last executing test programs: 4.880814961s ago: executing program 2 (id=72): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000071000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="0c00018008000100070001000c0002"], 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.692697886s ago: executing program 2 (id=74): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0xfffffffb) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @random="246fd483a581", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a35f2", 0x14, 0x6, 0x0, @remote={0xfe, 0x50}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) 4.547887119s ago: executing program 0 (id=76): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x18, 0x1}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x6, 0x4, 0x4, 0xfe, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r2}, 0xc) 4.484719081s ago: executing program 2 (id=77): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0xa42) r0 = syz_open_procfs(0x0, &(0x7f0000000480)='fd/3\x00') r1 = epoll_create1(0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000004c0)={0x6000000d}) 4.342601094s ago: executing program 0 (id=79): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) 4.046059082s ago: executing program 2 (id=81): unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24000000) r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000a80)={[{@auto_da_alloc}]}, 0x0, 0x236, &(0x7f0000000b40)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000700)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a}) 3.885124625s ago: executing program 3 (id=82): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e24, @remote}, 0x10) timer_create(0x0, &(0x7f0000000380)={0x0, 0x11, 0x800000000004}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="89", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000002c0)="a9", 0x1}], 0x20c}}], 0x2, 0x4000045) 3.541363733s ago: executing program 1 (id=84): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x80881000, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, 0x0, 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000002b40)={r1, 0x0, 0x0}, 0x20) 3.478011775s ago: executing program 3 (id=85): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, 0x0}, 0x68) r0 = userfaultfd(0x801) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x6, @link_local}, 0x10) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x3000}) 3.320409589s ago: executing program 3 (id=86): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io(r1, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.316331689s ago: executing program 1 (id=87): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000bec9ff10cd0631016016af02030109021b0001000000000904"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) mkdir(&(0x7f0000000040)='mnt\x00', 0x1ff) syz_usb_control_io$rtl8150(r0, &(0x7f0000002740)={0x14, &(0x7f0000002680)={0x20, 0x30, 0x21, {0x21, 0x28, "a5502be770ada4c2d0b57d695a9f73ec7eba5f92a4425dd1f88eb58dd2629e"}}, 0x0}, &(0x7f0000002900)={0x2c, &(0x7f0000002780)={0x40, 0x10, 0x34, "83acc0bc81ca13569361a3d5cde984f694bf52eb16f7d2dca0594c447a103806d41ac6b476068c7a197a27aab19b365e78dc63f0"}, &(0x7f0000002800)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000002840)={0x0, 0x8, 0x1, 0x1}, 0x0, &(0x7f00000028c0)}) mount(0x0, &(0x7f0000000080)='mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='mnt/ttyUSB0\x00', 0x6082, 0x0) 3.240305721s ago: executing program 2 (id=88): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f00000001c0)={0x20, 0xe, 0xf, "cf0d416510d44a33a84085a068b520"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 1.363873326s ago: executing program 3 (id=89): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x10000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) ppoll(&(0x7f0000000000)=[{r0, 0x104}], 0x1, 0x0, 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0xe, 0x8, '9P2000.u'}, 0x15) 1.069278894s ago: executing program 0 (id=90): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f0000000440)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000004c0), 0x20000328) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000500)={0x0, 0x0}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x300000f, 0x11, r0, 0xcfa3e000) 745.340081ms ago: executing program 1 (id=91): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r0, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041) recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0}, 0xb35}], 0x1, 0x0, 0x0) 644.836694ms ago: executing program 0 (id=92): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(arc4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)=',', 0x1) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 472.415878ms ago: executing program 0 (id=93): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) 471.986558ms ago: executing program 1 (id=94): r0 = fanotify_init(0x40, 0x0) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000640)=""/152, 0x98}], 0x1) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000700)='.\x00', 0xa880, 0x97) fanotify_mark(r0, 0x1, 0x40001019, r1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) close_range(r1, 0xffffffffffffffff, 0x0) 432.566579ms ago: executing program 3 (id=95): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000280)='./file2\x00', 0x800010, &(0x7f0000000380), 0xff, 0x507, &(0x7f00000003c0)="$eJzs3c9vI1cdAPCvJ3HiZNMmhR4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHEpByR+RKAGiYPRjCdZb9beWE1iR/HnI43mvXkTf9+LM+/Zz/G8AMbW7Yg4jIipiHgvIubz44V8i7c7W3rep0eP1o6PHq0Vot1+95+FrDw9Fl0/k7qVP2YpIn743YifFJ6O29w/2Fqt1aq7eX6xVd9ZbO4f3Nusr25UN6rblcrK8srSm/ffqFxaW1+uT+Wpr3zyh8Nv/iyt1lx+pLsdl6nT9OJpnNRkRHz/KoKNwETenqkzx3s85VxDSX6Jv5Jd//MxkT2bAMBN1m7PR3u+Ow8A3HRJNgdWSMr5XMBcJEm53JnDezFmk1qj2br7sLG3vd6ZK1uIYvJws1ZdyucKF6JYSPPLWfpxvnImfz8iXoiIX0zPZPnyWqO2PsoXPgAwxm6dGf//M90Z/wGAG6406goAAENn/AeA8WP8B4DxY/wHgPHTGf9nRl0NAGCIvP8HgPFj/AeAsfKDd95Jt/Zxfv/r9ff397Ya799brza3yvW9tfJaY3envNFobGT37Kmf93i1RmNn+fXY+2DhWzvN1mJz/+BBvbG33XqQ3df7QbWYnXU4hJYBAP288PLHfy6kI/JbM9kWXWs5FEdaM+CqJaOuADAyE6OuADAyVvuC8XWB9/imB+CGOG+91lKvLwi12+321VUJuGJ3vmj+H8ZV1/y//wKGMWP+H8ZXNv/vzh8wltrtwqBr/segJwIA15s5fqDP5/+fy/e/zT8c+PH62TM+uspaAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPV2sv5vOV8LfC6SpFyOeC4iFqJYeLhZqy5FxPMR8afp4nSaXx5xnQGAi0r+VsjX/7oz/9rcE0Uv3TpNTkXET3/17i8/WG21dv8YMVX41/TJ8dZH+fHK8GsPAJzvZJzO9l1v5D89erR2sg2zPn//TkSUOvGPj6bi+DT+ZExm+1IUI2L234U831Homru4iMMPI+ILvdpfiLlsDqSz8unZ+Gns54YaP3kifpKVdfbp7+Lzl1AXGDcfp/3P272uvyRuZ/ve138p66EuLu//0odaO876wMfxT/q/iT793+1BY7z+++91UjNPl30Y8aXJiJPYx139z0n8Qp/4rw0Y/y9ffumVfmXtX0fcid7xu2Mttuo7i839g3ub9dWN6kZ1u1JZWV5ZevP+G5XFbI56sf9o8I+37j7fryxt/2yf+KVz2v+1Adv/m/+996OvPiP+N17tFT+JF58RPx0Tvz5g/NXZ35X6laXx1/u0/7zn/+6A8T/568FTy4YDAKPT3D/YWq3VqrvXOJG+ELsG1ZAYKJHEFYZI/2RH3cB+iW8PK9ZU9C76+auda/pMUbv9mWL16zEuY9YNuA5OL/qI+O+oKwMAAAAAAAAAAAAAAPQ0jG8sjbqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3Fz/DwAA//9Mr8zH") r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x101842, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000002380)='./file2\x00', 0x143042, 0x80) pwritev2(r1, &(0x7f00000023c0)=[{&(0x7f0000002400)="ff", 0xabfe}], 0x1, 0x5405, 0x0, 0x0) sendfile(r1, r1, 0x0, 0x7a680000) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000980)) 317.051222ms ago: executing program 1 (id=96): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2100, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x0, [{}]}) 138.505906ms ago: executing program 2 (id=97): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001080)='/proc/locks\x00', 0x0, 0x0) r1 = open(&(0x7f0000000a40)='.\x00', 0x0, 0x0) flock(r1, 0x2) r2 = open(&(0x7f0000000a80)='.\x00', 0x100000, 0x2) flock(r2, 0x1) preadv(r0, &(0x7f00000002c0)=[{&(0x7f00000023c0)=""/4093, 0xffd}], 0x1, 0x2f, 0x0) 477.72µs ago: executing program 0 (id=98): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r0, @ANYBLOB="7ba9"], 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040), 0x3, 0x1) write$P9_RVERSION(r1, &(0x7f0000000080)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.u'}, 0x15) close_range(r0, 0xffffffffffffffff, 0x0) 211.29µs ago: executing program 3 (id=99): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x40, 0x30, 0xb, "75675a8f4aa1cfe4b31a4a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802) 0s ago: executing program 1 (id=100): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB='+cpu '], 0xb) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 59.328271][ T5433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.353065][ T5433] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller syzkaller login: [ 76.197446][ T5663] sshd-session (5663) used greatest stack depth: 20880 bytes left Warning: Permanently added '10.128.1.93' (ED25519) to the list of known hosts. [ 84.330898][ T5760] cgroup: Unknown subsys name 'net' [ 84.452905][ T5760] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.156340][ T5760] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.111925][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.120751][ T5777] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.130374][ T5777] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.139245][ T5777] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.148935][ T5777] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 88.150877][ T5779] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.160424][ T5777] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.171558][ T5779] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.180677][ T5782] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.190295][ T5084] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.224617][ T5084] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.232936][ T5084] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.245633][ T5084] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.259634][ T5782] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 88.259839][ T5084] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.274957][ T5782] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.279709][ T5084] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.290605][ T5084] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.345215][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.354110][ T5772] (null): rxe_set_mtu: Set mtu to 1024 [ 88.354659][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.367787][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.375858][ T5780] (null): rxe_set_mtu: Set mtu to 1024 [ 88.382882][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.385510][ T5780] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 88.397309][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 88.414490][ T5782] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.442415][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.465504][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.475337][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.493499][ T5784] (null): rxe_set_mtu: Set mtu to 1024 [ 88.517220][ T5773] (null): rxe_set_mtu: Set mtu to 1024 [ 88.523498][ T5773] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 88.533275][ T5784] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 88.783355][ T5772] infiniband rxe0: set active [ 88.789369][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.808114][ T5772] infiniband rxe0: added rxe_eth0 [ 88.882170][ T5772] RDS/IB: rxe0: added [ 88.887449][ T5772] smc: adding ib device rxe0 with port count 1 [ 88.893884][ T5772] smc: ib device rxe0 port 1 has pnetid [ 88.925271][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 88.963985][ T5762] rxe_eth0 speed is unknown, defaulting to 1000 [ 89.185930][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 89.251873][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 89.327879][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 89.438732][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 89.670458][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 89.793659][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.805427][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.813275][ T5773] bridge_slave_0: entered allmulticast mode [ 89.825111][ T5773] bridge_slave_0: entered promiscuous mode [ 89.839782][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.847272][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.858459][ T5773] bridge_slave_1: entered allmulticast mode [ 89.866352][ T5773] bridge_slave_1: entered promiscuous mode [ 89.915748][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.923042][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.934645][ T5780] bridge_slave_0: entered allmulticast mode [ 89.942285][ T5780] bridge_slave_0: entered promiscuous mode [ 89.962039][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.969578][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.977024][ T5784] bridge_slave_0: entered allmulticast mode [ 89.984572][ T5784] bridge_slave_0: entered promiscuous mode [ 89.993209][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.000492][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.007824][ T5784] bridge_slave_1: entered allmulticast mode [ 90.015274][ T5784] bridge_slave_1: entered promiscuous mode [ 90.043873][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.051238][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.058642][ T5780] bridge_slave_1: entered allmulticast mode [ 90.066060][ T5780] bridge_slave_1: entered promiscuous mode [ 90.089042][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.106795][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.119692][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.156626][ T5772] rxe_eth0 speed is unknown, defaulting to 1000 [ 90.196675][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.228144][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.245978][ T5773] team0: Port device team_slave_0 added [ 90.259938][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.270369][ T5084] Bluetooth: hci1: command tx timeout [ 90.310672][ T5784] team0: Port device team_slave_0 added [ 90.320628][ T5773] team0: Port device team_slave_1 added [ 90.344562][ T5084] Bluetooth: hci2: command tx timeout [ 90.344585][ T5782] Bluetooth: hci0: command tx timeout [ 90.378703][ T5784] team0: Port device team_slave_1 added [ 90.440508][ T5780] team0: Port device team_slave_0 added [ 90.452235][ T5780] team0: Port device team_slave_1 added [ 90.461930][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.469060][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.495272][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.505969][ T5084] Bluetooth: hci3: command tx timeout [ 90.515128][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.522147][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.549321][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.562632][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.569989][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.600595][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.648780][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.656054][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.682192][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.732922][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.740179][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.766831][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.780689][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.788277][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.814533][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.913063][ T5773] hsr_slave_0: entered promiscuous mode [ 90.919728][ T5773] hsr_slave_1: entered promiscuous mode [ 90.946145][ T5780] hsr_slave_0: entered promiscuous mode [ 90.952837][ T5780] hsr_slave_1: entered promiscuous mode [ 90.959576][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.967726][ T5780] Cannot create hsr debugfs directory [ 90.978409][ T5784] hsr_slave_0: entered promiscuous mode [ 90.987624][ T5784] hsr_slave_1: entered promiscuous mode [ 90.993796][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.001474][ T5784] Cannot create hsr debugfs directory [ 91.509221][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 91.676806][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 91.732627][ T5773] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.795100][ T5773] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.846356][ T5773] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.861398][ T5773] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.925365][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.932611][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.944854][ T5772] bridge_slave_0: entered allmulticast mode [ 91.954505][ T5772] bridge_slave_0: entered promiscuous mode [ 91.965992][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.997335][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.006195][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 92.013622][ T5772] bridge_slave_1: entered allmulticast mode [ 92.021592][ T5772] bridge_slave_1: entered promiscuous mode [ 92.054366][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.107380][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.119778][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.138170][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.165815][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.189893][ T23] cfg80211: failed to load regulatory.db [ 92.254077][ T5772] team0: Port device team_slave_0 added [ 92.278435][ T5784] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.301757][ T5772] team0: Port device team_slave_1 added [ 92.318170][ T5784] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.334298][ T5784] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.344399][ T5084] Bluetooth: hci1: command tx timeout [ 92.401616][ T5784] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.427532][ T5084] Bluetooth: hci2: command tx timeout [ 92.427543][ T5782] Bluetooth: hci0: command tx timeout [ 92.451119][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.460265][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.494896][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.537301][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.557549][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.584517][ T5084] Bluetooth: hci3: command tx timeout [ 92.590063][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.616490][ T5433] infiniband rxe0: set active [ 92.621845][ T23] rxe_eth0 speed is unknown, defaulting to 1000 [ 92.712186][ T5772] hsr_slave_0: entered promiscuous mode [ 92.720147][ T5772] hsr_slave_1: entered promiscuous mode [ 92.727881][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.736279][ T5772] Cannot create hsr debugfs directory [ 92.879966][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.018998][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.032646][ T32] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.040246][ T32] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.082727][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.089914][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.123803][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.141492][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.193573][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.232516][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.250488][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.257756][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.271296][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.282630][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.313148][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.326921][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.334220][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.347822][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.355041][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.365509][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.372651][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.400392][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.701736][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.765475][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.796391][ T2882] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.803599][ T2882] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.850853][ T2882] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.858117][ T2882] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.024120][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.221661][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.256715][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.264320][ T5773] veth0_vlan: entered promiscuous mode [ 94.301415][ T5773] veth1_vlan: entered promiscuous mode [ 94.387702][ T5784] veth0_vlan: entered promiscuous mode [ 94.420980][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.430561][ T5084] Bluetooth: hci1: command tx timeout [ 94.457344][ T5784] veth1_vlan: entered promiscuous mode [ 94.479771][ T5780] veth0_vlan: entered promiscuous mode [ 94.504731][ T5084] Bluetooth: hci2: command tx timeout [ 94.506102][ T5782] Bluetooth: hci0: command tx timeout [ 94.516385][ T5780] veth1_vlan: entered promiscuous mode [ 94.536246][ T5773] veth0_macvtap: entered promiscuous mode [ 94.569117][ T5773] veth1_macvtap: entered promiscuous mode [ 94.607991][ T5772] veth0_vlan: entered promiscuous mode [ 94.639653][ T5784] veth0_macvtap: entered promiscuous mode [ 94.651986][ T5784] veth1_macvtap: entered promiscuous mode [ 94.665002][ T5782] Bluetooth: hci3: command tx timeout [ 94.692923][ T5780] veth0_macvtap: entered promiscuous mode [ 94.707487][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.719410][ T5772] veth1_vlan: entered promiscuous mode [ 94.733457][ T5780] veth1_macvtap: entered promiscuous mode [ 94.743425][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.772838][ T5773] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.782062][ T5773] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.792057][ T5773] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.801133][ T5773] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.815609][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.829180][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.841301][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.882199][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 94.892986][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.906842][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.921232][ T5784] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.930725][ T5784] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.939943][ T5784] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.949238][ T5784] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.001446][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.015808][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.029206][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.039929][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.052263][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.101480][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.113075][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.124531][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.135835][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.148169][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.186447][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.198426][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.210799][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.220924][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.285082][ T5772] veth0_macvtap: entered promiscuous mode [ 95.286190][ T128] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.304070][ T128] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.337549][ T5772] veth1_macvtap: entered promiscuous mode [ 95.396029][ T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.403948][ T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.468595][ T1138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.478014][ T1138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.486538][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.498800][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.508755][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.523786][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.533846][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 95.545109][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.561500][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.600257][ T2882] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.608925][ T2882] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.633100][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.645626][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.656419][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.667404][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.679682][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 95.690247][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.702602][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.737693][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.747622][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.756708][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.765922][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.820034][ T128] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.850154][ T128] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.985885][ T1138] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.007463][ T1138] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.073827][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.088276][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.190126][ T128] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.218192][ T128] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.504857][ T5782] Bluetooth: hci1: command tx timeout [ 96.515775][ T5905] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7'. [ 96.553008][ T5905] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7'. [ 96.584311][ T5782] Bluetooth: hci0: command tx timeout [ 96.585127][ T5084] Bluetooth: hci2: command tx timeout [ 96.745699][ T5084] Bluetooth: hci3: command tx timeout [ 96.989550][ T5921] netlink: 'syz.2.15': attribute type 1 has an invalid length. [ 97.253476][ T5926] device-mapper: dirty region log: unrecognised sync argument to dirty region log: n [ 97.278430][ T5926] device-mapper: table: 248:0: mirror: Error creating mirror dirty log (-EINVAL) [ 97.295099][ T5926] device-mapper: ioctl: error adding target to table [ 97.394845][ T5931] xt_hashlimit: size too large, truncated to 1048576 [ 97.517022][ T5936] netlink: 'syz.0.21': attribute type 4 has an invalid length. [ 97.603862][ T5938] netlink: 'syz.0.21': attribute type 4 has an invalid length. [ 97.644743][ T5932] rxe_eth0 speed is unknown, defaulting to 1000 [ 97.747783][ T5941] netlink: 52 bytes leftover after parsing attributes in process `syz.1.22'. [ 98.665212][ T5963] syz.3.29[5963]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 98.705341][ T5963] loop3: detected capacity change from 0 to 256 [ 98.748253][ T5963] exFAT-fs (loop3): invalid fs_name [ 98.766805][ T5963] exFAT-fs (loop3): failed to read boot sector [ 98.773073][ T5963] exFAT-fs (loop3): failed to recognize exfat type [ 98.901781][ T5963] netlink: 8 bytes leftover after parsing attributes in process `syz.3.29'. [ 99.110043][ T5973] netlink: 4 bytes leftover after parsing attributes in process `syz.0.33'. [ 99.552128][ T5985] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 99.787831][ T5991] FAULT_INJECTION: forcing a failure. [ 99.787831][ T5991] name failslab, interval 1, probability 0, space 0, times 1 [ 99.801244][ T5991] CPU: 0 PID: 5991 Comm: syz.0.41 Not tainted syzkaller #0 [ 99.808506][ T5991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 99.818639][ T5991] Call Trace: [ 99.821973][ T5991] [ 99.824952][ T5991] dump_stack_lvl+0x18c/0x250 [ 99.829738][ T5991] ? show_regs_print_info+0x20/0x20 [ 99.834986][ T5991] ? load_image+0x420/0x420 [ 99.839575][ T5991] should_fail_ex+0x394/0x4c0 [ 99.844332][ T5991] should_failslab+0x9/0x20 [ 99.848892][ T5991] slab_pre_alloc_hook+0x59/0x300 [ 99.853966][ T5991] ? do_raw_spin_lock+0x11f/0x2b0 [ 99.859095][ T5991] ? tipc_nametbl_subscribe+0x275/0x11d0 [ 99.864870][ T5991] __kmem_cache_alloc_node+0x53/0x250 [ 99.870304][ T5991] ? tipc_nametbl_subscribe+0x275/0x11d0 [ 99.875970][ T5991] kmalloc_trace+0x2a/0xe0 [ 99.880607][ T5991] tipc_nametbl_subscribe+0x275/0x11d0 [ 99.886107][ T5991] ? lockdep_softirqs_off+0x440/0x440 [ 99.891516][ T5991] ? tipc_nametbl_withdraw+0x2d0/0x2d0 [ 99.897018][ T5991] ? __raw_spin_lock_init+0x45/0x100 [ 99.902365][ T5991] tipc_sub_subscribe+0x3a5/0x690 [ 99.907468][ T5991] tipc_conn_rcv_sub+0x14f/0x370 [ 99.912474][ T5991] tipc_topsrv_kern_subscr+0x189/0x250 [ 99.917990][ T5991] ? conn_put+0x320/0x320 [ 99.922362][ T5991] ? __asan_memset+0x22/0x40 [ 99.926996][ T5991] tipc_group_create+0x35b/0x4e0 [ 99.931978][ T5991] tipc_sk_join+0x25a/0x6a0 [ 99.936517][ T5991] ? __tipc_sendstream+0x1290/0x1290 [ 99.941844][ T5991] tipc_setsockopt+0x73f/0x990 [ 99.946652][ T5991] ? tipc_shutdown+0x4d0/0x4d0 [ 99.951455][ T5991] ? __fget_files+0x28/0x460 [ 99.956087][ T5991] ? aa_sock_opt_perm+0x74/0x100 [ 99.961058][ T5991] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 99.966649][ T5991] ? security_socket_setsockopt+0x7e/0xa0 [ 99.972404][ T5991] ? tipc_shutdown+0x4d0/0x4d0 [ 99.977221][ T5991] do_sock_setsockopt+0x175/0x1a0 [ 99.982285][ T5991] ? __fdget+0x180/0x210 [ 99.986570][ T5991] __x64_sys_setsockopt+0x182/0x200 [ 99.991809][ T5991] do_syscall_64+0x55/0xb0 [ 99.996263][ T5991] ? clear_bhb_loop+0x40/0x90 [ 100.000989][ T5991] ? clear_bhb_loop+0x40/0x90 [ 100.005701][ T5991] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 100.011637][ T5991] RIP: 0033:0x7f3293b9e559 [ 100.016122][ T5991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.035813][ T5991] RSP: 002b:00007f3294a12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 100.044309][ T5991] RAX: ffffffffffffffda RBX: 00007f3293e25fa0 RCX: 00007f3293b9e559 [ 100.052315][ T5991] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000004 [ 100.060354][ T5991] RBP: 00007f3293c35ad8 R08: 00000000000004bd R09: 0000000000000000 [ 100.068360][ T5991] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 100.076557][ T5991] R13: 00007f3293e26038 R14: 00007f3293e25fa0 R15: 00007ffd657202f8 [ 100.084589][ T5991] [ 100.087776][ T5991] tipc: Service creation failed, no memory [ 100.093633][ T5991] tipc: Failed to subscribe for {4294967295,0,4294967295} [ 100.775881][ T6000] netlink: 12 bytes leftover after parsing attributes in process `syz.0.45'. [ 100.793468][ T5984] loop1: detected capacity change from 0 to 32768 [ 100.881627][ T5984] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 101.093313][ T5984] XFS (loop1): Ending clean mount [ 101.822990][ T5784] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 102.650053][ T6040] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.659387][ T6040] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.794085][ T6041] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.801410][ T6041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.809112][ T6041] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.816388][ T6041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.852917][ T6041] bridge0: entered promiscuous mode [ 102.860696][ T6041] bridge0: entered allmulticast mode [ 102.892885][ T5862] rxe_eth0 speed is unknown, defaulting to 1000 [ 102.944719][ T6040] syz.3.57 (6040) used greatest stack depth: 20808 bytes left [ 103.359786][ T6054] Bluetooth: MGMT ver 1.22 [ 104.155993][ T6078] loop3: detected capacity change from 0 to 1024 [ 104.180384][ T6078] EXT4-fs: Ignoring removed nomblk_io_submit option [ 104.244769][ T6078] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 104.311460][ T6078] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.334522][ T6078] ext4 filesystem being mounted at /23/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 104.501059][ T6016] syz.0.48 (6016) used greatest stack depth: 19976 bytes left [ 104.544120][ T6078] EXT4-fs error (device loop3): ext4_validate_block_bitmap:439: comm syz.3.68: bg 0: block 112: padding at end of block bitmap is not set [ 104.593565][ T6078] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 7 with max blocks 1 with error 28 [ 104.612876][ T6078] EXT4-fs (loop3): This should not happen!! Data will be lost [ 104.612876][ T6078] [ 104.624035][ T6078] EXT4-fs (loop3): Total free blocks count 0 [ 104.636032][ T6078] EXT4-fs (loop3): Free/Dirty block details [ 104.642310][ T6078] EXT4-fs (loop3): free_blocks=0 [ 104.651349][ T6078] EXT4-fs (loop3): dirty_blocks=64 [ 104.657054][ T6078] EXT4-fs (loop3): Block reservation details [ 104.684594][ T6078] EXT4-fs (loop3): i_reserved_data_blocks=4 [ 104.729680][ T6097] Zero length message leads to an empty skb [ 104.847112][ T1138] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 51 with error 28 [ 105.197001][ T6111] loop3: detected capacity change from 0 to 512 [ 105.272363][ T6111] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 105.296624][ T6111] ext4 filesystem being mounted at /24/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 105.574852][ T27] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 105.620072][ T6128] loop2: detected capacity change from 0 to 128 [ 105.627903][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.739801][ T6128] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 105.769669][ T6128] ext4 filesystem being mounted at /15/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 105.803428][ T27] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.830786][ T27] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 105.840702][ T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.887433][ T27] as10x_usb: device has been detected [ 105.895072][ T27] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 105.970623][ T27] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 106.107201][ T27] as10x_usb: error during firmware upload part1 [ 106.133078][ T27] Registered device Abilis Systems DVB-Titan [ 106.190702][ T6128] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 106.494520][ T23] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 106.514375][ T5862] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 106.594304][ T174] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 106.680991][ T23] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 106.692092][ T23] usb 4-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 106.701929][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.712262][ T5862] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.732318][ T5862] usb 2-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 106.741845][ T5862] usb 2-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 106.754263][ T5862] usb 2-1: Product: syz [ 106.758516][ T5862] usb 2-1: Manufacturer: syz [ 106.763334][ T5862] usb 2-1: SerialNumber: syz [ 106.777256][ T5862] usb 2-1: config 0 descriptor?? [ 106.796222][ T5862] keyspan 2-1:0.0: Keyspan 4 port adapter converter detected [ 106.806118][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 81 [ 106.806302][ T174] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 106.824014][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 88 [ 106.835676][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 1 [ 106.844404][ T174] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 106.859007][ T5862] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 106.867238][ T174] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 106.881176][ T174] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.892121][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 2 [ 106.915331][ T5862] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 106.929740][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 4 [ 106.940336][ T23] qmi_wwan 4-1:1.0: cdc-wdm1: USB WDM device [ 106.959716][ T174] usb 3-1: probing VID:PID(0424:012C) [ 106.969129][ T5862] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 106.983704][ T174] usb 3-1: vub300 testing BULK IN EndPoint(0) 81 [ 106.993980][ T5862] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 6 [ 107.007943][ T174] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02 [ 107.019169][ T23] wwan wwan0: port wwan0qmi0 attached [ 107.026566][ T174] usb 3-1: vub300 testing BULK IN EndPoint(2) 83 [ 107.033000][ T174] usb 3-1: vub300 testing BULK OUT EndPoint(3) 04 [ 107.040348][ T5862] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 107.055522][ T174] usb 3-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 107.178067][ T23] qmi_wwan 4-1:1.0 wwan0: register 'qmi_wwan' at usb-dummy_hcd.3-1, WWAN/QMI device, f2:1f:96:a4:f0:3e [ 107.364763][ T23] usb 4-1: USB disconnect, device number 2 [ 107.410388][ T174] usb 3-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 107.424791][ T23] qmi_wwan 4-1:1.0 wwan0: unregister 'qmi_wwan' usb-dummy_hcd.3-1, WWAN/QMI device [ 107.595490][ T23] wwan wwan0: port wwan0qmi0 disconnected [ 107.611337][ T174] usb 3-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 107.789990][ T5862] usb 1-1: USB disconnect, device number 2 [ 107.833885][ T5862] Unregistered device Abilis Systems DVB-Titan [ 107.842280][ T5862] as10x_usb: device has been disconnected [ 108.090416][ T23] usb 2-1: USB disconnect, device number 2 [ 108.116877][ T23] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 108.172902][ T23] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 108.199584][ T23] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 108.221100][ T23] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 108.254918][ T23] keyspan 2-1:0.0: device disconnected [ 108.741501][ T8] usb 3-1: USB disconnect, device number 2 [ 108.753811][ T5862] usb 3-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 108.870357][ T8] USB vub300 remote SDIO host controller[0] now disconnected [ 108.917440][ T6195] "syz.0.92" (6195) uses obsolete ecb(arc4) skcipher [ 109.120718][ T6203] loop3: detected capacity change from 0 to 512 [ 109.181970][ T6204] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 109.219038][ T6203] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.234634][ T6203] ext4 filesystem being mounted at /29/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.469047][ C0] [ 109.471843][ C0] ============================= [ 109.476806][ C0] WARNING: suspicious RCU usage [ 109.481718][ C0] syzkaller #0 Not tainted [ 109.484105][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 109.486248][ C0] ----------------------------- [ 109.486275][ C0] kernel/sched/core.c:10174 Illegal context switch in RCU-sched read-side critical section! [ 109.486292][ C0] [ 109.486292][ C0] other info that might help us debug this: [ 109.486292][ C0] [ 109.486301][ C0] [ 109.486301][ C0] rcu_scheduler_active = 2, debug_locks = 1 [ 109.486315][ C0] 9 locks held by syz-executor/5773: [ 109.486329][ C0] #0: ffffffff8dfd44d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x298/0x1e30 [ 109.486398][ C0] #1: ffff888032190b20 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 109.486450][ C0] #2: ffff888018868b20 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 109.486506][ C0] #3: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 109.486560][ C0] #4: ffff888032099f78 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 109.486620][ C0] #5: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 109.486673][ C0] #6: ffff8880318af438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 109.486763][ C0] #7: ffffffff8df321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 109.486828][ C0] #8: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 109.486881][ C0] [ 109.486881][ C0] stack backtrace: [ 109.486889][ C0] CPU: 0 PID: 5773 Comm: syz-executor Not tainted syzkaller #0 [ 109.486906][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 109.486917][ C0] Call Trace: [ 109.486927][ C0] [ 109.486935][ C0] dump_stack_lvl+0x18c/0x250 [ 109.486957][ C0] ? show_regs_print_info+0x20/0x20 [ 109.486975][ C0] ? load_image+0x420/0x420 [ 109.487012][ C0] lockdep_rcu_suspicious+0x1e1/0x300 [ 109.487039][ C0] __might_resched+0x123/0x5f0 [ 109.487070][ C0] ? __might_sleep+0xe0/0xe0 [ 109.487092][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 109.487121][ C0] ? _raw_spin_unlock+0x40/0x40 [ 109.487143][ C0] ? kasan_set_track+0x5f/0x70 [ 109.487163][ C0] ? kasan_save_free_info+0x28/0x40 [ 109.487187][ C0] ? ____kasan_slab_free+0x126/0x1f0 [ 109.487210][ C0] ? slab_free_freelist_hook+0x130/0x1a0 [ 109.487242][ C0] __flush_work+0x10f/0xac0 [ 109.487270][ C0] ? flush_work+0x20/0x20 [ 109.487287][ C0] ? __timer_delete+0x6b/0x290 [ 109.487309][ C0] ? mark_lock+0x94/0x320 [ 109.487334][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 109.487356][ C0] ? mod_delayed_work_on+0x1c0/0x1c0 [ 109.487376][ C0] ? lock_chain_count+0x20/0x20 [ 109.487403][ C0] ? __cancel_work_timer+0x36e/0x560 [ 109.487429][ C0] __cancel_work_timer+0x3f8/0x560 [ 109.487454][ C0] ? cancel_work_sync+0x20/0x20 [ 109.487475][ C0] ? kobject_put+0x260/0x450 [ 109.487500][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 109.487536][ C0] ? kobject_put+0x421/0x450 [ 109.487568][ C0] mmc_free_host+0x19/0x40 [ 109.487589][ C0] call_timer_fn+0x189/0x540 [ 109.785870][ C0] ? kref_get+0x70/0x70 [ 109.790093][ C0] ? call_timer_fn+0xd2/0x540 [ 109.794793][ C0] ? __run_timers+0x810/0x810 [ 109.799525][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 109.804769][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 109.810025][ C0] ? kref_get+0x70/0x70 [ 109.814228][ C0] __run_timers+0x570/0x810 [ 109.818805][ C0] ? detach_timer+0x2b0/0x2b0 [ 109.823501][ C0] ? lock_chain_count+0x20/0x20 [ 109.828403][ C0] run_timer_softirq+0x67/0xf0 [ 109.833249][ C0] handle_softirqs+0x27d/0x820 [ 109.838081][ C0] ? read_tsc+0x9/0x20 [ 109.842182][ C0] ? ktime_get+0x24b/0x280 [ 109.846650][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 109.851468][ C0] ? do_softirq+0x1a0/0x1a0 [ 109.856024][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 109.861268][ C0] __irq_exit_rcu+0xd3/0x190 [ 109.865915][ C0] ? irq_exit_rcu+0x20/0x20 [ 109.870482][ C0] irq_exit_rcu+0x9/0x20 [ 109.874780][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 109.880495][ C0] [ 109.883479][ C0] [ 109.886461][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 109.892511][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 109.897826][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 109.917540][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 109.923655][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 109.931675][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 109.939695][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 109.947701][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 109.955712][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 109.963847][ C0] ? read_lock_is_recursive+0x20/0x20 [ 109.969265][ C0] ? page_ext_put+0x9c/0xb0 [ 109.973825][ C0] ? pfn_valid+0xcd/0x420 [ 109.978226][ C0] pfn_valid+0xe9/0x420 [ 109.982422][ C0] ? pfn_valid+0xcd/0x420 [ 109.986851][ C0] page_table_check_set+0x25/0x6e0 [ 109.992017][ C0] copy_page_range+0x24fc/0x3700 [ 109.997039][ C0] ? pfn_valid+0x450/0x450 [ 110.001524][ C0] ? copy_mm+0x1705/0x1e30 [ 110.005999][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 110.011085][ C0] ? down_write+0x16e/0x200 [ 110.015632][ C0] ? up_write+0x1be/0x410 [ 110.019988][ C0] copy_mm+0x1751/0x1e30 [ 110.024276][ C0] ? copy_signal+0x640/0x640 [ 110.028941][ C0] ? __init_rwsem+0x122/0x160 [ 110.033659][ C0] ? copy_signal+0x51f/0x640 [ 110.038302][ C0] copy_process+0x16c9/0x3da0 [ 110.043064][ C0] ? copy_process+0x98e/0x3da0 [ 110.047948][ C0] ? __pidfd_prepare+0x140/0x140 [ 110.052943][ C0] kernel_clone+0x24b/0x8a0 [ 110.057535][ C0] ? create_io_thread+0x190/0x190 [ 110.062612][ C0] ? __might_fault+0xaa/0x120 [ 110.067356][ C0] __x64_sys_clone+0x1b7/0x230 [ 110.072201][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 110.077311][ C0] ? lock_chain_count+0x20/0x20 [ 110.082213][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 110.087460][ C0] do_syscall_64+0x55/0xb0 [ 110.091913][ C0] ? clear_bhb_loop+0x40/0x90 [ 110.096611][ C0] ? clear_bhb_loop+0x40/0x90 [ 110.101313][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.107296][ C0] RIP: 0033:0x7f3293bc6fd2 [ 110.111777][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 110.131463][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 110.139928][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 110.147961][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 110.156006][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 110.164027][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 110.172068][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 110.180120][ C0] [ 110.183305][ C0] BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 [ 110.192424][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5773, name: syz-executor [ 110.201721][ C0] preempt_count: 103, expected: 0 [ 110.206858][ C0] RCU nest depth: 2, expected: 0 [ 110.211864][ C0] 9 locks held by syz-executor/5773: [ 110.217242][ C0] #0: ffffffff8dfd44d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x298/0x1e30 [ 110.226202][ C0] #1: ffff888032190b20 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 110.235346][ C0] #2: ffff888018868b20 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 110.244624][ C0] #3: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 110.254238][ C0] #4: ffff888032099f78 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 110.265010][ C0] #5: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 110.274692][ C0] #6: ffff8880318af438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 110.285269][ C0] #7: ffffffff8df321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 110.294866][ C0] #8: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 110.305454][ C0] Preemption disabled at: [ 110.305470][ C0] [<0000000000000000>] 0x0 [ 110.314345][ C0] CPU: 0 PID: 5773 Comm: syz-executor Not tainted syzkaller #0 [ 110.321929][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 110.332010][ C0] Call Trace: [ 110.335312][ C0] [ 110.338175][ C0] dump_stack_lvl+0x18c/0x250 [ 110.342882][ C0] ? show_regs_print_info+0x20/0x20 [ 110.348122][ C0] ? load_image+0x420/0x420 [ 110.352691][ C0] __might_resched+0x48d/0x5f0 [ 110.357553][ C0] ? __might_sleep+0xe0/0xe0 [ 110.362256][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 110.368214][ C0] ? _raw_spin_unlock+0x40/0x40 [ 110.373117][ C0] ? kasan_set_track+0x5f/0x70 [ 110.377938][ C0] ? kasan_save_free_info+0x28/0x40 [ 110.383232][ C0] ? ____kasan_slab_free+0x126/0x1f0 [ 110.388581][ C0] ? slab_free_freelist_hook+0x130/0x1a0 [ 110.394295][ C0] __flush_work+0x10f/0xac0 [ 110.398884][ C0] ? flush_work+0x20/0x20 [ 110.403238][ C0] ? __timer_delete+0x6b/0x290 [ 110.408049][ C0] ? mark_lock+0x94/0x320 [ 110.412433][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 110.418473][ C0] ? mod_delayed_work_on+0x1c0/0x1c0 [ 110.423785][ C0] ? lock_chain_count+0x20/0x20 [ 110.428696][ C0] ? __cancel_work_timer+0x36e/0x560 [ 110.434030][ C0] __cancel_work_timer+0x3f8/0x560 [ 110.439169][ C0] ? cancel_work_sync+0x20/0x20 [ 110.444039][ C0] ? kobject_put+0x260/0x450 [ 110.448652][ C0] ? __kmem_cache_free+0xba/0x1f0 [ 110.453725][ C0] ? kobject_put+0x421/0x450 [ 110.458371][ C0] mmc_free_host+0x19/0x40 [ 110.462828][ C0] call_timer_fn+0x189/0x540 [ 110.467479][ C0] ? kref_get+0x70/0x70 [ 110.471709][ C0] ? call_timer_fn+0xd2/0x540 [ 110.476447][ C0] ? __run_timers+0x810/0x810 [ 110.481163][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 110.486406][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 110.491663][ C0] ? kref_get+0x70/0x70 [ 110.495865][ C0] __run_timers+0x570/0x810 [ 110.500407][ C0] ? detach_timer+0x2b0/0x2b0 [ 110.505120][ C0] ? lock_chain_count+0x20/0x20 [ 110.510019][ C0] run_timer_softirq+0x67/0xf0 [ 110.514849][ C0] handle_softirqs+0x27d/0x820 [ 110.519631][ C0] ? read_tsc+0x9/0x20 [ 110.523744][ C0] ? ktime_get+0x24b/0x280 [ 110.528201][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 110.533038][ C0] ? do_softirq+0x1a0/0x1a0 [ 110.537570][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 110.542797][ C0] __irq_exit_rcu+0xd3/0x190 [ 110.547449][ C0] ? irq_exit_rcu+0x20/0x20 [ 110.551991][ C0] irq_exit_rcu+0x9/0x20 [ 110.556274][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 110.561986][ C0] [ 110.564948][ C0] [ 110.567929][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 110.573957][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 110.579299][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 110.598930][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 110.605049][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 110.613159][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 110.621150][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 110.629147][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 110.637166][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 110.645226][ C0] ? read_lock_is_recursive+0x20/0x20 [ 110.650654][ C0] ? page_ext_put+0x9c/0xb0 [ 110.655180][ C0] ? pfn_valid+0xcd/0x420 [ 110.659555][ C0] pfn_valid+0xe9/0x420 [ 110.663737][ C0] ? pfn_valid+0xcd/0x420 [ 110.668117][ C0] page_table_check_set+0x25/0x6e0 [ 110.673283][ C0] copy_page_range+0x24fc/0x3700 [ 110.678285][ C0] ? pfn_valid+0x450/0x450 [ 110.682765][ C0] ? copy_mm+0x1705/0x1e30 [ 110.687248][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 110.692338][ C0] ? down_write+0x16e/0x200 [ 110.696890][ C0] ? up_write+0x1be/0x410 [ 110.701274][ C0] copy_mm+0x1751/0x1e30 [ 110.705563][ C0] ? copy_signal+0x640/0x640 [ 110.710207][ C0] ? __init_rwsem+0x122/0x160 [ 110.714907][ C0] ? copy_signal+0x51f/0x640 [ 110.719553][ C0] copy_process+0x16c9/0x3da0 [ 110.724284][ C0] ? copy_process+0x98e/0x3da0 [ 110.729099][ C0] ? __pidfd_prepare+0x140/0x140 [ 110.734117][ C0] kernel_clone+0x24b/0x8a0 [ 110.738671][ C0] ? create_io_thread+0x190/0x190 [ 110.743723][ C0] ? __might_fault+0xaa/0x120 [ 110.748451][ C0] __x64_sys_clone+0x1b7/0x230 [ 110.753285][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 110.758427][ C0] ? lock_chain_count+0x20/0x20 [ 110.763330][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 110.768590][ C0] do_syscall_64+0x55/0xb0 [ 110.773057][ C0] ? clear_bhb_loop+0x40/0x90 [ 110.777796][ C0] ? clear_bhb_loop+0x40/0x90 [ 110.782529][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 110.788492][ C0] RIP: 0033:0x7f3293bc6fd2 [ 110.792952][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 110.812615][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 110.821058][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 110.829081][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 110.837089][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 110.845098][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 110.853121][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 110.861128][ C0] [ 110.864545][ C0] [ 110.866925][ C0] ============================= [ 110.871817][ C0] WARNING: suspicious RCU usage [ 110.876753][ C0] syzkaller #0 Tainted: G W [ 110.882696][ C0] ----------------------------- [ 110.887654][ C0] kernel/rcu/srcutree.c:1377 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 110.899721][ C0] [ 110.899721][ C0] other info that might help us debug this: [ 110.899721][ C0] [ 110.910056][ C0] [ 110.910056][ C0] rcu_scheduler_active = 2, debug_locks = 1 [ 110.918237][ C0] 9 locks held by syz-executor/5773: [ 110.923562][ C0] #0: ffffffff8dfd44d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x298/0x1e30 [ 110.932462][ C0] #1: ffff888032190b20 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 110.941535][ C0] #2: ffff888018868b20 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 110.950807][ C0] #3: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 110.960411][ C0] #4: ffff888032099f78 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 110.971147][ C0] #5: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 110.980751][ C0] #6: ffff8880318af438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 110.991224][ C0] #7: ffffffff8df321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 111.000773][ C0] #8: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 111.011338][ C0] [ 111.011338][ C0] stack backtrace: [ 111.017316][ C0] CPU: 0 PID: 5773 Comm: syz-executor Tainted: G W syzkaller #0 [ 111.026470][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 111.036561][ C0] Call Trace: [ 111.039878][ C0] [ 111.042747][ C0] dump_stack_lvl+0x18c/0x250 [ 111.047449][ C0] ? show_regs_print_info+0x20/0x20 [ 111.052694][ C0] ? load_image+0x420/0x420 [ 111.057283][ C0] lockdep_rcu_suspicious+0x1e1/0x300 [ 111.062735][ C0] __synchronize_srcu+0x150/0x3d0 [ 111.067820][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 111.073783][ C0] ? synchronize_srcu_expedited+0x20/0x20 [ 111.079576][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 111.085525][ C0] ? _raw_spin_unlock+0x40/0x40 [ 111.090425][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 111.096362][ C0] ? read_tsc+0x9/0x20 [ 111.100474][ C0] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 111.106050][ C0] ? synchronize_srcu+0x25a/0x280 [ 111.111100][ C0] wakeup_source_unregister+0x116/0x190 [ 111.116688][ C0] mmc_host_classdev_release+0x47/0x100 [ 111.122292][ C0] ? mmc_free_host+0x40/0x40 [ 111.126903][ C0] device_release+0xbc/0x1e0 [ 111.131522][ C0] kobject_put+0x21b/0x450 [ 111.135986][ C0] call_timer_fn+0x189/0x540 [ 111.140656][ C0] ? kref_get+0x70/0x70 [ 111.144838][ C0] ? call_timer_fn+0xd2/0x540 [ 111.149539][ C0] ? __run_timers+0x810/0x810 [ 111.154256][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 111.159526][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 111.164772][ C0] ? kref_get+0x70/0x70 [ 111.168982][ C0] __run_timers+0x570/0x810 [ 111.173517][ C0] ? detach_timer+0x2b0/0x2b0 [ 111.178236][ C0] ? lock_chain_count+0x20/0x20 [ 111.183141][ C0] run_timer_softirq+0x67/0xf0 [ 111.187934][ C0] handle_softirqs+0x27d/0x820 [ 111.192750][ C0] ? read_tsc+0x9/0x20 [ 111.196848][ C0] ? ktime_get+0x24b/0x280 [ 111.201317][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 111.206119][ C0] ? do_softirq+0x1a0/0x1a0 [ 111.210642][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 111.215912][ C0] __irq_exit_rcu+0xd3/0x190 [ 111.220542][ C0] ? irq_exit_rcu+0x20/0x20 [ 111.225085][ C0] irq_exit_rcu+0x9/0x20 [ 111.229369][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 111.235043][ C0] [ 111.238008][ C0] [ 111.240957][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 111.246962][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 111.252287][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 111.271946][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 111.278051][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 111.286044][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 111.294048][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 111.302056][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 111.310052][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 111.318076][ C0] ? read_lock_is_recursive+0x20/0x20 [ 111.323479][ C0] ? page_ext_put+0x9c/0xb0 [ 111.328024][ C0] ? pfn_valid+0xcd/0x420 [ 111.332417][ C0] pfn_valid+0xe9/0x420 [ 111.336608][ C0] ? pfn_valid+0xcd/0x420 [ 111.340995][ C0] page_table_check_set+0x25/0x6e0 [ 111.346201][ C0] copy_page_range+0x24fc/0x3700 [ 111.351221][ C0] ? pfn_valid+0x450/0x450 [ 111.355686][ C0] ? copy_mm+0x1705/0x1e30 [ 111.360148][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 111.365198][ C0] ? down_write+0x16e/0x200 [ 111.369753][ C0] ? up_write+0x1be/0x410 [ 111.374183][ C0] copy_mm+0x1751/0x1e30 [ 111.378519][ C0] ? copy_signal+0x640/0x640 [ 111.383195][ C0] ? __init_rwsem+0x122/0x160 [ 111.387919][ C0] ? copy_signal+0x51f/0x640 [ 111.392550][ C0] copy_process+0x16c9/0x3da0 [ 111.397322][ C0] ? copy_process+0x98e/0x3da0 [ 111.402158][ C0] ? __pidfd_prepare+0x140/0x140 [ 111.407145][ C0] kernel_clone+0x24b/0x8a0 [ 111.411700][ C0] ? create_io_thread+0x190/0x190 [ 111.416887][ C0] ? __might_fault+0xaa/0x120 [ 111.421612][ C0] __x64_sys_clone+0x1b7/0x230 [ 111.426405][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 111.431485][ C0] ? lock_chain_count+0x20/0x20 [ 111.436385][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 111.441636][ C0] do_syscall_64+0x55/0xb0 [ 111.446118][ C0] ? clear_bhb_loop+0x40/0x90 [ 111.450831][ C0] ? clear_bhb_loop+0x40/0x90 [ 111.455545][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 111.461494][ C0] RIP: 0033:0x7f3293bc6fd2 [ 111.465927][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 111.485572][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 111.494053][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 111.502062][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 111.510068][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 111.518065][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 111.526077][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 111.534091][ C0] [ 111.537243][ C0] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1381 [ 111.546667][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5773, name: syz-executor [ 111.555987][ C0] preempt_count: 103, expected: 0 [ 111.561075][ C0] RCU nest depth: 2, expected: 0 [ 111.566107][ C0] 9 locks held by syz-executor/5773: [ 111.571447][ C0] #0: ffffffff8dfd44d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x298/0x1e30 [ 111.580409][ C0] #1: ffff888032190b20 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 111.589537][ C0] #2: ffff888018868b20 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 111.598843][ C0] #3: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 111.608460][ C0] #4: ffff888032099f78 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 111.619193][ C0] #5: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 111.628892][ C0] #6: ffff8880318af438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 111.639483][ C0] #7: ffffffff8df321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 111.649030][ C0] #8: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 111.659575][ C0] Preemption disabled at: [ 111.659591][ C0] [<0000000000000000>] 0x0 [ 111.668413][ C0] CPU: 0 PID: 5773 Comm: syz-executor Tainted: G W syzkaller #0 [ 111.677471][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 111.687567][ C0] Call Trace: [ 111.690885][ C0] [ 111.693771][ C0] dump_stack_lvl+0x18c/0x250 [ 111.698484][ C0] ? show_regs_print_info+0x20/0x20 [ 111.703708][ C0] ? load_image+0x420/0x420 [ 111.708270][ C0] __might_resched+0x48d/0x5f0 [ 111.713099][ C0] ? show_regs_print_info+0x20/0x20 [ 111.718352][ C0] ? __might_sleep+0xe0/0xe0 [ 111.722995][ C0] __synchronize_srcu+0x197/0x3d0 [ 111.728051][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 111.733975][ C0] ? synchronize_srcu_expedited+0x20/0x20 [ 111.739729][ C0] ? read_tsc+0x9/0x20 [ 111.743831][ C0] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 111.749402][ C0] ? synchronize_srcu+0x25a/0x280 [ 111.754468][ C0] wakeup_source_unregister+0x116/0x190 [ 111.760059][ C0] mmc_host_classdev_release+0x47/0x100 [ 111.765623][ C0] ? mmc_free_host+0x40/0x40 [ 111.770251][ C0] device_release+0xbc/0x1e0 [ 111.774884][ C0] kobject_put+0x21b/0x450 [ 111.779362][ C0] call_timer_fn+0x189/0x540 [ 111.783970][ C0] ? kref_get+0x70/0x70 [ 111.788266][ C0] ? call_timer_fn+0xd2/0x540 [ 111.792995][ C0] ? __run_timers+0x810/0x810 [ 111.797738][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 111.803099][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 111.808335][ C0] ? kref_get+0x70/0x70 [ 111.812531][ C0] __run_timers+0x570/0x810 [ 111.817089][ C0] ? detach_timer+0x2b0/0x2b0 [ 111.821821][ C0] ? lock_chain_count+0x20/0x20 [ 111.826698][ C0] run_timer_softirq+0x67/0xf0 [ 111.831514][ C0] handle_softirqs+0x27d/0x820 [ 111.836335][ C0] ? read_tsc+0x9/0x20 [ 111.840461][ C0] ? ktime_get+0x24b/0x280 [ 111.844902][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 111.849725][ C0] ? do_softirq+0x1a0/0x1a0 [ 111.854275][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 111.859543][ C0] __irq_exit_rcu+0xd3/0x190 [ 111.864195][ C0] ? irq_exit_rcu+0x20/0x20 [ 111.868799][ C0] irq_exit_rcu+0x9/0x20 [ 111.873106][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 111.878820][ C0] [ 111.881799][ C0] [ 111.884861][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 111.890910][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 111.896259][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 111.915933][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 111.922026][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 111.930025][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 111.938051][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 111.946068][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 111.954098][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 111.962120][ C0] ? read_lock_is_recursive+0x20/0x20 [ 111.967546][ C0] ? page_ext_put+0x9c/0xb0 [ 111.972108][ C0] ? pfn_valid+0xcd/0x420 [ 111.976467][ C0] pfn_valid+0xe9/0x420 [ 111.980649][ C0] ? pfn_valid+0xcd/0x420 [ 111.985026][ C0] page_table_check_set+0x25/0x6e0 [ 111.990216][ C0] copy_page_range+0x24fc/0x3700 [ 111.995236][ C0] ? pfn_valid+0x450/0x450 [ 111.999701][ C0] ? copy_mm+0x1705/0x1e30 [ 112.004197][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 112.009280][ C0] ? down_write+0x16e/0x200 [ 112.013834][ C0] ? up_write+0x1be/0x410 [ 112.018189][ C0] copy_mm+0x1751/0x1e30 [ 112.022466][ C0] ? copy_signal+0x640/0x640 [ 112.027126][ C0] ? __init_rwsem+0x122/0x160 [ 112.031866][ C0] ? copy_signal+0x51f/0x640 [ 112.036499][ C0] copy_process+0x16c9/0x3da0 [ 112.041255][ C0] ? copy_process+0x98e/0x3da0 [ 112.046092][ C0] ? __pidfd_prepare+0x140/0x140 [ 112.051107][ C0] kernel_clone+0x24b/0x8a0 [ 112.055661][ C0] ? create_io_thread+0x190/0x190 [ 112.060718][ C0] ? __might_fault+0xaa/0x120 [ 112.065442][ C0] __x64_sys_clone+0x1b7/0x230 [ 112.070257][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 112.075312][ C0] ? lock_chain_count+0x20/0x20 [ 112.080237][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 112.085528][ C0] do_syscall_64+0x55/0xb0 [ 112.089995][ C0] ? clear_bhb_loop+0x40/0x90 [ 112.094712][ C0] ? clear_bhb_loop+0x40/0x90 [ 112.099462][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.105429][ C0] RIP: 0033:0x7f3293bc6fd2 [ 112.109887][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 112.129554][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 112.138022][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 112.146062][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 112.154128][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 112.162159][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 112.170154][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 112.178164][ C0] [ 112.181269][ C0] ODEBUG: object ffffc900000079c0 is NOT on stack ffffc90004418000, but annotated. [ 112.182939][ C0] [ 112.182946][ C0] ====================================================== [ 112.182952][ C0] WARNING: possible circular locking dependency detected [ 112.182961][ C0] syzkaller #0 Tainted: G W [ 112.182972][ C0] ------------------------------------------------------ [ 112.182978][ C0] syz-executor/5773 is trying to acquire lock: [ 112.182989][ C0] ffffffff8df263e0 (console_owner){..-.}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 112.183052][ C0] [ 112.183052][ C0] but task is already holding lock: [ 112.183057][ C0] ffffffff98350bf0 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0x5c/0x450 [ 112.183108][ C0] [ 112.183108][ C0] which lock already depends on the new lock. [ 112.183108][ C0] [ 112.183114][ C0] [ 112.183114][ C0] the existing dependency chain (in reverse order) is: [ 112.183120][ C0] [ 112.183120][ C0] -> #4 (&obj_hash[i].lock){-.-.}-{2:2}: [ 112.183145][ C0] _raw_spin_lock_irqsave+0xb4/0x100 [ 112.183173][ C0] debug_object_activate+0x6c/0x500 [ 112.183198][ C0] insert_work+0x35/0x310 [ 112.183219][ C0] __queue_work+0xbfd/0xfd0 [ 112.183236][ C0] queue_work_on+0x128/0x1f0 [ 112.183253][ C0] start_poll_synchronize_rcu_expedited+0x105/0x140 [ 112.183285][ C0] rcu_init+0x10d/0x160 [ 112.183307][ C0] start_kernel+0x1fd/0x4e0 [ 112.183327][ C0] x86_64_start_reservations+0x2a/0x30 [ 112.183346][ C0] copy_bootdata+0x0/0xd0 [ 112.183363][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 112.183388][ C0] [ 112.183388][ C0] -> #3 (&pool->lock){-.-.}-{2:2}: [ 112.183414][ C0] _raw_spin_lock+0x2e/0x40 [ 112.183439][ C0] __queue_work+0x72f/0xfd0 [ 112.183457][ C0] queue_work_on+0x128/0x1f0 [ 112.183475][ C0] rpm_suspend+0x1133/0x1b60 [ 112.183491][ C0] __pm_runtime_idle+0x12f/0x1a0 [ 112.183507][ C0] __device_attach+0x352/0x420 [ 112.183526][ C0] bus_probe_device+0x180/0x260 [ 112.183554][ C0] device_add+0x87c/0xc40 [ 112.183586][ C0] serial_base_port_add+0x2f6/0x430 [ 112.183608][ C0] serial_core_register_port+0x378/0x20b0 [ 112.183628][ C0] serial8250_register_8250_port+0x15fd/0x1f40 [ 112.183653][ C0] serial_pnp_probe+0x577/0x750 [ 112.183677][ C0] pnp_device_probe+0x305/0x4b0 [ 112.183702][ C0] really_probe+0x247/0xae0 [ 112.183720][ C0] __driver_probe_device+0x1f5/0x390 [ 112.183740][ C0] driver_probe_device+0x4f/0x420 [ 112.183759][ C0] __driver_attach+0x444/0x6d0 [ 112.183777][ C0] bus_for_each_dev+0x235/0x2b0 [ 112.183805][ C0] bus_add_driver+0x340/0x630 [ 112.183832][ C0] driver_register+0x23a/0x310 [ 112.183852][ C0] serial8250_init+0x9a/0x170 [ 112.183871][ C0] do_one_initcall+0x242/0x790 [ 112.183895][ C0] do_initcall_level+0x13d/0x1f0 [ 112.183916][ C0] do_initcalls+0x69/0xd0 [ 112.183936][ C0] kernel_init_freeable+0x3d9/0x560 [ 112.183957][ C0] kernel_init+0x1d/0x1c0 [ 112.183980][ C0] ret_from_fork+0x48/0x80 [ 112.184003][ C0] ret_from_fork_asm+0x11/0x20 [ 112.184027][ C0] [ 112.184027][ C0] -> #2 (&dev->power.lock){-...}-{2:2}: [ 112.184054][ C0] _raw_spin_lock_irqsave+0xb4/0x100 [ 112.184080][ C0] __pm_runtime_resume+0x10f/0x170 [ 112.184097][ C0] __uart_start+0x171/0x3e0 [ 112.184115][ C0] uart_write+0x449/0x5d0 [ 112.184134][ C0] n_tty_write+0xd3d/0x11e0 [ 112.184164][ C0] file_tty_write+0x529/0x960 [ 112.184187][ C0] vfs_write+0x474/0x9a0 [ 112.184212][ C0] ksys_write+0x151/0x260 [ 112.184235][ C0] do_syscall_64+0x55/0xb0 [ 112.184251][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.184279][ C0] [ 112.184279][ C0] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 112.184303][ C0] _raw_spin_lock_irqsave+0xb4/0x100 [ 112.184328][ C0] serial8250_console_write+0x181/0x18b0 [ 112.184356][ C0] console_flush_all+0x6ad/0xcf0 [ 112.184380][ C0] console_unlock+0xad/0x350 [ 112.184402][ C0] vprintk_emit+0x497/0x610 [ 112.184424][ C0] _printk+0xde/0x130 [ 112.184447][ C0] register_console+0xb96/0xf00 [ 112.184471][ C0] univ8250_console_init+0x45/0x50 [ 112.184490][ C0] console_init+0x17b/0x5d0 [ 112.184511][ C0] start_kernel+0x2c8/0x4e0 [ 112.184531][ C0] x86_64_start_reservations+0x2a/0x30 [ 112.184549][ C0] copy_bootdata+0x0/0xd0 [ 112.184566][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 112.184601][ C0] [ 112.184601][ C0] -> #0 (console_owner){..-.}-{0:0}: [ 112.184627][ C0] __lock_acquire+0x3a07/0x7eb0 [ 112.184649][ C0] lock_acquire+0x19e/0x420 [ 112.184670][ C0] console_flush_all+0x676/0xcf0 [ 112.184693][ C0] console_unlock+0xad/0x350 [ 112.184715][ C0] vprintk_emit+0x497/0x610 [ 112.184737][ C0] _printk+0xde/0x130 [ 112.184759][ C0] __debug_object_init+0x18d/0x450 [ 112.184785][ C0] __synchronize_srcu+0x2ae/0x3d0 [ 112.184809][ C0] wakeup_source_unregister+0x116/0x190 [ 112.184832][ C0] mmc_host_classdev_release+0x47/0x100 [ 112.184851][ C0] device_release+0xbc/0x1e0 [ 112.184877][ C0] kobject_put+0x21b/0x450 [ 112.184898][ C0] call_timer_fn+0x189/0x540 [ 112.184917][ C0] __run_timers+0x570/0x810 [ 112.184935][ C0] run_timer_softirq+0x67/0xf0 [ 112.184952][ C0] handle_softirqs+0x27d/0x820 [ 112.184970][ C0] __irq_exit_rcu+0xd3/0x190 [ 112.184988][ C0] irq_exit_rcu+0x9/0x20 [ 112.185005][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 112.185028][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 112.185047][ C0] lock_acquire+0x208/0x420 [ 112.185066][ C0] pfn_valid+0xe9/0x420 [ 112.185090][ C0] page_table_check_set+0x25/0x6e0 [ 112.185113][ C0] copy_page_range+0x24fc/0x3700 [ 112.185141][ C0] copy_mm+0x1751/0x1e30 [ 112.185158][ C0] copy_process+0x16c9/0x3da0 [ 112.185177][ C0] kernel_clone+0x24b/0x8a0 [ 112.185197][ C0] __x64_sys_clone+0x1b7/0x230 [ 112.185218][ C0] do_syscall_64+0x55/0xb0 [ 112.185234][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.185265][ C0] [ 112.185265][ C0] other info that might help us debug this: [ 112.185265][ C0] [ 112.185270][ C0] Chain exists of: [ 112.185270][ C0] console_owner --> &pool->lock --> &obj_hash[i].lock [ 112.185270][ C0] [ 112.185299][ C0] Possible unsafe locking scenario: [ 112.185299][ C0] [ 112.185303][ C0] CPU0 CPU1 [ 112.185307][ C0] ---- ---- [ 112.185312][ C0] lock(&obj_hash[i].lock); [ 112.185323][ C0] lock(&pool->lock); [ 112.185335][ C0] lock(&obj_hash[i].lock); [ 112.185347][ C0] lock(console_owner); [ 112.185358][ C0] [ 112.185358][ C0] *** DEADLOCK *** [ 112.185358][ C0] [ 112.185361][ C0] 12 locks held by syz-executor/5773: [ 112.185374][ C0] #0: ffffffff8dfd44d0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x298/0x1e30 [ 112.185423][ C0] #1: ffff888032190b20 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 112.185470][ C0] #2: ffff888018868b20 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 112.185521][ C0] #3: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 112.185569][ C0] #4: ffff888032099f78 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 112.185629][ C0] #5: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 112.185675][ C0] #6: ffff8880318af438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 112.185739][ C0] #7: ffffffff8df321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 112.185789][ C0] #8: ffffc90000007be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 112.185836][ C0] #9: ffffffff98350bf0 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0x5c/0x450 [ 112.185888][ C0] #10: ffffffff8df264c0 (console_lock){+.+.}-{0:0}, at: _printk+0xde/0x130 [ 112.185939][ C0] #11: ffffffff8de0dcd0 (console_srcu){....}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 112.185991][ C0] [ 112.185991][ C0] stack backtrace: [ 112.185998][ C0] CPU: 0 PID: 5773 Comm: syz-executor Tainted: G W syzkaller #0 [ 112.186018][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 112.186029][ C0] Call Trace: [ 112.186037][ C0] [ 112.186046][ C0] dump_stack_lvl+0x18c/0x250 [ 112.186066][ C0] ? load_image+0x420/0x420 [ 112.186093][ C0] ? show_regs_print_info+0x20/0x20 [ 112.186117][ C0] ? print_circular_bug+0x12b/0x1a0 [ 112.186144][ C0] check_noncircular+0x2fc/0x400 [ 112.186174][ C0] ? print_deadlock_bug+0x5d0/0x5d0 [ 112.186198][ C0] ? lockdep_lock+0xf5/0x230 [ 112.186228][ C0] __lock_acquire+0x3a07/0x7eb0 [ 112.186265][ C0] ? verify_lock_unused+0x140/0x140 [ 112.186300][ C0] lock_acquire+0x19e/0x420 [ 112.186323][ C0] ? console_flush_all+0x10b/0xcf0 [ 112.186352][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 112.186375][ C0] ? do_raw_spin_lock+0x11f/0x2b0 [ 112.186402][ C0] ? read_lock_is_recursive+0x20/0x20 [ 112.186427][ C0] ? __rwlock_init+0x150/0x150 [ 112.186455][ C0] ? do_raw_spin_unlock+0x121/0x230 [ 112.186484][ C0] console_flush_all+0x676/0xcf0 [ 112.186510][ C0] ? console_flush_all+0x10b/0xcf0 [ 112.186537][ C0] ? console_flush_all+0x10b/0xcf0 [ 112.186568][ C0] ? is_console_locked+0x20/0x20 [ 112.186608][ C0] console_unlock+0xad/0x350 [ 112.186634][ C0] ? other_cpu_in_panic+0xf0/0xf0 [ 112.186666][ C0] vprintk_emit+0x497/0x610 [ 112.186692][ C0] ? printk_sprint+0x460/0x460 [ 112.186720][ C0] ? do_raw_spin_lock+0x11f/0x2b0 [ 112.186750][ C0] _printk+0xde/0x130 [ 112.186779][ C0] ? load_image+0x420/0x420 [ 112.186805][ C0] ? alloc_object+0x1c/0x640 [ 112.186837][ C0] __debug_object_init+0x18d/0x450 [ 112.186869][ C0] __synchronize_srcu+0x2ae/0x3d0 [ 112.186897][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 112.186926][ C0] ? synchronize_srcu_expedited+0x20/0x20 [ 112.186959][ C0] ? read_tsc+0x9/0x20 [ 112.186980][ C0] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 112.187007][ C0] ? synchronize_srcu+0x25a/0x280 [ 112.187035][ C0] wakeup_source_unregister+0x116/0x190 [ 112.187062][ C0] mmc_host_classdev_release+0x47/0x100 [ 112.187085][ C0] ? mmc_free_host+0x40/0x40 [ 112.187103][ C0] device_release+0xbc/0x1e0 [ 112.187133][ C0] kobject_put+0x21b/0x450 [ 112.187161][ C0] call_timer_fn+0x189/0x540 [ 112.187181][ C0] ? kref_get+0x70/0x70 [ 112.187201][ C0] ? call_timer_fn+0xd2/0x540 [ 112.187222][ C0] ? __run_timers+0x810/0x810 [ 112.187247][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 112.187275][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 112.187299][ C0] ? kref_get+0x70/0x70 [ 112.187320][ C0] __run_timers+0x570/0x810 [ 112.187349][ C0] ? detach_timer+0x2b0/0x2b0 [ 112.187373][ C0] ? lock_chain_count+0x20/0x20 [ 112.187400][ C0] run_timer_softirq+0x67/0xf0 [ 112.187420][ C0] handle_softirqs+0x27d/0x820 [ 112.187440][ C0] ? read_tsc+0x9/0x20 [ 112.187462][ C0] ? ktime_get+0x24b/0x280 [ 112.187486][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 112.187509][ C0] ? do_softirq+0x1a0/0x1a0 [ 112.187531][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 112.187559][ C0] __irq_exit_rcu+0xd3/0x190 [ 112.187587][ C0] ? irq_exit_rcu+0x20/0x20 [ 112.187612][ C0] irq_exit_rcu+0x9/0x20 [ 112.187631][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 112.187657][ C0] [ 112.187663][ C0] [ 112.187670][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 112.187692][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 112.187719][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 112.187736][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 112.187754][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 112.187768][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 112.187782][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 112.187797][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 112.187811][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 112.187838][ C0] ? read_lock_is_recursive+0x20/0x20 [ 112.187866][ C0] ? page_ext_put+0x9c/0xb0 [ 112.187891][ C0] ? pfn_valid+0xcd/0x420 [ 112.187917][ C0] pfn_valid+0xe9/0x420 [ 112.187942][ C0] ? pfn_valid+0xcd/0x420 [ 112.187968][ C0] page_table_check_set+0x25/0x6e0 [ 112.187998][ C0] copy_page_range+0x24fc/0x3700 [ 112.188049][ C0] ? pfn_valid+0x450/0x450 [ 112.188081][ C0] ? copy_mm+0x1705/0x1e30 [ 112.188103][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 112.188128][ C0] ? down_write+0x16e/0x200 [ 112.188156][ C0] ? up_write+0x1be/0x410 [ 112.188177][ C0] copy_mm+0x1751/0x1e30 [ 112.188207][ C0] ? copy_signal+0x640/0x640 [ 112.188239][ C0] ? __init_rwsem+0x122/0x160 [ 112.188260][ C0] ? copy_signal+0x51f/0x640 [ 112.188282][ C0] copy_process+0x16c9/0x3da0 [ 112.188312][ C0] ? copy_process+0x98e/0x3da0 [ 112.188342][ C0] ? __pidfd_prepare+0x140/0x140 [ 112.188370][ C0] kernel_clone+0x24b/0x8a0 [ 112.188397][ C0] ? create_io_thread+0x190/0x190 [ 112.188424][ C0] ? __might_fault+0xaa/0x120 [ 112.188449][ C0] __x64_sys_clone+0x1b7/0x230 [ 112.188474][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 112.188505][ C0] ? lock_chain_count+0x20/0x20 [ 112.188531][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 112.188556][ C0] do_syscall_64+0x55/0xb0 [ 112.188581][ C0] ? clear_bhb_loop+0x40/0x90 [ 112.188600][ C0] ? clear_bhb_loop+0x40/0x90 [ 112.188621][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 112.188652][ C0] RIP: 0033:0x7f3293bc6fd2 [ 112.188670][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 112.188686][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 112.188706][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 112.188721][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 112.188733][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 112.188745][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 112.188757][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 112.188779][ C0] [ 113.631461][ C0] ------------[ cut here ]------------ [ 113.636972][ C0] WARNING: CPU: 0 PID: 5773 at lib/debugobjects.c:558 __debug_object_init+0x18d/0x450 [ 113.646598][ C0] Modules linked in: [ 113.650514][ C0] CPU: 0 PID: 5773 Comm: syz-executor Tainted: G W syzkaller #0 [ 113.659552][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 113.669621][ C0] RIP: 0010:__debug_object_init+0x18d/0x450 [ 113.675537][ C0] Code: 24 08 74 2f 41 ff c6 44 89 35 af 1b 05 14 48 c7 c1 00 5a 1d 8b 48 c7 c7 60 5a 1d 8b 84 c0 48 0f 45 f9 48 89 de e8 73 bf 4b 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f [ 113.695153][ C0] RSP: 0018:ffffc90000007928 EFLAGS: 00010046 [ 113.701233][ C0] RAX: 0000000000000050 RBX: ffffc900000079c0 RCX: 0cfcda5b4c7a8700 [ 113.709213][ C0] RDX: 0000000000000100 RSI: 0000000000000104 RDI: 0000000000000000 [ 113.717195][ C0] RBP: dffffc0000000000 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 113.725197][ C0] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff888078735a20 [ 113.733201][ C0] R13: ffff888030e82d20 R14: 0000000000000001 R15: ffffffff8acbe300 [ 113.741209][ C0] FS: 000055556095b500(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 113.750155][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.756753][ C0] CR2: 00005555864d0a38 CR3: 0000000061c42000 CR4: 00000000003506f0 [ 113.764756][ C0] Call Trace: [ 113.768071][ C0] [ 113.770928][ C0] __synchronize_srcu+0x2ae/0x3d0 [ 113.775974][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 113.781948][ C0] ? synchronize_srcu_expedited+0x20/0x20 [ 113.787697][ C0] ? read_tsc+0x9/0x20 [ 113.791784][ C0] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 113.797380][ C0] ? synchronize_srcu+0x25a/0x280 [ 113.802431][ C0] wakeup_source_unregister+0x116/0x190 [ 113.808026][ C0] mmc_host_classdev_release+0x47/0x100 [ 113.813592][ C0] ? mmc_free_host+0x40/0x40 [ 113.818197][ C0] device_release+0xbc/0x1e0 [ 113.822807][ C0] kobject_put+0x21b/0x450 [ 113.827272][ C0] call_timer_fn+0x189/0x540 [ 113.831900][ C0] ? kref_get+0x70/0x70 [ 113.836082][ C0] ? call_timer_fn+0xd2/0x540 [ 113.840805][ C0] ? __run_timers+0x810/0x810 [ 113.845528][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.850761][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 113.855976][ C0] ? kref_get+0x70/0x70 [ 113.860148][ C0] __run_timers+0x570/0x810 [ 113.864684][ C0] ? detach_timer+0x2b0/0x2b0 [ 113.869488][ C0] ? lock_chain_count+0x20/0x20 [ 113.874388][ C0] run_timer_softirq+0x67/0xf0 [ 113.879186][ C0] handle_softirqs+0x27d/0x820 [ 113.883964][ C0] ? read_tsc+0x9/0x20 [ 113.888052][ C0] ? ktime_get+0x24b/0x280 [ 113.892483][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 113.897280][ C0] ? do_softirq+0x1a0/0x1a0 [ 113.901822][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 113.907057][ C0] __irq_exit_rcu+0xd3/0x190 [ 113.911662][ C0] ? irq_exit_rcu+0x20/0x20 [ 113.916181][ C0] irq_exit_rcu+0x9/0x20 [ 113.920439][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 113.926115][ C0] [ 113.929054][ C0] [ 113.931995][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 113.937997][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 113.943323][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 113.962976][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 113.969066][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 113.977063][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 113.985072][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 113.993084][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 114.001068][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 114.009071][ C0] ? read_lock_is_recursive+0x20/0x20 [ 114.014462][ C0] ? page_ext_put+0x9c/0xb0 [ 114.019012][ C0] ? pfn_valid+0xcd/0x420 [ 114.023365][ C0] pfn_valid+0xe9/0x420 [ 114.027730][ C0] ? pfn_valid+0xcd/0x420 [ 114.032111][ C0] page_table_check_set+0x25/0x6e0 [ 114.037270][ C0] copy_page_range+0x24fc/0x3700 [ 114.042243][ C0] ? pfn_valid+0x450/0x450 [ 114.046694][ C0] ? copy_mm+0x1705/0x1e30 [ 114.051157][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 114.056198][ C0] ? down_write+0x16e/0x200 [ 114.060746][ C0] ? up_write+0x1be/0x410 [ 114.065127][ C0] copy_mm+0x1751/0x1e30 [ 114.069405][ C0] ? copy_signal+0x640/0x640 [ 114.074020][ C0] ? __init_rwsem+0x122/0x160 [ 114.078707][ C0] ? copy_signal+0x51f/0x640 [ 114.083330][ C0] copy_process+0x16c9/0x3da0 [ 114.088043][ C0] ? copy_process+0x98e/0x3da0 [ 114.092844][ C0] ? __pidfd_prepare+0x140/0x140 [ 114.097801][ C0] kernel_clone+0x24b/0x8a0 [ 114.102326][ C0] ? create_io_thread+0x190/0x190 [ 114.107368][ C0] ? __might_fault+0xaa/0x120 [ 114.112059][ C0] __x64_sys_clone+0x1b7/0x230 [ 114.116843][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 114.121918][ C0] ? lock_chain_count+0x20/0x20 [ 114.126789][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 114.132011][ C0] do_syscall_64+0x55/0xb0 [ 114.136456][ C0] ? clear_bhb_loop+0x40/0x90 [ 114.141150][ C0] ? clear_bhb_loop+0x40/0x90 [ 114.145840][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.151780][ C0] RIP: 0033:0x7f3293bc6fd2 [ 114.156209][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 114.175855][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 114.184317][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 114.192326][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 114.200309][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 114.208306][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 114.216304][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 114.224323][ C0] [ 114.227368][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 114.234684][ C0] CPU: 0 PID: 5773 Comm: syz-executor Tainted: G W syzkaller #0 [ 114.243732][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 114.253802][ C0] Call Trace: [ 114.257125][ C0] [ 114.260024][ C0] dump_stack_lvl+0x18c/0x250 [ 114.264749][ C0] ? show_regs_print_info+0x20/0x20 [ 114.269995][ C0] ? load_image+0x420/0x420 [ 114.274531][ C0] panic+0x2ca/0x720 [ 114.278455][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 114.283002][ C0] __warn+0x2e0/0x470 [ 114.287003][ C0] ? __debug_object_init+0x18d/0x450 [ 114.292312][ C0] ? __debug_object_init+0x18d/0x450 [ 114.297661][ C0] report_bug+0x2be/0x4f0 [ 114.302014][ C0] ? __debug_object_init+0x18d/0x450 [ 114.307320][ C0] ? __debug_object_init+0x18d/0x450 [ 114.312632][ C0] ? __debug_object_init+0x18f/0x450 [ 114.317940][ C0] handle_bug+0xcf/0x120 [ 114.322312][ C0] exc_invalid_op+0x1a/0x50 [ 114.326842][ C0] asm_exc_invalid_op+0x1a/0x20 [ 114.331723][ C0] RIP: 0010:__debug_object_init+0x18d/0x450 [ 114.337664][ C0] Code: 24 08 74 2f 41 ff c6 44 89 35 af 1b 05 14 48 c7 c1 00 5a 1d 8b 48 c7 c7 60 5a 1d 8b 84 c0 48 0f 45 f9 48 89 de e8 73 bf 4b 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f [ 114.357289][ C0] RSP: 0018:ffffc90000007928 EFLAGS: 00010046 [ 114.363385][ C0] RAX: 0000000000000050 RBX: ffffc900000079c0 RCX: 0cfcda5b4c7a8700 [ 114.371392][ C0] RDX: 0000000000000100 RSI: 0000000000000104 RDI: 0000000000000000 [ 114.379404][ C0] RBP: dffffc0000000000 R08: ffff8880b8c28c53 R09: 1ffff1101718518a [ 114.387408][ C0] R10: dffffc0000000000 R11: ffffed101718518b R12: ffff888078735a20 [ 114.395395][ C0] R13: ffff888030e82d20 R14: 0000000000000001 R15: ffffffff8acbe300 [ 114.403414][ C0] ? __debug_object_init+0x18d/0x450 [ 114.408723][ C0] __synchronize_srcu+0x2ae/0x3d0 [ 114.413768][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 114.419715][ C0] ? synchronize_srcu_expedited+0x20/0x20 [ 114.425481][ C0] ? read_tsc+0x9/0x20 [ 114.429587][ C0] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 114.435166][ C0] ? synchronize_srcu+0x25a/0x280 [ 114.440262][ C0] wakeup_source_unregister+0x116/0x190 [ 114.445829][ C0] mmc_host_classdev_release+0x47/0x100 [ 114.451405][ C0] ? mmc_free_host+0x40/0x40 [ 114.456152][ C0] device_release+0xbc/0x1e0 [ 114.460792][ C0] kobject_put+0x21b/0x450 [ 114.465268][ C0] call_timer_fn+0x189/0x540 [ 114.469907][ C0] ? kref_get+0x70/0x70 [ 114.474099][ C0] ? call_timer_fn+0xd2/0x540 [ 114.478800][ C0] ? __run_timers+0x810/0x810 [ 114.483499][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.488713][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 114.493927][ C0] ? kref_get+0x70/0x70 [ 114.498122][ C0] __run_timers+0x570/0x810 [ 114.502670][ C0] ? detach_timer+0x2b0/0x2b0 [ 114.507397][ C0] ? lock_chain_count+0x20/0x20 [ 114.512279][ C0] run_timer_softirq+0x67/0xf0 [ 114.517060][ C0] handle_softirqs+0x27d/0x820 [ 114.521871][ C0] ? read_tsc+0x9/0x20 [ 114.525977][ C0] ? ktime_get+0x24b/0x280 [ 114.530432][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 114.535253][ C0] ? do_softirq+0x1a0/0x1a0 [ 114.539834][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 114.545104][ C0] __irq_exit_rcu+0xd3/0x190 [ 114.549810][ C0] ? irq_exit_rcu+0x20/0x20 [ 114.554353][ C0] irq_exit_rcu+0x9/0x20 [ 114.558656][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 114.564363][ C0] [ 114.567329][ C0] [ 114.570306][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.576309][ C0] RIP: 0010:lock_acquire+0x208/0x420 [ 114.581620][ C0] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 114.601262][ C0] RSP: 0018:ffffc9000441f3a0 EFLAGS: 00000206 [ 114.607384][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0cfcda5b4c7a8700 [ 114.615410][ C0] RDX: 0000000000000000 RSI: ffffffff8acae160 RDI: ffffffff8b1d5160 [ 114.623441][ C0] RBP: ffffc9000441f4a8 R08: dffffc0000000000 R09: 1ffffffff23fe2a0 [ 114.631481][ C0] R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: 1ffff92000883e80 [ 114.639500][ C0] R13: ffffffff8df321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 114.647546][ C0] ? read_lock_is_recursive+0x20/0x20 [ 114.652982][ C0] ? page_ext_put+0x9c/0xb0 [ 114.657542][ C0] ? pfn_valid+0xcd/0x420 [ 114.661949][ C0] pfn_valid+0xe9/0x420 [ 114.666155][ C0] ? pfn_valid+0xcd/0x420 [ 114.670538][ C0] page_table_check_set+0x25/0x6e0 [ 114.675708][ C0] copy_page_range+0x24fc/0x3700 [ 114.680744][ C0] ? pfn_valid+0x450/0x450 [ 114.685224][ C0] ? copy_mm+0x1705/0x1e30 [ 114.689686][ C0] ? __lock_acquire+0x7eb0/0x7eb0 [ 114.694759][ C0] ? down_write+0x16e/0x200 [ 114.699311][ C0] ? up_write+0x1be/0x410 [ 114.703690][ C0] copy_mm+0x1751/0x1e30 [ 114.707993][ C0] ? copy_signal+0x640/0x640 [ 114.712651][ C0] ? __init_rwsem+0x122/0x160 [ 114.717382][ C0] ? copy_signal+0x51f/0x640 [ 114.722022][ C0] copy_process+0x16c9/0x3da0 [ 114.726757][ C0] ? copy_process+0x98e/0x3da0 [ 114.731568][ C0] ? __pidfd_prepare+0x140/0x140 [ 114.736560][ C0] kernel_clone+0x24b/0x8a0 [ 114.741129][ C0] ? create_io_thread+0x190/0x190 [ 114.746212][ C0] ? __might_fault+0xaa/0x120 [ 114.751032][ C0] __x64_sys_clone+0x1b7/0x230 [ 114.755860][ C0] ? __ia32_sys_vfork+0x140/0x140 [ 114.760941][ C0] ? lock_chain_count+0x20/0x20 [ 114.765842][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 114.771098][ C0] do_syscall_64+0x55/0xb0 [ 114.775591][ C0] ? clear_bhb_loop+0x40/0x90 [ 114.780320][ C0] ? clear_bhb_loop+0x40/0x90 [ 114.785046][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 114.790992][ C0] RIP: 0033:0x7f3293bc6fd2 [ 114.795437][ C0] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 114.815078][ C0] RSP: 002b:00007ffd65720510 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 114.823500][ C0] RAX: ffffffffffffffda RBX: 00007ffd65720510 RCX: 00007f3293bc6fd2 [ 114.831485][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 114.839483][ C0] RBP: 00007ffd6572069c R08: 0000000000000000 R09: 0000000000000001 [ 114.847474][ C0] R10: 000055556095b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 114.855460][ C0] R13: 00000000000927c0 R14: 000000000001aab9 R15: 00007ffd657206f0 [ 114.863468][ C0] [ 114.867110][ C0] Kernel Offset: disabled [ 114.871455][ C0] Rebooting in 86400 seconds..