538] RIP: 0033:0x7f0031f9de99 [ 861.291488][T32538] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 861.291524][T32538] RSP: 002b:00007f0032f0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 861.291558][T32538] RAX: ffffffffffffffda RBX: 00007f0032225fa0 RCX: 00007f0031f9de99 [ 861.291582][T32538] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008 [ 861.291602][T32538] RBP: 00007f0032033eaf R08: 0000000000000007 R09: 0000000000000000 [ 861.291624][T32538] R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000000 [ 861.291645][T32538] R13: 00007f0032226038 R14: 00007f0032225fa0 R15: 00007ffd14fd4f18 [ 861.291690][T32538] [ 862.130370][T32569] usb usb39: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 862.151061][T32569] vhci_hcd vhci_hcd.3: invalid port number 108 [ 862.180607][T32569] vhci_hcd vhci_hcd.3: default hub control req: 2e2f v6966 i006c l48 [ 863.326853][T32609] netlink: 206 bytes leftover after parsing attributes in process `syz.0.12493'. [ 863.380189][T32562] kexec: Could not allocate control_code_buffer [ 863.705730][T32626] netlink: 350 bytes leftover after parsing attributes in process `syz.2.12501'. [ 864.188043][T32647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12513'. [ 864.255046][T32651] [ 864.257450][T32651] ====================================================== [ 864.264539][T32651] WARNING: possible circular locking dependency detected [ 864.271699][T32651] syzkaller #0 Tainted: G U L [ 864.277812][T32651] ------------------------------------------------------ [ 864.284895][T32651] syz.2.12512/32651 is trying to acquire lock: [ 864.291357][T32651] ffff88801caf5210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_getattr+0x9c/0xf0 [ 864.301734][T32651] [ 864.301734][T32651] but task is already holding lock: [ 864.309170][T32651] ffff888027890060 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20 [ 864.320647][T32651] [ 864.320647][T32651] which lock already depends on the new lock. [ 864.320647][T32651] [ 864.331091][T32651] [ 864.331091][T32651] the existing dependency chain (in reverse order) is: [ 864.340159][T32651] [ 864.340159][T32651] -> #2 (&q->q_usage_counter(io)#23){++++}-{0:0}: [ 864.348851][T32651] lock_acquire+0x1b9/0x370 [ 864.353985][T32651] blk_alloc_queue+0x610/0x790 [ 864.359452][T32651] blk_mq_alloc_queue+0x174/0x290 [ 864.365081][T32651] __blk_mq_alloc_disk+0x29/0x120 [ 864.370697][T32651] loop_add+0x498/0xb60 [ 864.375515][T32651] loop_init+0x1d3/0x200 [ 864.380330][T32651] do_one_initcall+0x11d/0x700 [ 864.385676][T32651] kernel_init_freeable+0x6ea/0x7b0 [ 864.391647][T32651] kernel_init+0x1f/0x1e0 [ 864.396581][T32651] ret_from_fork+0x72b/0xd50 [ 864.401770][T32651] ret_from_fork_asm+0x1a/0x30 [ 864.407107][T32651] [ 864.407107][T32651] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 864.414372][T32651] lock_acquire+0x1b9/0x370 [ 864.419456][T32651] fs_reclaim_acquire+0xc4/0x100 [ 864.425224][T32651] kmem_cache_alloc_noprof+0x63/0x6a0 [ 864.431194][T32651] __kernfs_iattrs+0x126/0x450 [ 864.436638][T32651] __kernfs_setattr+0x4d/0x3c0 [ 864.441993][T32651] kernfs_iop_setattr+0xda/0x130 [ 864.447503][T32651] notify_change+0xb25/0x1330 [ 864.452838][T32651] do_truncate+0x1df/0x240 [ 864.457812][T32651] path_openat+0x370f/0x4280 [ 864.463051][T32651] do_file_open+0x20e/0x430 [ 864.468107][T32651] do_sys_openat2+0x10f/0x1e0 [ 864.473344][T32651] __x64_sys_openat+0x12d/0x210 [ 864.478756][T32651] do_syscall_64+0x115/0x840 [ 864.483912][T32651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.490367][T32651] [ 864.490367][T32651] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 864.498929][T32651] check_prev_add+0xeb/0xe60 [ 864.504094][T32651] __lock_acquire+0x136c/0x1a40 [ 864.509524][T32651] lock_acquire+0x1b9/0x370 [ 864.514631][T32651] down_read+0x99/0x4c0 [ 864.519539][T32651] kernfs_iop_getattr+0x9c/0xf0 [ 864.525050][T32651] vfs_getattr_nosec+0x2d4/0x430 [ 864.530545][T32651] vfs_getattr+0x4a/0x60 [ 864.535347][T32651] loop_query_min_dio_size.isra.0+0x117/0x250 [ 864.541984][T32651] lo_ioctl+0x13aa/0x1bc0 [ 864.546889][T32651] blkdev_ioctl+0x5ad/0x6f0 [ 864.552026][T32651] __x64_sys_ioctl+0x18e/0x210 [ 864.557359][T32651] do_syscall_64+0x115/0x840 [ 864.562519][T32651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.569163][T32651] [ 864.569163][T32651] other info that might help us debug this: [ 864.569163][T32651] [ 864.579673][T32651] Chain exists of: [ 864.579673][T32651] &root->kernfs_iattr_rwsem --> fs_reclaim --> &q->q_usage_counter(io)#23 [ 864.579673][T32651] [ 864.594160][T32651] Possible unsafe locking scenario: [ 864.594160][T32651] [ 864.601634][T32651] CPU0 CPU1 [ 864.607018][T32651] ---- ---- [ 864.612406][T32651] lock(&q->q_usage_counter(io)#23); [ 864.617822][T32651] lock(fs_reclaim); [ 864.624528][T32651] lock(&q->q_usage_counter(io)#23); [ 864.632478][T32651] rlock(&root->kernfs_iattr_rwsem); [ 864.637882][T32651] [ 864.637882][T32651] *** DEADLOCK *** [ 864.637882][T32651] [ 864.646045][T32651] 3 locks held by syz.2.12512/32651: [ 864.651352][T32651] #0: ffff888027a5b430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_global_lock_killable+0x30/0xb0 [ 864.661606][T32651] #1: ffff888027890060 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20 [ 864.673347][T32651] #2: ffff888027890098 (&q->q_usage_counter(queue)#7){+.+.}-{0:0}, at: blk_mq_freeze_queue_nomemsave+0x15/0x20 [ 864.685283][T32651] [ 864.685283][T32651] stack backtrace: [ 864.691205][T32651] CPU: 0 UID: 0 PID: 32651 Comm: syz.2.12512 Tainted: G U L syzkaller #0 PREEMPT(full) [ 864.691247][T32651] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 864.691258][T32651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 864.691274][T32651] Call Trace: [ 864.691285][T32651] [ 864.691295][T32651] dump_stack_lvl+0x100/0x190 [ 864.691326][T32651] print_circular_bug.cold+0x178/0x1c7 [ 864.691372][T32651] check_noncircular+0x146/0x160 [ 864.691418][T32651] check_prev_add+0xeb/0xe60 [ 864.691461][T32651] __lock_acquire+0x136c/0x1a40 [ 864.691510][T32651] lock_acquire+0x1b9/0x370 [ 864.691552][T32651] ? kernfs_iop_getattr+0x9c/0xf0 [ 864.691599][T32651] ? __pfx___might_resched+0x10/0x10 [ 864.691646][T32651] down_read+0x99/0x4c0 [ 864.691683][T32651] ? kernfs_iop_getattr+0x9c/0xf0 [ 864.691721][T32651] ? find_held_lock+0x2b/0x80 [ 864.691754][T32651] ? __pfx_down_read+0x10/0x10 [ 864.691790][T32651] ? kernfs_root+0xee/0x2a0 [ 864.691831][T32651] kernfs_iop_getattr+0x9c/0xf0 [ 864.691871][T32651] vfs_getattr_nosec+0x2d4/0x430 [ 864.691903][T32651] ? __pfx_kernfs_iop_getattr+0x10/0x10 [ 864.691944][T32651] vfs_getattr+0x4a/0x60 [ 864.691974][T32651] loop_query_min_dio_size.isra.0+0x117/0x250 [ 864.692008][T32651] ? __pfx_loop_query_min_dio_size.isra.0+0x10/0x10 [ 864.692055][T32651] lo_ioctl+0x13aa/0x1bc0 [ 864.692091][T32651] ? __pfx_lo_ioctl+0x10/0x10 [ 864.692125][T32651] ? kasan_quarantine_put+0x104/0x240 [ 864.692157][T32651] ? blk_get_meta_cap+0xd4/0x6c0 [ 864.692276][T32651] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 864.692321][T32651] ? tomoyo_path_number_perm+0x28f/0x580 [ 864.692387][T32651] ? blkdev_common_ioctl+0x515/0x2b80 [ 864.692416][T32651] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 864.692443][T32651] ? __pfx_futex_wait+0x10/0x10 [ 864.692484][T32651] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 864.692526][T32651] ? do_vfs_ioctl+0x226/0x13e0 [ 864.692565][T32651] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 864.692614][T32651] ? __x64_sys_close_range+0x2d9/0x5d0 [ 864.692654][T32651] ? __pfx_lo_ioctl+0x10/0x10 [ 864.692687][T32651] blkdev_ioctl+0x5ad/0x6f0 [ 864.692712][T32651] ? __pfx_blkdev_ioctl+0x10/0x10 [ 864.692738][T32651] ? xfd_validate_state+0x129/0x190 [ 864.692771][T32651] ? __pfx_blkdev_ioctl+0x10/0x10 [ 864.692798][T32651] __x64_sys_ioctl+0x18e/0x210 [ 864.692837][T32651] do_syscall_64+0x115/0x840 [ 864.692871][T32651] ? clear_bhb_loop+0x40/0x90 [ 864.692901][T32651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.692930][T32651] RIP: 0033:0x7f47ffb9de99 [ 864.692952][T32651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 864.692979][T32651] RSP: 002b:00007f4800a7e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 864.693004][T32651] RAX: ffffffffffffffda RBX: 00007f47ffe25fa0 RCX: 00007f47ffb9de99 [ 864.693022][T32651] RDX: 0000000000000000 RSI: 0000000000004c06 RDI: 0000000000000001 [ 864.693039][T32651] RBP: 00007f47ffc33eaf R08: 0000000000000000 R09: 0000000000000000 [ 864.693056][T32651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 864.693072][T32651] R13: 00007f47ffe26038 R14: 00007f47ffe25fa0 R15: 00007fffee2718e8 [ 864.693100][T32651] [ 865.068376][T32656] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12514'. [ 866.880631][ T1321] ieee802154 phy0 wpan0: encryption failed: -22 [ 866.887370][ T1321] ieee802154 phy1 wpan1: encryption failed: -22