last executing test programs: 2m37.037587266s ago: executing program 0 (id=1242): fanotify_mark$auto(0xffffffffffffffff, 0x205, 0xa, 0x4, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0x9}, 0x2, &(0x7f00000001c0), 0x18000000, 0xa505}, 0x800}, 0x7, 0x7d0) r1 = socket(0x10, 0x2, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00'}) syz_genetlink_get_family_id$auto_net_dm(&(0x7f0000000000), r2) close_range$auto(0x2, 0x8, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bus/usb/032/001\x00', 0x80202, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x100000009b72, 0x2, 0x8000) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptya1\x00', 0x20080, 0x0) msgctl$auto(0x9, 0x7fff, 0x0) shmctl$auto_IPC_SET(0x0, 0x1, &(0x7f0000000300)={{0x9, 0xee01, 0xffffffffffffffff, 0xe2, 0x4, 0x3, 0x7}, 0xfffffeff, 0x3, 0x1, 0x3ff, @inferred=0xffffffffffffffff, @inferred, 0x6, 0x0, 0x0, 0x0}) io_uring_setup$auto(0x1000, 0x0) ioctl$auto_SNDCTL_TMR_CONTINUE(r3, 0x5408, 0x0) 2m36.749012636s ago: executing program 0 (id=1247): fanotify_mark$auto(0xffffffffffffffff, 0x205, 0xa, 0x4, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0x9}, 0x2, &(0x7f00000001c0), 0x18000000, 0xa505}, 0x800}, 0x7, 0x7d0) r1 = socket(0x10, 0x2, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00'}) syz_genetlink_get_family_id$auto_net_dm(&(0x7f0000000000), r2) close_range$auto(0x2, 0x8, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bus/usb/032/001\x00', 0x80202, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x100000009b72, 0x2, 0x8000) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptya1\x00', 0x20080, 0x0) msgctl$auto(0x9, 0x7fff, 0x0) shmctl$auto_IPC_SET(0x0, 0x1, &(0x7f0000000300)={{0x9, 0xee01, 0xffffffffffffffff, 0xe2, 0x4, 0x3, 0x7}, 0xfffffeff, 0x3, 0x1, 0x3ff, @inferred=0xffffffffffffffff, @inferred, 0x6, 0x0, 0x0, 0x0}) io_uring_setup$auto(0x1000, 0x0) ioctl$auto(0x3, 0x5420, 0x38) open_tree_attr$auto(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x9, &(0x7f00000001c0)={0x2d, 0x3, 0x500008002, @inferred=r3}, 0xfffffffffffffffd) ioctl$auto_SNDCTL_TMR_CONTINUE(r3, 0x5408, 0x0) 2m36.353884708s ago: executing program 0 (id=1250): r0 = fsopen$auto(0x0, 0x1) fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0) process_madvise$auto_MADV_PAGEOUT(r0, &(0x7f0000000180)={0x0, 0x3}, 0x1, 0x15, 0x5) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) select$auto(0xd, 0x0, &(0x7f0000000400)={[0x8, 0x200000000005, 0x7, 0x7, 0x0, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x4009, 0x3, 0xfffffffffffff954, 0xfffffffffffffff8, 0xfff]}, 0x0, &(0x7f0000000080)={0x800000000001ff, 0x401}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) rt_sigqueueinfo$auto(0x0, 0xb, &(0x7f00000001c0)={@siginfo_0_0={0x3, 0x401, 0xfffffffb, @_timer={0x0, 0xd, @sival_ptr=0x0, 0x62}}}) sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f0000002c80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002c40)={&(0x7f0000000a40)={0x270, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_MAC_ADDRS={0x247, 0xa6, 0x0, 0x1, [@typed={0x8, 0xa, 0x0, 0x0, @pid}, @nested={0xe, 0xb2, 0x0, 0x1, [@generic="226aa139a6fc2f572338"]}, @nested={0x4, 0xb2}, @generic="3fee4784ea23a632cae6941c585d011d5a13d6aa11ba2143440a59cdec4df62f9d77bc56fb613b623ad0857cf2a82924ab81fbe5488f7ed2bdc0d6d0d0a5b77406df17b2d2b754a435dc5c96c208209ad5f4b4e33a275420901c0db44f0a06a2fa6f3f65c65b135e9f3a88cbf924c750a0e2589f76990f8b9da644edf6dec84d36bc48a89b3708875003e2367a094d9d3d37bbee9a5cbd45e9f607c132c050d0ce5aa38e8893ad16fcecec53e05d121ef50fb8b613bc994b968bde403d21d740c71d2212c0181c0b5e527d48fa19f820107ab0f6d006900441821d2d6db374", @nested={0x146, 0x156, 0x0, 0x1, [@nested={0x4, 0x95}, @generic="1060dad00db5ccc6881808a96697bbfd90c4514ebe341b59b89635d8abc23c55016a928b04a0b4a61764845da33c6db55e9b01297d4a1aabb210e0b16dafebdc714e3efd925491dd1bea0ac5f336a1bd4344c1231b7ae5a537ee3ecfec6fa7c4fb95ef34bc2790578a5e348b9102216a23c332d23f30c27245da85f2e5e3ab9bf4f5e96779e8f3ef48b5ca9344ef615cf8cb792872e9c8", @nested={0x4, 0x1c}, @generic="7e72d9ce399a024a1d0885146ebc1027dbabb70e962443cfdbc52d4f8e5afcf14e408bcbe0498c453cdb1b3eed1b58bf26c1876a111f476cf286a24ae87d44cab65a25dd43f5f87c6fadbc3f5437ae7d78139758ab0ecdab385267bbb5ed6dcf7d759c6d3583910ed5450df9b5875a3f3fcff476afa3539d", @generic="fcea25409dda4931b76eeba7becd4ce180a8fb4ab615fc52549812e5e60c18713cc42b30f5c010a409596c"]}]}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7}]}, 0x270}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) set_mempolicy$auto(0x6, 0x0, 0x9) socket$nl_generic(0x10, 0x3, 0x10) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0xe01, 0x0) setresgid$auto(0xffffffffffffffff, 0xee00, 0x0) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r1, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2T\xc0\x1d\xa4\x10r\xc4\xa2\xb1y\t\x05\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xed\rW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1', 0x100000001) write$auto(0xffffffffffffffff, &(0x7f0000001440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3\xb8\xc0\x1f\xe6\x9f\x9cy\xa9\xad\x96\x19Fy\x11}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdf\x17\xe4\xcbA\xa5[\x1aG\xa6\x94\xe0\xdf\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(W| \xce\xcc\xdd%\xcf\xab\xa8\xafhM\x0f%\xc4C9~\xfe\x02]\xedVfQ', 0xf) write$auto(r1, &(0x7f0000000080)='S\x00\x00\x00\xfe\xff\xff\xff', 0x8587) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x0, 0x0) openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec29\x00', 0x900, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000) 2m35.337819337s ago: executing program 0 (id=1252): ptrace$auto(0x10, 0x0, 0x4, 0x7ff) r0 = openat$auto_fops_u8_(0xffffffffffffff9c, &(0x7f00000014c0)='/sys/kernel/debug/nfcsim/nfc0/dropframe\x00', 0x20000, 0x0) read$auto_fops_u8_(r0, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/platform/vhci_hcd.0/detach\x00', 0x101001, 0x0) write$auto(r1, &(0x7f00000000c0)='0\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c(\xdb', 0x10010000085) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) unshare$auto(0x801) semget$auto(0x0, 0x2e4a, 0x8000) semtimedop$auto(0x0, &(0x7f0000000000)={0x7, 0x9, 0x36ec}, 0x1f4, 0x0) mkdir$auto(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x8cd) bpf$auto_BPF_OBJ_GET_INFO_BY_FD(0xf, &(0x7f00000002c0)=@test={0xffffffffffffffff, 0x0, 0x856, 0x189, 0x8, 0x7fff, 0x7fff, 0x10000, 0xc91a, 0x7, 0x5, 0x3, 0x3, 0x3, 0x6}, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) inotify_init1$auto(0x3000000000000) socket$nl_generic(0x11, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/smaps_rollup\x00', 0x840, 0x0) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r2) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x805, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004044}, 0x8000) r4 = socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) mmap$auto(0xfffffffffffffffd, 0x2000b, 0xa169, 0x16, r4, 0x3) 2m34.902018721s ago: executing program 0 (id=1255): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mremap$auto(0x0, 0xffffffffffffffff, 0x3fd6, 0x3, 0x7fffffffb000) prctl$auto(0x23, 0x200000000000009, 0x7fffffffefff, 0x0, 0x0) r0 = openat$auto_proc_pid_cmdline_ops_base(0xffffffffffffff9c, 0x0, 0x60502, 0x0) read$auto_proc_pid_cmdline_ops_base(r0, &(0x7f0000000040)=""/139, 0xca) 2m34.764823069s ago: executing program 0 (id=1258): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000100), r0) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="07031abd70250c00587b22"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40800) r2 = getpid() process_vm_readv$auto(r2, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x402000a, 0xffffffffffffffff, 0x400eb1, 0x401, 0x8000) r3 = socket(0xa, 0x5, 0x84) io_uring_setup$auto(0xa, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) setsockopt$auto(0x3, 0x10000000084, 0x81, 0x0, 0x8) setsockopt$auto(0x3, 0x84, 0x17, 0x0, 0x27) setsockopt$auto(0x3, 0x10000000084, 0x18, 0x0, 0x8) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) setsockopt$auto(r3, 0x10000000084, 0x23, 0x0, 0x8) r4 = getpid() process_vm_readv$auto(r4, &(0x7f0000000000)={0x0, 0xfff}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000140), 0x40000000001243}, 0xa, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_NFSD_CMD_LISTENER_SET(r6, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000000200)={0x14, r7, 0x1, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x48080) sendmsg$auto_NFSD_CMD_LISTENER_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r7, 0x1, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4000804}, 0x50) rename$auto(&(0x7f0000000480)='./file0\x00', &(0x7f0000000100)='./file1\x00') openat$auto_vga_arb_device_fops_vgaarb(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) sendmsg$auto_IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ff837375d985f59734facb53e3d8fb919c9c9a877969f9e81724452c97bace68bcb31f76cb69da49809c8051ac96bdef8a921a40d316c7503d60d30d2fade9e0c7d5e2a0efdb2a7b3e4085488574631212ae71543c46b2e630720f7037b4547257a14a773686b5d0efebe83039cc3f11cf", @ANYRES16=0x0, @ANYBLOB="000827bd7000fddbdf252b000000140030009d7ad483e492af317593d93a9e7a9e3711001f007465616d5f736c6176655f300000000006000b00080000000500110005000000080014000800000005002b000300000006000e00f2ff000005002a00070000000500210000000000050003006a000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x8050) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r8, 0x1, 0x94d1) 2m19.225824086s ago: executing program 32 (id=1258): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000100), r0) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="07031abd70250c00587b22"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40800) r2 = getpid() process_vm_readv$auto(r2, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x402000a, 0xffffffffffffffff, 0x400eb1, 0x401, 0x8000) r3 = socket(0xa, 0x5, 0x84) io_uring_setup$auto(0xa, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) setsockopt$auto(0x3, 0x10000000084, 0x81, 0x0, 0x8) setsockopt$auto(0x3, 0x84, 0x17, 0x0, 0x27) setsockopt$auto(0x3, 0x10000000084, 0x18, 0x0, 0x8) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) setsockopt$auto(r3, 0x10000000084, 0x23, 0x0, 0x8) r4 = getpid() process_vm_readv$auto(r4, &(0x7f0000000000)={0x0, 0xfff}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000140), 0x40000000001243}, 0xa, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_NFSD_CMD_LISTENER_SET(r6, &(0x7f0000003140)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000000200)={0x14, r7, 0x1, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x48080) sendmsg$auto_NFSD_CMD_LISTENER_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r7, 0x1, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4000804}, 0x50) rename$auto(&(0x7f0000000480)='./file0\x00', &(0x7f0000000100)='./file1\x00') openat$auto_vga_arb_device_fops_vgaarb(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) sendmsg$auto_IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ff837375d985f59734facb53e3d8fb919c9c9a877969f9e81724452c97bace68bcb31f76cb69da49809c8051ac96bdef8a921a40d316c7503d60d30d2fade9e0c7d5e2a0efdb2a7b3e4085488574631212ae71543c46b2e630720f7037b4547257a14a773686b5d0efebe83039cc3f11cf", @ANYRES16=0x0, @ANYBLOB="000827bd7000fddbdf252b000000140030009d7ad483e492af317593d93a9e7a9e3711001f007465616d5f736c6176655f300000000006000b00080000000500110005000000080014000800000005002b000300000006000e00f2ff000005002a00070000000500210000000000050003006a000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x8050) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r8, 0x1, 0x94d1) 1m55.136123969s ago: executing program 4 (id=1404): openat$auto_ftrace_enable_fops_trace_events(0xffffffffffffff9c, &(0x7f00000008c0)='/sys/kernel/tracing/events/vmalloc/purge_vmap_area_lazy/enable\x00', 0x2, 0x0) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) socket(0x10, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_RSS_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="010329bd700002dcdf2526000000abb0b40200631606ef2e536c99855cc69228962cdddadd56bbe38d0a4027f5f0c9de4079bf3472c44fa2d2f124181318d40f0000f1ad31ba4b5bc1a51329e87e0183d4de0969d769c2157bc3dbf14a27a3a132d0f23c6ec8c52bcd19d0854a8921e6174f9cba2fb7a209567f95c0b0aa5066c44ebe0f9c568385"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40) 1m54.753982821s ago: executing program 4 (id=1406): mmap$auto(0x3, 0x80002020009, 0x7, 0xfa, 0xffffffffffffffff, 0x400) syz_genetlink_get_family_id$auto_ovs_meter(0x0, 0xffffffffffffffff) setitimer$auto(0x10000, &(0x7f00000010c0)={{0x4, 0x8}, {0xfffffffffffffffe, 0x8}}, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000001280)='/proc/sys/net/ipv4/conf/wlan0/igmpv2_unsolicited_report_interval\x00', 0x0, 0x0) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x189002, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x26, 0x6, 0x1) r0 = openat$auto_rng_chrdev_ops_core(0xffffffffffffff9c, &(0x7f0000000000), 0x101040, 0x0) read$auto_rng_chrdev_ops_core(r0, &(0x7f0000000040)=""/4096, 0xfffffe82) syz_genetlink_get_family_id$auto_seg6(&(0x7f0000000b40), 0xffffffffffffffff) sendmsg$auto_SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000340)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x44}, 0x84) sendmsg$auto_SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000001040)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000001100)=ANY=[@ANYBLOB, @ANYRES16, @ANYRESDEC], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x4000004) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000001140)='/dev/snd/midiC2D2\x00', 0x1, 0x0) r1 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) write$auto_console_fops_tty_io(r1, &(0x7f0000000000)="c80d1b5d399b58", 0xfdef) mprotect$auto(0x200000000000, 0x806120, 0x0) landlock_create_ruleset$auto(&(0x7f0000000140)={0x100000daa0, 0x401, 0x9}, 0x7ffd, 0x0) 1m51.643806151s ago: executing program 4 (id=1417): socket$nl_generic(0x10, 0x3, 0x10) socket(0x11, 0x80003, 0x300) socket(0x11, 0xa, 0x300) r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/net/ptype\x00', 0x101000, 0x0) pread64$auto(r0, 0x0, 0x8, 0xffff) 1m51.441541379s ago: executing program 4 (id=1420): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x26000, 0x0) ioctl$auto_BLKTRACESETUP(r0, 0xc0481273, 0x0) 1m51.299830335s ago: executing program 4 (id=1422): bpf$auto(0x0, &(0x7f0000000100)=@task_fd_query={0xe, 0x4, 0x4, 0x10001, 0x8, 0xc, 0xffffffffffffffff, 0x9, 0x7ff}, 0xee) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sysfs$auto(0x2, 0x4b, 0x0) fsopen$auto(0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/profiling\x00', 0x82002, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000080)="2dfc", 0x2) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) socket(0x2b, 0x5, 0xfffffffd) mmap$auto(0x80000000, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000) ioctl$auto_VHOST_SET_FEATURES2(r3, 0x4008af00, &(0x7f0000000040)=0x3) ioctl$auto_SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000000240)=0x9) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mremap$auto(0xfffffffffffffe01, 0x40000000100005, 0x843, 0x3, 0x2) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r4 = openat$auto_tracing_iter_fops_trace(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/tracing/trace_options\x00', 0x2, 0x0) write$auto(r4, 0x0, 0x6) madvise$auto(0x0, 0x2003f2, 0x15) openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/tracing/error_log\x00', 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x100, 0x5, 0x0, 0x8001) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) sendfile$auto(r5, r5, 0x0, 0x3) 1m50.202744419s ago: executing program 4 (id=1425): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/devices/virtual/net/lapb2/statistics/tx_errors\x00', 0xd00e2, 0x0) r0 = getpid() unshare$auto(0x40000080) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x4, 0xffb, 0xecb8, 0x3, 0x354e) r1 = prctl$auto(0x1b, 0x6, 0x0, 0x0, 0x0) openat$auto_rfkill_fops_core(0xffffffffffffff9c, &(0x7f0000000140), 0x2c0b83, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000001040)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(0xffffffffffffffff, &(0x7f0000000340)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x8, 0x7, 0x7, 0x20, 0x9687, 0x100000000000003, 0x3c2a19d5, 0x6, 0x3, 0x62, 0x8, 0x7, 0x6d3f, 0x6, 0xa, 0xfffffffffffffffe]}, 0x0) openat$auto_nsim_udp_tunnels_info_reset_fops_udp_tunnels(0xffffffffffffff9c, 0x0, 0x20000, 0x0) unshare$auto(0x20000) prctl$auto_PR_GET_AUXV(0x41555856, 0x5400000000000000, 0x5, 0x0, 0x5) ioctl$auto(0xffffffffffffffff, 0x5646, 0xffffffffffffffff) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000240), r1) r2 = pidfd_open$auto(0x1, 0x0) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xf6\x04W\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xed\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\x9bg\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'veth1_virt_wifi\x00', 0x0}) sendmsg$auto_NETDEV_CMD_QUEUE_GET(r2, &(0x7f0000000480)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, 0x0, 0x4, 0x70bd29, 0x25dfdbfe, {}, [@NETDEV_A_QUEUE_TYPE={0x8, 0x3, 0x101}, @NETDEV_A_QUEUE_IFINDEX={0x8, 0x2, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000050) setns(r2, 0x60020000) process_vm_readv$auto(r0, 0x0, 0x800000001, 0x0, 0x6, 0x0) openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x2000, 0x0) socket(0xa, 0x3, 0xff) fcntl$auto(0x3, 0x4, 0xffffffffffffffff) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x40001, 0x0) socket(0x18, 0x5, 0x1) 1m34.000935999s ago: executing program 33 (id=1425): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/devices/virtual/net/lapb2/statistics/tx_errors\x00', 0xd00e2, 0x0) r0 = getpid() unshare$auto(0x40000080) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x4, 0xffb, 0xecb8, 0x3, 0x354e) r1 = prctl$auto(0x1b, 0x6, 0x0, 0x0, 0x0) openat$auto_rfkill_fops_core(0xffffffffffffff9c, &(0x7f0000000140), 0x2c0b83, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000001040)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(0xffffffffffffffff, &(0x7f0000000340)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x8, 0x7, 0x7, 0x20, 0x9687, 0x100000000000003, 0x3c2a19d5, 0x6, 0x3, 0x62, 0x8, 0x7, 0x6d3f, 0x6, 0xa, 0xfffffffffffffffe]}, 0x0) openat$auto_nsim_udp_tunnels_info_reset_fops_udp_tunnels(0xffffffffffffff9c, 0x0, 0x20000, 0x0) unshare$auto(0x20000) prctl$auto_PR_GET_AUXV(0x41555856, 0x5400000000000000, 0x5, 0x0, 0x5) ioctl$auto(0xffffffffffffffff, 0x5646, 0xffffffffffffffff) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000240), r1) r2 = pidfd_open$auto(0x1, 0x0) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xf6\x04W\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xed\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\x9bg\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'veth1_virt_wifi\x00', 0x0}) sendmsg$auto_NETDEV_CMD_QUEUE_GET(r2, &(0x7f0000000480)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, 0x0, 0x4, 0x70bd29, 0x25dfdbfe, {}, [@NETDEV_A_QUEUE_TYPE={0x8, 0x3, 0x101}, @NETDEV_A_QUEUE_IFINDEX={0x8, 0x2, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000050) setns(r2, 0x60020000) process_vm_readv$auto(r0, 0x0, 0x800000001, 0x0, 0x6, 0x0) openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x2000, 0x0) socket(0xa, 0x3, 0xff) fcntl$auto(0x3, 0x4, 0xffffffffffffffff) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x40001, 0x0) socket(0x18, 0x5, 0x1) 7.9049802s ago: executing program 5 (id=1866): r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/netdevsim/del_device\x00', 0x501, 0x0) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/pcm0p/sub5/hw_params\x00', 0x44000, 0x0) mmap$auto_proc_reg_file_ops_compat_inode(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x4000010, r1, 0x80) r2 = socket(0x10, 0x2, 0x0) r3 = semctl$auto(0x800, 0x5, 0x3, 0x2) r4 = openat$auto_proc_mountstats_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$auto_proc_mountstats_operations_mnt_namespace(r4, &(0x7f00000003c0)=""/63, 0x3f) msgctl$auto_IPC_STAT(0x1, 0x2, &(0x7f0000000340)={{0x200009, 0xee00, 0x0, 0x10000, 0x9, 0x4, 0xae}, &(0x7f0000000140)=0x9, &(0x7f0000000280)=0x9, 0xbed, 0x5b66, 0x5b1, 0x0, 0xe7f, 0x9, 0x9, 0x3, @raw=0xf8000000, @inferred=r3}) lstat$auto(0x0, &(0x7f0000000180)={0x8, 0x0, 0x100000008, 0x3, 0x0, r5, 0x0, 0x10001, 0x6, 0x9, 0x400, 0xfffffffffffffffb, 0xc, 0xffffffff80000000, 0x1, 0x65, 0x103}) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYBLOB='^\x00\''], 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x40000) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8) write$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000040)="3290b800009c550d22350f737ca2dd0af0d849aec832ec49c034169af8fa9231c143b1a8dd292977588a83400445ddc508f3aef64488936413adba3a9cc99bdfd8e7000000", 0x45) 6.303686582s ago: executing program 5 (id=1873): bpf$auto(0x9, &(0x7f00000000c0)=@batch={0xffffffffffff3c77, 0x8000000037, 0x0, 0x5, 0x9, 0xffffffffffffffff, 0x6, 0x5852}, 0x1b) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'veth1_to_bond\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'dvmrp1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bond0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ac000000", @ANYRES16=0x0, @ANYBLOB="020025bd7000fddbdf250200000050e62a56b13b2dbbaa00018014000200766972745f776966693000000000000014000200766972745f776966693000000000000008000300010000001400020070696d726567000000000000306486776e9fc2a744fac1f17abeea2542b1b03cda313161b061047c683c7f58f49efd37bc078ced55", @ANYRES32=r1, @ANYBLOB="300001801400020076657468315f746f5f6261746164760008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="0800030000000000180001801400020076657468315f766c616e000000000000"], 0xac}, 0x1, 0x0, 0x0, 0x10000}, 0x4000000) mmap$auto(0x0, 0x2020009, 0x100003, 0x9000000eb1, 0xfffffffffffffffa, 0x0) sendmsg$auto_NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x80) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0x1a, &(0x7f0000000000), 0x1) r4 = openat$auto_xfs_dir_file_operations_xfs_file(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/bluetooth/hci1/power\x00', 0x1, 0x0) ioctl$auto_XFS_IOC_SET_RESBLKS(r4, 0xc0105872, &(0x7f00000000c0)={0xfffffffffffffff9, 0x5}) r5 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff) close_range$auto(r0, r4, 0xfffffffa) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x3c, r5, 0x1b, 0x70bc23, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_PROBE={0x4}, @OVS_PACKET_ATTR_ACTIONS={0xc, 0x3, 0x0, 0x1, [@typed={0xfffffffffffffe03, 0xb}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f17790485908286dd"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800) 5.889396469s ago: executing program 5 (id=1875): unshare$auto(0x93a3) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) socket(0x10, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_RSS_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="010329bd700002dcdf2526000000abb0b40200631606ef2e536c99855cc69228962cdddadd56bbe38d0a4027f5f0c9de4079bf3472c44fa2d2f124181318d40f0000f1ad31ba4b5bc1a51329e87e0183d4de0969d769c2157bc3dbf14a27a3a132d0f23c6ec8c52bcd19d0854a8921e6174f9cba2fb7a209567f95c0b0aa5066c44ebe0f9c5683"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x40) 5.723468757s ago: executing program 5 (id=1877): ptrace$auto(0x10, 0x0, 0x4, 0x7ff) r0 = openat$auto_fops_u8_(0xffffffffffffff9c, &(0x7f00000014c0)='/sys/kernel/debug/nfcsim/nfc0/dropframe\x00', 0x20000, 0x0) read$auto_fops_u8_(r0, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/platform/vhci_hcd.0/detach\x00', 0x101001, 0x0) write$auto(r1, &(0x7f00000000c0)='0\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c(\xdb', 0x10010000085) unshare$auto(0x801) semget$auto(0x0, 0x2e4a, 0x8000) semtimedop$auto(0x0, &(0x7f0000000000)={0x7, 0x9, 0x36ec}, 0x1f4, 0x0) mkdir$auto(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x8cd) bpf$auto_BPF_OBJ_GET_INFO_BY_FD(0xf, &(0x7f00000002c0)=@test={0xffffffffffffffff, 0x0, 0x856, 0x189, 0x8, 0x7fff, 0x7fff, 0x10000, 0xc91a, 0x7, 0x5, 0x3, 0x3, 0x3, 0x6}, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) inotify_init1$auto(0x3000000000000) socket$nl_generic(0x11, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/smaps_rollup\x00', 0x840, 0x0) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0xa, 0x1, 0x84) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @local}, 0x54) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r2) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x805, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004044}, 0x8000) r4 = socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) mmap$auto(0xfffffffffffffffd, 0x2000b, 0xa169, 0x16, r4, 0x3) 5.095216285s ago: executing program 5 (id=1880): openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cec27\x00', 0x80200, 0x0) r0 = openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/ubifs/chk_fs\x00', 0x101000, 0x0) read$auto_dfs_global_fops_debug(r0, 0x0, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = prctl$auto(0x41, 0x3, 0x0, 0x0, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$auto_SO_PEEK_OFF(r2, 0x0, 0x2a, 0x0, 0x6) pwritev$auto(r1, 0x0, 0x2, 0xfffffffffffff274, 0x6) msgget$auto(0xc, 0x77d9) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto_USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f0000000040)=0x1) r3 = openat$auto_btrfs_ctl_fops_super(0xffffffffffffff9c, &(0x7f0000000380), 0x400000, 0x0) sendto$auto(r1, 0x0, 0xffffffffffffbdef, 0x101, 0x0, 0x1c) r4 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4], 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810) syslog$auto(0x3, &(0x7f0000000080)='..\x00k\xce\xa0\x17\bI3\'\xc5tw\xd7\x1d\x00\x80\x00\x00\x00\x00\x00\x00j<\v\xf47\n\xa7\xd2\x8b\x11e1\xb3\xfdd\x04\xa9 1q\x97\xc4,\xa9^\xc1\xb6\xa1q\x0f\xd1\x013\x87l\xb9\x1e\x05\x90\xa2', 0x5) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)) getdents$auto(r5, 0x0, 0xa2b0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/block/ram6/queue/max_hw_sectors_kb\x00', 0x80000, 0x0) r6 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000180), 0x40900, 0x0) ioctl$auto_UBI_IOCATT(r6, 0x40186f40, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYRES16=r3, @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) setresuid$auto(0x2, 0x7, 0x0) 4.356543289s ago: executing program 5 (id=1882): r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x300c00, 0x0) ioctl$auto_TIOCGDEV2(r0, 0x80045432, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) clock_getres$auto(0xfffffffd, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) mmap$auto(0x1, 0x7, 0x1000df, 0x8216, 0xffffffffffffffff, 0x8000) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, 0x0) r2 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000003cc0)='/dev/bus/usb/016/001\x00', 0x1, 0x0) ioctl$auto_USBDEVFS_FREE_STREAMS(r2, 0x8008551d, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000001080)="7a47301037954c081c9a0bb04ef84993eab91abe1686f43e43d786e91365f04455bd620de9f3fb6d25e6c078c1a672c549dbc7876cb528ba081a81d884bfc00dd4eef57cedc0cc3756ff6a5b0aa8ba9511fe2b07c6e7f4732fe36ba2") read$auto(0xffffffffffffffff, 0x0, 0x1f40) ioctl$auto(0xc8, 0x800454e1, 0x5c8d) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) read$auto(0x3, 0x0, 0x8080) sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810) sendmsg$auto_SMC_NETLINK_DUMP_UEID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40015}, 0x4) mknod$auto(&(0x7f0000000040)='./file0\x00', 0x1001, 0x4) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) write$auto(0x3, 0x0, 0x100082) ioctl$auto_SNDRV_PCM_IOCTL_INFO2(0xffffffffffffffff, 0x81204101, &(0x7f0000000280)={0x3, 0x8001, 0x4, 0x0, "8ae984f59ad56b41628d5ce9d7e8509b5967fbfaeacb8d14b00c0effa6eff1c9bbc3de6bc0e87cae64fc94e1e73af322af1fc3330217dc7315eceb81671b5307", "f26087d90f39ef2715449a676612aa63d1229bfb5df2181f72919b51608d6dd7bf0793e003b6d1c2d6ba4551f19d44d0061fe47d742381fbdea19e01f10af002d023cf7851bbeaa163b8c98aacb98c49", "07bfdd649515caa087cbd691cbeb27f55a8beda3e933e252089a4abd4633aef7", 0x9b58, 0x5, 0x1, 0x9a, '\x00', "029b411bc31b3e0b801d22d72268831b6b48389cbd28c10350eb4fedd57919887772e8952f2605b3f0b4b17fdf3ad1bfde0ddb3c38c734d3990c2f45dbf64f73"}) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') fchdir$auto(r3) mount$auto(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@J\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x5, 0x0) getegid() socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) 4.230513916s ago: executing program 3 (id=1883): mmap$auto(0x0, 0x2020009, 0x6, 0xf8, 0xfffffffffffffffa, 0x8000) r0 = socket(0x15, 0x5, 0x0) acct$auto(&(0x7f0000000100)='./cgroup/cgroup.subtree_control\x00') unshare$auto(0x40000080) write$auto(0xca, &(0x7f00000000c0)='\x04>\x01\x01\x00J:\xdd\xfc\xb6\xc6\x0f\xaf\xe3\x0f\xd1V\xb1yz\\\xa6\xed\ag+\xa3p(\xe2\x1b\xdc7\x1b\xc4TM}\xce\x90\xfa9\x957\xec\xd8\xe0TC\x86\xad\xe1G\xc7\xd4\x96\x12h\x84;Y\xe2\x03i\xa1)`\n\xc3\xfeR\x06\x03\xf5/@\xf0\'\xb9\xdf\xe1\xef\v\x19B\xc0\xe2\xac\xa5^\x01D\xef\xaf#\xbc\xa5\xf9J\xdc\xc3),=1\b\x05\x9d\x82\xd4\'\xe8\xfe\xfd\x9a\x9f\x00\x00\x00\x00\x00\x00\x00\x00', 0x7f) writev$auto(r0, &(0x7f0000000140)={&(0x7f0000000040)="2e4a68c27a01b1d2b299226dfa21fb52520c500021022a4393fa346001e72254a9a4f67fdb2e617d490f90a38fe4fc723eb7b727", 0xc4}, 0x9) truncate$auto(0x0, 0xfffffffffffffffe) io_uring_register$auto_IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, 0x0, 0x5cd) mmap$auto(0x1, 0x20009, 0x4000000000df, 0xebe, 0x401, 0x8000) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0xe0301, 0x0) mmap$auto(0x0, 0x3, 0x10, 0xeb1, 0x403, 0x8000) mmap$auto(0x0, 0x5b7, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x18, 0xffffffffffff0001, 0x15) r2 = waitid$auto_P_PID(0x1, 0x0, &(0x7f00000002c0)={@siginfo_0_0={0x6, 0x6, 0x4, @_sigpoll={0x4, r1}}}, 0xec2, 0x0) prctl$auto(0x9, 0x400, r2, 0x100000, 0x7) pkey_mprotect$auto(0x800000000000, 0xb, 0x6, 0x0) acct$auto(&(0x7f0000000180)='./cgroup/cgroup.subtree_control\x00') 3.725754387s ago: executing program 3 (id=1885): bpf$auto(0x0, &(0x7f0000000100)=@task_fd_query={0xe, 0x4, 0x4, 0x10001, 0x8, 0xc, 0xffffffffffffffff, 0x9, 0x7ff}, 0xee) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) fsopen$auto(0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/kernel/profiling\x00', 0x82002, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000080)="2dfc", 0x2) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) setpriority$auto(0x80000, 0xee00, 0x1c54) socket(0x2b, 0x5, 0xfffffffd) mmap$auto(0x80000000, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000) ioctl$auto_VHOST_SET_FEATURES2(r3, 0x4008af00, &(0x7f0000000040)=0x3) ioctl$auto_SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000000240)=0x9) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mremap$auto(0xfffffffffffffe01, 0x40000000100005, 0x843, 0x3, 0x2) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r4 = openat$auto_tracing_iter_fops_trace(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/tracing/trace_options\x00', 0x2, 0x0) write$auto(r4, 0x0, 0x6) madvise$auto(0x0, 0x2003f2, 0x15) openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/tracing/error_log\x00', 0x2, 0x0) setsockopt$auto(0xffffffffffffffff, 0x100, 0x5, 0x0, 0x8001) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) sendfile$auto(r5, r5, 0x0, 0x3) 3.337901016s ago: executing program 2 (id=1889): socket(0x2, 0x3, 0x2) (async) write$auto(0xffffffffffffffff, &(0x7f0000000080)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(', 0xa) unshare$auto(0x40000080) (async) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) (async) mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32) mmap$auto(0x0, 0x20005, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) (async, rerun: 32) statmount$auto(0x0, &(0x7f0000000180)={0x7d4, 0x1, 0x401c2, 0x2081, 0x3f, 0x7ffc, 0x1ffde, 0x8001, 0x2, 0x4, 0x9, 0x3, 0x5, 0x8, 0x200000003004, 0x9, 0x6, 0x10002, 0x80, 0x400, 0xa9, 0x1000, 0x401ffc, 0x8203, 0x400, 0x2, 0x1, 0x0, 0x40, 0x4, 0x2, [0x7249, 0xa9d, 0x0, 0x1000000000000000, 0x0, 0x7, 0x2, 0x0, 0x0, 0x200000000000000, 0xfc6a, 0x1000000, 0x10000, 0x40000000000, 0x0, 0x500000000000, 0x80000000000000, 0x0, 0xffffffffff7ffffc, 0x5, 0x0, 0x2, 0xfff, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0xb, 0xfffffffffffffffc, 0x400000000000002, 0xfffffffffffffffc, 0x3, 0x1, 0x5, 0xfffffffffffffffc, 0x4]}, 0x1fe, 0xd) (async) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x24008000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4000019}, 0x40001) (async) r1 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x1f, &(0x7f0000000100)={0x0, 0x5}, 0x2, 0x0, 0x7, 0xa505}, 0x2}, 0x7, 0x4008) (async, rerun: 32) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) (rerun: 32) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) (async) mmap$auto(0x0, 0x400005, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0x49, 0x0) (async) r2 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) ioctl$auto_FS_IOC_FSSETXATTR(r2, 0x401c5820, 0x5) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) shmctl$auto_SHM_STAT(0x101, 0xd, &(0x7f0000000500)={{0x6, 0xee00, 0xee01, 0x2, 0x1, 0x9, 0x4317}, 0x4, 0x807, 0x1, 0x5bc132, @raw=0x6, @raw=0x6, 0x3ff, 0x0, &(0x7f0000000380)="7e78655b3b9c671b46b580828bc0dd91b9eec0faebbaec3259f73a94f0fef585d0d1f1a3d39498a5f2385db445c7d58da5c109192ac1c903491b144c786cf7b266226048d1043641df56fe5e2ef18711438996fb1cc0a5a3ac3d851afcbce9bdd56ac17e3207f36f76fd2c124bb87656fd88096c3d091967e64b92ee6e3f25e472c3af0bf541131f14247070692fb734aba5a4ce41d1db96ea0801329d0ae1ebac7ba3103063", &(0x7f0000000440)="d2109d246b50a027fad15dd37cb2f8cc7266cedf85116e065605e090daaa62cc1e4931cd35e37b6186fe268f98a95380d5e2e3ddee6a18a69ad940e9a9d34e027b11dc346eda19c2bfae87a7b3351a514fd792ee72b7fd276e2a6a61775b2605ace1720acbb592b5f12a0e0e3ce27712623f14fa7527cde782d3ee09ffb739eef7c8d4049257f6a4b869e09dcbb79b2c50eaca9e61f972c8d10b2d0b76f16622c73f52e236ee33c05f1df0212e0d"}) (async) ioctl$auto_XFS_IOC_FREESP(r2, 0x4030580b, &(0x7f0000000600)={0x7, 0xa, 0xf7d, 0x6, 0x4, 0x0}) msgctl$auto_IPC_INFO(0x6, 0x3, &(0x7f0000000640)={{0x9fc, r5, 0x0, 0x4, 0x6, 0x40, 0x6}, &(0x7f0000000580)=0x5, &(0x7f00000005c0), 0x101, 0x8, 0xffffffffffffffff, 0x1, 0x8, 0x9, 0x6, 0x3, @raw=0x9, @inferred=r6}) sendmsg$auto_NFSD_CMD_THREADS_GET(r4, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000001780)={0x14, 0x0, 0x4, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x44848}, 0x4000000) (async) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f00000019c0), r4) r7 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), r4) sendmsg$auto_ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, r7, 0x609, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x8810) setsockopt$auto(0x3, 0x0, 0xcf, 0xfffffffffffffffc, 0x4) 3.126326019s ago: executing program 2 (id=1890): mmap$auto(0x0, 0x20009, 0xde, 0xeb1, 0x405, 0x8000) mmap$auto(0x0, 0x4020009, 0xdf, 0xebf, 0x401, 0x8000) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0) write$auto(r0, 0x0, 0x800000008) ioctl$auto_SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000180)="dd06d1574c0a1719baadf81f683297e8af14b4dad2728892c747c5e01a1b7165a54b36471475e5b56eef9a6bd918ceb4aef4e8bcdd0f2bd3802806ade2") 3.051654199s ago: executing program 2 (id=1891): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x9, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) r0 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @remote}, 0x6a) sendmmsg$auto(r0, &(0x7f0000000000)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xfffbfffd}, 0xffff}, 0x4000, 0x20000043) mmap$auto(0x3, 0x2020009, 0x3, 0xeb1, r0, 0x8000) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000480)={'veth0_to_bridge\x00'}) connect$auto(0x3, &(0x7f0000000440)=@generic={0x22, "afdeba1b5f163a564d9c28753369"}, 0x2091) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) sendmmsg$auto(0xffffffffffffffff, 0x0, 0x9a6, 0xe32) syz_genetlink_get_family_id$auto_nlbl_unlbl(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), r1) sendmsg$auto_NL80211_CMD_UPDATE_FT_IES(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r2, 0x100, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_VHT_CAPABILITY={0x1f, 0x9d, "2201153bf182ba92571c7c247d2c1f881b438fdcf1fea617323b4b"}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x20000}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}, @NL80211_ATTR_FREQ_FIXED={0x4}, @NL80211_ATTR_MLO_RECONF_REM_LINKS={0x6, 0x14f, 0x3}, @NL80211_ATTR_RADAR_BACKGROUND={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x2c044814) move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ram8\x00', 0x16fa02, 0x0) sendfile$auto(0x3, r3, 0x0, 0x400000000006) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/kernel/task_delayacct\x00', 0x80282, 0x0) select$auto(0x4, 0x0, 0x0, &(0x7f0000000080)={[0x1ff, 0x7, 0x3, 0x1, 0x7, 0x1000000000000004, 0x15f4da0a, 0x4000000400039, 0x3, 0x2bffffffffffffe, 0x80000002, 0x7a142c64, 0x6d3c, 0x5, 0x80, 0xfb]}, 0x0) shutdown$auto(0x200000003, 0x2) setreuid$auto(0x3, 0x7) io_uring_register$auto_IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, &(0x7f0000000240)="e256b9e63a96e3898bf7126505f65a498818f2c6010bf9450753ed84f640db09f20569c318f4c95219cbefea92610694ddd78c7ed8a38bea5f22dce6a4ffc9db79ef5626469ca58e6a1fb589fd252773d4e244c1315dc563162f50e8aba13cf34b4ac9719ad426bd7fc473ee1ae211a74fa163a4aa6edd2f23715e9d", 0x2) 2.742827005s ago: executing program 3 (id=1892): io_submit$auto(0x51e, 0x10004, &(0x7f0000000180)=&(0x7f0000000000)={0x9, 0x1000, 0x2, 0x8001, 0x8, 0xffffffffffffffff, 0x5, 0x80000001, 0xfffffffffffffffd, 0x0, 0x405, 0xffffffffffffffff}) fcntl$auto_F_OFD_GETLK(r0, 0x24, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0xffffffffffffffff, 0x8000) io_uring_setup$auto(0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000000140)='/dev/binderfs/binder1\x00', 0x0, 0x0) ioctl$auto_BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x0) ioctl$auto_BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)="fc06c1f730b9d2867a8ba29f242cf38f59f712fcd917fee796") 2.221094496s ago: executing program 1 (id=1894): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x9, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) r0 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @remote}, 0x6a) sendmmsg$auto(r0, &(0x7f0000000000)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xfffbfffd}, 0xffff}, 0x4000, 0x20000043) mmap$auto(0x3, 0x2020009, 0x3, 0xeb1, r0, 0x8000) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000480)={'veth0_to_bridge\x00'}) connect$auto(0x3, &(0x7f0000000440)=@generic={0x22, "afdeba1b5f163a564d9c28753369"}, 0x2091) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) sendmmsg$auto(0xffffffffffffffff, 0x0, 0x9a6, 0xe32) syz_genetlink_get_family_id$auto_nlbl_unlbl(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), r1) sendmsg$auto_NL80211_CMD_UPDATE_FT_IES(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x50, r2, 0x100, 0x70bd28, 0x25dfdbff, {}, [@NL80211_ATTR_VHT_CAPABILITY={0x1f, 0x9d, "2201153bf182ba92571c7c247d2c1f881b438fdcf1fea617323b4b"}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x20000}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}, @NL80211_ATTR_FREQ_FIXED={0x4}, @NL80211_ATTR_MLO_RECONF_REM_LINKS={0x6, 0x14f, 0x3}, @NL80211_ATTR_RADAR_BACKGROUND={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x2c044814) move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ram8\x00', 0x16fa02, 0x0) sendfile$auto(0x3, r3, 0x0, 0x400000000006) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/kernel/task_delayacct\x00', 0x80282, 0x0) select$auto(0x4, 0x0, 0x0, &(0x7f0000000080)={[0x1ff, 0x7, 0x3, 0x1, 0x7, 0x1000000000000004, 0x15f4da0a, 0x4000000400039, 0x3, 0x2bffffffffffffe, 0x80000002, 0x7a142c64, 0x6d3c, 0x5, 0x80, 0xfb]}, 0x0) shutdown$auto(0x200000003, 0x2) setreuid$auto(0x3, 0x7) io_uring_register$auto_IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, &(0x7f0000000240)="e256b9e63a96e3898bf7126505f65a498818f2c6010bf9450753ed84f640db09f20569c318f4c95219cbefea92610694ddd78c7ed8a38bea5f22dce6a4ffc9db79ef5626469ca58e6a1fb589fd252773d4e244c1315dc563162f50e8aba13cf34b4ac9719ad426bd7fc473ee1ae211a74fa163a4aa6edd2f23715e9d", 0x2) 2.166077286s ago: executing program 2 (id=1895): sendmsg$auto_ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01008008000100000000000000005d8c000000000000", @ANYRES32=0x0, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'team_slave_0\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="130026bd7000fcdbdf2502"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r2 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/rpc/use-gss-proxy\x00', 0x0, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) ioctl$auto_VHOST_SET_OWNER(r2, 0xaf01, 0x5) ioctl$auto_VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000000)) 1.843801494s ago: executing program 3 (id=1896): mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_o2hb_debug_fops_heartbeat(0xffffffffffffff9c, &(0x7f0000001d80)='/sys/kernel/debug/o2hb/quorum_regions\x00', 0x0, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x189101, 0x0) mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0xa, 0x0) ioctl$auto(0xffffffffffffffff, 0xc040564a, 0xffffffffffffffff) 1.780360924s ago: executing program 3 (id=1897): close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/platform/vhci_hcd.6/usb22/22-0:1.0/usb22-port8/power/control\x00', 0x3bff69145f39d632, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000040)=""/44, 0x2c) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/v4l-subdev6\x00', 0x169000, 0x0) close_range$auto(0x2, 0x8, 0x0) socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000000), 0xc0402, 0x0) ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40043d04, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/sun\x00', 0xa0200, 0x0) pread64$auto(r2, 0x0, 0x6, 0x40008) madvise$auto(0x0, 0xffffffffffff0005, 0x17) close_range$auto(0xffffffffffffffff, 0x8, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = socket(0x2, 0xa, 0x5) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x10002, 0x0) prctl$auto_PR_TIMER_CREATE_RESTORE_IDS_ON(0x9, 0x1, 0x0, 0x6, 0x2) r4 = openat$auto_set_tracer_fops_trace(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/tracing/current_tracer\x00', 0x8000, 0x0) timerfd_settime$auto(r4, 0x4, 0x0, &(0x7f0000000280)={{0x6, 0xb382}, {0x5, 0xbd78}}) getsockopt$auto_SO_TXREHASH(r3, 0x1, 0x4a, 0x0, &(0x7f0000000080)=0x9) syz_genetlink_get_family_id$auto_nbd(0x0, 0xffffffffffffffff) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x200007, 0x19) msgctl$auto(0x0, 0x1, 0x0) 1.322069227s ago: executing program 1 (id=1898): close_range$auto(0x2, 0x8, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/bus/usb/032/001\x00', 0x80202, 0x0) nanosleep$auto(&(0x7f0000000180)={0x0, 0x44d4}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000600), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'dummy0\x00'}) sendmsg$auto_ETHTOOL_MSG_MODULE_FW_FLASH_ACT(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e80)=ANY=[@ANYBLOB="14160000", @ANYRES16=r1, @ANYBLOB="100028bd7000fddbdf252c000000"], 0x14}, 0x1, 0x1000060}, 0x8c011) shmctl$auto(0x8, 0xfffffffe, &(0x7f0000000140)={{0x3, 0xffffffffffffffff, 0xee00, 0x3ff, 0x6, 0x6, 0x400}, 0xffffffff, 0x4, 0x76d2, 0x3, @raw=0x6, @raw=0x9322, 0x40, 0x0, &(0x7f0000000040)="b5b8704c75117c52a0aee18e66292b885eec514213972b750b27c06199c226a6a333a6c0ba308d759a13b442eb3f708cebc821abf4185252d4f6a4e0bdf1fdfa25db53274435f55190c472b9069f8039ab068b32f9a52407216888532182847abca053bfb896b4d1e0a54d50809c29c8bea05411318197c5678fbcbcfb2e6c1966618f5d0e6c5cb50674409ad082704c9a4f727de1657a333f599c", &(0x7f0000000100)="fe3e14"}) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001640), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_LEAVE_OCB(r3, &(0x7f0000001f00)={0x0, 0x0, &(0x7f0000001ec0)={&(0x7f0000001800)={0xa0, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NL80211_ATTR_IE={0x8c, 0x2a, "3684a660bdccd1367bc48d95c45654a7d4ef122b5aaf580986f36c8305d02a0134617098711133f1352d29a8989d6853d2b62e6876842b9141c1f1baed01823c40a15b3a9b06aaa8c7fe2bcb43f0e02ab341b1480fd251e4695746cad00d4417d34c9d41ed33d62e634ac67f4a04ac804817cea529436086a5355b67030a24cc223223926569c0ee"}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) socket(0x11, 0x2, 0x6) socket(0x10, 0x80000, 0x75) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000780)='/proc/driver/nvram\x00', 0x10b402, 0x0) preadv$auto(0xffffffffffffffff, 0x0, 0x7, 0x7, 0x402) madvise$auto(0x110c230000, 0x8031ca, 0x9) read$auto_ptdump_fops_(0xffffffffffffffff, 0x0, 0x0) unshare$auto(0x40000080) r4 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card1/cable#1\x00', 0xc0f02, 0x0) pread64$auto(r4, 0x0, 0x3, 0x5ef6) r5 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r5, &(0x7f0000000500)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x95\x82 )\xca\x99h\xcf\xfdK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r6 = bpf$auto(0x0, &(0x7f0000000080)=@bpf_attr_4={0x1e, 0xffffffffffffffff, 0xffffffff}, 0xd) bpf$auto(0x3, &(0x7f00000001c0)=@link_update={r6, @new_prog_fd, 0x403, @old_map_fd=r6}, 0x9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) pread64$auto(0xffffffffffffffff, 0x0, 0x8100000041, 0x413e) mremap$auto(0xfffff000, 0x4, 0x4, 0x7, 0x1001ff000) r7 = open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) fcntl$auto(r7, 0x400, 0x1) 1.277153999s ago: executing program 2 (id=1899): r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, 0x0, 0x582, 0x0) write$auto_console_fops_tty_io(r1, &(0x7f0000001240), 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) close_range$auto(0x2, 0x8, 0x0) openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) setrlimit$auto(0xfff, &(0x7f0000000380)={0x14e2e7dd, 0x1}) pwrite64$auto(r0, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x88\xa8s\x1c\b\x06\x8a>)\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0x4e, 0x3) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cgroup.threads\x00', 0x80302, 0x0) sendmsg$auto_IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010028bd7000fedbdf250c0000001d000280d2f7abf5204c1c01107d33d6d37bc50e476301cfa9375e0781"], 0x34}, 0x1, 0x0, 0x0, 0x20004014}, 0x4014) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x80}, 0x40000) pwrite64$auto(0xc8, &(0x7f0000000040)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdde\x1cJ\x99\x00\x00\x00\x00\x00\x00\xfd\xfd\xd3\xd3\x1d\xf8\xbe\x01\x00\x00\x00\'\x03\x00\x00\x9f\x1e\xf9\xa4*\x01\x00\x00\x00^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e#\xae\xa9i8W\xe5Iq\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8dg\x81K*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,,\x93\xba\x88\x93\xc6#\xe5\xaae\x9d\xb6\x1a\x7f\xc0%\xb0\rfOJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd0\xbdn\x1d\x00\xeb]B\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00'/231, 0xfdf2, 0x3a) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) pwritev2$auto(r2, &(0x7f0000000180)={&(0x7f0000000140)="000d7fc249aa0ec38c9a6f0be872cac913c1b3aa34ebeaa54322d5382e257e7322ab8444fb236b2771f84812c234a93ccd457d0557ed91a8323c4d", 0x5}, 0x6, 0x800, 0x702, 0x6) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r3) kexec_load$auto(0x8, 0x17, &(0x7f0000002200)={@buf=&(0x7f0000000240)="557520b858fd7175472fcb0f3514254f0f98d090101503ecb7013ec18ea4c46a08f4c5220f9f6071c1cce3e0244c6143770c92d10a2e31e0ec68e825f7d13f9aa4922d42b69d796ca6d0ec0913459344fbe9eca33e6820d1d7fb65bc4616ddd621677e691ef2550ab8d6daf1d4a3d03414a0538c775be04927789269850425d3b13b61e6d87ffc75d8eaaf0b7dcbd09b94801009bb4586a2fac4942b20b518261f13a9468a2b42c9d04dccbf06f56a02f233928af6db2931d0fa4ba85fee747ddfb9b8c153cf1442be87b1991251dcf168373e9bd00291ecd58c39955b2073ceea8f29cd52518000ca7a35511e6a6b6fb0477f2ac0", 0x2, 0x7f, 0x9}, 0x1) close_range$auto(0xffffffffffffffff, 0x8, 0x0) mmap$auto(0x0, 0x9, 0xdf, 0xeb1, 0x401, 0x8000) pwrite64$auto(0xc8, 0x0, 0xfdef, 0x2) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/platform/i8042/serio0/scroll\x00', 0x2062, 0x0) write$auto(r4, &(0x7f00000001c0)='1\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) 782.206631ms ago: executing program 2 (id=1900): close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/platform/vhci_hcd.6/usb22/22-0:1.0/usb22-port8/power/control\x00', 0x3bff69145f39d632, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000040)=""/44, 0x2c) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/v4l-subdev6\x00', 0x169000, 0x0) close_range$auto(0x2, 0x8, 0x0) socketpair$auto(0x1, 0x4, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000000), 0xc0402, 0x0) ioctl$auto_posix_clock_file_operations_posix_clock(r1, 0x40043d04, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/sun\x00', 0xa0200, 0x0) pread64$auto(r2, 0x0, 0x6, 0x40008) madvise$auto(0x0, 0xffffffffffff0005, 0x17) close_range$auto(0xffffffffffffffff, 0x8, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = socket(0x2, 0xa, 0x5) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x10002, 0x0) prctl$auto_PR_TIMER_CREATE_RESTORE_IDS_ON(0x9, 0x1, 0x0, 0x6, 0x2) r4 = openat$auto_set_tracer_fops_trace(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/tracing/current_tracer\x00', 0x8000, 0x0) timerfd_settime$auto(r4, 0x4, 0x0, &(0x7f0000000280)={{0x6, 0xb382}, {0x5, 0xbd78}}) getsockopt$auto_SO_TXREHASH(r3, 0x1, 0x4a, 0x0, &(0x7f0000000080)=0x9) syz_genetlink_get_family_id$auto_nbd(0x0, 0xffffffffffffffff) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x200007, 0x19) msgctl$auto(0x0, 0x1, 0x0) 390.152365ms ago: executing program 1 (id=1901): mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), r0) sendmsg$auto_NL80211_CMD_SET_SAR_SPECS(r0, &(0x7f0000000640)={0x0, 0xe00, &(0x7f0000000600)={&(0x7f00000005c0)={0x20, r1, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c080}, 0x44) 279.767819ms ago: executing program 1 (id=1902): r0 = socket(0x2, 0x1, 0x106) bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) r1 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000200), 0xffffffffffffffff) r2 = getpid() process_vm_readv$auto(r2, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) r3 = getpid() r4 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/controlC2\x00', 0x88800, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_REMOVE(r4, 0xc0405519, &(0x7f0000000040)={@inferred=r3, 0x555c, 0xffff, 0x1, "8f9638544ae4bbdf48e497dbb5a3760f9b6b2c854e493a712fcbb4034dde3ba72adae5bfa41dba811bf5488f", @inferred=r3}) sendmsg$auto_MACSEC_CMD_ADD_RXSA(r0, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)={0x1b4, r1, 0x21a, 0x70bd26, 0x25dfdbfd, {}, [@MACSEC_ATTR_IFINDEX={0x8}, @MACSEC_ATTR_OFFLOAD={0x196, 0x9, 0x0, 0x1, [@nested={0x10b, 0xcf, 0x0, 0x1, [@nested={0x4, 0x23}, @nested={0x4, 0x125}, @typed={0x8, 0x108, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x48}, @typed={0x8, 0x14, 0x0, 0x0, @pid=r3}, @generic="e6446f71f73a398c33c24e4af0a6e83f9e5907bb4c835aae34bbd42141d3764dc575bc7dc038b33cd1296cb6bd507131d256e5d3e61db4af4cd3b0ed4193dfbb3d83ae2f978b404465895df08151a55a3a24223e5ebfbf1b115d50340092f2a1bdb2b079f637905fd6d60d434ec618a0f6c58305f3b90cbcede6dae23e7e3254c6eef8c615135423859a5e5eb2c9aaee2cfcbe8dcce55bddf3bd891e710b779e4529a9011769718d0cb7385082f63a3b6735406af5fd3ac374c05b202d66ad94e522b1753513d151e33f1bc3d2c784ec35c5194ce8df70eca14d07916d72bc6f6a360b", @nested={0x4, 0x158}, @nested={0x4, 0x119}]}, @generic="38fb688d195180b44ec3b46f184ab39ee6f47dea2adce30ba5c95b8bac7df5759c4e9e17efe78f044205c9ec38aa0eba98308010ce4c912fb358551f2e3f3b927c72cc1cac31072cc8681d261c3177b14391f05e7991cc45f35327b17081f81a2410c49ee5a7b4b09dbd166dab4b0f2140fa43e94f9e1b40568b546e84502be2ad3b9b15f5cf"]}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x44005}, 0x40) 213.791435ms ago: executing program 3 (id=1903): r0 = fsopen$auto(0x0, 0x1) fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0) process_madvise$auto_MADV_PAGEOUT(r0, &(0x7f0000000180)={0x0, 0x3}, 0x1, 0x15, 0x5) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) select$auto(0xd, 0x0, &(0x7f0000000400)={[0x8, 0x200000000005, 0x7, 0x7, 0x0, 0x80000004, 0xc, 0x6, 0x8fc, 0xb80, 0xe34c, 0x4009, 0x3, 0xfffffffffffff954, 0xfffffffffffffff8, 0xfff]}, 0x0, &(0x7f0000000080)={0x800000000001ff, 0x401}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) rt_sigqueueinfo$auto(0x0, 0xb, &(0x7f00000001c0)={@siginfo_0_0={0x3, 0x401, 0xfffffffb, @_timer={0x0, 0xd, @sival_ptr=0x0, 0x62}}}) shmctl$auto_SHM_INFO(0x441, 0xe, &(0x7f0000000580)={{0x81, 0xee00, 0xee01, 0x8, 0x772, 0x6, 0x7fff}, 0xb, 0x4, 0x3, 0x0, @inferred, @inferred=0x0, 0x3ff, 0x0, &(0x7f0000000480)="4ef0cefe10b2587e5bf7e874", &(0x7f00000004c0)="2fc8ec3b1468265c4d230b25ebc89115c4efae75230b1de490bc7897d37d7a1c3c39fe3be11419266953b809bf5619f929538a17aa86d6779bd142b91739a9528eedb4bfbaed59f984abb5d681bed5e21213f4f20782afc9d71aa1a35c373fc6c384c7599f93412ce046179e688e30922f7764b845bba984858c060aef97391b1b52dcc19b9db17482ce93514cf0d7191d249f1a32725230ead457a3d4427dee9bcdd837dc1d72cf91712f7f03767d1f612628f165653d99b0"}) sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(r0, &(0x7f0000002c80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000002c40)={&(0x7f0000000a40)={0x354, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_MAC_ADDRS={0x32b, 0xa6, 0x0, 0x1, [@typed={0x8, 0xa, 0x0, 0x0, @pid=r1}, @nested={0xe, 0xb2, 0x0, 0x1, [@generic="226aa139a6fc2f572338"]}, @nested={0xfd, 0xb2, 0x0, 0x1, [@nested={0x4, 0x155}, @typed={0x8, 0x5b, 0x0, 0x0, @ipv4=@local}, @typed={0x8, 0x7, 0x0, 0x0, @ipv4=@remote}, @generic="880a7e1fa0a565908a7aec43e93b5c8e2f8e531b49b8677dbca6ccf44f7f035855df19e74b2201eb593700c85a1b2ec5f3ae03b5cc759c3b5fc5ebfcc513611a", @generic="772630d4ea854e455474743737a4bce043ff0462edaa6dcd2b97368425078254d0c23448804a4839df804fcf74e132cb71e67839122bc34ad5e802beb6ec38c4326dfa5ae52aa5363fb81bfcb842e87bbf5cbeb70645e2b9c77d6359aefd99dbb64c8a72086c5da7f9ec059fea8f931adfc79335d8f06ba3844b0abcd5fb8092b59839948b9f0a67491b91de2c210dfa2139cbe2a6a1883133785d2c94ca76ec33626c7fc7"]}, @generic="3fee4784ea23a632cae6941c585d011d5a13d6aa11ba2143440a59cdec4df62f9d77bc56fb613b623ad0857cf2a82924ab81fbe5488f7ed2bdc0d6d0d0a5b77406df17b2d2b754a435dc5c96c208209ad5f4b4e33a275420901c0db44f0a06a2fa6f3f65c65b135e9f3a88cbf924c750a0e2589f76990f8b9da644edf6dec84d36bc48a89b3708875003e2367a094d9d3d37bbee9a5cbd45e9f607c132c050d0ce5aa38e8893ad16fcecec53e05d121ef50fb8b613bc994b968bde403d21d740c71d2212c0181c0b5e527d48fa19f820107ab0f6d006900441821d2d6db374", @nested={0x12d, 0x156, 0x0, 0x1, [@nested={0x4, 0x95}, @generic="1060dad00db5ccc6881808a96697bbfd90c4514ebe341b59b89635d8abc23c55016a928b04a0b4a61764845da33c6db55e9b01297d4a1aabb210e0b16dafebdc714e3efd925491dd1bea0ac5f336a1bd4344c1231b7ae5a537ee3ecfec6fa7c4fb95ef34bc2790578a5e348b9102216a23c3", @nested={0x4, 0x1c}, @generic="7e72d9ce399a024a1d0885146ebc1027dbabb70e962443cfdbc52d4f8e5afcf14e408bcbe0498c453cdb1b3eed1b58bf26c1876a111f476cf286a24ae87d44cab65a25dd43f5f87c6fadbc3f5437ae7d78139758ab0ecdab385267bbb5ed6dcf7d759c6d3583910ed5450df9b5875a3f3fcff476afa3539d", @typed={0xc, 0x10b, 0x0, 0x0, @u64=0x7}, @generic="fcea25409dda4931b76eeba7becd4ce180a8fb4ab615fc52549812e5e60c18713cc42b30f5c010a409596c"]}]}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x7}]}, 0x354}, 0x1, 0x0, 0x0, 0x8080}, 0x80) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) set_mempolicy$auto(0x6, 0x0, 0x9) socket$nl_generic(0x10, 0x3, 0x10) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0xe01, 0x0) setresgid$auto(0xffffffffffffffff, 0xee00, 0x0) r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r2, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2T\xc0\x1d\xa4\x10r\xc4\xa2\xb1y\t\x05\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xed\rW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1', 0x100000001) write$auto(0xffffffffffffffff, &(0x7f0000001440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3\xb8\xc0\x1f\xe6\x9f\x9cy\xa9\xad\x96\x19Fy\x11}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdf\x17\xe4\xcbA\xa5[\x1aG\xa6\x94\xe0\xdf\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(W| \xce\xcc\xdd%\xcf\xab\xa8\xafhM\x0f%\xc4C9~\xfe\x02]\xedVfQ', 0xf) write$auto(r2, &(0x7f0000000080)='S\x00\x00\x00\xfe\xff\xff\xff', 0x8587) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x0, 0x0) openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec29\x00', 0x900, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000) 169.731874ms ago: executing program 1 (id=1904): rseq$auto(&(0x7f0000000200)={0x0, 0x7, 0x8, 0x55d, 0x79f9, 0x10, "8f5911253f83"}, 0x78e5, 0xd, 0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="2f212cbd7000fcdbdf", @ANYRES32=r2, @ANYBLOB="10002c80"], 0x2c}}, 0x4000000) 0s ago: executing program 1 (id=1905): io_submit$auto(0x51e, 0x10004, &(0x7f0000000180)=&(0x7f0000000000)={0x9, 0x1000, 0x2, 0x8001, 0x8, 0xffffffffffffffff, 0x5, 0x80000001, 0xfffffffffffffffd, 0x0, 0x405, 0xffffffffffffffff}) fcntl$auto_F_OFD_GETLK(r0, 0x24, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0xffffffffffffffff, 0x8000) io_uring_setup$auto(0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000000140)='/dev/binderfs/binder1\x00', 0x0, 0x0) ioctl$auto_BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x0) ioctl$auto_BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)="fc06c1f730b9d2867a8ba29f242cf38f59f712fcd917fee796") kernel console output (not intermixed with test programs): 648] zram: Error allocating disk structure for device 0 [ 359.676934][T11684] netlink: 'syz.2.1241': attribute type 1 has an invalid length. [ 361.368898][T11739] vhci_hcd: not connected 4 [ 361.796710][T11750] netlink: 'syz.2.1254': attribute type 1 has an invalid length. [ 361.838030][T11755] vhci_hcd: not connected 4 [ 364.279471][T11820] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 364.285611][T11820] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 364.301396][T11820] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 364.336872][T11818] netlink: 'syz.1.1268': attribute type 1 has an invalid length. [ 364.463128][T11826] vhci_hcd: not connected 4 [ 365.019056][T11830] FAULT_INJECTION: forcing a failure. [ 365.019056][T11830] name failslab, interval 1, probability 0, space 0, times 0 [ 365.062581][T11830] CPU: 0 UID: 0 PID: 11830 Comm: syz.1.1270 Not tainted syzkaller #0 PREEMPT(full) [ 365.062609][T11830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 365.062620][T11830] Call Trace: [ 365.062627][T11830] [ 365.062634][T11830] dump_stack_lvl+0x100/0x190 [ 365.062661][T11830] should_fail_ex.cold+0x5/0xa [ 365.062680][T11830] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 365.062700][T11830] should_failslab+0xc2/0x120 [ 365.062721][T11830] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 365.062738][T11830] ? mas_preallocate+0x1105/0x14a0 [ 365.062763][T11830] mas_preallocate+0x1105/0x14a0 [ 365.062787][T11830] ? __pfx_mas_preallocate+0x10/0x10 [ 365.062812][T11830] ? vm_area_alloc+0x1f/0x160 [ 365.062838][T11830] ? lockdep_init_map_type+0x5c/0x250 [ 365.062866][T11830] __mmap_region+0x1230/0x2db0 [ 365.062895][T11830] ? __pfx___mmap_region+0x10/0x10 [ 365.062921][T11830] ? __pfx___might_resched+0x10/0x10 [ 365.062947][T11830] ? process_measurement+0x4c8/0x2350 [ 365.063020][T11830] ? lock_release+0x24d/0x310 [ 365.063044][T11830] ? down_write+0x146/0x1f0 [ 365.063067][T11830] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 365.063084][T11830] ? rcu_is_watching+0x12/0xc0 [ 365.063102][T11830] ? lock_release+0x24d/0x310 [ 365.063127][T11830] ? do_raw_spin_unlock+0x145/0x1e0 [ 365.063144][T11830] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 365.063180][T11830] ? finish_task_switch.isra.0+0x2c5/0x1010 [ 365.063219][T11830] ? preempt_schedule_common+0x42/0xc0 [ 365.063247][T11830] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 365.063287][T11830] mmap_region+0x35d/0x620 [ 365.063303][T11830] ? rcu_is_watching+0x12/0xc0 [ 365.063320][T11830] ? __pfx_mmap_region+0x10/0x10 [ 365.063336][T11830] ? cap_mmap_addr+0x4b/0x120 [ 365.063377][T11830] ? bpf_lsm_mmap_addr+0x9/0x30 [ 365.063413][T11830] ? security_mmap_addr+0x71/0x1e0 [ 365.063452][T11830] ? __get_unmapped_area+0x255/0x3e0 [ 365.063474][T11830] do_mmap+0xc63/0x12f0 [ 365.063496][T11830] ? __pfx_do_mmap+0x10/0x10 [ 365.063516][T11830] ? __pfx_down_write_killable+0x10/0x10 [ 365.063538][T11830] vm_mmap_pgoff+0x29e/0x470 [ 365.063577][T11830] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 365.063600][T11830] ? __pfx_do_futex+0x10/0x10 [ 365.063619][T11830] ksys_mmap_pgoff+0xe4/0x610 [ 365.063639][T11830] ? __x64_sys_futex+0x358/0x4d0 [ 365.063656][T11830] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 365.063677][T11830] ? xfd_validate_state+0x129/0x190 [ 365.063698][T11830] __x64_sys_mmap+0x125/0x190 [ 365.063718][T11830] do_syscall_64+0x115/0x840 [ 365.063735][T11830] ? clear_bhb_loop+0x40/0x90 [ 365.063755][T11830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.063772][T11830] RIP: 0033:0x7fec8659ce59 [ 365.063788][T11830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.063806][T11830] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 365.063824][T11830] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 365.063836][T11830] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 365.063846][T11830] RBP: 00007fec86632e6f R08: 0000000000000002 R09: 0000000000008000 [ 365.063857][T11830] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 365.063868][T11830] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 365.063885][T11830] [ 365.473562][T11841] vhci_hcd: not connected 4 [ 366.310705][T10076] Bluetooth: hci3: command 0x0c1a tx timeout [ 366.316758][ T7857] Bluetooth: hci2: command 0x0c1a tx timeout [ 366.324137][ T8243] Bluetooth: hci0: command 0x0c1a tx timeout [ 367.288665][T11877] FAULT_INJECTION: forcing a failure. [ 367.288665][T11877] name failslab, interval 1, probability 0, space 0, times 0 [ 367.332264][T11877] CPU: 0 UID: 0 PID: 11877 Comm: syz.3.1280 Not tainted syzkaller #0 PREEMPT(full) [ 367.332293][T11877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 367.332305][T11877] Call Trace: [ 367.332312][T11877] [ 367.332318][T11877] dump_stack_lvl+0x100/0x190 [ 367.332342][T11877] should_fail_ex.cold+0x5/0xa [ 367.332362][T11877] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 367.332381][T11877] should_failslab+0xc2/0x120 [ 367.332406][T11877] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 367.332423][T11877] ? vm_area_dup+0x27/0x8e0 [ 367.332447][T11877] ? mas_prev+0x9b/0xf0 [ 367.332470][T11877] vm_area_dup+0x27/0x8e0 [ 367.332496][T11877] copy_vma+0x643/0xac0 [ 367.332524][T11877] ? __pfx_copy_vma+0x10/0x10 [ 367.332553][T11877] ? trace_hrtimer_start+0x77/0x220 [ 367.332574][T11877] ? rcu_is_watching+0x12/0xc0 [ 367.332592][T11877] ? rcu_is_watching+0x12/0xc0 [ 367.332610][T11877] ? lock_acquire+0x301/0x370 [ 367.332634][T11877] ? trace_irq_enable.constprop.0+0x122/0x160 [ 367.332662][T11877] copy_vma_and_data+0x1cf/0x7c0 [ 367.332690][T11877] ? __pfx_copy_vma_and_data+0x10/0x10 [ 367.332720][T11877] ? lock_release+0x24d/0x310 [ 367.332745][T11877] ? __vma_start_write+0x17f/0x280 [ 367.332769][T11877] ? __pfx___vma_start_write+0x10/0x10 [ 367.332795][T11877] move_vma+0x574/0x1920 [ 367.332823][T11877] ? __pfx_move_vma+0x10/0x10 [ 367.332851][T11877] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 367.332873][T11877] ? cap_mmap_addr+0x4b/0x120 [ 367.332892][T11877] ? bpf_lsm_mmap_addr+0x9/0x30 [ 367.332917][T11877] ? security_mmap_addr+0x71/0x1e0 [ 367.332942][T11877] ? __get_unmapped_area+0x255/0x3e0 [ 367.332963][T11877] ? vrm_set_new_addr+0x204/0x290 [ 367.332990][T11877] mremap_to+0x234/0x4c0 [ 367.333016][T11877] ? mas_walk+0x6ef/0x9b0 [ 367.333033][T11877] ? __pfx_mremap_to+0x10/0x10 [ 367.333059][T11877] ? check_prep_vma+0x912/0xe60 [ 367.333087][T11877] __do_sys_mremap+0x88c/0x1850 [ 367.333116][T11877] ? __pfx___do_sys_mremap+0x10/0x10 [ 367.333146][T11877] ? __pfx_do_futex+0x10/0x10 [ 367.333165][T11877] ? __x64_sys_futex+0x34f/0x4d0 [ 367.333184][T11877] ? rcu_is_watching+0x12/0xc0 [ 367.333202][T11877] do_syscall_64+0x115/0x840 [ 367.333228][T11877] ? clear_bhb_loop+0x40/0x90 [ 367.333247][T11877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.333265][T11877] RIP: 0033:0x7ff44839ce59 [ 367.333280][T11877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.333297][T11877] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 367.333316][T11877] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 367.333328][T11877] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200001000000 [ 367.333339][T11877] RBP: 00007ff448432e6f R08: 0000000100000000 R09: 0000000000000000 [ 367.333350][T11877] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 367.333361][T11877] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 367.333377][T11877] [ 370.545896][T11913] netlink: 'syz.2.1288': attribute type 1 has an invalid length. [ 370.832113][T11919] FAULT_INJECTION: forcing a failure. [ 370.832113][T11919] name failslab, interval 1, probability 0, space 0, times 0 [ 370.884095][T11919] CPU: 0 UID: 0 PID: 11919 Comm: syz.1.1290 Not tainted syzkaller #0 PREEMPT(full) [ 370.884123][T11919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 370.884134][T11919] Call Trace: [ 370.884140][T11919] [ 370.884147][T11919] dump_stack_lvl+0x100/0x190 [ 370.884174][T11919] should_fail_ex.cold+0x5/0xa [ 370.884196][T11919] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 370.884217][T11919] should_failslab+0xc2/0x120 [ 370.884239][T11919] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 370.884257][T11919] ? vm_area_alloc+0x1f/0x160 [ 370.884285][T11919] vm_area_alloc+0x1f/0x160 [ 370.884310][T11919] __mmap_region+0x1033/0x2db0 [ 370.884339][T11919] ? rcu_is_watching+0x12/0xc0 [ 370.884360][T11919] ? __pfx___mmap_region+0x10/0x10 [ 370.884385][T11919] ? __pfx___might_resched+0x10/0x10 [ 370.884412][T11919] ? do_raw_spin_lock+0x128/0x260 [ 370.884433][T11919] ? debug_object_assert_init+0x1c4/0x300 [ 370.884525][T11919] ? debug_object_assert_init+0x1c4/0x300 [ 370.884558][T11919] ? lock_release+0x24d/0x310 [ 370.884611][T11919] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 370.884641][T11919] ? rcu_is_watching+0x12/0xc0 [ 370.884659][T11919] ? trace_irq_enable.constprop.0+0x122/0x160 [ 370.884698][T11919] ? futex_unqueue+0x133/0x2c0 [ 370.884724][T11919] ? lock_release+0x24d/0x310 [ 370.884749][T11919] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 370.884773][T11919] mmap_region+0x35d/0x620 [ 370.884789][T11919] ? rcu_is_watching+0x12/0xc0 [ 370.884807][T11919] ? __pfx_mmap_region+0x10/0x10 [ 370.884823][T11919] ? cap_mmap_addr+0x4b/0x120 [ 370.884842][T11919] ? bpf_lsm_mmap_addr+0x9/0x30 [ 370.884868][T11919] ? security_mmap_addr+0x71/0x1e0 [ 370.884892][T11919] ? __get_unmapped_area+0x255/0x3e0 [ 370.884914][T11919] do_mmap+0xc63/0x12f0 [ 370.884935][T11919] ? __pfx_do_mmap+0x10/0x10 [ 370.884956][T11919] ? __pfx_down_write_killable+0x10/0x10 [ 370.884979][T11919] ? __pfx_futex_wait+0x10/0x10 [ 370.885000][T11919] vm_mmap_pgoff+0x29e/0x470 [ 370.885021][T11919] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 370.885042][T11919] ? __pfx_do_futex+0x10/0x10 [ 370.885059][T11919] ksys_mmap_pgoff+0xe4/0x610 [ 370.885080][T11919] ? __x64_sys_futex+0x358/0x4d0 [ 370.885096][T11919] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 370.885116][T11919] ? xfd_validate_state+0x129/0x190 [ 370.885138][T11919] __x64_sys_mmap+0x125/0x190 [ 370.885158][T11919] do_syscall_64+0x115/0x840 [ 370.885175][T11919] ? clear_bhb_loop+0x40/0x90 [ 370.885195][T11919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.885213][T11919] RIP: 0033:0x7fec8659ce59 [ 370.885229][T11919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.885246][T11919] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 370.885264][T11919] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 370.885277][T11919] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 370.885287][T11919] RBP: 00007fec86632e6f R08: 0000000000000002 R09: 0000000000008000 [ 370.885299][T11919] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 370.885309][T11919] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 370.885325][T11919] [ 372.138610][T11948] FAULT_INJECTION: forcing a failure. [ 372.138610][T11948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 372.191238][T11948] CPU: 0 UID: 0 PID: 11948 Comm: syz.1.1297 Not tainted syzkaller #0 PREEMPT(full) [ 372.191265][T11948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 372.191276][T11948] Call Trace: [ 372.191282][T11948] [ 372.191290][T11948] dump_stack_lvl+0x100/0x190 [ 372.191314][T11948] should_fail_ex.cold+0x5/0xa [ 372.191335][T11948] _copy_from_user+0x2e/0xd0 [ 372.191364][T11948] kstrtouint_from_user+0xd6/0x1d0 [ 372.191386][T11948] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 372.191409][T11948] ? nilfs_cpfile_change_cpmode+0x1970/0x1d90 [ 372.191527][T11948] proc_fail_nth_write+0x83/0x220 [ 372.191548][T11948] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 372.191568][T11948] ? __pfx___might_resched+0x10/0x10 [ 372.191602][T11948] vfs_write+0x2aa/0x1050 [ 372.191628][T11948] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 372.191648][T11948] ? __pfx_vfs_write+0x10/0x10 [ 372.191673][T11948] ? rcu_is_watching+0x12/0xc0 [ 372.191693][T11948] ? __fget_files+0x21f/0x3d0 [ 372.191720][T11948] ksys_write+0x12a/0x250 [ 372.191744][T11948] ? __pfx_ksys_write+0x10/0x10 [ 372.191769][T11948] ? rcu_is_watching+0x12/0xc0 [ 372.191788][T11948] do_syscall_64+0x115/0x840 [ 372.191807][T11948] ? clear_bhb_loop+0x40/0x90 [ 372.191827][T11948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.191845][T11948] RIP: 0033:0x7fec8655d68e [ 372.191860][T11948] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 372.191878][T11948] RSP: 002b:00007fec847f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 372.191896][T11948] RAX: ffffffffffffffda RBX: 00007fec847f66c0 RCX: 00007fec8655d68e [ 372.191908][T11948] RDX: 0000000000000001 RSI: 00007fec847f60a0 RDI: 0000000000000005 [ 372.191919][T11948] RBP: 00007fec847f6090 R08: 0000000000000000 R09: 0000000000000000 [ 372.191930][T11948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 372.191940][T11948] R13: 00007fec86816128 R14: 00007fec86816090 R15: 00007ffc1ddcb118 [ 372.191956][T11948] [ 373.885155][T11982] vhci_hcd: not connected 4 [ 374.465872][T10076] Bluetooth: hci3: unexpected subevent 0x01 length: 3 < 18 [ 376.025423][T12020] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 376.031830][T12020] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 376.040167][T12020] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 376.050189][T12020] netlink: 'syz.3.1313': attribute type 1 has an invalid length. [ 376.172133][T12026] vhci_hcd: not connected 4 [ 376.680297][T12037] FAULT_INJECTION: forcing a failure. [ 376.680297][T12037] name failslab, interval 1, probability 0, space 0, times 0 [ 376.708212][T12037] CPU: 0 UID: 0 PID: 12037 Comm: syz.1.1319 Not tainted syzkaller #0 PREEMPT(full) [ 376.708239][T12037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 376.708258][T12037] Call Trace: [ 376.708264][T12037] [ 376.708271][T12037] dump_stack_lvl+0x100/0x190 [ 376.708296][T12037] should_fail_ex.cold+0x5/0xa [ 376.708315][T12037] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 376.708334][T12037] should_failslab+0xc2/0x120 [ 376.708355][T12037] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 376.708372][T12037] ? mas_preallocate+0x1105/0x14a0 [ 376.708399][T12037] mas_preallocate+0x1105/0x14a0 [ 376.708431][T12037] ? __pfx_mas_preallocate+0x10/0x10 [ 376.708474][T12037] ? vm_area_alloc+0x1f/0x160 [ 376.708507][T12037] ? lockdep_init_map_type+0x5c/0x250 [ 376.708535][T12037] __mmap_region+0x1230/0x2db0 [ 376.708563][T12037] ? __pfx___mmap_region+0x10/0x10 [ 376.708590][T12037] ? __pfx___might_resched+0x10/0x10 [ 376.708617][T12037] ? do_raw_spin_lock+0x128/0x260 [ 376.708635][T12037] ? do_raw_spin_unlock+0x145/0x1e0 [ 376.708653][T12037] ? debug_object_activate+0x331/0x490 [ 376.708681][T12037] ? __pfx_debug_object_activate+0x10/0x10 [ 376.708707][T12037] ? lock_release+0x24d/0x310 [ 376.708735][T12037] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 376.708758][T12037] ? rcu_is_watching+0x12/0xc0 [ 376.708776][T12037] ? trace_irq_enable.constprop.0+0x122/0x160 [ 376.708813][T12037] ? futex_unqueue+0x133/0x2c0 [ 376.708839][T12037] ? lock_release+0x24d/0x310 [ 376.708864][T12037] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 376.708888][T12037] mmap_region+0x35d/0x620 [ 376.708903][T12037] ? rcu_is_watching+0x12/0xc0 [ 376.708921][T12037] ? __pfx_mmap_region+0x10/0x10 [ 376.708937][T12037] ? cap_mmap_addr+0x4b/0x120 [ 376.708956][T12037] ? bpf_lsm_mmap_addr+0x9/0x30 [ 376.708982][T12037] ? security_mmap_addr+0x71/0x1e0 [ 376.709007][T12037] ? __get_unmapped_area+0x255/0x3e0 [ 376.709029][T12037] do_mmap+0xc63/0x12f0 [ 376.709051][T12037] ? __pfx_do_mmap+0x10/0x10 [ 376.709071][T12037] ? __pfx_down_write_killable+0x10/0x10 [ 376.709092][T12037] ? __pfx_futex_wait+0x10/0x10 [ 376.709113][T12037] vm_mmap_pgoff+0x29e/0x470 [ 376.709135][T12037] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 376.709156][T12037] ? __pfx_do_futex+0x10/0x10 [ 376.709173][T12037] ksys_mmap_pgoff+0xe4/0x610 [ 376.709194][T12037] ? __x64_sys_futex+0x358/0x4d0 [ 376.709210][T12037] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 376.709234][T12037] ? xfd_validate_state+0x129/0x190 [ 376.709253][T12037] __x64_sys_mmap+0x125/0x190 [ 376.709273][T12037] do_syscall_64+0x115/0x840 [ 376.709291][T12037] ? clear_bhb_loop+0x40/0x90 [ 376.709311][T12037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.709329][T12037] RIP: 0033:0x7fec8659ce59 [ 376.709344][T12037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.709361][T12037] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 376.709379][T12037] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 376.709390][T12037] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 376.709401][T12037] RBP: 00007fec86632e6f R08: 0000000000000002 R09: 0000000000008000 [ 376.709412][T12037] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 376.709422][T12037] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 376.709437][T12037] [ 377.428290][ T5622] Process accounting resumed [ 377.693650][ T8243] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 377.710402][ T8243] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 377.722652][ T8243] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 377.738867][ T8243] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 377.746575][ T8243] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 378.076544][ T8243] Bluetooth: hci3: command 0x0c1a tx timeout [ 378.082737][T10076] Bluetooth: hci2: command 0x0c1a tx timeout [ 378.089042][ T7857] Bluetooth: hci0: command 0x0c1a tx timeout [ 378.160186][T12062] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 378.238169][T12062] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 378.301588][T12062] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 378.341990][T12062] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 378.365722][T12062] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 378.391325][T12062] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 378.599636][T12073] vhci_hcd: not connected 4 [ 379.169212][T12047] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.198690][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.206898][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.219720][T12047] bridge0: port 1(bridge_slave_0) entered disabled state [ 379.248221][T12047] bridge_slave_0: entered allmulticast mode [ 379.273576][T12047] bridge_slave_0: entered promiscuous mode [ 379.296233][T12047] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.321757][T12047] bridge0: port 2(bridge_slave_1) entered disabled state [ 379.343837][T12047] bridge_slave_1: entered allmulticast mode [ 379.370555][T12047] bridge_slave_1: entered promiscuous mode [ 379.427400][T12047] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 379.462944][T12047] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 379.524837][T12047] team0: Port device team_slave_0 added [ 379.547992][T12047] team0: Port device team_slave_1 added [ 379.599910][T12047] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 379.621611][T12047] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.704270][T12047] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 379.742934][T12047] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 379.766314][T12047] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.843905][T12047] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 379.943709][T12047] hsr_slave_0: entered promiscuous mode [ 379.962260][T12047] hsr_slave_1: entered promiscuous mode [ 379.976601][T12047] debugfs: 'hsr0' already exists in 'hsr' [ 379.989291][T12047] Cannot create hsr debugfs directory [ 380.237327][T10076] Bluetooth: hci0: command 0x0c1a tx timeout [ 380.317525][T10076] Bluetooth: hci3: command 0x0c1a tx timeout [ 380.323784][ T8243] Bluetooth: hci2: command 0x0c1a tx timeout [ 380.333807][T12047] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 380.354241][T12047] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 380.373068][T12047] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 380.390513][T12047] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 380.398906][T10076] Bluetooth: hci4: command 0x041b tx timeout [ 380.416047][T12047] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 380.435969][T12047] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 380.453039][T12047] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 380.492260][T12047] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 380.651581][T12047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 380.721274][T12047] 8021q: adding VLAN 0 to HW filter on device team0 [ 380.753506][ T8337] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.760985][ T8337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 380.800003][ T8337] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.807425][ T8337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 381.151346][T12120] binder: 12117:12120 unknown command 1936094318 [ 381.181848][T12120] binder: 12117:12120 ioctl c0306201 0 returned -22 [ 381.428203][T12047] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 381.786585][T12146] FAULT_INJECTION: forcing a failure. [ 381.786585][T12146] name failslab, interval 1, probability 0, space 0, times 0 [ 381.830308][T12146] CPU: 0 UID: 0 PID: 12146 Comm: syz.1.1334 Not tainted syzkaller #0 PREEMPT(full) [ 381.830337][T12146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 381.830347][T12146] Call Trace: [ 381.830353][T12146] [ 381.830361][T12146] dump_stack_lvl+0x100/0x190 [ 381.830386][T12146] should_fail_ex.cold+0x5/0xa [ 381.830405][T12146] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 381.830425][T12146] should_failslab+0xc2/0x120 [ 381.830446][T12146] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 381.830463][T12146] ? vm_area_dup+0x27/0x8e0 [ 381.830488][T12146] ? mas_prev+0x9b/0xf0 [ 381.830511][T12146] vm_area_dup+0x27/0x8e0 [ 381.830537][T12146] copy_vma+0x643/0xac0 [ 381.830565][T12146] ? __pfx_copy_vma+0x10/0x10 [ 381.830594][T12146] ? timerqueue_linked_add+0x260/0x430 [ 381.830621][T12146] ? rcu_is_watching+0x12/0xc0 [ 381.830640][T12146] ? rcu_is_watching+0x12/0xc0 [ 381.830665][T12146] ? lock_acquire+0x301/0x370 [ 381.830689][T12146] ? trace_irq_enable.constprop.0+0x122/0x160 [ 381.830717][T12146] copy_vma_and_data+0x1cf/0x7c0 [ 381.830746][T12146] ? __pfx_copy_vma_and_data+0x10/0x10 [ 381.830775][T12146] ? lock_release+0x24d/0x310 [ 381.830803][T12146] ? __vma_start_write+0x17f/0x280 [ 381.830827][T12146] ? __pfx___vma_start_write+0x10/0x10 [ 381.830854][T12146] move_vma+0x574/0x1920 [ 381.830882][T12146] ? __pfx_move_vma+0x10/0x10 [ 381.830909][T12146] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 381.830932][T12146] ? cap_mmap_addr+0x4b/0x120 [ 381.830951][T12146] ? bpf_lsm_mmap_addr+0x9/0x30 [ 381.830976][T12146] ? security_mmap_addr+0x71/0x1e0 [ 381.831001][T12146] ? __get_unmapped_area+0x255/0x3e0 [ 381.831023][T12146] ? vrm_set_new_addr+0x204/0x290 [ 381.831051][T12146] mremap_to+0x234/0x4c0 [ 381.831077][T12146] ? mas_walk+0x6ef/0x9b0 [ 381.831094][T12146] ? __pfx_mremap_to+0x10/0x10 [ 381.831120][T12146] ? check_prep_vma+0x912/0xe60 [ 381.831148][T12146] __do_sys_mremap+0x88c/0x1850 [ 381.831178][T12146] ? __pfx___do_sys_mremap+0x10/0x10 [ 381.831209][T12146] ? __pfx_do_futex+0x10/0x10 [ 381.831227][T12146] ? __x64_sys_futex+0x34f/0x4d0 [ 381.831246][T12146] ? rcu_is_watching+0x12/0xc0 [ 381.831265][T12146] do_syscall_64+0x115/0x840 [ 381.831282][T12146] ? clear_bhb_loop+0x40/0x90 [ 381.831301][T12146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.831319][T12146] RIP: 0033:0x7fec8659ce59 [ 381.831334][T12146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.831351][T12146] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 381.831369][T12146] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 381.831381][T12146] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200001000000 [ 381.831391][T12146] RBP: 00007fec86632e6f R08: 0000000100000000 R09: 0000000000000000 [ 381.831402][T12146] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 381.831412][T12146] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 381.831427][T12146] [ 382.483391][T10076] Bluetooth: hci4: command 0x041b tx timeout [ 382.526691][T12047] veth0_vlan: entered promiscuous mode [ 382.544504][T12047] veth1_vlan: entered promiscuous mode [ 382.579734][T12047] veth0_macvtap: entered promiscuous mode [ 382.598155][T12047] veth1_macvtap: entered promiscuous mode [ 382.644673][T12047] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 382.737207][T12047] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 382.953990][ T8916] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.033170][ T8916] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.095068][ T8916] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.160580][ T8916] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.234784][ T7864] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.261283][ T7864] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 383.343012][ T8917] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 383.375006][ T8917] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 384.559526][ T8243] Bluetooth: hci4: command 0x041b tx timeout [ 386.640606][ T8243] Bluetooth: hci4: command 0x041b tx timeout [ 387.768470][T12238] FAULT_INJECTION: forcing a failure. [ 387.768470][T12238] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 387.835666][T12238] CPU: 0 UID: 0 PID: 12238 Comm: syz.4.1353 Not tainted syzkaller #0 PREEMPT(full) [ 387.835693][T12238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 387.835705][T12238] Call Trace: [ 387.835710][T12238] [ 387.835717][T12238] dump_stack_lvl+0x100/0x190 [ 387.835741][T12238] should_fail_ex.cold+0x5/0xa [ 387.835762][T12238] should_fail_alloc_page+0xeb/0x140 [ 387.835785][T12238] prepare_alloc_pages+0x1f0/0x5f0 [ 387.835810][T12238] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 387.835840][T12238] ? tomoyo_check_open_permission+0x1a2/0x3c0 [ 387.835922][T12238] ? stack_trace_save+0x8e/0xc0 [ 387.835944][T12238] ? __pfx_stack_trace_save+0x10/0x10 [ 387.835967][T12238] ? rcu_is_watching+0x12/0xc0 [ 387.835989][T12238] ? ima_match_policy+0x8c4/0x2350 [ 387.836016][T12238] ? rcu_is_watching+0x12/0xc0 [ 387.836034][T12238] ? ima_match_policy+0x8c4/0x2350 [ 387.836062][T12238] ? lock_release+0x24d/0x310 [ 387.836088][T12238] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 387.836120][T12238] ? desc_read_finalized_seq+0x131/0x1d0 [ 387.836148][T12238] ? __asan_memcpy+0x3c/0x60 [ 387.836175][T12238] ? desc_read+0x2e2/0x380 [ 387.836200][T12238] ? panic_on_this_cpu+0x32/0x40 [ 387.836223][T12238] ? vma_is_special_huge+0x23f/0x2d0 [ 387.836245][T12238] ? __pfx_vma_is_special_huge+0x10/0x10 [ 387.836266][T12238] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 387.836302][T12238] ? policy_nodemask+0xed/0x4f0 [ 387.836325][T12238] alloc_pages_mpol+0x1fb/0x540 [ 387.836347][T12238] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 387.836370][T12238] ? rcu_is_watching+0x12/0xc0 [ 387.836387][T12238] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 387.836414][T12238] alloc_pages_noprof+0x1a/0x160 [ 387.836439][T12238] __pmd_alloc+0x3b/0x950 [ 387.836463][T12238] __handle_mm_fault+0xa9c/0x2a00 [ 387.836499][T12238] ? mt_find+0x45e/0x8e0 [ 387.836521][T12238] ? __pfx___handle_mm_fault+0x10/0x10 [ 387.836547][T12238] ? __pfx_mt_find+0x10/0x10 [ 387.836572][T12238] ? find_vma+0xbf/0x140 [ 387.836590][T12238] ? __pfx_find_vma+0x10/0x10 [ 387.836610][T12238] handle_mm_fault+0x37b/0xa30 [ 387.836637][T12238] do_user_addr_fault+0x74c/0x12f0 [ 387.836663][T12238] exc_page_fault+0x6f/0xd0 [ 387.836679][T12238] asm_exc_page_fault+0x26/0x30 [ 387.836697][T12238] RIP: 0010:rep_movs_alternative+0x33/0xa0 [ 387.836723][T12238] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 bd 9d 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 387.836741][T12238] RSP: 0018:ffffc90003f27b30 EFLAGS: 00050246 [ 387.836757][T12238] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008 [ 387.836768][T12238] RDX: 0000000000000001 RSI: ffffc90003f27bd0 RDI: 0000000000000003 [ 387.836779][T12238] RBP: 0000000000000003 R08: 0000000000000000 R09: fffff520007e4f7a [ 387.836789][T12238] R10: ffffc90003f27bd7 R11: 0000000000000001 R12: ffffc90003f27bd0 [ 387.836800][T12238] R13: 000000000000000b R14: 00007ffffffff000 R15: 0000000000000000 [ 387.836815][T12238] _copy_to_user+0xa4/0xd0 [ 387.836845][T12238] vt_ioctl+0x1a1c/0x3110 [ 387.836902][T12238] ? __pfx_vt_ioctl+0x10/0x10 [ 387.836918][T12238] ? tomoyo_path_number_perm+0x28f/0x580 [ 387.836942][T12238] ? tomoyo_path_number_perm+0x28f/0x580 [ 387.836965][T12238] ? lock_release+0x24d/0x310 [ 387.836999][T12238] ? tomoyo_path_number_perm+0x188/0x580 [ 387.837024][T12238] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 387.837049][T12238] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 387.837074][T12238] ? __pfx_vt_ioctl+0x10/0x10 [ 387.837090][T12238] tty_ioctl+0x26a/0x1640 [ 387.837144][T12238] ? __pfx_tty_ioctl+0x10/0x10 [ 387.837169][T12238] ? rcu_is_watching+0x12/0xc0 [ 387.837187][T12238] ? __fget_files+0x215/0x3d0 [ 387.837217][T12238] ? hook_file_ioctl_common+0x140/0x440 [ 387.837262][T12238] ? __fget_files+0x21f/0x3d0 [ 387.837287][T12238] ? __pfx_tty_ioctl+0x10/0x10 [ 387.837310][T12238] __x64_sys_ioctl+0x18e/0x210 [ 387.837332][T12238] do_syscall_64+0x115/0x840 [ 387.837350][T12238] ? clear_bhb_loop+0x40/0x90 [ 387.837374][T12238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.837393][T12238] RIP: 0033:0x7f43b239ce59 [ 387.837406][T12238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 387.837426][T12238] RSP: 002b:00007f43b31c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 387.837444][T12238] RAX: ffffffffffffffda RBX: 00007f43b2615fa0 RCX: 00007f43b239ce59 [ 387.837456][T12238] RDX: 0000000000000003 RSI: 0000000000005601 RDI: 0000000000000003 [ 387.837466][T12238] RBP: 00007f43b31c7090 R08: 0000000000000000 R09: 0000000000000000 [ 387.837540][T12238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 387.837550][T12238] R13: 00007f43b2616038 R14: 00007f43b2615fa0 R15: 00007fff57184fd8 [ 387.837566][T12238] [ 388.835135][ T8243] Bluetooth: hci4: command 0x041b tx timeout [ 388.859060][T12245] vhci_hcd: not connected 4 [ 388.873205][T12244] FAULT_INJECTION: forcing a failure. [ 388.873205][T12244] name failslab, interval 1, probability 0, space 0, times 0 [ 388.904497][T12244] CPU: 0 UID: 0 PID: 12244 Comm: syz.1.1356 Not tainted syzkaller #0 PREEMPT(full) [ 388.904527][T12244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 388.904537][T12244] Call Trace: [ 388.904543][T12244] [ 388.904550][T12244] dump_stack_lvl+0x100/0x190 [ 388.904573][T12244] should_fail_ex.cold+0x5/0xa [ 388.904601][T12244] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 388.904621][T12244] should_failslab+0xc2/0x120 [ 388.904645][T12244] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 388.904663][T12244] ? vm_area_dup+0x27/0x8e0 [ 388.904688][T12244] ? mas_prev+0x9b/0xf0 [ 388.904711][T12244] vm_area_dup+0x27/0x8e0 [ 388.904738][T12244] copy_vma+0x643/0xac0 [ 388.904766][T12244] ? __pfx_copy_vma+0x10/0x10 [ 388.904798][T12244] ? timerqueue_linked_add+0x260/0x430 [ 388.904828][T12244] ? rcu_is_watching+0x12/0xc0 [ 388.904847][T12244] ? rcu_is_watching+0x12/0xc0 [ 388.904864][T12244] ? lock_acquire+0x301/0x370 [ 388.904888][T12244] ? trace_irq_enable.constprop.0+0x122/0x160 [ 388.904917][T12244] copy_vma_and_data+0x1cf/0x7c0 [ 388.904946][T12244] ? __pfx_copy_vma_and_data+0x10/0x10 [ 388.904976][T12244] ? lock_release+0x24d/0x310 [ 388.905001][T12244] ? __vma_start_write+0x17f/0x280 [ 388.905026][T12244] ? __pfx___vma_start_write+0x10/0x10 [ 388.905053][T12244] move_vma+0x574/0x1920 [ 388.905082][T12244] ? __pfx_move_vma+0x10/0x10 [ 388.905110][T12244] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 388.905132][T12244] ? cap_mmap_addr+0x4b/0x120 [ 388.905151][T12244] ? bpf_lsm_mmap_addr+0x9/0x30 [ 388.905177][T12244] ? security_mmap_addr+0x71/0x1e0 [ 388.905202][T12244] ? __get_unmapped_area+0x255/0x3e0 [ 388.905224][T12244] ? vrm_set_new_addr+0x204/0x290 [ 388.905251][T12244] mremap_to+0x234/0x4c0 [ 388.905277][T12244] ? mas_walk+0x6ef/0x9b0 [ 388.905294][T12244] ? __pfx_mremap_to+0x10/0x10 [ 388.905321][T12244] ? check_prep_vma+0x912/0xe60 [ 388.905349][T12244] __do_sys_mremap+0x88c/0x1850 [ 388.905379][T12244] ? __pfx___do_sys_mremap+0x10/0x10 [ 388.905410][T12244] ? __pfx_do_futex+0x10/0x10 [ 388.905428][T12244] ? __x64_sys_futex+0x34f/0x4d0 [ 388.905448][T12244] ? rcu_is_watching+0x12/0xc0 [ 388.905466][T12244] do_syscall_64+0x115/0x840 [ 388.905484][T12244] ? clear_bhb_loop+0x40/0x90 [ 388.905504][T12244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.905522][T12244] RIP: 0033:0x7fec8659ce59 [ 388.905537][T12244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.905554][T12244] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 388.905573][T12244] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 388.905584][T12244] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200001000000 [ 388.905602][T12244] RBP: 00007fec86632e6f R08: 0000000100000000 R09: 0000000000000000 [ 388.905613][T12244] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 388.905624][T12244] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 388.905644][T12244] [ 390.351445][T12267] FAULT_INJECTION: forcing a failure. [ 390.351445][T12267] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 390.516470][T12267] CPU: 0 UID: 0 PID: 12267 Comm: syz.1.1361 Not tainted syzkaller #0 PREEMPT(full) [ 390.516498][T12267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 390.516509][T12267] Call Trace: [ 390.516515][T12267] [ 390.516523][T12267] dump_stack_lvl+0x100/0x190 [ 390.516548][T12267] should_fail_ex.cold+0x5/0xa [ 390.516578][T12267] should_fail_alloc_page+0xeb/0x140 [ 390.516602][T12267] prepare_alloc_pages+0x1f0/0x5f0 [ 390.516635][T12267] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 390.516666][T12267] ? trace_kmem_cache_alloc+0xdd/0x100 [ 390.516689][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.516707][T12267] ? clockevents_program_event+0x23e/0x820 [ 390.516725][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.516742][T12267] ? clockevents_program_event+0x23e/0x820 [ 390.516760][T12267] ? lock_release+0x24d/0x310 [ 390.516786][T12267] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 390.516815][T12267] ? lapic_next_event+0x10/0x20 [ 390.516834][T12267] ? clockevents_program_event+0x1ef/0x820 [ 390.516853][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.516870][T12267] ? __pfx_clockevents_program_event+0x10/0x10 [ 390.516890][T12267] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 390.516910][T12267] ? lock_release+0x24d/0x310 [ 390.516937][T12267] ? do_raw_spin_unlock+0x145/0x1e0 [ 390.516954][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.516971][T12267] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 390.516995][T12267] ? policy_nodemask+0xed/0x4f0 [ 390.517017][T12267] alloc_pages_mpol+0x1fb/0x540 [ 390.517039][T12267] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 390.517060][T12267] ? filemap_get_entry+0x22d/0x450 [ 390.517086][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.517103][T12267] ? filemap_get_entry+0x22d/0x450 [ 390.517128][T12267] ? lock_release+0x24d/0x310 [ 390.517153][T12267] folio_alloc_noprof+0x22/0x250 [ 390.517179][T12267] filemap_alloc_folio_noprof.part.0+0x377/0x450 [ 390.517201][T12267] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 390.517223][T12267] ? rcu_is_watching+0x12/0xc0 [ 390.517241][T12267] __filemap_get_folio_mpol+0x653/0x1320 [ 390.517271][T12267] ioctx_alloc+0x7e1/0x21a0 [ 390.517331][T12267] ? __pfx_ioctx_alloc+0x10/0x10 [ 390.517357][T12267] ? __might_fault+0xc5/0x140 [ 390.517386][T12267] __x64_sys_io_setup+0xc9/0x220 [ 390.517415][T12267] do_syscall_64+0x115/0x840 [ 390.517433][T12267] ? clear_bhb_loop+0x40/0x90 [ 390.517453][T12267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.517471][T12267] RIP: 0033:0x7fec8659ce59 [ 390.517486][T12267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.517503][T12267] RSP: 002b:00007fec847f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 390.517522][T12267] RAX: ffffffffffffffda RBX: 00007fec86816090 RCX: 00007fec8659ce59 [ 390.517534][T12267] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 000000000000ffff [ 390.517546][T12267] RBP: 00007fec86632e6f R08: 0000000000000000 R09: 0000000000000000 [ 390.517557][T12267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 390.517575][T12267] R13: 00007fec86816128 R14: 00007fec86816090 R15: 00007ffc1ddcb118 [ 390.517591][T12267] [ 390.884093][T10076] Bluetooth: hci4: command 0x041b tx timeout [ 392.900522][T12317] vhci_hcd: not connected 4 [ 394.814743][T12359] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 394.847473][T12359] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 394.919489][T12361] netlink: 'syz.3.1380': attribute type 1 has an invalid length. [ 394.959761][T12359] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 395.015928][T12359] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 395.403603][T12366] FAULT_INJECTION: forcing a failure. [ 395.403603][T12366] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 395.536246][T12366] CPU: 0 UID: 0 PID: 12366 Comm: syz.3.1382 Not tainted syzkaller #0 PREEMPT(full) [ 395.536275][T12366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 395.536286][T12366] Call Trace: [ 395.536292][T12366] [ 395.536299][T12366] dump_stack_lvl+0x100/0x190 [ 395.536323][T12366] should_fail_ex.cold+0x5/0xa [ 395.536344][T12366] _copy_from_user+0x2e/0xd0 [ 395.536373][T12366] get_timespec64+0x8b/0x1b0 [ 395.536398][T12366] ? __pfx_get_timespec64+0x10/0x10 [ 395.536423][T12366] ? common_nsleep+0xa1/0xd0 [ 395.536461][T12366] __x64_sys_clock_nanosleep+0x1ce/0x480 [ 395.536487][T12366] ? __pfx___x64_sys_clock_nanosleep+0x10/0x10 [ 395.536513][T12366] ? rcu_is_watching+0x12/0xc0 [ 395.536533][T12366] do_syscall_64+0x115/0x840 [ 395.536553][T12366] ? clear_bhb_loop+0x40/0x90 [ 395.536573][T12366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.536592][T12366] RIP: 0033:0x7ff44835d68e [ 395.536607][T12366] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 395.536625][T12366] RSP: 002b:00007ffc0a440008 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 [ 395.536644][T12366] RAX: ffffffffffffffda RBX: 0000555561123500 RCX: 00007ff44835d68e [ 395.536655][T12366] RDX: 00007ffc0a440060 RSI: 0000000000000000 RDI: 0000000000000000 [ 395.536666][T12366] RBP: 00007ff448617da0 R08: 0000000000000000 R09: 0000000000000000 [ 395.536677][T12366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000060a6a [ 395.536688][T12366] R13: 00007ff44861609c R14: 00000000000607b7 R15: 00007ff448616090 [ 395.536703][T12366] [ 395.901560][T12371] FAULT_INJECTION: forcing a failure. [ 395.901560][T12371] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 395.955681][T12371] CPU: 0 UID: 0 PID: 12371 Comm: syz.4.1383 Not tainted syzkaller #0 PREEMPT(full) [ 395.955711][T12371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 395.955722][T12371] Call Trace: [ 395.955729][T12371] [ 395.955735][T12371] dump_stack_lvl+0x100/0x190 [ 395.955759][T12371] should_fail_ex.cold+0x5/0xa [ 395.955779][T12371] should_fail_alloc_page+0xeb/0x140 [ 395.955802][T12371] prepare_alloc_pages+0x1f0/0x5f0 [ 395.955825][T12371] ? is_bpf_text_address+0x8a/0x1a0 [ 395.955848][T12371] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 395.955874][T12371] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 395.955904][T12371] ? is_bpf_text_address+0x94/0x1a0 [ 395.955927][T12371] ? kernel_text_address+0x8d/0x100 [ 395.955974][T12371] ? rcu_is_watching+0x12/0xc0 [ 395.955994][T12371] ? __kernel_text_address+0xd/0x30 [ 395.956019][T12371] ? unwind_get_return_address+0x59/0xa0 [ 395.956044][T12371] ? arch_stack_walk+0xa6/0xf0 [ 395.956068][T12371] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 395.956099][T12371] ? stack_trace_save+0x8e/0xc0 [ 395.956119][T12371] ? __pfx_stack_trace_save+0x10/0x10 [ 395.956141][T12371] ? stack_depot_save_flags+0x27/0x9d0 [ 395.956225][T12371] ? kmem_cache_alloc_noprof+0x241/0x6d0 [ 395.956242][T12371] ? __pmd_alloc+0xbf/0x950 [ 395.956264][T12371] ? __handle_mm_fault+0xa9c/0x2a00 [ 395.956289][T12371] ? handle_mm_fault+0x37b/0xa30 [ 395.956316][T12371] ? __get_user_pages+0x1178/0x32a0 [ 395.956346][T12371] ? populate_vma_page_range+0x267/0x3f0 [ 395.956369][T12371] ? __mm_populate+0x107/0x3a0 [ 395.956390][T12371] ? vm_mmap_pgoff+0x37f/0x470 [ 395.956409][T12371] ? ksys_mmap_pgoff+0xe4/0x610 [ 395.956428][T12371] ? __x64_sys_mmap+0x125/0x190 [ 395.956446][T12371] ? do_syscall_64+0x115/0x840 [ 395.956464][T12371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.956483][T12371] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 395.956506][T12371] ? policy_nodemask+0xed/0x4f0 [ 395.956528][T12371] alloc_pages_mpol+0x1fb/0x540 [ 395.956550][T12371] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 395.956572][T12371] ? __pfx___css_rstat_updated+0x10/0x10 [ 395.956602][T12371] alloc_pages_noprof+0x1a/0x160 [ 395.956627][T12371] pte_alloc_one+0x1c/0x3d0 [ 395.956652][T12371] __pte_alloc+0x6d/0x3e0 [ 395.956670][T12371] ? __pfx___pte_alloc+0x10/0x10 [ 395.956689][T12371] ? do_raw_spin_lock+0x128/0x260 [ 395.956706][T12371] ? __pmd_alloc+0x3f6/0x950 [ 395.956731][T12371] do_anonymous_page+0x13a7/0x2080 [ 395.956758][T12371] ? __pmd_alloc+0x3fb/0x950 [ 395.956779][T12371] __handle_mm_fault+0x1d2c/0x2a00 [ 395.956806][T12371] ? mt_find+0x45e/0x8e0 [ 395.956827][T12371] ? __pfx___handle_mm_fault+0x10/0x10 [ 395.956853][T12371] ? __pfx_mt_find+0x10/0x10 [ 395.956876][T12371] ? find_vma+0xbf/0x140 [ 395.956894][T12371] ? __pfx_find_vma+0x10/0x10 [ 395.956913][T12371] handle_mm_fault+0x37b/0xa30 [ 395.956940][T12371] __get_user_pages+0x1178/0x32a0 [ 395.956964][T12371] ? __pfx___get_user_pages+0x10/0x10 [ 395.956985][T12371] ? __pfx___might_resched+0x10/0x10 [ 395.957011][T12371] populate_vma_page_range+0x267/0x3f0 [ 395.957035][T12371] ? __pfx_populate_vma_page_range+0x10/0x10 [ 395.957058][T12371] ? __pfx_find_vma_intersection+0x10/0x10 [ 395.957079][T12371] ? do_mmap+0x93f/0x12f0 [ 395.957100][T12371] __mm_populate+0x107/0x3a0 [ 395.957122][T12371] ? __pfx___mm_populate+0x10/0x10 [ 395.957145][T12371] ? up_write+0x2e5/0x5c0 [ 395.957161][T12371] vm_mmap_pgoff+0x37f/0x470 [ 395.957182][T12371] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 395.957203][T12371] ? __pfx_do_futex+0x10/0x10 [ 395.957221][T12371] ksys_mmap_pgoff+0xe4/0x610 [ 395.957241][T12371] ? __x64_sys_futex+0x358/0x4d0 [ 395.957257][T12371] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 395.957277][T12371] ? xfd_validate_state+0x129/0x190 [ 395.957300][T12371] __x64_sys_mmap+0x125/0x190 [ 395.957320][T12371] do_syscall_64+0x115/0x840 [ 395.957345][T12371] ? clear_bhb_loop+0x40/0x90 [ 395.957364][T12371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.957382][T12371] RIP: 0033:0x7f43b239ce59 [ 395.957398][T12371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.957416][T12371] RSP: 002b:00007f43b31c7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 395.957435][T12371] RAX: ffffffffffffffda RBX: 00007f43b2615fa0 RCX: 00007f43b239ce59 [ 395.957447][T12371] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 395.957458][T12371] RBP: 00007f43b2432e6f R08: 0000000000000002 R09: 0000000000008000 [ 395.957473][T12371] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 395.957484][T12371] R13: 00007f43b2616038 R14: 00007f43b2615fa0 R15: 00007fff57184fd8 [ 395.957499][T12371] [ 397.022700][ T8243] Bluetooth: hci2: command 0x0c1a tx timeout [ 397.031237][ T8243] Bluetooth: hci0: command 0x0c1a tx timeout [ 397.040729][ T8243] Bluetooth: hci3: command 0x0c1a tx timeout [ 397.047666][ T8243] Bluetooth: hci4: command 0x041b tx timeout [ 397.723914][T12376] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 400.354586][T12452] vhci_hcd: not connected 4 [ 402.205868][T12481] dlm: non-version read from control device 2147479540 [ 402.205891][T12481] dlm: non-version read from control device 2147479540 [ 402.205905][T12481] dlm: non-version read from control device 2147479540 [ 402.205917][T12481] dlm: non-version read from control device 2147479540 [ 402.205930][T12481] dlm: non-version read from control device 2147479540 [ 402.205943][T12481] dlm: non-version read from control device 2147479540 [ 402.205956][T12481] dlm: non-version read from control device 2147479540 [ 402.205969][T12481] dlm: non-version read from control device 2147479540 [ 402.205982][T12481] dlm: non-version read from control device 2147479540 [ 402.205995][T12481] dlm: non-version read from control device 2147479540 [ 402.206008][T12481] dlm: non-version read from control device 2147479540 [ 402.206021][T12481] dlm: non-version read from control device 2147479540 [ 402.206033][T12481] dlm: non-version read from control device 2147479540 [ 402.206046][T12481] dlm: non-version read from control device 2147479540 [ 402.206059][T12481] dlm: non-version read from control device 2147479540 [ 402.206072][T12481] dlm: non-version read from control device 2147479540 [ 402.206085][T12481] dlm: non-version read from control device 2147479540 [ 402.206098][T12481] dlm: non-version read from control device 2147479540 [ 402.206111][T12481] dlm: non-version read from control device 2147479540 [ 402.206124][T12481] dlm: non-version read from control device 2147479540 [ 402.206137][T12481] dlm: non-version read from control device 2147479540 [ 402.206150][T12481] dlm: non-version read from control device 2147479540 [ 402.206163][T12481] dlm: non-version read from control device 2147479540 [ 402.206180][T12481] dlm: non-version read from control device 2147479540 [ 402.206198][T12481] dlm: non-version read from control device 2147479540 [ 402.206212][T12481] dlm: non-version read from control device 2147479540 [ 402.206227][T12481] dlm: non-version read from control device 2147479540 [ 402.206240][T12481] dlm: non-version read from control device 2147479540 [ 402.206255][T12481] dlm: non-version read from control device 2147479540 [ 402.206268][T12481] dlm: non-version read from control device 2147479540 [ 402.206281][T12481] dlm: non-version read from control device 2147479540 [ 402.206294][T12481] dlm: non-version read from control device 2147479540 [ 402.206309][T12481] dlm: non-version read from control device 2147479540 [ 402.206322][T12481] dlm: non-version read from control device 2147479540 [ 402.206335][T12481] dlm: non-version read from control device 2147479540 [ 402.206348][T12481] dlm: non-version read from control device 2147479540 [ 402.206361][T12481] dlm: non-version read from control device 2147479540 [ 402.206382][T12481] dlm: non-version read from control device 2147479540 [ 402.206395][T12481] dlm: non-version read from control device 2147479540 [ 402.206408][T12481] dlm: non-version read from control device 2147479540 [ 402.206421][T12481] dlm: non-version read from control device 2147479540 [ 402.206434][T12481] dlm: non-version read from control device 2147479540 [ 402.206446][T12481] dlm: non-version read from control device 2147479540 [ 402.206459][T12481] dlm: non-version read from control device 2147479540 [ 402.206472][T12481] dlm: non-version read from control device 2147479540 [ 402.206485][T12481] dlm: non-version read from control device 2147479540 [ 402.206498][T12481] dlm: non-version read from control device 2147479540 [ 402.206511][T12481] dlm: non-version read from control device 2147479540 [ 402.206524][T12481] dlm: non-version read from control device 2147479540 [ 402.206537][T12481] dlm: non-version read from control device 2147479540 [ 402.206549][T12481] dlm: non-version read from control device 2147479540 [ 402.206562][T12481] dlm: non-version read from control device 2147479540 [ 402.206575][T12481] dlm: non-version read from control device 2147479540 [ 402.206588][T12481] dlm: non-version read from control device 2147479540 [ 402.206601][T12481] dlm: non-version read from control device 2147479540 [ 402.206615][T12481] dlm: non-version read from control device 2147479540 [ 402.206629][T12481] dlm: non-version read from control device 2147479540 [ 402.206642][T12481] dlm: non-version read from control device 2147479540 [ 402.206654][T12481] dlm: non-version read from control device 2147479540 [ 402.206667][T12481] dlm: non-version read from control device 2147479540 [ 402.206680][T12481] dlm: non-version read from control device 2147479540 [ 402.206693][T12481] dlm: non-version read from control device 2147479540 [ 402.206707][T12481] dlm: non-version read from control device 2147479540 [ 402.206720][T12481] dlm: non-version read from control device 2147479540 [ 402.206733][T12481] dlm: non-version read from control device 2147479540 [ 404.293248][ T30] audit: type=1800 audit(1782136400.853:2): pid=12520 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1414" name="lu_gp_id" dev="configfs" ino=44258 res=0 errno=0 [ 405.795954][T12552] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 405.866182][T12556] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 407.953749][T12597] sctp: [Deprecated]: syz.1.1433 (pid 12597) Use of struct sctp_assoc_value in delayed_ack socket option. [ 407.953749][T12597] Use struct sctp_sack_info instead [ 408.749962][T12618] netlink: 'syz.2.1436': attribute type 1 has an invalid length. [ 409.606450][T12642] vhci_hcd: not connected 4 [ 410.681191][T12661] FAULT_INJECTION: forcing a failure. [ 410.681191][T12661] name failslab, interval 1, probability 0, space 0, times 0 [ 410.710208][T12661] CPU: 0 UID: 0 PID: 12661 Comm: syz.1.1446 Not tainted syzkaller #0 PREEMPT(full) [ 410.710236][T12661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 410.710248][T12661] Call Trace: [ 410.710254][T12661] [ 410.710260][T12661] dump_stack_lvl+0x100/0x190 [ 410.710284][T12661] should_fail_ex.cold+0x5/0xa [ 410.710304][T12661] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 410.710324][T12661] should_failslab+0xc2/0x120 [ 410.710346][T12661] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 410.710370][T12661] ? mas_preallocate+0x1105/0x14a0 [ 410.710395][T12661] mas_preallocate+0x1105/0x14a0 [ 410.710420][T12661] ? __pfx_mas_preallocate+0x10/0x10 [ 410.710444][T12661] ? vm_area_alloc+0x1f/0x160 [ 410.710471][T12661] ? lockdep_init_map_type+0x5c/0x250 [ 410.710500][T12661] __mmap_region+0x1230/0x2db0 [ 410.710528][T12661] ? __pfx___mmap_region+0x10/0x10 [ 410.710554][T12661] ? __pfx___might_resched+0x10/0x10 [ 410.710579][T12661] ? process_measurement+0x4c8/0x2350 [ 410.710601][T12661] ? lock_release+0x24d/0x310 [ 410.710624][T12661] ? down_write+0x146/0x1f0 [ 410.710647][T12661] ? debug_object_assert_init+0x1c4/0x300 [ 410.710674][T12661] ? debug_object_assert_init+0x1c4/0x300 [ 410.710700][T12661] ? lock_release+0x24d/0x310 [ 410.710728][T12661] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 410.710751][T12661] ? rcu_is_watching+0x12/0xc0 [ 410.710769][T12661] ? trace_irq_enable.constprop.0+0x122/0x160 [ 410.710806][T12661] ? futex_unqueue+0x133/0x2c0 [ 410.710831][T12661] ? lock_release+0x24d/0x310 [ 410.710858][T12661] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 410.710884][T12661] mmap_region+0x35d/0x620 [ 410.710900][T12661] ? rcu_is_watching+0x12/0xc0 [ 410.710918][T12661] ? __pfx_mmap_region+0x10/0x10 [ 410.710934][T12661] ? cap_mmap_addr+0x4b/0x120 [ 410.710952][T12661] ? bpf_lsm_mmap_addr+0x9/0x30 [ 410.710978][T12661] ? security_mmap_addr+0x71/0x1e0 [ 410.711003][T12661] ? __get_unmapped_area+0x255/0x3e0 [ 410.711025][T12661] do_mmap+0xc63/0x12f0 [ 410.711047][T12661] ? __pfx_do_mmap+0x10/0x10 [ 410.711068][T12661] ? __pfx_down_write_killable+0x10/0x10 [ 410.711088][T12661] ? __pfx_futex_wait+0x10/0x10 [ 410.711109][T12661] vm_mmap_pgoff+0x29e/0x470 [ 410.711131][T12661] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 410.711152][T12661] ? __pfx_do_futex+0x10/0x10 [ 410.711170][T12661] ksys_mmap_pgoff+0xe4/0x610 [ 410.711193][T12661] ? __x64_sys_futex+0x358/0x4d0 [ 410.711210][T12661] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 410.711230][T12661] ? xfd_validate_state+0x129/0x190 [ 410.711249][T12661] __x64_sys_mmap+0x125/0x190 [ 410.711269][T12661] do_syscall_64+0x115/0x840 [ 410.711286][T12661] ? clear_bhb_loop+0x40/0x90 [ 410.711306][T12661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.711324][T12661] RIP: 0033:0x7fec8659ce59 [ 410.711338][T12661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.711362][T12661] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 410.711380][T12661] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 410.711392][T12661] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 410.711403][T12661] RBP: 00007fec86632e6f R08: 0000000000000002 R09: 0000000000008000 [ 410.711414][T12661] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 410.711425][T12661] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 410.711441][T12661] [ 411.163741][T12666] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 414.002831][T12699] bond0: option slaves: interface -]=,Do does not exist! [ 415.590632][T12732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1464'. [ 419.885984][T12804] FAULT_INJECTION: forcing a failure. [ 419.885984][T12804] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.929696][T12804] CPU: 0 UID: 0 PID: 12804 Comm: syz.3.1479 Not tainted syzkaller #0 PREEMPT(full) [ 419.929725][T12804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 419.929736][T12804] Call Trace: [ 419.929742][T12804] [ 419.929748][T12804] dump_stack_lvl+0x100/0x190 [ 419.929772][T12804] should_fail_ex.cold+0x5/0xa [ 419.929793][T12804] _copy_from_user+0x2e/0xd0 [ 419.929825][T12804] ip6_mroute_setsockopt+0x2deb/0x35a0 [ 419.929936][T12804] ? unwind_next_frame+0x3be/0x2090 [ 419.929961][T12804] ? rcu_is_watching+0x12/0xc0 [ 419.929981][T12804] ? __pfx_ip6_mroute_setsockopt+0x10/0x10 [ 419.930006][T12804] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 419.930029][T12804] ? call_rcu_tasks_generic.constprop.0+0x490/0x750 [ 419.930054][T12804] ? lock_release+0x24d/0x310 [ 419.930079][T12804] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 419.930103][T12804] ? is_bpf_text_address+0x94/0x1a0 [ 419.930127][T12804] ? kernel_text_address+0x8d/0x100 [ 419.930152][T12804] ? __kernel_text_address+0xd/0x30 [ 419.930175][T12804] ? unwind_get_return_address+0x59/0xa0 [ 419.930199][T12804] ? arch_stack_walk+0xa6/0xf0 [ 419.930224][T12804] ? putname+0xb1/0x110 [ 419.930251][T12804] ? _parse_integer_limit+0x1ac/0x220 [ 419.930274][T12804] ? do_ipv6_setsockopt+0x543/0x43a0 [ 419.930317][T12804] do_ipv6_setsockopt+0x543/0x43a0 [ 419.930340][T12804] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 419.930362][T12804] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 419.930388][T12804] ? kstrtouint_from_user+0x13c/0x1d0 [ 419.930409][T12804] ? rcu_is_watching+0x12/0xc0 [ 419.930428][T12804] ? get_pid_task+0xfc/0x250 [ 419.930446][T12804] ? rcu_is_watching+0x12/0xc0 [ 419.930464][T12804] ? get_pid_task+0xfc/0x250 [ 419.930482][T12804] ? lock_release+0x24d/0x310 [ 419.930508][T12804] ? get_pid_task+0x106/0x250 [ 419.930528][T12804] ? __pfx___might_resched+0x10/0x10 [ 419.930553][T12804] ? ksys_write+0x12a/0x250 [ 419.930577][T12804] ? rcu_is_watching+0x12/0xc0 [ 419.930596][T12804] ? aa_sk_perm+0x309/0xaa0 [ 419.930620][T12804] ? ipv6_setsockopt+0xcb/0x170 [ 419.930639][T12804] ipv6_setsockopt+0xcb/0x170 [ 419.930660][T12804] rawv6_setsockopt+0xee/0x5a0 [ 419.930693][T12804] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 419.930709][T12804] ? aa_sock_opt_perm+0xfe/0x1b0 [ 419.930727][T12804] ? sock_common_setsockopt+0x2e/0xf0 [ 419.930777][T12804] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 419.930807][T12804] do_sock_setsockopt+0xf3/0x1d0 [ 419.930837][T12804] __sys_setsockopt+0x119/0x190 [ 419.930862][T12804] __x64_sys_setsockopt+0xbd/0x160 [ 419.930885][T12804] ? trace_irq_enable.constprop.0+0x122/0x160 [ 419.930914][T12804] do_syscall_64+0x115/0x840 [ 419.930933][T12804] ? clear_bhb_loop+0x40/0x90 [ 419.930953][T12804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.930971][T12804] RIP: 0033:0x7ff44839ce59 [ 419.930986][T12804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.931004][T12804] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 419.931023][T12804] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 419.931035][T12804] RDX: 00000000000000d1 RSI: 0000000000000029 RDI: 0400000000000003 [ 419.931046][T12804] RBP: 00007ff4491cf090 R08: 0000000000000004 R09: 0000000000000000 [ 419.931057][T12804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.931067][T12804] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 419.931083][T12804] [ 420.343526][T12807] random: crng reseeded on system resumption [ 420.371447][T12807] hub 1-0:1.0: USB hub found [ 420.378855][T12807] hub 1-0:1.0: 1 port detected [ 421.347060][T12813] FAULT_INJECTION: forcing a failure. [ 421.347060][T12813] name failslab, interval 1, probability 0, space 0, times 0 [ 421.429894][T12813] CPU: 0 UID: 0 PID: 12813 Comm: syz.1.1482 Not tainted syzkaller #0 PREEMPT(full) [ 421.429923][T12813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 421.429935][T12813] Call Trace: [ 421.429941][T12813] [ 421.429950][T12813] dump_stack_lvl+0x100/0x190 [ 421.429973][T12813] should_fail_ex.cold+0x5/0xa [ 421.429992][T12813] ? __kmalloc_cache_node_noprof+0x57/0x760 [ 421.430015][T12813] should_failslab+0xc2/0x120 [ 421.430036][T12813] __kmalloc_cache_node_noprof+0x7d/0x760 [ 421.430056][T12813] ? __alloc_workqueue+0x781/0x1940 [ 421.430075][T12813] ? lockdep_init_map_type+0x5c/0x250 [ 421.430104][T12813] __alloc_workqueue+0x781/0x1940 [ 421.430125][T12813] alloc_workqueue_noprof+0xc7/0x130 [ 421.430144][T12813] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 421.430166][T12813] ? lockdep_init_map_type+0x5c/0x250 [ 421.430192][T12813] ? lockdep_init_map_type+0x5c/0x250 [ 421.430220][T12813] __rds_conn_create+0x1234/0x25a0 [ 421.430308][T12813] ? __pfx___rds_conn_create+0x10/0x10 [ 421.430330][T12813] ? rcu_is_watching+0x12/0xc0 [ 421.430351][T12813] ? trace_kmalloc+0xeb/0x110 [ 421.430372][T12813] ? lockdep_init_map_type+0x5c/0x250 [ 421.430400][T12813] rds_conn_create_outgoing+0x44/0x60 [ 421.430423][T12813] rds_sendmsg+0x10da/0x3480 [ 421.430449][T12813] ? trace_sched_exit_tp+0x120/0x160 [ 421.430468][T12813] ? __schedule+0x126e/0x6730 [ 421.430495][T12813] ? rcu_is_watching+0x12/0xc0 [ 421.430516][T12813] ? __pfx_rds_sendmsg+0x10/0x10 [ 421.430542][T12813] ? __pfx_aa_sk_perm+0x10/0x10 [ 421.430568][T12813] ? lock_release+0x24d/0x310 [ 421.430594][T12813] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 421.430614][T12813] ? ____sys_sendmsg+0xa4d/0xbe0 [ 421.430632][T12813] ____sys_sendmsg+0xa4d/0xbe0 [ 421.430648][T12813] ? __pfx_rds_sendmsg+0x10/0x10 [ 421.430675][T12813] ? __pfx_____sys_sendmsg+0x10/0x10 [ 421.430696][T12813] ___sys_sendmsg+0x190/0x1e0 [ 421.430715][T12813] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.430737][T12813] ? rcu_is_watching+0x12/0xc0 [ 421.430765][T12813] __sys_sendmsg+0x160/0x210 [ 421.430789][T12813] ? __pfx___sys_sendmsg+0x10/0x10 [ 421.430817][T12813] ? rcu_is_watching+0x12/0xc0 [ 421.430836][T12813] do_syscall_64+0x115/0x840 [ 421.430854][T12813] ? clear_bhb_loop+0x40/0x90 [ 421.430874][T12813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.430894][T12813] RIP: 0033:0x7fec8659ce59 [ 421.430910][T12813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.430928][T12813] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 421.430954][T12813] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 421.430966][T12813] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000009 [ 421.430977][T12813] RBP: 00007fec86632e6f R08: 0000000000000000 R09: 0000000000000000 [ 421.430989][T12813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 421.430999][T12813] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 421.431015][T12813] [ 422.659765][T12825] vhci_hcd: not connected 4 [ 423.007813][ T8243] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 423.015248][ T8243] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 423.024632][ T8243] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 423.033904][ T8243] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 423.043021][ T8243] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 423.402608][T12849] netlink: 'syz.2.1491': attribute type 1 has an invalid length. [ 423.488172][T12860] FAULT_INJECTION: forcing a failure. [ 423.488172][T12860] name failslab, interval 1, probability 0, space 0, times 0 [ 423.562586][T12860] CPU: 0 UID: 0 PID: 12860 Comm: syz.3.1493 Not tainted syzkaller #0 PREEMPT(full) [ 423.562614][T12860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 423.562624][T12860] Call Trace: [ 423.562630][T12860] [ 423.562637][T12860] dump_stack_lvl+0x100/0x190 [ 423.562661][T12860] should_fail_ex.cold+0x5/0xa [ 423.562680][T12860] ? __kmalloc_cache_noprof+0x53/0x6e0 [ 423.562708][T12860] should_failslab+0xc2/0x120 [ 423.562733][T12860] __kmalloc_cache_noprof+0x7a/0x6e0 [ 423.562763][T12860] ? alloc_pipe_info+0x10e/0x590 [ 423.562791][T12860] alloc_pipe_info+0x10e/0x590 [ 423.562818][T12860] splice_direct_to_actor+0x78f/0xa30 [ 423.562846][T12860] ? __pfx_direct_splice_actor+0x10/0x10 [ 423.562874][T12860] ? __pfx_aa_file_perm+0x10/0x10 [ 423.562905][T12860] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 423.562931][T12860] ? rcu_is_watching+0x12/0xc0 [ 423.562950][T12860] ? get_pid_task+0xfc/0x250 [ 423.562969][T12860] ? lock_release+0x24d/0x310 [ 423.562996][T12860] do_splice_direct+0x174/0x240 [ 423.563022][T12860] ? __pfx_do_splice_direct+0x10/0x10 [ 423.563049][T12860] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 423.563075][T12860] ? bpf_lsm_file_permission+0x9/0x10 [ 423.563101][T12860] ? security_file_permission+0x76/0x210 [ 423.563130][T12860] ? rw_verify_area+0xce/0x6d0 [ 423.563151][T12860] do_sendfile+0xadc/0xe20 [ 423.563175][T12860] ? __pfx_do_sendfile+0x10/0x10 [ 423.563201][T12860] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 423.563231][T12860] ? __fget_files+0x21f/0x3d0 [ 423.563258][T12860] __x64_sys_sendfile64+0x1d8/0x220 [ 423.563287][T12860] ? ksys_write+0x1ac/0x250 [ 423.563310][T12860] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 423.563340][T12860] ? rcu_is_watching+0x12/0xc0 [ 423.563359][T12860] do_syscall_64+0x115/0x840 [ 423.563377][T12860] ? clear_bhb_loop+0x40/0x90 [ 423.563397][T12860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.563416][T12860] RIP: 0033:0x7ff44839ce59 [ 423.563430][T12860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 423.563448][T12860] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 423.563466][T12860] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 423.563478][T12860] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 423.563489][T12860] RBP: 00007ff4491cf090 R08: 0000000000000000 R09: 0000000000000000 [ 423.563499][T12860] R10: 0000000000800048 R11: 0000000000000246 R12: 0000000000000001 [ 423.563510][T12860] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 423.563526][T12860] [ 424.141687][T12836] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x18000 [ 424.172045][T12836] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 424.199770][T12836] raw: 00fff00000002000 ffffea0000600008 ffffea0000600008 0000000000000000 [ 424.241554][T12836] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 424.283151][T12836] page dumped because: unmovable page [ 424.300944][T12836] page_owner info is not present (never set?) [ 425.059627][T10076] Bluetooth: hci5: command tx timeout [ 425.513146][T12829] bridge0: port 1(bridge_slave_0) entered blocking state [ 425.550891][T12829] bridge0: port 1(bridge_slave_0) entered disabled state [ 425.561341][T12904] vhci_hcd: not connected 4 [ 425.568023][T12901] netlink: 'syz.2.1498': attribute type 1 has an invalid length. [ 425.584553][T12829] bridge_slave_0: entered allmulticast mode [ 425.600803][T12829] bridge_slave_0: entered promiscuous mode [ 425.654007][T12829] bridge0: port 2(bridge_slave_1) entered blocking state [ 425.666008][T12829] bridge0: port 2(bridge_slave_1) entered disabled state [ 425.682364][T12829] bridge_slave_1: entered allmulticast mode [ 425.699609][T12829] bridge_slave_1: entered promiscuous mode [ 425.815294][T12829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 425.924592][T12829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.028629][T12829] team0: Port device team_slave_0 added [ 426.169734][T12829] team0: Port device team_slave_1 added [ 426.265150][T12829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 426.284760][T12915] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 426.314278][T12829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.349685][T12915] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 426.386393][T12917] netlink: 'syz.3.1502': attribute type 1 has an invalid length. [ 426.413903][T12915] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 426.445250][T12829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 426.467230][T12915] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 426.485215][T12915] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 426.492486][T12829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 426.511319][T12829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 426.556859][T12915] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 426.599209][T12829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 426.776374][T12829] hsr_slave_0: entered promiscuous mode [ 426.815537][T12829] hsr_slave_1: entered promiscuous mode [ 426.851449][T12829] debugfs: 'hsr0' already exists in 'hsr' [ 426.887553][T12829] Cannot create hsr debugfs directory [ 427.522606][T12829] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 427.525593][T12829] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 427.526183][T12829] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 427.533225][T12829] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 427.570659][T12829] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 427.583217][T12829] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 427.585642][T12829] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 427.588850][T12829] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 427.940142][T12829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 428.005546][T12829] 8021q: adding VLAN 0 to HW filter on device team0 [ 428.020731][ T8909] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.020801][ T8909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 428.048468][T12961] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.048515][T12961] bridge0: port 2(bridge_slave_1) entered forwarding state [ 428.341426][T10076] Bluetooth: hci0: command 0x0c1a tx timeout [ 428.421644][T10076] Bluetooth: hci3: command 0x0c1a tx timeout [ 428.427843][ T8243] Bluetooth: hci2: command 0x0c1a tx timeout [ 428.501392][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 429.064611][T12829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 429.716562][T12829] veth0_vlan: entered promiscuous mode [ 429.810936][T12829] veth1_vlan: entered promiscuous mode [ 429.908815][T12829] veth0_macvtap: entered promiscuous mode [ 429.959831][T12829] veth1_macvtap: entered promiscuous mode [ 430.026811][T12829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 430.075366][T12829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 430.135182][ T7864] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.166561][ T7864] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.220323][ T7864] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.263120][ T7864] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 430.335972][T12961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.357142][T12961] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.382793][ T7847] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 430.405774][ T7847] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.450521][T13058] futex_wake_op: syz.1.1522 tries to shift op by -2048; fix this program [ 430.583497][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 431.259441][T13082] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1526'. [ 431.289519][T13082] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 431.324668][T13082] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 431.581992][T13085] syz.1.1527 (13085): drop_caches: 0 [ 432.663882][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 434.022069][T10076] Bluetooth: hci5: unexpected subevent 0x01 length: 123 > 18 [ 434.030313][T10076] Bluetooth: hci5: Invalid handle: 0x3a4a > 0x0eff [ 434.334280][T10076] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 434.342731][T10076] Bluetooth: hci3: Invalid handle: 0x3a4a > 0x0eff [ 434.744397][ T8243] Bluetooth: hci5: command 0x040f tx timeout [ 434.925885][ T5359] Process accounting resumed [ 435.003013][ T5359] Process accounting resumed [ 435.369091][T13136] Process accounting resumed [ 435.414441][T13114] Process accounting resumed [ 436.693293][T13167] vhci_hcd: not connected 4 [ 436.825642][ T8243] Bluetooth: hci5: command 0x040f tx timeout [ 437.776250][T13193] vhci_hcd: not connected 4 [ 438.336013][ T8243] Bluetooth: hci5: unexpected event 0x09 length: 435 > 3 [ 438.515547][T13213] random: crng reseeded on system resumption [ 440.669270][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.679817][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.362224][T13284] FAULT_INJECTION: forcing a failure. [ 442.362224][T13284] name failslab, interval 1, probability 0, space 0, times 0 [ 442.362255][T13284] CPU: 0 UID: 0 PID: 13284 Comm: syz.5.1572 Not tainted syzkaller #0 PREEMPT(full) [ 442.362277][T13284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 442.362287][T13284] Call Trace: [ 442.362294][T13284] [ 442.362301][T13284] dump_stack_lvl+0x100/0x190 [ 442.362323][T13284] should_fail_ex.cold+0x5/0xa [ 442.362342][T13284] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 442.362362][T13284] should_failslab+0xc2/0x120 [ 442.362382][T13284] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 442.362399][T13284] ? vm_area_dup+0x27/0x8e0 [ 442.362424][T13284] ? mas_prev+0x9b/0xf0 [ 442.362446][T13284] vm_area_dup+0x27/0x8e0 [ 442.362472][T13284] copy_vma+0x643/0xac0 [ 442.362501][T13284] ? __pfx_copy_vma+0x10/0x10 [ 442.362530][T13284] ? trace_hrtimer_start+0x77/0x220 [ 442.362550][T13284] ? rcu_is_watching+0x12/0xc0 [ 442.362569][T13284] ? rcu_is_watching+0x12/0xc0 [ 442.362587][T13284] ? lock_acquire+0x301/0x370 [ 442.362611][T13284] ? trace_irq_enable.constprop.0+0x122/0x160 [ 442.362639][T13284] copy_vma_and_data+0x1cf/0x7c0 [ 442.362668][T13284] ? __pfx_copy_vma_and_data+0x10/0x10 [ 442.362698][T13284] ? lock_release+0x24d/0x310 [ 442.362723][T13284] ? __vma_start_write+0x17f/0x280 [ 442.362747][T13284] ? __pfx___vma_start_write+0x10/0x10 [ 442.362774][T13284] move_vma+0x574/0x1920 [ 442.362801][T13284] ? __pfx_move_vma+0x10/0x10 [ 442.362829][T13284] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 442.362852][T13284] ? cap_mmap_addr+0x4b/0x120 [ 442.362871][T13284] ? bpf_lsm_mmap_addr+0x9/0x30 [ 442.362899][T13284] ? security_mmap_addr+0x71/0x1e0 [ 442.362925][T13284] ? __get_unmapped_area+0x255/0x3e0 [ 442.362947][T13284] ? vrm_set_new_addr+0x204/0x290 [ 442.362974][T13284] mremap_to+0x234/0x4c0 [ 442.363000][T13284] ? mas_walk+0x6ef/0x9b0 [ 442.363016][T13284] ? __pfx_mremap_to+0x10/0x10 [ 442.363042][T13284] ? check_prep_vma+0x912/0xe60 [ 442.363080][T13284] __do_sys_mremap+0x88c/0x1850 [ 442.363112][T13284] ? __pfx___do_sys_mremap+0x10/0x10 [ 442.363144][T13284] ? __pfx_do_futex+0x10/0x10 [ 442.363163][T13284] ? __x64_sys_futex+0x34f/0x4d0 [ 442.363183][T13284] ? rcu_is_watching+0x12/0xc0 [ 442.363202][T13284] do_syscall_64+0x115/0x840 [ 442.363221][T13284] ? clear_bhb_loop+0x40/0x90 [ 442.363241][T13284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.363260][T13284] RIP: 0033:0x7f068b39ce59 [ 442.363274][T13284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 442.363291][T13284] RSP: 002b:00007f068c265028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 442.363308][T13284] RAX: ffffffffffffffda RBX: 00007f068b615fa0 RCX: 00007f068b39ce59 [ 442.363320][T13284] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200001000000 [ 442.363330][T13284] RBP: 00007f068b432e6f R08: 0000000100000000 R09: 0000000000000000 [ 442.363341][T13284] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 442.363351][T13284] R13: 00007f068b616038 R14: 00007f068b615fa0 R15: 00007fff002448a8 [ 442.363367][T13284] [ 443.510487][T13297] vhci_hcd: not connected 4 [ 444.289354][T13317] raw_sendmsg: syz.3.1579 forgot to set AF_INET. Fix it! [ 444.888874][T13303] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 445.539336][T13337] vhci_hcd: not connected 4 [ 447.781380][T13383] vhci_hcd: not connected 4 [ 447.966794][T13388] netlink: 'syz.3.1594': attribute type 1 has an invalid length. [ 448.041859][T13387] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 448.090660][T13387] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 448.117213][T13387] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 448.158105][T13387] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 449.385164][T13407] ovs_: entered promiscuous mode [ 450.113398][ T8243] Bluetooth: hci2: command 0x0c1a tx timeout [ 450.119739][T10076] Bluetooth: hci0: command 0x0c1a tx timeout [ 450.192281][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 450.198590][ T8243] Bluetooth: hci3: command 0x0c1a tx timeout [ 453.891522][T10076] Bluetooth: hci3: unexpected subevent 0x18 length: 123 > 19 [ 453.899557][T10076] Bluetooth: hci3: Unable to find connection for dst f9:56:cc:cc:70:a9 sid 0x00 [ 454.459933][T13514] random: crng reseeded on system resumption [ 454.935855][T13526] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 454.982224][T13526] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 455.031450][T13526] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 455.066712][T13524] netlink: 'syz.3.1626': attribute type 1 has an invalid length. [ 455.101998][T13526] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 455.378101][T13534] vhci_hcd: not connected 4 [ 455.435672][T13532] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 455.467949][T13535] netlink: 'syz.3.1627': attribute type 1 has an invalid length. [ 455.527787][T13532] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 455.578355][T13532] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 455.623612][T13532] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 455.682195][T13541] vhci_hcd: not connected 4 [ 455.931829][T13549] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 456.566338][T13573] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 456.777383][T13553] bond0: option slaves: interface -]=,Do does not exist! [ 457.475714][T10076] Bluetooth: hci0: command 0x0c1a tx timeout [ 457.555975][T10076] Bluetooth: hci2: command 0x0c1a tx timeout [ 457.636193][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 457.642478][ T8243] Bluetooth: hci3: command 0x0c1a tx timeout [ 458.388232][T13618] futex_wake_op: syz.2.1647 tries to shift op by -2048; fix this program [ 458.424792][T13618] futex_wake_op: syz.2.1647 tries to shift op by -2048; fix this program [ 458.726664][T13627] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 458.807242][T13627] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 458.846511][T13630] netlink: 'syz.5.1649': attribute type 1 has an invalid length. [ 458.875539][T13627] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 458.929387][T13627] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 460.757343][T10076] Bluetooth: hci0: command 0x0c1a tx timeout [ 460.837467][T10076] Bluetooth: hci2: command 0x0c1a tx timeout [ 460.917405][T10076] Bluetooth: hci3: command 0x0c1a tx timeout [ 460.997469][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 462.444379][T13680] bond0: option slaves: interface -]=,Do does not exist! [ 462.639945][T13694] FAULT_INJECTION: forcing a failure. [ 462.639945][T13694] name failslab, interval 1, probability 0, space 0, times 0 [ 462.715479][T13694] CPU: 0 UID: 0 PID: 13694 Comm: syz.3.1663 Not tainted syzkaller #0 PREEMPT(full) [ 462.715506][T13694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 462.715516][T13694] Call Trace: [ 462.715523][T13694] [ 462.715529][T13694] dump_stack_lvl+0x100/0x190 [ 462.715554][T13694] should_fail_ex.cold+0x5/0xa [ 462.715573][T13694] ? __kmalloc_cache_node_noprof+0x57/0x760 [ 462.715595][T13694] should_failslab+0xc2/0x120 [ 462.715617][T13694] __kmalloc_cache_node_noprof+0x7d/0x760 [ 462.715637][T13694] ? __alloc_disk_node+0x5a/0x6b0 [ 462.715662][T13694] ? lock_release+0x24d/0x310 [ 462.715691][T13694] ? lock_release+0x24d/0x310 [ 462.715716][T13694] __alloc_disk_node+0x5a/0x6b0 [ 462.715740][T13694] __blk_alloc_disk+0xd2/0x170 [ 462.715764][T13694] ? __pfx___blk_alloc_disk+0x10/0x10 [ 462.715793][T13694] ? __pfx_idr_alloc+0x10/0x10 [ 462.715813][T13694] ? lockdep_init_map_type+0x5c/0x250 [ 462.715839][T13694] ? __raw_spin_lock_init+0x3a/0x110 [ 462.715857][T13694] ? __pfx_hot_add_show+0x10/0x10 [ 462.715880][T13694] zram_add+0x1bf/0x5d0 [ 462.715899][T13694] ? __pfx_zram_add+0x10/0x10 [ 462.715918][T13694] ? trace_contention_end+0x126/0x160 [ 462.715954][T13694] ? rcu_is_watching+0x12/0xc0 [ 462.715973][T13694] ? sysfs_file_kobj+0xe4/0x290 [ 462.715991][T13694] ? rcu_is_watching+0x12/0xc0 [ 462.716010][T13694] ? __pfx_hot_add_show+0x10/0x10 [ 462.716029][T13694] hot_add_show+0x21/0x80 [ 462.716048][T13694] class_attr_show+0x72/0xa0 [ 462.716076][T13694] ? __pfx_class_attr_show+0x10/0x10 [ 462.716102][T13694] sysfs_kf_seq_show+0x217/0x3f0 [ 462.716123][T13694] seq_read_iter+0x32f/0x1270 [ 462.716150][T13694] kernfs_fop_read_iter+0x46c/0x610 [ 462.716167][T13694] ? rw_verify_area+0xce/0x6d0 [ 462.716188][T13694] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 462.716206][T13694] vfs_read+0x82e/0xb40 [ 462.716230][T13694] ? __pfx_vfs_read+0x10/0x10 [ 462.716258][T13694] ksys_read+0x12a/0x250 [ 462.716281][T13694] ? __pfx_ksys_read+0x10/0x10 [ 462.716306][T13694] ? rcu_is_watching+0x12/0xc0 [ 462.716324][T13694] do_syscall_64+0x115/0x840 [ 462.716342][T13694] ? clear_bhb_loop+0x40/0x90 [ 462.716361][T13694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.716380][T13694] RIP: 0033:0x7ff44839ce59 [ 462.716394][T13694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.716411][T13694] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 462.716436][T13694] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 462.716448][T13694] RDX: 0000000000000a00 RSI: 0000200000000ec0 RDI: 0000000000000005 [ 462.716458][T13694] RBP: 00007ff448432e6f R08: 0000000000000000 R09: 0000000000000000 [ 462.716468][T13694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 462.716479][T13694] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 462.716494][T13694] [ 463.432505][T13694] zram: Error allocating disk structure for device 0 [ 463.693152][ T7864] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.787028][T10076] Bluetooth: hci3: unexpected event for opcode 0x7c89 [ 464.302827][T13708] input: jJǸ-9%vJ86 as /devices/virtual/input/input6 [ 464.590613][T13717] [U] ^H [ 464.811007][ T5359] Process accounting resumed [ 465.064364][T13688] Process accounting resumed [ 465.236293][T13732] mmap: syz.1.1672 (13732): VmData 37724160 exceed data ulimit 4. Update limits or use boot option ignore_rlimit_data. [ 465.874964][T13722] Process accounting paused [ 465.891012][T13724] Process accounting paused [ 467.862310][T13779] vhci_hcd: not connected 4 [ 468.157471][T13745] kexec: Could not allocate control_code_buffer [ 468.504379][T13791] futex_wake_op: syz.2.1685 tries to shift op by -2048; fix this program [ 468.596793][T13791] futex_wake_op: syz.2.1685 tries to shift op by -2048; fix this program [ 468.655020][T13793] FAULT_INJECTION: forcing a failure. [ 468.655020][T13793] name failslab, interval 1, probability 0, space 0, times 0 [ 468.708200][T10076] Bluetooth: hci0: unexpected event 0x10 length: 124 > 1 [ 468.708252][T10076] Bluetooth: hci0: hardware error 0x00 [ 468.728680][T13793] CPU: 0 UID: 0 PID: 13793 Comm: syz.3.1686 Not tainted syzkaller #0 PREEMPT(full) [ 468.728707][T13793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 468.728718][T13793] Call Trace: [ 468.728724][T13793] [ 468.728731][T13793] dump_stack_lvl+0x100/0x190 [ 468.728754][T13793] should_fail_ex.cold+0x5/0xa [ 468.728773][T13793] ? __kmalloc_noprof+0xba/0x840 [ 468.728801][T13793] ? alloc_pipe_info+0x1ec/0x590 [ 468.728827][T13793] should_failslab+0xc2/0x120 [ 468.728848][T13793] __kmalloc_noprof+0xe0/0x840 [ 468.728875][T13793] alloc_pipe_info+0x1ec/0x590 [ 468.728902][T13793] splice_direct_to_actor+0x78f/0xa30 [ 468.728930][T13793] ? __pfx_direct_splice_actor+0x10/0x10 [ 468.728956][T13793] ? __pfx_aa_file_perm+0x10/0x10 [ 468.728986][T13793] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 468.729013][T13793] ? rcu_is_watching+0x12/0xc0 [ 468.729031][T13793] ? get_pid_task+0xfc/0x250 [ 468.729050][T13793] ? lock_release+0x24d/0x310 [ 468.729077][T13793] do_splice_direct+0x174/0x240 [ 468.729103][T13793] ? __pfx_do_splice_direct+0x10/0x10 [ 468.729130][T13793] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 468.729156][T13793] ? bpf_lsm_file_permission+0x9/0x10 [ 468.729182][T13793] ? security_file_permission+0x76/0x210 [ 468.729209][T13793] ? rw_verify_area+0xce/0x6d0 [ 468.729230][T13793] do_sendfile+0xadc/0xe20 [ 468.729254][T13793] ? __pfx_do_sendfile+0x10/0x10 [ 468.729276][T13793] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 468.729297][T13793] ? __fget_files+0x21f/0x3d0 [ 468.729323][T13793] __x64_sys_sendfile64+0x1d8/0x220 [ 468.729351][T13793] ? ksys_write+0x1ac/0x250 [ 468.729374][T13793] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 468.729413][T13793] ? rcu_is_watching+0x12/0xc0 [ 468.729431][T13793] do_syscall_64+0x115/0x840 [ 468.729448][T13793] ? clear_bhb_loop+0x40/0x90 [ 468.729468][T13793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 468.729486][T13793] RIP: 0033:0x7ff44839ce59 [ 468.729499][T13793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 468.729517][T13793] RSP: 002b:00007ff4491ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 468.729535][T13793] RAX: ffffffffffffffda RBX: 00007ff448616090 RCX: 00007ff44839ce59 [ 468.729546][T13793] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000003 [ 468.729556][T13793] RBP: 00007ff4491ae090 R08: 0000000000000000 R09: 0000000000000000 [ 468.729567][T13793] R10: 0000400000000006 R11: 0000000000000246 R12: 0000000000000001 [ 468.729578][T13793] R13: 00007ff448616128 R14: 00007ff448616090 R15: 00007ffc0a43ff28 [ 468.729594][T13793] [ 469.257040][T13803] vhci_hcd: not connected 4 [ 470.005062][T13826] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 470.039983][T13827] netlink: 'syz.1.1695': attribute type 1 has an invalid length. [ 470.059534][T13826] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 470.106736][T13826] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 470.762665][T10076] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 470.990484][T13814] bond0: option slaves: interface -]=,Do does not exist! [ 472.043258][T10076] Bluetooth: hci2: command 0x0c1a tx timeout [ 472.123144][ T8243] Bluetooth: hci3: command 0x0c1a tx timeout [ 472.129393][T10076] Bluetooth: hci5: command 0x040f tx timeout [ 475.608633][T13951] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1719'. [ 475.971340][T13955] netlink: 'syz.1.1721': attribute type 1 has an invalid length. [ 476.947198][T13978] ubi1: attaching mtd0 [ 476.983729][T13978] ubi1 error: ubi_attach_mtd_dev: bad VID header (1) or data offsets (65) [ 477.882676][T14002] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1733'. [ 477.951037][T13997] FAULT_INJECTION: forcing a failure. [ 477.951037][T13997] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 478.127524][T13997] CPU: 0 UID: 0 PID: 13997 Comm: syz.5.1732 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.127557][T13997] Tainted: [L]=SOFTLOCKUP [ 478.127563][T13997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 478.127574][T13997] Call Trace: [ 478.127580][T13997] [ 478.127587][T13997] dump_stack_lvl+0x100/0x190 [ 478.127610][T13997] should_fail_ex.cold+0x5/0xa [ 478.127631][T13997] should_fail_alloc_page+0xeb/0x140 [ 478.127653][T13997] prepare_alloc_pages+0x1f0/0x5f0 [ 478.127676][T13997] ? rcu_is_watching+0x12/0xc0 [ 478.127696][T13997] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 478.127749][T13997] ? stack_trace_save+0x8e/0xc0 [ 478.127770][T13997] ? __pfx_stack_trace_save+0x10/0x10 [ 478.127792][T13997] ? stack_depot_save_flags+0x27/0x9d0 [ 478.127824][T13997] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 478.127861][T13997] ? kasan_save_stack+0x3f/0x50 [ 478.127879][T13997] ? kasan_save_stack+0x30/0x50 [ 478.127897][T13997] ? kasan_save_track+0x14/0x30 [ 478.127915][T13997] ? __kasan_slab_alloc+0x89/0x90 [ 478.127934][T13997] ? kmem_cache_alloc_noprof+0x241/0x6d0 [ 478.127951][T13997] ? __pmd_alloc+0xbf/0x950 [ 478.127972][T13997] ? move_page_tables+0x2f7c/0x4610 [ 478.127999][T13997] ? copy_vma_and_data+0x25c/0x7c0 [ 478.128025][T13997] ? move_vma+0x574/0x1920 [ 478.128050][T13997] ? mremap_to+0x234/0x4c0 [ 478.128077][T13997] ? __do_sys_mremap+0x88c/0x1850 [ 478.128103][T13997] ? do_syscall_64+0x115/0x840 [ 478.128121][T13997] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.128143][T13997] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 478.128167][T13997] ? policy_nodemask+0xed/0x4f0 [ 478.128189][T13997] alloc_pages_mpol+0x1fb/0x540 [ 478.128210][T13997] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 478.128231][T13997] ? rcu_is_watching+0x12/0xc0 [ 478.128249][T13997] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 478.128280][T13997] alloc_pages_noprof+0x1a/0x160 [ 478.128304][T13997] pte_alloc_one+0x1c/0x3d0 [ 478.128329][T13997] __pte_alloc+0x6d/0x3e0 [ 478.128347][T13997] ? __pfx___pte_alloc+0x10/0x10 [ 478.128366][T13997] ? _raw_spin_unlock+0x28/0x50 [ 478.128391][T13997] ? __pmd_alloc+0x3fb/0x950 [ 478.128414][T13997] move_page_tables+0x2ec4/0x4610 [ 478.128442][T13997] ? __pfx_copy_vma+0x10/0x10 [ 478.128472][T13997] ? __pfx_move_page_tables+0x10/0x10 [ 478.128503][T13997] ? rcu_is_watching+0x12/0xc0 [ 478.128520][T13997] ? lock_acquire+0x301/0x370 [ 478.128543][T13997] ? finish_task_switch.isra.0+0x2c5/0x1010 [ 478.128573][T13997] copy_vma_and_data+0x25c/0x7c0 [ 478.128602][T13997] ? __pfx_copy_vma_and_data+0x10/0x10 [ 478.128631][T13997] ? lock_release+0x24d/0x310 [ 478.128656][T13997] ? __vma_start_write+0x17f/0x280 [ 478.128680][T13997] ? __pfx___vma_start_write+0x10/0x10 [ 478.128705][T13997] ? security_vm_enough_memory_mm+0xdc/0x110 [ 478.128728][T13997] move_vma+0x574/0x1920 [ 478.128756][T13997] ? __pfx_move_vma+0x10/0x10 [ 478.128784][T13997] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 478.128806][T13997] ? cap_mmap_addr+0x4b/0x120 [ 478.128824][T13997] ? bpf_lsm_mmap_addr+0x9/0x30 [ 478.128855][T13997] ? security_mmap_addr+0x71/0x1e0 [ 478.128880][T13997] ? __get_unmapped_area+0x255/0x3e0 [ 478.128902][T13997] ? vrm_set_new_addr+0x204/0x290 [ 478.128930][T13997] mremap_to+0x234/0x4c0 [ 478.128956][T13997] ? mas_walk+0x6ef/0x9b0 [ 478.128975][T13997] ? __pfx_mremap_to+0x10/0x10 [ 478.129001][T13997] ? check_prep_vma+0x912/0xe60 [ 478.129030][T13997] __do_sys_mremap+0x88c/0x1850 [ 478.129062][T13997] ? __pfx___do_sys_mremap+0x10/0x10 [ 478.129093][T13997] ? __pfx_do_futex+0x10/0x10 [ 478.129112][T13997] ? __x64_sys_futex+0x34f/0x4d0 [ 478.129131][T13997] ? rcu_is_watching+0x12/0xc0 [ 478.129150][T13997] do_syscall_64+0x115/0x840 [ 478.129167][T13997] ? clear_bhb_loop+0x40/0x90 [ 478.129186][T13997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.129204][T13997] RIP: 0033:0x7f068b39ce59 [ 478.129220][T13997] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.129238][T13997] RSP: 002b:00007f068c244028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 478.129256][T13997] RAX: ffffffffffffffda RBX: 00007f068b616090 RCX: 00007f068b39ce59 [ 478.129268][T13997] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000000000 [ 478.129278][T13997] RBP: 00007f068b432e6f R08: 0000000100000000 R09: 0000000000000000 [ 478.129290][T13997] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 478.129300][T13997] R13: 00007f068b616128 R14: 00007f068b616090 R15: 00007fff002448a8 [ 478.129315][T13997] [ 479.497829][T14023] ubi1: attaching mtd0 [ 479.516492][T14023] ubi1 error: ubi_attach_mtd_dev: bad VID header (1) or data offsets (65) [ 479.752555][T14027] netlink: 'syz.1.1738': attribute type 1 has an invalid length. [ 480.414184][T14041] nvme_fcloop: unknown parameter or missing value '7=";&L=j"Yq'R"' [ 480.550343][T14045] FAULT_INJECTION: forcing a failure. [ 480.550343][T14045] name failslab, interval 1, probability 0, space 0, times 0 [ 480.625550][T14045] CPU: 0 UID: 0 PID: 14045 Comm: syz.3.1743 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.625584][T14045] Tainted: [L]=SOFTLOCKUP [ 480.625590][T14045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 480.625602][T14045] Call Trace: [ 480.625609][T14045] [ 480.625617][T14045] dump_stack_lvl+0x100/0x190 [ 480.625640][T14045] should_fail_ex.cold+0x5/0xa [ 480.625661][T14045] ? kmem_cache_alloc_lru_noprof+0x59/0x6e0 [ 480.625681][T14045] should_failslab+0xc2/0x120 [ 480.625701][T14045] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 480.625718][T14045] ? __d_alloc+0x35/0xa50 [ 480.625746][T14045] ? lockdep_init_map_type+0x5c/0x250 [ 480.625775][T14045] __d_alloc+0x35/0xa50 [ 480.625809][T14045] d_alloc_pseudo+0x1c/0xc0 [ 480.625829][T14045] alloc_file_pseudo+0x118/0x290 [ 480.625848][T14045] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 480.625867][T14045] ? alloc_fd+0x471/0x7a0 [ 480.625892][T14045] sock_alloc_file+0x50/0x210 [ 480.625919][T14045] __sys_socket+0x1c0/0x260 [ 480.625938][T14045] ? __pfx___sys_socket+0x10/0x10 [ 480.625959][T14045] __x64_sys_socket+0x72/0xb0 [ 480.625978][T14045] do_syscall_64+0x115/0x840 [ 480.625996][T14045] ? clear_bhb_loop+0x40/0x90 [ 480.626016][T14045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.626039][T14045] RIP: 0033:0x7ff44839ce59 [ 480.626053][T14045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 480.626071][T14045] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 480.626090][T14045] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 480.626101][T14045] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 480.626111][T14045] RBP: 00007ff448432e6f R08: 0000000000000000 R09: 0000000000000000 [ 480.626122][T14045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 480.626132][T14045] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 480.626148][T14045] [ 481.212591][T14054] vhci_hcd: not connected 4 [ 482.189932][T14080] netlink: 'syz.2.1752': attribute type 1 has an invalid length. [ 482.547192][T14089] FAULT_INJECTION: forcing a failure. [ 482.547192][T14089] name failslab, interval 1, probability 0, space 0, times 0 [ 482.661475][T14089] CPU: 0 UID: 0 PID: 14089 Comm: syz.5.1755 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.661508][T14089] Tainted: [L]=SOFTLOCKUP [ 482.661514][T14089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 482.661525][T14089] Call Trace: [ 482.661531][T14089] [ 482.661538][T14089] dump_stack_lvl+0x100/0x190 [ 482.661560][T14089] should_fail_ex.cold+0x5/0xa [ 482.661579][T14089] ? __kmalloc_node_noprof+0xc1/0x890 [ 482.661598][T14089] should_failslab+0xc2/0x120 [ 482.661620][T14089] __kmalloc_node_noprof+0xe7/0x890 [ 482.661637][T14089] ? mempool_init_node+0x11b/0x6e0 [ 482.661655][T14089] ? lockdep_init_map_type+0x5c/0x250 [ 482.661686][T14089] ? __pfx_mempool_free_slab+0x10/0x10 [ 482.661703][T14089] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 482.661721][T14089] mempool_init_node+0x11b/0x6e0 [ 482.661741][T14089] ? __pfx_mempool_alloc_slab+0x10/0x10 [ 482.661757][T14089] ? __pfx_mempool_free_slab+0x10/0x10 [ 482.661773][T14089] mempool_init_noprof+0x3a/0x50 [ 482.661792][T14089] bioset_init+0x37e/0x8a0 [ 482.661872][T14089] ? __pfx_bioset_init+0x10/0x10 [ 482.661897][T14089] __alloc_disk_node+0x83/0x6b0 [ 482.661924][T14089] __blk_alloc_disk+0xd2/0x170 [ 482.661947][T14089] ? __pfx___blk_alloc_disk+0x10/0x10 [ 482.661976][T14089] ? __pfx_idr_alloc+0x10/0x10 [ 482.661996][T14089] ? lockdep_init_map_type+0x5c/0x250 [ 482.662022][T14089] ? __raw_spin_lock_init+0x3a/0x110 [ 482.662039][T14089] ? __pfx_hot_add_show+0x10/0x10 [ 482.662059][T14089] zram_add+0x1bf/0x5d0 [ 482.662077][T14089] ? __pfx_zram_add+0x10/0x10 [ 482.662096][T14089] ? trace_contention_end+0x126/0x160 [ 482.662128][T14089] ? rcu_is_watching+0x12/0xc0 [ 482.662146][T14089] ? sysfs_file_kobj+0xe4/0x290 [ 482.662164][T14089] ? rcu_is_watching+0x12/0xc0 [ 482.662182][T14089] ? __pfx_hot_add_show+0x10/0x10 [ 482.662202][T14089] hot_add_show+0x21/0x80 [ 482.662222][T14089] class_attr_show+0x72/0xa0 [ 482.662249][T14089] ? __pfx_class_attr_show+0x10/0x10 [ 482.662275][T14089] sysfs_kf_seq_show+0x217/0x3f0 [ 482.662304][T14089] seq_read_iter+0x32f/0x1270 [ 482.662331][T14089] kernfs_fop_read_iter+0x46c/0x610 [ 482.662349][T14089] ? rw_verify_area+0xce/0x6d0 [ 482.662370][T14089] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 482.662389][T14089] vfs_read+0x82e/0xb40 [ 482.662413][T14089] ? __pfx_vfs_read+0x10/0x10 [ 482.662442][T14089] ksys_read+0x12a/0x250 [ 482.662468][T14089] ? __pfx_ksys_read+0x10/0x10 [ 482.662492][T14089] ? rcu_is_watching+0x12/0xc0 [ 482.662511][T14089] do_syscall_64+0x115/0x840 [ 482.662528][T14089] ? clear_bhb_loop+0x40/0x90 [ 482.662547][T14089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.662565][T14089] RIP: 0033:0x7f068b39ce59 [ 482.662580][T14089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 482.662606][T14089] RSP: 002b:00007f068c244028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 482.662624][T14089] RAX: ffffffffffffffda RBX: 00007f068b616090 RCX: 00007f068b39ce59 [ 482.662636][T14089] RDX: 0000000000001000 RSI: 0000200000000ec0 RDI: 0000000000000005 [ 482.662648][T14089] RBP: 00007f068b432e6f R08: 0000000000000000 R09: 0000000000000000 [ 482.662658][T14089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 482.662669][T14089] R13: 00007f068b616128 R14: 00007f068b616090 R15: 00007fff002448a8 [ 482.662685][T14089] [ 483.172115][T14089] zram: Error allocating disk structure for device 0 [ 483.887606][T14100] netlink: 202 bytes leftover after parsing attributes in process `syz.3.1759'. [ 484.286559][T14118] netlink: 'syz.2.1763': attribute type 1 has an invalid length. [ 484.744263][T14128] netlink: 'syz.2.1765': attribute type 1 has an invalid length. [ 486.498994][T10076] Bluetooth: hci3: unexpected event 0x0f length: 7 > 4 [ 486.499028][T10076] Bluetooth: hci3: unexpected event for opcode 0x4b6d [ 487.635862][T14186] vhci_hcd: not connected 4 [ 487.952873][T14192] netlink: 'syz.3.1780': attribute type 33 has an invalid length. [ 488.043114][T14192] netlink: 322 bytes leftover after parsing attributes in process `syz.3.1780'. [ 488.236291][T14197] FAULT_INJECTION: forcing a failure. [ 488.236291][T14197] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 488.285646][T14199] netlink: 342 bytes leftover after parsing attributes in process `syz.5.1783'. [ 488.323946][T14197] CPU: 0 UID: 0 PID: 14197 Comm: syz.1.1782 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.323978][T14197] Tainted: [L]=SOFTLOCKUP [ 488.323984][T14197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 488.323995][T14197] Call Trace: [ 488.324000][T14197] [ 488.324007][T14197] dump_stack_lvl+0x100/0x190 [ 488.324033][T14197] should_fail_ex.cold+0x5/0xa [ 488.324056][T14197] _copy_to_user+0x32/0xd0 [ 488.324087][T14197] simple_read_from_buffer+0xcb/0x170 [ 488.324115][T14197] proc_fail_nth_read+0x1af/0x230 [ 488.324134][T14197] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 488.324153][T14197] ? security_file_permission+0x76/0x210 [ 488.324182][T14197] ? rw_verify_area+0xce/0x6d0 [ 488.324204][T14197] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 488.324222][T14197] vfs_read+0x1e4/0xb40 [ 488.324247][T14197] ? __pfx_vfs_read+0x10/0x10 [ 488.324270][T14197] ? rcu_is_watching+0x12/0xc0 [ 488.324292][T14197] ? __fget_files+0x21f/0x3d0 [ 488.324319][T14197] ksys_read+0x12a/0x250 [ 488.324348][T14197] ? __pfx_ksys_read+0x10/0x10 [ 488.324373][T14197] ? rcu_is_watching+0x12/0xc0 [ 488.324392][T14197] do_syscall_64+0x115/0x840 [ 488.324411][T14197] ? clear_bhb_loop+0x40/0x90 [ 488.324433][T14197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.324451][T14197] RIP: 0033:0x7fec8655d68e [ 488.324464][T14197] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 488.324486][T14197] RSP: 002b:00007fec87385fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 488.324504][T14197] RAX: ffffffffffffffda RBX: 00007fec873866c0 RCX: 00007fec8655d68e [ 488.324516][T14197] RDX: 000000000000000f RSI: 00007fec873860a0 RDI: 0000000000000007 [ 488.324527][T14197] RBP: 00007fec87386090 R08: 0000000000000000 R09: 0000000000000000 [ 488.324537][T14197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.324548][T14197] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 488.324564][T14197] [ 489.099442][T14218] vhci_hcd: not connected 4 [ 489.805149][T14228] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 490.021473][T14234] FAULT_INJECTION: forcing a failure. [ 490.021473][T14234] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 490.088713][T14234] CPU: 0 UID: 0 PID: 14234 Comm: syz.1.1793 Tainted: G L syzkaller #0 PREEMPT(full) [ 490.088745][T14234] Tainted: [L]=SOFTLOCKUP [ 490.088752][T14234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 490.088763][T14234] Call Trace: [ 490.088769][T14234] [ 490.088775][T14234] dump_stack_lvl+0x100/0x190 [ 490.088800][T14234] should_fail_ex.cold+0x5/0xa [ 490.088821][T14234] should_fail_alloc_page+0xeb/0x140 [ 490.088845][T14234] prepare_alloc_pages+0x1f0/0x5f0 [ 490.088869][T14234] ? arch_stack_walk+0xa6/0xf0 [ 490.088895][T14234] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 490.088927][T14234] ? stack_trace_save+0x8e/0xc0 [ 490.088950][T14234] ? __pfx_stack_trace_save+0x10/0x10 [ 490.088974][T14234] ? rcu_is_watching+0x12/0xc0 [ 490.088994][T14234] ? stack_depot_save_flags+0x27/0x9d0 [ 490.089025][T14234] ? unwind_next_frame+0x3be/0x2090 [ 490.089050][T14234] ? rcu_is_watching+0x12/0xc0 [ 490.089068][T14234] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 490.089098][T14234] ? kasan_save_stack+0x3f/0x50 [ 490.089116][T14234] ? kasan_save_track+0x14/0x30 [ 490.089133][T14234] ? kmem_cache_alloc_noprof+0x241/0x6d0 [ 490.089150][T14234] ? __pmd_alloc+0xbf/0x950 [ 490.089173][T14234] ? __handle_mm_fault+0xa9c/0x2a00 [ 490.089198][T14234] ? handle_mm_fault+0x37b/0xa30 [ 490.089223][T14234] ? do_user_addr_fault+0x74c/0x12f0 [ 490.089245][T14234] ? exc_page_fault+0x6f/0xd0 [ 490.089261][T14234] ? asm_exc_page_fault+0x26/0x30 [ 490.089278][T14234] ? __get_user_4+0x14/0x30 [ 490.089302][T14234] ? do_vfs_ioctl+0xec4/0x13e0 [ 490.089321][T14234] ? __x64_sys_ioctl+0x114/0x210 [ 490.089340][T14234] ? do_syscall_64+0x115/0x840 [ 490.089357][T14234] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.089379][T14234] ? __css_rstat_updated+0x1ce/0x5a0 [ 490.089405][T14234] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 490.089430][T14234] ? policy_nodemask+0xed/0x4f0 [ 490.089453][T14234] alloc_pages_mpol+0x1fb/0x540 [ 490.089475][T14234] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 490.089497][T14234] ? __thp_vma_allowable_orders+0x1d9/0xce0 [ 490.089533][T14234] ? do_raw_spin_lock+0x128/0x260 [ 490.089555][T14234] alloc_pages_noprof+0x1a/0x160 [ 490.089581][T14234] pte_alloc_one+0x1c/0x3d0 [ 490.089606][T14234] do_fault+0x86c/0x1750 [ 490.089628][T14234] ? __pmd_alloc+0x3fb/0x950 [ 490.089651][T14234] __handle_mm_fault+0x187d/0x2a00 [ 490.089687][T14234] ? mt_find+0x45e/0x8e0 [ 490.089708][T14234] ? __pfx___handle_mm_fault+0x10/0x10 [ 490.089734][T14234] ? __pfx_mt_find+0x10/0x10 [ 490.089763][T14234] ? find_vma+0xbf/0x140 [ 490.089781][T14234] ? __pfx_find_vma+0x10/0x10 [ 490.089801][T14234] handle_mm_fault+0x37b/0xa30 [ 490.089829][T14234] do_user_addr_fault+0x74c/0x12f0 [ 490.089854][T14234] exc_page_fault+0x6f/0xd0 [ 490.089870][T14234] asm_exc_page_fault+0x26/0x30 [ 490.089888][T14234] RIP: 0010:__get_user_4+0x14/0x30 [ 490.089914][T14234] Code: 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 490.089933][T14234] RSP: 0018:ffffc90003ccfd20 EFLAGS: 00050287 [ 490.089948][T14234] RAX: 0000000000000003 RBX: ffff888034764000 RCX: 0000000000000001 [ 490.089960][T14234] RDX: 00007ffffffff000 RSI: ffffffff825b1cd1 RDI: ffffffff8e1ec920 [ 490.089972][T14234] RBP: 1ffff92000799fa7 R08: 0000000000000000 R09: 0000000000000000 [ 490.089982][T14234] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003 [ 490.089995][T14234] R13: ffff88802d570750 R14: 0000000000005452 R15: 0000000000005452 [ 490.090009][T14234] ? __might_fault+0x111/0x140 [ 490.090038][T14234] do_vfs_ioctl+0xec4/0x13e0 [ 490.090059][T14234] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 490.090081][T14234] ? rcu_is_watching+0x12/0xc0 [ 490.090100][T14234] ? __fget_files+0x215/0x3d0 [ 490.090123][T14234] ? hook_file_ioctl_common+0x140/0x440 [ 490.090151][T14234] ? __fget_files+0x21f/0x3d0 [ 490.090179][T14234] __x64_sys_ioctl+0x114/0x210 [ 490.090200][T14234] do_syscall_64+0x115/0x840 [ 490.090217][T14234] ? clear_bhb_loop+0x40/0x90 [ 490.090237][T14234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.090255][T14234] RIP: 0033:0x7fec8659ce59 [ 490.090268][T14234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.090285][T14234] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 490.090301][T14234] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 490.090313][T14234] RDX: 0000000000000003 RSI: 0000000000005452 RDI: 0000000000000003 [ 490.090323][T14234] RBP: 00007fec87386090 R08: 0000000000000000 R09: 0000000000000000 [ 490.090334][T14234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.090344][T14234] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 490.090360][T14234] [ 490.898551][T14239] FAULT_INJECTION: forcing a failure. [ 490.898551][T14239] name failslab, interval 1, probability 0, space 0, times 0 [ 490.913286][T14239] CPU: 0 UID: 0 PID: 14239 Comm: syz.1.1795 Tainted: G L syzkaller #0 PREEMPT(full) [ 490.913319][T14239] Tainted: [L]=SOFTLOCKUP [ 490.913326][T14239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 490.913337][T14239] Call Trace: [ 490.913346][T14239] [ 490.913353][T14239] dump_stack_lvl+0x100/0x190 [ 490.913376][T14239] should_fail_ex.cold+0x5/0xa [ 490.913395][T14239] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 490.913416][T14239] should_failslab+0xc2/0x120 [ 490.913437][T14239] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 490.913454][T14239] ? anon_vma_fork+0x19a/0x6b0 [ 490.913480][T14239] ? kmem_cache_alloc_noprof+0x292/0x6d0 [ 490.913499][T14239] anon_vma_fork+0x19a/0x6b0 [ 490.913525][T14239] dup_mmap+0x143e/0x21b0 [ 490.913551][T14239] ? __pfx_dup_mmap+0x10/0x10 [ 490.913584][T14239] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 490.913613][T14239] ? lock_release+0x24d/0x310 [ 490.913639][T14239] ? do_raw_spin_lock+0x128/0x260 [ 490.913656][T14239] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 490.913673][T14239] ? __percpu_counter_init_many+0x2bc/0x3b0 [ 490.913758][T14239] ? rcu_is_watching+0x12/0xc0 [ 490.913777][T14239] ? lock_acquire+0x301/0x370 [ 490.913804][T14239] copy_process+0x4588/0x7ff0 [ 490.913827][T14239] ? __pfx_copy_process+0x10/0x10 [ 490.913845][T14239] ? futex_wake+0x4ea/0x5e0 [ 490.913865][T14239] ? rcu_is_watching+0x12/0xc0 [ 490.913886][T14239] kernel_clone+0x176/0x9d0 [ 490.913904][T14239] ? __pfx_kernel_clone+0x10/0x10 [ 490.913928][T14239] ? 0xffffffffff600000 [ 490.913940][T14239] __do_sys_clone+0xd9/0x120 [ 490.913958][T14239] ? __pfx___do_sys_clone+0x10/0x10 [ 490.913977][T14239] ? 0xffffffffff600000 [ 490.913992][T14239] ? rcu_is_watching+0x12/0xc0 [ 490.914011][T14239] do_syscall_64+0x115/0x840 [ 490.914029][T14239] ? clear_bhb_loop+0x40/0x90 [ 490.914049][T14239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.914067][T14239] RIP: 0033:0x7fec8659ce59 [ 490.914081][T14239] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.914099][T14239] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 490.914117][T14239] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 490.914129][T14239] RDX: ffffffffffffffff RSI: 0000000000000005 RDI: 0000000000009001 [ 490.914141][T14239] RBP: 00007fec86632e6f R08: 0000000000000006 R09: 0000000000000000 [ 490.914152][T14239] R10: ffffffffff600000 R11: 0000000000000246 R12: 0000000000000000 [ 490.914164][T14239] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 490.914177][T14239] ? 0xffffffffff600000 [ 490.914192][T14239] [ 491.203510][T10076] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 491.212333][T10076] Bluetooth: hci3: Injecting HCI hardware error event [ 491.219532][T10076] Bluetooth: hci3: hardware error 0x00 [ 491.806270][T14250] vhci_hcd: not connected 4 [ 494.046009][T14298] vhci_hcd: not connected 4 [ 494.054669][T10076] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 494.549825][T14308] futex_wake_op: syz.3.1810 tries to shift op by -2048; fix this program [ 494.577141][T14308] futex_wake_op: syz.3.1810 tries to shift op by -2048; fix this program [ 494.627420][T14308] 0x000000000001-0x000000020000 : "" [ 494.666767][T14308] ftl_cs: FTL header corrupt! [ 495.183107][T14318] ubi9: attaching mtd2 [ 495.231837][T14318] ubi9 error: ubi_attach_mtd_dev: bad VID header (10) or data offsets (74) [ 495.622932][T14331] netlink: 'syz.2.1813': attribute type 1 has an invalid length. [ 495.679815][T14330] ubi9: attaching mtd2 [ 495.737617][T14330] ubi9 error: ubi_attach_mtd_dev: bad VID header (10) or data offsets (74) [ 496.181033][T14282] Process accounting paused [ 496.709565][T14353] ubi9: attaching mtd2 [ 496.742089][T14353] ubi9 error: ubi_attach_mtd_dev: bad VID header (10) or data offsets (74) [ 496.922458][T14345] bond0: option slaves: interface -]=,Do does not exist! [ 497.912980][T14370] vhci_hcd: not connected 4 [ 500.339803][T14414] FAULT_INJECTION: forcing a failure. [ 500.339803][T14414] name failslab, interval 1, probability 0, space 0, times 0 [ 500.504855][T14414] CPU: 0 UID: 0 PID: 14414 Comm: syz.3.1833 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.504888][T14414] Tainted: [L]=SOFTLOCKUP [ 500.504894][T14414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 500.504905][T14414] Call Trace: [ 500.504912][T14414] [ 500.504919][T14414] dump_stack_lvl+0x100/0x190 [ 500.504943][T14414] should_fail_ex.cold+0x5/0xa [ 500.504963][T14414] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 500.504996][T14414] should_failslab+0xc2/0x120 [ 500.505103][T14414] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 500.505145][T14414] ? security_file_alloc+0x34/0x2c0 [ 500.505172][T14414] ? trace_kmem_cache_alloc+0xdd/0x100 [ 500.505195][T14414] security_file_alloc+0x34/0x2c0 [ 500.505222][T14414] init_file+0x95/0x480 [ 500.505239][T14414] alloc_empty_file+0x79/0x1c0 [ 500.505259][T14414] path_openat+0xe7/0x4280 [ 500.505287][T14414] ? kasan_save_stack+0x3f/0x50 [ 500.505305][T14414] ? kasan_save_stack+0x30/0x50 [ 500.505323][T14414] ? kasan_save_track+0x14/0x30 [ 500.505340][T14414] ? __kasan_slab_alloc+0x89/0x90 [ 500.505360][T14414] ? kmem_cache_alloc_noprof+0x241/0x6d0 [ 500.505377][T14414] ? do_getname+0x35/0x390 [ 500.505394][T14414] ? do_sys_openat2+0xc7/0x1e0 [ 500.505413][T14414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.505434][T14414] ? __pfx_path_openat+0x10/0x10 [ 500.505468][T14414] do_file_open+0x20e/0x430 [ 500.505495][T14414] ? __pfx_do_file_open+0x10/0x10 [ 500.505528][T14414] ? alloc_fd+0x471/0x7a0 [ 500.505554][T14414] ? do_getname+0x191/0x390 [ 500.505573][T14414] do_sys_openat2+0x10f/0x1e0 [ 500.505592][T14414] ? __pfx_do_sys_openat2+0x10/0x10 [ 500.505611][T14414] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 500.505633][T14414] ? __fget_files+0x21f/0x3d0 [ 500.505659][T14414] __x64_sys_openat+0x12d/0x210 [ 500.505678][T14414] ? __pfx___x64_sys_openat+0x10/0x10 [ 500.505698][T14414] ? ksys_write+0x1ac/0x250 [ 500.505724][T14414] ? rcu_is_watching+0x12/0xc0 [ 500.505745][T14414] do_syscall_64+0x115/0x840 [ 500.505763][T14414] ? clear_bhb_loop+0x40/0x90 [ 500.505784][T14414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.505803][T14414] RIP: 0033:0x7ff44839ce59 [ 500.505820][T14414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.505840][T14414] RSP: 002b:00007ff4491ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 500.505861][T14414] RAX: ffffffffffffffda RBX: 00007ff448616090 RCX: 00007ff44839ce59 [ 500.505872][T14414] RDX: 0000000000000401 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 500.505883][T14414] RBP: 00007ff4491ae090 R08: 0000000000000000 R09: 0000000000000000 [ 500.505894][T14414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.505904][T14414] R13: 00007ff448616128 R14: 00007ff448616090 R15: 00007ffc0a43ff28 [ 500.505920][T14414] [ 502.141716][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.151232][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.738446][T14454] FAULT_INJECTION: forcing a failure. [ 502.738446][T14454] name failslab, interval 1, probability 0, space 0, times 0 [ 502.801566][T14454] CPU: 0 UID: 0 PID: 14454 Comm: syz.3.1842 Tainted: G L syzkaller #0 PREEMPT(full) [ 502.801599][T14454] Tainted: [L]=SOFTLOCKUP [ 502.801606][T14454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 502.801616][T14454] Call Trace: [ 502.801622][T14454] [ 502.801629][T14454] dump_stack_lvl+0x100/0x190 [ 502.801651][T14454] should_fail_ex.cold+0x5/0xa [ 502.801680][T14454] ? __kmalloc_noprof+0xba/0x840 [ 502.801707][T14454] ? load_msg+0x118/0x4a0 [ 502.801801][T14454] should_failslab+0xc2/0x120 [ 502.801823][T14454] __kmalloc_noprof+0xe0/0x840 [ 502.801851][T14454] load_msg+0x118/0x4a0 [ 502.801880][T14454] do_mq_timedsend+0x3ce/0xc40 [ 502.801915][T14454] ? __pfx_do_mq_timedsend+0x10/0x10 [ 502.801935][T14454] ? __mutex_unlock_slowpath+0x35d/0x930 [ 502.801958][T14454] ? __fget_files+0x21f/0x3d0 [ 502.801984][T14454] __x64_sys_mq_timedsend+0x1cd/0x260 [ 502.802005][T14454] ? ksys_write+0x1ac/0x250 [ 502.802029][T14454] ? __pfx___x64_sys_mq_timedsend+0x10/0x10 [ 502.802052][T14454] ? rcu_is_watching+0x12/0xc0 [ 502.802072][T14454] do_syscall_64+0x115/0x840 [ 502.802090][T14454] ? clear_bhb_loop+0x40/0x90 [ 502.802110][T14454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.802129][T14454] RIP: 0033:0x7ff44839ce59 [ 502.802143][T14454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.802162][T14454] RSP: 002b:00007ff4491cf028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f2 [ 502.802180][T14454] RAX: ffffffffffffffda RBX: 00007ff448615fa0 RCX: 00007ff44839ce59 [ 502.802192][T14454] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 0000000000000004 [ 502.802203][T14454] RBP: 00007ff4491cf090 R08: 0000000000000000 R09: 0000000000000000 [ 502.802213][T14454] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 502.802223][T14454] R13: 00007ff448616038 R14: 00007ff448615fa0 R15: 00007ffc0a43ff28 [ 502.802239][T14454] [ 503.109288][T14419] Invalid ELF header magic: != ELF [ 503.150788][T14458] random: crng reseeded on system resumption [ 503.572765][T14467] scsi_dev_info_list_add_str: bad dev info string '' '' '' [ 503.640829][T14469] random: crng reseeded on system resumption [ 503.800038][T14467] hub 1-0:1.0: USB hub found [ 503.829576][T14467] hub 1-0:1.0: 1 port detected [ 504.035425][T14481] vhci_hcd: not connected 4 [ 507.802471][T14572] FAULT_INJECTION: forcing a failure. [ 507.802471][T14572] name failslab, interval 1, probability 0, space 0, times 0 [ 507.879238][T14572] CPU: 0 UID: 0 PID: 14572 Comm: syz.1.1863 Tainted: G L syzkaller #0 PREEMPT(full) [ 507.879271][T14572] Tainted: [L]=SOFTLOCKUP [ 507.879279][T14572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 507.879291][T14572] Call Trace: [ 507.879297][T14572] [ 507.879305][T14572] dump_stack_lvl+0x100/0x190 [ 507.879328][T14572] should_fail_ex.cold+0x5/0xa [ 507.879347][T14572] ? kmem_cache_alloc_noprof+0x54/0x6d0 [ 507.879368][T14572] should_failslab+0xc2/0x120 [ 507.879390][T14572] kmem_cache_alloc_noprof+0x7b/0x6d0 [ 507.879407][T14572] ? mas_preallocate+0x1105/0x14a0 [ 507.879435][T14572] mas_preallocate+0x1105/0x14a0 [ 507.879459][T14572] ? __pfx_mas_preallocate+0x10/0x10 [ 507.879485][T14572] ? vm_area_alloc+0x1f/0x160 [ 507.879511][T14572] ? lockdep_init_map_type+0x5c/0x250 [ 507.879540][T14572] __mmap_region+0x1230/0x2db0 [ 507.879568][T14572] ? __pfx___mmap_region+0x10/0x10 [ 507.879595][T14572] ? __pfx___might_resched+0x10/0x10 [ 507.879622][T14572] ? do_raw_spin_lock+0x128/0x260 [ 507.879643][T14572] ? debug_object_assert_init+0x1c4/0x300 [ 507.879673][T14572] ? debug_object_assert_init+0x1c4/0x300 [ 507.879707][T14572] ? lock_release+0x24d/0x310 [ 507.879736][T14572] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 507.879762][T14572] ? rcu_is_watching+0x12/0xc0 [ 507.879782][T14572] ? trace_irq_enable.constprop.0+0x122/0x160 [ 507.879821][T14572] ? futex_unqueue+0x133/0x2c0 [ 507.879851][T14572] ? lock_release+0x24d/0x310 [ 507.879876][T14572] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 507.879901][T14572] mmap_region+0x35d/0x620 [ 507.879917][T14572] ? rcu_is_watching+0x12/0xc0 [ 507.879935][T14572] ? __pfx_mmap_region+0x10/0x10 [ 507.879953][T14572] ? cap_mmap_addr+0x4b/0x120 [ 507.879973][T14572] ? bpf_lsm_mmap_addr+0x9/0x30 [ 507.880001][T14572] ? security_mmap_addr+0x71/0x1e0 [ 507.880027][T14572] ? __get_unmapped_area+0x255/0x3e0 [ 507.880049][T14572] do_mmap+0xc63/0x12f0 [ 507.880071][T14572] ? __pfx_do_mmap+0x10/0x10 [ 507.880092][T14572] ? __pfx_down_write_killable+0x10/0x10 [ 507.880123][T14572] ? __pfx_futex_wait+0x10/0x10 [ 507.880146][T14572] vm_mmap_pgoff+0x29e/0x470 [ 507.880170][T14572] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 507.880193][T14572] ? __pfx_do_futex+0x10/0x10 [ 507.880211][T14572] ksys_mmap_pgoff+0xe4/0x610 [ 507.880233][T14572] ? __x64_sys_futex+0x358/0x4d0 [ 507.880250][T14572] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 507.880271][T14572] ? xfd_validate_state+0x129/0x190 [ 507.880291][T14572] __x64_sys_mmap+0x125/0x190 [ 507.880311][T14572] do_syscall_64+0x115/0x840 [ 507.880328][T14572] ? clear_bhb_loop+0x40/0x90 [ 507.880349][T14572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.880367][T14572] RIP: 0033:0x7fec8659ce59 [ 507.880383][T14572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.880402][T14572] RSP: 002b:00007fec87386028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 507.880421][T14572] RAX: ffffffffffffffda RBX: 00007fec86815fa0 RCX: 00007fec8659ce59 [ 507.880433][T14572] RDX: 00000000000000df RSI: 0000000000400006 RDI: 0000000000000000 [ 507.880444][T14572] RBP: 00007fec86632e6f R08: 0000000000000002 R09: 0000000000008000 [ 507.880456][T14572] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 507.880467][T14572] R13: 00007fec86816038 R14: 00007fec86815fa0 R15: 00007ffc1ddcb118 [ 507.880484][T14572] [ 508.917599][T14580] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.253777][T14580] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.330350][T14600] netlink: 'syz.3.1869': attribute type 1 has an invalid length. [ 509.444933][T14596] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 509.470546][T14596] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 509.506197][T14580] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.731005][T14580] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.979165][T14580] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.005397][T14636] vhci_hcd: not connected 4 [ 511.503098][T10076] Bluetooth: hci2: command 0x0c1a tx timeout [ 511.509510][ T8243] Bluetooth: hci5: command 0x040f tx timeout [ 511.746132][T14652] ubi0: attaching mtd0 [ 511.817062][T14652] ubi0: scanning is finished [ 511.877868][T14652] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 512.176308][T14652] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 512.757216][ T5703] Process accounting resumed [ 512.878115][T14662] Process accounting resumed [ 514.076804][T14700] FAULT_INJECTION: forcing a failure. [ 514.076804][T14700] name fail_futex, interval 1, probability 0, space 0, times 0 [ 514.091613][T14700] CPU: 0 UID: 0 PID: 14700 Comm: syz.1.1893 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.091644][T14700] Tainted: [L]=SOFTLOCKUP [ 514.091651][T14700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 514.091662][T14700] Call Trace: [ 514.091676][T14700] [ 514.091682][T14700] dump_stack_lvl+0x100/0x190 [ 514.091707][T14700] should_fail_ex.cold+0x5/0xa [ 514.091728][T14700] get_futex_key+0x295/0x14f0 [ 514.091761][T14700] ? __pfx_get_futex_key+0x10/0x10 [ 514.091789][T14700] ? rcu_is_watching+0x12/0xc0 [ 514.091808][T14700] ? lock_acquire+0x301/0x370 [ 514.091834][T14700] futex_wake+0xf4/0x5e0 [ 514.091854][T14700] ? __mutex_lock+0x26d/0x1bd0 [ 514.091874][T14700] ? __pfx_futex_wake+0x10/0x10 [ 514.091894][T14700] ? exit_mm_release+0x19/0x30 [ 514.091913][T14700] ? lock_release+0x24d/0x310 [ 514.091939][T14700] do_futex+0x2b2/0x440 [ 514.091960][T14700] ? __pfx_do_futex+0x10/0x10 [ 514.091975][T14700] ? lock_release+0x24d/0x310 [ 514.092002][T14700] mm_release+0x24a/0x2f0 [ 514.092031][T14700] do_exit+0x707/0x2ae0 [ 514.092053][T14700] ? __pfx_do_exit+0x10/0x10 [ 514.092075][T14700] ? do_raw_spin_lock+0x128/0x260 [ 514.092091][T14700] ? get_signal+0x7e0/0x21e0 [ 514.092109][T14700] do_group_exit+0xd5/0x2a0 [ 514.092132][T14700] get_signal+0x1ec7/0x21e0 [ 514.092151][T14700] ? __pfx_get_signal+0x10/0x10 [ 514.092168][T14700] ? do_futex+0x190/0x440 [ 514.092184][T14700] arch_do_signal_or_restart+0x91/0x7a0 [ 514.092233][T14700] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 514.092265][T14700] ? rcu_is_watching+0x12/0xc0 [ 514.092284][T14700] exit_to_user_mode_loop+0x139/0x6f0 [ 514.092312][T14700] ? rcu_is_watching+0x12/0xc0 [ 514.092331][T14700] do_syscall_64+0x652/0x840 [ 514.092348][T14700] ? clear_bhb_loop+0x40/0x90 [ 514.092368][T14700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 514.092386][T14700] RIP: 0033:0x7fec8659ce59 [ 514.092400][T14700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 514.092418][T14700] RSP: 002b:00007fec873860e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 514.092436][T14700] RAX: fffffffffffffe00 RBX: 00007fec86815fa8 RCX: 00007fec8659ce59 [ 514.092455][T14700] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fec86815fa8 [ 514.092466][T14700] RBP: 00007fec86815fa0 R08: 0000000000000000 R09: 0000000000000000 [ 514.092477][T14700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 514.092488][T14700] R13: 00007fec86816038 R14: 00007ffc1ddcb030 R15: 00007ffc1ddcb118 [ 514.092503][T14700] [ 514.476336][T14704] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1895'. [ 516.865520][ T31] INFO: task syz.0.1258:11767 blocked for more than 143 seconds. [ 516.888163][ T31] Tainted: G L syzkaller #0 [ 516.910432][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 516.942481][ T31] task:syz.0.1258 state:D stack:28328 pid:11767 tgid:11760 ppid:5622 task_flags:0x400040 flags:0x00080002 [ 516.982673][ T31] Call Trace: [ 516.998968][ T31] [ 517.011378][ T31] __schedule+0x125c/0x6730 [ 517.031073][ T31] ? do_syscall_64+0x115/0x840 [ 517.042549][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.056864][ T31] ? do_raw_spin_lock+0x128/0x260 [ 517.069649][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 517.076284][ T31] ? debug_mutex_add_waiter+0x122/0x200 [ 517.081967][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.087217][ T31] ? __pfx___schedule+0x10/0x10 [ 517.094010][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.099589][ T31] ? schedule+0x2bf/0x390 [ 517.104515][ T31] ? lock_release+0x24d/0x310 [ 517.112359][ T31] schedule+0xdd/0x390 [ 517.118114][ T31] schedule_preempt_disabled+0x13/0x30 [ 517.124021][ T31] __mutex_lock+0xccc/0x1bd0 [ 517.130074][ T31] ? nfsd_nl_listener_get_doit+0x13f/0x7c0 [ 517.138183][ T31] ? __kmalloc_node_track_caller_noprof+0x33b/0x890 [ 517.146081][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 517.151877][ T31] ? kmalloc_reserve+0xf9/0x350 [ 517.157755][ T31] ? skb_put+0x138/0x180 [ 517.162888][ T31] ? __nlmsg_put+0x152/0x1c0 [ 517.168430][ T31] ? nfsd_nl_listener_get_doit+0x13f/0x7c0 [ 517.174525][ T31] nfsd_nl_listener_get_doit+0x13f/0x7c0 [ 517.180862][ T31] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 517.188762][ T31] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 517.197903][ T31] genl_family_rcv_msg_doit+0x214/0x300 [ 517.203873][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 517.210281][ T31] ? genl_get_cmd+0x3e7/0x760 [ 517.215369][ T31] ? __dev_queue_xmit+0xa11/0x4940 [ 517.221286][ T31] ? __radix_tree_lookup+0x217/0x2b0 [ 517.227150][ T31] genl_rcv_msg+0x560/0x800 [ 517.231835][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 517.237765][ T31] ? __pfx_nfsd_nl_listener_get_doit+0x10/0x10 [ 517.244157][ T31] netlink_rcv_skb+0x159/0x420 [ 517.250934][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 517.257037][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 517.262948][ T31] ? netlink_deliver_tap+0x1ae/0xcc0 [ 517.268765][ T31] genl_rcv+0x28/0x40 [ 517.273165][ T31] netlink_unicast+0x585/0x850 [ 517.278681][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 517.284293][ T31] netlink_sendmsg+0x8b0/0xda0 [ 517.289520][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 517.296938][ T31] ? __import_iovec+0x1d2/0x640 [ 517.301958][ T31] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 517.308612][ T31] ____sys_sendmsg+0xa4d/0xbe0 [ 517.313501][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 517.319494][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 517.325040][ T31] ? trace_irq_enable.constprop.0+0x122/0x160 [ 517.332669][ T31] ___sys_sendmsg+0x190/0x1e0 [ 517.338222][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 517.343603][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.348832][ T31] __sys_sendmsg+0x160/0x210 [ 517.353822][ T31] ? __pfx___sys_sendmsg+0x10/0x10 [ 517.360896][ T31] ? kcov_ioctl+0x17a/0x750 [ 517.366398][ T31] ? rcu_is_watching+0x12/0xc0 [ 517.371394][ T31] do_syscall_64+0x115/0x840 [ 517.376573][ T31] ? clear_bhb_loop+0x40/0x90 [ 517.381456][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.389344][ T31] RIP: 0033:0x7f107a59ce59 [ 517.394400][ T31] RSP: 002b:00007f10787cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 517.404941][ T31] RAX: ffffffffffffffda RBX: 00007f107a816090 RCX: 00007f107a59ce59 [ 517.414118][ T31] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 0000000000000004 [ 517.422538][ T31] RBP: 00007f107a632e6f R08: 0000000000000000 R09: 0000000000000000 [ 517.430801][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.439367][ T31] R13: 00007f107a816128 R14: 00007f107a816090 R15: 00007fff7a55de88 [ 517.448252][ T31] [ 517.461699][ T31] INFO: lockdep is turned off. [ 517.474200][ T31] NMI backtrace for cpu 0 [ 517.474223][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 517.474251][ T31] Tainted: [L]=SOFTLOCKUP [ 517.474258][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 517.474270][ T31] Call Trace: [ 517.474278][ T31] [ 517.474286][ T31] dump_stack_lvl+0x100/0x190 [ 517.474310][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 517.474332][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 517.474352][ T31] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 517.474381][ T31] sys_info+0x141/0x190 [ 517.474408][ T31] watchdog+0xcb1/0x1030 [ 517.474434][ T31] ? trace_irq_enable.constprop.0+0x122/0x160 [ 517.474463][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.474487][ T31] ? __kthread_parkme+0x18c/0x230 [ 517.474505][ T31] ? kthread+0x13a/0x450 [ 517.474526][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.474556][ T31] kthread+0x370/0x450 [ 517.474576][ T31] ? __pfx_kthread+0x10/0x10 [ 517.474599][ T31] ret_from_fork+0x72b/0xd50 [ 517.474619][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 517.474639][ T31] ? __switch_to+0x800/0x10f0 [ 517.474665][ T31] ? __switch_to_asm+0x39/0x70 [ 517.474689][ T31] ? __pfx_kthread+0x10/0x10 [ 517.474713][ T31] ret_from_fork_asm+0x1a/0x30 [ 517.474742][ T31] [ 517.702737][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 517.710245][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 517.722031][ T31] Tainted: [L]=SOFTLOCKUP [ 517.726545][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 517.736778][ T31] Call Trace: [ 517.740071][ T31] [ 517.743197][ T31] dump_stack_lvl+0x100/0x190 [ 517.748019][ T31] vpanic+0x552/0x970 [ 517.752269][ T31] ? __pfx_vpanic+0x10/0x10 [ 517.757150][ T31] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 517.763595][ T31] panic+0xd1/0xe0 [ 517.767362][ T31] ? __pfx_panic+0x10/0x10 [ 517.771920][ T31] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 517.778120][ T31] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 517.784572][ T31] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 517.790775][ T31] ? watchdog.cold+0x1ec/0x234 [ 517.795686][ T31] ? watchdog+0xcc1/0x1030 [ 517.800380][ T31] watchdog.cold+0x1fd/0x234 [ 517.805338][ T31] ? trace_irq_enable.constprop.0+0x122/0x160 [ 517.811700][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.816409][ T31] ? __kthread_parkme+0x18c/0x230 [ 517.821553][ T31] ? kthread+0x13a/0x450 [ 517.826363][ T31] ? __pfx_watchdog+0x10/0x10 [ 517.831158][ T31] kthread+0x370/0x450 [ 517.835245][ T31] ? __pfx_kthread+0x10/0x10 [ 517.840132][ T31] ret_from_fork+0x72b/0xd50 [ 517.845112][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 517.850360][ T31] ? __switch_to+0x800/0x10f0 [ 517.855077][ T31] ? __switch_to_asm+0x39/0x70 [ 517.860334][ T31] ? __pfx_kthread+0x10/0x10 [ 517.865000][ T31] ret_from_fork_asm+0x1a/0x30 [ 517.870202][ T31] [ 517.873410][ T31] Kernel Offset: disabled [ 517.877825][ T31] Rebooting in 86400 seconds..