last executing test programs: 12.771866632s ago: executing program 2 (id=424): r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/cad_pid\x00', 0x242, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="040025bd7000ffdbdf251f000000050013000900000008000d000d0000000500080005000000050011000e000000080005000000000005001a0002000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000850}, 0x1) ioctl$auto_SW_SYNC_IOC_INC(0xffffffffffffffff, 0x40045701, 0x0) mmap$auto(0x87df, 0x400004, 0x1, 0x9b72, 0xffffffffffffffff, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/015/001\x00', 0xa901, 0x0) ioctl$auto(r4, 0x81085520, r4) syz_genetlink_get_family_id$auto_nl80211(0x0, r3) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) ioctl$auto_SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000080)) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x8001, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) msync$auto(0x1ffff000, 0x1800000ff000000, 0x400000004) r5 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r5, &(0x7f00000002c0)=""/190, 0xfffffe39) 12.611219383s ago: executing program 0 (id=426): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) unshare$auto(0x8000000) semget$auto(0x0, 0x2e4a, 0x8000) semtimedop$auto(0x0, &(0x7f0000000000)={0x7, 0x9, 0x36ec}, 0x1f4, 0x0) mkdir$auto(&(0x7f0000000000)='./cgroup.cpu/cpuset.cpus\x00', 0x8cd) bpf$auto_BPF_OBJ_GET_INFO_BY_FD(0xf, &(0x7f00000002c0)=@test={0xffffffffffffffff, 0x0, 0x856, 0x189, 0x8, 0x7fff, 0x7fff, 0x10000, 0xc91a, 0x7, 0x5, 0x3, 0x3, 0x3, 0x6}, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) r0 = inotify_init1$auto(0x3000000000000) socket$nl_generic(0x11, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x2, 0x1) unshare$auto(0x40000080) openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/smaps_rollup\x00', 0x840, 0x0) read$auto(r0, 0x0, 0x7) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) write$auto(0x3, 0x0, 0xfdef) write$auto(0x3, 0x0, 0xfdef) 11.014660108s ago: executing program 0 (id=427): close_range$auto(0x0, 0xfffffffffffff000, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/mm/lru_gen/enabled\x00', 0xb02, 0x0) syz_genetlink_get_family_id$auto_netdev(&(0x7f0000000100), r0) sendmsg$auto_NETDEV_CMD_NAPI_GET2(r0, 0x0, 0x4000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/ceph/parameters/disable_send_metrics\x00', 0xc0202, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x0, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x5, 0x400a) process_vm_writev$auto(0x0, &(0x7f00000011c0)={&(0x7f00000001c0)="42777dd1330b458d0b5c44ca32e94fc00cfbce962ee7d8f31c0f90c327830f55adfdceafcc0f7b5a21ea23bdf5344d47d49d60218e57bb33118d04fdd37f", 0x8}, 0x7, 0x0, 0x7, 0xb5) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sg0\x00', 0x8001, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), r1) r3 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/swradio12\x00', 0x0, 0x0) poll$auto(&(0x7f0000000480)={r3, 0xffff, 0x29}, 0x3, 0x7) write$auto(0x1, 0x0, 0x80000000) write$auto(0x1, 0x0, 0x7ffbfffc) munmap$auto(0x7, 0x894) bpf$auto_BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x122) close_range$auto(0x2, 0x8, 0x0) syz_genetlink_get_family_id$auto_nfc(&(0x7f0000000240), 0xffffffffffffffff) 11.014452071s ago: executing program 3 (id=428): mmap$auto(0x0, 0x4, 0x10000400, 0xeb1, 0xfffffffffffffffa, 0x10000) capset$auto(&(0x7f0000000100)={0x20080522}, 0x0) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) preadv$auto(0xffffffffffffffff, 0x0, 0x7, 0x7, 0x402) madvise$auto(0x110c230000, 0x8031ca, 0x9) read$auto_ptdump_fops_(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000740), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00', @ANYRES16=r1, @ANYBLOB="01002abd7400fcdbdf25140000000c00018008000100", @ANYRES32=r2, @ANYBLOB="0800140000000010"], 0x28}, 0x1, 0x0, 0x0, 0x48c1}, 0xc000) unshare$auto(0x40000080) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r3, &(0x7f0000000500)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x95\x82 )\xca\x99h\xcf\xfdK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) pread64$auto(0xffffffffffffffff, 0x0, 0x8100000041, 0x413e) setsockopt$auto(0x3, 0x11b, 0x2, 0xffffffffffffffff, 0x9) syz_clone3(&(0x7f0000000100)={0x2108000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) fcntl$auto(r4, 0x400, 0x1) execve$auto(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) openat$auto_u32_array_fops_file(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/netdevsim/netdevsim4/ports/2/udp_ports_table0\x00', 0x40201, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x4, 0x84) 10.860180894s ago: executing program 2 (id=429): pread64$auto(0xffffffffffffffff, 0x0, 0x8, 0x8000) pread64$auto(0xffffffffffffffff, 0x0, 0xffffff7f, 0x8000000000009) read$auto_mon_fops_text_t_mon_text(0xffffffffffffffff, 0x0, 0x0) read$auto_v4l2_fops_v4l2_dev(0xffffffffffffffff, &(0x7f0000000000)=""/40, 0x28) close_range$auto(0x2, 0x8, 0x0) r0 = socket(0x10, 0x2, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/netdevsim3/sriov_numvfs\x00', 0x10b142, 0x0) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000200), r0) sendmsg$auto_NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={0x0, 0x390}, 0x1, 0x0, 0x0, 0x95}, 0x80) write$auto(r1, 0x0, 0x3) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/zswap/parameters/compressor\x00', 0xc0002, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ram1\x00', 0x6281, 0x0) ioctl$auto_BLKZEROOUT(r2, 0x127f, 0x0) mmap$auto(0x0, 0xe, 0x7, 0xeb1, 0x401, 0x8000) r3 = socket(0x1a, 0xa, 0x40300) setsockopt$auto(r3, 0x107, 0x14, 0x0, 0x4) sendmmsg$auto(r1, 0x0, 0x2, 0xf12) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x182b02, 0x0) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0xe6e43, 0x0) ioctl$auto_BLKFLSBUF(r4, 0x1261, 0x0) lseek$auto(0x3, 0xffffffffff800002, 0x10) ioctl$auto_BLKFLSBUF(r4, 0x1261, 0x0) r5 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0xa04c0, 0x0) ioctl$auto_KVM_CREATE_VM(r5, 0xae01, 0x0) 9.936726833s ago: executing program 2 (id=430): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @remote}, 0x6a) sendmmsg$auto(0xffffffffffffffff, 0x0, 0x4000, 0x20000047) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x0, 0x6, 0x2, 0x40eb2, 0xffffffffffffffff, 0x308000000000) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2) capset$auto(0x0, &(0x7f0000000000)={0x2, 0x10000002, 0x6}) acct$auto(&(0x7f0000000100)='./cgroup/cgroup.subtree_control\x00') write$auto(0xffffffffffffffff, 0x0, 0x8000007f) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ram8\x00', 0x16fa02, 0x0) sendfile$auto(0x3, r0, 0x0, 0x400000000006) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/kernel/task_delayacct\x00', 0x80282, 0x0) select$auto(0x4, 0x0, 0x0, &(0x7f0000000080)={[0x1ff, 0x7, 0x3, 0x1, 0x7, 0x1000000000000004, 0x15f4da0a, 0x4000000400039, 0x3, 0x2bffffffffffffe, 0x80000002, 0x7a142c64, 0x6d3c, 0x5, 0x80, 0xfb]}, 0x0) shutdown$auto(0x200000003, 0x2) 8.83487804s ago: executing program 3 (id=431): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram5\x00', 0x1eba02, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/bus/usb/drivers/ax88179_178a/remove_id\x00', 0x488081, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0x82001, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x80000, 0x0) read$auto(r1, 0x0, 0x20) r2 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/net/afs/rootcell\x00', 0x1cb842, 0x0) write$auto(r2, 0x0, 0x7) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bpf$auto(0x0, &(0x7f0000000040)=@bpf_attr_0={0x1, 0xb5, 0x4, 0x48d0, 0x4, 0xffffffffffffffff, 0x74b, "2af051a940806ec05be276cfc83ce63f", 0x0, 0xffffffffffffffff, 0x5, 0x4, 0xe5, 0x3}, 0x10) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14f602, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) madvise$auto(0x0, 0x2000040080000004, 0xe) r3 = openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cec8\x00', 0x0, 0x0) ioctl$auto_CEC_DQEVENT(r3, 0xc0506107, 0x0) ioctl$auto_CEC_DQEVENT(r3, 0xc0506107, 0x0) unshare$auto(0x40000080) setsockopt$auto_SO_WIFI_STATUS(0xffffffffffffffff, 0x480, 0x29, &(0x7f0000000000)=']\x00', 0x8) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040), 0x0) unshare$auto(0x40000080) 8.833818476s ago: executing program 0 (id=439): mmap$auto(0x0, 0x2000d, 0x5b, 0xeb1, 0x404, 0x8000) close_range$auto(0x2, 0xa, 0x0) timer_create$auto_CLOCK_BOOTTIME(0x7, &(0x7f00000000c0)={@sival_int=0x2, @raw=0x80, 0x9}, &(0x7f0000000140)=0x2) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x101c82, 0x0) r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/mtrr\x00', 0xc0000, 0x0) ioctl$auto(0x3, 0x400c4d05, r0) close_range$auto(0x2, 0x8, 0x0) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) unshare$auto(0x40000080) openat$auto_ftrace_event_format_fops_trace_events(0xffffffffffffff9c, 0x0, 0x40, 0x0) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0x2a, 0x2, 0x1) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) r2 = prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) execveat$auto(r2, 0x0, 0x0, 0x0, 0x7) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0x3, 0x4) io_setup$auto(0xffff, &(0x7f0000000580)) mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000) mmap$auto(0x0, 0x20009, 0xdf, 0x20000000000e31, 0x40000000000a5, 0x8000) pread64$auto(0xffffffffffffffff, &(0x7f0000000040)='uete1\x00', 0x200000000006, 0x7) ioctl$auto_USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000300)={0x2, 0x7f, 0x7, 0x7, &(0x7f0000000380)="4741007abb7e7878ec45998eba20ee71d55200ef1c1ad0ef872fd31511755b8bf1d0a25269e578b0ce0eadba08bd102a9aa7aaab8afabdb48d03adcdf4bb2a4a8750fd8cec0c6eb2aab5421beb28bc50c55b024dac63aae741e0602918dd10b8fdc7c1f324cebd3730c1ac0e49fc9a73491a21e3e5e68fa692162b96307b15f33f6489534161daa8dff06e620b6630113a3604955a0d09e7dfc2b5bdb1826247b0e57e802fc5eb8c1ec6502aa5ef7f730e4ca1682a8c3ddba47e34d4b6ad8fc66ca1ba46e238d78a08939ddc7f23110e5466a8", 0x8, 0x7f, 0x9, @number_of_packets=0x1f85, 0xe746, 0x7, &(0x7f0000000240)="0056c653945203bc33539e3058ad9e724152e80e335addfd83ae60053085fe17fd1e156c9edeb4f4ad75cc1746a9e1870241b451e8b68278e47b19993976974264b3d5b0ee85460c2b236ac246a346aa6b4598a493e07fcdf8cf2d59c442ff911f1e87be7c16d3cdfd5f03ecf5e1b2153794aa83664bc73d09c8afe018b0f54872ecd291067b9b9d566e1b58b8c3ebea597089dbf20e"}) 7.70364464s ago: executing program 2 (id=432): mmap$auto(0x2000000000000000, 0x9, 0x4000000001df, 0xeb1, 0xffffffffffffffff, 0x8000) socket(0x2, 0x1, 0x106) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000100), 0x80001, 0x0) socket(0x11, 0x3, 0x9) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) r1 = socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0xffffffffffffffff, 0x8000) connect$auto(0x3, &(0x7f0000000080)=@isdn={0x22, 0x3, 0x10, 0x4, 0x79}, 0x50) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) bind$auto(r1, &(0x7f0000000040)=@hci={0x1f, 0xffffffffffffffff}, 0x6a) sendmsg$auto_NL802154_CMD_DEL_SEC_KEY(0xffffffffffffffff, 0x0, 0x4000004) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video3\x00', 0x2aa01, 0x0) socket$nl_generic(0x10, 0x3, 0x10) select$auto(0x9, 0x0, 0x0, &(0x7f0000000440)={[0x1ff, 0x87, 0x8, 0x1, 0x948b, 0x5, 0x15f4da07, 0x6, 0x2, 0x64, 0x80000020, 0x400, 0x5d8, 0x1000000000000009, 0x7, 0x8]}, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x8000000000001fd, 0x20000008007, 0x800000000000004, 0x1000000000000bc3, 0x800, 0x3, 0xff, 0x10001, 0x2, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x80000000, 0x4, 0xe05a, 0x4]}, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_clone(0x0, 0x0, 0xffffffffffffff87, 0x0, 0x0, 0x0) pidfd_open$auto(r2, 0x0) getpgid(0xffffffffffffffff) syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000001c40), 0xffffffffffffffff) close_range$auto(0x2, 0x8, 0x0) 7.699533522s ago: executing program 1 (id=441): openat$auto_o2hb_debug_fops_heartbeat(0xffffffffffffff9c, 0x0, 0x200, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x40004) io_uring_setup$auto(0x6, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/hwsim0/addr_len\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000040)=""/213, 0xd5) mmap$auto(0x0, 0x400006, 0xdf, 0x9b72, 0x2, 0x8000) unshare$auto(0x40000080) r1 = socket(0x2b, 0x1, 0x1) io_uring_setup$auto(0x40000002c55, 0x0) setsockopt$auto(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x8004) socketpair$auto(0xfffffffe, 0x1, 0x8000000000000000, 0x0) ioctl$auto(r1, 0x89a0, 0x4) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') ioctl$auto(r2, 0x8008b70d, 0xffffffffffffffff) io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3) mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x6, 0x2) write$auto(0xffffffffffffffff, 0x0, 0x98c7) writev$auto(0xffffffffffffffff, 0x0, 0xb) r3 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv6/conf/all/forwarding\x00', 0x42a81, 0x0) write$auto(r3, &(0x7f0000000380)='0\x81=\"\xad/\x8d\b\x00\x00\x00\x00\xb4\xd9\x82=~\x17\xfb&L\xeb=j\a\xf1y\xb3\"\xeb\a\xdd\xf4\xf4Ry\x86\x0f\xcf\x7f\xbf\xab\x12{\xc2\xc2*\xc1M+6/v8\xea\xe9\x85s4\xfe\xe5\t\x7fc\xfb7^\xb86J_\x1d1s!\x01\xff\xff\xff\xff\xff\xff\xff\x1dF\xe6\xf6\x17\x10+\xc0\xb0\xafc\x99\xd4\x150Y~\x1e\xe2\xd6x4fW\x13\xc4U`\x9e-X\xd7\xe2H^\fLS\x03\x00\x00\x00\f\x00\xeaN\xa5\xd2\x82;\x7f\xa0.\x9a\xfb\x8d\xf3l\xf2\xd3\x95\xc1M5\xcb\xa6I\x067\xe36\xea\xe9\xe3\xf44oT_`8\xb3\xef\x04 \x05K\xf9\x87pl\xac\x86\nE\xc7e\xc5Q\x89\xcd\x06\x00\x92\x00\x87\x976\x9f>\xa2\xcfm\xec\r\x11\x7f\x00\x00\x00\xb1\xde@\x02\xce\x03\xb7\xb1\xfb\x9fr\v\xb2\xe3\xc7\b\x85\x00 /zm\x7f\x8fg,p81\xb6\xbb\xd8D\xde\x0eR=A\x00\x1f\x8a\xa7/Q\"J\xbb\xb0m\xf2SP\x84\x84S\xf0\xba\x9a\xf6\xb6`WI\xba\xba*8\x9f\xea\xe8K/\x98\xbc7~\b\x00\x9buB\xcb\xe4\x8aKf\xba\x8c\x19m\xe6I\x02\xde\x80\x9d\x87}\xf4\xbd9\xaa\xd6\xdb1]\xde\xa0r\x14\xca56^\x94\xd2\xd8\xe6}9\x91\xcf\xf7\xa1=\x96\x11\xf1\\\xa91\x0e\xd1\xe4z\xc1;Pw!\x8b\xf5{\xc7Xd\xe1\xf2}\x96EVf\xc9\xa8\xcd\xe4\xc9\x8d\x1d7\xd5\x94\\\xb5\r\xd2\xaa\xe6H\xfe)\xb3a\x04\x1eRMl\xa3F\xa8W0\x90\xc9Ky#\x03\xf5~\xd2Z\xe9(\x99\b\x00M\xde\x01]\r\xd09k\xc2\x84\xc1\xabN\x96\x8a6\x98@\xd3\xab\xa8m\xdf\x8d\x1d\b\x82\xfcP\x87\x93\x80\x97Q\x86\x8a\x9c\xf8L\x0f\xa8@VE2\x9d\x1e`5\xd8\xd7M\xd4k1\xe6\x13Y\\\x83E\xd0e\x0eM\xa9Q\xac\x0e\x1d]\auq\x17\x19H\x81\xd2\xccF\xc6\xd4\xe2R$\xfa\xd6}\xbdsN\x18\xdf\xf5\xffP\xf5\f\xccL\xef\x83\xb3$\xd4\xf4\xb5\xe6\xd0 \xb9\xa7\x8e6\t\x83q\xef\b\xd2\xdb\xf6n\x82\xd4\xd6\xcc\xc19\x95+\x94\xb0\x8a:(\xf6\x7fR^&cU\xfc\xeb&l\x86D\x98\xa0\xc0 \xcec\xa3\x13\xf7\x02\a\x9d\x9d\x8e\x81\x8eu\xc73\x9f\x02\xe7 \x03\x9c\xab\xbe\x85-\a\"H\x87\x12A\xdc\xedF\xa3t\x91\x9f!\x8c\xd1A\xe7\x95\xa7\"\x8c\xb5\x1b\x80\x12u\x90AI\xc2\xbao3Ob\x94\xfa\'\x8d\x0f\xc6&\x94C\xa6|~\xebn-\x17\x1e+-\xdc\xe6f0cm\xf2\t\xb4:\x93g}/%\xc2\xe5\x8c\xd8\xc1+T\xe9@ysq,\x0frl\x92\xd0\xd3\x9a\xf9\xf76KlQ\xa8\xf0\xf3\xd3\x1e\x93\xe5\xbe\xb5\xee\xbf\xb2\xbb\x1dP\xbb\xa2$\xd5`\x01\xf0G\xa8\xf2\xc5\x9e\x98\xa6+xX6M>\x8fq\xab\xaa\xe4\x87\xa1\xaa\x1d\xee\xb1[\x9e\x03\xdd\x11\x1dTg\x1b\x91\x86\x05\xf6\xa5 1\xbeSL\x19\x80\x9f.\n\xa4\xa80\xd8\xeb\x86\xf1s\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc4}y\xde\xc6\xa9I\xa0A\xb0\x1f\xb4\x01)\xedS\x89\xb7\xe4$\xd3\xeej\xdc\xf4\x00\xad\'\x9e\xb6\xa8&\x97=\xe2\xed\x82\xee\xb1\xfc\x0e\xa9\xc4w\x9e\xf7\xf2\v\x98HG\xed\xca=\xe1V\xdc\xcdl\x97Ik\x87\xe4\x9b\'\xc7\x10]??~\xbc\xca][\xfaf\xef:\xc3Gt/q_Wc\x9b\x06T\x15.\xb4{\xc0i\x12I*j\xb9\'\'&\xc3\x8bS2\xd2Po\x1e\x004\x13(\xc0%\xff\xeb\x1ap\x11\t\x04\xf58\xb3J\xb3\x87];\xa4\xdbt\x96JIp\x99@\xa8\xb8\x81\xb9_\x90\xb5yGu\xee/\x8e\xe0\xd5c\x10\xec\xe6\b\xbe,\xf0\t!\xac\xd6\xfb\xdc5\x15@m\x8d\xa6x\xaaOJ(\x19\xe6\xefk\xbb7\xd6\xa5\xe5\xae\xdb\xbe\x91\x00\xccw\x9c\x93\xd3\r\xcb\x8d\xde\xc01i\xfb\x7f\xa5\xbf\xe5\x88\xeb+\xec\xb76Atz=>\xc0\xbf\xd8\x8e\x82T\xc6*\xde\x14\xc4\x9c\xe2\x84\x06-\xd9\xd8B%\aM}{\x9c\xe1\x8b\x17\x86R\xc7\x18B\xc4\xc5\x86_\xf0\xca\x8a:\xd7\x94\xdc', 0x49) openat$auto_aoe_fops_aoechr(0xffffffffffffff9c, &(0x7f0000000180)='/dev/etherd/revalidate\x00', 0x2000, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/set_event\x00', 0x42a00, 0x0) 5.585712332s ago: executing program 3 (id=433): mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0x7, 0x28000) sysfs$auto(0x2, 0x100001000000032, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x2, 0xffe, 0x8000000008011, r0, 0x8000) preadv2$auto(r0, &(0x7f0000000140)={0x0, 0x6}, 0xa, 0x3, 0x7, 0x2e) inotify_init1$auto(0x41) mmap$auto(0x1000000010000, 0x4, 0x9f, 0x12, 0xffffffffffffffff, 0x8) mprotect$auto(0xffd, 0x20000000401003, 0x0) close_range$auto(0x2, 0x8, 0x0) r1 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) unshare$auto(0x40000080) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) gettid() socket(0x11, 0x3, 0x0) r2 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bus/usb/034/001\x00', 0x20882, 0x0) ioctl$auto_USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000240)={0x23, 0x3, 0x18, 0x2006, 0x7fa, 0x7fb, &(0x7f0000000280)}) shmget$auto(0x8, 0x10565, 0x7ff) shmat$auto(0x0, &(0x7f0000000300)=')\x80p\xd1\xc7Zf\xc2\xe7\x05K\x068\x82i\x95m\x83\x89\xe7\x8c`\xee\xc4k\'\xaf?\x94\xf67\x94\fFu_\nu\x16\x885\x99-<]\xc2\x8f\xd8]\xc6m\x11\xc3|\xf3\xfc\xf7Kd=~w\x94\xc6\xb2\x94HC^\xdfF5\xe0<\nL\x8c9M\xe0\x98\xe7\x8f1\xf2\xda\xa7^}', 0xfffffffa) shmctl$auto(0x0, 0x0, 0xfffffffffffffffd) shmat$auto(0x0, 0x0, 0xfffffffb) ioctl$auto_VHOST_SET_MEM_TABLE(r1, 0x4001af84, 0x0) ioctl$auto_VHOST_SET_OWNER(r1, 0xaf01, 0x0) mremap$auto(0x200000004000, 0x4, 0x4, 0x3, 0x100000000) 5.578054674s ago: executing program 0 (id=434): mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) r0 = open(&(0x7f0000000040)='./file0\x00', 0x2041, 0xfa) write$auto(r0, 0x0, 0xfffffdf1) fallocate$auto(0x8000000000000003, 0x3, 0xf, 0x10) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) mprotect$auto(0x0, 0x8000000000000001, 0x8) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/reset\x00', 0x82, 0x0) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x100000000008000) r1 = openat$auto_adf_ctl_ops_adf_ctl_drv(0xffffffffffffff9c, &(0x7f00000000c0), 0x101c41, 0x0) add_key$auto_KEY_SPEC_REQKEY_AUTH_KEY(0x0, 0x0, 0x0, 0x8, 0xfffffffffffffff9) ioctl$auto(r1, 0x40046103, 0x81) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) unshare$auto(0x40000080) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x4, &(0x7f00000002c0)={0x0, 0xffeb}, 0x1, 0x0, 0x5, 0x7}, 0x8}, 0xffffffff, 0xb00) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_TUNNEL_INFO_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000080)={0x14, r3, 0x705, 0x70bd25, 0x25dfdbfb}, 0x14}}, 0x40d0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sysfs$auto(0x2, 0xf, 0x0) 5.161407279s ago: executing program 2 (id=435): socket(0x2, 0x2, 0x0) mmap$auto(0x0, 0x6, 0x3, 0xeb1, 0x7, 0x8000) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1\x00', 0x20342, 0x0) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x6, 0x0) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f00000000c0)=@in={0x2, 0x3, @loopback}, 0x54) read$auto(0x3, 0x0, 0x8080) write$auto(0x3, 0x0, 0xffd8) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) pwrite64$auto(r0, &(0x7f0000000040)='+\x00', 0xfdef, 0x1ff) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) openat$auto_uprobe_profile_ops_trace_uprobe(0xffffffffffffff9c, 0x0, 0x80000, 0x0) prctl$auto(0x41, 0x1, 0x0, 0x0, 0x0) prctl$auto(0x41, 0x1, 0x0, 0x0, 0x0) capget$auto(0x0, 0xfffffffffffffffe) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/route\x00', 0x8a200, 0x0) pread64$auto(r1, &(0x7f0000000540)='veth1\x00\xe0,\x17\xa0\xf7\x89Pl\x84K?\x01\x84\xa1i\xe00\x81p\xa0U \f\xdbP`:\xe2\'\xa7\xbf\xbd\x04\x18\xad\x90I^\x99M\xe0W\x14\x11\xf4\xeb\x90:\v\xc5\x13*\xfe\x90\xb1\xa9O\xa5\x05\xaa\x8fTi\xd6\x88Q\xda\xca', 0x200000000003, 0x8) connect$auto(0x3, 0x0, 0x50) setsockopt$auto(0x3, 0x1, 0x2a, 0x0, 0x9) recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0) 4.650177755s ago: executing program 1 (id=436): open(&(0x7f0000000100)='.\x00', 0x595002, 0x408) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/platform/mac802154_hwsim/ieee802154/phy1/net/wpan1/queues/tx-0/byte_queue_limits/limit\x00', 0x181382, 0x0) io_uring_setup$auto(0x2, 0x0) socket(0x11, 0x3, 0x9) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, 0x0, 0x103040, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x180, 0x0) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, 0x0, 0x101001, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, 0x0, 0xa8802, 0x0) sendmsg$auto_TCP_METRICS_CMD_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0100f9020000fbdbdf250100000008000b00ac141420080001"], 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x0) r0 = socket(0x11, 0xa, 0x9) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x880, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, 0x0, 0x8800, 0x0) socket(0xa, 0x2, 0x0) r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = socket(0x10, 0x2, 0x4) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r0, @ANYRES8=r1], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0xc086) write$auto(r2, &(0x7f0000000000)='-\x00', 0xfdef) 4.647643006s ago: executing program 3 (id=446): r0 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/security/tomoyo/manager\x00', 0x121d00, 0x0) openat$auto_proc_pid_set_timerslack_ns_operations_base(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$auto_BPF_PROG_QUERY(0x10, &(0x7f00000000c0)=@prog_bind_map={r0, 0xffffffffffffffff, 0x3}, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) unshare$auto(0x40000080) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x40280, 0x0) write$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffffff, 0x0, 0x0) ioctl$auto_CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000100)={"00fffb00", 0x0, 0x6, 0x2, 0x10009b3, 0x9, "0200000002000000997e763f222ce1", '\x00', "0001410c", '\x00', ["f5404de9641f000000006041", "70d9a96021a70000800100", "0d00a9827abd9c5c00001600"]}) r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x8a603, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vbi15\x00', 0x802, 0x0) ioctl$auto(r1, 0x5646, r1) close_range$auto(0x2, 0x8, 0x0) prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x7, 0xa55, 0x3) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x4, 0x0, 0x5, 0x8) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) unshare$auto(0x40000080) rseq$auto(0x0, 0x20, 0x0, 0x8000006) flock$auto(0xffffffffffffffff, 0xffffffff) eventfd$auto(0x1004) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x1000, 0x0) r2 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$auto_VHOST_SET_OWNER(r2, 0xaf01, 0x5) 4.325248746s ago: executing program 1 (id=437): r0 = openat$auto_adf_ctl_ops_adf_ctl_drv(0xffffffffffffff9c, 0x0, 0x1940, 0x0) ioctl$auto_IOCTL_GET_NUM_DEVICES(r0, 0x40046104, &(0x7f0000000040)=0x74c7) r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/pagetypeinfo\x00', 0x43102, 0x0) read$auto_proc_iter_file_ops_compat_inode(r1, &(0x7f0000000180)=""/178, 0xb2) madvise$auto(0x110c230000, 0x1, 0x9) close_range$auto(0x2, 0x8, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) write$auto(0xffffffffffffffff, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) r2 = openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000001640)='/proc/self/mem\x00', 0x401, 0x0) write$auto_proc_mem_operations_base(r2, 0x0, 0x0) socket(0x2c, 0x3, 0x10000) set_mempolicy$auto(0x6, &(0x7f0000000080)=0x3, 0x21) mmap$auto(0x0, 0x4005, 0xb, 0x40eb2, 0x401, 0x300000000000) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) mbind$auto(0x0, 0x100000004, 0x100000000, 0x0, 0x6, 0x2) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sda1\x00', 0x4040, 0x0) fadvise64$auto(r3, 0x7fffffffffffffff, 0x400000040000005, 0x4) mmap$auto(0x0, 0xc685, 0x3e, 0x1200000010, r1, 0x4) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) mmap$auto(0x0, 0x202000c, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000000000008000) io_setup$auto(0x7ffe, 0x0) gettid() 3.309986315s ago: executing program 1 (id=438): mmap$auto(0x0, 0x2020089, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/kexec_crash_size\x00', 0x102, 0x0) write$auto(r0, &(0x7f0000000480)='7\x00\\\xa0\x04\x9c\"\xa9Nd_\xff\xa0k\xd8\xc9\xba\x00\xb5\x89\x8cg\xa84\xd8D)\xfdcR8\xdb\x98\xc5\xd7\x94\x94\xda\xc0r\x8f)\xbb_r\xac\x98\xa2k\x9bu=>\xce\x8d\xa2\fZ\xfa\x0f\x87R\xf7\x05OA\xfak\xba0\xab\xe1\xffm\xf9t\x012A\xc8%H\x88\xaej\xda\xae\x1dO\xd7\x88?\x19\xf3\x068\xb4e\xb5\x93\x9a\xb9|Kh\xc2d\xda\xb7\xe5\x1fb~8\xf2q\x0e\x98A[\xbb\xa9\xdc[8\xfc\xc6\x9f\xa3\xb5\xdf\x1a', 0x84) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) close_range$auto(0x2, 0x8, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_GET_INTERFACE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)={0x1c, r3, 0xb01, 0x70bd27, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000050}, 0x240088e4) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) r5 = openat$auto_ht40allow_map_ops_debugfs(0xffffffffffffff9c, 0x0, 0x181000, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000cf, 0xeb1, 0xffffffffffffffff, 0x7) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x1, 0x106) listen$auto(0x3, 0x81) read$auto(r5, 0x0, 0x10) ioctl$auto_SNDRV_PCM_IOCTL_HW_PARAMS_OLD(0xffffffffffffffff, 0xc1004111, &(0x7f0000000380)={0x5, [0x53, 0xf, 0x659], [{0x7, 0xffffff01, 0x1, 0x1}, {0xab6, 0x4, 0x1, 0x0, 0x0, 0x1}, {0x8, 0x6}, {0x4, 0x10, 0x1, 0x1}, {0x0, 0x2, 0x1, 0x1, 0x1}, {0x5, 0x1, 0x1, 0x1, 0x1}, {0x4, 0x0, 0x0, 0x1, 0x1}, {0x2, 0x6, 0x1, 0x1, 0x1}, {0x5, 0x7ff, 0x0, 0x1, 0x0, 0x1}, {0x6, 0x6, 0x1, 0x0, 0x1}, {0x4, 0x40, 0x0, 0x1, 0x0, 0x1}, {0x3, 0x401, 0x1, 0x0, 0x1, 0x1}], 0x4, 0x9, 0x10, 0x9b1, 0x0, 0x1, 0x9, "3d60f1799d5517614cb5db232a171fe794feb32c6fa42fb100e50cfc95618db7f4466f2e7d6b4e383e01de0564711212835f5ea4b55685c9784003f654a77a10"}) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0x4040, 0x0) unshare$auto(0x40000080) r6 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1\x00', 0x20b42, 0x0) mmap$auto(0x0, 0x4020009, 0xdb, 0xeb1, 0x401, 0x8000) setsockopt$auto(0xffffffffffffffff, 0x1, 0x9, 0x0, 0xeb66) write$auto(r6, 0x0, 0x800000006) 3.308729059s ago: executing program 0 (id=449): openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/net/can/stats\x00', 0x121040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x402000b, 0xdf, 0xeb1, 0x401, 0x8000) mmap$auto(0x20000000, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x2ffffffffffe) sendmsg$auto_ETHTOOL_MSG_STATS_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x24040000}, 0x4000080) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) read$auto(r0, 0x0, 0x20) mprotect$auto(0x1ffffffff000, 0x100004, 0x6) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000006c0)='/sys/devices/platform/dummy_hcd.5/usb6/bMaxPower\x00', 0x80, 0x0) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x140082, 0x0) writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3) mq_getsetattr$auto(0x3, 0x0, &(0x7f0000000100)={0x8, 0x8, 0x2, 0x1}) mmap$auto(0xfffffffffffffffd, 0x8, 0xdf, 0x9b72, r1, 0x6) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYRES16=0x0, @ANYBLOB="1b0026bd7000fddbdf25030000000400080010"], 0x28}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1400e31d", @ANYRES16=0x0, @ANYBLOB="000326bd7000fedbdf25020000"], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x40000) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x8002, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x9}, 0x3, 0x0) lsm_list_modules$auto(0x0, 0x0, 0x0) r2 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000280), 0x141182, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r2, 0x403c6f2b, 0x0) 1.770813527s ago: executing program 3 (id=440): r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x1, 0x7fffffffffffffff, 0x2000000000000df, 0x97, r0, 0x8000) socket(0x11, 0x80003, 0x300) socket(0x11, 0x80003, 0x200300) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) ioctl$auto(0xffffffffffffffff, 0x40104d01, 0xffffffffffffffff) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) capget$auto(&(0x7f0000000280)={0x3, 0x0}, 0x0) capget$auto(&(0x7f0000000300)={0x589, r2}, &(0x7f0000000380)={0x1, 0x1, 0x800}) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000002dc0)='/dev/adsp1\x00', 0x2401, 0x0) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/adsp1\x00', 0x20342, 0x0) write$auto(r3, &(0x7f0000000100)='/dev/audio1\x00\xf6\x89\t\xb6t\xae\x12Q\x15E O\xd8\x8d/\xd9\x13\v_\xbcTd\xe0DS\xef?f\xf1ou\xa4W&^\x80\xb2}\x96K\x16*\xa0\x10[8\xa3\x86\x9a3\xc1\xf7\x89x; 4\x8d,U\xa2\xd8\xd5\xfd\xf8\xd8\xb0\xe0W\xad\xe7\x05l*\xc5Z\x8d\xc88}n\x81\tK\x00\x12\xae\xff\xe5\xf1\xb5w\x81$\xd4\xca\xbe&\x195\xc1\xda>\x8c\x89P\xa1\xdb\xb4g9E\xc8\x92\xf6m\x1c\x9b\xebAzeI\xcb\x16f\xc0@\x978x\xbe\x15\'\xc6d}\xc2\xd3\x9f\xc5F8\x15f\x90\xa2\x84', 0x6051) readv$auto(0x3, 0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) memfd_create$auto(0x0, 0xe) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ipvs(&(0x7f00000000c0), r1) sendmsg$auto_IPVS_CMD_SET_DEST(r4, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4048000}, 0x80) mmap$auto(0x0, 0x810006, 0xffb, 0x8000000008011, 0x3, 0x0) msync$auto(0x0, 0xe0, 0x6) 1.523526125s ago: executing program 0 (id=442): mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) r0 = open(0x0, 0x22240, 0x154) bpf$auto(0x5, &(0x7f0000000100)=@iter_create={r0, 0x5d62}, 0x103) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card1/pcm1c/sub6/status\x00', 0x2e8c02, 0x0) madvise$auto_MADV_GUARD_INSTALL(0x0, 0x2021000, 0x66) rseq$auto(0x0, 0x8000, 0x0, 0x6) r1 = socket(0x2a, 0x2, 0x6) bind$auto(r1, &(0x7f0000000080)=@qipcrtr={0x2a, 0x1, 0xfffffffe}, 0x6b) r2 = socket(0x2, 0x1, 0x106) bind$auto(r2, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) write$auto(0x3, 0x0, 0x1) write$auto(0x1, 0x0, 0x80000000) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffff7, 0x8000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x48140, 0x0) mmap$auto(0x0, 0x28009, 0x4000000000df, 0xeb2, 0x401, 0x8000) sendfile$auto(0x1, 0x3, 0x0, 0xa) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) close_range$auto(0x2, 0x8, 0x0) 1.392637856s ago: executing program 1 (id=443): r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) io_uring_setup$auto(0x6, 0x0) r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snd/controlC2\x00', 0xa900, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, 0x0) r2 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snd/controlC2\x00', 0x8100, 0x0) r3 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snd/controlC2\x00', 0x80, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{@raw=0x7fffffff, 0xf0ee, 0x20009, 0x1, "790eaa00ffff8eac2cdafc1f64010043eeb0b053030001ffff000e00", @raw=0x5}, 0x4, 0x966, 0x3, @raw=0x404, @integer64={0xc, 0xeb1e, 0x34}, "6cc1294d63a4f1b4285854c5368de438f8cc142ef6df12bf3373a1183bedbd31b642b4051b078fa1c1c61c329794e5311121c760cb9611c78e6947a99807bcc1"}) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_LIST(r2, 0xc0505510, 0x0) close_range$auto(0x2, 0xa, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x2041, 0x32) write$auto(r4, 0x0, 0xfffffdf1) linkat$auto(r4, 0x0, 0xffffffffffffff9c, &(0x7f0000000080)='&&\x00', 0x1000) r5 = fcntl$getown(r4, 0x9) r6 = prctl$auto_PR_TIMER_CREATE_RESTORE_IDS_OFF(0x8, 0x0, r5, 0x1, 0xb91) r7 = syz_genetlink_get_family_id$auto_gtp(&(0x7f0000000100), r4) sendmsg$auto_GTP_CMD_GETPDP(r6, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="a500000000000000635625357f04032abd7000a8ba043ce560558f5e85e3a90cd9fb1ebe111a6038eade64f62ed669bc2533c28f6328834391eb049ca4a25d0f53c7327cc74c8480496c9ec8b03f442ea8fbecdf9333410ea68e529c6e2e5696ca11b8e37fedf4c0062b823424c3de8a3cb8affe125c80b45b1e83d62a5aede3a6761066511eee5163f3c2aecc0cd91cbc7ddcd80eaf3261241a0a5590851a2ed14e518cad8b965036d49ead72fde291c9094e3a4eb0ed219ab047a6300625db6a053c2a3f"], 0x14}, 0x1, 0x0, 0x0, 0x214c0}, 0x2000400) sendmsg$auto_GTP_CMD_GETPDP(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x4008000}, 0x9) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000002140), 0xffffffffffffffff) r8 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000280)='/proc/asound/modules\x00', 0x88400, 0x0) read$auto_proc_reg_file_ops_compat_inode(r8, &(0x7f0000000040)=""/209, 0xd1) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) 609.53417ms ago: executing program 2 (id=444): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram5\x00', 0x1eba02, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/bus/usb/drivers/ax88179_178a/remove_id\x00', 0x488081, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x82001, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="5f74ab2fc43781e047140a5cbc3ac5229b90633d9cddda9efb1f2c3d5d1e63f3fb5acf079b9336319d009cb514679a42eaca52b81c166d19625d173c26ece6542f2fb29712f4fb9072fc432b4cf3e6f5a7f3c9f91ee88ba5fa11d48fd3658e8f44f8423b4cd02bbec912ed34f9f4b19b03d4c62b24ede44c0c76c34edf7bde061903c2ee4c64110ac668239fa53ba42933ae74c3d173663248ff0945dd2e405e0d378b5a8e4643a7bc3b35a7248431450ca8901467ea6dc5d86de1e90f869f6a04ac10043676f3b2c7f1339b2d7468133fb8447d17846b6b78079ecc31d7d0f74caa4a3db1ac4d312bfdb34bd331f1f771a2396108561a52153d63a7b2a3a077a7e4c1a22bcb23e1f3e511fee310baa67904d2aad4d6671e8b77c7720e37e84e0efecb60a35f188cbe8b8b2fb3967b78aa482aabb103f23083baa9b2ae653731d5993db4054233dea4af", 0x14a) ioctl$auto_SNDCTL_SEQ_SYNC(r0, 0x5101, 0x0) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x6, 0x2, 0x40eb2, 0xffffffffffffffff, 0x308000000000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x800, 0x0) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x147) move_pages$auto(0x1, 0x20007, 0x0, 0x0, 0x0, 0x8000000000000000) select$auto(0xfffffffb, 0x0, &(0x7f0000000100)={[0x20000000000d, 0x203, 0x0, 0xc, 0x400000000000005, 0x5, 0x6, 0x1f2, 0x9, 0xe8, 0x400000000fb, 0xa, 0x4, 0xaab, 0x5, 0x7]}, 0x0, 0x0) execve$auto(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000004cc0)={0x14, r2, 0x301, 0x70bd27, 0x25dfdc03}, 0x14}, 0x1, 0x0, 0x0, 0x2000001c}, 0x20000800) execve$auto(&(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000100)=&(0x7f0000000600)='#\xdc\xfe\xd8E\xc8\x8bu4\xd9n\xcb\xca\xc7zw \x96\x9ejh\xad\x9eEc\xae\x1e\x89\x92\x9a\xbbP[B\xae\x9cf)\x15\xac\x90)l\x06\xf0\t\x12\x05zz\xa6\xb3\xce=\x00\x00\x00\x00\x00/\xc4T\x1f\xe5P\xff\xb4\xb7s0\x02\xc5\x81\x93\xc6\xc8\xb6Sp\x1a{8\xfc\xe0,X\xc7BU\xd0\x97\x7f1\x16\x99\x04\xabu/a(\x02\x7f\xbb\xbd\x906\xa8\xce\xee\xcd\xd7\t\x00\xfb\x83\xc8\x8aO\xe9\xbe=\xf7\xf4\x84,\x06\xd3j\x99b\xe6\xf6Y3A\xbb\xa4\xb2\f\x1b\xc3\x8a,g\xc6\xe8[\xdf\x88\x01\x9f7\xb5\x19m\xd8L\x84j\x8c\xec\xdf\x1a\xbd\xc5\x94\xb9\xb7\xd5\xa4\xc0\f-6\xfe\xa8\xed/u\x81_G\xfeR\xbb\x12\x16\xb8*\xa9\xc9\xe81\x9d\x06\xbbC\x17\xbb\xe6|\x97\xabB4J\xed+-\xf8u0/n\xcf\x8b\x95\x9d\xab\xa8\xc47\xa6\x0e\xdeOq\\\xc3\'{\b\xd3m\x94\xc2\xdd{\xeaO\x0e\xe4\xe0\xb9N:\xd60\x17,\x06\xc7B#Y0\x99\xeb\x874\xab?\xc8\x82\xe5\x8f\xb7\x91\xc2\xbe\xb2\x02\xfe\xd3k\xd5\xdcZ\xdcP\x8e+\xd8\xc7C\xcb\x15\x13c\xbf\xe8\xbd\"\x8f3\"\x14\xf8(\xda\x19\xcd\xec\x03.\xd9^\xc3A\xda\r[\x1a\xda\\#/\xd4\xaf\xd0\xe8\xa2\xdd\xc5{\xfa\xe0\x90\x8f\x99lQ\xec\x84h^\x11+\x93\b\xe0c\xe6\xd22\xf9\xa5') mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid$auto_P_ALL(0x0, 0xffffffffffffffff, 0x0, 0x5, 0x0) read$auto(0x3, 0x0, 0x8080) 554.70502ms ago: executing program 3 (id=445): mkdir$auto(&(0x7f0000000040)='./cgroup/../file0\x00', 0x1) r0 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) unshare$auto(0x40000080) unshare$auto(0x40000080) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x1e, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x80000001) mmap$auto(0x0, 0x9, 0xdf, 0xeb1, 0x1, 0x8000) mmap$auto(0x0, 0xfff, 0xdf, 0x9b72, 0x400, 0x28000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x1, 0x3) seccomp$auto(0x2, 0x0, 0x0) getsockopt$auto(0x6, 0x1, 0x25, 0xfffffffffffffffe, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x7, 0x800008000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/module/libata/parameters/atapi_passthru16\x00', 0x80d40, 0x0) read$auto(r2, 0x0, 0x20) r3 = openat$auto_nsim_dev_max_vfs_fops_dev(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim3/max_vfs\x00', 0x48002, 0x0) write$auto(r3, 0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0x18, &(0x7f0000000000), 0x1) sendmsg$auto_ETHTOOL_MSG_TUNNEL_INFO_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001826caca440575039960", @ANYRES16=r0, @ANYBLOB="010028bd7000fedbdf251c00000018000180140002006e657464657673696d30000000000000"], 0x2c}}, 0x4000000) rmdir$auto(&(0x7f0000000000)='./cgroup/../file0\x00') 0s ago: executing program 1 (id=447): openat$auto_nsim_udp_tunnels_info_reset_fops_udp_tunnels(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/netdevsim/netdevsim5/ports/3/udp_ports_reset\x00', 0x20000, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/devices/virtual/workqueue/nvmet-wq/affinity_strict\x00', 0x20461, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f0000000000)='-7', 0xfffffc49) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty46\x00', 0x0, 0x0) ioctl$auto(r1, 0x4b2f, 0x0) mmap$auto(0x0, 0x20002020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x5) unshare$auto(0x20000) ioctl$auto_USB_RAW_IOCTL_VBUS_DRAW(0xffffffffffffffff, 0x4004550a, 0x0) r2 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/swradio13\x00', 0x8a2c0, 0x0) prctl$auto_PR_GET_AUXV(0x41555856, 0x5400000000000000, 0x5, 0x0, 0x5) read$auto_proc_iter_file_ops_compat_inode(0xffffffffffffffff, &(0x7f00000001c0)=""/213, 0xd5) ioctl$auto(r2, 0x5646, r2) r3 = pidfd_open$auto(0x1, 0x0) mount$auto(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xf6\x04W\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xed\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\x9bg\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x7, 0x0) setns(r3, 0x60020000) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) syz_clone3(&(0x7f0000000300)={0x153326100, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0xa7) r4 = setfsuid$auto(0xee00) ioctl$auto(r2, 0x2, r0) r5 = setfsuid$auto(0xee01) setresuid$auto(r4, r5, r4) ioctl$auto(0xffffffffffffffff, 0x8936, 0x1) read$auto(r2, &(0x7f0000000200)='{\x00', 0x4) openat$auto_ftrace_event_format_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/events/vmalloc/purge_vmap_area_lazy/format\x00', 0x500, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.90' (ED25519) to the list of known hosts. [ 95.571818][ T5612] cgroup: Unknown subsys name 'net' [ 95.683942][ T5612] cgroup: Unknown subsys name 'cpuset' [ 95.693819][ T5612] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 97.365527][ T42] cfg80211: failed to load regulatory.db [ 97.587349][ T5612] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.768451][ T5632] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 99.783938][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 99.784445][ T5634] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 99.801148][ T5635] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.801730][ T5634] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 99.817193][ T5635] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 99.825545][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 99.828948][ T5634] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.841589][ T5634] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 99.851156][ T5634] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 99.858273][ T5638] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 99.864583][ T5634] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.873442][ T5638] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 99.882013][ T5638] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 99.889438][ T5634] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 99.891405][ T5638] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.905897][ T5638] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 99.910082][ T5634] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 99.920781][ T4942] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 99.932270][ T5634] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 101.787370][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.795633][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.803397][ T5627] bridge_slave_0: entered allmulticast mode [ 101.811103][ T5627] bridge_slave_0: entered promiscuous mode [ 101.834224][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.842459][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.850719][ T5627] bridge_slave_1: entered allmulticast mode [ 101.858489][ T5627] bridge_slave_1: entered promiscuous mode [ 101.976167][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.993067][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.001934][ T5628] Bluetooth: hci0: command tx timeout [ 102.002528][ T5634] Bluetooth: hci2: command tx timeout [ 102.008791][ T5628] Bluetooth: hci3: command tx timeout [ 102.016200][ T4942] Bluetooth: hci1: command tx timeout [ 102.027463][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.036139][ T5624] bridge_slave_0: entered allmulticast mode [ 102.044005][ T5624] bridge_slave_0: entered promiscuous mode [ 102.063192][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.096743][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.104100][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.111449][ T5624] bridge_slave_1: entered allmulticast mode [ 102.119079][ T5624] bridge_slave_1: entered promiscuous mode [ 102.190937][ T5627] team0: Port device team_slave_0 added [ 102.197106][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.204549][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.212477][ T5626] bridge_slave_0: entered allmulticast mode [ 102.220517][ T5626] bridge_slave_0: entered promiscuous mode [ 102.242286][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.250139][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.257470][ T5625] bridge_slave_0: entered allmulticast mode [ 102.265373][ T5625] bridge_slave_0: entered promiscuous mode [ 102.276432][ T5627] team0: Port device team_slave_1 added [ 102.283880][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.291388][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.299084][ T5626] bridge_slave_1: entered allmulticast mode [ 102.306607][ T5626] bridge_slave_1: entered promiscuous mode [ 102.317422][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.327285][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.334974][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.342477][ T5625] bridge_slave_1: entered allmulticast mode [ 102.350479][ T5625] bridge_slave_1: entered promiscuous mode [ 102.384917][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.464516][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.472055][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.499629][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.515304][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.529531][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.553157][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.564501][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.572053][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.598887][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.626270][ T5624] team0: Port device team_slave_0 added [ 102.634859][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.681587][ T5624] team0: Port device team_slave_1 added [ 102.689934][ T5626] team0: Port device team_slave_0 added [ 102.725392][ T5626] team0: Port device team_slave_1 added [ 102.757041][ T5625] team0: Port device team_slave_0 added [ 102.765618][ T5625] team0: Port device team_slave_1 added [ 102.796065][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.803768][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.831537][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.855869][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.863082][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.889806][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.914684][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.922371][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.948518][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.980998][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.988133][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.014894][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.033733][ T5627] hsr_slave_0: entered promiscuous mode [ 103.041334][ T5627] hsr_slave_1: entered promiscuous mode [ 103.064463][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.071790][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.098816][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.130972][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.138174][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.164869][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.287061][ T5626] hsr_slave_0: entered promiscuous mode [ 103.294009][ T5626] hsr_slave_1: entered promiscuous mode [ 103.301654][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 103.307991][ T5626] Cannot create hsr debugfs directory [ 103.334276][ T5624] hsr_slave_0: entered promiscuous mode [ 103.341398][ T5624] hsr_slave_1: entered promiscuous mode [ 103.348343][ T5624] debugfs: 'hsr0' already exists in 'hsr' [ 103.354228][ T5624] Cannot create hsr debugfs directory [ 103.396781][ T5625] hsr_slave_0: entered promiscuous mode [ 103.403866][ T5625] hsr_slave_1: entered promiscuous mode [ 103.410631][ T5625] debugfs: 'hsr0' already exists in 'hsr' [ 103.416575][ T5625] Cannot create hsr debugfs directory [ 103.881849][ T5627] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.897456][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.937830][ T5627] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.951306][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.960210][ T5627] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.974391][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.003224][ T5627] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.014197][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.078841][ T4942] Bluetooth: hci1: command tx timeout [ 104.084567][ T5634] Bluetooth: hci2: command tx timeout [ 104.086525][ T50] Bluetooth: hci3: command tx timeout [ 104.096518][ T5628] Bluetooth: hci0: command tx timeout [ 104.135638][ T5626] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.154596][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.166880][ T5626] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.176825][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.186613][ T5626] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.200196][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.209081][ T5626] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.224087][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.357262][ T5625] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.375644][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.387467][ T5625] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.400500][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.409415][ T5625] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.424163][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.443965][ T5625] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.455916][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.571797][ T5624] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.583110][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.592454][ T5624] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.605310][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.622729][ T5624] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.634394][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.643642][ T5624] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.654601][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.689306][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.764749][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.792874][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.831888][ T347] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.840131][ T347] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.859683][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.900147][ T347] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.907389][ T347] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.917963][ T347] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.925447][ T347] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.964364][ T347] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.971846][ T347] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.052739][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.130370][ T5625] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.150707][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.197278][ T347] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.204737][ T347] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.232352][ T347] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.239653][ T347] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.255449][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.280042][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.287277][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.337429][ T1123] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.344885][ T1123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.161245][ T50] Bluetooth: hci1: command tx timeout [ 106.163152][ T5634] Bluetooth: hci0: command tx timeout [ 106.167291][ T5628] Bluetooth: hci2: command tx timeout [ 106.167333][ T5628] Bluetooth: hci3: command tx timeout [ 106.362464][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.524057][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.580132][ T5626] veth0_vlan: entered promiscuous mode [ 106.627618][ T5626] veth1_vlan: entered promiscuous mode [ 106.753074][ T5627] veth0_vlan: entered promiscuous mode [ 106.807712][ T5626] veth0_macvtap: entered promiscuous mode [ 106.824652][ T5627] veth1_vlan: entered promiscuous mode [ 106.846426][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.855973][ T5626] veth1_macvtap: entered promiscuous mode [ 106.884937][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.934597][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.975013][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.020717][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.045495][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.057221][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.075157][ T5627] veth0_macvtap: entered promiscuous mode [ 107.083623][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.124249][ T5627] veth1_macvtap: entered promiscuous mode [ 107.136657][ T5625] veth0_vlan: entered promiscuous mode [ 107.205525][ T5625] veth1_vlan: entered promiscuous mode [ 107.237819][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.294731][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.327963][ T5624] veth0_vlan: entered promiscuous mode [ 107.367535][ T1123] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.377785][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.393988][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.402873][ T1123] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.437035][ T1123] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.456526][ T5624] veth1_vlan: entered promiscuous mode [ 107.474028][ T1123] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.512427][ T1123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.534578][ T1123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.576147][ T5625] veth0_macvtap: entered promiscuous mode [ 107.656366][ T5625] veth1_macvtap: entered promiscuous mode [ 107.700217][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.725460][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.763550][ T5626] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 107.810556][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.824120][ T1123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.834599][ T5624] veth0_macvtap: entered promiscuous mode [ 107.860142][ T1123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.891441][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.938075][ T5624] veth1_macvtap: entered promiscuous mode [ 107.950548][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.970450][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.015500][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.039539][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.208177][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.239241][ T50] Bluetooth: hci2: command tx timeout [ 108.251293][ T5634] Bluetooth: hci3: command tx timeout [ 108.257348][ T4942] Bluetooth: hci1: command tx timeout [ 108.262632][ T5628] Bluetooth: hci0: command tx timeout [ 108.331332][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.353600][ T29] audit: type=1800 audit(1783980079.256:2): pid=5781 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1" name="dbroot" dev="configfs" ino=7579 res=0 errno=0 [ 108.546319][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.575459][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.658344][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.669560][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.681433][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.698714][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.933582][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.949801][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.713278][ T347] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.733822][ T347] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.951997][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.972990][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.570543][ T5802] process 'syz.1.7' launched ':,' with NULL argv: empty string added [ 111.919378][ T5628] Bluetooth: hci1: command 0x0c1a tx timeout [ 111.928648][ T5790] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 112.210228][ T5790] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 112.313085][ T5790] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 112.368485][ T5790] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 112.383454][ T5790] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 112.417479][ T5790] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 112.440316][ T5790] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 112.457254][ T5790] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 112.481798][ T5790] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 112.515521][ T5790] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 112.530683][ T5790] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 112.566624][ T5790] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 113.575111][ T5835] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 113.999342][ T5628] Bluetooth: hci1: command 0x0c1a tx timeout [ 114.137785][ T5831] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 114.402510][ T5628] Bluetooth: hci2: command 0x0c1a tx timeout [ 114.480688][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout [ 114.560676][ T5628] Bluetooth: hci3: command 0x0c1a tx timeout [ 114.811011][ T5832] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 116.079599][ T5628] Bluetooth: hci1: command 0x0c1a tx timeout [ 116.279640][ T5628] Bluetooth: hci1: unexpected event for opcode 0x7c89 [ 116.478825][ T5628] Bluetooth: hci2: command 0x0c1a tx timeout [ 116.561825][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout [ 116.640572][ T5628] Bluetooth: hci3: command 0x0c1a tx timeout [ 118.559086][ T5628] Bluetooth: hci2: command 0x0c1a tx timeout [ 118.587182][ T5870] Zero length message leads to an empty skb [ 118.639289][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout [ 118.718683][ T5628] Bluetooth: hci3: command 0x0c1a tx timeout [ 119.567646][ T5888] bridge0: port 3(team0) entered blocking state [ 119.594718][ T5888] bridge0: port 3(team0) entered disabled state [ 119.628024][ T5888] team0: entered allmulticast mode [ 119.640877][ T5888] team_slave_0: entered allmulticast mode [ 119.646847][ T5888] team_slave_1: entered allmulticast mode [ 119.657547][ T5888] team0: entered promiscuous mode [ 119.664469][ T5888] team_slave_0: entered promiscuous mode [ 119.671096][ T5888] team_slave_1: entered promiscuous mode [ 119.678205][ T5888] bridge0: port 3(team0) entered blocking state [ 119.685979][ T5888] bridge0: port 3(team0) entered forwarding state [ 120.013042][ T5890] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 121.231755][ T5914] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 122.174603][ T5920] syz.2.26 (5920) used greatest stack depth: 18216 bytes left [ 122.652367][ T5931] netlink: 330 bytes leftover after parsing attributes in process `syz.2.29'. [ 124.114507][ T5956] FAULT_INJECTION: forcing a failure. [ 124.114507][ T5956] name failslab, interval 1, probability 0, space 0, times 1 [ 124.227718][ T5956] CPU: 0 UID: 0 PID: 5956 Comm: syz.1.33 Not tainted syzkaller #0 PREEMPT(full) [ 124.227765][ T5956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 124.227796][ T5956] Call Trace: [ 124.227808][ T5956] [ 124.227821][ T5956] dump_stack_lvl+0x100/0x190 [ 124.227891][ T5956] should_fail_ex.cold+0x5/0xa [ 124.227931][ T5956] should_failslab+0xc2/0x120 [ 124.227976][ T5956] kmem_cache_alloc_noprof+0x91/0x6a0 [ 124.228018][ T5956] ? __kernfs_new_node+0xd2/0xa10 [ 124.228075][ T5956] __kernfs_new_node+0xd2/0xa10 [ 124.228132][ T5956] ? __pfx___kernfs_new_node+0x10/0x10 [ 124.228193][ T5956] ? find_held_lock+0x2b/0x80 [ 124.228231][ T5956] ? kernfs_root+0xee/0x2a0 [ 124.228275][ T5956] ? kernfs_root+0xee/0x2a0 [ 124.228329][ T5956] kernfs_new_node+0x117/0x150 [ 124.228388][ T5956] __kernfs_create_file+0x53/0x350 [ 124.228432][ T5956] sysfs_add_file_mode_ns+0x207/0x3c0 [ 124.228486][ T5956] internal_create_group+0x593/0xfb0 [ 124.228550][ T5956] ? __pfx_internal_create_group+0x10/0x10 [ 124.228605][ T5956] ? kernfs_create_link+0x1bd/0x240 [ 124.228650][ T5956] internal_create_groups+0x9d/0x150 [ 124.228703][ T5956] device_add+0x7c8/0x1970 [ 124.228756][ T5956] ? __pfx_device_add+0x10/0x10 [ 124.228804][ T5956] ? lockdep_init_map_type+0x5c/0x250 [ 124.228857][ T5956] ? __init_waitqueue_head+0xca/0x150 [ 124.228907][ T5956] netdev_register_kobject+0x1a9/0x3d0 [ 124.228966][ T5956] register_netdevice+0x15b6/0x25a0 [ 124.229019][ T5956] ? __pfx_register_netdevice+0x10/0x10 [ 124.229058][ T5956] ? net_generic+0xea/0x2a0 [ 124.229120][ T5956] ppp_dev_configure+0x986/0xcb0 [ 124.229186][ T5956] ppp_ioctl+0x9d7/0x27c0 [ 124.229222][ T5956] ? find_held_lock+0x2b/0x80 [ 124.229261][ T5956] ? __pfx_ppp_ioctl+0x10/0x10 [ 124.229301][ T5956] ? __fget_files+0x21f/0x3d0 [ 124.229356][ T5956] ? __pfx_ppp_ioctl+0x10/0x10 [ 124.229390][ T5956] __x64_sys_ioctl+0x18e/0x210 [ 124.229436][ T5956] do_syscall_64+0x115/0x840 [ 124.229466][ T5956] ? clear_bhb_loop+0x40/0x90 [ 124.229507][ T5956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.229541][ T5956] RIP: 0033:0x7ff176f9de59 [ 124.229588][ T5956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.229626][ T5956] RSP: 002b:00007ff177eeb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.229658][ T5956] RAX: ffffffffffffffda RBX: 00007ff177225fa0 RCX: 00007ff176f9de59 [ 124.229680][ T5956] RDX: 0000000000000000 RSI: 00000000c004743e RDI: 0000000000000008 [ 124.229700][ T5956] RBP: 00007ff177033e6f R08: 0000000000000000 R09: 0000000000000000 [ 124.229720][ T5956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.229740][ T5956] R13: 00007ff177226038 R14: 00007ff177225fa0 R15: 00007ffd78dc52d8 [ 124.229784][ T5956] [ 125.638968][ T5970] netlink: 'syz.1.35': attribute type 4 has an invalid length. [ 127.135675][ T5989] vivid-007: ================= START STATUS ================= [ 127.159899][ T5989] vivid-007: Generate PTS: true [ 127.181858][ T5989] vivid-007: Generate SCR: true [ 127.191110][ T5989] tpg source WxH: 320x240 (Y'CbCr) [ 127.228132][ T5989] tpg field: 1 [ 127.235384][ T5989] tpg crop: (0,0)/320x240 [ 127.245061][ T5989] tpg compose: (0,0)/320x240 [ 127.263416][ T5989] tpg colorspace: 8 [ 127.279152][ T5628] Bluetooth: hci1: Unexpected cc 0x7c89 with no status [ 127.357795][ T5989] tpg transfer function: 0/0 [ 127.413039][ T5989] tpg Y'CbCr encoding: 0/0 [ 127.429050][ T5989] tpg quantization: 0/0 [ 127.464411][ T5989] tpg RGB range: 0/2 [ 127.483792][ T5989] vivid-007: ================== END STATUS ================== [ 129.732729][ T6021] FAULT_INJECTION: forcing a failure. [ 129.732729][ T6021] name failslab, interval 1, probability 0, space 0, times 0 [ 129.756887][ T6021] CPU: 1 UID: 0 PID: 6021 Comm: syz.2.45 Not tainted syzkaller #0 PREEMPT(full) [ 129.756932][ T6021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 129.756951][ T6021] Call Trace: [ 129.756962][ T6021] [ 129.756974][ T6021] dump_stack_lvl+0x100/0x190 [ 129.757017][ T6021] should_fail_ex.cold+0x5/0xa [ 129.757055][ T6021] should_failslab+0xc2/0x120 [ 129.757098][ T6021] __kmalloc_noprof+0xfc/0x820 [ 129.757134][ T6021] ? __register_sysctl_table+0xbc8/0x1650 [ 129.757189][ T6021] ? __register_sysctl_table+0xbc8/0x1650 [ 129.757244][ T6021] ? __register_sysctl_table+0xbe4/0x1650 [ 129.757305][ T6021] __register_sysctl_table+0xbe4/0x1650 [ 129.757371][ T6021] ? __pfx___register_sysctl_table+0x10/0x10 [ 129.757423][ T6021] ? is_module_address+0x69/0xf0 [ 129.757481][ T6021] ? register_net_sysctl_sz+0x222/0x430 [ 129.757532][ T6021] __devinet_sysctl_register+0x1b9/0x360 [ 129.757601][ T6021] ? __pfx___devinet_sysctl_register+0x10/0x10 [ 129.757665][ T6021] ? __asan_memcpy+0x3c/0x60 [ 129.757702][ T6021] devinet_init_net+0x334/0x8d0 [ 129.757760][ T6021] ? __pfx_devinet_init_net+0x10/0x10 [ 129.757813][ T6021] ops_init+0x1e2/0x5f0 [ 129.757859][ T6021] setup_net+0x118/0x3a0 [ 129.757900][ T6021] ? __pfx_setup_net+0x10/0x10 [ 129.757941][ T6021] ? mutex_init_lockdep+0xf1/0x120 [ 129.758001][ T6021] copy_net_ns+0x46f/0x7c0 [ 129.758049][ T6021] create_new_namespaces+0x3ea/0xac0 [ 129.758116][ T6021] unshare_nsproxy_namespaces+0xf2/0x220 [ 129.758153][ T6021] ksys_unshare+0x438/0xab0 [ 129.758195][ T6021] ? __pfx_ksys_unshare+0x10/0x10 [ 129.758251][ T6021] __x64_sys_unshare+0x31/0x40 [ 129.758294][ T6021] do_syscall_64+0x115/0x840 [ 129.758324][ T6021] ? clear_bhb_loop+0x40/0x90 [ 129.758365][ T6021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.758400][ T6021] RIP: 0033:0x7fd15f59de59 [ 129.758428][ T6021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.758462][ T6021] RSP: 002b:00007fd16054f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 129.758495][ T6021] RAX: ffffffffffffffda RBX: 00007fd15f825fa0 RCX: 00007fd15f59de59 [ 129.758517][ T6021] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 129.758537][ T6021] RBP: 00007fd15f633e6f R08: 0000000000000000 R09: 0000000000000000 [ 129.758555][ T6021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.758581][ T6021] R13: 00007fd15f826038 R14: 00007fd15f825fa0 R15: 00007ffd97a95d98 [ 129.758624][ T6021] [ 130.152715][ T6021] sysctl could not get directory: /net/ipv4/conf/default -12 [ 132.034700][ T6040] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.213319][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.221632][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.411500][ T6067] nbd: socks must be embedded in a SOCK_ITEM attr [ 134.436743][ T6065] bond0: invalid ARP target specified [ 134.495290][ T6067] block nbd0: shutting down sockets [ 134.595596][ T6065] netlink: 28 bytes leftover after parsing attributes in process `syz.3.53'. [ 134.629352][ T6065] bridge0: port 3(team0) entered disabled state [ 134.662082][ T6065] team0 (unregistering): left allmulticast mode [ 134.691159][ T6065] team_slave_0: left allmulticast mode [ 134.719914][ T6065] team_slave_1: left allmulticast mode [ 134.736331][ T6065] team0 (unregistering): left promiscuous mode [ 134.768008][ T6065] team_slave_0: left promiscuous mode [ 134.794420][ T6065] team_slave_1: left promiscuous mode [ 134.815404][ T6065] bridge0: port 3(team0) entered disabled state [ 134.905561][ T6065] team0 (unregistering): Port device team_slave_0 removed [ 134.961044][ T6065] team0 (unregistering): Port device team_slave_1 removed [ 135.113597][ T6078] netlink: zone id is out of range [ 135.147217][ T6078] netlink: zone id is out of range [ 135.163200][ T6078] netlink: zone id is out of range [ 135.173094][ T6078] netlink: zone id is out of range [ 135.188741][ T6078] netlink: zone id is out of range [ 135.251506][ T6078] netlink: zone id is out of range [ 135.278989][ T6078] netlink: zone id is out of range [ 135.427621][ T6078] netlink: zone id is out of range [ 135.518288][ T6078] netlink: set zone limit has 8 unknown bytes [ 138.026123][ T6110] bond0: invalid ARP target specified [ 138.199423][ T6112] netlink: 28 bytes leftover after parsing attributes in process `syz.1.62'. [ 138.269164][ T6112] team0 (unregistering): Port device team_slave_0 removed [ 138.305943][ T6112] team0 (unregistering): Port device team_slave_1 removed [ 138.925460][ T6124] futex_wake_op: syz.0.65 tries to shift op by -2048; fix this program [ 138.995514][ T6118] 0x000000000001-0x000000020000 : "" [ 139.075575][ T6118] ftl_cs: FTL header corrupt! [ 139.292449][ T6123] ubi1: attaching mtd0 [ 139.404834][ T6123] ubi1: scanning is finished [ 139.417710][ T6123] ubi1: empty MTD device detected [ 139.787838][ T6123] ubi1: attached mtd0 (name "mtdram test device", size 0 MiB) [ 139.832684][ T6123] ubi1: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 139.878784][ T6123] ubi1: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 139.890222][ T6123] ubi1: VID header offset: 64 (aligned 64), data offset: 128 [ 139.912503][ T6123] ubi1: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 139.972878][ T6123] ubi1: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 140.008128][ T6123] ubi1: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 920782880 [ 140.035752][ T6123] ubi1: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 140.131592][ T6129] ubi1: background thread "ubi_bgt1d" started, PID 6129 [ 140.504463][ T6131] syz.3.66 uses obsolete (PF_INET,SOCK_PACKET) [ 148.015913][ T6223] ======================================================= [ 148.015913][ T6223] WARNING: The mand mount option has been deprecated and [ 148.015913][ T6223] and is ignored by this kernel. Remove the mand [ 148.015913][ T6223] option from the mount to silence this warning. [ 148.015913][ T6223] ======================================================= [ 149.882668][ T6220] Process accounting resumed [ 150.189996][ T6241] FAULT_INJECTION: forcing a failure. [ 150.189996][ T6241] name failslab, interval 1, probability 0, space 0, times 0 [ 150.255327][ T6241] CPU: 0 UID: 0 PID: 6241 Comm: syz.0.87 Not tainted syzkaller #0 PREEMPT(full) [ 150.255375][ T6241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 150.255396][ T6241] Call Trace: [ 150.255407][ T6241] [ 150.255421][ T6241] dump_stack_lvl+0x100/0x190 [ 150.255463][ T6241] should_fail_ex.cold+0x5/0xa [ 150.255501][ T6241] should_failslab+0xc2/0x120 [ 150.255554][ T6241] __kmalloc_cache_noprof+0x91/0x6c0 [ 150.255607][ T6241] ? lock_acquire+0x1b9/0x370 [ 150.255657][ T6241] ? __hw_addr_create+0x57/0x220 [ 150.255712][ T6241] __hw_addr_create+0x57/0x220 [ 150.255764][ T6241] __hw_addr_add_ex+0x32b/0x650 [ 150.255815][ T6241] ? stack_depot_init+0x38/0x80 [ 150.255862][ T6241] ? __pfx___hw_addr_add_ex+0x10/0x10 [ 150.255914][ T6241] ? __mutex_unlock_slowpath+0x35d/0x930 [ 150.255976][ T6241] dev_addr_init+0x161/0x250 [ 150.256028][ T6241] ? __pfx_dev_addr_init+0x10/0x10 [ 150.256089][ T6241] ? __pfx_do_setup+0x10/0x10 [ 150.256124][ T6241] ? __pfx_do_setup+0x10/0x10 [ 150.256155][ T6241] alloc_netdev_mqs+0x363/0x15c0 [ 150.256196][ T6241] ? ovs_vport_alloc+0x288/0x3b0 [ 150.256235][ T6241] internal_dev_create+0x8a/0x520 [ 150.256273][ T6241] ovs_vport_add+0x147/0x4d0 [ 150.256307][ T6241] new_vport+0x16/0x1d0 [ 150.256353][ T6241] ovs_dp_cmd_new+0x65d/0xdf0 [ 150.256413][ T6241] ? __pfx_ovs_dp_cmd_new+0x10/0x10 [ 150.256461][ T6241] ? __nla_parse+0x40/0x60 [ 150.256499][ T6241] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 150.256542][ T6241] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 150.256590][ T6241] genl_family_rcv_msg_doit+0x214/0x300 [ 150.256630][ T6241] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 150.256665][ T6241] ? genl_get_cmd+0x3e7/0x760 [ 150.256731][ T6241] ? bpf_lsm_capable+0x9/0x10 [ 150.256764][ T6241] ? security_capable+0x80/0x260 [ 150.256816][ T6241] ? ns_capable+0xd2/0xf0 [ 150.256850][ T6241] genl_rcv_msg+0x560/0x800 [ 150.256888][ T6241] ? __pfx_genl_rcv_msg+0x10/0x10 [ 150.256923][ T6241] ? __pfx_ovs_dp_cmd_new+0x10/0x10 [ 150.256985][ T6241] netlink_rcv_skb+0x159/0x420 [ 150.257034][ T6241] ? __pfx_genl_rcv_msg+0x10/0x10 [ 150.257069][ T6241] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 150.257137][ T6241] ? netlink_deliver_tap+0x1ae/0xcc0 [ 150.257194][ T6241] genl_rcv+0x28/0x40 [ 150.257224][ T6241] netlink_unicast+0x585/0x850 [ 150.257283][ T6241] ? __pfx_netlink_unicast+0x10/0x10 [ 150.257347][ T6241] netlink_sendmsg+0x8b0/0xda0 [ 150.257406][ T6241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 150.257466][ T6241] ? apparmor_socket_sendmsg+0x15b/0x270 [ 150.257529][ T6241] ____sys_sendmsg+0xa4d/0xbe0 [ 150.257585][ T6241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 150.257640][ T6241] ? __pfx_____sys_sendmsg+0x10/0x10 [ 150.257711][ T6241] ___sys_sendmsg+0x190/0x1e0 [ 150.257767][ T6241] ? __pfx____sys_sendmsg+0x10/0x10 [ 150.257815][ T6241] ? __lock_acquire+0x49f/0x1a40 [ 150.257915][ T6241] __sys_sendmsg+0x160/0x210 [ 150.257957][ T6241] ? __pfx___sys_sendmsg+0x10/0x10 [ 150.258020][ T6241] do_syscall_64+0x115/0x840 [ 150.258052][ T6241] ? clear_bhb_loop+0x40/0x90 [ 150.258094][ T6241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.258130][ T6241] RIP: 0033:0x7f4d1e99de59 [ 150.258159][ T6241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.258190][ T6241] RSP: 002b:00007f4d1f8ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 150.258222][ T6241] RAX: ffffffffffffffda RBX: 00007f4d1ec25fa0 RCX: 00007f4d1e99de59 [ 150.258245][ T6241] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006 [ 150.258266][ T6241] RBP: 00007f4d1ea33e6f R08: 0000000000000000 R09: 0000000000000000 [ 150.258286][ T6241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 150.258307][ T6241] R13: 00007f4d1ec26038 R14: 00007f4d1ec25fa0 R15: 00007fff98552cf8 [ 150.258351][ T6241] [ 151.865623][ T6255] netlink: 9 bytes leftover after parsing attributes in process `syz.0.90'. [ 152.380642][ T5628] Bluetooth: hci3: unexpected event for opcode 0x7c89 [ 154.087376][ T6258] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 154.105624][ T6258] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 154.140308][ T6258] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 154.174980][ T6258] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 154.479129][ T5628] Bluetooth: hci1: command 0x0c1a tx timeout [ 156.158852][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout [ 156.165079][ T5634] Bluetooth: hci2: command 0x0c1a tx timeout [ 156.248834][ T5634] Bluetooth: hci3: command 0x0c1a tx timeout [ 156.827514][ T6289] netlink: 12 bytes leftover after parsing attributes in process `syz.3.95'. [ 158.638984][ T6316] FAULT_INJECTION: forcing a failure. [ 158.638984][ T6316] name failslab, interval 1, probability 0, space 0, times 0 [ 158.681713][ T6316] CPU: 1 UID: 0 PID: 6316 Comm: syz.1.103 Tainted: G L syzkaller #0 PREEMPT(full) [ 158.681762][ T6316] Tainted: [L]=SOFTLOCKUP [ 158.681773][ T6316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 158.681792][ T6316] Call Trace: [ 158.681801][ T6316] [ 158.681812][ T6316] dump_stack_lvl+0x100/0x190 [ 158.681852][ T6316] should_fail_ex.cold+0x5/0xa [ 158.681885][ T6316] should_failslab+0xc2/0x120 [ 158.681922][ T6316] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 158.681960][ T6316] ? __kasan_kmalloc+0xaa/0xb0 [ 158.681994][ T6316] ? __request_module+0x2d5/0x6a0 [ 158.682028][ T6316] kstrdup+0x51/0xe0 [ 158.682059][ T6316] __request_module+0x2d5/0x6a0 [ 158.682088][ T6316] ? __pfx___request_module+0x10/0x10 [ 158.682127][ T6316] ? inode_init_always_gfp+0xc98/0xfb0 [ 158.682186][ T6316] __sock_create+0x5c4/0x860 [ 158.682235][ T6316] __sys_socket+0x14d/0x260 [ 158.682290][ T6316] ? __pfx___sys_socket+0x10/0x10 [ 158.682346][ T6316] __x64_sys_socket+0x72/0xb0 [ 158.682389][ T6316] ? lockdep_hardirqs_on+0x78/0x100 [ 158.682436][ T6316] do_syscall_64+0x115/0x840 [ 158.682461][ T6316] ? clear_bhb_loop+0x40/0x90 [ 158.682495][ T6316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.682524][ T6316] RIP: 0033:0x7ff176f9de59 [ 158.682548][ T6316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.682575][ T6316] RSP: 002b:00007ff177eeb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 158.682603][ T6316] RAX: ffffffffffffffda RBX: 00007ff177225fa0 RCX: 00007ff176f9de59 [ 158.682623][ T6316] RDX: 0000000000000004 RSI: 000000000000000a RDI: 000000000000000b [ 158.682639][ T6316] RBP: 00007ff177033e6f R08: 0000000000000000 R09: 0000000000000000 [ 158.682656][ T6316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.682673][ T6316] R13: 00007ff177226038 R14: 00007ff177225fa0 R15: 00007ffd78dc52d8 [ 158.682709][ T6316] [ 159.469680][ T6326] netlink: 342 bytes leftover after parsing attributes in process `syz.2.105'. [ 159.681772][ T5634] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 161.324710][ T6352] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5624] was attempted by "I0,y[8(]fm2hPM\x0b\x1bmr_\x074rR3d8>l&d@3*WcgX$e3jjX̀<>i#(&#`{ɐ2.w; h_\x0d6x(m#s{\x0dB#n'm5=.2$-T4ca.I2bj\x0d86Ћ|hS]uk?/,\x0ba\x0a \x0cQRۺijUS_‘dW`5ee>[Ł 0tOwOl/i\x22&\x5c O+65UzmΒx0/*Cۮ)Nd_,(WTþŒX\x0bb6; ;;$߳'s}CG%*>C|,˖ib=NTqy4uBJ(}I<'Hܙ*\x22U#*'}8cI8\x0c;Ȉݷ3ص` ;jzd!퇱`a\x0dVɉ/\x22Nbl@Q-涪ڍX\x07}]_ sY϶uy# E0O\x09@loۺ/O`\x1bK'|Oэs[{9bĉ_\x0bigR&k> FTXq5_i:}O\x0c\x09WP\x0bI-v#\x07gY\x1bmӼo@ׂTtsdHw[#k/>'t,epd[QAc_feۘ%4.Q҉Dk6st\x0a%\x09#0]4 [ 163.176151][ T6369] netlink: 28 bytes leftover after parsing attributes in process `syz.3.113'. [ 163.311036][ T6369] veth1_vlan: entered allmulticast mode [ 164.199755][ T6382] netlink: 350 bytes leftover after parsing attributes in process `syz.2.116'. [ 164.772804][ T6398] netlink: 28 bytes leftover after parsing attributes in process `syz.3.120'. [ 164.855991][ T6398] bridge_slave_1: left allmulticast mode [ 164.856055][ T6398] bridge_slave_1: left promiscuous mode [ 164.856921][ T6398] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.881556][ T6398] bridge_slave_0: left allmulticast mode [ 164.881593][ T6398] bridge_slave_0: left promiscuous mode [ 164.885338][ T6398] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.108452][ T6395] netlink: 28 bytes leftover after parsing attributes in process `syz.2.119'. [ 165.628400][ T6407] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5625] was attempted by "VB~eL/r+).!(fc)qi;C\x0a'߫7QeX(.V8#7?{dTHқNlz\x1bbqW+*O`ˆL'm:jHrBpiՌZ5MQp.#/xkՊ99o!UM}a%7%\x1bFРe@8`Z$C406`:AQTK#\x1b+$ n/\x0b\x07+;YEĩn_qa$H1\x0b|e~3YBow;l+uf}W&%˪a\x07q4V-eAaw21&pt{2ZoWcwiy׺? S!jx1Fn/BۛNbg)wp!9]Gдш\x0d9jy3ÒFx+,*=f1prbx-dK3|x`OD(+n XsъA8x?Hk`yހIiA' &mwPFRwc$c㍱A:(LwCUݖ8`ԯx\x0aتWWw'_0 bym3TSld`̱͸Ffs718֢\x0db33$zcᙣg+F{z R1ײ2i0&IڒUD'\x0aR_$7304S'VP;E+>/\x0a aa蘬=Lj\x5c٧|ZuBSz@Arauae`rb.T̤c [ 166.211488][ T6421] mmap: syz.2.124 (6421) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 170.952448][ T6466] netlink: 330 bytes leftover after parsing attributes in process `syz.2.134'. [ 173.112932][ T6493] NFSD: Failed to start, no listeners configured. [ 173.896518][ T6502] can0: slcan on pty155. [ 174.008655][ T6514] random: crng reseeded on system resumption [ 174.083879][ T6507] can0 (unregistered): slcan off pty155. [ 175.408995][ T29] audit: type=1804 audit(1783982192.311:3): pid=6538 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.150" name="/newroot/30/file0" dev="tmpfs" ino=175 res=1 errno=0 [ 175.507286][ T29] audit: type=1804 audit(1783982192.331:4): pid=6532 uid=2 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.150" name="/newroot/30/file0" dev="tmpfs" ino=175 res=1 errno=0 [ 176.398324][ T6556] random: crng reseeded on system resumption [ 177.408214][ T6562] netlink: 'syz.3.154': attribute type 1 has an invalid length. [ 177.425438][ T6562] netlink: 33 bytes leftover after parsing attributes in process `syz.3.154'. [ 179.865946][ T6580] Bluetooth: hci3: SCO packet for unknown connection handle 0 [ 180.271491][ T6592] Process accounting paused [ 181.091788][ T6615] program syz.1.165 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 181.145950][ T6615] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 181.797315][ T6619] vhci_hcd: not connected 4 [ 182.122014][ T6622] pim6reg: entered allmulticast mode [ 184.581050][ T6580] Bluetooth: hci0: SCO packet for unknown connection handle 0 [ 187.284403][ T6714] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 187.433861][ T6715] random: crng reseeded on system resumption [ 187.614359][ T6706] vhci_hcd: not connected 4 [ 187.922324][ T6728] binder: 6726:6728 ioctl 541b 0 returned -22 [ 193.636637][ T6783] random: crng reseeded on system resumption [ 194.373504][ T29] audit: type=1804 audit(1783982211.271:5): pid=6796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.189" name="/newroot/43/file0" dev="tmpfs" ino=249 res=1 errno=0 [ 194.438977][ T29] audit: type=1804 audit(1783982211.291:6): pid=6788 uid=2 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.189" name="/newroot/43/file0" dev="tmpfs" ino=249 res=1 errno=0 [ 194.656962][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.667937][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.755441][ T6801] binder: 6800:6801 ioctl 541b 0 returned -22 [ 194.809089][ T6803] program syz.2.199 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 194.871743][ T6803] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 194.965375][ T6802] pim6reg: entered allmulticast mode [ 196.426603][ T6818] program syz.0.201 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 196.494973][ T6818] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 198.018426][ T6831] vhci_hcd: not connected 4 [ 198.276269][ T6838] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5627] was attempted by "+I:\x0auʍ'FUH>s;㧖 T\x099\x0c'\x0bIˏJ q/X<|R_M}rO4l5.֪\x09ME/,\x07ά:0%acٜ)M$HRcӒ>%;,I\x07\x09o'GL-h}8lNn:c:ƟтZ!j4|k?e)<0MCe[\x0bCі\x0bo \x07V!nޔr/ph<\x0c߁P\x5c:!R݉þᏄPMڎ8SТ@\x0bOӣLC00s}@!57͈F؛I!Lz\x074|E s5R2&1P\x09CS>e9Ⳉ$'i[2g00h\x0aHT{\x229hG߽C.a!(MKy`pnR2rmjHZ%3\x09Q28W71 [ 198.827645][ T6843] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 200.362823][ T6866] netlink: 28 bytes leftover after parsing attributes in process `syz.0.202'. [ 200.415608][ T6866] bridge_slave_1: left allmulticast mode [ 200.422573][ T6866] bridge_slave_1: left promiscuous mode [ 200.429038][ T6866] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.499694][ T6866] bridge_slave_0: left allmulticast mode [ 200.506350][ T6866] bridge_slave_0: left promiscuous mode [ 200.522994][ T6866] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.023277][ T6882] program syz.3.205 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 202.034055][ T6882] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 204.805666][ T6903] binder: 6901:6903 ioctl 541b 0 returned -22 [ 208.369879][ T6932] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 208.758781][ T6934] NFSD: Failed to start, no listeners configured. [ 209.397919][ T6942] program syz.0.222 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 209.473337][ T6942] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 210.815666][ T6942] Process accounting resumed [ 211.354834][ T6958] netlink: 28 bytes leftover after parsing attributes in process `syz.2.213'. [ 211.421759][ T6958] bridge_slave_1: left allmulticast mode [ 211.472172][ T6958] bridge_slave_1: left promiscuous mode [ 211.526723][ T6958] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.614328][ T6958] bridge_slave_0: left allmulticast mode [ 211.645977][ T6958] bridge_slave_0: left promiscuous mode [ 211.685491][ T6958] bridge0: port 1(bridge_slave_0) entered disabled state [ 220.486626][ T7034] program syz.1.231 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 220.496419][ T7034] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 224.505453][ T29] audit: type=1800 audit(1783982241.376:7): pid=7068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.235" name="dbroot" dev="configfs" ino=14168 res=0 errno=0 [ 224.564834][ T7068] netlink: 8 bytes leftover after parsing attributes in process `syz.3.235'. [ 226.267007][ T7061] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 226.273444][ T6580] Bluetooth: hci1: command 0x0c1a tx timeout [ 226.675885][ T7061] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 226.714428][ T7061] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 226.736018][ T7061] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 227.115923][ T7092] futex_wake_op: syz.1.247 tries to shift op by -2048; fix this program [ 227.182113][ T7090] 0x000000000001-0x000000020000 : "" [ 227.289730][ T7090] ftl_cs: FTL header corrupt! [ 227.622792][ T7087] ubi: mtd0 is already attached to ubi1 [ 228.346720][ T6580] Bluetooth: hci2: command 0x0c1a tx timeout [ 228.724981][ T29] audit: type=1804 audit(1783982245.594:8): pid=7116 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.240" name="/newroot/56/file0" dev="tmpfs" ino=319 res=1 errno=0 [ 228.763434][ T6580] Bluetooth: hci3: command 0x0c1a tx timeout [ 228.769656][ T6580] Bluetooth: hci0: command 0x0c1a tx timeout [ 228.815749][ T29] audit: type=1804 audit(1783982245.634:9): pid=7109 uid=2 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.240" name="/newroot/56/file0" dev="tmpfs" ino=319 res=1 errno=0 [ 233.335405][ T7167] netlink: 330 bytes leftover after parsing attributes in process `syz.3.248'. [ 233.485894][ T7171] netlink: 28 bytes leftover after parsing attributes in process `syz.1.246'. [ 233.510645][ T7171] bridge_slave_1: left allmulticast mode [ 233.518867][ T7171] bridge_slave_1: left promiscuous mode [ 233.525653][ T7171] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.577457][ T7171] bridge_slave_0: left allmulticast mode [ 233.589574][ T7171] bridge_slave_0: left promiscuous mode [ 233.599718][ T7171] bridge0: port 1(bridge_slave_0) entered disabled state [ 234.686559][ T7189] usb usb3: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 234.935071][ T7176] zswap: compressor 000 not available [ 240.887834][ T7243] FAULT_INJECTION: forcing a failure. [ 240.887834][ T7243] name failslab, interval 1, probability 0, space 0, times 0 [ 240.943347][ T7243] CPU: 1 UID: 0 PID: 7243 Comm: syz.1.262 Tainted: G L syzkaller #0 PREEMPT(full) [ 240.943399][ T7243] Tainted: [L]=SOFTLOCKUP [ 240.943410][ T7243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 240.943499][ T7243] Call Trace: [ 240.943513][ T7243] [ 240.943523][ T7243] dump_stack_lvl+0x100/0x190 [ 240.943554][ T7243] should_fail_ex.cold+0x5/0xa [ 240.943581][ T7243] should_failslab+0xc2/0x120 [ 240.943673][ T7243] kmem_cache_alloc_noprof+0x91/0x6a0 [ 240.943703][ T7243] ? mas_preallocate+0x1105/0x14a0 [ 240.943738][ T7243] mas_preallocate+0x1105/0x14a0 [ 240.943772][ T7243] ? __pfx_mas_preallocate+0x10/0x10 [ 240.943811][ T7243] ? anon_vma_name+0x5a/0x250 [ 240.943862][ T7243] __split_vma+0x33d/0xda0 [ 240.943905][ T7243] ? __pfx___split_vma+0x10/0x10 [ 240.943940][ T7243] ? vma_link+0x5ee/0x8d0 [ 240.943993][ T7243] vms_gather_munmap_vmas+0x1d2/0x1720 [ 240.944048][ T7243] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 240.944090][ T7243] ? alloc_new_pud+0x217/0x320 [ 240.944112][ T7243] ? get_old_pud+0xd8/0x360 [ 240.944135][ T7243] ? move_page_tables+0x11c/0x4610 [ 240.944160][ T7243] ? __pfx_copy_vma+0x10/0x10 [ 240.944182][ T7243] ? ktime_get+0x9f/0x320 [ 240.944227][ T7243] do_vmi_align_munmap+0x287/0x5f0 [ 240.944272][ T7243] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 240.944353][ T7243] do_vmi_munmap+0x1f8/0x3e0 [ 240.944381][ T7243] move_vma+0xe5b/0x1920 [ 240.944409][ T7243] ? __pfx_move_vma+0x10/0x10 [ 240.944437][ T7243] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 240.944481][ T7243] ? vrm_set_new_addr+0x204/0x290 [ 240.944507][ T7243] mremap_to+0x234/0x4c0 [ 240.944534][ T7243] ? mas_walk+0x6ef/0x9b0 [ 240.944556][ T7243] ? __pfx_mremap_to+0x10/0x10 [ 240.944579][ T7243] ? check_prep_vma+0x912/0xe60 [ 240.944613][ T7243] __do_sys_mremap+0x88c/0x1850 [ 240.944648][ T7243] ? __pfx___do_sys_mremap+0x10/0x10 [ 240.944670][ T7243] ? ksys_write+0x190/0x250 [ 240.944716][ T7243] ? __pfx_do_futex+0x10/0x10 [ 240.944756][ T7243] ? __x64_sys_futex+0x34f/0x4d0 [ 240.944799][ T7243] do_syscall_64+0x115/0x840 [ 240.944828][ T7243] ? clear_bhb_loop+0x40/0x90 [ 240.944858][ T7243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.944913][ T7243] RIP: 0033:0x7ff176f9de59 [ 240.944949][ T7243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.944973][ T7243] RSP: 002b:00007ff177eeb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 240.944996][ T7243] RAX: ffffffffffffffda RBX: 00007ff177225fa0 RCX: 00007ff176f9de59 [ 240.945021][ T7243] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000400000 [ 240.945036][ T7243] RBP: 00007ff177033e6f R08: 0000000100000000 R09: 0000000000000000 [ 240.945051][ T7243] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 240.945065][ T7243] R13: 00007ff177226038 R14: 00007ff177225fa0 R15: 00007ffd78dc52d8 [ 240.945096][ T7243] [ 241.975090][ T7252] NFSD: Failed to start, no listeners configured. [ 242.186452][ T7255] netlink: 28 bytes leftover after parsing attributes in process `syz.3.264'. [ 242.308480][ T7251] Process accounting paused [ 242.589917][ T7262] bond0: invalid ARP target specified [ 242.730220][ T7262] netlink: 28 bytes leftover after parsing attributes in process `syz.2.268'. [ 242.914806][ T7262] team0 (unregistering): Port device team_slave_0 removed [ 242.963359][ T7262] team0 (unregistering): Port device team_slave_1 removed [ 247.366336][ T7311] bond0: invalid ARP target specified [ 247.643467][ T7311] netlink: 28 bytes leftover after parsing attributes in process `syz.2.286'. [ 248.370115][ T7320] NFSD: Failed to start, no listeners configured. [ 249.081138][ T7325] netlink: 28 bytes leftover after parsing attributes in process `syz.1.279'. [ 251.142395][ T7362] netlink: zone id is out of range [ 251.168216][ T7362] netlink: zone id is out of range [ 251.188296][ T7362] netlink: zone id is out of range [ 251.207232][ T7362] netlink: zone id is out of range [ 251.219675][ T7362] netlink: zone id is out of range [ 251.243757][ T7362] netlink: zone id is out of range [ 251.279487][ T7362] netlink: zone id is out of range [ 251.350215][ T7362] netlink: zone id is out of range [ 251.496775][ T7362] netlink: set zone limit has 8 unknown bytes [ 256.128075][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.140286][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.178139][ T7399] netlink: 'syz.1.297': attribute type 1 has an invalid length. [ 256.193829][ T7399] netlink: 9 bytes leftover after parsing attributes in process `syz.1.297'. [ 256.775195][ T7407] zswap: compressor not available [ 256.813289][ T7401] netlink: 28 bytes leftover after parsing attributes in process `syz.0.295'. [ 261.412726][ T7455] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5624] was attempted by "XHN\x0coڬ/ʃբEZ-)Bt\x07gq΋W;暊Mnӝ{ms4'tG\x0dƖBf7Mo砜 NH#\x0d)͠Pmd=qyntAGD8%RjuDT)Nv`Z&J\x22t\x0c-@„zDJ]%jC\x5cr)Ie&۾u7t;Tx+}+R.~`GP$15.ہp\x0c\x0c+\x0b1V0?וSG)1Cm7,뛹mg&/0ؗnފޯ{o!Wc&לO\x09&Ey#L[pwRs#\x0apdag(u&nզ\x5ccT-O&6R\x0aNOIYhE[?\x07ew~qI$Pr^~~9ECjD$քe AuX(Fͥ| szlª8!\x0b+1%4ZP5WmӢ!gLq`hNUJQBFbX&Njmw,S'TNj (!ٗk`Bv/*]+uk<Q3\x1bݳa.Et\x0dmHW3}-ŅTζa'2ݠ?{\x0aTfO¾j\x0d\x09 [ 262.302653][ T7465] bond0: invalid ARP target specified [ 262.598806][ T7467] nbd: socks must be embedded in a SOCK_ITEM attr [ 262.670192][ T7467] block nbd0: shutting down sockets [ 262.709477][ T7465] netlink: 28 bytes leftover after parsing attributes in process `syz.0.305'. [ 262.908808][ T7465] team0 (unregistering): Port device team_slave_0 removed [ 262.978016][ T7465] team0 (unregistering): Port device team_slave_1 removed [ 263.594006][ T7485] netlink: 17 bytes leftover after parsing attributes in process `syz.2.309'. [ 268.073277][ T7524] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5626] was attempted by "\x5cHjNzW=~qF`Ư`hJmW/G#ų\x0cBL:)SΪӁZovNي\x0a\x1bC}RѦN{\x09\x1b,L~v#yX,\x5c-\x0d|&ݐ\x224'=lRoC~QUR71[]h\x0cCNt?._|\x5c[gy.F+z9 Sqw*q%)a/VެY38bŦ+Hww$\x07/1n\x5co\x0aoqHaة'2ʙ\x0aE jA0\x0cӱ\x5c*6&ZfOXk'>--*\x0c;}5*{Eip_|\x0cV\x0c#@X?HwKE>/Fk3h_M=\x07^k#,u<\x0b'\x0a~V\x0a2`\x0caqUׇ+*gl0ڻ\x0aD7nTcۣ`*\x07|yeR\x0b\x0bg)t[&E\x07I/ϝ_)_U$:[XNf\x09~*DAqehi\x0c-N+*2B\x0dKio\x07t[α\x07{P1:+#[ʝx\x22dI8,p1+p?n(-4\x5c>#>Xo\x07RC@ 651 99J@o%\x22A&k3\x1b|r6d1m1\x0aseHI\x0cd?[Sz`+r_D)6ZH\x [ 268.111578][ T7525] vivid-007: ================= START STATUS ================= [ 268.264284][ T7525] vivid-007: Generate PTS: true [ 268.276708][ T7525] vivid-007: Generate SCR: true [ 268.297134][ T7525] tpg source WxH: 320x240 (Y'CbCr) [ 268.306644][ T7525] tpg field: 1 [ 268.313031][ T7525] tpg crop: (0,0)/320x240 [ 268.326741][ T7525] tpg compose: (0,0)/320x240 [ 268.334561][ T7525] tpg colorspace: 8 [ 268.400012][ T7525] tpg transfer function: 0/0 [ 268.421982][ T7525] tpg Y'CbCr encoding: 0/0 [ 268.448067][ T7525] tpg quantization: 0/0 [ 268.463354][ T7525] tpg RGB range: 0/2 [ 268.526544][ T7525] vivid-007: ================== END STATUS ================== [ 270.275356][ T7546] bond0: invalid ARP target specified [ 270.347880][ T7546] nbd: socks must be embedded in a SOCK_ITEM attr [ 270.372692][ T7546] block nbd0: shutting down sockets [ 270.450180][ T7546] netlink: 28 bytes leftover after parsing attributes in process `syz.1.319'. [ 270.538212][ T7547] zswap: compressor not available [ 270.693438][ T7560] netlink: zone id is out of range [ 270.721751][ T7560] netlink: zone id is out of range [ 270.744736][ T7560] netlink: zone id is out of range [ 270.768114][ T7560] netlink: zone id is out of range [ 270.796018][ T7560] netlink: zone id is out of range [ 270.816152][ T7560] netlink: zone id is out of range [ 270.836793][ T7560] netlink: zone id is out of range [ 270.867277][ T7560] netlink: zone id is out of range [ 270.911917][ T7560] netlink: set zone limit has 8 unknown bytes [ 271.140856][ T6573] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 272.630585][ T7568] Bluetooth: hci3: Unexpected cc 0x7c89 with no status [ 273.092427][ T7580] Process accounting resumed [ 274.479068][ T7604] netlink: 28 bytes leftover after parsing attributes in process `syz.1.336'. [ 274.655880][ T7614] bond0: invalid ARP target specified [ 274.730821][ T7614] nbd: socks must be embedded in a SOCK_ITEM attr [ 274.755638][ T7614] block nbd0: shutting down sockets [ 274.868871][ T7614] netlink: 28 bytes leftover after parsing attributes in process `syz.0.337'. [ 276.390924][ T7568] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 278.735553][ T7664] bond0: invalid ARP target specified [ 278.802096][ T7664] nbd: socks must be embedded in a SOCK_ITEM attr [ 278.819253][ T7664] block nbd0: shutting down sockets [ 278.890371][ T7664] netlink: 28 bytes leftover after parsing attributes in process `syz.3.348'. [ 279.491542][ T7668] netlink: 28 bytes leftover after parsing attributes in process `syz.0.349'. [ 280.888495][ T7660] kexec: Could not allocate control_code_buffer [ 283.713286][ T7718] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 283.935900][ T7718] File: /dev/nullb0 PID: 7718 Comm: syz.0.355 [ 284.117991][ T7727] netlink: 'syz.3.358': attribute type 1 has an invalid length. [ 284.161135][ T7727] netlink: 9 bytes leftover after parsing attributes in process `syz.3.358'. [ 285.325567][ T7750] nbd: must specify at least one socket [ 287.630772][ T7778] netlink: 28 bytes leftover after parsing attributes in process `syz.3.368'. [ 287.804769][ T7778] veth1_macvtap: left promiscuous mode [ 287.822988][ T7778] macsec0: entered promiscuous mode [ 287.842912][ T7778] macsec0: entered allmulticast mode [ 290.144423][ T29] audit: type=1800 audit(1783982306.993:10): pid=7808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.376" name="SYSV00000008" dev="tmpfs" ino=0 res=0 errno=0 [ 290.376587][ T7811] random: crng reseeded on system resumption [ 290.649882][ T7797] syz.1.373 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 291.786815][ T7568] Bluetooth: hci1: hcon ffff888077ac8000 sent 1 < count 256 [ 292.483900][ T7834] bond0: invalid ARP target specified [ 292.609387][ T7834] nbd: socks must be embedded in a SOCK_ITEM attr [ 292.626729][ T7834] block nbd0: shutting down sockets [ 292.712586][ T7834] netlink: 28 bytes leftover after parsing attributes in process `syz.1.382'. [ 296.119447][ T7872] nbd: socks must be embedded in a SOCK_ITEM attr [ 296.942609][ T7887] netlink: zone id is out of range [ 296.962798][ T7887] netlink: zone id is out of range [ 296.982743][ T7887] netlink: zone id is out of range [ 297.002041][ T7887] netlink: zone id is out of range [ 297.015852][ T7887] netlink: zone id is out of range [ 297.055545][ T7887] netlink: zone id is out of range [ 297.085659][ T7887] netlink: zone id is out of range [ 297.132260][ T7887] netlink: zone id is out of range [ 297.230612][ T7887] netlink: set zone limit has 8 unknown bytes [ 298.051054][ T7900] busy [ 301.380463][ T7929] busy [ 303.459189][ T7953] nbd: socks must be embedded in a SOCK_ITEM attr [ 303.684661][ T7953] ptp ptp0: new virtual clock ptp1 [ 303.736351][ T7953] ptp ptp0: new virtual clock ptp2 [ 303.773963][ T7953] ptp ptp0: new virtual clock ptp3 [ 303.804746][ T7953] ptp ptp0: new virtual clock ptp4 [ 303.828357][ T7953] ptp ptp0: new virtual clock ptp5 [ 303.841051][ T7953] ptp ptp0: new virtual clock ptp6 [ 303.859101][ T7953] ptp ptp0: new virtual clock ptp7 [ 303.892830][ T7953] ptp ptp0: new virtual clock ptp8 [ 303.935055][ T7953] ptp ptp0: new virtual clock ptp9 [ 303.956239][ T7953] ptp ptp0: new virtual clock ptp10 [ 304.009165][ T7953] ptp ptp0: new virtual clock ptp11 [ 304.042646][ T7953] ptp ptp0: new virtual clock ptp12 [ 304.078805][ T7953] ptp ptp0: new virtual clock ptp13 [ 304.108336][ T7953] ptp ptp0: new virtual clock ptp14 [ 304.127635][ T7953] ptp ptp0: new virtual clock ptp15 [ 304.159780][ T7953] ptp ptp0: guarantee physical clock free running [ 304.546687][ T7568] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 304.753549][ T7979] netlink: 28 bytes leftover after parsing attributes in process `syz.0.407'. [ 304.846223][ T7979] veth1_macvtap: left promiscuous mode [ 304.853637][ T7979] macsec0: entered promiscuous mode [ 304.862041][ T7979] macsec0: entered allmulticast mode [ 306.633554][ T7568] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 317.598612][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.605454][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.803975][ T8107] zero sized request [ 319.677740][ T8100] Process accounting resumed [ 322.118084][ T29] audit: type=1800 audit(1783982338.947:11): pid=8134 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.433" name="SYSVffffffff" dev="tmpfs" ino=0 res=0 errno=0 [ 322.946978][ T8145] netlink: 'syz.1.436': attribute type 1 has an invalid length. [ 322.981365][ T8148] vivid-007: ================= START STATUS ================= [ 322.989317][ T8145] netlink: 9 bytes leftover after parsing attributes in process `syz.1.436'. [ 323.081055][ T8148] vivid-007: Enable Output Cropping: true [ 323.093840][ T8148] vivid-007: Enable Output Composing: true [ 323.101824][ T8148] vivid-007: Enable Output Scaler: true [ 323.138159][ T8148] vivid-007: Tx RGB Quantization Range: Automatic [ 323.173542][ T8148] vivid-007: Transmit Mode: HDMI [ 323.210143][ T8148] vivid-007: Hotplug Present: 0x00000000 [ 323.281117][ T8148] vivid-007: RxSense Present: 0x00000000 [ 323.287286][ T8148] vivid-007: EDID Present: 0x00000000 [ 323.315325][ T8148] vivid-007: ================== END STATUS ================== [ 323.587571][ T8149] syz.3.446(8149): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 324.317979][ T8166] netlink: 342 bytes leftover after parsing attributes in process `syz.0.449'. [ 324.568984][ T8166] FAULT_INJECTION: forcing a failure. [ 324.568984][ T8166] name failslab, interval 1, probability 0, space 0, times 0 [ 324.595124][ T8166] CPU: 1 UID: 0 PID: 8166 Comm: syz.0.449 Tainted: G L syzkaller #0 PREEMPT(full) [ 324.595179][ T8166] Tainted: [L]=SOFTLOCKUP [ 324.595192][ T8166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 324.595212][ T8166] Call Trace: [ 324.595223][ T8166] [ 324.595235][ T8166] dump_stack_lvl+0x100/0x190 [ 324.595280][ T8166] should_fail_ex.cold+0x5/0xa [ 324.595329][ T8166] should_failslab+0xc2/0x120 [ 324.595374][ T8166] __kmalloc_noprof+0xfc/0x820 [ 324.595415][ T8166] ? tnode_new+0x2f7/0x350 [ 324.595464][ T8166] tnode_new+0x2f7/0x350 [ 324.595508][ T8166] resize+0xe5b/0x22f0 [ 324.595580][ T8166] fib_insert_alias+0x9b3/0xe30 [ 324.595638][ T8166] fib_trie_unmerge+0x289/0xbd0 [ 324.595696][ T8166] ? __pfx_fib_trie_unmerge+0x10/0x10 [ 324.595746][ T8166] ? __pfx___mutex_lock+0x10/0x10 [ 324.595792][ T8166] fib_unmerge+0xee/0x510 [ 324.595843][ T8166] ? __pfx_fib_nl2rule.constprop.0+0x10/0x10 [ 324.595897][ T8166] fib4_rule_configure+0x383/0x10c0 [ 324.595942][ T8166] fib_newrule+0x356/0x1ed0 [ 324.595996][ T8166] ? rcu_is_watching+0x12/0xc0 [ 324.596036][ T8166] ? __pfx_fib_newrule+0x10/0x10 [ 324.596084][ T8166] ? kfree_skbmem+0x150/0x210 [ 324.596132][ T8166] ? kmem_cache_free+0x127/0x6b0 [ 324.596179][ T8166] ? skb_release_data+0x6ca/0x8e0 [ 324.596237][ T8166] ? find_held_lock+0x2b/0x80 [ 324.596271][ T8166] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 324.596305][ T8166] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 324.596343][ T8166] ? __pfx_fib_nl_newrule+0x10/0x10 [ 324.596386][ T8166] rtnetlink_rcv_msg+0x95e/0xe90 [ 324.596491][ T8166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 324.596693][ T8166] ? ref_tracker_free+0x37e/0x6c0 [ 324.596844][ T8166] netlink_rcv_skb+0x159/0x420 [ 324.596984][ T8166] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 324.597105][ T8166] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 324.597282][ T8166] ? netlink_deliver_tap+0x1ae/0xcc0 [ 324.597435][ T8166] netlink_unicast+0x585/0x850 [ 324.597581][ T8166] ? __pfx_netlink_unicast+0x10/0x10 [ 324.597744][ T8166] netlink_sendmsg+0x8b0/0xda0 [ 324.597895][ T8166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.598054][ T8166] ? apparmor_socket_sendmsg+0x15b/0x270 [ 324.598237][ T8166] ____sys_sendmsg+0xa4d/0xbe0 [ 324.598357][ T8166] ? __pfx_netlink_sendmsg+0x10/0x10 [ 324.598499][ T8166] ? __pfx_____sys_sendmsg+0x10/0x10 [ 324.598651][ T8166] ? rcu_is_watching+0x12/0xc0 [ 324.598740][ T8166] ? ___sys_sendmsg+0x19d/0x1e0 [ 324.598872][ T8166] ? kfree+0x1e5/0x6c0 [ 324.599017][ T8166] ___sys_sendmsg+0x190/0x1e0 [ 324.599151][ T8166] ? __pfx____sys_sendmsg+0x10/0x10 [ 324.599288][ T8166] ? futex_hash+0x311/0x400 [ 324.599574][ T8166] ? __pfx___might_resched+0x10/0x10 [ 324.599729][ T8166] __sys_sendmmsg+0x20c/0x440 [ 324.599849][ T8166] ? __pfx___sys_sendmmsg+0x10/0x10 [ 324.599950][ T8166] ? __fget_files+0x215/0x3d0 [ 324.600128][ T8166] ? __pfx_do_futex+0x10/0x10 [ 324.600271][ T8166] ? xfd_validate_state+0x129/0x190 [ 324.600397][ T8166] __x64_sys_sendmmsg+0x9c/0x100 [ 324.600504][ T8166] ? lockdep_hardirqs_on+0x78/0x100 [ 324.600656][ T8166] do_syscall_64+0x115/0x840 [ 324.600736][ T8166] ? clear_bhb_loop+0x40/0x90 [ 324.600875][ T8166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.600979][ T8166] RIP: 0033:0x7f4d1e99de59 [ 324.601057][ T8166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 324.601139][ T8166] RSP: 002b:00007f4d1f8de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 324.601225][ T8166] RAX: ffffffffffffffda RBX: 00007f4d1ec26090 RCX: 00007f4d1e99de59 [ 324.601283][ T8166] RDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003 [ 324.601337][ T8166] RBP: 00007f4d1ea33e6f R08: 0000000000000000 R09: 0000000000000000 [ 324.601392][ T8166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 324.601446][ T8166] R13: 00007f4d1ec26128 R14: 00007f4d1ec26090 R15: 00007fff98552cf8 [ 324.601567][ T8166] [ 327.847337][ T9] ================================================================== [ 327.847369][ T9] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x19fb/0x1d60 [ 327.847415][ T9] Write of size 8 at addr ffffc90004a31be0 by task kworker/0:0/9 [ 327.847441][ T9] [ 327.847458][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.847501][ T9] Tainted: [L]=SOFTLOCKUP [ 327.847513][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 327.847538][ T9] Workqueue: events_power_efficient fb_flashcursor [ 327.847581][ T9] Call Trace: [ 327.847591][ T9] [ 327.847603][ T9] dump_stack_lvl+0x100/0x190 [ 327.847637][ T9] print_report+0x13d/0x4b0 [ 327.847682][ T9] ? _raw_spin_lock_irqsave+0x52/0x60 [ 327.847733][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 327.847768][ T9] kasan_report+0xdf/0x1c0 [ 327.847810][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 327.847947][ T9] sys_imageblit+0x19fb/0x1d60 [ 327.847994][ T9] ? __pfx_sys_imageblit+0x10/0x10 [ 327.848038][ T9] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 327.848092][ T9] soft_cursor+0x524/0xa10 [ 327.848125][ T9] bit_cursor+0xca1/0x1490 [ 327.848191][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 327.848260][ T9] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 327.848305][ T9] ? get_color+0x1da/0x450 [ 327.848350][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 327.848400][ T9] fb_flashcursor+0x338/0x430 [ 327.848453][ T9] process_one_work+0xa23/0x1940 [ 327.848507][ T9] ? __pfx_process_one_work+0x10/0x10 [ 327.848557][ T9] ? __pfx_fb_flashcursor+0x10/0x10 [ 327.848603][ T9] worker_thread+0x5ef/0xe50 [ 327.848652][ T9] ? kthread+0x13a/0x450 [ 327.848688][ T9] ? __pfx_worker_thread+0x10/0x10 [ 327.848729][ T9] kthread+0x370/0x450 [ 327.848766][ T9] ? __pfx_kthread+0x10/0x10 [ 327.848816][ T9] ret_from_fork+0x72b/0xd50 [ 327.848854][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 327.848890][ T9] ? __switch_to+0x800/0x10f0 [ 327.848935][ T9] ? __switch_to_asm+0x39/0x70 [ 327.848977][ T9] ? __pfx_kthread+0x10/0x10 [ 327.849013][ T9] ret_from_fork_asm+0x1a/0x30 [ 327.849060][ T9] [ 327.849070][ T9] [ 327.849077][ T9] The buggy address belongs to a vmalloc virtual mapping [ 327.849099][ T9] Memory state around the buggy address: [ 327.849127][ T9] ffffc90004a31a80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 327.849153][ T9] ffffc90004a31b00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 327.849173][ T9] >ffffc90004a31b80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 327.849189][ T9] ^ [ 327.849206][ T9] ffffc90004a31c00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 327.849225][ T9] ffffc90004a31c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 327.849241][ T9] ================================================================== [ 327.849318][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 327.849341][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 327.849382][ T9] Tainted: [L]=SOFTLOCKUP [ 327.849393][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 327.849413][ T9] Workqueue: events_power_efficient fb_flashcursor [ 327.849455][ T9] Call Trace: [ 327.849464][ T9] [ 327.849475][ T9] dump_stack_lvl+0x100/0x190 [ 327.849507][ T9] vpanic+0x552/0x970 [ 327.849533][ T9] ? __pfx_vpanic+0x10/0x10 [ 327.849565][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 327.849608][ T9] panic+0xd1/0xe0 [ 327.849635][ T9] ? __pfx_panic+0x10/0x10 [ 327.849667][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 327.849706][ T9] ? preempt_schedule_common+0x42/0xc0 [ 327.849758][ T9] ? check_panic_on_warn+0x1f/0x90 [ 327.849804][ T9] check_panic_on_warn.cold+0x19/0x34 [ 327.849838][ T9] end_report.part.0+0x3a/0x90 [ 327.849883][ T9] kasan_report.cold+0xe/0x18 [ 327.849931][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 327.849971][ T9] sys_imageblit+0x19fb/0x1d60 [ 327.850014][ T9] ? __pfx_sys_imageblit+0x10/0x10 [ 327.850061][ T9] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 327.850115][ T9] soft_cursor+0x524/0xa10 [ 327.850152][ T9] bit_cursor+0xca1/0x1490 [ 327.850210][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 327.850276][ T9] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 327.850324][ T9] ? get_color+0x1da/0x450 [ 327.850365][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 327.850414][ T9] fb_flashcursor+0x338/0x430 [ 327.850456][ T9] process_one_work+0xa23/0x1940 [ 327.850507][ T9] ? __pfx_process_one_work+0x10/0x10 [ 327.850556][ T9] ? __pfx_fb_flashcursor+0x10/0x10 [ 327.850602][ T9] worker_thread+0x5ef/0xe50 [ 327.850652][ T9] ? kthread+0x13a/0x450 [ 327.850686][ T9] ? __pfx_worker_thread+0x10/0x10 [ 327.850727][ T9] kthread+0x370/0x450 [ 327.850763][ T9] ? __pfx_kthread+0x10/0x10 [ 327.850799][ T9] ret_from_fork+0x72b/0xd50 [ 327.850832][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 327.850864][ T9] ? __switch_to+0x800/0x10f0 [ 327.850905][ T9] ? __switch_to_asm+0x39/0x70 [ 327.850943][ T9] ? __pfx_kthread+0x10/0x10 [ 327.850978][ T9] ret_from_fork_asm+0x1a/0x30 [ 327.851026][ T9] [ 327.851654][ T9] Kernel Offset: disabled