.96 Not tainted syzkaller #0 PREEMPT(full) [ 618.139098][ T8112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 618.139112][ T8112] Call Trace: [ 618.139121][ T8112] [ 618.139130][ T8112] dump_stack_lvl+0x189/0x250 [ 618.139169][ T8112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 618.139201][ T8112] ? __pfx__printk+0x10/0x10 [ 618.139234][ T8112] ? rcu_is_watching+0x15/0xb0 [ 618.139260][ T8112] dump_header+0xd3/0x480 [ 618.139281][ T8112] oom_kill_process+0x387/0x920 [ 618.139307][ T8112] out_of_memory+0xf09/0x12a0 [ 618.139333][ T8112] ? mem_cgroup_iter+0x3b/0x460 [ 618.139357][ T8112] ? __pfx_out_of_memory+0x10/0x10 [ 618.139384][ T8112] mem_cgroup_out_of_memory+0x145/0x240 [ 618.139408][ T8112] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 618.139437][ T8112] ? _raw_spin_unlock+0x28/0x50 [ 618.139462][ T8112] ? memcg1_oom_prepare+0x37f/0x450 [ 618.139492][ T8112] try_charge_memcg+0xdff/0x1290 [ 618.139530][ T8112] ? __pfx_try_charge_memcg+0x10/0x10 [ 618.139561][ T8112] ? get_mem_cgroup_from_mm+0x38/0x2a0 [ 618.139585][ T8112] ? rcu_is_watching+0x15/0xb0 [ 618.139607][ T8112] ? lock_release+0x4b/0x3e0 [ 618.139626][ T8112] ? percpu_ref_tryget+0x15/0x180 [ 618.139648][ T8112] charge_memcg+0x9f/0x180 [ 618.139678][ T8112] __mem_cgroup_charge+0x25/0x80 [ 618.139708][ T8112] folio_prealloc+0x51/0x180 [ 618.139728][ T8112] do_wp_page+0x1231/0x5800 [ 618.139774][ T8112] ? lock_acquire+0x5f/0x360 [ 618.139796][ T8112] ? __pfx_do_wp_page+0x10/0x10 [ 618.139822][ T8112] ? do_raw_spin_lock+0x121/0x290 [ 618.139852][ T8112] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 618.139879][ T8112] ? ___pte_offset_map+0x45/0x250 [ 618.139913][ T8112] __handle_mm_fault+0x1033/0x5400 [ 618.139951][ T8112] ? __pfx___handle_mm_fault+0x10/0x10 [ 618.139981][ T8112] ? rcu_is_watching+0x15/0xb0 [ 618.140008][ T8112] ? lock_vma_under_rcu+0x3cb/0x450 [ 618.140027][ T8112] ? rcu_is_watching+0x15/0xb0 [ 618.140050][ T8112] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 618.140072][ T8112] handle_mm_fault+0x40a/0x8e0 [ 618.140107][ T8112] do_user_addr_fault+0xa81/0x1390 [ 618.140131][ T8112] ? rcu_is_watching+0x15/0xb0 [ 618.140154][ T8112] ? trace_page_fault_user+0x84/0x1e0 [ 618.140176][ T8112] exc_page_fault+0x82/0x100 [ 618.140203][ T8112] asm_exc_page_fault+0x26/0x30 [ 618.140223][ T8112] RIP: 0033:0x7f658765691f [ 618.140241][ T8112] Code: 49 bc 20 91 10 00 00 86 00 00 eb b2 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 56 41 55 41 54 55 48 89 fd 53 48 83 ec 50 47 04 01 89 37 c6 47 20 00 84 d2 74 1c 8b 87 98 00 00 00 85 c0 [ 618.140260][ T8112] RSP: 002b:00007ffcf03da1e0 EFLAGS: 00010202 [ 618.140280][ T8112] RAX: 0000000000000000 RBX: 00007f65879b5fa0 RCX: 0000000000000000 [ 618.140295][ T8112] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f65879b5fa0 [ 618.140308][ T8112] RBP: 00007f65879b5fa0 R08: 00007f65879b5fa0 R09: 0000000000000000 [ 618.140323][ T8112] R10: 0000000000000000 R11: 0000000000000000 R12: 00007f65879b5fa0 [ 618.140337][ T8112] R13: 00007f65879b5fa0 R14: 000000000000129d R15: 0000000000000004 [ 618.140360][ T8112] [ 618.140368][ T8112] memory: usage 307200kB, limit 307200kB, failcnt 3052 [ 618.543936][ T8112] memory+swap: usage 312064kB, limit 9007199254740988kB, failcnt 0 [ 618.552110][ T8112] kmem: usage 2572kB, limit 9007199254740988kB, failcnt 0 [ 618.565797][ T8100] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.600723][ T8112] Memory cgroup stats for /syz1: [ 618.600862][ T8112] cache 311574528 [ 618.611979][ T8112] rss 348160 [ 618.615331][ T8112] rss_huge 0 [ 618.618930][ T8112] shmem 311574528 [ 618.622924][ T8112] mapped_file 0 [ 618.626405][ T8112] dirty 0 [ 618.630416][ T8112] writeback 0 [ 618.633917][ T8112] workingset_refault_anon 0 [ 618.639533][ T8112] workingset_refault_file 0 [ 618.644073][ T8112] swap 4980736 [ 618.648341][ T8112] swapcached 0 [ 618.651967][ T8112] pgpgin 79768 [ 618.655369][ T8112] pgpgout 3615 [ 618.660607][ T8112] pgfault 3710 [ 618.664082][ T8112] pgmajfault 3 [ 618.689395][ T8100] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.702852][ T8112] inactive_anon 113156096 [ 618.707779][ T8112] active_anon 198750208 [ 618.712010][ T8112] inactive_file 0 [ 618.715668][ T8112] active_file 0 [ 618.719807][ T8112] unevictable 0 [ 618.723294][ T8112] hierarchical_memory_limit 314572800 [ 618.729138][ T8112] hierarchical_memsw_limit 9223372036854771712 [ 618.735313][ T8112] total_cache 311574528 [ 618.738625][ T5917] Bluetooth: hci74: command tx timeout [ 618.741582][ T8112] total_rss 348160 [ 618.749232][ T8112] total_rss_huge 0 [ 618.752979][ T8112] total_shmem 311574528 [ 618.757159][ T8112] total_mapped_file 0 [ 618.764967][ T8112] total_dirty 0 [ 618.770220][ T8112] total_writeback 0 [ 618.811598][ T8112] total_workingset_refault_anon 0 [ 618.816693][ T8112] total_workingset_refault_file 0 [ 618.822403][ T8112] total_swap 4980736 [ 618.827032][ T8112] total_swapcached 0 [ 618.834270][ T8112] total_pgpgin 79768 [ 618.838355][ T8112] total_pgpgout 3615 [ 618.842274][ T8112] total_pgfault 3710 [ 618.846180][ T8112] total_pgmajfault 3 [ 618.850262][ T8112] total_inactive_anon 113156096 [ 618.855144][ T8112] total_active_anon 198750208 [ 618.859993][ T8112] total_inactive_file 0 [ 618.864254][ T8112] total_active_file 0 [ 618.868337][ T8112] total_unevictable 0 [ 618.872339][ T8112] anon_cost 0 [ 618.897152][ T8112] file_cost 0 [ 618.900701][ T8112] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.96,pid=8112,uid=0 [ 618.915529][ T8112] Memory cgroup out of memory: Killed process 8112 (syz.1.96) total-vm:44504kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 618.920339][ T8100] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 618.945734][ T8100] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 619.013652][ T8100] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 619.041552][ T8100] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 619.075691][ T8114] syz.1.97 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=1000 [ 619.112738][ T8114] CPU: 0 UID: 0 PID: 8114 Comm: syz.1.97 Not tainted syzkaller #0 PREEMPT(full) [ 619.112768][ T8114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 619.112783][ T8114] Call Trace: [ 619.112791][ T8114] [ 619.112801][ T8114] dump_stack_lvl+0x189/0x250 [ 619.112839][ T8114] ? __pfx_dump_stack_lvl+0x10/0x10 [ 619.112870][ T8114] ? __pfx__printk+0x10/0x10 [ 619.112903][ T8114] ? rcu_is_watching+0x15/0xb0 [ 619.112929][ T8114] dump_header+0xd3/0x480 [ 619.112950][ T8114] oom_kill_process+0x387/0x920 [ 619.112976][ T8114] out_of_memory+0xf09/0x12a0 [ 619.113001][ T8114] ? mem_cgroup_iter+0x3b/0x460 [ 619.113026][ T8114] ? __pfx_out_of_memory+0x10/0x10 [ 619.113052][ T8114] mem_cgroup_out_of_memory+0x145/0x240 [ 619.113076][ T8114] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 619.113104][ T8114] ? _raw_spin_unlock+0x28/0x50 [ 619.113128][ T8114] ? memcg1_oom_prepare+0x37f/0x450 [ 619.113158][ T8114] try_charge_memcg+0xdff/0x1290 [ 619.113197][ T8114] ? __pfx_try_charge_memcg+0x10/0x10 [ 619.113226][ T8114] ? rcu_is_watching+0x15/0xb0 [ 619.113248][ T8114] ? lock_release+0x4b/0x3e0 [ 619.113267][ T8114] ? percpu_ref_tryget+0x15/0x180 [ 619.113288][ T8114] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 619.113314][ T8114] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 619.113343][ T8114] __memcg_kmem_charge_page+0xe1/0x240 [ 619.113371][ T8114] __alloc_frozen_pages_noprof+0x1b5/0x370 [ 619.113398][ T8114] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 619.113430][ T8114] alloc_pages_mpol+0x232/0x4a0 [ 619.113451][ T8114] alloc_pages_noprof+0xa9/0x190 [ 619.113472][ T8114] pte_alloc_one+0x21/0x170 [ 619.113497][ T8114] __pte_alloc+0x25/0x1a0 [ 619.113521][ T8114] __handle_mm_fault+0x4985/0x5400 [ 619.113558][ T8114] ? __pfx___handle_mm_fault+0x10/0x10 [ 619.113588][ T8114] ? rcu_is_watching+0x15/0xb0 [ 619.113616][ T8114] ? lock_vma_under_rcu+0x3cb/0x450 [ 619.113641][ T8114] ? rcu_is_watching+0x15/0xb0 [ 619.113665][ T8114] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 619.113687][ T8114] handle_mm_fault+0x40a/0x8e0 [ 619.113721][ T8114] do_user_addr_fault+0xa81/0x1390 [ 619.113747][ T8114] ? rcu_is_watching+0x15/0xb0 [ 619.113769][ T8114] ? trace_page_fault_user+0x84/0x1e0 [ 619.113791][ T8114] exc_page_fault+0x82/0x100 [ 619.113820][ T8114] asm_exc_page_fault+0x26/0x30 [ 619.113840][ T8114] RIP: 0033:0x7f6587756958 [ 619.113858][ T8114] Code: fc 89 37 c3 c5 fa 6f 06 c5 fa 6f 4c 16 f0 c5 fa 7f 07 c5 fa 7f 4c 17 f0 c3 66 0f 1f 84 00 00 00 00 00 48 8b 4c 16 f8 48 8b 36 <48> 89 37 48 89 4c 17 f8 c3 c5 fe 6f 54 16 e0 c5 fe 6f 5c 16 c0 c5 [ 619.113876][ T8114] RSP: 002b:00007ffcf03da258 EFLAGS: 00010206 [ 619.113896][ T8114] RAX: 0000200000001140 RBX: 0000000000000004 RCX: 0030626c6c756e72 [ 619.113911][ T8114] RDX: 000000000000000d RSI: 756e722f7665642f RDI: 0000200000001140 [ 619.113926][ T8114] RBP: 0000000000000000 R08: 0000001b33920000 R09: 0000000000000001 [ 619.113940][ T8114] R10: 0000000000000001 R11: 0000000000000009 R12: 0000000000000000 [ 619.113951][ T8114] R13: 00000000000927c0 R14: fffffffffffffffe R15: 00007ffcf03da510 [ 619.113975][ T8114] [ 619.113984][ T8114] memory: usage 307200kB, limit 307200kB, failcnt 3138 [ 619.382417][ T8100] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.414013][ T8114] memory+swap: usage 312064kB, limit 9007199254740988kB, failcnt 0 [ 619.565090][ T8114] kmem: usage 2588kB, limit 9007199254740988kB, failcnt 0 [ 619.572368][ T8114] Memory cgroup stats for /syz1: [ 619.572508][ T8114] cache 311574528 [ 619.581401][ T8114] rss 348160 [ 619.584621][ T8114] rss_huge 0 [ 619.588129][ T8114] shmem 311574528 [ 619.609013][ T8114] mapped_file 0 [ 619.612527][ T8114] dirty 0 [ 619.618157][ T8114] writeback 0 [ 619.625469][ T8100] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.638733][ T8114] workingset_refault_anon 0 [ 619.646575][ T2960] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.653741][ T2960] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.669187][ T8114] workingset_refault_file 0 [ 619.675535][ T2960] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.682727][ T2960] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.683958][ T8114] swap 4980736 [ 619.722587][ T8114] swapcached 0 [ 619.726058][ T8114] pgpgin 79779 [ 619.737776][ T8114] pgpgout 3626 [ 619.741211][ T8114] pgfault 3742 [ 619.744701][ T8114] pgmajfault 3 [ 619.751537][ T8114] inactive_anon 113156096 [ 619.758106][ T8114] active_anon 198766592 [ 619.762381][ T8114] inactive_file 0 [ 619.766202][ T8114] active_file 0 [ 619.770454][ T8100] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 619.780532][ T32] oom_reaper: reaped process 6444 (syz.2.30), now anon-rss:88kB, file-rss:168kB, shmem-rss:0kB [ 619.791874][ T8114] unevictable 0 [ 619.816425][ T8100] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 619.816497][ T8114] hierarchical_memory_limit 314572800 [ 619.832819][ T8114] hierarchical_memsw_limit 9223372036854771712 [ 619.839164][ T8114] total_cache 311574528 [ 619.843518][ T8114] total_rss 348160 [ 619.847262][ T8114] total_rss_huge 0 [ 619.873497][ T8114] total_shmem 311574528 [ 619.878090][ T8114] total_mapped_file 0 [ 619.882112][ T8114] total_dirty 0 [ 619.885595][ T8114] total_writeback 0 [ 619.895266][ T8114] total_workingset_refault_anon 0 [ 619.924351][ T8114] total_workingset_refault_file 0 [ 619.936374][ T8114] total_swap 4980736 [ 619.941399][ T8114] total_swapcached 0 [ 619.945326][ T8114] total_pgpgin 79779 [ 619.949705][ T8114] total_pgpgout 3626 [ 619.953642][ T8114] total_pgfault 3742 [ 619.959060][ T8114] total_pgmajfault 3 [ 619.963097][ T8114] total_inactive_anon 113156096 [ 619.968352][ T8114] total_active_anon 198766592 [ 619.974004][ T8114] total_inactive_file 0 [ 619.978576][ T8114] total_active_file 0 [ 619.982580][ T8114] total_unevictable 0 [ 619.987083][ T8114] anon_cost 0 [ 619.990916][ T8114] file_cost 0 [ 619.994236][ T8114] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.97,pid=8114,uid=0 [ 620.047267][ T8114] Memory cgroup out of memory: Killed process 8114 (syz.1.97) total-vm:44504kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 620.146267][ T8110] syz.2.95 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 620.149389][ T8100] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 620.174955][ T8110] CPU: 1 UID: 0 PID: 8110 Comm: syz.2.95 Not tainted syzkaller #0 PREEMPT(full) [ 620.174986][ T8110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 620.175000][ T8110] Call Trace: [ 620.175008][ T8110] [ 620.175017][ T8110] dump_stack_lvl+0x189/0x250 [ 620.175057][ T8110] ? __pfx_dump_stack_lvl+0x10/0x10 [ 620.175088][ T8110] ? __pfx__printk+0x10/0x10 [ 620.175120][ T8110] ? rcu_is_watching+0x15/0xb0 [ 620.175146][ T8110] dump_header+0xd3/0x480 [ 620.175167][ T8110] oom_kill_process+0x387/0x920 [ 620.175193][ T8110] out_of_memory+0xf09/0x12a0 [ 620.175218][ T8110] ? mem_cgroup_iter+0x3b/0x460 [ 620.175243][ T8110] ? __pfx_out_of_memory+0x10/0x10 [ 620.175269][ T8110] mem_cgroup_out_of_memory+0x145/0x240 [ 620.175293][ T8110] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 620.175321][ T8110] ? _raw_spin_unlock+0x28/0x50 [ 620.175344][ T8110] ? memcg1_oom_prepare+0x37f/0x450 [ 620.175373][ T8110] try_charge_memcg+0xdff/0x1290 [ 620.175408][ T8110] ? percpu_ref_tryget+0x15/0x180 [ 620.175430][ T8110] ? __pfx_try_charge_memcg+0x10/0x10 [ 620.175460][ T8110] ? lock_release+0x4b/0x3e0 [ 620.175479][ T8110] ? percpu_ref_tryget+0x15/0x180 [ 620.175496][ T8110] ? percpu_ref_tryget+0x15/0x180 [ 620.175517][ T8110] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 620.175544][ T8110] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 620.175572][ T8110] __memcg_kmem_charge_page+0xe1/0x240 [ 620.175601][ T8110] memcg_charge_kernel_stack+0x2f5/0x500 [ 620.175641][ T8110] dup_task_struct+0x1ab/0x860 [ 620.175668][ T8110] copy_process+0x54b/0x3c00 [ 620.175694][ T8110] ? free_swap_cache+0x109/0x300 [ 620.175720][ T8110] ? __might_fault+0xb0/0x130 [ 620.175748][ T8110] ? rcu_is_watching+0x15/0xb0 [ 620.175776][ T8110] ? __pfx_copy_process+0x10/0x10 [ 620.175801][ T8110] ? __might_fault+0xcc/0x130 [ 620.175834][ T8110] kernel_clone+0x21e/0x840 [ 620.175863][ T8110] ? __pfx_kernel_clone+0x10/0x10 2025/08/27 23:11:53 executed programs: 88 [ 620.175892][ T8110] ? __handle_mm_fault+0x1033/0x5400 [ 620.175924][ T8110] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 620.175955][ T8110] __se_sys_clone3+0x256/0x2d0 [ 620.175981][ T8110] ? lock_acquire+0x5f/0x360 [ 620.176000][ T8110] ? __pfx___se_sys_clone3+0x10/0x10 [ 620.176033][ T8110] ? _copy_to_user+0x8a/0xb0 [ 620.176065][ T8110] ? do_user_addr_fault+0xc8a/0x1390 [ 620.176088][ T8110] ? rcu_is_watching+0x15/0xb0 [ 620.176111][ T8110] do_syscall_64+0xfa/0xfa0 [ 620.176140][ T8110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.176160][ T8110] ? clear_bhb_loop+0x60/0xb0 [ 620.176182][ T8110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.176202][ T8110] RIP: 0033:0x7fa56bbc3449 [ 620.176220][ T8110] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 620.176239][ T8110] RSP: 002b:00007ffdd47aa438 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 620.176261][ T8110] RAX: ffffffffffffffda RBX: 00007fa56bb45860 RCX: 00007fa56bbc3449 [ 620.176277][ T8110] RDX: 00007fa56bb45860 RSI: 0000000000000058 RDI: 00007ffdd47aa480 [ 620.176291][ T8110] RBP: 00007fa56c95f6c0 R08: 00007fa56c95f6c0 R09: 00007ffdd47aa567 [ 620.176305][ T8110] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 620.176318][ T8110] R13: 000000000000000b R14: 00007ffdd47aa480 R15: 00007ffdd47aa568 [ 620.176341][ T8110] [ 620.176350][ T8110] memory: usage 307200kB, limit 307200kB, failcnt 3172 [ 620.580398][ T8110] memory+swap: usage 314896kB, limit 9007199254740988kB, failcnt 0 [ 620.593299][ T8110] kmem: usage 2584kB, limit 9007199254740988kB, failcnt 0 [ 620.600636][ T8110] Memory cgroup stats for /syz2: [ 620.600770][ T8110] cache 311582720 [ 620.609883][ T8110] rss 344064 [ 620.613108][ T8110] rss_huge 0 [ 620.628320][ T8110] shmem 311582720 [ 620.640774][ T8110] mapped_file 0 [ 620.644451][ T8110] dirty 0 [ 620.652450][ T8110] writeback 0 [ 620.657668][ T8110] workingset_refault_anon 0 [ 620.662208][ T8110] workingset_refault_file 0 [ 620.670798][ T8110] swap 7880704 [ 620.674219][ T8110] swapcached 0 [ 620.677948][ T8110] pgpgin 80673 [ 620.681441][ T8110] pgpgout 4519 [ 620.684838][ T8110] pgfault 3601 [ 620.689091][ T8110] pgmajfault 3 [ 620.692577][ T8110] inactive_anon 119988224 [ 620.696923][ T8110] active_anon 191938560 [ 620.701830][ T8110] inactive_file 0 [ 620.706193][ T8110] active_file 0 [ 620.710127][ T8110] unevictable 0 [ 620.713616][ T8110] hierarchical_memory_limit 314572800 [ 620.755092][ T8110] hierarchical_memsw_limit 9223372036854771712 [ 620.762035][ T8110] total_cache 311582720 [ 620.775012][ T8110] total_rss 344064 [ 620.779294][ T8110] total_rss_huge 0 [ 620.783158][ T8110] total_shmem 311582720 [ 620.788247][ T8110] total_mapped_file 0 [ 620.792278][ T8110] total_dirty 0 [ 620.795790][ T8110] total_writeback 0 [ 620.800929][ T8110] total_workingset_refault_anon 0 [ 620.808040][ T8110] total_workingset_refault_file 0 [ 620.809085][ T5917] Bluetooth: hci74: command tx timeout [ 620.815466][ T8110] total_swap 7880704 [ 620.843072][ T8110] total_swapcached 0 [ 620.847168][ T8110] total_pgpgin 80673 [ 620.851274][ T8110] total_pgpgout 4519 [ 620.856013][ T8110] total_pgfault 3601 [ 620.862697][ T8110] total_pgmajfault 3 [ 620.866708][ T8110] total_inactive_anon 119988224 [ 620.877042][ T8100] veth0_vlan: entered promiscuous mode [ 620.885401][ T8110] total_active_anon 191938560 [ 620.903665][ T8110] total_inactive_file 0 [ 620.909383][ T8100] veth1_vlan: entered promiscuous mode [ 620.915219][ T8110] total_active_file 0 [ 620.921187][ T8110] total_unevictable 0 [ 620.948202][ T8110] anon_cost 0 [ 620.951551][ T8110] file_cost 0 [ 620.954936][ T8110] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.95,pid=8110,uid=0 [ 620.987067][ T8100] veth0_macvtap: entered promiscuous mode [ 620.993047][ T8110] Memory cgroup out of memory: Killed process 8110 (syz.2.95) total-vm:44636kB, anon-rss:948kB, file-rss:1060kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 621.012872][ T8058] syz-executor invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=0 [ 621.052225][ T8100] veth1_macvtap: entered promiscuous mode [ 621.094608][ T8100] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 621.108279][ T8058] CPU: 0 UID: 0 PID: 8058 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 621.108308][ T8058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 621.108322][ T8058] Call Trace: [ 621.108330][ T8058] [ 621.108339][ T8058] dump_stack_lvl+0x189/0x250 [ 621.108377][ T8058] ? __pfx_dump_stack_lvl+0x10/0x10 [ 621.108407][ T8058] ? __pfx__printk+0x10/0x10 [ 621.108438][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.108464][ T8058] dump_header+0xd3/0x480 [ 621.108484][ T8058] oom_kill_process+0x387/0x920 [ 621.108510][ T8058] out_of_memory+0xf09/0x12a0 [ 621.108535][ T8058] ? mem_cgroup_iter+0x3b/0x460 [ 621.108558][ T8058] ? __pfx_out_of_memory+0x10/0x10 [ 621.108591][ T8058] mem_cgroup_out_of_memory+0x145/0x240 [ 621.108615][ T8058] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 621.108643][ T8058] ? _raw_spin_unlock+0x28/0x50 [ 621.108667][ T8058] ? memcg1_oom_prepare+0x37f/0x450 [ 621.108696][ T8058] try_charge_memcg+0xdff/0x1290 [ 621.108734][ T8058] ? __pfx_try_charge_memcg+0x10/0x10 [ 621.108763][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.108785][ T8058] ? lock_release+0x4b/0x3e0 [ 621.108804][ T8058] ? percpu_ref_tryget+0x15/0x180 [ 621.108826][ T8058] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 621.108853][ T8058] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 621.108882][ T8058] __memcg_kmem_charge_page+0xe1/0x240 [ 621.108909][ T8058] __alloc_frozen_pages_noprof+0x1b5/0x370 [ 621.108935][ T8058] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 621.108961][ T8058] ? page_counter_try_charge+0x23c/0x320 [ 621.108987][ T8058] ? policy_nodemask+0x27c/0x720 [ 621.109020][ T8058] alloc_pages_mpol+0x232/0x4a0 [ 621.109041][ T8058] alloc_pages_noprof+0xa9/0x190 [ 621.109061][ T8058] __pmd_alloc+0x3a/0x3b0 [ 621.109092][ T8058] copy_pmd_range+0x7ae9/0x7f00 [ 621.109115][ T8058] ? __lruvec_stat_mod_folio+0x6f/0x2e0 [ 621.109138][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.109160][ T8058] ? __lruvec_stat_mod_folio+0x6f/0x2e0 [ 621.109182][ T8058] ? lock_release+0x4b/0x3e0 [ 621.109201][ T8058] ? mod_memcg_lruvec_state+0x1bb/0x370 [ 621.109226][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.109251][ T8058] ? __pfx_copy_pmd_range+0x10/0x10 [ 621.109268][ T8058] ? do_raw_spin_lock+0x121/0x290 [ 621.109296][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.109319][ T8058] ? do_raw_spin_unlock+0x122/0x240 [ 621.109348][ T8058] ? _raw_spin_unlock+0x28/0x50 [ 621.109372][ T8058] ? __pud_alloc+0x1db/0x260 [ 621.109402][ T8058] copy_page_range+0xc14/0x1270 [ 621.109437][ T8058] ? __pfx_copy_page_range+0x10/0x10 [ 621.109463][ T8058] ? anon_vma_fork+0x4a2/0x500 [ 621.109486][ T8058] dup_mmap+0xf57/0x1ac0 [ 621.109513][ T8058] ? __pfx_dup_mmap+0x10/0x10 [ 621.109536][ T8058] ? mm_init+0xd69/0xfa0 [ 621.109568][ T8058] copy_mm+0x13c/0x4b0 [ 621.109594][ T8058] copy_process+0x1706/0x3c00 [ 621.109625][ T8058] ? copy_process+0x97f/0x3c00 [ 621.109652][ T8058] ? __pfx_copy_process+0x10/0x10 [ 621.109682][ T8058] kernel_clone+0x21e/0x840 [ 621.109708][ T8058] ? css_rstat_updated+0x23a/0x4f0 [ 621.109731][ T8058] ? __pfx_kernel_clone+0x10/0x10 [ 621.109760][ T8058] ? count_memcg_event_mm+0x21/0x260 [ 621.109788][ T8058] ? count_memcg_event_mm+0x21/0x260 [ 621.109818][ T8058] __x64_sys_clone+0x18b/0x1e0 [ 621.109843][ T8058] ? count_memcg_events+0x10b/0x270 [ 621.109866][ T8058] ? __pfx___x64_sys_clone+0x10/0x10 [ 621.109900][ T8058] ? do_user_addr_fault+0xc8a/0x1390 [ 621.109924][ T8058] ? rcu_is_watching+0x15/0xb0 [ 621.109948][ T8058] do_syscall_64+0xfa/0xfa0 [ 621.109975][ T8058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.109995][ T8058] ? clear_bhb_loop+0x60/0xb0 [ 621.110018][ T8058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.110037][ T8058] RIP: 0033:0x7f6587785453 [ 621.110055][ T8058] Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 [ 621.110074][ T8058] RSP: 002b:00007ffcf03da378 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 621.110095][ T8058] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6587785453 [ 621.110110][ T8058] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 621.110123][ T8058] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 621.110134][ T8058] R10: 00005555651817d0 R11: 0000000000000246 R12: 0000000000000000 [ 621.110148][ T8058] R13: 00000000000927c0 R14: 00000000000971e6 R15: 00007ffcf03da510 [ 621.110169][ T8058] [ 621.110178][ T8058] memory: usage 307200kB, limit 307200kB, failcnt 3181 [ 621.215260][ T8100] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 621.219375][ T8058] memory+swap: usage 312064kB, limit 9007199254740988kB, failcnt 0 [ 621.307719][ T2960] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.589481][ T8058] kmem: usage 2512kB, limit 9007199254740988kB, failcnt 0 [ 621.705077][ T8058] Memory cgroup stats for /syz1: [ 621.705212][ T8058] cache 311574528 [ 621.714072][ T8058] rss 348160 [ 621.717323][ T8058] rss_huge 0 [ 621.718782][ T2960] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.720692][ T8058] shmem 311574528 [ 621.733919][ T8058] mapped_file 0 [ 621.737637][ T8058] dirty 0 [ 621.740599][ T8058] writeback 0 [ 621.765365][ T8058] workingset_refault_anon 0 [ 621.766245][ T2960] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.770677][ T8058] workingset_refault_file 0 [ 621.783772][ T8058] swap 4980736 [ 621.787255][ T8058] swapcached 0 [ 621.794550][ T8058] pgpgin 79779 [ 621.798195][ T8058] pgpgout 3626 [ 621.801593][ T8058] pgfault 3751 [ 621.804987][ T8058] pgmajfault 3 [ 621.808890][ T8058] inactive_anon 113156096 [ 621.813311][ T8058] active_anon 198766592 [ 621.817590][ T8058] inactive_file 0 [ 621.821717][ T2960] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.822083][ T8058] active_file 0 [ 621.835209][ T8058] unevictable 0 [ 621.867010][ T8058] hierarchical_memory_limit 314572800 [ 621.873213][ T8058] hierarchical_memsw_limit 9223372036854771712 [ 621.879680][ T8058] total_cache 311574528 [ 621.883873][ T8058] total_rss 348160 [ 621.888546][ T8058] total_rss_huge 0 [ 621.892479][ T8058] total_shmem 311574528 [ 621.896651][ T8058] total_mapped_file 0 [ 621.901308][ T8058] total_dirty 0 [ 621.904816][ T8058] total_writeback 0 [ 621.908906][ T8058] total_workingset_refault_anon 0 [ 621.913951][ T8058] total_workingset_refault_file 0 [ 621.919636][ T8058] total_swap 4980736 [ 621.923552][ T8058] total_swapcached 0 [ 621.928993][ T8058] total_pgpgin 79779 [ 621.934871][ T8058] total_pgpgout 3626 [ 621.960392][ T8058] total_pgfault 3751 [ 621.964351][ T8058] total_pgmajfault 3 [ 621.968507][ T8058] total_inactive_anon 113156096 [ 621.973381][ T8058] total_active_anon 198766592 [ 621.989584][ T8058] total_inactive_file 0 [ 621.993829][ T8058] total_active_file 0 [ 622.000215][ T2960] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.007558][ T8058] total_unevictable 0 [ 622.013345][ T2960] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.025520][ T8058] anon_cost 0 [ 622.038296][ T8058] file_cost 0 [ 622.041719][ T8058] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.18,pid=6137,uid=0 [ 622.078683][ T8058] Memory cgroup out of memory: Killed process 6138 (syz.1.18) total-vm:44768kB, anon-rss:944kB, file-rss:168kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 622.097395][ T8063] syz-executor invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 622.107287][ T8063] CPU: 0 UID: 0 PID: 8063 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 622.107317][ T8063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 622.107331][ T8063] Call Trace: [ 622.107341][ T8063] [ 622.107350][ T8063] dump_stack_lvl+0x189/0x250 [ 622.107388][ T8063] ? __pfx_dump_stack_lvl+0x10/0x10 [ 622.107423][ T8063] ? __pfx__printk+0x10/0x10 [ 622.107453][ T8063] ? rcu_is_watching+0x15/0xb0 [ 622.107477][ T8063] dump_header+0xd3/0x480 [ 622.107502][ T8063] oom_kill_process+0x387/0x920 [ 622.107528][ T8063] out_of_memory+0xf09/0x12a0 [ 622.107553][ T8063] ? mem_cgroup_iter+0x3b/0x460 [ 622.107576][ T8063] ? __pfx_out_of_memory+0x10/0x10 [ 622.107601][ T8063] mem_cgroup_out_of_memory+0x145/0x240 [ 622.107623][ T8063] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 622.107650][ T8063] ? _raw_spin_unlock+0x28/0x50 [ 622.107673][ T8063] ? memcg1_oom_prepare+0x37f/0x450 [ 622.107701][ T8063] try_charge_memcg+0xdff/0x1290 [ 622.107736][ T8063] ? __pfx_try_charge_memcg+0x10/0x10 [ 622.107763][ T8063] ? get_mem_cgroup_from_mm+0x38/0x2a0 [ 622.107786][ T8063] ? rcu_is_watching+0x15/0xb0 [ 622.107807][ T8063] ? lock_release+0x4b/0x3e0 [ 622.107825][ T8063] ? percpu_ref_tryget+0x15/0x180 [ 622.107846][ T8063] charge_memcg+0x9f/0x180 [ 622.107876][ T8063] __mem_cgroup_charge+0x25/0x80 [ 622.107905][ T8063] folio_prealloc+0x51/0x180 [ 622.107926][ T8063] do_wp_page+0x1231/0x5800 [ 622.107965][ T8063] ? __pfx_do_wp_page+0x10/0x10 [ 622.107991][ T8063] ? do_raw_spin_lock+0x121/0x290 [ 622.108020][ T8063] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 622.108045][ T8063] ? ___pte_offset_map+0x45/0x250 [ 622.108079][ T8063] __handle_mm_fault+0x1033/0x5400 [ 622.108116][ T8063] ? __pfx___handle_mm_fault+0x10/0x10 [ 622.108145][ T8063] ? rcu_is_watching+0x15/0xb0 [ 622.108172][ T8063] ? lock_vma_under_rcu+0x3cb/0x450 [ 622.108190][ T8063] ? rcu_is_watching+0x15/0xb0 [ 622.108213][ T8063] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 622.108235][ T8063] handle_mm_fault+0x40a/0x8e0 [ 622.108269][ T8063] do_user_addr_fault+0xa81/0x1390 [ 622.108293][ T8063] ? rcu_is_watching+0x15/0xb0 [ 622.108316][ T8063] ? trace_page_fault_user+0x84/0x1e0 [ 622.108338][ T8063] exc_page_fault+0x82/0x100 [ 622.108365][ T8063] asm_exc_page_fault+0x26/0x30 [ 622.108384][ T8063] RIP: 0033:0x7fa56bbb69a1 [ 622.108403][ T8063] Code: d7 eb b2 66 0f 1f 44 00 00 64 48 8b 0c 25 10 00 00 00 8b 91 08 03 00 00 48 8d b9 08 03 00 00 89 d6 83 ce 02 39 d6 74 21 89 d0 0f b1 37 89 c6 75 1b 83 e2 3b 83 ca 02 83 fa 0a 74 14 89 f0 c3 [ 622.108422][ T8063] RSP: 002b:00007ffdd47aa878 EFLAGS: 00010202 [ 622.108441][ T8063] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000555581b10500 [ 622.108456][ T8063] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000555581b10808 [ 622.108470][ T8063] RBP: 00007ffdd47aa92c R08: 000000000a882994 R09: 7fffffffffffffff [ 622.108486][ T8063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 622.108507][ T8063] R13: 00000000000927c0 R14: 0000000000097a78 R15: 00007ffdd47aa980 [ 622.108531][ T8063] [ 622.203875][ T3530] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.439363][ T8063] memory: usage 307200kB, limit 307200kB, failcnt 3262 [ 622.446331][ T8063] memory+swap: usage 314896kB, limit 9007199254740988kB, failcnt 0 [ 622.455845][ T8063] kmem: usage 2584kB, limit 9007199254740988kB, failcnt 0 [ 622.476547][ T8063] Memory cgroup stats for /syz2: [ 622.476687][ T8063] cache 311582720 [ 622.485444][ T8063] rss 344064 [ 622.489353][ T8063] rss_huge 0 [ 622.492586][ T8063] shmem 311582720 [ 622.496247][ T8063] mapped_file 0 [ 622.501732][ T8063] dirty 0 [ 622.504713][ T8063] writeback 0 [ 622.508184][ T8063] workingset_refault_anon 0 [ 622.512715][ T8063] workingset_refault_file 0 [ 622.517236][ T8063] swap 7880704 [ 622.520792][ T8063] swapcached 0 [ 622.524182][ T8063] pgpgin 80686 [ 622.527655][ T8063] pgpgout 4532 [ 622.531049][ T8063] pgfault 3645 [ 622.534441][ T8063] pgmajfault 3 [ 622.537982][ T8063] inactive_anon 119988224 [ 622.542336][ T8063] active_anon 191938560 [ 622.546507][ T8063] inactive_file 0 [ 622.550282][ T8063] active_file 0 [ 622.553764][ T8063] unevictable 0 [ 622.557241][ T8063] hierarchical_memory_limit 314572800 [ 622.570368][ T8063] hierarchical_memsw_limit 9223372036854771712 [ 622.576572][ T8063] total_cache 311582720 [ 622.587085][ T8063] total_rss 344064 [ 622.590930][ T8063] total_rss_huge 0 [ 622.594673][ T8063] total_shmem 311582720 [ 622.599019][ T8063] total_mapped_file 0 [ 622.603023][ T8063] total_dirty 0 [ 622.606496][ T8063] total_writeback 0 [ 622.611428][ T8063] total_workingset_refault_anon 0 [ 622.616495][ T8063] total_workingset_refault_file 0 [ 622.621866][ T8063] total_swap 7880704 [ 622.625872][ T8063] total_swapcached 0 [ 622.629964][ T8063] total_pgpgin 80686 [ 622.633874][ T8063] total_pgpgout 4532 [ 622.637940][ T8063] total_pgfault 3645 [ 622.641852][ T8063] total_pgmajfault 3 [ 622.645763][ T8063] total_inactive_anon 119988224 [ 622.660056][ T8063] total_active_anon 191938560 [ 622.677291][ T8063] total_inactive_file 0 [ 622.682596][ T8063] total_active_file 0 [ 622.686758][ T8063] total_unevictable 0 [ 622.691031][ T8063] anon_cost 0 [ 622.694363][ T8063] file_cost 0 [ 622.697979][ T8063] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.99,pid=8134,uid=0 [ 622.712744][ T3530] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.734667][ T8063] Memory cgroup out of memory: Killed process 8134 (syz.2.99) total-vm:44636kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 622.813961][ T8136] syz.5.94 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 622.823837][ T8136] CPU: 1 UID: 0 PID: 8136 Comm: syz.5.94 Not tainted syzkaller #0 PREEMPT(full) [ 622.823864][ T8136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 622.823877][ T8136] Call Trace: [ 622.823886][ T8136] [ 622.823895][ T8136] dump_stack_lvl+0x189/0x250 [ 622.823932][ T8136] ? __pfx_dump_stack_lvl+0x10/0x10 [ 622.823963][ T8136] ? __pfx__printk+0x10/0x10 [ 622.823995][ T8136] ? rcu_is_watching+0x15/0xb0 [ 622.824020][ T8136] dump_header+0xd3/0x480 [ 622.824040][ T8136] oom_kill_process+0x387/0x920 [ 622.824066][ T8136] out_of_memory+0xf09/0x12a0 [ 622.824091][ T8136] ? mem_cgroup_iter+0x3b/0x460 [ 622.824114][ T8136] ? __pfx_out_of_memory+0x10/0x10 [ 622.824140][ T8136] mem_cgroup_out_of_memory+0x145/0x240 [ 622.824163][ T8136] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 622.824192][ T8136] ? _raw_spin_unlock+0x28/0x50 [ 622.824228][ T8136] ? memcg1_oom_prepare+0x37f/0x450 [ 622.824258][ T8136] try_charge_memcg+0xdff/0x1290 [ 622.824292][ T8136] ? percpu_ref_tryget+0x15/0x180 [ 622.824313][ T8136] ? __pfx_try_charge_memcg+0x10/0x10 [ 622.824343][ T8136] ? lock_release+0x4b/0x3e0 [ 622.824361][ T8136] ? percpu_ref_tryget+0x15/0x180 [ 622.824379][ T8136] ? percpu_ref_tryget+0x15/0x180 [ 622.824400][ T8136] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 622.824426][ T8136] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 622.824456][ T8136] __memcg_kmem_charge_page+0xe1/0x240 [ 622.824484][ T8136] memcg_charge_kernel_stack+0x2f5/0x500 [ 622.824515][ T8136] dup_task_struct+0x406/0x860 [ 622.824541][ T8136] copy_process+0x54b/0x3c00 [ 622.824565][ T8136] ? free_swap_cache+0x109/0x300 [ 622.824592][ T8136] ? __might_fault+0xb0/0x130 [ 622.824620][ T8136] ? rcu_is_watching+0x15/0xb0 [ 622.824648][ T8136] ? __pfx_copy_process+0x10/0x10 [ 622.824671][ T8136] ? __might_fault+0xcc/0x130 [ 622.824705][ T8136] kernel_clone+0x21e/0x840 [ 622.824732][ T8136] ? __pfx_kernel_clone+0x10/0x10 [ 622.824757][ T8136] ? __handle_mm_fault+0x1033/0x5400 [ 622.824790][ T8136] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 622.824821][ T8136] __se_sys_clone3+0x256/0x2d0 [ 622.824847][ T8136] ? lock_acquire+0x5f/0x360 [ 622.824865][ T8136] ? __pfx___se_sys_clone3+0x10/0x10 [ 622.824899][ T8136] ? _copy_to_user+0x8a/0xb0 [ 622.824930][ T8136] ? do_user_addr_fault+0xc8a/0x1390 [ 622.824953][ T8136] ? rcu_is_watching+0x15/0xb0 [ 622.824978][ T8136] do_syscall_64+0xfa/0xfa0 [ 622.825005][ T8136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.825024][ T8136] ? clear_bhb_loop+0x60/0xb0 [ 622.825047][ T8136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.825067][ T8136] RIP: 0033:0x7fa57a3c3449 [ 622.825085][ T8136] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 622.825104][ T8136] RSP: 002b:00007ffcbea1d4f8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 622.825126][ T8136] RAX: ffffffffffffffda RBX: 00007fa57a345860 RCX: 00007fa57a3c3449 [ 622.825142][ T8136] RDX: 00007fa57a345860 RSI: 0000000000000058 RDI: 00007ffcbea1d540 [ 622.825156][ T8136] RBP: 00007fa57b28e6c0 R08: 00007fa57b28e6c0 R09: 00007ffcbea1d627 [ 622.825170][ T8136] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 622.825184][ T8136] R13: 000000000000000b R14: 00007ffcbea1d540 R15: 00007ffcbea1d628 [ 622.825212][ T8136] [ 622.825220][ T8136] memory: usage 307184kB, limit 307200kB, failcnt 971 [ 622.898179][ T5917] Bluetooth: hci74: command tx timeout [ 622.931311][ T8136] memory+swap: usage 324828kB, limit 9007199254740988kB, failcnt 0 [ 622.931334][ T8136] kmem: usage 2652kB, limit 9007199254740988kB, failcnt 0 [ 623.243442][ T8136] Memory cgroup stats for /syz5: [ 623.243581][ T8136] cache 311324672 [ 623.252324][ T8136] rss 516096 [ 623.255540][ T8136] rss_huge 0 [ 623.259575][ T8136] shmem 311324672 [ 623.263240][ T8136] mapped_file 0 [ 623.266711][ T8136] dirty 0 [ 623.269793][ T8136] writeback 0 [ 623.273269][ T8136] workingset_refault_anon 0 [ 623.313006][ T8136] workingset_refault_file 23 [ 623.317960][ T8136] swap 18067456 [ 623.321717][ T8136] swapcached 0 [ 623.325301][ T8136] pgpgin 82452 [ 623.330037][ T8136] pgpgout 6319 [ 623.333457][ T8136] pgfault 3627 [ 623.336877][ T8136] pgmajfault 2 [ 623.340622][ T8136] inactive_anon 303050752 [ 623.344986][ T8136] active_anon 8790016 [ 623.351310][ T8136] inactive_file 0 [ 623.355053][ T8136] active_file 0 [ 623.359249][ T8136] unevictable 0 [ 623.362916][ T8136] hierarchical_memory_limit 314572800 [ 623.369607][ T8136] hierarchical_memsw_limit 9223372036854771712 [ 623.375827][ T8136] total_cache 311324672 [ 623.403385][ T8136] total_rss 516096 [ 623.407175][ T8136] total_rss_huge 0 [ 623.411055][ T8136] total_shmem 311324672 [ 623.415320][ T8136] total_mapped_file 0 [ 623.420204][ T8136] total_dirty 0 [ 623.423699][ T8136] total_writeback 0 [ 623.428384][ T8136] total_workingset_refault_anon 0 [ 623.433446][ T8136] total_workingset_refault_file 23 [ 623.439515][ T8136] total_swap 18067456 [ 623.443549][ T8136] total_swapcached 0 [ 623.448560][ T8136] total_pgpgin 82452 [ 623.452488][ T8136] total_pgpgout 6319 [ 623.456403][ T8136] total_pgfault 3627 [ 623.464790][ T8136] total_pgmajfault 2 [ 623.468863][ T8136] total_inactive_anon 303050752 [ 623.473867][ T8136] total_active_anon 8790016 [ 623.479123][ T8136] total_inactive_file 0 [ 623.515180][ T8136] total_active_file 0 [ 623.522013][ T8136] total_unevictable 0 [ 623.526175][ T8136] anon_cost 0 [ 623.530507][ T8136] file_cost 0 [ 623.533820][ T8136] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.72,pid=7609,uid=0 [ 623.552078][ T8136] Memory cgroup out of memory: Killed process 7610 (syz.5.72) total-vm:44768kB, anon-rss:944kB, file-rss:1320kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 623.570904][ T8137] syz.2.100 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=1000 [ 623.595711][ T8137] CPU: 1 UID: 0 PID: 8137 Comm: syz.2.100 Not tainted syzkaller #0 PREEMPT(full) [ 623.595740][ T8137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 623.595754][ T8137] Call Trace: [ 623.595761][ T8137] [ 623.595769][ T8137] dump_stack_lvl+0x189/0x250 [ 623.595800][ T8137] ? __pfx_dump_stack_lvl+0x10/0x10 [ 623.595825][ T8137] ? __pfx__printk+0x10/0x10 [ 623.595851][ T8137] ? rcu_is_watching+0x15/0xb0 [ 623.595873][ T8137] dump_header+0xd3/0x480 [ 623.595894][ T8137] oom_kill_process+0x387/0x920 [ 623.595915][ T8137] out_of_memory+0xf09/0x12a0 [ 623.595936][ T8137] ? mem_cgroup_iter+0x3b/0x460 [ 623.595957][ T8137] ? __pfx_out_of_memory+0x10/0x10 [ 623.595978][ T8137] mem_cgroup_out_of_memory+0x145/0x240 [ 623.595997][ T8137] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 623.596020][ T8137] ? _raw_spin_unlock+0x28/0x50 [ 623.596039][ T8137] ? memcg1_oom_prepare+0x37f/0x450 [ 623.596063][ T8137] try_charge_memcg+0xdff/0x1290 [ 623.596094][ T8137] ? __pfx_try_charge_memcg+0x10/0x10 [ 623.596118][ T8137] ? rcu_is_watching+0x15/0xb0 [ 623.596136][ T8137] ? lock_release+0x4b/0x3e0 [ 623.596165][ T8137] ? percpu_ref_tryget+0x15/0x180 [ 623.596183][ T8137] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 623.596205][ T8137] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 623.596228][ T8137] __memcg_kmem_charge_page+0xe1/0x240 [ 623.596250][ T8137] __alloc_frozen_pages_noprof+0x1b5/0x370 [ 623.596271][ T8137] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 623.596289][ T8137] ? do_raw_spin_unlock+0x122/0x240 [ 623.596314][ T8137] ? finish_fault+0xe70/0x1080 [ 623.596337][ T8137] ? policy_nodemask+0x27c/0x720 [ 623.596364][ T8137] alloc_pages_mpol+0x232/0x4a0 [ 623.596381][ T8137] alloc_pages_noprof+0xa9/0x190 [ 623.596396][ T8137] pte_alloc_one+0x21/0x170 [ 623.596419][ T8137] __handle_mm_fault+0x2767/0x5400 [ 623.596448][ T8137] ? __pfx___handle_mm_fault+0x10/0x10 [ 623.596472][ T8137] ? rcu_is_watching+0x15/0xb0 [ 623.596494][ T8137] ? lock_vma_under_rcu+0x3cb/0x450 [ 623.596508][ T8137] ? rcu_is_watching+0x15/0xb0 [ 623.596527][ T8137] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 623.596544][ T8137] handle_mm_fault+0x40a/0x8e0 [ 623.596571][ T8137] do_user_addr_fault+0xa81/0x1390 [ 623.596591][ T8137] ? rcu_is_watching+0x15/0xb0 [ 623.596608][ T8137] ? trace_page_fault_user+0x84/0x1e0 [ 623.596625][ T8137] exc_page_fault+0x82/0x100 [ 623.596648][ T8137] asm_exc_page_fault+0x26/0x30 [ 623.596663][ T8137] RIP: 0033:0x7fa56ba52775 [ 623.596678][ T8137] Code: 00 00 00 66 90 53 48 8b 1d 48 56 36 00 45 31 d2 31 c9 48 8b 17 45 31 db 4c 8d 83 00 00 40 00 48 89 d0 0f 1f 00 4c 39 c0 73 6b <44> 0f b6 08 48 83 c0 01 4c 89 ce 83 e6 7f 48 d3 e6 49 09 f2 45 84 [ 623.596693][ T8137] RSP: 002b:00007ffdd47aa6c0 EFLAGS: 00010287 [ 623.596709][ T8137] RAX: 0000001b33820000 RBX: 0000001b33820000 RCX: 0000000000000000 [ 623.596721][ T8137] RDX: 0000001b33820000 RSI: 00007ffdd47aa6b0 RDI: 00007ffdd47aa798 [ 623.596733][ T8137] RBP: 0000000000000000 R08: 0000001b33c20000 R09: 0000000000000000 [ 623.596744][ T8137] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 623.596753][ T8137] R13: 00000000000927c0 R14: 0000000000097a78 R15: 00007ffdd47aa980 [ 623.596772][ T8137] [ 623.596784][ T8137] memory: usage 307200kB, limit 307200kB, failcnt 3328 [ 623.980101][ T8137] memory+swap: usage 314896kB, limit 9007199254740988kB, failcnt 0 [ 623.988222][ T8137] kmem: usage 2556kB, limit 9007199254740988kB, failcnt 0 [ 624.009184][ T8137] Memory cgroup stats for /syz2: [ 624.009325][ T8137] cache 311582720 [ 624.018644][ T8137] rss 294912 [ 624.021878][ T8137] rss_huge 0 [ 624.025100][ T8137] shmem 311582720 [ 624.037069][ T8137] mapped_file 0 [ 624.040759][ T8137] dirty 0 [ 624.043711][ T8137] writeback 0 [ 624.047013][ T8137] workingset_refault_anon 0 [ 624.051685][ T8137] workingset_refault_file 0 [ 624.056210][ T8137] swap 7880704 [ 624.060519][ T8137] swapcached 0 [ 624.063928][ T8137] pgpgin 80687 [ 624.067313][ T8137] pgpgout 4545 [ 624.072184][ T8137] pgfault 3650 [ 624.075589][ T8137] pgmajfault 3 [ 624.079397][ T8137] inactive_anon 119988224 [ 624.083877][ T8137] active_anon 191889408 [ 624.089078][ T8137] inactive_file 0 [ 624.092737][ T8137] active_file 0 [ 624.117741][ T8137] unevictable 0 [ 624.121253][ T8137] hierarchical_memory_limit 314572800 [ 624.126796][ T8137] hierarchical_memsw_limit 9223372036854771712 [ 624.133646][ T8137] total_cache 311582720 [ 624.138354][ T8137] total_rss 294912 [ 624.142104][ T8137] total_rss_huge 0 [ 624.145951][ T8137] total_shmem 311582720 [ 624.150683][ T8137] total_mapped_file 0 [ 624.154692][ T8137] total_dirty 0 [ 624.158670][ T8137] total_writeback 0 [ 624.162613][ T8137] total_workingset_refault_anon 0 [ 624.170015][ T8137] total_workingset_refault_file 0 [ 624.173509][ T32] oom_reaper: reaped process 6138 (syz.1.18), now anon-rss:0kB, file-rss:168kB, shmem-rss:0kB [ 624.175194][ T8137] total_swap 7880704 [ 624.190080][ T8137] total_swapcached 0 [ 624.194010][ T8137] total_pgpgin 80687 [ 624.198321][ T8137] total_pgpgout 4545 [ 624.218388][ T8137] total_pgfault 3650 [ 624.222336][ T8137] total_pgmajfault 3 [ 624.226252][ T8137] total_inactive_anon 119988224 [ 624.231759][ T8137] total_active_anon 191889408 [ 624.236556][ T8137] total_inactive_file 0 [ 624.241251][ T8137] total_active_file 0 [ 624.245603][ T8137] total_unevictable 0 [ 624.254707][ T8137] anon_cost 0 [ 624.258454][ T8137] file_cost 0 [ 624.261765][ T8137] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.100,pid=8137,uid=0 [ 624.277997][ T8137] Memory cgroup out of memory: Killed process 8137 (syz.2.100) total-vm:44504kB, anon-rss:948kB, file-rss:1052kB, shmem-rss:0kB, UID:0 pgtables:56kB oom_score_adj:1000 [ 624.332383][ T8135] syz.1.98 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 624.356124][ T8135] CPU: 0 UID: 0 PID: 8135 Comm: syz.1.98 Not tainted syzkaller #0 PREEMPT(full) [ 624.356154][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 624.356168][ T8135] Call Trace: [ 624.356176][ T8135] [ 624.356185][ T8135] dump_stack_lvl+0x189/0x250 [ 624.356222][ T8135] ? __pfx_dump_stack_lvl+0x10/0x10 [ 624.356253][ T8135] ? __pfx__printk+0x10/0x10 [ 624.356286][ T8135] ? rcu_is_watching+0x15/0xb0 [ 624.356313][ T8135] dump_header+0xd3/0x480 [ 624.356333][ T8135] oom_kill_process+0x387/0x920 [ 624.356359][ T8135] out_of_memory+0xf09/0x12a0 [ 624.356384][ T8135] ? mem_cgroup_iter+0x3b/0x460 [ 624.356409][ T8135] ? __pfx_out_of_memory+0x10/0x10 [ 624.356436][ T8135] mem_cgroup_out_of_memory+0x145/0x240 [ 624.356459][ T8135] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 624.356488][ T8135] ? _raw_spin_unlock+0x28/0x50 [ 624.356511][ T8135] ? memcg1_oom_prepare+0x37f/0x450 [ 624.356541][ T8135] try_charge_memcg+0xdff/0x1290 [ 624.356570][ T8135] ? stack_depot_save_flags+0x40/0x860 [ 624.356603][ T8135] ? rcu_is_watching+0x15/0xb0 [ 624.356627][ T8135] ? __pfx_try_charge_memcg+0x10/0x10 [ 624.356657][ T8135] ? rcu_irq_exit_check_preempt+0x201/0x210 [ 624.356681][ T8135] ? lock_release+0x4b/0x3e0 [ 624.356701][ T8135] ? percpu_ref_tryget+0x15/0x180 [ 624.356722][ T8135] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 624.356748][ T8135] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 624.356777][ T8135] obj_cgroup_charge_pages+0x1e/0xa0 [ 624.356803][ T8135] obj_cgroup_charge_account+0xcf/0x660 [ 624.356830][ T8135] ? obj_cgroup_charge_account+0x13b/0x660 [ 624.356858][ T8135] __memcg_slab_post_alloc_hook+0x3dc/0x7d0 [ 624.356894][ T8135] kmem_cache_alloc_node_noprof+0x2a9/0x390 [ 624.356925][ T8135] ? dup_task_struct+0x52/0x860 [ 624.356950][ T8135] dup_task_struct+0x52/0x860 [ 624.356977][ T8135] copy_process+0x54b/0x3c00 [ 624.357003][ T8135] ? free_swap_cache+0x109/0x300 [ 624.357036][ T8135] ? __might_fault+0xb0/0x130 [ 624.357064][ T8135] ? rcu_is_watching+0x15/0xb0 [ 624.357092][ T8135] ? __pfx_copy_process+0x10/0x10 [ 624.357116][ T8135] ? __might_fault+0xcc/0x130 [ 624.357150][ T8135] kernel_clone+0x21e/0x840 [ 624.357177][ T8135] ? __pfx_kernel_clone+0x10/0x10 [ 624.357199][ T8135] ? __handle_mm_fault+0x1033/0x5400 [ 624.357230][ T8135] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 624.357259][ T8135] __se_sys_clone3+0x256/0x2d0 [ 624.357286][ T8135] ? lock_acquire+0x5f/0x360 [ 624.357305][ T8135] ? __pfx___se_sys_clone3+0x10/0x10 [ 624.357339][ T8135] ? _copy_to_user+0x8a/0xb0 [ 624.357370][ T8135] ? rcu_is_watching+0x15/0xb0 [ 624.357395][ T8135] ? rcu_is_watching+0x15/0xb0 [ 624.357422][ T8135] do_syscall_64+0xfa/0xfa0 [ 624.357448][ T8135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.357467][ T8135] ? clear_bhb_loop+0x60/0xb0 [ 624.357490][ T8135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.357510][ T8135] RIP: 0033:0x7f65877c3449 [ 624.357528][ T8135] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 624.357545][ T8135] RSP: 002b:00007ffcf03d9fc8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 624.357567][ T8135] RAX: ffffffffffffffda RBX: 00007f6587745860 RCX: 00007f65877c3449 [ 624.357582][ T8135] RDX: 00007f6587745860 RSI: 0000000000000058 RDI: 00007ffcf03da010 [ 624.357595][ T8135] RBP: 00007f6586dfe6c0 R08: 00007f6586dfe6c0 R09: 00007ffcf03da0f7 [ 624.357609][ T8135] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 624.357622][ T8135] R13: 000000000000000b R14: 00007ffcf03da010 R15: 00007ffcf03da0f8 [ 624.357644][ T8135] [ 624.775130][ T8135] memory: usage 307196kB, limit 307200kB, failcnt 3287 [ 624.782267][ T8135] memory+swap: usage 311988kB, limit 9007199254740988kB, failcnt 0 [ 624.790379][ T8135] kmem: usage 2576kB, limit 9007199254740988kB, failcnt 0 [ 624.797599][ T8135] Memory cgroup stats for /syz1: [ 624.797745][ T8135] cache 311574528 [ 624.806431][ T8135] rss 356352 [ 624.810100][ T8135] rss_huge 0 [ 624.835124][ T8135] shmem 311574528 [ 624.838903][ T8135] mapped_file 0 [ 624.842382][ T8135] dirty 0 [ 624.845333][ T8135] writeback 0 [ 624.851952][ T8135] workingset_refault_anon 0 [ 624.856490][ T8135] workingset_refault_file 0 [ 624.872720][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.882233][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.890971][ T8135] swap 4907008 [ 624.894394][ T8135] swapcached 0 [ 624.899293][ T8135] pgpgin 79792 [ 624.902704][ T8135] pgpgout 3637 [ 624.906090][ T8135] pgfault 3798 [ 624.910174][ T8135] pgmajfault 3 [ 624.913567][ T8135] inactive_anon 113147904 [ 624.930628][ T8135] active_anon 198782976 [ 624.934854][ T8135] inactive_file 0 [ 624.944059][ T8135] active_file 0 [ 624.947915][ T8135] unevictable 0 [ 624.951468][ T8135] hierarchical_memory_limit 314572800 [ 624.956938][ T8135] hierarchical_memsw_limit 9223372036854771712 [ 624.963649][ T8135] total_cache 311574528 [ 624.971402][ T8135] total_rss 356352 [ 624.975236][ T8135] total_rss_huge 0 [ 624.980887][ T8135] total_shmem 311574528 [ 624.985136][ T8135] total_mapped_file 0 [ 624.990336][ T8135] total_dirty 0 [ 624.993830][ T8135] total_writeback 0 [ 624.998148][ T8135] total_workingset_refault_anon 0 [ 625.003284][ T8135] total_workingset_refault_file 0 [ 625.008790][ T8135] total_swap 4907008 [ 625.012705][ T8135] total_swapcached 0 [ 625.016729][ T8135] total_pgpgin 79792 [ 625.042728][ T8135] total_pgpgout 3637 [ 625.046693][ T8135] total_pgfault 3798 [ 625.064709][ T8135] total_pgmajfault 3 [ 625.068970][ T8135] total_inactive_anon 113147904 [ 625.073847][ T8135] total_active_anon 198782976 [ 625.080289][ T8135] total_inactive_file 0 [ 625.084471][ T8135] total_active_file 0 [ 625.089851][ T8135] total_unevictable 0 [ 625.093899][ T8135] anon_cost 0 [ 625.097198][ T8135] file_cost 0 [ 625.101619][ T8135] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.98,pid=8135,uid=0 [ 625.117728][ T8135] Memory cgroup out of memory: Killed process 8135 (syz.1.98) total-vm:44636kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:80kB oom_score_adj:1000 [ 625.162128][ T8063] syz-executor invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=0 [ 625.189552][ T8063] CPU: 0 UID: 0 PID: 8063 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 625.189582][ T8063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 625.189596][ T8063] Call Trace: [ 625.189604][ T8063] [ 625.189614][ T8063] dump_stack_lvl+0x189/0x250 [ 625.189653][ T8063] ? __pfx_dump_stack_lvl+0x10/0x10 [ 625.189683][ T8063] ? __pfx__printk+0x10/0x10 [ 625.189716][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.189743][ T8063] dump_header+0xd3/0x480 [ 625.189763][ T8063] oom_kill_process+0x387/0x920 [ 625.189789][ T8063] out_of_memory+0xf09/0x12a0 [ 625.189815][ T8063] ? mem_cgroup_iter+0x3b/0x460 [ 625.189840][ T8063] ? __pfx_out_of_memory+0x10/0x10 [ 625.189867][ T8063] mem_cgroup_out_of_memory+0x145/0x240 [ 625.189892][ T8063] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 625.189920][ T8063] ? _raw_spin_unlock+0x28/0x50 [ 625.189946][ T8063] ? memcg1_oom_prepare+0x37f/0x450 [ 625.189976][ T8063] try_charge_memcg+0xdff/0x1290 [ 625.190014][ T8063] ? __pfx_try_charge_memcg+0x10/0x10 [ 625.190044][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.190067][ T8063] ? lock_release+0x4b/0x3e0 [ 625.190086][ T8063] ? percpu_ref_tryget+0x15/0x180 [ 625.190108][ T8063] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 625.190136][ T8063] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 625.190165][ T8063] __memcg_kmem_charge_page+0xe1/0x240 [ 625.190193][ T8063] __alloc_frozen_pages_noprof+0x1b5/0x370 [ 625.190219][ T8063] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 625.190246][ T8063] ? page_counter_try_charge+0x23c/0x320 [ 625.190274][ T8063] ? policy_nodemask+0x27c/0x720 [ 625.190319][ T8063] alloc_pages_mpol+0x232/0x4a0 [ 625.190340][ T8063] alloc_pages_noprof+0xa9/0x190 [ 625.190360][ T8063] __pmd_alloc+0x3a/0x3b0 [ 625.190392][ T8063] copy_pmd_range+0x7ae9/0x7f00 [ 625.190416][ T8063] ? __lruvec_stat_mod_folio+0x6f/0x2e0 [ 625.190440][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.190462][ T8063] ? __lruvec_stat_mod_folio+0x6f/0x2e0 [ 625.190484][ T8063] ? lock_release+0x4b/0x3e0 [ 625.190503][ T8063] ? mod_memcg_lruvec_state+0x1bb/0x370 [ 625.190528][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.190553][ T8063] ? __pfx_copy_pmd_range+0x10/0x10 [ 625.190570][ T8063] ? do_raw_spin_lock+0x121/0x290 [ 625.190599][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.190624][ T8063] ? do_raw_spin_unlock+0x122/0x240 [ 625.190654][ T8063] ? _raw_spin_unlock+0x28/0x50 [ 625.190677][ T8063] ? __pud_alloc+0x1db/0x260 [ 625.190707][ T8063] copy_page_range+0xc14/0x1270 [ 625.190744][ T8063] ? __pfx_copy_page_range+0x10/0x10 [ 625.190770][ T8063] ? anon_vma_fork+0x4a2/0x500 [ 625.190793][ T8063] dup_mmap+0xf57/0x1ac0 [ 625.190821][ T8063] ? __pfx_dup_mmap+0x10/0x10 [ 625.190844][ T8063] ? mm_init+0xd69/0xfa0 [ 625.190870][ T8063] copy_mm+0x13c/0x4b0 [ 625.190895][ T8063] copy_process+0x1706/0x3c00 [ 625.190927][ T8063] ? copy_process+0x97f/0x3c00 [ 625.190955][ T8063] ? __pfx_copy_process+0x10/0x10 [ 625.190985][ T8063] kernel_clone+0x21e/0x840 [ 625.191011][ T8063] ? css_rstat_updated+0x23a/0x4f0 [ 625.191035][ T8063] ? __pfx_kernel_clone+0x10/0x10 [ 625.191063][ T8063] ? count_memcg_event_mm+0x21/0x260 [ 625.191088][ T8063] ? count_memcg_event_mm+0x21/0x260 [ 625.191116][ T8063] __x64_sys_clone+0x18b/0x1e0 [ 625.191140][ T8063] ? count_memcg_events+0x10b/0x270 [ 625.191159][ T8063] ? __pfx___x64_sys_clone+0x10/0x10 [ 625.191186][ T8063] ? do_user_addr_fault+0xc8a/0x1390 [ 625.191204][ T8063] ? rcu_is_watching+0x15/0xb0 [ 625.191224][ T8063] do_syscall_64+0xfa/0xfa0 [ 625.191246][ T8063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.191263][ T8063] ? clear_bhb_loop+0x60/0xb0 [ 625.191280][ T8063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 625.191302][ T8063] RIP: 0033:0x7fa56bb85453 [ 625.191317][ T8063] Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 [ 625.191332][ T8063] RSP: 002b:00007ffdd47aa7e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 625.191350][ T8063] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa56bb85453 [ 625.191362][ T8063] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 625.191373][ T8063] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 625.191382][ T8063] R10: 0000555581b107d0 R11: 0000000000000246 R12: 0000000000000000 [ 625.191393][ T8063] R13: 00000000000927c0 R14: 000000000009812f R15: 00007ffdd47aa980 [ 625.191411][ T8063] [ 625.191424][ T8063] memory: usage 307200kB, limit 307200kB, failcnt 3354 [ 625.615801][ T32] oom_reaper: reaped process 7610 (syz.5.72), now anon-rss:112kB, file-rss:80kB, shmem-rss:0kB [ 625.617789][ T8063] memory+swap: usage 314896kB, limit 9007199254740988kB, failcnt 0 [ 625.778351][ T8063] kmem: usage 2500kB, limit 9007199254740988kB, failcnt 0 [ 625.785507][ T8063] Memory cgroup stats for /syz2: [ 625.785637][ T8063] cache 311582720 [ 625.794852][ T8063] rss 331776 [ 625.798123][ T8063] rss_huge 0 [ 625.801338][ T8063] shmem 311582720 [ 625.804986][ T8063] mapped_file 0 [ 625.808538][ T8063] dirty 0 [ 625.811493][ T8063] writeback 0 2025/08/27 23:11:58 executed programs: 94 [ 625.825346][ T8063] workingset_refault_anon 0 [ 625.830255][ T8063] workingset_refault_file 0 [ 625.834775][ T8063] swap 7880704 [ 625.859299][ T8063] swapcached 0 [ 625.862932][ T8063] pgpgin 80696 [ 625.866326][ T8063] pgpgout 4545 [ 625.870055][ T8063] pgfault 3683 [ 625.873455][ T8063] pgmajfault 3 [ 625.876848][ T8063] inactive_anon 119988224 [ 625.882653][ T8063] active_anon 191926272 [ 625.886849][ T8063] inactive_file 0 [ 625.891361][ T8063] active_file 0 [ 625.894920][ T8063] unevictable 0 [ 625.898871][ T8063] hierarchical_memory_limit 314572800 [ 625.904486][ T8063] hierarchical_memsw_limit 9223372036854771712 [ 625.911047][ T8063] total_cache 311582720 [ 625.915273][ T8063] total_rss 331776 [ 625.919117][ T8063] total_rss_huge 0 [ 625.923041][ T8063] total_shmem 311582720 [ 625.927220][ T8063] total_mapped_file 0 [ 625.931866][ T8063] total_dirty 0 [ 625.935421][ T8063] total_writeback 0 [ 625.961766][ T8063] total_workingset_refault_anon 0 [ 625.966922][ T8063] total_workingset_refault_file 0 [ 625.972827][ T8063] total_swap 7880704 [ 625.976741][ T8063] total_swapcached 0 [ 625.981993][ T8063] total_pgpgin 80696 [ 625.985930][ T8063] total_pgpgout 4545 [ 625.993085][ T8063] total_pgfault 3683 [ 625.997012][ T8063] total_pgmajfault 3 [ 626.002908][ T8063] total_inactive_anon 119988224 [ 626.013157][ T8063] total_active_anon 191926272 [ 626.018023][ T8063] total_inactive_file 0 [ 626.022350][ T8063] total_active_file 0 [ 626.026420][ T8063] total_unevictable 0 [ 626.030511][ T8063] anon_cost 0 [ 626.033936][ T8063] file_cost 0 [ 626.037625][ T8063] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.60,pid=7263,uid=0 [ 626.068818][ T8063] Memory cgroup out of memory: Killed process 7264 (syz.2.60) total-vm:44768kB, anon-rss:944kB, file-rss:168kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000 [ 626.086446][ T8058] syz-executor invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=0 [ 626.109845][ T8058] CPU: 1 UID: 0 PID: 8058 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 626.109875][ T8058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 626.109889][ T8058] Call Trace: [ 626.109898][ T8058] [ 626.109907][ T8058] dump_stack_lvl+0x189/0x250 [ 626.109945][ T8058] ? __pfx_dump_stack_lvl+0x10/0x10 [ 626.109978][ T8058] ? __pfx__printk+0x10/0x10 [ 626.110018][ T8058] ? rcu_is_watching+0x15/0xb0 [ 626.110043][ T8058] dump_header+0xd3/0x480 [ 626.110065][ T8058] oom_kill_process+0x387/0x920 [ 626.110091][ T8058] out_of_memory+0xf09/0x12a0 [ 626.110116][ T8058] ? mem_cgroup_iter+0x3b/0x460 [ 626.110141][ T8058] ? __pfx_out_of_memory+0x10/0x10 [ 626.110166][ T8058] mem_cgroup_out_of_memory+0x145/0x240 [ 626.110189][ T8058] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 626.110218][ T8058] ? _raw_spin_unlock+0x28/0x50 [ 626.110242][ T8058] ? memcg1_oom_prepare+0x37f/0x450 [ 626.110273][ T8058] try_charge_memcg+0xdff/0x1290 [ 626.110307][ T8058] ? percpu_ref_tryget+0x15/0x180 [ 626.110329][ T8058] ? __pfx_try_charge_memcg+0x10/0x10 [ 626.110359][ T8058] ? lock_release+0x4b/0x3e0 [ 626.110379][ T8058] ? percpu_ref_tryget+0x15/0x180 [ 626.110397][ T8058] ? percpu_ref_tryget+0x15/0x180 [ 626.110419][ T8058] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 626.110446][ T8058] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 626.110475][ T8058] obj_cgroup_charge_pages+0x1e/0xa0 [ 626.110503][ T8058] obj_cgroup_charge_account+0xcf/0x660 [ 626.110531][ T8058] ? obj_cgroup_charge_account+0x13b/0x660 [ 626.110559][ T8058] __memcg_slab_post_alloc_hook+0x3dc/0x7d0 [ 626.110595][ T8058] kmem_cache_alloc_noprof+0x2ab/0x390 [ 626.110624][ T8058] ? anon_vma_clone+0x3a9/0x4f0 [ 626.110643][ T8058] anon_vma_clone+0x3a9/0x4f0 [ 626.110666][ T8058] anon_vma_fork+0x79/0x500 [ 626.110684][ T8058] ? vm_area_dup+0x4f5/0x680 [ 626.110702][ T8058] ? __vm_enough_memory+0x11b/0x380 [ 626.110730][ T8058] dup_mmap+0x9eb/0x1ac0 [ 626.110754][ T8058] ? __pfx_dup_mmap+0x10/0x10 [ 626.110776][ T8058] ? mm_init+0xd69/0xfa0 [ 626.110799][ T8058] copy_mm+0x13c/0x4b0 [ 626.110823][ T8058] copy_process+0x1706/0x3c00 [ 626.110853][ T8058] ? copy_process+0x97f/0x3c00 [ 626.110878][ T8058] ? __pfx_copy_process+0x10/0x10 [ 626.110906][ T8058] kernel_clone+0x21e/0x840 [ 626.110930][ T8058] ? css_rstat_updated+0x23a/0x4f0 [ 626.110953][ T8058] ? __pfx_kernel_clone+0x10/0x10 [ 626.110980][ T8058] ? count_memcg_event_mm+0x21/0x260 [ 626.111013][ T8058] ? count_memcg_event_mm+0x21/0x260 [ 626.111042][ T8058] __x64_sys_clone+0x18b/0x1e0 [ 626.111066][ T8058] ? count_memcg_events+0x10b/0x270 [ 626.111087][ T8058] ? __pfx___x64_sys_clone+0x10/0x10 [ 626.111120][ T8058] ? do_user_addr_fault+0xc8a/0x1390 [ 626.111142][ T8058] ? rcu_is_watching+0x15/0xb0 [ 626.111165][ T8058] do_syscall_64+0xfa/0xfa0 [ 626.111192][ T8058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.111212][ T8058] ? clear_bhb_loop+0x60/0xb0 [ 626.111232][ T8058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.111251][ T8058] RIP: 0033:0x7f6587785453 [ 626.111269][ T8058] Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 [ 626.111286][ T8058] RSP: 002b:00007ffcf03da378 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 626.111306][ T8058] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6587785453 [ 626.111320][ T8058] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 626.111332][ T8058] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 626.111344][ T8058] R10: 00005555651817d0 R11: 0000000000000246 R12: 0000000000000000 [ 626.111356][ T8058] R13: 00000000000927c0 R14: 0000000000097e6c R15: 00007ffcf03da510 [ 626.111376][ T8058] [ 626.111385][ T8058] memory: usage 307200kB, limit 307200kB, failcnt 3337 [ 626.585640][ T8058] memory+swap: usage 311992kB, limit 9007199254740988kB, failcnt 0 [ 626.593873][ T8058] kmem: usage 2536kB, limit 9007199254740988kB, failcnt 0 [ 626.601126][ T8058] Memory cgroup stats for /syz1: [ 626.601262][ T8058] cache 311574528 [ 626.618817][ T8058] rss 303104 [ 626.622076][ T8058] rss_huge 0 [ 626.625285][ T8058] shmem 311574528 [ 626.630165][ T8058] mapped_file 0 [ 626.633663][ T8058] dirty 0 [ 626.636622][ T8058] writeback 0 [ 626.640265][ T8058] workingset_refault_anon 0 [ 626.644800][ T8058] workingset_refault_file 0 [ 626.650732][ T8058] swap 4907008 [ 626.654254][ T8058] swapcached 0 [ 626.683656][ T8058] pgpgin 79792 [ 626.687180][ T8058] pgpgout 3650 [ 626.693532][ T8058] pgfault 3803 [ 626.696954][ T8058] pgmajfault 3 [ 626.700735][ T8058] inactive_anon 113147904 [ 626.705129][ T8058] active_anon 198729728 [ 626.709583][ T8058] inactive_file 0 [ 626.713249][ T8058] active_file 0 [ 626.716717][ T8058] unevictable 0 [ 626.722323][ T8058] hierarchical_memory_limit 314572800 [ 626.730818][ T8058] hierarchical_memsw_limit 9223372036854771712 [ 626.737093][ T8058] total_cache 311574528 [ 626.741544][ T8058] total_rss 303104 [ 626.745290][ T8058] total_rss_huge 0 [ 626.749396][ T8058] total_shmem 311574528 [ 626.753573][ T8058] total_mapped_file 0 [ 626.757864][ T8058] total_dirty 0 [ 626.782370][ T8058] total_writeback 0 [ 626.786239][ T8058] total_workingset_refault_anon 0 [ 626.791569][ T8058] total_workingset_refault_file 0 [ 626.796616][ T8058] total_swap 4907008 [ 626.801056][ T8058] total_swapcached 0 [ 626.804975][ T8058] total_pgpgin 79792 [ 626.810137][ T8058] total_pgpgout 3650 [ 626.814081][ T8058] total_pgfault 3803 [ 626.821095][ T8058] total_pgmajfault 3 [ 626.825034][ T8058] total_inactive_anon 113147904 [ 626.832331][ T8058] total_active_anon 198729728 [ 626.837052][ T8058] total_inactive_file 0 [ 626.843008][ T8058] total_active_file 0 [ 626.847114][ T8058] total_unevictable 0 [ 626.851531][ T8058] anon_cost 0 [ 626.854949][ T8058] file_cost 0 [ 626.858495][ T8058] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.29,pid=6401,uid=0 [ 626.896262][ T5917] Bluetooth: hci52: command 0x0406 tx timeout [ 626.896470][ T6010] Bluetooth: hci50: command 0x0406 tx timeout [ 626.902637][ T51] Bluetooth: hci51: command 0x0406 tx timeout [ 626.917237][ T8058] Memory cgroup out of memory: Killed process 6402 (syz.1.29) total-vm:44768kB, anon-rss:944kB, file-rss:164kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 626.937951][ T8140] syz.5.103 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 626.961406][ T8140] CPU: 0 UID: 0 PID: 8140 Comm: syz.5.103 Not tainted syzkaller #0 PREEMPT(full) [ 626.961436][ T8140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 626.961449][ T8140] Call Trace: [ 626.961458][ T8140] [ 626.961467][ T8140] dump_stack_lvl+0x189/0x250 [ 626.961506][ T8140] ? __pfx_dump_stack_lvl+0x10/0x10 [ 626.961538][ T8140] ? __pfx__printk+0x10/0x10 [ 626.961570][ T8140] ? rcu_is_watching+0x15/0xb0 [ 626.961593][ T8140] dump_header+0xd3/0x480 [ 626.961613][ T8140] oom_kill_process+0x387/0x920 [ 626.961639][ T8140] out_of_memory+0xf09/0x12a0 [ 626.961664][ T8140] ? mem_cgroup_iter+0x3b/0x460 [ 626.961689][ T8140] ? __pfx_out_of_memory+0x10/0x10 [ 626.961715][ T8140] mem_cgroup_out_of_memory+0x145/0x240 [ 626.961740][ T8140] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 626.961767][ T8140] ? _raw_spin_unlock+0x28/0x50 [ 626.961791][ T8140] ? memcg1_oom_prepare+0x37f/0x450 [ 626.961820][ T8140] try_charge_memcg+0xdff/0x1290 [ 626.961854][ T8140] ? percpu_ref_tryget+0x15/0x180 [ 626.961875][ T8140] ? __pfx_try_charge_memcg+0x10/0x10 [ 626.961905][ T8140] ? lock_release+0x4b/0x3e0 [ 626.961923][ T8140] ? percpu_ref_tryget+0x15/0x180 [ 626.961954][ T8140] ? percpu_ref_tryget+0x15/0x180 [ 626.961975][ T8140] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 626.962003][ T8140] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 626.962030][ T8140] __memcg_kmem_charge_page+0xe1/0x240 [ 626.962058][ T8140] memcg_charge_kernel_stack+0x1c0/0x500 [ 626.962090][ T8140] dup_task_struct+0x1ab/0x860 [ 626.962117][ T8140] copy_process+0x54b/0x3c00 [ 626.962143][ T8140] ? free_swap_cache+0x109/0x300 [ 626.962169][ T8140] ? __might_fault+0xb0/0x130 [ 626.962199][ T8140] ? rcu_is_watching+0x15/0xb0 [ 626.962227][ T8140] ? __pfx_copy_process+0x10/0x10 [ 626.962252][ T8140] ? __might_fault+0xcc/0x130 [ 626.962286][ T8140] kernel_clone+0x21e/0x840 [ 626.962315][ T8140] ? __pfx_kernel_clone+0x10/0x10 [ 626.962340][ T8140] ? __handle_mm_fault+0x1033/0x5400 [ 626.962373][ T8140] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 626.962404][ T8140] __se_sys_clone3+0x256/0x2d0 [ 626.962432][ T8140] ? lock_acquire+0x5f/0x360 [ 626.962450][ T8140] ? __pfx___se_sys_clone3+0x10/0x10 [ 626.962485][ T8140] ? _copy_to_user+0x8a/0xb0 [ 626.962516][ T8140] ? do_user_addr_fault+0xc8a/0x1390 [ 626.962539][ T8140] ? rcu_is_watching+0x15/0xb0 [ 626.962563][ T8140] do_syscall_64+0xfa/0xfa0 [ 626.962591][ T8140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.962610][ T8140] ? clear_bhb_loop+0x60/0xb0 [ 626.962631][ T8140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.962650][ T8140] RIP: 0033:0x7fa57a3c3449 [ 626.962668][ T8140] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 626.962686][ T8140] RSP: 002b:00007ffcbea1d4f8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 626.962708][ T8140] RAX: ffffffffffffffda RBX: 00007fa57a345860 RCX: 00007fa57a3c3449 [ 626.962723][ T8140] RDX: 00007fa57a345860 RSI: 0000000000000058 RDI: 00007ffcbea1d540 [ 626.962737][ T8140] RBP: 00007fa57b28e6c0 R08: 00007fa57b28e6c0 R09: 00007ffcbea1d627 [ 626.962751][ T8140] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 626.962765][ T8140] R13: 000000000000000b R14: 00007ffcbea1d540 R15: 00007ffcbea1d628 [ 626.962788][ T8140] [ 626.962798][ T8140] memory: usage 307200kB, limit 307200kB, failcnt 1095 [ 626.999624][ T5917] Bluetooth: hci75: unexpected cc 0x0c03 length: 249 > 1 [ 626.999954][ T5917] Bluetooth: hci75: unexpected cc 0x1003 length: 249 > 9 [ 627.000192][ T5917] Bluetooth: hci75: unexpected cc 0x1001 length: 249 > 9 [ 627.000862][ T5917] Bluetooth: hci75: unexpected cc 0x0c23 length: 249 > 4 [ 627.001310][ T5917] Bluetooth: hci75: unexpected cc 0x0c38 length: 249 > 2 [ 627.441282][ T8140] memory+swap: usage 324844kB, limit 9007199254740988kB, failcnt 0 [ 627.451823][ T8140] kmem: usage 2640kB, limit 9007199254740988kB, failcnt 0 [ 627.459102][ T8140] Memory cgroup stats for /syz5: [ 627.459237][ T8140] cache 311324672 [ 627.468664][ T8140] rss 425984 [ 627.471901][ T8140] rss_huge 0 [ 627.475243][ T8140] shmem 311324672 [ 627.494560][ T8140] mapped_file 0 [ 627.517605][ T8140] dirty 0 [ 627.520608][ T8140] writeback 0 [ 627.523907][ T8140] workingset_refault_anon 0 [ 627.529513][ T8140] workingset_refault_file 23 [ 627.534133][ T8140] swap 18067456 [ 627.538029][ T8140] swapcached 0 [ 627.541517][ T8140] pgpgin 82466 [ 627.544913][ T8140] pgpgout 6355 [ 627.548701][ T8140] pgfault 3673 [ 627.552180][ T8140] pgmajfault 2 [ 627.555578][ T8140] inactive_anon 302956544 [ 627.560436][ T8140] active_anon 8794112 [ 627.564550][ T8140] inactive_file 0 [ 627.568572][ T8140] active_file 0 [ 627.572142][ T8140] unevictable 0 [ 627.575683][ T8140] hierarchical_memory_limit 314572800 [ 627.597117][ T8140] hierarchical_memsw_limit 9223372036854771712 [ 627.603634][ T8140] total_cache 311324672 [ 627.609099][ T8140] total_rss 425984 [ 627.612994][ T8140] total_rss_huge 0 [ 627.616782][ T8140] total_shmem 311324672 [ 627.621458][ T8140] total_mapped_file 0 [ 627.625463][ T8140] total_dirty 0 [ 627.629292][ T8140] total_writeback 0 [ 627.633123][ T8140] total_workingset_refault_anon 0 [ 627.638570][ T8140] total_workingset_refault_file 23 [ 627.643733][ T8140] total_swap 18067456 [ 627.648186][ T8140] total_swapcached 0 [ 627.652190][ T8140] total_pgpgin 82466 [ 627.656097][ T8140] total_pgpgout 6355 [ 627.660493][ T8140] total_pgfault 3673 [ 627.664419][ T8140] total_pgmajfault 2 [ 627.668729][ T8140] total_inactive_anon 302956544 [ 627.673601][ T8140] total_active_anon 8794112 [ 627.705151][ T8140] total_inactive_file 0 [ 627.709707][ T8140] total_active_file 0 [ 627.713709][ T8140] total_unevictable 0 [ 627.720169][ T8140] anon_cost 0 [ 627.723493][ T8140] file_cost 0 [ 627.727768][ T8140] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz5,task_memcg=/syz5,task=syz.5.62,pid=7323,uid=0 [ 627.767342][ T8140] Memory cgroup out of memory: Killed process 7324 (syz.5.62) total-vm:44768kB, anon-rss:944kB, file-rss:1316kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 627.798975][ T8144] chnl_net:caif_netlink_parms(): no params data found [ 627.976837][ T8144] bridge0: port 1(bridge_slave_0) entered blocking state [ 627.984350][ T8144] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.055532][ T8144] bridge_slave_0: entered allmulticast mode [ 628.079450][ T8144] bridge_slave_0: entered promiscuous mode [ 628.103586][ T32] oom_reaper: reaped process 7264 (syz.2.60), now anon-rss:100kB, file-rss:168kB, shmem-rss:0kB [ 628.124784][ T8144] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.132523][ T8144] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.140283][ T8144] bridge_slave_1: entered allmulticast mode [ 628.148454][ T8144] bridge_slave_1: entered promiscuous mode [ 628.185250][ T8141] syz.2.101 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 628.230025][ T8141] CPU: 1 UID: 0 PID: 8141 Comm: syz.2.101 Not tainted syzkaller #0 PREEMPT(full) [ 628.230055][ T8141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 628.230069][ T8141] Call Trace: [ 628.230078][ T8141] [ 628.230087][ T8141] dump_stack_lvl+0x189/0x250 [ 628.230124][ T8141] ? __pfx_dump_stack_lvl+0x10/0x10 [ 628.230155][ T8141] ? __pfx__printk+0x10/0x10 [ 628.230188][ T8141] ? rcu_is_watching+0x15/0xb0 [ 628.230213][ T8141] dump_header+0xd3/0x480 [ 628.230233][ T8141] oom_kill_process+0x387/0x920 [ 628.230258][ T8141] out_of_memory+0xf09/0x12a0 [ 628.230283][ T8141] ? mem_cgroup_iter+0x3b/0x460 [ 628.230312][ T8141] ? __pfx_out_of_memory+0x10/0x10 [ 628.230338][ T8141] mem_cgroup_out_of_memory+0x145/0x240 [ 628.230362][ T8141] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 628.230391][ T8141] ? _raw_spin_unlock+0x28/0x50 [ 628.230414][ T8141] ? memcg1_oom_prepare+0x37f/0x450 [ 628.230444][ T8141] try_charge_memcg+0xdff/0x1290 [ 628.230479][ T8141] ? percpu_ref_tryget+0x15/0x180 [ 628.230501][ T8141] ? __pfx_try_charge_memcg+0x10/0x10 [ 628.230530][ T8141] ? lock_release+0x4b/0x3e0 [ 628.230549][ T8141] ? percpu_ref_tryget+0x15/0x180 [ 628.230567][ T8141] ? percpu_ref_tryget+0x15/0x180 [ 628.230589][ T8141] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 628.230616][ T8141] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 628.230645][ T8141] __memcg_kmem_charge_page+0xe1/0x240 [ 628.230673][ T8141] memcg_charge_kernel_stack+0x28e/0x500 [ 628.230717][ T8141] dup_task_struct+0x1ab/0x860 [ 628.230744][ T8141] copy_process+0x54b/0x3c00 [ 628.230768][ T8141] ? __pfx_css_rstat_updated+0x10/0x10 [ 628.230807][ T8141] ? __might_fault+0xb0/0x130 [ 628.230836][ T8141] ? rcu_is_watching+0x15/0xb0 [ 628.230859][ T8141] ? page_table_check_set+0x18d/0x730 [ 628.230889][ T8141] ? rcu_is_watching+0x15/0xb0 [ 628.230914][ T8141] ? __pfx_copy_process+0x10/0x10 [ 628.230938][ T8141] ? __might_fault+0xcc/0x130 [ 628.230979][ T8141] kernel_clone+0x21e/0x840 [ 628.231006][ T8141] ? __pfx_kernel_clone+0x10/0x10 [ 628.231031][ T8141] ? __handle_mm_fault+0x3ada/0x5400 [ 628.231065][ T8141] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 628.231097][ T8141] __se_sys_clone3+0x256/0x2d0 [ 628.231124][ T8141] ? lock_acquire+0x5f/0x360 [ 628.231143][ T8141] ? __pfx___se_sys_clone3+0x10/0x10 [ 628.231178][ T8141] ? _copy_to_user+0x8a/0xb0 [ 628.231209][ T8141] ? do_user_addr_fault+0xc8a/0x1390 [ 628.231232][ T8141] ? rcu_is_watching+0x15/0xb0 [ 628.231256][ T8141] do_syscall_64+0xfa/0xfa0 [ 628.231285][ T8141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.231305][ T8141] ? clear_bhb_loop+0x60/0xb0 [ 628.231328][ T8141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.231348][ T8141] RIP: 0033:0x7fa56bbc3449 [ 628.231366][ T8141] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 628.231385][ T8141] RSP: 002b:00007ffdd47aa438 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 628.231408][ T8141] RAX: ffffffffffffffda RBX: 00007fa56bb45860 RCX: 00007fa56bbc3449 [ 628.231424][ T8141] RDX: 00007fa56bb45860 RSI: 0000000000000058 RDI: 00007ffdd47aa480 [ 628.231438][ T8141] RBP: 00007fa56c93e6c0 R08: 00007fa56c93e6c0 R09: 00007ffdd47aa567 [ 628.231452][ T8141] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 628.231466][ T8141] R13: 000000000000006e R14: 00007ffdd47aa480 R15: 00007ffdd47aa568 [ 628.231488][ T8141] [ 628.231519][ T8141] memory: usage 307200kB, limit 307200kB, failcnt 3606 [ 628.667771][ T8141] memory+swap: usage 314896kB, limit 9007199254740988kB, failcnt 0 [ 628.676380][ T8141] kmem: usage 2628kB, limit 9007199254740988kB, failcnt 0 [ 628.686710][ T8141] Memory cgroup stats for /syz2: [ 628.686850][ T8141] cache 311582720 [ 628.744858][ T8144] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 628.747513][ T8141] rss 290816 [ 628.758065][ T8141] rss_huge 0 [ 628.765724][ T8141] shmem 311582720 [ 628.775496][ T8144] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 628.777476][ T8141] mapped_file 0 [ 628.790040][ T8141] dirty 0 [ 628.793023][ T8141] writeback 0 [ 628.796333][ T8141] workingset_refault_anon 0 [ 628.801109][ T8141] workingset_refault_file 0 [ 628.805656][ T8141] swap 7880704 [ 628.853830][ T8141] swapcached 0 [ 628.858167][ T8141] pgpgin 80715 [ 628.866164][ T8144] team0: Port device team_slave_0 added [ 628.874484][ T8141] pgpgout 4574 [ 628.882883][ T8144] team0: Port device team_slave_1 added [ 628.889223][ T8141] pgfault 3736 [ 628.893400][ T8141] pgmajfault 3 [ 628.896807][ T8141] inactive_anon 119951360 [ 628.907876][ T8141] active_anon 191922176 [ 628.935241][ T8141] inactive_file 0 [ 628.939537][ T8141] active_file 0 [ 628.952276][ T8141] unevictable 0 [ 628.957553][ T8141] hierarchical_memory_limit 314572800 [ 628.971771][ T32] oom_reaper: reaped process 6402 (syz.1.29), now anon-rss:0kB, file-rss:164kB, shmem-rss:0kB [ 628.985656][ T8144] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 628.994400][ T8141] hierarchical_memsw_limit 9223372036854771712 [ 629.000858][ T8144] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.008778][ T8141] total_cache 311582720 [ 629.056644][ T5917] Bluetooth: hci75: command tx timeout [ 629.064879][ T8141] total_rss 290816 [ 629.069663][ T8141] total_rss_huge 0 [ 629.073560][ T8141] total_shmem 311582720 [ 629.078574][ T8141] total_mapped_file 0 [ 629.082639][ T8141] total_dirty 0 [ 629.085500][ T8144] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 629.086159][ T8141] total_writeback 0 [ 629.106196][ T8144] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 629.113395][ T8144] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.140489][ T8141] total_workingset_refault_anon 0 [ 629.140506][ T8141] total_workingset_refault_file 0 [ 629.140516][ T8141] total_swap 7880704 [ 629.140525][ T8141] total_swapcached 0 [ 629.140534][ T8141] total_pgpgin 80715 [ 629.140542][ T8141] total_pgpgout 4574 [ 629.140551][ T8141] total_pgfault 3736 [ 629.140560][ T8141] total_pgmajfault 3 [ 629.140569][ T8141] total_inactive_anon 119951360 [ 629.140578][ T8141] total_active_anon 191922176 [ 629.140588][ T8141] total_inactive_file 0 [ 629.140597][ T8141] total_active_file 0 [ 629.140606][ T8141] total_unevictable 0 [ 629.140615][ T8141] anon_cost 0 [ 629.140623][ T8141] file_cost 0 [ 629.140633][ T8141] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.101,pid=8141,uid=0 [ 629.140735][ T8141] Memory cgroup out of memory: Killed process 8141 (syz.2.101) total-vm:44768kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:72kB oom_score_adj:1000 [ 629.342277][ T8143] syz.1.102 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=1, oom_score_adj=1000 [ 629.365018][ T8143] CPU: 0 UID: 0 PID: 8143 Comm: syz.1.102 Not tainted syzkaller #0 PREEMPT(full) [ 629.365162][ T8143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 629.365178][ T8143] Call Trace: [ 629.365188][ T8143] [ 629.365199][ T8143] dump_stack_lvl+0x189/0x250 [ 629.365236][ T8143] ? __pfx_dump_stack_lvl+0x10/0x10 [ 629.365268][ T8143] ? __pfx__printk+0x10/0x10 [ 629.365299][ T8143] ? rcu_is_watching+0x15/0xb0 [ 629.365329][ T8143] dump_header+0xd3/0x480 [ 629.365350][ T8143] oom_kill_process+0x387/0x920 [ 629.365376][ T8143] out_of_memory+0xf09/0x12a0 [ 629.365401][ T8143] ? mem_cgroup_iter+0x3b/0x460 [ 629.365426][ T8143] ? __pfx_out_of_memory+0x10/0x10 [ 629.365452][ T8143] mem_cgroup_out_of_memory+0x145/0x240 [ 629.365477][ T8143] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 629.365506][ T8143] ? _raw_spin_unlock+0x28/0x50 [ 629.365530][ T8143] ? memcg1_oom_prepare+0x37f/0x450 [ 629.365559][ T8143] try_charge_memcg+0xdff/0x1290 [ 629.365588][ T8143] ? stack_depot_save_flags+0x40/0x860 [ 629.365621][ T8143] ? rcu_is_watching+0x15/0xb0 [ 629.365646][ T8143] ? __pfx_try_charge_memcg+0x10/0x10 [ 629.365676][ T8143] ? rcu_irq_exit_check_preempt+0x201/0x210 [ 629.365702][ T8143] ? lock_release+0x4b/0x3e0 [ 629.365721][ T8143] ? percpu_ref_tryget+0x15/0x180 [ 629.365743][ T8143] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 629.365770][ T8143] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 629.365796][ T8143] obj_cgroup_charge_pages+0x1e/0xa0 [ 629.365822][ T8143] obj_cgroup_charge_account+0xcf/0x660 [ 629.365848][ T8143] ? obj_cgroup_charge_account+0x13b/0x660 [ 629.365877][ T8143] __memcg_slab_post_alloc_hook+0x3dc/0x7d0 [ 629.365917][ T8143] kmem_cache_alloc_node_noprof+0x2a9/0x390 [ 629.366021][ T8143] ? dup_task_struct+0x52/0x860 [ 629.366061][ T8143] dup_task_struct+0x52/0x860 [ 629.366087][ T8143] copy_process+0x54b/0x3c00 [ 629.366110][ T8143] ? __pfx_css_rstat_updated+0x10/0x10 [ 629.366139][ T8143] ? __might_fault+0xb0/0x130 [ 629.366169][ T8143] ? rcu_is_watching+0x15/0xb0 [ 629.366193][ T8143] ? page_table_check_set+0x18d/0x730 [ 629.366224][ T8143] ? rcu_is_watching+0x15/0xb0 [ 629.366248][ T8143] ? __pfx_copy_process+0x10/0x10 [ 629.366272][ T8143] ? __might_fault+0xcc/0x130 [ 629.366306][ T8143] kernel_clone+0x21e/0x840 [ 629.366336][ T8143] ? __pfx_kernel_clone+0x10/0x10 [ 629.366360][ T8143] ? __handle_mm_fault+0x3ada/0x5400 [ 629.366394][ T8143] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 629.366425][ T8143] __se_sys_clone3+0x256/0x2d0 [ 629.366453][ T8143] ? lock_acquire+0x5f/0x360 [ 629.366472][ T8143] ? __pfx___se_sys_clone3+0x10/0x10 [ 629.366508][ T8143] ? _copy_to_user+0x8a/0xb0 [ 629.366546][ T8143] ? do_user_addr_fault+0xc8a/0x1390 [ 629.366574][ T8143] ? rcu_is_watching+0x15/0xb0 [ 629.366598][ T8143] do_syscall_64+0xfa/0xfa0 [ 629.366628][ T8143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.366649][ T8143] ? clear_bhb_loop+0x60/0xb0 [ 629.366673][ T8143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.366695][ T8143] RIP: 0033:0x7f65877c3449 [ 629.366715][ T8143] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 629.366734][ T8143] RSP: 002b:00007ffcf03d9fc8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 629.366756][ T8143] RAX: ffffffffffffffda RBX: 00007f6587745860 RCX: 00007f65877c3449 [ 629.366771][ T8143] RDX: 00007f6587745860 RSI: 0000000000000058 RDI: 00007ffcf03da010 [ 629.366785][ T8143] RBP: 00007f6586ddd6c0 R08: 00007f6586ddd6c0 R09: 00007ffcf03da0f7 [ 629.366800][ T8143] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 629.366814][ T8143] R13: 000000000000006e R14: 00007ffcf03da010 R15: 00007ffcf03da0f8 [ 629.366837][ T8143] [ 629.366923][ T8143] memory: usage 307200kB, limit 307200kB, failcnt 3572 [ 629.377637][ T8144] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 629.901446][ T32] oom_reaper: reaped process 7324 (syz.5.62), now anon-rss:4kB, file-rss:160kB, shmem-rss:0kB [ 629.923889][ T8143] memory+swap: usage 311992kB, limit 9007199254740988kB, failcnt 0 [ 629.965788][ T8143] kmem: usage 2624kB, limit 9007199254740988kB, failcnt 0 [ 629.976728][ T8144] hsr_slave_0: entered promiscuous mode [ 629.985061][ T8144] hsr_slave_1: entered promiscuous mode [ 629.987575][ T8143] Memory cgroup stats for /syz1: [ 629.990777][ T8143] cache 311574528 [ 629.994005][ T8144] debugfs: 'hsr0' already exists in 'hsr' [ 630.005624][ T8144] Cannot create hsr debugfs directory [ 630.007792][ T8143] rss 303104 [ 630.014772][ T8143] rss_huge 0 [ 630.025499][ T8143] shmem 311574528 [ 630.048810][ T8143] mapped_file 0 [ 630.052340][ T8143] dirty 0 [ 630.055438][ T8143] writeback 0 [ 630.067712][ T8143] workingset_refault_anon 0 [ 630.072552][ T8143] workingset_refault_file 0 [ 630.084891][ T8143] swap 4907008 [ 630.091155][ T8143] swapcached 0 [ 630.095010][ T8143] pgpgin 79811 [ 630.099148][ T8143] pgpgout 3669 [ 630.102587][ T8143] pgfault 3851 [ 630.118294][ T8143] pgmajfault 3 [ 630.121734][ T8143] inactive_anon 113070080 [ 630.126091][ T8143] active_anon 198807552 [ 630.163572][ T8143] inactive_file 0 [ 630.169427][ T8143] active_file 0 [ 630.172922][ T8143] unevictable 0 [ 630.176834][ T8143] hierarchical_memory_limit 314572800 [ 630.204767][ T8143] hierarchical_memsw_limit 9223372036854771712 [ 630.212393][ T8143] total_cache 311574528 [ 630.222428][ T8143] total_rss 303104 [ 630.226297][ T8143] total_rss_huge 0 [ 630.257548][ T8143] total_shmem 311574528 [ 630.261935][ T8143] total_mapped_file 0 [ 630.266052][ T8143] total_dirty 0 [ 630.280019][ T8143] total_writeback 0 [ 630.284452][ T8143] total_workingset_refault_anon 0 [ 630.292891][ T8144] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.304040][ T8143] total_workingset_refault_file 0 [ 630.309632][ T8143] total_swap 4907008 [ 630.313557][ T8143] total_swapcached 0 [ 630.321662][ T8143] total_pgpgin 79811 [ 630.325849][ T8143] total_pgpgout 3669 [ 630.337242][ T8143] total_pgfault 3851 [ 630.341881][ T8143] total_pgmajfault 3 [ 630.380943][ T8143] total_inactive_anon 113070080 [ 630.386295][ T8143] total_active_anon 198807552 [ 630.394064][ T8143] total_inactive_file 0 [ 630.395908][ T8144] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.398507][ T8143] total_active_file 0 [ 630.398519][ T8143] total_unevictable 0 [ 630.398529][ T8143] anon_cost 0 [ 630.398536][ T8143] file_cost 0 [ 630.398546][ T8143] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.102,pid=8143,uid=0 [ 630.398633][ T8143] Memory cgroup out of memory: Killed process 8143 (syz.1.102) total-vm:44768kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:80kB oom_score_adj:1000 [ 630.614068][ T8144] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.679758][ T8144] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.809689][ T8144] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 630.821525][ T8144] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 630.835473][ T8144] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 630.846523][ T8144] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 630.947679][ T8144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 630.985859][ T8144] 8021q: adding VLAN 0 to HW filter on device team0 [ 631.006492][ T3009] bridge0: port 1(bridge_slave_0) entered blocking state [ 631.013694][ T3009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 631.040202][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.047365][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 631.127847][ T5189] Bluetooth: hci75: command tx timeout [ 631.219583][ T32] oom_reaper: reaped process 8141 (syz.2.101), now anon-rss:92kB, file-rss:76kB, shmem-rss:0kB [ 631.303260][ T8144] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 631.570764][ T8144] veth0_vlan: entered promiscuous mode [ 631.602650][ T8144] veth1_vlan: entered promiscuous mode [ 631.641466][ T8144] veth0_macvtap: entered promiscuous mode [ 631.657242][ T8144] veth1_macvtap: entered promiscuous mode [ 631.694999][ T8144] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 631.708220][ T8144] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 631.726107][ T6737] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.736920][ T6737] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.746407][ T6737] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.761893][ T6737] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.849113][ T5189] Bluetooth: hci53: command 0x0406 tx timeout [ 631.909114][ T6737] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 631.916984][ T6737] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 2025/08/27 23:12:04 executed programs: 95 [ 632.007118][ T3009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.020853][ T3009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.119525][ T8175] syz.4.104 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 632.129729][ T8175] CPU: 1 UID: 0 PID: 8175 Comm: syz.4.104 Not tainted syzkaller #0 PREEMPT(full) [ 632.129759][ T8175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 632.129773][ T8175] Call Trace: [ 632.129781][ T8175] [ 632.129790][ T8175] dump_stack_lvl+0x189/0x250 [ 632.129828][ T8175] ? __pfx_dump_stack_lvl+0x10/0x10 [ 632.129865][ T8175] ? __pfx__printk+0x10/0x10 [ 632.129898][ T8175] ? rcu_is_watching+0x15/0xb0 [ 632.129925][ T8175] dump_header+0xd3/0x480 [ 632.129945][ T8175] oom_kill_process+0x387/0x920 [ 632.129971][ T8175] out_of_memory+0xf09/0x12a0 [ 632.129997][ T8175] ? mem_cgroup_iter+0x3b/0x460 [ 632.130022][ T8175] ? __pfx_out_of_memory+0x10/0x10 [ 632.130048][ T8175] mem_cgroup_out_of_memory+0x145/0x240 [ 632.130072][ T8175] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 632.130100][ T8175] ? _raw_spin_unlock+0x28/0x50 [ 632.130124][ T8175] ? memcg1_oom_prepare+0x37f/0x450 [ 632.130155][ T8175] try_charge_memcg+0xdff/0x1290 [ 632.130190][ T8175] ? zero_pmd_populate+0xd0/0x250 [ 632.130216][ T8175] ? __pfx_try_charge_memcg+0x10/0x10 [ 632.130246][ T8175] ? get_mem_cgroup_from_mm+0x38/0x2a0 [ 632.130269][ T8175] ? rcu_is_watching+0x15/0xb0 [ 632.130291][ T8175] ? lock_release+0x4b/0x3e0 [ 632.130310][ T8175] ? percpu_ref_tryget+0x15/0x180 [ 632.130332][ T8175] charge_memcg+0x9f/0x180 [ 632.130361][ T8175] __mem_cgroup_charge+0x25/0x80 [ 632.130391][ T8175] folio_prealloc+0x51/0x180 [ 632.130410][ T8175] __handle_mm_fault+0x2a8b/0x5400 [ 632.130446][ T8175] ? __pfx___handle_mm_fault+0x10/0x10 [ 632.130477][ T8175] ? rcu_is_watching+0x15/0xb0 [ 632.130504][ T8175] ? lock_vma_under_rcu+0x3cb/0x450 [ 632.130524][ T8175] ? __pfx_do_futex+0x10/0x10 [ 632.130552][ T8175] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 632.130574][ T8175] handle_mm_fault+0x40a/0x8e0 [ 632.130608][ T8175] do_user_addr_fault+0xa81/0x1390 [ 632.130633][ T8175] ? rcu_is_watching+0x15/0xb0 [ 632.130655][ T8175] ? trace_page_fault_user+0x84/0x1e0 [ 632.130676][ T8175] exc_page_fault+0x82/0x100 [ 632.130703][ T8175] asm_exc_page_fault+0x26/0x30 [ 632.130722][ T8175] RIP: 0033:0x7f2ec644e1ee [ 632.130741][ T8175] Code: f6 31 c0 e8 b4 f2 13 00 48 81 c4 90 00 00 00 48 98 5b c3 66 0f 1f 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89 [ 632.130758][ T8175] RSP: 002b:00007f2ec7459f70 EFLAGS: 00010202 [ 632.130778][ T8175] RAX: 0000000000000000 RBX: 00007f2ec6613167 RCX: 00007f2ec66234a0 [ 632.130793][ T8175] RDX: 00000000000013f1 RSI: 0000000000000000 RDI: 00007f2ec6613167 [ 632.130807][ T8175] RBP: 00007f2ec67b5fa0 R08: 000000000215fb89 R09: 7fffffffffffffff [ 632.130821][ T8175] R10: 3fffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 632.130836][ T8175] R13: 00007f2ec67b6038 R14: 00007f2ec67b5fa0 R15: 00007ffc136b8818 [ 632.130867][ T8175] [ 632.130876][ T8175] memory: usage 307200kB, limit 307200kB, failcnt 4771 [ 632.471059][ T32] oom_reaper: reaped process 8143 (syz.1.102), now anon-rss:88kB, file-rss:76kB, shmem-rss:0kB [ 632.481766][ T8175] memory+swap: usage 316668kB, limit 9007199254740988kB, failcnt 0 [ 632.490230][ T8175] kmem: usage 2648kB, limit 9007199254740988kB, failcnt 0 [ 632.524996][ T8175] Memory cgroup stats for /syz4: [ 632.525139][ T8175] cache 311304192 [ 632.533887][ T8175] rss 528384 [ 632.537100][ T8175] rss_huge 0 [ 632.540459][ T8175] shmem 311304192 [ 632.544126][ T8175] mapped_file 0 [ 632.548122][ T8175] dirty 0 [ 632.551211][ T8175] writeback 0 [ 632.554538][ T8175] workingset_refault_anon 0 [ 632.559186][ T8175] workingset_refault_file 2207 [ 632.563973][ T8175] swap 9699328 [ 632.567363][ T8175] swapcached 0 [ 632.572313][ T8175] pgpgin 81032 [ 632.575927][ T8175] pgpgout 4901 [ 632.579658][ T8175] pgfault 3689 [ 632.583063][ T8175] pgmajfault 9 [ 632.586454][ T8175] inactive_anon 189874176 [ 632.592044][ T8175] active_anon 121958400 [ 632.608862][ T8175] inactive_file 0 [ 632.612555][ T8175] active_file 0 [ 632.616121][ T8175] unevictable 0 [ 632.622086][ T8175] hierarchical_memory_limit 314572800 [ 632.627720][ T8175] hierarchical_memsw_limit 9223372036854771712 [ 632.634063][ T8175] total_cache 311304192 [ 632.638601][ T8175] total_rss 528384 [ 632.642346][ T8175] total_rss_huge 0 [ 632.646081][ T8175] total_shmem 311304192 [ 632.651157][ T8175] total_mapped_file 0 [ 632.655166][ T8175] total_dirty 0 [ 632.659000][ T8175] total_writeback 0 [ 632.663260][ T8175] total_workingset_refault_anon 0 [ 632.669152][ T8175] total_workingset_refault_file 2207 [ 632.674468][ T8175] total_swap 9699328 [ 632.678849][ T8175] total_swapcached 0 [ 632.682767][ T8175] total_pgpgin 81032 [ 632.686669][ T8175] total_pgpgout 4901 [ 632.692700][ T8175] total_pgfault 3689 [ 632.696618][ T8175] total_pgmajfault 9 [ 632.724307][ T8175] total_inactive_anon 189874176 [ 632.729817][ T8175] total_active_anon 121958400 [ 632.734524][ T8175] total_inactive_file 0 [ 632.738946][ T8175] total_active_file 0 [ 632.742950][ T8175] total_unevictable 0 [ 632.746939][ T8175] anon_cost 0 [ 632.750559][ T8175] file_cost 0 [ 632.753872][ T8175] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.71,pid=7613,uid=0 [ 632.768828][ T8175] Memory cgroup out of memory: Killed process 7614 (syz.4.71) total-vm:44768kB, anon-rss:944kB, file-rss:1320kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 633.208576][ T5917] Bluetooth: hci75: command tx timeout [ 634.892627][ T32] oom_reaper: reaped process 7614 (syz.4.71), now anon-rss:0kB, file-rss:204kB, shmem-rss:0kB [ 634.914266][ T8176] 9p: Bad value for 'rfdno' [ 634.932120][ T8176] syz.4.104 invoked oom-killer: gfp_mask=0x400cc0(GFP_KERNEL_ACCOUNT), order=1, oom_score_adj=1000 [ 634.944530][ T8176] CPU: 1 UID: 0 PID: 8176 Comm: syz.4.104 Not tainted syzkaller #0 PREEMPT(full) [ 634.944558][ T8176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 634.944571][ T8176] Call Trace: [ 634.944579][ T8176] [ 634.944587][ T8176] dump_stack_lvl+0x189/0x250 [ 634.944626][ T8176] ? __pfx_dump_stack_lvl+0x10/0x10 [ 634.944657][ T8176] ? __pfx__printk+0x10/0x10 [ 634.944689][ T8176] ? rcu_is_watching+0x15/0xb0 [ 634.944714][ T8176] dump_header+0xd3/0x480 [ 634.944734][ T8176] oom_kill_process+0x387/0x920 [ 634.944760][ T8176] out_of_memory+0xf09/0x12a0 [ 634.944786][ T8176] ? mem_cgroup_iter+0x3b/0x460 [ 634.944811][ T8176] ? __pfx_out_of_memory+0x10/0x10 [ 634.944838][ T8176] mem_cgroup_out_of_memory+0x145/0x240 [ 634.944862][ T8176] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 634.944891][ T8176] ? _raw_spin_unlock+0x28/0x50 [ 634.944914][ T8176] ? memcg1_oom_prepare+0x37f/0x450 [ 634.944944][ T8176] try_charge_memcg+0xdff/0x1290 [ 634.944975][ T8176] ? stack_depot_save_flags+0x40/0x860 [ 634.945008][ T8176] ? percpu_ref_tryget+0x15/0x180 [ 634.945029][ T8176] ? __pfx_try_charge_memcg+0x10/0x10 [ 634.945059][ T8176] ? lock_release+0x4b/0x3e0 [ 634.945078][ T8176] ? percpu_ref_tryget+0x15/0x180 [ 634.945095][ T8176] ? percpu_ref_tryget+0x15/0x180 [ 634.945116][ T8176] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 634.945144][ T8176] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 634.945173][ T8176] obj_cgroup_charge_pages+0x1e/0xa0 [ 634.945200][ T8176] obj_cgroup_charge_account+0xcf/0x660 [ 634.945228][ T8176] ? obj_cgroup_charge_account+0x13b/0x660 [ 634.945257][ T8176] __memcg_slab_post_alloc_hook+0x3dc/0x7d0 [ 634.945292][ T8176] __kvmalloc_node_noprof+0x446/0x5b0 [ 634.945323][ T8176] ? alloc_fdtable+0x101/0x2c0 [ 634.945348][ T8176] alloc_fdtable+0x101/0x2c0 [ 634.945369][ T8176] ? dup_fd+0x864/0xb60 [ 634.945391][ T8176] dup_fd+0x86c/0xb60 [ 634.945416][ T8176] copy_files+0xc9/0x120 [ 634.945450][ T8176] copy_process+0x15b2/0x3c00 [ 634.945481][ T8176] ? copy_process+0x97f/0x3c00 [ 634.945508][ T8176] ? __pfx_copy_process+0x10/0x10 [ 634.945532][ T8176] ? futex_private_hash_put+0x245/0x280 [ 634.945562][ T8176] kernel_clone+0x21e/0x840 [ 634.945588][ T8176] ? __pfx_futex_wake+0x10/0x10 [ 634.945610][ T8176] ? __pfx_kernel_clone+0x10/0x10 [ 634.945639][ T8176] ? do_futex+0x395/0x420 [ 634.945670][ T8176] __x64_sys_clone+0x18b/0x1e0 [ 634.945697][ T8176] ? __pfx___x64_sys_clone+0x10/0x10 [ 634.945732][ T8176] ? rcu_is_watching+0x15/0xb0 [ 634.945756][ T8176] ? rcu_is_watching+0x15/0xb0 [ 634.945780][ T8176] do_syscall_64+0xfa/0xfa0 [ 634.945807][ T8176] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.945827][ T8176] ? clear_bhb_loop+0x60/0xb0 [ 634.945849][ T8176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.945869][ T8176] RIP: 0033:0x7f2ec658ebe9 [ 634.945892][ T8176] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 634.945910][ T8176] RSP: 002b:00007f2ec7438fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 634.945932][ T8176] RAX: ffffffffffffffda RBX: 00007f2ec67b6090 RCX: 00007f2ec658ebe9 [ 634.945948][ T8176] RDX: 0000000000000000 RSI: fffffffffffffc70 RDI: 0000000001022000 [ 634.945963][ T8176] RBP: 00007f2ec6611e19 R08: 0000000000000000 R09: 0000000000000000 [ 634.945976][ T8176] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 634.945988][ T8176] R13: 00007f2ec67b6128 R14: 00007f2ec67b6090 R15: 00007ffc136b8818 [ 634.946012][ T8176] [ 634.946020][ T8176] memory: usage 307200kB, limit 307200kB, failcnt 7956 [ 635.307747][ T5917] Bluetooth: hci75: command tx timeout [ 635.316264][ T8176] memory+swap: usage 316664kB, limit 9007199254740988kB, failcnt 0 [ 635.393296][ T8176] kmem: usage 2724kB, limit 9007199254740988kB, failcnt 0 [ 635.400570][ T8176] Memory cgroup stats for /syz4: [ 635.400702][ T8176] cache 311304192 [ 635.409496][ T8176] rss 557056 [ 635.412720][ T8176] rss_huge 0 [ 635.415924][ T8176] shmem 311304192 [ 635.419956][ T8176] mapped_file 0 [ 635.423444][ T8176] dirty 0 [ 635.426391][ T8176] writeback 0 [ 635.429797][ T8176] workingset_refault_anon 0 [ 635.434389][ T8176] workingset_refault_file 2207 [ 635.446203][ T8176] swap 9699328 [ 635.453462][ T8176] swapcached 0 [ 635.456881][ T8176] pgpgin 81039 [ 635.487208][ T8176] pgpgout 4901 [ 635.491003][ T8176] pgfault 3697 [ 635.494396][ T8176] pgmajfault 9 [ 635.499145][ T8176] inactive_anon 189874176 [ 635.503502][ T8176] active_anon 121987072 [ 635.508015][ T8176] inactive_file 0 [ 635.511666][ T8176] active_file 0 [ 635.515132][ T8176] unevictable 0 [ 635.519093][ T8176] hierarchical_memory_limit 314572800 [ 635.524482][ T8176] hierarchical_memsw_limit 9223372036854771712 [ 635.531868][ T8176] total_cache 311304192 [ 635.536053][ T8176] total_rss 557056 [ 635.540141][ T8176] total_rss_huge 0 [ 635.543873][ T8176] total_shmem 311304192 [ 635.549046][ T8176] total_mapped_file 0 [ 635.553056][ T8176] total_dirty 0 [ 635.556524][ T8176] total_writeback 0 [ 635.560818][ T8176] total_workingset_refault_anon 0 [ 635.582260][ T8176] total_workingset_refault_file 2207 [ 635.591575][ T8176] total_swap 9699328 [ 635.595565][ T8176] total_swapcached 0 [ 635.599876][ T8176] total_pgpgin 81039 [ 635.603790][ T8176] total_pgpgout 4901 [ 635.608427][ T8176] total_pgfault 3697 [ 635.612600][ T8176] total_pgmajfault 9 [ 635.617140][ T8176] total_inactive_anon 189874176 [ 635.623089][ T8176] total_active_anon 121987072 [ 635.629238][ T8176] total_inactive_file 0 [ 635.633442][ T8176] total_active_file 0 [ 635.638101][ T8176] total_unevictable 0 [ 635.642103][ T8176] anon_cost 0 [ 635.645437][ T8176] file_cost 0 [ 635.649366][ T8176] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.61,pid=7302,uid=0 [ 635.664623][ T8176] Memory cgroup out of memory: Killed process 7303 (syz.4.61) total-vm:44900kB, anon-rss:944kB, file-rss:1192kB, shmem-rss:0kB, UID:0 pgtables:96kB oom_score_adj:1000 [ 637.772973][ T32] oom_reaper: reaped process 7303 (syz.4.61), now anon-rss:88kB, file-rss:76kB, shmem-rss:0kB [ 637.779869][ T8178] cgroup: fork rejected by pids controller in /syz4 [ 638.084951][ T8178] syz.4.105 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 638.096882][ T8178] CPU: 0 UID: 0 PID: 8178 Comm: syz.4.105 Not tainted syzkaller #0 PREEMPT(full) [ 638.096912][ T8178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 638.096926][ T8178] Call Trace: [ 638.096934][ T8178] [ 638.096942][ T8178] dump_stack_lvl+0x189/0x250 [ 638.096982][ T8178] ? __pfx_dump_stack_lvl+0x10/0x10 [ 638.097013][ T8178] ? __pfx__printk+0x10/0x10 [ 638.097046][ T8178] ? rcu_is_watching+0x15/0xb0 [ 638.097073][ T8178] dump_header+0xd3/0x480 [ 638.097093][ T8178] oom_kill_process+0x387/0x920 [ 638.097119][ T8178] out_of_memory+0xf09/0x12a0 [ 638.097144][ T8178] ? mem_cgroup_iter+0x3b/0x460 [ 638.097170][ T8178] ? __pfx_out_of_memory+0x10/0x10 [ 638.097197][ T8178] mem_cgroup_out_of_memory+0x145/0x240 [ 638.097221][ T8178] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 638.097250][ T8178] ? _raw_spin_unlock+0x28/0x50 [ 638.097275][ T8178] ? memcg1_oom_prepare+0x37f/0x450 [ 638.097305][ T8178] try_charge_memcg+0xdff/0x1290 [ 638.097340][ T8178] ? percpu_ref_tryget+0x15/0x180 [ 638.097362][ T8178] ? __pfx_try_charge_memcg+0x10/0x10 [ 638.097392][ T8178] ? lock_release+0x4b/0x3e0 [ 638.097415][ T8178] ? percpu_ref_tryget+0x15/0x180 [ 638.097431][ T8178] ? percpu_ref_tryget+0x15/0x180 [ 638.097452][ T8178] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 638.097478][ T8178] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 638.097513][ T8178] __memcg_kmem_charge_page+0xe1/0x240 [ 638.097540][ T8178] memcg_charge_kernel_stack+0x2f5/0x500 [ 638.097572][ T8178] dup_task_struct+0x1ab/0x860 [ 638.097597][ T8178] copy_process+0x54b/0x3c00 [ 638.097627][ T8178] ? __might_fault+0xb0/0x130 [ 638.097670][ T8178] ? rcu_is_watching+0x15/0xb0 [ 638.097698][ T8178] ? __pfx_copy_process+0x10/0x10 [ 638.097721][ T8178] ? __might_fault+0xcc/0x130 [ 638.097754][ T8178] kernel_clone+0x21e/0x840 [ 638.097781][ T8178] ? __pfx_kernel_clone+0x10/0x10 [ 638.097805][ T8178] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 638.097835][ T8178] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 638.097866][ T8178] __se_sys_clone3+0x256/0x2d0 [ 638.097894][ T8178] ? lock_acquire+0x5f/0x360 [ 638.097912][ T8178] ? __pfx___se_sys_clone3+0x10/0x10 [ 638.097945][ T8178] ? _copy_to_user+0x8a/0xb0 [ 638.097979][ T8178] ? rcu_is_watching+0x15/0xb0 [ 638.098003][ T8178] do_syscall_64+0xfa/0xfa0 [ 638.098030][ T8178] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.098050][ T8178] ? clear_bhb_loop+0x60/0xb0 [ 638.098073][ T8178] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.098093][ T8178] RIP: 0033:0x7f2ec65c3449 [ 638.098112][ T8178] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 638.098130][ T8178] RSP: 002b:00007ffc136b86e8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 638.098153][ T8178] RAX: ffffffffffffffda RBX: 00007f2ec6545860 RCX: 00007f2ec65c3449 [ 638.098168][ T8178] RDX: 00007f2ec6545860 RSI: 0000000000000058 RDI: 00007ffc136b8730 [ 638.098182][ T8178] RBP: 00007f2ec74186c0 R08: 00007f2ec74186c0 R09: 00007ffc136b8817 [ 638.098196][ T8178] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 638.098210][ T8178] R13: 000000000000000b R14: 00007ffc136b8730 R15: 00007ffc136b8818 [ 638.098232][ T8178] [ 638.469624][ T8178] memory: usage 307200kB, limit 307200kB, failcnt 11989 [ 638.476757][ T8178] memory+swap: usage 316672kB, limit 9007199254740988kB, failcnt 0 [ 638.485148][ T8178] kmem: usage 2716kB, limit 9007199254740988kB, failcnt 0 [ 638.499068][ T8178] Memory cgroup stats for /syz4: [ 638.499321][ T8178] cache 311304192 [ 638.513929][ T8178] rss 405504 [ 638.517171][ T8178] rss_huge 0 [ 638.521832][ T8178] shmem 311304192 [ 638.525494][ T8178] mapped_file 0 [ 638.529087][ T8178] dirty 0 [ 638.532036][ T8178] writeback 0 [ 638.562723][ T8178] workingset_refault_anon 0 [ 638.567287][ T8178] workingset_refault_file 2475 [ 638.572926][ T8178] swap 9699328 [ 638.576333][ T8178] swapcached 0 [ 638.580055][ T8178] pgpgin 81425 [ 638.583448][ T8178] pgpgout 5324 [ 638.586837][ T8178] pgfault 3802 [ 638.590649][ T8178] pgmajfault 29 [ 638.594133][ T8178] inactive_anon 9109504 [ 638.598633][ T8178] active_anon 302600192 [ 638.602812][ T8178] inactive_file 0 [ 638.606454][ T8178] active_file 0 [ 638.610454][ T8178] unevictable 0 [ 638.613934][ T8178] hierarchical_memory_limit 314572800 [ 638.619734][ T8178] hierarchical_memsw_limit 9223372036854771712 [ 638.625909][ T8178] total_cache 311304192 [ 638.630473][ T8178] total_rss 405504 [ 638.634224][ T8178] total_rss_huge 0 [ 638.662661][ T8178] total_shmem 311304192 [ 638.666939][ T8178] total_mapped_file 0 [ 638.671691][ T8178] total_dirty 0 [ 638.675261][ T8178] total_writeback 0 [ 638.680507][ T8178] total_workingset_refault_anon 0 [ 638.685563][ T8178] total_workingset_refault_file 2475 [ 638.692006][ T8178] total_swap 9699328 [ 638.695923][ T8178] total_swapcached 0 [ 638.700208][ T8178] total_pgpgin 81425 [ 638.704123][ T8178] total_pgpgout 5324 [ 638.708373][ T8178] total_pgfault 3802 [ 638.712280][ T8178] total_pgmajfault 29 [ 638.716307][ T8178] total_inactive_anon 9109504 [ 638.721465][ T8178] total_active_anon 302600192 [ 638.726161][ T8178] total_inactive_file 0 [ 638.732549][ T8178] total_active_file 0 [ 638.736563][ T8178] total_unevictable 0 [ 638.763195][ T8178] anon_cost 0 [ 638.766592][ T8178] file_cost 0 [ 638.771157][ T8178] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.105,pid=8178,uid=0 [ 638.786294][ T8178] Memory cgroup out of memory: Killed process 8178 (syz.4.105) total-vm:44900kB, anon-rss:948kB, file-rss:1188kB, shmem-rss:0kB, UID:0 pgtables:80kB oom_score_adj:1000 [ 639.514371][ T5189] Bluetooth: hci76: unexpected cc 0x0c03 length: 249 > 1 [ 639.522744][ T5189] Bluetooth: hci76: unexpected cc 0x1003 length: 249 > 9 [ 639.531724][ T5189] Bluetooth: hci76: unexpected cc 0x1001 length: 249 > 9 [ 639.541332][ T5189] Bluetooth: hci76: unexpected cc 0x0c23 length: 249 > 4 [ 639.549817][ T5189] Bluetooth: hci76: unexpected cc 0x0c38 length: 249 > 2 [ 639.743916][ T8223] chnl_net:caif_netlink_parms(): no params data found [ 639.854715][ T8223] bridge0: port 1(bridge_slave_0) entered blocking state [ 639.862076][ T8223] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.883488][ T8223] bridge_slave_0: entered allmulticast mode [ 639.891913][ T8223] bridge_slave_0: entered promiscuous mode [ 639.901022][ T8223] bridge0: port 2(bridge_slave_1) entered blocking state [ 639.908397][ T8223] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.916027][ T8223] bridge_slave_1: entered allmulticast mode [ 639.925060][ T8223] bridge_slave_1: entered promiscuous mode [ 640.048673][ T8223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 640.090967][ T8223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 640.162047][ T8223] team0: Port device team_slave_0 added [ 640.201231][ T8223] team0: Port device team_slave_1 added [ 640.254147][ T8223] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 640.261682][ T8223] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 640.303307][ T8223] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 640.318076][ T8223] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 640.325079][ T8223] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 640.352673][ T8223] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 640.430380][ T8223] hsr_slave_0: entered promiscuous mode [ 640.437776][ T8223] hsr_slave_1: entered promiscuous mode [ 640.444534][ T8223] debugfs: 'hsr0' already exists in 'hsr' [ 640.450934][ T8223] Cannot create hsr debugfs directory [ 640.562183][ T6010] Bluetooth: hci77: unexpected cc 0x0c03 length: 249 > 1 [ 640.581928][ T6010] Bluetooth: hci77: unexpected cc 0x1003 length: 249 > 9 [ 640.601250][ T6010] Bluetooth: hci77: unexpected cc 0x1001 length: 249 > 9 [ 640.609155][ T6010] Bluetooth: hci77: unexpected cc 0x0c23 length: 249 > 4 [ 640.617657][ T6010] Bluetooth: hci77: unexpected cc 0x0c38 length: 249 > 2 [ 640.657169][ T8223] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.723381][ T8223] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.777299][ T8223] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.816596][ T32] oom_reaper: reaped process 8178 (syz.4.105), now anon-rss:12kB, file-rss:76kB, shmem-rss:0kB [ 640.846061][ T8223] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.014468][ T8223] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 641.038877][ T8223] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 641.052664][ T8234] chnl_net:caif_netlink_parms(): no params data found [ 641.065102][ T8223] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 641.089889][ T8223] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 641.223215][ T8234] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.231003][ T8234] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.239487][ T8234] bridge_slave_0: entered allmulticast mode [ 641.247364][ T8234] bridge_slave_0: entered promiscuous mode [ 641.256723][ T8234] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.264922][ T8234] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.273695][ T8234] bridge_slave_1: entered allmulticast mode [ 641.282754][ T8234] bridge_slave_1: entered promiscuous mode [ 641.363813][ T8234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 641.394423][ T8234] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 641.463841][ T8223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 641.475088][ T8234] team0: Port device team_slave_0 added [ 641.496873][ T8234] team0: Port device team_slave_1 added [ 641.519696][ T8223] 8021q: adding VLAN 0 to HW filter on device team0 [ 641.580808][ T51] Bluetooth: hci78: unexpected cc 0x0c03 length: 249 > 1 [ 641.588528][ T51] Bluetooth: hci78: unexpected cc 0x1003 length: 249 > 9 [ 641.595851][ T51] Bluetooth: hci78: unexpected cc 0x1001 length: 249 > 9 [ 641.604275][ T51] Bluetooth: hci78: unexpected cc 0x0c23 length: 249 > 4 [ 641.623490][ T51] Bluetooth: hci76: command tx timeout [ 641.643039][ T2960] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.647709][ T6859] Bluetooth: hci78: unexpected cc 0x0c38 length: 249 > 2 [ 641.650217][ T2960] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.671732][ T2960] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.678982][ T2960] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.696746][ T8234] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 641.704410][ T8234] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.743332][ T8234] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.756739][ T8234] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.763887][ T8234] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 641.790520][ T8234] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.889522][ T8234] hsr_slave_0: entered promiscuous mode [ 641.896852][ T8234] hsr_slave_1: entered promiscuous mode [ 641.903769][ T8234] debugfs: 'hsr0' already exists in 'hsr' [ 641.909672][ T8234] Cannot create hsr debugfs directory [ 642.009106][ T6010] Bluetooth: hci54: command 0x0406 tx timeout [ 642.015267][ T6010] Bluetooth: hci55: command 0x0406 tx timeout [ 642.206440][ T8234] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.303137][ T8234] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.405973][ T8234] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.475618][ T8249] chnl_net:caif_netlink_parms(): no params data found [ 642.498223][ T8234] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.556947][ T8223] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 642.694081][ T8249] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.702113][ T8249] bridge0: port 1(bridge_slave_0) entered disabled state [ 642.710803][ T8249] bridge_slave_0: entered allmulticast mode [ 642.718945][ T8249] bridge_slave_0: entered promiscuous mode [ 642.729543][ T5917] Bluetooth: hci77: command tx timeout [ 642.763981][ T8249] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.788065][ T8249] bridge0: port 2(bridge_slave_1) entered disabled state [ 642.795913][ T8249] bridge_slave_1: entered allmulticast mode [ 642.805805][ T8249] bridge_slave_1: entered promiscuous mode [ 642.922205][ T8249] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 642.976051][ T8234] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 643.006756][ T8249] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 643.033329][ T8234] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 643.067345][ T8234] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 643.080172][ T8234] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 643.107056][ T8249] team0: Port device team_slave_0 added [ 643.116864][ T8249] team0: Port device team_slave_1 added [ 643.180193][ T8249] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 643.187283][ T8249] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 643.215259][ T8249] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 643.265410][ T8249] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 643.274748][ T8249] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 643.302103][ T8249] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 643.403520][ T8223] veth0_vlan: entered promiscuous mode [ 643.446764][ T8249] hsr_slave_0: entered promiscuous mode [ 643.476387][ T8249] hsr_slave_1: entered promiscuous mode [ 643.483875][ T8249] debugfs: 'hsr0' already exists in 'hsr' [ 643.490996][ T8249] Cannot create hsr debugfs directory [ 643.518672][ T8223] veth1_vlan: entered promiscuous mode [ 643.613315][ T8234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.653697][ T8223] veth0_macvtap: entered promiscuous mode [ 643.680603][ T8234] 8021q: adding VLAN 0 to HW filter on device team0 [ 643.688433][ T5917] Bluetooth: hci78: command tx timeout [ 643.694143][ T5917] Bluetooth: hci76: command tx timeout [ 643.714905][ T8223] veth1_macvtap: entered promiscuous mode [ 643.729409][ T337] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.736643][ T337] bridge0: port 1(bridge_slave_0) entered forwarding state [ 643.790575][ T337] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.797767][ T337] bridge0: port 2(bridge_slave_1) entered forwarding state [ 643.846644][ T8223] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 643.903654][ T8223] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 643.922601][ T8249] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.960613][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.989803][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.015453][ T8249] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.036350][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.046417][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.097309][ T8249] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.184522][ T8249] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.360835][ T337] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.404304][ T337] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.536505][ T8234] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 644.544368][ T8249] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 644.562938][ T3530] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.563796][ T8249] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 644.592630][ T3530] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.614273][ T8249] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 644.625567][ T8249] netdevsim netdevsim9 netdevsim3: renamed from eth3 2025/08/27 23:12:17 executed programs: 97 [ 644.772976][ T8223] syz-executor invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_COMP), order=0, oom_score_adj=0 [ 644.807711][ T5189] Bluetooth: hci77: command tx timeout [ 644.856399][ T8223] CPU: 0 UID: 0 PID: 8223 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 644.856430][ T8223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 644.856444][ T8223] Call Trace: [ 644.856453][ T8223] [ 644.856462][ T8223] dump_stack_lvl+0x189/0x250 [ 644.856501][ T8223] ? __pfx_dump_stack_lvl+0x10/0x10 [ 644.856533][ T8223] ? __pfx__printk+0x10/0x10 [ 644.856565][ T8223] ? rcu_is_watching+0x15/0xb0 [ 644.856590][ T8223] dump_header+0xd3/0x480 [ 644.856611][ T8223] oom_kill_process+0x387/0x920 [ 644.856637][ T8223] out_of_memory+0xf09/0x12a0 [ 644.856662][ T8223] ? mem_cgroup_iter+0x3b/0x460 [ 644.856686][ T8223] ? __pfx_out_of_memory+0x10/0x10 [ 644.856713][ T8223] mem_cgroup_out_of_memory+0x145/0x240 [ 644.856736][ T8223] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 644.856766][ T8223] ? _raw_spin_unlock+0x28/0x50 [ 644.856790][ T8223] ? memcg1_oom_prepare+0x37f/0x450 [ 644.856864][ T8223] try_charge_memcg+0xdff/0x1290 [ 644.856902][ T8223] ? __pfx_try_charge_memcg+0x10/0x10 [ 644.856932][ T8223] ? rcu_is_watching+0x15/0xb0 [ 644.856954][ T8223] ? lock_release+0x4b/0x3e0 [ 644.856973][ T8223] ? percpu_ref_tryget+0x15/0x180 [ 644.856995][ T8223] ? get_mem_cgroup_from_objcg+0x1b0/0x1d0 [ 644.857021][ T8223] ? get_mem_cgroup_from_objcg+0x1a/0x1d0 [ 644.857050][ T8223] __memcg_kmem_charge_page+0xe1/0x240 [ 644.857079][ T8223] __alloc_frozen_pages_noprof+0x1b5/0x370 [ 644.857105][ T8223] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 644.857134][ T8223] ? policy_nodemask+0x27c/0x720 [ 644.857167][ T8223] alloc_pages_mpol+0x232/0x4a0 [ 644.857188][ T8223] alloc_pages_noprof+0xa9/0x190 [ 644.857209][ T8223] pte_alloc_one+0x21/0x170 [ 644.857234][ T8223] __handle_mm_fault+0x2767/0x5400 [ 644.857271][ T8223] ? __pfx___handle_mm_fault+0x10/0x10 [ 644.857301][ T8223] ? rcu_is_watching+0x15/0xb0 [ 644.857329][ T8223] ? lock_vma_under_rcu+0x3cb/0x450 [ 644.857348][ T8223] ? rcu_is_watching+0x15/0xb0 [ 644.857372][ T8223] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 644.857394][ T8223] handle_mm_fault+0x40a/0x8e0 [ 644.857430][ T8223] do_user_addr_fault+0xa81/0x1390 [ 644.857453][ T8223] ? rcu_is_watching+0x15/0xb0 [ 644.857475][ T8223] ? trace_page_fault_user+0x84/0x1e0 [ 644.857495][ T8223] exc_page_fault+0x82/0x100 [ 644.857522][ T8223] asm_exc_page_fault+0x26/0x30 [ 644.857541][ T8223] RIP: 0033:0x7fb44b065b99 [ 644.857559][ T8223] Code: de 1b 43 48 f7 64 24 48 48 8d 6c 24 3c 48 8b 05 0d fc e7 00 48 69 4c 24 40 e8 03 00 00 48 c1 ea 12 4c 8d 34 11 4c 89 74 24 18 <8b> 40 08 44 89 64 24 2c 89 44 24 08 bf 10 27 00 00 e8 91 8f 12 00 [ 644.857577][ T8223] RSP: 002b:00007ffc514a7a30 EFLAGS: 00010203 [ 644.857597][ T8223] RAX: 0000001b2ea24000 RBX: 0000000000000003 RCX: 000000000009d3a0 [ 644.857611][ T8223] RDX: 00000000000002cd RSI: 00007ffc514a7a70 RDI: 0000000000000001 [ 644.857624][ T8223] RBP: 00007ffc514a7a6c R08: 000000002ac480c6 R09: 7fffffffffffffff [ 644.857639][ T8223] R10: 3fffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 644.857653][ T8223] R13: 00007fb44b381280 R14: 000000000009d66d R15: 00007ffc514a7ac0 [ 644.857676][ T8223] [ 645.043803][ T8249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 645.257804][ T8223] memory: usage 307200kB, limit 307200kB, failcnt 2170 [ 645.264694][ T8223] memory+swap: usage 322796kB, limit 9007199254740988kB, failcnt 0 [ 645.336016][ T8223] kmem: usage 2652kB, limit 9007199254740988kB, failcnt 0 [ 645.343805][ T8223] Memory cgroup stats for /syz6: [ 645.343940][ T8223] cache 311312384 [ 645.352735][ T8223] rss 520192 [ 645.355953][ T8223] rss_huge 0 [ 645.359336][ T8223] shmem 311312384 [ 645.362985][ T8223] mapped_file 0 [ 645.366463][ T8223] dirty 0 [ 645.370961][ T8223] writeback 0 [ 645.374282][ T8223] workingset_refault_anon 0 [ 645.379028][ T8223] workingset_refault_file 0 [ 645.386179][ T8223] swap 15970304 [ 645.439127][ T8249] 8021q: adding VLAN 0 to HW filter on device team0 [ 645.452223][ T3530] bridge0: port 1(bridge_slave_0) entered blocking state [ 645.457683][ T8223] swapcached 20480 [ 645.459586][ T3530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 645.463197][ T8223] pgpgin 81858 [ 645.473856][ T8223] pgpgout 5722 [ 645.477383][ T8223] pgfault 3619 [ 645.481867][ T8223] pgmajfault 11 [ 645.485357][ T8223] inactive_anon 28782592 [ 645.490238][ T8223] active_anon 283070464 [ 645.494430][ T8223] inactive_file 0 [ 645.523170][ T8223] active_file 0 [ 645.528187][ T8223] unevictable 0 [ 645.531915][ T8223] hierarchical_memory_limit 314572800 [ 645.547336][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 645.554760][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 645.557594][ T8223] hierarchical_memsw_limit 9223372036854771712 [ 645.584342][ T8223] total_cache 311312384 [ 645.616570][ T8234] veth0_vlan: entered promiscuous mode [ 645.636664][ T8223] total_rss 520192 [ 645.641406][ T8223] total_rss_huge 0 [ 645.645170][ T8223] total_shmem 311312384 [ 645.649619][ T8223] total_mapped_file 0 [ 645.653630][ T8223] total_dirty 0 [ 645.657101][ T8223] total_writeback 0 [ 645.661204][ T8223] total_workingset_refault_anon 0 [ 645.666391][ T8223] total_workingset_refault_file 0 [ 645.678040][ T8223] total_swap 15970304 [ 645.682073][ T8223] total_swapcached 20480 [ 645.686326][ T8223] total_pgpgin 81858 [ 645.701969][ T8234] veth1_vlan: entered promiscuous mode [ 645.732940][ T8223] total_pgpgout 5722 [ 645.736908][ T8223] total_pgfault 3619 [ 645.745096][ T8223] total_pgmajfault 11 [ 645.761854][ T8223] total_inactive_anon 28782592 [ 645.766680][ T8223] total_active_anon 283070464 [ 645.768584][ T5917] Bluetooth: hci76: command tx timeout [ 645.776858][ T6010] Bluetooth: hci78: command tx timeout [ 645.802165][ T8223] total_inactive_file 0 [ 645.833240][ T8234] veth0_macvtap: entered promiscuous mode [ 645.844531][ T8234] veth1_macvtap: entered promiscuous mode [ 645.853347][ T8223] total_active_file 0 [ 645.857378][ T8223] total_unevictable 0 [ 645.877670][ T8223] anon_cost 0 [ 645.881024][ T8223] file_cost 0 [ 645.884325][ T8223] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz6,task_memcg=/syz6,task=syz.6.63,pid=7379,uid=0 [ 645.901209][ T8234] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 645.931598][ T8223] Memory cgroup out of memory: Killed process 7380 (syz.6.63) total-vm:44768kB, anon-rss:944kB, file-rss:1320kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 [ 645.979472][ T8234] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 646.033464][ T3009] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.054291][ T3009] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.085521][ T3009] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.132555][ T3009] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 646.302691][ T8249] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 646.353666][ T3009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 646.370462][ T3009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 646.516629][ T6737] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 646.568448][ T6737] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 646.889722][ T6010] Bluetooth: hci77: command tx timeout [ 647.368856][ T6010] Bluetooth: hci56: command 0x0406 tx timeout [ 647.781324][ T8286] ------------[ cut here ]------------ [ 647.786868][ T8286] pvqspinlock: lock 0xffff8881c5419bc0 has corrupted value 0x0! [ 647.795319][ T8286] WARNING: kernel/locking/qspinlock_paravirt.h:506 at __pv_queued_spin_unlock_slowpath+0x1fe/0x2a0, CPU#1: syz.6.106/8286 [ 647.808240][ T8286] Modules linked in: [ 647.812178][ T8286] CPU: 1 UID: 0 PID: 8286 Comm: syz.6.106 Not tainted syzkaller #0 PREEMPT(full) [ 647.821512][ T8286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 647.831725][ T8286] RIP: 0010:__pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 647.839032][ T8286] Code: f8 a8 9b f6 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 93 00 00 00 8b 13 48 c7 c7 00 0c ab 8b 48 89 de e8 73 9c fb f5 90 <0f> 0b 90 90 eb 95 48 c7 c7 90 e4 40 8e 4c 89 f6 4c 89 fa e8 fa c5 [ 647.868014][ T8286] RSP: 0018:ffffc900100c78c0 EFLAGS: 00010246 [ 647.874144][ T8286] RAX: 9e0501aa69750800 RBX: ffff8881c5419bc0 RCX: ffff8881921f9e00 [ 647.888941][ T8286] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 647.896967][ T8286] RBP: 1ffff11038a83379 R08: 0000000000000003 R09: 0000000000000004 [ 647.905094][ T8286] R10: dffffc0000000000 R11: fffffbfff1c7a604 R12: dffffc0000000000 [ 647.913214][ T8286] R13: dffffc0000000000 R14: ffff8881c5419bd0 R15: ffff8881c5419bc8 [ 647.921308][ T8286] FS: 0000555565514500(0000) GS:ffff8881258c4000(0000) knlGS:0000000000000000 [ 647.930663][ T8286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 647.937285][ T8286] CR2: 00007f8801a12e9c CR3: 00000001d6f0c000 CR4: 00000000003526f0 [ 647.945361][ T8286] Call Trace: [ 647.948753][ T8286] [ 647.951710][ T8286] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x15/0x30 [ 647.967867][ T8286] .slowpath+0x9/0x18 [ 647.971919][ T8286] do_raw_spin_unlock+0x122/0x240 [ 647.976986][ T8286] _raw_spin_unlock+0x1e/0x50 [ 647.988332][ T8286] copy_process+0x2793/0x3c00 [ 647.993091][ T8286] ? copy_process+0x97f/0x3c00 [ 647.998039][ T8286] ? __pfx_copy_process+0x10/0x10 [ 648.003102][ T8286] ? __might_fault+0xcc/0x130 [ 648.007673][ T6010] Bluetooth: hci78: command tx timeout [ 648.008777][ T8286] kernel_clone+0x21e/0x840 [ 648.013672][ T5189] Bluetooth: hci76: command tx timeout [ 648.017962][ T8286] ? __pfx_kernel_clone+0x10/0x10 [ 648.017995][ T8286] ? __handle_mm_fault+0x1033/0x5400 [ 648.018030][ T8286] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 648.018063][ T8286] __se_sys_clone3+0x256/0x2d0 [ 648.018090][ T8286] ? lock_acquire+0x5f/0x360 [ 648.018109][ T8286] ? __pfx___se_sys_clone3+0x10/0x10 [ 648.018144][ T8286] ? _copy_to_user+0x8a/0xb0 [ 648.018175][ T8286] ? do_user_addr_fault+0xc8a/0x1390 [ 648.018200][ T8286] ? rcu_is_watching+0x15/0xb0 [ 648.018225][ T8286] do_syscall_64+0xfa/0xfa0 [ 648.018255][ T8286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.018276][ T8286] ? clear_bhb_loop+0x60/0xb0 [ 648.018299][ T8286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.018319][ T8286] RIP: 0033:0x7fb44b1c3449 [ 648.018339][ T8286] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 648.018358][ T8286] RSP: 002b:00007ffc514a7578 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 648.018383][ T8286] RAX: ffffffffffffffda RBX: 00007fb44b145860 RCX: 00007fb44b1c3449 [ 648.018399][ T8286] RDX: 00007fb44b145860 RSI: 0000000000000058 RDI: 00007ffc514a75c0 [ 648.018415][ T8286] RBP: 00007fb44a7fe6c0 R08: 00007fb44a7fe6c0 R09: 00007ffc514a76a7 [ 648.018431][ T8286] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 648.018445][ T8286] R13: 000000000000000b R14: 00007ffc514a75c0 R15: 00007ffc514a76a8 [ 648.018468][ T8286] [ 648.018494][ T8286] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 648.018510][ T8286] CPU: 1 UID: 0 PID: 8286 Comm: syz.6.106 Not tainted syzkaller #0 PREEMPT(full) [ 648.018550][ T8286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 648.018566][ T8286] Call Trace: [ 648.018578][ T8286] [ 648.018588][ T8286] dump_stack_lvl+0x99/0x250 [ 648.018627][ T8286] ? __asan_memcpy+0x40/0x70 [ 648.018656][ T8286] ? __pfx_dump_stack_lvl+0x10/0x10 [ 648.018693][ T8286] ? __pfx__printk+0x10/0x10 [ 648.018732][ T8286] vpanic+0x281/0x750 [ 648.018761][ T8286] ? __pfx_vpanic+0x10/0x10 [ 648.018789][ T8286] ? is_bpf_text_address+0x292/0x2b0 [ 648.018813][ T8286] ? is_bpf_text_address+0x26/0x2b0 [ 648.018840][ T8286] panic+0xb9/0xc0 [ 648.018867][ T8286] ? __pfx_panic+0x10/0x10 [ 648.018911][ T8286] __warn+0x334/0x4c0 [ 648.018938][ T8286] ? __pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 648.018975][ T8286] ? __pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 648.019009][ T8286] report_bug+0x2be/0x4f0 [ 648.019037][ T8286] ? __pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 648.019071][ T8286] ? __pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 648.019104][ T8286] ? __pv_queued_spin_unlock_slowpath+0x200/0x2a0 [ 648.019138][ T8286] handle_bug+0x84/0x160 [ 648.019158][ T8286] exc_invalid_op+0x1a/0x50 [ 648.019180][ T8286] asm_exc_invalid_op+0x1a/0x20 [ 648.019202][ T8286] RIP: 0010:__pv_queued_spin_unlock_slowpath+0x1fe/0x2a0 [ 648.019245][ T8286] Code: f8 a8 9b f6 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 93 00 00 00 8b 13 48 c7 c7 00 0c ab 8b 48 89 de e8 73 9c fb f5 90 <0f> 0b 90 90 eb 95 48 c7 c7 90 e4 40 8e 4c 89 f6 4c 89 fa e8 fa c5 [ 648.019265][ T8286] RSP: 0018:ffffc900100c78c0 EFLAGS: 00010246 [ 648.019285][ T8286] RAX: 9e0501aa69750800 RBX: ffff8881c5419bc0 RCX: ffff8881921f9e00 [ 648.019304][ T8286] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 648.019320][ T8286] RBP: 1ffff11038a83379 R08: 0000000000000003 R09: 0000000000000004 [ 648.019336][ T8286] R10: dffffc0000000000 R11: fffffbfff1c7a604 R12: dffffc0000000000 [ 648.019355][ T8286] R13: dffffc0000000000 R14: ffff8881c5419bd0 R15: ffff8881c5419bc8 [ 648.019384][ T8286] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x15/0x30 [ 648.019424][ T8286] .slowpath+0x9/0x18 [ 648.019454][ T8286] do_raw_spin_unlock+0x122/0x240 [ 648.019488][ T8286] _raw_spin_unlock+0x1e/0x50 [ 648.019515][ T8286] copy_process+0x2793/0x3c00 [ 648.019551][ T8286] ? copy_process+0x97f/0x3c00 [ 648.019583][ T8286] ? __pfx_copy_process+0x10/0x10 [ 648.019610][ T8286] ? __might_fault+0xcc/0x130 [ 648.019649][ T8286] kernel_clone+0x21e/0x840 [ 648.019682][ T8286] ? __pfx_kernel_clone+0x10/0x10 [ 648.019710][ T8286] ? __handle_mm_fault+0x1033/0x5400 [ 648.019748][ T8286] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 648.019784][ T8286] __se_sys_clone3+0x256/0x2d0 [ 648.019814][ T8286] ? lock_acquire+0x5f/0x360 [ 648.019836][ T8286] ? __pfx___se_sys_clone3+0x10/0x10 [ 648.019888][ T8286] ? _copy_to_user+0x8a/0xb0 [ 648.019922][ T8286] ? do_user_addr_fault+0xc8a/0x1390 [ 648.019949][ T8286] ? rcu_is_watching+0x15/0xb0 [ 648.019979][ T8286] do_syscall_64+0xfa/0xfa0 [ 648.020012][ T8286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.020036][ T8286] ? clear_bhb_loop+0x60/0xb0 [ 648.020064][ T8286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.020088][ T8286] RIP: 0033:0x7fb44b1c3449 [ 648.020106][ T8286] Code: d7 08 00 48 8d 3d fc d7 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 648.020127][ T8286] RSP: 002b:00007ffc514a7578 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 648.020150][ T8286] RAX: ffffffffffffffda RBX: 00007fb44b145860 RCX: 00007fb44b1c3449 [ 648.020167][ T8286] RDX: 00007fb44b145860 RSI: 0000000000000058 RDI: 00007ffc514a75c0 [ 648.020185][ T8286] RBP: 00007fb44a7fe6c0 R08: 00007fb44a7fe6c0 R09: 00007ffc514a76a7 [ 648.020203][ T8286] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 648.020219][ T8286] R13: 000000000000000b R14: 00007ffc514a75c0 R15: 00007ffc514a76a8 [ 648.020246][ T8286] [ 648.024260][ T8286] Kernel Offset: disabled