last executing test programs: 7m34.390805628s ago: executing program 1 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) 7m31.414206165s ago: executing program 1 (id=13): mount(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2002404, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1df) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x109042, 0x15) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r4, 0x4020aed2, 0x0) 7m29.75505145s ago: executing program 1 (id=15): bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0xffffffffffffff98) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x39cb, 0x4) shutdown(0xffffffffffffffff, 0x1) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000300)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x800}) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) r3 = socket$kcm(0x1e, 0x5, 0x0) recvmsg$kcm(r3, &(0x7f0000001740)={0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) 7m20.093471512s ago: executing program 1 (id=30): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x654a, 0x4) bind$inet(r0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) 7m19.131623154s ago: executing program 1 (id=34): r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='127.0.0.1', 0x9) 7m18.813896471s ago: executing program 1 (id=38): r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000000)={0x20000002}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd2(0x2000003, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000240)={r5, 0x7fc, 0x2, r5}) ioctl$KVM_SET_IRQCHIP(r4, 0xae64, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r6 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f000004c000/0x4000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x4, 0x0, 0x0, 0x1c3, 0x0, 0x0, 0x38, 0x32}) ioctl$KVM_SET_PIT2(r4, 0xae71, &(0x7f0000000100)={[{0x10000, 0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffff8}, {0xffffffff, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x10, 0xc}, {0x10000, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x21, 0x3, 0xfd, 0x0, 0x0, 0x0, 0x800}]}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x20000001}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000080)) ioctl$NILFS_IOCTL_GET_SUSTAT(0xffffffffffffffff, 0x80306e85, &(0x7f00000000c0)) 7m3.485236251s ago: executing program 32 (id=38): r0 = epoll_create1(0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000000)={0x20000002}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = eventfd2(0x2000003, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000240)={r5, 0x7fc, 0x2, r5}) ioctl$KVM_SET_IRQCHIP(r4, 0xae64, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) r6 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f000004c000/0x4000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x4, 0x0, 0x0, 0x1c3, 0x0, 0x0, 0x38, 0x32}) ioctl$KVM_SET_PIT2(r4, 0xae71, &(0x7f0000000100)={[{0x10000, 0x6, 0x0, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffff8}, {0xffffffff, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x10, 0xc}, {0x10000, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x21, 0x3, 0xfd, 0x0, 0x0, 0x0, 0x800}]}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x20000001}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000080)) ioctl$NILFS_IOCTL_GET_SUSTAT(0xffffffffffffffff, 0x80306e85, &(0x7f00000000c0)) 2m40.231738899s ago: executing program 4 (id=458): r0 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)) r6 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r6, &(0x7f0000000300)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x5, 0x3a, 'M', 0x3a, '\\', 0x3a, './proc_mnt'}, 0x2c) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000140)={0x5, "a8dfa6fcc54700000000aed10000df000000004000", 0x3, 0x7ffffff8, 0x4, 0x8000, 0x4050805, 0xa}) 2m33.483430449s ago: executing program 4 (id=464): ioctl$USBDEVFS_SETCONFIGURATION(0xffffffffffffffff, 0x80045505, 0x0) syz_usb_connect(0x2, 0x38, &(0x7f0000005e80)={{0x12, 0x1, 0x200, 0x69, 0xc2, 0x5, 0x40, 0x5c6, 0x9002, 0x95b5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x26, 0x3, 0x40, 0x0, 0x10, 0xc, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x6c, 0x2b, 0xb3, 0xff}}, {{0x9, 0x4, 0x76, 0x8, 0x0, 0xff, 0xff, 0xff, 0x0, [@uac_as]}}, {{0x9, 0x4, 0x9c, 0x8, 0x0, 0xd2, 0x4a, 0x6b, 0x9, [@generic={0x2, 0xe}]}}]}}]}}, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10161, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f000000d8c0)={'wg0\x00'}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) 2m29.203375573s ago: executing program 4 (id=469): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000140)) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) read(r3, &(0x7f00000002c0)=""/10, 0x5b) openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x12) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x44, &(0x7f0000000040)={0x0, 0x0}, 0x10) 2m26.771457647s ago: executing program 4 (id=473): r0 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040880) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)) r5 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r5, &(0x7f0000000300)={0x3a, 'syz3', 0x3a, 'M', 0x3a, 0x5, 0x3a, 'M', 0x3a, '\\', 0x3a, './proc_mnt'}, 0x2c) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000140)={0x5, "a8dfa6fcc54700000000aed10000df000000004000", 0x3, 0x7ffffff8, 0x4, 0x8000, 0x4050805, 0xa}) 2m20.21625026s ago: executing program 4 (id=477): r0 = gettid() socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000340)=""/102400, 0x19000) process_vm_writev(r0, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0x310, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) 2m18.700428357s ago: executing program 4 (id=479): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400ee", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) 2m3.486454003s ago: executing program 33 (id=479): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400ee", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x8000) 16.704579612s ago: executing program 0 (id=652): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, &(0x7f0000000180)=0x0) io_submit(r4, 0x1, &(0x7f0000000780)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x5, r3, &(0x7f0000000a00)="1c73de19da4e24a4be5c3011d88efffbb251589a5bef61f451a747474f315938cc426a841b78d07b04cc6f2d276323ea48a6fd1c0ba66f5055239df5a21b234315694fd58fe32aeaa543e5fe08ccdf3e689caa8cedec8010f8bb8c59eaa1ecbf0f6f66afde88c010b3138095b6a0116af9c9011f03cc24e087286f2553198568c0aea639920383723c52ce2839b5dcb5ecf2eb92eeb24271354e1719e92347b792d0402fb04bbbf78fbebbf4b4832385561e1010dd612da55e8f738b13288b548d333c1d174ade527cafb3fc6576c16cd2e71f68286e28d5d8a17ef63d253bc56ce36b8d4aef6c0a34d8b9463ce4535f9c1700a5bf7b0f217ae63d3d377ddbcf7d4dd2f3f8f08de60c87b1e07487cae176e2f76ea307fa1693d84328c7f751d6d997555964813b103ea44b6e2e8bcc09609c25e5d1e0f174c44dfed19aa2fc6e6a60c589909709ff6b1a8e3c7462427d11469f81fa4d9a69ee39b8f3824889f3ee0c5838a22832193d9f42bfcff8f1990746da71c109c82f51aaffbc9b33b03fe4993f4bfb59461c5a2e13514072283677447793cfe1e7bf5b48416b80a7e18e22cb13e0370f7bb9bf952c4c5355dbb8fe0d912f88d743c536db4b306075c2dcd59d602e75bb159f71e4f11192631fc338203c136c9efc5f05bf94d2fee1a6ad20f2c7e834e5be49ebedde2d9735f46eb08c6537d24f3f06589a4597f2d9378f", 0x200, 0x200}]) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) dup(r5) r6 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xe, &(0x7f0000000000)=0x4800, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count', 0xa0042, 0x0) copy_file_range(r8, 0x0, r8, &(0x7f0000000040)=0x8, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000002800)=@nat={'nat\x00', 0x670, 0x5, 0x430, 0x230, 0x0, 0xffffffff, 0x2d4, 0x0, 0x39c, 0x39c, 0xffffffff, 0x39c, 0x39c, 0x5, 0x0, {[{{@uncond, 0x0, 0x158, 0x18c, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@addrtype1={{0x28}, {0x4, 0x400, 0x3}}]}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1d, {0x0, @rand_addr=0x64010102, @loopback, @gre_key=0x3, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa4}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x1b, @multicast1, @local, @port=0x4e20, @gre_key=0x6}}}}, {{@ip={@loopback, @private=0xa010102, 0xff, 0x0, 'team_slave_0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x0, 0x4}, 0x0, 0x70, 0xa4}, @MASQUERADE={0x34, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @remote, @icmp_id=0x67, @port=0x4e23}}}}, {{@ip={@multicast1, @broadcast, 0xffffff00, 0xff, 'veth1_macvtap\x00', 'bridge0\x00', {}, {0xff}, 0x73, 0x0, 0x20}, 0x0, 0x94, 0xc8, 0x0, {}, [@common=@icmp={{0x24}, {0xc, "1542", 0x1}}]}, @DNAT0={0x34, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x26}, @port=0x4e23, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x48c) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x4, 0x401}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x19}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x2000000, 0x0, 0x5}, 0x0) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400440}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)={0x180, r9, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x33e7bbf9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x532580ab}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_BEARER={0xdc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0xfd6b, 0x1, @in={0x2, 0x4e20, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e23, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @mcast2, 0x7}}, {0x14, 0x2, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x1f0, @empty, 0x1}}}}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'ib', 0x3a, 'nicvf0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x18}]}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x0, 0x2, 0x6}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_ID={0x10, 0x3, "c9d369717f3be6011d574945"}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x4048090}, 0x400c005) 13.800801786s ago: executing program 0 (id=656): socket$inet6(0xa, 0x3, 0x5) setns(0xc9, 0x4000000) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000880)={0x2020}, 0x2020) 12.86171077s ago: executing program 0 (id=659): sched_setscheduler(0x0, 0x1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x141400) ioctl$CEC_S_MODE(r4, 0x40046109, &(0x7f0000000140)=0x12) 10.1216038s ago: executing program 0 (id=663): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000"], 0x1c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[], 0x48) getrlimit(0xb, &(0x7f0000000080)) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r2, 0x2000000, 0x300}, 0x38) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80002, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c) prctl$PR_CAPBSET_DROP(0x18, 0x20000009) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @empty}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x1}}], 0x18}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mount(&(0x7f0000000140)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000180)='bfs\x00', 0x2208004, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000780)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) 9.197222384s ago: executing program 3 (id=664): r0 = fanotify_init(0xf00, 0x80000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, r1, 0x2) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x441, 0x0) fanotify_mark(r0, 0x2, 0x4800103b, r2, 0x0) 9.054984087s ago: executing program 3 (id=665): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1fe) 8.627157882s ago: executing program 3 (id=667): socket$inet6(0xa, 0x3, 0x5) setns(0xc9, 0x4000000) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000880)={0x2020}, 0x2020) 7.723048022s ago: executing program 2 (id=668): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4205, r0, 0x2, &(0x7f00000002c0)={0x0}) 6.746738522s ago: executing program 0 (id=669): openat$fault_inject(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x3a09007, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./file0\x00') syz_open_dev$tty1(0xc, 0x4, 0x2) 6.701034046s ago: executing program 3 (id=670): socket$inet_tcp(0x2, 0x1, 0x0) fstat(0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61124400000000006113340000000000bf1000000000000015000200091b00003d030100000000008701000000000000bc26000000000000bf67000000000000560300000ee600f06702000014000000160300000ee600f0bf050000000000000f610000000000006507f4ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe7030586e3f640f9f7e9a73b761ad4f0952a70046270d2b6436fdeecd791614ed46de741eb8cf91c046ef9beca574b350021c7ec6ef130f53748068ca432dae4e248b22b9ad8b2811f67916a1764578cba4b069037bfb3362d5691ac397f7e207145d970f0d97867552629b146645c785fb77dbeca38e49a9d5221f1f45f0a25890d04d91a15a05ae7e7ed6252c3d6c1973fb858de1da70d67317e7872b0603ce47ed2c1520e71b527bb42aa2e20e1e85df73736ed0a782ab7e7278dd54358cfdf6313d40f926332623625b49626481054787ab2dff85a9bebd6b317f26c691a65aa97bb3d1506a3a565e9c7ea5ad4611d2d77ee8a5c1b23814a26b6a20061fbb65bdd03770fa849f2a29ba69f90625f42592a70ba890f7a92878ae73574c3a233ee5954119931a1905210715fa77a8795f2fbec3797cb90f59fe8a4abec25f40c87bf25b750bbaa"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) 6.663611387s ago: executing program 2 (id=671): sched_setscheduler(0x0, 0x1, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x141400) ioctl$CEC_S_MODE(r5, 0x40046109, &(0x7f0000000140)=0x12) 4.184722547s ago: executing program 2 (id=672): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.863792149s ago: executing program 0 (id=673): bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) socket$nl_generic(0x10, 0x3, 0x10) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) close(r0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) 3.207928268s ago: executing program 3 (id=674): mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./cifs\x00', 0x1ed) mount(&(0x7f0000000800)=@filename='\\\\::1\\share\x00', &(0x7f0000000300)='./cifs\x00', &(0x7f0000000400)='cifs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) 3.094483067s ago: executing program 2 (id=675): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1fe) 1.917090158s ago: executing program 3 (id=676): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r3, 0x402c5639, &(0x7f0000000000)={0x1, 0x5, 0x927bb}) r4 = openat$nullb(0xffffffffffffff9c, 0x0, 0x400000000a882, 0x0) ioctl$BLKZEROOUT(r4, 0x127f, 0x0) write(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x404, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[], [{@fowner_gt}, {@smackfsfloor={'smackfsfloor', 0x3d, '/!\xd2%('}}]}}) 1.045930993s ago: executing program 2 (id=677): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2fc835cd83886412, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000080)="100c0601000000baf775", 0xa, 0xfffffffffffffffe) setfsgid(0xee00) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fsopen(0x0, 0x0) 0s ago: executing program 2 (id=678): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r0, 0x0, r1, 0x0, 0x6, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) vmsplice(r1, 0x0, 0x0, 0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, 0x0, 0x4044004) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000080) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.69' (ED25519) to the list of known hosts. [ 75.462913][ T5591] cgroup: Unknown subsys name 'net' [ 75.713990][ T5591] cgroup: Unknown subsys name 'cpuset' [ 75.758977][ T5591] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.366252][ T5591] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.879595][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.905970][ T5613] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.911921][ T5613] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.935453][ T5613] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.956580][ T5620] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.970384][ T5620] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.977852][ T5620] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.979166][ T5620] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.986052][ T5613] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.986174][ T5613] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.989619][ T5620] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 79.990773][ T5620] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.999678][ T5620] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.000762][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.005996][ T5623] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.006319][ T5613] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.008152][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.008267][ T5623] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.008279][ T5613] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 80.009685][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.015240][ T5620] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 80.016865][ T5607] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.030642][ T5620] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.046201][ T59] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 80.052506][ T59] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 82.090697][ T5612] Bluetooth: hci0: command tx timeout [ 82.092723][ T5612] Bluetooth: hci3: command tx timeout [ 82.170764][ T59] Bluetooth: hci2: command tx timeout [ 82.171279][ T5612] Bluetooth: hci1: command tx timeout [ 82.248567][ T59] Bluetooth: hci4: command tx timeout [ 82.574298][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.575626][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.575855][ T5602] bridge_slave_0: entered allmulticast mode [ 82.579623][ T5602] bridge_slave_0: entered promiscuous mode [ 82.638274][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.638639][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.638873][ T5602] bridge_slave_1: entered allmulticast mode [ 82.642805][ T5602] bridge_slave_1: entered promiscuous mode [ 82.735743][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.736681][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.737198][ T5604] bridge_slave_0: entered allmulticast mode [ 82.741524][ T5604] bridge_slave_0: entered promiscuous mode [ 82.787789][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.788992][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.789164][ T5603] bridge_slave_0: entered allmulticast mode [ 82.791744][ T5603] bridge_slave_0: entered promiscuous mode [ 82.796024][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.796136][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.796695][ T5604] bridge_slave_1: entered allmulticast mode [ 82.800294][ T5604] bridge_slave_1: entered promiscuous mode [ 82.840836][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.841567][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.841680][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.841853][ T5605] bridge_slave_0: entered allmulticast mode [ 82.845095][ T5605] bridge_slave_0: entered promiscuous mode [ 82.852709][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.852824][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.853062][ T5603] bridge_slave_1: entered allmulticast mode [ 82.856345][ T5603] bridge_slave_1: entered promiscuous mode [ 82.904973][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.905145][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.905315][ T5606] bridge_slave_0: entered allmulticast mode [ 82.907768][ T5606] bridge_slave_0: entered promiscuous mode [ 82.921516][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.921839][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.921951][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.922097][ T5605] bridge_slave_1: entered allmulticast mode [ 82.924933][ T5605] bridge_slave_1: entered promiscuous mode [ 82.969268][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.970278][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.970450][ T5606] bridge_slave_1: entered allmulticast mode [ 82.973497][ T5606] bridge_slave_1: entered promiscuous mode [ 83.020650][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.070110][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.074628][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.093645][ T5602] team0: Port device team_slave_0 added [ 83.098192][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.108567][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.134523][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.140794][ T5602] team0: Port device team_slave_1 added [ 83.144216][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.175114][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.216382][ T5604] team0: Port device team_slave_0 added [ 83.257821][ T5603] team0: Port device team_slave_0 added [ 83.262494][ T5604] team0: Port device team_slave_1 added [ 83.277703][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.277781][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.277802][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.292145][ T5605] team0: Port device team_slave_0 added [ 83.295996][ T5603] team0: Port device team_slave_1 added [ 83.321956][ T5606] team0: Port device team_slave_0 added [ 83.323157][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.323170][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.323193][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.331787][ T5605] team0: Port device team_slave_1 added [ 83.393961][ T5606] team0: Port device team_slave_1 added [ 83.443329][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.443446][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.443469][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.493360][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.493822][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.493847][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.495121][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.495133][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.495156][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.522674][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.522693][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.522717][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.528770][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.528787][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.528810][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.570181][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.570198][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.570221][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.571801][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.571812][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.571835][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.632038][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.632056][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.632080][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.652765][ T5602] hsr_slave_0: entered promiscuous mode [ 83.654438][ T5602] hsr_slave_1: entered promiscuous mode [ 83.794366][ T5604] hsr_slave_0: entered promiscuous mode [ 83.795830][ T5604] hsr_slave_1: entered promiscuous mode [ 83.796846][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 83.796984][ T5604] Cannot create hsr debugfs directory [ 83.864457][ T5603] hsr_slave_0: entered promiscuous mode [ 83.866776][ T5603] hsr_slave_1: entered promiscuous mode [ 83.867584][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 83.867607][ T5603] Cannot create hsr debugfs directory [ 83.882488][ T5605] hsr_slave_0: entered promiscuous mode [ 83.883873][ T5605] hsr_slave_1: entered promiscuous mode [ 83.884674][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 83.884696][ T5605] Cannot create hsr debugfs directory [ 83.951607][ T5606] hsr_slave_0: entered promiscuous mode [ 83.952961][ T5606] hsr_slave_1: entered promiscuous mode [ 83.953917][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 83.953940][ T5606] Cannot create hsr debugfs directory [ 84.168712][ T59] Bluetooth: hci3: command tx timeout [ 84.168729][ T5612] Bluetooth: hci0: command tx timeout [ 84.248714][ T59] Bluetooth: hci2: command tx timeout [ 84.248797][ T59] Bluetooth: hci1: command tx timeout [ 84.329703][ T5612] Bluetooth: hci4: command tx timeout [ 85.244958][ T5602] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.291143][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.301514][ T5602] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.342149][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.347629][ T5602] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.389866][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.412387][ T5602] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.447570][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.613874][ T5603] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.642500][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.647236][ T5603] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.665000][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.672392][ T5603] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.701697][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.729792][ T5603] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.752889][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.892989][ T5605] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 85.934164][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.945701][ T5605] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 85.982551][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.993131][ T5605] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.032080][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.059599][ T5605] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.102124][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.249288][ T59] Bluetooth: hci3: command tx timeout [ 86.252344][ T5612] Bluetooth: hci0: command tx timeout [ 86.287217][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.297780][ T5604] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.323358][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.337078][ T5604] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.339930][ T59] Bluetooth: hci2: command tx timeout [ 86.340247][ T5612] Bluetooth: hci1: command tx timeout [ 86.381832][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.394058][ T5604] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.408694][ T5612] Bluetooth: hci4: command tx timeout [ 86.425131][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.459398][ T5604] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.503157][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.593774][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.651380][ T1256] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.668604][ T1256] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.694284][ T5606] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.734867][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.750039][ T5606] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.793320][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.802524][ T5606] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.831406][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.843047][ T1256] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.843196][ T1256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.847803][ T5606] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.886904][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.933793][ T10] cfg80211: failed to load regulatory.db [ 86.966809][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.096439][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.154921][ T1210] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.155199][ T1210] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.203119][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.265306][ T1209] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.266855][ T1209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.447924][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.537740][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.555778][ T1206] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.557529][ T1206] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.635839][ T1209] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.636014][ T1209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.683727][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.762228][ T1209] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.762417][ T1209] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.837853][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.868307][ T1209] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.876712][ T1209] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.980814][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.042298][ T1210] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.042495][ T1210] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.173137][ T1256] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.173393][ T1256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.246701][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.329069][ T59] Bluetooth: hci3: command tx timeout [ 88.329159][ T5612] Bluetooth: hci0: command tx timeout [ 88.423603][ T59] Bluetooth: hci2: command tx timeout [ 88.423728][ T5612] Bluetooth: hci1: command tx timeout [ 88.489370][ T5612] Bluetooth: hci4: command tx timeout [ 88.891995][ T5602] veth0_vlan: entered promiscuous mode [ 89.024657][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.082551][ T5602] veth1_vlan: entered promiscuous mode [ 89.207403][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.417954][ T5603] veth0_vlan: entered promiscuous mode [ 89.427022][ T5602] veth0_macvtap: entered promiscuous mode [ 89.452220][ T5602] veth1_macvtap: entered promiscuous mode [ 89.492711][ T5603] veth1_vlan: entered promiscuous mode [ 89.600029][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.645009][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.888150][ T5603] veth0_macvtap: entered promiscuous mode [ 89.974686][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.991147][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.076367][ T5603] veth1_macvtap: entered promiscuous mode [ 90.295694][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.358133][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.385410][ T3339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.387917][ T3339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.604246][ T5605] veth0_vlan: entered promiscuous mode [ 90.629074][ T5606] veth0_vlan: entered promiscuous mode [ 90.630566][ T5604] veth0_vlan: entered promiscuous mode [ 90.638891][ T1210] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.638913][ T1210] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.849360][ T5605] veth1_vlan: entered promiscuous mode [ 90.876702][ T5606] veth1_vlan: entered promiscuous mode [ 91.022979][ T5604] veth1_vlan: entered promiscuous mode [ 91.306834][ T1256] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.317835][ T1256] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.434805][ T5605] veth0_macvtap: entered promiscuous mode [ 91.620962][ T5605] veth1_macvtap: entered promiscuous mode [ 91.627144][ T5606] veth0_macvtap: entered promiscuous mode [ 91.646247][ T5604] veth0_macvtap: entered promiscuous mode [ 91.654262][ T1209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.654338][ T1209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.674039][ T5606] veth1_macvtap: entered promiscuous mode [ 91.770367][ T5604] veth1_macvtap: entered promiscuous mode [ 91.801842][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.049343][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.063841][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.861626][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.869959][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.949865][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.095688][ T5823] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 98.076179][ T1206] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.084144][ T1206] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.318482][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.328470][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.338486][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.348511][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.358485][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.368478][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.378522][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.388480][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 100.215022][ T3339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.216626][ T3339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.287031][ T5849] sctp: [Deprecated]: syz.0.14 (pid 5849) Use of struct sctp_assoc_value in delayed_ack socket option. [ 100.287031][ T5849] Use struct sctp_sack_info instead [ 100.596982][ T1212] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.599105][ T1256] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.624400][ T1212] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.811354][ T1256] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.819329][ T1256] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.904800][ T1209] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.904883][ T1209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.148603][ T1206] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.297818][ T1206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.297877][ T1206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.431308][ T3339] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.589016][ T3339] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.589470][ T3339] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.839143][ T3339] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.876404][ T3339] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.068500][ T1212] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.083668][ T1206] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.084418][ T1206] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.111832][ T1206] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.454059][ T1256] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.865174][ T1257] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.802307][ T1257] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.859632][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 104.534586][ T3338] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.546903][ T1281] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.587739][ T5612] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 104.595302][ T5612] CPU: 1 UID: 0 PID: 5612 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.595329][ T5612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.595340][ T5612] Workqueue: hci3 hci_rx_work [ 104.595393][ T5612] Call Trace: [ 104.595399][ T5612] [ 104.595407][ T5612] dump_stack_lvl+0xe8/0x150 [ 104.595443][ T5612] sysfs_create_dir_ns+0x271/0x2a0 [ 104.595468][ T5612] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 104.595494][ T5612] ? rt_spin_unlock+0x165/0x200 [ 104.595521][ T5612] kobject_add_internal+0x62c/0xce0 [ 104.595549][ T5612] kobject_add+0x163/0x240 [ 104.595567][ T5612] ? rt_spin_unlock+0x159/0x200 [ 104.595594][ T5612] ? __pfx_kobject_add+0x10/0x10 [ 104.595619][ T5612] ? get_device_parent+0x370/0x3a0 [ 104.595644][ T5612] device_add+0x3fa/0xb80 [ 104.595669][ T5612] hci_conn_add_sysfs+0xd5/0x210 [ 104.595700][ T5612] le_conn_complete_evt+0xfe3/0x16d0 [ 104.595728][ T5612] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 104.595751][ T5612] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.595770][ T5612] ? rt_mutex_slowunlock+0x219/0x460 [ 104.595795][ T5612] ? skb_pull_data+0xf0/0x200 [ 104.595825][ T5612] hci_le_conn_complete_evt+0x187/0x470 [ 104.595852][ T5612] hci_event_packet+0x67a/0xf10 [ 104.595878][ T5612] ? reacquire_held_locks+0x117/0x1a0 [ 104.595908][ T5612] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 104.595925][ T5612] ? __pfx_hci_event_packet+0x10/0x10 [ 104.595949][ T5612] ? rt_spin_unlock+0x159/0x200 [ 104.595982][ T5612] ? hci_send_to_monitor+0xe2/0x590 [ 104.596007][ T5612] hci_rx_work+0x3ee/0x1020 [ 104.596041][ T5612] ? process_scheduled_works+0x97a/0x1630 [ 104.596066][ T5612] process_scheduled_works+0xc3d/0x1630 [ 104.596121][ T5612] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.596151][ T5612] ? assign_work+0x3cf/0x5d0 [ 104.596180][ T5612] worker_thread+0xa47/0xfb0 [ 104.596236][ T5612] kthread+0x38b/0x470 [ 104.596256][ T5612] ? __pfx_worker_thread+0x10/0x10 [ 104.596279][ T5612] ? __pfx_kthread+0x10/0x10 [ 104.596299][ T5612] ret_from_fork+0x514/0xb70 [ 104.596323][ T5612] ? __pfx_ret_from_fork+0x10/0x10 [ 104.596341][ T5612] ? __switch_to+0xc89/0x1420 [ 104.596369][ T5612] ? __pfx_kthread+0x10/0x10 [ 104.596389][ T5612] ret_from_fork_asm+0x1a/0x30 [ 104.596431][ T5612] [ 104.603828][ T5612] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 104.603878][ T5612] Bluetooth: hci3: failed to register connection device [ 104.988654][ T1281] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.988849][ T1281] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.988884][ T1281] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.988915][ T1281] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.361931][ T5884] syz.2.22 (5884) used greatest stack depth: 19144 bytes left [ 106.741889][ T5887] netlink: 'syz.4.25': attribute type 4 has an invalid length. [ 109.572947][ T5915] warning: `syz.4.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 110.484633][ T37] audit: type=1326 audit(1788302519.806:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.592621][ T37] audit: type=1326 audit(1788302519.816:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.592713][ T37] audit: type=1326 audit(1788302519.836:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.592745][ T37] audit: type=1326 audit(1788302519.896:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.592775][ T37] audit: type=1326 audit(1788302519.896:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.592803][ T37] audit: type=1326 audit(1788302519.906:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.611007][ T37] audit: type=1326 audit(1788302519.936:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.611055][ T37] audit: type=1326 audit(1788302519.936:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.611090][ T37] audit: type=1326 audit(1788302519.936:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.616569][ T37] audit: type=1326 audit(1788302519.946:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5928 comm="syz.0.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7fb8975ce159 code=0x7ffc0000 [ 110.730244][ T5935] netlink: 8 bytes leftover after parsing attributes in process `syz.4.36'. [ 114.842795][ T5967] binder: 5965:5967 ioctl 4018620d 0 returned -22 [ 115.318484][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 118.654364][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 121.084989][ T6009] cgroup: name respecified [ 121.502597][ T6015] Zero length message leads to an empty skb [ 122.770351][ T6019] binder: 6016:6019 ioctl 4018620d 0 returned -22 [ 125.915059][ T1212] IPVS: starting estimator thread 0... [ 126.020915][ T6043] IPVS: using max 9 ests per chain, 21600 per kthread [ 126.963613][ T5815] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 127.668573][ T5736] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 127.862309][ T5736] usb 4-1: not running at top speed; connect to a high speed hub [ 127.895610][ T5736] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 127.935450][ T5736] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 127.948148][ T5736] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 6 [ 127.948200][ T5736] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.309408][ T59] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 128.323046][ T59] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 128.327830][ T59] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 128.371476][ T59] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 128.375873][ T59] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 128.644064][ T5736] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 128.875044][ T6053] netlink: 'syz.4.66': attribute type 2 has an invalid length. [ 128.952161][ T5736] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 129.003497][ T5736] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 130.183722][ T5736] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 130.208737][ T5736] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 130.331105][ T5736] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 130.488673][ T5612] Bluetooth: hci5: command tx timeout [ 130.557982][ T5736] usb 4-1: USB disconnect, device number 3 [ 130.644619][ T6073] binder: 6070:6073 ioctl 4018620d 0 returned -22 [ 132.569440][ T5612] Bluetooth: hci5: command tx timeout [ 132.670395][ T5736] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 132.791366][ T5736] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 132.810696][ T5736] keyspan 4-1:1.0: device disconnected [ 133.007553][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.021109][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.657549][ T6097] PKCS7: Unknown OID: [4] 0.0 [ 133.658359][ T6097] PKCS7: Only support pkcs7_signedData type [ 134.652635][ T5612] Bluetooth: hci5: command tx timeout [ 134.798490][ T3350] IPVS: starting estimator thread 0... [ 134.954480][ T6106] IPVS: using max 8 ests per chain, 19200 per kthread [ 135.889895][ T6108] trusted_key: encrypted_key: insufficient parameters specified [ 136.737924][ T5612] Bluetooth: hci5: command tx timeout [ 138.127989][ T37] kauditd_printk_skb: 26 callbacks suppressed [ 138.128073][ T37] audit: type=1800 audit(1788302547.266:38): pid=6113 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.73" name="(" dev="sda1" ino=2049 res=0 errno=0 [ 139.212860][ T6130] binder: BINDER_SET_CONTEXT_MGR already set [ 139.227853][ T6130] binder: 6128:6130 ioctl 4018620d 200000004a80 returned -16 [ 140.496212][ T66] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.656207][ T6146] process 'syz.0.88' launched './file2' with NULL argv: empty string added [ 141.159049][ T6141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.87'. [ 141.259528][ T1256] IPVS: starting estimator thread 0... [ 141.348636][ T6159] IPVS: using max 7 ests per chain, 16800 per kthread [ 148.480257][ T66] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.812711][ T6174] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 150.688109][ T6194] binder: BINDER_SET_CONTEXT_MGR already set [ 150.709856][ T6194] binder: 6193:6194 ioctl 4018620d 200000004a80 returned -16 [ 150.864924][ T6197] netlink: 16 bytes leftover after parsing attributes in process `syz.4.100'. [ 152.054918][ T6202] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 152.054955][ T6202] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 152.453816][ T6202] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 152.453854][ T6202] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 152.468128][ T6207] file system registered [ 154.139323][ T66] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.250110][ T6202] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 154.250144][ T6202] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 155.502366][ T5606] ffs_data_put(): freeing [ 155.806130][ T6202] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 155.806169][ T6202] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 156.170464][ T6202] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 156.170487][ T6202] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 156.234659][ T66] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.189189][ T6233] faux_driver vgem: [drm] Unknown color mode 1024; guessing buffer size. [ 158.103903][ T6242] netlink: 16 bytes leftover after parsing attributes in process `syz.3.113'. [ 158.652262][ T5605] ffs_data_put(): freeing [ 160.608584][ T5732] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 162.395584][ T6049] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.402873][ T6049] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.403076][ T6049] bridge_slave_0: entered allmulticast mode [ 162.406382][ T6049] bridge_slave_0: entered promiscuous mode [ 162.409657][ T5732] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 162.500817][ T6049] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.508104][ T6049] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.508316][ T6049] bridge_slave_1: entered allmulticast mode [ 162.551212][ T6049] bridge_slave_1: entered promiscuous mode [ 163.771085][ T5732] usb 1-1: unable to read config index 0 descriptor/all [ 163.776728][ T5732] usb 1-1: can't read configurations, error -71 [ 164.388953][ T6281] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 164.389432][ T6281] CIFS: Attempting to mount //::1/share [ 164.400156][ T6281] CIFS: VFS: Error connecting to socket. Aborting operation. [ 164.400319][ T6281] CIFS: VFS: cifs_mount failed w/return code = -111 [ 167.111516][ T66] bridge_slave_1: left allmulticast mode [ 167.111607][ T66] bridge_slave_1: left promiscuous mode [ 167.113283][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.356076][ T66] bridge_slave_0: left allmulticast mode [ 167.356127][ T66] bridge_slave_0: left promiscuous mode [ 167.356389][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.599625][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 168.702140][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 168.743557][ T66] bond0 (unregistering): Released all slaves [ 168.917097][ T6049] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.950700][ T6049] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 169.263565][ T6049] team0: Port device team_slave_0 added [ 169.277247][ T6049] team0: Port device team_slave_1 added [ 169.683241][ T5266] 8021q: adding VLAN 0 to HW filter on device eth1 [ 169.760805][ T6049] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.760878][ T6049] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.760900][ T6049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.785213][ T6049] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.785231][ T6049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.785255][ T6049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 170.659923][ T5735] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 170.808982][ T5735] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 170.813838][ T5735] usb 1-1: Dual-Role OTG device on HNP port [ 170.814185][ T5735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.800592][ T5735] gspca_main: spca501-2.14.0 probing 0000:0000 [ 172.819539][ T5735] gspca_spca501: reg write: error -32 [ 172.819603][ T5735] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 172.819738][ T5735] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 173.613810][ T5266] 8021q: adding VLAN 0 to HW filter on device eth2 [ 173.765140][ T6049] hsr_slave_0: entered promiscuous mode [ 173.781801][ T6049] hsr_slave_1: entered promiscuous mode [ 173.799015][ T6049] debugfs: 'hsr0' already exists in 'hsr' [ 173.812639][ T6049] Cannot create hsr debugfs directory [ 175.130071][ T5735] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 175.877913][ T6331] overlayfs: overlapping lowerdir path [ 180.912115][ T5266] 8021q: adding VLAN 0 to HW filter on device eth3 [ 182.310805][ T66] hsr_slave_0: left promiscuous mode [ 182.373122][ T66] hsr_slave_1: left promiscuous mode [ 182.380911][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.381017][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.492649][ T66] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.507054][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 183.126525][ T66] veth1_macvtap: left promiscuous mode [ 183.160720][ T66] veth0_macvtap: left promiscuous mode [ 183.161103][ T66] veth1_vlan: left promiscuous mode [ 183.161435][ T66] veth0_vlan: left promiscuous mode [ 184.572848][ T66] team0 (unregistering): Port device team_slave_1 removed [ 185.491699][ T66] team0 (unregistering): Port device team_slave_0 removed [ 186.213311][ T6381] CIFS: Attempting to mount //::1/share [ 186.661024][ T6381] CIFS: VFS: Error connecting to socket. Aborting operation. [ 186.661058][ T6381] CIFS: VFS: cifs_mount failed w/return code = -4 [ 187.527020][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 187.567810][ T59] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 187.574655][ T59] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 187.581352][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 187.582236][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 187.850251][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 187.891867][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 187.938278][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 187.981181][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 187.995340][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 189.311160][ T5266] 8021q: adding VLAN 0 to HW filter on device eth4 [ 190.486115][ T59] Bluetooth: hci0: command tx timeout [ 190.974685][ T6413] sctp: [Deprecated]: syz.4.148 (pid 6413) Use of struct sctp_assoc_value in delayed_ack socket option. [ 190.974685][ T6413] Use struct sctp_sack_info instead [ 191.825310][ T6420] fuse: Bad value for 'fd' [ 192.289415][ T6396] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 192.318650][ T6396] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 192.829705][ T6396] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 194.619704][ T6445] CIFS: Attempting to mount //::1/share [ 195.089641][ T6445] CIFS: VFS: Error connecting to socket. Aborting operation. [ 195.089676][ T6445] CIFS: VFS: cifs_mount failed w/return code = -4 [ 195.370498][ T59] Bluetooth: hci0: command 0x040f tx timeout [ 195.445648][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.445728][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 197.449432][ T59] Bluetooth: hci0: command 0x040f tx timeout [ 199.539916][ T59] Bluetooth: hci0: command 0x040f tx timeout [ 200.613390][ T66] bridge_slave_1: left allmulticast mode [ 200.613467][ T66] bridge_slave_1: left promiscuous mode [ 200.613726][ T66] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.683017][ T6502] fuse: Invalid rootmode [ 201.618852][ T59] Bluetooth: hci0: command 0x040f tx timeout [ 203.415851][ T66] bridge_slave_0: left allmulticast mode [ 203.453860][ T66] bridge_slave_0: left promiscuous mode [ 203.666099][ T66] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.690833][ T59] Bluetooth: hci0: command 0x040f tx timeout [ 205.760624][ T66] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 205.860854][ T66] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 205.944562][ T66] bond0 (unregistering): Released all slaves [ 209.272334][ T6541] fuse: Invalid rootmode [ 209.438051][ T6384] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.438260][ T6384] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.439028][ T6384] bridge_slave_0: entered allmulticast mode [ 209.454171][ T6384] bridge_slave_0: entered promiscuous mode [ 209.477843][ T6384] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.478037][ T6384] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.500000][ T6384] bridge_slave_1: entered allmulticast mode [ 209.533065][ T6384] bridge_slave_1: entered promiscuous mode [ 209.792750][ T6547] overlayfs: overlapping lowerdir path [ 209.931469][ T6384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.879100][ T66] hsr_slave_0: left promiscuous mode [ 212.073997][ T66] hsr_slave_1: left promiscuous mode [ 212.076685][ T66] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 212.185673][ T66] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 215.461309][ T6578] fuse: Unknown parameter '00000000000000000000' [ 215.495338][ T66] team0 (unregistering): Port device team_slave_1 removed [ 215.571839][ T66] team0 (unregistering): Port device team_slave_0 removed [ 215.921526][ T5736] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 216.049494][ T6585] sctp: [Deprecated]: syz.3.193 (pid 6585) Use of struct sctp_assoc_value in delayed_ack socket option. [ 216.049494][ T6585] Use struct sctp_sack_info instead [ 216.638576][ T5736] usb 5-1: Using ep0 maxpacket: 32 [ 216.647244][ T5736] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 216.683897][ T5736] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.825802][ T6589] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 217.842680][ T6384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 217.882143][ T5736] usb 5-1: config 0 descriptor?? [ 218.273685][ T5736] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 220.303464][ T6384] team0: Port device team_slave_0 added [ 220.617397][ T6384] team0: Port device team_slave_1 added [ 220.719214][ T5736] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 220.790517][ T5736] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 220.861154][ T5736] usb 5-1: media controller created [ 221.144559][ T6384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 221.151764][ T6384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 221.151852][ T6384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 221.803423][ T6384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 221.830787][ T6384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 221.830864][ T6384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 222.085083][ T6384] hsr_slave_0: entered promiscuous mode [ 222.100894][ T6384] hsr_slave_1: entered promiscuous mode [ 222.118235][ T6384] debugfs: 'hsr0' already exists in 'hsr' [ 222.125368][ T6384] Cannot create hsr debugfs directory [ 222.654963][ T5736] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 222.808490][ T6621] sctp: [Deprecated]: syz.0.203 (pid 6621) Use of struct sctp_assoc_value in delayed_ack socket option. [ 222.808490][ T6621] Use struct sctp_sack_info instead [ 223.296844][ T6620] fuse: Unknown parameter '00000000000000000000' [ 223.856362][ T5736] az6027: usb out operation failed. (-71) [ 223.916121][ T5736] az6027: usb out operation failed. (-71) [ 223.916141][ T5736] stb0899_attach: Driver disabled by Kconfig [ 223.916150][ T5736] az6027: no front-end attached [ 223.916150][ T5736] [ 223.917576][ T5736] az6027: usb out operation failed. (-71) [ 223.926182][ T5736] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 225.094117][ T5736] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input5 [ 225.316889][ T5736] dvb-usb: schedule remote query interval to 400 msecs. [ 225.324869][ T5736] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 225.422382][ T5736] usb 5-1: USB disconnect, device number 3 [ 228.543801][ T6649] syz_tun: entered allmulticast mode [ 228.566082][ T6656] netlink: 'syz.0.212': attribute type 4 has an invalid length. [ 228.624996][ T6643] syz_tun: left allmulticast mode [ 228.786773][ T6658] sctp: [Deprecated]: syz.2.214 (pid 6658) Use of struct sctp_assoc_value in delayed_ack socket option. [ 228.786773][ T6658] Use struct sctp_sack_info instead [ 229.356311][ T6662] fuse: Unknown parameter '00000000000000000000' [ 234.225612][ T6682] ======================================================= [ 234.225612][ T6682] WARNING: The mand mount option has been deprecated and [ 234.225612][ T6682] and is ignored by this kernel. Remove the mand [ 234.225612][ T6682] option from the mount to silence this warning. [ 234.225612][ T6682] ======================================================= [ 235.310782][ T6384] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 237.030330][ T6384] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 237.046907][ T6384] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 237.191215][ T6384] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 237.204336][ T6384] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 237.264091][ T6384] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 237.274269][ T6384] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 237.368635][ T6384] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 237.745069][ T6696] fuse: Unknown parameter 'user00000000000000000000' [ 239.494415][ T5736] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 240.071812][ T6384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.334209][ T6721] sg_write: data in/out 366944/136 bytes for SCSI command 0x0-- guessing data in; [ 240.334209][ T6721] program syz.4.234 not setting count and/or reply_len properly [ 242.982565][ T6384] 8021q: adding VLAN 0 to HW filter on device team0 [ 243.146027][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.146249][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 243.623333][ T6738] sctp: [Deprecated]: syz.2.226 (pid 6738) Use of struct sctp_assoc_value in delayed_ack socket option. [ 243.623333][ T6738] Use struct sctp_sack_info instead [ 244.557333][ T1256] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.611064][ T1256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 244.666932][ T6742] fuse: Unknown parameter 'user00000000000000000000' [ 244.862074][ T6745] fuse: Bad value for 'fd' [ 250.034776][ T6791] fuse: Unknown parameter 'user00000000000000000000' [ 250.641739][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 250.709066][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 250.712216][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 250.717431][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 250.726472][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 251.832439][ T6799] overlayfs: overlapping lowerdir path [ 252.571850][ T1203] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 252.790135][ T1203] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 252.791721][ T1203] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.814400][ T1203] usb 5-1: config 0 descriptor?? [ 253.102316][ T59] Bluetooth: hci5: command tx timeout [ 253.333012][ T6808] IPVS: length: 31 != 24 [ 254.147491][ T1203] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 254.148094][ T1203] [drm:udl_init] *ERROR* Selecting channel failed [ 255.136200][ T59] Bluetooth: hci5: command tx timeout [ 255.872500][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.872687][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.066179][ T1203] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1 [ 256.066258][ T1203] [drm] Initialized udl on minor 1 [ 256.378603][ T1203] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 256.478463][ T5736] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 256.576954][ T1203] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 256.643202][ T5736] usb 3-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 256.654245][ T5736] usb 3-1: config 4 has an invalid interface number: 44 but max is 0 [ 256.654273][ T5736] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 256.654290][ T5736] usb 3-1: config 4 has no interface number 0 [ 256.654387][ T5736] usb 3-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 256.716608][ T5736] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.724907][ T5736] usb 3-1: Product: syz [ 256.724927][ T5736] usb 3-1: Manufacturer: syz [ 256.724940][ T5736] usb 3-1: SerialNumber: syz [ 256.926517][ T1203] usb 5-1: USB disconnect, device number 4 [ 257.208489][ T59] Bluetooth: hci5: command tx timeout [ 258.578687][ T6841] fuse: Unknown parameter 'user_i00000000000000000000' [ 259.286900][ T5736] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 259.288549][ T59] Bluetooth: hci5: command tx timeout [ 259.818074][ T6852] FAULT_INJECTION: forcing a failure. [ 259.818074][ T6852] name failslab, interval 1, probability 0, space 0, times 1 [ 259.819011][ T6852] CPU: 1 UID: 0 PID: 6852 Comm: syz.0.266 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 259.819039][ T6852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 259.819052][ T6852] Call Trace: [ 259.819059][ T6852] [ 259.819068][ T6852] dump_stack_lvl+0xe8/0x150 [ 259.819100][ T6852] should_fail_ex+0x46b/0x600 [ 259.819121][ T6852] should_failslab+0xa8/0x100 [ 259.819145][ T6852] __kmalloc_cache_node_noprof+0xac/0x670 [ 259.819169][ T6852] ? __alloc_workqueue+0x746/0x1fe0 [ 259.819187][ T6852] ? __alloc_workqueue+0x746/0x1fe0 [ 259.819211][ T6852] __alloc_workqueue+0x746/0x1fe0 [ 259.819234][ T6852] ? vsnprintf+0xe42/0xef0 [ 259.819269][ T6852] alloc_workqueue_noprof+0xe3/0x210 [ 259.819298][ T6852] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 259.819325][ T6852] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 259.819353][ T6852] nci_register_device+0x3fe/0x9a0 [ 259.819384][ T6852] ? __pfx_nci_register_device+0x10/0x10 [ 259.819410][ T6852] ? __rt_spin_lock_init+0x3e/0x50 [ 259.819431][ T6852] ? __init_waitqueue_head+0xad/0x160 [ 259.819455][ T6852] virtual_ncidev_open+0x129/0x190 [ 259.819481][ T6852] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 259.819503][ T6852] misc_open+0x2de/0x350 [ 259.819531][ T6852] chrdev_open+0x4dc/0x600 [ 259.819557][ T6852] ? __pfx_chrdev_open+0x10/0x10 [ 259.819580][ T6852] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 259.819608][ T6852] ? __pfx_chrdev_open+0x10/0x10 [ 259.819628][ T6852] do_dentry_open+0x849/0x1420 [ 259.819663][ T6852] vfs_open+0x3b/0x350 [ 259.819685][ T6852] ? path_openat+0x142d/0x1d60 [ 259.819709][ T6852] path_openat+0x1448/0x1d60 [ 259.819749][ T6852] do_file_open+0x23e/0x4a0 [ 259.819774][ T6852] ? __pfx_do_file_open+0x10/0x10 [ 259.819863][ T6852] ? alloc_fd+0x654/0x6d0 [ 259.819901][ T6852] do_sys_openat2+0x115/0x200 [ 259.819926][ T6852] ? __se_sys_futex+0x3a8/0x450 [ 259.819953][ T6852] ? __pfx_do_sys_openat2+0x10/0x10 [ 259.819982][ T6852] ? rcu_is_watching+0x16/0xb0 [ 259.820015][ T6852] __x64_sys_openat+0x138/0x170 [ 259.820044][ T6852] do_syscall_64+0x166/0x520 [ 259.820062][ T6852] ? trace_irq_disable+0x3b/0x140 [ 259.820083][ T6852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.820102][ T6852] ? clear_bhb_loop+0x70/0xc0 [ 259.820123][ T6852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.820141][ T6852] RIP: 0033:0x7fb8975ce159 [ 259.820172][ T6852] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.820188][ T6852] RSP: 002b:00007fb895826028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 259.820213][ T6852] RAX: ffffffffffffffda RBX: 00007fb897855fa0 RCX: 00007fb8975ce159 [ 259.820227][ T6852] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 259.820240][ T6852] RBP: 00007fb897665024 R08: 0000000000000000 R09: 0000000000000000 [ 259.820251][ T6852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 259.820263][ T6852] R13: 00007fb897856038 R14: 00007fb897855fa0 R15: 00007ffed7a2d248 [ 259.820293][ T6852] [ 260.569416][ T5736] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 260.581056][ T5736] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 260.585575][ T5736] usb 3-1: media controller created [ 260.614009][ T5736] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 263.280546][ T5736] DVB: Unable to find symbol dib7000p_attach() [ 263.280607][ T5736] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 263.328009][ T6875] fuse: Bad value for 'fd' [ 263.634150][ T5736] rc_core: IR keymap rc-dib0700-rc5 not found [ 263.634225][ T5736] Registered IR keymap rc-empty [ 263.667200][ T5736] dvb-usb: could not initialize remote control. [ 263.667302][ T5736] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 265.707061][ T5736] usb 3-1: USB disconnect, device number 2 [ 266.351719][ T5736] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 267.581875][ T6913] fuse: Bad value for 'group_id' [ 267.592810][ T6913] fuse: Bad value for 'group_id' [ 268.056516][ T6919] fuse: Unknown parameter 'user_i00000000000000000000' [ 272.839682][ T1203] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 273.025614][ T1203] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 273.034722][ T1203] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 273.034777][ T1203] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 273.034817][ T1203] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.109305][ T1205] bridge_slave_1: left allmulticast mode [ 273.109431][ T1205] bridge_slave_1: left promiscuous mode [ 273.109872][ T1205] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.159453][ T1203] usbtmc 5-1:16.0: bulk endpoints not found [ 273.593904][ T1203] usb 5-1: USB disconnect, device number 5 [ 273.664491][ T1205] bridge_slave_0: left allmulticast mode [ 273.727905][ T1205] bridge_slave_0: left promiscuous mode [ 273.798432][ T1205] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.728439][ T1205] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 277.040906][ T1205] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 277.122928][ T1205] bond0 (unregistering): Released all slaves [ 277.175921][ T6986] syz_tun: entered allmulticast mode [ 277.178401][ T6986] syz_tun: left allmulticast mode [ 277.515643][ T6792] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.523344][ T6792] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.523535][ T6792] bridge_slave_0: entered allmulticast mode [ 277.556108][ T6792] bridge_slave_0: entered promiscuous mode [ 277.742379][ T6792] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.749831][ T6792] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.750046][ T6792] bridge_slave_1: entered allmulticast mode [ 277.854264][ T6792] bridge_slave_1: entered promiscuous mode [ 277.918835][ T7002] fuse: Bad value for 'fd' [ 278.150140][ T6792] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.432551][ T6792] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 282.011475][ T1205] hsr_slave_0: left promiscuous mode [ 282.087602][ T1205] hsr_slave_1: left promiscuous mode [ 282.097108][ T1205] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 282.441834][ T1205] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 285.080019][ T5614] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 285.097952][ T7037] capability: warning: `syz.3.315' uses 32-bit capabilities (legacy support in use) [ 286.517399][ T5614] usb 5-1: device descriptor read/all, error -71 [ 287.330309][ T5870] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 289.583114][ T1205] team0 (unregistering): Port device team_slave_1 removed [ 289.829668][ T1205] team0 (unregistering): Port device team_slave_0 removed [ 289.923447][ T31] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 290.128495][ T31] usb 5-1: Using ep0 maxpacket: 16 [ 290.135173][ T31] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice= 0.00 [ 290.136758][ T31] usb 5-1: too many endpoints for config 0 interface 0 altsetting 3: 255, using maximum allowed: 30 [ 290.136801][ T31] usb 5-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 290.136827][ T31] usb 5-1: config 0 interface 0 has no altsetting 0 [ 290.136856][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.220240][ T31] usb 5-1: config 0 descriptor?? [ 290.677449][ T6792] team0: Port device team_slave_0 added [ 290.781340][ T37] audit: type=1800 audit(1788302700.106:39): pid=7065 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.326" name="zoned" dev="configfs" ino=12768 res=0 errno=0 [ 290.931238][ T37] audit: type=1800 audit(1788302700.266:40): pid=7068 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.326" name="power" dev="configfs" ino=12770 res=0 errno=0 [ 291.016427][ T7069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.095015][ T7069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.204689][ T37] audit: type=1800 audit(1788302700.536:41): pid=7065 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.326" name="zone_nr_conv" dev="configfs" ino=12769 res=0 errno=0 [ 291.552246][ T31] usbhid 5-1:0.0: can't add hid device: -71 [ 291.554808][ T31] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 291.606158][ T31] usb 5-1: USB disconnect, device number 8 [ 293.030456][ T7075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 293.036250][ T7075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 294.014897][ T6792] team0: Port device team_slave_1 added [ 295.819943][ T6792] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 295.820061][ T6792] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 295.820080][ T6792] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 296.799732][ T6792] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 296.799796][ T6792] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.799855][ T6792] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 298.349610][ T5266] 8021q: adding VLAN 0 to HW filter on device eth5 [ 298.766829][ T6792] hsr_slave_0: entered promiscuous mode [ 298.818927][ T6792] hsr_slave_1: entered promiscuous mode [ 298.827762][ T6792] debugfs: 'hsr0' already exists in 'hsr' [ 298.827791][ T6792] Cannot create hsr debugfs directory [ 301.579653][ T5266] 8021q: adding VLAN 0 to HW filter on device eth6 [ 302.868885][ T5743] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 303.299031][ T5743] usb 5-1: Using ep0 maxpacket: 8 [ 303.594034][ T5743] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 303.884673][ T5743] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 303.887939][ T5743] usb 5-1: config 179 has no interface number 0 [ 303.888002][ T5743] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 303.888027][ T5743] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 303.888052][ T5743] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 230, changing to 11 [ 303.888076][ T5743] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 57438, setting to 1024 [ 303.888099][ T5743] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 303.888122][ T5743] usb 5-1: config 179 interface 65 has no altsetting 0 [ 303.888153][ T5743] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.161235][ T5743] usb 5-1: can't set config #179, error -71 [ 306.172461][ T5743] usb 5-1: USB disconnect, device number 9 [ 306.212436][ T7153] netlink: 36 bytes leftover after parsing attributes in process `syz.3.350'. [ 306.741131][ T5266] 8021q: adding VLAN 0 to HW filter on device eth7 [ 306.915798][ T5266] 8021q: adding VLAN 0 to HW filter on device eth8 [ 310.756579][ T7207] fuse: Bad value for 'fd' [ 312.222026][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 314.072560][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 314.571503][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 314.599442][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 314.600782][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 317.786641][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.786783][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.789817][ T59] Bluetooth: hci0: command tx timeout [ 319.850426][ T59] Bluetooth: hci0: command tx timeout [ 320.658785][ T7257] CIFS: Attempting to mount //::1/share [ 320.660795][ T7257] CIFS: VFS: Error connecting to socket. Aborting operation. [ 320.660827][ T7257] CIFS: VFS: cifs_mount failed w/return code = -111 [ 321.929597][ T59] Bluetooth: hci0: command tx timeout [ 324.008513][ T59] Bluetooth: hci0: command tx timeout [ 332.121228][ T7316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 332.140495][ T7316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.664987][ T3339] bridge_slave_1: left allmulticast mode [ 335.665120][ T3339] bridge_slave_1: left promiscuous mode [ 335.665574][ T3339] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.747630][ T3339] bridge_slave_0: left allmulticast mode [ 338.761352][ T3339] bridge_slave_0: left promiscuous mode [ 338.762960][ T3339] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.839222][ T7353] comedi comedi3: dt2817: I/O base address or length out of range [ 340.670947][ T3339] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 340.919480][ T3339] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 341.051512][ T3339] bond0 (unregistering): Released all slaves [ 342.989692][ T10] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 343.249206][ T10] usb 5-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 343.277657][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 343.287728][ T10] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 343.287757][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 343.287843][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 343.287884][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.402224][ T7365] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 343.407373][ T7365] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 343.455669][ T10] pl2303 5-1:1.0: pl2303 converter detected [ 343.841511][ T10] usb 5-1: pl2303 converter now attached to ttyUSB0 [ 344.033475][ T10] usb 5-1: USB disconnect, device number 10 [ 344.071453][ T3339] hsr_slave_0: left promiscuous mode [ 344.123492][ T10] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 344.146222][ T10] pl2303 5-1:1.0: device disconnected [ 344.152043][ T3339] hsr_slave_1: left promiscuous mode [ 344.163090][ T3339] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 344.376854][ T3339] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 344.647781][ T7391] fuse: Bad value for 'fd' [ 345.353338][ T7406] comedi comedi3: dt2817: I/O base address or length out of range [ 346.296932][ T3339] team0 (unregistering): Port device team_slave_1 removed [ 346.378901][ T3339] team0 (unregistering): Port device team_slave_0 removed [ 351.839661][ T7433] overlayfs: overlapping lowerdir path [ 353.147547][ T7213] bridge0: port 1(bridge_slave_0) entered blocking state [ 353.164423][ T7213] bridge0: port 1(bridge_slave_0) entered disabled state [ 353.164759][ T7213] bridge_slave_0: entered allmulticast mode [ 353.182618][ T7213] bridge_slave_0: entered promiscuous mode [ 353.196712][ T7213] bridge0: port 2(bridge_slave_1) entered blocking state [ 353.196861][ T7213] bridge0: port 2(bridge_slave_1) entered disabled state [ 353.197037][ T7213] bridge_slave_1: entered allmulticast mode [ 353.214943][ T7213] bridge_slave_1: entered promiscuous mode [ 354.029274][ T7213] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 354.252801][ T7213] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 354.656108][ T7213] team0: Port device team_slave_0 added [ 354.674825][ T7213] team0: Port device team_slave_1 added [ 354.836007][ T7213] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 354.843097][ T7213] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.843127][ T7213] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 354.916973][ T7213] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 354.925328][ T7213] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.957753][ T7213] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 355.141803][ T7213] hsr_slave_0: entered promiscuous mode [ 355.149540][ T7213] hsr_slave_1: entered promiscuous mode [ 355.156748][ T7213] debugfs: 'hsr0' already exists in 'hsr' [ 355.156775][ T7213] Cannot create hsr debugfs directory [ 356.175078][ T7453] netlink: 116 bytes leftover after parsing attributes in process `syz.0.423'. [ 357.588569][ T7465] comedi comedi3: dt2817: I/O base address or length out of range [ 357.674158][ T7453] gretap0: entered promiscuous mode [ 357.689518][ T7453] gretap0: entered allmulticast mode [ 359.169174][ T7474] overlayfs: overlapping lowerdir path [ 361.137399][ T7213] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 361.231944][ T7213] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 361.276316][ T7213] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 361.527333][ T7213] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 361.545594][ T7213] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 362.481046][ T7213] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 362.528914][ T7213] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 363.096739][ T7213] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 365.764717][ T7510] CIFS: Attempting to mount //::1/share [ 365.910108][ T7510] CIFS: VFS: Error connecting to socket. Aborting operation. [ 365.910305][ T7510] CIFS: VFS: cifs_mount failed w/return code = -111 [ 368.489999][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.072142][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 374.173026][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 374.178688][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 374.192292][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 374.196150][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 376.451216][ T59] Bluetooth: hci5: command tx timeout [ 378.079158][ T7561] overlayfs: overlapping lowerdir path [ 378.488445][ T59] Bluetooth: hci5: command tx timeout [ 378.731802][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.731935][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.563390][ T59] Bluetooth: hci5: command tx timeout [ 384.345628][ T59] Bluetooth: hci5: command tx timeout [ 389.577213][ T7617] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 390.100993][ T7617] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 394.532574][ T7622] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 394.549018][ T7622] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 395.499104][ T7622] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 396.558762][ T1203] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 396.568378][ T59] Bluetooth: hci5: command 0x0c1a tx timeout [ 398.183934][ T1203] usb 5-1: not running at top speed; connect to a high speed hub [ 398.192247][ T1203] usb 5-1: New USB device found, idVendor=05c6, idProduct=9002, bcdDevice=95.b5 [ 398.195182][ T1203] usb 5-1: config 64 has an invalid interface number: 3 but max is 2 [ 398.195209][ T1203] usb 5-1: config 64 has an invalid interface number: 118 but max is 2 [ 398.195227][ T1203] usb 5-1: config 64 has an invalid interface number: 156 but max is 2 [ 398.195252][ T1203] usb 5-1: config 64 has no interface number 0 [ 398.195265][ T1203] usb 5-1: config 64 has no interface number 1 [ 398.195273][ T1203] usb 5-1: config 64 has no interface number 2 [ 398.195405][ T1203] usb 5-1: config 64 interface 118 has no altsetting 0 [ 398.195423][ T1203] usb 5-1: config 64 interface 156 has no altsetting 0 [ 398.367957][ T1203] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.372657][ T1203] usb 5-1: Product: syz [ 398.372678][ T1203] usb 5-1: Manufacturer: syz [ 398.372692][ T1203] usb 5-1: SerialNumber: syz [ 398.698948][ T59] Bluetooth: hci5: command 0x0c1a tx timeout [ 399.718412][ T1203] usb 5-1: USB disconnect, device number 11 [ 401.687496][ T59] Bluetooth: hci5: command 0x0c1a tx timeout [ 404.129413][ T7532] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.129625][ T7532] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.129828][ T7532] bridge_slave_0: entered allmulticast mode [ 404.152429][ T7532] bridge_slave_0: entered promiscuous mode [ 404.176278][ T7532] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.176374][ T7532] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.176549][ T7532] bridge_slave_1: entered allmulticast mode [ 404.190665][ T7532] bridge_slave_1: entered promiscuous mode [ 404.520531][ T7532] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.582342][ T7532] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 406.182720][ T7532] team0: Port device team_slave_0 added [ 406.226892][ T7532] team0: Port device team_slave_1 added [ 407.137013][ T7532] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.137117][ T7532] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.137142][ T7532] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 408.347963][ T7532] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 408.348743][ T7532] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 408.348784][ T7532] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 411.046358][ T7694] syz_tun: entered allmulticast mode [ 411.638516][ T5614] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 411.778955][ T7700] syz_tun: left allmulticast mode [ 411.815321][ T5614] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 411.861079][ T5614] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 411.861167][ T5614] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.904374][ T5614] usb 3-1: config 0 descriptor?? [ 411.958888][ T5614] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 414.381854][ T5732] usb 3-1: USB disconnect, device number 3 [ 416.286274][ T7532] hsr_slave_0: entered promiscuous mode [ 416.300283][ T7532] hsr_slave_1: entered promiscuous mode [ 416.316423][ T7532] debugfs: 'hsr0' already exists in 'hsr' [ 416.325057][ T7532] Cannot create hsr debugfs directory [ 417.560540][ T1209] bridge_slave_1: left allmulticast mode [ 417.560689][ T1209] bridge_slave_1: left promiscuous mode [ 417.561048][ T1209] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.638520][ T7719] netlink: 28 bytes leftover after parsing attributes in process `syz.4.479'. [ 417.781719][ T7724] fuse: Bad value for 'fd' [ 419.436359][ T1209] bridge_slave_0: left allmulticast mode [ 419.442409][ T1209] bridge_slave_0: left promiscuous mode [ 419.443208][ T1209] bridge0: port 1(bridge_slave_0) entered disabled state [ 423.299623][ T5614] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 423.523861][ T5614] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 423.567535][ T5614] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.578492][ T5614] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.593420][ T5614] usb 4-1: config 0 descriptor?? [ 423.617352][ T5614] pwc: Askey VC010 type 2 USB webcam detected. [ 423.925155][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 424.028543][ T5614] pwc: recv_control_msg error -32 req 02 val 2b00 [ 424.046637][ T5614] pwc: recv_control_msg error -32 req 02 val 2700 [ 424.055226][ T5614] pwc: recv_control_msg error -32 req 02 val 2c00 [ 424.063094][ T5614] pwc: recv_control_msg error -32 req 04 val 1000 [ 424.064338][ T5614] pwc: recv_control_msg error -32 req 04 val 1300 [ 424.065314][ T5614] pwc: recv_control_msg error -32 req 04 val 1400 [ 424.066117][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 424.066495][ T5614] pwc: recv_control_msg error -32 req 02 val 2000 [ 424.116351][ T5614] pwc: recv_control_msg error -32 req 02 val 2100 [ 424.131612][ T5614] pwc: recv_control_msg error -32 req 04 val 1500 [ 424.133006][ T5614] pwc: recv_control_msg error -32 req 02 val 2500 [ 424.134210][ T5614] pwc: recv_control_msg error -32 req 02 val 2400 [ 424.137362][ T5614] pwc: recv_control_msg error -32 req 02 val 2600 [ 424.271795][ T1209] bond0 (unregistering): Released all slaves [ 424.381181][ T5614] pwc: recv_control_msg error -71 req 02 val 2800 [ 424.391573][ T5614] pwc: recv_control_msg error -71 req 04 val 1100 [ 424.392093][ T5614] pwc: recv_control_msg error -71 req 04 val 1200 [ 424.648688][ T5266] 8021q: adding VLAN 0 to HW filter on device eth5 [ 424.731020][ T5614] pwc: Registered as video103. [ 424.744201][ T5614] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input7 [ 424.830631][ T5614] usb 4-1: USB disconnect, device number 5 [ 425.487977][ T7756] FAULT_INJECTION: forcing a failure. [ 425.487977][ T7756] name failslab, interval 1, probability 0, space 0, times 0 [ 425.504793][ T7756] CPU: 1 UID: 0 PID: 7756 Comm: syz.3.494 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 425.504827][ T7756] Tainted: [L]=SOFTLOCKUP [ 425.504831][ T7756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 425.504845][ T7756] Call Trace: [ 425.504850][ T7756] [ 425.504856][ T7756] dump_stack_lvl+0xe8/0x150 [ 425.505027][ T7756] should_fail_ex+0x46b/0x600 [ 425.505077][ T7756] should_failslab+0xa8/0x100 [ 425.505130][ T7756] __kmalloc_cache_noprof+0xa1/0x680 [ 425.505171][ T7756] ? __se_sys_fanotify_init+0x4d8/0xb20 [ 425.505195][ T7756] ? __se_sys_fanotify_init+0x4d8/0xb20 [ 425.505208][ T7756] __se_sys_fanotify_init+0x4d8/0xb20 [ 425.505224][ T7756] ? __pfx___se_sys_fanotify_init+0x10/0x10 [ 425.505254][ T7756] do_syscall_64+0x166/0x520 [ 425.505352][ T7756] ? trace_irq_disable+0x3b/0x140 [ 425.505382][ T7756] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.505411][ T7756] ? clear_bhb_loop+0x70/0xc0 [ 425.505435][ T7756] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.505459][ T7756] RIP: 0033:0x7ff6ce12e159 [ 425.505478][ T7756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.505494][ T7756] RSP: 002b:00007ff6cc386028 EFLAGS: 00000246 ORIG_RAX: 000000000000012c [ 425.505515][ T7756] RAX: ffffffffffffffda RBX: 00007ff6ce3b5fa0 RCX: 00007ff6ce12e159 [ 425.505524][ T7756] RDX: 0000000000000000 RSI: 0000000000101000 RDI: 0000000000000040 [ 425.505531][ T7756] RBP: 00007ff6ce1c5024 R08: 0000000000000000 R09: 0000000000000000 [ 425.505537][ T7756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 425.505543][ T7756] R13: 00007ff6ce3b6038 R14: 00007ff6ce3b5fa0 R15: 00007ffcc09f5d38 [ 425.505559][ T7756] [ 426.177020][ T1209] hsr_slave_0: left promiscuous mode [ 426.232102][ T1209] hsr_slave_1: left promiscuous mode [ 426.246636][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 426.280489][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 427.769599][ T7770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.780849][ T7770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.795546][ T7788] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 431.862592][ T7788] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 431.941218][ T7788] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 431.952140][ T1209] team0 (unregistering): Port device team_slave_1 removed [ 432.000832][ T7788] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 432.019907][ T7788] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 432.640470][ T1209] team0 (unregistering): Port device team_slave_0 removed [ 434.461137][ T7788] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 434.514459][ T7788] Bluetooth: hci0: command tx timeout [ 434.547353][ T5612] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 434.555973][ T5612] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 434.567559][ T5612] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 434.568512][ T5612] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 437.020946][ T5612] Bluetooth: hci0: command tx timeout [ 437.021066][ T5612] Bluetooth: hci2: command tx timeout [ 438.227908][ T5266] 8021q: adding VLAN 0 to HW filter on device eth6 [ 438.924429][ T5266] 8021q: adding VLAN 0 to HW filter on device eth7 [ 439.380948][ T5612] Bluetooth: hci0: command tx timeout [ 439.383905][ T59] Bluetooth: hci2: command tx timeout [ 439.542006][ T5266] 8021q: adding VLAN 0 to HW filter on device eth8 [ 440.182869][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.183044][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.462436][ T59] Bluetooth: hci2: command tx timeout [ 441.469918][ T5612] Bluetooth: hci0: command tx timeout [ 442.933927][ T1209] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 444.379579][ T59] Bluetooth: hci2: command tx timeout [ 445.046839][ T7856] FAULT_INJECTION: forcing a failure. [ 445.046839][ T7856] name failslab, interval 1, probability 0, space 0, times 0 [ 445.046930][ T7856] CPU: 1 UID: 0 PID: 7856 Comm: syz.0.509 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 445.046957][ T7856] Tainted: [L]=SOFTLOCKUP [ 445.046963][ T7856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 445.046975][ T7856] Call Trace: [ 445.046982][ T7856] [ 445.046991][ T7856] dump_stack_lvl+0xe8/0x150 [ 445.047021][ T7856] should_fail_ex+0x46b/0x600 [ 445.047041][ T7856] should_failslab+0xa8/0x100 [ 445.047066][ T7856] __kmalloc_noprof+0xfb/0x790 [ 445.047086][ T7856] ? __kasan_kmalloc+0x93/0xb0 [ 445.047144][ T7856] ? nla_strdup+0x9d/0x140 [ 445.047164][ T7856] ? nla_strdup+0x9d/0x140 [ 445.047189][ T7856] nla_strdup+0x9d/0x140 [ 445.047212][ T7856] nf_tables_newtable+0x49a/0x1990 [ 445.047394][ T7856] nfnetlink_rcv+0x1291/0x28d0 [ 445.047476][ T7856] ? __local_bh_enable+0x1e3/0x2f0 [ 445.047548][ T7856] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 445.047587][ T7856] ? ref_tracker_free+0x668/0x820 [ 445.047632][ T7856] ? skb_clone+0x246/0x3a0 [ 445.047727][ T7856] ? __netlink_deliver_tap+0x811/0x860 [ 445.047793][ T7856] ? netlink_deliver_tap+0x2e/0x1b0 [ 445.047817][ T7856] ? netlink_deliver_tap+0x2e/0x1b0 [ 445.047846][ T7856] netlink_unicast+0x7f5/0x990 [ 445.047878][ T7856] netlink_sendmsg+0x813/0xb40 [ 445.047913][ T7856] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.047939][ T7856] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 445.047988][ T7856] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.048015][ T7856] sock_sendmsg_nosec+0x13a/0x180 [ 445.048081][ T7856] ____sys_sendmsg+0x565/0x870 [ 445.048115][ T7856] ? __pfx_____sys_sendmsg+0x10/0x10 [ 445.048148][ T7856] ? import_iovec+0x73/0xa0 [ 445.048183][ T7856] ___sys_sendmsg+0x2a5/0x360 [ 445.048205][ T7856] ? __lock_acquire+0x6df/0x2e40 [ 445.048244][ T7856] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.048267][ T7856] ? futex_wait+0x2a2/0x390 [ 445.048325][ T7856] ? __fget_files+0x2a/0x420 [ 445.048356][ T7856] ? __fget_files+0x3a8/0x420 [ 445.048381][ T7856] __x64_sys_sendmsg+0x1b7/0x290 [ 445.048407][ T7856] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 445.048448][ T7856] do_syscall_64+0x166/0x520 [ 445.048468][ T7856] ? trace_irq_disable+0x3b/0x140 [ 445.048488][ T7856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.048507][ T7856] ? clear_bhb_loop+0x70/0xc0 [ 445.048529][ T7856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.048546][ T7856] RIP: 0033:0x7fb8975ce159 [ 445.048565][ T7856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.048579][ T7856] RSP: 002b:00007fb895826028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 445.048600][ T7856] RAX: ffffffffffffffda RBX: 00007fb897855fa0 RCX: 00007fb8975ce159 [ 445.048613][ T7856] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 445.048626][ T7856] RBP: 00007fb897665024 R08: 0000000000000000 R09: 0000000000000000 [ 445.048637][ T7856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 445.048647][ T7856] R13: 00007fb897856038 R14: 00007fb897855fa0 R15: 00007ffed7a2d248 [ 445.048676][ T7856] [ 445.886205][ T7866] netlink: 20 bytes leftover after parsing attributes in process `syz.0.515'. [ 446.442990][ T1209] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.348943][ T7886] FAULT_INJECTION: forcing a failure. [ 451.348943][ T7886] name fail_futex, interval 1, probability 0, space 0, times 1 [ 451.349329][ T7886] CPU: 1 UID: 0 PID: 7886 Comm: syz.0.516 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 451.349355][ T7886] Tainted: [L]=SOFTLOCKUP [ 451.349361][ T7886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 451.349371][ T7886] Call Trace: [ 451.349378][ T7886] [ 451.349392][ T7886] dump_stack_lvl+0xe8/0x150 [ 451.349423][ T7886] should_fail_ex+0x46b/0x600 [ 451.349447][ T7886] get_futex_key+0x8e2/0x1580 [ 451.349482][ T7886] ? __pfx_get_futex_key+0x10/0x10 [ 451.349516][ T7886] futex_wake+0x119/0x600 [ 451.349540][ T7886] ? __pfx_futex_wake+0x10/0x10 [ 451.349557][ T7886] ? do_raw_spin_lock+0x12b/0x2f0 [ 451.349591][ T7886] do_futex+0x458/0x4e0 [ 451.349620][ T7886] ? __pfx_do_futex+0x10/0x10 [ 451.349649][ T7886] ? __might_fault+0xaf/0x130 [ 451.349713][ T7886] mm_exit_exec_release+0x10d/0x290 [ 451.349740][ T7886] exit_mm+0x50/0x240 [ 451.349759][ T7886] do_exit+0x6cd/0x2360 [ 451.349777][ T7886] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 451.349917][ T7886] ? __pfx_do_exit+0x10/0x10 [ 451.349935][ T7886] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 451.349964][ T7886] ? rt_spin_unlock+0x159/0x200 [ 451.349989][ T7886] do_group_exit+0x22d/0x2f0 [ 451.350006][ T7886] ? rt_spin_unlock+0x165/0x200 [ 451.350030][ T7886] get_signal+0x121b/0x12c0 [ 451.350073][ T7886] arch_do_signal_or_restart+0xbb/0x860 [ 451.350120][ T7886] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 451.350151][ T7886] ? ksys_write+0x248/0x270 [ 451.350186][ T7886] exit_to_user_mode_loop+0x10e/0x770 [ 451.350219][ T7886] ? rcu_is_watching+0x16/0xb0 [ 451.350245][ T7886] do_syscall_64+0x328/0x520 [ 451.350263][ T7886] ? trace_irq_disable+0x3b/0x140 [ 451.350283][ T7886] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.350301][ T7886] ? clear_bhb_loop+0x70/0xc0 [ 451.350321][ T7886] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.350337][ T7886] RIP: 0033:0x7fb8975ce159 [ 451.350355][ T7886] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.350369][ T7886] RSP: 002b:00007fb8958050e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 451.350388][ T7886] RAX: fffffffffffffe00 RBX: 00007fb897856098 RCX: 00007fb8975ce159 [ 451.350401][ T7886] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fb897856098 [ 451.350412][ T7886] RBP: 00007fb897856090 R08: 0000000000000000 R09: 0000000000000000 [ 451.350423][ T7886] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 451.350433][ T7886] R13: 00007fb897856128 R14: 00007ffed7a2d160 R15: 00007ffed7a2d248 [ 451.350464][ T7886] [ 451.731998][ T1209] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.403902][ T7768] bridge0: port 1(bridge_slave_0) entered blocking state [ 452.404157][ T7768] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.404352][ T7768] bridge_slave_0: entered allmulticast mode [ 452.437100][ T7768] bridge_slave_0: entered promiscuous mode [ 452.852303][ T7768] bridge0: port 2(bridge_slave_1) entered blocking state [ 452.852526][ T7768] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.852716][ T7768] bridge_slave_1: entered allmulticast mode [ 452.858801][ T7768] bridge_slave_1: entered promiscuous mode [ 453.680648][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 453.889992][ T31] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 453.891513][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 453.891572][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 453.891610][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 453.891632][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 453.891669][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.897895][ T7905] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 453.898214][ T7905] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 453.922656][ T31] pl2303 3-1:1.0: pl2303 converter detected [ 453.957360][ T1209] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.996688][ T7918] netlink: 12 bytes leftover after parsing attributes in process `syz.0.523'. [ 454.430661][ T31] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 454.824305][ T5614] usb 3-1: USB disconnect, device number 4 [ 455.131390][ T5614] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 455.133899][ T5614] pl2303 3-1:1.0: device disconnected [ 455.362122][ T7768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 455.614327][ T7768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 456.489852][ T7796] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.490092][ T7796] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.490278][ T7796] bridge_slave_0: entered allmulticast mode [ 456.545291][ T7796] bridge_slave_0: entered promiscuous mode [ 456.659549][ T7796] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.659718][ T7796] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.659912][ T7796] bridge_slave_1: entered allmulticast mode [ 456.694911][ T7796] bridge_slave_1: entered promiscuous mode [ 456.732155][ T7768] team0: Port device team_slave_0 added [ 457.066183][ T7768] team0: Port device team_slave_1 added [ 458.426454][ T7796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.148804][ T7960] fuse: Invalid rootmode [ 460.293117][ T7796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.322640][ T7768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 460.322730][ T7768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.322754][ T7768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 460.501667][ T7768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 460.502070][ T7768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 460.502093][ T7768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.189185][ T37] audit: type=1800 audit(1788302871.526:42): pid=7970 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.534" name="zoned" dev="configfs" ino=15942 res=0 errno=0 [ 462.259636][ T7796] team0: Port device team_slave_0 added [ 462.598509][ T37] audit: type=1800 audit(1788302871.926:43): pid=7970 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.534" name="zoned" dev="configfs" ino=15944 res=0 errno=0 [ 462.644502][ T37] audit: type=1800 audit(1788302871.976:44): pid=7970 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.534" name="power" dev="configfs" ino=15945 res=0 errno=0 [ 462.738642][ T5732] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 462.824140][ T7796] team0: Port device team_slave_1 added [ 462.951475][ T5732] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 462.963035][ T5732] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 462.963126][ T5732] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 462.963149][ T5732] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 462.963172][ T5732] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 462.963205][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.076225][ T7973] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 463.076464][ T7973] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 463.117984][ T5732] pl2303 3-1:1.0: pl2303 converter detected [ 463.193328][ T5732] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 463.603712][ T5736] usb 3-1: USB disconnect, device number 5 [ 463.603753][ T7796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 463.603807][ T7796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.603831][ T7796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 463.766128][ T7768] hsr_slave_0: entered promiscuous mode [ 463.800615][ T5736] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 463.819969][ T5736] pl2303 3-1:1.0: device disconnected [ 463.833159][ T7768] hsr_slave_1: entered promiscuous mode [ 463.845405][ T7768] debugfs: 'hsr0' already exists in 'hsr' [ 463.845517][ T7768] Cannot create hsr debugfs directory [ 463.863981][ T7796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.864051][ T7796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.864075][ T7796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.992719][ T1209] bridge_slave_1: left allmulticast mode [ 463.992811][ T1209] bridge_slave_1: left promiscuous mode [ 463.993051][ T1209] bridge0: port 2(bridge_slave_1) entered disabled state [ 464.216159][ T1209] bridge_slave_0: left allmulticast mode [ 464.222055][ T1209] bridge_slave_0: left promiscuous mode [ 464.223054][ T1209] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.425452][ T7980] netlink: 132 bytes leftover after parsing attributes in process `syz.3.536'. [ 466.005939][ T7991] fuse: Unknown parameter '00000000000000000000' [ 466.495803][ T1209] bridge_slave_1: left allmulticast mode [ 466.496257][ T1209] bridge_slave_1: left promiscuous mode [ 466.496782][ T1209] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.865239][ T1209] bridge_slave_0: left allmulticast mode [ 467.865322][ T1209] bridge_slave_0: left promiscuous mode [ 467.865981][ T1209] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.295482][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 470.388616][ T8012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.415643][ T8012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.460157][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 470.818144][ T8018] netlink: 132 bytes leftover after parsing attributes in process `syz.2.546'. [ 471.622094][ T1209] bond0 (unregistering): Released all slaves [ 473.010454][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 473.084398][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 473.174791][ T1209] bond0 (unregistering): Released all slaves [ 475.099569][ T8032] fuse: Unknown parameter '00000000000000000000' [ 475.838215][ T37] audit: type=1326 audit(1788302885.166:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8039 comm="syz.2.552" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f528374e159 code=0x7ffc0000 [ 476.041413][ T37] audit: type=1326 audit(1788302885.206:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8039 comm="syz.2.552" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f528374e159 code=0x7ffc0000 [ 477.043168][ T8049] netlink: 132 bytes leftover after parsing attributes in process `syz.0.555'. [ 477.629299][ T7796] hsr_slave_0: entered promiscuous mode [ 477.631741][ T7796] hsr_slave_1: entered promiscuous mode [ 477.633202][ T7796] debugfs: 'hsr0' already exists in 'hsr' [ 477.633279][ T7796] Cannot create hsr debugfs directory [ 477.634659][ T8045] tipc: Started in network mode [ 477.634748][ T8045] tipc: Node identity 7e8d3361760a, cluster identity 4711 [ 477.651595][ T8045] tipc: Enabled bearer , priority 10 [ 479.237394][ T5736] tipc: Node number set to 143078241 [ 479.488760][ T5870] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 479.755171][ T8066] fuse: Unknown parameter '00000000000000000000' [ 479.839130][ T5870] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 479.851493][ T5870] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 479.851575][ T5870] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 479.851599][ T5870] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 479.851621][ T5870] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 479.851657][ T5870] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.004657][ T8052] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 480.004915][ T8052] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 480.063575][ T5870] pl2303 3-1:1.0: pl2303 converter detected [ 480.107104][ T5870] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 480.757013][ T8068] bridge1: entered promiscuous mode [ 480.761614][ T8068] bridge1: entered allmulticast mode [ 480.793679][ T8068] team0: Port device bridge1 added [ 480.842394][ T5266] 8021q: adding VLAN 0 to HW filter on device eth9 [ 480.914038][ T5736] usb 3-1: USB disconnect, device number 6 [ 480.982040][ T5736] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 480.995609][ T5736] pl2303 3-1:1.0: device disconnected [ 481.393046][ T1209] hsr_slave_0: left promiscuous mode [ 481.409698][ T1209] hsr_slave_1: left promiscuous mode [ 481.410956][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.430273][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 482.191771][ T8091] netlink: 132 bytes leftover after parsing attributes in process `syz.3.565'. [ 482.623888][ T1209] hsr_slave_0: left promiscuous mode [ 482.708526][ T1209] hsr_slave_1: left promiscuous mode [ 482.715931][ T1209] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 482.715959][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 482.981959][ T1209] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 482.982043][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 483.006422][ T8099] fuse: Unknown parameter 'user00000000000000000000' [ 483.104824][ T1209] veth1_macvtap: left promiscuous mode [ 483.112481][ T1209] veth0_macvtap: left promiscuous mode [ 483.125122][ T1209] veth1_vlan: left promiscuous mode [ 483.130940][ T1209] veth0_vlan: left promiscuous mode [ 484.685521][ T1209] team0 (unregistering): Port device team_slave_1 removed [ 484.741356][ T1209] team0 (unregistering): Port device team_slave_0 removed [ 485.481550][ T1209] team0 (unregistering): Port device team_slave_1 removed [ 485.569470][ T1209] team0 (unregistering): Port device team_slave_0 removed [ 486.840363][ T5266] 8021q: adding VLAN 0 to HW filter on device eth10 [ 486.938139][ T5266] 8021q: adding VLAN 0 to HW filter on device eth11 [ 487.135113][ T5612] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 487.994239][ T5612] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 488.015650][ T5612] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 488.038747][ T5266] 8021q: adding VLAN 0 to HW filter on device eth12 [ 488.039045][ T5612] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 488.058541][ T5612] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 488.463592][ T5732] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 488.819524][ T5732] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 488.821040][ T5732] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 488.821069][ T5732] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 488.821090][ T5732] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 488.821112][ T5732] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 488.821147][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.904466][ T8138] netlink: 132 bytes leftover after parsing attributes in process `syz.3.576'. [ 489.648114][ T8130] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 489.648435][ T8130] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 489.711223][ T5732] pl2303 3-1:1.0: pl2303 converter detected [ 490.103462][ T5732] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 490.180003][ T59] Bluetooth: hci5: command tx timeout [ 490.350895][ T5732] usb 3-1: USB disconnect, device number 7 [ 490.429602][ T8148] jffs2: notice: (8148) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 490.576008][ T5732] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 490.587542][ T5732] pl2303 3-1:1.0: device disconnected [ 492.723128][ T59] Bluetooth: hci5: command tx timeout [ 493.642041][ T8184] netlink: 132 bytes leftover after parsing attributes in process `syz.2.586'. [ 494.715462][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 494.730533][ T7798] Bluetooth: hci5: command tx timeout [ 494.754278][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 494.766957][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 494.785069][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 494.792744][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 495.875387][ T8205] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 497.314644][ T59] Bluetooth: hci5: command tx timeout [ 497.314764][ T5612] Bluetooth: hci0: command tx timeout [ 499.680524][ T5612] Bluetooth: hci0: command tx timeout [ 500.290122][ T8239] netlink: 132 bytes leftover after parsing attributes in process `syz.3.595'. [ 501.509211][ T1209] IPVS: stop unused estimator thread 0... [ 501.624052][ T1348] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.627080][ T1348] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.688353][ T59] Bluetooth: hci0: command tx timeout [ 503.811979][ T59] Bluetooth: hci0: command tx timeout [ 507.356204][ T8289] netlink: 132 bytes leftover after parsing attributes in process `syz.3.605'. [ 508.409138][ T31] usb 1-1: USB disconnect, device number 4 [ 510.554881][ T8311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.613'. [ 511.021031][ T8311] bridge_slave_1: left allmulticast mode [ 511.027386][ T8311] bridge_slave_1: left promiscuous mode [ 511.075513][ T8311] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.400204][ T8311] bridge_slave_0: left allmulticast mode [ 511.400286][ T8311] bridge_slave_0: left promiscuous mode [ 511.448997][ T8311] bridge0: port 1(bridge_slave_0) entered disabled state [ 513.335297][ T8326] random: crng reseeded on system resumption [ 513.891132][ T8329] syz_tun: entered allmulticast mode [ 513.985413][ T8341] netlink: 68 bytes leftover after parsing attributes in process `syz.3.623'. [ 515.216237][ T8341] ubi0: attaching mtd0 [ 515.313727][ T8341] ubi0: scanning is finished [ 515.318883][ T8341] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 515.336114][ T8348] UBIFS error (pid: 8348): cannot open "ubi0:testvol", error -19 [ 515.499578][ T8323] syz_tun: left allmulticast mode [ 515.537322][ T8123] bridge0: port 1(bridge_slave_0) entered blocking state [ 515.537541][ T8123] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.537744][ T8123] bridge_slave_0: entered allmulticast mode [ 515.551391][ T8123] bridge_slave_0: entered promiscuous mode [ 515.566633][ T8123] bridge0: port 2(bridge_slave_1) entered blocking state [ 515.566762][ T8123] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.566960][ T8123] bridge_slave_1: entered allmulticast mode [ 515.585237][ T8123] bridge_slave_1: entered promiscuous mode [ 516.042417][ T8123] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 516.201200][ T8123] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 516.604258][ T8341] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 519.006492][ T8123] team0: Port device team_slave_0 added [ 519.100345][ T8123] team0: Port device team_slave_1 added [ 519.142677][ T5732] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 519.273810][ T8393] syz_tun: entered allmulticast mode [ 519.353511][ T5732] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 519.359678][ T5732] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.364157][ T5732] usb 1-1: config 0 descriptor?? [ 519.746060][ T8387] IPVS: length: 31 != 24 [ 519.881289][ T8401] overlayfs: overlapping lowerdir path [ 519.959868][ T8391] overlay: Unknown parameter '/' [ 520.280163][ T8387] loop5: detected capacity change from 0 to 7 [ 520.864919][ T8123] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 520.868392][ T8123] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 520.868425][ T8123] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 521.121841][ T5732] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 521.137084][ T5732] [drm:udl_init] *ERROR* Selecting channel failed [ 521.257896][ T5732] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 521.278602][ T5732] [drm] Initialized udl on minor 1 [ 521.312561][ T5732] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 521.324484][ T5732] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 521.471463][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 521.556824][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 521.557034][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 521.567372][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 521.567456][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 521.584336][ T8123] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 521.584356][ T8123] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 521.584380][ T8123] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 521.595033][ T8385] syz_tun: left allmulticast mode [ 521.673070][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 521.673162][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 521.673924][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 521.673992][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 521.697049][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 521.697169][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 521.745052][ T5732] usb 1-1: USB disconnect, device number 5 [ 522.012299][ T8408] netlink: 68 bytes leftover after parsing attributes in process `syz.0.637'. [ 522.564631][ T8413] UBIFS error (pid: 8413): cannot open "ubi0:testvol", error -19 [ 522.946743][ T1209] bridge_slave_1: left allmulticast mode [ 522.948417][ T1209] bridge_slave_1: left promiscuous mode [ 522.948676][ T1209] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.313422][ T8418] syz.3.639 uses obsolete (PF_INET,SOCK_PACKET) [ 523.522823][ T1209] bridge_slave_0: left allmulticast mode [ 523.522948][ T1209] bridge_slave_0: left promiscuous mode [ 523.523133][ T1209] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.169666][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 525.299164][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 525.401954][ T1209] bond0 (unregistering): Released all slaves [ 525.675802][ T8123] hsr_slave_0: entered promiscuous mode [ 525.677553][ T8123] hsr_slave_1: entered promiscuous mode [ 525.742377][ T8123] debugfs: 'hsr0' already exists in 'hsr' [ 525.742474][ T8123] Cannot create hsr debugfs directory [ 525.805056][ T5604] ffs_data_put(): freeing [ 525.970539][ T8189] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.971038][ T8189] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.971231][ T8189] bridge_slave_0: entered allmulticast mode [ 525.997704][ T8189] bridge_slave_0: entered promiscuous mode [ 528.309291][ T8189] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.309797][ T8189] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.440707][ T8189] bridge_slave_1: entered allmulticast mode [ 528.479765][ T8189] bridge_slave_1: entered promiscuous mode [ 530.320594][ T1209] hsr_slave_0: left promiscuous mode [ 530.359101][ T1209] hsr_slave_1: left promiscuous mode [ 530.361267][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 530.439281][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 532.019625][ T1209] team0 (unregistering): Port device team_slave_1 removed [ 532.058964][ T1209] team0 (unregistering): Port device team_slave_0 removed [ 532.427006][ T5266] 8021q: adding VLAN 0 to HW filter on device eth5 [ 532.527109][ T8460] netlink: 64 bytes leftover after parsing attributes in process `syz.0.648'. [ 532.745627][ T8189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 532.923648][ T8189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 535.266453][ T8469] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 535.447129][ T8189] team0: Port device team_slave_0 added [ 535.559654][ T8189] team0: Port device team_slave_1 added [ 536.528956][ T8189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 536.536149][ T8189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.536180][ T8189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 536.580657][ T8189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 536.587728][ T8189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.587758][ T8189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 538.668576][ T5266] 8021q: adding VLAN 0 to HW filter on device eth6 [ 539.227864][ T8505] netlink: 68 bytes leftover after parsing attributes in process `syz.2.662'. [ 539.536406][ T8505] ubi0: attaching mtd0 [ 539.669723][ T8508] UBIFS error (pid: 8508): cannot open "ubi0:testvol", error -19 [ 539.699149][ T8505] ubi0: scanning is finished [ 539.699255][ T8505] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 539.966271][ T8189] hsr_slave_0: entered promiscuous mode [ 539.989732][ T8189] hsr_slave_1: entered promiscuous mode [ 539.990603][ T8189] debugfs: 'hsr0' already exists in 'hsr' [ 539.990625][ T8189] Cannot create hsr debugfs directory [ 540.357343][ T8505] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 541.894699][ T1209] bridge_slave_1: left allmulticast mode [ 542.030244][ T1209] bridge_slave_1: left promiscuous mode [ 542.031410][ T1209] bridge0: port 2(bridge_slave_1) entered disabled state [ 542.640377][ T1209] bridge_slave_0: left allmulticast mode [ 542.646282][ T1209] bridge_slave_0: left promiscuous mode [ 542.646539][ T1209] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.820230][ T1209] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 545.947412][ T1209] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 546.054081][ T1209] bond0 (unregistering): Released all slaves [ 547.283932][ T8543] CIFS: Attempting to mount //::1/share [ 547.285224][ T8543] CIFS: VFS: Error connecting to socket. Aborting operation. [ 547.285255][ T8543] CIFS: VFS: cifs_mount failed w/return code = -111 [ 547.893974][ T5612] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 547.943398][ T5612] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 547.952338][ T5612] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 547.976939][ T5612] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 548.016787][ T5612] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 549.870026][ T5743] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 550.028998][ T5743] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 550.039549][ T5743] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 550.039598][ T5743] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 550.039621][ T5743] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.074070][ T8562] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 550.087534][ T5743] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 550.129637][ T1209] hsr_slave_0: left promiscuous mode [ 550.173376][ T59] Bluetooth: hci2: command tx timeout [ 550.180305][ T1209] hsr_slave_1: left promiscuous mode [ 550.200323][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 550.219222][ T1209] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 550.299697][ C1] ================================================================== [ 550.299715][ C1] BUG: KASAN: slab-use-after-free in dummy_timer+0xce9/0x4d50 [ 550.299864][ C1] Read of size 1 at addr ffff8880287f58e8 by task ktimers/1/29 [ 550.299874][ C1] [ 550.299884][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 550.299902][ C1] Tainted: [L]=SOFTLOCKUP [ 550.299906][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 550.299914][ C1] Call Trace: [ 550.299919][ C1] [ 550.299925][ C1] dump_stack_lvl+0xe8/0x150 [ 550.299945][ C1] print_address_description+0x55/0x1e0 [ 550.299970][ C1] ? dummy_timer+0xce9/0x4d50 [ 550.299985][ C1] print_report+0x58/0x70 [ 550.299999][ C1] kasan_report+0x117/0x150 [ 550.300018][ C1] ? dummy_timer+0xce9/0x4d50 [ 550.300036][ C1] dummy_timer+0xce9/0x4d50 [ 550.300054][ C1] ? __lock_acquire+0x6df/0x2e40 [ 550.300070][ C1] ? rtlock_slowlock_locked+0xfb/0x3c20 [ 550.300101][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 550.300115][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 550.300131][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 550.300143][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 550.300159][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 550.300176][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 550.300189][ C1] handle_softirqs+0x1da/0x6d0 [ 550.300206][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 550.300227][ C1] run_ktimerd+0x6a/0x100 [ 550.300242][ C1] smpboot_thread_fn+0x565/0xa70 [ 550.300257][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 550.300274][ C1] kthread+0x38b/0x470 [ 550.300285][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 550.300299][ C1] ? __pfx_kthread+0x10/0x10 [ 550.300310][ C1] ret_from_fork+0x514/0xb70 [ 550.300323][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 550.300333][ C1] ? __switch_to+0xc89/0x1420 [ 550.300349][ C1] ? __pfx_kthread+0x10/0x10 [ 550.300359][ C1] ret_from_fork_asm+0x1a/0x30 [ 550.300373][ C1] [ 550.300377][ C1] [ 550.300382][ C1] Allocated by task 6286: [ 550.300388][ C1] kasan_save_track+0x3e/0x80 [ 550.300401][ C1] __kasan_kmalloc+0x93/0xb0 [ 550.300414][ C1] __kmalloc_noprof+0x41d/0x790 [ 550.300427][ C1] usb_copy_descriptors+0xf7/0x320 [ 550.300498][ C1] f_midi2_bind+0x2736/0x2c40 [ 550.300535][ C1] usb_add_function+0x290/0x930 [ 550.300547][ C1] configfs_composite_bind+0xde0/0x1410 [ 550.300561][ C1] gadget_bind_driver+0x2ca/0x9e0 [ 550.300570][ C1] really_probe+0x254/0xae0 [ 550.300637][ C1] __driver_probe_device+0x1e8/0x360 [ 550.300649][ C1] driver_probe_device+0x4f/0x240 [ 550.300661][ C1] __driver_attach+0x339/0x600 [ 550.300673][ C1] bus_for_each_dev+0x23e/0x2c0 [ 550.300682][ C1] bus_add_driver+0x348/0x670 [ 550.300708][ C1] driver_register+0x23a/0x320 [ 550.300721][ C1] usb_gadget_register_driver_owner+0xf9/0x270 [ 550.300731][ C1] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 550.300741][ C1] configfs_write_iter+0x33a/0x430 [ 550.300764][ C1] vfs_write+0x61e/0xbb0 [ 550.300775][ C1] ksys_write+0x156/0x270 [ 550.300784][ C1] do_syscall_64+0x166/0x520 [ 550.300795][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.300806][ C1] [ 550.300808][ C1] Freed by task 8297: [ 550.300813][ C1] kasan_save_track+0x3e/0x80 [ 550.300825][ C1] kasan_save_free_info+0x40/0x50 [ 550.300835][ C1] __kasan_slab_free+0x5c/0x80 [ 550.300848][ C1] kfree+0x1c5/0x6d0 [ 550.300858][ C1] usb_free_all_descriptors+0x78/0x110 [ 550.300869][ C1] purge_configs_funcs+0x248/0x3d0 [ 550.300882][ C1] configfs_composite_unbind+0xa0/0x1b0 [ 550.300895][ C1] gadget_unbind_driver+0x1cb/0x410 [ 550.300904][ C1] device_release_driver_internal+0x48b/0x880 [ 550.300917][ C1] driver_detach+0x1f3/0x2d0 [ 550.300929][ C1] bus_remove_driver+0x229/0x320 [ 550.300938][ C1] usb_gadget_unregister_driver+0x4e/0x70 [ 550.300947][ C1] gadget_dev_desc_UDC_store+0x17a/0x2f0 [ 550.300958][ C1] configfs_write_iter+0x33a/0x430 [ 550.300969][ C1] vfs_write+0x61e/0xbb0 [ 550.300978][ C1] ksys_write+0x156/0x270 [ 550.300987][ C1] do_syscall_64+0x166/0x520 [ 550.300997][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.301007][ C1] [ 550.301009][ C1] The buggy address belongs to the object at ffff8880287f5800 [ 550.301009][ C1] which belongs to the cache kmalloc-512 of size 512 [ 550.301019][ C1] The buggy address is located 232 bytes inside of [ 550.301019][ C1] freed 512-byte region [ffff8880287f5800, ffff8880287f5a00) [ 550.301030][ C1] [ 550.301033][ C1] The buggy address belongs to the physical page: [ 550.301043][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880287f5800 pfn:0x287f4 [ 550.301055][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 550.301064][ C1] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 550.301083][ C1] page_type: f5(slab) [ 550.301094][ C1] raw: 0080000000000240 ffff88813ffbbc80 ffffea000184f910 ffffea0000a6f010 [ 550.301103][ C1] raw: ffff8880287f5800 000000000010000c 00000000f5000000 0000000000000000 [ 550.301113][ C1] head: 0080000000000240 ffff88813ffbbc80 ffffea000184f910 ffffea0000a6f010 [ 550.301123][ C1] head: ffff8880287f5800 000000000010000c 00000000f5000000 0000000000000000 [ 550.301133][ C1] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 550.301141][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 550.301147][ C1] page dumped because: kasan: bad access detected [ 550.301161][ C1] page_owner tracks the page as allocated [ 550.301167][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5352, tgid 5352 (dhcpcd-run-hook), ts 54242267243 [ 550.301197][ C1] post_alloc_hook+0x1f9/0x250 [ 550.301217][ C1] get_page_from_freelist+0x2591/0x2600 [ 550.301244][ C1] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 550.301264][ C1] allocate_slab+0x7d/0x620 [ 550.301274][ C1] refill_objects+0x2d8/0x350 [ 550.301283][ C1] __pcs_replace_empty_main+0x339/0x690 [ 550.301298][ C1] __kmalloc_cache_noprof+0x46f/0x680 [ 550.301311][ C1] alloc_bprm+0x79/0x640 [ 550.301322][ C1] do_execveat_common+0x172/0x670 [ 550.301333][ C1] __x64_sys_execve+0x97/0xc0 [ 550.301344][ C1] do_syscall_64+0x166/0x520 [ 550.301353][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.301363][ C1] page last free pid 5298 tgid 5298 ts 52510113378 stack trace: [ 550.301371][ C1] __free_frozen_pages+0xf8e/0x1070 [ 550.301383][ C1] __slab_free+0x250/0x2a0 [ 550.301395][ C1] qlist_free_all+0x99/0x100 [ 550.301407][ C1] kasan_quarantine_reduce+0x148/0x160 [ 550.301419][ C1] __kasan_slab_alloc+0x22/0x80 [ 550.301432][ C1] __kmalloc_noprof+0x3b9/0x790 [ 550.301444][ C1] tomoyo_realpath_from_path+0xef/0x640 [ 550.301458][ C1] tomoyo_path_perm+0x283/0x560 [ 550.301466][ C1] security_inode_getattr+0x12b/0x310 [ 550.301481][ C1] __x64_sys_newfstat+0x133/0x270 [ 550.301496][ C1] do_syscall_64+0x166/0x520 [ 550.301505][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.301515][ C1] [ 550.301518][ C1] Memory state around the buggy address: [ 550.301524][ C1] ffff8880287f5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 550.301531][ C1] ffff8880287f5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 550.301538][ C1] >ffff8880287f5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 550.301543][ C1] ^ [ 550.301549][ C1] ffff8880287f5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 550.301556][ C1] ffff8880287f5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 550.301561][ C1] ================================================================== [ 550.301596][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 551.061563][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 551.072679][ C1] Tainted: [L]=SOFTLOCKUP [ 551.077070][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.087105][ C1] Call Trace: [ 551.090388][ C1] [ 551.093333][ C1] vpanic+0x56d/0xa60 [ 551.097318][ C1] ? rcu_is_watching+0x16/0xb0 [ 551.102069][ C1] ? __pfx_vpanic+0x10/0x10 [ 551.106561][ C1] panic+0xc5/0xd0 [ 551.110350][ C1] ? __pfx_panic+0x10/0x10 [ 551.114761][ C1] ? dummy_timer+0xce9/0x4d50 [ 551.119439][ C1] ? dummy_timer+0xce9/0x4d50 [ 551.124109][ C1] check_panic_on_warn+0x89/0xb0 [ 551.129036][ C1] ? dummy_timer+0xce9/0x4d50 [ 551.133739][ C1] end_report+0x73/0x170 [ 551.138014][ C1] ? dummy_timer+0xce9/0x4d50 [ 551.142680][ C1] kasan_report+0x128/0x150 [ 551.147175][ C1] ? dummy_timer+0xce9/0x4d50 [ 551.151875][ C1] dummy_timer+0xce9/0x4d50 [ 551.156400][ C1] ? __lock_acquire+0x6df/0x2e40 [ 551.161342][ C1] ? rtlock_slowlock_locked+0xfb/0x3c20 [ 551.166919][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 551.172311][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 551.177431][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 551.183234][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 551.188183][ C1] __hrtimer_run_queues+0x3eb/0xaf0 [ 551.193571][ C1] hrtimer_run_softirq+0x1e1/0x2e0 [ 551.198684][ C1] handle_softirqs+0x1da/0x6d0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 551.203450][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 551.208469][ C1] run_ktimerd+0x6a/0x100 [ 551.212796][ C1] smpboot_thread_fn+0x565/0xa70 [ 551.217735][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 551.222752][ C1] kthread+0x38b/0x470 [ 551.226824][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 551.232357][ C1] ? __pfx_kthread+0x10/0x10 [ 551.236944][ C1] ret_from_fork+0x514/0xb70 [ 551.241570][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 551.246694][ C1] ? __switch_to+0xc89/0x1420 [ 551.251403][ C1] ? __pfx_kthread+0x10/0x10 [ 551.256025][ C1] ret_from_fork_asm+0x1a/0x30 [ 551.260829][ C1] [ 551.264151][ C1] Kernel Offset: disabled [ 551.268494][ C1] Rebooting in 86400 seconds..