last executing test programs: 1m21.350904929s ago: executing program 1 (id=2363): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_PHY_GET(0xffffffffffffffff, &(0x7f0000003200)={0x0, 0x0, &(0x7f00000031c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x2404c012}, 0x80) r0 = socket(0x10, 0x2, 0x0) ioctl$auto_TUNSETOFFLOAD2(0xffffffffffffffff, 0x400454d0, &(0x7f0000000080)=0x6) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x3f, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) 1m21.056778045s ago: executing program 1 (id=2365): r0 = socket(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_ETHTOOL_MSG_PLCA_GET_STATUS(r1, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000003080)={&(0x7f0000000400)=ANY=[@ANYBLOB="16018d"], 0x14}, 0x1, 0x0, 0x0, 0x4854}, 0x40) syz_genetlink_get_family_id$auto_netdev(&(0x7f0000003900), r1) r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), r1) sendmsg$auto_ETHTOOL_MSG_WOL_SET(r0, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fcdbdf250a9e00ff15000000140001"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0) 1m20.797090917s ago: executing program 1 (id=2366): openat$auto_o2hb_debug_fops_heartbeat(0xffffffffffffff9c, 0x0, 0x200, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x58000}, 0x40004) r0 = io_uring_setup$auto(0x6, 0x0) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/security/tomoyo/stat\x00', 0x40802, 0x0) read$auto(r1, 0x0, 0x100000004) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/virtual/net/hwsim0/addr_len\x00', 0x0, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/orangefs/capcache/hard_limit\x00', 0x82042, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000000000)='-', 0x1) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000040)=""/213, 0xd5) mmap$auto(0x58a1, 0x400006, 0x69f, 0x9b72, 0x2, 0x0) unshare$auto(0x40000080) r3 = socket(0x2b, 0x1, 0x1) setsockopt$auto(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x8004) ioctl$auto(r3, 0x89a0, 0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') openat$auto_userfaultfd_dev_fops_userfaultfd(0xffffffffffffff9c, &(0x7f0000000280), 0x400100, 0x0) fcntl$auto_F_GETSIG(r0, 0xb, 0xfffffffffffffff7) io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x3) write$auto(0xffffffffffffffff, 0x0, 0x98c7) writev$auto(0xffffffffffffffff, 0x0, 0xb) write$auto(0xffffffffffffffff, &(0x7f0000000380)='0\x81=\"\xad/\x8d\b\x00\x00\x00\x00\xb4\xd9\x82=~\x17\xfb&L\xeb=j\a\xf1y\xb3\"\xeb\a\xdd\xf4\xf4Ry\x86\x0f\xcf\x7f\xbf\xab\x12{\xc2\xc2*\xc1M+6/v8\xea\xe9\x85s4\xfe\xe5\t\x7fc\xfb7^\xb86J_\x1d1s!\x01\xff\xff\xff\xff\xff\xff\xff\x1dF\xe6\xf6\x17\x10+\xc0\xb0\xafc\x99\xd4\x150Y~\x1e\xe2\xd6x4fW\x13\xc4U`\x9e-X\xd7\xe2H^\fLS\x03\x00\x00\x00\f\x00\xeaN\xa5\xd2\x82;\x7f\xa0.\x9a\xfb\x8d\xf3l\xf2\xd3\x95\xc1M5\xcb\xa6I\x067\xe36\xea\xe9\xe3\xf44oT_`8\xb3\xef\x04 \x05K\xf9\x87pl\xac\x86\nE\xc7e\xc5Q\x89\xcd\x06\x00\x92\x00\x87\x976\x9f>\xa2\xcfm\xec\r\x11\x7f\x00\x00\x00\xb1\xde@\x02\xce\x03\xb7\xb1\xfb\x9fr\v\xb2\xe3\xc7\b\x85\x00 /zm\x7f\x8fg,p81\xb6\xbb\xd8D\xde\x0eR=A\x00\x1f\x8a\xa7/Q\"J\xbb\xb0m\xf2SP\x84\x84S\xf0\xba\x9a\xf6\xb6`WI\xba\xba*8\x9f\xea\xe8K/\x98\xbc7~\b\x00\x9buB\xcb\xe4\x8aKf\xba\x8c\x19m\xe6I\x02\xde\x80\x9d\x87}\xf4\xbd9\xaa\xd6\xdb1]\xde\xa0r\x14\xca56^\x94\xd2\xd8\xe6}9\x91\xcf\xf7\xa1=\x96\x11\xf1\\\xa91\x0e\xd1\xe4z\xc1;Pw!\x8b\xf5{\xc7Xd\xe1\xf2}\x96EVf\xc9\xa8\xcd\xe4\xc9\x8d\x1d7\xd5\x94\\\xb5\r\xd2\xaa\xe6H\xfe)\xb3a\x04\x1eRMl\xa3F\xa8W0\x90\xc9Ky#\x03\xf5~\xd2Z\xe9(\x99\b\x00M\xde\x01]\r\xd09k\xc2\x84\xc1\xabN\x96\x8a6\x98@\xd3\xab\xa8m\xdf\x8d\x1d\b\x82\xfcP\x87\x93\x80\x97Q\x86\x8a\x9c\xf8L\x0f\xa8@VE2\x9d\x1e`5\xd8\xd7M\xd4k1\xe6\x13Y\\\x83E\xd0e\x0eM\xa9Q\xac\x0e\x1d]\auq\x17\x19H\x81\xd2\xccF\xc6\xd4\xe2R$\xfa\xd6}\xbdsN\x18\xdf\xf5\xffP\xf5\f\xccL\xef\x83\xb3$\xd4\xf4\xb5\xe6\xd0 \xb9\xa7\x8e6\t\x83q\xef\b\xd2\xdb\xf6n\x82\xd4\xd6\xcc\xc19\x95+\x94\xb0\x8a:(\xf6\x7fR^&cU\xfc\xeb&l\x86D\x98\xa0\xc0 \xcec\xa3\x13\xf7\x02\a\x9d\x9d\x8e\x81\x8eu\xc73\x9f\x02\xe7 \x03\x9c\xab\xbe\x85-\a\"H\x87\x12A\xdc\xedF\xa3t\x91\x9f!\x8c\xd1A\xe7\x95\xa7\"\x8c\xb5\x1b\x80\x12u\x90AI\xc2\xbao3Ob\x94\xfa\'\x8d\x0f\xc6&\x94C\xa6|~\xebn-\x17\x1e+-\xdc\xe6f0cm\xf2\t\xb4:\x93g}/%\xc2\xe5\x8c\xd8\xc1+T\xe9@ysq,\x0frl\x92\xd0\xd3\x9a\xf9\xf76KlQ\xa8\xf0\xf3\xd3\x1e\x93\xe5\xbe\xb5\xee\xbf\xb2\xbb\x1dP\xbb\xa2$\xd5`\x01\xf0G\xa8\xf2\xc5\x9e\x98\xa6+xX6M>\x8fq\xab\xaa\xe4\x87\xa1\xaa\x1d\xee\xb1[\x9e\x03\xdd\x11\x1dTg\x1b\x91\x86\x05\xf6\xa5 1\xbeSL\x19\x80\x9f.\n\xa4\xa80\xd8\xeb\x86\xf1s\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc4}y\xde\xc6\xa9I\xa0A\xb0\x1f\xb4\x01)\xedS\x89\xb7\xe4$\xd3\xeej\xdc\xf4\x00\xad\'\x9e\xb6\xa8&\x97=\xe2\xed\x82\xee\xb1\xfc\x0e\xa9\xc4w\x9e\xf7\xf2\v\x98HG\xed\xca=\xe1V\xdc\xcdl\x97Ik\x87\xe4\x9b\'\xc7\x10]??~\xbc\xca][\xfaf\xef:\xc3Gt/q_Wc\x9b\x06T\x15.\xb4{\xc0i\x12I*j\xb9\'\'&\xc3\x8bS2\xd2Po\x1e\x004\x13(\xc0%\xff\xeb\x1ap\x11\t\x04\xf58\xb3J\xb3\x87];\xa4\xdbt\x96JIp\x99@\xa8\xb8\x81\xb9_\x90\xb5yGu\xee/\x8e\xe0\xd5c\x10\xec\xe6\b\xbe,\xf0\t!\xac\xd6\xfb\xdc5\x15@m\x8d\xa6x\xaaOJ(\x19\xe6\xefk\xbb7\xd6\xa5\xe5\xae\xdb\xbe\x91\x00\xccw\x9c\x93\xd3\r\xcb\x8d\xde\xc01i\xfb\x7f\xa5\xbf\xe5\x88\xeb+\xec\xb76Atz=>\xc0\xbf\xd8\x8e\x82T\xc6*\xde\x14\xc4\x9c\xe2\x84\x06-\xd9\xd8B%\aM}{\x9c\xe1\x8b\x17\x86R\xc7\x18B\xc4\xc5\x86_\xf0\xca\x8a:\xd7\x94\xdc', 0x49) openat$auto_aoe_fops_aoechr(0xffffffffffffff9c, &(0x7f0000000180)='/dev/etherd/revalidate\x00', 0x2000, 0x0) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/zswap/parameters/compressor\x00', 0xc0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r4, &(0x7f0000003900)='\t', 0x1) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/ati_remote2/parameters/mode_mask\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000000100)=""/45, 0x2d) 1m19.330800456s ago: executing program 0 (id=2368): r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000840)='./cgroup.cpu/memory.stat\x00', 0x80200, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) (async) pread64$auto(r0, 0x0, 0x3, 0x40004) r1 = openat$auto_snapshot_fops_user(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) write$auto(r1, 0x0, 0x2000000000007) (async) write$auto(r0, 0x0, 0x6) (async) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) close_range$auto(0x2, 0x8, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1e, 0x5, 0x0) (async) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/rnbd-client/ctl/map_device\x00', 0x40442, 0x0) (async) kill$auto(0x0, 0x11) (async) msgctl$auto_IPC_INFO(0x7, 0x3, 0x0) (async) ptrace$auto(0x10, 0x0, 0x1, 0x7ff) (async) unshare$auto(0x40000080) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x6, 0x0) (async) select$auto(0x7, 0x0, &(0x7f0000000080)={[0x8, 0xc0b, 0x8, 0x5, 0x2, 0xffffffffffffffff, 0x13, 0x7, 0xb, 0x1, 0xced80000000000, 0x9, 0x6, 0x0, 0x3, 0x7fffffff]}, 0x0, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv$auto(r3, &(0x7f0000000a80)={0x0, 0x3}, 0x3) (async) close_range$auto(0x2, 0x8, 0x0) (async) write$auto(r2, &(0x7f0000000200)='0\x81=\"\xad/\x8d\b\x00\x18\xa4\xb0\xb4\xd9\x82=~\x17\xfb&L\xeb=j\a\xf1y\xb3\"\xeb\a\xdd\xf4\xf4Ry\xee\xd7\x1e\x1c\x86\x0f\xcf\x7f\xbf\xab\x12{\xc2\xc2*\xc1M+6/v8\xea\xe9\x85s4\xfe\xe5\t\x7fc\xfb7^\xb86J_\x1d1s!\x01\xff\xff\xff\xff\xff\xff\xff\x1dF\xe6\xf6\x17\x10+\xc0\xb0\xafc\x99\xd4\x150Y~\x1e\xe2\xd6x4fW\x13\xc4U`\x9e-X\xd7\xe2H^\fLS`\xfc\xbb\r\f\x00\xeaN\xa5\xd2\x82;\x7f\xa0\xd3\x95\xc1M5\xcb\xa6I\x067\xe36\xea\xe9\xe3\xf44oT_`8\xb3\xef\x04 \x05K\xf9\x87pl\xac\x86\nE\xc7e\xc5Q\x89\xcd@\x1c\x92\x00\x87\x976\x9f>\xa2\xcfm\xec\r\x11\x7f\x00\x00\x00\xb1\xde@\x02\xce\x03\xb7\xb1\xfb\x9fr\v\xb2\xe3\xc7\b\x85K /zm\x7f\x8fg,p\a\xc8\x7f\xa5\x87\x02\x87\xbbR=A\x00\x1f\x8a\xa7/Q\"J\xbb\xb0m\xf2SP\x84\x84S\xf0\xba\x9a\xf6\xb6`WI\xba\xba*8\x9f\xea\xe8K/\x98\xbc7~>\x12\x9buB\xcb\xe4\x8aKf\xba\x8c\x19m\xe6I\x02\xde\x80\x9d\x87}\xf4\xbd9\xaa\xd6\xdb1]\xde\xa0r\x14\xca56^\x9c\xd2\xd8\xe6}9\x91\xb6\xf7\xa1=\x96\x11\xf1\\\xa91\x0e\xd1\xe4z\xc1;Pw!\x8b\xf5{\xc7Xd\xe9\xf2}\x96EVf\xc9\xa8\xcd\xe4\xc9\x8d\x1d7\xd5\x94\\\xb5\r\xd2\xaa\xe6H\xfe)\xb3a\x04\x1eRMl\xa3F\xa8W0\x90\xc9Ky#\x03\xf5~\xd2\x96\xe9(\x99\b\x00M\xde\x01]\r\xd09k\xc2\x84\xc1\xabN\x96\x8a6\x98@\xd3\xab\xa8m\xdf\x8d\x1d\b\x82\xfcP\x87\x93\x80\x97Q\x86\x8a\x9c\xf0L\x0f\xa8@VE2\x9d\x1e`#\xd8\xd7M\xd4k1\xe6\x13Y\\\x83E\xd0e\x0eM\xa9Q\xac\x0e\x1d]\a\x19H\x81\xd2\xccF\xc6\xd4\xe2R$\xfa\xd6}\xbdsN\x18\xdf\xf5\xffP\xf5\f\xccL\xef\x83\xb3$\xd4\xf4\xb5\xe6\xd0 \xb9\xa7\x8e6\t\x83q\xef\b\xd2\xdb\xe4\xe2\xf4(\x05\xf6g5\x1f\xa0\x8e\xeb\xc0\x84\x80^\xff\x99m\x99\x1b\xd0\xf3\x00Z\xf3}\xc4\xb0_\xde\f\xfeR=\x88\xbe\xeda\xfc\x17\x85\x107u\x00\x00\x00\x00\x00\x00\x00', 0x8001) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r4) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r5, 0x805, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4004044}, 0x8000) r6 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r6, 0xae01, 0x0) (async) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) (async) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyb3\x00', 0x80502, 0x0) ioctl$auto_TIOCGPTPEER2(r7, 0x5441, 0xebffffff) 1m19.085051478s ago: executing program 1 (id=2369): openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bus/usb/010/001\x00', 0x139c00, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_vhci_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket(0x11, 0xa, 0x9) socket(0xa, 0x2, 0x3a) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptyz9\x00', 0x600882, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snd/controlC0\x00', 0x880, 0x0) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/fs/ext4/sda1/options\x00', 0x0, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000000)='/proc/cmdline\x00', 0x8800, 0x0) socket(0xa, 0x2, 0x0) r1 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x787806, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = socket(0x10, 0x2, 0x4) socket(0x10, 0x2, 0xc) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r0, @ANYRES8=r1], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082) write$auto(r2, &(0x7f0000000000)='-\x00', 0xfdef) 1m18.870068753s ago: executing program 0 (id=2370): openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) shutdown$auto(r0, 0xda6) (async) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) ioctl$auto_BLKRRPART(0xffffffffffffffff, 0x125f, 0x700000000000000) (async) r1 = socket(0x10, 0x2, 0x0) (async) statmount$auto(0x0, &(0x7f0000000180)={0x6, 0x1, 0x9, 0x7, 0x3b, 0x3ff, 0x1ffde, 0x7, 0x6, 0x2, 0x9, 0x3, 0x6, 0x4, 0xb2, 0x9, 0x3, 0x40fffc, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0x0, 0x81, 0x0, 0x7, 0x0, 0x0, 0x0, [0x1000000001, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffff, 0x9, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x10000, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x3, 0x0, 0x9, 0x7fffffffffffffff, 0x0, 0x0, 0x7]}, 0x202, 0xd) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="bc000000", @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) (async) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x20040001) (async) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x5}, 0x7, 0x0) close_range$auto(0x2, 0x8, 0x0) (async) socket(0x2, 0x80002, 0x73) (async) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda1\x00', 0xe6e43, 0x0) ioctl$auto_BLKFLSBUF(r2, 0x1261, 0x0) r3 = socket(0x23, 0x3, 0x5) (async) close_range$auto(0x2, 0x8, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket(0x1d, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r5}, 0x6a) (async) sendmmsg$auto(r3, &(0x7f0000000180)={{&(0x7f0000000040), 0xc8b, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x8000005}, 0x3b8b, 0xa) (async) socket(0xa, 0x1, 0x84) (async) r6 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x2a8080, 0x0) ioctl$auto_IOCTL_VMCI_QUEUEPAIR_SETPAGEFILE(r6, 0x7a9, 0x0) (async) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x189401, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) (async) close_range$auto(0x0, 0xfffff004, 0x2) (async) socket(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1m18.769107668s ago: executing program 1 (id=2371): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyzb\x00', 0x800, 0x0) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$auto(0x3, 0x40076f3f, 0x38) r0 = memfd_create$auto(&(0x7f0000000300)='/sys/kernel/debug/x86/boot_params/data\x00\"F\xb6\xcd\x06\xd6\x97\\L\xe1\xb2\xee\xb8\x8e\xd6O\xa1j\x90w\xc7\x94\xb7yi\x01&\x04b/\xaa\xfb#s\xc4\xa3\xa7\xacj\xc6\x8e\xf4L\x9a\xf8\xcc\xdcy\x9f\x93\xbc\xf6\xc8\xdb\x05w,|B\xfc\x04\x97\xd3\x0f\x8b\x81\xe8\xbc\x81\x0e\xd7o\xd2\xcd\x18z\xc2\xb7|\xe1\xa6\x9a~\x96\x10rnLnt\xdb\xdb-\x1b\x99\xd4\xed;\xf8\x13a\r\xf2\a\x85%\xef\xa7\x7f#\x96\xf2S\xb0\xf1Hq\x0f;\x83\xb7\x0fz\x9dN\xc9\x1e\x15r\x97|\xbfE\xce\"', 0x4) fallocate$auto(r0, 0x0, 0x9, 0x4cbd5d) syz_genetlink_get_family_id$auto_nl802154(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) process_vm_readv$auto(0x0, 0x0, 0x1, 0x0, 0x6, 0x0) madvise$auto(0x0, 0xffffffffffff0005, 0x19) r1 = socket(0x11, 0x3, 0x9) sendmmsg$auto(r1, &(0x7f0000000180)={{&(0x7f00000001c0)="dd2fe40a09", 0x5ac, &(0x7f0000000100)={&(0x7f0000000340), 0x21}, 0x5, &(0x7f0000000180), 0x5, 0xe}, 0x5}, 0x2, 0x100) madvise$auto(0x0, 0x2003f2, 0x15) r2 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000140), r0) msgctl$auto_IPC_SET(0x8, 0x1, &(0x7f00000003c0)={{0x3, 0xffffffffffffffff, 0xee00, 0x8, 0x4, 0x3a426425, 0xfffd}, &(0x7f0000000200)=0x5, &(0x7f0000000240)=0x3, 0x80, 0x6, 0x7fff, 0x9, 0x9, 0x7, 0x0, 0x40, @raw=0x3, @inferred=0xffffffffffffffff}) sendmsg$auto_OVS_FLOW_CMD_SET(r1, &(0x7f0000001000)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000880)={0x730, r2, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@OVS_FLOW_ATTR_ACTIONS={0x713, 0x2, 0x0, 0x1, [@nested={0x1c2, 0x59, 0x0, 0x1, [@nested={0x4, 0x103}, @nested={0x4, 0x107}, @generic, @nested={0x4, 0x7e}, @typed={0x14, 0x93, 0x0, 0x0, @ipv6=@mcast2}, @typed={0xa1, 0x13, 0x0, 0x0, @binary="dc16f8a54cd43fbf2056365af238bd7146a6efd51dafa2b7f81afb94ac687c0037421c42ac31791d4b42adf51fe526d0dde100337a2b14ed74f4a7aad8c45ea28501b7fa42c41e3427311786240cb591b83f345fcddea52126b238aaabde936a8ef670152ae1338eb72b7df172d47ead960084275f075316632c3b232300a16480b8fd5b29d05627779b8da2135c05761abc043b64cbbef94edb2c7b5e"}, @nested={0x4, 0x146}, @generic="e269b0a8b28ac587558b0ea5d69a894f7a19688dd9c7c41075c89acdc1b2b8026ce327901938edea46a6508076b2b6f8ffedf599c237edd8cc40f6ff96c3fd8c8332287eab53f60f64769907a12c38bb824d22d52bd57fb65603740e8485cf56c8d4db38579300b37974b5a3f574c790bf4097a36b806623d9f74d1de168aec4938dc267fb3dc0eee96b8ea1c4a64086fe23572ddbda92f4bc28b64d5f364744da01f2cbd75bcc3c7dd7e1154a4ab8a4eb3f73a41039aa8cb70172eab057058fb7a8e830776ee20c93f4577368809948786cbf4d06c30bbb7b6f1455ad263fd16efbef71a6df1ca28105c7b6aad9c5a4a579", @nested={0x4, 0x139}]}, @nested={0x1bf, 0x1, 0x0, 0x1, [@nested={0x4, 0x17}, @generic="d270031b4b6ab4a77bdfe264c0e703c55bde56cc33d307d6c534a22dc4ce3190b0e5a567a0c14fb6b660ddc1da14bbeca8830b2a84a64b49c894aba119932b0d7229007d70873c7cd5b3156a5da897ce3dbbc1df9cbbf474020c4e7bc3dcc2e21f29b525c9d32ed609a173ffd39a6d2d4db4cf3f32b54b6b3ed62dcc53936f04369eea50d64e41476cedfde319d0adf3a541e5ade521f1f99817ac9b8c5cd30e3c07830829eb912e49c2c0dc6184d2fd069618d405c6f9c42adda9e70058d5a24d934da66925596cf3c732d8f82f6f17bf2e7185e2566fb2e9b46afd51cab31d4ddbb68e575ce4ad2714a54559f928", @generic="3405ac954956ff4a9c2089b2133decf5ce234e8c743fc2fc274d881fa60f12f570a47fcc22b202a5b0388b378290686f3b5c424e900c122900602713aa5e0b0f4e70a6549e24bf8d24ba79da30763978c0fd0ced56f4fc535933f6a4a2d1e30cb250f88aefca559c7726e026436590ef74c44c80e2848e3af938c2692d4359d1e0ae25b7c8c799408f4ccb13916cc411b15cc365ddca1691cd3c31ca2c77a562d6a5d324701672416db33a1c44bb782b113b76bafd29502c", @typed={0x8, 0xdd, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}, @typed={0x8, 0x3c, 0x0, 0x0, @uid=r3}]}, @nested={0xd8, 0x15e, 0x0, 0x1, [@generic="a23ad5b36fdf19b771c789f313f6c515adc9947441e627febaac316ba9370137", @nested={0x4, 0x51}, @typed={0x4, 0xc2}, @nested={0x4, 0xec}, @nested={0x4, 0x126}, @nested={0x4, 0x50}, @generic="46c988accb5cd2eb82763a0aaef76b2fff359fa8dc3cd7e330a0b9d799e7f6408bd60dc8fb7e22861fa3afaf7793b3fec737ed34f22b41701d155144aa22e5d4e97544b173f642158cff5da35bd750dce15236e10d034e37e8d0ea9fbd460cc51a4b7f3d20b6cf5872a9821bc38ab619a85777562e01891f571af412f83cf6264089785fff12390ff32a2ebf1797822da549c3de131d6dae4c14f1d08c3ce66a"]}, @generic="fe62486fe883feea0ce23e097bcd12d3b578c2a83e036743e6064cef3a444e3453d8a76ab28ba6cadd5f34105a708c6f9073550e7f43fff6286069d1b9928fd1b25205ed776fdfd40d992d0d4c317b4491fd39b1b0cc47235904abf9b8f6298b722ebaab53f5d8d21dd9f5e341ae8cf29f387c72ebfe562edaefbd392ed86a46691a3c028167fc50afbdd9cc6659940e0f8f4a31540b72dc717d1558042966bc57b81680ecf718ce93fb472ae3f7eb903bfd8db711991a16d47a2d0d6b95f50d14c63c99a0fe6726c9415fe3", @generic="7988bf37e1ee6083571317d910f50f289ae701864beec8b786b97e6e0ee39ef321f8f786e9a0e41efae0bdb7ebca69593cc93716e4a84c4b230d6f28a0abaaf5153811cc8f2dac3f536887b0ad3624818fdd3c1e2e37549f2190a84cd3f61d0d46674f95e19ff49e218571b815d2ad2a1e6ec9ae97435f44bb0d00331b328c68382a6906833ecd336b13cb79da956dd3b51a446c18ca673e0eac4c17a1bfcea4f320e670a1d351af850489832de479bb6fde3e7c632e9396aa8582a9efa1ecdf5e4047443b3b01d771bd2fe550cecfba1b0e487f1a6c8a0d818b17dcd88bebfac393f65abb613425276fd9c5cfd6ae54bd7cbe", @nested={0xf2, 0xb3, 0x0, 0x1, [@generic="47d2ccf04567f67039e65d6755186cac6ee11600a863e69066f33655db4fc644e73b690b0517d79099ea9c5aa2f3b3bf5795363784f7e38dfbbc6fd7c110edccd76ca874b1080184659357e927bba8ddcc61c56daaba4faaf137f66c10de280365250baf3557124130909648d031c432f63047555b79c3a0b78b204f2bba7bf4e5cb98ccbbdea068cf9c2b254cecac13ec59679a72d8ef073cb7404e51d5f5a7a740892ddcedaa1b31ab2515f93b52e60d02f7cbc7", @generic="7a1c8ce53899dd9d71e84be3334dfca72d89bf0aee54628130be91b14635bbab1ad6e40bea3c328149144b1848", @typed={0xc, 0x9f, 0x0, 0x0, @u64=0x101}]}]}, @OVS_FLOW_ATTR_UFID={0x5, 0x9, 0xf5}]}, 0x730}, 0x1, 0x0, 0x0, 0x8010}, 0x20000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x30, r5, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x40080}, 0x20040000) madvise$auto(0x0, 0x1010001, 0x100000003) madvise$auto(0x1000, 0x400050, 0x9) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x0) r6 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/virtual/net/dummy0/flags\x00', 0x2c62, 0x0) write$auto(r6, &(0x7f0000000580)='0\x00\xa6\xcc\r\x91QU\x9d\x15\x84\xab`\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04\x7f\x00\x00\x00\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18K\xb0D\x91OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfdFq\xe7\x03\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10)kcsZ^3H\xf1\xdf\x96\xfd)\xf3\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xaeO\x03\x91p6\xa0\xb9g.\xde\xd4`\xfa\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb\x88\xd8\'\xe4\xf8\xe9f{\xf7gl\r\xdf\xc8n)J\xa2\xfa\x03\xbe%\xf6\xd1\xfb\xbcg\"\a\x03\xdef\x10K\xa1\x80z\xd1Z{\xb0\x91\ft\xf5\xaf:\xc9\x02~`\x11\x15\xa3\xd9y\xb3)~\xb6\xaaB\x16O\x1c\xdeY2\x8f*R\xf6\xb5m\xc6\x91+\x14\x04\xf7*9\x9e\x04\xe3\x03\b\x02kud\xf8j\x95I.\x04\\\x80S\xa5\n\x14\x05\x12\n^\xc9|\xf8.>\x8b\xb1y\xe7\x96\x9asW\x10}(\x9c\xc9\x84\xec\xf68\xb7\xd7\xec\xc9F\xe1v\x9aD\t\xc6f\ay\xafX\x96\xcc\xa8\xae\xcb\xac\xd5\xd4\xee1\"L\xacC\t\x81\x8b3\xc6\x1e\xbbwlK\xd2\x9e\xc8\xde\xed\xb6\xbeX\xe4`s\xec\xec]\xb3\xfa\xd8\x86\x1bP\xa3\xc4\xb4\x84\xd2\x94Z\xbeA\x1f,a\a\xf7\x7f\x12\xa9E\xfb\xcd\xa2@\x83<\xe0\xaf\xc5\'\xcf\xa3\xf2KD\x80\x8c\xac\xb1\xd6\r\xf4+\x9cSx\xa3\xf3mE\xbbD\xd3\x1bK\xdc\xc7\x9c\xa6M3\x1f\xac{\xc1\x036\xd16\b\x00\xa7\xc9&\x92\x0e~\x05LM \xb8\xf6.,\xf8\xa8\a\xa5)\x91\xc4\xe9P\xa6\xda\xef\xe1\xbdu\xa2\xb7\xa3\x0eZ\xdf\xaf\x87\xa10\xa0\xc8\xa4\xa0O\x96\xeb\xb9\x10\xf3]\\8\v\xcc\x16\xca\xadm\xd3\xcc\xa4\\\x192\xc6\xb1i/\x90$\x05Y>soi)\x12\x05@\a\xe9c\x17\x818\x1e\x8fn\\)\x1a\x96\xc0\xf6\xa4\xf1]\xfe\xa7\x1e\x02\xd3\x1f\x97MT\xd5g\x1e\x04sD\x92+', 0x9) fallocate$auto(0x8000000000000003, 0x3, 0xf, 0x200000004) r7 = openat$auto_snd_mixer_oss_f_ops_mixer_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer1\x00', 0x40, 0x0) ioctl$auto_OSS_GETVERSION(r7, 0x80044d76, &(0x7f0000000080)="370a08fb663e57d0b981d832eb7647e7f6f27e64c4ca2d80c21a3a8d1351099cfbd68dfd") 1m18.182248254s ago: executing program 0 (id=2373): r0 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r0, 0x711, 0x70b52c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848) 1m17.804922505s ago: executing program 0 (id=2375): mknod$auto(&(0x7f0000000180)=':,\x00', 0xcb, 0xfffffffa) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) socket(0xa, 0x1, 0x84) setsockopt$auto(0x3, 0x1, 0x42, 0x0, 0x88) execve$auto(&(0x7f0000000000)=':,\x00', 0x0, 0x0) rename$auto(&(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='./file0\x00') r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r1 = ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$auto_USBDEVFS_SUBMITURB32(0xffffffffffffffff, 0x802c550a, &(0x7f0000000080)={0x4, 0x4, 0x3, 0x9, 0x7, 0x7fffffff, 0x7, 0x80000000, 0x3, 0xff, 0x0, 0x2, [{0xd, 0x1ff, 0x4}, {0xb, 0x72, 0x5}, {0x8, 0x9, 0x5}, {0x1, 0x8, 0x7f}, {0x8000, 0x7, 0x2}, {0x4dc, 0x7, 0xa}, {0x606, 0x6d, 0x8}]}) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages\x00', 0xa0666, 0x0) write$auto(r2, &(0x7f00000000c0)='1\x00\xc7k\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00j(=\xd1<\xf9\x96\x10>\xb9\x05\xbe\xc8v\x81-ILplM\x98\x88J\xfd\x17\xc8K\xdd\x89;T@d\xa3_\xfcb8\x7fA\x11\xba\xefL\xe1L\x8aE}\xa7\x05\b\xd7\xe2\xae\xfek\xbbw\x8c\x88\x1emW-\xf5\x94\xdak\x81\xe4\x1e\x1dS\xf2~>\xb1\xc6\xd1\xee\xc8\x19e\xc1w\xf05%\xd76]\x0f\v\x01\xa4(\xec\xd3\xca\a\x15&nv\xc1}\xfcD', 0x85) read$auto(0x3, 0x0, 0x8080) seccomp$auto(0x2, 0x100000000, 0xfffffffffffffffc) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0xa00006, 0x400002, 0x40eb1, 0x602, 0x300000000000) socket(0x2, 0x1, 0x106) fgetxattr$auto(0xffffffffffffffff, &(0x7f0000000200)='+(**\x00', &(0x7f0000000240)="428bed624d5ff2203024d6b1e3781eea6a0b40bd01e2175e6f4144bdb0a8148e70fb0e966276e0f1c18888b9247275c2673516ee0fa9003d12d2ad6ead9f6e41968ce0c9c6a5bdbbb81e9da3f0627297abc2c2918d9131a9d9872abac88e6f455afdecf37328d51c0d6d38c571e725420cfbd78a4b5cc83e34e6a63e2201cab3797943b22f17b69f235d55b265c8c840ff154a75d3de6087e0b59b73b097535ecb82a88747ed516c2d7923eb20b63fe148d968af48dd017057d65912a5b7f0df61548fd9105b65fdbcd7fda2", 0x6) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/ptp/ptp0/max_vclocks\x00', 0x101, 0x0) write$auto_tomoyo_operations_securityfs_if(r3, &(0x7f0000000040)="804acfe1a2", 0x5) r4 = syz_clone(0x4100000, 0x0, 0x0, 0x0, 0x0, 0x0) mbind$auto(0x0, 0x100000004, 0x100000000, 0x0, 0x6, 0x2) ioctl$auto_KVM_GET_MSRS(0xffffffffffffffff, 0x4068aea3, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto_XFS_IOC_FREESP64(r1, 0x40305825, &(0x7f00000001c0)={0x800, 0x2, 0x8000000000000000, 0x7ff, 0xe, r4}) ioctl$auto_KVM_GET_MSRS(r1, 0x4068aea3, &(0x7f0000000040)={0x80, 0x100000}) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x14be02, 0x0) 1m17.462718785s ago: executing program 1 (id=2376): socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) r0 = gettid() kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@kbuf=0x0, 0x2aa7, 0x6c0000c000, 0xc000}, 0x4) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) ioperm$auto(0x3, 0x5, 0x149) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyq2\x00', 0x54842, 0x0) kill$auto(r0, 0x11) syz_clone3(&(0x7f0000000380)={0x4081080, 0x0, 0x0, 0x0, {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = openat$auto_bm_register_operations_binfmt_misc(0xffffffffffffff9c, &(0x7f0000000640), 0x401, 0x0) write$auto_bm_register_operations_binfmt_misc(r1, &(0x7f0000000100)="b5fcb5114c179410cc977d", 0xb) prctl$auto(0x3e, 0x4000000000001, 0x0, 0x1, 0x0) sysfs$auto(0x2, 0x100000000000036, 0x0) fsopen$auto(0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) 1m13.062998966s ago: executing program 0 (id=2385): r0 = socket(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_ETHTOOL_MSG_PLCA_GET_STATUS(r1, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000003080)={&(0x7f0000000400)=ANY=[@ANYBLOB="16018d"], 0x14}, 0x1, 0x0, 0x0, 0x4854}, 0x40) syz_genetlink_get_family_id$auto_netdev(&(0x7f0000003900), r1) r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), r1) sendmsg$auto_ETHTOOL_MSG_WOL_SET(r0, &(0x7f0000002cc0)={0x0, 0x0, &(0x7f0000002c80)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fcdbdf250a9e00ff15000000140001"], 0x2c}, 0x1, 0x0, 0x0, 0x4801}, 0x0) 1m12.811775172s ago: executing program 0 (id=2386): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bpf$auto(0x5, &(0x7f0000000100)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0xd, 0x9, 0x9, 0x6, 0x7fff}, 0x3b) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r1 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r1, 0x0, 0x0) r2 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r2, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r1, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r0, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r3 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r3, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) 57.458595051s ago: executing program 32 (id=2386): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bpf$auto(0x5, &(0x7f0000000100)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0xd, 0x9, 0x9, 0x6, 0x7fff}, 0x3b) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r1 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r1, 0x0, 0x0) r2 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r2, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r1, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r0, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r3 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r3, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) 51.246953304s ago: executing program 3 (id=2425): mmap$auto(0x0, 0x400005, 0xdf, 0x9b71, 0xffffffffffffffff, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mknod$auto(&(0x7f0000000180)=':,\x00', 0xc9, 0xfffffffa) mmap$auto(0x0, 0x202000c, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) writev$auto(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x7e}, 0x40000000000009) execve$auto(&(0x7f0000000040)=':,\x00', 0x0, &(0x7f0000000200)=&(0x7f00000001c0)=':,\x00') r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyu3\x00', 0x0, 0x0) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) ioctl$auto_TCFLSH2(r1, 0x80045439, 0x0) ioctl$auto_TIOCSETD2(r0, 0x5423, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) recvfrom$auto(r2, &(0x7f0000000600), 0x4, 0x4, 0x0, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x14, 0x0, 0x301, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r3 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x38d883, 0x0) r4 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000000c0), 0x8001, 0x0) ioctl$auto(r4, 0x8001af85, r3) r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/mtrr\x00', 0x0, 0x0) ioctl$auto(r5, 0x400c4d07, r5) 47.973234376s ago: executing program 3 (id=2431): mmap$auto(0x0, 0x400008, 0xa, 0x9b72, 0xc, 0x800008000) openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mtd0\x00', 0x28082, 0x0) mmap$auto(0x0, 0x20009, 0x7ff, 0x40000000000eb1, 0x401, 0x8000) socket(0x2b, 0x1, 0x0) io_uring_setup$auto(0x6, 0x0) setsockopt$auto(0x3, 0x1, 0x23, 0x0, 0xa) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) getsockopt$auto(0x3, 0x200000000001, 0x23, 0xfffffffffffffffe, 0x0) futex$auto(0x0, 0x85, 0x38, 0x0, 0x0, 0x80800005) r0 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mtd0\x00', 0x68082, 0x0) ioctl$auto_BLKPG2(r0, 0x1269, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r1 = openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/wchan\x00', 0x2400, 0x0) read$auto_proc_single_file_operations_base(r1, &(0x7f0000000200)=""/225, 0xe1) unlink$auto(0x0) close_range$auto(0x2, 0x8, 0x0) fcntl$auto(0x3, 0x4, 0xa553) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) close_range$auto(0x0, 0x5, 0x0) 43.266089421s ago: executing program 3 (id=2437): socket(0x10, 0x3, 0x6) mmap$auto(0x0, 0x8, 0x1000e2, 0xeb1, 0xffffffffffffffff, 0x100008000) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/oom_adj\x00', 0x49402, 0x0) read$auto(r1, 0x0, 0x9a28) r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) mknod$auto(&(0x7f0000000180)=':,\x00', 0xcb, 0xfffffffa) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NETDEV_CMD_DEV_GET(r3, &(0x7f0000001840)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0xf0ffff, 0x0, 0x4005}, 0x28044004) r4 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000500), r3) sendmsg$auto_BATADV_CMD_TP_METER(r0, &(0x7f00000030c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000003080)={&(0x7f0000003000)={0x60, 0x0, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_LAST_SEEN_MSECS={0x8, 0x17, 0xec}, @BATADV_ATTR_DAT_CACHE_HWADDRESS={0xa, 0x24, @broadcast}, @BATADV_ATTR_HARD_IFNAME={0x14, 0x7, 'ip6gretap0\x00'}, @BATADV_ATTR_ROUTER={0xa, 0x1d, @local}, @BATADV_ATTR_VERSION={0xd, 0x1, 'ip6_vti0\x00'}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'ipvlan0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="01002abd7400fcdbdf25140000000c00018008000100", @ANYRES32=r5, @ANYBLOB="080004000000"], 0x28}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) keyctl$auto(0xc, 0x1, 0x0, 0x3, 0x402) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'pimreg0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_MODULE_FW_FLASH_ACT(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000002f00)=ANY=[@ANYBLOB="88000000", @ANYRES16=r4, @ANYBLOB="00022bbd7000eedbdf63a90727babd809e8a9d79252c0000002000020070696d367247760fcd5815da8231005d6ee2a1f704fee54703b8bc3e0d00020070696d367265673100000000080003000400000008000300050000003400018008", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="080003000d0000000800030008000000"], 0x88}, 0x1, 0x0, 0x0, 0x4000}, 0x4) pidfd_open$auto(0x0, 0x800) ioctl$auto_BLKTRACESETUP2(r0, 0xc0481273, &(0x7f00000001c0)={"b8230df23beaad3fee2304b9d8e773c62b69cbbeb72800a1bd9a56a441db9a71", 0xc5, 0x0, 0x8, 0x0, 0x3, 0xffffffffffffffff}) r8 = gettid() setpriority$auto_PRIO_PGRP(0x1, r8, 0x6) sendmsg$auto_MACSEC_CMD_UPD_RXSC(r0, &(0x7f0000002ec0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002e80)={&(0x7f0000000240)=ANY=[@ANYBLOB="04080000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fddbdf250300000008000100", @ANYRES32=r6, @ANYBLOB="7004028008001a00ff00000010b8cc062e36ff5524cf19101b036e036392f8aee11ccc6b6111b618772c0804d7f3943d4d5701fa3ed06aaba19fca66fc68c03599cbeed9dfaea1d9f8708a1004006e8008006080040096007501e58082aa23c3da9aa5db4f44cb62b10351eacd4aac3f4cef70da1829045a523dadc9827282d3a5803e2cefabc52fa53acba7b7a42cd1a4867fdadf72d376f4bec08cda0f5420cf1bccc1ba8cbee09e616bddc085379d2e368bd58b13978901573c67ffbeeb912def864ca6227c68f69587f4f33947d48a53b328bcc32040141fb409468ea43179f61049bb78c0a5ff0e69dcb4efab3fc2acfdea761b922124d58cc7fb05548aac8bd4d0ec6a57e1063009512a46af8970ccbe9cc3aafdee4762ca9d0c6ccc8ed7db9549ca0ded11684312d2e2fd12317ed25657d2e7e4b0b79a19d2841308579ba2e359ed6d04e3254eaa1befd91c91df4bf51b38bdac9ce6c0ceff151ae933a9013bd132e1e10f3e990af5e36169bab8405904adf83e0ea49ceda51610804619ad56a80a1a8953dc37138007fc27b244d6f6edcf3b0ad4fe3e36683a17aea75c2b50e2a73b5aaf5654476fb10400358014006400ff02000000000000000000000000000108004400ac1414bb000000b801bf80633fdae66d61a114a14e724c57fc4b4dd2f10478bd0436ad55a827cac7c752e53c44d1589a1b307f992f50adcf8a5efea7bd8de97397b914cb33900172bddaa23b76a294c821676a5fad0629c09790d3c39b80a649512c1ace3ec83426d9cbddeca9f0d9c7c3ba27b378d2d1d872fa74247a245974005b37d3d85e08e8be0a08259804d648295194f8d28590da48486ca11924754e98a5bb1944586c870f30a6a036450c6d67f5b8125dda88420206a027739d0bb2a83e15ba5ebd5e3e15252e45dc22ac979d6bf71ac37dc7e40d4851c5209c14d3f8d2dca6a6f15b9c3b22887102b87bef0618352818f9218e64234ff93f87c4c6b3529571e371289af3e709aa9d1ff154b39d43c72b81c200f5dfa7d17cf555944ee823fca00a240810f2311897720d7d3bfadaa1c0d7100e5efce9d06603f8e46f446f135acd74d51a3adfb2beff5eb51920bd3c8c478ec60d9258a9c5d17291b00e3776f6fa69ae915f5e2aa337998ee46c4a3401b5b0a7723674fdb02836709989e22a3cc28fda1c128b8d9c86d33e35e609dcda3f16ddef0a49bc7061fcd5a7012a2032bea135d9a6fd4ac3f8b3949536d638b77d2a69634dd32bcd3c67e80008806b00c9009e9819d22684ebc648844382079b0996753bb5536c4e744741f51d1bcf1f85207c9ddf2ad846f787af3820b606b4bf925369dbc9cabfd3a54e87f77643c5a13abbf98d00624d41f94c12c632fdd60112e48d9c1d3b5987773e9848fb9f4f08957d5dd374198d36000400c980c13c13f51167b45cb9b2e519f105e779c50a66e614e0235a8f7341473ba095d71c2fd9e5ee370c3611fc549aeceb448e0e18e1a8cfa0ea36b1b59bc13698aafcfe25569a9e71c5e77c9ab4e15153929e11ddd8cc5b83ae2beab8c29164d0594c14004500fe880000000000000000000000000001230103801400ae00fc0000000000000000000000000000010400a8009cb1d40123e04fe027d3dd84fad897b809e1f67a9de51f2ddf613ea6636914536c41cd7bf5af87d8fa0f96a1fe38e1839c6feac7bc0f0023231498ccb31a8e7b32e5647323d5c69003a0ad5e6d1de02e67a9afab7c873a75e60ed1adb9f5ba5ffb34fd041ffa9a984a582ed1ae6f8f3c5721e912aef7e90c63f9e9d515f51210c517140ffd917e2a70db7174001e00c3287beee4ab3c64e2506a7d6aba2421e5217123c42f84ef7e357ef7ee1c936cb2c12acd4d8752d7c325f8fda465d0092c865f0e0b3e34fe7daf3f2a5703b105414a879149b4e7cb95ed6fc13d7fad5da280f381fd6bdb88bb937b476c376143895a16a7ce354920a156afc42ea565c708001c00ff7f000000460203802800318004000c800400348008003c00", @ANYRES32, @ANYBLOB="1400f000fe8000000000000000000000000000aae4002480040000800400158004008c800c005100070000000000000004004180040054804dae1611db966bb86cf598e7db1686a4edbdf8b8073d5a55184eb0ef3e7f4bba229bda23e8c5c5a46148f26f686a652034e5c3db49b17779ce164da6d73472c6e4712afbf5d038a70571326afb0f5c4c706044346db61f70375ca7e7ffefab6c1aa91d79b2fb3cdc77168f9ea8e4efd1c82deedc7576ce8a1167d064ed5fcc208fe764f0a8f2175362354d8460aaed6982de29559ef1bf8d3f36c677cee7fdc0f7276eeae8c7ef723a8958de1d95de8ef439d2c9cbc2394bf944281779b52175040015801000c98008008b00", @ANYRES32=r7, @ANYBLOB="040007805becb4628acdab0289e0b16a76e978f27e043b6f4264efb4f7fc16c1e4a59df30cce9a87d77e8dc1a5a160ec4afdb7d21a6e702d3fc2823786bec3a907177a62f7013bda7c732af8692f80b799dbdbf0b157d6888adaf4bd78e1fe171b1fb8b381aadf2f4a66f8e6fbac50a156febf2f57f42123a53ae391e54345253349a8b6a888e1f347b2725d60eb7a9a4d5c5248229b1aee0ca56c8a53e542590ed465b9156598e3b7ee7678623bb7301524145251ae63e37dc33b73818498ca7ac0dc8567e66e3dc08358672d672a25708295218c360fa561462529354d86ad15e20f861772d4f0e7075226ddc2490bf7c9d4b96b17280a15ad48790b70b53eb961c0aa8b3078ac6726bde911dc98b37326f2b717cf641408152408f2854a25cd56544ac3c70000"], 0x7f8}}, 0x400) execve$auto(&(0x7f0000000000)=':,\x00', 0x0, 0x0) bind$auto(0x3, 0x0, 0x6a) writev$auto(r2, &(0x7f0000000100)={0x0, 0x7}, 0x4000000000007) r9 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/kcore\x00', 0xc40, 0x0) read$auto_proc_iter_file_ops_compat_inode(r9, 0x0, 0x4d) openat$auto_virtual_ncidev_fops_virtual_ncidev(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) 38.563515988s ago: executing program 3 (id=2441): write$auto(0xca, &(0x7f0000000000)='\x04>\x01\x01\x00@\x00\x00\x01_\x19\x05:R\xcc\x96\b\'\x02\xb0\x93l\xeb\x87\r\b\x87\x14\xf8e6\x9c%\xb6\x9a\\S\xa2(Q\xcc', 0x7f) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/fs/bcache/pendings_cleanup\x00', 0xc0481, 0x0) write$auto(r0, &(0x7f0000000000)='\x14\xf4\xb6\xc6\x97\xdb\x18B\f\xef\x1dQZ\xa66\xe7\x06\\\xe0)+\x86\xa7\x9bv\xe1\x18\xf5\x83\b\x11\x19\xdd\x1c', 0x4) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$auto(0x8, 0x0, 0x0, 0x2, 0x100000000) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) r1 = open(&(0x7f0000000240)='./file0\x00', 0x2, 0x19) socket(0x9, 0x5, 0x3b) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/cgroup\x00') socket(0x2, 0x3, 0xa) ioctl$auto_TIOCNOTTY2(r1, 0x5422, &(0x7f00000002c0)="e0777c5f9005bcc00e5456c960c4b594ab24091e9e") r2 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/usbmon0\x00', 0x70000, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bus/usb/039/001\x00', 0x40000, 0x0) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x501, 0x0) syz_genetlink_get_family_id$auto_mac802154_hwsim(&(0x7f0000000180), r1) mmap$auto(0x2000040, 0x4, 0x4000000000df, 0x100000000000eb4, 0x401, 0x5) syz_genetlink_get_family_id$auto_ipvs(0x0, 0xffffffffffffffff) madvise$auto(0x0, 0xffffffffffff0001, 0x15) madvise$auto(0x0, 0x2000000080000001, 0x3) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x0, 0x2091d2, 0x8000004, 0x0, 0x8, 0x2) madvise$auto(0x110d230000, 0x1, 0x9) mmap$auto(0x0, 0x202000d, 0x7, 0x14, r2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/pagemap\x00', 0x8000, 0x0) 35.616339324s ago: executing program 3 (id=2446): mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xffffffffffffffff, 0x8000) r0 = socket(0x28, 0x800, 0x1) setsockopt$auto(r0, 0xffffa203, 0x39, 0x0, 0x3) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nbd5\x00', 0x14f602, 0x0) r2 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/module/scsi_mod/parameters/default_dev_flags\x00', 0x63102, 0x0) sendfile$auto(r3, r3, 0x0, 0x2) ioctl$auto_PPPIOCSMRU(r2, 0xc004743e, 0x0) epoll_create$auto(0x70c) io_uring_register$auto_IORING_REGISTER_PROBE(r1, 0x8, &(0x7f0000000180)="97fdb200771cb2e6b7373a9a13fafba0cf40770e9a4aa9c0a5429f2e435a87dc23deba0b6a57d194226d2553f40f1f9a872e715640e61a679d7ba38cf252143a", 0xfffffff9) sendmsg$auto_NL80211_CMD_ADD_LINK(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x0, 0x2, 0x70bd25, 0x25dfdbff, {}, [@NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x81) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r4 = open(&(0x7f0000000100)='.\x00', 0x595002, 0x408) write$auto(r4, 0x0, 0xfffffdf2) linkat$auto(r4, 0x0, 0xffffffffffffff9c, &(0x7f0000000080)='&&\x00', 0x1000) io_uring_setup$auto(0x6, 0x0) open(0x0, 0x22040, 0x75) utimes$auto(0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x114) mprotect$auto(0x0, 0x8000000000000001, 0x8) 33.743228648s ago: executing program 3 (id=2448): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bpf$auto(0x5, &(0x7f0000000100)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0xd, 0x9, 0x9, 0x6, 0x7fff}, 0x3b) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fe02, 0x0) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r0 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r0, 0x0, 0x0) r1 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r1, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r0, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(0xffffffffffffffff, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r2 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r2, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) 19.873867892s ago: executing program 2 (id=2470): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) r0 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x11}}, 0x6a) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x3, 0x20000000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) r1 = socket(0xa, 0x801, 0x106) recvmmsg$auto(r1, &(0x7f00000003c0)={{0x0, 0x5a, 0x0, 0x0, 0x0, 0x7, 0x7f}, 0x7ff}, 0x70000000, 0x9, &(0x7f0000000400)={0x3, 0xbd64}) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r2 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/zswap/parameters/compressor\x00', 0xc0002, 0x0) r4 = socket(0x2a, 0x1, 0x0) connect$auto(r4, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x2100}, 0x6) write$auto_ocfs2_control_fops_stack_user(r3, &(0x7f0000003900)='\t', 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), r5) write$auto(0xffffffffffffffff, &(0x7f0000000440)='ON\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf0F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\xed\'\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0xb8c5) openat$auto_proc_pid_attr_operations_base(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/sockcreate\x00', 0x101102, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$auto_netdev(&(0x7f00000002c0), 0xffffffffffffffff) socket(0xa, 0x4, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x6, 0x0) shutdown$auto(0x200000003, 0x2) sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="34200000a2e61cc25c6212ae8089cbb0210eb518c6d489ff7f0000f4160ba5b3014796c02af5445e11392ec2cf51e97f7f5d9bb703989f69852d9e0e94a146564a4ad92cf6f1b906086c6335de868a627cbc2a6cbb911b55f762540fbff23622b9da0f0f79c92dbb7ecf51292b8ec3002365546b2953a7bf5e3b1dd33a7cfbbbedaad4b696ee967461c23a5d54890b8629b934bc6eba2cba7e59b01c13c5ee1cd47209ce314ad43047e98df7e6bcd17989", @ANYRES16=r7, @ANYBLOB="010026bd7000ffdbdf25050000000c0001000200000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r5, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x220000c1}, 0x20000050) statx$auto(r2, 0x0, 0x401006, 0x4015, 0x0) setsockopt$auto(0x3, 0x1, 0x41, 0x0, 0x88) 18.493581995s ago: executing program 33 (id=2448): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bpf$auto(0x5, &(0x7f0000000100)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0xd, 0x9, 0x9, 0x6, 0x7fff}, 0x3b) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fe02, 0x0) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r0 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r0, 0x0, 0x0) r1 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r1, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r0, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(0xffffffffffffffff, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r2 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r2, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) 18.097658204s ago: executing program 2 (id=2472): write$auto(0xca, &(0x7f0000000000)='\x04>\x01\x01\x00@\x00\x00\x01_\x19\x05:R\xcc\x96\b\'\x02\xb0\x93l\xeb\x87\r\b\x87\x14\xf8e6\x9c%\xb6\x9a\\S\xa2(Q\xcc', 0x7f) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/fs/bcache/pendings_cleanup\x00', 0xc0481, 0x0) write$auto(r0, &(0x7f0000000000)='\x14\xf4\xb6\xc6\x97\xdb\x18B\f\xef\x1dQZ\xa66\xe7\x06\\\xe0)+\x86\xa7\x9bv\xe1\x18\xf5\x83\b\x11\x19\xdd\x1c', 0x4) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$auto(0x8, 0x0, 0x0, 0x2, 0x100000000) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) r1 = open(&(0x7f0000000240)='./file0\x00', 0x2, 0x19) socket(0x9, 0x5, 0x3b) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/cgroup\x00') socket(0x2, 0x3, 0xa) ioctl$auto_TIOCNOTTY2(r1, 0x5422, &(0x7f00000002c0)="e0777c5f9005bcc00e5456c960c4b594ab24091e9e") socket(0x1e, 0x4, 0x84) openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/usbmon0\x00', 0x70000, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bus/usb/039/001\x00', 0x40000, 0x0) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x501, 0x0) syz_genetlink_get_family_id$auto_mac802154_hwsim(&(0x7f0000000180), r1) mmap$auto(0x2000040, 0x4, 0x4000000000df, 0x100000000000eb4, 0x401, 0x5) syz_genetlink_get_family_id$auto_ipvs(0x0, 0xffffffffffffffff) madvise$auto(0x0, 0xffffffffffff0001, 0x15) madvise$auto(0x0, 0x2000000080000001, 0x3) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x0, 0x2091d2, 0x8000004, 0x0, 0x8, 0x2) madvise$auto(0x110d230000, 0x1, 0x9) mmap$auto(0x0, 0x202000d, 0x7, 0x14, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/pagemap\x00', 0x8000, 0x0) 17.366701581s ago: executing program 2 (id=2473): openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f00000017c0)='/sys/kernel/debug/lru_gen\x00', 0x1, 0x0) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000880)='/dev/input/event0\x00', 0x40100, 0x0) r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/fs/cifs/dfscache\x00', 0x101000, 0x0) pread64$auto(r0, 0x0, 0x8, 0x75e8) open(&(0x7f0000000040)='./file0\x00', 0x149443, 0x0) openat$auto_tracing_cpumask_fops_trace(0xffffffffffffff9c, 0x0, 0x8002, 0x0) mmap$auto(0x0, 0xf6, 0xdf, 0xeb1, 0x401, 0x0) ioctl$auto_SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS1\x00', 0x0, 0x0) r1 = openat$auto_rng_chrdev_ops_core(0xffffffffffffff9c, &(0x7f0000000000), 0x101040, 0x0) read$auto_rng_chrdev_ops_core(r1, &(0x7f0000000040)=""/4096, 0xfffffe82) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) openat$auto_iommufd_fops_main(0xffffffffffffff9c, 0x0, 0x900, 0x0) openat$auto_nsim_dev_trap_fa_cookie_fops_dev(0xffffffffffffff9c, 0x0, 0x2202, 0x0) ioctl$auto_PROCMAP_QUERY(0xffffffffffffffff, 0xc0686611, &(0x7f0000000080)={0x67, 0x3f, 0x7fff, 0x2005, 0x80000000007, 0x5, 0x6, 0xff, 0x5, 0x3c, 0xfbfffffe, 0xfff, 0x7fb, 0x405, 0x2}) sendmsg$auto_IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) r2 = openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, &(0x7f0000001180)='/dev/input/mice\x00', 0x1a1382, 0x0) writev$auto(r2, &(0x7f0000000100)={&(0x7f0000000140), 0x7111}, 0x8) ioctl$auto_XFS_IOC_ERROR_INJECTION(0xffffffffffffffff, 0x40085874, &(0x7f0000000140)={r2, 0x1}) writev$auto(0x3, &(0x7f0000000080)={0x0, 0x1}, 0x3) syz_genetlink_get_family_id$auto_seg6(&(0x7f0000000b40), 0xffffffffffffffff) sendmsg$auto_SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4080}, 0x4000004) 16.380611386s ago: executing program 2 (id=2474): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r0 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_PHY_GET(0xffffffffffffffff, &(0x7f0000003200)={0x0, 0x0, &(0x7f00000031c0)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010326bd7000ffdbdf"], 0x20}, 0x1, 0x0, 0x0, 0x2404c012}, 0x80) r1 = socket(0x10, 0x2, 0x0) ioctl$auto_TUNSETOFFLOAD2(0xffffffffffffffff, 0x400454d0, &(0x7f0000000080)=0x6) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x3f, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) 16.166379529s ago: executing program 2 (id=2475): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/graphics/fbcon/rotate\x00', 0x10b842, 0x0) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/rpc/auth.unix.ip/flush\x00', 0x40d81, 0x0) write$auto_proc_reg_file_ops_compat_inode(r0, 0x0, 0x0) fstatfs$auto(0xffffffffffffffff, &(0x7f0000000140)={0x8001, 0x100000000003, 0x1, 0x9, 0x5d, 0x0, 0x75, {[0x80000000]}, 0x0, 0x7ff, 0x68a6, [0x5, 0x8, 0x5, 0x4]}) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f00000003c0)=""/20, 0xfffffcc4) connect$auto(r0, &(0x7f0000000240)=@nl=@kern={0x10, 0x0, 0x0, 0x100}, 0x8) write$auto(0x3, 0x0, 0x1) open(&(0x7f0000001bc0)='./file0\x00', 0x4140, 0x6) mount$auto(0x0, &(0x7f0000001500)='./file0\x00', &(0x7f00000000c0)='cifs\x00s \xfe\xcd\x94=\xbf\xfd\x02;\xffP\xf26\xea\x97\x95\xad\xb6\x1d\\\xd3\x89\xe0\n\x0f\xf7]\xafa\xcc\xbbgv7\x04\"\xb4\xe1\xc8#\x1b\xf0&\xc3\x15\xea\x1f\xcf0#e\x14\xe6\xf9\xc9\xec\x1d\x1d\xa7\xcd\x94\xae\x01\x00\x00\x00\x00\x00\x00\x000\xc3\xeem\x8e\xfb`\x1a[\x01\xf6Re\xad x\xbc\x00\x0f\x0f\xc6f\x82\x16\x8e\xab\xf6)^\xbe{=\xa3\xeb\xc44\f\r\xf6\x17\x87\xe8\xb0\xd9V\xfb\xc6U\xe9\xb7\xe6\xa2\xdb\xbbP\xf14S\xe6\xce|?\xa0\xf3\x8f^?5\x1bb^R\x11\xf6\xe8\xfc\v\xfa\x96\x89%\x02\xc0\xa9\xc9\xd2\xb0b\x86\xd1\x1c\xa2\xca\xc9\x90\xd7\xe1\xbf%\xdbzh\xfc\xaa4KhoD\xe7\xda\x12^\x8b\x81\xb3B5\xfd-\x83\x9f\xe7ZHh^9\x18z*\x02\xa8Fu\x80\xee\xc6\x98v\xf6\xa7\xdf\xd8\x9ans\x16\xa7\x03\xd9\xc2\xee\"\xa7\xefx\xd5,Q\xfe\xe6\va\x06\x00\x00\x00\x00\x00\x00\x00\xaa\x89!,m\x16M\x19no\x1e+ 1\xa7\x1c\x95\xa0\xd6`\xd1\xf8r\xea\x13sFn)\x05\xc8\x1e\xf8a\xf5H\x86\x9a\xc4\x81\xbf\xa1h`\xe0\xd8\xdd\xeb9k\xa4\x1fA}\x80\x9e\x8a\x031\\D@\a\x8b\xc7.\xc1\xe4Z\xd4C\x19g^\x06\x06\x82', 0x8002, &(0x7f00000001c0)) mmap$auto(0x0, 0x2020009, 0x3, 0xeb2, 0xfffffffffffffffb, 0x8000) setsockopt$auto(0x3, 0x4, 0x21, 0x0, 0x9) getpid() close_range$auto(r0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x801, 0x100) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x23, @dev={0xac, 0x14, 0x14, 0x17}}, 0x53) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0xe883, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x3, 0x2) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x54) connect$auto(0x3, &(0x7f00000018c0)=@l2tp={0x2, 0x0, @multicast1}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) listen$auto(0x3, 0x81) 15.039240924s ago: executing program 2 (id=2476): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fe02, 0x0) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r1 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r1, 0x0, 0x0) r2 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r2, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r1, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r0, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r3 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r3, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) 0s ago: executing program 34 (id=2476): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto_XFS_IOC_FREESP64(0xffffffffffffffff, 0x40305825, 0x0) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$auto(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fe02, 0x0) mmap$auto(0x0, 0x20007, 0x1004000000000df, 0x16, 0x401, 0x8000) ioctl$auto_BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={"ef65ce6c00cf81000000ffffffffffffff291d000000000700000000000300", 0x8bff, 0x64c6, 0x7fff, 0x400004, 0x200000000040000d}) ioctl$auto_BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) r1 = openat$auto_transaction_log_fops_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transaction_log\x00', 0x121002, 0x0) read$auto_transaction_log_fops_(r1, 0x0, 0x0) r2 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r2, &(0x7f0000000240)='\x03W\x96l\x15\x00\x00\x1f\x00\xf4\x00\x00\x00\x00\xf4\x00\x00\x00\x00\x00\x00', 0x100000002, 0x100000001) mmap$auto(0xffffffffffffffff, 0x5, 0x7, 0xbe, 0xffffffffffffffff, 0x7ffe) setrlimit$auto(0xa, &(0x7f0000000080)={0x7, 0x5}) socket(0x18, 0x4, 0x0) sysfs$auto(0x2, 0x23, 0x0) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r1, 0x0, 0x9) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r0, 0x80085502, &(0x7f0000000380)=ANY=[@ANYBLOB="050000000200000087c788deb1e689ded72700ac7e75046f5e547f0939e6c37acca832a2dacd007c9e2177923a589076e8dedc15db27d5af71356faabe0cae869409e01eaaf51b3ff9f05159438811b43e8511e85cffde5ac434b65098ab7fd5eca656e770f6a0c84ccb81b98d07eb6826c9de760e875fe12242f37e662835bed249fe0bd132cec7e8cf8e543b8faeebf75fb6961034812a6cefa843b4eafbf2beca656a6ca55464d7de1d56398823d37f8157dcab7d3c42d8bc1af84b34076ffeac979949ba"]) r3 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim1/health/break_health\x00', 0x2041, 0x0) write$auto(r3, 0x0, 0x4) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) close_range$auto(0x2, 0xa, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) kernel console output (not intermixed with test programs): a25fa0 R15: 00007ffcbbc2e7b8 [ 785.309287][T19667] [ 785.311054][T19667] ERROR: Out of memory at tomoyo_realpath_from_path. [ 785.982908][T12642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 786.223500][T19683] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20000 [ 786.318806][T19683] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 786.361776][T19683] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 786.365857][T19683] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 786.365888][T19683] page dumped because: unmovable page [ 786.365908][T19683] page_owner tracks the page as allocated [ 786.365933][T19683] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 0, tgid 0 (swapper), ts 1709871138, free_ts 0 [ 786.365971][T19683] register_early_stack+0x74/0xaf [ 786.366004][T19683] init_page_owner+0x4c/0xa10 [ 786.366113][T19683] page_ext_init+0x71d/0x780 [ 786.366158][T19683] mm_core_init+0x229/0x270 [ 786.366219][T19683] page_owner free stack trace missing [ 786.407700][T19692] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 787.059158][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 789.129184][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 790.430346][T19822] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 793.012137][T19909] random: crng reseeded on system resumption [ 793.491267][T19921] zswap: compressor not available [ 793.517922][T19920] zswap: compressor not available [ 794.286713][T14829] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 795.537117][T20043] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 796.295460][T12642] Bluetooth: hci2: command 0x0406 tx timeout [ 797.210217][T20101] Process accounting resumed [ 797.585139][T20227] random: crng reseeded on system resumption [ 797.644214][T20227] FAULT_INJECTION: forcing a failure. [ 797.644214][T20227] name fail_futex, interval 1, probability 0, space 0, times 0 [ 797.696054][T20227] CPU: 0 UID: 0 PID: 20227 Comm: syz.0.1857 Tainted: G L syzkaller #0 PREEMPT(full) [ 797.696098][T20227] Tainted: [L]=SOFTLOCKUP [ 797.696108][T20227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 797.696124][T20227] Call Trace: [ 797.696133][T20227] [ 797.696143][T20227] dump_stack_lvl+0x100/0x190 [ 797.696175][T20227] should_fail_ex.cold+0x5/0xa [ 797.696203][T20227] get_futex_key+0x1d2/0x14f0 [ 797.696247][T20227] ? __pfx_get_futex_key+0x10/0x10 [ 797.696287][T20227] ? kasan_save_stack+0x3f/0x50 [ 797.696316][T20227] ? kasan_save_stack+0x30/0x50 [ 797.696343][T20227] ? kasan_record_aux_stack+0xa7/0xc0 [ 797.696381][T20227] ? __call_rcu_common.constprop.0+0xa5/0x9b0 [ 797.696433][T20227] ? __put_cred+0x10c/0x180 [ 797.696472][T20227] ? keyctl_session_to_parent+0x95a/0xae0 [ 797.696573][T20227] ? __do_sys_keyctl+0x2b1/0x5a0 [ 797.696595][T20227] ? do_syscall_64+0x115/0x840 [ 797.696647][T20227] futex_wake+0xf4/0x5e0 [ 797.696681][T20227] ? __pfx_futex_wake+0x10/0x10 [ 797.696724][T20227] do_futex+0x2b2/0x440 [ 797.696751][T20227] ? __pfx_do_futex+0x10/0x10 [ 797.696783][T20227] __x64_sys_futex+0x34f/0x4d0 [ 797.696813][T20227] ? __pfx___x64_sys_futex+0x10/0x10 [ 797.696838][T20227] ? __put_cred+0x111/0x180 [ 797.696872][T20227] ? keyctl_session_to_parent+0x39a/0xae0 [ 797.696924][T20227] do_syscall_64+0x115/0x840 [ 797.696962][T20227] ? clear_bhb_loop+0x40/0x90 [ 797.696993][T20227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.697020][T20227] RIP: 0033:0x7f988279de59 [ 797.697042][T20227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 797.697068][T20227] RSP: 002b:00007f98835bc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 797.697092][T20227] RAX: ffffffffffffffda RBX: 00007f9882a26188 RCX: 00007f988279de59 [ 797.697110][T20227] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9882a2618c [ 797.697127][T20227] RBP: 00007f9882a26180 R08: 0000000000000001 R09: 0000000000000000 [ 797.697144][T20227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 797.697160][T20227] R13: 00007f9882a26218 R14: 00007ffcbbc2e6d0 R15: 00007ffcbbc2e7b8 [ 797.697192][T20227] [ 798.341277][T14829] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 798.393294][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 800.329571][T20358] random: crng reseeded on system resumption [ 800.442245][T20358] FAULT_INJECTION: forcing a failure. [ 800.442245][T20358] name fail_futex, interval 1, probability 0, space 0, times 0 [ 800.518722][T20358] CPU: 0 UID: 0 PID: 20358 Comm: syz.2.1867 Tainted: G L syzkaller #0 PREEMPT(full) [ 800.518764][T20358] Tainted: [L]=SOFTLOCKUP [ 800.518779][T20358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 800.518796][T20358] Call Trace: [ 800.518804][T20358] [ 800.518815][T20358] dump_stack_lvl+0x100/0x190 [ 800.518848][T20358] should_fail_ex.cold+0x5/0xa [ 800.518876][T20358] get_futex_key+0x1d2/0x14f0 [ 800.518920][T20358] ? __pfx_get_futex_key+0x10/0x10 [ 800.518958][T20358] ? __do_sys_keyctl+0x2b1/0x5a0 [ 800.518982][T20358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.519019][T20358] futex_wake+0xf4/0x5e0 [ 800.519051][T20358] ? __pfx_futex_wake+0x10/0x10 [ 800.519094][T20358] do_futex+0x2b2/0x440 [ 800.519119][T20358] ? __pfx_do_futex+0x10/0x10 [ 800.519145][T20358] ? task_work_add+0x201/0x3b0 [ 800.519183][T20358] __x64_sys_futex+0x34f/0x4d0 [ 800.519212][T20358] ? __pfx___x64_sys_futex+0x10/0x10 [ 800.519239][T20358] ? keyctl_session_to_parent+0x39a/0xae0 [ 800.519290][T20358] do_syscall_64+0x115/0x840 [ 800.519329][T20358] ? clear_bhb_loop+0x40/0x90 [ 800.519361][T20358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.519387][T20358] RIP: 0033:0x7f859239de59 [ 800.519407][T20358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.519433][T20358] RSP: 002b:00007f85905b40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 800.519457][T20358] RAX: ffffffffffffffda RBX: 00007f8592626188 RCX: 00007f859239de59 [ 800.519474][T20358] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f859262618c [ 800.519491][T20358] RBP: 00007f8592626180 R08: 0000000000000001 R09: 0000000000000000 [ 800.519507][T20358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 800.519522][T20358] R13: 00007f8592626218 R14: 00007ffc35cc6440 R15: 00007ffc35cc6528 [ 800.519554][T20358] [ 800.680863][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 802.375463][ T30] audit: type=1800 audit(875579199.749:20): pid=20419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1872" name="lu_gp_id" dev="configfs" ino=74544 res=0 errno=0 [ 802.747239][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 802.886014][T20434] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 803.205217][T20447] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 804.458154][T12642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 804.671048][T20542] futex_wake_op: syz.3.1879 tries to shift op by -2048; fix this program [ 804.698279][T20542] 0x000000000001-0x000000020000 : "" [ 804.798103][T20542] ftl_cs: FTL header corrupt! [ 805.147258][T20565] kfence: disabled [ 806.490844][T12263] Bluetooth: hci0: command 0x0c1a tx timeout [ 806.651927][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 806.660476][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 806.777152][T20632] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 807.597212][T20653] binder: 20648:20653 ioctl c0306201 0 returned -14 [ 807.663795][T20657] futex_wake_op: syz.2.1888 tries to shift op by -2048; fix this program [ 807.871201][T20657] futex_wake_op: syz.2.1888 tries to shift op by -2048; fix this program [ 807.968056][T20663] 0x000000000001-0x000000020000 : "" [ 808.088889][T20663] ftl_cs: FTL header corrupt! [ 808.564884][T12263] Bluetooth: hci0: command 0x0c1a tx timeout [ 808.816181][T20680] NFSD: Failed to start, no listeners configured. [ 809.379361][T20760] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 809.687600][T20784] bridge0: port 4(team0) entered blocking state [ 809.718106][T20784] bridge0: port 4(team0) entered disabled state [ 809.751083][T20784] team0: entered allmulticast mode [ 809.822281][T20784] team_slave_0: entered allmulticast mode [ 809.897074][T20784] team_slave_1: entered allmulticast mode [ 809.985856][T20784] team0: entered promiscuous mode [ 810.057549][T20784] team_slave_0: entered promiscuous mode [ 810.127994][T20784] team_slave_1: entered promiscuous mode [ 810.209763][T20784] bridge0: port 4(team0) entered blocking state [ 810.216178][T20784] bridge0: port 4(team0) entered forwarding state [ 812.742284][T20964] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 813.426666][T21000] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1902'. [ 813.726557][T21017] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1903'. [ 814.298217][T21017] bond0: entered promiscuous mode [ 814.315226][T21017] bond_slave_1: entered promiscuous mode [ 818.999127][T21171] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1914'. [ 819.055075][T21176] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1914'. [ 819.987710][T21221] futex_wake_op: syz.0.1917 tries to shift op by -2048; fix this program [ 820.020719][T21221] futex_wake_op: syz.0.1917 tries to shift op by -2048; fix this program [ 821.020756][T21273] FAULT_INJECTION: forcing a failure. [ 821.020756][T21273] name failslab, interval 1, probability 0, space 0, times 0 [ 821.272086][T21273] CPU: 0 UID: 0 PID: 21273 Comm: syz.3.1918 Tainted: G L syzkaller #0 PREEMPT(full) [ 821.272128][T21273] Tainted: [L]=SOFTLOCKUP [ 821.272138][T21273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 821.272155][T21273] Call Trace: [ 821.272163][T21273] [ 821.272174][T21273] dump_stack_lvl+0x100/0x190 [ 821.272207][T21273] should_fail_ex.cold+0x5/0xa [ 821.272236][T21273] should_failslab+0xc2/0x120 [ 821.272270][T21273] __kmalloc_cache_noprof+0x91/0x6c0 [ 821.272309][T21273] ? trace_kmalloc+0xeb/0x110 [ 821.272339][T21273] ? __kasan_kmalloc+0xaa/0xb0 [ 821.272367][T21273] ? vb2_vmalloc_alloc+0xf9/0x410 [ 821.272552][T21273] vb2_vmalloc_alloc+0xf9/0x410 [ 821.272599][T21273] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 821.272641][T21273] __vb2_queue_alloc+0x8d5/0x1160 [ 821.272713][T21273] vb2_core_reqbufs+0x899/0xf30 [ 821.272760][T21273] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 821.272799][T21273] ? kasan_save_track+0x14/0x30 [ 821.272828][T21273] ? __kasan_kmalloc+0xaa/0xb0 [ 821.272860][T21273] ? __vb2_init_fileio+0x18f/0x1000 [ 821.272904][T21273] __vb2_init_fileio+0x32d/0x1000 [ 821.272942][T21273] ? aa_file_perm+0x7f3/0x14d0 [ 821.272985][T21273] __vb2_perform_fileio+0x9ba/0x1380 [ 821.273031][T21273] ? __pfx___vb2_perform_fileio+0x10/0x10 [ 821.273071][T21273] ? __pfx___might_resched+0x10/0x10 [ 821.273117][T21273] vb2_fop_read+0x211/0x520 [ 821.273158][T21273] v4l2_read+0x229/0x2c0 [ 821.273211][T21273] ? __pfx_v4l2_read+0x10/0x10 [ 821.273244][T21273] vfs_read+0x1e4/0xb40 [ 821.273286][T21273] ? __pfx_vfs_read+0x10/0x10 [ 821.273321][T21273] ? find_held_lock+0x2b/0x80 [ 821.273349][T21273] ? __fget_files+0x215/0x3d0 [ 821.273386][T21273] ? __fget_files+0x215/0x3d0 [ 821.273428][T21273] ? __fget_files+0x21f/0x3d0 [ 821.273473][T21273] ksys_read+0x12a/0x250 [ 821.273510][T21273] ? __pfx_ksys_read+0x10/0x10 [ 821.273560][T21273] do_syscall_64+0x115/0x840 [ 821.273605][T21273] ? clear_bhb_loop+0x40/0x90 [ 821.273641][T21273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 821.273668][T21273] RIP: 0033:0x7f72b3d9de59 [ 821.273690][T21273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 821.273718][T21273] RSP: 002b:00007f72b4b80028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 821.273742][T21273] RAX: ffffffffffffffda RBX: 00007f72b4026090 RCX: 00007f72b3d9de59 [ 821.273760][T21273] RDX: 0000000000000028 RSI: 0000200000000280 RDI: 0000000000000006 [ 821.273776][T21273] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 821.273792][T21273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 821.273808][T21273] R13: 00007f72b4026128 R14: 00007f72b4026090 R15: 00007fff28cb5798 [ 821.273841][T21273] [ 825.994982][T21436] vivid-007: ================= START STATUS ================= [ 826.031500][T21436] vivid-007: Enable Output Cropping: true [ 826.059684][T21436] vivid-007: Enable Output Composing: true [ 826.096984][T21436] vivid-007: Enable Output Scaler: true [ 826.128346][T21436] vivid-007: Tx RGB Quantization Range: Automatic [ 826.184085][T21436] vivid-007: Transmit Mode: HDMI [ 826.239057][T21436] vivid-007: Hotplug Present: 0x00000000 [ 826.295525][T21436] vivid-007: RxSense Present: 0x00000000 [ 826.333699][T21436] vivid-007: EDID Present: 0x00000000 [ 826.368359][T21436] vivid-007: ================== END STATUS ================== [ 826.953582][T21450] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 827.221500][T21469] netlink: 'syz.3.1939': attribute type 27 has an invalid length. [ 827.298341][T21465] netlink: 'syz.3.1939': attribute type 27 has an invalid length. [ 827.416483][T21452] Process accounting paused [ 827.456147][T21465] netlink: 334 bytes leftover after parsing attributes in process `syz.3.1939'. [ 827.516846][T21469] netlink: 334 bytes leftover after parsing attributes in process `syz.3.1939'. [ 828.121349][T21473] kexec: Could not allocate control_code_buffer [ 829.995797][T21574] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 3 with max blocks 3 with error 117 [ 830.189064][T21574] EXT4-fs (sda1): This should not happen!! Data will be lost [ 830.189064][T21574] [ 830.518887][T21592] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1949'. [ 830.926929][T12642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 832.571335][T21620] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 832.949220][T21631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1959'. [ 833.002706][T12642] Bluetooth: hci1: command 0x0406 tx timeout [ 835.075617][T12263] Bluetooth: hci1: command 0x0406 tx timeout [ 836.817500][T21751] futex_wake_op: syz.3.1971 tries to shift op by -2048; fix this program [ 836.930196][T21755] 0x000000000001-0x000000020000 : "" [ 837.257186][T21755] ftl_cs: FTL header corrupt! [ 838.433420][T21783] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 839.685280][T12642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 840.078934][T21766] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 841.762170][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 843.833313][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 844.713183][T22064] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1993'. [ 845.000228][T22081] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1995'. [ 846.046518][T22147] FAULT_INJECTION: forcing a failure. [ 846.046518][T22147] name failslab, interval 1, probability 0, space 0, times 0 [ 846.115292][T22147] CPU: 0 UID: 0 PID: 22147 Comm: syz.3.1999 Tainted: G L syzkaller #0 PREEMPT(full) [ 846.115334][T22147] Tainted: [L]=SOFTLOCKUP [ 846.115344][T22147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 846.115360][T22147] Call Trace: [ 846.115369][T22147] [ 846.115379][T22147] dump_stack_lvl+0x100/0x190 [ 846.115417][T22147] should_fail_ex.cold+0x5/0xa [ 846.115446][T22147] should_failslab+0xc2/0x120 [ 846.115480][T22147] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 846.115510][T22147] ? proc_alloc_inode+0x25/0x200 [ 846.115550][T22147] ? __pfx_proc_alloc_inode+0x10/0x10 [ 846.115589][T22147] proc_alloc_inode+0x25/0x200 [ 846.115625][T22147] alloc_inode+0x68/0x250 [ 846.115655][T22147] new_inode+0x22/0x1c0 [ 846.115716][T22147] proc_get_inode+0x1d/0x780 [ 846.115757][T22147] proc_lookup_de+0x236/0x360 [ 846.115819][T22147] proc_lookup+0xd8/0x110 [ 846.115871][T22147] ? __pfx_proc_root_lookup+0x10/0x10 [ 846.115912][T22147] proc_root_lookup+0x3b/0x70 [ 846.115951][T22147] ? __pfx_proc_root_lookup+0x10/0x10 [ 846.115998][T22147] path_openat+0x241f/0x4280 [ 846.116051][T22147] ? __pfx_path_openat+0x10/0x10 [ 846.116100][T22147] do_file_open+0x20e/0x430 [ 846.116143][T22147] ? __pfx_do_file_open+0x10/0x10 [ 846.116204][T22147] ? alloc_fd+0x471/0x7a0 [ 846.116245][T22147] ? do_getname+0x191/0x390 [ 846.116276][T22147] do_sys_openat2+0x10f/0x1e0 [ 846.116307][T22147] ? __pfx_do_sys_openat2+0x10/0x10 [ 846.116340][T22147] ? __fget_files+0x21f/0x3d0 [ 846.116383][T22147] __x64_sys_openat+0x12d/0x210 [ 846.116415][T22147] ? __pfx___x64_sys_openat+0x10/0x10 [ 846.116458][T22147] do_syscall_64+0x115/0x840 [ 846.116497][T22147] ? clear_bhb_loop+0x40/0x90 [ 846.116528][T22147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.116555][T22147] RIP: 0033:0x7f72b3d9de59 [ 846.116577][T22147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.116602][T22147] RSP: 002b:00007f72b4ba1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 846.116627][T22147] RAX: ffffffffffffffda RBX: 00007f72b4025fa0 RCX: 00007f72b3d9de59 [ 846.116645][T22147] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 846.116662][T22147] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 846.116678][T22147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 846.116693][T22147] R13: 00007f72b4026038 R14: 00007f72b4025fa0 R15: 00007fff28cb5798 [ 846.116725][T22147] [ 849.049445][T22292] futex_wake_op: syz.0.2005 tries to shift op by -2048; fix this program [ 850.085439][T22308] zswap: compressor not available [ 850.920092][T12642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 851.267782][T22339] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 851.718537][T22345] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2015'. [ 852.988960][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 854.550355][T12263] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 854.836153][T22420] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 855.059239][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 855.757629][T22440] random: crng reseeded on system resumption [ 855.892053][T22440] hub 1-0:1.0: USB hub found [ 855.952933][T22440] hub 1-0:1.0: 1 port detected [ 856.200899][T22440] netlink: 146 bytes leftover after parsing attributes in process `syz.2.2028'. [ 856.572310][T14829] Bluetooth: hci1: command 0x0406 tx timeout [ 857.704590][T22453] Process accounting resumed [ 857.978000][T12642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 858.566195][T22572] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 858.644269][T12263] Bluetooth: hci1: command 0x0406 tx timeout [ 859.590715][T22588] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 859.695979][T22584] usb usb35: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 859.823598][T22584] vhci_hcd vhci_hcd.1: SetHubDepth req not supported for USB 2.0 roothub [ 859.996947][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 860.338631][T22585] zswap: compressor not available [ 860.701124][T22596] zswap: compressor not available [ 861.358973][T12642] Bluetooth: hci0: unexpected event 0x3e length: 726 > 260 [ 861.359006][T12642] Bluetooth: hci0: unexpected subevent 0x0d length: 725 > 260 [ 861.374812][T12642] Bluetooth: hci0: Unknown advertising packet type: 0x7f [ 861.374862][T12642] Bluetooth: hci0: Unknown advertising packet type: 0x7e [ 861.383663][T12642] Bluetooth: hci0: adv larger than maximum supported [ 861.390905][T12642] Bluetooth: hci0: Unknown advertising packet type: 0x1d [ 861.399358][T12642] Bluetooth: hci0: adv larger than maximum supported [ 861.406461][T12642] Bluetooth: hci0: Malformed LE Event: 0x0d [ 862.069164][T12642] Bluetooth: hci0: command 0x0c1a tx timeout [ 862.208813][T14829] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 863.206565][T22783] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 863.757582][T22789] can: request_module (can-proto-0) failed. [ 864.216316][T12642] Bluetooth: hci3: command 0x0406 tx timeout [ 864.296038][T22804] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5626] was attempted by "ci-qemu-gce-upstream-auto/syz-executor exec"[22804] [ 864.411107][ T30] audit: type=1400 audit(4294967305.036:21): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=22801 comm="syz.2.2054" [ 865.353953][T22824] zswap: compressor not available [ 866.286312][T12642] Bluetooth: hci3: command 0x0406 tx timeout [ 867.805538][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 867.818176][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 868.551331][T22966] sysfs_service_op_store: Client not running :-5: [ 868.552128][T22966] sysfs_service_op_show: Client not running :-5: [ 868.623876][T22973] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 869.208040][T22979] zswap: compressor not available [ 869.961480][T23016] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2066'. [ 870.126201][T23013] FAULT_INJECTION: forcing a failure. [ 870.126201][T23013] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 870.273502][T23013] CPU: 0 UID: 0 PID: 23013 Comm: syz.2.2067 Tainted: G L syzkaller #0 PREEMPT(full) [ 870.273544][T23013] Tainted: [L]=SOFTLOCKUP [ 870.273553][T23013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 870.273569][T23013] Call Trace: [ 870.273580][T23013] [ 870.273590][T23013] dump_stack_lvl+0x100/0x190 [ 870.273624][T23013] should_fail_ex.cold+0x5/0xa [ 870.273653][T23013] _copy_to_iter+0x1f3/0x1720 [ 870.273711][T23013] ? __pfx__copy_to_iter+0x10/0x10 [ 870.273746][T23013] ? down_read+0x13b/0x4c0 [ 870.273772][T23013] ? __pfx_down_read+0x10/0x10 [ 870.273806][T23013] read_kcore_iter+0x93e/0x1800 [ 870.273833][T23013] ? trace_ignore_this_task+0x56/0x100 [ 870.273880][T23013] ? trace_ignore_this_task+0x56/0x100 [ 870.273922][T23013] ? __pfx_read_kcore_iter+0x10/0x10 [ 870.273959][T23013] ? event_filter_pid_sched_wakeup_probe_pre+0x130/0x280 [ 870.273998][T23013] ? event_filter_pid_sched_wakeup_probe_post+0x4f/0x270 [ 870.274052][T23013] ? find_held_lock+0x2b/0x80 [ 870.274081][T23013] ? aa_file_perm+0x7e4/0x14d0 [ 870.274114][T23013] ? aa_file_perm+0x7e4/0x14d0 [ 870.274153][T23013] ? aa_file_perm+0x7f3/0x14d0 [ 870.274194][T23013] ? __pfx_aa_file_perm+0x10/0x10 [ 870.274237][T23013] ? __pfx___might_resched+0x10/0x10 [ 870.274274][T23013] ? lock_acquire+0x1b9/0x370 [ 870.274324][T23013] ? proc_reg_read_iter+0x11b/0x310 [ 870.274362][T23013] proc_reg_read_iter+0x11b/0x310 [ 870.274402][T23013] ? __pfx_proc_reg_read_iter+0x10/0x10 [ 870.274441][T23013] vfs_read+0x82e/0xb40 [ 870.274483][T23013] ? __pfx_vfs_read+0x10/0x10 [ 870.274539][T23013] ksys_read+0x12a/0x250 [ 870.274577][T23013] ? __pfx_ksys_read+0x10/0x10 [ 870.274624][T23013] do_syscall_64+0x115/0x840 [ 870.274663][T23013] ? clear_bhb_loop+0x40/0x90 [ 870.274694][T23013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.274721][T23013] RIP: 0033:0x7f859239de59 [ 870.274744][T23013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 870.274770][T23013] RSP: 002b:00007f85905f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 870.274794][T23013] RAX: ffffffffffffffda RBX: 00007f8592625fa0 RCX: 00007f859239de59 [ 870.274811][T23013] RDX: 000000000000004d RSI: 0000000000000000 RDI: 0000000000000007 [ 870.274827][T23013] RBP: 00007f8592433e6f R08: 0000000000000000 R09: 0000000000000000 [ 870.274843][T23013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 870.274858][T23013] R13: 00007f8592626038 R14: 00007f8592625fa0 R15: 00007ffc35cc6528 [ 870.274899][T23013] [ 870.553790][T23035] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2069'. [ 870.563585][T23035] netlink: 54041 bytes leftover after parsing attributes in process `syz.1.2069'. [ 870.833747][T14829] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 871.777887][T12642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 872.393980][T23069] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 872.626000][T12642] Bluetooth: hci2: unexpected event 0x02 length: 1021 > 260 [ 872.627604][T12642] Bluetooth: hci2: unexpected event 0x02 length: 1021 > 260 [ 872.895772][T12642] Bluetooth: hci2: command 0x0406 tx timeout [ 874.966075][T12642] Bluetooth: hci2: command 0x0406 tx timeout [ 875.265059][T12642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 876.214432][T23192] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2087'. [ 876.286042][T12263] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 877.036031][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 877.274989][T12642] Bluetooth: hci0: command 0x0c1a tx timeout [ 877.924613][T23253] FAULT_INJECTION: forcing a failure. [ 877.924613][T23253] name failslab, interval 1, probability 0, space 0, times 0 [ 877.981297][T23253] CPU: 0 UID: 0 PID: 23253 Comm: syz.0.2094 Tainted: G L syzkaller #0 PREEMPT(full) [ 877.981336][T23253] Tainted: [L]=SOFTLOCKUP [ 877.981345][T23253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 877.981360][T23253] Call Trace: [ 877.981368][T23253] [ 877.981378][T23253] dump_stack_lvl+0x100/0x190 [ 877.981409][T23253] should_fail_ex.cold+0x5/0xa [ 877.981436][T23253] should_failslab+0xc2/0x120 [ 877.981468][T23253] __kvmalloc_node_noprof+0x116/0x970 [ 877.981498][T23253] ? seq_read_iter+0x819/0x1270 [ 877.981545][T23253] seq_read_iter+0x819/0x1270 [ 877.981591][T23253] seq_read+0x344/0x4d0 [ 877.981625][T23253] ? __pfx_seq_read+0x10/0x10 [ 877.981656][T23253] ? __pfx___might_resched+0x10/0x10 [ 877.981692][T23253] ? lock_acquire+0x1b9/0x370 [ 877.981740][T23253] ? rw_verify_area+0xce/0x6d0 [ 877.981772][T23253] ? __pfx_seq_read+0x10/0x10 [ 877.981806][T23253] vfs_read+0x1e4/0xb40 [ 877.981845][T23253] ? __pfx_vfs_read+0x10/0x10 [ 877.981879][T23253] ? __fget_files+0x215/0x3d0 [ 877.981924][T23253] ? __fget_files+0x21f/0x3d0 [ 877.981967][T23253] ksys_read+0x12a/0x250 [ 877.982002][T23253] ? __pfx_ksys_read+0x10/0x10 [ 877.982045][T23253] do_syscall_64+0x115/0x840 [ 877.982084][T23253] ? clear_bhb_loop+0x40/0x90 [ 877.982113][T23253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.982138][T23253] RIP: 0033:0x7f988279de59 [ 877.982158][T23253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 877.982182][T23253] RSP: 002b:00007f98809f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 877.982205][T23253] RAX: ffffffffffffffda RBX: 00007f9882a26360 RCX: 00007f988279de59 [ 877.982221][T23253] RDX: 000000000000008e RSI: 0000200000000040 RDI: 0000000000000008 [ 877.982236][T23253] RBP: 00007f98809f6090 R08: 0000000000000000 R09: 0000000000000000 [ 877.982251][T23253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 877.982266][T23253] R13: 00007f9882a263f8 R14: 00007f9882a26360 R15: 00007ffcbbc2e7b8 [ 877.982296][T23253] [ 879.106618][T12263] Bluetooth: hci2: command 0x0406 tx timeout [ 879.258034][T23271] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 879.345126][T12263] Bluetooth: hci0: command 0x0c1a tx timeout [ 881.165368][T23381] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2104'. [ 881.177588][T12642] Bluetooth: hci2: command 0x0406 tx timeout [ 881.908758][T23473] sysfs_service_op_store: Client not running :-5: [ 881.940776][T23473] sysfs_service_op_show: Client not running :-5: [ 882.657288][T23491] zswap: compressor not available [ 883.246745][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 884.034756][T23604] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2112'. [ 885.311600][T23690] NFSD: Failed to start, no listeners configured. [ 886.052463][T14829] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 887.068854][T23788] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 888.105001][T12642] Bluetooth: hci3: command 0x0406 tx timeout [ 889.122513][T23901] ima: policy update failed [ 889.181966][ T30] audit: type=1802 audit(4294967329.932:22): pid=23901 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.2125" res=0 errno=0 [ 889.559563][T23914] sysfs_service_op_store: Client not running :-5: [ 889.612481][T23915] sysfs_service_op_show: Client not running :-5: [ 889.626624][T23764] Process accounting paused [ 890.174042][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 891.235160][T12642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 891.669688][T23969] input: jJǸ-9%vJ86 as /devices/virtual/input/input17 [ 893.281766][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 895.350223][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 896.938304][ T30] audit: type=1800 audit(4294967337.719:23): pid=24124 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2149" name="trigger" dev="tracefs" ino=19680823 res=0 errno=0 [ 897.044857][T24127] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2148'. [ 898.582484][T24195] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2157'. [ 898.689623][T24193] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 900.555853][T24232] sysfs_service_op_store: Client not running :-5: [ 900.594046][T24232] sysfs_service_op_show: Client not running :-5: [ 901.023766][T24228] netlink: 334 bytes leftover after parsing attributes in process `syz.0.2162'. [ 901.606627][T24318] FAULT_INJECTION: forcing a failure. [ 901.606627][T24318] name failslab, interval 1, probability 0, space 0, times 0 [ 901.650090][T24318] CPU: 0 UID: 0 PID: 24318 Comm: syz.2.2165 Tainted: G L syzkaller #0 PREEMPT(full) [ 901.650132][T24318] Tainted: [L]=SOFTLOCKUP [ 901.650142][T24318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 901.650158][T24318] Call Trace: [ 901.650167][T24318] [ 901.650178][T24318] dump_stack_lvl+0x100/0x190 [ 901.650214][T24318] should_fail_ex.cold+0x5/0xa [ 901.650243][T24318] should_failslab+0xc2/0x120 [ 901.650278][T24318] kmem_cache_alloc_noprof+0x91/0x6a0 [ 901.650306][T24318] ? __pfx_map_id_range_down+0x10/0x10 [ 901.650351][T24318] ? rcu_is_watching+0x12/0xc0 [ 901.650379][T24318] ? security_inode_alloc+0x3b/0x2c0 [ 901.650413][T24318] security_inode_alloc+0x3b/0x2c0 [ 901.650439][T24318] inode_init_always_gfp+0xc77/0xfb0 [ 901.650484][T24318] alloc_inode+0x8e/0x250 [ 901.650514][T24318] new_inode+0x22/0x1c0 [ 901.650546][T24318] proc_get_inode+0x1d/0x780 [ 901.650587][T24318] proc_lookup_de+0x236/0x360 [ 901.650632][T24318] proc_lookup+0xd8/0x110 [ 901.650671][T24318] ? __pfx_proc_root_lookup+0x10/0x10 [ 901.650712][T24318] proc_root_lookup+0x3b/0x70 [ 901.650750][T24318] ? __pfx_proc_root_lookup+0x10/0x10 [ 901.650795][T24318] path_openat+0x241f/0x4280 [ 901.650849][T24318] ? __pfx_path_openat+0x10/0x10 [ 901.650897][T24318] do_file_open+0x20e/0x430 [ 901.650940][T24318] ? __pfx_do_file_open+0x10/0x10 [ 901.651002][T24318] ? alloc_fd+0x471/0x7a0 [ 901.651052][T24318] ? do_getname+0x191/0x390 [ 901.651084][T24318] do_sys_openat2+0x10f/0x1e0 [ 901.651115][T24318] ? __pfx_do_sys_openat2+0x10/0x10 [ 901.651149][T24318] ? __fget_files+0x21f/0x3d0 [ 901.651192][T24318] __x64_sys_openat+0x12d/0x210 [ 901.651225][T24318] ? __pfx___x64_sys_openat+0x10/0x10 [ 901.651267][T24318] do_syscall_64+0x115/0x840 [ 901.651307][T24318] ? clear_bhb_loop+0x40/0x90 [ 901.651338][T24318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.651366][T24318] RIP: 0033:0x7f859239de59 [ 901.651388][T24318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 901.651413][T24318] RSP: 002b:00007f85905f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 901.651438][T24318] RAX: ffffffffffffffda RBX: 00007f8592625fa0 RCX: 00007f859239de59 [ 901.651455][T24318] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 901.651472][T24318] RBP: 00007f8592433e6f R08: 0000000000000000 R09: 0000000000000000 [ 901.651489][T24318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 901.651504][T24318] R13: 00007f8592626038 R14: 00007f8592625fa0 R15: 00007ffc35cc6528 [ 901.651536][T24318] [ 902.100732][T24343] futex_wake_op: syz.2.2167 tries to shift op by -2048; fix this program [ 902.110992][T24343] 0x000000000001-0x000000020000 : "" [ 902.124694][T24343] ftl_cs: FTL header corrupt! [ 904.342712][T24431] futex_wake_op: syz.2.2174 tries to shift op by -2048; fix this program [ 904.398697][T24431] 0x000000000001-0x000000020000 : "" [ 904.466063][T24431] ftl_cs: FTL header corrupt! [ 905.316479][T24467] MTRR 1 not used [ 906.922045][T12642] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 907.073625][T12642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 907.886482][T24570] sysfs_service_op_store: Client not running :-5: [ 907.966620][T24578] sysfs_service_op_show: Client not running :-5: [ 908.813433][T24599] NFSD: Failed to start, no listeners configured. [ 908.950528][T24596] zswap: compressor not available [ 909.104344][T24605] NFSD: Failed to start, no listeners configured. [ 909.126940][T14829] Bluetooth: hci1: command 0x0406 tx timeout [ 909.458554][T24614] zswap: compressor not available [ 910.712073][T24724] sysfs_service_op_store: Client not running :-5: [ 910.761946][T24724] sysfs_service_op_show: Client not running :-5: [ 911.196667][T12642] Bluetooth: hci1: command 0x0406 tx timeout [ 911.398167][T24771] NFSD: Failed to start, no listeners configured. [ 911.738814][T24781] zswap: compressor not available [ 912.286288][T24847] sysfs_service_op_store: Client not running :-5: [ 912.321779][T24847] sysfs_service_op_show: Client not running :-5: [ 912.535957][T24854] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2206'. [ 912.575672][T24854] netlink: 29609 bytes leftover after parsing attributes in process `syz.3.2206'. [ 913.073521][T24881] FAULT_INJECTION: forcing a failure. [ 913.073521][T24881] name fail_futex, interval 1, probability 0, space 0, times 0 [ 913.173206][T24850] zswap: compressor not available [ 913.217256][T24881] CPU: 0 UID: 0 PID: 24881 Comm: syz.3.2209 Tainted: G L syzkaller #0 PREEMPT(full) [ 913.217298][T24881] Tainted: [L]=SOFTLOCKUP [ 913.217308][T24881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 913.217325][T24881] Call Trace: [ 913.217334][T24881] [ 913.217344][T24881] dump_stack_lvl+0x100/0x190 [ 913.217378][T24881] should_fail_ex.cold+0x5/0xa [ 913.217407][T24881] get_futex_key+0x1d2/0x14f0 [ 913.217451][T24881] ? __pfx_get_futex_key+0x10/0x10 [ 913.217501][T24881] futex_wake+0xf4/0x5e0 [ 913.217534][T24881] ? __pfx_futex_wake+0x10/0x10 [ 913.217561][T24881] ? kasan_quarantine_put+0x104/0x240 [ 913.217594][T24881] ? putname+0xb1/0x110 [ 913.217616][T24881] ? kmem_cache_free+0x127/0x6b0 [ 913.217661][T24881] do_futex+0x2b2/0x440 [ 913.217687][T24881] ? __pfx_do_futex+0x10/0x10 [ 913.217709][T24881] ? __pfx_do_sys_openat2+0x10/0x10 [ 913.217742][T24881] ? __fget_files+0x21f/0x3d0 [ 913.217795][T24881] __x64_sys_futex+0x34f/0x4d0 [ 913.217822][T24881] ? __x64_sys_openat+0x12d/0x210 [ 913.217853][T24881] ? __pfx___x64_sys_futex+0x10/0x10 [ 913.217892][T24881] do_syscall_64+0x115/0x840 [ 913.217931][T24881] ? clear_bhb_loop+0x40/0x90 [ 913.217962][T24881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.217988][T24881] RIP: 0033:0x7f72b3d9de59 [ 913.218009][T24881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 913.218035][T24881] RSP: 002b:00007f72b4ba10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 913.218060][T24881] RAX: ffffffffffffffda RBX: 00007f72b4025fa8 RCX: 00007f72b3d9de59 [ 913.218077][T24881] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f72b4025fac [ 913.218093][T24881] RBP: 00007f72b4025fa0 R08: 0000000000000001 R09: 0000000000000000 [ 913.218109][T24881] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 913.218124][T24881] R13: 00007f72b4026038 R14: 00007fff28cb56b0 R15: 00007fff28cb5798 [ 913.218156][T24881] [ 913.749946][T24881] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 914.111864][T14829] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 916.133193][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 918.193188][T25102] sysfs_service_op_store: Client not running :-5: [ 918.203006][T12642] Bluetooth: hci2: command 0x0406 tx timeout [ 918.259084][T25106] sysfs_service_op_show: Client not running :-5: [ 918.591223][T25111] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 918.980610][T25112] zswap: compressor not available [ 919.793230][ T5624] Process accounting resumed [ 920.595359][T12642] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 920.612820][T12642] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 920.623209][T12642] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 920.634636][T12642] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 920.644607][T12642] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 922.245763][T12713] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.700236][T12713] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 922.742038][T12642] Bluetooth: hci4: command tx timeout [ 922.948090][T12713] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 924.425620][T12713] bridge_slave_1: left allmulticast mode [ 924.456250][T12713] bridge_slave_1: left promiscuous mode [ 924.495529][T12713] bridge0: port 2(bridge_slave_1) entered disabled state [ 924.641584][T25404] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 924.712149][T12713] bridge_slave_0: left allmulticast mode [ 924.753301][T12713] bridge_slave_0: left promiscuous mode [ 924.773887][T12713] bridge0: port 1(bridge_slave_0) entered disabled state [ 924.813916][T12642] Bluetooth: hci4: command tx timeout [ 925.572485][T12713] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 925.602181][T12713] bond_slave_1: left promiscuous mode [ 925.619108][T12713] bond0 (unregistering): Released all slaves [ 925.781976][ T5289] 8021q: adding VLAN 0 to HW filter on device eth1 [ 925.889992][T12713] HfR: left promiscuous mode [ 926.281888][T25436] NFSD: Failed to start, no listeners configured. [ 926.629544][T25438] zswap: compressor not available [ 926.881818][T12642] Bluetooth: hci4: command tx timeout [ 927.251989][T25507] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 927.790338][T25163] bridge0: port 1(bridge_slave_0) entered blocking state [ 927.838091][T25163] bridge0: port 1(bridge_slave_0) entered disabled state [ 927.878254][T25163] bridge_slave_0: entered allmulticast mode [ 927.884707][T25563] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2245'. [ 927.931424][T25163] bridge_slave_0: entered promiscuous mode [ 927.990791][T25563] ipvlan1: entered promiscuous mode [ 928.064763][T12712] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 3 with max blocks 3 with error 117 [ 928.080536][T25563] ipvlan1: entered allmulticast mode [ 928.109384][T25563] veth0_vlan: entered allmulticast mode [ 928.140074][T12712] EXT4-fs (sda1): This should not happen!! Data will be lost [ 928.140074][T12712] [ 928.221733][T25163] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.276984][T25163] bridge0: port 2(bridge_slave_1) entered disabled state [ 928.326962][T25163] bridge_slave_1: entered allmulticast mode [ 928.371047][T25163] bridge_slave_1: entered promiscuous mode [ 928.771598][T25163] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 928.861827][T25163] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 928.956317][T12642] Bluetooth: hci4: command tx timeout [ 928.962489][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 928.969337][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 929.202579][T12642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 929.304041][ T5289] 8021q: adding VLAN 0 to HW filter on device eth2 [ 929.366718][T25163] team0: Port device team_slave_0 added [ 929.486610][T25163] team0: Port device team_slave_1 added [ 929.888562][T25163] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 929.933996][T25163] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 930.064167][T25163] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 930.127827][T12713] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 930.157233][T12713] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 930.181170][T12713] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 930.206300][T12713] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 930.275150][T12713] veth1_macvtap: left promiscuous mode [ 930.303860][T25666] netlink: 'syz.3.2251': attribute type 1 has an invalid length. [ 930.317492][T12713] veth0_macvtap: left promiscuous mode [ 930.822000][T12713] team0 (unregistering): Port device team_slave_1 removed [ 930.868507][T12713] team0 (unregistering): Port device team_slave_0 removed [ 931.151066][T25163] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 931.168943][T25163] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 931.240152][T25163] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 931.263313][T14829] Bluetooth: hci1: command 0x0406 tx timeout [ 931.651860][T25720] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2253'. [ 931.676716][T25163] hsr_slave_0: entered promiscuous mode [ 931.702083][T25163] hsr_slave_1: entered promiscuous mode [ 931.709246][T25163] debugfs: 'hsr0' already exists in 'hsr' [ 931.728013][T25163] Cannot create hsr debugfs directory [ 931.740507][ T5289] 8021q: adding VLAN 0 to HW filter on device eth3 [ 931.860486][T12642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 933.332533][T12263] Bluetooth: hci1: command 0x0406 tx timeout [ 934.164744][T25894] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2259'. [ 936.944442][T25163] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 937.007217][T25163] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 937.057081][T25163] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 937.129628][T25163] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 937.195009][T25163] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 937.273989][T25163] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 937.317874][T25163] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 937.419274][T25163] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 938.139045][T26091] NFSD: Failed to start, no listeners configured. [ 938.458861][T25163] 8021q: adding VLAN 0 to HW filter on device bond0 [ 938.529966][T26050] netlink: 334 bytes leftover after parsing attributes in process `syz.3.2264'. [ 938.621716][T25163] 8021q: adding VLAN 0 to HW filter on device team0 [ 938.746229][T26109] NFSD: Failed to start, no listeners configured. [ 938.993278][T12770] bridge0: port 1(bridge_slave_0) entered blocking state [ 939.000513][T12770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 939.145724][T12712] bridge0: port 2(bridge_slave_1) entered blocking state [ 939.152970][T12712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 939.203195][T26122] MTRR 1 not used [ 939.852498][T26150] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 939.908890][T26143] MTRR 1 not used [ 940.251782][T26159] NFSD: Failed to start, no listeners configured. [ 940.882329][T26182] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 941.794724][T26193] NFSD: Failed to start, no listeners configured. [ 941.922698][T25163] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 942.277261][T25163] veth0_vlan: entered promiscuous mode [ 942.304818][T26208] futex_wake_op: syz.2.2279 tries to shift op by -2048; fix this program [ 942.353146][T25163] veth1_vlan: entered promiscuous mode [ 942.538105][T25163] veth0_macvtap: entered promiscuous mode [ 942.600944][T25163] veth1_macvtap: entered promiscuous mode [ 942.719167][T25163] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 942.727274][T14829] Bluetooth: hci1: command 0x0406 tx timeout [ 942.735649][T26175] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 942.788791][T25163] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 942.879698][T12771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.929845][T12771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 942.998844][T12771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 943.053013][T12771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 943.783441][T26175] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 943.820549][T26175] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 943.848142][T26175] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 943.889033][T26175] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 943.909914][T26175] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 943.940248][T26175] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 944.202583][T12771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 944.266535][T12771] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 944.344121][T26257] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 944.711859][T12770] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 944.773184][T12770] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 944.877739][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 945.367835][T26271] netlink: 334 bytes leftover after parsing attributes in process `syz.3.2286'. [ 945.637866][T26320] NFSD: Failed to start, no listeners configured. [ 945.833732][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 945.917470][T14829] Bluetooth: hci4: command 0x0c1a tx timeout [ 945.928929][T26331] zswap: compressor not available [ 945.944778][T26352] futex_wake_op: syz.0.2288 tries to shift op by -2048; fix this program [ 947.376396][T26403] netlink: 334 bytes leftover after parsing attributes in process `syz.1.2293'. [ 947.904695][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 947.982546][T14829] Bluetooth: hci4: command 0x0c1a tx timeout [ 948.457157][T26468] MTRR 1 not used [ 948.533610][T26476] sysfs_service_op_store: Client not running :-5: [ 948.562538][T26476] sysfs_service_op_show: Client not running :-5: [ 948.925150][T14829] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 949.822240][T26521] zswap: compressor not available [ 950.053436][T14829] Bluetooth: hci4: command 0x0c1a tx timeout [ 950.318818][T26560] futex_wake_op: syz.0.2300 tries to shift op by -2048; fix this program [ 950.909466][T26581] NFSD: Failed to start, no listeners configured. [ 951.242471][T26586] zswap: compressor not available [ 952.133838][T14829] Bluetooth: hci4: command 0x0c1a tx timeout [ 952.145138][T26639] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 3 with max blocks 1 with error 117 [ 952.315875][T26639] EXT4-fs (sda1): This should not happen!! Data will be lost [ 952.315875][T26639] [ 952.765529][T26655] sysfs_service_op_store: Client not running :-5: [ 952.812595][T26655] sysfs_service_op_show: Client not running :-5: [ 953.109642][T26666] snd_virmidi snd_virmidi.0: control 53842:9:2:y:9 is already present [ 953.671520][T26662] zswap: compressor not available [ 954.193409][T12263] Bluetooth: hci4: command 0x0c1a tx timeout [ 954.818125][T14829] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 954.843150][T14829] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 954.856455][T14829] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 954.867078][T14829] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 954.883166][T14829] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 955.143206][T26673] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 955.200237][T12263] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 955.409148][T12770] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 955.812656][T12770] bridge0: port 3(netdevsim3) entered disabled state [ 955.927523][T12770] netdevsim netdevsim2 netdevsim3 (unregistering): left allmulticast mode [ 955.960998][T12770] netdevsim netdevsim2 netdevsim3 (unregistering): left promiscuous mode [ 955.991780][T12770] bridge0: port 3(netdevsim3) entered disabled state [ 956.099528][T12770] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.423768][T12770] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.619782][T12770] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.888471][T12770] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 956.982891][T12263] Bluetooth: hci1: command tx timeout [ 957.057386][T26800] futex_wake_op: syz.0.2316 tries to shift op by -2048; fix this program [ 957.114387][T26800] 0x000000000001-0x000000020000 : "" [ 957.164341][T26800] ftl_cs: FTL header corrupt! [ 957.220353][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 958.206401][T12770] team0: left allmulticast mode [ 958.232606][T12770] team_slave_0: left allmulticast mode [ 958.259281][T12770] team_slave_1: left allmulticast mode [ 958.309869][T26871] MTRR 1 not used [ 958.321658][T12770] team0: left promiscuous mode [ 958.346849][T12770] team_slave_0: left promiscuous mode [ 958.370683][T12770] team_slave_1: left promiscuous mode [ 958.400186][T12770] bridge0: port 4(team0) entered disabled state [ 958.446421][T12770] bridge_slave_1: left allmulticast mode [ 958.471985][T12770] bridge_slave_1: left promiscuous mode [ 958.500173][T12770] bridge0: port 2(bridge_slave_1) entered disabled state [ 958.547761][T12770] bridge_slave_0: left allmulticast mode [ 958.588277][T12770] bridge_slave_0: left promiscuous mode [ 958.617032][T12770] bridge0: port 1(bridge_slave_0) entered disabled state [ 959.050809][T14829] Bluetooth: hci1: command tx timeout [ 959.184141][T12770] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 959.225145][T12770] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 959.256531][T12770] bond0 (unregistering): Released all slaves [ 959.289750][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 959.459239][T12770] HfR: left promiscuous mode [ 960.452817][ T5289] 8021q: adding VLAN 0 to HW filter on device eth1 [ 960.821440][T26936] netlink: 334 bytes leftover after parsing attributes in process `syz.3.2327'. [ 960.875553][T26933] netlink: 334 bytes leftover after parsing attributes in process `syz.0.2326'. [ 961.120966][T12263] Bluetooth: hci1: command tx timeout [ 961.234617][T26719] bridge0: port 1(bridge_slave_0) entered blocking state [ 961.252546][T26719] bridge0: port 1(bridge_slave_0) entered disabled state [ 961.278259][T26719] bridge_slave_0: entered allmulticast mode [ 961.311039][T26719] bridge_slave_0: entered promiscuous mode [ 961.552691][T27055] NFSD: Failed to start, no listeners configured. [ 961.582568][T26719] bridge0: port 2(bridge_slave_1) entered blocking state [ 961.600416][T26719] bridge0: port 2(bridge_slave_1) entered disabled state [ 961.622293][T26719] bridge_slave_1: entered allmulticast mode [ 961.649974][T26719] bridge_slave_1: entered promiscuous mode [ 961.934075][T26719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 962.004182][T12770] hsr_slave_0: left promiscuous mode [ 962.044659][T12770] hsr_slave_1: left promiscuous mode [ 962.079079][T12770] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 962.132886][T12770] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 962.175135][T12770] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 962.217030][T12770] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 962.260525][T12263] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 962.275971][T14829] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 962.319190][T12770] veth1_vlan: left promiscuous mode [ 962.354302][T12770] veth0_vlan: left promiscuous mode [ 963.191031][T27120] Bluetooth: hci1: command tx timeout [ 963.298786][T12770] team0 (unregistering): Port device team_slave_1 removed [ 963.334714][T27120] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 963.388124][T12770] team0 (unregistering): Port device team_slave_0 removed [ 963.662679][T27141] random: crng reseeded on system resumption [ 963.956324][T27141] hub 1-0:1.0: USB hub found [ 963.983895][T27141] hub 1-0:1.0: 1 port detected [ 964.010744][T26719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 964.160962][ T5289] 8021q: adding VLAN 0 to HW filter on device eth2 [ 964.303285][T26719] team0: Port device team_slave_0 added [ 964.313249][T27136] Bluetooth: hci4: command 0x0c1a tx timeout [ 964.319864][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 964.386076][T26719] team0: Port device team_slave_1 added [ 964.578765][T26719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 964.632391][T26719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 964.766800][T26719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 964.834534][T26719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 964.859602][T26719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 964.981671][T26719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 965.027597][T27180] netlink: 334 bytes leftover after parsing attributes in process `syz.3.2336'. [ 965.420605][T27169] Bluetooth: hci3: command 0x0406 tx timeout [ 965.453915][T26719] hsr_slave_0: entered promiscuous mode [ 965.477581][T26719] hsr_slave_1: entered promiscuous mode [ 966.071028][T27271] MTRR 1 not used [ 966.366685][T27328] futex_wake_op: syz.3.2342 tries to shift op by -2048; fix this program [ 966.376916][T27120] Bluetooth: hci0: command 0x0c1a tx timeout [ 966.382996][T27169] Bluetooth: hci4: command 0x0c1a tx timeout [ 966.447889][T14829] Bluetooth: hci4: unexpected subevent 0x01 length: 123 > 18 [ 966.478934][T27342] 0x000000000001-0x000000020000 : "" [ 966.567208][T27342] ftl_cs: FTL header corrupt! [ 967.454167][ T5289] 8021q: adding VLAN 0 to HW filter on device eth3 [ 967.490913][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 967.777223][T27391] FAULT_INJECTION: forcing a failure. [ 967.777223][T27391] name failslab, interval 1, probability 0, space 0, times 0 [ 967.834305][T27391] CPU: 0 UID: 0 PID: 27391 Comm: syz.3.2348 Tainted: G L syzkaller #0 PREEMPT(full) [ 967.834348][T27391] Tainted: [L]=SOFTLOCKUP [ 967.834357][T27391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 967.834373][T27391] Call Trace: [ 967.834382][T27391] [ 967.834392][T27391] dump_stack_lvl+0x100/0x190 [ 967.834425][T27391] should_fail_ex.cold+0x5/0xa [ 967.834454][T27391] should_failslab+0xc2/0x120 [ 967.834487][T27391] __kmalloc_cache_noprof+0x91/0x6c0 [ 967.834530][T27391] ? open_kcore+0xa9/0x250 [ 967.834561][T27391] open_kcore+0xa9/0x250 [ 967.834584][T27391] ? __pfx_open_kcore+0x10/0x10 [ 967.834618][T27391] proc_reg_open+0x137/0x5f0 [ 967.834659][T27391] do_dentry_open+0x6ab/0x14d0 [ 967.834699][T27391] ? __pfx_proc_reg_open+0x10/0x10 [ 967.834747][T27391] vfs_open+0x82/0x3f0 [ 967.834780][T27391] path_openat+0x2873/0x4280 [ 967.834833][T27391] ? __pfx_path_openat+0x10/0x10 [ 967.834881][T27391] do_file_open+0x20e/0x430 [ 967.834924][T27391] ? __pfx_do_file_open+0x10/0x10 [ 967.834990][T27391] ? alloc_fd+0x471/0x7a0 [ 967.835041][T27391] ? do_getname+0x191/0x390 [ 967.835073][T27391] do_sys_openat2+0x10f/0x1e0 [ 967.835109][T27391] ? __pfx_do_sys_openat2+0x10/0x10 [ 967.835141][T27391] ? __fget_files+0x21f/0x3d0 [ 967.835185][T27391] __x64_sys_openat+0x12d/0x210 [ 967.835216][T27391] ? __pfx___x64_sys_openat+0x10/0x10 [ 967.835258][T27391] do_syscall_64+0x115/0x840 [ 967.835297][T27391] ? clear_bhb_loop+0x40/0x90 [ 967.835329][T27391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.835355][T27391] RIP: 0033:0x7f72b3d9de59 [ 967.835377][T27391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.835402][T27391] RSP: 002b:00007f72b4ba1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 967.835427][T27391] RAX: ffffffffffffffda RBX: 00007f72b4025fa0 RCX: 00007f72b3d9de59 [ 967.835444][T27391] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 967.835461][T27391] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 967.835477][T27391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 967.835493][T27391] R13: 00007f72b4026038 R14: 00007f72b4025fa0 R15: 00007fff28cb5798 [ 967.835524][T27391] [ 968.538649][T14829] Bluetooth: hci4: command 0x0c1a tx timeout [ 970.266519][T27506] netlink: 334 bytes leftover after parsing attributes in process `syz.1.2351'. [ 970.597461][T27136] Bluetooth: hci4: command 0x0c1a tx timeout [ 970.803123][T26719] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 970.853170][T26719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 970.891373][T26719] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 970.958366][T26719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 971.014302][T26719] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 971.058389][T26719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 971.118608][T26719] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 971.179573][T26719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 971.562222][T27591] MTRR 1 not used [ 971.629529][T26719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 971.766118][T26719] 8021q: adding VLAN 0 to HW filter on device team0 [ 971.923944][T12770] bridge0: port 1(bridge_slave_0) entered blocking state [ 971.931193][T12770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 972.061546][T12771] bridge0: port 2(bridge_slave_1) entered blocking state [ 972.068819][T12771] bridge0: port 2(bridge_slave_1) entered forwarding state [ 972.962149][T27633] MTRR 1 not used [ 973.288902][T27661] NFSD: Failed to start, no listeners configured. [ 973.726473][T27668] zswap: compressor not available [ 974.438629][T27736] sysfs_service_op_store: Client not running :-5: [ 974.482026][T27736] sysfs_service_op_show: Client not running :-5: [ 975.130596][T27749] zswap: compressor not available [ 975.784530][T26719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 976.045140][T26719] veth0_vlan: entered promiscuous mode [ 976.156565][T26719] veth1_vlan: entered promiscuous mode [ 976.237323][T27853] random: crng reseeded on system resumption [ 976.320691][T26719] veth0_macvtap: entered promiscuous mode [ 976.382803][T26719] veth1_macvtap: entered promiscuous mode [ 976.493202][T26719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 976.582321][T26719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 976.674825][T12712] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 976.786658][T12712] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 976.840793][T12712] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 976.904141][T12712] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 977.440014][T12769] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 977.502869][T12769] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 977.651311][T12769] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 977.699147][T12769] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 978.074833][T27912] sysfs_service_op_store: Client not running :-5: [ 978.123017][T27912] sysfs_service_op_show: Client not running :-5: [ 978.828744][T27923] zswap: compressor not available [ 979.227143][T27911] kexec: Could not allocate control_code_buffer [ 980.058580][T28003] FAULT_INJECTION: forcing a failure. [ 980.058580][T28003] name failslab, interval 1, probability 0, space 0, times 0 [ 980.166359][T28003] CPU: 0 UID: 0 PID: 28003 Comm: syz.3.2380 Tainted: G L syzkaller #0 PREEMPT(full) [ 980.166402][T28003] Tainted: [L]=SOFTLOCKUP [ 980.166411][T28003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 980.166428][T28003] Call Trace: [ 980.166437][T28003] [ 980.166447][T28003] dump_stack_lvl+0x100/0x190 [ 980.166480][T28003] should_fail_ex.cold+0x5/0xa [ 980.166508][T28003] should_failslab+0xc2/0x120 [ 980.166541][T28003] __kmalloc_cache_noprof+0x91/0x6c0 [ 980.166583][T28003] ? open_kcore+0xa9/0x250 [ 980.166613][T28003] open_kcore+0xa9/0x250 [ 980.166636][T28003] ? __pfx_open_kcore+0x10/0x10 [ 980.166662][T28003] proc_reg_open+0x137/0x5f0 [ 980.166703][T28003] do_dentry_open+0x6ab/0x14d0 [ 980.166747][T28003] ? __pfx_proc_reg_open+0x10/0x10 [ 980.166794][T28003] vfs_open+0x82/0x3f0 [ 980.166826][T28003] path_openat+0x2873/0x4280 [ 980.166878][T28003] ? __pfx_path_openat+0x10/0x10 [ 980.166926][T28003] do_file_open+0x20e/0x430 [ 980.166968][T28003] ? __pfx_do_file_open+0x10/0x10 [ 980.167029][T28003] ? alloc_fd+0x471/0x7a0 [ 980.167070][T28003] ? do_getname+0x191/0x390 [ 980.167101][T28003] do_sys_openat2+0x10f/0x1e0 [ 980.167132][T28003] ? __pfx_do_sys_openat2+0x10/0x10 [ 980.167165][T28003] ? __fget_files+0x21f/0x3d0 [ 980.167209][T28003] __x64_sys_openat+0x12d/0x210 [ 980.167249][T28003] ? __pfx___x64_sys_openat+0x10/0x10 [ 980.167291][T28003] do_syscall_64+0x115/0x840 [ 980.167332][T28003] ? clear_bhb_loop+0x40/0x90 [ 980.167363][T28003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 980.167390][T28003] RIP: 0033:0x7f72b3d9de59 [ 980.167412][T28003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 980.167437][T28003] RSP: 002b:00007f72b4ba1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 980.167461][T28003] RAX: ffffffffffffffda RBX: 00007f72b4025fa0 RCX: 00007f72b3d9de59 [ 980.167478][T28003] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 980.167495][T28003] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 980.167511][T28003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 980.167527][T28003] R13: 00007f72b4026038 R14: 00007f72b4025fa0 R15: 00007fff28cb5798 [ 980.167560][T28003] [ 980.818159][T28011] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 981.110495][T27136] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 981.204001][T27136] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 981.250575][T27136] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 981.354573][T27136] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 981.392591][T27136] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 981.841839][T12712] bridge0: port 3(netdevsim3) entered disabled state [ 982.067119][T12712] netdevsim netdevsim1 netdevsim3 (unregistering): left allmulticast mode [ 982.110574][T12712] netdevsim netdevsim1 netdevsim3 (unregistering): left promiscuous mode [ 982.151064][T12712] bridge0: port 3(netdevsim3) entered disabled state [ 982.325154][T12712] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.790798][T12712] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.101165][T12712] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.197281][T28077] sysfs_service_op_store: Client not running :-5: [ 983.213868][T28077] sysfs_service_op_show: Client not running :-5: [ 983.575424][T27136] Bluetooth: hci2: command tx timeout [ 983.610970][T28081] zswap: compressor not available [ 983.882167][T12712] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.546884][T28250] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 985.648396][T27136] Bluetooth: hci2: command tx timeout [ 985.968084][T28012] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.015405][T28012] bridge0: port 1(bridge_slave_0) entered disabled state [ 986.054907][T28012] bridge_slave_0: entered allmulticast mode [ 986.106576][T28012] bridge_slave_0: entered promiscuous mode [ 986.145560][T28012] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.171334][T28012] bridge0: port 2(bridge_slave_1) entered disabled state [ 986.210602][T28012] bridge_slave_1: entered allmulticast mode [ 986.238552][T28012] bridge_slave_1: entered promiscuous mode [ 986.397892][T28308] random: crng reseeded on system resumption [ 986.417363][T28012] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 986.459753][T28012] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 986.625083][T28012] team0: Port device team_slave_0 added [ 986.649816][T28012] team0: Port device team_slave_1 added [ 986.688918][T28344] futex_wake_op: syz.2.2393 tries to shift op by -2048; fix this program [ 986.729545][T28344] 0x000000000001-0x000000020000 : "" [ 986.798707][T28012] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 986.809734][T28344] ftl_cs: FTL header corrupt! [ 986.842441][T28012] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 986.965734][T28012] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 987.047869][T28012] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 987.081118][T28012] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 987.141702][T28368] MTRR 1 not used [ 987.165298][T28012] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 987.222781][T27136] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 987.450620][T28012] hsr_slave_0: entered promiscuous mode [ 987.479348][T28012] hsr_slave_1: entered promiscuous mode [ 987.501343][T28012] debugfs: 'hsr0' already exists in 'hsr' [ 987.516543][T28012] Cannot create hsr debugfs directory [ 987.717232][T27136] Bluetooth: hci2: command tx timeout [ 988.027354][T12770] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 3 with max blocks 3 with error 117 [ 988.059247][T12770] EXT4-fs (sda1): This should not happen!! Data will be lost [ 988.059247][T12770] [ 988.420972][T28483] MTRR 1 not used [ 988.910021][T28503] MTRR 1 not used [ 989.308990][T14829] Bluetooth: hci1: command 0x2016 tx timeout [ 989.787110][T27136] Bluetooth: hci2: command tx timeout [ 990.108654][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 990.119345][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 991.178891][T28577] input: f as /devices/virtual/input/input18 [ 991.399245][T27136] Bluetooth: hci1: command 0x2016 tx timeout [ 991.604613][T28604] futex_wake_op: syz.2.2404 tries to shift op by -2048; fix this program [ 991.615080][T28604] 0x000000000001-0x000000020000 : "" [ 991.634605][T28604] ftl_cs: FTL header corrupt! [ 994.748848][T28742] netlink: 334 bytes leftover after parsing attributes in process `syz.2.2408'. [ 995.930856][T28779] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 998.230686][T14829] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 998.323348][T27120] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 998.343168][T27120] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 998.355214][T27120] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 998.363323][T27120] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 998.375075][T27120] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1000.302124][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1000.456584][T27120] Bluetooth: hci3: command tx timeout [ 1000.562701][T28834] bridge0: port 1(bridge_slave_0) entered blocking state [ 1000.588048][T28834] bridge0: port 1(bridge_slave_0) entered disabled state [ 1000.611129][T28834] bridge_slave_0: entered allmulticast mode [ 1000.640995][T28834] bridge_slave_0: entered promiscuous mode [ 1000.665870][T28834] bridge0: port 2(bridge_slave_1) entered blocking state [ 1000.690880][T28834] bridge0: port 2(bridge_slave_1) entered disabled state [ 1000.718559][T28834] bridge_slave_1: entered allmulticast mode [ 1000.756564][T28834] bridge_slave_1: entered promiscuous mode [ 1000.890243][T28834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1000.931123][T28834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1001.066333][T28834] team0: Port device team_slave_0 added [ 1001.106537][T28834] team0: Port device team_slave_1 added [ 1001.241113][T28834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1001.250475][T28834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1001.278355][T28834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1001.307445][T28834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1001.315907][T28834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1001.346439][T28834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1001.623320][T28834] hsr_slave_0: entered promiscuous mode [ 1001.641604][T28834] hsr_slave_1: entered promiscuous mode [ 1001.651242][T28834] debugfs: 'hsr0' already exists in 'hsr' [ 1001.666817][T28834] Cannot create hsr debugfs directory [ 1002.370089][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1002.526924][T27120] Bluetooth: hci3: command tx timeout [ 1004.596663][T27120] Bluetooth: hci3: command tx timeout [ 1004.615327][T29204] vhci_hcd vhci_hcd.0: invalid port number 182 [ 1004.649254][T29204] vhci_hcd vhci_hcd.0: default hub control req: a0b9 vc7c7 i00b6 l0 [ 1004.691908][ T30] audit: type=1800 audit(4294967445.985:24): pid=29215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2426" name="SYSV00000008" dev="tmpfs" ino=0 res=0 errno=0 [ 1005.507513][T29228] netlink: 334 bytes leftover after parsing attributes in process `syz.2.2427'. [ 1005.837102][T29260] NFSD: Failed to start, no listeners configured. [ 1006.113372][T29267] zswap: compressor not available [ 1006.337342][T29279] sysfs_service_op_store: Client not running :-5: [ 1006.362910][T29279] sysfs_service_op_show: Client not running :-5: [ 1006.670147][T27120] Bluetooth: hci3: command tx timeout [ 1006.842624][T29290] zswap: compressor not available [ 1008.175909][T29360] ubi0: attaching mtd0 [ 1008.198062][T29360] ubi0: scanning is finished [ 1008.221833][T29360] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 1008.451665][T29360] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 1008.607644][T29328] futex_wake_op: syz.3.2431 tries to shift op by -2048; fix this program [ 1008.709744][T29366] could not allocate digest TFM handle [ 1008.742995][T29328] futex_wake_op: syz.3.2431 tries to shift op by -2048; fix this program [ 1008.801511][T29362] 0x000000000001-0x000000020000 : "" [ 1008.988744][T29362] ftl_cs: FTL header corrupt! [ 1009.117254][T29383] FAULT_INJECTION: forcing a failure. [ 1009.117254][T29383] name failslab, interval 1, probability 0, space 0, times 0 [ 1009.173502][T29383] CPU: 0 UID: 0 PID: 29383 Comm: syz.2.2434 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.173544][T29383] Tainted: [L]=SOFTLOCKUP [ 1009.173553][T29383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1009.173570][T29383] Call Trace: [ 1009.173579][T29383] [ 1009.173596][T29383] dump_stack_lvl+0x100/0x190 [ 1009.173630][T29383] should_fail_ex.cold+0x5/0xa [ 1009.173659][T29383] should_failslab+0xc2/0x120 [ 1009.173693][T29383] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 1009.173724][T29383] ? proc_alloc_inode+0x25/0x200 [ 1009.173764][T29383] ? __pfx_proc_alloc_inode+0x10/0x10 [ 1009.173803][T29383] proc_alloc_inode+0x25/0x200 [ 1009.173839][T29383] alloc_inode+0x68/0x250 [ 1009.173870][T29383] new_inode+0x22/0x1c0 [ 1009.173901][T29383] proc_get_inode+0x1d/0x780 [ 1009.173941][T29383] proc_lookup_de+0x236/0x360 [ 1009.173986][T29383] proc_lookup+0xd8/0x110 [ 1009.174028][T29383] ? __pfx_proc_root_lookup+0x10/0x10 [ 1009.174068][T29383] proc_root_lookup+0x3b/0x70 [ 1009.174106][T29383] ? __pfx_proc_root_lookup+0x10/0x10 [ 1009.174147][T29383] path_openat+0x241f/0x4280 [ 1009.174200][T29383] ? __pfx_path_openat+0x10/0x10 [ 1009.174248][T29383] do_file_open+0x20e/0x430 [ 1009.174291][T29383] ? __pfx_do_file_open+0x10/0x10 [ 1009.174353][T29383] ? alloc_fd+0x471/0x7a0 [ 1009.174394][T29383] ? do_getname+0x191/0x390 [ 1009.174426][T29383] do_sys_openat2+0x10f/0x1e0 [ 1009.174457][T29383] ? __pfx_do_sys_openat2+0x10/0x10 [ 1009.174490][T29383] ? __fget_files+0x21f/0x3d0 [ 1009.174533][T29383] __x64_sys_openat+0x12d/0x210 [ 1009.174565][T29383] ? __pfx___x64_sys_openat+0x10/0x10 [ 1009.174615][T29383] do_syscall_64+0x115/0x840 [ 1009.174657][T29383] ? clear_bhb_loop+0x40/0x90 [ 1009.174689][T29383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.174716][T29383] RIP: 0033:0x7fb6c6d9de59 [ 1009.174737][T29383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1009.174762][T29383] RSP: 002b:00007fb6c7c9c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1009.174786][T29383] RAX: ffffffffffffffda RBX: 00007fb6c7025fa0 RCX: 00007fb6c6d9de59 [ 1009.174803][T29383] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 1009.174819][T29383] RBP: 00007fb6c6e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 1009.174836][T29383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1009.174851][T29383] R13: 00007fb6c7026038 R14: 00007fb6c7025fa0 R15: 00007ffc541fa278 [ 1009.174884][T29383] [ 1009.658743][T29362] syz.3.2431 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1009.669003][T29362] CPU: 0 UID: 0 PID: 29362 Comm: syz.3.2431 Tainted: G L syzkaller #0 PREEMPT(full) [ 1009.669042][T29362] Tainted: [L]=SOFTLOCKUP [ 1009.669051][T29362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1009.669066][T29362] Call Trace: [ 1009.669076][T29362] [ 1009.669086][T29362] dump_stack_lvl+0x100/0x190 [ 1009.669123][T29362] dump_header+0xfb/0x606 [ 1009.669152][T29362] oom_kill_process.cold+0xd/0x330 [ 1009.669182][T29362] out_of_memory+0x340/0x14f0 [ 1009.669238][T29362] ? __pfx_out_of_memory+0x10/0x10 [ 1009.669283][T29362] mem_cgroup_out_of_memory+0xc6/0x130 [ 1009.669325][T29362] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1009.669365][T29362] ? find_held_lock+0x2b/0x80 [ 1009.669399][T29362] ? do_raw_spin_unlock+0x145/0x1e0 [ 1009.669424][T29362] ? _raw_spin_unlock+0x28/0x50 [ 1009.669461][T29362] try_charge_memcg+0x6e5/0xdf0 [ 1009.669501][T29362] ? __pfx_try_charge_memcg+0x10/0x10 [ 1009.669539][T29362] ? find_held_lock+0x2b/0x80 [ 1009.669565][T29362] ? rcu_read_unlock+0x17/0x60 [ 1009.669598][T29362] ? rcu_read_unlock+0x17/0x60 [ 1009.669642][T29362] __memcg_slab_post_alloc_hook+0x469/0x1160 [ 1009.669687][T29362] ? kasan_save_track+0x14/0x30 [ 1009.669718][T29362] kmem_cache_alloc_lru_noprof+0x583/0x6a0 [ 1009.669747][T29362] ? start_dirop+0x79/0xb0 [ 1009.669782][T29362] ? alloc_inode+0x68/0x250 [ 1009.669812][T29362] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 1009.669911][T29362] alloc_inode+0x68/0x250 [ 1009.669940][T29362] new_inode+0x22/0x1c0 [ 1009.669971][T29362] __debugfs_create_file+0x105/0x4f0 [ 1009.670007][T29362] debugfs_create_file_full+0x41/0x60 [ 1009.670042][T29362] debugfs_create_files+0x108/0x2c0 [ 1009.670130][T29362] blk_mq_debugfs_register_hctx+0x194/0x440 [ 1009.670157][T29362] ? dput.part.0+0x4f/0x240 [ 1009.670188][T29362] ? __pfx_blk_mq_debugfs_register_hctx+0x10/0x10 [ 1009.670218][T29362] ? find_held_lock+0x2b/0x80 [ 1009.670245][T29362] ? queue_hctx+0xe4/0x2a0 [ 1009.670281][T29362] ? queue_hctx+0xe4/0x2a0 [ 1009.670326][T29362] blk_mq_debugfs_register+0x13b/0x190 [ 1009.670356][T29362] blk_register_queue+0x1f1/0x630 [ 1009.670411][T29362] __add_disk+0x73f/0xe40 [ 1009.670459][T29362] add_disk_fwnode+0x118/0x5c0 [ 1009.670488][T29362] add_mtd_blktrans_dev+0xd0b/0x1520 [ 1009.670556][T29362] ? __pfx_add_mtd_blktrans_dev+0x10/0x10 [ 1009.670614][T29362] ? __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1009.670655][T29362] ? mtdblock_add_mtd+0x4a/0x270 [ 1009.670698][T29362] mtdblock_add_mtd+0x1cc/0x270 [ 1009.670738][T29362] blktrans_notify_add+0xa2/0xf0 [ 1009.670775][T29362] add_mtd_device+0xb1a/0x17a0 [ 1009.670817][T29362] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1009.670858][T29362] ? __pfx_add_mtd_device+0x10/0x10 [ 1009.670895][T29362] mtd_add_partition+0x30a/0x660 [ 1009.670931][T29362] ? __pfx_mtd_add_partition+0x10/0x10 [ 1009.670963][T29362] ? __might_fault+0xc5/0x140 [ 1009.671001][T29362] ? __might_fault+0xc5/0x140 [ 1009.671052][T29362] mtdchar_blkpg_ioctl+0x207/0x250 [ 1009.671087][T29362] ? __pfx_mtdchar_blkpg_ioctl+0x10/0x10 [ 1009.671153][T29362] mtdchar_ioctl+0x1670/0x1fd0 [ 1009.671193][T29362] ? __pfx_mtdchar_ioctl+0x10/0x10 [ 1009.671230][T29362] ? lock_acquire+0x1b9/0x370 [ 1009.671275][T29362] ? trace_contention_end+0x126/0x160 [ 1009.671318][T29362] ? mtdchar_unlocked_ioctl+0xa2/0xf0 [ 1009.671356][T29362] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1009.671391][T29362] ? __pfx___mutex_lock+0x10/0x10 [ 1009.671436][T29362] ? find_held_lock+0x2b/0x80 [ 1009.671479][T29362] mtdchar_unlocked_ioctl+0xb0/0xf0 [ 1009.671515][T29362] ? __pfx_mtdchar_unlocked_ioctl+0x10/0x10 [ 1009.671554][T29362] __x64_sys_ioctl+0x18e/0x210 [ 1009.671588][T29362] do_syscall_64+0x115/0x840 [ 1009.671627][T29362] ? clear_bhb_loop+0x40/0x90 [ 1009.671657][T29362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1009.671683][T29362] RIP: 0033:0x7f72b3d9de59 [ 1009.671706][T29362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1009.671730][T29362] RSP: 002b:00007f72b4b80028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1009.671753][T29362] RAX: ffffffffffffffda RBX: 00007f72b4026090 RCX: 00007f72b3d9de59 [ 1009.671769][T29362] RDX: 0000000000000000 RSI: 0000000000001269 RDI: 0000000000000006 [ 1009.671784][T29362] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 1009.671799][T29362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1009.671813][T29362] R13: 00007f72b4026128 R14: 00007f72b4026090 R15: 00007fff28cb5798 [ 1009.671847][T29362] [ 1010.598582][T29404] MTRR 1 not used [ 1010.834348][T29362] memory: usage 3036kB, limit 3072kB, failcnt 12026 [ 1010.866063][T29362] memory+swap: usage 7308kB, limit 9007199254740988kB, failcnt 0 [ 1010.902219][T29362] kmem: usage 2596kB, limit 9007199254740988kB, failcnt 0 [ 1010.928630][T29362] Memory cgroup stats for /syz3: [ 1010.928930][T29362] cache 311296 [ 1010.962765][T29362] rss 16384 [ 1010.988962][T29362] rss_huge 0 [ 1011.000341][T29362] shmem 0 [ 1011.013172][T29362] mapped_file 0 [ 1011.025015][T29362] dirty 16384 [ 1011.044513][T29362] writeback 0 [ 1011.058341][T29362] workingset_refault_anon 4756 [ 1011.079243][T29362] workingset_refault_file 16093 [ 1011.094605][T29362] swap 4374528 [ 1011.107499][T29362] swapcached 48496640 [ 1011.121195][T29362] pgpgin 455962 [ 1011.132516][T29362] pgpgout 494469 [ 1011.148260][T29362] pgfault 371988 [ 1011.163989][T29362] pgmajfault 1933 [ 1011.177616][T29362] inactive_anon 32768 [ 1011.193847][T29362] active_anon 0 [ 1011.204363][T29362] inactive_file 307200 [ 1011.230129][T29362] active_file 4096 [ 1011.239626][T29362] unevictable 0 [ 1011.248578][T29362] hierarchical_memory_limit 3145728 [ 1011.262671][T29362] hierarchical_memsw_limit 9223372036854771712 [ 1011.277379][T29362] total_cache 311296 [ 1011.286749][T29362] total_rss 16384 [ 1011.310954][T29362] total_rss_huge 0 [ 1011.319956][T29362] total_shmem 0 [ 1011.339775][T29362] total_mapped_file 0 [ 1011.350514][T29362] total_dirty 16384 [ 1011.364108][T29362] total_writeback 0 [ 1011.381713][T29362] total_workingset_refault_anon 4756 [ 1011.415790][T29362] total_workingset_refault_file 16093 [ 1011.434982][T29362] total_swap 4374528 [ 1011.453260][T29362] total_swapcached 48496640 [ 1011.473039][T29362] total_pgpgin 455962 [ 1011.494462][T29362] total_pgpgout 494469 [ 1011.500092][T27120] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 1011.523200][T29362] total_pgfault 371988 [ 1011.541196][T29362] total_pgmajfault 1933 [ 1011.556080][T29362] total_inactive_anon 32768 [ 1011.570842][T29362] total_active_anon 0 [ 1011.588722][T29362] total_inactive_file 307200 [ 1011.608924][T29362] total_active_file 4096 [ 1011.622151][T29362] total_unevictable 0 [ 1011.640419][T29362] anon_cost 256 [ 1011.658124][T29362] file_cost 18 [ 1011.675491][T29362] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.2431,pid=29326,uid=0 [ 1011.757985][T29362] Memory cgroup out of memory: Killed process 29362 (syz.3.2431) total-vm:137384kB, anon-rss:3224kB, file-rss:22680kB, shmem-rss:0kB, UID:0 pgtables:164kB oom_score_adj:1000 [ 1013.055761][T29441] netlink: 334 bytes leftover after parsing attributes in process `syz.2.2438'. [ 1013.514874][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1013.798911][T29479] zswap: compressor not available [ 1015.586388][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1015.768999][T29434] FAULT_INJECTION: forcing a failure. [ 1015.768999][T29434] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1015.803036][T29434] CPU: 0 UID: 0 PID: 29434 Comm: syz.3.2437 Tainted: G L syzkaller #0 PREEMPT(full) [ 1015.803077][T29434] Tainted: [L]=SOFTLOCKUP [ 1015.803087][T29434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1015.803104][T29434] Call Trace: [ 1015.803114][T29434] [ 1015.803124][T29434] dump_stack_lvl+0x100/0x190 [ 1015.803160][T29434] should_fail_ex.cold+0x5/0xa [ 1015.803185][T29434] ? prepare_alloc_pages+0x16d/0x5f0 [ 1015.803223][T29434] should_fail_alloc_page+0xeb/0x140 [ 1015.803259][T29434] prepare_alloc_pages+0x1f0/0x5f0 [ 1015.803295][T29434] ? __pfx_stack_trace_save+0x10/0x10 [ 1015.803332][T29434] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 1015.803362][T29434] ? zswap_entry_free+0x38e/0x640 [ 1015.803399][T29434] ? kasan_save_stack+0x3f/0x50 [ 1015.803427][T29434] ? kasan_save_stack+0x30/0x50 [ 1015.803454][T29434] ? kasan_save_track+0x14/0x30 [ 1015.803482][T29434] ? __kasan_slab_free+0x5f/0x80 [ 1015.803517][T29434] ? __lock_acquire+0x49f/0x1a40 [ 1015.803554][T29434] ? __css_rstat_updated+0x1ce/0x5a0 [ 1015.803593][T29434] ? __pfx___css_rstat_updated+0x10/0x10 [ 1015.803632][T29434] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1015.803666][T29434] ? __asan_memset+0x23/0x50 [ 1015.803690][T29434] ? folios_put_refs+0x58a/0xaa0 [ 1015.803737][T29434] ? find_held_lock+0x2b/0x80 [ 1015.803764][T29434] ? folio_batch_move_lru+0x37c/0xc00 [ 1015.803808][T29434] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1015.803861][T29434] ? policy_nodemask+0xed/0x4f0 [ 1015.803900][T29434] alloc_pages_mpol+0x1fb/0x540 [ 1015.803935][T29434] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1015.803978][T29434] ? do_raw_spin_lock+0x128/0x260 [ 1015.804056][T29434] ? find_held_lock+0x2b/0x80 [ 1015.804087][T29434] ? swap_cache_alloc_folio+0x374/0xc50 [ 1015.804117][T29434] folio_alloc_mpol_noprof+0x36/0x260 [ 1015.804159][T29434] swap_cache_alloc_folio+0x3d7/0xc50 [ 1015.804231][T29434] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 1015.804258][T29434] ? swap_cache_get_folio+0x28d/0x360 [ 1015.804302][T29434] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 1015.804345][T29434] ? find_held_lock+0x2b/0x80 [ 1015.804375][T29434] ? mlock_drain_local+0x254/0x4e0 [ 1015.804399][T29434] ? mlock_drain_local+0x254/0x4e0 [ 1015.804427][T29434] swap_cache_read_folio+0x47/0x140 [ 1015.804456][T29434] swap_cluster_readahead+0x387/0x5f0 [ 1015.804488][T29434] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 1015.804531][T29434] ? __lock_acquire+0x49f/0x1a40 [ 1015.804568][T29434] ? get_vma_policy+0x23d/0x3b0 [ 1015.804606][T29434] swapin_readahead+0x159/0x1200 [ 1015.804641][T29434] ? __pfx_swapin_readahead+0x10/0x10 [ 1015.804673][T29434] ? swap_table_get+0x10d/0x2c0 [ 1015.804714][T29434] ? swap_cache_get_folio+0x28d/0x360 [ 1015.804757][T29434] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 1015.804799][T29434] ? __pfx_softleaf_type+0x10/0x10 [ 1015.804830][T29434] ? do_swap_page+0xf98/0x5780 [ 1015.804867][T29434] do_swap_page+0xf98/0x5780 [ 1015.804919][T29434] ? __pfx_do_swap_page+0x10/0x10 [ 1015.804959][T29434] ? __lock_acquire+0x49f/0x1a40 [ 1015.804995][T29434] ? find_held_lock+0x2b/0x80 [ 1015.805031][T29434] ? rcu_is_watching+0x12/0xc0 [ 1015.805060][T29434] ? __pte_offset_map+0x179/0x310 [ 1015.805093][T29434] __handle_mm_fault+0x192f/0x2a00 [ 1015.805139][T29434] ? reacquire_held_locks+0xce/0x1e0 [ 1015.805179][T29434] ? __pfx___handle_mm_fault+0x10/0x10 [ 1015.805224][T29434] ? lock_vma_under_rcu+0x17c/0x590 [ 1015.805280][T29434] handle_mm_fault+0x37b/0xa30 [ 1015.805325][T29434] do_user_addr_fault+0x5a3/0x12f0 [ 1015.805376][T29434] exc_page_fault+0x6f/0xd0 [ 1015.805424][T29434] asm_exc_page_fault+0x26/0x30 [ 1015.805451][T29434] RIP: 0033:0x7f72b3c524ce [ 1015.805474][T29434] Code: bf 40 0d 03 00 89 c3 e8 c0 c4 14 00 48 83 c4 10 48 63 c3 5b c3 0f 1f 80 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89 [ 1015.805501][T29434] RSP: 002b:00007f72b4ba0f60 EFLAGS: 00010206 [ 1015.805522][T29434] RAX: 0000000000000000 RBX: 00007f72b3e34824 RCX: 00007f72b3e1ebe0 [ 1015.805540][T29434] RDX: 000000000004217e RSI: 0000000000000000 RDI: 00007f72b3e34824 [ 1015.805557][T29434] RBP: 00007f72b4025fa0 R08: 003a7403b13fc9c0 R09: 0000000000000001 [ 1015.805573][T29434] R10: 000000000002f56a R11: 0000000000000246 R12: 0000000000000000 [ 1015.805589][T29434] R13: 00007f72b4026038 R14: 00007f72b4025fa0 R15: 00007fff28cb5798 [ 1015.805622][T29434] [ 1016.843276][T27120] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 1018.020351][T29513] FAULT_INJECTION: forcing a failure. [ 1018.020351][T29513] name failslab, interval 1, probability 0, space 0, times 0 [ 1018.046129][T29513] CPU: 0 UID: 0 PID: 29513 Comm: syz.2.2443 Tainted: G L syzkaller #0 PREEMPT(full) [ 1018.046187][T29513] Tainted: [L]=SOFTLOCKUP [ 1018.046197][T29513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1018.046213][T29513] Call Trace: [ 1018.046222][T29513] [ 1018.046232][T29513] dump_stack_lvl+0x100/0x190 [ 1018.046265][T29513] should_fail_ex.cold+0x5/0xa [ 1018.046294][T29513] should_failslab+0xc2/0x120 [ 1018.046327][T29513] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 1018.046359][T29513] ? proc_alloc_inode+0x25/0x200 [ 1018.046399][T29513] ? __pfx_proc_alloc_inode+0x10/0x10 [ 1018.046438][T29513] proc_alloc_inode+0x25/0x200 [ 1018.046473][T29513] alloc_inode+0x68/0x250 [ 1018.046504][T29513] new_inode+0x22/0x1c0 [ 1018.046535][T29513] proc_get_inode+0x1d/0x780 [ 1018.046575][T29513] proc_lookup_de+0x236/0x360 [ 1018.046623][T29513] proc_lookup+0xd8/0x110 [ 1018.046661][T29513] ? __pfx_proc_root_lookup+0x10/0x10 [ 1018.046702][T29513] proc_root_lookup+0x3b/0x70 [ 1018.046740][T29513] ? __pfx_proc_root_lookup+0x10/0x10 [ 1018.046787][T29513] path_openat+0x241f/0x4280 [ 1018.046840][T29513] ? __pfx_path_openat+0x10/0x10 [ 1018.046889][T29513] do_file_open+0x20e/0x430 [ 1018.046933][T29513] ? __pfx_do_file_open+0x10/0x10 [ 1018.046994][T29513] ? alloc_fd+0x471/0x7a0 [ 1018.047036][T29513] ? do_getname+0x191/0x390 [ 1018.047068][T29513] do_sys_openat2+0x10f/0x1e0 [ 1018.047099][T29513] ? __pfx_do_sys_openat2+0x10/0x10 [ 1018.047133][T29513] ? __fget_files+0x21f/0x3d0 [ 1018.047176][T29513] __x64_sys_openat+0x12d/0x210 [ 1018.047208][T29513] ? __pfx___x64_sys_openat+0x10/0x10 [ 1018.047251][T29513] do_syscall_64+0x115/0x840 [ 1018.047290][T29513] ? clear_bhb_loop+0x40/0x90 [ 1018.047322][T29513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1018.047349][T29513] RIP: 0033:0x7fb6c6d9de59 [ 1018.047370][T29513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1018.047395][T29513] RSP: 002b:00007fb6c7c9c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1018.047420][T29513] RAX: ffffffffffffffda RBX: 00007fb6c7025fa0 RCX: 00007fb6c6d9de59 [ 1018.047437][T29513] RDX: 0000000000000c40 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 1018.047453][T29513] RBP: 00007fb6c6e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 1018.047469][T29513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1018.047485][T29513] R13: 00007fb6c7026038 R14: 00007fb6c7025fa0 R15: 00007ffc541fa278 [ 1018.047517][T29513] [ 1018.850765][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 1018.994665][T29524] NFSD: Failed to start, no listeners configured. [ 1019.191001][T29530] zswap: compressor not available [ 1020.919643][T14829] Bluetooth: hci0: command 0x0c1a tx timeout [ 1023.495696][T29602] syz.3.2448 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1023.547743][T29602] CPU: 0 UID: 0 PID: 29602 Comm: syz.3.2448 Tainted: G L syzkaller #0 PREEMPT(full) [ 1023.547783][T29602] Tainted: [L]=SOFTLOCKUP [ 1023.547792][T29602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1023.547808][T29602] Call Trace: [ 1023.547816][T29602] [ 1023.547826][T29602] dump_stack_lvl+0x100/0x190 [ 1023.547858][T29602] dump_header+0xfb/0x606 [ 1023.547887][T29602] oom_kill_process.cold+0xd/0x330 [ 1023.547917][T29602] out_of_memory+0x340/0x14f0 [ 1023.547960][T29602] ? __pfx_out_of_memory+0x10/0x10 [ 1023.548004][T29602] mem_cgroup_out_of_memory+0xc6/0x130 [ 1023.548047][T29602] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 1023.548090][T29602] ? find_held_lock+0x2b/0x80 [ 1023.548125][T29602] ? do_raw_spin_unlock+0x145/0x1e0 [ 1023.548159][T29602] ? _raw_spin_unlock+0x28/0x50 [ 1023.548195][T29602] try_charge_memcg+0x6e5/0xdf0 [ 1023.548234][T29602] ? __pfx_try_charge_memcg+0x10/0x10 [ 1023.548266][T29602] ? find_held_lock+0x2b/0x80 [ 1023.548292][T29602] ? rcu_read_unlock+0x17/0x60 [ 1023.548326][T29602] ? rcu_read_unlock+0x17/0x60 [ 1023.548362][T29602] ? find_held_lock+0x2b/0x80 [ 1023.548391][T29602] ? rcu_read_unlock+0x17/0x60 [ 1023.548431][T29602] charge_memcg+0x187/0x1e0 [ 1023.548466][T29602] __mem_cgroup_charge+0x2b/0x1c0 [ 1023.548506][T29602] do_anonymous_page+0xb53/0x2080 [ 1023.548547][T29602] ? rcu_read_unlock+0x2d/0xb0 [ 1023.548576][T29602] __handle_mm_fault+0x1d2c/0x2a00 [ 1023.548620][T29602] ? mt_find+0x45e/0x8e0 [ 1023.548661][T29602] ? __pfx___handle_mm_fault+0x10/0x10 [ 1023.548698][T29602] ? __pfx_mt_find+0x10/0x10 [ 1023.548738][T29602] ? find_vma+0xbf/0x140 [ 1023.548766][T29602] ? __pfx_find_vma+0x10/0x10 [ 1023.548797][T29602] handle_mm_fault+0x37b/0xa30 [ 1023.548843][T29602] do_user_addr_fault+0x74c/0x12f0 [ 1023.548882][T29602] exc_page_fault+0x6f/0xd0 [ 1023.548919][T29602] asm_exc_page_fault+0x26/0x30 [ 1023.548943][T29602] RIP: 0010:rep_stos_alternative+0x40/0x80 [ 1023.548973][T29602] Code: c9 75 f6 e9 c2 aa 04 00 48 89 07 48 83 c7 08 83 e9 08 74 ef 83 f9 08 73 ef eb de 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 1023.548997][T29602] RSP: 0018:ffffc90003f2fcb8 EFLAGS: 00050206 [ 1023.549017][T29602] RAX: 0000000000000000 RBX: 000000007fab5000 RCX: 0000000000000240 [ 1023.549033][T29602] RDX: 0000000000080000 RSI: ffffffff825b8ab1 RDI: 000020000054b000 [ 1023.549048][T29602] RBP: 0000000000001000 R08: 0000000000000001 R09: 00000000000001cb [ 1023.549064][T29602] R10: 0000000000000200 R11: 0000000000000000 R12: 000000000054b000 [ 1023.549079][T29602] R13: ffff88804a828000 R14: dffffc0000000000 R15: 000020000054a240 [ 1023.549103][T29602] ? __might_fault+0x111/0x140 [ 1023.549151][T29602] read_zero+0xed/0x1f0 [ 1023.549188][T29602] ? __pfx_read_zero+0x10/0x10 [ 1023.549220][T29602] vfs_read+0x1e4/0xb40 [ 1023.549260][T29602] ? __pfx_vfs_read+0x10/0x10 [ 1023.549293][T29602] ? find_held_lock+0x2b/0x80 [ 1023.549320][T29602] ? __fget_files+0x215/0x3d0 [ 1023.549355][T29602] ? __fget_files+0x215/0x3d0 [ 1023.549396][T29602] ? __fget_files+0x21f/0x3d0 [ 1023.549439][T29602] __x64_sys_pread64+0x1eb/0x250 [ 1023.549478][T29602] ? __pfx___x64_sys_pread64+0x10/0x10 [ 1023.549525][T29602] do_syscall_64+0x115/0x840 [ 1023.549561][T29602] ? clear_bhb_loop+0x40/0x90 [ 1023.549591][T29602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.549616][T29602] RIP: 0033:0x7f72b3d9de59 [ 1023.549636][T29602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1023.549659][T29602] RSP: 002b:00007f72b4ba1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 1023.549681][T29602] RAX: ffffffffffffffda RBX: 00007f72b4025fa0 RCX: 00007f72b3d9de59 [ 1023.549697][T29602] RDX: 0000000100000002 RSI: 0000200000000240 RDI: 0000000000000004 [ 1023.549713][T29602] RBP: 00007f72b3e33e6f R08: 0000000000000000 R09: 0000000000000000 [ 1023.549727][T29602] R10: 0000000100000001 R11: 0000000000000246 R12: 0000000000000000 [ 1023.549743][T29602] R13: 00007f72b4026038 R14: 00007f72b4025fa0 R15: 00007fff28cb5798 [ 1023.549774][T29602] [ 1023.551531][T29602] memory: usage 3056kB, limit 3072kB, failcnt 20380 [ 1024.019755][T29602] memory+swap: usage 8608kB, limit 9007199254740988kB, failcnt 0 [ 1024.030981][T29602] kmem: usage 2844kB, limit 9007199254740988kB, failcnt 0 [ 1024.040522][T29602] Memory cgroup stats for /syz3: [ 1024.040816][T29602] cache 0 [ 1024.049478][T29602] rss 24576 [ 1024.052669][T29602] rss_huge 0 [ 1024.056643][T29602] shmem 0 [ 1024.069895][T29602] mapped_file 0 [ 1024.075624][T29602] dirty 0 [ 1024.079677][T29602] writeback 0 [ 1024.083354][T29602] workingset_refault_anon 6227 [ 1024.090917][T29602] workingset_refault_file 19092 [ 1024.096295][T29602] swap 5660672 [ 1024.103027][T29602] swapcached 68595712 [ 1024.113379][T29602] pgpgin 464009 [ 1024.131779][T29602] pgpgout 502576 [ 1024.136900][T29602] pgfault 377634 [ 1024.141828][T29602] pgmajfault 2936 [ 1024.150952][T29602] inactive_anon 98304 [ 1024.161636][T29602] active_anon 0 [ 1024.172705][T29602] inactive_file 0 [ 1024.189975][T29602] active_file 0 [ 1024.219001][T29602] unevictable 0 [ 1024.228757][T29602] hierarchical_memory_limit 3145728 [ 1024.242277][T29602] hierarchical_memsw_limit 9223372036854771712 [ 1024.263340][T29602] total_cache 0 [ 1024.270802][T29602] total_rss 24576 [ 1024.277423][T29602] total_rss_huge 0 [ 1024.281369][T29602] total_shmem 0 [ 1024.297811][T29602] total_mapped_file 0 [ 1024.307994][T29602] total_dirty 0 [ 1024.311619][T29602] total_writeback 0 [ 1024.316123][T29602] total_workingset_refault_anon 6227 [ 1024.323229][T29602] total_workingset_refault_file 19092 [ 1024.329535][T29602] total_swap 5660672 [ 1024.333899][T29602] total_swapcached 68595712 [ 1024.338572][T29602] total_pgpgin 464009 [ 1024.342683][T29602] total_pgpgout 502576 [ 1024.347368][T29602] total_pgfault 377634 [ 1024.351492][T29602] total_pgmajfault 2936 [ 1024.356202][T29602] total_inactive_anon 98304 [ 1024.364319][T29602] total_active_anon 0 [ 1024.368428][T29602] total_inactive_file 0 [ 1024.372663][T29602] total_active_file 0 [ 1024.377333][T29602] total_unevictable 0 [ 1024.381455][T29602] anon_cost 25 [ 1024.385354][T29602] file_cost 0 [ 1024.388770][T29602] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.2448,pid=29601,uid=0 [ 1024.412100][T29602] Memory cgroup out of memory: Killed process 29601 (syz.3.2448) total-vm:141488kB, anon-rss:3232kB, file-rss:26644kB, shmem-rss:0kB, UID:0 pgtables:168kB oom_score_adj:1000 [ 1026.118661][T29703] random: crng reseeded on system resumption [ 1026.523786][ T32] oom_reaper: reaped process 29601 (syz.3.2448), now anon-rss:0kB, file-rss:25612kB, shmem-rss:0kB [ 1027.224514][T29736] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1028.267802][T29739] zswap: compressor not available [ 1029.424887][T27120] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 1029.960170][T29797] zswap: compressor not available [ 1031.431916][T14829] Bluetooth: hci1: command 0x2016 tx timeout [ 1032.194470][T29811] zswap: compressor not available [ 1032.726037][T29820] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 1033.058424][T27120] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 1033.066392][T27120] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:64' [ 1033.077093][T27120] CPU: 0 UID: 0 PID: 27120 Comm: kworker/u11:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1033.077147][T27120] Tainted: [L]=SOFTLOCKUP [ 1033.077159][T27120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1033.077179][T27120] Workqueue: hci1 hci_rx_work [ 1033.077248][T27120] Call Trace: [ 1033.077258][T27120] [ 1033.077269][T27120] dump_stack_lvl+0x100/0x190 [ 1033.077303][T27120] sysfs_warn_dup.cold+0x1c/0x28 [ 1033.077361][T27120] sysfs_create_dir_ns+0x24b/0x2b0 [ 1033.077401][T27120] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1033.077438][T27120] ? find_held_lock+0x2b/0x80 [ 1033.077471][T27120] ? kobject_add_internal+0x25f/0x930 [ 1033.077511][T27120] ? kobject_add_internal+0x25f/0x930 [ 1033.077548][T27120] ? do_raw_spin_unlock+0x145/0x1e0 [ 1033.077579][T27120] kobject_add_internal+0x2c8/0x930 [ 1033.077619][T27120] kobject_add+0x16a/0x1e0 [ 1033.077653][T27120] ? __pfx_kobject_add+0x10/0x10 [ 1033.077685][T27120] ? class_to_subsys+0x10f/0x150 [ 1033.077738][T27120] ? kobject_put+0xb9/0x640 [ 1033.077767][T27120] ? _raw_spin_unlock+0x28/0x50 [ 1033.077822][T27120] device_add+0x294/0x1970 [ 1033.077873][T27120] ? __pfx_dev_set_name+0x10/0x10 [ 1033.077920][T27120] ? __pfx_device_add+0x10/0x10 [ 1033.077961][T27120] ? mgmt_send_event_skb+0x2fb/0x460 [ 1033.078027][T27120] hci_conn_add_sysfs+0x1a3/0x260 [ 1033.078067][T27120] le_conn_complete_evt+0x11eb/0x1f60 [ 1033.078132][T27120] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1033.078174][T27120] ? __pfx_bt_warn+0x10/0x10 [ 1033.078224][T27120] ? hci_event_packet+0x186/0xcd0 [ 1033.078275][T27120] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1033.078322][T27120] ? skb_pull_data+0x15f/0x1e0 [ 1033.078386][T27120] hci_le_meta_evt+0x34a/0x5f0 [ 1033.078413][T27120] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1033.078462][T27120] hci_event_packet+0x51c/0xcd0 [ 1033.078508][T27120] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1033.078538][T27120] ? __pfx_hci_event_packet+0x10/0x10 [ 1033.078604][T27120] ? kcov_remote_start+0x384/0x670 [ 1033.078643][T27120] ? lockdep_hardirqs_on+0x78/0x100 [ 1033.078694][T27120] hci_rx_work+0x451/0xfc0 [ 1033.078743][T27120] process_one_work+0xa23/0x1940 [ 1033.078802][T27120] ? __pfx_process_one_work+0x10/0x10 [ 1033.078851][T27120] ? __pfx_hci_rx_work+0x10/0x10 [ 1033.078897][T27120] worker_thread+0x5ef/0xe50 [ 1033.078944][T27120] ? __pfx_worker_thread+0x10/0x10 [ 1033.078984][T27120] ? kthread+0x13a/0x450 [ 1033.079017][T27120] ? __pfx_worker_thread+0x10/0x10 [ 1033.079054][T27120] kthread+0x370/0x450 [ 1033.079087][T27120] ? __pfx_kthread+0x10/0x10 [ 1033.079130][T27120] ret_from_fork+0x72b/0xd50 [ 1033.079173][T27120] ? __pfx_ret_from_fork+0x10/0x10 [ 1033.079205][T27120] ? rcu_is_watching+0x12/0xc0 [ 1033.079236][T27120] ? __switch_to+0x800/0x10f0 [ 1033.079280][T27120] ? __switch_to_asm+0x39/0x70 [ 1033.079318][T27120] ? __pfx_kthread+0x10/0x10 [ 1033.079356][T27120] ret_from_fork_asm+0x1a/0x30 [ 1033.079410][T27120] [ 1033.081252][T27120] kobject: kobject_add_internal failed for hci1:64 with -EEXIST, don't try to register things with the same name in the same directory. [ 1033.407798][T27120] Bluetooth: hci1: failed to register connection device [ 1033.506224][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1035.276421][T29877] netlink: 25 bytes leftover after parsing attributes in process `syz.2.2468'. [ 1035.439934][T29880] zswap: compressor not available [ 1035.570644][T14829] Bluetooth: hci1: command 0x2016 tx timeout [ 1035.753496][T29887] zswap: compressor not available [ 1037.098629][T27120] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1037.116825][T27120] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1037.128386][T27120] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1037.139675][T27120] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1037.147623][T27120] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1037.321039][T27120] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 1037.643125][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1038.548173][T29895] bridge0: port 1(bridge_slave_0) entered blocking state [ 1038.566878][T29895] bridge0: port 1(bridge_slave_0) entered disabled state [ 1038.582922][T29895] bridge_slave_0: entered allmulticast mode [ 1038.615000][T29895] bridge_slave_0: entered promiscuous mode [ 1038.632068][T29895] bridge0: port 2(bridge_slave_1) entered blocking state [ 1038.651148][T29895] bridge0: port 2(bridge_slave_1) entered disabled state [ 1038.668025][T29895] bridge_slave_1: entered allmulticast mode [ 1038.685455][T29895] bridge_slave_1: entered promiscuous mode [ 1038.787347][T29895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1038.818163][T29895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1038.913584][T29895] team0: Port device team_slave_0 added [ 1038.934390][T29895] team0: Port device team_slave_1 added [ 1039.044876][T29895] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1039.060613][T29895] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1039.091725][T29895] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1039.125785][T29895] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1039.132769][T29895] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1039.221122][T29895] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1039.233584][T27120] Bluetooth: hci5: command tx timeout [ 1039.317180][T30079] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 1039.359532][T29895] hsr_slave_0: entered promiscuous mode [ 1039.377196][T29895] hsr_slave_1: entered promiscuous mode [ 1039.404945][T29895] debugfs: 'hsr0' already exists in 'hsr' [ 1039.428389][T29895] Cannot create hsr debugfs directory [ 1039.711327][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1039.862793][T27120] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1039.883642][T27120] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1039.892904][T27120] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1039.904326][T27120] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1039.914218][T27120] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1041.236046][T30147] bridge0: port 1(bridge_slave_0) entered blocking state [ 1041.245581][T30147] bridge0: port 1(bridge_slave_0) entered disabled state [ 1041.252894][T30147] bridge_slave_0: entered allmulticast mode [ 1041.261742][T30147] bridge_slave_0: entered promiscuous mode [ 1041.270882][T30147] bridge0: port 2(bridge_slave_1) entered blocking state [ 1041.279808][T30147] bridge0: port 2(bridge_slave_1) entered disabled state [ 1041.287707][T30147] bridge_slave_1: entered allmulticast mode [ 1041.296302][T30147] bridge_slave_1: entered promiscuous mode [ 1041.304366][T27120] Bluetooth: hci5: command tx timeout [ 1041.360825][T30147] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1041.375494][T30147] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1041.424656][T30147] team0: Port device team_slave_0 added [ 1041.434327][T30147] team0: Port device team_slave_1 added [ 1041.478388][T30147] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1041.486635][T30147] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1041.515756][T30147] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1041.528928][T30147] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1041.536720][T30147] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1041.567452][T30147] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1041.637994][T30147] hsr_slave_0: entered promiscuous mode [ 1041.646318][T30147] hsr_slave_1: entered promiscuous mode [ 1041.653646][T30147] debugfs: 'hsr0' already exists in 'hsr' [ 1041.659512][T30147] Cannot create hsr debugfs directory [ 1041.782214][T27120] Bluetooth: hci1: command 0x2016 tx timeout [ 1041.941153][T27120] Bluetooth: hci6: command tx timeout [ 1043.374096][T27120] Bluetooth: hci5: command tx timeout [ 1044.010990][T27120] Bluetooth: hci6: command tx timeout [ 1045.444185][T27120] Bluetooth: hci5: command tx timeout [ 1046.081287][T27120] Bluetooth: hci6: command tx timeout [ 1048.151519][T27120] Bluetooth: hci6: command tx timeout [ 1051.260102][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1051.268042][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.503296][T14829] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1055.520861][T14829] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1055.531801][T14829] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1055.544598][T14829] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1055.555177][T14829] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1056.257348][T30486] bridge0: port 1(bridge_slave_0) entered blocking state [ 1056.265516][T30486] bridge0: port 1(bridge_slave_0) entered disabled state [ 1056.272816][T30486] bridge_slave_0: entered allmulticast mode [ 1056.283355][T30486] bridge_slave_0: entered promiscuous mode [ 1056.292097][T30486] bridge0: port 2(bridge_slave_1) entered blocking state [ 1056.299516][T30486] bridge0: port 2(bridge_slave_1) entered disabled state [ 1056.308135][T30486] bridge_slave_1: entered allmulticast mode [ 1056.317258][T30486] bridge_slave_1: entered promiscuous mode [ 1056.387698][T30486] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1056.400609][T30486] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1056.450502][T30486] team0: Port device team_slave_0 added [ 1056.460496][T30486] team0: Port device team_slave_1 added [ 1056.501697][T30486] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1056.509598][T30486] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1056.538509][T30486] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1056.556021][T30486] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1056.563296][T30486] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1056.590050][T30486] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1056.665149][T30486] hsr_slave_0: entered promiscuous mode [ 1056.676518][T30486] hsr_slave_1: entered promiscuous mode [ 1056.686867][T30486] debugfs: 'hsr0' already exists in 'hsr' [ 1056.693384][T30486] Cannot create hsr debugfs directory [ 1057.627054][T27120] Bluetooth: hci7: command tx timeout [ 1057.968989][T14829] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1057.991046][T14829] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1058.008002][T14829] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1058.017139][T14829] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1058.030838][T14829] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1058.743033][T30749] bridge0: port 1(bridge_slave_0) entered blocking state [ 1058.750300][T30749] bridge0: port 1(bridge_slave_0) entered disabled state [ 1058.759989][T30749] bridge_slave_0: entered allmulticast mode [ 1058.769694][T30749] bridge_slave_0: entered promiscuous mode [ 1058.781134][T30749] bridge0: port 2(bridge_slave_1) entered blocking state [ 1058.792119][T30749] bridge0: port 2(bridge_slave_1) entered disabled state [ 1058.799441][T30749] bridge_slave_1: entered allmulticast mode [ 1058.807608][T30749] bridge_slave_1: entered promiscuous mode [ 1058.860861][T30749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1058.878624][T30749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1058.925784][T30749] team0: Port device team_slave_0 added [ 1058.935227][T30749] team0: Port device team_slave_1 added [ 1058.978577][T30749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1058.987727][T30749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1059.015641][T30749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1059.028789][T30749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1059.036210][T30749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1059.062980][T30749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1059.136394][T30749] hsr_slave_0: entered promiscuous mode [ 1059.145196][T30749] hsr_slave_1: entered promiscuous mode [ 1059.153177][T30749] debugfs: 'hsr0' already exists in 'hsr' [ 1059.158978][T30749] Cannot create hsr debugfs directory [ 1059.697571][T14829] Bluetooth: hci7: command tx timeout [ 1060.095545][T14829] Bluetooth: hci8: command tx timeout [ 1061.767740][T14829] Bluetooth: hci7: command tx timeout [ 1062.165904][T14829] Bluetooth: hci8: command tx timeout [ 1063.837854][T14829] Bluetooth: hci7: command tx timeout [ 1064.236373][T14829] Bluetooth: hci8: command tx timeout [ 1066.306547][T14829] Bluetooth: hci8: command tx timeout [ 1078.810124][T14829] Bluetooth: hci1: command 0x2016 tx timeout [ 1097.026280][T14829] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1097.047169][T14829] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1097.060935][T14829] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1097.072878][T14829] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1097.080646][T14829] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1097.854014][T31017] bridge0: port 1(bridge_slave_0) entered blocking state [ 1097.863254][T31017] bridge0: port 1(bridge_slave_0) entered disabled state [ 1097.872393][T31017] bridge_slave_0: entered allmulticast mode [ 1097.881251][T31017] bridge_slave_0: entered promiscuous mode [ 1097.890804][T31017] bridge0: port 2(bridge_slave_1) entered blocking state [ 1097.898648][T31017] bridge0: port 2(bridge_slave_1) entered disabled state [ 1097.908281][T31017] bridge_slave_1: entered allmulticast mode [ 1097.916186][T31017] bridge_slave_1: entered promiscuous mode [ 1097.973003][T31017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1097.986653][T31017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1098.035575][T31017] team0: Port device team_slave_0 added [ 1098.045443][T31017] team0: Port device team_slave_1 added [ 1098.089962][T31017] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1098.098358][T31017] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.127676][T31017] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1098.140695][T31017] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1098.148207][T31017] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1098.175345][T31017] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1098.248160][T31017] hsr_slave_0: entered promiscuous mode [ 1098.257002][T31017] hsr_slave_1: entered promiscuous mode [ 1098.263586][T31017] debugfs: 'hsr0' already exists in 'hsr' [ 1098.270364][T31017] Cannot create hsr debugfs directory [ 1099.112542][T14829] Bluetooth: hci9: command tx timeout [ 1100.020788][T27120] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1100.039965][T27120] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1100.053985][T27120] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1100.066448][T27120] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1100.079334][T27120] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1100.818111][T31279] bridge0: port 1(bridge_slave_0) entered blocking state [ 1100.826608][T31279] bridge0: port 1(bridge_slave_0) entered disabled state [ 1100.835213][T31279] bridge_slave_0: entered allmulticast mode [ 1100.843760][T31279] bridge_slave_0: entered promiscuous mode [ 1100.852675][T31279] bridge0: port 2(bridge_slave_1) entered blocking state [ 1100.861635][T31279] bridge0: port 2(bridge_slave_1) entered disabled state [ 1100.871368][T31279] bridge_slave_1: entered allmulticast mode [ 1100.879455][T31279] bridge_slave_1: entered promiscuous mode [ 1100.930224][T31279] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1100.946893][T31279] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1100.997144][T31279] team0: Port device team_slave_0 added [ 1101.006938][T31279] team0: Port device team_slave_1 added [ 1101.048918][T31279] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1101.058069][T31279] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1101.087287][T31279] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1101.100065][T31279] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1101.108761][T31279] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1101.135638][T31279] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1101.183373][T14829] Bluetooth: hci9: command tx timeout [ 1101.213531][T31279] hsr_slave_0: entered promiscuous mode [ 1101.220262][T31279] hsr_slave_1: entered promiscuous mode [ 1101.227868][T31279] debugfs: 'hsr0' already exists in 'hsr' [ 1101.234464][T31279] Cannot create hsr debugfs directory [ 1102.137963][T14829] Bluetooth: hci10: command tx timeout [ 1103.252999][T14829] Bluetooth: hci9: command tx timeout [ 1104.208194][T14829] Bluetooth: hci10: command tx timeout [ 1104.292374][T14829] Bluetooth: hci2: command 0x0406 tx timeout [ 1105.323449][T27120] Bluetooth: hci9: command tx timeout [ 1106.278471][T27120] Bluetooth: hci10: command tx timeout [ 1108.348639][T27120] Bluetooth: hci10: command tx timeout [ 1112.416536][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1112.425491][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.546488][T14829] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1115.565500][T14829] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1115.575847][T14829] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1115.586596][T14829] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1115.604824][T14829] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1116.349197][T31543] bridge0: port 1(bridge_slave_0) entered blocking state [ 1116.358712][T31543] bridge0: port 1(bridge_slave_0) entered disabled state [ 1116.368034][T31543] bridge_slave_0: entered allmulticast mode [ 1116.376724][T31543] bridge_slave_0: entered promiscuous mode [ 1116.386460][T31543] bridge0: port 2(bridge_slave_1) entered blocking state [ 1116.395759][T31543] bridge0: port 2(bridge_slave_1) entered disabled state [ 1116.403708][T31543] bridge_slave_1: entered allmulticast mode [ 1116.412488][T31543] bridge_slave_1: entered promiscuous mode [ 1116.463162][T31543] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1116.481917][T31543] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1116.529477][T31543] team0: Port device team_slave_0 added [ 1116.539392][T31543] team0: Port device team_slave_1 added [ 1116.587388][T31543] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1116.595999][T31543] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1116.623719][T31543] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1116.639134][T31543] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1116.646826][T31543] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1116.675004][T31543] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1116.750262][T31543] hsr_slave_0: entered promiscuous mode [ 1116.757196][T31543] hsr_slave_1: entered promiscuous mode [ 1116.766303][T31543] debugfs: 'hsr0' already exists in 'hsr' [ 1116.772973][T31543] Cannot create hsr debugfs directory [ 1117.665083][T27120] Bluetooth: hci11: command tx timeout [ 1118.050334][T14829] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1118.069424][T14829] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1118.081668][T14829] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1118.091320][T14829] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1118.099774][T14829] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1118.826383][T31807] bridge0: port 1(bridge_slave_0) entered blocking state [ 1118.834046][T31807] bridge0: port 1(bridge_slave_0) entered disabled state [ 1118.842537][T31807] bridge_slave_0: entered allmulticast mode [ 1118.850902][T31807] bridge_slave_0: entered promiscuous mode [ 1118.862335][T31807] bridge0: port 2(bridge_slave_1) entered blocking state [ 1118.869812][T31807] bridge0: port 2(bridge_slave_1) entered disabled state [ 1118.877141][T31807] bridge_slave_1: entered allmulticast mode [ 1118.886479][T31807] bridge_slave_1: entered promiscuous mode [ 1118.944358][T31807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1118.958082][T31807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1119.006132][T31807] team0: Port device team_slave_0 added [ 1119.015793][T31807] team0: Port device team_slave_1 added [ 1119.060621][T31807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1119.067750][T31807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.095386][T31807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1119.112055][T31807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1119.119486][T31807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.146733][T31807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1119.221693][T31807] hsr_slave_0: entered promiscuous mode [ 1119.229353][T31807] hsr_slave_1: entered promiscuous mode [ 1119.236014][T31807] debugfs: 'hsr0' already exists in 'hsr' [ 1119.242886][T31807] Cannot create hsr debugfs directory [ 1119.735946][T14829] Bluetooth: hci11: command tx timeout [ 1120.212917][T14829] Bluetooth: hci12: command tx timeout [ 1121.805479][T14829] Bluetooth: hci11: command tx timeout [ 1122.283282][T14829] Bluetooth: hci12: command tx timeout [ 1123.876026][T14829] Bluetooth: hci11: command tx timeout [ 1124.353560][T14829] Bluetooth: hci12: command tx timeout [ 1124.676535][T14829] Bluetooth: hci3: command 0x0406 tx timeout [ 1126.423813][T14829] Bluetooth: hci12: command tx timeout [ 1130.245871][ T31] INFO: task kworker/u10:8:12712 blocked for more than 143 seconds. [ 1130.254050][ T31] Tainted: G L syzkaller #0 [ 1130.264972][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1130.274068][ T31] task:kworker/u10:8 state:D stack:24256 pid:12712 tgid:12712 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 1130.287445][ T31] Workqueue: netns cleanup_net [ 1130.292313][ T31] Call Trace: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1130.296006][ T31] [ 1130.299546][ T31] __schedule+0x125c/0x6730 [ 1130.310801][ T31] ? __pfx___schedule+0x10/0x10 [ 1130.327643][ T31] ? find_held_lock+0x2b/0x80 [ 1130.335310][ T31] ? schedule+0x225/0x2c0 [ 1130.345549][ T31] schedule+0xdd/0x2c0 [ 1130.355201][ T31] schedule_timeout+0x1b2/0x280 [ 1130.364585][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1130.401179][ T31] ? mark_held_locks+0x40/0x70 [ 1130.437716][ T31] __wait_for_common+0x2e7/0x4c0 [ 1130.466833][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1130.492568][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1130.499097][ T31] remove_one+0x312/0x420 [ 1130.503534][ T31] ? up_write+0x2e5/0x5c0 [ 1130.509452][ T31] __simple_recursive_removal+0x148/0x5c0 [ 1130.515578][ T31] ? __pfx_remove_one+0x10/0x10 [ 1130.522111][ T31] debugfs_remove+0x5d/0x80 [ 1130.527976][ T31] nsim_dev_health_exit+0x3b/0xe0 [ 1130.533242][ T31] nsim_dev_reload_destroy+0x144/0x4a0 [ 1130.539307][ T31] nsim_dev_reload_down+0x66/0xd0 [ 1130.545573][ T31] devlink_reload+0x1ae/0x7a0 [ 1130.550632][ T31] ? __pfx_devlink_reload+0x10/0x10 [ 1130.556368][ T31] devlink_pernet_pre_exit+0x247/0x370 [ 1130.561997][ T31] ? iput.part.0+0x1a0/0x1050 [ 1130.568347][ T31] ? __pfx_devlink_pernet_pre_exit+0x10/0x10 [ 1130.574746][ T31] ? iput+0x3a/0x40 [ 1130.578631][ T31] ? sock_release+0x14d/0x1c0 [ 1130.583453][ T31] ? __pfx_devlink_pernet_pre_exit+0x10/0x10 [ 1130.590205][ T31] ops_undo_list+0x187/0xab0 [ 1130.595153][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 1130.600338][ T31] ? cleanup_net+0x332/0x920 [ 1130.605490][ T31] ? cleanup_net+0x332/0x920 [ 1130.610176][ T31] ? idr_destroy+0x62/0x2e0 [ 1130.615937][ T31] cleanup_net+0x499/0x920 [ 1130.620431][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 1130.627814][ T31] ? rcu_is_watching+0x12/0xc0 [ 1130.632658][ T31] process_one_work+0xa23/0x1940 [ 1130.638807][ T31] ? __pfx_process_one_work+0x10/0x10 [ 1130.645048][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 1130.650065][ T31] worker_thread+0x5ef/0xe50 [ 1130.655800][ T31] ? kthread+0x13a/0x450 [ 1130.660361][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1130.665850][ T31] kthread+0x370/0x450 [ 1130.670157][ T31] ? __pfx_kthread+0x10/0x10 [ 1130.675121][ T31] ret_from_fork+0x72b/0xd50 [ 1130.679798][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1130.685300][ T31] ? __switch_to+0x800/0x10f0 [ 1130.690337][ T31] ? __switch_to_asm+0x39/0x70 [ 1130.695429][ T31] ? __pfx_kthread+0x10/0x10 [ 1130.700121][ T31] ret_from_fork_asm+0x1a/0x30 [ 1130.705475][ T31] [ 1130.708650][ T31] INFO: task syz.0.2386:28061 blocked for more than 143 seconds. [ 1130.739225][ T31] Tainted: G L syzkaller #0 [ 1130.748792][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1130.757850][ T31] task:syz.0.2386 state:D stack:28776 pid:28061 tgid:28056 ppid:25163 task_flags:0x400040 flags:0x00080002 [ 1130.770894][ T31] Call Trace: [ 1130.774529][ T31] [ 1130.777526][ T31] __schedule+0x125c/0x6730 [ 1130.782069][ T31] ? do_raw_spin_lock+0x128/0x260 [ 1130.787625][ T31] ? __pfx___schedule+0x10/0x10 [ 1130.792548][ T31] ? find_held_lock+0x2b/0x80 [ 1130.797787][ T31] ? schedule+0x225/0x2c0 [ 1130.802180][ T31] schedule+0xdd/0x2c0 [ 1130.810964][ T31] schedule_preempt_disabled+0x13/0x30 [ 1130.816800][ T31] __mutex_lock+0xccc/0x1bd0 [ 1130.821481][ T31] ? devlink_health_report+0x656/0xb00 [ 1130.828885][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1130.834318][ T31] ? devlink_recover_notify.constprop.0+0x1e3/0x550 [ 1130.841027][ T31] ? devlink_health_report+0x656/0xb00 [ 1130.847739][ T31] devlink_health_report+0x656/0xb00 [ 1130.854085][ T31] ? __pfx_devlink_health_report+0x10/0x10 [ 1130.860058][ T31] ? _copy_from_user+0x59/0xd0 [ 1130.865422][ T31] nsim_dev_health_break_write+0x166/0x210 [ 1130.871328][ T31] ? __pfx_nsim_dev_health_break_write+0x10/0x10 [ 1130.878888][ T31] full_proxy_write+0x135/0x1a0 [ 1130.885389][ T31] vfs_write+0x2aa/0x1050 [ 1130.889816][ T31] ? __pfx_full_proxy_write+0x10/0x10 [ 1130.896121][ T31] ? __pfx_vfs_write+0x10/0x10 [ 1130.900960][ T31] ? __fget_files+0x215/0x3d0 [ 1130.906191][ T31] ? __fget_files+0x21f/0x3d0 [ 1130.910940][ T31] ksys_write+0x12a/0x250 [ 1130.915801][ T31] ? __pfx_ksys_write+0x10/0x10 [ 1130.920725][ T31] do_syscall_64+0x115/0x840 [ 1130.925828][ T31] ? clear_bhb_loop+0x40/0x90 [ 1130.931991][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.938420][ T31] RIP: 0033:0x7f0e7859de59 [ 1130.943259][ T31] RSP: 002b:00007f0e794c4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1130.951735][ T31] RAX: ffffffffffffffda RBX: 00007f0e78826090 RCX: 00007f0e7859de59 [ 1130.961147][ T31] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000007 [ 1130.970105][ T31] RBP: 00007f0e78633e6f R08: 0000000000000000 R09: 0000000000000000 [ 1130.978658][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1130.987841][ T31] R13: 00007f0e78826128 R14: 00007f0e78826090 R15: 00007ffce72f7978 [ 1130.996267][ T31] [ 1130.999477][ T31] [ 1130.999477][ T31] Showing all locks held in the system: [ 1131.008020][ T31] 1 lock held by khungtaskd/31: [ 1131.013426][ T31] #0: ffffffff8ebe5f00 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 1131.023778][ T31] 2 locks held by getty/5382: [ 1131.030089][ T31] #0: ffff888036f5e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1131.041007][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 1131.053134][ T31] 6 locks held by kworker/u10:8/12712: [ 1131.058712][ T31] #0: ffff88801caf6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 1131.070267][ T31] #1: ffffc900032cfd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 1131.081535][ T31] #2: ffffffff90a85268 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 [ 1131.090970][ T31] #3: ffff88807a43c128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x19e/0x370 [ 1131.102379][ T31] #4: ffff88807a43f258 (&devlink->lock_key#3){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x1b4/0x370 [ 1131.113931][ T31] #5: ffff888077bf4140 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0xe0/0x5c0 [ 1131.127913][ T31] 5 locks held by syz-executor/28012: [ 1131.135104][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.144613][ T31] #1: ffff88805b5f3880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.154760][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.165252][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.176608][ T31] #4: ffff88807a43c128 (&dev->mutex){....}-{4:4}, at: device_del+0xa0/0x9b0 [ 1131.185812][ T31] 3 locks held by syz.0.2386/28061: [ 1131.191868][ T31] #0: ffff88807abe0470 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 1131.201859][ T31] #1: ffff888020aa6450 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.212029][ T31] #2: ffff88807a43f258 (&devlink->lock_key#3){+.+.}-{4:4}, at: devlink_health_report+0x656/0xb00 [ 1131.223147][ T31] 4 locks held by syz-executor/28834: [ 1131.228564][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.239605][ T31] #1: ffff888035fbc480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.249795][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.260865][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.271736][ T31] 2 locks held by syz.3.2448/29605: [ 1131.276980][ T31] #0: ffff888020aa6450 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0xad9/0x4280 [ 1131.290353][ T31] #1: ffff888077bf4140 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0x29f2/0x4280 [ 1131.302010][ T31] 4 locks held by syz-executor/29895: [ 1131.307441][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.316922][ T31] #1: ffff88804a886c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.327791][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.340036][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.350940][ T31] 4 locks held by syz-executor/30147: [ 1131.356484][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.368578][ T31] #1: ffff888097c0e480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.378899][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.389390][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.401353][ T31] 2 locks held by syz.2.2476/30187: [ 1131.406635][ T31] #0: ffff888020aa6450 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0xad9/0x4280 [ 1131.416927][ T31] #1: ffff888077bf4140 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0x29f2/0x4280 [ 1131.428141][ T31] 4 locks held by syz-executor/30486: [ 1131.434570][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.446914][ T31] #1: ffff88809ab09080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.457243][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.467893][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.481125][ T31] 4 locks held by syz-executor/30749: [ 1131.486628][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.496238][ T31] #1: ffff888035d3d480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.506468][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.517774][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.532193][ T31] 4 locks held by syz-executor/31017: [ 1131.537967][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.549673][ T31] #1: ffff8880979ff480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.559846][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.570277][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.580949][ T31] 4 locks held by syz-executor/31279: [ 1131.586385][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.595832][ T31] #1: ffff8880981da480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.607017][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.617360][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.628772][ T31] 4 locks held by syz-executor/31543: [ 1131.634473][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.645722][ T31] #1: ffff888047cc5080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.656831][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.667221][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.678061][ T31] 4 locks held by syz-executor/31807: [ 1131.683943][ T31] #0: ffff888035a96450 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1131.693431][ T31] #1: ffff8880acca5080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1131.703635][ T31] #2: ffff888029881b48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1131.714168][ T31] #3: ffffffff9000c660 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 1131.724992][ T31] [ 1131.727377][ T31] ============================================= [ 1131.727377][ T31] [ 1131.738822][ T31] NMI backtrace for cpu 0 [ 1131.738843][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1131.738876][ T31] Tainted: [L]=SOFTLOCKUP [ 1131.738885][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1131.738900][ T31] Call Trace: [ 1131.738908][ T31] [ 1131.738917][ T31] dump_stack_lvl+0x100/0x190 [ 1131.738947][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 1131.738977][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1131.739004][ T31] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 1131.739039][ T31] sys_info+0x141/0x190 [ 1131.739065][ T31] watchdog+0xcb1/0x1030 [ 1131.739103][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1131.739139][ T31] ? __pfx_watchdog+0x10/0x10 [ 1131.739172][ T31] ? __kthread_parkme+0x18c/0x230 [ 1131.739199][ T31] ? kthread+0x13a/0x450 [ 1131.739226][ T31] ? __pfx_watchdog+0x10/0x10 [ 1131.739256][ T31] kthread+0x370/0x450 [ 1131.739284][ T31] ? __pfx_kthread+0x10/0x10 [ 1131.739314][ T31] ret_from_fork+0x72b/0xd50 [ 1131.739342][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1131.739370][ T31] ? __switch_to+0x800/0x10f0 [ 1131.739403][ T31] ? __switch_to_asm+0x39/0x70 [ 1131.739435][ T31] ? __pfx_kthread+0x10/0x10 [ 1131.739465][ T31] ret_from_fork_asm+0x1a/0x30 [ 1131.739510][ T31] [ 1131.893272][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1131.900178][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1131.910878][ T31] Tainted: [L]=SOFTLOCKUP [ 1131.915214][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1131.925293][ T31] Call Trace: [ 1131.928674][ T31] [ 1131.931617][ T31] dump_stack_lvl+0x100/0x190 [ 1131.936322][ T31] vpanic+0x552/0x970 [ 1131.940328][ T31] ? __pfx_vpanic+0x10/0x10 [ 1131.944853][ T31] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 1131.951044][ T31] panic+0xd1/0xe0 [ 1131.954784][ T31] ? __pfx_panic+0x10/0x10 [ 1131.959221][ T31] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 1131.965490][ T31] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 1131.971858][ T31] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 1131.978208][ T31] ? watchdog.cold+0x1ec/0x234 [ 1131.983012][ T31] ? watchdog+0xcc1/0x1030 [ 1131.987483][ T31] watchdog.cold+0x1fd/0x234 [ 1131.992116][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1131.997972][ T31] ? __pfx_watchdog+0x10/0x10 [ 1132.002678][ T31] ? __kthread_parkme+0x18c/0x230 [ 1132.007740][ T31] ? kthread+0x13a/0x450 [ 1132.012025][ T31] ? __pfx_watchdog+0x10/0x10 [ 1132.016743][ T31] kthread+0x370/0x450 [ 1132.020871][ T31] ? __pfx_kthread+0x10/0x10 [ 1132.025512][ T31] ret_from_fork+0x72b/0xd50 [ 1132.030180][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1132.035333][ T31] ? __switch_to+0x800/0x10f0 [ 1132.040053][ T31] ? __switch_to_asm+0x39/0x70 [ 1132.045112][ T31] ? __pfx_kthread+0x10/0x10 [ 1132.049747][ T31] ret_from_fork_asm+0x1a/0x30 [ 1132.054557][ T31] [ 1132.057674][ T31] Kernel Offset: disabled [ 1132.062062][ T31] Rebooting in 86400 seconds..