last executing test programs: 9.603211962s ago: executing program 3 (id=554): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x5, 0x84) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda\x00', 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r1, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, 0x0, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r3, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r4 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r4, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r4}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r2}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000140), r0) socket$nl_generic(0x10, 0x3, 0x10) 8.31707858s ago: executing program 3 (id=557): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0xffffffffffffffff, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000001140)=""/4093, 0xffd) io_uring_setup$auto(0x1, 0x0) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0) ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0) openat$auto_rfkill_fops_core(0xffffffffffffff9c, 0x0, 0x200080, 0x0) read$auto(0xffffffffffffffff, 0x0, 0x4) close_range$auto(0x2, 0x8, 0x0) mremap$auto(0x9, 0x3ff, 0x5d, 0x80000000, 0x100) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS2\x00', 0x101e81, 0x0) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) close_range$auto(0x0, 0xffffeffe, 0x2) socket(0x2, 0x801, 0x106) pipe$auto(0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) futex_wait$auto(0x0, 0xb7, 0x9, 0x7fff, 0x0, 0xb60) setregid$auto(0x81, 0x5) setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd) setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd) 8.207268304s ago: executing program 0 (id=558): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram5\x00', 0x1eba02, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/bus/usb/drivers/ax88179_178a/remove_id\x00', 0x488081, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x82001, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba42933ae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d86de1e90f869f6a04ac10043676f3b2c7f1339b2d7468133fb8447d17846b6b78079ecc31d7d0f74caa4a3db1ac4d312bfdb34bd331f1f771a2396108561a52153d63a7b2a3a077a7e4c1a22bcb23e1f3e511fee310baa67904d2aad4d6671e8b77c7720e37e84e0efecb60a35f188cbe8b8b2fb3967b78aa482aabb103f23083baa9b2ae653731d5993db4054233dea4af25795e12eb4d6b046bdeea6adce8626e0def15dd32b0ec16a85d93e1dea980794033f4b46973062c64c0209f9d3efc6ea7704c8e8dfea8cdfbe2cb1e367bf634a1952190e0660994f79f0c622d47ee8f93ce1c2852db907ae68a29bcc960b26e0e634173287fd012c4bb3063c41d35c92e896b44080bc5a98e90907cd1d01cc0708019cc1c93c71f29bfe841c873ad2aa0565dfaeb86c8b8e58ea2075de2a562ba1b5dc4ca452df21f25453b7c7f9a3e31547f4e803cefbac3b94715f2ab1f9fc66570244472f2f29deb9bdf6dc5b18d54e3c2264f9598f2ea749d170a66d351acf003c3f37fe74a09a8a964ce28", 0x238) ioctl$auto_SNDCTL_SEQ_SYNC(r0, 0x5101, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) unshare$auto(0x40000080) r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/arp_tables_targets\x00', 0x0, 0x0) pread64$auto(r1, &(0x7f0000000100)='/proc/self/net/arp_tables_targets\x00', 0x8, 0x9) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) timer_create$auto(0x0, 0x0, 0x0) timer_gettime$auto(0x0, 0x0) write$auto(0x3, 0x0, 0xfdef) bpf$auto_BPF_PROG_QUERY(0x10, &(0x7f00000001c0)=@query={@target_fd=r1, 0x89e3, 0x0, 0x3, 0xe, @prog_cnt=0x8, 0x0, 0x3, 0x401, 0x1, 0x5cd}, 0x7) r2 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x4e0041, 0x0) ioctl$auto_UI_SET_PROPBIT(r2, 0x4004556e, &(0x7f00000000c0)=0x9) socket(0xa, 0x801, 0x84) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0x2, 0x5, 0x0) pipe$auto(0x0) setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9) mincore$auto(0x0, 0x1, 0x0) 7.933892396s ago: executing program 2 (id=560): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x18c, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x101}, @NL80211_ATTR_AUTH_DATA={0xff, 0x9c, "4a9d41110d37aa5b200098e9b14286e7751bd11fbf6651f03040b05ca3b4c87ece49f32b27eab127cd2e4b3a59ef3a181c26d1703b53e6e90dababdfe762aae1319749701954a1541b79224f4614d8d505b2dc352b8f17091d9b0ff5e8b0e5ed5193fd298569479f2bb022b96cec6f9b012cf72054c4d3d46c74a732ceb1a6ed5fd95e68023fa8ada8ed1c098f446f88b6c944f7cc40b96c61666de68f4239af8a7f36868f52c557d0b11fdc4681fc57247e7db31866fdfe374815621638d48f22ed3fd4cb8354dd4be3c09b69c1a779b7935f484a6097b45c737c22516dc5b0b045e304bb20053a404ec71f907693ddbdeaf2e6bd9dfa0848efb8"}, @NL80211_ATTR_COLOR_CHANGE_COUNT={0x5, 0x12f, 0x7}, @NL80211_ATTR_BEACON_TAIL={0x37, 0xf, "44dc8ac31cd6fee77115d7b99c9ac67f8fb5fe54bb485727c3be92f234189294b465eea033152850442276da9ac166e73ab470"}, @NL80211_ATTR_BSS_BASIC_RATES={0x1c, 0x24, "f134268964f008c9d78f5f09813d45317a7fdd9610ebd307"}, @NL80211_ATTR_TIMEOUT_REASON={0x8, 0xf8, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x20000001) socket(0x2, 0x80002, 0x73) shutdown$auto(0x200000003, 0x0) select$auto(0x4, 0x0, &(0x7f0000000080)={[0x209c, 0xe9e, 0x4, 0x5, 0x1000, 0x100000001, 0xc, 0xf, 0x0, 0x40, 0xe, 0xd59, 0x101, 0xff, 0x2, 0x80080001]}, 0x0, 0x0) mmap$auto(0x0, 0x8020009, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = open(&(0x7f00000000c0)='./cgroup\x00', 0xe6a9030037b8afae, 0x69) fchdir$auto(r2) r3 = open(&(0x7f0000000100)='.\x00', 0x10000, 0x4c5) getdents64$auto(r3, 0x0, 0x18) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r5 = timerfd_create$auto(0x8, 0x800) ioctl$auto_MON_IOCX_GET(r5, 0x40189206, 0x0) read$auto_proc_pid_attr_operations_base(r5, &(0x7f0000000240)=""/126, 0x7e) r6 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/kernel/watchdog_cpumask\x00', 0x141241, 0x0) write$auto(r6, 0x0, 0x0) fsopen$auto(&(0x7f0000000440)='[{%\xbc::(\x00', 0x1) request_key$auto_KEY_SPEC_PROCESS_KEYRING(&(0x7f00000006c0)='[{%\xbc::(\x00', 0xfffffffffffffffd, 0x0, 0xfffffffffffffffe) r7 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) io_cancel$auto(0x1, &(0x7f0000000140)={0x9, 0x0, 0xe, 0x7, 0x1e, r4, 0x7fffffffffffffff, 0x7, 0xb5, 0x0, 0x8000}, &(0x7f0000000180)={0x7e, 0x180000000, 0x5, 0x80}) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, r7, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x14) semctl$auto_GETALL(0x6, 0x4, 0xd, 0x301) utimes$auto(&(0x7f0000000100)='./file0\x00', 0x0) r8 = prctl$auto_PR_SYS_DISPATCH_ON(0x81, 0x1, 0x0, 0x9, 0xffffffffffffff6d) ioctl$auto_TIOCGETD(r8, 0x5424, &(0x7f0000000000)="ad669ab991a3c75e0d02dbafe732848df80fa9512b3c52ea633abd8b03e2d7704740b6b87192c1a5bbe8bb5a3de0807194278835b634ffe5513cd3944b2a89de0caf29cffeedbbd959ef75f5992e000df470825f31048c7e1237900772cfed930ff64752b1e9f6f1065c739ed9c0974900b99e6defda16b6") 5.882925403s ago: executing program 0 (id=561): mmap$auto(0x0, 0x2020009, 0xffffffff, 0xeb1, 0xffffffffffffffff, 0x8000) r0 = socket(0xa, 0x2, 0x3a) setsockopt$auto(r0, 0x29, 0x1d, 0x0, 0x1ff) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_ftrace_set_event_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/set_event_pid\x00', 0xa0201, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r1, 0x0, 0x9) openat$auto_snd_mixer_oss_f_ops_mixer_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer2\x00', 0x20100, 0x0) openat$auto_tracing_iter_fops_trace(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/tracing/trace_options\x00', 0x2, 0x0) r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/net/ipv6_route\x00', 0x101000, 0x0) pread64$auto(r2, 0x0, 0xc, 0xffff) r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/net/tcp\x00', 0x40, 0x0) pread64$auto(r3, 0x0, 0x10001, 0x830) setresuid$auto(0xee01, 0x0, 0x0) write$auto(0x3, 0x0, 0xfdef) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ram9\x00', 0xe6e43, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ovs_vport(0x0, 0xffffffffffffffff) getpgid$auto(0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_nodes_fops_netdebug(0xffffffffffffff9c, &(0x7f0000000140), 0xa0100, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snd/controlC1\x00', 0x42000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) socket(0x2, 0x3, 0x100) socket(0x11, 0xa, 0x9) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) 5.88215536s ago: executing program 1 (id=562): close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x5, 0x84) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r0, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f0026bd7000fcdbdf9907"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r1 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r2, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r3 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r3, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r1, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r3}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r1}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) socket$nl_generic(0x10, 0x3, 0x10) 5.881401781s ago: executing program 2 (id=570): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x18c, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x101}, @NL80211_ATTR_AUTH_DATA={0xff, 0x9c, "4a9d41110d37aa5b200098e9b14286e7751bd11fbf6651f03040b05ca3b4c87ece49f32b27eab127cd2e4b3a59ef3a181c26d1703b53e6e90dababdfe762aae1319749701954a1541b79224f4614d8d505b2dc352b8f17091d9b0ff5e8b0e5ed5193fd298569479f2bb022b96cec6f9b012cf72054c4d3d46c74a732ceb1a6ed5fd95e68023fa8ada8ed1c098f446f88b6c944f7cc40b96c61666de68f4239af8a7f36868f52c557d0b11fdc4681fc57247e7db31866fdfe374815621638d48f22ed3fd4cb8354dd4be3c09b69c1a779b7935f484a6097b45c737c22516dc5b0b045e304bb20053a404ec71f907693ddbdeaf2e6bd9dfa0848efb8"}, @NL80211_ATTR_COLOR_CHANGE_COUNT={0x5, 0x12f, 0x7}, @NL80211_ATTR_BEACON_TAIL={0x37, 0xf, "44dc8ac31cd6fee77115d7b99c9ac67f8fb5fe54bb485727c3be92f234189294b465eea033152850442276da9ac166e73ab470"}, @NL80211_ATTR_BSS_BASIC_RATES={0x1c, 0x24, "f134268964f008c9d78f5f09813d45317a7fdd9610ebd307"}, @NL80211_ATTR_TIMEOUT_REASON={0x8, 0xf8, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x20000001) socket(0x2, 0x80002, 0x73) shutdown$auto(0x200000003, 0x0) select$auto(0x4, 0x0, &(0x7f0000000080)={[0x209c, 0xe9e, 0x4, 0x5, 0x1000, 0x100000001, 0xc, 0xf, 0x0, 0x40, 0xe, 0xd59, 0x101, 0xff, 0x2, 0x80080001]}, 0x0, 0x0) mmap$auto(0x0, 0x8020009, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = open(&(0x7f00000000c0)='./cgroup\x00', 0xe6a9030037b8afae, 0x69) fchdir$auto(r2) r3 = open(&(0x7f0000000100)='.\x00', 0x10000, 0x4c5) getdents64$auto(r3, 0x0, 0x18) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r5 = timerfd_create$auto(0x8, 0x800) ioctl$auto_MON_IOCX_GET(r5, 0x40189206, 0x0) read$auto_proc_pid_attr_operations_base(r5, &(0x7f0000000240)=""/126, 0x7e) r6 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/kernel/watchdog_cpumask\x00', 0x141241, 0x0) write$auto(r6, 0x0, 0x0) fsopen$auto(&(0x7f0000000440)='[{%\xbc::(\x00', 0x1) request_key$auto_KEY_SPEC_PROCESS_KEYRING(&(0x7f00000006c0)='[{%\xbc::(\x00', 0xfffffffffffffffd, 0x0, 0xfffffffffffffffe) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) io_cancel$auto(0x1, &(0x7f0000000140)={0x9, 0x0, 0xe, 0x7, 0x1e, r4, 0x7fffffffffffffff, 0x7, 0xb5, 0x0, 0x8000}, &(0x7f0000000180)={0x7e, 0x180000000, 0x5, 0x80}) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x14) semctl$auto_GETALL(0x6, 0x4, 0xd, 0x301) utimes$auto(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x6, 0x8}) r7 = prctl$auto_PR_SYS_DISPATCH_ON(0x81, 0x1, 0x0, 0x9, 0xffffffffffffff6d) ioctl$auto_TIOCGETD(r7, 0x5424, &(0x7f0000000000)="ad669ab991a3c75e0d02dbafe732848df80fa9512b3c52ea633abd8b03e2d7704740b6b87192c1a5bbe8bb5a3de0807194278835b634ffe5513cd3944b2a89de0caf29cffeedbbd959ef75f5992e000df470825f31048c7e1237900772cfed930ff64752b1e9f6f1065c739ed9c0974900b99e6defda16b6") 5.880612978s ago: executing program 3 (id=572): r0 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/015/001\x00', 0xa901, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000000040), r1) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000008080)={0x40, r2, 0x1b, 0x70bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_PROBE={0x4}, @OVS_PACKET_ATTR_ACTIONS={0x10, 0x3, 0x0, 0x1, [@nested={0xc, 0x17, 0x0, 0x1, [@nested={0x4, 0x7f}, @generic="1047b707"]}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f1779048590828847"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800) ioctl$auto(r0, 0x5522, 0xf15) ioctl$auto(r0, 0x5523, r0) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) mknod$auto(&(0x7f0000000040)='./file0\x00', 0x1001, 0x4) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x161342, 0x13d) write$auto(r3, 0x0, 0x0) waitid$auto_P_PGID(0x2, 0x0, 0x0, 0x6, 0x0) ioctl$auto_OSS_GETVERSION(r3, 0x80044d76, &(0x7f00000000c0)="63afed8d275f53200651c466fd582f4a083ad2cee9350f815893b842980a3668692580") r4 = openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$auto_RTC_WKALM_RD(r4, 0x80287010, &(0x7f0000000100)={0x0, 0xc7, {0xfffffffb, 0x7, 0x5, 0x0, 0x0, 0x1, 0x101, 0x7, 0x2}}) clone$auto(0x21, 0x9, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x6) acct$auto(0x0) mmap$auto(0x0, 0x2020009, 0x8000003, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = io_uring_setup$auto(0x6, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) epoll_ctl$auto(r6, 0x2, r5, 0x0) r7 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) r8 = socket(0xa, 0x1, 0x84) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) io_uring_setup$auto(0x401, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$auto(r8, 0x84, 0x72, 0x0, 0x0) sendfile$auto(r7, r7, 0x0, 0x3) bpf$auto_BPF_LINK_GET_NEXT_ID(0x1f, 0x0, 0xc12) 4.838482387s ago: executing program 1 (id=563): r0 = openat$auto_nvram_misc_fops_nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) write$auto_nvram_misc_fops_nvram(r0, 0x0, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/devices/virtual/block/ram8/events_poll_msecs\x00', 0x80302, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) mmap$auto(0x0, 0x9, 0xdf, 0xeb1, 0x401, 0x8000) r1 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) unshare$auto(0x40000080) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) read$auto(0xffffffffffffffff, 0x0, 0x9) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) socket(0x10, 0x2, 0x0) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022abd7000fbdbdf2502000000080003000000000008000100050001"], 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0xc0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="10002cbd7000fddbdf251c"], 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x10004010) r3 = syz_genetlink_get_family_id$auto_batadv(&(0x7f0000000140), r1) sendmsg$auto_BATADV_CMD_TP_METER(r1, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x40, r3, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_MESH_ADDRESS={0xa, 0x5, @multicast}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xe}, @BATADV_ATTR_BLA_CRC={0x6, 0x22, 0xff9d}, @BATADV_ATTR_ALGO_NAME={0x5, 0x2, ')'}]}, 0x40}, 0x1, 0x0, 0x0, 0x40048c4}, 0x4000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}}, 0x8800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) write$auto(0x3, 0x0, 0xfdef) r4 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bus/usb/034/001\x00', 0x20882, 0x0) ioctl$auto_USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000000240)={0x23, 0x3, 0x17, 0x205, 0x7ff, 0x400, &(0x7f00000001c0)}) write$auto(r2, &(0x7f00000002c0)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef`\xd8\x9c\xf7?:\x1a\xc62\x911e\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\b};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xff\x7f\xd0UV\x11\xcb\xdd\x81\xbe\xde\f/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7\x00\x85Z\x06?\x12\x98\x0f)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1;\xe4pd$\xd7\x1b\v\x82\r\f\xd0Hq\xd9\r\x88#\x89\x8d\xcd\x1e\x87N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8HR+\a\xb7R\t\n+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb\xc8^\xa4\xe2\x05\x91|\x123\xc3:\xfd\xee\x04a\xc8\x12\xce\xa2\x12\xcb\x8c\x87f\xebGQ\xe9\x96\xd5E\x13a\xb7\x057<&\xe0\x94\xa7\xfb\x9d;\xfa\xb1\x1b4a,\'\xb2Ym\xe1:\xbf\x8cs\x06\xa3u\x8d!\n\x80-\x9a\xbb;\xf4\xf3\xe1\x97\xfc8\xff\xa7\\\x8b\xf9\x95\x10$\xef\x1a #b\xfb\xfe\xe9\x06fK0\xdd\x84T,\xfa\xb5\x00\x83d\xbba\xd7\n\x92l\xdfAN\x9d\xcb\x96\xc7\xe8\xe6\x8bC\xeb\xc7EZ\xc8\x1a\x81nf\tZ-sZ\x13n\xec\xa9\xbf\xd0$\xb9\xd8\x00\x00\x00\x00\x00\x00\x00', 0xb) mmap$auto(0x0, 0x40009, 0xe1, 0x9b72, 0x7, 0x28000) r5 = open(&(0x7f0000000100)='.\x00', 0x0, 0x57e) fcntl$auto_F_ADD_SEALS(r5, 0x410, 0x0) mknod$auto(&(0x7f0000000580)='u[,&*}\x00\a\x00\x00\x00?\xa4\x1fN\xa1~5Z\xc7\r\f}M4\xa8m\xe6\x19[11\xab\xff-E\xac9(\xb4O\xa0t4h\x9f-gn\x1f\x01\x00\x00\x00\x00\x00\x00\x00\xaeR\x81\r_\x0e\x19\b\x85\bvv(e\xdax)\t\x15\xf6\xc8\xee\x04\x16\xc1\x9a!\x87I7\x8cD&zg\xb0a\xab|E\xde\x14\xee[\xc8\xc0\xa8Nh\x0f\xa3\xdbT\xb3\xb8\xd2F\xa0\xc4]\xaf\xc43&\xe4\x01\x05\xd2\x15\xf8\xf1!\x9d\x92\xbbH\xd3^aD\x87\xd8\xe7\xd2\xf3[r\xc5S&}D[\x97\xf1\xd9\xf8Y\x1c\x03\x84\xb4\xd7\x16\x19\xe5\x17\x10\xd8fcG:\xfbY8\x17w\x98?\x03@\xe5\x02\x05\x93h\xb9\xf7\xef\x84\x8aGlN\a\x1e\x00\x00\x00\x00\x00\x00\x00\xf1p\xeb\xe9(%\x89\xef\x85\xdfr\xce\x00\x00\x00\x00\xff\x00\xa2M\'d\x12\x1c\x12\xca\xa5_\x8d\xdf\xc5\x8d\x19?\xfc~\xb3X\x14\xa7\xa9M\x87\xfcTW\x1bR\xbci\x8d\x8aNEO\xb3~~\xa8\xa6\x894\x80;s\xb7\xa3V\x1b\x14|\x9e\xd4\x05\x85\x0f!\xab-E\'\x97Y\xb7\xe8fMv_\xf8\xa0S\xef\xb7\b\xe7!T.g\x92\x87\t$\x06\xa4\xfb\x83\x8c\x17^\x82\xe7\xd3\xf6q\x1a\xa0\xf82[W\x90\xdd\xe3\xde\xa9\xde\x94`-\x9a\x1e}\xebO*\xb85,v.\xfc5\xba?vlt\xda%\x06a\x15I\x1f\xe3\x05+\x810T2\xf9\x9b\xc7\xd1\t\x03\xf2\x8d\x8a\x90\xb54\bH<9\xf1\x91 D\x85g,\xaa\xca\xcd\xd5\xcb\x9a\xb1j\xf2F\xce\x14\x92\xf9\xd7\xec\xc5\x1e\x8aq2\xce\x881f\xd7\xd4\x9e\xf6\xb6P\x01\xe8T\xb5X\xb9d-I\xd6\x91\xc3\xe2\x88S\x82l=\x02t$p\t\x8cY\x06\r\x83\xb0\x86\xc6\x84\x1c\xce\xb6\xf0\xdfC\x9fj<\xfe\xa4\x1f\x82L\xe4\x13+H\x00\x00\x00\x00\x00\x00\x00\x01M\x16\xa0\xbeB6\xfb\xa2-\x17\x93Q\x9fKusl5\xa2$M\xb4\x18\x1db\xf3\xce\x8c\xe5Rna\xd5\xbbQ\xc7\xa7+\vH\xc1l\x1bIv\xe8_', 0x1081, 0x9) close_range$auto(0x2, 0x8, 0x0) 4.838121431s ago: executing program 2 (id=564): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x5, 0x84) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r1, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f0026bd7000fcdbdf9907"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r3, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r4 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r4, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r4}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r2}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000140), r0) socket$nl_generic(0x10, 0x3, 0x10) 4.83302494s ago: executing program 0 (id=574): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x18c, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x101}, @NL80211_ATTR_AUTH_DATA={0xff, 0x9c, "4a9d41110d37aa5b200098e9b14286e7751bd11fbf6651f03040b05ca3b4c87ece49f32b27eab127cd2e4b3a59ef3a181c26d1703b53e6e90dababdfe762aae1319749701954a1541b79224f4614d8d505b2dc352b8f17091d9b0ff5e8b0e5ed5193fd298569479f2bb022b96cec6f9b012cf72054c4d3d46c74a732ceb1a6ed5fd95e68023fa8ada8ed1c098f446f88b6c944f7cc40b96c61666de68f4239af8a7f36868f52c557d0b11fdc4681fc57247e7db31866fdfe374815621638d48f22ed3fd4cb8354dd4be3c09b69c1a779b7935f484a6097b45c737c22516dc5b0b045e304bb20053a404ec71f907693ddbdeaf2e6bd9dfa0848efb8"}, @NL80211_ATTR_COLOR_CHANGE_COUNT={0x5, 0x12f, 0x7}, @NL80211_ATTR_BEACON_TAIL={0x37, 0xf, "44dc8ac31cd6fee77115d7b99c9ac67f8fb5fe54bb485727c3be92f234189294b465eea033152850442276da9ac166e73ab470"}, @NL80211_ATTR_BSS_BASIC_RATES={0x1c, 0x24, "f134268964f008c9d78f5f09813d45317a7fdd9610ebd307"}, @NL80211_ATTR_TIMEOUT_REASON={0x8, 0xf8, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x20000001) socket(0x2, 0x80002, 0x73) shutdown$auto(0x200000003, 0x0) select$auto(0x4, 0x0, &(0x7f0000000080)={[0x209c, 0xe9e, 0x4, 0x5, 0x1000, 0x100000001, 0xc, 0xf, 0x0, 0x40, 0xe, 0xd59, 0x101, 0xff, 0x2, 0x80080001]}, 0x0, 0x0) mmap$auto(0x0, 0x8020009, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = open(&(0x7f00000000c0)='./cgroup\x00', 0xe6a9030037b8afae, 0x69) fchdir$auto(r2) r3 = open(&(0x7f0000000100)='.\x00', 0x10000, 0x4c5) getdents64$auto(r3, 0x0, 0x18) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r5 = timerfd_create$auto(0x8, 0x800) ioctl$auto_MON_IOCX_GET(r5, 0x40189206, 0x0) read$auto_proc_pid_attr_operations_base(r5, &(0x7f0000000240)=""/126, 0x7e) r6 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/kernel/watchdog_cpumask\x00', 0x141241, 0x0) write$auto(r6, 0x0, 0x0) fsopen$auto(&(0x7f0000000440)='[{%\xbc::(\x00', 0x1) request_key$auto_KEY_SPEC_PROCESS_KEYRING(&(0x7f00000006c0)='[{%\xbc::(\x00', 0xfffffffffffffffd, 0x0, 0xfffffffffffffffe) r7 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) io_cancel$auto(0x1, &(0x7f0000000140)={0x9, 0x0, 0xe, 0x7, 0x1e, r4, 0x7fffffffffffffff, 0x7, 0xb5, 0x0, 0x8000}, &(0x7f0000000180)={0x7e, 0x180000000, 0x5, 0x80}) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, r7, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x14) semctl$auto_GETALL(0x6, 0x4, 0xd, 0x301) utimes$auto(0x0, &(0x7f0000000140)={0x6, 0x8}) r8 = prctl$auto_PR_SYS_DISPATCH_ON(0x81, 0x1, 0x0, 0x9, 0xffffffffffffff6d) ioctl$auto_TIOCGETD(r8, 0x5424, &(0x7f0000000000)="ad669ab991a3c75e0d02dbafe732848df80fa9512b3c52ea633abd8b03e2d7704740b6b87192c1a5bbe8bb5a3de0807194278835b634ffe5513cd3944b2a89de0caf29cffeedbbd959ef75f5992e000df470825f31048c7e1237900772cfed930ff64752b1e9f6f1065c739ed9c0974900b99e6defda16b6") 4.402523282s ago: executing program 0 (id=565): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth1_to_batadv\x00'}) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x14fa02, 0x0) mmap$auto(0x0, 0x810004, 0x400000000ffb, 0x8000000008011, 0x3, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x1, 0x0) getsockopt$auto(0x4, 0x6, 0x1b, 0xfffffffffffffffc, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x123040, 0x1d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000f40)={'batadv0\x00', 0x0}) io_uring_register$auto(0xffffffffffffffff, 0x8, 0x0, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0xfffffffffffffffc) write$auto(0xffffffffffffffff, 0x0, 0x2) syz_clone(0x80000980, 0x0, 0x0, 0x0, 0x0, 0x0) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) r4 = open(0x0, 0x0, 0x408) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r0, &(0x7f0000000080)={0x0, 0xe2}, 0x6, 0x5, 0x100000004, 0x2e) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$auto_tcp_metrics(0x0, r5) sendmsg$auto_TCP_METRICS_CMD_DEL(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x11, &(0x7f0000000c80)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYRESDEC=r4], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x40) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fb1\x00', 0x4000, 0x0) bpf$auto(0x0, &(0x7f0000000180)=@link_create={@prog_fd=r3, @target_ifindex=r2, 0xd, 0x3420, @perf_event={0x1}}, 0x6f4) readv$auto(0x3, &(0x7f0000000000)={0x0, 0x10000ffff}, 0x1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) lsm_get_self_attr$auto(0x68, 0x0, &(0x7f0000002440)=0x8, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0x3, 0x4) 4.292470742s ago: executing program 3 (id=567): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x5, 0x84) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda\x00', 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r1, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, 0x0, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r3, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r4 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r4, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r4}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r2}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000140), r0) socket$nl_generic(0x10, 0x3, 0x10) 3.914348761s ago: executing program 1 (id=568): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$auto_SO_DETACH_FILTER(r0, 0x1, 0x19, &(0x7f00000061c0)='ethtool\x00', 0x5) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/fail-nth\x00', 0x1c1402, 0x0) write$auto(r1, &(0x7f0000000040)='7\x00\\\xfa\b\x1c\xc7k\x00\x00\x00\x00\x00\x00', 0x81) r2 = pipe$auto(&(0x7f0000000080)) write$auto_tomoyo_operations_securityfs_if(r2, &(0x7f0000000140)="6923bef7335959966e44adc19ef829d2d54fac9f6059b45f4b8a9079b94244c2b181c1b91dc64c9616e7d70a18a43fed3e059dde263a0de089d0f475c7a797c942098f9eec171e3edac4f97c1fafef6098656464be467480e611019ef03bb10be88c941b3570902739068ada383cec92c48ed2e20e24e6c72050092ff49c1e38fd377bf61b0edd7c5544a9aefe09dab69e1e6b3ee643549065f64b0e76162445b35e8ac39ec6efdb0e49c73246850ff5908dcc4c0079e9b7f4f3f3d0bf6a3dd4e37249389b3a278fab18bd26cd9b2dc4353b1f1840d2d06c59ee5c1e7c1eb107d6", 0xe1) clock_settime$auto(0x0, &(0x7f00000000c0)={0x656, 0x7}) adjtimex$auto(&(0x7f0000000780)={0xf, 0x0, 0x2b8, 0x100000001, 0x6, 0x5, 0x2, 0x0, 0xe, 0x0, 0x5, {0x2fa}, 0x7fffffffffffffff, 0x4, 0x5, 0x5, 0x0, 0x6, 0x400000000, 0x7, 0x9, 0x5, 0x1}) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) close_range$auto(0x0, 0x5, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/module/dvb_usb_gp8psk/version\x00', 0x0, 0x0) r3 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x2, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) write$auto_console_fops_tty_io(r3, &(0x7f0000000000)="c80d1b5d399b3b", 0xfdef) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/vtconsole/vtcon1/bind\x00', 0x182b02, 0x0) r5 = socket(0x10, 0x2, 0xc) sendmsg$auto_CTRL_CMD_GETPOLICY(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xc8}, 0x1, 0x0, 0x0, 0x24050803}, 0x10004010) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000140), r5) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$auto_NL80211_CMD_GET_WOWLAN(r0, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r6, 0x20, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xb0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000810) sendfile$auto(0x3, r4, 0x0, 0xfdef) adjtimex$auto(&(0x7f00000002c0)={0x8c15, 0x0, 0xfff, 0x7f, 0x1, 0xffffffffffffff16, 0x3, 0x0, 0xb, 0x1, 0x100, {0x10002, 0x4}, 0x8, 0x0, 0x4, 0xffffff62, 0x0, 0x40, 0x1, 0x3, 0xfffffffffffffffe, 0x1000000005, 0x1}) adjtimex$auto(&(0x7f0000000540)={0x72, 0x0, 0xff, 0x800, 0x2, 0xffffffffffffffff, 0xa0c, 0x0, 0x3ffbffffffffff, 0x9536, 0x4007, {0x200, 0x4}, 0x80, 0x80, 0x5, 0x5, 0x0, 0x100000000, 0x21, 0x18d, 0x6, 0xa, 0x2015}) write$auto(0x3, 0x0, 0x100082) write$auto(0xffffffffffffffff, &(0x7f0000000100)='/sys/devices/virtual/bluetooth/hci1/rfkill6\x00', 0x9) 3.771771898s ago: executing program 2 (id=569): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) unshare$auto(0x8000000) semget$auto(0x0, 0x2e4a, 0x8000) r0 = socket(0xa, 0x1, 0x84) mmap$auto(0x0, 0x25c, 0x8000000000df, 0x9b72, 0xffffffffffffffff, 0x808000) io_uring_setup$auto(0x401, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$auto(r0, 0x84, 0x81, 0x0, 0x0) semtimedop$auto(0x0, &(0x7f0000000000)={0x7, 0x9, 0x36ec}, 0x1f4, 0x0) mkdir$auto(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x8cd) bpf$auto_BPF_OBJ_GET_INFO_BY_FD(0xf, &(0x7f00000002c0)=@test={0xffffffffffffffff, 0x0, 0x856, 0x189, 0x8, 0x7fff, 0x7fff, 0x10000, 0xc91a, 0x7, 0x5, 0x3, 0x3, 0x3, 0x6}, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) inotify_init1$auto(0x3000000000000) socket$nl_generic(0x11, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/smaps_rollup\x00', 0x840, 0x0) r1 = openat$auto_ftrace_formats_fops_trace_printk(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/printk_formats\x00', 0x100000, 0x0) pread64$auto(r1, &(0x7f0000000040)='],{(@&&\x00', 0xa1fb, 0x1) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @local}, 0x54) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x805, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004044}, 0x8000) 2.283030715s ago: executing program 0 (id=571): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0xffffffffffffffff, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000001140)=""/4093, 0xffd) io_uring_setup$auto(0x1, 0x0) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0) ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0) openat$auto_rfkill_fops_core(0xffffffffffffff9c, 0x0, 0x200080, 0x0) read$auto(0xffffffffffffffff, 0x0, 0x4) close_range$auto(0x2, 0x8, 0x0) mremap$auto(0x9, 0x3ff, 0x5d, 0x80000000, 0x100) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyS2\x00', 0x101e81, 0x0) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) close_range$auto(0x0, 0xffffeffe, 0x2) socket(0x2, 0x801, 0x106) pipe$auto(0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) futex_wait$auto(0x0, 0xb7, 0x9, 0x7fff, 0x0, 0xb60) setregid$auto(0x81, 0x5) setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd) setsockopt$auto(0x3, 0x10000000084, 0x7b, 0x0, 0xd) 2.281840902s ago: executing program 3 (id=581): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x5, 0x84) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r1, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f0026bd7000fcdbdf9907"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r3, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r4 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r4, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r4}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r2}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000140), r0) socket$nl_generic(0x10, 0x3, 0x10) 1.912938446s ago: executing program 2 (id=573): madvise$auto(0x0, 0x2003f2, 0x15) r0 = socket$nl_generic(0x10, 0x3, 0x10) timer_create$auto_CLOCK_TAI(0xb, 0x0, 0x0) mmap$auto(0x0, 0x4020005, 0xdf, 0xeb1, 0x401, 0x8000) r1 = openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/input/event0\x00', 0x2, 0x0) ioctl$auto_EVIOCGMASK(r1, 0x80104592, &(0x7f0000000000)={0x11, 0x800004, 0x8}) mmap$auto(0x0, 0x2020009, 0x3, 0x800000000000eb1, 0xfffffffffffffffa, 0x8000) r2 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) writev$auto(r2, &(0x7f0000000280)={&(0x7f0000000140)="7cd5f762bf2301e06a", 0x2}, 0x1) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x89fc, &(0x7f00000002c0)={'geneve1\x00'}) r3 = openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000440), 0x20201, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0x5}, 0x7) ioctl$auto_I2C_RDWR(r3, 0x707, &(0x7f0000000180)) madvise$auto(0x0, 0xffffffffffff0001, 0x15) getsockopt$auto_SO_BUSY_POLL(r2, 0x8, 0x2e, 0x0, 0x0) landlock_add_rule$auto(0xffffffffffffffff, 0x1, 0x0, 0x0) write$auto(r1, 0x0, 0x47ffffdf2) ioctl$auto_dvb_demux_fops_dmxdev(r2, 0x6, &(0x7f00000002c0)) r4 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000140)='/proc/fs/cifs/open_files\x00', 0xd00, 0x0) read$auto_proc_iter_file_ops_compat_inode(r4, &(0x7f0000000180)=""/249, 0xf9) unshare$auto(0x1) r5 = openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/card1\x00', 0x0, 0x0) ioctl$auto(r5, 0x921064a3, r5) ioctl$auto_EVIOCGMASK(r1, 0x80104592, 0x0) r6 = openat$auto_vcs_fops_vc_screen(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x101041, 0x0) write$auto(r6, &(0x7f0000000180)='/sys/kernel/se\x06\x00rity\xee\xa1\x00\x00rity/\xefvL/evm_xattss\x00\x00\x00z\x01t\x7f\xedn1\xc9?\x8a{T\xad#*\xe5<\xe40\xb3\x82\x1d\x18\xfa{F\xd4\xd8rUI\xe2B!\xd5U\xfb\x17\x92\xd4\x83aQ\xc5\xfc\x96R\xb4\x943?\x98\xe3\xd4\x12W/`\x1a$\xe8\xeaA\xe0\xd0\xa3J\x02\x00\x00\x005\xe6mD\x94\xfbr\x88\xad\x9f\xe3\xd9\xd1\x10\x0fZ\xbeM\x8b\b\xfe|M\xc3\xec\xa4\xff\xf0\x83\x885\x9ax\xbb\xf1\x95>\x82\x01\xead\xf5\xeb\x1c_\xab=\t\x00\xc6CZ\x901\x84A!\xccjoW\xeae\x92\xb7\x86\xf1\xe7i~KD\xdaG0:\xfe\x98\xe2\x8aS\x80\x00\x00\x02\x00\x00\x00\x00\x00\x00\x86$\xd21\x1d\xfd\x00\x86\x94_[\\\x15\x03\x00\x88\xf4\x15t\xa17#\\', 0x20000002) getsockopt$auto_SO_ZEROCOPY(r0, 0x100, 0x3c, 0x0, &(0x7f0000000100)=0x3) 1.498023237s ago: executing program 1 (id=575): close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x5, 0x84) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r0, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f0026bd7000fcdbdf9907"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r1 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r2, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r3 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r3, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r1, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r3}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r1}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) socket$nl_generic(0x10, 0x3, 0x10) 1.077937788s ago: executing program 3 (id=576): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0xa, 0x5, 0x84) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) preadv2$auto(r1, 0x0, 0x6, 0xfffffffffffffffb, 0x4, 0x800) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) open$dir(0x0, 0x10000, 0x6) close_range$auto(0x2, 0xa, 0x0) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f0026bd7000fcdbdf9907"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1e00df45"], 0x1ac}}, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0xfffffffc, &(0x7f0000000100)={0x0, 0xfbe}, 0x8, 0x0, 0x8, 0x1}, 0x3}, 0xc, 0x4008) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x189880, 0x0) ioctl$auto_tracing_buffers_fops_trace(r3, 0x5220, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) socketpair$auto(0x1, 0x5, 0x3b, 0x0) openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, 0x0, 0x20401, 0x0) connect$auto(0xffffffffffffffff, 0x0, 0x8) mmap$auto(0x0, 0x861, 0x100001000000004, 0xfa31, 0x400, 0x8000) r4 = setfsuid$auto(0xee00) setresuid$auto(0xffffffffffffffff, r4, 0xffffffffffffffff) waitid$auto_P_ALL(0x0, 0x9, &(0x7f00000008c0)={@siginfo_0_0={0x8, 0x1, 0x2, @_sigchld={0x0, 0xffffffffffffffff, 0x5, 0x7fffffffffffffff}}}, 0x1000, &(0x7f0000000940)={{0x0, 0x6}, {0x0, 0x7}, 0x8, 0xd, 0x3ff, 0x1, 0x5, 0x8000000000000000, 0x8, 0x16, 0x2, 0x9, 0x4, 0x6, 0x7fffffff, 0x4}) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8608d100}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000a00)={0x170, 0x0, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_PEER={0x148, 0x28, 0x0, 0x1, [@generic="289f9b91e208441f416a9bc5dc19ae888dd21d0f0bd3f9ea8370762465ce50ace5105bc712985898b57196235e30811a156df6c2207c5bd2fc3ed23c70397ab7c7bc9bdca5e5753f916521d0e21fd121de3f26d19362", @generic="723973e47cc39f9fbaa0", @nested={0xe3, 0x9d, 0x0, 0x1, [@typed={0x8, 0x146, 0x0, 0x0, @fd}, @typed={0x8, 0x88, 0x0, 0x0, @uid}, @typed={0x8, 0x160, 0x0, 0x0, @uid=r4}, @generic="d78bbc9ac135d291f48121175d2538067dc8d99011f28969b645ce78f81a066342a01f2f4bb0e764c28e5712f84cbed8bd77e3a481a1d27dda1a2b9f425ff8fc425a30545a5795b529aaa99a772d28d59c8e0b44eb914d033cae27e79d5300836037b94e3f3f7c3da76d9430a524b07ca5b6913efdecdbf425a6b1f767eb6b696d8b7a7b56b69fc4177ba13a641ebc4d46901223b3a59eefa9ddb592c1b7b987984db860b8cb5f41d85c23bf92232955b3e6a6453c25f718a7be4f838f7f23", @typed={0x8, 0xfe, 0x0, 0x0, @fd=r2}, @generic]}]}, @NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x7}, @NL802154_ATTR_WPAN_PHY_CAPS={0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xfffffd64}]}, 0x170}}, 0xc094) io_setup$auto(0x8000003, 0x0) kexec_load$auto(0x5b50, 0x2, 0x0, 0xe) syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000140), r0) socket$nl_generic(0x10, 0x3, 0x10) 629.159923ms ago: executing program 0 (id=577): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ovs_ct_limit(&(0x7f0000000080), 0xffffffffffffffff) mmap$auto(0x3, 0x80002020009, 0x7, 0xfa, 0xffffffffffffffff, 0x400) syz_genetlink_get_family_id$auto_ovs_meter(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mlock$auto(0x112, 0x80006) mmap$auto(0x0, 0x3, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) getsockopt$auto(0xffffffffffffffff, 0x84, 0x11, 0x0, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/rds/tcp/rds_tcp_sndbuf\x00', 0xa802, 0x0) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x189002, 0x0) r3 = ioctl$auto_SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) r4 = openat$auto_rng_chrdev_ops_core(0xffffffffffffff9c, &(0x7f0000000000), 0x101040, 0x0) read$auto_rng_chrdev_ops_core(r4, &(0x7f0000000040)=""/4096, 0xfffffe82) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_seg6(&(0x7f0000000b40), 0xffffffffffffffff) sendmsg$auto_SEG6_CMD_SETHMAC(r5, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x44}, 0x84) sendmsg$auto_SEG6_CMD_DUMPHMAC(r3, &(0x7f0000001040)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000001100)=ANY=[@ANYBLOB, @ANYRES16, @ANYRESDEC=0x0, @ANYRESDEC=r5], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x4000004) unshare$auto(0x40000080) r6 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) write$auto_console_fops_tty_io(r6, &(0x7f0000000000)="c80d1b5d399b58", 0xfdef) mprotect$auto(0x200000000000, 0x806121, 0x8) landlock_create_ruleset$auto(&(0x7f0000000140)={0x100000daa0, 0x401, 0x9}, 0x7ffd, 0x0) pwrite64$auto(r2, &(0x7f0000001180)='C#\x00', 0x6, 0xe) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x3, 0x2) r7 = syz_genetlink_get_family_id$auto_802_15_4_mac(&(0x7f00000000c0), r0) sendmsg$auto_IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r7, 0x4, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x4}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x7}, @IEEE802154_ATTR_FRAME_RETRIES={0x5, 0x28, 0x7f}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000880}, 0x40081) sendmsg$auto_OVS_CT_LIMIT_CMD_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x20, r1, 0x200, 0x51bd2e, 0x25dfcbfb, {}, [@OVS_CT_LIMIT_ATTR_ZONE_LIMIT={0x4}, @OVS_CT_LIMIT_ATTR_ZONE_LIMIT={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x6}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4) 429.327248ms ago: executing program 1 (id=578): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x18c, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x101}, @NL80211_ATTR_AUTH_DATA={0xff, 0x9c, "4a9d41110d37aa5b200098e9b14286e7751bd11fbf6651f03040b05ca3b4c87ece49f32b27eab127cd2e4b3a59ef3a181c26d1703b53e6e90dababdfe762aae1319749701954a1541b79224f4614d8d505b2dc352b8f17091d9b0ff5e8b0e5ed5193fd298569479f2bb022b96cec6f9b012cf72054c4d3d46c74a732ceb1a6ed5fd95e68023fa8ada8ed1c098f446f88b6c944f7cc40b96c61666de68f4239af8a7f36868f52c557d0b11fdc4681fc57247e7db31866fdfe374815621638d48f22ed3fd4cb8354dd4be3c09b69c1a779b7935f484a6097b45c737c22516dc5b0b045e304bb20053a404ec71f907693ddbdeaf2e6bd9dfa0848efb8"}, @NL80211_ATTR_COLOR_CHANGE_COUNT={0x5, 0x12f, 0x7}, @NL80211_ATTR_BEACON_TAIL={0x37, 0xf, "44dc8ac31cd6fee77115d7b99c9ac67f8fb5fe54bb485727c3be92f234189294b465eea033152850442276da9ac166e73ab470"}, @NL80211_ATTR_BSS_BASIC_RATES={0x1c, 0x24, "f134268964f008c9d78f5f09813d45317a7fdd9610ebd307"}, @NL80211_ATTR_TIMEOUT_REASON={0x8, 0xf8, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x20000001) socket(0x2, 0x80002, 0x73) shutdown$auto(0x200000003, 0x0) select$auto(0x4, 0x0, &(0x7f0000000080)={[0x209c, 0xe9e, 0x4, 0x5, 0x1000, 0x100000001, 0xc, 0xf, 0x0, 0x40, 0xe, 0xd59, 0x101, 0xff, 0x2, 0x80080001]}, 0x0, 0x0) mmap$auto(0x0, 0x8020009, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = open(&(0x7f00000000c0)='./cgroup\x00', 0xe6a9030037b8afae, 0x69) fchdir$auto(r2) r3 = open(&(0x7f0000000100)='.\x00', 0x10000, 0x4c5) getdents64$auto(r3, 0x0, 0x18) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r5 = timerfd_create$auto(0x8, 0x800) ioctl$auto_MON_IOCX_GET(r5, 0x40189206, 0x0) read$auto_proc_pid_attr_operations_base(r5, &(0x7f0000000240)=""/126, 0x7e) r6 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/kernel/watchdog_cpumask\x00', 0x141241, 0x0) write$auto(r6, 0x0, 0x0) fsopen$auto(&(0x7f0000000440)='[{%\xbc::(\x00', 0x1) request_key$auto_KEY_SPEC_PROCESS_KEYRING(&(0x7f00000006c0)='[{%\xbc::(\x00', 0xfffffffffffffffd, 0x0, 0xfffffffffffffffe) r7 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) io_cancel$auto(0x1, &(0x7f0000000140)={0x9, 0x0, 0xe, 0x7, 0x1e, r4, 0x7fffffffffffffff, 0x7, 0xb5, 0x0, 0x8000}, &(0x7f0000000180)={0x7e, 0x180000000, 0x5, 0x80}) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, r7, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x14) semctl$auto_GETALL(0x6, 0x4, 0xd, 0x301) utimes$auto(&(0x7f0000000100)='./file0\x00', 0x0) r8 = prctl$auto_PR_SYS_DISPATCH_ON(0x81, 0x1, 0x0, 0x9, 0xffffffffffffff6d) ioctl$auto_TIOCGETD(r8, 0x5424, &(0x7f0000000000)="ad669ab991a3c75e0d02dbafe732848df80fa9512b3c52ea633abd8b03e2d7704740b6b87192c1a5bbe8bb5a3de0807194278835b634ffe5513cd3944b2a89de0caf29cffeedbbd959ef75f5992e000df470825f31048c7e1237900772cfed930ff64752b1e9f6f1065c739ed9c0974900b99e6defda16b6") 118.95828ms ago: executing program 2 (id=579): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_SET_REG(r0, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x18c, r1, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0x101}, @NL80211_ATTR_AUTH_DATA={0xff, 0x9c, "4a9d41110d37aa5b200098e9b14286e7751bd11fbf6651f03040b05ca3b4c87ece49f32b27eab127cd2e4b3a59ef3a181c26d1703b53e6e90dababdfe762aae1319749701954a1541b79224f4614d8d505b2dc352b8f17091d9b0ff5e8b0e5ed5193fd298569479f2bb022b96cec6f9b012cf72054c4d3d46c74a732ceb1a6ed5fd95e68023fa8ada8ed1c098f446f88b6c944f7cc40b96c61666de68f4239af8a7f36868f52c557d0b11fdc4681fc57247e7db31866fdfe374815621638d48f22ed3fd4cb8354dd4be3c09b69c1a779b7935f484a6097b45c737c22516dc5b0b045e304bb20053a404ec71f907693ddbdeaf2e6bd9dfa0848efb8"}, @NL80211_ATTR_COLOR_CHANGE_COUNT={0x5, 0x12f, 0x7}, @NL80211_ATTR_BEACON_TAIL={0x37, 0xf, "44dc8ac31cd6fee77115d7b99c9ac67f8fb5fe54bb485727c3be92f234189294b465eea033152850442276da9ac166e73ab470"}, @NL80211_ATTR_BSS_BASIC_RATES={0x1c, 0x24, "f134268964f008c9d78f5f09813d45317a7fdd9610ebd307"}, @NL80211_ATTR_TIMEOUT_REASON={0x8, 0xf8, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_MLO_LINK_DISABLED={0x4}]}, 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x20000001) socket(0x2, 0x80002, 0x73) shutdown$auto(0x200000003, 0x0) select$auto(0x4, 0x0, &(0x7f0000000080)={[0x209c, 0xe9e, 0x4, 0x5, 0x1000, 0x100000001, 0xc, 0xf, 0x0, 0x40, 0xe, 0xd59, 0x101, 0xff, 0x2, 0x80080001]}, 0x0, 0x0) mmap$auto(0x0, 0x8020009, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = open(&(0x7f00000000c0)='./cgroup\x00', 0xe6a9030037b8afae, 0x69) fchdir$auto(r2) r3 = open(&(0x7f0000000100)='.\x00', 0x10000, 0x4c5) getdents64$auto(r3, 0x0, 0x18) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r5 = timerfd_create$auto(0x8, 0x800) ioctl$auto_MON_IOCX_GET(r5, 0x40189206, 0x0) read$auto_proc_pid_attr_operations_base(r5, &(0x7f0000000240)=""/126, 0x7e) r6 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/kernel/watchdog_cpumask\x00', 0x141241, 0x0) write$auto(r6, 0x0, 0x0) fsopen$auto(&(0x7f0000000440)='[{%\xbc::(\x00', 0x1) request_key$auto_KEY_SPEC_PROCESS_KEYRING(&(0x7f00000006c0)='[{%\xbc::(\x00', 0xfffffffffffffffd, 0x0, 0xfffffffffffffffe) r7 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) io_cancel$auto(0x1, &(0x7f0000000140)={0x9, 0x0, 0xe, 0x7, 0x1e, r4, 0x7fffffffffffffff, 0x7, 0xb5, 0x0, 0x8000}, &(0x7f0000000180)={0x7e, 0x180000000, 0x5, 0x80}) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, r7, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x14) semctl$auto_GETALL(0x6, 0x4, 0xd, 0x301) utimes$auto(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x6, 0x8}) r8 = prctl$auto_PR_SYS_DISPATCH_ON(0x81, 0x1, 0x0, 0x9, 0xffffffffffffff6d) ioctl$auto_TIOCGETD(r8, 0x5424, &(0x7f0000000000)) 0s ago: executing program 1 (id=580): openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0) socket(0x2000000000000021, 0x2, 0x10000000000002) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x123002, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_ehash_entries\x00', 0x40100, 0x0) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) unshare$auto(0x40000080) madvise$auto(0x0, 0xffffffffffff0005, 0x19) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0xa, 0x800, 0xe) openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f0000000040)='/dev/usbmon0\x00', 0x0, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/bus/usb/018/001\x00', 0x16d080, 0x0) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) mmap$auto(0x0, 0x810006, 0x8, 0x8000000008011, 0x3, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x400000000000000b) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x38, 0xffffffffffffffff, 0x8000) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000040)=""/4096, 0x1000) write$auto(0x1, 0x0, 0x80000000) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x6aa02, 0x0) open(0x0, 0x56042, 0xe1d2b27bdc14aabc) r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv6/conf/all/disable_ipv6\x00', 0x1401, 0x0) pwrite64$auto(r0, 0x0, 0x8001, 0x20000000) ioctl$auto_SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101, 0x0) unshare$auto(0x40000080) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000001140)='/dev/psaux\x00', 0x42000, 0x0) select$auto(0x11, 0x0, 0x0, &(0x7f0000000580)={[0x1ff, 0x8000, 0xb, 0x400001, 0x200948d, 0x3, 0x4, 0xe, 0x7, 0x5, 0x8000001f, 0x8, 0x4d3e, 0x200000002, 0x2, 0xffffffffffffffff]}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.110' (ED25519) to the list of known hosts. [ 91.174252][ T5612] cgroup: Unknown subsys name 'net' [ 91.286636][ T5612] cgroup: Unknown subsys name 'cpuset' [ 91.298658][ T5612] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 93.268583][ T5612] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.554401][ T5637] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 95.564163][ T5636] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 95.577287][ T5637] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.585404][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 95.595028][ T5636] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.606418][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 95.613044][ T5639] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 95.619988][ T5636] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.626575][ T5639] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 95.630211][ T5636] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.642769][ T5639] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 95.653272][ T5639] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 95.663791][ T5639] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 95.675839][ T5639] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 95.685160][ T5639] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 95.705313][ T5639] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 95.719146][ T5639] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 95.735341][ T5639] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 95.753133][ T5639] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 95.762712][ T5639] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.360667][ T30] cfg80211: failed to load regulatory.db [ 97.480851][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.488333][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.495876][ T5625] bridge_slave_0: entered allmulticast mode [ 97.503602][ T5625] bridge_slave_0: entered promiscuous mode [ 97.547998][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.555259][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.562830][ T5625] bridge_slave_1: entered allmulticast mode [ 97.570704][ T5625] bridge_slave_1: entered promiscuous mode [ 97.673282][ T5630] Bluetooth: hci0: command tx timeout [ 97.677329][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.687336][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.695371][ T5627] bridge_slave_0: entered allmulticast mode [ 97.703260][ T5627] bridge_slave_0: entered promiscuous mode [ 97.753256][ T5639] Bluetooth: hci1: command tx timeout [ 97.760078][ T5630] Bluetooth: hci3: command tx timeout [ 97.767757][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.777159][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.784759][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.792119][ T5627] bridge_slave_1: entered allmulticast mode [ 97.799616][ T5627] bridge_slave_1: entered promiscuous mode [ 97.807382][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.815042][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.822931][ T5624] bridge_slave_0: entered allmulticast mode [ 97.830558][ T5624] bridge_slave_0: entered promiscuous mode [ 97.836636][ T5630] Bluetooth: hci2: command tx timeout [ 97.843755][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.851041][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.858463][ T5626] bridge_slave_0: entered allmulticast mode [ 97.867316][ T5626] bridge_slave_0: entered promiscuous mode [ 97.877977][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.926097][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.935207][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.942553][ T5624] bridge_slave_1: entered allmulticast mode [ 97.950017][ T5624] bridge_slave_1: entered promiscuous mode [ 97.959552][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.966940][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.974911][ T5626] bridge_slave_1: entered allmulticast mode [ 97.982787][ T5626] bridge_slave_1: entered promiscuous mode [ 98.003916][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.074889][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.087831][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.100539][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.128158][ T5625] team0: Port device team_slave_0 added [ 98.166075][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.179687][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.190995][ T5625] team0: Port device team_slave_1 added [ 98.249513][ T5627] team0: Port device team_slave_0 added [ 98.257508][ T5624] team0: Port device team_slave_0 added [ 98.289325][ T5627] team0: Port device team_slave_1 added [ 98.297417][ T5624] team0: Port device team_slave_1 added [ 98.307200][ T5626] team0: Port device team_slave_0 added [ 98.314350][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.321869][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.348432][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.388956][ T5626] team0: Port device team_slave_1 added [ 98.395489][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.404037][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.430073][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.486866][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.494421][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.520741][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.533055][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.540108][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.566364][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.592618][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.599645][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.625926][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.637915][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.647277][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.674291][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.698741][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.705824][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.732435][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.745467][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.754223][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.780820][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.854051][ T5625] hsr_slave_0: entered promiscuous mode [ 98.860971][ T5625] hsr_slave_1: entered promiscuous mode [ 98.914375][ T5627] hsr_slave_0: entered promiscuous mode [ 98.921219][ T5627] hsr_slave_1: entered promiscuous mode [ 98.927935][ T5627] debugfs: 'hsr0' already exists in 'hsr' [ 98.933809][ T5627] Cannot create hsr debugfs directory [ 98.969259][ T5626] hsr_slave_0: entered promiscuous mode [ 98.975907][ T5626] hsr_slave_1: entered promiscuous mode [ 98.982474][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 98.988239][ T5626] Cannot create hsr debugfs directory [ 99.036990][ T5624] hsr_slave_0: entered promiscuous mode [ 99.043632][ T5624] hsr_slave_1: entered promiscuous mode [ 99.050109][ T5624] debugfs: 'hsr0' already exists in 'hsr' [ 99.055992][ T5624] Cannot create hsr debugfs directory [ 99.564239][ T5625] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 99.585737][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.596650][ T5625] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 99.608922][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.617718][ T5625] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 99.630647][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.639351][ T5625] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 99.649657][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.743253][ T5627] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 99.751754][ T5630] Bluetooth: hci0: command tx timeout [ 99.759861][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.769848][ T5627] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 99.780244][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.788838][ T5627] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 99.801395][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.811445][ T5627] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 99.822424][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.832334][ T5639] Bluetooth: hci1: command tx timeout [ 99.837824][ T5630] Bluetooth: hci3: command tx timeout [ 99.911713][ T5630] Bluetooth: hci2: command tx timeout [ 99.944904][ T5624] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 99.957896][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.966877][ T5624] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 99.977392][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.985842][ T5624] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 99.999046][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.015041][ T5624] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 100.029327][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.143183][ T5626] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 100.154369][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.163595][ T5626] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 100.175724][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.185695][ T5626] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 100.196203][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.206475][ T5626] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 100.217015][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.335683][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.363116][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.410794][ T5625] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.439092][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.466860][ T1153] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.474679][ T1153] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.508376][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.515593][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.527419][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.534633][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.547980][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.575440][ T1153] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.582720][ T1153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.646174][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.663278][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.689443][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.696725][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.744115][ T1153] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.751358][ T1153] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.800379][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.847059][ T27] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.854312][ T27] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.906844][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.914095][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.035678][ T5624] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 101.836210][ T5630] Bluetooth: hci0: command tx timeout [ 101.856318][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.913407][ T5630] Bluetooth: hci3: command tx timeout [ 101.919995][ T5639] Bluetooth: hci1: command tx timeout [ 101.992280][ T5639] Bluetooth: hci2: command tx timeout [ 102.004636][ T5625] veth0_vlan: entered promiscuous mode [ 102.068030][ T5625] veth1_vlan: entered promiscuous mode [ 102.127752][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.219979][ T5625] veth0_macvtap: entered promiscuous mode [ 102.240702][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.267294][ T5625] veth1_macvtap: entered promiscuous mode [ 102.345275][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.355356][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.382056][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.423217][ T135] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.433273][ T135] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.444654][ T5627] veth0_vlan: entered promiscuous mode [ 102.458073][ T135] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.480435][ T135] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.512757][ T5627] veth1_vlan: entered promiscuous mode [ 102.520145][ T5624] veth0_vlan: entered promiscuous mode [ 102.620138][ T5624] veth1_vlan: entered promiscuous mode [ 102.711390][ T5627] veth0_macvtap: entered promiscuous mode [ 102.718822][ T135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.732267][ T135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.758096][ T5627] veth1_macvtap: entered promiscuous mode [ 102.770973][ T5626] veth0_vlan: entered promiscuous mode [ 102.834625][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.844673][ T135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.851629][ T5626] veth1_vlan: entered promiscuous mode [ 102.858045][ T135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.875291][ T5624] veth0_macvtap: entered promiscuous mode [ 102.892830][ T5624] veth1_macvtap: entered promiscuous mode [ 102.911013][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.949699][ T1153] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.963657][ T1153] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.982793][ T1153] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.992691][ T1153] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.011178][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.020187][ T5625] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 103.064562][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.119034][ T579] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.158418][ T579] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.184694][ T579] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.224792][ T579] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.239569][ T5780] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2'. [ 103.251222][ T5780] netlink: 354 bytes leftover after parsing attributes in process `syz.1.2'. [ 103.262219][ T5780] Zero length message leads to an empty skb [ 103.277838][ T5626] veth0_macvtap: entered promiscuous mode [ 103.372573][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.379408][ T5626] veth1_macvtap: entered promiscuous mode [ 103.419368][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.503695][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.524009][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.558928][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.589238][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.621650][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.624064][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.703841][ T27] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.731817][ T27] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.922050][ T5639] Bluetooth: hci0: command tx timeout [ 103.958741][ T27] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.999602][ T27] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.999713][ T579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.004804][ T5639] Bluetooth: hci1: command tx timeout [ 104.016917][ T5630] Bluetooth: hci3: command tx timeout [ 104.029704][ T579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.081700][ T5630] Bluetooth: hci2: command tx timeout [ 104.385691][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.433322][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.565997][ T579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.587039][ T579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.269560][ T5801] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 105.362948][ T5810] process 'syz.0.1' launched './file0' with NULL argv: empty string added [ 105.898985][ T5815] zswap: compressor û not available [ 106.175924][ T5824] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 108.318049][ T5630] Bluetooth: hci3: Unexpected cc 0x7c89 with no status [ 108.321339][ T5838] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.601626][ T5872] netlink: 338 bytes leftover after parsing attributes in process `syz.1.15'. [ 108.870434][ T5871] netlink: 338 bytes leftover after parsing attributes in process `syz.1.15'. [ 112.414180][ T5930] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 113.465527][ T5943] sysfs_service_op_store: Client not running :-5: [ 114.314688][ T5951] netlink: 164 bytes leftover after parsing attributes in process `syz.2.24'. [ 115.596179][ T5962] ACPI: \_SB_.LNKS: No IRQ available. Try pci=noacpi or acpi=off [ 115.703485][ T5962] pci 0000:00:01.3: PCI INT A: no GSI [ 116.362832][ T5975] netlink: 28 bytes leftover after parsing attributes in process `syz.1.29'. [ 116.435272][ T5975] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.563982][ T5975] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 117.200527][ T5975] ptp ptp0: only physical clock in use now [ 117.339634][ T5974] hub 1-0:1.0: USB hub found [ 117.369855][ T5974] hub 1-0:1.0: 1 port detected [ 118.240445][ T5999] input: f¬ as /devices/virtual/input/input6 [ 119.404888][ T6011] FAULT_INJECTION: forcing a failure. [ 119.404888][ T6011] name failslab, interval 1, probability 0, space 0, times 1 [ 119.421912][ T6011] CPU: 1 UID: 0 PID: 6011 Comm: syz.2.33 Not tainted syzkaller #0 PREEMPT(full) [ 119.421957][ T6011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 119.421986][ T6011] Call Trace: [ 119.421997][ T6011] [ 119.422009][ T6011] dump_stack_lvl+0x100/0x190 [ 119.422057][ T6011] should_fail_ex.cold+0x5/0xa [ 119.422096][ T6011] should_failslab+0xc2/0x120 [ 119.422141][ T6011] kmem_cache_alloc_noprof+0x91/0x6a0 [ 119.422179][ T6011] ? __proc_create+0xc1/0x8f0 [ 119.422243][ T6011] ? __proc_create+0xc1/0x8f0 [ 119.422289][ T6011] ? __proc_create+0x247/0x8f0 [ 119.422339][ T6011] __proc_create+0x247/0x8f0 [ 119.422390][ T6011] ? __pfx___proc_create+0x10/0x10 [ 119.422439][ T6011] ? _raw_write_unlock+0x28/0x50 [ 119.422480][ T6011] ? proc_register+0x56d/0x910 [ 119.422530][ T6011] proc_create_reg+0x75/0x170 [ 119.422558][ T6011] ? __pfx_can_stats_proc_show+0x10/0x10 [ 119.422587][ T6011] proc_create_net_single+0x86/0x180 [ 119.422640][ T6011] ? __pfx_proc_create_net_single+0x10/0x10 [ 119.422688][ T6011] ? round_jiffies+0x10a/0x160 [ 119.422739][ T6011] can_init_proc+0xac/0x4b0 [ 119.422768][ T6011] can_pernet_init+0x1e4/0x370 [ 119.422815][ T6011] ? __pfx_can_pernet_init+0x10/0x10 [ 119.422859][ T6011] ops_init+0x1e2/0x5f0 [ 119.422897][ T6011] setup_net+0x118/0x3a0 [ 119.422931][ T6011] ? __pfx_setup_net+0x10/0x10 [ 119.422964][ T6011] ? mutex_init_lockdep+0xf1/0x120 [ 119.423014][ T6011] copy_net_ns+0x46f/0x7c0 [ 119.423054][ T6011] create_new_namespaces+0x3ea/0xac0 [ 119.423108][ T6011] unshare_nsproxy_namespaces+0xf2/0x220 [ 119.423158][ T6011] ksys_unshare+0x438/0xab0 [ 119.423192][ T6011] ? __pfx_ksys_unshare+0x10/0x10 [ 119.423250][ T6011] __x64_sys_unshare+0x31/0x40 [ 119.423283][ T6011] do_syscall_64+0x115/0x840 [ 119.423329][ T6011] ? clear_bhb_loop+0x40/0x90 [ 119.423363][ T6011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.423391][ T6011] RIP: 0033:0x7f498799de59 [ 119.423433][ T6011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.423461][ T6011] RSP: 002b:00007f4988859028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 119.423490][ T6011] RAX: ffffffffffffffda RBX: 00007f4987c26090 RCX: 00007f498799de59 [ 119.423509][ T6011] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 119.423527][ T6011] RBP: 00007f4987a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 119.423544][ T6011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.423561][ T6011] R13: 00007f4987c26128 R14: 00007f4987c26090 R15: 00007ffe34e1ed58 [ 119.423600][ T6011] [ 121.020111][ T6042] netlink: 338 bytes leftover after parsing attributes in process `syz.1.34'. [ 121.162197][ T6041] netlink: 338 bytes leftover after parsing attributes in process `syz.1.34'. [ 122.980808][ T6083] netlink: 338 bytes leftover after parsing attributes in process `syz.3.41'. [ 123.081714][ T6083] netlink: 338 bytes leftover after parsing attributes in process `syz.3.41'. [ 124.569652][ T6099] mmap: syz.3.43 (6099) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 125.232353][ T6111] netlink: 338 bytes leftover after parsing attributes in process `syz.0.46'. [ 125.279005][ T6111] netlink: 338 bytes leftover after parsing attributes in process `syz.0.46'. [ 125.325913][ T6116] netlink: 28 bytes leftover after parsing attributes in process `syz.2.47'. [ 125.590973][ T579] netdevsim netdevsim9 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.846784][ T6121] netlink: 338 bytes leftover after parsing attributes in process `syz.3.48'. [ 125.869465][ T6121] netlink: 338 bytes leftover after parsing attributes in process `syz.3.48'. [ 126.466504][ T6128] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 126.714981][ T6131] netlink: 4 bytes leftover after parsing attributes in process `syz.1.51'. [ 126.861152][ T6138] netlink: 25 bytes leftover after parsing attributes in process `syz.1.51'. [ 128.782317][ T6163] netlink: 338 bytes leftover after parsing attributes in process `syz.0.56'. [ 128.824819][ T6163] netlink: 338 bytes leftover after parsing attributes in process `syz.0.56'. [ 129.004552][ T6159] netlink: 8 bytes leftover after parsing attributes in process `syz.3.57'. [ 129.805064][ T6184] netlink: 338 bytes leftover after parsing attributes in process `syz.0.60'. [ 130.067616][ T6183] netlink: 338 bytes leftover after parsing attributes in process `syz.0.60'. [ 130.368494][ T6193] FAULT_INJECTION: forcing a failure. [ 130.368494][ T6193] name failslab, interval 1, probability 0, space 0, times 0 [ 130.449018][ T6193] CPU: 0 UID: 0 PID: 6193 Comm: syz.3.61 Not tainted syzkaller #0 PREEMPT(full) [ 130.449063][ T6193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 130.449083][ T6193] Call Trace: [ 130.449094][ T6193] [ 130.449106][ T6193] dump_stack_lvl+0x100/0x190 [ 130.449152][ T6193] should_fail_ex.cold+0x5/0xa [ 130.449193][ T6193] should_failslab+0xc2/0x120 [ 130.449238][ T6193] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 130.449282][ T6193] ? __d_alloc+0x35/0xa50 [ 130.449322][ T6193] __d_alloc+0x35/0xa50 [ 130.449361][ T6193] d_alloc+0x4a/0x1e0 [ 130.449398][ T6193] lookup_one_qstr_excl+0x171/0x250 [ 130.449446][ T6193] start_dirop+0x59/0xb0 [ 130.449497][ T6193] simple_start_creating+0xf9/0x110 [ 130.449551][ T6193] ? __pfx_simple_start_creating+0x10/0x10 [ 130.449615][ T6193] nfsd_fill_super+0x1c9/0x560 [ 130.449668][ T6193] ? __pfx_nfsd_fill_super+0x10/0x10 [ 130.449715][ T6193] get_tree_keyed+0x10e/0x1d0 [ 130.449779][ T6193] vfs_get_tree+0x92/0x320 [ 130.449825][ T6193] path_mount+0x7d0/0x23d0 [ 130.449869][ T6193] ? __pfx_path_mount+0x10/0x10 [ 130.449903][ T6193] ? lockdep_hardirqs_on+0x78/0x100 [ 130.449963][ T6193] ? putname+0xb1/0x110 [ 130.450001][ T6193] ? kmem_cache_free+0x127/0x6b0 [ 130.450071][ T6193] ? __x64_sys_mount+0x293/0x310 [ 130.450106][ T6193] __x64_sys_mount+0x293/0x310 [ 130.450144][ T6193] ? __pfx___x64_sys_mount+0x10/0x10 [ 130.450196][ T6193] do_syscall_64+0x115/0x840 [ 130.450250][ T6193] ? clear_bhb_loop+0x40/0x90 [ 130.450293][ T6193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.450329][ T6193] RIP: 0033:0x7f915539de59 [ 130.450357][ T6193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 130.450388][ T6193] RSP: 002b:00007f9156320028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 130.450419][ T6193] RAX: ffffffffffffffda RBX: 00007f9155625fa0 RCX: 00007f915539de59 [ 130.450442][ T6193] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000000000000000 [ 130.450462][ T6193] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 130.450483][ T6193] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 [ 130.450504][ T6193] R13: 00007f9155626038 R14: 00007f9155625fa0 R15: 00007ffdefc98df8 [ 130.450546][ T6193] [ 131.392936][ T6208] random: crng reseeded on system resumption [ 131.532853][ T6205] netlink: 164 bytes leftover after parsing attributes in process `syz.3.63'. [ 132.731658][ T1153] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.195611][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.205670][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.929397][ T6242] FAULT_INJECTION: forcing a failure. [ 133.929397][ T6242] name failslab, interval 1, probability 0, space 0, times 0 [ 134.094987][ T6247] bridge0: port 3(veth1) entered blocking state [ 134.140681][ T6242] CPU: 0 UID: 0 PID: 6242 Comm: syz.3.71 Not tainted syzkaller #0 PREEMPT(full) [ 134.140714][ T6242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 134.140729][ T6242] Call Trace: [ 134.140737][ T6242] [ 134.140746][ T6242] dump_stack_lvl+0x100/0x190 [ 134.140777][ T6242] should_fail_ex.cold+0x5/0xa [ 134.140804][ T6242] should_failslab+0xc2/0x120 [ 134.140836][ T6242] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 134.140866][ T6242] ? __d_alloc+0x35/0xa50 [ 134.140894][ T6242] __d_alloc+0x35/0xa50 [ 134.140921][ T6242] d_alloc+0x4a/0x1e0 [ 134.140956][ T6242] lookup_one_qstr_excl+0x171/0x250 [ 134.140990][ T6242] start_dirop+0x59/0xb0 [ 134.141027][ T6242] simple_start_creating+0xf9/0x110 [ 134.141066][ T6242] ? __pfx_simple_start_creating+0x10/0x10 [ 134.141105][ T6242] ? mntput+0x70/0xa0 [ 134.141140][ T6242] ? simple_pin_fs+0xa3/0x190 [ 134.141175][ T6242] debugfs_start_creating.part.0+0x82/0x170 [ 134.141209][ T6242] __debugfs_create_file+0xb3/0x4f0 [ 134.141245][ T6242] debugfs_create_file_full+0x41/0x60 [ 134.141280][ T6242] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 134.141318][ T6242] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 134.141354][ T6242] ? ida_alloc_range+0x70d/0x830 [ 134.141400][ T6242] ? kasan_save_track+0x14/0x30 [ 134.141428][ T6242] ? __kasan_kmalloc+0xaa/0xb0 [ 134.141456][ T6242] ? lockdep_init_map_type+0x5c/0x250 [ 134.141547][ T6242] preinit_net.part.0+0x252/0x920 [ 134.141595][ T6242] copy_net_ns+0x339/0x7c0 [ 134.141636][ T6242] create_new_namespaces+0x3ea/0xac0 [ 134.141684][ T6242] unshare_nsproxy_namespaces+0xf2/0x220 [ 134.141729][ T6242] ksys_unshare+0x438/0xab0 [ 134.141760][ T6242] ? __pfx_ksys_unshare+0x10/0x10 [ 134.141800][ T6242] __x64_sys_unshare+0x31/0x40 [ 134.141828][ T6242] do_syscall_64+0x115/0x840 [ 134.141867][ T6242] ? clear_bhb_loop+0x40/0x90 [ 134.141899][ T6242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.141924][ T6242] RIP: 0033:0x7f915539de59 [ 134.141950][ T6242] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.141974][ T6242] RSP: 002b:00007f91562ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 134.141997][ T6242] RAX: ffffffffffffffda RBX: 00007f9155626090 RCX: 00007f915539de59 [ 134.142013][ T6242] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 134.142027][ T6242] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 134.142042][ T6242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.142057][ T6242] R13: 00007f9155626128 R14: 00007f9155626090 R15: 00007ffdefc98df8 [ 134.142088][ T6242] [ 134.182268][ T6247] bridge0: port 3(veth1) entered disabled state [ 134.565344][ T6247] veth1: entered allmulticast mode [ 134.649844][ T6247] veth1: entered promiscuous mode [ 134.714128][ T6247] bridge0: port 3(veth1) entered blocking state [ 134.721224][ T6247] bridge0: port 3(veth1) entered forwarding state [ 134.913832][ T6249] netlink: 338 bytes leftover after parsing attributes in process `syz.0.72'. [ 135.677921][ T6177] kexec: Could not allocate control_code_buffer [ 135.706633][ T6267] netlink: 338 bytes leftover after parsing attributes in process `syz.2.73'. [ 136.151950][ T6264] netlink: 338 bytes leftover after parsing attributes in process `syz.2.73'. [ 136.893441][ T6294] netlink: 164 bytes leftover after parsing attributes in process `syz.0.77'. [ 140.187251][ T6353] netlink: 338 bytes leftover after parsing attributes in process `syz.1.86'. [ 141.229236][ T6369] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 141.321533][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 141.391229][ T6374] netlink: 164 bytes leftover after parsing attributes in process `syz.1.89'. [ 144.512375][ T6416] netlink: 338 bytes leftover after parsing attributes in process `syz.3.96'. [ 144.605899][ T6414] netlink: 338 bytes leftover after parsing attributes in process `syz.3.96'. [ 145.332827][ T6421] netlink: 338 bytes leftover after parsing attributes in process `syz.1.97'. [ 145.589017][ T6429] netlink: 164 bytes leftover after parsing attributes in process `syz.0.100'. [ 145.607876][ T6430] netlink: 338 bytes leftover after parsing attributes in process `syz.3.98'. [ 147.282897][ T6460] netlink: 338 bytes leftover after parsing attributes in process `syz.3.106'. [ 147.359169][ T6456] netlink: 338 bytes leftover after parsing attributes in process `syz.3.106'. [ 147.917542][ T6459] FAULT_INJECTION: forcing a failure. [ 147.917542][ T6459] name failslab, interval 1, probability 0, space 0, times 0 [ 148.101902][ T6459] CPU: 0 UID: 0 PID: 6459 Comm: syz.1.101 Not tainted syzkaller #0 PREEMPT(full) [ 148.101938][ T6459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 148.101955][ T6459] Call Trace: [ 148.101963][ T6459] [ 148.101974][ T6459] dump_stack_lvl+0x100/0x190 [ 148.102009][ T6459] should_fail_ex.cold+0x5/0xa [ 148.102040][ T6459] should_failslab+0xc2/0x120 [ 148.102076][ T6459] __kmalloc_noprof+0xfc/0x820 [ 148.102107][ T6459] ? security_inode_init_security+0x113/0x370 [ 148.102155][ T6459] security_inode_init_security+0x113/0x370 [ 148.102197][ T6459] ? __pfx_shmem_initxattrs+0x10/0x10 [ 148.102234][ T6459] ? __pfx_security_inode_init_security+0x10/0x10 [ 148.102280][ T6459] ? make_vfsgid+0xf1/0x140 [ 148.102325][ T6459] shmem_mknod+0x2ce/0x480 [ 148.102374][ T6459] ? __pfx_shmem_mknod+0x10/0x10 [ 148.102420][ T6459] vfs_create+0x301/0x6c0 [ 148.102462][ T6459] filename_mknodat+0x2de/0x7f0 [ 148.102516][ T6459] ? __pfx_filename_mknodat+0x10/0x10 [ 148.102562][ T6459] ? strncpy_from_user+0x19d/0x2d0 [ 148.102600][ T6459] ? do_getname+0x191/0x390 [ 148.102634][ T6459] __x64_sys_mknod+0x8f/0xc0 [ 148.102661][ T6459] do_syscall_64+0x115/0x840 [ 148.102704][ T6459] ? clear_bhb_loop+0x40/0x90 [ 148.102740][ T6459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 148.102769][ T6459] RIP: 0033:0x7fec9ef9de59 [ 148.102791][ T6459] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.102817][ T6459] RSP: 002b:00007fec9fe24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 148.102844][ T6459] RAX: ffffffffffffffda RBX: 00007fec9f226360 RCX: 00007fec9ef9de59 [ 148.102863][ T6459] RDX: 0000000000000009 RSI: 0000000000000002 RDI: 0000000000000000 [ 148.102879][ T6459] RBP: 00007fec9f033e6f R08: 0000000000000000 R09: 0000000000000000 [ 148.102896][ T6459] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 148.102912][ T6459] R13: 00007fec9f2263f8 R14: 00007fec9f226360 R15: 00007fff67f15d88 [ 148.102946][ T6459] [ 148.369199][ T6455] ======================================================= [ 148.369199][ T6455] WARNING: The mand mount option has been deprecated and [ 148.369199][ T6455] and is ignored by this kernel. Remove the mand [ 148.369199][ T6455] option from the mount to silence this warning. [ 148.369199][ T6455] ======================================================= [ 148.932379][ T6474] netlink: 338 bytes leftover after parsing attributes in process `syz.3.108'. [ 149.257377][ T6469] capability: warning: `syz.0.107' uses 32-bit capabilities (legacy support in use) [ 149.385662][ T6469] FAULT_INJECTION: forcing a failure. [ 149.385662][ T6469] name failslab, interval 1, probability 0, space 0, times 0 [ 149.421149][ T6469] CPU: 0 UID: 0 PID: 6469 Comm: syz.0.107 Not tainted syzkaller #0 PREEMPT(full) [ 149.421193][ T6469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 149.421213][ T6469] Call Trace: [ 149.421223][ T6469] [ 149.421235][ T6469] dump_stack_lvl+0x100/0x190 [ 149.421281][ T6469] should_fail_ex.cold+0x5/0xa [ 149.421310][ T6469] should_failslab+0xc2/0x120 [ 149.421341][ T6469] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 149.421373][ T6469] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 149.421434][ T6469] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 149.421469][ T6469] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 149.421508][ T6469] alloc_inode+0x68/0x250 [ 149.421549][ T6469] new_inode+0x22/0x1c0 [ 149.421594][ T6469] hugetlbfs_get_inode+0x39a/0x700 [ 149.421629][ T6469] ? do_raw_spin_lock+0x128/0x260 [ 149.421668][ T6469] hugetlb_file_setup+0x15b/0x5b0 [ 149.421712][ T6469] memfd_alloc_file+0xc2/0x610 [ 149.421755][ T6469] ? _raw_spin_unlock+0x28/0x50 [ 149.421803][ T6469] ? __pfx_memfd_alloc_file+0x10/0x10 [ 149.421868][ T6469] __do_sys_memfd_create+0x236/0x3d0 [ 149.421917][ T6469] do_syscall_64+0x115/0x840 [ 149.421968][ T6469] ? clear_bhb_loop+0x40/0x90 [ 149.422010][ T6469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.422046][ T6469] RIP: 0033:0x7fb02259de59 [ 149.422074][ T6469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.422106][ T6469] RSP: 002b:00007fb023521028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 149.422137][ T6469] RAX: ffffffffffffffda RBX: 00007fb022825fa0 RCX: 00007fb02259de59 [ 149.422159][ T6469] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000040 [ 149.422180][ T6469] RBP: 00007fb022633e6f R08: 0000000000000000 R09: 0000000000000000 [ 149.422200][ T6469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 149.422221][ T6469] R13: 00007fb022826038 R14: 00007fb022825fa0 R15: 00007ffe12e53378 [ 149.422263][ T6469] [ 150.480641][ T6491] smpboot: CPU 1 is now offline [ 150.951227][ T6501] netlink: 338 bytes leftover after parsing attributes in process `syz.1.112'. [ 150.952058][ T6498] netlink: 338 bytes leftover after parsing attributes in process `syz.1.112'. [ 153.060424][ T6531] netlink: 338 bytes leftover after parsing attributes in process `syz.0.118'. [ 153.206936][ T6533] netlink: 338 bytes leftover after parsing attributes in process `syz.0.118'. [ 156.508774][ T6579] netlink: 164 bytes leftover after parsing attributes in process `syz.2.124'. [ 157.213877][ T6597] ubi0: attaching mtd0 [ 157.593613][ T6602] FAULT_INJECTION: forcing a failure. [ 157.593613][ T6602] name failslab, interval 1, probability 0, space 0, times 0 [ 157.669560][ T6602] CPU: 0 UID: 0 PID: 6602 Comm: syz.2.125 Not tainted syzkaller #0 PREEMPT(full) [ 157.669594][ T6602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 157.669609][ T6602] Call Trace: [ 157.669617][ T6602] [ 157.669626][ T6602] dump_stack_lvl+0x100/0x190 [ 157.669657][ T6602] should_fail_ex.cold+0x5/0xa [ 157.669685][ T6602] should_failslab+0xc2/0x120 [ 157.669717][ T6602] __kmalloc_noprof+0xfc/0x820 [ 157.669744][ T6602] ? alloc_pipe_info+0x1ec/0x590 [ 157.669789][ T6602] alloc_pipe_info+0x1ec/0x590 [ 157.669832][ T6602] create_pipe_files+0x8c/0x970 [ 157.669858][ T6602] do_pipe2+0xbd/0x1e0 [ 157.669879][ T6602] ? __pfx_do_pipe2+0x10/0x10 [ 157.669911][ T6602] __x64_sys_pipe+0x33/0x50 [ 157.669933][ T6602] do_syscall_64+0x115/0x840 [ 157.669971][ T6602] ? clear_bhb_loop+0x40/0x90 [ 157.670001][ T6602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.670026][ T6602] RIP: 0033:0x7f498799de59 [ 157.670046][ T6602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.670069][ T6602] RSP: 002b:00007f498887a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 157.670092][ T6602] RAX: ffffffffffffffda RBX: 00007f4987c25fa0 RCX: 00007f498799de59 [ 157.670108][ T6602] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 157.670123][ T6602] RBP: 00007f4987a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 157.670137][ T6602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 157.670152][ T6602] R13: 00007f4987c26038 R14: 00007f4987c25fa0 R15: 00007ffe34e1ed58 [ 157.670182][ T6602] [ 158.023173][ T6597] ubi0: scanning is finished [ 158.039975][ T6597] ubi0: empty MTD device detected [ 159.149822][ T6621] netlink: 338 bytes leftover after parsing attributes in process `syz.2.127'. [ 159.297428][ T6597] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 159.315421][ T6618] netlink: 338 bytes leftover after parsing attributes in process `syz.2.127'. [ 159.377973][ T6597] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 159.516077][ T6597] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 159.628414][ T6597] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 159.717244][ T6597] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 159.909143][ T6597] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 160.047906][ T6597] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3538418358 [ 160.260824][ T6597] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 160.274157][ T6625] ubi0: background thread "ubi_bgt0d" started, PID 6625 [ 160.334826][ T6600] ubi0: detaching mtd0 [ 160.489135][ T6600] ubi0: mtd0 is detached [ 163.485780][ T6647] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 163.525154][ T6647] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 163.673816][ T6647] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 163.776074][ T6647] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 163.810617][ T6647] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 163.869455][ T6647] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 163.945270][ T6647] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 163.980743][ T6647] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 164.102389][ T6647] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 164.147750][ T6647] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 164.184115][ T6647] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 164.256518][ T6647] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 164.789725][ T5630] Bluetooth: hci1: command 0x0c1a tx timeout [ 165.832256][ T5630] Bluetooth: hci0: command 0x0c1a tx timeout [ 165.988205][ T5630] Bluetooth: hci3: command 0x0c1a tx timeout [ 166.148123][ T5630] Bluetooth: hci2: command 0x0c1a tx timeout [ 166.167299][ T6684] netlink: 338 bytes leftover after parsing attributes in process `syz.3.138'. [ 166.278068][ T6682] netlink: 338 bytes leftover after parsing attributes in process `syz.3.138'. [ 166.867716][ T5630] Bluetooth: hci1: command 0x0c1a tx timeout [ 167.192726][ T6698] netlink: 164 bytes leftover after parsing attributes in process `syz.3.142'. [ 167.710776][ T6687] zswap: compressor not available [ 167.908077][ T5630] Bluetooth: hci0: command 0x0c1a tx timeout [ 167.952877][ T6705] netlink: 338 bytes leftover after parsing attributes in process `syz.0.144'. [ 168.028537][ T6706] netlink: 338 bytes leftover after parsing attributes in process `syz.0.144'. [ 168.068243][ T5630] Bluetooth: hci3: command 0x0c1a tx timeout [ 168.227903][ T5630] Bluetooth: hci2: command 0x0c1a tx timeout [ 168.947626][ T5630] Bluetooth: hci1: command 0x0c1a tx timeout [ 169.987899][ T5630] Bluetooth: hci0: command 0x0c1a tx timeout [ 170.011649][ T6721] FAULT_INJECTION: forcing a failure. [ 170.011649][ T6721] name failslab, interval 1, probability 0, space 0, times 0 [ 170.015035][ T6721] CPU: 0 UID: 0 PID: 6721 Comm: syz.0.147 Not tainted syzkaller #0 PREEMPT(full) [ 170.015073][ T6721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 170.015087][ T6721] Call Trace: [ 170.015096][ T6721] [ 170.015105][ T6721] dump_stack_lvl+0x100/0x190 [ 170.015136][ T6721] should_fail_ex.cold+0x5/0xa [ 170.015164][ T6721] should_failslab+0xc2/0x120 [ 170.015195][ T6721] __kmalloc_noprof+0xfc/0x820 [ 170.015220][ T6721] ? cache_create_net+0x2b/0x1f0 [ 170.015261][ T6721] ? cache_create_net+0xa2/0x1f0 [ 170.015294][ T6721] cache_create_net+0xa2/0x1f0 [ 170.015325][ T6721] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 170.015354][ T6721] gss_svc_init_net+0x69/0x640 [ 170.015379][ T6721] ? __pfx_canbcm_pernet_init+0x10/0x10 [ 170.015410][ T6721] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 170.015437][ T6721] ops_init+0x1e2/0x5f0 [ 170.015470][ T6721] setup_net+0x118/0x3a0 [ 170.015501][ T6721] ? __pfx_setup_net+0x10/0x10 [ 170.015532][ T6721] ? mutex_init_lockdep+0xf1/0x120 [ 170.015576][ T6721] copy_net_ns+0x46f/0x7c0 [ 170.015611][ T6721] create_new_namespaces+0x3ea/0xac0 [ 170.015659][ T6721] unshare_nsproxy_namespaces+0xf2/0x220 [ 170.015703][ T6721] ksys_unshare+0x438/0xab0 [ 170.015734][ T6721] ? __pfx_ksys_unshare+0x10/0x10 [ 170.015777][ T6721] __x64_sys_unshare+0x31/0x40 [ 170.015806][ T6721] do_syscall_64+0x115/0x840 [ 170.015844][ T6721] ? clear_bhb_loop+0x40/0x90 [ 170.015873][ T6721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.015898][ T6721] RIP: 0033:0x7fb02259de59 [ 170.015918][ T6721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.015942][ T6721] RSP: 002b:00007fb023500028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 170.015964][ T6721] RAX: ffffffffffffffda RBX: 00007fb022826090 RCX: 00007fb02259de59 [ 170.015980][ T6721] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 170.015995][ T6721] RBP: 00007fb022633e6f R08: 0000000000000000 R09: 0000000000000000 [ 170.016009][ T6721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 170.016024][ T6721] R13: 00007fb022826128 R14: 00007fb022826090 R15: 00007ffe12e53378 [ 170.016061][ T6721] [ 170.148615][ T5630] Bluetooth: hci3: command 0x0c1a tx timeout [ 170.315944][ T5630] Bluetooth: hci2: command 0x0c1a tx timeout [ 171.312115][ T6751] netlink: 338 bytes leftover after parsing attributes in process `syz.0.151'. [ 171.316891][ T6751] netlink: 338 bytes leftover after parsing attributes in process `syz.0.151'. [ 172.097300][ T6759] netlink: 338 bytes leftover after parsing attributes in process `syz.2.152'. [ 172.376070][ T6757] netlink: 338 bytes leftover after parsing attributes in process `syz.2.152'. [ 172.811269][ T6765] netlink: 338 bytes leftover after parsing attributes in process `syz.0.154'. [ 172.865700][ T6768] netlink: 338 bytes leftover after parsing attributes in process `syz.0.154'. [ 172.936345][ T6774] netlink: 338 bytes leftover after parsing attributes in process `syz.3.155'. [ 173.111419][ T6773] netlink: 338 bytes leftover after parsing attributes in process `syz.3.155'. [ 174.991498][ T6799] openvswitch: netlink: Message has 4 unknown bytes. [ 177.329951][ T6820] netlink: 338 bytes leftover after parsing attributes in process `syz.1.162'. [ 177.933659][ T6821] netlink: 338 bytes leftover after parsing attributes in process `syz.1.162'. [ 179.436304][ T6838] netlink: 24 bytes leftover after parsing attributes in process `syz.1.166'. [ 181.246377][ T6868] netlink: 338 bytes leftover after parsing attributes in process `syz.0.172'. [ 181.252426][ T6868] netlink: 338 bytes leftover after parsing attributes in process `syz.0.172'. [ 182.955520][ T6882] futex_wake_op: syz.2.174 tries to shift op by -2048; fix this program [ 183.070144][ T6882] futex_wake_op: syz.2.174 tries to shift op by -2048; fix this program [ 183.118678][ T6894] 0x000000000001-0x000000020000 : "" [ 183.419520][ T6894] ftl_cs: FTL header corrupt! [ 184.205817][ T6909] random: crng reseeded on system resumption [ 192.004897][ T7009] netlink: 338 bytes leftover after parsing attributes in process `syz.2.193'. [ 192.093927][ T7009] netlink: 338 bytes leftover after parsing attributes in process `syz.2.193'. [ 194.633557][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.646083][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.848739][ T7041] random: crng reseeded on system resumption [ 198.145590][ T7072] hub 1-0:1.0: USB hub found [ 198.261601][ T7072] hub 1-0:1.0: 1 port detected [ 198.543486][ T7092] netlink: 28 bytes leftover after parsing attributes in process `syz.1.208'. [ 199.358412][ T7092] bond0: (slave bond_slave_0): Releasing backup interface [ 200.426819][ T7108] HfR: entered promiscuous mode [ 200.966195][ T7108] netlink: 12 bytes leftover after parsing attributes in process `syz.0.211'. [ 201.083624][ T7111] netlink: 12 bytes leftover after parsing attributes in process `syz.0.211'. [ 201.424895][ T7111] openvswitch: HfR: Dropping previously announced user features [ 202.813805][ T7138] zram0: detected capacity change from 0 to 16 [ 202.854470][ T7131] syz.0.215 (7131) used greatest stack depth: 17160 bytes left [ 203.345118][ T7149] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input7 [ 203.400796][ T7152] random: crng reseeded on system resumption [ 205.280417][ T7170] netlink: 28 bytes leftover after parsing attributes in process `syz.2.222'. [ 205.710913][ T7170] bond0: (slave bond_slave_0): Releasing backup interface [ 211.978747][ T7260] netlink: 338 bytes leftover after parsing attributes in process `syz.3.239'. [ 212.089258][ T7260] netlink: 338 bytes leftover after parsing attributes in process `syz.3.239'. [ 213.463941][ T7282] usb usb16: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 217.542128][ T7317] FAULT_INJECTION: forcing a failure. [ 217.542128][ T7317] name failslab, interval 1, probability 0, space 0, times 0 [ 217.795362][ T7317] CPU: 0 UID: 0 PID: 7317 Comm: syz.2.244 Not tainted syzkaller #0 PREEMPT(full) [ 217.795395][ T7317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 217.795411][ T7317] Call Trace: [ 217.795419][ T7317] [ 217.795428][ T7317] dump_stack_lvl+0x100/0x190 [ 217.795461][ T7317] should_fail_ex.cold+0x5/0xa [ 217.795488][ T7317] should_failslab+0xc2/0x120 [ 217.795520][ T7317] __kmalloc_cache_noprof+0x91/0x6c0 [ 217.795560][ T7317] ? __pfx_sprintf+0x10/0x10 [ 217.795605][ T7317] ? do_dentry_open+0x6ab/0x14d0 [ 217.795644][ T7317] ? snd_seq_queue_alloc+0x56/0x540 [ 217.795689][ T7317] snd_seq_queue_alloc+0x56/0x540 [ 217.795733][ T7317] snd_seq_ioctl_create_queue+0xa9/0x370 [ 217.795765][ T7317] call_seq_client_ctl+0xa3/0x130 [ 217.795808][ T7317] snd_seq_kernel_client_ctl+0x77/0xd0 [ 217.795842][ T7317] alloc_seq_queue+0xdb/0x180 [ 217.795881][ T7317] ? __pfx_alloc_seq_queue+0x10/0x10 [ 217.795926][ T7317] ? find_held_lock+0x2b/0x80 [ 217.795957][ T7317] ? mark_held_locks+0x40/0x70 [ 217.795998][ T7317] snd_seq_oss_open+0x2b2/0xa10 [ 217.796037][ T7317] odev_open+0x6f/0x90 [ 217.796066][ T7317] ? __pfx_odev_open+0x10/0x10 [ 217.796096][ T7317] soundcore_open+0x2e3/0x5a0 [ 217.796135][ T7317] ? __pfx_soundcore_open+0x10/0x10 [ 217.796167][ T7317] chrdev_open+0x234/0x6a0 [ 217.796206][ T7317] ? __pfx_apparmor_file_open+0x10/0x10 [ 217.796248][ T7317] ? __pfx_chrdev_open+0x10/0x10 [ 217.796289][ T7317] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 217.796321][ T7317] do_dentry_open+0x6ab/0x14d0 [ 217.796359][ T7317] ? __pfx_chrdev_open+0x10/0x10 [ 217.796405][ T7317] vfs_open+0x82/0x3f0 [ 217.796437][ T7317] path_openat+0x2873/0x4280 [ 217.796494][ T7317] ? __pfx_path_openat+0x10/0x10 [ 217.796541][ T7317] do_file_open+0x20e/0x430 [ 217.796583][ T7317] ? __pfx_do_file_open+0x10/0x10 [ 217.796643][ T7317] ? alloc_fd+0x471/0x7a0 [ 217.796683][ T7317] ? do_getname+0x191/0x390 [ 217.796713][ T7317] do_sys_openat2+0x10f/0x1e0 [ 217.796750][ T7317] ? __pfx_do_sys_openat2+0x10/0x10 [ 217.796790][ T7317] ? fdget+0x18b/0x210 [ 217.796832][ T7317] __x64_sys_openat+0x12d/0x210 [ 217.796863][ T7317] ? __pfx___x64_sys_openat+0x10/0x10 [ 217.796905][ T7317] do_syscall_64+0x115/0x840 [ 217.796944][ T7317] ? clear_bhb_loop+0x40/0x90 [ 217.796975][ T7317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.797000][ T7317] RIP: 0033:0x7f498799de59 [ 217.797027][ T7317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.797050][ T7317] RSP: 002b:00007f4988838028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 217.797074][ T7317] RAX: ffffffffffffffda RBX: 00007f4987c26180 RCX: 00007f498799de59 [ 217.797090][ T7317] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 217.797105][ T7317] RBP: 00007f4987a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 217.797120][ T7317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 217.797134][ T7317] R13: 00007f4987c26218 R14: 00007f4987c26180 R15: 00007ffe34e1ed58 [ 217.797165][ T7317] [ 218.431485][ T7303] usb usb2: usbfs: process 7303 (syz.3.243) did not claim interface 0 before use [ 219.973615][ T7325] netlink: 'syz.0.246': attribute type 11 has an invalid length. [ 220.017531][ T7325] netlink: 'syz.0.246': attribute type 1 has an invalid length. [ 220.071741][ T7325] netlink: 9 bytes leftover after parsing attributes in process `syz.0.246'. [ 220.087692][ T7332] random: crng reseeded on system resumption [ 222.741965][ T7357] netlink: 338 bytes leftover after parsing attributes in process `syz.3.253'. [ 222.848870][ T7359] netlink: 338 bytes leftover after parsing attributes in process `syz.3.253'. [ 224.970971][ T7386] netlink: 342 bytes leftover after parsing attributes in process `syz.3.259'. [ 225.149280][ T7374] FAULT_INJECTION: forcing a failure. [ 225.149280][ T7374] name failslab, interval 1, probability 0, space 0, times 0 [ 225.191263][ T7374] CPU: 0 UID: 0 PID: 7374 Comm: syz.1.257 Not tainted syzkaller #0 PREEMPT(full) [ 225.191296][ T7374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 225.191311][ T7374] Call Trace: [ 225.191319][ T7374] [ 225.191328][ T7374] dump_stack_lvl+0x100/0x190 [ 225.191360][ T7374] should_fail_ex.cold+0x5/0xa [ 225.191387][ T7374] should_failslab+0xc2/0x120 [ 225.191419][ T7374] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 225.191452][ T7374] ? cache_create_net+0x2b/0x1f0 [ 225.191484][ T7374] kmemdup_noprof+0x29/0x60 [ 225.191510][ T7374] cache_create_net+0x2b/0x1f0 [ 225.191540][ T7374] gss_svc_init_net+0x11f/0x640 [ 225.191565][ T7374] ? __pfx_canbcm_pernet_init+0x10/0x10 [ 225.191599][ T7374] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 225.191627][ T7374] ops_init+0x1e2/0x5f0 [ 225.191660][ T7374] setup_net+0x118/0x3a0 [ 225.191690][ T7374] ? __pfx_setup_net+0x10/0x10 [ 225.191720][ T7374] ? mutex_init_lockdep+0xf1/0x120 [ 225.191764][ T7374] copy_net_ns+0x46f/0x7c0 [ 225.191799][ T7374] create_new_namespaces+0x3ea/0xac0 [ 225.191846][ T7374] unshare_nsproxy_namespaces+0xf2/0x220 [ 225.191891][ T7374] ksys_unshare+0x438/0xab0 [ 225.191921][ T7374] ? __pfx_ksys_unshare+0x10/0x10 [ 225.191961][ T7374] __x64_sys_unshare+0x31/0x40 [ 225.191989][ T7374] do_syscall_64+0x115/0x840 [ 225.192028][ T7374] ? clear_bhb_loop+0x40/0x90 [ 225.192058][ T7374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.192083][ T7374] RIP: 0033:0x7fec9ef9de59 [ 225.192102][ T7374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.192126][ T7374] RSP: 002b:00007fec9fea8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 225.192149][ T7374] RAX: ffffffffffffffda RBX: 00007fec9f225fa0 RCX: 00007fec9ef9de59 [ 225.192165][ T7374] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 225.192179][ T7374] RBP: 00007fec9f033e6f R08: 0000000000000000 R09: 0000000000000000 [ 225.192194][ T7374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 225.192208][ T7374] R13: 00007fec9f226038 R14: 00007fec9f225fa0 R15: 00007fff67f15d88 [ 225.192239][ T7374] [ 225.881525][ T7396] netlink: 28 bytes leftover after parsing attributes in process `syz.0.269'. [ 226.046156][ T7396] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 226.204960][ T7396] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 226.844743][ T7396] ptp ptp0: only physical clock in use now [ 226.952662][ T7393] hub 1-0:1.0: USB hub found [ 226.991404][ T7393] hub 1-0:1.0: 1 port detected [ 229.635448][ T7451] netlink: 342 bytes leftover after parsing attributes in process `syz.3.270'. [ 230.493935][ T7467] netlink: 342 bytes leftover after parsing attributes in process `syz.2.273'. [ 230.780457][ T7466] netlink: 342 bytes leftover after parsing attributes in process `syz.2.273'. [ 231.117631][ T7477] netlink: 28 bytes leftover after parsing attributes in process `syz.3.276'. [ 231.174557][ T7477] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 231.428721][ T7477] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 232.205805][ T7477] hub 1-0:1.0: USB hub found [ 232.249521][ T7480] ptp ptp0: only physical clock in use now [ 232.292620][ T7477] hub 1-0:1.0: 1 port detected [ 233.601434][ T7520] FAULT_INJECTION: forcing a failure. [ 233.601434][ T7520] name failslab, interval 1, probability 0, space 0, times 0 [ 233.663331][ T7520] CPU: 0 UID: 0 PID: 7520 Comm: syz.2.281 Not tainted syzkaller #0 PREEMPT(full) [ 233.663367][ T7520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 233.663382][ T7520] Call Trace: [ 233.663390][ T7520] [ 233.663400][ T7520] dump_stack_lvl+0x100/0x190 [ 233.663432][ T7520] should_fail_ex.cold+0x5/0xa [ 233.663459][ T7520] should_failslab+0xc2/0x120 [ 233.663497][ T7520] kmem_cache_alloc_noprof+0x91/0x6a0 [ 233.663525][ T7520] ? __pfx_map_id_range_down+0x10/0x10 [ 233.663558][ T7520] ? security_inode_alloc+0x3b/0x2c0 [ 233.663588][ T7520] security_inode_alloc+0x3b/0x2c0 [ 233.663613][ T7520] inode_init_always_gfp+0xc77/0xfb0 [ 233.663655][ T7520] ? __pfx_nfsd_fill_super+0x10/0x10 [ 233.663689][ T7520] alloc_inode+0x8e/0x250 [ 233.663718][ T7520] new_inode+0x22/0x1c0 [ 233.663748][ T7520] ? __pfx_nfsd_fill_super+0x10/0x10 [ 233.663781][ T7520] nfsd_fill_super+0x145/0x560 [ 233.663816][ T7520] ? __pfx_nfsd_fill_super+0x10/0x10 [ 233.663849][ T7520] get_tree_keyed+0x10e/0x1d0 [ 233.663886][ T7520] vfs_get_tree+0x92/0x320 [ 233.663918][ T7520] path_mount+0x7d0/0x23d0 [ 233.663949][ T7520] ? __pfx_path_mount+0x10/0x10 [ 233.663972][ T7520] ? lockdep_hardirqs_on+0x78/0x100 [ 233.664015][ T7520] ? putname+0xb1/0x110 [ 233.664036][ T7520] ? kmem_cache_free+0x127/0x6b0 [ 233.664086][ T7520] ? __x64_sys_mount+0x293/0x310 [ 233.664110][ T7520] __x64_sys_mount+0x293/0x310 [ 233.664137][ T7520] ? __pfx___x64_sys_mount+0x10/0x10 [ 233.664172][ T7520] do_syscall_64+0x115/0x840 [ 233.664211][ T7520] ? clear_bhb_loop+0x40/0x90 [ 233.664241][ T7520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.664267][ T7520] RIP: 0033:0x7f498799de59 [ 233.664287][ T7520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 233.664310][ T7520] RSP: 002b:00007f498887a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 233.664334][ T7520] RAX: ffffffffffffffda RBX: 00007f4987c25fa0 RCX: 00007f498799de59 [ 233.664350][ T7520] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000000000000000 [ 233.664365][ T7520] RBP: 00007f4987a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 233.664379][ T7520] R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 [ 233.664394][ T7520] R13: 00007f4987c26038 R14: 00007f4987c25fa0 R15: 00007ffe34e1ed58 [ 233.664425][ T7520] [ 234.243571][ T7530] netlink: 342 bytes leftover after parsing attributes in process `syz.0.283'. [ 234.287894][ T7530] netlink: 342 bytes leftover after parsing attributes in process `syz.0.283'. [ 234.756877][ T7540] netlink: 338 bytes leftover after parsing attributes in process `syz.3.287'. [ 234.988337][ T7540] netlink: 338 bytes leftover after parsing attributes in process `syz.3.287'. [ 236.218574][ T7557] netlink: 8 bytes leftover after parsing attributes in process `syz.2.290'. [ 238.216201][ T7575] netlink: 338 bytes leftover after parsing attributes in process `syz.0.300'. [ 239.418059][ T7594] netlink: 342 bytes leftover after parsing attributes in process `syz.1.295'. [ 239.903187][ T7600] netlink: 338 bytes leftover after parsing attributes in process `syz.0.296'. [ 240.576633][ T7611] sysfs_service_op_store: Client not running :-5: [ 242.025379][ T5630] Bluetooth: hci2: Unexpected cc 0x7c89 with no status [ 242.258477][ T7623] FAULT_INJECTION: forcing a failure. [ 242.258477][ T7623] name failslab, interval 1, probability 0, space 0, times 0 [ 242.319162][ T7623] CPU: 0 UID: 0 PID: 7623 Comm: syz.3.301 Not tainted syzkaller #0 PREEMPT(full) [ 242.319195][ T7623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 242.319220][ T7623] Call Trace: [ 242.319228][ T7623] [ 242.319237][ T7623] dump_stack_lvl+0x100/0x190 [ 242.319269][ T7623] should_fail_ex.cold+0x5/0xa [ 242.319296][ T7623] should_failslab+0xc2/0x120 [ 242.319327][ T7623] kmem_cache_alloc_noprof+0x91/0x6a0 [ 242.319353][ T7623] ? __proc_create+0xc1/0x8f0 [ 242.319392][ T7623] ? __proc_create+0xc1/0x8f0 [ 242.319430][ T7623] ? __proc_create+0x247/0x8f0 [ 242.319482][ T7623] __proc_create+0x247/0x8f0 [ 242.319523][ T7623] ? __pfx___proc_create+0x10/0x10 [ 242.319567][ T7623] ? _raw_write_unlock+0x28/0x50 [ 242.319607][ T7623] ? proc_register+0x56d/0x910 [ 242.319651][ T7623] proc_create_reg+0x75/0x170 [ 242.319677][ T7623] proc_create_data+0x86/0x110 [ 242.319701][ T7623] ? __pfx_proc_create_data+0x10/0x10 [ 242.319724][ T7623] ? net_generic+0xea/0x2a0 [ 242.319754][ T7623] gss_svc_init_net+0x2e7/0x640 [ 242.319778][ T7623] ? __pfx_canbcm_pernet_init+0x10/0x10 [ 242.319808][ T7623] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 242.319836][ T7623] ops_init+0x1e2/0x5f0 [ 242.319869][ T7623] setup_net+0x118/0x3a0 [ 242.319899][ T7623] ? __pfx_setup_net+0x10/0x10 [ 242.319929][ T7623] ? mutex_init_lockdep+0xf1/0x120 [ 242.319973][ T7623] copy_net_ns+0x46f/0x7c0 [ 242.320008][ T7623] create_new_namespaces+0x3ea/0xac0 [ 242.320057][ T7623] unshare_nsproxy_namespaces+0xf2/0x220 [ 242.320102][ T7623] ksys_unshare+0x438/0xab0 [ 242.320133][ T7623] ? __pfx_ksys_unshare+0x10/0x10 [ 242.320172][ T7623] __x64_sys_unshare+0x31/0x40 [ 242.320200][ T7623] do_syscall_64+0x115/0x840 [ 242.320239][ T7623] ? clear_bhb_loop+0x40/0x90 [ 242.320269][ T7623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.320294][ T7623] RIP: 0033:0x7f915539de59 [ 242.320313][ T7623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.320337][ T7623] RSP: 002b:00007f91562ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 242.320359][ T7623] RAX: ffffffffffffffda RBX: 00007f9155626090 RCX: 00007f915539de59 [ 242.320376][ T7623] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 242.320390][ T7623] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 242.320405][ T7623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.320419][ T7623] R13: 00007f9155626128 R14: 00007f9155626090 R15: 00007ffdefc98df8 [ 242.320450][ T7623] [ 244.191489][ T7649] netlink: 338 bytes leftover after parsing attributes in process `syz.2.305'. [ 245.343352][ T7669] netlink: 342 bytes leftover after parsing attributes in process `syz.0.308'. [ 246.425627][ T7687] netlink: 338 bytes leftover after parsing attributes in process `syz.3.312'. [ 246.956794][ T7684] netlink: 338 bytes leftover after parsing attributes in process `syz.3.312'. [ 248.739594][ T7701] FAULT_INJECTION: forcing a failure. [ 248.739594][ T7701] name failslab, interval 1, probability 0, space 0, times 0 [ 248.787590][ T7701] CPU: 0 UID: 0 PID: 7701 Comm: syz.3.316 Not tainted syzkaller #0 PREEMPT(full) [ 248.787623][ T7701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 248.787637][ T7701] Call Trace: [ 248.787645][ T7701] [ 248.787654][ T7701] dump_stack_lvl+0x100/0x190 [ 248.787686][ T7701] should_fail_ex.cold+0x5/0xa [ 248.787713][ T7701] should_failslab+0xc2/0x120 [ 248.787746][ T7701] kmem_cache_alloc_noprof+0x91/0x6a0 [ 248.787772][ T7701] ? __proc_create+0xc1/0x8f0 [ 248.787811][ T7701] ? __proc_create+0xc1/0x8f0 [ 248.787850][ T7701] ? __proc_create+0x247/0x8f0 [ 248.787893][ T7701] __proc_create+0x247/0x8f0 [ 248.787934][ T7701] ? __pfx___proc_create+0x10/0x10 [ 248.787986][ T7701] ? _raw_write_unlock+0x28/0x50 [ 248.788023][ T7701] ? proc_register+0x56d/0x910 [ 248.788104][ T7701] proc_create_reg+0x75/0x170 [ 248.788130][ T7701] proc_create_data+0x86/0x110 [ 248.788153][ T7701] ? __pfx_proc_create_data+0x10/0x10 [ 248.788177][ T7701] ? cache_register_net+0x137/0x5e0 [ 248.788210][ T7701] ? cache_register_net+0x137/0x5e0 [ 248.788249][ T7701] cache_register_net+0x25a/0x5e0 [ 248.788297][ T7701] gss_svc_init_net+0x14e/0x640 [ 248.788322][ T7701] ? __pfx_canbcm_pernet_init+0x10/0x10 [ 248.788355][ T7701] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 248.788384][ T7701] ops_init+0x1e2/0x5f0 [ 248.788417][ T7701] setup_net+0x118/0x3a0 [ 248.788447][ T7701] ? __pfx_setup_net+0x10/0x10 [ 248.788477][ T7701] ? mutex_init_lockdep+0xf1/0x120 [ 248.788523][ T7701] copy_net_ns+0x46f/0x7c0 [ 248.788558][ T7701] create_new_namespaces+0x3ea/0xac0 [ 248.788607][ T7701] unshare_nsproxy_namespaces+0xf2/0x220 [ 248.788651][ T7701] ksys_unshare+0x438/0xab0 [ 248.788682][ T7701] ? __pfx_ksys_unshare+0x10/0x10 [ 248.788721][ T7701] __x64_sys_unshare+0x31/0x40 [ 248.788750][ T7701] do_syscall_64+0x115/0x840 [ 248.788794][ T7701] ? clear_bhb_loop+0x40/0x90 [ 248.788824][ T7701] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.788849][ T7701] RIP: 0033:0x7f915539de59 [ 248.788870][ T7701] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 248.788893][ T7701] RSP: 002b:00007f9156320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 248.788916][ T7701] RAX: ffffffffffffffda RBX: 00007f9155625fa0 RCX: 00007f915539de59 [ 248.788932][ T7701] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 248.788947][ T7701] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 248.788962][ T7701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 248.788976][ T7701] R13: 00007f9155626038 R14: 00007f9155625fa0 R15: 00007ffdefc98df8 [ 248.789031][ T7701] [ 250.541415][ T7714] input: f¬ as /devices/virtual/input/input8 [ 254.069270][ T7765] netlink: 338 bytes leftover after parsing attributes in process `syz.2.333'. [ 254.136320][ T7765] netlink: 338 bytes leftover after parsing attributes in process `syz.2.333'. [ 256.071308][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.085952][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.096855][ T7788] netlink: 28 bytes leftover after parsing attributes in process `syz.1.326'. [ 256.526084][ T7796] FAULT_INJECTION: forcing a failure. [ 256.526084][ T7796] name failslab, interval 1, probability 0, space 0, times 0 [ 256.678170][ T7801] bridge0: port 3(veth1) entered blocking state [ 256.726179][ T7796] CPU: 0 UID: 0 PID: 7796 Comm: syz.0.328 Not tainted syzkaller #0 PREEMPT(full) [ 256.726212][ T7796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 256.726227][ T7796] Call Trace: [ 256.726234][ T7796] [ 256.726243][ T7796] dump_stack_lvl+0x100/0x190 [ 256.726274][ T7796] should_fail_ex.cold+0x5/0xa [ 256.726301][ T7796] should_failslab+0xc2/0x120 [ 256.726333][ T7796] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 256.726363][ T7796] ? __d_alloc+0x35/0xa50 [ 256.726391][ T7796] __d_alloc+0x35/0xa50 [ 256.726417][ T7796] d_alloc+0x4a/0x1e0 [ 256.726442][ T7796] lookup_one_qstr_excl+0x171/0x250 [ 256.726477][ T7796] start_dirop+0x59/0xb0 [ 256.726515][ T7796] simple_start_creating+0xf9/0x110 [ 256.726553][ T7796] ? __pfx_simple_start_creating+0x10/0x10 [ 256.726592][ T7796] ? mntput+0x70/0xa0 [ 256.726626][ T7796] ? simple_pin_fs+0xa3/0x190 [ 256.726661][ T7796] debugfs_start_creating.part.0+0x82/0x170 [ 256.726695][ T7796] __debugfs_create_file+0xb3/0x4f0 [ 256.726730][ T7796] debugfs_create_file_full+0x41/0x60 [ 256.726765][ T7796] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 256.726802][ T7796] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 256.726837][ T7796] ? ida_alloc_range+0x70d/0x830 [ 256.726889][ T7796] ? kasan_save_track+0x14/0x30 [ 256.726921][ T7796] ? __kasan_kmalloc+0xaa/0xb0 [ 256.726949][ T7796] ? lockdep_init_map_type+0x5c/0x250 [ 256.726992][ T7796] preinit_net.part.0+0x252/0x920 [ 256.727025][ T7796] copy_net_ns+0x339/0x7c0 [ 256.727060][ T7796] create_new_namespaces+0x3ea/0xac0 [ 256.727108][ T7796] unshare_nsproxy_namespaces+0xf2/0x220 [ 256.727152][ T7796] ksys_unshare+0x438/0xab0 [ 256.727182][ T7796] ? __pfx_ksys_unshare+0x10/0x10 [ 256.727222][ T7796] __x64_sys_unshare+0x31/0x40 [ 256.727250][ T7796] do_syscall_64+0x115/0x840 [ 256.727289][ T7796] ? clear_bhb_loop+0x40/0x90 [ 256.727319][ T7796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.727344][ T7796] RIP: 0033:0x7fb02259de59 [ 256.727364][ T7796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 256.727387][ T7796] RSP: 002b:00007fb023500028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 256.727410][ T7796] RAX: ffffffffffffffda RBX: 00007fb022826090 RCX: 00007fb02259de59 [ 256.727426][ T7796] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 256.727441][ T7796] RBP: 00007fb022633e6f R08: 0000000000000000 R09: 0000000000000000 [ 256.727456][ T7796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 256.727470][ T7796] R13: 00007fb022826128 R14: 00007fb022826090 R15: 00007ffe12e53378 [ 256.727501][ T7796] [ 257.485281][ T7800] FAULT_INJECTION: forcing a failure. [ 257.485281][ T7800] name failslab, interval 1, probability 0, space 0, times 0 [ 257.535333][ T7800] CPU: 0 UID: 0 PID: 7800 Comm: syz.1.331 Not tainted syzkaller #0 PREEMPT(full) [ 257.535367][ T7800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 257.535381][ T7800] Call Trace: [ 257.535389][ T7800] [ 257.535398][ T7800] dump_stack_lvl+0x100/0x190 [ 257.535429][ T7800] should_fail_ex.cold+0x5/0xa [ 257.535456][ T7800] should_failslab+0xc2/0x120 [ 257.535488][ T7800] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 257.535518][ T7800] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 257.535548][ T7800] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 257.535572][ T7800] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 257.535606][ T7800] alloc_inode+0x68/0x250 [ 257.535636][ T7800] new_inode+0x22/0x1c0 [ 257.535667][ T7800] hugetlbfs_get_inode+0x39a/0x700 [ 257.535692][ T7800] ? do_raw_spin_lock+0x128/0x260 [ 257.535720][ T7800] hugetlb_file_setup+0x15b/0x5b0 [ 257.535750][ T7800] memfd_alloc_file+0xc2/0x610 [ 257.535780][ T7800] ? _raw_spin_unlock+0x28/0x50 [ 257.535814][ T7800] ? __pfx_memfd_alloc_file+0x10/0x10 [ 257.535855][ T7800] __do_sys_memfd_create+0x236/0x3d0 [ 257.535889][ T7800] do_syscall_64+0x115/0x840 [ 257.535928][ T7800] ? clear_bhb_loop+0x40/0x90 [ 257.535958][ T7800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.535983][ T7800] RIP: 0033:0x7fec9ef9de59 [ 257.536003][ T7800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.536026][ T7800] RSP: 002b:00007fec9fea8028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 257.536049][ T7800] RAX: ffffffffffffffda RBX: 00007fec9f225fa0 RCX: 00007fec9ef9de59 [ 257.536065][ T7800] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000040 [ 257.536079][ T7800] RBP: 00007fec9f033e6f R08: 0000000000000000 R09: 0000000000000000 [ 257.536094][ T7800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 257.536108][ T7800] R13: 00007fec9f226038 R14: 00007fec9f225fa0 R15: 00007fff67f15d88 [ 257.536138][ T7800] [ 258.230453][ T7801] bridge0: port 3(veth1) entered disabled state [ 258.257058][ T7801] veth1: entered allmulticast mode [ 258.288703][ T7801] veth1: entered promiscuous mode [ 258.320005][ T7801] bridge0: port 3(veth1) entered blocking state [ 258.326522][ T7801] bridge0: port 3(veth1) entered forwarding state [ 258.472360][ T7809] netlink: 338 bytes leftover after parsing attributes in process `syz.3.332'. [ 258.540235][ T7811] netlink: 338 bytes leftover after parsing attributes in process `syz.3.332'. [ 259.000863][ T7822] netlink: 338 bytes leftover after parsing attributes in process `syz.1.335'. [ 259.696651][ T5630] Bluetooth: hci1: Unexpected cc 0x7c89 with no status [ 265.434695][ T7911] netlink: 342 bytes leftover after parsing attributes in process `syz.2.349'. [ 265.660811][ T7908] netlink: 342 bytes leftover after parsing attributes in process `syz.2.349'. [ 267.398424][ T7929] random: crng reseeded on system resumption [ 272.084630][ T7979] sysfs_service_op_store: Client not running :-5: [ 273.718182][ T8006] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 274.036503][ T8006] File: /dev/nullb0 PID: 8006 Comm: syz.2.365 [ 275.477524][ T5630] Bluetooth: hci0: Unexpected cc 0x7c89 with no status [ 275.533073][ T8035] FAULT_INJECTION: forcing a failure. [ 275.533073][ T8035] name failslab, interval 1, probability 0, space 0, times 0 [ 275.770352][ T8038] bridge0: port 3(veth1) entered blocking state [ 275.827745][ T8035] CPU: 0 UID: 0 PID: 8035 Comm: syz.2.368 Not tainted syzkaller #0 PREEMPT(full) [ 275.827777][ T8035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 275.827791][ T8035] Call Trace: [ 275.827799][ T8035] [ 275.827808][ T8035] dump_stack_lvl+0x100/0x190 [ 275.827838][ T8035] should_fail_ex.cold+0x5/0xa [ 275.827868][ T8035] should_failslab+0xc2/0x120 [ 275.827900][ T8035] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 275.827931][ T8035] ? __d_alloc+0x35/0xa50 [ 275.827958][ T8035] __d_alloc+0x35/0xa50 [ 275.827984][ T8035] d_alloc+0x4a/0x1e0 [ 275.828009][ T8035] lookup_one_qstr_excl+0x171/0x250 [ 275.828041][ T8035] start_dirop+0x59/0xb0 [ 275.828077][ T8035] simple_start_creating+0xf9/0x110 [ 275.828115][ T8035] ? __pfx_simple_start_creating+0x10/0x10 [ 275.828154][ T8035] ? mntput+0x70/0xa0 [ 275.828195][ T8035] ? simple_pin_fs+0xa3/0x190 [ 275.828231][ T8035] debugfs_start_creating.part.0+0x82/0x170 [ 275.828265][ T8035] __debugfs_create_file+0xb3/0x4f0 [ 275.828300][ T8035] debugfs_create_file_full+0x41/0x60 [ 275.828335][ T8035] ref_tracker_dir_debugfs+0x19e/0x2e0 [ 275.828373][ T8035] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 275.828431][ T8035] ? kasan_save_track+0x14/0x30 [ 275.828458][ T8035] ? __kasan_kmalloc+0xaa/0xb0 [ 275.828486][ T8035] ? lockdep_init_map_type+0x5c/0x250 [ 275.828529][ T8035] preinit_net.part.0+0x43b/0x920 [ 275.828560][ T8035] copy_net_ns+0x339/0x7c0 [ 275.828595][ T8035] create_new_namespaces+0x3ea/0xac0 [ 275.828643][ T8035] unshare_nsproxy_namespaces+0xf2/0x220 [ 275.828688][ T8035] ksys_unshare+0x438/0xab0 [ 275.828718][ T8035] ? __pfx_ksys_unshare+0x10/0x10 [ 275.828757][ T8035] __x64_sys_unshare+0x31/0x40 [ 275.828785][ T8035] do_syscall_64+0x115/0x840 [ 275.828824][ T8035] ? clear_bhb_loop+0x40/0x90 [ 275.828854][ T8035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.828879][ T8035] RIP: 0033:0x7f498799de59 [ 275.828899][ T8035] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.828923][ T8035] RSP: 002b:00007f4988859028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 275.828946][ T8035] RAX: ffffffffffffffda RBX: 00007f4987c26090 RCX: 00007f498799de59 [ 275.828962][ T8035] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 275.828976][ T8035] RBP: 00007f4987a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 275.828991][ T8035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 275.829005][ T8035] R13: 00007f4987c26128 R14: 00007f4987c26090 R15: 00007ffe34e1ed58 [ 275.829036][ T8035] [ 276.432960][ T8038] bridge0: port 3(veth1) entered disabled state [ 276.511078][ T8038] veth1: entered allmulticast mode [ 276.633893][ T8038] veth1: entered promiscuous mode [ 276.765028][ T8038] bridge0: port 3(veth1) entered blocking state [ 276.771602][ T8038] bridge0: port 3(veth1) entered forwarding state [ 279.290122][ T8051] netlink: del zone limit has 4 unknown bytes [ 279.865897][ T8050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.369'. [ 281.713950][ T8079] sysfs_service_op_store: Client not running :-5: [ 281.889632][ T8080] netlink: 338 bytes leftover after parsing attributes in process `syz.2.382'. [ 281.954758][ T8080] netlink: 338 bytes leftover after parsing attributes in process `syz.2.382'. [ 282.925492][ T8098] netlink: 28 bytes leftover after parsing attributes in process `syz.3.375'. [ 284.620152][ T8126] can0: slcan on ttyS2. [ 285.555388][ T8125] can0 (unregistered): slcan off ttyS2. [ 285.994855][ T8147] netlink: 338 bytes leftover after parsing attributes in process `syz.1.385'. [ 286.308059][ T8152] netlink: 338 bytes leftover after parsing attributes in process `syz.2.386'. [ 286.353779][ T8145] netlink: 338 bytes leftover after parsing attributes in process `syz.1.385'. [ 286.474651][ T8152] netlink: 338 bytes leftover after parsing attributes in process `syz.2.386'. [ 288.859033][ T8192] kAFS: unparsable volume name [ 289.305594][ T8176] queue_state_write: unsupported operation '' [ 289.305642][ T8176] queue_state_write: use 'run', 'start' or 'kick' [ 291.068761][ T8206] netlink: 24 bytes leftover after parsing attributes in process `syz.2.396'. [ 291.486677][ T8219] netlink: 338 bytes leftover after parsing attributes in process `syz.3.399'. [ 291.497483][ T8204] vivid-007: ================= START STATUS ================= [ 291.520033][ T8204] vivid-007: Generate PTS: [ 291.523862][ T8219] netlink: 338 bytes leftover after parsing attributes in process `syz.3.399'. [ 291.538691][ T8204] true [ 291.542253][ T8204] vivid-007: Generate SCR: true [ 291.548504][ T8204] tpg source WxH: 320x240 (Y'CbCr) [ 291.559220][ T8204] tpg field: 1 [ 291.576449][ T8204] tpg crop: (0,0)/320x240 [ 291.592571][ T8204] tpg compose: (0,0)/320x240 [ 291.608294][ T8204] tpg colorspace: 8 [ 291.660354][ T8204] tpg transfer function: 0/0 [ 291.735282][ T8204] tpg Y'CbCr encoding: 0/0 [ 291.778117][ T8204] tpg quantization: 0/0 [ 291.844271][ T8204] tpg RGB range: 0/2 [ 291.878118][ T5630] Bluetooth: hci1: unexpected event 0x02 length: 1021 > 260 [ 291.935570][ T8204] vivid-007: ================== END STATUS ================== [ 291.960597][ T8228] netlink: 146 bytes leftover after parsing attributes in process `syz.3.401'. [ 294.732177][ T8269] netlink: 338 bytes leftover after parsing attributes in process `syz.2.407'. [ 294.825742][ T8269] netlink: 338 bytes leftover after parsing attributes in process `syz.2.407'. [ 294.999399][ T8268] random: crng reseeded on system resumption [ 295.072909][ T8276] netlink: 24 bytes leftover after parsing attributes in process `syz.0.408'. [ 295.646347][ T8287] netlink: 338 bytes leftover after parsing attributes in process `syz.0.410'. [ 295.724267][ T8288] netlink: 338 bytes leftover after parsing attributes in process `syz.0.410'. [ 296.162230][ T8294] netlink: 338 bytes leftover after parsing attributes in process `syz.2.411'. [ 296.215568][ T8296] netlink: 338 bytes leftover after parsing attributes in process `syz.2.411'. [ 297.768989][ T8322] netlink: 28 bytes leftover after parsing attributes in process `syz.0.414'. [ 299.388090][ T8344] netlink: 338 bytes leftover after parsing attributes in process `syz.3.421'. [ 299.467099][ T8346] netlink: 338 bytes leftover after parsing attributes in process `syz.3.421'. [ 300.465660][ T8357] sysfs_service_op_store: Client not running :-5: [ 302.471656][ T8393] netlink: 338 bytes leftover after parsing attributes in process `syz.3.430'. [ 302.533475][ T8393] netlink: 338 bytes leftover after parsing attributes in process `syz.3.430'. [ 303.027025][ T8403] netlink: 338 bytes leftover after parsing attributes in process `syz.1.433'. [ 303.139078][ T8402] netlink: 338 bytes leftover after parsing attributes in process `syz.1.433'. [ 304.408982][ T8413] futex_wake_op: syz.0.435 tries to shift op by -2048; fix this program [ 304.526784][ T8418] netlink: 338 bytes leftover after parsing attributes in process `syz.3.437'. [ 304.583676][ T8413] futex_wake_op: syz.0.435 tries to shift op by -2048; fix this program [ 304.622649][ T8418] netlink: 338 bytes leftover after parsing attributes in process `syz.3.437'. [ 304.853004][ T8409] 0x000000000001-0x000000020000 : "" [ 304.968137][ T8409] ftl_cs: FTL header corrupt! [ 305.055907][ T8425] random: crng reseeded on system resumption [ 306.516894][ T8442] netlink: 338 bytes leftover after parsing attributes in process `syz.2.442'. [ 306.566210][ T8445] netlink: 338 bytes leftover after parsing attributes in process `syz.2.442'. [ 307.103499][ T5630] Bluetooth: hci2: Unexpected cc 0x7c89 with no status [ 308.095474][ T8460] netlink: 338 bytes leftover after parsing attributes in process `syz.2.446'. [ 308.156699][ T8460] netlink: 338 bytes leftover after parsing attributes in process `syz.2.446'. [ 308.496101][ T8463] netlink: 338 bytes leftover after parsing attributes in process `syz.1.447'. [ 308.574854][ T8467] netlink: 338 bytes leftover after parsing attributes in process `syz.1.447'. [ 312.663047][ T8521] netlink: 338 bytes leftover after parsing attributes in process `syz.3.458'. [ 312.740940][ T8522] netlink: 338 bytes leftover after parsing attributes in process `syz.3.458'. [ 312.845131][ T8524] netlink: 338 bytes leftover after parsing attributes in process `syz.2.459'. [ 312.893157][ T8524] netlink: 338 bytes leftover after parsing attributes in process `syz.2.459'. [ 317.509238][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.515935][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.565310][ T8609] netlink: 338 bytes leftover after parsing attributes in process `syz.3.481'. [ 317.630413][ T8610] netlink: 338 bytes leftover after parsing attributes in process `syz.3.481'. [ 318.324239][ T8619] FAULT_INJECTION: forcing a failure. [ 318.324239][ T8619] name failslab, interval 1, probability 0, space 0, times 0 [ 318.416287][ T8619] CPU: 0 UID: 0 PID: 8619 Comm: syz.3.483 Not tainted syzkaller #0 PREEMPT(full) [ 318.416320][ T8619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 318.416341][ T8619] Call Trace: [ 318.416348][ T8619] [ 318.416357][ T8619] dump_stack_lvl+0x100/0x190 [ 318.416388][ T8619] should_fail_ex.cold+0x5/0xa [ 318.416416][ T8619] should_failslab+0xc2/0x120 [ 318.416448][ T8619] kmem_cache_alloc_noprof+0x91/0x6a0 [ 318.416475][ T8619] ? __pfx_map_id_range_down+0x10/0x10 [ 318.416509][ T8619] ? security_inode_alloc+0x3b/0x2c0 [ 318.416538][ T8619] security_inode_alloc+0x3b/0x2c0 [ 318.416563][ T8619] inode_init_always_gfp+0xc77/0xfb0 [ 318.416606][ T8619] alloc_inode+0x8e/0x250 [ 318.416636][ T8619] new_inode+0x22/0x1c0 [ 318.416666][ T8619] hugetlbfs_get_inode+0x39a/0x700 [ 318.416693][ T8619] ? do_raw_spin_lock+0x128/0x260 [ 318.416720][ T8619] hugetlb_file_setup+0x15b/0x5b0 [ 318.416758][ T8619] memfd_alloc_file+0xc2/0x610 [ 318.416789][ T8619] ? _raw_spin_unlock+0x28/0x50 [ 318.416823][ T8619] ? __pfx_memfd_alloc_file+0x10/0x10 [ 318.416869][ T8619] __do_sys_memfd_create+0x236/0x3d0 [ 318.416904][ T8619] do_syscall_64+0x115/0x840 [ 318.416943][ T8619] ? clear_bhb_loop+0x40/0x90 [ 318.416973][ T8619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.416998][ T8619] RIP: 0033:0x7f915539de59 [ 318.417018][ T8619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.417042][ T8619] RSP: 002b:00007f9156320028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 318.417069][ T8619] RAX: ffffffffffffffda RBX: 00007f9155625fa0 RCX: 00007f915539de59 [ 318.417085][ T8619] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000040 [ 318.417100][ T8619] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 318.417115][ T8619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 318.417129][ T8619] R13: 00007f9155626038 R14: 00007f9155625fa0 R15: 00007ffdefc98df8 [ 318.417159][ T8619] [ 321.062124][ T8670] netlink: 28 bytes leftover after parsing attributes in process `syz.3.495'. [ 322.803606][ T8700] input: f¬ as /devices/virtual/input/input12 [ 325.885423][ T5630] Bluetooth: hci3: unexpected event for opcode 0x7c89 [ 328.245671][ T8776] input: f¬ as /devices/virtual/input/input13 [ 331.661009][ T8825] Bluetooth: hci2: unexpected event for opcode 0x7c89 [ 333.569866][ T8825] Bluetooth: hci0: unexpected event for opcode 0x7c89 [ 334.324136][ T8859] ubi0: attaching mtd0 [ 334.426859][ T8859] ubi0 error: ubi_add_to_av: two LEBs with same sequence number 1 [ 334.572104][ T8859] eraseblock attaching information dump: [ 334.669273][ T8859] ec 1 [ 334.772712][ T8859] pnum 0 [ 334.874279][ T8859] lnum 0 [ 334.943944][ T8859] scrub 0 [ 335.012477][ T8859] sqnum 1 [ 335.092711][ T8859] Volume identifier header dump: [ 335.249156][ T8859] magic 55424921 [ 335.348040][ T8859] version 1 [ 335.415264][ T8859] vol_type 1 [ 335.476579][ T8859] copy_flag 0 [ 335.526969][ T8884] input: f¬ as /devices/virtual/input/input14 [ 335.559126][ T8859] compat 5 [ 335.610299][ T8859] vol_id 2147479551 [ 335.703806][ T8859] lnum 0 [ 335.769881][ T8859] data_size 0 [ 335.844514][ T8859] used_ebs 0 [ 335.917003][ T8859] data_pad 0 [ 336.004106][ T8859] sqnum 1 [ 336.048440][ T8859] hdr_crc 65b3bd2d [ 336.116782][ T8859] Volume identifier header hexdump: [ 336.729333][ T8859] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 337.315406][ T8903] FAULT_INJECTION: forcing a failure. [ 337.315406][ T8903] name failslab, interval 1, probability 0, space 0, times 0 [ 337.392387][ T8903] CPU: 0 UID: 0 PID: 8903 Comm: syz.3.539 Not tainted syzkaller #0 PREEMPT(full) [ 337.392423][ T8903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 337.392438][ T8903] Call Trace: [ 337.392445][ T8903] [ 337.392454][ T8903] dump_stack_lvl+0x100/0x190 [ 337.392486][ T8903] should_fail_ex.cold+0x5/0xa [ 337.392513][ T8903] should_failslab+0xc2/0x120 [ 337.392545][ T8903] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 337.392574][ T8903] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 337.392616][ T8903] ? __d_alloc+0x35/0xa50 [ 337.392643][ T8903] __d_alloc+0x35/0xa50 [ 337.392669][ T8903] d_alloc_pseudo+0x1c/0xc0 [ 337.392701][ T8903] alloc_file_pseudo+0x118/0x290 [ 337.392731][ T8903] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 337.392758][ T8903] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 337.392802][ T8903] create_pipe_files+0x360/0x970 [ 337.392831][ T8903] do_pipe2+0xbd/0x1e0 [ 337.392853][ T8903] ? __pfx_do_pipe2+0x10/0x10 [ 337.392885][ T8903] __x64_sys_pipe+0x33/0x50 [ 337.392907][ T8903] do_syscall_64+0x115/0x840 [ 337.392946][ T8903] ? clear_bhb_loop+0x40/0x90 [ 337.392976][ T8903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.393001][ T8903] RIP: 0033:0x7f915539de59 [ 337.393021][ T8903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 337.393044][ T8903] RSP: 002b:00007f9156320028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 337.393067][ T8903] RAX: ffffffffffffffda RBX: 00007f9155625fa0 RCX: 00007f915539de59 [ 337.393083][ T8903] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 337.393098][ T8903] RBP: 00007f9155433e6f R08: 0000000000000000 R09: 0000000000000000 [ 337.393112][ T8903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 337.393127][ T8903] R13: 00007f9155626038 R14: 00007f9155625fa0 R15: 00007ffdefc98df8 [ 337.393157][ T8903] [ 338.517533][ T8825] Bluetooth: hci2: unexpected event for opcode 0x7c89 [ 341.440702][ T8937] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 341.533016][ T8937] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 341.629778][ T8937] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 341.718683][ T8937] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 342.305352][ T8825] Bluetooth: hci1: command 0x0c1a tx timeout [ 343.287364][ T8985] FAULT_INJECTION: forcing a failure. [ 343.287364][ T8985] name failslab, interval 1, probability 0, space 0, times 0 [ 343.359343][ T8985] CPU: 0 UID: 0 PID: 8985 Comm: syz.1.551 Not tainted syzkaller #0 PREEMPT(full) [ 343.359377][ T8985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 343.359391][ T8985] Call Trace: [ 343.359399][ T8985] [ 343.359408][ T8985] dump_stack_lvl+0x100/0x190 [ 343.359440][ T8985] should_fail_ex.cold+0x5/0xa [ 343.359467][ T8985] should_failslab+0xc2/0x120 [ 343.359499][ T8985] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 343.359531][ T8985] ? cache_create_net+0x2b/0x1f0 [ 343.359564][ T8985] kmemdup_noprof+0x29/0x60 [ 343.359592][ T8985] cache_create_net+0x2b/0x1f0 [ 343.359622][ T8985] gss_svc_init_net+0x11f/0x640 [ 343.359647][ T8985] ? __pfx_canbcm_pernet_init+0x10/0x10 [ 343.359677][ T8985] ? __pfx_rpcsec_gss_init_net+0x10/0x10 [ 343.359705][ T8985] ops_init+0x1e2/0x5f0 [ 343.359738][ T8985] setup_net+0x118/0x3a0 [ 343.359769][ T8985] ? __pfx_setup_net+0x10/0x10 [ 343.359798][ T8985] ? mutex_init_lockdep+0xf1/0x120 [ 343.359843][ T8985] copy_net_ns+0x46f/0x7c0 [ 343.359878][ T8985] create_new_namespaces+0x3ea/0xac0 [ 343.359935][ T8985] unshare_nsproxy_namespaces+0xf2/0x220 [ 343.359981][ T8985] ksys_unshare+0x438/0xab0 [ 343.360012][ T8985] ? __pfx_ksys_unshare+0x10/0x10 [ 343.360052][ T8985] __x64_sys_unshare+0x31/0x40 [ 343.360080][ T8985] do_syscall_64+0x115/0x840 [ 343.360119][ T8985] ? clear_bhb_loop+0x40/0x90 [ 343.360149][ T8985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.360174][ T8985] RIP: 0033:0x7fec9ef9de59 [ 343.360193][ T8985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.360217][ T8985] RSP: 002b:00007fec9fea8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 343.360240][ T8985] RAX: ffffffffffffffda RBX: 00007fec9f225fa0 RCX: 00007fec9ef9de59 [ 343.360256][ T8985] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 343.360270][ T8985] RBP: 00007fec9f033e6f R08: 0000000000000000 R09: 0000000000000000 [ 343.360285][ T8985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 343.360299][ T8985] R13: 00007fec9f226038 R14: 00007fec9f225fa0 R15: 00007fff67f15d88 [ 343.360330][ T8985] [ 343.899992][ T8825] Bluetooth: hci0: command 0x0c1a tx timeout [ 343.906385][ T8825] Bluetooth: hci3: command 0x0c1a tx timeout [ 343.912422][ T8825] Bluetooth: hci2: command 0x0c1a tx timeout [ 343.998937][ T9012] netlink: 342 bytes leftover after parsing attributes in process `syz.3.554'. [ 346.990719][ T9065] openvswitch: netlink: Message has 4 unknown bytes. [ 348.881311][ T9111] netlink: 342 bytes leftover after parsing attributes in process `syz.3.567'. [ 348.974839][ T9114] FAULT_INJECTION: forcing a failure. [ 348.974839][ T9114] name failslab, interval 1, probability 0, space 0, times 0 [ 349.082463][ T9114] CPU: 0 UID: 0 PID: 9114 Comm: syz.1.568 Not tainted syzkaller #0 PREEMPT(full) [ 349.082497][ T9114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 349.082512][ T9114] Call Trace: [ 349.082519][ T9114] [ 349.082528][ T9114] dump_stack_lvl+0x100/0x190 [ 349.082559][ T9114] should_fail_ex.cold+0x5/0xa [ 349.082589][ T9114] should_failslab+0xc2/0x120 [ 349.082620][ T9114] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 349.082649][ T9114] ? __pfx_inode_set_ctime_to_ts+0x10/0x10 [ 349.082690][ T9114] ? __d_alloc+0x35/0xa50 [ 349.082717][ T9114] __d_alloc+0x35/0xa50 [ 349.082743][ T9114] d_alloc_pseudo+0x1c/0xc0 [ 349.082774][ T9114] alloc_file_pseudo+0x118/0x290 [ 349.082805][ T9114] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 349.082832][ T9114] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 349.082876][ T9114] create_pipe_files+0x360/0x970 [ 349.082902][ T9114] do_pipe2+0xbd/0x1e0 [ 349.082923][ T9114] ? __pfx_do_pipe2+0x10/0x10 [ 349.082955][ T9114] __x64_sys_pipe+0x33/0x50 [ 349.082977][ T9114] do_syscall_64+0x115/0x840 [ 349.083016][ T9114] ? clear_bhb_loop+0x40/0x90 [ 349.083046][ T9114] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.083071][ T9114] RIP: 0033:0x7fec9ef9de59 [ 349.083091][ T9114] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.083114][ T9114] RSP: 002b:00007fec9fea8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 349.083137][ T9114] RAX: ffffffffffffffda RBX: 00007fec9f225fa0 RCX: 00007fec9ef9de59 [ 349.083153][ T9114] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 349.083168][ T9114] RBP: 00007fec9f033e6f R08: 0000000000000000 R09: 0000000000000000 [ 349.083183][ T9114] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.083197][ T9114] R13: 00007fec9f226038 R14: 00007fec9f225fa0 R15: 00007fff67f15d88 [ 349.083228][ T9114] [ 352.668060][ T9155] ================================================================== [ 352.668087][ T9155] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x19fb/0x1d60 [ 352.668128][ T9155] Write of size 8 at addr ffffc90004a09080 by task syz.0.577/9155 [ 352.668148][ T9155] [ 352.668159][ T9155] CPU: 0 UID: 0 PID: 9155 Comm: syz.0.577 Not tainted syzkaller #0 PREEMPT(full) [ 352.668187][ T9155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 352.668202][ T9155] Call Trace: [ 352.668209][ T9155] [ 352.668218][ T9155] dump_stack_lvl+0x100/0x190 [ 352.668244][ T9155] print_report+0x13d/0x4b0 [ 352.668279][ T9155] ? _raw_spin_lock_irqsave+0x52/0x60 [ 352.668317][ T9155] ? sys_imageblit+0x19fb/0x1d60 [ 352.668343][ T9155] kasan_report+0xdf/0x1c0 [ 352.668375][ T9155] ? sys_imageblit+0x19fb/0x1d60 [ 352.668406][ T9155] sys_imageblit+0x19fb/0x1d60 [ 352.668437][ T9155] ? __pfx_sys_imageblit+0x10/0x10 [ 352.668467][ T9155] ? prb_read_valid+0x78/0xa0 [ 352.668507][ T9155] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 352.668547][ T9155] soft_cursor+0x524/0xa10 [ 352.668592][ T9155] ? atomic_notifier_call_chain+0x60/0x1c0 [ 352.668623][ T9155] ? fb_get_color_depth+0x120/0x250 [ 352.668660][ T9155] bit_cursor+0xca1/0x1490 [ 352.668702][ T9155] ? __pfx_bit_cursor+0x10/0x10 [ 352.668745][ T9155] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 352.668779][ T9155] ? get_color+0x1da/0x450 [ 352.668811][ T9155] ? __pfx_bit_cursor+0x10/0x10 [ 352.668849][ T9155] fbcon_cursor+0x43c/0x5e0 [ 352.668882][ T9155] ? add_softcursor+0x1a0/0x290 [ 352.668907][ T9155] set_cursor+0x1db/0x250 [ 352.668930][ T9155] con_write+0x89/0xb0 [ 352.668958][ T9155] n_tty_write+0x431/0x1160 [ 352.668999][ T9155] ? __pfx_n_tty_write+0x10/0x10 [ 352.669033][ T9155] ? __kasan_kmalloc+0xaa/0xb0 [ 352.669060][ T9155] ? __pfx_woken_wake_function+0x10/0x10 [ 352.669107][ T9155] ? rcu_is_watching+0x12/0xc0 [ 352.669133][ T9155] ? file_tty_write.isra.0+0x694/0x890 [ 352.669160][ T9155] ? kfree+0x1e5/0x6c0 [ 352.669197][ T9155] ? __pfx_n_tty_write+0x10/0x10 [ 352.669233][ T9155] file_tty_write.isra.0+0x4d2/0x890 [ 352.669265][ T9155] redirected_tty_write+0xd4/0x120 [ 352.669294][ T9155] vfs_write+0x6ac/0x1050 [ 352.669331][ T9155] ? __pfx_redirected_tty_write+0x10/0x10 [ 352.669362][ T9155] ? __pfx_vfs_write+0x10/0x10 [ 352.669396][ T9155] ? find_held_lock+0x2b/0x80 [ 352.669433][ T9155] ksys_write+0x12a/0x250 [ 352.669469][ T9155] ? __pfx_ksys_write+0x10/0x10 [ 352.669509][ T9155] do_syscall_64+0x115/0x840 [ 352.669549][ T9155] ? clear_bhb_loop+0x40/0x90 [ 352.669577][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.669602][ T9155] RIP: 0033:0x7fb02259de59 [ 352.669621][ T9155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 352.669644][ T9155] RSP: 002b:00007fb0234df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 352.669667][ T9155] RAX: ffffffffffffffda RBX: 00007fb022826180 RCX: 00007fb02259de59 [ 352.669684][ T9155] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000008 [ 352.669699][ T9155] RBP: 00007fb022633e6f R08: 0000000000000000 R09: 0000000000000000 [ 352.669715][ T9155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 352.669730][ T9155] R13: 00007fb022826218 R14: 00007fb022826180 R15: 00007ffe12e53378 [ 352.669755][ T9155] [ 352.669763][ T9155] [ 352.669769][ T9155] The buggy address belongs to a vmalloc virtual mapping [ 352.669786][ T9155] Memory state around the buggy address: [ 352.669798][ T9155] ffffc90004a08f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 352.669816][ T9155] ffffc90004a09000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 352.669834][ T9155] >ffffc90004a09080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 352.669847][ T9155] ^ [ 352.669859][ T9155] ffffc90004a09100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 352.669877][ T9155] ffffc90004a09180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 352.669890][ T9155] ================================================================== [ 352.731134][ T9155] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 352.731156][ T9155] CPU: 0 UID: 0 PID: 9155 Comm: syz.0.577 Not tainted syzkaller #0 PREEMPT(full) [ 352.731186][ T9155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 352.731202][ T9155] Call Trace: [ 352.731210][ T9155] [ 352.731219][ T9155] dump_stack_lvl+0x100/0x190 [ 352.731249][ T9155] vpanic+0x552/0x970 [ 352.731271][ T9155] ? __pfx_vpanic+0x10/0x10 [ 352.731295][ T9155] ? mark_held_locks+0x40/0x70 [ 352.731333][ T9155] ? sys_imageblit+0x19fb/0x1d60 [ 352.731360][ T9155] panic+0xd1/0xe0 [ 352.731382][ T9155] ? __pfx_panic+0x10/0x10 [ 352.731406][ T9155] ? sys_imageblit+0x19fb/0x1d60 [ 352.731433][ T9155] ? preempt_schedule_common+0x42/0xc0 [ 352.731474][ T9155] check_panic_on_warn.cold+0x19/0x34 [ 352.731500][ T9155] end_report.part.0+0x3a/0x90 [ 352.731536][ T9155] kasan_report.cold+0xe/0x18 [ 352.731572][ T9155] ? sys_imageblit+0x19fb/0x1d60 [ 352.731603][ T9155] sys_imageblit+0x19fb/0x1d60 [ 352.731635][ T9155] ? __pfx_sys_imageblit+0x10/0x10 [ 352.731665][ T9155] ? prb_read_valid+0x78/0xa0 [ 352.731705][ T9155] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 352.731749][ T9155] soft_cursor+0x524/0xa10 [ 352.731790][ T9155] ? atomic_notifier_call_chain+0x60/0x1c0 [ 352.731823][ T9155] ? fb_get_color_depth+0x120/0x250 [ 352.731860][ T9155] bit_cursor+0xca1/0x1490 [ 352.731903][ T9155] ? __pfx_bit_cursor+0x10/0x10 [ 352.731946][ T9155] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 352.731981][ T9155] ? get_color+0x1da/0x450 [ 352.732013][ T9155] ? __pfx_bit_cursor+0x10/0x10 [ 352.732051][ T9155] fbcon_cursor+0x43c/0x5e0 [ 352.732085][ T9155] ? add_softcursor+0x1a0/0x290 [ 352.732117][ T9155] set_cursor+0x1db/0x250 [ 352.732140][ T9155] con_write+0x89/0xb0 [ 352.732170][ T9155] n_tty_write+0x431/0x1160 [ 352.732212][ T9155] ? __pfx_n_tty_write+0x10/0x10 [ 352.732246][ T9155] ? __kasan_kmalloc+0xaa/0xb0 [ 352.732274][ T9155] ? __pfx_woken_wake_function+0x10/0x10 [ 352.732317][ T9155] ? rcu_is_watching+0x12/0xc0 [ 352.732343][ T9155] ? file_tty_write.isra.0+0x694/0x890 [ 352.732371][ T9155] ? kfree+0x1e5/0x6c0 [ 352.732407][ T9155] ? __pfx_n_tty_write+0x10/0x10 [ 352.732443][ T9155] file_tty_write.isra.0+0x4d2/0x890 [ 352.732476][ T9155] redirected_tty_write+0xd4/0x120 [ 352.732506][ T9155] vfs_write+0x6ac/0x1050 [ 352.732542][ T9155] ? __pfx_redirected_tty_write+0x10/0x10 [ 352.732573][ T9155] ? __pfx_vfs_write+0x10/0x10 [ 352.732609][ T9155] ? find_held_lock+0x2b/0x80 [ 352.732646][ T9155] ksys_write+0x12a/0x250 [ 352.732682][ T9155] ? __pfx_ksys_write+0x10/0x10 [ 352.732723][ T9155] do_syscall_64+0x115/0x840 [ 352.732762][ T9155] ? clear_bhb_loop+0x40/0x90 [ 352.732791][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 352.732816][ T9155] RIP: 0033:0x7fb02259de59 [ 352.732836][ T9155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 352.732860][ T9155] RSP: 002b:00007fb0234df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 352.732884][ T9155] RAX: ffffffffffffffda RBX: 00007fb022826180 RCX: 00007fb02259de59 [ 352.732902][ T9155] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000008 [ 352.732918][ T9155] RBP: 00007fb022633e6f R08: 0000000000000000 R09: 0000000000000000 [ 352.732933][ T9155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 352.732948][ T9155] R13: 00007fb022826218 R14: 00007fb022826180 R15: 00007ffe12e53378 [ 352.732973][ T9155] [ 352.733051][ T9155] Kernel Offset: disabled