last executing test programs: 31.91837028s ago: executing program 4 (id=620): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000780)="120000001200e7ef007b00000000000000a1", 0x12, 0x4040080, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002c40)={0x1, &(0x7f0000002c80)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x2000000000000) 31.81444473s ago: executing program 4 (id=623): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000001, 0x401d132, 0xffffffffffffffff, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) syz_clone(0x2180100, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x40, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000680)={0x0}}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 31.446776438s ago: executing program 4 (id=629): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000000040), 0x4) socketpair(0x1, 0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) rmdir(0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, 0x0, 0x0) read(r4, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000940)={0x1, &(0x7f0000000980)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f00000003c0)={{&(0x7f0000405000/0x2000)=nil, 0x2000}}) close_range(r5, 0xffffffffffffffff, 0x0) 30.476794485s ago: executing program 4 (id=632): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in=@remote, @in=@empty, 0x4e23, 0x0, 0x4e21, 0x4, 0x2, 0xa0, 0x80, 0x21}, {0xa9a7, 0x8, 0x8000000000000000, 0x5, 0x9, 0x3, 0x4, 0xf}, {0x3, 0x200, 0x2, 0x9}, 0x7, 0x6e6bb3, 0x0, 0x1, 0x3, 0x2}, {{@in6=@loopback, 0x4d4, 0xff}, 0xa, @in=@loopback, 0x3502, 0x2, 0x2, 0x0, 0x80, 0xffff, 0x3}}, 0xe8) 30.262910327s ago: executing program 4 (id=635): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r0, 0x8002f515, 0x0) 30.13053009s ago: executing program 4 (id=638): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000100)='./tracefs\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/test\x00', 0x777) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='100000', 0x6) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r5, &(0x7f0000000300)='0', 0x1) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs/instances/foo\x00', 0x1ff) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c890}, 0x0) 23.000688719s ago: executing program 0 (id=660): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) syz_ublk_setup_io_uring(0x352e, 0x0, 0x0, 0x0, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, 0x0}, 0x4048043) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) 21.50262849s ago: executing program 0 (id=664): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x88802) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000200), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB="2c00bd8c89b63ed8614457509670760200bc56ac8b4875c4802cbe376a000081733cfdc2eaeec12119033f7abbaf7c95fbb3d72705a496dca1c2e0314b53e358e921c12ead845034e449a30405cfb280fa"]) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) semctl$GETALL(0x0, 0x0, 0xd, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000400)=0x4) r3 = syz_open_dev$MSR(&(0x7f0000000440), 0x0, 0x0) read$msr(r3, &(0x7f0000000480)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000019480)=0x410000002) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000194c0)={&(0x7f0000019500)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000019540)={0x11, 0xf, &(0x7f0000019600)=ANY=[@ANYRES32], &(0x7f0000019640)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x0, r4, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000019680)=[{0x0, 0x1, 0x9, 0x1}], 0x10, 0xfffffd2b}, 0x94) 20.61474158s ago: executing program 0 (id=666): r0 = socket(0x2, 0x80805, 0x0) close(0x3) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r1, 0x4) sendmmsg$inet_sctp(r0, &(0x7f0000000cc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB='0'], 0x30, 0x180}], 0x1, 0x0) 20.476741964s ago: executing program 0 (id=677): unshare(0x2c020400) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000001200), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000001240)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000001280)={@hyper}) 19.966819555s ago: executing program 0 (id=668): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="90000000", @ANYRES16=r3, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="0600cd00000000006c003300802009000802110000010802110000005050505050505f00ff"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 19.191420043s ago: executing program 0 (id=670): bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) prlimit64(r0, 0x4, 0x0, &(0x7f0000000240)) io_setup(0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./trace\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./trace/trace\x00', 0x0, 0x0) read(r3, &(0x7f0000000500), 0x1000) 14.835842023s ago: executing program 32 (id=638): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracefs\x00', 0x1ef) mount(0x0, &(0x7f0000000100)='./tracefs\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/test\x00', 0x777) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='100000', 0x6) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r5, &(0x7f0000000300)='0', 0x1) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs/instances/foo\x00', 0x1ff) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c890}, 0x0) 12.625964806s ago: executing program 2 (id=697): openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = userfaultfd(0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x2, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000140)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000001c0), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000200), 0x4000087, 0x2, 0x0) mount(0x0, &(0x7f0000000280)='./trace\x00', 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f000070d000/0x2000)=nil, 0x2000, 0x2000009, 0x12, r1, 0x91c6b000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000480)={0xaa, 0x100}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000540)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 11.30028386s ago: executing program 2 (id=700): r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x38) write$P9_RREADLINK(r0, &(0x7f0000000000)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) setxattr$security_ima(&(0x7f0000000180)='./file1\x00', &(0x7f0000000340), &(0x7f00000003c0)=@sha1={0x1, "38fd72674e608a87e092a271aace7add25be06a2"}, 0xfffe, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/test\x00', 0x68a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='1', 0x1) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) 10.726632568s ago: executing program 2 (id=701): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000140)='7', 0x1) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) write$sndseq(r0, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x0, @time, {0x4}, {}, @ext={0x50, 0x0}}, {0x0, 0x0, 0x0, 0x1, @tick, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw8={"272be5806cd46d7b9ff797a0"}}, {0x0, 0x0, 0x0, 0x0, @time={0x8000, 0x1}, {}, {}, @result={0xbac, 0x28}}], 0x68) 9.350567727s ago: executing program 2 (id=704): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000003c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000400)=0x81) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000440)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000480), 0x0, 0x0) read$msr(r3, &(0x7f00000004c0)=""/102392, 0x18ff8) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f00000194c0)={0x40000000, 0x0, &(0x7f0000019500)={&(0x7f0000019540)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r4, &(0x7f0000019580)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f00000195c0)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000019600)={{{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffa, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r4, &(0x7f0000019700), 0x800001d, 0x1c) 9.350315837s ago: executing program 3 (id=705): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000ac0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000b40)=[{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000bc0)="f48d9ca38fff48f3be52163448702ba8", 0x10}, {&(0x7f0000000c00)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d20ffffffff00000000aae1efd7e005cb874a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb09587", 0x4d}, {&(0x7f0000000c80)="e8628add700e444d50a969ff67347cff6127e6ef12ee3819271482a4ff01000000000000b3945d1032005eabe97b4dc33a47d3", 0x33}], 0x3}], 0x1, 0x40800) recvmsg(r1, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000e80)=""/81, 0x7ffff000}, {&(0x7f0000000f00)=""/83, 0x20000253}], 0x2}, 0x0) 7.04471658s ago: executing program 3 (id=707): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x40) write(r0, &(0x7f00000001c0)='27', 0x2) rt_sigprocmask(0x0, 0x0, &(0x7f00000000c0), 0x8) syz_io_uring_setup(0xd00, &(0x7f0000000680)={0x0, 0x7483, 0x2, 0x2, 0x3af}, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780)) 7.04322147s ago: executing program 2 (id=717): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = epoll_create1(0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, 0x0) epoll_pwait(r3, &(0x7f0000000200)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) r4 = dup3(r1, r3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, 0x0) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x2000000, 0x20031, 0xffffffffffffffff, 0x2000) remap_file_pages(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x9, 0x10000) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_INIT(r5, 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r3, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='}.+-\x00', 0x0, 0x0, 0x3, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x3}) ioctl$RTC_VL_CLR(r6, 0x7014) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = socket$pptp(0x18, 0x1, 0x2) getsockopt$sock_buf(r7, 0x1, 0x1c, 0x0, &(0x7f0000000080)) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) 6.765349018s ago: executing program 3 (id=709): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x140, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000001800)={0xfffffffffffffd17, 0xffffffffffffffda, 0x0, {0x7, 0x1f, 0xe0000000, 0x50426000, 0xb, 0xffff, 0x5, 0x2, 0x0, 0x0, 0x80, 0x80000001}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000001880)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000003880), 0x1a1080, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000038c0)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f00000039c0), 0x2, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) write(r1, &(0x7f0000000200)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress.discovery,traddr=127.0.0.1\x00', 0x48) 5.35112018s ago: executing program 1 (id=712): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$sndctrl(&(0x7f0000000340), 0x0, 0x3630c1) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f00000000c0)='nilfs2\x00', 0x11, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0xf00, 0x480, 0x1, 0x1, 0xd59f80, 0x19f2, 0x3f, 0x19ef, 0x3, 0x3, 0x2800, 0x2800, 0x2, 0xd1, 0xc, 0x30, {0x8, 0xfffffff7}, 0xd0, 0x9}}) futex(0x0, 0x83, 0x0, 0x0, 0x0, 0xffffff01) 4.377578409s ago: executing program 3 (id=713): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 3.837421693s ago: executing program 33 (id=670): bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000240), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) prlimit64(r0, 0x4, 0x0, &(0x7f0000000240)) io_setup(0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./trace\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./trace/trace\x00', 0x0, 0x0) read(r3, &(0x7f0000000500), 0x1000) 3.823260975s ago: executing program 1 (id=715): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bond0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x44}}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000280)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r4 = socket(0x11, 0x80a, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x40, 0x1040}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x4}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000004c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x4000, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 2.946007733s ago: executing program 1 (id=716): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$sequencer2(0xffffff9c, &(0x7f0000000000), 0x20940, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet6(0xa, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xffd8) 2.379437931s ago: executing program 1 (id=718): syz_emit_ethernet(0x36, &(0x7f00000002c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 2.239652025s ago: executing program 1 (id=719): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$VHOST_GET_FEATURES(r0, 0x8008af00, 0xffffffffffffffff) 2.144099634s ago: executing program 1 (id=720): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x40) write(r0, &(0x7f00000001c0)='27', 0x2) rt_sigprocmask(0x0, 0x0, &(0x7f00000000c0), 0x8) syz_io_uring_setup(0xd00, &(0x7f0000000680)={0x0, 0x7483, 0x2, 0x2, 0x3af}, &(0x7f0000000700), &(0x7f0000000740), &(0x7f0000000780)) 2.078949271s ago: executing program 2 (id=721): prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000440)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000480)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000580)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000600), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000640), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) setitimer(0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r3, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/sda\x00', 0x101042, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x40000000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 1.937426325s ago: executing program 3 (id=722): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x800001000089}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000140)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) r0 = getpid() syz_emit_ethernet(0x46, &(0x7f0000000240)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x10, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts]}}}}}, 0x0) sched_setscheduler(r0, 0x2, &(0x7f00000001c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000000480)=""/102392, 0x18ff8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x21, &(0x7f0000000340), 0x4) sendmsg$xdp(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0, 0x40088c5}, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000019940)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x40) recvmmsg(0xffffffffffffffff, &(0x7f0000019980), 0x0, 0x20000020, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x141a82, 0x33) write$cgroup_freezer_state(r2, &(0x7f00000000c0)='THAWED\x00', 0x7) 0s ago: executing program 3 (id=723): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000002440)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a306406092a864886f70d01010b29801f901b8747026e7fd8160030343132303006035504030c2943657248c166696361746520000072696669636174626f6e2073656c662d74657374696e67206b65793020170d32323035313832320700000000000000313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5e7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b36664266761fbfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebf026c8a31f31cc74be693cda35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0683551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac1197cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f0593447070000000000000000f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cffbffffffffffffff79748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46", 0x504, r0) mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='127.0.0.1', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000004c0)=0xe8) getgroups(0x2, &(0x7f0000000500)=[0xee00, 0xee01]) mount$fuse(0x0, &(0x7f0000000080)='./config/cluster/ocfs2/node/node0/local\x00', &(0x7f00000000c0), 0x1902008, &(0x7f00000005c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@smackfsdef={'smackfsdef', 0x3d, '['}}, {@dont_hash}]}}) write(r2, &(0x7f0000000240)='7', 0x1) write(0xffffffffffffffff, &(0x7f00000002c0)='0', 0x1) rt_sigprocmask(0x0, &(0x7f0000000400)={[0xfffff7feffff7ffc]}, 0x0, 0x8) r5 = gettid() tkill(r5, 0x12) io_pgetevents(0x0, 0x3, 0x0, 0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={[0x2368e8ff]}, 0x8}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0) write(r6, &(0x7f0000000580)='3', 0x1) kernel console output (not intermixed with test programs): 307][ T4460] device syzkaller0 entered promiscuous mode [ 79.135382][ T4465] device syzkaller0 entered promiscuous mode [ 79.180854][ T4463] device syzkaller0 entered promiscuous mode [ 79.370439][ T4476] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 79.391679][ T4475] device syzkaller0 entered promiscuous mode [ 79.559452][ T4485] netlink: 28 bytes leftover after parsing attributes in process `syz.0.55'. [ 79.574278][ T4485] netlink: 28 bytes leftover after parsing attributes in process `syz.0.55'. [ 79.804308][ T13] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.027175][ T4485] device team0 entered promiscuous mode [ 80.095427][ T4485] device team_slave_0 entered promiscuous mode [ 80.183192][ T4485] device team_slave_1 entered promiscuous mode [ 80.234757][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 80.300601][ T13] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 80.455770][ T13] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 80.512824][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.531653][ T4485] device bond0 entered promiscuous mode [ 80.543568][ T4485] device bond_slave_0 entered promiscuous mode [ 80.555582][ T13] usb 5-1: config 0 descriptor?? [ 80.562208][ T4485] device bond_slave_1 entered promiscuous mode [ 80.591515][ T4485] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 80.615380][ T4300] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 80.839215][ T13] usb 5-1: USB disconnect, device number 2 [ 81.041918][ T4506] ODEBUG: Out of memory. ODEBUG disabled [ 81.226938][ T26] audit: type=1800 audit(1794154484.357:2): pid=4517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.50" name=08 dev="sda1" ino=2047 res=0 errno=0 [ 81.877108][ T4528] device syzkaller0 entered promiscuous mode [ 81.916578][ T4525] device syzkaller0 entered promiscuous mode [ 82.410649][ T4521] device syzkaller0 entered promiscuous mode [ 83.048596][ T4542] device syzkaller0 entered promiscuous mode [ 83.128038][ T4548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.62'. [ 83.313816][ T4553] netlink: 28 bytes leftover after parsing attributes in process `syz.4.63'. [ 83.385711][ T4554] 9pnet_virtio: no channels available for device 127.0.0.1 [ 83.562121][ T4553] netlink: 28 bytes leftover after parsing attributes in process `syz.4.63'. [ 84.060536][ T4553] device team0 entered promiscuous mode [ 84.106316][ T4553] device team_slave_0 entered promiscuous mode [ 84.115307][ T4553] device team_slave_1 entered promiscuous mode [ 84.150476][ T4553] device bond0 entered promiscuous mode [ 84.156925][ T4553] device bond_slave_0 entered promiscuous mode [ 84.163698][ T4553] device bond_slave_1 entered promiscuous mode [ 84.177284][ T4553] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 84.186585][ T4553] Cannot create hsr debugfs directory [ 84.192428][ T4553] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 84.203979][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 84.460100][ T4570] device syzkaller0 entered promiscuous mode [ 84.549400][ T4579] device syzkaller0 entered promiscuous mode [ 84.732524][ T4592] device syzkaller0 entered promiscuous mode [ 84.771338][ T4586] device syzkaller0 entered promiscuous mode [ 84.809383][ T4594] netlink: 28 bytes leftover after parsing attributes in process `syz.3.79'. [ 84.818902][ T4594] netlink: 28 bytes leftover after parsing attributes in process `syz.3.79'. [ 84.830379][ T4594] device bond0 entered promiscuous mode [ 84.836820][ T4594] device bond_slave_0 entered promiscuous mode [ 84.847258][ T4594] device bond_slave_1 entered promiscuous mode [ 84.909104][ T4594] device bond0 left promiscuous mode [ 84.937020][ T4594] device bond_slave_0 left promiscuous mode [ 84.985052][ T4594] device bond_slave_1 left promiscuous mode [ 86.646374][ T4599] sched: RT throttling activated [ 86.772151][ T1111] cfg80211: failed to load regulatory.db [ 87.342630][ T4625] device syzkaller0 entered promiscuous mode [ 87.797815][ T4636] device syzkaller0 entered promiscuous mode [ 88.606140][ T4645] device syzkaller0 entered promiscuous mode [ 89.769978][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.94'. [ 89.853054][ T4650] netlink: 28 bytes leftover after parsing attributes in process `syz.2.94'. [ 90.070886][ T4650] device bond0 entered promiscuous mode [ 90.136469][ T4650] device bond_slave_0 entered promiscuous mode [ 90.214072][ T4650] device bond_slave_1 entered promiscuous mode [ 90.388090][ T4650] device bond0 left promiscuous mode [ 90.404904][ T4650] device bond_slave_0 left promiscuous mode [ 90.427023][ T4650] device bond_slave_1 left promiscuous mode [ 90.637925][ T4670] FAULT_INJECTION: forcing a failure. [ 90.637925][ T4670] name failslab, interval 1, probability 0, space 0, times 1 [ 90.678211][ T4670] CPU: 0 PID: 4670 Comm: syz.2.103 Not tainted syzkaller #0 [ 90.685554][ T4670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 90.692658][ T4674] device syzkaller0 entered promiscuous mode [ 90.695812][ T4670] Call Trace: [ 90.695847][ T4670] [ 90.695857][ T4670] dump_stack_lvl+0x188/0x250 [ 90.695891][ T4670] ? show_regs_print_info+0x20/0x20 [ 90.695917][ T4670] ? load_image+0x410/0x410 [ 90.695943][ T4670] ? __might_sleep+0xf0/0xf0 [ 90.695963][ T4670] ? __lock_acquire+0x7d40/0x7d40 [ 90.732353][ T4670] should_fail+0x383/0x4b0 [ 90.736815][ T4670] should_failslab+0x5/0x20 [ 90.741345][ T4670] slab_pre_alloc_hook+0x51/0xc0 [ 90.746413][ T4670] kmem_cache_alloc_trace+0x47/0x290 [ 90.751739][ T4670] ? sctp_transport_new+0x7c/0x5b0 [ 90.756878][ T4670] sctp_transport_new+0x7c/0x5b0 [ 90.761844][ T4670] sctp_assoc_add_peer+0x2ab/0x1680 [ 90.767078][ T4670] sctp_connect_new_asoc+0x31f/0x6a0 [ 90.772402][ T4670] ? __sctp_connect+0xd80/0xd80 [ 90.777282][ T4670] ? __local_bh_enable_ip+0x136/0x1c0 [ 90.782702][ T4670] ? bpf_lsm_sctp_bind_connect+0x5/0x10 [ 90.788268][ T4670] ? security_sctp_bind_connect+0x85/0xb0 [ 90.794016][ T4670] sctp_sendmsg+0x15e1/0x2940 [ 90.798736][ T4670] ? sctp_getsockopt+0x8a0/0x8a0 [ 90.803780][ T4670] ? aa_af_perm+0x340/0x340 [ 90.808307][ T4670] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 90.814753][ T4670] ? aa_sock_msg_perm+0x94/0x150 [ 90.819703][ T4670] ? sock_rps_record_flow+0x17/0x3b0 [ 90.824996][ T4670] ? inet_sendmsg+0xca/0x2a0 [ 90.829594][ T4670] __sys_sendto+0x46d/0x620 [ 90.834109][ T4670] ? __ia32_sys_getpeername+0x80/0x80 [ 90.839516][ T4670] ? lock_chain_count+0x20/0x20 [ 90.844383][ T4670] __x64_sys_sendto+0xda/0xf0 [ 90.849068][ T4670] do_syscall_64+0x4c/0xa0 [ 90.853509][ T4670] ? clear_bhb_loop+0x30/0x80 [ 90.858187][ T4670] ? clear_bhb_loop+0x30/0x80 [ 90.862876][ T4670] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 90.868770][ T4670] RIP: 0033:0x7fbb1b9ffb19 [ 90.873193][ T4670] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.892886][ T4670] RSP: 002b:00007fbb19c56028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 90.901317][ T4670] RAX: ffffffffffffffda RBX: 00007fbb1bc85fa0 RCX: 00007fbb1b9ffb19 [ 90.909291][ T4670] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 90.917273][ T4670] RBP: 00007fbb1ba97b70 R08: 0000200000000080 R09: 000000000000001c [ 90.925246][ T4670] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 90.933389][ T4670] R13: 00007fbb1bc86038 R14: 00007fbb1bc85fa0 R15: 00007ffeac0a4d28 [ 90.941379][ T4670] [ 91.065485][ T4677] device syzkaller0 entered promiscuous mode [ 91.179191][ T4690] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(0.0.0), cmd(5) [ 91.244706][ T4693] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 91.298216][ T4695] netlink: 28 bytes leftover after parsing attributes in process `syz.0.112'. [ 91.307539][ T4695] netlink: 28 bytes leftover after parsing attributes in process `syz.0.112'. [ 91.328392][ T4692] device syzkaller0 entered promiscuous mode [ 91.470873][ T4708] netlink: 'syz.1.116': attribute type 21 has an invalid length. [ 91.481498][ T4708] netlink: 128 bytes leftover after parsing attributes in process `syz.1.116'. [ 91.491217][ T4708] netlink: 'syz.1.116': attribute type 4 has an invalid length. [ 91.499254][ T4708] netlink: 'syz.1.116': attribute type 3 has an invalid length. [ 91.507346][ T4708] netlink: 3 bytes leftover after parsing attributes in process `syz.1.116'. [ 91.665939][ T4724] device syzkaller0 entered promiscuous mode [ 92.671944][ T4738] device syzkaller0 entered promiscuous mode [ 92.687500][ T4744] device syzkaller0 entered promiscuous mode [ 92.717627][ T4742] netlink: 28 bytes leftover after parsing attributes in process `syz.4.128'. [ 92.739727][ T4742] netlink: 28 bytes leftover after parsing attributes in process `syz.4.128'. [ 92.855210][ T4750] device syzkaller0 entered promiscuous mode [ 92.930455][ T4759] netlink: 'syz.4.134': attribute type 1 has an invalid length. [ 93.237508][ T4312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 93.624266][ T4312] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 94.198470][ T4312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.274967][ T4312] usb 2-1: config 0 descriptor?? [ 94.445340][ T4791] netlink: 28 bytes leftover after parsing attributes in process `syz.4.145'. [ 94.466472][ T4791] netlink: 28 bytes leftover after parsing attributes in process `syz.4.145'. [ 94.553218][ T4794] device syzkaller0 entered promiscuous mode [ 94.639767][ T4799] FAULT_INJECTION: forcing a failure. [ 94.639767][ T4799] name failslab, interval 1, probability 0, space 0, times 0 [ 94.652814][ T4799] CPU: 1 PID: 4799 Comm: syz.3.148 Not tainted syzkaller #0 [ 94.660109][ T4799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 94.670357][ T4799] Call Trace: [ 94.673648][ T4799] [ 94.676588][ T4799] dump_stack_lvl+0x188/0x250 [ 94.681270][ T4799] ? show_regs_print_info+0x20/0x20 [ 94.686487][ T4799] ? load_image+0x410/0x410 [ 94.691028][ T4799] should_fail+0x383/0x4b0 [ 94.695445][ T4799] should_failslab+0x5/0x20 [ 94.699947][ T4799] slab_pre_alloc_hook+0x51/0xc0 [ 94.704893][ T4799] ? xas_create+0x1047/0x15a0 [ 94.709580][ T4799] kmem_cache_alloc+0x3d/0x280 [ 94.714339][ T4799] ? xas_descend+0x210/0x3b0 [ 94.718924][ T4799] xas_create+0x1047/0x15a0 [ 94.723485][ T4799] xas_store+0x9f/0x1a00 [ 94.727837][ T4799] __xa_store+0xe6/0x210 [ 94.732079][ T4799] xa_store+0x2f/0x50 [ 94.736058][ T4799] __io_uring_add_tctx_node+0x1ce/0x500 [ 94.741618][ T4799] ? __io_cqring_overflow_flush+0xa30/0xa30 [ 94.747528][ T4799] ? _raw_spin_unlock+0x24/0x40 [ 94.752377][ T4799] ? alloc_fd+0x59e/0x650 [ 94.756733][ T4799] io_uring_install_fd+0xc0/0xf0 [ 94.761689][ T4799] __se_sys_io_uring_setup+0x2303/0x2900 [ 94.767351][ T4799] ? __x64_sys_io_uring_setup+0x60/0x60 [ 94.772909][ T4799] ? lockdep_hardirqs_on+0x94/0x140 [ 94.778237][ T4799] do_syscall_64+0x4c/0xa0 [ 94.782694][ T4799] ? clear_bhb_loop+0x30/0x80 [ 94.787476][ T4799] ? clear_bhb_loop+0x30/0x80 [ 94.792201][ T4799] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 94.798089][ T4799] RIP: 0033:0x7f7a6769bb19 [ 94.802518][ T4799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.822136][ T4799] RSP: 002b:00007f7a658f1fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 94.830560][ T4799] RAX: ffffffffffffffda RBX: 0000200000000080 RCX: 00007f7a6769bb19 [ 94.838540][ T4799] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000001593 [ 94.846505][ T4799] RBP: 00007f7a67733b70 R08: 0000000000000000 R09: 0000000000000000 [ 94.854468][ T4799] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 94.862438][ T4799] R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff26621998 [ 94.870410][ T4799] [ 94.905494][ T4312] [drm] Initialized udl 0.0.1 20120220 for 2-1:0.0 on minor 2 [ 95.025996][ T4312] [drm] Initialized udl on minor 2 [ 95.085002][ T4761] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 95.594574][ T4312] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 95.681089][ T4312] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 95.874081][ T4312] usb 2-1: USB disconnect, device number 2 [ 95.905574][ T23] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 95.967715][ T23] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 95.986783][ T23] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 96.222075][ T4827] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.231124][ T4827] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.240195][ T4827] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.249293][ T4827] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 96.333871][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #0a!!! [ 96.353874][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 96.363879][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.373871][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.383865][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.393870][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.403870][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.423875][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 96.647697][ T4834] netlink: 28 bytes leftover after parsing attributes in process `syz.0.160'. [ 96.664287][ T4834] netlink: 28 bytes leftover after parsing attributes in process `syz.0.160'. [ 96.718598][ T4837] device syzkaller0 entered promiscuous mode [ 96.973877][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #28a!!! [ 96.993870][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #28a!!! [ 97.278911][ T4851] process 'syz.3.166' launched './file0' with NULL argv: empty string added [ 100.165174][ T4869] mmap: syz.3.173 (4869) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 100.626560][ T4869] gadgetfs: bound to dummy_udc driver [ 100.701659][ T4881] netlink: 28 bytes leftover after parsing attributes in process `syz.2.176'. [ 100.711042][ T4881] netlink: 28 bytes leftover after parsing attributes in process `syz.2.176'. [ 100.817952][ T4881] device team0 entered promiscuous mode [ 100.831954][ T4881] device team_slave_0 entered promiscuous mode [ 100.862662][ T4881] device team_slave_1 entered promiscuous mode [ 100.953753][ T4881] device bond0 entered promiscuous mode [ 101.015797][ T4881] device bond_slave_0 entered promiscuous mode [ 101.024433][ T4881] device bond_slave_1 entered promiscuous mode [ 101.084931][ T4881] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 101.124032][ T4881] Cannot create hsr debugfs directory [ 101.162713][ T4881] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 101.209152][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 106.026572][ T4950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.192'. [ 106.193999][ T4950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.192'. [ 106.337589][ T4950] device bond0 entered promiscuous mode [ 106.344024][ T4950] device bond_slave_0 entered promiscuous mode [ 106.350492][ T4950] device bond_slave_1 entered promiscuous mode [ 106.541603][ T4950] device bond0 left promiscuous mode [ 106.548125][ T4950] device bond_slave_0 left promiscuous mode [ 106.578388][ T4950] device bond_slave_1 left promiscuous mode [ 106.715360][ T5001] device syzkaller0 entered promiscuous mode [ 111.175298][ T5046] netlink: 28 bytes leftover after parsing attributes in process `syz.2.207'. [ 111.234081][ T5046] netlink: 28 bytes leftover after parsing attributes in process `syz.2.207'. [ 111.715529][ T5058] device syzkaller0 entered promiscuous mode [ 111.970570][ T5068] device syzkaller0 entered promiscuous mode [ 112.940821][ T5076] device syzkaller0 entered promiscuous mode [ 115.083757][ T5090] netlink: 8 bytes leftover after parsing attributes in process `syz.3.222'. [ 115.398721][ T5095] netlink: 28 bytes leftover after parsing attributes in process `syz.1.224'. [ 115.436431][ T5095] netlink: 28 bytes leftover after parsing attributes in process `syz.1.224'. [ 115.479595][ T5095] device bond0 entered promiscuous mode [ 115.489819][ T5095] device bond_slave_0 entered promiscuous mode [ 115.519671][ T5095] device bond_slave_1 entered promiscuous mode [ 115.558135][ T5095] device bond0 left promiscuous mode [ 115.563538][ T5095] device bond_slave_0 left promiscuous mode [ 116.454057][ T5095] device bond_slave_1 left promiscuous mode [ 116.549665][ T5109] netlink: 12 bytes leftover after parsing attributes in process `syz.0.229'. [ 116.740784][ T5115] device syzkaller0 entered promiscuous mode [ 117.213864][ T5117] input: syz1 as /devices/virtual/input/input5 [ 118.132660][ T5122] device syzkaller0 entered promiscuous mode [ 118.332913][ T5128] netlink: 12 bytes leftover after parsing attributes in process `syz.4.235'. [ 118.380547][ T5131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.237'. [ 118.607812][ T5142] netlink: 28 bytes leftover after parsing attributes in process `syz.0.241'. [ 118.676252][ T5142] netlink: 28 bytes leftover after parsing attributes in process `syz.0.241'. [ 118.921951][ T5144] device syzkaller0 entered promiscuous mode [ 120.328218][ T5156] device syzkaller0 entered promiscuous mode [ 120.594531][ T5164] device syzkaller0 entered promiscuous mode [ 120.675653][ T5165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.250'. [ 122.943608][ T5181] netlink: 28 bytes leftover after parsing attributes in process `syz.4.256'. [ 122.983406][ T5181] netlink: 28 bytes leftover after parsing attributes in process `syz.4.256'. [ 124.454288][ T5186] device syzkaller0 entered promiscuous mode [ 124.815335][ T5195] device syzkaller0 entered promiscuous mode [ 125.322258][ T5204] netlink: 8 bytes leftover after parsing attributes in process `syz.3.264'. [ 125.593238][ T5210] device syzkaller0 entered promiscuous mode [ 126.220003][ T5218] fuse: Bad value for 'fd' [ 126.674478][ T5224] netlink: 36 bytes leftover after parsing attributes in process `syz.4.267'. [ 126.908552][ T5234] device syzkaller0 entered promiscuous mode [ 126.914162][ T23] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 127.088379][ T5245] netlink: 28 bytes leftover after parsing attributes in process `syz.3.274'. [ 127.104086][ T5245] netlink: 28 bytes leftover after parsing attributes in process `syz.3.274'. [ 127.114029][ T23] usb 1-1: device descriptor read/64, error -71 [ 127.144114][ T5245] device bond0 entered promiscuous mode [ 127.161326][ T5245] device bond_slave_0 entered promiscuous mode [ 127.171350][ T5245] device bond_slave_1 entered promiscuous mode [ 127.188819][ T5245] device bond0 left promiscuous mode [ 127.202041][ T5249] capability: warning: `syz.4.275' uses deprecated v2 capabilities in a way that may be insecure [ 127.216422][ T5245] device bond_slave_0 left promiscuous mode [ 127.233247][ T5245] device bond_slave_1 left promiscuous mode [ 127.393987][ T23] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 127.668580][ T4278] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 127.944010][ T23] usb 1-1: device descriptor read/64, error -71 [ 128.009353][ T5260] device syzkaller0 entered promiscuous mode [ 128.084327][ T5264] device syzkaller0 entered promiscuous mode [ 128.091469][ T5266] ip_tables: iptables: counters copy to user failed while replacing table [ 128.101959][ T23] usb usb1-port1: attempt power cycle [ 128.233080][ T5271] netlink: 36 bytes leftover after parsing attributes in process `syz.3.284'. [ 128.241861][ T5272] FAULT_INJECTION: forcing a failure. [ 128.241861][ T5272] name failslab, interval 1, probability 0, space 0, times 0 [ 128.267303][ T5272] CPU: 0 PID: 5272 Comm: syz.4.282 Not tainted syzkaller #0 [ 128.274644][ T5272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 128.284728][ T5272] Call Trace: [ 128.288034][ T5272] [ 128.290994][ T5272] dump_stack_lvl+0x188/0x250 [ 128.295707][ T5272] ? show_regs_print_info+0x20/0x20 [ 128.300926][ T5272] ? load_image+0x410/0x410 [ 128.305449][ T5272] ? __lock_acquire+0x7d40/0x7d40 [ 128.310467][ T5272] ? kfree+0xef/0x2a0 [ 128.314442][ T5272] should_fail+0x383/0x4b0 [ 128.318853][ T5272] should_failslab+0x5/0x20 [ 128.323347][ T5272] slab_pre_alloc_hook+0x51/0xc0 [ 128.328388][ T5272] __kmalloc+0x6b/0x340 [ 128.332538][ T5272] ? video_usercopy+0x1a9/0xf10 [ 128.337383][ T5272] video_usercopy+0x1a9/0xf10 [ 128.342068][ T5272] ? video_ioctl2+0x30/0x30 [ 128.346578][ T5272] ? v4l_printk_ioctl+0x130/0x130 [ 128.351607][ T5272] v4l2_ioctl+0x183/0x1d0 [ 128.355929][ T5272] ? v4l2_poll+0x2b0/0x2b0 [ 128.360336][ T5272] __se_sys_ioctl+0xfa/0x170 [ 128.364921][ T5272] do_syscall_64+0x4c/0xa0 [ 128.369327][ T5272] ? clear_bhb_loop+0x30/0x80 [ 128.373996][ T5272] ? clear_bhb_loop+0x30/0x80 [ 128.378673][ T5272] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 128.384561][ T5272] RIP: 0033:0x7fe5aa2f7b19 [ 128.388974][ T5272] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.408581][ T5272] RSP: 002b:00007fe5a854e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 128.416992][ T5272] RAX: ffffffffffffffda RBX: 00007fe5aa57dfa0 RCX: 00007fe5aa2f7b19 [ 128.424956][ T5272] RDX: 0000200000000040 RSI: 00000000c0d05640 RDI: 0000000000000004 [ 128.432932][ T5272] RBP: 00007fe5aa38fb70 R08: 0000000000000000 R09: 0000000000000000 [ 128.440913][ T5272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.448880][ T5272] R13: 00007fe5aa57e038 R14: 00007fe5aa57dfa0 R15: 00007fff5281b0c8 [ 128.456861][ T5272] [ 128.474350][ T5274] device syzkaller0 entered promiscuous mode [ 128.524114][ T23] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 128.524136][ T4278] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 128.545685][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 128.580921][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 128.613361][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 128.624128][ T23] usb 1-1: device descriptor read/8, error -71 [ 128.625122][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 128.647530][ T5280] netlink: 28 bytes leftover after parsing attributes in process `syz.1.288'. [ 128.674113][ T5280] netlink: 28 bytes leftover after parsing attributes in process `syz.1.288'. [ 128.743955][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 128.893984][ T23] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 129.497362][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 129.507480][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 129.519379][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 129.528038][ T5280] device bond0 entered promiscuous mode [ 129.529367][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 129.544645][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 129.554651][ T4278] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 129.560952][ T5280] device bond_slave_0 entered promiscuous mode [ 129.565883][ T4278] usb 3-1: config 1 interface 0 altsetting 0 has 11 endpoint descriptors, different from the interface descriptor's value: 14 [ 129.573953][ T23] usb 1-1: device descriptor read/8, error -71 [ 129.631352][ T5280] device bond_slave_1 entered promiscuous mode [ 129.684471][ T5280] device bond0 left promiscuous mode [ 129.765095][ T23] usb usb1-port1: unable to enumerate USB device [ 129.793965][ T5280] device bond_slave_0 left promiscuous mode [ 129.801206][ T5280] device bond_slave_1 left promiscuous mode [ 131.354588][ T4278] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 131.665996][ T4278] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.706608][ T4278] usb 3-1: Product: syz [ 131.723947][ T4278] usb 3-1: Manufacturer: syz [ 131.728596][ T4278] usb 3-1: SerialNumber: syz [ 131.843633][ T4278] usb 3-1: can't set config #1, error -71 [ 131.853777][ T4278] usb 3-1: USB disconnect, device number 2 [ 132.196689][ T5316] FAULT_INJECTION: forcing a failure. [ 132.196689][ T5316] name failslab, interval 1, probability 0, space 0, times 0 [ 132.214103][ T5316] CPU: 1 PID: 5316 Comm: syz.0.297 Not tainted syzkaller #0 [ 132.221482][ T5316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 132.231574][ T5316] Call Trace: [ 132.234876][ T5316] [ 132.237875][ T5316] dump_stack_lvl+0x188/0x250 [ 132.242683][ T5316] ? show_regs_print_info+0x20/0x20 [ 132.247897][ T5316] ? load_image+0x410/0x410 [ 132.252414][ T5316] ? __might_sleep+0xf0/0xf0 [ 132.257069][ T5316] ? __lock_acquire+0x7d40/0x7d40 [ 132.262298][ T5316] should_fail+0x383/0x4b0 [ 132.266743][ T5316] should_failslab+0x5/0x20 [ 132.271266][ T5316] slab_pre_alloc_hook+0x51/0xc0 [ 132.276226][ T5316] ? v9fs_session_init+0xf7/0x1770 [ 132.281381][ T5316] __kmalloc_track_caller+0x69/0x330 [ 132.286693][ T5316] ? v9fs_session_init+0xf7/0x1770 [ 132.291916][ T5316] kstrdup+0x32/0x70 [ 132.295809][ T5316] v9fs_session_init+0xf7/0x1770 [ 132.300766][ T5316] ? v9fs_show_options+0x610/0x610 [ 132.305919][ T5316] v9fs_mount+0x72/0x850 [ 132.310311][ T5316] legacy_get_tree+0xe6/0x180 [ 132.315000][ T5316] ? trace_xrep_findroot_block+0x1f0/0x1f0 [ 132.320833][ T5316] vfs_get_tree+0x88/0x270 [ 132.325277][ T5316] do_new_mount+0x247/0xa50 [ 132.329827][ T5316] __se_sys_mount+0x2e3/0x3d0 [ 132.334540][ T5316] ? __x64_sys_mount+0xc0/0xc0 [ 132.339322][ T5316] ? lockdep_hardirqs_on+0x94/0x140 [ 132.344521][ T5316] ? __x64_sys_mount+0x1c/0xc0 [ 132.349547][ T5316] do_syscall_64+0x4c/0xa0 [ 132.353967][ T5316] ? clear_bhb_loop+0x30/0x80 [ 132.358640][ T5316] ? clear_bhb_loop+0x30/0x80 [ 132.363319][ T5316] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 132.369223][ T5316] RIP: 0033:0x7f4541b3cb19 [ 132.373646][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.393377][ T5316] RSP: 002b:00007f453fd93028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 132.401813][ T5316] RAX: ffffffffffffffda RBX: 00007f4541dc2fa0 RCX: 00007f4541b3cb19 [ 132.409814][ T5316] RDX: 0000200000000540 RSI: 0000200000000500 RDI: 0000000000000000 [ 132.417796][ T5316] RBP: 00007f4541bd4b70 R08: 0000000000000000 R09: 0000000000000000 [ 132.425790][ T5316] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000000 [ 132.433928][ T5316] R13: 00007f4541dc3038 R14: 00007f4541dc2fa0 R15: 00007fff05901ff8 [ 132.442052][ T5316] [ 132.487159][ T5321] netlink: 36 bytes leftover after parsing attributes in process `syz.3.298'. [ 132.637263][ T5329] device syzkaller0 entered promiscuous mode [ 133.541753][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.548207][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.648554][ T5346] netlink: 28 bytes leftover after parsing attributes in process `syz.4.306'. [ 134.444204][ T5346] netlink: 28 bytes leftover after parsing attributes in process `syz.4.306'. [ 134.498877][ T5357] netlink: 36 bytes leftover after parsing attributes in process `syz.0.310'. [ 134.582423][ T5359] device syzkaller0 entered promiscuous mode [ 134.609940][ T5361] device syzkaller0 entered promiscuous mode [ 134.627139][ T5365] netlink: 'syz.2.315': attribute type 1 has an invalid length. [ 134.904831][ T5378] device syzkaller0 entered promiscuous mode [ 136.709732][ T5394] netlink: 36 bytes leftover after parsing attributes in process `syz.3.325'. [ 136.762854][ T5397] device syzkaller0 entered promiscuous mode [ 138.795889][ T5418] device syzkaller0 entered promiscuous mode [ 138.851229][ T5420] jffs2: notice: (5420) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 138.887458][ T5422] netlink: 28 bytes leftover after parsing attributes in process `syz.1.327'. [ 139.785696][ T5422] netlink: 28 bytes leftover after parsing attributes in process `syz.1.327'. [ 139.808305][ T5422] device bond0 entered promiscuous mode [ 139.823947][ T5422] device bond_slave_0 entered promiscuous mode [ 139.838031][ T5422] device bond_slave_1 entered promiscuous mode [ 139.875411][ T5422] device bond0 left promiscuous mode [ 139.881009][ T5422] device bond_slave_0 left promiscuous mode [ 139.914821][ T5422] device bond_slave_1 left promiscuous mode [ 140.034715][ T5430] netlink: 36 bytes leftover after parsing attributes in process `syz.3.339'. [ 140.256003][ T5438] device syzkaller0 entered promiscuous mode [ 140.332254][ T4197] Bluetooth: Unexpected continuation frame (len 64) [ 140.418439][ T5444] netlink: 76 bytes leftover after parsing attributes in process `syz.3.345'. [ 140.732421][ T5449] syz.1.347 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 140.759799][ T5449] CPU: 1 PID: 5449 Comm: syz.1.347 Not tainted syzkaller #0 [ 140.767160][ T5449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 140.777340][ T5449] Call Trace: [ 140.780662][ T5449] [ 140.783602][ T5449] dump_stack_lvl+0x188/0x250 [ 140.788280][ T5449] ? show_regs_print_info+0x20/0x20 [ 140.793488][ T5449] ? load_image+0x410/0x410 [ 140.797990][ T5449] ? local_lock_release+0x170/0x170 [ 140.803277][ T5449] ? __rwlock_init+0x140/0x140 [ 140.808075][ T5449] dump_header+0xd9/0x780 [ 140.812426][ T5449] oom_kill_process+0x20e/0x3d0 [ 140.817286][ T5449] out_of_memory+0xdb2/0x1190 [ 140.822040][ T5449] ? mem_cgroup_out_of_memory+0xbd/0x3b0 [ 140.827791][ T5449] ? mutex_lock_io_nested+0x60/0x60 [ 140.832986][ T5449] ? unregister_oom_notifier+0x20/0x20 [ 140.838558][ T5449] mem_cgroup_out_of_memory+0x2b9/0x3b0 [ 140.844109][ T5449] ? mem_cgroup_oom_trylock+0x210/0x210 [ 140.849655][ T5449] ? do_raw_spin_unlock+0x11d/0x230 [ 140.854850][ T5449] try_charge_memcg+0x1075/0x15b0 [ 140.860000][ T5449] ? get_mem_cgroup_from_objcg+0x120/0x120 [ 140.865957][ T5449] ? rcu_lock_acquire+0x30/0x30 [ 140.870853][ T5449] charge_memcg+0x100/0x300 [ 140.875355][ T5449] ? __mem_cgroup_charge+0x80/0x80 [ 140.880506][ T5449] __mem_cgroup_charge+0x21/0x80 [ 140.885450][ T5449] shmem_add_to_page_cache+0xa8a/0x14d0 [ 140.891006][ T5449] ? put_page+0x200/0x200 [ 140.895356][ T5449] ? mark_lock+0x94/0x320 [ 140.899681][ T5449] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 140.905665][ T5449] ? lock_chain_count+0x20/0x20 [ 140.910543][ T5449] ? do_user_addr_fault+0x69f/0xc90 [ 140.915773][ T5449] shmem_getpage_gfp+0x1735/0x2c10 [ 140.920929][ T5449] shmem_write_begin+0xcd/0x1a0 [ 140.925789][ T5449] generic_perform_write+0x2b6/0x550 [ 140.931101][ T5449] ? grab_cache_page_write_begin+0xa0/0xa0 [ 140.936939][ T5449] ? file_remove_privs+0x5d0/0x5d0 [ 140.942081][ T5449] ? rwsem_write_trylock+0x135/0x1c0 [ 140.947378][ T5449] ? clear_nonspinnable+0x60/0x60 [ 140.952564][ T5449] __generic_file_write_iter+0x261/0x4e0 [ 140.958305][ T5449] ? generic_write_checks+0x39c/0x460 [ 140.963685][ T5449] generic_file_write_iter+0xa6/0x1b0 [ 140.969079][ T5449] vfs_write+0x748/0xd70 [ 140.973330][ T5449] ? file_end_write+0x250/0x250 [ 140.978190][ T5449] ? mutex_lock_nested+0x17/0x20 [ 140.983121][ T5449] ? __fdget_pos+0x2bf/0x370 [ 140.987710][ T5449] ? ksys_write+0x70/0x260 [ 140.992147][ T5449] ksys_write+0x153/0x260 [ 140.996472][ T5449] ? __ia32_sys_read+0x80/0x80 [ 141.001232][ T5449] ? lockdep_hardirqs_on+0x94/0x140 [ 141.006426][ T5449] do_syscall_64+0x4c/0xa0 [ 141.011032][ T5449] ? clear_bhb_loop+0x30/0x80 [ 141.015724][ T5449] ? clear_bhb_loop+0x30/0x80 [ 141.020394][ T5449] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 141.026278][ T5449] RIP: 0033:0x7fa970868b19 [ 141.030685][ T5449] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.050461][ T5449] RSP: 002b:00007fa96eabf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 141.058870][ T5449] RAX: ffffffffffffffda RBX: 00007fa970aeefa0 RCX: 00007fa970868b19 [ 141.066835][ T5449] RDX: 00000000fffffdab RSI: 0000200000000000 RDI: 0000000000000003 [ 141.074814][ T5449] RBP: 00007fa970900b70 R08: 0000000000000000 R09: 0000000000000000 [ 141.082774][ T5449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.090751][ T5449] R13: 00007fa970aef038 R14: 00007fa970aeefa0 R15: 00007ffc8e0ca218 [ 141.098734][ T5449] [ 141.410114][ T5467] device syzkaller0 entered promiscuous mode [ 141.493542][ T5449] memory: usage 0kB, limit 0kB, failcnt 19 [ 141.499507][ T5449] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.507069][ T5449] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 141.517568][ T5449] Memory cgroup stats for /syz1/test: [ 141.518413][ T5449] anon 0 [ 141.518413][ T5449] file 0 [ 141.518413][ T5449] kernel_stack 0 [ 141.518413][ T5449] pagetables 0 [ 141.518413][ T5449] percpu 0 [ 141.518413][ T5449] sock 0 [ 141.518413][ T5449] shmem 0 [ 141.518413][ T5449] file_mapped 0 [ 141.518413][ T5449] file_dirty 0 [ 141.518413][ T5449] file_writeback 0 [ 141.518413][ T5449] swapcached 0 [ 141.518413][ T5449] anon_thp 0 [ 141.518413][ T5449] file_thp 0 [ 141.518413][ T5449] shmem_thp 0 [ 141.518413][ T5449] inactive_anon 0 [ 141.518413][ T5449] active_anon 0 [ 141.518413][ T5449] inactive_file 0 [ 141.518413][ T5449] active_file 0 [ 141.518413][ T5449] unevictable 0 [ 141.518413][ T5449] slab_reclaimable 0 [ 141.518413][ T5449] slab_unreclaimable 0 [ 141.518413][ T5449] slab 0 [ 141.518413][ T5449] workingset_refault_anon 0 [ 141.518413][ T5449] workingset_refault_file 0 [ 141.518413][ T5449] workingset_activate_anon 0 [ 141.518413][ T5449] workingset_activate_file 0 [ 141.658052][ T5449] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.347,pid=5448,uid=0 [ 141.704140][ T5449] Memory cgroup out of memory: Killed process 5449 (syz.1.347) total-vm:102540kB, anon-rss:1456kB, file-rss:22516kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 141.829134][ T5475] netlink: 28 bytes leftover after parsing attributes in process `syz.3.352'. [ 141.888867][ T5475] netlink: 28 bytes leftover after parsing attributes in process `syz.3.352'. [ 142.004285][ T5475] device bond0 entered promiscuous mode [ 142.022658][ T5475] device bond_slave_0 entered promiscuous mode [ 142.055002][ T5475] device bond_slave_1 entered promiscuous mode [ 142.086826][ T5475] device bond0 left promiscuous mode [ 142.124024][ T5475] device bond_slave_0 left promiscuous mode [ 142.164168][ T5475] device bond_slave_1 left promiscuous mode [ 142.193957][ T4283] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 142.253050][ T5484] netlink: 20 bytes leftover after parsing attributes in process `syz.1.355'. [ 142.419789][ T5492] device syzkaller0 entered promiscuous mode [ 142.444000][ T4283] usb 3-1: Using ep0 maxpacket: 32 [ 143.944165][ T4283] usb 3-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 143.966256][ T4283] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.015901][ T5505] device syzkaller0 entered promiscuous mode [ 144.028995][ T4283] usb 3-1: Product: syz [ 144.033198][ T4283] usb 3-1: Manufacturer: syz [ 144.038363][ T4283] usb 3-1: SerialNumber: syz [ 144.059664][ T4283] usb 3-1: config 0 descriptor?? [ 144.125991][ T4283] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 144.173970][ T4283] dvb-usb: bulk message failed: -22 (4/0) [ 144.181041][ T4283] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 144.213976][ T4283] dvb-usb: bulk message failed: -22 (5/0) [ 144.241863][ T4283] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 144.291119][ T4283] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 144.328943][ T5482] dvb-usb: bulk message failed: -22 (7/0) [ 144.336171][ T4283] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 144.357291][ T5482] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 144.370429][ T4283] usb 3-1: media controller created [ 144.420732][ T5482] ttusb2: i2c transfer failed. [ 144.468257][ T4283] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 144.590894][ T4283] usb 3-1: selecting invalid altsetting 3 [ 144.593106][ T5513] jffs2: notice: (5513) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 144.625655][ T4283] ttusb2: set interface to alts=3 failed [ 144.799479][ T4283] DVB: Unable to find symbol tda10086_attach() [ 144.809101][ T4283] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 144.874003][ T4283] dvb-usb: bulk message failed: -22 (4/0) [ 144.879759][ T4283] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 144.934223][ T4283] dvb-usb: bulk message failed: -22 (5/0) [ 144.940090][ T4283] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 144.974193][ T4283] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 145.031821][ T4283] usb 3-1: USB disconnect, device number 3 [ 145.148623][ T4283] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 145.212087][ T5523] netlink: 20 bytes leftover after parsing attributes in process `syz.4.370'. [ 145.303258][ T5523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.315539][ T5525] netlink: 28 bytes leftover after parsing attributes in process `syz.2.371'. [ 145.369815][ T5525] netlink: 28 bytes leftover after parsing attributes in process `syz.2.371'. [ 145.406380][ T5527] device syzkaller0 entered promiscuous mode [ 146.826040][ T5534] device syzkaller0 entered promiscuous mode [ 146.919864][ T5540] netlink: set zone limit has 8 unknown bytes [ 146.942147][ T5543] device syzkaller0 entered promiscuous mode [ 148.061812][ T5554] netlink: 20 bytes leftover after parsing attributes in process `syz.4.383'. [ 149.493560][ T5562] device syzkaller0 entered promiscuous mode [ 150.126361][ T5572] device syzkaller0 entered promiscuous mode [ 150.359120][ T5582] device syzkaller0 entered promiscuous mode [ 150.681590][ T5594] netlink: 20 bytes leftover after parsing attributes in process `syz.4.397'. [ 150.827169][ T5602] device syzkaller0 entered promiscuous mode [ 153.957296][ T5629] netlink: 28 bytes leftover after parsing attributes in process `syz.3.385'. [ 154.023769][ T5637] syz.0.408 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 154.053024][ T5629] netlink: 28 bytes leftover after parsing attributes in process `syz.3.385'. [ 154.473244][ T5629] device bond0 entered promiscuous mode [ 154.551245][ T5629] device bond_slave_0 entered promiscuous mode [ 154.643665][ T5629] device bond_slave_1 entered promiscuous mode [ 154.853507][ T5629] device bond0 left promiscuous mode [ 154.859342][ T5629] device bond_slave_0 left promiscuous mode [ 154.865462][ T5629] device bond_slave_1 left promiscuous mode [ 154.922074][ T5639] device syzkaller0 entered promiscuous mode [ 157.728992][ T5659] device syzkaller0 entered promiscuous mode [ 158.353008][ T5667] netlink: 36 bytes leftover after parsing attributes in process `syz.3.421'. [ 158.607772][ T5672] device syzkaller0 entered promiscuous mode [ 158.650906][ T5674] pi3usb30532 0-0005: Error reading config register -5 [ 158.664746][ T5674] pi3usb30532: probe of 0-0005 failed with error -5 [ 158.679364][ T5674] i2c i2c-0: new_device: Instantiated device pi3usb30532 at 0x05 [ 159.358996][ T5681] overlayfs: invalid redirect (./file2) [ 159.409550][ T5686] netlink: 20 bytes leftover after parsing attributes in process `syz.2.414'. [ 159.557933][ T5691] device syzkaller0 entered promiscuous mode [ 159.644563][ T5694] kernel read not supported for file /!selinuxw (pid: 5694 comm: syz.0.418) [ 159.665634][ T5692] device syzkaller0 entered promiscuous mode [ 160.073346][ T5709] device syzkaller0 entered promiscuous mode [ 160.962194][ T5723] netlink: 28 bytes leftover after parsing attributes in process `syz.1.428'. [ 160.974547][ T5723] netlink: 28 bytes leftover after parsing attributes in process `syz.1.428'. [ 161.897059][ T5723] device bond0 entered promiscuous mode [ 161.903966][ T5723] device bond_slave_0 entered promiscuous mode [ 161.910306][ T5723] device bond_slave_1 entered promiscuous mode [ 162.983740][ T5723] device bond0 left promiscuous mode [ 162.994086][ T5723] device bond_slave_0 left promiscuous mode [ 163.005204][ T5723] device bond_slave_1 left promiscuous mode [ 163.044045][ T5731] netlink: 20 bytes leftover after parsing attributes in process `syz.4.442'. [ 163.072600][ T5733] device syzkaller0 entered promiscuous mode [ 164.245686][ T5755] device syzkaller0 entered promiscuous mode [ 164.368932][ T4278] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 164.513748][ T26] audit: type=1326 audit(1794154567.747:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5759 comm="syz.4.453" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5aa2f7b19 code=0x7fc00000 [ 164.591750][ T26] audit: type=1326 audit(1794154567.777:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5759 comm="syz.4.453" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fe5aa2f1897 code=0x7fc00000 [ 164.777579][ T26] audit: type=1326 audit(1794154567.777:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5759 comm="syz.4.453" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fe5aa298e99 code=0x7fc00000 [ 164.807104][ T4278] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 164.818532][ T4278] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 164.828539][ T4278] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 164.842272][ T4278] usb 1-1: New USB device found, idVendor=046d, idProduct=c704, bcdDevice= 0.00 [ 164.911250][ T4278] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.931668][ T4278] usb 1-1: config 0 descriptor?? [ 164.937695][ T26] audit: type=1326 audit(1794154567.777:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5759 comm="syz.4.453" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7fe5aa298f5d code=0x7fc00000 [ 164.963263][ T26] audit: type=1326 audit(1794154567.777:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5759 comm="syz.4.453" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fe5aa2f7b19 code=0x7fc00000 [ 165.165782][ T5781] netlink: 28 bytes leftover after parsing attributes in process `syz.2.458'. [ 165.192167][ T5746] use of bytesused == 0 is deprecated and will be removed in the future, [ 165.214417][ T5781] netlink: 28 bytes leftover after parsing attributes in process `syz.2.458'. [ 165.223743][ T5746] use the actual size instead. [ 165.297318][ T5785] device syzkaller0 entered promiscuous mode [ 165.327956][ T5789] device syzkaller0 entered promiscuous mode [ 165.334276][ T4278] usbhid 1-1:0.0: can't add hid device: -71 [ 165.340363][ T4278] usbhid: probe of 1-1:0.0 failed with error -71 [ 165.376251][ T4278] usb 1-1: USB disconnect, device number 7 [ 166.930706][ T26] audit: type=1800 audit(1794154570.167:8): pid=5807 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.466" name=08 dev="sda1" ino=2047 res=0 errno=0 [ 167.201586][ T5810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 167.329830][ T5821] netlink: 28 bytes leftover after parsing attributes in process `syz.3.474'. [ 167.349243][ T5821] netlink: 28 bytes leftover after parsing attributes in process `syz.3.474'. [ 167.368551][ T5821] device bond0 entered promiscuous mode [ 167.374791][ T5821] device bond_slave_0 entered promiscuous mode [ 167.381278][ T5821] device bond_slave_1 entered promiscuous mode [ 167.391514][ T5821] device bond0 left promiscuous mode [ 167.400019][ T5821] device bond_slave_0 left promiscuous mode [ 167.408152][ T5821] device bond_slave_1 left promiscuous mode [ 167.450490][ T5823] device syzkaller0 entered promiscuous mode [ 169.204969][ T5883] device syzkaller0 entered promiscuous mode [ 169.832298][ T26] audit: type=1800 audit(1794154573.067:9): pid=5894 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.482" name=08 dev="sda1" ino=2047 res=0 errno=0 [ 169.896487][ T5896] FAULT_INJECTION: forcing a failure. [ 169.896487][ T5896] name failslab, interval 1, probability 0, space 0, times 0 [ 169.941122][ T5896] CPU: 1 PID: 5896 Comm: syz.1.468 Not tainted syzkaller #0 [ 169.948477][ T5896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 169.958555][ T5896] Call Trace: [ 169.961858][ T5896] [ 169.964855][ T5896] dump_stack_lvl+0x188/0x250 [ 169.969566][ T5896] ? show_regs_print_info+0x20/0x20 [ 169.974802][ T5896] ? load_image+0x410/0x410 [ 169.979338][ T5896] ? __lock_acquire+0x7d40/0x7d40 [ 169.984396][ T5896] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 169.990316][ T5896] should_fail+0x383/0x4b0 [ 169.994759][ T5896] should_failslab+0x5/0x20 [ 169.999292][ T5896] slab_pre_alloc_hook+0x51/0xc0 [ 170.004354][ T5896] kmem_cache_alloc_trace+0x47/0x290 [ 170.009661][ T5896] ? snd_seq_oss_midi_check_new_port+0x141/0x620 [ 170.016015][ T5896] snd_seq_oss_midi_check_new_port+0x141/0x620 [ 170.022198][ T5896] receive_announce+0x281/0x370 [ 170.027178][ T5896] ? info_read+0x80/0x80 [ 170.031485][ T5896] ? do_raw_read_unlock+0x39/0x70 [ 170.036620][ T5896] ? _raw_read_unlock+0x24/0x40 [ 170.041495][ T5896] ? snd_seq_port_use_ptr+0xfd/0x120 [ 170.046802][ T5896] ? info_read+0x80/0x80 [ 170.051075][ T5896] snd_seq_deliver_single_event+0x806/0xb30 [ 170.057008][ T5896] ? read_lock_is_recursive+0x10/0x10 [ 170.062405][ T5896] ? lock_chain_count+0x20/0x20 [ 170.067282][ T5896] ? snd_sequencer_device_done+0x20/0x20 [ 170.073034][ T5896] ? down_read_nested+0x1ac/0x2e0 [ 170.078180][ T5896] snd_seq_deliver_event+0x49d/0x8d0 [ 170.083947][ T5896] snd_seq_kernel_client_dispatch+0x1fc/0x2f0 [ 170.090042][ T5896] snd_seq_system_broadcast+0xf1/0x150 [ 170.095529][ T5896] ? snd_seq_info_timer_read+0x310/0x310 [ 170.101196][ T5896] ? snd_seq_create_port+0x4fe/0x6a0 [ 170.107209][ T5896] snd_seq_ioctl_create_port+0x4f9/0x640 [ 170.112990][ T5896] snd_seq_ioctl+0x265/0x3e0 [ 170.117615][ T5896] ? snd_seq_poll+0x230/0x230 [ 170.122344][ T5896] ? bpf_lsm_file_ioctl+0x5/0x10 [ 170.127307][ T5896] ? security_file_ioctl+0x7c/0xa0 [ 170.132442][ T5896] ? snd_seq_poll+0x230/0x230 [ 170.137140][ T5896] __se_sys_ioctl+0xfa/0x170 [ 170.141765][ T5896] do_syscall_64+0x4c/0xa0 [ 170.146199][ T5896] ? clear_bhb_loop+0x30/0x80 [ 170.150897][ T5896] ? clear_bhb_loop+0x30/0x80 [ 170.155599][ T5896] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 170.161510][ T5896] RIP: 0033:0x7fa970868b19 [ 170.165949][ T5896] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.185679][ T5896] RSP: 002b:00007fa96eabf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 170.194127][ T5896] RAX: ffffffffffffffda RBX: 00007fa970aeefa0 RCX: 00007fa970868b19 [ 170.202139][ T5896] RDX: 0000200000000300 RSI: 00000000c0a85320 RDI: 0000000000000004 [ 170.210141][ T5896] RBP: 00007fa970900b70 R08: 0000000000000000 R09: 0000000000000000 [ 170.218225][ T5896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.226216][ T5896] R13: 00007fa970aef038 R14: 00007fa970aeefa0 R15: 00007ffc8e0ca218 [ 170.234222][ T5896] [ 170.434795][ T5905] rxe_eth0 speed is unknown, defaulting to 1000 [ 170.451502][ T5903] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(1) [ 170.612330][ T5912] netlink: 28 bytes leftover after parsing attributes in process `syz.4.488'. [ 170.644061][ T5912] netlink: 28 bytes leftover after parsing attributes in process `syz.4.488'. [ 170.720987][ T5914] device syzkaller0 entered promiscuous mode [ 171.382677][ T5927] device syzkaller0 entered promiscuous mode [ 171.483636][ T5933] netlink: 16 bytes leftover after parsing attributes in process `syz.2.495'. [ 171.644480][ T4278] asus 0005:0B05:8502.0001: No inputs registered, leaving [ 171.665596][ T4278] asus 0005:0B05:8502.0001: hidraw0: BLUETOOTH HID v0.00 Mouse [syz0] on syz0 [ 173.004508][ T5950] netlink: 32 bytes leftover after parsing attributes in process `syz.4.501'. [ 173.118861][ T5951] fido_id[5951]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 173.234627][ T26] audit: type=1800 audit(1794154576.447:10): pid=5958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.503" name=08 dev="sda1" ino=2047 res=0 errno=0 [ 173.345815][ T5961] device syzkaller0 entered promiscuous mode [ 173.484666][ T5964] netlink: 16 bytes leftover after parsing attributes in process `syz.3.507'. [ 173.526576][ T5964] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.774775][ T5971] device syzkaller0 entered promiscuous mode [ 174.278693][ T5975] netlink: 16 bytes leftover after parsing attributes in process `syz.1.511'. [ 176.730894][ T5985] netlink: 28 bytes leftover after parsing attributes in process `syz.0.502'. [ 177.475969][ T5985] netlink: 28 bytes leftover after parsing attributes in process `syz.0.502'. [ 177.924814][ T5998] device syzkaller0 entered promiscuous mode [ 179.150699][ T6008] device syzkaller0 entered promiscuous mode [ 180.557617][ T26] audit: type=1800 audit(1794154583.767:11): pid=6020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.512" name=08 dev="sda1" ino=2047 res=0 errno=0 [ 180.644264][ T4426] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 181.024055][ T4426] usb 5-1: Using ep0 maxpacket: 16 [ 181.144201][ T4426] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 181.289330][ T6033] device syzkaller0 entered promiscuous mode [ 181.493990][ T4426] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 181.503214][ T4426] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.305493][ T4426] usb 5-1: Product: syz [ 182.310741][ T4426] usb 5-1: Manufacturer: syz [ 182.315990][ T4426] usb 5-1: SerialNumber: syz [ 182.324230][ T4426] usb 5-1: config 0 descriptor?? [ 182.353995][ T4426] usb 5-1: can't set config #0, error -71 [ 182.374859][ T6051] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 182.409561][ T4426] usb 5-1: USB disconnect, device number 3 [ 182.700823][ T6052] device syzkaller0 entered promiscuous mode [ 183.361929][ T6051] crypto_alloc_aead failed rc=-4 [ 183.661710][ T6087] device syzkaller0 entered promiscuous mode [ 183.784149][ T4283] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 184.126966][ T6098] kvm: apic: phys broadcast and lowest prio [ 184.214093][ T4283] usb 3-1: config 0 has no interfaces? [ 184.219637][ T4283] usb 3-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 184.231322][ T6108] netlink: 57 bytes leftover after parsing attributes in process `syz.3.549'. [ 184.260721][ T4283] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.280280][ T4283] usb 3-1: config 0 descriptor?? [ 184.405204][ T6114] device syzkaller0 entered promiscuous mode [ 184.586682][ T6076] device syz_tun entered promiscuous mode [ 184.621109][ T6076] device vlan2 entered promiscuous mode [ 184.767107][ T6125] device syzkaller0 entered promiscuous mode [ 184.824997][ T21] usb 3-1: USB disconnect, device number 4 [ 185.090181][ T6131] netlink: 48 bytes leftover after parsing attributes in process `syz.0.557'. [ 185.100906][ T6131] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 186.083948][ T4498] Bluetooth: hci2: command 0x0406 tx timeout [ 186.093945][ T4498] Bluetooth: hci0: command 0x0406 tx timeout [ 186.110357][ T4498] Bluetooth: hci1: command 0x0406 tx timeout [ 186.120526][ T4498] Bluetooth: hci3: command 0x0406 tx timeout [ 186.132506][ T4498] Bluetooth: hci4: command 0x0406 tx timeout [ 186.164027][ T6134] device syzkaller0 entered promiscuous mode [ 187.562059][ T4283] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 188.934206][ T4283] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 188.962539][ T4283] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.037694][ T4283] usb 1-1: Product: syz [ 189.067771][ T4283] usb 1-1: Manufacturer: syz [ 189.188211][ T4283] usb 1-1: SerialNumber: syz [ 189.515506][ T4283] usb 1-1: can't set config #1, error -71 [ 189.669716][ T4283] usb 1-1: USB disconnect, device number 8 [ 189.714219][ T6163] device syzkaller0 entered promiscuous mode [ 191.702093][ T6188] device syzkaller0 entered promiscuous mode [ 194.387010][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.393373][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.410777][ T6199] device syzkaller0 entered promiscuous mode [ 194.519121][ T6206] netlink: 28 bytes leftover after parsing attributes in process `syz.0.582'. [ 194.534342][ T6206] netlink: 28 bytes leftover after parsing attributes in process `syz.0.582'. [ 194.673300][ T6208] device syzkaller0 entered promiscuous mode [ 195.052025][ T6228] device syzkaller0 entered promiscuous mode [ 195.288235][ T6232] block device autoloading is deprecated and will be removed. [ 197.181455][ T6248] device syzkaller0 entered promiscuous mode [ 197.237898][ T6252] netlink: 8 bytes leftover after parsing attributes in process `syz.0.598'. [ 197.369032][ T6250] netlink: 28 bytes leftover after parsing attributes in process `syz.4.596'. [ 197.385092][ T6250] netlink: 28 bytes leftover after parsing attributes in process `syz.4.596'. [ 197.428691][ T6259] block nbd0: not configured, cannot reconfigure [ 198.703002][ T6280] FAULT_INJECTION: forcing a failure. [ 198.703002][ T6280] name failslab, interval 1, probability 0, space 0, times 0 [ 198.722602][ T6280] CPU: 0 PID: 6280 Comm: syz.2.606 Not tainted syzkaller #0 [ 198.729942][ T6280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 198.740225][ T6280] Call Trace: [ 198.743526][ T6280] [ 198.746475][ T6280] dump_stack_lvl+0x188/0x250 [ 198.751187][ T6280] ? show_regs_print_info+0x20/0x20 [ 198.756421][ T6280] ? load_image+0x410/0x410 [ 198.760948][ T6280] ? __might_sleep+0xf0/0xf0 [ 198.765560][ T6280] ? __lock_acquire+0x7d40/0x7d40 [ 198.770613][ T6280] ? current_save_fsgs+0x163/0x300 [ 198.775753][ T6280] should_fail+0x383/0x4b0 [ 198.780202][ T6280] should_failslab+0x5/0x20 [ 198.784815][ T6280] slab_pre_alloc_hook+0x51/0xc0 [ 198.789780][ T6280] ? alloc_pid+0x9a/0xad0 [ 198.794152][ T6280] kmem_cache_alloc+0x3d/0x280 [ 198.798952][ T6280] alloc_pid+0x9a/0xad0 [ 198.803144][ T6280] ? io_fallback_req_func+0x210/0x210 [ 198.808551][ T6280] copy_process+0x1cce/0x4250 [ 198.813285][ T6280] ? __pidfd_prepare+0x140/0x140 [ 198.818250][ T6280] ? __lock_acquire+0x7d40/0x7d40 [ 198.823299][ T6280] ? io_fallback_req_func+0x210/0x210 [ 198.828691][ T6280] ? io_fallback_req_func+0x210/0x210 [ 198.834089][ T6280] create_io_thread+0x111/0x180 [ 198.838957][ T6280] ? __se_sys_io_uring_setup+0x19c9/0x2900 [ 198.844789][ T6280] ? copy_process+0x4250/0x4250 [ 198.849659][ T6280] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 198.855319][ T6280] ? io_fallback_req_func+0x210/0x210 [ 198.860737][ T6280] __se_sys_io_uring_setup+0x1d6e/0x2900 [ 198.866410][ T6280] ? __x64_sys_io_uring_setup+0x60/0x60 [ 198.872001][ T6280] ? lockdep_hardirqs_on+0x94/0x140 [ 198.877221][ T6280] do_syscall_64+0x4c/0xa0 [ 198.881660][ T6280] ? clear_bhb_loop+0x30/0x80 [ 198.886353][ T6280] ? clear_bhb_loop+0x30/0x80 [ 198.891048][ T6280] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 198.896957][ T6280] RIP: 0033:0x7fbb1b9ffb19 [ 198.901408][ T6280] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 198.921047][ T6280] RSP: 002b:00007fbb19c55fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 198.929572][ T6280] RAX: ffffffffffffffda RBX: 0000200000000680 RCX: 00007fbb1b9ffb19 [ 198.937563][ T6280] RDX: 0000200000000740 RSI: 0000200000000680 RDI: 0000000000000d00 [ 198.945667][ T6280] RBP: 00007fbb1ba97b70 R08: 0000000000000000 R09: 0000000000000000 [ 198.953673][ T6280] R10: 0000200000000780 R11: 0000000000000206 R12: 0000200000000740 [ 198.961676][ T6280] R13: 0000200000000780 R14: 0000200000000700 R15: 00007ffeac0a4d28 [ 198.969697][ T6280] [ 199.100920][ T6283] FAULT_INJECTION: forcing a failure. [ 199.100920][ T6283] name failslab, interval 1, probability 0, space 0, times 0 [ 199.122298][ T6283] CPU: 0 PID: 6283 Comm: syz.3.607 Not tainted syzkaller #0 [ 199.129641][ T6283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 199.139718][ T6283] Call Trace: [ 199.143028][ T6283] [ 199.145976][ T6283] dump_stack_lvl+0x188/0x250 [ 199.150691][ T6283] ? show_regs_print_info+0x20/0x20 [ 199.156089][ T6283] ? load_image+0x410/0x410 [ 199.160640][ T6283] ? __might_sleep+0xf0/0xf0 [ 199.165255][ T6283] ? __lock_acquire+0x7d40/0x7d40 [ 199.170312][ T6283] should_fail+0x383/0x4b0 [ 199.174754][ T6283] should_failslab+0x5/0x20 [ 199.179279][ T6283] slab_pre_alloc_hook+0x51/0xc0 [ 199.184389][ T6283] kmem_cache_alloc_trace+0x47/0x290 [ 199.189692][ T6283] ? snd_mixer_oss_get_volume1_sw+0xbc/0x430 [ 199.195725][ T6283] snd_mixer_oss_get_volume1_sw+0xbc/0x430 [ 199.201554][ T6283] ? kfree+0xef/0x2a0 [ 199.205565][ T6283] snd_mixer_oss_get_recsrc1_sw+0x8c/0x130 [ 199.211400][ T6283] snd_mixer_oss_set_recsrc+0x2e2/0x3e0 [ 199.216979][ T6283] ? snd_mixer_oss_notify_handler+0xf60/0xf60 [ 199.223080][ T6283] ? __might_fault+0xb3/0x110 [ 199.227792][ T6283] snd_mixer_oss_ioctl1+0xf16/0x1640 [ 199.233108][ T6283] ? snd_mixer_oss_ioctl_card+0x120/0x120 [ 199.238894][ T6283] ? snd_mixer_oss_set_recsrc+0x3e0/0x3e0 [ 199.244633][ T6283] snd_mixer_oss_ioctl+0x44/0x50 [ 199.249605][ T6283] __se_sys_ioctl+0xfa/0x170 [ 199.254218][ T6283] do_syscall_64+0x4c/0xa0 [ 199.258652][ T6283] ? clear_bhb_loop+0x30/0x80 [ 199.263347][ T6283] ? clear_bhb_loop+0x30/0x80 [ 199.268047][ T6283] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 199.273964][ T6283] RIP: 0033:0x7f7a6769bb19 [ 199.278403][ T6283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.298027][ T6283] RSP: 002b:00007f7a658f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 199.306469][ T6283] RAX: ffffffffffffffda RBX: 00007f7a67921fa0 RCX: 00007f7a6769bb19 [ 199.314500][ T6283] RDX: 0000200000000a00 RSI: 00000000c0044dff RDI: 0000000000000004 [ 199.322534][ T6283] RBP: 00007f7a67733b70 R08: 0000000000000000 R09: 0000000000000000 [ 199.330611][ T6283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 199.338614][ T6283] R13: 00007f7a67922038 R14: 00007f7a67921fa0 R15: 00007fff26621998 [ 199.346630][ T6283] [ 199.546219][ T26] audit: type=1800 audit(1794154602.777:12): pid=6290 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.609" name="p_chmask" dev="configfs" ino=40291 res=0 errno=0 [ 199.548642][ T6290] Need at least one configuration in g1. [ 199.566506][ C1] vkms_vblank_simulate: vblank timer overrun [ 199.611100][ T26] audit: type=1800 audit(1794154602.787:13): pid=6290 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.609" name="UDC" dev="configfs" ino=40292 res=0 errno=0 [ 199.650433][ T6290] udc dummy_udc.0: failed to start g1: -22 [ 199.713162][ T6295] netlink: 8 bytes leftover after parsing attributes in process `syz.2.611'. [ 201.475016][ T6330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.624'. [ 201.678717][ T6337] FAULT_INJECTION: forcing a failure. [ 201.678717][ T6337] name failslab, interval 1, probability 0, space 0, times 0 [ 201.692910][ T6339] netlink: 12 bytes leftover after parsing attributes in process `syz.2.628'. [ 201.719204][ T6337] CPU: 1 PID: 6337 Comm: syz.0.627 Not tainted syzkaller #0 [ 201.726553][ T6337] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 201.736644][ T6337] Call Trace: [ 201.739956][ T6337] [ 201.742916][ T6337] dump_stack_lvl+0x188/0x250 [ 201.747636][ T6337] ? show_regs_print_info+0x20/0x20 [ 201.752867][ T6337] ? load_image+0x410/0x410 [ 201.757405][ T6337] ? __lock_acquire+0x7d40/0x7d40 [ 201.762488][ T6337] should_fail+0x383/0x4b0 [ 201.766947][ T6337] should_failslab+0x5/0x20 [ 201.771478][ T6337] slab_pre_alloc_hook+0x51/0xc0 [ 201.776451][ T6337] ? single_open+0x118/0x240 [ 201.781077][ T6337] kmem_cache_alloc+0x3d/0x280 [ 201.785964][ T6337] single_open+0x118/0x240 [ 201.790524][ T6337] single_open_net+0x74/0x120 [ 201.795236][ T6337] proc_reg_open+0x200/0x500 [ 201.799852][ T6337] ? proc_reg_mmap+0x280/0x280 [ 201.804643][ T6337] do_dentry_open+0x7f7/0xf90 [ 201.809356][ T6337] ? vfs_open+0x2b/0x80 [ 201.813544][ T6337] path_openat+0x2718/0x2fb0 [ 201.818197][ T6337] ? do_filp_open+0x400/0x400 [ 201.822922][ T6337] do_filp_open+0x1df/0x400 [ 201.827465][ T6337] ? vfs_tmpfile+0x300/0x300 [ 201.832090][ T6337] ? noop_direct_IO+0x10/0x10 [ 201.836975][ T6337] ? _raw_spin_unlock+0x24/0x40 [ 201.841863][ T6337] ? alloc_fd+0x59e/0x650 [ 201.846232][ T6337] do_sys_openat2+0x14b/0x500 [ 201.850933][ T6337] ? __lock_acquire+0x7d40/0x7d40 [ 201.855995][ T6337] ? do_sys_open+0xe0/0xe0 [ 201.860441][ T6337] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 201.866467][ T6337] ? lock_chain_count+0x20/0x20 [ 201.871630][ T6337] __x64_sys_openat+0x135/0x160 [ 201.876523][ T6337] do_syscall_64+0x4c/0xa0 [ 201.881063][ T6337] ? clear_bhb_loop+0x30/0x80 [ 201.885772][ T6337] ? clear_bhb_loop+0x30/0x80 [ 201.890500][ T6337] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 201.896433][ T6337] RIP: 0033:0x7f4541afd34e [ 201.900879][ T6337] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 201.920517][ T6337] RSP: 002b:00007f453fd92ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 201.928973][ T6337] RAX: ffffffffffffffda RBX: 00007f453fd936c0 RCX: 00007f4541afd34e [ 201.937065][ T6337] RDX: 0000000000000002 RSI: 00007f453fd92f90 RDI: ffffffffffffff9c [ 201.945072][ T6337] RBP: 00007f4541bd4b70 R08: 0000000000000000 R09: 0000000000000000 [ 201.953082][ T6337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.961089][ T6337] R13: 00007f4541dc3038 R14: 00007f4541dc2fa0 R15: 00007fff05901ff8 [ 201.969193][ T6337] [ 202.985680][ T6359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.637'. [ 203.185943][ T6370] device erspan0 entered promiscuous mode [ 203.454898][ T6363] Could not create tracefs 'filter' entry [ 203.583633][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 203.676190][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 203.775982][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 203.902091][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.001796][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.079901][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.154903][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.226474][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.277486][ T6363] Could not create tracefs 'trigger' entry [ 204.300183][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.364113][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.442207][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.515130][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.590339][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.660416][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.727580][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.747781][ T6363] Could not create tracefs 'format' entry [ 204.794128][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.865313][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 204.912208][ T6370] syz.4.638 (6370) used greatest stack depth: 17232 bytes left [ 204.941806][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.009818][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.080738][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.161151][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.234645][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.307079][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.376502][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.415723][ T6363] Could not create tracefs 'filter' entry [ 205.447262][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.518841][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.589590][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.665428][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.702702][ T6363] Could not create tracefs 'trigger' entry [ 205.736407][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.806642][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.866617][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.939941][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 205.979841][ T6363] Could not create tracefs 'format' entry [ 206.012986][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.080805][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.154972][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.228753][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.299068][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.334146][ T6363] Could not create tracefs 'inject' entry [ 206.375356][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.455085][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.529958][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.599278][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.625695][ T6363] Could not create tracefs 'qrtr_ns_server_add' directory [ 206.667817][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.738812][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.750651][ T6363] Could not create directory for event qrtr_ns_server_add [ 206.800750][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.873484][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 206.959453][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.040076][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.071798][ T6363] Could not create tracefs 'qrtr_ns_service_announce_del' directory [ 207.111049][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.176533][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.209548][ T6363] Could not create directory for event qrtr_ns_service_announce_del [ 207.243994][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.283283][ T6363] Could not create tracefs 'qrtr_ns_service_announce_new' directory [ 207.292137][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.322625][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.337654][ T6363] Could not create directory for event qrtr_ns_service_announce_new [ 207.370595][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.399049][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.418473][ T6363] Failed to create system directory vsock [ 207.440007][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.468953][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.489214][ T6363] Could not create directory for event virtio_transport_recv_pkt [ 207.498861][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.512279][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.531296][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.572225][ T6363] Failed to create system directory vsock [ 207.578591][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.594455][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.597829][ T6363] Could not create directory for event virtio_transport_alloc_pkt [ 207.602227][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.602271][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.635741][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.649580][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.660494][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: unknown main item tag 0x0 [ 207.681612][ T4426] hid-generic 0DDE:FFFFFFFF:0004.0002: hidraw0: HID v0.03 Device [syz0] on syz1 [ 207.714174][ T6363] Failed to create system directory openvswitch [ 207.720605][ T6363] Could not create directory for event ovs_dp_upcall [ 207.864573][ T6363] Failed to create system directory openvswitch [ 207.887962][ T6385] fido_id[6385]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 207.944121][ T6363] Could not create directory for event ovs_do_execute_action [ 207.959286][ T6395] netlink: 8 bytes leftover after parsing attributes in process `syz.1.649'. [ 208.067049][ T6363] Failed to create system directory mac802154 [ 208.073292][ T6363] Could not create directory for event 802154_drv_set_promiscuous_mode [ 208.338580][ T6363] Failed to create system directory mac802154 [ 208.378784][ T6363] Could not create directory for event 802154_drv_set_max_frame_retries [ 208.496890][ T6363] Failed to create system directory mac802154 [ 208.503032][ T6363] Could not create directory for event 802154_drv_set_csma_params [ 208.549463][ T6363] Failed to create system directory mac802154 [ 208.562068][ T6363] Could not create directory for event 802154_drv_set_pan_coord [ 208.679025][ T6415] FAULT_INJECTION: forcing a failure. [ 208.679025][ T6415] name fail_futex, interval 1, probability 0, space 0, times 1 [ 208.738756][ T6363] Failed to create system directory mac802154 [ 208.757805][ T6415] CPU: 1 PID: 6415 Comm: syz.1.654 Not tainted syzkaller #0 [ 208.765193][ T6415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 208.775298][ T6415] Call Trace: [ 208.775312][ T6415] [ 208.775321][ T6415] dump_stack_lvl+0x188/0x250 [ 208.775354][ T6415] ? show_regs_print_info+0x20/0x20 [ 208.782117][ T6363] Could not create directory for event 802154_drv_set_extended_addr [ 208.786523][ T6415] ? load_image+0x410/0x410 [ 208.786549][ T6415] ? __lock_acquire+0x12df/0x7d40 [ 208.786580][ T6415] ? mark_lock+0x94/0x320 [ 208.799688][ T6363] Failed to create system directory mac802154 [ 208.799763][ T6415] should_fail+0x383/0x4b0 [ 208.804361][ T6363] Could not create directory for event 802154_drv_set_pan_id [ 208.809279][ T6415] get_futex_key+0x1a0/0x1200 [ 208.827692][ T6363] Failed to create system directory mac802154 [ 208.831538][ T6415] ? futex_wait_restart+0x250/0x250 [ 208.836328][ T6363] Could not create directory for event 802154_drv_set_short_addr [ 208.842413][ T6415] futex_wake+0x101/0x540 [ 208.842437][ T6415] ? verify_lock_unused+0x140/0x140 [ 208.855003][ T6363] Failed to create system directory mac802154 [ 208.855333][ T6415] ? verify_lock_unused+0x140/0x140 [ 208.859745][ T6363] Could not create directory for event 802154_drv_set_lbt_mode [ 208.864854][ T6415] ? futex_wait+0x680/0x680 [ 208.864895][ T6415] do_futex+0xd83/0x12b0 [ 208.864928][ T6415] ? __might_sleep+0xf0/0xf0 [ 208.864949][ T6415] ? __might_fault+0xb7/0x110 [ 208.864974][ T6415] ? futex_exit_release+0x1c0/0x1c0 [ 208.864995][ T6415] ? __lock_acquire+0x7d40/0x7d40 [ 208.865028][ T6415] mm_release+0x278/0x3c0 [ 208.886340][ T6363] Failed to create system directory mac802154 [ 208.888409][ T6415] ? exit_mm_release+0x30/0x30 [ 208.888437][ T6415] ? lockdep_hardirqs_on+0x94/0x140 [ 208.892764][ T6363] Could not create directory for event 802154_drv_set_tx_power [ 208.897264][ T6415] exit_mm+0xaf/0x7b0 [ 208.897287][ T6415] ? perf_pmu_migrate_context+0xb70/0xb70 [ 208.897317][ T6415] ? do_exit+0x2100/0x2100 [ 208.910297][ T6363] Failed to create system directory mac802154 [ 208.912318][ T6415] ? rcu_is_watching+0x11/0xa0 [ 208.912344][ T6415] ? mm_trace_rss_stat+0x81/0x1c0 [ 208.923533][ T6363] Could not create directory for event 802154_drv_set_cca_ed_level [ 208.927692][ T6415] ? sync_mm_rss+0x211/0x350 [ 208.927718][ T6415] do_exit+0x5b8/0x2100 [ 208.927747][ T6415] ? put_task_struct+0x80/0x80 [ 208.927767][ T6415] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 208.941409][ T6363] Failed to create system directory mac802154 [ 208.944482][ T6415] ? _raw_spin_lock_irq+0xb7/0xf0 [ 208.944514][ T6415] do_group_exit+0x12c/0x2f0 [ 208.944533][ T6415] ? lockdep_hardirqs_on+0x94/0x140 [ 208.950692][ T6363] Could not create directory for event 802154_drv_set_cca_mode [ 208.954664][ T6415] get_signal+0x7eb/0x12e0 [ 208.954708][ T6415] arch_do_signal_or_restart+0xe6/0x12a0 [ 208.976530][ T6363] Failed to create system directory mac802154 [ 208.978422][ T6415] ? __lock_acquire+0x7d40/0x7d40 [ 208.978461][ T6415] ? futex_exit_release+0x1c0/0x1c0 [ 208.983139][ T6363] Could not create directory for event 802154_drv_set_channel [ 208.987187][ T6415] ? get_sigframe_size+0x10/0x10 [ 208.987213][ T6415] ? __context_tracking_exit+0x4c/0x80 [ 208.987246][ T6415] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 209.000262][ T6363] Failed to create system directory mac802154 [ 209.004041][ T6415] ? exit_to_user_mode_loop+0x3b/0x130 [ 209.004069][ T6415] exit_to_user_mode_loop+0x9e/0x130 [ 209.004090][ T6415] exit_to_user_mode_prepare+0xee/0x180 [ 209.009182][ T6363] Could not create directory for event 802154_drv_stop [ 209.013685][ T6415] syscall_exit_to_user_mode+0x16/0x40 [ 209.013710][ T6415] do_syscall_64+0x58/0xa0 [ 209.036451][ T6363] Failed to create system directory mac802154 [ 209.036745][ T6415] ? clear_bhb_loop+0x30/0x80 [ 209.045199][ T6363] Could not create directory for event 802154_drv_start [ 209.047945][ T6415] ? clear_bhb_loop+0x30/0x80 [ 209.047977][ T6415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 209.075662][ T6363] Failed to create system directory mac802154 [ 209.076993][ T6415] RIP: 0033:0x7fa970868b19 [ 209.077019][ T6415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.077035][ T6415] RSP: 002b:00007fa96ea9e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 209.077059][ T6415] RAX: fffffffffffffe00 RBX: 00007fa970aef098 RCX: 00007fa970868b19 [ 209.077075][ T6415] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa970aef098 [ 209.077089][ T6415] RBP: 00007fa970aef090 R08: 0000000000000000 R09: 0000000000000000 [ 209.077102][ T6415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.077115][ T6415] R13: 00007fa970aef128 R14: 00007ffc8e0ca130 R15: 00007ffc8e0ca218 [ 209.077146][ T6415] [ 209.868959][ T6419] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input7 [ 209.920226][ T6363] Could not create directory for event 802154_drv_return_int [ 209.952796][ T6363] Failed to create system directory mac802154 [ 209.969247][ T6363] Could not create directory for event 802154_drv_return_void [ 210.037334][ T6363] Failed to create system directory cfg802154 [ 210.090316][ T6363] Could not create directory for event 802154_rdev_return_int [ 210.162797][ T6435] netlink: 8 bytes leftover after parsing attributes in process `syz.2.661'. [ 210.196469][ T6363] Failed to create system directory cfg802154 [ 210.202621][ T6363] Could not create directory for event 802154_rdev_set_ackreq_default [ 210.255049][ T6363] Failed to create system directory cfg802154 [ 210.261315][ T6363] Could not create directory for event 802154_rdev_set_lbt_mode [ 210.333501][ T6363] Failed to create system directory cfg802154 [ 210.370397][ T6363] Could not create directory for event 802154_rdev_set_max_frame_retries [ 210.439074][ T6363] Failed to create system directory cfg802154 [ 211.028181][ T6363] Could not create directory for event 802154_rdev_set_csma_backoffs [ 211.618131][ T6363] Failed to create system directory cfg802154 [ 211.668321][ T6363] Could not create directory for event 802154_rdev_set_backoff_exponent [ 211.715982][ T6363] Failed to create system directory cfg802154 [ 211.740361][ T6363] Could not create directory for event 802154_rdev_set_short_addr [ 212.300007][ T6363] Failed to create system directory cfg802154 [ 212.318838][ T6363] Could not create directory for event 802154_rdev_set_pan_id [ 212.390939][ T6363] Failed to create system directory cfg802154 [ 212.397221][ T6363] Could not create directory for event 802154_rdev_set_cca_ed_level [ 212.419597][ T6363] Failed to create system directory cfg802154 [ 212.426422][ T6363] Could not create directory for event 802154_rdev_set_cca_mode [ 212.457075][ T6363] Failed to create system directory cfg802154 [ 212.463213][ T6363] Could not create directory for event 802154_rdev_set_tx_power [ 212.596323][ T6363] Failed to create system directory cfg802154 [ 212.614130][ T6363] Could not create directory for event 802154_rdev_set_channel [ 212.666855][ T6363] Failed to create system directory cfg802154 [ 212.719747][ T6363] Could not create directory for event 802154_rdev_del_virtual_intf [ 212.770479][ T6363] Failed to create system directory cfg802154 [ 212.824262][ T6363] Could not create directory for event 802154_rdev_add_virtual_intf [ 212.857463][ T6460] netlink: 48 bytes leftover after parsing attributes in process `syz.2.667'. [ 212.867157][ T6460] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 213.814873][ T6363] Failed to create system directory cfg802154 [ 213.856321][ C0] Unknown status report in ack skb [ 213.862642][ T6363] Could not create directory for event 802154_rdev_resume [ 213.931118][ T6363] Failed to create system directory cfg802154 [ 213.960114][ T6363] Could not create directory for event 802154_rdev_suspend [ 214.010286][ T6363] Failed to create system directory 9p [ 214.024437][ T6363] Could not create directory for event 9p_protocol_dump [ 214.040063][ T6363] Failed to create system directory 9p [ 214.053188][ T6363] Could not create directory for event 9p_client_res [ 214.097955][ T6363] Failed to create system directory 9p [ 214.111990][ T6363] Could not create directory for event 9p_client_req [ 214.132121][ T6363] Failed to create system directory tipc [ 214.148221][ T6363] Could not create directory for event tipc_l2_device_event [ 214.192952][ T6363] Failed to create system directory tipc [ 214.221464][ T6363] Could not create directory for event tipc_node_fsm [ 214.435045][ T6363] Failed to create system directory tipc [ 214.498434][ T6363] Could not create directory for event tipc_link_fsm [ 214.534338][ T4178] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 214.739283][ T6363] Failed to create system directory tipc [ 214.784885][ T6363] Could not create directory for event tipc_node_check_state [ 214.934207][ T4178] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 214.975715][ T4178] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.075157][ T6363] Failed to create system directory tipc [ 215.080889][ T6363] Could not create directory for event tipc_node_reset_links [ 215.112591][ T6363] Failed to create system directory tipc [ 215.118976][ T6363] Could not create directory for event tipc_node_link_down [ 215.245738][ T4178] usb 4-1: config 0 descriptor?? [ 215.581987][ T6363] Failed to create system directory tipc [ 215.588176][ T6363] Could not create directory for event tipc_node_link_up [ 215.904018][ T6363] Failed to create system directory tipc [ 215.910412][ T6363] Could not create directory for event tipc_node_timeout [ 215.951283][ T6363] Failed to create system directory tipc [ 215.957123][ T6363] Could not create directory for event tipc_node_lost_contact [ 215.997831][ T6363] Failed to create system directory tipc [ 216.003617][ T6363] Could not create directory for event tipc_node_delete [ 216.048366][ T6363] Failed to create system directory tipc [ 216.063978][ T6363] Could not create directory for event tipc_node_create [ 216.091529][ T6363] Failed to create system directory tipc [ 216.101525][ T6363] Could not create directory for event tipc_node_dump [ 216.128108][ T6363] Failed to create system directory tipc [ 216.143840][ T6363] Could not create directory for event tipc_link_bc_ack [ 216.202268][ T6363] Failed to create system directory tipc [ 216.208136][ T6363] Could not create directory for event tipc_link_retrans [ 216.223463][ T6363] Failed to create system directory tipc [ 216.229339][ T6363] Could not create directory for event tipc_link_too_silent [ 216.241322][ T4178] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 216.244704][ T6363] Failed to create system directory tipc [ 216.255975][ T6363] Could not create directory for event tipc_link_reset [ 216.287287][ T4178] [drm] Initialized udl on minor 2 [ 216.482177][ T6363] Failed to create system directory tipc [ 216.513570][ T6363] Could not create directory for event tipc_link_timeout [ 216.556027][ T4178] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 216.606839][ T4178] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 216.803981][ T4178] usb 4-1: USB disconnect, device number 2 [ 216.938572][ T6363] Failed to create system directory tipc [ 216.955142][ T4498] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 216.984677][ T6363] Could not create directory for event tipc_link_conges [ 216.993167][ T4498] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 217.020234][ T4498] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 217.032555][ T6363] Failed to create system directory tipc [ 217.079926][ T6363] Could not create directory for event tipc_link_dump [ 217.105604][ T6363] Failed to create system directory tipc [ 217.131778][ T6363] Could not create directory for event tipc_sk_overlimit2 [ 217.192043][ T6363] Failed to create system directory tipc [ 217.206251][ T6363] Could not create directory for event tipc_sk_overlimit1 [ 217.244615][ T6363] Failed to create system directory tipc [ 217.278979][ T6363] Could not create directory for event tipc_sk_shutdown [ 217.310567][ T6363] Failed to create system directory tipc [ 217.316593][ T6363] Could not create directory for event tipc_sk_release [ 217.327005][ T6515] netlink: 24 bytes leftover after parsing attributes in process `syz.2.687'. [ 217.361618][ T6363] Failed to create system directory tipc [ 217.376875][ T6363] Could not create directory for event tipc_sk_drop_msg [ 217.415305][ T6363] Failed to create system directory tipc [ 217.421588][ T6363] Could not create directory for event tipc_sk_rej_msg [ 217.448234][ T6363] Failed to create system directory tipc [ 217.464712][ T6363] Could not create directory for event tipc_sk_advance_rx [ 217.472349][ T6521] FAULT_INJECTION: forcing a failure. [ 217.472349][ T6521] name failslab, interval 1, probability 0, space 0, times 0 [ 217.506667][ T6363] Failed to create system directory tipc [ 217.519637][ T6520] rxe_eth0 speed is unknown, defaulting to 1000 [ 217.526239][ T6363] Could not create directory for event tipc_sk_filter_rcv [ 217.552693][ T6363] Failed to create system directory tipc [ 217.562607][ T6521] CPU: 1 PID: 6521 Comm: syz.1.698 Not tainted syzkaller #0 [ 217.569939][ T6521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 217.580026][ T6521] Call Trace: [ 217.583440][ T6521] [ 217.586372][ T6521] dump_stack_lvl+0x188/0x250 [ 217.591073][ T6521] ? show_regs_print_info+0x20/0x20 [ 217.596280][ T6521] ? load_image+0x410/0x410 [ 217.600903][ T6521] ? __might_sleep+0xf0/0xf0 [ 217.605506][ T6521] ? __lock_acquire+0x7d40/0x7d40 [ 217.610539][ T6521] ? tomoyo_get_local_path+0x62a/0x780 [ 217.616036][ T6521] should_fail+0x383/0x4b0 [ 217.620490][ T6521] should_failslab+0x5/0x20 [ 217.625021][ T6521] slab_pre_alloc_hook+0x51/0xc0 [ 217.630005][ T6521] __kmalloc+0x6b/0x340 [ 217.634199][ T6521] ? tomoyo_encode+0x28a/0x550 [ 217.639003][ T6521] tomoyo_encode+0x28a/0x550 [ 217.643621][ T6521] tomoyo_realpath_from_path+0x5a2/0x5e0 [ 217.649275][ T6521] tomoyo_check_open_permission+0x1eb/0x410 [ 217.655287][ T6521] ? tomoyo_check_path_number_acl+0x280/0x280 [ 217.661509][ T6521] ? __lock_acquire+0x7d40/0x7d40 [ 217.666558][ T6521] ? __rwlock_init+0x140/0x140 [ 217.671374][ T6521] ? preempt_count_add+0x8d/0x190 [ 217.676443][ T6521] ? hook_file_open+0xf1/0x230 [ 217.681243][ T6521] ? tomoyo_file_open+0xe9/0x170 [ 217.686337][ T6521] security_file_open+0x5e/0xa0 [ 217.691330][ T6521] do_dentry_open+0x321/0xf90 [ 217.696112][ T6521] ? vfs_open+0x2b/0x80 [ 217.700390][ T6521] path_openat+0x2718/0x2fb0 [ 217.705038][ T6521] ? do_filp_open+0x400/0x400 [ 217.709748][ T6521] do_filp_open+0x1df/0x400 [ 217.714268][ T6521] ? vfs_tmpfile+0x300/0x300 [ 217.719099][ T6521] ? noop_direct_IO+0x10/0x10 [ 217.723814][ T6521] ? _raw_spin_unlock+0x24/0x40 [ 217.728674][ T6521] ? alloc_fd+0x59e/0x650 [ 217.733004][ T6521] do_sys_openat2+0x14b/0x500 [ 217.737854][ T6521] ? __lock_acquire+0x7d40/0x7d40 [ 217.742967][ T6521] ? do_sys_open+0xe0/0xe0 [ 217.747380][ T6521] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 217.753365][ T6521] ? lock_chain_count+0x20/0x20 [ 217.758237][ T6521] __x64_sys_openat+0x135/0x160 [ 217.763115][ T6521] do_syscall_64+0x4c/0xa0 [ 217.767538][ T6521] ? clear_bhb_loop+0x30/0x80 [ 217.772240][ T6521] ? clear_bhb_loop+0x30/0x80 [ 217.776912][ T6521] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 217.782978][ T6521] RIP: 0033:0x7fa97082934e [ 217.787393][ T6521] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 217.807007][ T6521] RSP: 002b:00007fa96eabeec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 217.815461][ T6521] RAX: ffffffffffffffda RBX: 00007fa96eabf6c0 RCX: 00007fa97082934e [ 217.823456][ T6521] RDX: 0000000000000002 RSI: 00007fa96eabef90 RDI: ffffffffffffff9c [ 217.831425][ T6521] RBP: 00007fa970900b70 R08: 0000000000000000 R09: 0000000000000000 [ 217.839396][ T6521] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 217.847470][ T6521] R13: 00007fa970aef038 R14: 00007fa970aeefa0 R15: 00007ffc8e0ca218 [ 217.855476][ T6521] [ 217.869660][ T6363] Could not create directory for event tipc_sk_poll [ 217.890919][ T6363] Failed to create system directory tipc [ 217.898640][ T6363] Could not create directory for event tipc_sk_sendstream [ 217.914981][ T6363] Failed to create system directory tipc [ 217.924029][ T6363] Could not create directory for event tipc_sk_sendmsg [ 217.945961][ T6363] Failed to create system directory tipc [ 217.953563][ T6363] Could not create directory for event tipc_sk_sendmcast [ 217.977111][ T6363] Failed to create system directory tipc [ 217.988314][ T6363] Could not create directory for event tipc_sk_create [ 218.004244][ T6363] Failed to create system directory tipc [ 218.012210][ T6363] Could not create directory for event tipc_sk_dump [ 218.032367][ T6363] Failed to create system directory tipc [ 218.040866][ T6363] Could not create directory for event tipc_list_dump [ 218.064084][ T6363] Failed to create system directory tipc [ 218.072006][ T6363] Could not create directory for event tipc_proto_rcv [ 218.097181][ T6363] Failed to create system directory tipc [ 218.107423][ T6363] Could not create directory for event tipc_proto_build [ 218.133677][ T6363] Failed to create system directory tipc [ 218.146381][ T6363] Could not create directory for event tipc_skb_dump [ 218.170137][ T6363] Failed to create system directory mac80211 [ 218.197229][ T6363] Could not create directory for event drv_twt_teardown_request [ 218.229275][ T6363] Failed to create system directory mac80211 [ 218.253931][ T6521] ERROR: Out of memory at tomoyo_realpath_from_path. [ 218.263910][ T6363] Could not create directory for event drv_add_twt_setup [ 218.289686][ T6363] Failed to create system directory mac80211 [ 218.316493][ T6363] Could not create directory for event drv_sta_set_decap_offload [ 218.361247][ T6363] Failed to create system directory mac80211 [ 218.373864][ T6363] Could not create directory for event drv_sta_set_4addr [ 218.426399][ T6363] Failed to create system directory mac80211 [ 218.443851][ T6363] Could not create directory for event drv_update_vif_offload [ 218.533997][ T6363] Failed to create system directory mac80211 [ 218.540084][ T6363] Could not create directory for event drv_get_ftm_responder_stats [ 219.238624][ T6363] Failed to create system directory mac80211 [ 219.388474][ T6363] Could not create directory for event drv_wake_tx_queue [ 219.436755][ T6363] Failed to create system directory mac80211 [ 219.442904][ T6363] Could not create directory for event drv_tdls_recv_channel_switch [ 219.528643][ T6532] rxe_eth0 speed is unknown, defaulting to 1000 [ 219.554729][ T6363] Failed to create system directory mac80211 [ 219.566819][ T6363] Could not create directory for event drv_tdls_cancel_channel_switch [ 219.610464][ T6363] Failed to create system directory mac80211 [ 219.630496][ T6363] Could not create directory for event drv_tdls_channel_switch [ 219.661965][ T6363] Failed to create system directory mac80211 [ 219.682309][ T6363] Could not create directory for event drv_get_txpower [ 219.711784][ T6363] Failed to create system directory mac80211 [ 219.727068][ T6363] Could not create directory for event drv_channel_switch_rx_beacon [ 219.764271][ T6363] Failed to create system directory mac80211 [ 219.774089][ T6363] Could not create directory for event drv_abort_channel_switch [ 219.800273][ T6363] Failed to create system directory mac80211 [ 219.812473][ T6363] Could not create directory for event drv_post_channel_switch [ 219.853240][ T6363] Failed to create system directory mac80211 [ 219.868015][ T6363] Could not create directory for event drv_pre_channel_switch [ 219.886008][ T6363] Failed to create system directory mac80211 [ 219.895002][ T6363] Could not create directory for event drv_channel_switch_beacon [ 219.917499][ T6363] Failed to create system directory mac80211 [ 219.929819][ T6363] Could not create directory for event api_radar_detected [ 219.966038][ T6363] Failed to create system directory mac80211 [ 220.006460][ T6363] Could not create directory for event drv_set_default_unicast_key [ 220.103921][ T6363] Failed to create system directory mac80211 [ 220.109941][ T6363] Could not create directory for event stop_queue [ 220.149137][ T6532] chnl_net:caif_netlink_parms(): no params data found [ 220.267304][ T6363] Failed to create system directory mac80211 [ 220.273360][ T6363] Could not create directory for event wake_queue [ 220.288248][ T6363] Failed to create system directory mac80211 [ 220.297002][ T6363] Could not create directory for event api_sta_set_buffered [ 220.318045][ T6363] Failed to create system directory mac80211 [ 220.327640][ T6363] Could not create directory for event api_send_eosp_nullfunc [ 220.369185][ T6363] Failed to create system directory mac80211 [ 220.375580][ T6363] Could not create directory for event api_eosp [ 220.390166][ T6363] Failed to create system directory mac80211 [ 220.396765][ T6363] Could not create directory for event api_enable_rssi_reports [ 220.447875][ T6363] Failed to create system directory mac80211 [ 220.454086][ T6363] Could not create directory for event api_gtk_rekey_notify [ 220.479903][ T6363] Failed to create system directory mac80211 [ 220.470143][ T6532] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.489480][ T6363] Could not create directory for event api_remain_on_channel_expired [ 220.512461][ T6532] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.577500][ T6532] device bridge_slave_0 entered promiscuous mode [ 220.607615][ T6363] Failed to create system directory mac80211 [ 220.613629][ T6363] Could not create directory for event api_ready_on_channel [ 220.646302][ T6532] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.806842][ T6363] Failed to create system directory mac80211 [ 220.863882][ T6363] Could not create directory for event api_chswitch_done [ 220.920441][ T6363] Failed to create system directory mac80211 [ 220.926751][ T6363] Could not create directory for event api_sta_block_awake [ 221.797305][ T4498] Bluetooth: hci5: command 0x0409 tx timeout [ 221.816241][ T6363] Failed to create system directory mac80211 [ 221.822284][ T6363] Could not create directory for event api_sched_scan_stopped [ 221.844004][ T6532] bridge0: port 2(bridge_slave_1) entered disabled state [ 221.845608][ T6363] Failed to create system directory mac80211 [ 221.857417][ T6363] Could not create directory for event api_sched_scan_results [ 221.878504][ T6532] device bridge_slave_1 entered promiscuous mode [ 221.897245][ T6363] Failed to create system directory mac80211 [ 221.903303][ T6363] Could not create directory for event api_scan_completed [ 221.972031][ T6363] Failed to create system directory mac80211 [ 221.984613][ T6532] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 221.987573][ T6363] Could not create directory for event api_cqm_beacon_loss_notify [ 222.012962][ T6532] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 222.063721][ T6363] Failed to create system directory mac80211 [ 222.093866][ T6363] Could not create directory for event api_cqm_rssi_notify [ 222.111150][ T6532] team0: Port device team_slave_0 added [ 222.114377][ T6363] Failed to create system directory mac80211 [ 222.143863][ T6363] Could not create directory for event api_disconnect [ 222.164521][ T6532] team0: Port device team_slave_1 added [ 222.200016][ T6363] Failed to create system directory mac80211 [ 222.203852][ T6532] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 222.223339][ T6363] Could not create directory for event api_connection_loss [ 222.263600][ T6532] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 222.284875][ T6363] Failed to create system directory mac80211 [ 222.310696][ T6363] Could not create directory for event api_beacon_loss [ 222.345133][ T6532] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 222.358505][ T6363] Failed to create system directory mac80211 [ 222.386508][ T6532] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 222.394178][ T6363] Could not create directory for event api_restart_hw [ 222.415368][ T6532] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 222.483802][ T6363] Failed to create system directory mac80211 [ 222.489857][ T6363] Could not create directory for event api_stop_tx_ba_cb [ 222.524030][ T6532] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 222.552001][ T6363] Failed to create system directory mac80211 [ 222.564091][ T6363] Could not create directory for event api_stop_tx_ba_session [ 222.608714][ T6363] Failed to create system directory mac80211 [ 222.620031][ T6532] device hsr_slave_0 entered promiscuous mode [ 222.641502][ T6363] Could not create directory for event api_start_tx_ba_cb [ 222.658320][ T6532] device hsr_slave_1 entered promiscuous mode [ 222.665015][ T6570] FAULT_INJECTION: forcing a failure. [ 222.665015][ T6570] name failslab, interval 1, probability 0, space 0, times 0 [ 222.687038][ T6363] Failed to create system directory mac80211 [ 222.693083][ T6363] Could not create directory for event api_start_tx_ba_session [ 222.703979][ T6532] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 222.711589][ T6532] Cannot create hsr debugfs directory [ 222.745411][ T6570] CPU: 1 PID: 6570 Comm: syz.2.701 Not tainted syzkaller #0 [ 222.752788][ T6570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 222.762859][ T6570] Call Trace: [ 222.766160][ T6570] [ 222.769138][ T6570] dump_stack_lvl+0x188/0x250 [ 222.773839][ T6570] ? show_regs_print_info+0x20/0x20 [ 222.779085][ T6570] ? load_image+0x410/0x410 [ 222.783596][ T6570] ? __might_sleep+0xf0/0xf0 [ 222.788709][ T6570] ? __lock_acquire+0x7d40/0x7d40 [ 222.793740][ T6570] should_fail+0x383/0x4b0 [ 222.798171][ T6570] should_failslab+0x5/0x20 [ 222.802677][ T6570] slab_pre_alloc_hook+0x51/0xc0 [ 222.807622][ T6570] __kmalloc+0x6b/0x340 [ 222.811780][ T6570] ? device_write+0x160/0xea0 [ 222.816473][ T6570] device_write+0x160/0xea0 [ 222.820981][ T6570] ? security_file_permission+0x75/0xa0 [ 222.826533][ T6570] ? device_read+0x1140/0x1140 [ 222.831412][ T6570] vfs_write+0x304/0xd70 [ 222.835664][ T6570] ? file_end_write+0x250/0x250 [ 222.840524][ T6570] ? __fget_files+0x402/0x470 [ 222.845218][ T6570] ? __fdget_pos+0x1e2/0x370 [ 222.849809][ T6570] ? ksys_write+0x70/0x260 [ 222.854233][ T6570] ksys_write+0x153/0x260 [ 222.858569][ T6570] ? __ia32_sys_read+0x80/0x80 [ 222.863341][ T6570] ? lockdep_hardirqs_on+0x94/0x140 [ 222.868572][ T6570] do_syscall_64+0x4c/0xa0 [ 222.873019][ T6570] ? clear_bhb_loop+0x30/0x80 [ 222.877720][ T6570] ? clear_bhb_loop+0x30/0x80 [ 222.882417][ T6570] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 222.888338][ T6570] RIP: 0033:0x7fbb1b9ffb19 [ 222.892769][ T6570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.912567][ T6570] RSP: 002b:00007fbb19c56028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 222.920992][ T6570] RAX: ffffffffffffffda RBX: 00007fbb1bc85fa0 RCX: 00007fbb1b9ffb19 [ 222.929060][ T6570] RDX: 0000000000000068 RSI: 0000200000000180 RDI: 0000000000000003 [ 222.937035][ T6570] RBP: 00007fbb1ba97b70 R08: 0000000000000000 R09: 0000000000000000 [ 222.945096][ T6570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 222.953082][ T6570] R13: 00007fbb1bc86038 R14: 00007fbb1bc85fa0 R15: 00007ffeac0a4d28 [ 222.961192][ T6570] [ 222.974464][ T6363] Failed to create system directory mac80211 [ 222.980598][ T6363] Could not create directory for event drv_abort_pmsr [ 223.026869][ T6363] Failed to create system directory mac80211 [ 223.032925][ T6363] Could not create directory for event drv_start_pmsr [ 223.093124][ T6363] Failed to create system directory mac80211 [ 223.102066][ T6363] Could not create directory for event drv_del_nan_func [ 223.145462][ T6363] Failed to create system directory mac80211 [ 223.151524][ T6363] Could not create directory for event drv_add_nan_func [ 223.200521][ T6363] Failed to create system directory mac80211 [ 223.209974][ T6363] Could not create directory for event drv_nan_change_conf [ 223.246309][ T6363] Failed to create system directory mac80211 [ 223.272704][ T6363] Could not create directory for event drv_stop_nan [ 223.287165][ T6532] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 223.301113][ T6363] Failed to create system directory mac80211 [ 223.308601][ T6363] Could not create directory for event drv_start_nan [ 223.329362][ T6532] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 223.339811][ T6363] Failed to create system directory mac80211 [ 223.347287][ T6363] Could not create directory for event drv_get_expected_throughput [ 223.358429][ T6532] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 223.379152][ T6363] Failed to create system directory mac80211 [ 223.387862][ T6532] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 223.408263][ T6363] Could not create directory for event drv_leave_ibss [ 223.441218][ T6363] Failed to create system directory mac80211 [ 223.460442][ T6363] Could not create directory for event drv_join_ibss [ 223.500903][ T6363] Failed to create system directory mac80211 [ 223.518201][ T6363] Could not create directory for event drv_ipv6_addr_change [ 223.585945][ T6363] Failed to create system directory mac80211 [ 223.592003][ T6363] Could not create directory for event drv_reconfig_complete [ 223.622745][ T6532] 8021q: adding VLAN 0 to HW filter on device bond0 [ 223.665673][ T4999] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 223.676755][ T6363] Failed to create system directory mac80211 [ 223.682808][ T6363] Could not create directory for event drv_stop_ap [ 223.710691][ T4999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 223.747452][ T6532] 8021q: adding VLAN 0 to HW filter on device team0 [ 223.760274][ T6363] Failed to create system directory mac80211 [ 223.818602][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 223.827449][ T6363] Could not create directory for event drv_start_ap [ 223.843968][ T4498] Bluetooth: hci5: command 0x041b tx timeout [ 223.850437][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 223.878794][ T6363] Failed to create system directory mac80211 [ 223.879779][ T4975] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.892064][ T4975] bridge0: port 1(bridge_slave_0) entered forwarding state [ 223.893124][ T6363] Could not create directory for event drv_unassign_vif_chanctx [ 225.317874][ T6363] Failed to create system directory mac80211 [ 225.325444][ T6363] Could not create directory for event drv_assign_vif_chanctx [ 225.532184][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 225.670464][ T6363] Failed to create system directory mac80211 [ 225.716267][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 225.783873][ T6363] Could not create directory for event drv_switch_vif_chanctx [ 225.794156][ T4975] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.801274][ T4975] bridge0: port 2(bridge_slave_1) entered forwarding state [ 225.878299][ T6633] jffs2: notice: (6633) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 225.908513][ T6363] Failed to create system directory mac80211 [ 225.943380][ T4279] Bluetooth: hci5: command 0x040f tx timeout [ 225.982891][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 226.012214][ T6363] Could not create directory for event drv_change_chanctx [ 226.021245][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 226.032681][ T6363] Failed to create system directory mac80211 [ 226.045574][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 226.074224][ T6363] Could not create directory for event drv_remove_chanctx [ 226.097624][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 226.126818][ T6363] Failed to create system directory mac80211 [ 226.127348][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 226.132891][ T6363] Could not create directory for event drv_add_chanctx [ 226.172341][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 226.237103][ T6363] Failed to create system directory mac80211 [ 226.243325][ T6363] Could not create directory for event drv_mgd_protect_tdls_discover [ 226.244459][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.305389][ T6363] Failed to create system directory mac80211 [ 226.311443][ T6363] Could not create directory for event drv_mgd_complete_tx [ 226.338869][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 226.350446][ T6363] Failed to create system directory mac80211 [ 226.359854][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 226.368084][ T6363] Could not create directory for event drv_mgd_prepare_tx [ 226.414757][ T6363] Failed to create system directory mac80211 [ 226.418419][ T6532] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 226.444233][ T6363] Could not create directory for event drv_allow_buffered_frames [ 226.464229][ T6532] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 226.478165][ T6363] Failed to create system directory mac80211 [ 226.503723][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 226.513455][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 226.531394][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 226.553418][ T6363] Could not create directory for event drv_release_buffered_frames [ 226.639061][ T6363] Failed to create system directory mac80211 [ 226.663967][ T6363] Could not create directory for event drv_event_callback [ 226.705771][ T6363] Failed to create system directory mac80211 [ 226.744008][ T6363] Could not create directory for event drv_set_rekey_data [ 226.788354][ T6363] Failed to create system directory mac80211 [ 226.836475][ T6363] Could not create directory for event drv_set_bitrate_mask [ 226.879100][ T6363] Failed to create system directory mac80211 [ 226.933999][ T6363] Could not create directory for event drv_offchannel_tx_cancel_wait [ 226.947556][ T4414] nvme nvme0: rdma_resolve_route failed (-110). [ 226.995386][ T6363] Failed to create system directory mac80211 [ 227.002088][ T6363] Could not create directory for event drv_tx_frames_pending [ 227.013130][ T6645] nvme nvme0: rdma connection establishment failed (-19) [ 227.036289][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 227.066009][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 227.084654][ T6363] Failed to create system directory mac80211 [ 227.093930][ T6363] Could not create directory for event drv_get_ringparam [ 227.111735][ T6532] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 227.133674][ T6363] Failed to create system directory mac80211 [ 227.148506][ T6363] Could not create directory for event drv_set_ringparam [ 227.182523][ T6363] Failed to create system directory mac80211 [ 227.203213][ T6363] Could not create directory for event drv_cancel_remain_on_channel [ 227.248045][ T6363] Failed to create system directory mac80211 [ 227.265211][ T6363] Could not create directory for event drv_remain_on_channel [ 227.316109][ T6363] Failed to create system directory mac80211 [ 227.344123][ T6363] Could not create directory for event drv_get_antenna [ 227.380220][ T6363] Failed to create system directory mac80211 [ 227.401639][ T6363] Could not create directory for event drv_set_antenna [ 227.440869][ T6363] Failed to create system directory mac80211 [ 227.467380][ T6363] Could not create directory for event drv_channel_switch [ 227.504415][ T6363] Failed to create system directory mac80211 [ 227.527349][ T6363] Could not create directory for event drv_flush [ 227.586686][ T6363] Failed to create system directory mac80211 [ 227.592724][ T6363] Could not create directory for event drv_get_survey [ 227.620252][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 227.647531][ T6363] Failed to create system directory mac80211 [ 227.653582][ T6363] Could not create directory for event drv_ampdu_action [ 227.674272][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 227.757024][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 227.764852][ T6363] Failed to create system directory mac80211 [ 227.781830][ T6363] Could not create directory for event drv_tx_last_beacon [ 227.794641][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 227.838482][ T6363] Failed to create system directory mac80211 [ 227.860480][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 227.873836][ T6363] Could not create directory for event drv_reset_tsf [ 227.882477][ T4361] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 227.963447][ T6532] device veth0_vlan entered promiscuous mode [ 227.973610][ T6363] Failed to create system directory mac80211 [ 228.093960][ T4498] Bluetooth: hci5: command 0x0419 tx timeout [ 228.122625][ T6363] Could not create directory for event drv_offset_tsf [ 228.420497][ T6363] Failed to create system directory mac80211 [ 228.452937][ T6532] device veth1_vlan entered promiscuous mode [ 228.672690][ T6363] Could not create directory for event drv_set_tsf [ 228.771262][ T6532] device veth0_macvtap entered promiscuous mode [ 228.780068][ T6363] Failed to create system directory mac80211 [ 228.843943][ T6363] Could not create directory for event drv_get_tsf [ 228.897500][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 228.921606][ T6363] Failed to create system directory mac80211 [ 228.929282][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 228.950901][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 228.969277][ T6363] Could not create directory for event drv_conf_tx [ 228.996855][ T6532] device veth1_macvtap entered promiscuous mode [ 229.025517][ T6363] Failed to create system directory mac80211 [ 229.045383][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 229.073835][ T6363] Could not create directory for event drv_sta_rate_tbl_update [ 229.095018][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.115865][ T6363] Failed to create system directory mac80211 [ 229.121939][ T6363] Could not create directory for event drv_sync_rx_queues [ 229.129260][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.148579][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.164586][ T6363] Failed to create system directory mac80211 [ 229.170622][ T6363] Could not create directory for event drv_sta_pre_rcu_remove [ 229.180046][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.197677][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.214837][ T6363] Failed to create system directory mac80211 [ 229.220876][ T6363] Could not create directory for event drv_sta_remove [ 229.233806][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.243652][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.264305][ T6363] Failed to create system directory mac80211 [ 229.270456][ T6363] Could not create directory for event drv_sta_add [ 229.283831][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.332865][ T6363] Failed to create system directory mac80211 [ 229.339068][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 229.353824][ T6363] Could not create directory for event drv_sta_statistics [ 229.364462][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.394864][ T6363] Failed to create system directory mac80211 [ 229.400924][ T6363] Could not create directory for event drv_sta_rc_update [ 229.410475][ T6532] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 229.425204][ T6676] netlink: 'syz.1.715': attribute type 10 has an invalid length. [ 229.446579][ T6363] Could not create tracefs 'trigger' entry [ 229.466271][ T6676] device syz_tun entered promiscuous mode [ 229.481886][ T6363] Could not create tracefs 'format' entry [ 229.507507][ T6676] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 229.528299][ T6363] Could not create tracefs 'inject' entry [ 229.544855][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 229.553068][ T4996] bond0: (slave bond_slave_0): interface is now down [ 229.566492][ T6363] Could not create tracefs 'drv_sta_state' directory [ 229.573254][ T6363] Could not create directory for event drv_sta_state [ 229.573303][ T4996] bond0: (slave bond_slave_1): interface is now down [ 229.590148][ T4982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 229.601880][ T6363] Could not create tracefs 'drv_sta_notify' directory [ 229.622001][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 229.633204][ T6363] Could not create directory for event drv_sta_notify [ 229.640424][ T4996] bond0: (slave syz_tun): interface is now down [ 229.654512][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.684542][ T9] bond0: (slave bond_slave_0): interface is now down [ 229.685652][ T6363] Could not create tracefs 'drv_set_coverage_class' directory [ 229.699393][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 229.700339][ T9] bond0: (slave bond_slave_1): interface is now down [ 229.733827][ T6363] Could not create directory for event drv_set_coverage_class [ 229.741703][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.763216][ T9] bond0: (slave syz_tun): interface is now down [ 229.770848][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 229.792624][ T6363] Could not create tracefs 'drv_set_rts_threshold' directory [ 229.813929][ T4982] bond0: (slave bond_slave_0): interface is now down [ 229.820378][ T6363] Could not create directory for event drv_set_rts_threshold [ 229.820867][ T4982] bond0: (slave bond_slave_1): interface is now down [ 229.828642][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 229.867804][ T4982] bond0: (slave syz_tun): interface is now down [ 229.896522][ T4996] bond0: (slave bond_slave_0): interface is now down [ 229.900453][ T6363] Could not create tracefs 'drv_set_frag_threshold' directory [ 229.910797][ T6363] Could not create directory for event drv_set_frag_threshold [ 229.927051][ T6363] Could not create tracefs 'drv_get_key_seq' directory [ 229.933980][ T6363] Could not create directory for event drv_get_key_seq [ 229.936083][ T4996] bond0: (slave bond_slave_1): interface is now down [ 229.947680][ T6363] Could not create tracefs 'drv_get_stats' directory [ 229.947704][ T6363] Could not create directory for event drv_get_stats [ 229.954548][ T6363] Could not create tracefs 'drv_sw_scan_complete' directory [ 229.967049][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 229.969335][ T6363] Could not create directory for event drv_sw_scan_complete [ 230.005304][ T6363] Could not create tracefs 'drv_sw_scan_start' directory [ 230.012450][ T6363] Could not create directory for event drv_sw_scan_start [ 230.020756][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 230.043862][ T4996] bond0: (slave syz_tun): interface is now down [ 230.058089][ T6363] Could not create tracefs 'drv_sched_scan_stop' directory [ 230.058247][ T6532] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 230.073920][ T6363] Could not create directory for event drv_sched_scan_stop [ 230.082411][ T4996] bond0: (slave bond_slave_0): interface is now down [ 230.100282][ T4996] bond0: (slave bond_slave_1): interface is now down [ 230.113843][ T6532] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 230.115121][ T6363] Could not create tracefs 'drv_sched_scan_start' directory [ 230.123743][ T4996] bond0: (slave syz_tun): interface is now down [ 230.145105][ T6532] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 230.176292][ T9] bond0: (slave bond_slave_0): interface is now down [ 230.183034][ T9] bond0: (slave bond_slave_1): interface is now down [ 230.185116][ T6363] Could not create directory for event drv_sched_scan_start [ 230.204911][ T4996] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 230.221755][ T4996] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 230.230026][ T9] bond0: (slave syz_tun): interface is now down [ 230.250150][ T6363] Could not create tracefs 'drv_cancel_hw_scan' directory [ 230.254932][ T6532] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.264124][ T6363] Could not create directory for event drv_cancel_hw_scan [ 230.267153][ T4996] bond0: (slave bond_slave_0): interface is now down [ 230.303955][ T6532] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.312699][ T6532] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.322129][ T4996] bond0: (slave bond_slave_1): interface is now down [ 230.332274][ T6363] Could not create tracefs 'drv_hw_scan' directory [ 230.407580][ T6363] Could not create directory for event drv_hw_scan [ 230.456455][ T4996] bond0: (slave syz_tun): interface is now down [ 230.463753][ T6363] Could not create tracefs 'drv_update_tkip_key' directory [ 230.471132][ T6363] Could not create directory for event drv_update_tkip_key [ 230.484847][ T9] bond0: (slave bond_slave_0): interface is now down [ 230.494014][ T6532] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.508434][ T6679] rxe_eth0 speed is unknown, defaulting to 1000 [ 230.588353][ T6363] Could not create tracefs 'drv_set_key' directory [ 230.644194][ T6363] Could not create directory for event drv_set_key [ 230.713812][ T9] bond0: (slave bond_slave_1): interface is now down [ 230.724444][ T6363] Could not create tracefs 'drv_set_tim' directory [ 230.724584][ T9] bond0: (slave syz_tun): interface is now down [ 230.730986][ T6363] Could not create directory for event drv_set_tim [ 230.777605][ T6363] Could not create tracefs 'drv_config_iface_filter' directory [ 230.794925][ T4982] bond0: (slave bond_slave_0): interface is now down [ 230.801710][ T4982] bond0: (slave bond_slave_1): interface is now down [ 230.823987][ T6363] Could not create directory for event drv_config_iface_filter [ 230.845149][ T4982] bond0: (slave syz_tun): interface is now down [ 230.891701][ T6363] Could not create tracefs 'drv_configure_filter' directory [ 230.904020][ T4982] bond0: (slave bond_slave_0): interface is now down [ 230.923921][ T4982] bond0: (slave bond_slave_1): interface is now down [ 230.930765][ T6363] Could not create directory for event drv_configure_filter [ 230.949098][ T4982] bond0: (slave syz_tun): interface is now down [ 230.953879][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 230.971847][ T6363] Could not create tracefs 'drv_prepare_multicast' directory [ 230.996027][ T4996] bond0: (slave bond_slave_0): interface is now down [ 231.009681][ T6363] Could not create directory for event drv_prepare_multicast [ 231.010898][ T4996] bond0: (slave bond_slave_1): interface is now down [ 231.030220][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 231.032454][ T6692] FAULT_INJECTION: forcing a failure. [ 231.032454][ T6692] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 231.061690][ T4996] bond0: (slave syz_tun): interface is now down [ 231.066378][ T4975] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 231.083982][ T6692] CPU: 0 PID: 6692 Comm: syz.1.720 Not tainted syzkaller #0 [ 231.091329][ T6692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 231.101587][ T6692] Call Trace: [ 231.104897][ T6692] [ 231.104952][ T6363] Could not create tracefs 'drv_bss_info_changed' directory [ 231.107845][ T6692] dump_stack_lvl+0x188/0x250 [ 231.119832][ T6692] ? show_regs_print_info+0x20/0x20 [ 231.125071][ T6692] ? load_image+0x410/0x410 [ 231.127628][ T6363] Could not create directory for event drv_bss_info_changed [ 231.129609][ T6692] ? __lock_acquire+0x7d40/0x7d40 [ 231.142063][ T6692] ? __vmalloc_node_range+0x2dd/0x8b0 [ 231.147522][ T6692] ? dup_task_struct+0x41a/0xbc0 [ 231.152498][ T6692] should_fail+0x383/0x4b0 [ 231.157064][ T6692] prepare_alloc_pages+0x1e3/0x5b0 [ 231.162217][ T6692] __alloc_pages+0x11b/0x480 [ 231.166283][ T6363] Could not create tracefs 'drv_config' directory [ 231.166844][ T6692] ? zone_statistics+0x170/0x170 [ 231.178217][ T6692] ? alloc_pages+0x452/0x560 [ 231.182851][ T6692] __vmalloc_node_range+0x4b1/0x8b0 [ 231.188221][ T6692] dup_task_struct+0x41a/0xbc0 [ 231.188933][ T6363] Could not create directory for event drv_config [ 231.193103][ T6692] ? copy_process+0x721/0x4250 [ 231.193127][ T6692] ? _raw_spin_unlock_irq+0x1f/0x40 [ 231.209862][ T6692] ? lockdep_hardirqs_on+0x94/0x140 [ 231.215110][ T6692] copy_process+0x721/0x4250 [ 231.219756][ T6692] ? __mutex_trylock_common+0x15c/0x260 [ 231.225376][ T6692] ? __pidfd_prepare+0x140/0x140 [ 231.230338][ T6363] Could not create tracefs 'drv_remove_interface' directory [ 231.230466][ T6692] ? __lock_acquire+0x7d40/0x7d40 [ 231.242796][ T6692] ? io_fallback_req_func+0x210/0x210 [ 231.248206][ T6692] ? io_fallback_req_func+0x210/0x210 [ 231.253612][ T6692] create_io_thread+0x111/0x180 [ 231.254725][ T6363] Could not create directory for event drv_remove_interface [ 231.258479][ T6692] ? __se_sys_io_uring_setup+0x19c9/0x2900 [ 231.258509][ T6692] ? copy_process+0x4250/0x4250 [ 231.276540][ T6692] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 231.282211][ T6692] ? io_fallback_req_func+0x210/0x210 [ 231.287635][ T6692] __se_sys_io_uring_setup+0x1d6e/0x2900 [ 231.293331][ T6692] ? __x64_sys_io_uring_setup+0x60/0x60 [ 231.298930][ T6692] ? lockdep_hardirqs_on+0x94/0x140 [ 231.304164][ T6692] do_syscall_64+0x4c/0xa0 [ 231.308606][ T6692] ? clear_bhb_loop+0x30/0x80 [ 231.313360][ T6692] ? clear_bhb_loop+0x30/0x80 [ 231.318089][ T6692] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 231.324026][ T6692] RIP: 0033:0x7fa970868b19 [ 231.327977][ T6363] Could not create tracefs 'drv_change_interface' directory [ 231.328464][ T6692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.328487][ T6692] RSP: 002b:00007fa96eabefb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 231.357139][ T6363] Could not create directory for event drv_change_interface [ 231.364062][ T6692] RAX: ffffffffffffffda RBX: 0000200000000680 RCX: 00007fa970868b19 [ 231.364083][ T6692] RDX: 0000200000000740 RSI: 0000200000000680 RDI: 0000000000000d00 [ 231.364098][ T6692] RBP: 00007fa970900b70 R08: 0000000000000000 R09: 0000000000000000 [ 231.364112][ T6692] R10: 0000200000000780 R11: 0000000000000206 R12: 0000200000000740 [ 231.364126][ T6692] R13: 0000200000000780 R14: 0000200000000700 R15: 00007ffc8e0ca218 [ 231.364156][ T6692] [ 231.374315][ T4996] bond0: now running without any active interface! [ 231.428674][ T4285] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.436847][ T4285] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 233.141487][ C1] ------------[ cut here ]------------ [ 233.142508][ T4279] Bluetooth: hci6: command 0x0409 tx timeout [ 233.147060][ C1] WARNING: CPU: 1 PID: 4996 at net/mac80211/tx.c:4883 __ieee80211_beacon_get+0x178a/0x1ff0 [ 233.163141][ C1] Modules linked in: [ 233.167107][ C1] CPU: 1 PID: 4996 Comm: kworker/u4:25 Not tainted syzkaller #0 [ 233.174800][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 233.176025][ T6363] Could not create tracefs 'drv_add_interface' directory [ 233.184930][ C1] Workqueue: events_unbound cfg80211_wiphy_work [ 233.184960][ C1] RIP: 0010:__ieee80211_beacon_get+0x178a/0x1ff0 [ 233.184985][ C1] Code: 1d f8 0f 0b 4f 89 64 2f 04 4f 89 64 2f 0c 43 c6 44 2f 14 f8 e9 19 fe ff ff e8 12 8f 1d f8 0f 0b e9 16 ef ff ff e8 06 8f 1d f8 <0f> 0b e9 7c f2 ff ff e8 ba ec 6d 00 89 d9 80 e1 07 80 c1 03 38 c1 [ 233.185002][ C1] RSP: 0018:ffffc90000dd08c0 EFLAGS: 00010246 [ 233.230744][ C1] RAX: ffffffff895b9e8a RBX: ffff8880775a9600 RCX: ffff8880284e9dc0 [ 233.238918][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 233.239557][ T6363] Could not create directory for event drv_add_interface [ 233.246962][ C1] RBP: ffffc90000dd0af8 R08: ffff8880284e9dc0 R09: 0000000000000003 [ 233.246981][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: f8f8f8f8f8f8f8f8 [ 233.246995][ C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920001ba128 [ 233.247009][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 233.247027][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 233.247042][ C1] CR2: 00007fb1ca3d458c CR3: 0000000024a27000 CR4: 00000000003506e0 [ 233.247062][ C1] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 233.247076][ C1] DR3: ffffffffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 233.247092][ C1] Call Trace: [ 233.247100][ C1] [ 233.247124][ C1] ? ieee80211_beacon_get_template+0x30/0x30 [ 233.247153][ C1] ? verify_lock_unused+0x140/0x140 [ 233.247178][ C1] ? verify_lock_unused+0x140/0x140 [ 233.247199][ C1] ? ieee80211_get_buffered_bc+0x75e/0x860 [ 233.247227][ C1] ? mark_lock+0x94/0x320 [ 233.247267][ C1] ieee80211_beacon_get_tim+0x48/0x840 [ 233.247296][ C1] mac80211_hwsim_beacon_tx+0x104/0x900 [ 233.247326][ C1] __iterate_interfaces+0x225/0x4c0 [ 233.247352][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 233.247377][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 233.247401][ C1] ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 [ 233.247429][ C1] mac80211_hwsim_beacon+0x9b/0x180 [ 233.247451][ C1] ? hw_scan_work+0xef0/0xef0 [ 233.247473][ C1] __hrtimer_run_queues+0x4ea/0xb60 [ 233.247517][ C1] ? hrtimer_interrupt+0x8b0/0x8b0 [ 233.247551][ C1] hrtimer_run_softirq+0x176/0x240 [ 233.247579][ C1] handle_softirqs+0x336/0x830 [ 233.247607][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 233.247632][ C1] ? do_softirq+0x210/0x210 [ 233.247658][ C1] ? hrtimer_interrupt+0x6a2/0x8b0 [ 233.247685][ C1] ? irqtime_account_irq+0xb2/0x1b0 [ 233.247712][ C1] __irq_exit_rcu+0x13b/0x230 [ 233.247732][ C1] ? irq_exit_rcu+0x20/0x20 [ 233.247765][ C1] irq_exit_rcu+0x5/0x20 [ 233.247783][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 233.247805][ C1] [ 233.247813][ C1] [ 233.247823][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 233.247845][ C1] RIP: 0010:unwind_next_frame+0xfb6/0x1cf0 [ 233.247869][ C1] Code: 33 01 00 00 49 89 f4 48 89 f5 4c 89 e8 48 29 e8 48 89 c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 7c 45 00 4c 89 f8 <48> c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 27 [ 233.247886][ C1] RSP: 0018:ffffc900039ef5d0 EFLAGS: 00000246 [ 233.331611][ T6363] Could not create tracefs 'drv_stop' directory [ 233.336409][ C1] [ 233.336419][ C1] RAX: ffffffff8ec9dd2c RBX: ffffc900039ef668 RCX: 0000000000000000 [ 233.336436][ C1] RDX: ffffffff8f5d3070 RSI: ffffffff8ec9dd2c RDI: ffffffff81351ed7 [ 233.336452][ C1] RBP: ffffffff8ec9dd2c R08: 0000000000000009 R09: 0000000000000005 [ 233.336466][ C1] R10: dffffc0000000000 R11: fffff5200073ded9 R12: ffffffff8ec9dd2c [ 233.336482][ C1] R13: ffffffff8ec9dd2c R14: ffffffff87e81376 R15: ffffffff8ec9dd2c [ 233.336499][ C1] ? skb_release_data+0x666/0x830 [ 233.336534][ C1] ? unwind_next_frame+0x97/0x1cf0 [ 233.342903][ T6363] Could not create directory for event drv_stop [ 233.347684][ C1] ? skb_release_data+0x667/0x830 [ 233.347709][ C1] ? stack_trace_save+0xf0/0xf0 [ 233.347728][ C1] arch_stack_walk+0x10c/0x140 [ 233.347754][ C1] ? skb_release_data+0x667/0x830 [ 233.347774][ C1] ? kfree+0xef/0x2a0 [ 233.347794][ C1] stack_trace_save+0xa6/0xf0 [ 233.347814][ C1] ? stack_trace_snprint+0xe0/0xe0 [ 233.347839][ C1] ? kfree+0xef/0x2a0 [ 233.347859][ C1] ? memset+0x1e/0x40 [ 233.347875][ C1] kasan_set_track+0x4b/0x70 [ 233.347895][ C1] ? kasan_set_track+0x4b/0x70 [ 233.347913][ C1] ? kasan_set_free_info+0x1f/0x40 [ 233.347935][ C1] ? ____kasan_slab_free+0xd5/0x110 [ 233.347955][ C1] ? slab_free_freelist_hook+0xec/0x170 [ 233.347975][ C1] ? kfree+0xef/0x2a0 [ 233.347992][ C1] ? skb_release_data+0x667/0x830 [ 233.348065][ C1] kasan_set_free_info+0x1f/0x40 [ 233.348088][ C1] ____kasan_slab_free+0xd5/0x110 [ 233.348112][ C1] slab_free_freelist_hook+0xec/0x170 [ 233.348137][ C1] ? skb_release_data+0x667/0x830 [ 233.348155][ C1] kfree+0xef/0x2a0 [ 233.348176][ C1] ? lock_chain_count+0x20/0x20 [ 233.348204][ C1] skb_release_data+0x667/0x830 [ 233.348229][ C1] ? skb_release_head_state+0x1e7/0x240 [ 233.348252][ C1] kfree_skb_reason+0xaf/0x110 [ 233.348275][ C1] ieee80211_iface_work+0x781/0xc50 [ 233.348300][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 233.348328][ C1] cfg80211_wiphy_work+0x224/0x260 [ 233.348356][ C1] process_one_work+0x867/0xff0 [ 233.348396][ C1] ? worker_detach_from_pool+0x240/0x240 [ 233.348417][ C1] ? lockdep_hardirqs_off+0x70/0x100 [ 233.348444][ C1] ? _raw_spin_lock_irq+0xb7/0xf0 [ 233.348464][ C1] ? _raw_spin_lock_irqsave+0x100/0x100 [ 233.348487][ C1] ? wq_worker_running+0x97/0x170 [ 233.407433][ T6363] Could not create tracefs 'drv_set_wakeup' directory [ 233.408946][ C1] worker_thread+0xad7/0x12a0 [ 233.451974][ T6363] Could not create directory for event drv_set_wakeup [ 233.452084][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 233.494530][ T6363] Could not create tracefs 'drv_resume' directory [ 233.495488][ C1] kthread+0x42e/0x520 [ 233.501494][ T6363] Could not create directory for event drv_resume [ 233.507766][ C1] ? rcu_lock_release+0x20/0x20 [ 233.507788][ C1] ? kthread_blkcg+0xd0/0xd0 [ 233.507810][ C1] ret_from_fork+0x1f/0x30 [ 233.507847][ C1] [ 233.507859][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 233.507870][ C1] CPU: 1 PID: 4996 Comm: kworker/u4:25 Not tainted syzkaller #0 [ 233.507890][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 233.507903][ C1] Workqueue: events_unbound cfg80211_wiphy_work [ 233.507927][ C1] Call Trace: [ 233.507934][ C1] [ 233.507942][ C1] dump_stack_lvl+0x188/0x250 [ 233.507967][ C1] ? show_regs_print_info+0x20/0x20 [ 233.507986][ C1] ? load_image+0x410/0x410 [ 233.584086][ T6363] Could not create tracefs 'drv_suspend' directory [ 233.586393][ C1] panic+0x2f8/0x850 [ 233.590484][ T6363] Could not create directory for event drv_suspend [ 233.595168][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 233.595200][ C1] ? ret_from_fork+0x1f/0x30 [ 233.595223][ C1] ? __ieee80211_beacon_get+0x178a/0x1ff0 [ 233.640618][ T6363] Could not create tracefs 'drv_get_et_stats' directory [ 233.642471][ C1] __warn+0x248/0x2b0 [ 233.670984][ T6363] Could not create directory for event drv_get_et_stats [ 233.671666][ C1] ? __ieee80211_beacon_get+0x178a/0x1ff0 [ 233.707839][ T6363] Could not create tracefs 'drv_get_et_sset_count' directory [ 233.713117][ C1] report_bug+0x1b9/0x2e0 [ 233.753820][ T6363] Could not create directory for event drv_get_et_sset_count [ 233.758432][ C1] handle_bug+0x3a/0x70 [ 233.758458][ C1] exc_invalid_op+0x16/0x40 [ 233.758476][ C1] asm_exc_invalid_op+0x16/0x20 [ 233.758495][ C1] RIP: 0010:__ieee80211_beacon_get+0x178a/0x1ff0 [ 233.758519][ C1] Code: 1d f8 0f 0b 4f 89 64 2f 04 4f 89 64 2f 0c 43 c6 44 2f 14 f8 e9 19 fe ff ff e8 12 8f 1d f8 0f 0b e9 16 ef ff ff e8 06 8f 1d f8 <0f> 0b e9 7c f2 ff ff e8 ba ec 6d 00 89 d9 80 e1 07 80 c1 03 38 c1 [ 233.758535][ C1] RSP: 0018:ffffc90000dd08c0 EFLAGS: 00010246 [ 233.758555][ C1] RAX: ffffffff895b9e8a RBX: ffff8880775a9600 RCX: ffff8880284e9dc0 [ 233.758570][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 233.758583][ C1] RBP: ffffc90000dd0af8 R08: ffff8880284e9dc0 R09: 0000000000000003 [ 233.758597][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: f8f8f8f8f8f8f8f8 [ 233.758610][ C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920001ba128 [ 233.758632][ C1] ? __ieee80211_beacon_get+0x178a/0x1ff0 [ 233.758673][ C1] ? ieee80211_beacon_get_template+0x30/0x30 [ 233.758695][ C1] ? verify_lock_unused+0x140/0x140 [ 233.758720][ C1] ? verify_lock_unused+0x140/0x140 [ 233.758744][ C1] ? ieee80211_get_buffered_bc+0x75e/0x860 [ 233.758772][ C1] ? mark_lock+0x94/0x320 [ 233.758811][ C1] ieee80211_beacon_get_tim+0x48/0x840 [ 233.758838][ C1] mac80211_hwsim_beacon_tx+0x104/0x900 [ 233.758869][ C1] __iterate_interfaces+0x225/0x4c0 [ 233.758892][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 233.758917][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 233.758940][ C1] ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 [ 233.758968][ C1] mac80211_hwsim_beacon+0x9b/0x180 [ 233.758989][ C1] ? hw_scan_work+0xef0/0xef0 [ 233.759010][ C1] __hrtimer_run_queues+0x4ea/0xb60 [ 233.759052][ C1] ? hrtimer_interrupt+0x8b0/0x8b0 [ 233.759085][ C1] hrtimer_run_softirq+0x176/0x240 [ 233.759120][ C1] handle_softirqs+0x336/0x830 [ 233.759146][ C1] ? __irq_exit_rcu+0x13b/0x230 [ 233.759167][ C1] ? do_softirq+0x210/0x210 [ 233.759183][ C1] ? hrtimer_interrupt+0x6a2/0x8b0 [ 233.759205][ C1] ? irqtime_account_irq+0xb2/0x1b0 [ 233.759228][ C1] __irq_exit_rcu+0x13b/0x230 [ 233.759247][ C1] ? irq_exit_rcu+0x20/0x20 [ 233.759279][ C1] irq_exit_rcu+0x5/0x20 [ 233.759295][ C1] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 233.759316][ C1] [ 233.759323][ C1] [ 233.759332][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 233.759352][ C1] RIP: 0010:unwind_next_frame+0xfb6/0x1cf0 [ 233.759375][ C1] Code: 33 01 00 00 49 89 f4 48 89 f5 4c 89 e8 48 29 e8 48 89 c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 4c 8d 7c 45 00 4c 89 f8 <48> c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 27 [ 233.812933][ T6363] Could not create tracefs 'drv_get_et_strings' directory [ 233.818239][ C1] RSP: 0018:ffffc900039ef5d0 EFLAGS: 00000246 [ 233.818265][ C1] RAX: ffffffff8ec9dd2c RBX: ffffc900039ef668 RCX: 0000000000000000 [ 233.818279][ C1] RDX: ffffffff8f5d3070 RSI: ffffffff8ec9dd2c RDI: ffffffff81351ed7 [ 233.818292][ C1] RBP: ffffffff8ec9dd2c R08: 0000000000000009 R09: 0000000000000005 [ 233.818304][ C1] R10: dffffc0000000000 R11: fffff5200073ded9 R12: ffffffff8ec9dd2c [ 233.818317][ C1] R13: ffffffff8ec9dd2c R14: ffffffff87e81376 R15: ffffffff8ec9dd2c [ 233.818333][ C1] ? skb_release_data+0x666/0x830 [ 233.818367][ C1] ? unwind_next_frame+0x97/0x1cf0 [ 233.818397][ C1] ? skb_release_data+0x667/0x830 [ 233.818420][ C1] ? stack_trace_save+0xf0/0xf0 [ 233.818440][ C1] arch_stack_walk+0x10c/0x140 [ 233.818468][ C1] ? skb_release_data+0x667/0x830 [ 233.818489][ C1] ? kfree+0xef/0x2a0 [ 233.818508][ C1] stack_trace_save+0xa6/0xf0 [ 233.818525][ C1] ? stack_trace_snprint+0xe0/0xe0 [ 233.818547][ C1] ? kfree+0xef/0x2a0 [ 233.873812][ T6363] Could not create directory for event drv_get_et_strings [ 233.877588][ C1] ? memset+0x1e/0x40 [ 233.937333][ T6363] Could not create tracefs 'drv_start' directory [ 233.940309][ C1] kasan_set_track+0x4b/0x70 [ 234.013814][ T6363] Could not create directory for event drv_start [ 234.017580][ C1] ? kasan_set_track+0x4b/0x70 [ 234.093394][ T6363] Could not create tracefs 'drv_return_u64' directory [ 234.094448][ C1] ? kasan_set_free_info+0x1f/0x40 [ 234.094479][ C1] ? ____kasan_slab_free+0xd5/0x110 [ 234.099593][ T6363] Could not create directory for event drv_return_u64 [ 234.104344][ C1] ? slab_free_freelist_hook+0xec/0x170 [ 234.104364][ C1] ? kfree+0xef/0x2a0 [ 234.104380][ C1] ? skb_release_data+0x667/0x830 [ 234.148860][ T6363] Could not create tracefs 'drv_return_u32' directory [ 234.149177][ C1] kasan_set_free_info+0x1f/0x40 [ 234.188440][ T6363] Could not create directory for event drv_return_u32 [ 234.193777][ C1] ____kasan_slab_free+0xd5/0x110 [ 234.193809][ C1] slab_free_freelist_hook+0xec/0x170 [ 234.222754][ T6363] Could not create tracefs 'drv_return_bool' directory [ 234.225854][ C1] ? skb_release_data+0x667/0x830 [ 234.225883][ C1] kfree+0xef/0x2a0 [ 234.225902][ C1] ? lock_chain_count+0x20/0x20 [ 234.225927][ C1] skb_release_data+0x667/0x830 [ 234.225950][ C1] ? skb_release_head_state+0x1e7/0x240 [ 234.225972][ C1] kfree_skb_reason+0xaf/0x110 [ 234.225994][ C1] ieee80211_iface_work+0x781/0xc50 [ 234.226016][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 234.226043][ C1] cfg80211_wiphy_work+0x224/0x260 [ 234.226070][ C1] process_one_work+0x867/0xff0 [ 234.226112][ C1] ? worker_detach_from_pool+0x240/0x240 [ 234.262775][ T6363] Could not create directory for event drv_return_bool [ 234.264025][ C1] ? lockdep_hardirqs_off+0x70/0x100 [ 234.264063][ C1] ? _raw_spin_lock_irq+0xb7/0xf0 [ 234.264085][ C1] ? _raw_spin_lock_irqsave+0x100/0x100 [ 234.333895][ T6363] Could not create tracefs 'drv_return_int' directory [ 234.339038][ C1] ? wq_worker_running+0x97/0x170 [ 234.368248][ T6363] Could not create directory for event drv_return_int [ 234.372148][ C1] worker_thread+0xad7/0x12a0 [ 234.372193][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 234.372232][ C1] kthread+0x42e/0x520 [ 234.372250][ C1] ? rcu_lock_release+0x20/0x20 [ 234.372267][ C1] ? kthread_blkcg+0xd0/0xd0 [ 234.372288][ C1] ret_from_fork+0x1f/0x30 [ 234.372323][ C1] [ 234.372413][ C1] Kernel Offset: disabled [ 234.522295][ C1] Rebooting in 86400 seconds..