last executing test programs: 2m35.46927121s ago: executing program 0 (id=215): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0x50, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x2e}, 0x3}}, 0x50}, 0x1, 0x0, 0x0, 0x40804}, 0x0) 2m35.14933421s ago: executing program 0 (id=218): setns(0xc9, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="60005080110001004abee339084eeef16f162471f40000000800030009ac0f00050002"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2m34.841351857s ago: executing program 0 (id=224): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x81, 0x2) ioctl$vim2m_VIDIOC_QUERYCAP(r0, 0x80685600, &(0x7f0000000200)) 2m34.577963947s ago: executing program 0 (id=227): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000001640)={@my=0x0}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000bc0)={&(0x7f0000000780)={{@host, 0x8}, {@my=0x0, 0x3}, 0x400, "2de770bc063bdaafb7daff13e09090fd732427cd043054ce14511103cda3f0dd8495ea093e0891b487cc78d1d5bf8903f8e743c7d1235699a8e4ec51ab6144fde32e71c8d34e68fd56b41b25ea8cf9b5c2ecd9cdeb9671c239512583dbfcf3b9c65d2f551319cc688398b21719cdc3f618c4e72f95c95ccfc6cd89970da0f6f348e00d43a88d6b30ed2afef3ddba3b1455e2415a924a6dd4e7bafce4d88dbb4ba999b57dcb2ed0a45a755f6805d2053ebc2934f19dda6396184532f86a44c8dced870a47287d5f27a988986fd295db88d1e9e630db86a0d51531754a862c3b7e6c5b243d7f0970b827f7d2756c49a3a0f668d9cd9948bc42a8b644d86247e08aa74a2e3449f3a17d3e77d771146f74e116159be6c2a75733252fe1ac0cd1beb843b32ad6dc69417ad4101d62ffb324f2a636320b5d6566085438d4c9c20cb3aace2cf927c284367f7d5b120dacd94f0a68b568a913268530ddc709bbcf18a8144f3f65517282476cffc494449784886c7fe2e34cb1baa48c7da2c2047e2c9a847004c4d0e1dfa5594863039b8782f4c6058f758426a23af5f2585616248f306517c70cef67edf01c632b2cb4b4c5972209f88ed74846c5b727b34b6a8a2367f4c8a5d6b2816e441477e3e3aead9609ef9649b1601bcc99ba2a91f6a6245d70f96e6ec42efc6f8905126b51c330838d52f9d1d88c10e27334be3b1867f43759839e4abd1e5835ca6ba90dbcb6d9b29eb1e82258e0b4479658a08bc955ca416b80216ec5db233ce377f09e2e50eb994407f2e37f2fbc654b2e958712f4df75d938fd3e52fb8c94c541c3f177fa6e21af5c83b1e30ad7ae5498d45645407719db7cf2d8716ee4eed63d0bdcdbea4b5f161b38770d6981c7505cbd10c862e888610c0169eb2155436f2b58f57398c30730936cb4cb95f337794d3e35b4affdcb80d7f4765848d28ea091a90e7d41a21d44f252f195f886d9b0296d88af08b0a77f5d7f384da1f015af494fd9cb64384e197fb8afd46b7bdd3d0ae2017bf04fa38a51cfa38d59ee86fd87e52884d4605f71c5dcb0c957796a4370c00f502a51ecce37ecaf4ea3bbe086cdaa1ea41e39fa7615acd33c5bf9bbcce3b0db0627faa28f8b38f369815d136f40e038fa9beaa6c93c69079fa162c312f8a865e8b47d2717b0631620fe392d1e722568fd7f3d8316cfa1d60ceb4348d66df708cada424fac56a6b2e62cfe792b9310acc859b0ecfaf1928ebf34163b21fb6cec89e7bc0a1759cf634de9d3c242246ddb72c7150d7a084334754886bb4bc3632dbf35a476b2febf65db8e1a2ab6f6a8504360894cd6e98d5c1f6b6f58be7d58b2c94c5a4b319431b742077bcd45afed02cd478c3914fe406284ff5c95a12ceb12dd4990d3d38a837d80b64b2136866de69d0373446a8fe14427b3fc297cefdf3b3fa86491c489"}, 0x418, 0x4}) 2m34.255397514s ago: executing program 0 (id=231): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x8031, 0xffffffffffffffff, 0xcb19f000) 2m32.29359126s ago: executing program 0 (id=246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002280)=ANY=[]) 2m31.260724081s ago: executing program 4 (id=260): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r0, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) 2m31.130754632s ago: executing program 1 (id=262): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r1, 0x1, 0x70bd25, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040}, 0x4000) 2m30.887183644s ago: executing program 4 (id=264): syz_emit_vhci(&(0x7f0000003040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x0, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_disconn_rsp={{0x7, 0xbd, 0x4}, {0x3, 0xfff4}}}}, 0x11) 2m30.79807328s ago: executing program 5 (id=265): setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newqdisc={0x24, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0xe, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 2m30.797833129s ago: executing program 2 (id=266): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') ioctl$NS_GET_USERNS(r0, 0x8004b709, 0x0) 2m30.631024112s ago: executing program 1 (id=268): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000380)={0x1d, r1, 0x2, {0x2, 0x0, 0x2}}, 0x18) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newtfilter={0x24, 0x11, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x74, r3, {0x7, 0xfffa}, {0x7, 0xffff}, {0x3, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x4008050) 2m30.54211422s ago: executing program 4 (id=269): r0 = socket(0x2b, 0x80801, 0x1) syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r0) 2m30.494022429s ago: executing program 5 (id=270): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) creat(0x0, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x0, &(0x7f0000002280)={0x0, 0x0, 0xfffffffe}, 0x0) mount$nfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x8402, &(0x7f0000000400)=ANY=[@ANYBLOB='nointr']) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) setns(0xc9, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000002c0)={'broute\x00', 0x0, 0x0, 0x0, [0x3, 0x7, 0x4, 0x1, 0x2, 0x7]}, &(0x7f0000000200)=0x2) 2m30.470223554s ago: executing program 2 (id=271): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket(0x40000000015, 0x5, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) 2m30.2775884s ago: executing program 3 (id=273): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000240)={0x0, 0x1a, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000680)={r3, 0x1fb, 0x0, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x7fdfffff, 0x0, 0x0, 0x4], [0x0, 0x1001000, 0x2], [0x100000002, 0x0, 0xfffffffffefffffc, 0x7]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f00000001c0)={0x0, 0x2000, 0x3ff, 0x34325241, 0x0, [r4, 0x0, 0x0, r5], [0xffffffff, 0x0, 0xfffffffd, 0x8000], [0x0, 0x1]}) 2m30.24564436s ago: executing program 4 (id=274): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r3, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r5 = socket(0x11, 0x80a, 0x1) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x40, 0x1040}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x4}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000c40)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv6={0x86dd, @icmpv6={0xa, 0x6, "e07e22", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0x31, '\x00', {0x9, 0x6, "ac0567", 0xc70, 0x87, 0x0, @private1, @private2}}}}}}}, 0x0) 2m29.965422949s ago: executing program 5 (id=275): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max']) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='devpts\x00', 0x0, &(0x7f0000000100)) 2m29.824735541s ago: executing program 2 (id=276): r0 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r0, &(0x7f0000000200)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg(r0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[{0x18, 0x110, 0x1, 'd'}], 0x18}, 0x0) 2m29.793386653s ago: executing program 1 (id=277): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x120, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1f8, 0xffffffff, 0xffffffff, 0x1f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x7, 0x4, 0x9}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x328) 2m29.637573903s ago: executing program 5 (id=278): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r0, &(0x7f0000000240)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0102}}}, 0x14) 2m29.600584434s ago: executing program 3 (id=279): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000540)=@polexpire={0xcc, 0x1b, 0x1, 0x70bd2d, 0x25dfdbfd, {{{@in6=@ipv4={'\x00', '\xff\xff', @local}, @in=@loopback, 0x4e23, 0xc98f, 0x4e22, 0xfff9, 0x2, 0x80, 0x80, 0x3a}, {0x4, 0x5, 0xd, 0x3, 0xc6e3, 0x80, 0xb, 0x6}, {0xffffffffffffffff, 0x6dc, 0xfffffffffffffff8, 0x2}, 0x7, 0x0, 0x2, 0x0, 0x1, 0x2}, 0x9}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x1, 0x6}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x10}, 0x40840) 2m29.470985832s ago: executing program 1 (id=280): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000280)={0x2, @pix={0x0, 0xfffffff9, 0x32314742, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x2}}) 2m29.401599773s ago: executing program 2 (id=281): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYRES16], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a30000000002c000000030a01040000000000000000020000000900010073797a30000000000900030073797a300000000090000000060a01240000000000000000020000000900010073797a30000000000900020073797a300000000064000480600001800b0001007461726765740000500002800e00010049444c4554494d45520000000800024000000001340003"], 0x104}}, 0x0) 2m29.401341866s ago: executing program 3 (id=282): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_QTHRESHOLD={0x6, 0x4, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000600)={0x20, 0x7, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20040000}, 0x40000800) 2m29.331575884s ago: executing program 4 (id=283): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x113241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r1, 0xf501, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000001640)={@my=0x0}) ioctl$VIDIOC_G_DV_TIMINGS(0xffffffffffffffff, 0xc0845658, &(0x7f0000000600)={0x0, @bt={0x1, 0x8, 0x0, 0x3, 0x5, 0x8, 0xfffffff9, 0x5fba, 0x0, 0x80000001, 0x0, 0x3, 0x1, 0x4f232fad, 0x6, 0x20, {0x7800000}, 0xe, 0xa3}}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000000)={r3, 0x6a, "1d5e0751dcfa7ed9b6f4e8f24a04d5d6bccb4cc6405923884617da4689174a85d3e5161e5a816e62513b7310a23ff8fa27d718b8429a0088b1cdeb854186933a2c479d11021951ed222b76347edc5d8f374a3b7993a8accac7635078aba7ea010767b48a77b5eef9d7a0"}, &(0x7f0000000100)=0x72) 2m29.323307955s ago: executing program 5 (id=284): r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x121682, 0x0) read$nci(r0, &(0x7f0000000100)=""/107, 0x6b) pwritev(r0, &(0x7f0000000480)=[{&(0x7f0000000040)="10", 0x1}], 0x1, 0x6, 0x5) 2m29.193388746s ago: executing program 1 (id=285): sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x44, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x800, 0x4e}}}}, [@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x8808}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040005}, 0x400c810) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000400000008"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000040)=r0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000400)={r2, &(0x7f0000000240), 0x0}, 0x20) 2m29.193087787s ago: executing program 3 (id=286): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r0, 0x8008330e, 0x0) 2m29.192636002s ago: executing program 2 (id=287): set_mempolicy(0x1, &(0x7f0000000000)=0xffffffffffffffff, 0x6) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) 2m29.002437336s ago: executing program 3 (id=288): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) link(0x0, 0x0) open(&(0x7f0000000100)='./proc\x00', 0x2c2140, 0x22) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0x20, 0x41, 0x107, 0xfffffffa, 0x25dfdbfe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x4, 0x1}, @nested={0x4, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 2m28.907403767s ago: executing program 4 (id=289): r0 = syz_open_dev$mtd(&(0x7f0000000b80), 0x769a59cc, 0x0) ioctl$MEMGETOOBSEL(r0, 0x80c84d0a, 0x0) 2m28.756675015s ago: executing program 5 (id=290): symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00') io_uring_enter(0xffffffffffffffff, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file3\x00', &(0x7f0000000080)={0x8080, 0x0, 0x30}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write$vga_arbiter(r0, &(0x7f00000000c0)=@other={'lock', ' ', 'none'}, 0xa) 2m28.756337531s ago: executing program 1 (id=291): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x28, r1, 0x401, 0x70bd2b, 0x40024, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xc6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x44040800}, 0x0) 2m28.472340912s ago: executing program 3 (id=292): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$PPPIOCSACTIVE(r0, 0x40107446, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) 2m28.382610055s ago: executing program 2 (id=293): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000000)={&(0x7f0000002180)="c9b8bc", 0x3}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) openat(0xffffffffffffff9c, 0x0, 0x102, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$vim2m(0x0, 0x3, 0x2) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0xc010) 1m47.541855561s ago: executing program 32 (id=246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3000001, 0x11, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002280)=ANY=[]) 1m17.118471313s ago: executing program 33 (id=291): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x28, r1, 0x401, 0x70bd2b, 0x40024, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xc6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x44040800}, 0x0) 37.049202671s ago: executing program 34 (id=293): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000000000)={&(0x7f0000002180)="c9b8bc", 0x3}) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) openat(0xffffffffffffff9c, 0x0, 0x102, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$vim2m(0x0, 0x3, 0x2) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0xc010) 0s ago: executing program 35 (id=292): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$PPPIOCSACTIVE(r0, 0x40107446, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r1, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.74' (ED25519) to the list of known hosts. [ 78.161316][ T5601] cgroup: Unknown subsys name 'net' [ 78.291649][ T5601] cgroup: Unknown subsys name 'cpuset' [ 78.300734][ T5601] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.793165][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.401391][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.427873][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.428499][ T5629] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.436732][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.437079][ T5629] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 82.438900][ T5632] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.440000][ T5629] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 82.440305][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.440869][ T5633] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.441044][ T5634] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.447584][ T5632] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.448013][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.448401][ T5632] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.449048][ T5633] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.453272][ T5633] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.453801][ T5633] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 82.454152][ T5633] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.454495][ T5633] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.457527][ T5632] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.457862][ T5632] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.458188][ T5632] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.458541][ T5632] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 82.459994][ T5632] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.461889][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 82.462780][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 82.463382][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.464837][ T5632] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.485678][ T5618] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.495543][ T5618] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.515263][ T5622] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.499805][ T5625] Bluetooth: hci4: command tx timeout [ 84.499949][ T5625] Bluetooth: hci5: command tx timeout [ 84.500286][ T5628] Bluetooth: hci1: command tx timeout [ 84.577631][ T5622] Bluetooth: hci0: command tx timeout [ 84.577778][ T5622] Bluetooth: hci2: command tx timeout [ 84.578044][ T5628] Bluetooth: hci3: command tx timeout [ 84.828788][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.829582][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.829743][ T5617] bridge_slave_0: entered allmulticast mode [ 84.831844][ T5617] bridge_slave_0: entered promiscuous mode [ 84.871785][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.871959][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.872099][ T5617] bridge_slave_1: entered allmulticast mode [ 84.874073][ T5617] bridge_slave_1: entered promiscuous mode [ 84.906883][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.907021][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.907159][ T5615] bridge_slave_0: entered allmulticast mode [ 84.909732][ T5615] bridge_slave_0: entered promiscuous mode [ 84.913359][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.913535][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.913955][ T5615] bridge_slave_1: entered allmulticast mode [ 84.915996][ T5615] bridge_slave_1: entered promiscuous mode [ 85.099016][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.102891][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.148345][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.152252][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.193827][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.195357][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.195816][ T5612] bridge_slave_0: entered allmulticast mode [ 85.197991][ T5612] bridge_slave_0: entered promiscuous mode [ 85.250040][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.250180][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.250325][ T5613] bridge_slave_0: entered allmulticast mode [ 85.252419][ T5613] bridge_slave_0: entered promiscuous mode [ 85.257220][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.257899][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.258043][ T5613] bridge_slave_1: entered allmulticast mode [ 85.260276][ T5613] bridge_slave_1: entered promiscuous mode [ 85.269443][ T5617] team0: Port device team_slave_0 added [ 85.272594][ T5617] team0: Port device team_slave_1 added [ 85.272800][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.272909][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.274078][ T5612] bridge_slave_1: entered allmulticast mode [ 85.276786][ T5612] bridge_slave_1: entered promiscuous mode [ 85.360866][ T5615] team0: Port device team_slave_0 added [ 85.426379][ T5615] team0: Port device team_slave_1 added [ 85.454591][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.454853][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.456222][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.456361][ T5616] bridge_slave_0: entered allmulticast mode [ 85.465653][ T5616] bridge_slave_0: entered promiscuous mode [ 85.468917][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.469026][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.469737][ T5616] bridge_slave_1: entered allmulticast mode [ 85.471993][ T5616] bridge_slave_1: entered promiscuous mode [ 85.474617][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.474727][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.474858][ T5614] bridge_slave_0: entered allmulticast mode [ 85.477045][ T5614] bridge_slave_0: entered promiscuous mode [ 85.485346][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.502689][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.502705][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.502736][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.507020][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.507036][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.507066][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.511699][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.528374][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.528491][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.528633][ T5614] bridge_slave_1: entered allmulticast mode [ 85.532425][ T5614] bridge_slave_1: entered promiscuous mode [ 85.541487][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.542235][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.542249][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.542294][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.629698][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.629718][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.629749][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.690881][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.694830][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.727804][ T5613] team0: Port device team_slave_0 added [ 85.748145][ T5612] team0: Port device team_slave_0 added [ 85.769779][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.774621][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.796232][ T5613] team0: Port device team_slave_1 added [ 85.828707][ T5612] team0: Port device team_slave_1 added [ 85.883610][ T5617] hsr_slave_0: entered promiscuous mode [ 85.884860][ T5617] hsr_slave_1: entered promiscuous mode [ 85.902640][ T5616] team0: Port device team_slave_0 added [ 85.922382][ T5615] hsr_slave_0: entered promiscuous mode [ 85.923564][ T5615] hsr_slave_1: entered promiscuous mode [ 85.924364][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 85.924443][ T5615] Cannot create hsr debugfs directory [ 85.960591][ T5616] team0: Port device team_slave_1 added [ 85.963272][ T5614] team0: Port device team_slave_0 added [ 85.966939][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.966955][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.966985][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.985462][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.985480][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.985510][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.006305][ T5614] team0: Port device team_slave_1 added [ 86.022502][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.022519][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.022549][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.027426][ T9] cfg80211: failed to load regulatory.db [ 86.037149][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.037165][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.037196][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.159323][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.159343][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.159373][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.230779][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.230826][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.230857][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.232359][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.232374][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.232404][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.292608][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.292628][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.292660][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.360187][ T5613] hsr_slave_0: entered promiscuous mode [ 86.361346][ T5613] hsr_slave_1: entered promiscuous mode [ 86.362190][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 86.362211][ T5613] Cannot create hsr debugfs directory [ 86.415269][ T5612] hsr_slave_0: entered promiscuous mode [ 86.416795][ T5612] hsr_slave_1: entered promiscuous mode [ 86.417936][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 86.417957][ T5612] Cannot create hsr debugfs directory [ 86.578810][ T5625] Bluetooth: hci5: command tx timeout [ 86.578878][ T5625] Bluetooth: hci4: command tx timeout [ 86.589855][ T5628] Bluetooth: hci1: command tx timeout [ 86.615924][ T5616] hsr_slave_0: entered promiscuous mode [ 86.616988][ T5616] hsr_slave_1: entered promiscuous mode [ 86.618323][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 86.618343][ T5616] Cannot create hsr debugfs directory [ 86.657531][ T5622] Bluetooth: hci2: command tx timeout [ 86.657578][ T5622] Bluetooth: hci0: command tx timeout [ 86.668515][ T5628] Bluetooth: hci3: command tx timeout [ 86.720988][ T5614] hsr_slave_0: entered promiscuous mode [ 86.722107][ T5614] hsr_slave_1: entered promiscuous mode [ 86.722890][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 86.722909][ T5614] Cannot create hsr debugfs directory [ 87.032168][ T5615] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.043907][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.044983][ T5615] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.055601][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.096408][ T5615] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.106142][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.107185][ T5615] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.118553][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.279469][ T5617] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.290278][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.292327][ T5617] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.303237][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.309695][ T5617] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.316503][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.332113][ T5617] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.343357][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.417356][ T5612] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.426991][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.429885][ T5612] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.439467][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.447723][ T5612] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.455153][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.456046][ T5612] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.461287][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.580843][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.604862][ T5613] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.614410][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.616925][ T5613] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.624975][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.630939][ T5613] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.643324][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.665246][ T5613] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.675430][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.730818][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.775054][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.775184][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.778266][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.778388][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.806258][ T5616] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 87.817047][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.818903][ T5616] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 87.828951][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.845907][ T5616] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 87.850806][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.851864][ T5616] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 87.856597][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.949304][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.959319][ T5614] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 87.969727][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.971473][ T5614] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 87.980853][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.998632][ T5614] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 88.011219][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.032652][ T5614] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 88.043148][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.086015][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.110750][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.139061][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.166100][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.166219][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.215074][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.215202][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.218561][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.218663][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.287019][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.309581][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.309706][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.435405][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.504014][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.504149][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.583250][ T3343] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.583379][ T3343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.656347][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.663532][ T5625] Bluetooth: hci4: command tx timeout [ 88.663563][ T5625] Bluetooth: hci5: command tx timeout [ 88.663691][ T5628] Bluetooth: hci1: command tx timeout [ 88.746813][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.747438][ T5628] Bluetooth: hci3: command tx timeout [ 88.747756][ T5628] Bluetooth: hci0: command tx timeout [ 88.747792][ T5628] Bluetooth: hci2: command tx timeout [ 88.789510][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.822749][ T3343] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.822906][ T3343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.892907][ T3343] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.893067][ T3343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.924946][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.984057][ T3343] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.984189][ T3343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.040972][ T3343] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.041108][ T3343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.142408][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.423874][ T5615] veth0_vlan: entered promiscuous mode [ 89.476373][ T5615] veth1_vlan: entered promiscuous mode [ 89.640535][ T5615] veth0_macvtap: entered promiscuous mode [ 89.660059][ T5615] veth1_macvtap: entered promiscuous mode [ 89.770429][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.834251][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.895809][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.913660][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.177256][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.186094][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.246237][ T5617] veth0_vlan: entered promiscuous mode [ 90.298184][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.298322][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.298388][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.298616][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.318702][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.343964][ T5612] veth0_vlan: entered promiscuous mode [ 90.371033][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.371080][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.381877][ T5612] veth1_vlan: entered promiscuous mode [ 90.401873][ T5617] veth1_vlan: entered promiscuous mode [ 90.508042][ T5615] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 90.526169][ T5612] veth0_macvtap: entered promiscuous mode [ 90.584394][ T5612] veth1_macvtap: entered promiscuous mode [ 90.618585][ T5617] veth0_macvtap: entered promiscuous mode [ 90.643062][ T5617] veth1_macvtap: entered promiscuous mode [ 90.715221][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.729661][ T5613] veth0_vlan: entered promiscuous mode [ 90.738045][ T5622] Bluetooth: hci1: command tx timeout [ 90.739018][ T5622] Bluetooth: hci5: command tx timeout [ 90.739053][ T5622] Bluetooth: hci4: command tx timeout [ 90.748262][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.813430][ T5613] veth1_vlan: entered promiscuous mode [ 90.826502][ T5628] Bluetooth: hci2: command tx timeout [ 90.826538][ T5628] Bluetooth: hci0: command tx timeout [ 90.826565][ T5628] Bluetooth: hci3: command tx timeout [ 90.862658][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.876681][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.878253][ T113] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.878371][ T113] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.878415][ T113] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.878457][ T113] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.906130][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.951918][ T5841] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7'. [ 90.971092][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.107908][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.110573][ T3343] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.110624][ T3343] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.110667][ T3343] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.300065][ T5613] veth0_macvtap: entered promiscuous mode [ 91.324174][ T2340] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.324221][ T2340] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.345442][ T5613] veth1_macvtap: entered promiscuous mode [ 91.446325][ T3319] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.454387][ T3319] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.515128][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.515175][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.576242][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.662964][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.717266][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.718854][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.768153][ T2340] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.769420][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.769696][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.770646][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.226460][ T113] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.234852][ T113] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.245537][ T5616] veth0_vlan: entered promiscuous mode [ 92.256119][ T5614] veth0_vlan: entered promiscuous mode [ 92.273649][ T113] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.284447][ T113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.323034][ T5614] veth1_vlan: entered promiscuous mode [ 92.359624][ T5616] veth1_vlan: entered promiscuous mode [ 92.600707][ T5616] veth0_macvtap: entered promiscuous mode [ 92.626399][ T5616] veth1_macvtap: entered promiscuous mode [ 92.721476][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.752828][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.800190][ T5867] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1'. [ 92.819460][ T3343] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.967449][ T113] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.967625][ T113] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.978826][ T2340] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.096430][ T5614] veth0_macvtap: entered promiscuous mode [ 93.118680][ T5614] veth1_macvtap: entered promiscuous mode [ 93.278337][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.392736][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.402666][ T2340] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.402687][ T2340] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.563240][ T5887] netlink: 40 bytes leftover after parsing attributes in process `syz.2.15'. [ 93.960058][ T3343] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.960975][ T3343] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.960993][ T3343] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.961141][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.961830][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.977791][ T3343] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.663698][ T5902] Zero length message leads to an empty skb [ 94.843154][ T5754] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 94.857589][ T5620] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 94.929974][ T2340] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.930027][ T2340] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.978001][ T5754] usb 3-1: device descriptor read/64, error -71 [ 95.017789][ T5620] usb 1-1: Using ep0 maxpacket: 8 [ 95.024540][ T5620] usb 1-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 95.043133][ T5620] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.043178][ T5620] usb 1-1: Product: syz [ 95.043213][ T5620] usb 1-1: Manufacturer: syz [ 95.043237][ T5620] usb 1-1: SerialNumber: syz [ 95.085130][ T5620] usb 1-1: config 0 descriptor?? [ 95.098270][ T5620] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 95.111100][ T2340] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.119421][ T2340] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.217529][ T5754] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 95.276764][ T5915] netlink: 68 bytes leftover after parsing attributes in process `syz.5.25'. [ 95.348947][ T5754] usb 3-1: device descriptor read/64, error -71 [ 95.460099][ T5754] usb usb3-port1: attempt power cycle [ 95.797724][ T5754] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 95.818459][ T9] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 95.820248][ T5754] usb 3-1: device descriptor read/8, error -71 [ 95.978823][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 95.981020][ T9] usb 6-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 95.986707][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.986733][ T9] usb 6-1: Product: syz [ 95.986751][ T9] usb 6-1: Manufacturer: syz [ 95.986768][ T9] usb 6-1: SerialNumber: syz [ 95.993340][ T9] usb 6-1: config 0 descriptor?? [ 96.010359][ T9] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 96.057452][ T5754] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 96.081820][ T5754] usb 3-1: device descriptor read/8, error -71 [ 96.189969][ T5754] usb usb3-port1: unable to enumerate USB device [ 96.208742][ T30] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 96.221995][ T5775] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.367670][ T5775] usb 4-1: Using ep0 maxpacket: 16 [ 96.371200][ T5775] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 96.372772][ T5775] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.372798][ T5775] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 96.378044][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.378072][ T5775] usb 4-1: Product: syz [ 96.378089][ T5775] usb 4-1: Manufacturer: syz [ 96.378106][ T5775] usb 4-1: SerialNumber: syz [ 96.406296][ T30] usb 2-1: Using ep0 maxpacket: 8 [ 96.428906][ T5775] usb 4-1: 0:2 : does not exist [ 96.440625][ T30] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 96.451422][ T30] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 96.463467][ T30] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 96.463495][ T30] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 96.463531][ T30] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.463580][ T30] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.508222][ T5782] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 96.604973][ T5775] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 96.668266][ T5782] usb 5-1: Using ep0 maxpacket: 8 [ 96.675344][ T5782] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 96.689558][ T30] usb 2-1: GET_CAPABILITIES returned 0 [ 96.689625][ T30] usbtmc 2-1:16.0: can't read capabilities [ 96.695384][ T5775] usb 4-1: USB disconnect, device number 2 [ 96.716581][ T5782] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.716628][ T5782] usb 5-1: Product: syz [ 96.716707][ T5782] usb 5-1: Manufacturer: syz [ 96.716732][ T5782] usb 5-1: SerialNumber: syz [ 96.759481][ T5782] usb 5-1: config 0 descriptor?? [ 96.778078][ T5782] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 96.826565][ T5926] udevd[5926]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 96.896687][ T5791] usb 2-1: USB disconnect, device number 2 [ 96.974743][ T5620] gspca_sonixj: reg_r err -32 [ 97.008316][ T5620] sonixj 1-1:0.0: probe with driver sonixj failed with error -32 [ 97.231923][ T9] gspca_ov534_9: reg_w failed -71 [ 97.347358][ T25] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 97.447467][ T5620] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 97.517929][ T25] usb 3-1: Using ep0 maxpacket: 8 [ 97.518379][ T9] gspca_ov534_9: Unknown sensor 0000 [ 97.518465][ T9] ov534_9 6-1:0.0: probe with driver ov534_9 failed with error -22 [ 97.530373][ T25] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 97.530574][ T9] usb 6-1: USB disconnect, device number 2 [ 97.565744][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.574742][ T25] usb 3-1: Product: syz [ 97.580584][ T25] usb 3-1: Manufacturer: syz [ 97.580629][ T25] usb 3-1: SerialNumber: syz [ 97.597100][ T25] usb 3-1: config 0 descriptor?? [ 97.602643][ T5782] gspca_sonixj: reg_r err -32 [ 97.607700][ T5620] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 97.607908][ T5782] sonixj 5-1:0.0: probe with driver sonixj failed with error -32 [ 97.630666][ T5620] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 97.630814][ T5620] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 97.630851][ T5620] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 97.630887][ T5620] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 97.630967][ T5620] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.697636][ T25] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 98.033445][ T5620] usb 1-1: USB disconnect, device number 2 [ 98.482750][ T25] gspca_sonixj: reg_r err -32 [ 98.482854][ T25] sonixj 3-1:0.0: probe with driver sonixj failed with error -32 [ 98.750731][ T5965] FAULT_INJECTION: forcing a failure. [ 98.750731][ T5965] name failslab, interval 1, probability 0, space 0, times 1 [ 98.770757][ T5965] CPU: 1 UID: 0 PID: 5965 Comm: syz.0.46 Tainted: G L syzkaller #0 PREEMPT(full) [ 98.770800][ T5965] Tainted: [L]=SOFTLOCKUP [ 98.770810][ T5965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 98.770826][ T5965] Call Trace: [ 98.770836][ T5965] [ 98.770847][ T5965] dump_stack_lvl+0xe8/0x150 [ 98.770890][ T5965] should_fail_ex+0x410/0x560 [ 98.770938][ T5965] should_failslab+0xa8/0x100 [ 98.770973][ T5965] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 98.771023][ T5965] ? alloc_inode+0xb8/0x1b0 [ 98.771054][ T5965] ? alloc_inode+0xb8/0x1b0 [ 98.771086][ T5965] ? find_inode_fast+0xd2/0x740 [ 98.771127][ T5965] alloc_inode+0xb8/0x1b0 [ 98.771161][ T5965] iget_locked+0x131/0x6a0 [ 98.771205][ T5965] kernfs_get_inode+0x4f/0x770 [ 98.771250][ T5965] kernfs_get_tree+0x5cd/0x980 [ 98.771286][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771325][ T5965] ? __pfx_kernfs_get_tree+0x10/0x10 [ 98.771363][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771393][ T5965] ? apparmor_capable+0x126/0x170 [ 98.771431][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771461][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771497][ T5965] vfs_get_tree+0x92/0x2a0 [ 98.771541][ T5965] do_new_mount+0x319/0xdc0 [ 98.771575][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771611][ T5965] ? __pfx_do_new_mount+0x10/0x10 [ 98.771647][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771677][ T5965] ? ns_capable+0x89/0xe0 [ 98.771714][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771744][ T5965] ? path_mount+0x647/0x1050 [ 98.771781][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771811][ T5965] ? user_path_at+0xd4/0x160 [ 98.771852][ T5965] __se_sys_mount+0x31d/0x420 [ 98.771894][ T5965] ? __pfx___se_sys_mount+0x10/0x10 [ 98.771939][ T5965] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.771969][ T5965] ? __x64_sys_mount+0x20/0xc0 [ 98.772007][ T5965] do_syscall_64+0x166/0x520 [ 98.772035][ T5965] ? trace_irq_disable+0x3b/0x140 [ 98.772061][ T5965] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.772095][ T5965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.772122][ T5965] RIP: 0033:0x7f5db119e159 [ 98.772146][ T5965] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.772167][ T5965] RSP: 002b:00007f5db2134028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 98.772194][ T5965] RAX: ffffffffffffffda RBX: 00007f5db1425fa0 RCX: 00007f5db119e159 [ 98.772214][ T5965] RDX: 0000200000000600 RSI: 0000200000000400 RDI: 0000000000000000 [ 98.772231][ T5965] RBP: 00007f5db1235024 R08: 0000000000000000 R09: 0000000000000000 [ 98.772248][ T5965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.772263][ T5965] R13: 00007f5db1426038 R14: 00007f5db1425fa0 R15: 00007ffe20685538 [ 98.772303][ T5965] [ 99.286202][ T5620] usb 5-1: USB disconnect, device number 2 [ 99.884300][ T5989] x_tables: duplicate underflow at hook 3 [ 101.369768][ T10] usb 3-1: USB disconnect, device number 6 [ 102.843020][ T10] usb 4-1: USB disconnect, device number 3 [ 103.097400][ T5791] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 103.125403][ T6005] netlink: 8 bytes leftover after parsing attributes in process `syz.5.56'. [ 103.134343][ T5775] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 103.267486][ T5775] usb 1-1: device descriptor read/64, error -71 [ 103.271927][ T5791] usb 3-1: Using ep0 maxpacket: 32 [ 103.272826][ T5791] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 103.273970][ T5791] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 103.273994][ T5791] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 103.278255][ T5791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.278281][ T5791] usb 3-1: Product: syz [ 103.278298][ T5791] usb 3-1: Manufacturer: syz [ 103.278316][ T5791] usb 3-1: SerialNumber: syz [ 103.283507][ T5791] usb 3-1: config 0 descriptor?? [ 103.287659][ T5620] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 103.381353][ T6009] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 103.447572][ T5620] usb 2-1: Using ep0 maxpacket: 32 [ 103.448524][ T5620] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 103.449840][ T5620] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 103.449866][ T5620] usb 2-1: config 0 has no interface number 0 [ 103.449911][ T5620] usb 2-1: config 0 interface 12 has no altsetting 0 [ 103.457061][ T5620] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.457090][ T5620] usb 2-1: Product: syz [ 103.457108][ T5620] usb 2-1: Manufacturer: syz [ 103.457125][ T5620] usb 2-1: SerialNumber: syz [ 103.463637][ T5620] usb 2-1: config 0 descriptor?? [ 103.501077][ T5791] usb 3-1: USB disconnect, device number 7 [ 103.577407][ T5775] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 103.707357][ T5775] usb 1-1: device descriptor read/64, error -71 [ 103.818649][ T5775] usb usb1-port1: attempt power cycle [ 104.182633][ T5775] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 104.208551][ T5775] usb 1-1: device descriptor read/8, error -71 [ 104.465449][ T5775] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 104.488322][ T5775] usb 1-1: device descriptor read/8, error -71 [ 104.533278][ T5620] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 104.533363][ T5620] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 104.533517][ T5620] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 104.533604][ T5620] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 104.563598][ T5620] usb 2-1: USB disconnect, device number 3 [ 104.607757][ T5775] usb usb1-port1: unable to enumerate USB device [ 105.320878][ T6040] loop5: detected capacity change from 0 to 256 [ 105.337025][ T6040] ======================================================= [ 105.337025][ T6040] WARNING: The mand mount option has been deprecated and [ 105.337025][ T6040] and is ignored by this kernel. Remove the mand [ 105.337025][ T6040] option from the mount to silence this warning. [ 105.337025][ T6040] ======================================================= [ 107.694392][ T6090] loop0: detected capacity change from 0 to 32768 [ 108.120256][ T6102] loop4: detected capacity change from 0 to 256 [ 108.172954][ T31] audit: type=1804 audit(1788719085.328:2): pid=6102 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.96" name="/newroot/9/file1/bus" dev="loop4" ino=1048610 res=1 errno=0 [ 109.353439][ T6144] loop4: detected capacity change from 0 to 128 [ 109.523765][ T6144] syz.4.115 uses obsolete (PF_INET,SOCK_PACKET) [ 110.464884][ T6169] netlink: 'syz.4.127': attribute type 9 has an invalid length. [ 111.034916][ T6182] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 111.035199][ T6182] CIFS: Attempting to mount //127.0.0.1/share [ 111.051495][ T6182] CIFS: VFS: Error connecting to socket. Aborting operation. [ 111.051593][ T6182] CIFS: VFS: cifs_mount failed w/return code = -111 [ 111.393095][ T6189] usb usb7: usbfs: process 6189 (syz.5.133) did not claim interface 0 before use [ 111.965703][ T6204] netlink: 20 bytes leftover after parsing attributes in process `syz.4.141'. [ 112.373836][ T6211] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 112.373891][ T6211] overlayfs: failed to set xattr on upper [ 112.373922][ T6211] overlayfs: ...falling back to redirect_dir=nofollow. [ 112.373931][ T6211] overlayfs: ...falling back to index=off. [ 112.373939][ T6211] overlayfs: ...falling back to uuid=null. [ 113.005398][ T6230] fuse: root generation should be zero [ 113.391324][ T6241] mmap: syz.4.157 (6241) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 113.685097][ T6250] netlink: 4 bytes leftover after parsing attributes in process `syz.0.161'. [ 114.328506][ T5620] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 114.487775][ T5620] usb 2-1: Using ep0 maxpacket: 8 [ 114.493548][ T5620] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 114.505492][ T5620] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 114.505547][ T5620] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 114.505593][ T5620] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 114.505645][ T5620] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.563904][ T5620] usbtmc 2-1:16.0: bulk endpoints not found [ 115.408986][ T6293] netlink: 44 bytes leftover after parsing attributes in process `syz.3.179'. [ 115.738361][ T6304] program syz.3.182 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 115.746695][ T6306] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 116.488259][ T6321] syzkaller0: entered promiscuous mode [ 116.488306][ T6321] syzkaller0: entered allmulticast mode [ 116.816663][ T6326] netlink: 44 bytes leftover after parsing attributes in process `syz.0.191'. [ 117.079744][ T6337] Bluetooth: MGMT ver 1.23 [ 117.145011][ T10] usb 2-1: USB disconnect, device number 4 [ 117.301219][ T6340] tmpfs: Group quota block hardlimit too large. [ 118.310226][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310282][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310329][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310359][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310388][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310418][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310448][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310477][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310508][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.310544][ T5620] hid-generic 0005:0C45:0005.0001: unknown main item tag 0x0 [ 118.396029][ T5620] hid-generic 0005:0C45:0005.0001: hidraw0: BLUETOOTH HID v0.05 Device [syz0] on aa:aa:aa:aa:aa:aa [ 118.700122][ T6378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.213'. [ 119.050613][ T6391] netlink: 56 bytes leftover after parsing attributes in process `syz.0.218'. [ 119.518367][ T5620] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 119.669805][ T5620] usb 5-1: Using ep0 maxpacket: 8 [ 119.675690][ T5620] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 119.686760][ T5620] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 119.686830][ T5620] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 119.686874][ T5620] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 119.686909][ T5620] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 119.686944][ T5620] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 119.686995][ T5620] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.728195][ T6420] FAULT_INJECTION: forcing a failure. [ 119.728195][ T6420] name failslab, interval 1, probability 0, space 0, times 0 [ 119.728231][ T6420] CPU: 0 UID: 0 PID: 6420 Comm: syz.1.230 Tainted: G L syzkaller #0 PREEMPT(full) [ 119.728265][ T6420] Tainted: [L]=SOFTLOCKUP [ 119.728274][ T6420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 119.728289][ T6420] Call Trace: [ 119.728299][ T6420] [ 119.728310][ T6420] dump_stack_lvl+0xe8/0x150 [ 119.728353][ T6420] should_fail_ex+0x410/0x560 [ 119.728399][ T6420] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 119.728436][ T6420] should_failslab+0xa8/0x100 [ 119.728469][ T6420] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 119.728504][ T6420] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 119.728542][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.728575][ T6420] ? alloc_inode+0x6a/0x1b0 [ 119.728605][ T6420] ? alloc_inode+0x6a/0x1b0 [ 119.728637][ T6420] ? __pfx_simple_start_creating+0x10/0x10 [ 119.728680][ T6420] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 119.728716][ T6420] alloc_inode+0x6a/0x1b0 [ 119.728749][ T6420] new_inode+0x1f/0x170 [ 119.728788][ T6420] debugfs_create_symlink+0x9d/0x1c0 [ 119.728830][ T6420] ref_tracker_dir_symlink+0x25f/0x440 [ 119.728868][ T6420] ? __pfx_ref_tracker_dir_symlink+0x10/0x10 [ 119.728926][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.728956][ T6420] ? __lock_acquire+0x6df/0x2e50 [ 119.728985][ T6420] ? kfree+0x4d/0x650 [ 119.729025][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.729060][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.729089][ T6420] ? ida_alloc_range+0x82e/0x870 [ 119.729121][ T6420] net_ns_net_init+0xad/0x110 [ 119.729153][ T6420] ops_init+0x35d/0x5d0 [ 119.729177][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.729218][ T6420] setup_net+0x118/0x350 [ 119.729260][ T6420] ? __pfx_setup_net+0x10/0x10 [ 119.729299][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.729328][ T6420] ? down_read_killable+0x1bb/0x3b0 [ 119.729359][ T6420] ? srso_alias_return_thunk+0x5/0xfbef5 [ 119.729389][ T6420] ? __ns_common_init+0x2fc/0x4a0 [ 119.729430][ T6420] copy_net_ns+0x53b/0x780 [ 119.729473][ T6420] create_new_namespaces+0x3f0/0x6b0 [ 119.729511][ T6420] ? security_capable+0x7e/0x2c0 [ 119.729547][ T6420] unshare_nsproxy_namespaces+0x149/0x190 [ 119.729585][ T6420] ksys_unshare+0x5a7/0x950 [ 119.729631][ T6420] ? __pfx_ksys_unshare+0x10/0x10 [ 119.729669][ T6420] ? rcu_is_watching+0x16/0xb0 [ 119.729713][ T6420] __x64_sys_unshare+0x38/0x50 [ 119.729751][ T6420] do_syscall_64+0x166/0x520 [ 119.729774][ T6420] ? trace_irq_disable+0x3b/0x140 [ 119.729800][ T6420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.729833][ T6420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.729859][ T6420] RIP: 0033:0x7fe27159e159 [ 119.729882][ T6420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.729903][ T6420] RSP: 002b:00007fe2723e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 119.729929][ T6420] RAX: ffffffffffffffda RBX: 00007fe271825fa0 RCX: 00007fe27159e159 [ 119.729948][ T6420] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000 [ 119.729964][ T6420] RBP: 00007fe271635024 R08: 0000000000000000 R09: 0000000000000000 [ 119.729980][ T6420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.729995][ T6420] R13: 00007fe271826038 R14: 00007fe271825fa0 R15: 00007fffbe0db1b8 [ 119.730041][ T6420] [ 119.736472][ T6420] debugfs: out of free dentries, can not create symlink 'netns-38-4026534144-notrefcnt' [ 120.373234][ T5620] usb 5-1: GET_CAPABILITIES returned 0 [ 120.373311][ T5620] usbtmc 5-1:16.0: can't read capabilities [ 120.585534][ T5620] usb 5-1: USB disconnect, device number 3 [ 120.594435][ T6435] MTRR 1 not used [ 120.824244][ T6438] 9pnet_virtio: no channels available for device syz [ 121.559084][ T6451] jffs2: notice: (6451) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 121.741776][ T5628] Bluetooth: hci1: Malformed Event: 0x2f [ 121.924299][ T6463] 9p: Unknown Cache mode or invalid value f [ 122.171492][ T6471] netlink: 8 bytes leftover after parsing attributes in process `syz.4.251'. [ 122.458461][ T6480] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 122.577387][ T5628] Bluetooth: hci2: command 0x0405 tx timeout [ 123.222218][ T5622] Bluetooth: Unexpected continuation frame (len 12) [ 123.553596][ T6506] netlink: 4 bytes leftover after parsing attributes in process `syz.1.268'. [ 123.735810][ T6514] FAULT_INJECTION: forcing a failure. [ 123.735810][ T6514] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 123.758427][ T6514] CPU: 1 UID: 0 PID: 6514 Comm: syz.2.271 Tainted: G L syzkaller #0 PREEMPT(full) [ 123.758469][ T6514] Tainted: [L]=SOFTLOCKUP [ 123.758482][ T6514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 123.758497][ T6514] Call Trace: [ 123.758508][ T6514] [ 123.758519][ T6514] dump_stack_lvl+0xe8/0x150 [ 123.758564][ T6514] should_fail_ex+0x410/0x560 [ 123.758615][ T6514] prepare_alloc_pages+0x223/0x600 [ 123.758650][ T6514] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 123.758684][ T6514] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 123.758717][ T6514] ? __pfx_policy_nodemask+0x10/0x10 [ 123.758747][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.758795][ T6514] alloc_pages_mpol+0x21e/0x390 [ 123.758834][ T6514] alloc_pages_noprof+0xb1/0x2b0 [ 123.758870][ T6514] alloc_pages_exact_noprof+0x3b/0xc0 [ 123.758901][ T6514] snd_pcm_attach_substream+0x626/0xb10 [ 123.758955][ T6514] snd_pcm_open_substream+0xb9/0x24f0 [ 123.758985][ T6514] ? snd_pcm_open+0x17d/0x620 [ 123.759013][ T6514] ? __pfx___mutex_lock+0x10/0x10 [ 123.759045][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759085][ T6514] ? __pfx_snd_pcm_open_substream+0x10/0x10 [ 123.759115][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759150][ T6514] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 123.759188][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759224][ T6514] snd_pcm_open+0x1cf/0x620 [ 123.759251][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759292][ T6514] ? __pfx_snd_pcm_open+0x10/0x10 [ 123.759319][ T6514] ? __pfx_default_wake_function+0x10/0x10 [ 123.759373][ T6514] snd_pcm_playback_open+0x5f/0xc0 [ 123.759407][ T6514] chrdev_open+0x4d9/0x600 [ 123.759442][ T6514] ? __pfx_chrdev_open+0x10/0x10 [ 123.759471][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759502][ T6514] ? fsnotify_open_perm_and_set_mode+0x135/0x6b0 [ 123.759537][ T6514] ? __pfx_chrdev_open+0x10/0x10 [ 123.759566][ T6514] do_dentry_open+0x816/0x1380 [ 123.759611][ T6514] vfs_open+0x3b/0x340 [ 123.759639][ T6514] ? path_openat+0x1428/0x1d60 [ 123.759684][ T6514] path_openat+0x1443/0x1d60 [ 123.759750][ T6514] do_file_open+0x23e/0x4a0 [ 123.759799][ T6514] ? __pfx_do_file_open+0x10/0x10 [ 123.759866][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759897][ T6514] ? _raw_spin_unlock+0x28/0x50 [ 123.759932][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.759962][ T6514] ? alloc_fd+0x651/0x6c0 [ 123.760009][ T6514] do_sys_openat2+0x115/0x200 [ 123.760045][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.760076][ T6514] ? __se_sys_futex+0x3a8/0x450 [ 123.760112][ T6514] ? __pfx_do_sys_openat2+0x10/0x10 [ 123.760153][ T6514] ? rcu_is_watching+0x16/0xb0 [ 123.760185][ T6514] ? srso_alias_return_thunk+0x5/0xfbef5 [ 123.760222][ T6514] __x64_sys_openat+0x138/0x170 [ 123.760261][ T6514] do_syscall_64+0x166/0x520 [ 123.760286][ T6514] ? trace_irq_disable+0x3b/0x140 [ 123.760312][ T6514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.760346][ T6514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.760374][ T6514] RIP: 0033:0x7f92e4f5e98e [ 123.760397][ T6514] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 123.760418][ T6514] RSP: 002b:00007f92e5ee9b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 123.760445][ T6514] RAX: ffffffffffffffda RBX: 00007f92e5eea6c0 RCX: 00007f92e4f5e98e [ 123.760465][ T6514] RDX: 0000000000000000 RSI: 00007f92e5ee9c00 RDI: ffffffffffffff9c [ 123.760484][ T6514] RBP: 00007f92e5ee9c00 R08: 0000000000000000 R09: 0000000000000000 [ 123.760501][ T6514] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 123.760519][ T6514] R13: 00007f92e5226038 R14: 00007f92e5225fa0 R15: 00007ffe86b47568 [ 123.760559][ T6514] [ 124.233966][ T6520] devpts: Bad value for 'max' [ 124.234013][ T6517] netlink: 'syz.4.274': attribute type 10 has an invalid length. [ 124.252283][ T6517] syz_tun: entered promiscuous mode [ 124.325396][ T6517] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 124.363048][ T1036] bond0: (slave bond_slave_0): interface is now down [ 124.363100][ T1036] bond0: (slave bond_slave_1): interface is now down [ 124.363139][ T1036] bond0: (slave syz_tun): interface is now down [ 124.381169][ T1036] bond0: (slave bond_slave_0): interface is now down [ 124.381189][ T1036] bond0: (slave bond_slave_1): interface is now down [ 124.381206][ T1036] bond0: (slave syz_tun): interface is now down [ 124.413957][ T6527] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 124.442222][ T1036] bond0: now running without any active interface! [ 124.641894][ T6536] xt_IDLETIMER: label is empty or not nul-terminated [ 124.859973][ T6543] random: crng reseeded on system resumption [ 125.014948][ T6550] FAULT_INJECTION: forcing a failure. [ 125.014948][ T6550] name failslab, interval 1, probability 0, space 0, times 0 [ 125.015008][ T6550] CPU: 1 UID: 0 PID: 6550 Comm: syz.3.288 Tainted: G L syzkaller #0 PREEMPT(full) [ 125.015050][ T6550] Tainted: [L]=SOFTLOCKUP [ 125.015060][ T6550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 125.015075][ T6550] Call Trace: [ 125.015085][ T6550] [ 125.015096][ T6550] dump_stack_lvl+0xe8/0x150 [ 125.015138][ T6550] should_fail_ex+0x410/0x560 [ 125.015185][ T6550] ? ovs_flow_alloc+0x103/0x1f0 [ 125.015216][ T6550] should_failslab+0xa8/0x100 [ 125.015249][ T6550] ? ovs_flow_alloc+0x103/0x1f0 [ 125.015276][ T6550] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 125.015315][ T6550] ? ovs_flow_alloc+0x24/0x1f0 [ 125.015342][ T6550] ? kmem_cache_alloc_noprof+0x156/0x600 [ 125.015380][ T6550] ? ovs_flow_alloc+0x103/0x1f0 [ 125.015417][ T6550] ovs_flow_alloc+0x103/0x1f0 [ 125.015451][ T6550] ovs_flow_cmd_new+0x28b/0xea0 [ 125.015492][ T6550] ? __kasan_kmalloc+0x93/0xb0 [ 125.015524][ T6550] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 125.015620][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.015650][ T6550] ? __kmalloc_noprof+0x38c/0x720 [ 125.015692][ T6550] ? __nla_parse+0x40/0x60 [ 125.015725][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.015754][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.015783][ T6550] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 125.015821][ T6550] genl_family_rcv_msg_doit+0x233/0x340 [ 125.015854][ T6550] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 125.015894][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.015924][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.015953][ T6550] ? security_capable+0x7e/0x2c0 [ 125.015989][ T6550] genl_rcv_msg+0x614/0x7a0 [ 125.016023][ T6550] ? __pfx_genl_rcv_msg+0x10/0x10 [ 125.016055][ T6550] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 125.016094][ T6550] ? __pfx_ref_tracker_free+0x10/0x10 [ 125.016135][ T6550] netlink_rcv_skb+0x226/0x4a0 [ 125.016171][ T6550] ? __pfx_genl_rcv_msg+0x10/0x10 [ 125.016199][ T6550] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 125.016250][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016280][ T6550] ? down_read+0x2be/0x330 [ 125.016317][ T6550] genl_rcv+0x28/0x40 [ 125.016356][ T6550] netlink_unicast+0x7bd/0x940 [ 125.016399][ T6550] netlink_sendmsg+0x813/0xb40 [ 125.016445][ T6550] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.016490][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016520][ T6550] ? apparmor_socket_sendmsg+0x98/0x360 [ 125.016560][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016594][ T6550] ? __pfx_netlink_sendmsg+0x10/0x10 [ 125.016628][ T6550] sock_sendmsg_nosec+0x13a/0x180 [ 125.016670][ T6550] ____sys_sendmsg+0x54e/0x850 [ 125.016707][ T6550] ? __pfx_____sys_sendmsg+0x10/0x10 [ 125.016741][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016778][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016808][ T6550] ? import_iovec+0x73/0xa0 [ 125.016842][ T6550] ___sys_sendmsg+0x2a5/0x360 [ 125.016870][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.016900][ T6550] ? __lock_acquire+0x6df/0x2e50 [ 125.016932][ T6550] ? __pfx____sys_sendmsg+0x10/0x10 [ 125.016967][ T6550] ? futex_wait+0x2a2/0x390 [ 125.017047][ T6550] ? __fget_files+0x2a/0x420 [ 125.017081][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.017111][ T6550] ? __fget_files+0x3a2/0x420 [ 125.017158][ T6550] __x64_sys_sendmsg+0x1b1/0x290 [ 125.017188][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.017221][ T6550] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 125.017261][ T6550] ? srso_alias_return_thunk+0x5/0xfbef5 [ 125.017307][ T6550] do_syscall_64+0x166/0x520 [ 125.017331][ T6550] ? trace_irq_disable+0x3b/0x140 [ 125.017357][ T6550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.017391][ T6550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.017417][ T6550] RIP: 0033:0x7f040a19e159 [ 125.017456][ T6550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.017476][ T6550] RSP: 002b:00007f040afdb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.017503][ T6550] RAX: ffffffffffffffda RBX: 00007f040a425fa0 RCX: 00007f040a19e159 [ 125.017522][ T6550] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000005 [ 125.017539][ T6550] RBP: 00007f040a235024 R08: 0000000000000000 R09: 0000000000000000 [ 125.017555][ T6550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 125.017571][ T6550] R13: 00007f040a426038 R14: 00007f040a425fa0 R15: 00007ffeff47afc8 [ 125.017618][ T6550] [ 132.485942][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.598214][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.752024][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.762313][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 206.038072][ T4929] Bluetooth: hci3: command 0x0406 tx timeout [ 206.108589][ T4929] Bluetooth: hci5: command 0x0406 tx timeout [ 206.108926][ T4929] Bluetooth: hci4: command 0x0406 tx timeout [ 206.110440][ T4929] Bluetooth: hci1: command 0x0406 tx timeout [ 206.110750][ T4929] Bluetooth: hci0: command 0x0406 tx timeout [ 241.836364][ T5618] Bluetooth: hci2: command 0x0405 tx timeout [ 255.199827][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.235347][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 282.586059][ T32] INFO: task kworker/1:7:5860 blocked for more than 143 seconds. [ 282.586243][ T32] Tainted: G L syzkaller #0 [ 282.586485][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 282.586617][ T32] task:kworker/1:7 state:D stack:26184 pid:5860 tgid:5860 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 282.586997][ T32] Workqueue: events drain_vmap_area_work [ 282.587614][ T32] Call Trace: [ 282.587707][ T32] [ 282.732170][ T32] __schedule+0x17db/0x58f0 [ 282.732999][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.791718][ T32] ? __pfx___schedule+0x10/0x10 [ 282.792350][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.793113][ T32] ? __pfx___schedule+0x10/0x10 [ 282.838419][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.838739][ T32] ? schedule+0x90/0x2b0 [ 282.839555][ T32] schedule+0x164/0x2b0 [ 282.840101][ T32] schedule_timeout+0xc0/0x2c0 [ 282.924283][ T32] ? __pfx_schedule_timeout+0x10/0x10 [ 282.924551][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 282.924731][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 282.925181][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.000394][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 283.000984][ T32] ? wait_for_completion+0x272/0x5e0 [ 283.001412][ T32] wait_for_completion+0x2ca/0x5e0 [ 283.002789][ T32] ? __pfx_wait_for_completion+0x10/0x10 [ 283.003255][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.003826][ T32] ? __flush_work+0x101/0xca0 [ 283.004426][ T32] __flush_work+0xa63/0xca0 [ 283.004609][ T32] ? reclaim_list_global+0x137c/0x13b0 [ 283.004995][ T32] ? __flush_work+0x101/0xca0 [ 283.005742][ T32] ? __pfx___flush_work+0x10/0x10 [ 283.005989][ T32] ? __pfx_wq_barrier_func+0x10/0x10 [ 283.410526][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.411435][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.411666][ T32] ? flush_work+0xd/0x30 [ 283.470028][ T32] __purge_vmap_area_lazy+0x880/0xb40 [ 283.691092][ T32] ? process_scheduled_works+0x97a/0x1630 [ 283.691520][ T32] drain_vmap_area_work+0x27/0x40 [ 283.691652][ T32] process_scheduled_works+0xc3d/0x1630 [ 283.691937][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 283.872193][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 284.000041][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.000239][ T32] ? assign_work+0x3cf/0x5d0 [ 284.001006][ T32] worker_thread+0xa47/0xfb0 [ 284.019256][ T32] kthread+0x38b/0x480 [ 284.019538][ T32] ? __pfx_worker_thread+0x10/0x10 [ 284.019719][ T32] ? __pfx_kthread+0x10/0x10 [ 284.020355][ T32] ret_from_fork+0x514/0xb70 [ 284.020875][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 284.021118][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 284.021292][ T32] ? __switch_to+0xc89/0x1420 [ 284.113606][ T32] ? __pfx_kthread+0x10/0x10 [ 284.122393][ T32] ret_from_fork_asm+0x1a/0x30 [ 284.163959][ T32] [ 284.238925][ T32] [ 284.238925][ T32] Showing all locks held in the system: [ 284.239060][ T32] locks held by kworker/0:0/9: 4, on CPU#0: [ 284.239153][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.239942][ T32] #1: ffffc900000e7c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.240801][ T32] #2: ffffffff90250f00 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xac/0x1110 [ 284.241634][ T32] #3: ffff8880523b07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_check_chans_work+0x1a1/0x1110 [ 284.242167][ T32] locks held by kworker/u8:0/12: 3, last CPU#0: [ 284.242252][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.243016][ T32] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.243666][ T32] #2: ffff8880523b07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 284.244273][ T32] locks held by kworker/u8:1/13: 3, last CPU#0: [ 284.244401][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.245159][ T32] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.245689][ T32] #2: ffff888055d907a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 284.246593][ T32] locks held by khungtaskd/32: 1, last CPU#0: [ 284.246700][ T32] #0: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 284.247129][ T32] locks held by kworker/u8:2/38: 4, last CPU#1: [ 284.688482][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.689339][ T32] #1: ffffc90000ae7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.689927][ T32] #2: ffff8880556307a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 284.690819][ T32] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 284.691337][ T32] locks held by kworker/u8:3/50: 3, last CPU#1: [ 284.691426][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.692186][ T32] #1: ffffc90000bb7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.692819][ T32] #2: ffff8880549807a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 284.693436][ T32] locks held by kworker/u8:4/75: 3, last CPU#1: [ 284.693568][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.694318][ T32] #1: ffffc900022cfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.694855][ T32] #2: ffff888053b107a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 284.695767][ T32] locks held by kworker/0:2/980: 2, last CPU#0: [ 284.695856][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.696305][ T32] #1: ffffc9000521fc40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 284.697127][ T32] locks held by kworker/u8:6/1036: 4, last CPU#1: [ 285.054562][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.055559][ T32] #1: ffffc9000527fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.055975][ T32] #2: ffff8880522907a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.057118][ T32] #3: ffff8880b873bb20 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 285.084636][ T32] locks held by kworker/u8:7/1148: 3, last CPU#1: [ 285.084703][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.085122][ T32] #1: ffffc900056bfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.085285][ T32] #2: ffff8880554a07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.085526][ T32] locks held by kworker/u8:8/2340: 3, last CPU#1: [ 285.085570][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.489349][ T32] #1: ffffc900073b7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.490202][ T32] #2: ffff8880547807a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.490734][ T32] locks held by kworker/u8:9/3319: 3, last CPU#0: [ 285.490824][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.491973][ T32] #1: ffffc9000f0afc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.492410][ T32] #2: ffff888055d407a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.493236][ T32] locks held by kworker/u8:10/3325: 3, last CPU#0: [ 285.493395][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.493885][ T32] #1: ffffc9000edffc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.494621][ T32] #2: ffff888056883258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 285.495355][ T32] locks held by kworker/u8:12/3343: 3, last CPU#0: [ 285.495436][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.496148][ T32] #1: ffffc9000f42fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.496858][ T32] #2: ffff8880557d07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.820429][ T32] locks held by kworker/u8:13/3358: 4, last CPU#0: [ 285.820510][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.821423][ T32] #1: ffffc9000f4dfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.822229][ T32] #2: ffff8880524e07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 285.823071][ T32] #3: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 285.823594][ T32] locks held by kworker/0:3/4942: 2, last CPU#0: [ 285.823683][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.824443][ T32] #1: ffffc9000d75fc40 ((work_completion)(&vn->purge_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 285.825082][ T32] locks held by klogd/4970: 1, last CPU#1: [ 285.825157][ T32] #0: ffffffff8eeabc70 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 286.101213][ T32] locks held by udevd/4981: 1, last CPU#1: [ 286.108381][ T32] #0: ffffffff8f4efab8 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 286.350737][ T32] locks held by getty/5368: 2, on CPU#0: [ 286.350895][ T32] #0: ffff8880326ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 286.351417][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 286.352361][ T32] locks held by syz-executor/5610: 2, last CPU#0: [ 286.352415][ T32] #0: ffff8880341136b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 286.352947][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 286.353851][ T32] locks held by syz-executor/5612: 2, last CPU#1: [ 286.353939][ T32] #0: ffff888078f483b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 286.354384][ T32] #1: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 286.355207][ T32] locks held by udevd/5623: 1, last CPU#1: [ 286.355366][ T32] #0: ffffffff8eeabc70 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 286.355834][ T32] locks held by kworker/0:4/5753: 2, last CPU#0: [ 286.355927][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.356726][ T32] #1: ffffc90004957c40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.629191][ T32] locks held by kworker/1:5/5782: 3, last CPU#1: [ 286.629316][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.630240][ T32] #1: ffffc90004f37c40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.630677][ T32] #2: ffffffff8ed5c6e0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x1890 [ 286.631546][ T32] locks held by kworker/1:7/5860: 3, on CPU#1: [ 286.679596][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.680066][ T32] #1: ffffc9000524fc40 (drain_vmap_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.680372][ T32] #2: ffffffff8ee8b400 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 [ 286.680559][ T32] locks held by kworker/u8:14/5992: 3, last CPU#1: [ 286.680598][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.680871][ T32] #1: ffffc9000565fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.681422][ T32] #2: ffff888055b107a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 286.921800][ T32] locks held by kworker/u8:16/6559: 3, on CPU#0: [ 286.921908][ T32] #0: ffff88803257a940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.922771][ T32] #1: ffffc9000532fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.923292][ T32] #2: ffffffff90250f00 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 286.924409][ T32] locks held by kworker/u8:19/6564: 3, last CPU#0: [ 286.924552][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.924976][ T32] #1: ffffc9000528fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 286.925780][ T32] #2: ffff88802b30a258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 287.094887][ T32] locks held by kworker/u8:22/6567: 3, last CPU#1: [ 287.095026][ T32] #0: ffff888031ded940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 287.095703][ T32] #1: ffffc90004667c40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 287.096659][ T32] #2: ffff8880310f59c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 [ 287.310702][ T32] locks held by kworker/u8:24/6576: 5, last CPU#1: [ 287.310955][ T32] #0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 287.311463][ T32] #1: ffffc90003397c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 287.312193][ T32] #2: ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_disable+0x12/0x20 [ 287.312742][ T32] #3: ffffffff8ee38180 (jump_label_mutex){+.+.}-{4:4}, at: static_key_disable_cpuslocked+0x8d/0x1a0 [ 287.313498][ T32] #4: ffffffff8ebff620 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 [ 287.314150][ T32] locks held by dhcpcd/6582: 1, last CPU#1: [ 287.314225][ T32] #0: ffff8880790fc378 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 287.314909][ T32] locks held by syz-executor/6583: 1, last CPU#1: [ 287.315046][ T32] #0: ffff888077ff41c8 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 287.655998][ T32] [ 287.656083][ T32] ============================================= [ 287.656083][ T32] [ 287.656142][ T32] NMI backtrace for cpu 0 [ 287.656183][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 287.656235][ T32] Tainted: [L]=SOFTLOCKUP [ 287.656264][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 287.656300][ T32] Call Trace: [ 287.656381][ T32] [ 287.656473][ T32] dump_stack_lvl+0xe8/0x150 [ 287.656946][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 287.657358][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 287.657799][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 287.658133][ T32] sys_info+0x135/0x170 [ 287.658355][ T32] watchdog+0xfd7/0x1030 [ 287.659358][ T32] ? watchdog+0x1c7/0x1030 [ 287.660222][ T32] kthread+0x38b/0x480 [ 287.660766][ T32] ? __pfx_watchdog+0x10/0x10 [ 287.660810][ T32] ? __pfx_kthread+0x10/0x10 [ 287.661043][ T32] ret_from_fork+0x514/0xb70 [ 287.661585][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 287.661941][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.662123][ T32] ? __switch_to+0xc89/0x1420 [ 287.662559][ T32] ? __pfx_kthread+0x10/0x10 [ 287.662941][ T32] ret_from_fork_asm+0x1a/0x30 [ 287.664582][ T32] [ 287.665379][ T32] Sending NMI from CPU 0 to CPUs 1: [ 287.665473][ C1] NMI backtrace for cpu 1 [ 287.665497][ C1] CPU: 1 UID: 0 PID: 3325 Comm: kworker/u8:10 Tainted: G L syzkaller #0 PREEMPT(full) [ 287.665532][ C1] Tainted: [L]=SOFTLOCKUP [ 287.665545][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 287.665564][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 287.665617][ C1] RIP: 0010:rb_read_data_buffer+0xf5/0x5b0 [ 287.665654][ C1] Code: 00 31 ed 4c 63 ed 48 8b 44 24 30 4e 8d 3c 28 4c 89 ff e8 ae b3 fd ff 41 89 c6 bf 01 00 00 00 89 c6 e8 9f c7 fb ff 8b 5c 24 04 <44> 29 eb 44 89 f7 89 de e8 9e c4 fb ff 45 85 f6 0f 8e 12 04 00 00 [ 287.665677][ C1] RSP: 0018:ffffc90000a175c0 EFLAGS: 00000246 [ 287.665705][ C1] RAX: ffffffff81cbf881 RBX: 0000000000000958 RCX: ffff888032be9f40 [ 287.665726][ C1] RDX: 0000000000000300 RSI: 000000000000002c RDI: 0000000000000001 [ 287.665744][ C1] RBP: 00000000000005d8 R08: 0000000000000100 R09: 0000000000000020 [ 287.665763][ C1] R10: 000000000000001f R11: 0000000000000300 R12: 00000042fa73caaf [ 287.665782][ C1] R13: 00000000000005d8 R14: 000000000000002c R15: ffff88801e6935e8 [ 287.665806][ C1] FS: 0000000000000000(0000) GS:ffff888124dd8000(0000) knlGS:0000000000000000 [ 287.665829][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 287.665849][ C1] CR2: 00007f5b80feb630 CR3: 000000000eb48000 CR4: 0000000000350ef0 [ 287.665871][ C1] Call Trace: [ 287.665888][ C1] [ 287.666013][ C1] check_buffer+0x288/0x860 [ 287.666076][ C1] ? __pfx_trace_clock_local+0x10/0x10 [ 287.666212][ C1] __rb_reserve_next+0x549/0xdd0 [ 287.666440][ C1] ring_buffer_lock_reserve+0xc0d/0x10c0 [ 287.666481][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.666701][ C1] trace_event_buffer_lock_reserve+0x1d4/0x700 [ 287.666797][ C1] trace_event_buffer_reserve+0x1ef/0x2d0 [ 287.666885][ C1] trace_event_raw_event_lock_acquire+0x12c/0x2e0 [ 287.666962][ C1] ? __pfx_trace_event_raw_event_lock_acquire+0x10/0x10 [ 287.666997][ C1] ? trace_event_raw_event_lock+0x1c7/0x280 [ 287.667068][ C1] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 287.667107][ C1] ? lock_acquire+0x115/0x350 [ 287.667228][ C1] lock_acquire+0x303/0x350 [ 287.667270][ C1] ? unwind_next_frame+0x8f/0x2550 [ 287.667368][ C1] ? unwind_next_frame+0x8f/0x2550 [ 287.667413][ C1] ? __kmalloc_noprof+0x36b/0x720 [ 287.667468][ C1] ? unwind_next_frame+0x8f/0x2550 [ 287.667525][ C1] unwind_next_frame+0xac/0x2550 [ 287.667566][ C1] ? unwind_next_frame+0x8f/0x2550 [ 287.667656][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 287.667699][ C1] ? unwind_next_frame+0x8f/0x2550 [ 287.667776][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 287.667839][ C1] arch_stack_walk+0x11b/0x150 [ 287.667938][ C1] ? __kmalloc_noprof+0x36b/0x720 [ 287.668037][ C1] stack_trace_save+0xa9/0x100 [ 287.668105][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 287.668217][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.668256][ C1] ? ring_buffer_unlock_commit+0x51d/0x6c0 [ 287.668336][ C1] kasan_save_track+0x3e/0x80 [ 287.668373][ C1] ? kasan_save_track+0x3e/0x80 [ 287.668405][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 287.668440][ C1] ? __kmalloc_noprof+0x36b/0x720 [ 287.668899][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.668964][ C1] __kasan_kmalloc+0x93/0xb0 [ 287.669029][ C1] __kmalloc_noprof+0x36b/0x720 [ 287.669079][ C1] ? trace_event_raw_event_lock+0x1c7/0x280 [ 287.669128][ C1] ? __kmalloc_noprof+0x1ab/0x720 [ 287.669175][ C1] ? ieee802_11_parse_elems_full+0x14b/0x2de0 [ 287.669216][ C1] ? ieee802_11_parse_elems_full+0x14b/0x2de0 [ 287.669328][ C1] ieee802_11_parse_elems_full+0x14b/0x2de0 [ 287.669403][ C1] ? call_rcu+0x64d/0x8b0 [ 287.669468][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.669524][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.669584][ C1] ? __kfree_rcu_sheaf+0x21/0x6c0 [ 287.669641][ C1] ? __kfree_rcu_sheaf+0x21/0x6c0 [ 287.669712][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.669751][ C1] ? __kfree_rcu_sheaf+0x1c2/0x6c0 [ 287.669806][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.669844][ C1] ? trace_event_buffer_commit+0x258/0x7a0 [ 287.669978][ C1] ? __pfx_ieee802_11_parse_elems_full+0x10/0x10 [ 287.670025][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.670064][ C1] ? cfg80211_update_known_bss+0xa51/0x1430 [ 287.670195][ C1] ieee80211_inform_bss+0x163/0x10d0 [ 287.670233][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.670310][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.670349][ C1] ? __cfg80211_bss_update+0x125c/0x2010 [ 287.670418][ C1] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 287.670451][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 287.670553][ C1] ? __kmalloc_noprof+0x1ab/0x720 [ 287.670607][ C1] ? cfg80211_inform_single_bss_data+0x990/0x1be0 [ 287.670685][ C1] ? __pfx_ieee80211_inform_bss+0x10/0x10 [ 287.670744][ C1] cfg80211_inform_single_bss_data+0xd9c/0x1be0 [ 287.670877][ C1] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 287.671096][ C1] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 287.671173][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.671211][ C1] ? rb_event_length+0xf9/0x400 [ 287.671258][ C1] ? cfg80211_inform_bss_data+0x24b/0x3cc0 [ 287.671355][ C1] cfg80211_inform_bss_data+0x263/0x3cc0 [ 287.671475][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.671539][ C1] ? __pfx_trace_clock_local+0x10/0x10 [ 287.671638][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.671676][ C1] ? __rb_reserve_next+0x79f/0xdd0 [ 287.671760][ C1] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 287.671869][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.671908][ C1] ? rb_commit+0x787/0x7e0 [ 287.672056][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.672098][ C1] ? ring_buffer_unlock_commit+0x51d/0x6c0 [ 287.672204][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.672242][ C1] ? trace_buffer_unlock_commit_regs+0x156/0x520 [ 287.672290][ C1] ? ring_buffer_event_data+0x94/0x100 [ 287.672357][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.672396][ C1] ? trace_event_buffer_commit+0x258/0x7a0 [ 287.672579][ C1] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 287.672681][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.672759][ C1] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 287.672860][ C1] ? ieee80211_bss_info_update+0x30f/0xa50 [ 287.672947][ C1] ieee80211_bss_info_update+0x791/0xa50 [ 287.673049][ C1] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 287.673192][ C1] ? kcov_remote_start+0x9c/0x7e0 [ 287.673272][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.673311][ C1] ? ieee80211_get_channel_khz+0x15b/0x8a0 [ 287.673385][ C1] ieee80211_scan_rx+0x552/0xa40 [ 287.673505][ C1] ieee80211_rx_list+0x2d0e/0x3b00 [ 287.673550][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.673648][ C1] ? trace_event_buffer_commit+0x258/0x7a0 [ 287.673805][ C1] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 287.673937][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674015][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674054][ C1] ? lock_acquire+0x115/0x350 [ 287.674117][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674267][ C1] ? ieee80211_rx_napi+0xd1/0x3d0 [ 287.674308][ C1] ieee80211_rx_napi+0x1ad/0x3d0 [ 287.674386][ C1] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 287.674441][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674493][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674531][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 287.674583][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.674622][ C1] ? skb_dequeue+0x124/0x160 [ 287.674711][ C1] ieee80211_handle_queued_frames+0xe4/0x1d0 [ 287.674821][ C1] tasklet_action_common+0x2d7/0x490 [ 287.674936][ C1] handle_softirqs+0x226/0x860 [ 287.675019][ C1] ? do_softirq+0x77/0xd0 [ 287.675122][ C1] ? nsim_dev_trap_report_work+0x7a4/0xb40 [ 287.675177][ C1] do_softirq+0x77/0xd0 [ 287.675227][ C1] [ 287.675238][ C1] [ 287.675257][ C1] __local_bh_enable_ip+0x100/0x140 [ 287.675315][ C1] nsim_dev_trap_report_work+0x7a4/0xb40 [ 287.675490][ C1] ? process_scheduled_works+0x97a/0x1630 [ 287.675552][ C1] process_scheduled_works+0xc3d/0x1630 [ 287.675635][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.675939][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 287.676051][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.676090][ C1] ? assign_work+0x3cf/0x5d0 [ 287.676220][ C1] worker_thread+0xa47/0xfb0 [ 287.676507][ C1] kthread+0x38b/0x480 [ 287.676562][ C1] ? __pfx_worker_thread+0x10/0x10 [ 287.676604][ C1] ? __pfx_kthread+0x10/0x10 [ 287.676668][ C1] ret_from_fork+0x514/0xb70 [ 287.676742][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 287.676803][ C1] ? srso_alias_return_thunk+0x5/0xfbef5 [ 287.676841][ C1] ? __switch_to+0xc89/0x1420 [ 287.676929][ C1] ? __pfx_kthread+0x10/0x10 [ 287.676993][ C1] ret_from_fork_asm+0x1a/0x30 [ 287.677199][ C1] [ 289.386132][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 289.647585][ T32] CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 289.658291][ T32] Tainted: [L]=SOFTLOCKUP [ 289.662634][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 289.672710][ T32] Call Trace: [ 289.676067][ T32] [ 289.679092][ T32] vpanic+0x56d/0xa60 [ 289.683411][ T32] ? __pfx___schedule+0x10/0x10 [ 289.688722][ T32] ? __pfx_vpanic+0x10/0x10 [ 289.693374][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.699824][ T32] panic+0xc5/0xd0 [ 289.703932][ T32] ? __pfx_panic+0x10/0x10 [ 289.708516][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 289.714145][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 289.719743][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 289.726336][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 289.733223][ T32] watchdog+0x1030/0x1030 [ 289.738226][ T32] ? watchdog+0x1c7/0x1030 [ 289.743525][ T32] kthread+0x38b/0x480 [ 289.747833][ T32] ? __pfx_watchdog+0x10/0x10 [ 289.752600][ T32] ? __pfx_kthread+0x10/0x10 [ 289.757710][ T32] ret_from_fork+0x514/0xb70 [ 289.762815][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 289.768058][ T32] ? srso_alias_return_thunk+0x5/0xfbef5 [ 289.773761][ T32] ? __switch_to+0xc89/0x1420 [ 289.779038][ T32] ? __pfx_kthread+0x10/0x10 [ 289.784210][ T32] ret_from_fork_asm+0x1a/0x30 [ 289.790468][ T32] [ 289.793709][ T32] Kernel Offset: disabled [ 289.798069][ T32] Rebooting in 86400 seconds..