last executing test programs: 2m48.363856939s ago: executing program 1 (id=1550): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = prctl$auto(0x3e, 0x2, 0xffffffffffffffff, 0x1, 0x6) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) r2 = socket(0x2, 0x801, 0x106) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0x0) r3 = socket(0x1d, 0x2, 0x6) socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r4, 0xfd}, 0x6a) write$auto(0x3, 0x0, 0x81) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$auto(r5, &(0x7f0000001680)='\v\x90\xd1\xda\xbc>1\x8ag\x14\x18\xbe\xdc\x00', 0x4) sendmsg$auto_NL80211_CMD_SET_WIPHY(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000640)={&(0x7f0000000740)=ANY=[@ANYBLOB="94000000", @ANYBLOB="010029bd7000fcdbdf25020000000500c2000700000050c2280100ebd12597fe87beed4ca6de1fe7bc069841d70f5b0fef428e62ca8b86d9812877f912e0396109bd01c53ab691241708fec6ab5ebc584bf6a002b8bc74299e9ab17c574fc48c6df5fc43040046010500d300e50000001a001300c7c08e4d9e4fa5c06f5fbaf1bfc21be6636c900613c500000000267bdea594fc45b9bc561579394f7cdb10c0e711ad38c41854789519d300faae"], 0x94}, 0x1, 0x0, 0x0, 0x4000010}, 0x40000d0) r6 = openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000002f00)='/dev/input/event0\x00', 0x200, 0x0) ioctl$auto_EVIOCGREP(r6, 0x80084503, 0x0) getpeername$auto(r6, &(0x7f00000004c0)=@can, &(0x7f0000000500)=0x10) pread64$auto(r3, &(0x7f00000000c0)='\xff\xdf\x12\xe5\xebno\x8e/proc/tF\xcanY\x94\xacW\xa4?0\x17x\xdbQ\xcehread-self/net/tcp6\x00\xd2)\x8e\x89\x00\x00\x19\xfd\x03\xc3\x8d\xd7D\bz\xde5\xd5\xa3\xddS\xe6\x1a\x8a`\xad0\x98|\xbc\x00\x98\b\x0ey\xcb`\x9b\x91r\xd5\x13\x9e\xdd4\xe7\xb7\x94P\x8fBlm\x04eAW\xbc0\x9b\xbd\x8f\xf5];\x94\x18\xf0\v\xd7\xf4P\xd3\x9e,Q\xd8\x16\x989l\x03\a\xcc\x1e\xb9\xe9{\xeeS\xa9\xc60\x00\xb5&\x9e\xdbk{F\x18\xa8\xba*G\xd3\x80\xb1G.\xec1\x96uP\x97\x8co\xf1\xa6\xd5\xea\xc8L3|a\xb3\xaa\x90~Y\xb19\xad\xdc\x05o\x98g\xd4\x10]5\x95\xd0\xabJC\x06\xd0c\xd1Ra\xf7\xc4n\xdf\xe4\xc7\x03\x19x\xbb\v\x00\t\xde\xf5\x93\xfb\xfb#\x06\x00S\f57\x87\xdd\xaa\xf0\x9c\xd3G\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xae\xa7\xec*\xaeH\x13\xfb)\x8b\xe5\xcf\xd14\x1e\xabFH\xd2,\x99PG\xed(\xca\x80\x02\xf9,\xb2\xd6e\xbe0^\x85\xaco\xd0\xf7QJ\xc3E\xfd\x99lr\v\xe7\xfcg\xf7EE\xa3j\x7f\x1ah\xfd\x9a\x81\xae \x98\xcb\xa0\x12K\x8b=\x9d2f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc\x00\x00', 0x0) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) (async) mbind$auto(0x2000, 0x2091d2, 0x4, 0x0, 0x6, 0x2) (async) listen$auto(0x3, 0x81) (async, rerun: 32) mmap$auto(0x0, 0x2020009, 0x9, 0xeb1, r1, 0x8000) (rerun: 32) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) (async, rerun: 64) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) (async, rerun: 64) ioctl$auto_SNDRV_PCM_IOCTL_PREPARE2(r1, 0x4140, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000340), 0xffffffffffffffff) write$auto_proc_uid_map_operations_base(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$auto_NFSD_CMD_THREADS_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf2502000000810004006e66736600d8efe42d132b72f30c54315aa74a5b8103cf2ddf901f8fc81365e252374483326ace7da356b7a16f5ce613bc0ce3aeb87ed3d22b4a27c3ecc90c70c861befe60a7a9414b446427a001f61379e8caf4519e032a5dda1e1174e2d575772b93fc046cd3a674866b80d91473ece248c03d28f9398a63a785998700000008000300850000000800010002000000"], 0xa8}}, 0x4000) (async) madvise$auto(0x0, 0x200007, 0x19) (async) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/pagemap\x00', 0x404001, 0x0) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) (async) prctl$auto(0x1000000003b, 0x8000, 0x4, 0x5, 0x7) (async) r4 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/013/001\x00', 0x6ac01, 0x0) ioctl$auto_USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000100)={0x2, 0x80, 0xffff, 0x5, &(0x7f0000000240)="03", 0xc694, 0x3, 0x80005, @number_of_packets=0x3e, 0x2004b, 0xc, 0x0}) (async) madvise$auto(0x0, 0xffffffffffff0005, 0x19) (async) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0xb74, 0x66a) madvise$auto(0x0, 0xffffffffffff0001, 0x15) (async) socket(0x1a, 0x6, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x54) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) (async) ioctl$auto_BLKRRPART(r1, 0x125f, 0x0) write$auto_drm_edid_fops_drm_debugfs(r1, 0x0, 0x0) 2m42.090271484s ago: executing program 1 (id=1580): sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRES16=0x0, @ANYBLOB="000826bd7000fedbdf250300000008000400b70a0000060007000080000008000200", @ANYRES32, @ANYBLOB="0a0005000180c200000e00000a07000000000000000e00000a000100000000000000000008000200", @ANYRES32], 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x2404c8c1) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003b40)={'veth0_to_hsr\x00', 0x0}) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYRES16=r2], 0x1ac}, 0x1, 0x0, 0x0, 0x8000}, 0x40001) (async, rerun: 32) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x50}, 0x40000) (async, rerun: 32) sendmmsg$auto(r1, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa506}, 0x800}, 0x7, 0x4008) 2m41.913420328s ago: executing program 1 (id=1582): mmap$auto(0x8000, 0x2020006, 0x5, 0x80000eb1, 0xffffffffffffffff, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) r0 = bpf$auto(0x18, &(0x7f0000000380)=@link_create={@prog_fd, @target_fd, 0x7fff, 0x40000, @kprobe_multi={0x6, 0x80000001, 0xb70, 0x733, 0x4}}, 0x92) sendmsg$auto_NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x440d1}, 0x4084) bpf$auto(0x0, 0x0, 0x6f4) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card1/timer_source\x00', 0x8002, 0x0) write$auto(r1, 0x0, 0x1) close_range$auto(0x2, 0xa, 0x0) openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/set_event_notrace_pid\x00', 0x40000, 0x0) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) listen$auto(0x3, 0x81) madvise$auto(0x0, 0x2003f2, 0x15) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000340), 0xffffffffffffffff) r4 = openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, &(0x7f00000013c0)='/proc/self/uid_map\x00', 0x200000, 0x0) write$auto_proc_uid_map_operations_base(r4, 0x0, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = socket(0x21, 0x5, 0x84) getsockopt$auto(r5, 0x84, 0x1f, 0x0, &(0x7f0000000080)=0x49b) sendmsg$auto_NFSD_CMD_THREADS_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf2502000000810004006e66736600d8efe42d132b72f30c54315aa74a5b8103cf2ddf901f8fc81365e252374483326ace7da356b7a16f5ce613bc0ce3aeb87ed3d22b4a27c3ecc90c70c861befe60a7a9414b446427a001f61379e8caf4519e032a5dda1e1174e2d575772b93fc046cd3a674866b80d91473ece248c03d28f9398a63a785998700000008000300850000000800010002000000"], 0xa8}}, 0x4000) madvise$auto(0x0, 0x200007, 0x19) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/pagemap\x00', 0x404001, 0x0) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) 2m35.010220518s ago: executing program 3 (id=1615): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x11, 0x3, 0x9) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/kallsyms\x00', 0x20100, 0x0) readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x3, 0x3a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/system/memory/memory12/power/control\x00', 0x100, 0x0) r0 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r1 = socket(0x1d, 0x3, 0x1) setsockopt$auto(r1, 0x65, 0x2, 0x0, 0x4) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x8c00, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video43\x00', 0x129900, 0x0) ppoll$auto(&(0x7f0000000200)={0xffffffffffffffff, 0x6, 0x6}, 0x8, 0x0, 0x0, 0x8) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video43\x00', 0x129900, 0x0) select$auto(0x5, &(0x7f0000000080)={[0x400020000008, 0xfffffffffffffffc, 0x7, 0x6, 0xc, 0x3, 0x3, 0x1ffe000, 0x7, 0x2, 0x9, 0xf, 0xa657, 0x203, 0xd3, 0x1]}, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYRES16=r0], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8040) r3 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000", @ANYRES64], 0x1ac}, 0x1, 0x0, 0x0, 0x40}, 0x40000) sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0x3ff}, 0x2, &(0x7f0000000140), 0x7, 0x5}, 0x800}, 0x7, 0x4008) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) seccomp$auto(0x1, 0x0, &(0x7f0000000100)="740fb5dc698e7ba7e4") 2m34.7955604s ago: executing program 3 (id=1617): openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) read$auto_proc_uid_map_operations_base(0xffffffffffffffff, &(0x7f0000000080)=""/162, 0xa2) (async) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) (async) setrlimit$auto(0x7, &(0x7f0000000080)={0x0, 0x6}) (async) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0xa, 0xb8, 0x10, 0x7, 0x4, 0xffffffffffffffff, 0xa, "2af051b26b658a20d8dc6b36c83ce63f", 0x0, 0xffffffffffffffff, 0x5, 0x7, 0x7, 0x6}, 0xf) sendmsg$auto_ETHTOOL_MSG_CABLE_TEST_TDR_ACT(0xffffffffffffffff, 0x0, 0x800) (async) timer_create$auto(0x9, 0x0, 0x0) (async) read$auto(0x3, 0x0, 0x8080) socket(0xa, 0x1, 0x100) (async, rerun: 64) write$auto(0x3, 0x0, 0xffd8) (rerun: 64) unshare$auto(0x40000080) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS1\x00', 0x20000, 0x0) ioctl$auto_TIOCGDEV2(r0, 0x5429, 0x0) (async) process_mrelease$auto(0xffffffffffffffff, 0xa) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) (async, rerun: 32) r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) (rerun: 32) mount$auto(0x0, 0xfffffffffffffffe, 0x0, 0x80, 0xfffffffffffffffe) write$auto(r1, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6) (async) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/adsp1\x00', 0x4a42, 0x0) (async) mknod$auto(&(0x7f0000000140)='./file0\x00', 0x6, 0x4000000) (async) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/037/001\x00', 0x802, 0x0) mmap$auto(0x1000000000, 0x100000400008, 0x1000000000000df, 0x4000009b73, r2, 0x8000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/admmidi2\x00', 0x15f980, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x10000000000001ff, 0x7, 0xd3e, 0x20, 0x9687, 0x100000000000003, 0x3c2a19d5, 0x6, 0x3, 0x62, 0x8, 0x7, 0x6d3f, 0x6, 0xa, 0xfffffffffffffffe]}, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1, 0x4, 0x3, 0x3, 0x3, 0xffffffffffffffff, 0x3, 0x8000000000400000, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0) (async) close_range$auto(0xffffffffffffffff, r0, 0x1) (async) bpf$auto_BPF_PROG_QUERY(0x10, 0x0, 0x4006) (async, rerun: 32) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$auto_XFS_IOC_ERROR_CLEARALL(0xffffffffffffffff, 0x40085875, 0x0) rseq$auto(&(0x7f0000000400)={0x4001, 0xa, 0x7fffffffffffffff, 0x7, 0x8, 0x4, "bd8c851002787cdeff1484aa1807a899be4326bf5bfc9b3ada3a966cd39501a280e54db74207144c4c210f16237f1b401e6c629d5c1c32ca86e2085bfae565a459f38def68fb508043dd926147f553e657f25adc364ab505a98684a4a1252ef0bf81af347fb4dc92d1cb27bd45e6f1a6492b6a378583903ac8059b43539845754cbe198b5c16ee230fdf55944bf4563de4b61cc81181c7afa2895e4c328eb0f7e714cd64693957abcdb625e096ba42a22ef6e2ef20958a1faaecbfbe461d28e4fca25da306165c6f4efc6bc6c4d2ab3d0aacbdd5c49201aea8b83c8bd47b7301957d8f78109c95f7caf5680d0a92664e1c9f125165f1d606e25e6ba591fc66e583756a19d1eab29c9ce88b1b574da7157bab7113caeafdb49ea2547effa4597b823df27c0bdcca7491f303cac7dbac56b258198c0ec8d6175e74e2d48e6a2d344aefc30bb4950688f39e183b32"}, 0x5, 0x244, 0xe) 2m34.094067892s ago: executing program 3 (id=1619): syz_genetlink_get_family_id$auto_net_shaper(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x20006, 0xdf, 0xeb1, 0x401, 0x8000) r0 = timerfd_create$auto_CLOCK_TAI(0xb, 0x8) mmap$auto(0x0, 0x7295, 0xdf, 0x9b72, r0, 0x7ffc) prctl$auto_PR_SET_MM_START_CODE(0x80, 0x1, 0xffffffffffffffff, 0x7, 0x410) r1 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bus/usb/003/001\x00', 0x8001, 0x0) ioctl$auto_BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000380)=[{0xfa68, 0xffffffffffffffff, 0xcc3}, {0x2, 0x4fa, 0x7ff}, {0x8000000000000001, 0x9, 0xfffffffeffffffff}]) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) madvise$auto(0x0, 0x8, 0xe) madvise$auto(0x0, 0xffffffffffff0001, 0x15) ioctl$auto_USBDEVFS_RELEASE_PORT(r1, 0x80045519, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x15, 0x5, 0x7) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) madvise$auto(0x110c230000, 0x1, 0x9) getrandom$auto(0x0, 0x3, 0x80000001) statmount$auto(0x0, &(0x7f0000000180)={0x9, 0xfffffffe, 0x44f, 0xa, 0x10, 0x1007181, 0x0, 0x62, 0x7, 0x800, 0x0, 0x26, 0x4, 0x200003fffffe, 0xfffffffffffffff5, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x862, 0xf, 0x22002, 0x200, 0x0, 0x62f, 0x6, 0x0, 0x0, 0x0, 0xb626, [0xfffffffffffffffe, 0xffffffffffff04ef, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e, 0x0, 0xa7, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffffd, 0x40, 0x81, 0x8a0, 0xb, 0x81, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100002, 0x0, 0x3ff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4000000000000]}, 0x800000000000b, 0xbc) r2 = openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0) ioctl$auto__ctl_fops_dm_ioctl(r2, 0xfffffff7effffd0c, &(0x7f00000001c0)) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0xb74, 0x66a) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) setsockopt$auto(0x3, 0x0, 0x4, 0x0, 0x28) msync$auto(0x110c230000, 0x200001, 0x6) 2m33.090801872s ago: executing program 3 (id=1622): mmap$auto(0x0, 0x4020009, 0xdc, 0xeb1, 0xffffffffffffffff, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) unshare$auto(0x40000080) prctl$auto_PR_SCHED_CORE_SHARE_TO(0x7, 0x2, 0xffffffffffffffff, 0x6, 0x3) socket(0x2, 0x1, 0x0) close_range$auto(0x2, 0x8, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2, 0x1, 0x106) setsockopt$auto(r1, 0x6, 0xd, &(0x7f0000000280)='lp\x00h\x85M\xdf\xdc\x83\x8a\xa7\xe4]U(\x01\t=\x1e\x00\x00', 0x4) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, 0x0, 0x54) getsockopt$auto(0xffffffffffffffff, 0x84, 0x76, 0x0, &(0x7f00000002c0)=0x1000c0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x6e642, 0x0) sendmsg$auto_NL80211_CMD_ABORT_SCAN(r1, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000c80)=ANY=[@ANYRESDEC=r1, @ANYRES8=r0, @ANYRES16, @ANYRES32, @ANYBLOB="ed07ef80fccd9226da5e297bda376e9de44c1806394373cac1bb5b2306da528919fc9d1c923ad3421b9c031a70151be9c91b6d3c336ec68fd9480c38882ae5d5910057f40e9f4208153a878aa04961844aa8e8e407fd76084a82b171980908e34eb73a0f3d4469944d6f7245ba5bd596afa944e3d24b156d4fb19746d5cfc053c7bea82e7eb13504f50790e3073e47eeb15392e16c3b7d229b38ab6c8980d970bc02504eeb55fa4b6a83d4a66c2438f0681177068bfb842ea61d6a8f853783e1e3e390f5678cc3f18525f247e4a7ce8f10a9167a578be78284caf9e4729ece7c19caea9065e5b714346873c6cff4fbdbedbbd761f5be5c067180580640807c01478008005800ffffffffa068b0121e733b497aeabf63cff5cb45369896888b9e1f835a928fa4c10afd60715f7452f0132f15a054af098f566286772e159e973b088736a8f5b102c026897e57a976864102e801db03298ed207d37ad07a9c5c89b315b8a0d9cff20a192b6ac6db17314dba7683e0d1c7f6f23d3d3e212a62c0bb5fa4e2a475d3787eed74c921cbec58df308544c38c83834c9f4ede42e60f6b72c334a5b806b2f78cf73c61b9a59f692e084f06009cec9b5aabf41dbc568f4ebab5557226ab7d6e59e4d81858180389dec52bbd2111c705e2de1b79652d109840bd8a68af6fc408b5ed3c1172419752a1dfe0cb35b87d014d5f50199661ddb8bc5649b864b33ad72b3bce486e713dc3fa34d1062714147e67c204e9bd8bfdbc23eba7c2b41ee1213f81021a5c310a44bc4afba11cc895f8e59f0591bd7f9967988237939a85beee4968b33a90de20b055c5b99ec87c17b17100db73706bb3a1b77df4cd131f38ec8b8f04e20f2258a711938d95a65400d88306c708008300", @ANYRES32, @ANYBLOB="8f0252804be2bfdd2fb07c63769b275d81b5aef09abe2fc2ab892c1fcfb9b0a5b6dd6a0fd0f432dd4bdc0a70bc4dd9771fc1be698eba6d6185376e1590dfc9a6867c59d8b3ebd3f48c582d104e5641cc757bccf393ec771e09e0290b4464c614d8552e8c8bf6b29d63cd840d0fa97e94a0d346c1ee2ed23a6eae8e9d898adaf43d226c50ceda8a1a50cfde46177160f4a9d20e3febc9dc2fba4e71acc6bf1568605e3ee027a943208cd04cd20087f94d9e209aa67a9ce9933ebc4fc07af5c78a464271159265d0085aec470b67b81a2113fae7acb42e8b76e1c4c3de646e85211790802fa5b23aa0384f9fa4b57137f759b7d61914e3e71650bf690d2c3f07c666945a5a2394812c207500e10f8a9a6d34e64cbec206be828337f16ba1f9dd3e6206525f09919d93464b3a7f8cbde82b258553d503a441cf48adfa6e03d9e07d1d0d715fe335fdb65c8a59019593de5c895ef7af607710a5cc5f2d9827dce0ed8f2839a47ed0006c2048a51e6cb4418337dc92f64e8afe2830012d66d523ef8dfc1661547eb7dc077375a1e2f3f7c701327b8cfc9be155b2bc6291d68e054213cbc954784cf4c3045ee8d73256ffb2ff1df22e1389c9d44ee649673482785e37f3324ba2708a98a53096d2b5b4afd88d9aa20f82005c8ace7a1e0bd085e468d81a333895e3a500a4ef883b74c28b7362fd35425518359c9a103d8816376f80ad651fa9eb4528fb76a8bb00f7f6f260ea1f13c15cfe44d2e601bd82fb0520d59dcab39019ddba70c281708409ff970a17e5ed9f38f2941ece41474ea7e76eb8ec9b061750e898225ec3ee9b80eea1ce3b54de4f2fea38e6f06d15c0c5dca76c1dd5df10f3731c68868a19dd8bd1874e58fc4f08fc203cd9f84bd44a1e51532c0e70412b956ee47ddba48696e1581cb6006200f4800f00f9002f6465762f7a72616d300000d135a7b84172812c1d04007380bfb320997353e2871caef670a7317161e1da40f91473996eb93f05828a62a7ea72edc918cdebc324f11a0f71ae4507d482aa41aa64160c50e67a55e934b68289060000af5e23bdb20b6a40a4dcf9abbf1dc300effd720c885830f37a00096865fced0814b769a7ba4f6113ab7853f84128f5e499000538a54a44b81e3c3fdca70556c59aff25c1fc529f03ebc5815d14d8292429056d3083fb285ee95f7c506038c8fff8b02efac2f42adfdc9d9377ab0dd42883f71bedd7daad628eed9c426c76598409bd7544d7a701121582fadd1bdfecdf7e6614ff668d1667f7d86c837df255d5db48ccdafdadccb0f79999dbc52dabcb3a2df7615ee05cc04382993d17eee11ca14c2f651c1e0ac11a3fe7e322c7d9280577aaaa0cd1fcb0293ee94eb69bf7679035ba71810e86feea003700d9c52691fc9886092a82976c0b03e69815dd12a8b09c8f58fc66a3df4fe4e09c1be9ff9c8c474c8344644e5ad3a4b221e515f2d302fd0065f233770b14e53d4e0f9269954c415bf9f9e5187e200dc390ab07477afa735574794216934eb1369442aab7bfacd60ba9598b80e52521fc60906d1b3c20465dc12346398582f3b64fd05fbfde70f67b4ee76e8f44ad8cf7b2f7efbf9a01c6df30613ab7a0d3b1a4e4fcc4420829656a93ff7aa2da7aff54b6cda1e1f4b726c3a46a6d5f6a96a02474461a83acc1ea0db6434cb7c5a8c5fe7fb0b6ddacc83fa3d5171039b666bf9e83922a8e4becb000000800f1004000000073895e6d444d68518800daf62674039cf14af26045a56cb239996b23f8e029fcd87e3fce9f8527fbfb1cf2827a2843c17344fd37caa6a1ece2d74a401dd461a1e559636b2f1ad40518ee5f8cf1a736fbf18e2e63554ed526a8366a46650b6b772553104ebc5a532fedb55a7064028e778a036514973aea17d2d12d1e7786562c7c4641822c2a8c501a7d1764d638d54f03c8015424e15c9dc61f1c0000000800150064010101000000", @ANYRES32], 0xac0}, 0x1, 0x0, 0x0, 0x240000d0}, 0x20048800) write$auto(r2, &(0x7f0000000400)='odev/audio1\x00', 0x100000a3d9) socket(0xa, 0x2, 0x0) timerfd_create$auto_CLOCK_REALTIME(0x0, 0x5) 2m32.723601825s ago: executing program 3 (id=1624): sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0) setsockopt$auto(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x14) setsockopt$auto(0x3, 0x10f, 0x87, 0x0, 0x214) sendmmsg$auto(0x3, 0x0, 0x3, 0x0) r0 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000002dc0)='/dev/adsp1\x00', 0x2401, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/fail-nth\x00', 0x0, 0x0) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) bpf$auto(0x8, &(0x7f0000000380)=@iter_create={r1, 0x5}, 0xa) write$auto(r1, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) close_range$auto(0x2, 0x8, 0x0) recvmsg$auto(r0, &(0x7f0000000340)={&(0x7f0000000140)="c53955fc05d9ddf3c970aabe2803993ce7530fbb27a87ffa28677b57756af5dc72faf427f32ce0256495458d91819a55c56ca09bba9f21f95a38aa11727c7b30430083627180a916e86b0f12f8faae7f0ccebd5b8444dcbe072429d176a65deab613624d6050efeba8808766abf355ad077a5042c0c3128586c5dcd96f3071253a2c5a9a9df3460f992a1e305d66435782a7cd266add3e278f4152f677990d6a0173319eb9a671a58055baabd263cc0ce4b64e4f74bf4f", 0xffff, &(0x7f0000000280)={&(0x7f0000000200)="7adeac9b01c7258633094eb475473d1831cfa3358e8ae69cf71f71f90021087b8549854d94d1a14ddb9d810c9396ce207dfd4328f87dbc5ec95fe4fe843e8f255b105cc08ae499c9825fd1", 0x100000000}, 0x5, &(0x7f00000002c0)="f5e418adafe13d9110ea7302b994ca356596c7eb8ae14ae11c6badbc9711aeb2a36517e4c94fe7b7efd0a6c170da4c69c8d7034c6c58670a1aa0b81be93e33e0164ab034afedcf04b1d5646d86945eab09bd24bc5d857c15f5d11d537cbd35906208e86f2b6e95183e6a9d5a8346e0c19b98fc9a294900ef0d77fd90ddad", 0xfffffffffffffffa, 0xffff}, 0x513b) 2m32.523225942s ago: executing program 3 (id=1625): io_uring_setup$auto(0x386, &(0x7f0000000000)={0x5, 0x1, 0x4c, 0x0, 0x1, 0x8, 0xffffffffffffffff, [0x10001, 0x8, 0xa], {0x8, 0x8, 0x3fc000, 0x4, 0xffffff7a, 0x751ea2a8, 0x9, 0xec5, 0xffff}, {0xd5, 0x80000000, 0x1bee, 0x5d, 0x400, 0x9, 0x5, 0x8000, 0x7f}}) close_range$auto(0x2, 0x8, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/tty/ttyxa/dev\x00', 0x80000, 0x0) openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0x10002}, 0x1) close_range$auto(0x0, 0xffffffffffffffff, 0x4000000000002) openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socketcall$auto(0x9, 0x0) (async) socketcall$auto(0x9, 0x0) openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000002340)='/dev/binderfs/binder0\x00', 0x0, 0x0) (async) openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000002340)='/dev/binderfs/binder0\x00', 0x0, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x14be02, 0x0) ioctl$auto_BLKFLSBUF(r0, 0x1261, 0x0) openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/oom_adj\x00', 0x400000, 0x0) openat$auto_debugfs_devm_entry_ops_file(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/cec/cec23/status\x00', 0x6380, 0x0) (async) r1 = openat$auto_debugfs_devm_entry_ops_file(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/cec/cec23/status\x00', 0x6380, 0x0) read$auto_debugfs_devm_entry_ops_file(r1, &(0x7f00000001c0)=""/27, 0x1b) (async) read$auto_debugfs_devm_entry_ops_file(r1, &(0x7f00000001c0)=""/27, 0x1b) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) (async) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) (async) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) chdir$auto(&(0x7f0000000000)='}[,&*}\x00') open(&(0x7f0000000100)='.\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) getdents$auto(r2, 0x0, 0x18) mmap$auto(0x0, 0x20005, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8010) (async) mmap$auto(0x0, 0x20005, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8010) statmount$auto(0x0, &(0x7f0000000180)={0x7d4, 0x1, 0x401c2, 0x2081, 0x40, 0x7ffc, 0x1ffde, 0x8001, 0x3, 0x4, 0x9, 0x1, 0x4, 0x8, 0x200000003004, 0x9, 0x4, 0x10002, 0x80, 0x400, 0x5, 0x7, 0x1ffc, 0x8203, 0x400, 0x5, 0x5, 0x0, 0x40, 0x5, 0x2, [0x7249, 0xa9d, 0x2, 0x1000000000000000, 0x0, 0x180, 0x2, 0x0, 0x0, 0x200000000000000, 0xfc6a, 0x1000000, 0x10000, 0x40000000000, 0x0, 0x500000000000, 0x80000000000000, 0x0, 0xffffffffff7ffffc, 0x1ff, 0x0, 0x2, 0xfff, 0xd, 0xfffffffffffffffd, 0xffffffffffffffff, 0x2, 0x0, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x7, 0xffffffffffffdffc, 0x3, 0x1, 0x5, 0xfffffffffffffffc, 0x10000000004]}, 0x1fe, 0xd) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x24008000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) ioctl$auto(0x3, 0x40104d00, 0xffffffffffffffff) socket(0x10, 0x2, 0x0) (async) r3 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x1f, &(0x7f0000000100)={0x0, 0x1}, 0x2, 0x0, 0x7, 0xa505}, 0x2}, 0x7, 0xfffffff9) 2m26.825592176s ago: executing program 32 (id=1582): mmap$auto(0x8000, 0x2020006, 0x5, 0x80000eb1, 0xffffffffffffffff, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) r0 = bpf$auto(0x18, &(0x7f0000000380)=@link_create={@prog_fd, @target_fd, 0x7fff, 0x40000, @kprobe_multi={0x6, 0x80000001, 0xb70, 0x733, 0x4}}, 0x92) sendmsg$auto_NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x440d1}, 0x4084) bpf$auto(0x0, 0x0, 0x6f4) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card1/timer_source\x00', 0x8002, 0x0) write$auto(r1, 0x0, 0x1) close_range$auto(0x2, 0xa, 0x0) openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/tracing/set_event_notrace_pid\x00', 0x40000, 0x0) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) listen$auto(0x3, 0x81) madvise$auto(0x0, 0x2003f2, 0x15) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000340), 0xffffffffffffffff) r4 = openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, &(0x7f00000013c0)='/proc/self/uid_map\x00', 0x200000, 0x0) write$auto_proc_uid_map_operations_base(r4, 0x0, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = socket(0x21, 0x5, 0x84) getsockopt$auto(r5, 0x84, 0x1f, 0x0, &(0x7f0000000080)=0x49b) sendmsg$auto_NFSD_CMD_THREADS_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r3, @ANYBLOB="01002cbd7000fddbdf2502000000810004006e66736600d8efe42d132b72f30c54315aa74a5b8103cf2ddf901f8fc81365e252374483326ace7da356b7a16f5ce613bc0ce3aeb87ed3d22b4a27c3ecc90c70c861befe60a7a9414b446427a001f61379e8caf4519e032a5dda1e1174e2d575772b93fc046cd3a674866b80d91473ece248c03d28f9398a63a785998700000008000300850000000800010002000000"], 0xa8}}, 0x4000) madvise$auto(0x0, 0x200007, 0x19) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/pagemap\x00', 0x404001, 0x0) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) 2m17.311546299s ago: executing program 33 (id=1625): io_uring_setup$auto(0x386, &(0x7f0000000000)={0x5, 0x1, 0x4c, 0x0, 0x1, 0x8, 0xffffffffffffffff, [0x10001, 0x8, 0xa], {0x8, 0x8, 0x3fc000, 0x4, 0xffffff7a, 0x751ea2a8, 0x9, 0xec5, 0xffff}, {0xd5, 0x80000000, 0x1bee, 0x5d, 0x400, 0x9, 0x5, 0x8000, 0x7f}}) close_range$auto(0x2, 0x8, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/tty/ttyxa/dev\x00', 0x80000, 0x0) openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0x10002}, 0x1) close_range$auto(0x0, 0xffffffffffffffff, 0x4000000000002) openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socketcall$auto(0x9, 0x0) (async) socketcall$auto(0x9, 0x0) openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000002340)='/dev/binderfs/binder0\x00', 0x0, 0x0) (async) openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000002340)='/dev/binderfs/binder0\x00', 0x0, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sda\x00', 0x14be02, 0x0) ioctl$auto_BLKFLSBUF(r0, 0x1261, 0x0) openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/oom_adj\x00', 0x400000, 0x0) openat$auto_debugfs_devm_entry_ops_file(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/cec/cec23/status\x00', 0x6380, 0x0) (async) r1 = openat$auto_debugfs_devm_entry_ops_file(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/cec/cec23/status\x00', 0x6380, 0x0) read$auto_debugfs_devm_entry_ops_file(r1, &(0x7f00000001c0)=""/27, 0x1b) (async) read$auto_debugfs_devm_entry_ops_file(r1, &(0x7f00000001c0)=""/27, 0x1b) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) (async) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) (async) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) chdir$auto(&(0x7f0000000000)='}[,&*}\x00') open(&(0x7f0000000100)='.\x00', 0x0, 0x0) (async) r2 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) getdents$auto(r2, 0x0, 0x18) mmap$auto(0x0, 0x20005, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8010) (async) mmap$auto(0x0, 0x20005, 0x4000000000df, 0xeb1, 0xffffffffffffffff, 0x8010) statmount$auto(0x0, &(0x7f0000000180)={0x7d4, 0x1, 0x401c2, 0x2081, 0x40, 0x7ffc, 0x1ffde, 0x8001, 0x3, 0x4, 0x9, 0x1, 0x4, 0x8, 0x200000003004, 0x9, 0x4, 0x10002, 0x80, 0x400, 0x5, 0x7, 0x1ffc, 0x8203, 0x400, 0x5, 0x5, 0x0, 0x40, 0x5, 0x2, [0x7249, 0xa9d, 0x2, 0x1000000000000000, 0x0, 0x180, 0x2, 0x0, 0x0, 0x200000000000000, 0xfc6a, 0x1000000, 0x10000, 0x40000000000, 0x0, 0x500000000000, 0x80000000000000, 0x0, 0xffffffffff7ffffc, 0x1ff, 0x0, 0x2, 0xfff, 0xd, 0xfffffffffffffffd, 0xffffffffffffffff, 0x2, 0x0, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x7, 0xffffffffffffdffc, 0x3, 0x1, 0x5, 0xfffffffffffffffc, 0x10000000004]}, 0x1fe, 0xd) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x24008000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) ioctl$auto(0x3, 0x40104d00, 0xffffffffffffffff) socket(0x10, 0x2, 0x0) (async) r3 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0x1f, &(0x7f0000000100)={0x0, 0x1}, 0x2, 0x0, 0x7, 0xa505}, 0x2}, 0x7, 0xfffffff9) 1m46.286672331s ago: executing program 2 (id=1788): close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/net/rpc/nfsd.fh/channel\x00', 0x88400, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_PROBE_CLIENT(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, r1, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@NL80211_ATTR_PMKR0_NAME={0x22, 0x102, "165de92a8db9bb87b17b58fd2802f64d772132c212d1e7a021e3163f13fb"}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000808e}, 0x1) r2 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/mtrr\x00', 0xc0000, 0x0) ioctl$auto(r3, 0x2, 0x9) setresuid$auto(0x8, 0x8, 0x0) setfsuid$auto(0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x400200, 0x0) ioctl$auto_SNDCTL_SEQ_RESETSAMPLES(r2, 0x40045109, &(0x7f0000000180)="75874635b5ea32f37f25bea3c6507c62fbc535a447c4762e8277e187a928fa6451b61d1e9ca30bf9a7dfadaefe141eedf46ceffc96c76a78c9dfbc1a35b1a8e80a56f3c4735d78cd72b37768ab7aa7d580c8bd45e9b53e8a4f30f8e049d0f793b42e0d244189b5903cff86371cc5415109a43cded4c34a61c04dbde808076283c2fba2ee1aa19e73af681455c1b55ac9c8fa41b54f9fc606817ca0ee5d3ed8b61a2757136c6db405e1aeea") pivot_root$auto(&(0x7f0000000040)='..\x00', &(0x7f0000000080)='.\x00') openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f0000000000), 0x80100, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0xa, 0x0) openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000140)='/dev/input/event0\x00', 0x80400, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) socket(0x11, 0x3, 0x2) openat$auto_fops_blob_file(0xffffffffffffff9c, &(0x7f0000000040), 0x101400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2c, 0x3, 0x0) socket(0x11, 0x2, 0x73) 1m46.057881521s ago: executing program 2 (id=1790): r0 = openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000080), 0x161500, 0x0) ioctl$auto_IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, 0x0) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$auto_KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000000)={0x40}) 1m45.857265719s ago: executing program 2 (id=1792): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/mac80211_hwsim/hwsim1/net/wlan1/statistics/rx_crc_errors\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000100)=""/4096, 0x1000) setsockopt$auto_SO_CNX_ADVICE(r0, 0xfff, 0x35, &(0x7f0000001500)='\x00', 0x9) mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x401, 0x8000) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001180), r1) sendmsg$auto_NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001340)={0x18, r3, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_FILS_CACHE_ID={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000005}, 0x40011) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r4 = socket(0x1e, 0x1, 0x0) r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001580), r0) r6 = getpid() process_vm_readv$auto(r6, 0x0, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) statx$auto(0xffffffffffffff9c, &(0x7f0000001240)=':,\x00', 0x0, 0x9000000, &(0x7f0000001280)={0x4, 0xac, 0xfffffffffffffffb, 0x1, 0xee00, 0x0, 0x7, 0x100, 0xa, 0x5, 0x2, 0x0, {0x4, 0x7}, {0x3, 0x3274925}, {0x1, 0x4}, {0x180000000000000, 0x400}, 0x10001, 0x2, 0x8, 0x727, 0x33, 0x8, 0xfffffffd, 0xfffffffffffffffd, 0xfffffffe, 0x4, 0x3, 0x565, [0x5, 0xa71d, 0x7df5, 0x6, 0x9, 0x0, 0x8000, 0x6, 0x81]}) wait4$auto(0x0, &(0x7f0000001380)=0x7, 0x6, &(0x7f00000013c0)={{0xc000000, 0x4}, {0x48, 0x7}, 0x55f, 0xa4ac, 0x12, 0x1, 0x2, 0x1, 0x100, 0x9, 0x45, 0x7, 0x6, 0xfffffffffffffeff, 0x81, 0x1b}) shmctl$auto_IPC_INFO(0x2, 0x3, 0x0) sendmsg$auto_ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001d80)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001d40)={&(0x7f00000015c0)={0x424, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [@nested={0x4, 0x157}, @nested={0x4, 0x8c}, @typed={0x8, 0xdd, 0x0, 0x0, @u32=0x2}, @nested={0x20, 0x5b, 0x0, 0x1, [@typed={0x8, 0x5e, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8, 0x11c, 0x0, 0x0, @fd=r1}, @typed={0xc, 0xc9, 0x0, 0x0, @u64=0xcb8}, @generic]}, @typed={0x4, 0xa8}, @generic]}, @ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_PHY_INDEX={0x8, 0x4, 0xfffffffe}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x3c7, 0x2, 0x0, 0x1, [@nested={0x95, 0x4d, 0x0, 0x1, [@typed={0x8, 0xcd, 0x0, 0x0, @uid=0xee00}, @generic="35e778354a4cbbe66767af46447c2a916be188961f60217bca921fb75729764a6c7c3c120f4d577e9ef3d031944d9c536edb68f32c9ffe8b406f97b09c0a3c210ab31952e376889c028b0295537be8b7696fb76083a2a1994cbfc50516f0434c90dca8ab94bd1b8fb9087388090224ffade4e1d4361349d2a9c05b02ae9d12f990d878ec8207ea419f"]}, @generic="55d67aa9eb50baa8b549389e99869b7ccf334d1f0593450b7551ef04576384c88763ebbe06254ae6fc75", @nested={0x274, 0x92, 0x0, 0x1, [@typed={0x101, 0x156, 0x0, 0x0, @binary="fbcedf7ca35d0089dd7fb7204664dc05d1bb98ada40bc7a43d16e21978dc0a916d0dce92db81c59c59e12a65101486ec47c4e78664b3c8e43aafd586ec8c9c045d0adab9cde9ba5725ac36bdd7514a261c5fe31923799b37be356a343440ac95088fafa187273a7494c78b3d345152afc103949ff9019e6c1dc81181b631c1352ae7565a8c27e68cc32ca3e10ed3618d48574dd6615f82be8139d3d5db83be4efabe890962a93bbd924d5e77ad7f6a029a9bf9181df414b1611abc175f452c8433b93dc7f93641ef3d47500954fee4ccb5d84ea3ef8aebc198a711623949ed7ec9110889f559034df0deaf0fe8a87412d8e765b8f67c61b7c6b5709e42"}, @nested={0x4, 0x22}, @generic="97068e7d5cad19da5fb2a0d6c5dc42c5359eee09e3f7dd215547d2e5ef6b011eee641e2bedad396d9182e5a88934df667f3adc8ba9d6d60f7a42d5d0afd2e7490eee1ed6f428d3cb1325bb0b2a78e24cf3549c36a298a80a0e056de075d7489d642a57dfdd3b0330a2e4428582baddc22ed661f0defa944000851fe9a1414066a8ae6031a216728e4d3b09701f0b9f3e4215df76adf7dc2a15de3991fc4c26f03b8a0dcdd661e1482e8dc4e1ac1300ed466b8ec79917a934834912b7c6548150df9e859cb3509639cc", @generic="cbf10c685484165bf14589d7ab869dbd02a585daca2674a5c6a484130cc079e8b133e75558f3ad1d7802c8252112c9630eb13c5a8aa557f995d2eb2e5a64d9aa5c45496c4340f2df3704636313fd4b277242ab751255a3814fef6c2e105a9f366ab8f26409ad6b4376d4a9aefa9d46a60ac80177c9e31814aed29fcdb7895d4bc2f0bf", @typed={0x8, 0x15a, 0x0, 0x0, @fd=r0}, @generic, @typed={0x14, 0xd8, 0x0, 0x0, @ipv6=@loopback}]}, @typed={0x8, 0x121, 0x0, 0x0, @fd=r4}, @generic="48932c880e4a69a2b993548a860cb8d041b8cfb5941b0bd7f25a6fd03e299ee697f5cc93236f2d", @generic="e67e66be2b", @generic="50800a78bd77ec33e28a7c42d257e4ef70059c3f2bbd4a1af7d79c914232a119552bbe460eda5ee650aa17e9592f3e3a1f7b9bbbf3c095851139de2855dcb69b7136fcd4ad5ebe64dbf897f79a68845e056ab4c048de94af8f"]}]}, 0x424}, 0x1, 0x0, 0x0, 0x20000800}, 0x1000) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vbi0\x00', 0x80382, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) 1m44.808024486s ago: executing program 2 (id=1796): mmap$auto(0x0, 0x9d90, 0xdf, 0xeb1, 0x401, 0x8000) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x20000008000) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_MACSEC_CMD_ADD_RXSC(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB="01002900fedbdf25010000007d60e58b5c4798b9d08a5588c64b390c00028008000100030000000800010085f7eb277110780162e6b6368f99d89dc8bf40dec2b71a4245d2f5c97fbb2165ad9e707d3e77cdabbb08eccf5849b5894c37ea3a2ea51a354ff9d28e04823134ad98eb256532fe9434ce24bbbcfd8727bf261ca369119eede1781ce46a5638291a1aed81666f240579165d369587740cb037d22123ac69338bdb4b03dfd1ce43b29a9b1834ee2251c0962748a1bc80fab66f8cb6d625cdfb7e622a99cc26c6be642c79cb2dc0037f99579b8a8e72bc714ed831b4b283eedc039ae176d15166e4dc938bbf89fcafef258a771ed52f6ed847138cddb4b48d94a7b98276a15055b1a2e5c90bddf300000000000000000000000000000089b7143492d84740e79755fde74e210c7845b0318f82ca84a5f2f7e22cd5529dc6c9c79d8eea6ebc8a044d9a7706745aa4aa49ca62c47ab17b1534aedbd63b7667713a9851dae03334472ff6", @ANYRES32=0x0, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x20040801}, 0x8040840) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/system/node/node1/compact\x00', 0xc2481, 0x0) r3 = open(&(0x7f0000000000)='./file0\x00', 0x4242, 0xe1d2b27bdc14aabc) fallocate$auto(r3, 0x0, 0x7, 0x4cbd5d) utime$auto(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0) open$dir(&(0x7f00000001c0)='./file0\x00', 0x201, 0x14) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/arp_tables_names\x00', 0x40, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000040)={0x0, 0xfffffffd}, 0x6, 0x8, 0x5) writev$auto(r2, &(0x7f0000000080)={0x0, 0x1000}, 0x3) mmap$auto(0x0, 0x4005, 0x2, 0x40eb2, 0x401, 0x300000000000) r4 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(r4, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) setxattrat$auto(0xffffffffffffffff, 0x0, 0x1004, 0x0, 0x0, 0xc000000000000000) setrlimit$auto(0x7, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x8000, 0x100) mmap$auto(0x2, 0x9, 0xe3, 0x111, 0x40000000000a1, 0x8000) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000140), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xc048aeca, 0x0) 1m44.143294554s ago: executing program 2 (id=1801): mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x80000001) r0 = gettid() kcmp$auto_KCMP_EPOLL_TFD(r0, r0, 0x7, 0xffffffffffffffff, 0x9) r1 = socket(0x1d, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'vlan0\x00'}) madvise$auto_MADV_GUARD_INSTALL(0x0, 0x2021000, 0x66) 1m43.900507969s ago: executing program 2 (id=1803): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_NFSD_CMD_LISTENER_SET(r0, &(0x7f0000005380)={0x0, 0x0, &(0x7f0000005340)={&(0x7f0000000000)={0x14, r1, 0x1, 0x870bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x20000000) 1m28.759845545s ago: executing program 34 (id=1803): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_NFSD_CMD_LISTENER_SET(r0, &(0x7f0000005380)={0x0, 0x0, &(0x7f0000005340)={&(0x7f0000000000)={0x14, r1, 0x1, 0x870bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x20000000) 1m3.793304775s ago: executing program 5 (id=1954): mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) sendmsg$auto_NL80211_CMD_GET_SCAN(0xffffffffffffffff, 0x0, 0x0) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000826bd7000fedbdf250300000008000400b70a0000060007000080000008000200", @ANYRES32, @ANYBLOB="0a0005000180c200000e00000a0001000180c200000e00000a000100000000000000000008000200", @ANYRES32, @ANYBLOB="060006ff05000000080003009b"], 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) mprotect$auto(0x200000000000, 0x806122, 0xc) sched_setscheduler$auto(0x0, 0x5, &(0x7f0000000040)={0x2}) r0 = socket(0x15, 0x5, 0x0) ustat$auto(0x801, 0x0) readv$auto(r0, 0x0, 0x8) socket(0x2, 0x3, 0x100) r1 = openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy0/aqm\x00', 0x82, 0x0) write$auto_debugfs_full_proxy_file_operations_internal(r1, 0x0, 0x20) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) 1m2.658974552s ago: executing program 5 (id=1959): mmap$auto(0x0, 0x40009, 0x2, 0x9b72, 0x7, 0x28000) (async) mmap$auto(0x0, 0x40009, 0x2, 0x9b72, 0x7, 0x28000) capset$auto(&(0x7f0000000100)={0x20080522}, 0x0) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty48\x00', 0x40000, 0x0) ioctl$auto_TIOCSWINSZ2(r0, 0x4b44, 0x0) 1m2.338296658s ago: executing program 5 (id=1961): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/mac80211_hwsim/hwsim1/net/wlan1/statistics/rx_crc_errors\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000100)=""/4096, 0x1000) setsockopt$auto_SO_CNX_ADVICE(r0, 0xfff, 0x35, &(0x7f0000001500)='\x00', 0x9) mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x401, 0x8000) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001180), r1) sendmsg$auto_NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001340)={0x18, r3, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_FILS_CACHE_ID={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000005}, 0x40011) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r4 = socket(0x1e, 0x1, 0x0) r5 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001580), r0) r6 = getpid() process_vm_readv$auto(r6, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) statx$auto(0xffffffffffffff9c, 0x0, 0x0, 0x9000000, &(0x7f0000001280)={0x4, 0xac, 0xfffffffffffffffb, 0x1, 0xee00, 0x0, 0x7, 0x100, 0xa, 0x5, 0x2, 0x0, {0x4, 0x7}, {0x3, 0x3274925}, {0x1, 0x4}, {0x180000000000000, 0x400}, 0x10001, 0x2, 0x8, 0x727, 0x33, 0x8, 0xfffffffd, 0xfffffffffffffffd, 0xfffffffe, 0x4, 0x3, 0x565, [0x5, 0xa71d, 0x7df5, 0x6, 0x9, 0x0, 0x8000, 0x6, 0x81]}) wait4$auto(0x0, &(0x7f0000001380)=0x7, 0x6, &(0x7f00000013c0)={{0xc000000, 0x4}, {0x48, 0x7}, 0x55f, 0xa4ac, 0x12, 0x1, 0x2, 0x1, 0x100, 0x9, 0x45, 0x7, 0x6, 0xfffffffffffffeff, 0x81, 0x1b}) shmctl$auto_IPC_INFO(0x2, 0x3, 0x0) sendmsg$auto_ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001d80)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001d40)={&(0x7f00000015c0)={0x424, r5, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [@nested={0x4, 0x157}, @nested={0x4, 0x8c}, @typed={0x8, 0xdd, 0x0, 0x0, @u32=0x2}, @nested={0x20, 0x5b, 0x0, 0x1, [@typed={0x8, 0x5e, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8, 0x11c, 0x0, 0x0, @fd=r1}, @typed={0xc, 0xc9, 0x0, 0x0, @u64=0xcb8}, @generic]}, @typed={0x4, 0xa8}, @generic]}, @ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_PHY_INDEX={0x8, 0x4, 0xfffffffe}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x3c7, 0x2, 0x0, 0x1, [@nested={0x95, 0x4d, 0x0, 0x1, [@typed={0x8, 0xcd, 0x0, 0x0, @uid=0xee00}, @generic="35e778354a4cbbe66767af46447c2a916be188961f60217bca921fb75729764a6c7c3c120f4d577e9ef3d031944d9c536edb68f32c9ffe8b406f97b09c0a3c210ab31952e376889c028b0295537be8b7696fb76083a2a1994cbfc50516f0434c90dca8ab94bd1b8fb9087388090224ffade4e1d4361349d2a9c05b02ae9d12f990d878ec8207ea419f"]}, @generic="55d67aa9eb50baa8b549389e99869b7ccf334d1f0593450b7551ef04576384c88763ebbe06254ae6fc75", @nested={0x274, 0x92, 0x0, 0x1, [@typed={0x101, 0x156, 0x0, 0x0, @binary="fbcedf7ca35d0089dd7fb7204664dc05d1bb98ada40bc7a43d16e21978dc0a916d0dce92db81c59c59e12a65101486ec47c4e78664b3c8e43aafd586ec8c9c045d0adab9cde9ba5725ac36bdd7514a261c5fe31923799b37be356a343440ac95088fafa187273a7494c78b3d345152afc103949ff9019e6c1dc81181b631c1352ae7565a8c27e68cc32ca3e10ed3618d48574dd6615f82be8139d3d5db83be4efabe890962a93bbd924d5e77ad7f6a029a9bf9181df414b1611abc175f452c8433b93dc7f93641ef3d47500954fee4ccb5d84ea3ef8aebc198a711623949ed7ec9110889f559034df0deaf0fe8a87412d8e765b8f67c61b7c6b5709e42"}, @nested={0x4, 0x22}, @generic="97068e7d5cad19da5fb2a0d6c5dc42c5359eee09e3f7dd215547d2e5ef6b011eee641e2bedad396d9182e5a88934df667f3adc8ba9d6d60f7a42d5d0afd2e7490eee1ed6f428d3cb1325bb0b2a78e24cf3549c36a298a80a0e056de075d7489d642a57dfdd3b0330a2e4428582baddc22ed661f0defa944000851fe9a1414066a8ae6031a216728e4d3b09701f0b9f3e4215df76adf7dc2a15de3991fc4c26f03b8a0dcdd661e1482e8dc4e1ac1300ed466b8ec79917a934834912b7c6548150df9e859cb3509639cc", @generic="cbf10c685484165bf14589d7ab869dbd02a585daca2674a5c6a484130cc079e8b133e75558f3ad1d7802c8252112c9630eb13c5a8aa557f995d2eb2e5a64d9aa5c45496c4340f2df3704636313fd4b277242ab751255a3814fef6c2e105a9f366ab8f26409ad6b4376d4a9aefa9d46a60ac80177c9e31814aed29fcdb7895d4bc2f0bf", @typed={0x8, 0x15a, 0x0, 0x0, @fd=r0}, @generic, @typed={0x14, 0xd8, 0x0, 0x0, @ipv6=@loopback}]}, @typed={0x8, 0x121, 0x0, 0x0, @fd=r4}, @generic="48932c880e4a69a2b993548a860cb8d041b8cfb5941b0bd7f25a6fd03e299ee697f5cc93236f2d", @generic="e67e66be2b", @generic="50800a78bd77ec33e28a7c42d257e4ef70059c3f2bbd4a1af7d79c914232a119552bbe460eda5ee650aa17e9592f3e3a1f7b9bbbf3c095851139de2855dcb69b7136fcd4ad5ebe64dbf897f79a68845e056ab4c048de94af8f"]}]}, 0x424}, 0x1, 0x0, 0x0, 0x20000800}, 0x1000) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vbi0\x00', 0x80382, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) 1m1.261915403s ago: executing program 5 (id=1968): mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x20000008000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000000), 0x123002, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0x8000ffff}, 0x3) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) socket(0x10, 0x2, 0x4) socket(0x10, 0x3, 0x6) mmap$auto(0x2, 0xfffffffffffffffd, 0x400, 0x1d, 0xffffffffffffffff, 0x8000) connect$auto(0x3, 0x0, 0x55) r0 = socket(0xa, 0x2, 0x8) socketpair$auto(0x21, 0x4, 0x41ab, 0x0) write$auto(0xffffffffffffffff, 0x0, 0x5c8) write$auto(0xffffffffffffffff, 0x0, 0x8000000000b) close_range$auto(r0, 0xfffffffffffff000, 0x4000000000002) close_range$auto(r0, 0x8, 0xe84) unshare$auto(0x40000080) io_uring_setup$auto(0x5, 0x0) mknod$auto(&(0x7f0000000580)='u[,&*}\x00\a\x00\x00\x00?\xa4\x1fN\xa1~5Z\xc7\r\f}M4\xa8m\xe6\x19[11\xab\xff-E\xac9(\xb4O\xa0t4h\x9f-gn\x1f\x01\x00\x00\x00\x00\x00\x00\x00\xaeR\x81\r_\x0e\x19\b\x85\bvv(e\xdax)\t\x15\xf6\xc8\xee\x04\x16\xc1\x9a!\x87I7\x8cD&zg\xb0a\xab|E\xde\x14\xee[\xc8\xc0\xa8Nh\x0f\xa3\xdbT\xb3\xb8\xd2F\xa0\xc4]\xaf\xc43&\xe4\x01\x05\xd2\x15\xf8\xf1!\x9d\x92\xbbH\xd3^aD\x87\xd8\xe7\xd2\xf3[r\xc5S&}D[\x97\xf1\xd9\xf8Y\x1c\x03\x84\xb4\xd7\x16\x19\xe5\x17\x10\xd8fcG:\xfbY8\x17w\x98?\x03@\xe5\x02\x05\x93h\xb9\xf7\xef\x84\x8aGlN\a\x1e\x00\x00\x00\x00\x00\x00\x00\xf1p\xeb\xe9(%\x89\xef\x85\xdfr\xce\x00\x00\x00\x00\xff\x00\xa2M\'d\x12\x1c\x12\xca\xa5_\x8d\xdf\xc5\x8d\x19?\xfc~\xb3X\x14\xa7\xa9M\x87\xfcTW\x1bR\xbci\x8d\x8aNEO\xb3~~\xa8\xa6\x894\x80;s\xb7\xa3V\x1b\x14|\x9e\xd4\x05\x85\x0f!\xab-E\'\x97Y\xb7\xe8fMv_\xf8\xa0S\xef\xb7\b\xe7!T.g\x92\x87\t$\x06\xa4\xfb\x83\x8c\x17^\x82\xe7\xd3\xf6q\x1a\xa0\xf82[W\x90\xdd\xe3\xde\xa9\xde\x94`-\x9a\x1e}\xebO*\xb85,v.\xfc5\xba?vlt\xda%\x06a\x15I\x1f\xe3\x05+\x810T2\xf9\x9b\xc7\xd1\t\x03\xf2\x8d\x8a\x90\xb54\bH<9\xf1\x91 D\x85g,\xaa\xca\xcd\xd5\xcb\x9a\xb1j\xf2F\xce\x14\x92\xf9\xd7\xec\xc5\x1e\x8aq2\xce\x881f\xd7\xd4\x9e\xf6\xb6P\x01\xe8T\xb5X\xb9d-I\xd6\x91\xc3\xe2\x88S\x82l=\x02t$p\t\x8cY\x06\r\x83\xb0\x86\xc6\x84\x1c\xce\xb6\xf0\xdfC\x9fj<\xfe\xa4\x1f\x82L\xe4\x13+H\x00\x00\x00\x00\x00\x00\x00\x01M\x16\xa0\xbeB6\xfb\xa2-\x17\x93Q\x9fKusl5\xa2$M\xb4\x18\x1db\xf3\xce\x8c\xe5Rna\xd5\xbbQ\xc7\xa7+\vH\xc1l\x1bIv\xe8_', 0x1081, 0x9) acct$auto(&(0x7f0000000480)='u[,&*}\x00\a\x00\'\x00?\xa4\x1fN\xa1~5Z\xc7\r\f}M4\xa8m\xe6\x19[11\xab\xff-E\xac9(\xb4O\xa0t4h\x9f-gn\x1f\x0f\x18\xc5\x82-s\x83\xe6\xaeR\x81\r_\x0e\x19\x12\x85\bvf(e\xday)\t\x15\xf6\xc8\xee\x04\x16\xc1\x9a!\x87I7\x8cD&zg\xb0a\xab|E\xde\x14\xee[\xc8\xc0\xa8Nh\x0f\xa3\xdbT\xb3\xb8\xd2F\xa0\xc4]\xaf\xc43&\xe4\x01\x05\xd2\x15\xf8\xf1!\x9d\x92\xbbHL9aD\xb4\x80\xed\xba>\"\xb6\x7f\xa3f\x1d\a\xa1\x87\x84uA\xd8\xe7\xd2\xf3[r\xc5S&}D[\x97\xf1\xd9\xf8Y\x03\x84\xb4\xd7\x16\x19\xe5\x17\x10\xd8fcG:\xfbY8\x17w\x98?\x03@\xe5\x02\x05\x93h\xb9\xf7\xef\x84\x8aGlN\a\x1e') open(&(0x7f0000000480)='./cgroup.cpu/cgroup.procs\x00', 0x880c2, 0xb3) acct$auto(&(0x7f0000000280)='/sys/devices/virtual/mtd/mtd0/size\x00') timer_settime$auto(0xde66, 0xffff8000, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) 59.518872018s ago: executing program 5 (id=1976): mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0xa, 0x801, 0x84) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) utime$auto(&(0x7f0000000380)='}[,&*}\x00', 0x0) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8001) mount$auto(0x0, &(0x7f00000000c0)='}[,&*}\x00', &(0x7f0000000140)='nfsd\x00', 0xf, 0x0) chdir$auto(&(0x7f0000000000)='}[,&*}\x00') r1 = open(&(0x7f0000000100)='.\x00', 0x0, 0x0) getdents$auto(r1, 0x0, 0x62d4) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x0, 0xfffff004, 0x2) socket(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0xa, 0x2, 0x88) r3 = socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x1, 0x84) openat$auto_ecryptfs_miscdev_fops_miscdev(0xffffffffffffff9c, &(0x7f000000e680), 0x68182, 0x0) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nbd9\x00', 0x343e42, 0x0) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x40401, 0x0) ioctl$auto_TIOCSETD2(r4, 0x5423, 0x0) ioctl$auto_TCFLSH2(r4, 0x400455c8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r6, r5, 0x8, 0x7f, r2, @relative_fd, 0x4}, 0xf) bpf$auto(0x2, &(0x7f00000001c0)=@raw_tracepoint={0x5, 0xffffffffffffffff, 0x0, 0x1}, 0x4) getsockopt$auto(r0, 0x84, 0x6d, 0x0, 0x0) 59.127721143s ago: executing program 5 (id=1977): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) openat$auto_proc_mounts_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/mounts\x00', 0x105442, 0x0) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000100)=""/4096, 0x1000) setsockopt$auto_SO_CNX_ADVICE(r0, 0xfff, 0x35, &(0x7f0000001500)='\x00', 0x9) mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x401, 0x8000) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001180), r1) sendmsg$auto_NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001340)={0x18, r2, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_FILS_CACHE_ID={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000005}, 0x40011) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) close_range$auto(0x0, 0xfffffffffffff001, 0x2) r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001580), r0) getpid() statx$auto(0xffffffffffffff9c, &(0x7f0000001240)=':,\x00', 0x0, 0x9000000, &(0x7f0000001280)={0x4, 0xac, 0xfffffffffffffffb, 0x1, 0xee00, 0x0, 0x7, 0x100, 0xa, 0x5, 0x2, 0x0, {0x4, 0x7}, {0x3, 0x3274925}, {0x1, 0x4}, {0x180000000000000, 0x400}, 0x10001, 0x2, 0x8, 0x727, 0x33, 0x8, 0xfffffffd, 0xfffffffffffffffd, 0xfffffffe, 0x4, 0x3, 0x565, [0x5, 0xa71d, 0x7df5, 0x6, 0x9, 0x0, 0x8000, 0x6, 0x81]}) wait4$auto(0x0, &(0x7f0000001380)=0x7, 0x6, &(0x7f00000013c0)={{0xc000000, 0x4}, {0x48, 0x7}, 0x55f, 0xa4ac, 0x12, 0x1, 0x2, 0x1, 0x100, 0x9, 0x45, 0x7, 0x6, 0xfffffffffffffeff, 0x81, 0x1b}) shmctl$auto_IPC_INFO(0x2, 0x3, 0x0) sendmsg$auto_ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001d40)={&(0x7f00000015c0)={0x424, r3, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [@nested={0x4, 0x157}, @nested={0x4, 0x8c}, @typed={0x8, 0xdd, 0x0, 0x0, @u32=0x2}, @nested={0x20, 0x5b, 0x0, 0x1, [@typed={0x8, 0x5e, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8, 0x11c, 0x0, 0x0, @fd=r1}, @typed={0xc, 0xc9, 0x0, 0x0, @u64=0xcb8}, @generic]}, @typed={0x4, 0xa8}, @generic]}, @ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_PHY_INDEX={0x8, 0x4, 0xfffffffe}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x3c7, 0x2, 0x0, 0x1, [@nested={0x95, 0x4d, 0x0, 0x1, [@typed={0x8, 0xcd, 0x0, 0x0, @uid=0xee00}, @generic="35e778354a4cbbe66767af46447c2a916be188961f60217bca921fb75729764a6c7c3c120f4d577e9ef3d031944d9c536edb68f32c9ffe8b406f97b09c0a3c210ab31952e376889c028b0295537be8b7696fb76083a2a1994cbfc50516f0434c90dca8ab94bd1b8fb9087388090224ffade4e1d4361349d2a9c05b02ae9d12f990d878ec8207ea419f"]}, @generic="55d67aa9eb50baa8b549389e99869b7ccf334d1f0593450b7551ef04576384c88763ebbe06254ae6fc75", @nested={0x274, 0x92, 0x0, 0x1, [@typed={0x101, 0x156, 0x0, 0x0, @binary="fbcedf7ca35d0089dd7fb7204664dc05d1bb98ada40bc7a43d16e21978dc0a916d0dce92db81c59c59e12a65101486ec47c4e78664b3c8e43aafd586ec8c9c045d0adab9cde9ba5725ac36bdd7514a261c5fe31923799b37be356a343440ac95088fafa187273a7494c78b3d345152afc103949ff9019e6c1dc81181b631c1352ae7565a8c27e68cc32ca3e10ed3618d48574dd6615f82be8139d3d5db83be4efabe890962a93bbd924d5e77ad7f6a029a9bf9181df414b1611abc175f452c8433b93dc7f93641ef3d47500954fee4ccb5d84ea3ef8aebc198a711623949ed7ec9110889f559034df0deaf0fe8a87412d8e765b8f67c61b7c6b5709e42"}, @nested={0x4, 0x22}, @generic="97068e7d5cad19da5fb2a0d6c5dc42c5359eee09e3f7dd215547d2e5ef6b011eee641e2bedad396d9182e5a88934df667f3adc8ba9d6d60f7a42d5d0afd2e7490eee1ed6f428d3cb1325bb0b2a78e24cf3549c36a298a80a0e056de075d7489d642a57dfdd3b0330a2e4428582baddc22ed661f0defa944000851fe9a1414066a8ae6031a216728e4d3b09701f0b9f3e4215df76adf7dc2a15de3991fc4c26f03b8a0dcdd661e1482e8dc4e1ac1300ed466b8ec79917a934834912b7c6548150df9e859cb3509639cc", @generic="cbf10c685484165bf14589d7ab869dbd02a585daca2674a5c6a484130cc079e8b133e75558f3ad1d7802c8252112c9630eb13c5a8aa557f995d2eb2e5a64d9aa5c45496c4340f2df3704636313fd4b277242ab751255a3814fef6c2e105a9f366ab8f26409ad6b4376d4a9aefa9d46a60ac80177c9e31814aed29fcdb7895d4bc2f0bf", @typed={0x8, 0x15a, 0x0, 0x0, @fd=r0}, @generic, @typed={0x14, 0xd8, 0x0, 0x0, @ipv6=@loopback}]}, @typed={0x8, 0x121, 0x0, 0x0, @fd}, @generic="48932c880e4a69a2b993548a860cb8d041b8cfb5941b0bd7f25a6fd03e299ee697f5cc93236f2d", @generic="e67e66be2b", @generic="50800a78bd77ec33e28a7c42d257e4ef70059c3f2bbd4a1af7d79c914232a119552bbe460eda5ee650aa17e9592f3e3a1f7b9bbbf3c095851139de2855dcb69b7136fcd4ad5ebe64dbf897f79a68845e056ab4c048de94af8f"]}]}, 0x424}, 0x1, 0x0, 0x0, 0x20000800}, 0x1000) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vbi0\x00', 0x80382, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) 43.946511372s ago: executing program 35 (id=1977): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) openat$auto_proc_mounts_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/mounts\x00', 0x105442, 0x0) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000000100)=""/4096, 0x1000) setsockopt$auto_SO_CNX_ADVICE(r0, 0xfff, 0x35, &(0x7f0000001500)='\x00', 0x9) mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x401, 0x8000) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001180), r1) sendmsg$auto_NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001340)={0x18, r2, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_FILS_CACHE_ID={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000005}, 0x40011) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) close_range$auto(0x0, 0xfffffffffffff001, 0x2) r3 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001580), r0) getpid() statx$auto(0xffffffffffffff9c, &(0x7f0000001240)=':,\x00', 0x0, 0x9000000, &(0x7f0000001280)={0x4, 0xac, 0xfffffffffffffffb, 0x1, 0xee00, 0x0, 0x7, 0x100, 0xa, 0x5, 0x2, 0x0, {0x4, 0x7}, {0x3, 0x3274925}, {0x1, 0x4}, {0x180000000000000, 0x400}, 0x10001, 0x2, 0x8, 0x727, 0x33, 0x8, 0xfffffffd, 0xfffffffffffffffd, 0xfffffffe, 0x4, 0x3, 0x565, [0x5, 0xa71d, 0x7df5, 0x6, 0x9, 0x0, 0x8000, 0x6, 0x81]}) wait4$auto(0x0, &(0x7f0000001380)=0x7, 0x6, &(0x7f00000013c0)={{0xc000000, 0x4}, {0x48, 0x7}, 0x55f, 0xa4ac, 0x12, 0x1, 0x2, 0x1, 0x100, 0x9, 0x45, 0x7, 0x6, 0xfffffffffffffeff, 0x81, 0x1b}) shmctl$auto_IPC_INFO(0x2, 0x3, 0x0) sendmsg$auto_ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001d40)={&(0x7f00000015c0)={0x424, r3, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [@nested={0x4, 0x157}, @nested={0x4, 0x8c}, @typed={0x8, 0xdd, 0x0, 0x0, @u32=0x2}, @nested={0x20, 0x5b, 0x0, 0x1, [@typed={0x8, 0x5e, 0x0, 0x0, @pid=0xffffffffffffffff}, @typed={0x8, 0x11c, 0x0, 0x0, @fd=r1}, @typed={0xc, 0xc9, 0x0, 0x0, @u64=0xcb8}, @generic]}, @typed={0x4, 0xa8}, @generic]}, @ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_PHY_INDEX={0x8, 0x4, 0xfffffffe}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x3c7, 0x2, 0x0, 0x1, [@nested={0x95, 0x4d, 0x0, 0x1, [@typed={0x8, 0xcd, 0x0, 0x0, @uid=0xee00}, @generic="35e778354a4cbbe66767af46447c2a916be188961f60217bca921fb75729764a6c7c3c120f4d577e9ef3d031944d9c536edb68f32c9ffe8b406f97b09c0a3c210ab31952e376889c028b0295537be8b7696fb76083a2a1994cbfc50516f0434c90dca8ab94bd1b8fb9087388090224ffade4e1d4361349d2a9c05b02ae9d12f990d878ec8207ea419f"]}, @generic="55d67aa9eb50baa8b549389e99869b7ccf334d1f0593450b7551ef04576384c88763ebbe06254ae6fc75", @nested={0x274, 0x92, 0x0, 0x1, [@typed={0x101, 0x156, 0x0, 0x0, @binary="fbcedf7ca35d0089dd7fb7204664dc05d1bb98ada40bc7a43d16e21978dc0a916d0dce92db81c59c59e12a65101486ec47c4e78664b3c8e43aafd586ec8c9c045d0adab9cde9ba5725ac36bdd7514a261c5fe31923799b37be356a343440ac95088fafa187273a7494c78b3d345152afc103949ff9019e6c1dc81181b631c1352ae7565a8c27e68cc32ca3e10ed3618d48574dd6615f82be8139d3d5db83be4efabe890962a93bbd924d5e77ad7f6a029a9bf9181df414b1611abc175f452c8433b93dc7f93641ef3d47500954fee4ccb5d84ea3ef8aebc198a711623949ed7ec9110889f559034df0deaf0fe8a87412d8e765b8f67c61b7c6b5709e42"}, @nested={0x4, 0x22}, @generic="97068e7d5cad19da5fb2a0d6c5dc42c5359eee09e3f7dd215547d2e5ef6b011eee641e2bedad396d9182e5a88934df667f3adc8ba9d6d60f7a42d5d0afd2e7490eee1ed6f428d3cb1325bb0b2a78e24cf3549c36a298a80a0e056de075d7489d642a57dfdd3b0330a2e4428582baddc22ed661f0defa944000851fe9a1414066a8ae6031a216728e4d3b09701f0b9f3e4215df76adf7dc2a15de3991fc4c26f03b8a0dcdd661e1482e8dc4e1ac1300ed466b8ec79917a934834912b7c6548150df9e859cb3509639cc", @generic="cbf10c685484165bf14589d7ab869dbd02a585daca2674a5c6a484130cc079e8b133e75558f3ad1d7802c8252112c9630eb13c5a8aa557f995d2eb2e5a64d9aa5c45496c4340f2df3704636313fd4b277242ab751255a3814fef6c2e105a9f366ab8f26409ad6b4376d4a9aefa9d46a60ac80177c9e31814aed29fcdb7895d4bc2f0bf", @typed={0x8, 0x15a, 0x0, 0x0, @fd=r0}, @generic, @typed={0x14, 0xd8, 0x0, 0x0, @ipv6=@loopback}]}, @typed={0x8, 0x121, 0x0, 0x0, @fd}, @generic="48932c880e4a69a2b993548a860cb8d041b8cfb5941b0bd7f25a6fd03e299ee697f5cc93236f2d", @generic="e67e66be2b", @generic="50800a78bd77ec33e28a7c42d257e4ef70059c3f2bbd4a1af7d79c914232a119552bbe460eda5ee650aa17e9592f3e3a1f7b9bbbf3c095851139de2855dcb69b7136fcd4ad5ebe64dbf897f79a68845e056ab4c048de94af8f"]}]}, 0x424}, 0x1, 0x0, 0x0, 0x20000800}, 0x1000) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vbi0\x00', 0x80382, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) 27.326974211s ago: executing program 0 (id=2094): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) select$auto(0xa, 0x0, 0x0, 0x0, 0x0) openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mtd0\x00', 0x28082, 0x0) mmap$auto(0x0, 0x4, 0x1ff, 0x40eb1, 0x401, 0x300000000001) r0 = socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x30009, 0x4000000000df, 0x4000eb1, 0x401, 0x8000) unshare$auto(0x40000080) close_range$auto(0x2, 0x8, 0x0) semctl$auto(0xa, 0x2, 0x13, 0xde) r1 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyr0\x00', 0x602c81, 0x0) write$auto_tty_fops_tty_io(r2, &(0x7f0000000680)="1f9319c707498de36a6eedfcfaa139bb5f55cf18b4ee56510d", 0x19) setsockopt$auto(0x3, 0x1, 0x4c, 0x0, 0x9) ioctl$auto_I2C_SMBUS(r1, 0x720, &(0x7f0000000080)) recvmmsg$auto(0x3, 0x0, 0x80000401, 0x4000, 0x0) write$auto(r0, 0x0, 0x45c6) r3 = socket(0x11, 0xa, 0x9) bind$auto(r3, 0x0, 0x9) getpid() sendmsg$auto_OVS_FLOW_CMD_SET(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x10) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) openat$auto_generic(0xffffffffffffff9c, &(0x7f0000000000)='/proc/kpagecount\x00', 0x0, 0x0) readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x1000}, 0x100000007) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) write$auto(0xffffffffffffffff, 0x0, 0x0) openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000000080)='/dev/binderfs/binder1\x00', 0x80001, 0x0) 26.164776561s ago: executing program 0 (id=2097): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x5c, r1, 0x1, 0x70bd29, 0x25dfdc00, {0x1, 0x0, 0x3f00}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x59}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x9}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @mcast1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44000}, 0x90) mmap$auto(0x0, 0x2020009, 0x3, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0xfffffffffffffffe, 0x3, 0xdf, 0x80000000000eb1, 0x3, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty1\x00', 0x40, 0x0) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/mountinfo\x00', 0x28c40, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptyr0\x00', 0x6a500, 0x0) socket(0x15, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) pipe2$auto(0x0, 0x0) io_uring_setup$auto(0x7, 0x0) socketpair$auto(0x1, 0x5, 0x100000, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ptyd8\x00', 0x480, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ptyde\x00', 0xa0102, 0x0) ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0) mmap$auto(0x0, 0x2020009, 0x203, 0xeb1, 0xfffffffffffffffa, 0x8000) ioctl$auto(0x3, 0x80000541b, r2) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000001a80)='/dev/bus/usb/031/001\x00', 0x208000, 0x0) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/security/tomoyo/profile\x00', 0xc0802, 0x0) read$auto(0x3, 0x0, 0x8080) socket(0x10, 0x2, 0x0) memfd_secret$auto(0x0) socket$nl_generic(0x10, 0x3, 0x10) clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2) open(0x0, 0x109082, 0x0) 25.925348796s ago: executing program 0 (id=2099): mmap$auto(0x0, 0x402200d, 0xdf, 0xeb1, 0x401, 0x8000) sendmsg$auto_NETDEV_CMD_PAGE_POOL_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES32=0x0, @ANYRESHEX=0x0], 0x2c}, 0x1, 0x0, 0x0, 0x20008810}, 0x80c5) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) r0 = socket(0x18, 0x1, 0x100) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES32=0x0, @ANYBLOB="0a00050000000000000000000a00010000000000000000000a0001000000000000000000060007000100000008000200", @ANYRES32=0x0, @ANYBLOB="0c001a"], 0x68}, 0x1, 0x0, 0x0, 0x4044080}, 0x40014) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r1 = openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/oom_adj\x00', 0x0, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) write$auto(0xffffffffffffffff, 0x0, 0x100000a3d9) read$auto(r1, 0x0, 0x4) r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) writev$auto(r2, &(0x7f0000000200)={0x0, 0x7}, 0x3) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, 0x0, 0x111442, 0x0) r3 = ioctl$auto_NS_GET_USERNS(0xffffffffffffffff, 0xb701, 0x0) getsockopt$auto_SO_RCVTIMEO_OLD(r3, 0x6, 0x14, 0x0, 0x0) process_madvise$auto_MADV_DOFORK(0xffffffffffffffff, 0x0, 0x0, 0xb, 0x9) fanotify_mark$auto(0xffffffffffffffff, 0x8, 0xc, 0xffffffffffffffff, 0x0) unshare$auto(0x6c000000) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="13"], 0x1ac}}, 0x4004) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x0, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x5, 0x9}, 0x7}, 0x3, 0x0) 24.482529611s ago: executing program 0 (id=2103): open(&(0x7f0000000800)='./file0\x00', 0x62240, 0x1c6) (async) socket(0x2, 0x2, 0x88) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) (async, rerun: 64) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) (async, rerun: 64) write$auto(0x3, 0x0, 0xffd8) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/vtconsole/vtcon1/bind\x00', 0x182b02, 0x0) (rerun: 64) sendfile$auto(0x3, r0, 0x0, 0xfdef) (async) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r1 = openat$auto_blk_mq_debugfs_fops_blk_mq_debugfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/block/loop11/zone_wplugs\x00', 0x80000, 0x0) read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000400)=""/214, 0xd6) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/sit0/ifindex\x00', 0x80000, 0x0) (rerun: 64) read$auto(r2, 0x0, 0x20) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x202, 0x0) (async, rerun: 32) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/adsp1\x00', 0x20342, 0x0) (async, rerun: 32) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x480000, 0x0) writev$auto(r2, &(0x7f0000000100)={0x0, 0x7}, 0x2) (async) close_range$auto(0x2, 0x8, 0x0) (async) mmap$auto(0x0, 0x400008, 0xdf, 0x9b70, 0x2, 0x8000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) wait4$auto(0x0, &(0x7f0000000000)=0x9, 0x2, 0x0) 20.044034149s ago: executing program 0 (id=2115): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/mac80211_hwsim/hwsim1/net/wlan1/statistics/rx_crc_errors\x00', 0x0, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000100)=""/4096, 0x1000) setsockopt$auto_SO_CNX_ADVICE(r0, 0xfff, 0x35, &(0x7f0000001500)='\x00', 0x9) mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x401, 0x8000) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001180), r1) sendmsg$auto_NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001340)={0x18, r3, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_FILS_CACHE_ID={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000005}, 0x40011) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) socket(0x1e, 0x1, 0x0) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000001580), r0) r4 = getpid() process_vm_readv$auto(r4, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) statx$auto(0xffffffffffffff9c, &(0x7f0000001240)=':,\x00', 0x0, 0x9000000, &(0x7f0000001280)={0x4, 0xac, 0xfffffffffffffffb, 0x1, 0xee00, 0x0, 0x7, 0x100, 0xa, 0x5, 0x2, 0x0, {0x4, 0x7}, {0x3, 0x3274925}, {0x1, 0x4}, {0x180000000000000, 0x400}, 0x10001, 0x2, 0x8, 0x727, 0x33, 0x8, 0xfffffffd, 0xfffffffffffffffd, 0xfffffffe, 0x4, 0x3, 0x565, [0x5, 0xa71d, 0x7df5, 0x6, 0x9, 0x0, 0x8000, 0x6, 0x81]}) wait4$auto(0x0, &(0x7f0000001380)=0x7, 0x6, &(0x7f00000013c0)={{0xc000000, 0x4}, {0x48, 0x7}, 0x55f, 0xa4ac, 0x12, 0x1, 0x2, 0x1, 0x100, 0x9, 0x45, 0x7, 0x6, 0xfffffffffffffeff, 0x81, 0x1b}) shmctl$auto_IPC_INFO(0x2, 0x3, 0x0) sendmsg$auto_ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x1000) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vbi0\x00', 0x80382, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) 18.44467487s ago: executing program 0 (id=2121): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r1, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xfffffffe}, @NL80211_ATTR_HE_BSS_COLOR={0xc, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8800}, 0x404c) (async) sendmsg$auto_NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r1, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xfffffffe}, @NL80211_ATTR_HE_BSS_COLOR={0xc, 0x11b, 0x0, 0x1, [@NL80211_HE_BSS_COLOR_ATTR_DISABLED={0x4}, @NL80211_HE_BSS_COLOR_ATTR_PARTIAL={0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8800}, 0x404c) mmap$auto(0x0, 0x2020009, 0x3, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/mtd/mtd0/oobsize\x00', 0x40000, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1\x00', 0x80140, 0x0) read$auto(r3, 0x0, 0x8) (async) read$auto(r3, 0x0, 0x8) close_range$auto(0x2, 0x8, 0x0) (async) close_range$auto(0x2, 0x8, 0x0) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/devices/virtual/net/nr5/statistics/rx_nohandler\x00', 0xa880, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000300)=""/102, 0x66) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) (async) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x7fffffff, 0x0, 0x9) (async) madvise$auto(0x7fffffff, 0x0, 0x9) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) mbind$auto(0x2000, 0x100000008, 0x2100000000, 0x0, 0x6, 0x2) futex_wake$auto(0x0, 0x4, 0x1, 0x9) mincore$auto(0x1000, 0x4000000, 0x0) socket(0x1e, 0x805, 0x0) (async) socket(0x1e, 0x805, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/snd/controlC1\x00', 0x802, 0x0) (async) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/snd/controlC1\x00', 0x802, 0x0) ioctl$auto_TUNSETLINK(r2, 0x400454cd, &(0x7f00000001c0)=0x7) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/ip6_flowlabel\x00', 0x80, 0x0) ioctl$auto(0x3, 0x40045532, 0x38) openat$auto_snd_pcm_f_ops_pcm1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/pcmC1D0c\x00', 0x80600, 0x0) 9.69030522s ago: executing program 6 (id=2147): mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x4, 0x0) socket(0xa, 0x801, 0x84) openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48402, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/v4l-touch5\x00', 0x103040, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/net/rxrpc/calls\x00', 0x101000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) socket(0x2, 0x80802, 0x0) mmap$auto(0x0, 0x6, 0x9, 0x19, 0x401, 0x8000) socket(0xa, 0x3, 0x3b) syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x400, 0x2f, 0x940, 0x1ffe0, 0x5a6, 0x3, 0x100002, 0x7f, 0x767, 0xfff, 0x7, 0xb2, 0x9, 0x4, 0x3, 0x1, 0x4, 0x20, 0x0, 0x1, 0x202, 0x62c, 0x40000000, 0x0, 0x9, 0x0, 0x0, 0x2, [0x251, 0xffffffff, 0x0, 0x4, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200000, 0x1, 0x8000000000000000, 0x1, 0x0, 0x1, 0x0, 0x87ffd, 0x0, 0x6, 0xffffffffffffffff, 0x6, 0xb, 0x0, 0x0, 0x6, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x20000000000000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1]}, 0x1fa, 0x81) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) r0 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bus/usb/003/001\x00', 0x42082, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) memfd_create$auto(&(0x7f0000000040)='A^^\x02\x00\xef\x97\x8aY\x00\x00\xd2\x8c\xb05\x03\\\xb2\xbf247{\xde\t8\f\x00\x00\v\x00\x82\xcc\"K\xe1IIT\x00'/54, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sem\x00', 0xc8202, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/hid/drivers/cypress/new_id\x00', 0xa001, 0x0) write$auto(r2, &(0x7f0000000080)='0[.[\x00', 0x1) sendmsg$auto_TCP_METRICS_CMD_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="1d000000", @ANYRES16=0x0, @ANYBLOB="0100f902ff09000000000000000008000b00ac141420080001"], 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x0) socket(0x11, 0xa, 0xc) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 8.909444045s ago: executing program 6 (id=2148): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket(0x2, 0x80802, 0x0) setsockopt$auto(r0, 0x11, 0x1, 0x0, 0x8) (async) setsockopt$auto(r0, 0x11, 0x1, 0x0, 0x8) r1 = socket(0x15, 0x4, 0x8) setsockopt$auto(r1, 0x114, 0x8, 0x0, 0x4) 8.708313536s ago: executing program 6 (id=2149): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$auto_THERMAL_GENL_CMD_THRESHOLD_ADD(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="6a040000", @ANYRES16=r1, @ANYBLOB="00032abd7000ffdbdf25080000008600018088434daeca433a2b36ba51b1ebeb1854d805f262309302a43a477866eae5644f86f31e041d88df7a7e87a2e2ebed5219f2ba4292fad3ba1826b1e4a69682776feb0af6942377a715293316ef2bb44a8945084fc9198be0502d2033fb5f0bd9f5641e75d62a1456fd740369f55d8ce8227eae7901dd5fb8d3845f7c4ba2baa2db6d9300003b01148006004d00b00000000f0053006f76735f7061636b657400000c003e80040022800400c880da943f6b6c82a87a43b07013168f6830bd019b3e6ed259464bfd210f146c219bd3ef14f2e509fbf47f938897f1218bc11faa6c782c26039d81fa7159f252ffffffffd9b779a026ea18a00c711c59dce71315c24f7d695e90984f37257df3f6d5f67b6fd199f6bdfd2774dbf9bf605da659a54773d5ff0349dfa90c737deb7d0ee60c808d00fc008bbda47b439280a30beeaea5cd36f9d12ffb7457b86dc82baad0205255da06545bb01538dec79f4f305590be8fc662b275e38ba777c6a5cc228cbb023ba41389f4f17958bef9f713a6bc578c23e83ae7fe5a4fc5988ac7c413c93ea7399c73bdc698c3ac4b3bf55a8d2b08580eb429ad4b58efefec82d804bff339d4557f50b72959db375e237c287900000000"], 0x1d8}, 0x1, 0x0, 0x0, 0x40000}, 0x800) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1, 0x3, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x10005, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x20004050}, 0x4000084) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/netdevsim3/sriov_numvfs\x00', 0x10b142, 0x0) write$auto(r2, &(0x7f0000000240)='802.15.4 MAC\"', 0x3) lstat$auto(0x0, &(0x7f0000000180)={0x5, 0x1f, 0x9, 0x62, 0x0, 0x0, 0x0, 0xffc, 0x2, 0x80000000400000a, 0x0, 0x9, 0x9, 0xffffffff80000000, 0x11, 0x1, 0x6}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x89fc, &(0x7f0000000040)={'bridge0\x00'}) move_mount$auto(0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x77) io_uring_setup$auto(0x9, 0x0) r4 = socket(0x2a, 0x2, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(r4, 0xffffffffffffffff, 0x7) r5 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/kcore\x00', 0x40000, 0x0) read$auto_proc_iter_file_ops_compat_inode(r5, &(0x7f0000000400)=""/232, 0xfdef) r6 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x942, 0x0) write$auto(r6, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9) 7.685919829s ago: executing program 6 (id=2150): r0 = socket(0xa, 0x1, 0x84) epoll_pwait2$auto(r0, 0xfffffffffffffffc, 0x2000fff, 0x0, 0x0, 0x8) close_range$auto(0x2, 0xa, 0x0) openat$auto_snapshot_fops_user(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x3f) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r1 = socket(0x2, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4ea2, @remote}, 0x6a) sendmmsg$auto(r1, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0x80}, 0x8}, 0x7, 0x20020000) write$auto(0x3, 0x0, 0x100000000) shutdown$auto(0x200000003, 0x2) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, 0x0, 0x440, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x20b82, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x5, 0x0) openat$auto_snd_mixer_oss_f_ops_mixer_oss(0xffffffffffffff9c, 0x0, 0x902, 0x0) mmap$auto(0x0, 0x5, 0x2, 0xeb1, 0xffffffffffffffff, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) r2 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @loopback}, 0x6a) sendmmsg$auto(r2, &(0x7f0000000140)={{&(0x7f0000000040), 0x10, 0x0, 0x9, 0x0, 0x1f, 0x9}, 0x900006}, 0x7, 0x20000000) ioctl$auto_SG_GET_COMMAND_Q2(0xffffffffffffffff, 0x2270, 0x0) io_uring_setup$auto(0x1, 0x0) setsockopt$auto(0x3, 0x1, 0x2e, 0x0, 0x9) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) 6.557185223s ago: executing program 7 (id=2152): sched_getparam$auto(0x0, &(0x7f00000066c0)={0x2}) prctl$auto(0x2a, 0x82, 0x0, 0x1, 0xb) unlink$auto(&(0x7f0000000080)='./cgroup.cpu/cgroup.procs\x00') 6.400183819s ago: executing program 7 (id=2153): sigaltstack$auto(&(0x7f0000000180)={0x0, 0x80000001, 0x10004}, 0x0) (async) sigaltstack$auto(&(0x7f0000000180)={0x0, 0x80000001, 0x10004}, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/sound/seq/uevent\x00', 0x8500, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r0, &(0x7f00000000c0)=""/4096, 0x1000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r1 = getpid() gettid() (async) r2 = gettid() rt_tgsigqueueinfo$auto(r1, r2, 0x21, 0x0) 6.059329222s ago: executing program 7 (id=2155): unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r1 = clone3$auto(0x0, 0x1) r2 = prctl$auto(0x3e, 0x1, r1, 0x1, 0x0) setresuid$auto(0xffffffffffffffff, 0x0, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x123002, 0x0) ioctl$auto_SNDCTL_DSP_GETBLKSIZE(r3, 0xc0045004, &(0x7f0000000000)) mmap$auto(0x0, 0x2020009, 0x3, 0xebf, 0xfffffffffffffffa, 0x80000001) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) madvise$auto(0xfffffffffffffffe, 0x240007, 0x17) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/ram10/queue/max_sectors_kb\x00', 0xe3102, 0x0) sendfile$auto(r4, r4, 0x0, 0x1) madvise$auto(0x0, 0xffffffffffff0005, 0x19) mmap$auto(0xfffffffffffffffc, 0x400008, 0x1000df, 0x13, 0x2, 0x100000000008002) unshare$auto(0x40000080) ioctl$auto_SNDCTL_DSP_PROFILE(r3, 0x40045017, &(0x7f0000000180)="d145d0e91274995474c3f52da5506c2b5db017d54aec541e9c8eb418c73025c7e03b9bc8e20791b4ce1c4f4db3f48f0246d00a9d3d16546f77c531039b9187bc82b91c8cc22987ceb2006b062985d7cbf928bad56be8db05e3504b3912e23aee4ea963405c575980c60b64308e6c636b5157dbd1380c04bc0614aa7382cb4ff3cdd5bc7f112690d8640b830c68706ff3f04a0846eb48e1be4eb2f5d0b03ef92d53705b83531f22fa6af3aa740b1a6904b64cf750f0c6971b55fab357bc236143ef33d74124d97b2eb796885d9c1c19c1069f21d7c046ad33c1aaeb31f469e0851bd9254c78ec81b894a2bb3a0b8627b485de483bc9523201b20c5b01") ioctl$auto_HPET_IRQFREQ(r2, 0x40086806, &(0x7f0000000080)) r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000780)='/proc/self/net/rpc/auth.rpcsec.init/channel\x00', 0x8440, 0x0) write$auto(r5, &(0x7f0000000000)='\\@-,@n', 0x60) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty10\x00', 0x101100, 0x0) madvise$auto(0x0, 0x2003f2, 0x15) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r6 = socket(0x10, 0x2, 0x0) r7 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_MODULE_EEPROM_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="cb5b"], 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x0) sendmmsg$auto(r6, &(0x7f0000000080)={{0x0, 0x2, &(0x7f0000000040)={0x0, 0x7}, 0x4, 0x0, 0x7, 0x1009}, 0xffffff7d}, 0x2, 0xffffffff) recvmmsg$auto(r6, 0x0, 0x7, 0x6, 0x0) pkey_free$auto(0x8) 5.592698535s ago: executing program 6 (id=2157): mmap$auto(0x0, 0x40006, 0xdc, 0x200009b72, 0x7, 0x28000) r0 = socket(0x10, 0x2, 0x0) fcntl$auto_F_SETLEASE(r0, 0x400, 0x10002) close_range$auto(0x0, 0xfffffffffffff000, 0x2) bpf$auto(0x0, &(0x7f0000000100)=@bpf_attr_5={@target_fd=0x5, 0x7f, 0x9c, 0x7b2, 0x1, @relative_fd=0x2, 0x80}, 0x96) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/system/cpu/cpu0/cache/index3/type\x00', 0x22100, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000080)=""/247, 0xf7) bpf$auto(0x15, 0x0, 0x0) fsconfig$auto_SHMEM_HUGE_DENY(r1, 0x401, &(0x7f00000001c0)='(:^\x00', &(0x7f0000000200)="4bc69e97aa149b73356f368a78e98791b6ce2d0c8f593c7fe01400a6015453db65639679270ac89ca2cf87221c0164658066a582aa999a1364857abd67042c2c4f7ecce9591432e9ad42f2fa03fa69b86212b0e67f0619959e9173f4ed04011d939993ad9b563212d4d0d3237d3755533fd1e6dc412582cbb0d9d41a9d3883c32f843d69311cccef30322a49a894c615f04f582e4d88f211d1ef7355872c1c88227da0201e26293e46a381c13802a12f0c7c35f33999800f8a671fd7cf6c1ad0f54481cd91ee0662a110e3996e5cc4eb12234654242b8a29d8b7042940ac854f8d47bf2a57", 0xffffffffffffffff) open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x20342, 0x0) ioctl$auto_SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000000)) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x1a9402, 0x0) read$auto(0x3, 0x0, 0x8080) socket(0xa, 0x1, 0x100) write$auto(0x3, 0x0, 0xffd8) mmap$auto(0x0, 0x2020009, 0x7, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/ram1/integrity/tag_size\x00', 0x68e00, 0x0) connect$auto(0xffffffffffffffff, &(0x7f0000000300)=@in={0x2, 0x4e21, @local}, 0xd9) r4 = getpid() r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_MODULE_EEPROM_GET(r5, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000000340)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="890727bd7000ffdbdb251f000000080003000500000008000200dc0000000500060009000000050005000b0000000500040000000000682903a07c1b4638570969231db5646924f30ef91a80"], 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004840) process_vm_readv$auto(r4, &(0x7f0000000000)={0x0, 0xfff}, 0x800000001, &(0x7f0000000280)={&(0x7f0000000340), 0x1ffffffff}, 0x6, 0x0) r7 = socket(0x11, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r7, 0x8955, 0x0) unshare$auto(0x40000080) fsconfig$auto(r3, 0x800, &(0x7f0000000040)='/sys/devices/LNXSYSTM:00/LNXPWRBN:00/power/wakeup_abort_count\x00', 0x0, 0x0) write$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffffff, &(0x7f00000001c0), 0x0) 5.473976217s ago: executing program 4 (id=2158): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$auto_THERMAL_GENL_CMD_THRESHOLD_ADD(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="6a040000", @ANYRES16=r1, @ANYBLOB="00032abd7000ffdbdf25080000008600018088434daeca433a2b36ba51b1ebeb1854d805f262309302a43a477866eae5644f86f31e041d88df7a7e87a2e2ebed5219f2ba4292fad3ba1826b1e4a69682776feb0af6942377a715293316ef2bb44a8945084fc9198be0502d2033fb5f0bd9f5641e75d62a1456fd740369f55d8ce8227eae7901dd5fb8d3845f7c4ba2baa2db6d9300003b01148006004d00b00000000f0053006f76735f7061636b657400000c003e80040022800400c880da943f6b6c82a87a43b07013168f6830bd019b3e6ed259464bfd210f146c219bd3ef14f2e509fbf47f938897f1218bc11faa6c782c26039d81fa7159f252ffffffffd9b779a026ea18a00c711c59dce71315c24f7d695e90984f37257df3f6d5f67b6fd199f6bdfd2774dbf9bf605da659a54773d5ff0349dfa90c737deb7d0ee60c808d00fc008bbda47b439280a30beeaea5cd36f9d12ffb7457b86dc82baad0205255da06545bb01538dec79f4f305590be8fc662b275e38ba777c6a5cc228cbb023ba41389f4f17958bef9f713a6bc578c23e83ae7fe5a4fc5988ac7c413c93ea7399c73bdc698c3ac4b3bf55a8d2b08580eb429ad4b58efefec82d804bff339d4557f50b72959db375e237c287900000000"], 0x1d8}, 0x1, 0x0, 0x0, 0x40000}, 0x800) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1, 0x3, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x10005, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x20004050}, 0x4000084) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/netdevsim3/sriov_numvfs\x00', 0x10b142, 0x0) write$auto(r2, &(0x7f0000000240)='802.15.4 MAC\"', 0x3) lstat$auto(0x0, &(0x7f0000000180)={0x5, 0x1f, 0x9, 0x62, 0x0, 0x0, 0x0, 0xffc, 0x2, 0x80000000400000a, 0x0, 0x9, 0x9, 0xffffffff80000000, 0x11, 0x1, 0x6}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x89fc, &(0x7f0000000040)={'bridge0\x00'}) move_mount$auto(0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x77) io_uring_setup$auto(0x9, 0x0) r4 = socket(0x2a, 0x2, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(r4, 0xffffffffffffffff, 0x7) r5 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/kcore\x00', 0x40000, 0x0) read$auto_proc_iter_file_ops_compat_inode(r5, &(0x7f0000000400)=""/232, 0xfdef) r6 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x942, 0x0) write$auto(r6, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9) 4.858511409s ago: executing program 4 (id=2159): mmap$auto(0x0, 0x400008, 0x20000000000000df, 0x9b72, 0xffffffffffffffff, 0x8000) r0 = socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) write$auto(0x3, 0x0, 0xfffffdef) r1 = fcntl$auto_F_GETOWN(r0, 0x9, 0x6) madvise$auto(0x1, 0xf, 0x80000000) migrate_pages$auto(r1, 0x6, &(0x7f0000000000)=0x8001, &(0x7f0000000040)=0x2) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0xe, 0x9, 0x2, 0xfffffffffffffffd, 0x5, 0x4, 0x15f4da0e, 0x8, 0x9, 0x100000000000000c, 0x8, 0x1, 0xfca, 0x9, 0x2, 0x4000000000000d]}, 0x0) close_range$auto(0x2, 0x8, 0x0) 4.183248517s ago: executing program 4 (id=2160): symlink$auto(0x0, &(0x7f0000000440)='./file0\x00') close_range$auto(0x2, 0x8, 0x0) getpid() mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_GET_SCAN(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) inotify_add_watch$auto(0xffffffffffffffff, 0x0, 0x1000e6e) personality$auto(0x5) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/softnet_stat\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000826bd7000fedbdf250300000008000400b70a0000060007000080000008000200", @ANYRES32=r2, @ANYBLOB="0a0005000180c200000e00000a0001000180c200000e00000a000100000000000000000008000200", @ANYRES32=r2, @ANYBLOB="060006ff05000000080003009b"], 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x3, 0x100) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) readv$auto(r0, &(0x7f0000000540)={&(0x7f0000000480)="ce1bdd5eb94399b860bb55d24c841b91d8a40dd04ef5b1e880893c04ecc1dcf42f4a2c0ce9c2311b7dba84c879ad794bae2946a2d89e534daaf7466ca204fcaa99980e21e7ef37cd717a42951da220d53ce942a34fd0f254ef91ba4004645b9432df047bbfe4c0e86ccebb9ff19f63ec73d11d19739a5009989bfdd31e549cf9c8d04a6b859c570ff6dfbbbde713717624f95d1d0ee422e3637e9c4756b1eb1d8ed5b3a17e71f3ae00e82d21eb6b3543667bcea6e66bc9cfc4cbcf7154e1e9c3", 0x40}, 0x5) preadv$auto(0xffffffffffffffff, &(0x7f0000009180)={0x0, 0x7}, 0x26, 0x800000000080, 0x5) read$auto_blk_mq_debugfs_fops_blk_mq_debugfs(r1, &(0x7f0000000300)=""/241, 0xf1) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) 3.173174323s ago: executing program 4 (id=2161): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) (async) close_range$auto(0x2, 0x8, 0x0) (async) memfd_create$auto(0x0, 0xe) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0) write$auto(r0, &(0x7f0000000000)='//\xf2\x00', 0x80000000) (async) mmap$auto(0x0, 0x810006, 0xffb, 0x8000000008011, 0x3, 0x0) (async) mprotect$auto(0x0, 0x806121, 0x6) (async) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio1\x00', 0x200, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000080)) 2.899480004s ago: executing program 7 (id=2162): r0 = openat$auto_proc_pid_set_comm_operations_base(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/comm\x00', 0x56f77913f5631cab, 0x0) mmap$auto(0x0, 0xe983, 0x3, 0xebf, r0, 0x20000008000) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = openat$auto_ecryptfs_miscdev_fops_miscdev(0xffffffffffffff9c, &(0x7f00000001c0), 0x101002, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$auto_IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001b80)={0x14, r3, 0x701, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x40000) close_range$auto(r1, r2, 0xfffffff8) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) ioctl$auto_MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_tracing_entries_fops_trace(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$auto(r4, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/devices/system/node/node1/compact\x00', 0xc2481, 0x0) writev$auto(r5, &(0x7f0000000080)={0x0, 0x1000}, 0x3) syz_genetlink_get_family_id$auto_smbd_genl(0x0, 0xffffffffffffffff) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/module/libceph/parameters/supported_features\x00', 0x40000, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x149443, 0x0) mount$auto(0x0, 0x0, &(0x7f0000000240)='hfs\x00\x81\xe2\xde\xa8\xb7\xc4G[*}\xaa{\xf1\x86\xf7d@\xe8Y\xea\xb1H\x01\xff\"^\'6\xba\xa9s\x1d\xf4\xe1i\xc5\xb6_B\xa7KFS\xc1\xa7\x8e*h\xe3\x8b\x7f\xca\xfcNEi\x84?\x82\xff\xf2\xac\xd1\xee\xf4\x9a?\xac\x11\x88\aO\x84\xe6k\a\x9bY\xddx\xb8\xdf\vHv\xb5\f\xbc\b\xc0\xfa\xc0\xfe\xa6\xce\xbd\x03\x00\x93\xdc4\x97\xce\xd5&\x93\xae\x05q\xe9\xa8?\x00\xbdi\x88q\xd0w\xfd@\r\xce\xe4\xadrt`\xf8`b\xbf\xeci\x93a\xc6o\x9ej\xe4\xa3\x9d\xaa\xe1\xe1N\n\xbcq\n[\"5\xd4\xa6\x96#).\xbd\x8aD\x88>8J\v\xb5\x99H\xc5\a\xc9\xcf\xbc\x85\xbf\x85\x81\x0f\x7f8\x11\xdbK\xf3\xc2#\x18 \xdf\x05\xcd\xbb\xc03_\xb7Q@\xf2G', 0x7, 0x0) sendmsg$auto_KSMBD_EVENT_LOGIN_RESPONSE(0xffffffffffffffff, 0x0, 0x30004850) keyctl$auto(0x1ff, 0x0, 0x0, 0x0, 0x6) msync$auto(0x1ffff000, 0x1800000000000fe, 0x400000004) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, 0x0, 0x40802, 0x0) 1.69898532s ago: executing program 7 (id=2163): r0 = bpf$auto(0x5, &(0x7f0000000300)=@bpf_attr_3={0x9, 0x24, 0xf, 0x63, 0x2, 0x0, 0xffffffffffffffff, 0x80f0c8, 0x8, "38c1d5cbcb9f6b5e511f0cd8ed068f65", 0x0, 0x113e33f2, 0xffffffffffffffff, 0xe4, 0x319, 0x5, 0x6, 0x8, 0x0, 0x3, @attach_prog_fd, 0x6, 0xffff, 0x8, 0x4, 0xfffffffe, 0xffffffffffffffff, 0xffffffffffffffff}, 0x47) unshare$auto(0x40000080) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f00000005c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xed\xf8\xe1\xbc\x1d\x91D\xe7R\x12\xc4\xcd\xc6\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY2@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(', 0x100000a3dd) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x281, 0x0) read$auto_proc_reg_file_ops_compat_inode(0xffffffffffffffff, &(0x7f00000001c0)=""/218, 0xda) socket(0x2b, 0x1, 0x0) listen$auto(r2, 0x81) mremap$auto(0x0, 0x7, 0x3fd6, 0x0, 0x1ffffffe) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) open(0x0, 0x161342, 0x100) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_gtp(0x0, r0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0xfffffffc, &(0x7f0000000000)=@link_update={r4, @new_prog_fd=r4, 0x1, @old_prog_fd=r4}, 0x7) close_range$auto(0xffffffffffffffff, 0x8000, 0x4) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0x18, &(0x7f0000000000), 0x1) madvise$auto(0x0, 0xffffffffffff0001, 0x15) r6 = socket(0xa, 0x5, 0x84) getsockopt$auto(r6, 0x84, 0x9, 0x0, 0x0) mmap$auto(0x0, 0x2020009, 0x7f, 0xeb1, r3, 0x2) mmap$auto(0x0, 0x202000a, 0xffffffff, 0xdc, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x19) write$auto(0xffffffffffffffff, &(0x7f0000000440)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18\xbd\xe2\x1c\x89OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb', 0x98c7) madvise$auto(0x0, 0x2003f2, 0x15) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000180)=ANY=[@ANYRES16, @ANYRES8], 0x14}, 0x1, 0x0, 0x0, 0x40a49d6bfebafc92}, 0x24008084) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x101001, 0x0) 1.386266799s ago: executing program 4 (id=2164): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) (async) r0 = socket(0x2, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4ea2, @remote}, 0x6a) (async) getsockopt$auto_SO_RCVTIMEO_OLD(r0, 0xffffffff, 0x14, 0x0, 0x0) (async) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f00000000c0), 0x400012, 0x0, 0x9, 0x0, 0x1f, 0x80}, 0x1000}, 0x7, 0x12e) (async) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x13e, 0x0, 0xfffffffffffffffd) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) (async) write$auto(0x3, 0x0, 0x100000000) shutdown$auto(r0, 0x2) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000180)='/dev/tty60\x00', 0x161203, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x121a40, 0x0) io_uring_setup$auto(0xb, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) openat$auto_rfkill_fops_core(0xffffffffffffff9c, &(0x7f0000000000), 0x719a83, 0x0) (async) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0) socketpair$auto(0x4004, 0x2, 0xfff, 0x0) (async) ioctl$auto_TIOCSETD2(r1, 0x5423, 0x0) write$auto(r1, 0x0, 0x1) (async) r2 = socket(0x1f, 0x5, 0x0) getsockopt$auto(r2, 0x84, 0xa, &(0x7f0000000240)='\xc8\xfdV%\r\x80\\\xf7\\\x00\x0eU\xa7\x1a\x04J\xbb\xb3\xcb$=\xdd\xf3\x9a\x98\xf2\xde\x1e{\n\xb5=\xff\x01&\xcbk\xec\xe0P\xdb9\xb5]\xb2E^78\xfd~\x80\x89?\x80\xe2`\xa9M\xf1dJ\xf4TB\xd9\x89ta\x1e \x15C\tgBd\x0ew\x05\xc7j\xc9-\x82\xabie%\x96zl\x1f\xf6\x90\x90\xefr\xd0p\xb6\xb4sx\x91\\\xc1\x12?\xd3\xedF\x9e^O\x1f\x14b\xa9G\xe1\xa7\xb2\xaa1\x0f\xafX\x1c]\xb1\x84\x83\xa5\xdc\xe4\xa7\"\xd2H>\xc0\xb7A\x01\xaa\bu-p(\xb3M*B\xe7)\xc7b$\x8fI', &(0x7f0000000040)=0x1002) (async) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/xfs/xqm\x00', 0x1c9802, 0x0) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) prctl$auto(0x1000000003b, 0x1, 0x4, 0x80000000, 0x7) sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x10, 0x0, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4048) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/pci/00/01.3\x00', 0x149041, 0x0) 827.077622ms ago: executing program 4 (id=2165): unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r1 = clone3$auto(0x0, 0x1) prctl$auto(0x3e, 0x1, r1, 0x1, 0x0) setresuid$auto(0xffffffffffffffff, 0x0, 0x0) write$auto(r0, &(0x7f0000000340)='/Eev/audio+\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\\a\x00\x00\x00\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc\xa1g\x0f)\xe0\xea\xc5c\b9\xe6\xccKk\t\xb4\xde\a\xb5\x0eV\xbe\xfaLD\xaa\t`\x03s\xeaS\xb2\xee\x9d\xe0a>\xb8&\xecW\xe7\x85N4f\xc3\x15V\x0e\xdd:\xa9*\f|\x94Gc;\xac1c\xc0\x96L\x13\xe4j\xbd\xca|\x16\x92\x1c\xd1\xb5\x92\x1cue\x03M\xae\xd7\xa1\xf50-\x18TK\xd4\xed\x8e&\x8a}\xf0\xa4\xa8\x96\x1b\x93lNVr$\xedc\xe3\x14', 0x1) r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x123002, 0x0) ioctl$auto_SNDCTL_DSP_GETBLKSIZE(r2, 0xc0045004, &(0x7f0000000280)="c49408b314231b6aaf40417b7dd27db9ff7dc7d57cce626197d316a94cab4ac3c972d5536beb4dd26e89181f75f346105f4de141faf44fc66ab088ebe9c37c37d10da70b3f97f1984ade479dd5459d9fc746750605303c10171e293d6afdca4772fa0befcde1c106462f40ee24e1dd1cc7fa237bb6dbbf0ea0a987c9d865bbb3ec6c6ef401b5e44d6f03adc26b67d832716b3506caca55a07c86a698bc92248df00df7914ab565428006056734aba9214bda") mmap$auto(0x0, 0x2020009, 0x3, 0xebf, 0xfffffffffffffffa, 0x80000001) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) r3 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000000), 0x200200, 0x0) sendmmsg$auto(r3, &(0x7f0000000640)={{&(0x7f0000000380)="c6b8e3f9090a1e2ab3252b3b52a864a2832209c4a1bc0ce9f1a179989428887f10306b45193fe601b0371c86b420bc3329f21d8f0a634bf771714a33ec5951f85ecf598af74fae7e82f5c687e5817b9850b4875d960650bc973106e126bb8c95b5cda30f7df54fa8e37643a02d8687c79ee07b512a7845f44ba3d003192e1b0ae9ee0c9c9830e518603530f8f4624489e08ac6d9e9cc3a5cba97d855d32421b0319374a278c3fa82fd624c38dfe667c054b51691fe77b3ac1496e7080027bcb44dffb7b18cb44ddbf9b387", 0x6, &(0x7f0000000500)={&(0x7f0000000480)="1f09c10e20b6b4c2c3097f14e3fdf5ba4a5ba4a69d3dd7c56f5a7b5e8209f51cb5b621ca8dc56c7f1ea519", 0xce3d}, 0xfffffffffffffffe, &(0x7f0000000540)="c0a3093efc2967317e11a082fa2f009f8d4d8ee24a8bbe71f7f0a7e1fffe977d33b893f98ec85d3454254275265a9e3e4c45f2f8857240a46cf6a272808adfef73cc2de8a97bc5454c096b264bc45253b3ee2f096e76ecca8a7d276a83fb5017fb4787128f4380968831aabc691c02ed0fbd09fe138d5758ace23f6c16faef05131479c39707de3b170d0f05f51be430ad59cb34e9efc082935dad4f7b82fbb686109c9e8d951acbf5615d5522ac1b8c3985b7da2d0f70fed6adb0c1cfcde1ec2266eac786fa546ae19906d9184bacd579d12850efccdbc12f22680cd2bf43c4b9667987c856cf83bcc0dc76f9c8fe49dd59f6573be53309c11f14ff", 0x3, 0x1}, 0x1000}, 0x5, 0x800) r4 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, r4, 0x8000) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x40342, 0x22) socket(0x2, 0x3, 0x100) getpid() statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x0, 0x9, 0x3, 0xc, 0x940, 0x1ffe0, 0x3, 0x6, 0x2, 0x9, 0x5, 0x2, 0x7, 0xb0, 0x6, 0x5, 0x3, 0x5, 0x7, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffff7fffffff, 0x0, 0x400000, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6d76]}, 0x1fe, 0x81) mmap$auto(0x0, 0x20009, 0xe3, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) socket(0xa, 0x5, 0x0) open(0x0, 0x261c2, 0x84) r5 = socket(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r7, r6, 0x4, 0x1ff, r5, @relative_id=0x13, 0xe600}, 0xf) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) 473.518583ms ago: executing program 7 (id=2166): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_thermal(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$auto_THERMAL_GENL_CMD_THRESHOLD_ADD(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="6a040000", @ANYRES16=r1, @ANYBLOB="00032abd7000ffdbdf25080000008600018088434daeca433a2b36ba51b1ebeb1854d805f262309302a43a477866eae5644f86f31e041d88df7a7e87a2e2ebed5219f2ba4292fad3ba1826b1e4a69682776feb0af6942377a715293316ef2bb44a8945084fc9198be0502d2033fb5f0bd9f5641e75d62a1456fd740369f55d8ce8227eae7901dd5fb8d3845f7c4ba2baa2db6d9300003b01148006004d00b00000000f0053006f76735f7061636b657400000c003e80040022800400c880da943f6b6c82a87a43b07013168f6830bd019b3e6ed259464bfd210f146c219bd3ef14f2e509fbf47f938897f1218bc11faa6c782c26039d81fa7159f252ffffffffd9b779a026ea18a00c711c59dce71315c24f7d695e90984f37257df3f6d5f67b6fd199f6bdfd2774dbf9bf605da659a54773d5ff0349dfa90c737deb7d0ee60c808d00fc008bbda47b439280a30beeaea5cd36f9d12ffb7457b86dc82baad0205255da06545bb01538dec79f4f305590be8fc662b275e38ba777c6a5cc228cbb023ba41389f4f17958bef9f713a6bc578c23e83ae7fe5a4fc5988ac7c413c93ea7399c73bdc698c3ac4b3bf55a8d2b08580eb429ad4b58efefec82d804bff339d4557f50b72959db375e237c287900000000"], 0x1d8}, 0x1, 0x0, 0x0, 0x40000}, 0x800) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1, 0x3, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x10005, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x20004050}, 0x4000084) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/netdevsim3/sriov_numvfs\x00', 0x10b142, 0x0) write$auto(r2, &(0x7f0000000240)='802.15.4 MAC\"', 0x3) lstat$auto(0x0, &(0x7f0000000180)={0x5, 0x1f, 0x9, 0x62, 0x0, 0x0, 0x0, 0xffc, 0x2, 0x80000000400000a, 0x0, 0x9, 0x9, 0xffffffff80000000, 0x11, 0x1, 0x6}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x89fc, &(0x7f0000000040)={'bridge0\x00'}) move_mount$auto(0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x77) io_uring_setup$auto(0x9, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = socket(0x2a, 0x2, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(r4, 0xffffffffffffffff, 0x7) r5 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/kcore\x00', 0x40000, 0x0) read$auto_proc_iter_file_ops_compat_inode(r5, &(0x7f0000000400)=""/232, 0xfdef) r6 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x942, 0x0) write$auto(r6, &(0x7f0000000200)='/de\xef\xe7audio1\x00', 0xa3d9) 0s ago: executing program 6 (id=2167): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D0\x00', 0x8001, 0x0) write$auto(r0, &(0x7f0000000100)='d>*\xd2x\xc7\xbf\xff\x9a\xc01(\x00iM\x9c\bAa\x9e\xe98\xee\x15\xd3\xc5v\x99\f|\xe3\xbf\xd9\xf4C\x14A\xe6k\x105\xee\xc5\xaa$\x16\t?g\xb8b\x12\v*\xf9@B\xd0\xd2\x99{\x8b^\xff@\x83\x02Tvt\xc1_\x98\x9f\x16\xd5Is', 0x100000a3da) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) mlockall$auto(0x800000000000005) msync$auto(0x1ffff000, 0x1800000ff000000, 0x400000004) r1 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r1, &(0x7f00000002c0)=""/190, 0xfffffe39) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) madvise$auto(0x0, 0x20000a, 0x4) kernel console output (not intermixed with test programs): ORIG_RAX: 0000000000000110 [ 348.173352][T10245] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 348.173376][T10245] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 348.173397][T10245] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 348.173418][T10245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 348.173438][T10245] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 348.173483][T10245] [ 349.155064][T10259] FAULT_INJECTION: forcing a failure. [ 349.155064][T10259] name failslab, interval 1, probability 0, space 0, times 0 [ 349.257489][T10259] CPU: 0 UID: 0 PID: 10259 Comm: syz.2.1045 Not tainted syzkaller #0 PREEMPT(full) [ 349.257535][T10259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 349.257563][T10259] Call Trace: [ 349.257573][T10259] [ 349.257586][T10259] dump_stack_lvl+0x100/0x190 [ 349.257647][T10259] should_fail_ex.cold+0x5/0xa [ 349.257690][T10259] should_failslab+0xc2/0x120 [ 349.257730][T10259] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 349.257792][T10259] ? copy_utsname+0x1a8/0x690 [ 349.257849][T10259] ? copy_mnt_ns+0x106/0xc30 [ 349.257898][T10259] copy_utsname+0x1a8/0x690 [ 349.257956][T10259] create_new_namespaces+0x16a/0xac0 [ 349.257996][T10259] ? bpf_lsm_capable+0x9/0x10 [ 349.258034][T10259] ? security_capable+0x80/0x260 [ 349.258076][T10259] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 349.258119][T10259] ksys_unshare+0x473/0xad0 [ 349.258168][T10259] ? __pfx_ksys_unshare+0x10/0x10 [ 349.258230][T10259] __x64_sys_unshare+0x31/0x40 [ 349.258276][T10259] do_syscall_64+0x106/0xf80 [ 349.258313][T10259] ? clear_bhb_loop+0x40/0x90 [ 349.258355][T10259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.258390][T10259] RIP: 0033:0x7f97e3f9c819 [ 349.258418][T10259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.258452][T10259] RSP: 002b:00007f97e4e4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 349.258484][T10259] RAX: ffffffffffffffda RBX: 00007f97e4215fa0 RCX: 00007f97e3f9c819 [ 349.258512][T10259] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 349.258532][T10259] RBP: 00007f97e4032c91 R08: 0000000000000000 R09: 0000000000000000 [ 349.258588][T10259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 349.258608][T10259] R13: 00007f97e4216038 R14: 00007f97e4215fa0 R15: 00007ffda1cc5298 [ 349.258652][T10259] [ 350.902178][T10289] FAULT_INJECTION: forcing a failure. [ 350.902178][T10289] name failslab, interval 1, probability 0, space 0, times 0 [ 351.165980][T10289] CPU: 1 UID: 0 PID: 10289 Comm: syz.2.1056 Not tainted syzkaller #0 PREEMPT(full) [ 351.166023][T10289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 351.166041][T10289] Call Trace: [ 351.166050][T10289] [ 351.166061][T10289] dump_stack_lvl+0x100/0x190 [ 351.166112][T10289] should_fail_ex.cold+0x5/0xa [ 351.166147][T10289] should_failslab+0xc2/0x120 [ 351.166180][T10289] __kmalloc_cache_noprof+0x7a/0x6f0 [ 351.166221][T10289] ? copy_ipcs+0x10d/0x7e0 [ 351.166261][T10289] copy_ipcs+0x10d/0x7e0 [ 351.166297][T10289] create_new_namespaces+0x20a/0xac0 [ 351.166329][T10289] ? security_capable+0x80/0x260 [ 351.166363][T10289] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 351.166398][T10289] ksys_unshare+0x473/0xad0 [ 351.166439][T10289] ? __pfx_ksys_unshare+0x10/0x10 [ 351.166491][T10289] __x64_sys_unshare+0x31/0x40 [ 351.166528][T10289] do_syscall_64+0x106/0xf80 [ 351.166559][T10289] ? clear_bhb_loop+0x40/0x90 [ 351.166594][T10289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.166624][T10289] RIP: 0033:0x7f97e3f9c819 [ 351.166647][T10289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.166675][T10289] RSP: 002b:00007f97e4e4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 351.166710][T10289] RAX: ffffffffffffffda RBX: 00007f97e4215fa0 RCX: 00007f97e3f9c819 [ 351.166730][T10289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 351.166748][T10289] RBP: 00007f97e4032c91 R08: 0000000000000000 R09: 0000000000000000 [ 351.166765][T10289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 351.166783][T10289] R13: 00007f97e4216038 R14: 00007f97e4215fa0 R15: 00007ffda1cc5298 [ 351.166821][T10289] [ 353.472766][T10337] can: request_module (can-proto-0) failed. [ 353.523062][T10351] FAULT_INJECTION: forcing a failure. [ 353.523062][T10351] name failslab, interval 1, probability 0, space 0, times 0 [ 353.549116][T10351] CPU: 1 UID: 0 PID: 10351 Comm: syz.1.1069 Not tainted syzkaller #0 PREEMPT(full) [ 353.549161][T10351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 353.549182][T10351] Call Trace: [ 353.549193][T10351] [ 353.549205][T10351] dump_stack_lvl+0x100/0x190 [ 353.549264][T10351] should_fail_ex.cold+0x5/0xa [ 353.549321][T10351] should_failslab+0xc2/0x120 [ 353.549357][T10351] __kmalloc_cache_noprof+0x7a/0x6f0 [ 353.549407][T10351] ? copy_ipcs+0x10d/0x7e0 [ 353.549451][T10351] copy_ipcs+0x10d/0x7e0 [ 353.549488][T10351] create_new_namespaces+0x20a/0xac0 [ 353.549529][T10351] ? security_capable+0x80/0x260 [ 353.549569][T10351] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 353.549611][T10351] ksys_unshare+0x473/0xad0 [ 353.549657][T10351] ? __pfx_ksys_unshare+0x10/0x10 [ 353.549726][T10351] __x64_sys_unshare+0x31/0x40 [ 353.549771][T10351] do_syscall_64+0x106/0xf80 [ 353.549808][T10351] ? clear_bhb_loop+0x40/0x90 [ 353.549851][T10351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.549886][T10351] RIP: 0033:0x7f51e119c819 [ 353.549913][T10351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.549947][T10351] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 353.549981][T10351] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 353.550004][T10351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 353.550025][T10351] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 353.550046][T10351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 353.550066][T10351] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 353.550111][T10351] [ 355.405325][T10390] FAULT_INJECTION: forcing a failure. [ 355.405325][T10390] name failslab, interval 1, probability 0, space 0, times 0 [ 355.441188][T10390] CPU: 0 UID: 0 PID: 10390 Comm: syz.1.1079 Not tainted syzkaller #0 PREEMPT(full) [ 355.441234][T10390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 355.441254][T10390] Call Trace: [ 355.441265][T10390] [ 355.441286][T10390] dump_stack_lvl+0x100/0x190 [ 355.441345][T10390] should_fail_ex.cold+0x5/0xa [ 355.441387][T10390] should_failslab+0xc2/0x120 [ 355.441428][T10390] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 355.441484][T10390] ? copy_utsname+0x1a8/0x690 [ 355.441540][T10390] ? copy_mnt_ns+0x106/0xc30 [ 355.441588][T10390] copy_utsname+0x1a8/0x690 [ 355.441645][T10390] create_new_namespaces+0x16a/0xac0 [ 355.441685][T10390] ? bpf_lsm_capable+0x9/0x10 [ 355.441724][T10390] ? security_capable+0x80/0x260 [ 355.441766][T10390] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 355.441810][T10390] ksys_unshare+0x473/0xad0 [ 355.441858][T10390] ? __pfx_ksys_unshare+0x10/0x10 [ 355.441920][T10390] __x64_sys_unshare+0x31/0x40 [ 355.441965][T10390] do_syscall_64+0x106/0xf80 [ 355.442002][T10390] ? clear_bhb_loop+0x40/0x90 [ 355.442045][T10390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.442081][T10390] RIP: 0033:0x7f51e119c819 [ 355.442109][T10390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.442142][T10390] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 355.442175][T10390] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 355.442197][T10390] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 355.442218][T10390] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 355.442239][T10390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 355.442259][T10390] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 355.442312][T10390] [ 356.686619][T10412] openvswitch: netlink: IPv6 tunnel dst address is zero [ 357.609680][T10427] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 358.188500][T10442] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1093'. [ 358.792224][T10453] futex_wake_op: syz.0.1097 tries to shift op by -2048; fix this program [ 358.862964][T10453] futex_wake_op: syz.0.1097 tries to shift op by -2048; fix this program [ 359.106723][T10450] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 361.833806][ T30] audit: type=1800 audit(1775930899.817:13): pid=10539 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1119" name="nullb0" dev="tmpfs" ino=1059 res=0 errno=0 [ 363.555981][T10573] netlink: 186 bytes leftover after parsing attributes in process `syz.1.1124'. [ 363.625486][T10567] netlink: 186 bytes leftover after parsing attributes in process `syz.1.1124'. [ 364.817935][ T30] audit: type=1800 audit(1775930902.797:14): pid=10600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1133" name="members" dev="configfs" ino=34031 res=0 errno=0 [ 366.932675][T10638] NFSD: Failed to start, no listeners configured. [ 367.429930][T10649] FAULT_INJECTION: forcing a failure. [ 367.429930][T10649] name failslab, interval 1, probability 0, space 0, times 0 [ 367.674653][T10649] CPU: 0 UID: 0 PID: 10649 Comm: syz.1.1143 Not tainted syzkaller #0 PREEMPT(full) [ 367.674701][T10649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 367.674721][T10649] Call Trace: [ 367.674732][T10649] [ 367.674744][T10649] dump_stack_lvl+0x100/0x190 [ 367.674801][T10649] should_fail_ex.cold+0x5/0xa [ 367.674844][T10649] should_failslab+0xc2/0x120 [ 367.674883][T10649] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 367.674936][T10649] ? __kernfs_new_node+0xd2/0x960 [ 367.674994][T10649] __kernfs_new_node+0xd2/0x960 [ 367.675049][T10649] ? __pfx___kernfs_new_node+0x10/0x10 [ 367.675111][T10649] ? find_held_lock+0x2b/0x80 [ 367.675145][T10649] ? kernfs_root+0xee/0x2a0 [ 367.675193][T10649] ? kernfs_root+0xee/0x2a0 [ 367.675253][T10649] kernfs_new_node+0x11b/0x1a0 [ 367.675298][T10649] __kernfs_create_file+0x53/0x350 [ 367.675348][T10649] sysfs_add_file_mode_ns+0x207/0x3c0 [ 367.675413][T10649] sysfs_merge_group+0x194/0x340 [ 367.675472][T10649] ? __pfx_sysfs_merge_group+0x10/0x10 [ 367.675530][T10649] ? bus_add_device+0x368/0x6b0 [ 367.675569][T10649] ? __pfx_bus_add_device+0x10/0x10 [ 367.675616][T10649] ? __pfx_dev_add_physical_location+0x10/0x10 [ 367.675677][T10649] dpm_sysfs_add+0x237/0x280 [ 367.675725][T10649] device_add+0x9ef/0x1950 [ 367.675781][T10649] ? __pfx_device_add+0x10/0x10 [ 367.675827][T10649] ? lockdep_init_map_type+0x5c/0x250 [ 367.675876][T10649] ? __init_waitqueue_head+0xca/0x150 [ 367.675941][T10649] rfkill_register+0x1ad/0xb30 [ 367.675996][T10649] nfc_register_device+0x11f/0x3e0 [ 367.676036][T10649] nci_register_device+0x7f1/0xb80 [ 367.676089][T10649] ? __pfx_nci_register_device+0x10/0x10 [ 367.676147][T10649] ? lockdep_init_map_type+0x5c/0x250 [ 367.676202][T10649] virtual_ncidev_open+0x141/0x220 [ 367.676256][T10649] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 367.676294][T10649] misc_open+0x26d/0x450 [ 367.676328][T10649] ? __pfx_misc_open+0x10/0x10 [ 367.676359][T10649] chrdev_open+0x234/0x6a0 [ 367.676385][T10649] ? __pfx_apparmor_file_open+0x10/0x10 [ 367.676413][T10649] ? __pfx_chrdev_open+0x10/0x10 [ 367.676441][T10649] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 367.676476][T10649] do_dentry_open+0x6d8/0x1660 [ 367.676501][T10649] ? __pfx_chrdev_open+0x10/0x10 [ 367.676536][T10649] vfs_open+0x82/0x3f0 [ 367.676582][T10649] path_openat+0x208c/0x31a0 [ 367.676620][T10649] ? __pfx_path_openat+0x10/0x10 [ 367.676659][T10649] do_file_open+0x20e/0x430 [ 367.676689][T10649] ? __pfx_do_file_open+0x10/0x10 [ 367.676738][T10649] ? alloc_fd+0x476/0x790 [ 367.676767][T10649] ? do_getname+0x191/0x390 [ 367.676803][T10649] do_sys_openat2+0x10d/0x1e0 [ 367.676839][T10649] ? __pfx_do_sys_openat2+0x10/0x10 [ 367.676909][T10649] ? __fget_files+0x21f/0x3d0 [ 367.676954][T10649] __x64_sys_openat+0x12d/0x210 [ 367.677002][T10649] ? __pfx___x64_sys_openat+0x10/0x10 [ 367.677049][T10649] do_syscall_64+0x106/0xf80 [ 367.677074][T10649] ? clear_bhb_loop+0x40/0x90 [ 367.677105][T10649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.677130][T10649] RIP: 0033:0x7f51e119c819 [ 367.677150][T10649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.677174][T10649] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 367.677197][T10649] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 367.677213][T10649] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 367.677229][T10649] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 367.677244][T10649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 367.677258][T10649] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 367.677290][T10649] [ 369.481696][T10670] syz.0.1149(10670): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 369.565405][T10670] : entered promiscuous mode [ 372.548548][T10715] FAULT_INJECTION: forcing a failure. [ 372.548548][T10715] name failslab, interval 1, probability 0, space 0, times 0 [ 372.581400][T10715] CPU: 1 UID: 0 PID: 10715 Comm: syz.2.1159 Not tainted syzkaller #0 PREEMPT(full) [ 372.581444][T10715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 372.581465][T10715] Call Trace: [ 372.581476][T10715] [ 372.581490][T10715] dump_stack_lvl+0x100/0x190 [ 372.581551][T10715] should_fail_ex.cold+0x5/0xa [ 372.581593][T10715] should_failslab+0xc2/0x120 [ 372.581632][T10715] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 372.581695][T10715] ? __kernfs_new_node+0xd2/0x960 [ 372.581757][T10715] __kernfs_new_node+0xd2/0x960 [ 372.581808][T10715] ? kernfs_add_one+0x583/0x850 [ 372.581846][T10715] ? __pfx___kernfs_new_node+0x10/0x10 [ 372.581911][T10715] ? find_held_lock+0x2b/0x80 [ 372.581946][T10715] ? kernfs_root+0xee/0x2a0 [ 372.581996][T10715] ? kernfs_root+0xee/0x2a0 [ 372.582057][T10715] kernfs_new_node+0x11b/0x1a0 [ 372.582098][T10715] kernfs_create_dir_ns+0x4c/0x1a0 [ 372.582137][T10715] internal_create_group+0x36f/0xf40 [ 372.582200][T10715] ? bus_to_subsys+0x114/0x150 [ 372.582254][T10715] ? __pfx_internal_create_group+0x10/0x10 [ 372.582309][T10715] ? bus_add_device+0x368/0x6b0 [ 372.582344][T10715] ? __pfx_bus_add_device+0x10/0x10 [ 372.582374][T10715] ? __pfx_dev_add_physical_location+0x10/0x10 [ 372.582428][T10715] dpm_sysfs_add+0x80/0x280 [ 372.582474][T10715] device_add+0x9ef/0x1950 [ 372.582522][T10715] ? __pfx_device_add+0x10/0x10 [ 372.582567][T10715] ? lockdep_init_map_type+0x5c/0x250 [ 372.582628][T10715] ? __init_waitqueue_head+0xca/0x150 [ 372.582694][T10715] rfkill_register+0x1ad/0xb30 [ 372.582734][T10715] nfc_register_device+0x11f/0x3e0 [ 372.582763][T10715] nci_register_device+0x7f1/0xb80 [ 372.582801][T10715] ? __pfx_nci_register_device+0x10/0x10 [ 372.582842][T10715] ? lockdep_init_map_type+0x5c/0x250 [ 372.582881][T10715] virtual_ncidev_open+0x141/0x220 [ 372.582921][T10715] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 372.582959][T10715] misc_open+0x26d/0x450 [ 372.582991][T10715] ? __pfx_misc_open+0x10/0x10 [ 372.583022][T10715] chrdev_open+0x234/0x6a0 [ 372.583049][T10715] ? __pfx_apparmor_file_open+0x10/0x10 [ 372.583077][T10715] ? __pfx_chrdev_open+0x10/0x10 [ 372.583106][T10715] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 372.583141][T10715] do_dentry_open+0x6d8/0x1660 [ 372.583166][T10715] ? __pfx_chrdev_open+0x10/0x10 [ 372.583200][T10715] vfs_open+0x82/0x3f0 [ 372.583236][T10715] path_openat+0x208c/0x31a0 [ 372.583274][T10715] ? __pfx_path_openat+0x10/0x10 [ 372.583311][T10715] do_file_open+0x20e/0x430 [ 372.583341][T10715] ? __pfx_do_file_open+0x10/0x10 [ 372.583389][T10715] ? alloc_fd+0x476/0x790 [ 372.583418][T10715] ? do_getname+0x191/0x390 [ 372.583454][T10715] do_sys_openat2+0x10d/0x1e0 [ 372.583488][T10715] ? __pfx_do_sys_openat2+0x10/0x10 [ 372.583524][T10715] ? __fget_files+0x21f/0x3d0 [ 372.583555][T10715] __x64_sys_openat+0x12d/0x210 [ 372.583590][T10715] ? __pfx___x64_sys_openat+0x10/0x10 [ 372.583637][T10715] do_syscall_64+0x106/0xf80 [ 372.583669][T10715] ? clear_bhb_loop+0x40/0x90 [ 372.583699][T10715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.583724][T10715] RIP: 0033:0x7f97e3f9c819 [ 372.583744][T10715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 372.583768][T10715] RSP: 002b:00007f97e4e4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 372.583791][T10715] RAX: ffffffffffffffda RBX: 00007f97e4215fa0 RCX: 00007f97e3f9c819 [ 372.583808][T10715] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 372.583824][T10715] RBP: 00007f97e4032c91 R08: 0000000000000000 R09: 0000000000000000 [ 372.583840][T10715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 372.583854][T10715] R13: 00007f97e4216038 R14: 00007f97e4215fa0 R15: 00007ffda1cc5298 [ 372.583886][T10715] [ 375.804935][T10749] netlink: 'syz.2.1166': attribute type 11 has an invalid length. [ 378.020931][T10774] syz.1.1174 (10774): /proc/10771/oom_adj is deprecated, please use /proc/10771/oom_score_adj instead. [ 378.847239][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.853757][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.077691][T10821] FAULT_INJECTION: forcing a failure. [ 380.077691][T10821] name failslab, interval 1, probability 0, space 0, times 0 [ 380.097988][T10821] CPU: 1 UID: 0 PID: 10821 Comm: syz.2.1183 Not tainted syzkaller #0 PREEMPT(full) [ 380.098031][T10821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 380.098050][T10821] Call Trace: [ 380.098061][T10821] [ 380.098073][T10821] dump_stack_lvl+0x100/0x190 [ 380.098130][T10821] should_fail_ex.cold+0x5/0xa [ 380.098170][T10821] ? tomoyo_realpath_from_path+0xb6/0x690 [ 380.098219][T10821] should_failslab+0xc2/0x120 [ 380.098256][T10821] __kmalloc_noprof+0xe0/0x850 [ 380.098318][T10821] tomoyo_realpath_from_path+0xb6/0x690 [ 380.098377][T10821] tomoyo_path_number_perm+0x23c/0x580 [ 380.098418][T10821] ? tomoyo_path_number_perm+0x22e/0x580 [ 380.098463][T10821] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 380.098547][T10821] ? find_held_lock+0x2b/0x80 [ 380.098579][T10821] ? __fget_files+0x215/0x3d0 [ 380.098610][T10821] ? hook_file_ioctl_common+0x146/0x410 [ 380.098663][T10821] ? __fget_files+0x21f/0x3d0 [ 380.098703][T10821] security_file_ioctl+0xd3/0x230 [ 380.098747][T10821] __x64_sys_ioctl+0xb7/0x210 [ 380.098800][T10821] do_syscall_64+0x106/0xf80 [ 380.098835][T10821] ? clear_bhb_loop+0x40/0x90 [ 380.098888][T10821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.098920][T10821] RIP: 0033:0x7f97e3f9c819 [ 380.098972][T10821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.099004][T10821] RSP: 002b:00007f97e4e4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 380.099035][T10821] RAX: ffffffffffffffda RBX: 00007f97e4215fa0 RCX: 00007f97e3f9c819 [ 380.099056][T10821] RDX: 0000200000000180 RSI: 0000000000000707 RDI: 0000000000000007 [ 380.099077][T10821] RBP: 00007f97e4e4e090 R08: 0000000000000000 R09: 0000000000000000 [ 380.099097][T10821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 380.099117][T10821] R13: 00007f97e4216038 R14: 00007f97e4215fa0 R15: 00007ffda1cc5298 [ 380.099161][T10821] [ 380.099174][T10821] ERROR: Out of memory at tomoyo_realpath_from_path. [ 384.947590][ T30] audit: type=1800 audit(1775930922.927:15): pid=10931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1213" name="lu_gp_id" dev="configfs" ino=35645 res=0 errno=0 [ 384.950159][T10931] kstrtoul() returned -22 for lu_gp_id [ 385.236430][T10937] nbd: must specify an index to disconnect [ 385.362463][T10941] netlink: Setting conntrack mark requires 'commit' flag. [ 386.244339][T10952] netlink: 25 bytes leftover after parsing attributes in process `syz.1.1219'. [ 389.992275][T11031] smpboot: CPU 1 is now offline [ 390.613828][T11038] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 390.629590][T11038] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 390.660337][T11038] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 390.691325][T11038] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 391.037984][T11043] can: request_module (can-proto-5) failed. [ 392.433468][ T5838] Bluetooth: hci0: command 0x0c1a tx timeout [ 392.671392][ T5838] Bluetooth: hci2: command 0x0c1a tx timeout [ 392.677466][ T5838] Bluetooth: hci1: command 0x0c1a tx timeout [ 392.752075][ T5838] Bluetooth: hci3: command 0x0c1a tx timeout [ 393.511391][T11097] random: crng reseeded on system resumption [ 393.764446][T11098] delete_channel: no stack [ 394.213040][T11106] netlink: Setting conntrack mark requires 'commit' flag. [ 397.948864][T11171] netlink: 334 bytes leftover after parsing attributes in process `syz.3.1276'. [ 398.139536][T11175] vivid-007: ================= START STATUS ================= [ 398.180127][T11175] vivid-007: Generate PTS: true [ 398.214532][T11175] vivid-007: Generate SCR: true [ 398.219536][T11175] tpg source WxH: 320x240 (Y'CbCr) [ 398.317749][T11175] tpg field: 1 [ 398.339525][T11175] tpg crop: (0,0)/320x240 [ 398.410648][T11175] tpg compose: (0,0)/320x240 [ 398.453539][T11175] tpg colorspace: 8 [ 398.480342][T11175] tpg transfer function: 0/0 [ 398.519068][T11175] tpg Y'CbCr encoding: 0/0 [ 398.535747][T11175] tpg quantization: 0/0 [ 398.576403][T11175] tpg RGB range: 0/2 [ 398.631822][T11175] vivid-007: ================== END STATUS ================== [ 400.102075][T11214] random: crng reseeded on system resumption [ 405.288516][T11337] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1312'. [ 405.665222][T11342] FAULT_INJECTION: forcing a failure. [ 405.665222][T11342] name failslab, interval 1, probability 0, space 0, times 0 [ 405.730489][T11342] CPU: 0 UID: 0 PID: 11342 Comm: syz.1.1315 Not tainted syzkaller #0 PREEMPT(full) [ 405.730523][T11342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 405.730537][T11342] Call Trace: [ 405.730545][T11342] [ 405.730554][T11342] dump_stack_lvl+0x100/0x190 [ 405.730596][T11342] should_fail_ex.cold+0x5/0xa [ 405.730635][T11342] should_failslab+0xc2/0x120 [ 405.730663][T11342] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 405.730702][T11342] ? copy_utsname+0x1a8/0x690 [ 405.730740][T11342] ? copy_mnt_ns+0x106/0xc30 [ 405.730774][T11342] copy_utsname+0x1a8/0x690 [ 405.730815][T11342] create_new_namespaces+0x16a/0xac0 [ 405.730842][T11342] ? bpf_lsm_capable+0x9/0x10 [ 405.730869][T11342] ? security_capable+0x80/0x260 [ 405.730898][T11342] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 405.730928][T11342] ksys_unshare+0x473/0xad0 [ 405.730967][T11342] ? __pfx_ksys_unshare+0x10/0x10 [ 405.731010][T11342] __x64_sys_unshare+0x31/0x40 [ 405.731042][T11342] do_syscall_64+0x106/0xf80 [ 405.731068][T11342] ? clear_bhb_loop+0x40/0x90 [ 405.731098][T11342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.731123][T11342] RIP: 0033:0x7f51e119c819 [ 405.731142][T11342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.731166][T11342] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 405.731189][T11342] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 405.731205][T11342] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 405.731220][T11342] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 405.731235][T11342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 405.731249][T11342] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 405.731279][T11342] [ 406.473248][T11360] netlink: 'syz.3.1320': attribute type 1 has an invalid length. [ 406.679946][T11361] QAT: Device 0 not found [ 409.060320][T11403] FAULT_INJECTION: forcing a failure. [ 409.060320][T11403] name failslab, interval 1, probability 0, space 0, times 0 [ 409.121999][T11403] CPU: 0 UID: 0 PID: 11403 Comm: syz.1.1332 Not tainted syzkaller #0 PREEMPT(full) [ 409.122033][T11403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 409.122047][T11403] Call Trace: [ 409.122055][T11403] [ 409.122064][T11403] dump_stack_lvl+0x100/0x190 [ 409.122119][T11403] should_fail_ex.cold+0x5/0xa [ 409.122148][T11403] should_failslab+0xc2/0x120 [ 409.122174][T11403] __kmalloc_cache_noprof+0x7a/0x6f0 [ 409.122207][T11403] ? shrinker_alloc+0xf5/0xbc0 [ 409.122236][T11403] shrinker_alloc+0xf5/0xbc0 [ 409.122262][T11403] ? mark_held_locks+0x40/0x70 [ 409.122293][T11403] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 409.122318][T11403] ? rcu_is_watching+0x12/0xc0 [ 409.122357][T11403] ? __pfx_shrinker_alloc+0x10/0x10 [ 409.122385][T11403] ? lockdep_init_map_type+0x5c/0x250 [ 409.122417][T11403] ? lockdep_init_map_type+0x5c/0x250 [ 409.122484][T11403] ? __raw_spin_lock_init+0x3a/0x110 [ 409.122520][T11403] ? __init_rwsem+0x12d/0x1b0 [ 409.122558][T11403] alloc_super+0x7c7/0xd20 [ 409.122599][T11403] ? __pfx_mqueue_fill_super+0x10/0x10 [ 409.122621][T11403] sget_fc+0x117/0xc70 [ 409.122658][T11403] ? __pfx_set_anon_super_fc+0x10/0x10 [ 409.122696][T11403] ? __pfx_mqueue_fill_super+0x10/0x10 [ 409.122717][T11403] get_tree_nodev+0x28/0x190 [ 409.122742][T11403] mqueue_get_tree+0xf1/0x130 [ 409.122764][T11403] vfs_get_tree+0x92/0x320 [ 409.122798][T11403] fc_mount_longterm+0x1a/0x270 [ 409.122836][T11403] mq_init_ns+0x482/0x820 [ 409.122865][T11403] copy_ipcs+0x3dd/0x7e0 [ 409.122894][T11403] create_new_namespaces+0x20a/0xac0 [ 409.122920][T11403] ? security_capable+0x80/0x260 [ 409.122948][T11403] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 409.122977][T11403] ksys_unshare+0x473/0xad0 [ 409.123009][T11403] ? __pfx_ksys_unshare+0x10/0x10 [ 409.123051][T11403] __x64_sys_unshare+0x31/0x40 [ 409.123081][T11403] do_syscall_64+0x106/0xf80 [ 409.123105][T11403] ? clear_bhb_loop+0x40/0x90 [ 409.123134][T11403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.123158][T11403] RIP: 0033:0x7f51e119c819 [ 409.123177][T11403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.123200][T11403] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 409.123222][T11403] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 409.123237][T11403] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 409.123251][T11403] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 409.123266][T11403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.123279][T11403] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 409.123309][T11403] [ 409.809245][T11410] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1333'. [ 413.450472][T11478] netlink: 'syz.2.1348': attribute type 5 has an invalid length. [ 413.523283][T11478] netlink: 4158 bytes leftover after parsing attributes in process `syz.2.1348'. [ 417.914124][T11563] futex_wake_op: syz.0.1373 tries to shift op by -1; fix this program [ 418.374476][T11578] netlink: 'syz.0.1378': attribute type 1 has an invalid length. [ 421.206399][ T5838] Bluetooth: hci1: unexpected event 0x3e length: 726 > 260 [ 421.206431][ T5838] Bluetooth: hci1: unexpected subevent 0x0e length: 725 > 15 [ 421.222503][ T5838] Bluetooth: hci1: Unable to find connection for dst 00:a2:f2:94:be:c8 sid 0x4f [ 421.569734][T11644] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1393'. [ 421.601364][T11647] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1394'. [ 421.938199][T11655] capability: warning: `syz.0.1397' uses 32-bit capabilities (legacy support in use) [ 426.241923][T11743] futex_wake_op: syz.1.1420 tries to shift op by -2048; fix this program [ 428.530535][T11793] FAULT_INJECTION: forcing a failure. [ 428.530535][T11793] name failslab, interval 1, probability 0, space 0, times 0 [ 428.604236][T11793] CPU: 0 UID: 0 PID: 11793 Comm: syz.1.1435 Not tainted syzkaller #0 PREEMPT(full) [ 428.604269][T11793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 428.604285][T11793] Call Trace: [ 428.604293][T11793] [ 428.604302][T11793] dump_stack_lvl+0x100/0x190 [ 428.604344][T11793] should_fail_ex.cold+0x5/0xa [ 428.604374][T11793] should_failslab+0xc2/0x120 [ 428.604409][T11793] __kmalloc_cache_noprof+0x7a/0x6f0 [ 428.604444][T11793] ? shrinker_alloc+0xf5/0xbc0 [ 428.604475][T11793] shrinker_alloc+0xf5/0xbc0 [ 428.604502][T11793] ? mark_held_locks+0x40/0x70 [ 428.604540][T11793] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 428.604567][T11793] ? rcu_is_watching+0x12/0xc0 [ 428.604608][T11793] ? __pfx_shrinker_alloc+0x10/0x10 [ 428.604636][T11793] ? lockdep_init_map_type+0x5c/0x250 [ 428.604669][T11793] ? lockdep_init_map_type+0x5c/0x250 [ 428.604704][T11793] ? __raw_spin_lock_init+0x3a/0x110 [ 428.604742][T11793] ? __init_rwsem+0x12d/0x1b0 [ 428.604780][T11793] alloc_super+0x7c7/0xd20 [ 428.604822][T11793] ? __pfx_mqueue_fill_super+0x10/0x10 [ 428.604845][T11793] sget_fc+0x117/0xc70 [ 428.604884][T11793] ? __pfx_set_anon_super_fc+0x10/0x10 [ 428.604922][T11793] ? __pfx_mqueue_fill_super+0x10/0x10 [ 428.604945][T11793] get_tree_nodev+0x28/0x190 [ 428.604969][T11793] mqueue_get_tree+0xf1/0x130 [ 428.604992][T11793] vfs_get_tree+0x92/0x320 [ 428.605028][T11793] fc_mount_longterm+0x1a/0x270 [ 428.605068][T11793] mq_init_ns+0x482/0x820 [ 428.605098][T11793] copy_ipcs+0x3dd/0x7e0 [ 428.605128][T11793] create_new_namespaces+0x20a/0xac0 [ 428.605155][T11793] ? security_capable+0x80/0x260 [ 428.605183][T11793] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 428.605213][T11793] ksys_unshare+0x473/0xad0 [ 428.605251][T11793] ? __pfx_ksys_unshare+0x10/0x10 [ 428.605294][T11793] __x64_sys_unshare+0x31/0x40 [ 428.605326][T11793] do_syscall_64+0x106/0xf80 [ 428.605351][T11793] ? clear_bhb_loop+0x40/0x90 [ 428.605401][T11793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.605427][T11793] RIP: 0033:0x7f51e119c819 [ 428.605447][T11793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 428.605471][T11793] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 428.605494][T11793] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 428.605510][T11793] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 428.605525][T11793] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 428.605540][T11793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 428.605554][T11793] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 428.605592][T11793] [ 429.365902][T11805] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(18) [ 432.669734][T11858] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1449'. [ 433.114064][T11851] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 435.465869][T11907] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1460'. [ 438.404940][T11967] netlink: 148 bytes leftover after parsing attributes in process `syz.1.1474'. [ 439.932117][T11994] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1481'. [ 440.170093][T11999] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1482'. [ 440.222187][T11999] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 440.276465][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.282968][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.166949][T12025] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1490'. [ 442.917593][T12060] netlink: 326 bytes leftover after parsing attributes in process `syz.1.1499'. [ 443.505279][T12078] bond0: option resend_igmp: invalid value () [ 443.567506][T12078] bond0: option resend_igmp: allowed values 0 - 255 [ 445.329586][ T5838] Bluetooth: hci3: unexpected event 0x3e length: 508 > 260 [ 445.329622][ T5838] Bluetooth: hci3: unexpected subevent 0x02 length: 507 > 260 [ 445.345462][ T5838] Bluetooth: hci3: Dropping invalid advertising data [ 445.352541][ T5838] Bluetooth: hci3: unknown advertising packet type: 0xe9 [ 447.623487][T12178] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1527'. [ 448.418709][T12173] Process accounting resumed [ 449.500760][ T8735] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.330789][T12247] netlink: 314 bytes leftover after parsing attributes in process `syz.3.1543'. [ 451.271464][T12271] FAULT_INJECTION: forcing a failure. [ 451.271464][T12271] name failslab, interval 1, probability 0, space 0, times 0 [ 451.348682][T12271] CPU: 0 UID: 0 PID: 12271 Comm: syz.1.1547 Not tainted syzkaller #0 PREEMPT(full) [ 451.348715][T12271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 451.348730][T12271] Call Trace: [ 451.348738][T12271] [ 451.348748][T12271] dump_stack_lvl+0x100/0x190 [ 451.348790][T12271] should_fail_ex.cold+0x5/0xa [ 451.348819][T12271] should_failslab+0xc2/0x120 [ 451.348848][T12271] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 451.348887][T12271] ? __pmd_alloc+0xbf/0x950 [ 451.348924][T12271] __pmd_alloc+0xbf/0x950 [ 451.348952][T12271] ? mt_find+0x687/0x8e0 [ 451.348983][T12271] huge_pte_alloc+0x5ee/0x730 [ 451.349020][T12271] hugetlb_fault+0x363/0x1450 [ 451.349056][T12271] ? __pfx_hugetlb_fault+0x10/0x10 [ 451.349101][T12271] ? find_vma+0xbf/0x140 [ 451.349125][T12271] ? __pfx_find_vma+0x10/0x10 [ 451.349154][T12271] handle_mm_fault+0x5f1/0xa20 [ 451.349195][T12271] do_user_addr_fault+0x74c/0x12f0 [ 451.349229][T12271] exc_page_fault+0x6f/0xd0 [ 451.349256][T12271] asm_exc_page_fault+0x26/0x30 [ 451.349288][T12271] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 451.349325][T12271] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 451.349349][T12271] RSP: 0018:ffffc900055dfe48 EFLAGS: 00050212 [ 451.349368][T12271] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 451.349383][T12271] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc900055dfea0 [ 451.349398][T12271] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff52000abbfd5 [ 451.349413][T12271] R10: ffffc900055dfeaf R11: 0000000000000000 R12: 0000000000000000 [ 451.349427][T12271] R13: ffffc900055dfea0 R14: 0000000000000000 R15: 0000000000000000 [ 451.349458][T12271] _copy_from_user+0x98/0xd0 [ 451.349492][T12271] __x64_sys_setrlimit+0xc6/0x160 [ 451.349530][T12271] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 451.349574][T12271] do_syscall_64+0x106/0xf80 [ 451.349599][T12271] ? clear_bhb_loop+0x40/0x90 [ 451.349633][T12271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.349658][T12271] RIP: 0033:0x7f51e119c819 [ 451.349677][T12271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.349700][T12271] RSP: 002b:00007f51e20e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 451.349721][T12271] RAX: ffffffffffffffda RBX: 00007f51e1415fa0 RCX: 00007f51e119c819 [ 451.349737][T12271] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 451.349752][T12271] RBP: 00007f51e1232c91 R08: 0000000000000000 R09: 0000000000000000 [ 451.349767][T12271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 451.349781][T12271] R13: 00007f51e1416038 R14: 00007f51e1415fa0 R15: 00007ffd0ca34408 [ 451.349813][T12271] [ 452.942603][T12318] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1558'. [ 453.194704][T12318] veth0_macvtap: left promiscuous mode [ 453.215161][T12318] macvtap0: entered promiscuous mode [ 453.232841][T12318] macvtap0: entered allmulticast mode [ 454.504314][T12354] futex_wake_op: syz.0.1565 tries to shift op by -2048; fix this program [ 454.570481][T12354] futex_wake_op: syz.0.1565 tries to shift op by -2048; fix this program [ 455.491291][T12335] scsi_strcpy_devinfo: vendor string '/&c~n] | [ 455.491291][T12335] M' is too long [ 455.666210][T12335] scsi_strcpy_devinfo: model string 'Dd5 K2b [ 455.666210][T12335] W ' is too long [ 456.887962][T12376] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1573'. [ 459.081739][T12432] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1585'. [ 459.124600][T12432] bond0: entered promiscuous mode [ 459.156145][T12432] bond_slave_0: entered promiscuous mode [ 459.217240][T12432] bond_slave_1: entered promiscuous mode [ 459.846928][T12447] netlink: 504 bytes leftover after parsing attributes in process `syz.2.1587'. [ 460.057391][T12449] netlink: 334 bytes leftover after parsing attributes in process `syz.2.1588'. [ 473.734402][T12684] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 473.743969][T12684] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 473.751941][T12684] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 473.762188][T12684] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 473.769890][T12684] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 474.392458][T12683] chnl_net:caif_netlink_parms(): no params data found [ 474.791788][T12683] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.812907][T12683] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.820248][T12683] bridge_slave_0: entered allmulticast mode [ 474.871158][T12683] bridge_slave_0: entered promiscuous mode [ 474.893750][T12683] bridge0: port 2(bridge_slave_1) entered blocking state [ 474.930350][T12683] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.954169][T12683] bridge_slave_1: entered allmulticast mode [ 474.976599][T12683] bridge_slave_1: entered promiscuous mode [ 475.194252][T12683] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 475.234872][T12683] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 475.350612][T12683] team0: Port device team_slave_0 added [ 475.373191][T12683] team0: Port device team_slave_1 added [ 475.464598][T12683] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 475.493218][T12683] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.573275][T12683] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 475.614150][T12683] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 475.636721][T12683] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.730173][T12683] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 475.794265][T12684] Bluetooth: hci4: command tx timeout [ 475.893511][T12683] hsr_slave_0: entered promiscuous mode [ 475.900026][T12683] hsr_slave_1: entered promiscuous mode [ 475.941705][T12683] debugfs: 'hsr0' already exists in 'hsr' [ 475.960457][T12683] Cannot create hsr debugfs directory [ 476.655761][T12683] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 476.678775][T12683] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 476.705268][T12683] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 476.726892][T12683] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 477.095539][T12683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.146519][T12683] 8021q: adding VLAN 0 to HW filter on device team0 [ 477.165281][T12625] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.172579][T12625] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.228632][T12625] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.235841][T12625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.655327][T12683] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 477.874861][T12684] Bluetooth: hci4: command tx timeout [ 478.003144][T12683] veth0_vlan: entered promiscuous mode [ 478.049058][T12683] veth1_vlan: entered promiscuous mode [ 478.152038][T12683] veth0_macvtap: entered promiscuous mode [ 478.171804][T12683] veth1_macvtap: entered promiscuous mode [ 478.213790][T12683] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 478.243601][T12683] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 478.277327][ T9790] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.291594][ T9790] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.329359][ T9790] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.388428][ T9790] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.484180][ T9790] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.504796][ T9790] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.599140][T12624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.619729][T12624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 479.666126][T12768] bridge_slave_1: left allmulticast mode [ 479.690983][T12768] bridge_slave_1: left promiscuous mode [ 479.705187][T12768] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.954046][T12684] Bluetooth: hci4: command tx timeout [ 480.599445][T12781] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1659'. [ 482.031160][T12684] Bluetooth: hci4: command tx timeout [ 483.585380][ T5838] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 483.598165][ T5838] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 483.611265][ T5838] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 483.622963][ T5838] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 483.632079][ T5838] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 484.847402][T12838] chnl_net:caif_netlink_parms(): no params data found [ 485.052639][T12861] FAULT_INJECTION: forcing a failure. [ 485.052639][T12861] name failslab, interval 1, probability 0, space 0, times 0 [ 485.141101][T12861] CPU: 0 UID: 0 PID: 12861 Comm: syz.4.1672 Not tainted syzkaller #0 PREEMPT(full) [ 485.141134][T12861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 485.141149][T12861] Call Trace: [ 485.141156][T12861] [ 485.141165][T12861] dump_stack_lvl+0x100/0x190 [ 485.141207][T12861] should_fail_ex.cold+0x5/0xa [ 485.141235][T12861] ? lsm_blob_alloc+0x68/0x90 [ 485.141270][T12861] should_failslab+0xc2/0x120 [ 485.141297][T12861] __kmalloc_noprof+0xe0/0x850 [ 485.141335][T12861] ? down_write_nested+0x14f/0x200 [ 485.141376][T12861] lsm_blob_alloc+0x68/0x90 [ 485.141413][T12861] security_sb_alloc+0x25/0x240 [ 485.141439][T12861] alloc_super+0x24c/0xd20 [ 485.141480][T12861] ? __pfx_mqueue_fill_super+0x10/0x10 [ 485.141508][T12861] sget_fc+0x117/0xc70 [ 485.141546][T12861] ? __pfx_set_anon_super_fc+0x10/0x10 [ 485.141584][T12861] ? __pfx_mqueue_fill_super+0x10/0x10 [ 485.141606][T12861] get_tree_nodev+0x28/0x190 [ 485.141630][T12861] mqueue_get_tree+0xf1/0x130 [ 485.141653][T12861] vfs_get_tree+0x92/0x320 [ 485.141688][T12861] fc_mount_longterm+0x1a/0x270 [ 485.141726][T12861] mq_init_ns+0x482/0x820 [ 485.141755][T12861] copy_ipcs+0x3dd/0x7e0 [ 485.141785][T12861] create_new_namespaces+0x20a/0xac0 [ 485.141811][T12861] ? security_capable+0x80/0x260 [ 485.141838][T12861] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 485.141868][T12861] ksys_unshare+0x473/0xad0 [ 485.141901][T12861] ? __pfx_ksys_unshare+0x10/0x10 [ 485.141943][T12861] __x64_sys_unshare+0x31/0x40 [ 485.141973][T12861] do_syscall_64+0x106/0xf80 [ 485.141999][T12861] ? clear_bhb_loop+0x40/0x90 [ 485.142028][T12861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.142052][T12861] RIP: 0033:0x7faaeaf9c819 [ 485.142071][T12861] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.142094][T12861] RSP: 002b:00007faaebe37028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 485.142117][T12861] RAX: ffffffffffffffda RBX: 00007faaeb215fa0 RCX: 00007faaeaf9c819 [ 485.142132][T12861] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 485.142147][T12861] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 485.142161][T12861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 485.142175][T12861] R13: 00007faaeb216038 R14: 00007faaeb215fa0 R15: 00007ffdb433b798 [ 485.142205][T12861] [ 485.413362][T12865] netlink: 'syz.2.1673': attribute type 1 has an invalid length. [ 485.732840][ T5838] Bluetooth: hci5: command tx timeout [ 485.952575][T12838] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.971105][T12838] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.994529][T12838] bridge_slave_0: entered allmulticast mode [ 486.018163][T12838] bridge_slave_0: entered promiscuous mode [ 486.065055][T12838] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.141201][T12838] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.181154][T12838] bridge_slave_1: entered allmulticast mode [ 486.281160][T12838] bridge_slave_1: entered promiscuous mode [ 486.586704][T12838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 486.710414][T12838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 486.967165][T12838] team0: Port device team_slave_0 added [ 487.013397][T12838] team0: Port device team_slave_1 added [ 487.188647][T12838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 487.227099][T12838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.368702][T12838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 487.458959][T12838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 487.486308][T12838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.587048][T12927] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1681'. [ 487.609302][T12838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 487.791053][ T5838] Bluetooth: hci5: command tx timeout [ 488.001319][T12838] hsr_slave_0: entered promiscuous mode [ 488.028064][T12838] hsr_slave_1: entered promiscuous mode [ 488.053493][T12838] debugfs: 'hsr0' already exists in 'hsr' [ 488.059265][T12838] Cannot create hsr debugfs directory [ 489.325754][T12838] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 489.384943][T12838] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 489.436396][T12838] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 489.542751][T12838] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 489.642107][T12968] overlayfs: missing 'lowerdir' [ 489.871353][ T5838] Bluetooth: hci5: command tx timeout [ 489.933715][T12838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 490.006947][T12838] 8021q: adding VLAN 0 to HW filter on device team0 [ 490.076019][ T8730] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.083333][ T8730] bridge0: port 1(bridge_slave_0) entered forwarding state [ 490.144856][ T8730] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.152058][ T8730] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.999179][T12838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 491.055876][T12998] FAULT_INJECTION: forcing a failure. [ 491.055876][T12998] name failslab, interval 1, probability 0, space 0, times 0 [ 491.171015][T12998] CPU: 0 UID: 0 PID: 12998 Comm: syz.4.1694 Not tainted syzkaller #0 PREEMPT(full) [ 491.171048][T12998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 491.171063][T12998] Call Trace: [ 491.171070][T12998] [ 491.171082][T12998] dump_stack_lvl+0x100/0x190 [ 491.171123][T12998] should_fail_ex.cold+0x5/0xa [ 491.171152][T12998] should_failslab+0xc2/0x120 [ 491.171180][T12998] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 491.171236][T12998] ? __d_alloc+0x34/0xa80 [ 491.171262][T12998] ? raw_hash_sk+0x29f/0x5d0 [ 491.171293][T12998] ? raw_hash_sk+0x29f/0x5d0 [ 491.171341][T12998] __d_alloc+0x34/0xa80 [ 491.171371][T12998] d_alloc_pseudo+0x1c/0xc0 [ 491.171407][T12998] alloc_file_pseudo+0xcf/0x230 [ 491.171441][T12998] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 491.171473][T12998] ? alloc_fd+0x476/0x790 [ 491.171502][T12998] sock_alloc_file+0x50/0x210 [ 491.171528][T12998] __sys_socket+0x1c0/0x260 [ 491.171561][T12998] ? __pfx___sys_socket+0x10/0x10 [ 491.171601][T12998] __x64_sys_socket+0x72/0xb0 [ 491.171632][T12998] ? lockdep_hardirqs_on+0x78/0x100 [ 491.171657][T12998] do_syscall_64+0x106/0xf80 [ 491.171682][T12998] ? clear_bhb_loop+0x40/0x90 [ 491.171711][T12998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.171735][T12998] RIP: 0033:0x7faaeaf9c819 [ 491.171754][T12998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.171777][T12998] RSP: 002b:00007faaebe37028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 491.171799][T12998] RAX: ffffffffffffffda RBX: 00007faaeb215fa0 RCX: 00007faaeaf9c819 [ 491.171814][T12998] RDX: 000000000000000a RSI: 0000000000000003 RDI: 0000000000000002 [ 491.171828][T12998] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 491.171842][T12998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 491.171856][T12998] R13: 00007faaeb216038 R14: 00007faaeb215fa0 R15: 00007ffdb433b798 [ 491.171886][T12998] [ 491.971137][ T5838] Bluetooth: hci5: command tx timeout [ 492.058418][T13038] netlink: 330 bytes leftover after parsing attributes in process `syz.0.1700'. [ 492.473780][T12838] veth0_vlan: entered promiscuous mode [ 492.632686][T12838] veth1_vlan: entered promiscuous mode [ 492.785576][T13055] sctp: [Deprecated]: syz.0.1704 (pid 13055) Use of struct sctp_assoc_value in delayed_ack socket option. [ 492.785576][T13055] Use struct sctp_sack_info instead [ 492.813318][T13052] netlink: 'syz.2.1702': attribute type 27 has an invalid length. [ 492.836745][T13052] netlink: 334 bytes leftover after parsing attributes in process `syz.2.1702'. [ 492.907300][T12838] veth0_macvtap: entered promiscuous mode [ 492.972832][T12838] veth1_macvtap: entered promiscuous mode [ 493.067502][T12838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 493.116098][T12838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 493.164247][ T8736] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.198526][ T8736] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.252804][ T8736] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.318454][ T8736] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.455734][T12625] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 493.521531][T12625] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.635673][ T8735] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 493.674138][ T8735] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 494.127460][T13067] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 497.586451][T13134] bridge_slave_1: left allmulticast mode [ 497.607038][T13134] bridge_slave_1: left promiscuous mode [ 497.643842][T13134] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.750414][T13144] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1723'. [ 498.265640][T13152] Invalid ELF header magic: != ELF [ 499.396154][T13170] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1728'. [ 499.939747][T13194] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1732'. [ 501.194807][T13204] zswap: compressor not available [ 501.724642][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.731126][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.188974][T13252] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1745'. [ 506.403029][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1756'. [ 506.791299][T13313] netlink: 148 bytes leftover after parsing attributes in process `syz.2.1759'. [ 509.203222][ T5838] Bluetooth: hci4: unexpected event 0x03 length: 725 > 11 [ 509.861741][T13374] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1771'. [ 511.265914][T13361] Process accounting resumed [ 511.682681][T13407] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1776'. [ 511.742200][T13412] netlink: 13 bytes leftover after parsing attributes in process `syz.5.1776'. [ 512.996141][T13435] netlink: 346 bytes leftover after parsing attributes in process `syz.5.1779'. [ 514.131749][T13456] netlink: 74 bytes leftover after parsing attributes in process `syz.5.1787'. [ 514.385856][T13446] Process accounting resumed [ 517.239538][T13503] Process accounting resumed [ 518.301692][ T5838] Bluetooth: hci5: unexpected subevent 0x01 length: 123 > 18 [ 518.343125][ T30] audit: type=1800 audit(1775931056.327:16): pid=13544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1810" name="SYSV00000008" dev="hugetlbfs" ino=0 res=0 errno=0 [ 519.907396][T13572] FAULT_INJECTION: forcing a failure. [ 519.907396][T13572] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 519.957550][T13572] CPU: 0 UID: 7 PID: 13572 Comm: syz.4.1816 Not tainted syzkaller #0 PREEMPT(full) [ 519.957587][T13572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 519.957602][T13572] Call Trace: [ 519.957610][T13572] [ 519.957624][T13572] dump_stack_lvl+0x100/0x190 [ 519.957699][T13572] should_fail_ex.cold+0x5/0xa [ 519.957728][T13572] _copy_from_user+0x2e/0xd0 [ 519.957762][T13572] move_addr_to_kernel+0x65/0x170 [ 519.957797][T13572] __sys_sendto+0x1c9/0x4b0 [ 519.957836][T13572] ? __pfx___sys_sendto+0x10/0x10 [ 519.957873][T13572] ? proc_id_connector+0x2ed/0x650 [ 519.957920][T13572] ? find_held_lock+0x2b/0x80 [ 519.957956][T13572] ? xfd_validate_state+0x129/0x190 [ 519.958000][T13572] __x64_sys_sendto+0xe0/0x1c0 [ 519.958038][T13572] ? do_syscall_64+0x95/0xf80 [ 519.958064][T13572] ? lockdep_hardirqs_on+0x78/0x100 [ 519.958091][T13572] do_syscall_64+0x106/0xf80 [ 519.958115][T13572] ? clear_bhb_loop+0x40/0x90 [ 519.958146][T13572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.958171][T13572] RIP: 0033:0x7faaeaf5d04e [ 519.958191][T13572] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 519.958215][T13572] RSP: 002b:00007faaebe35e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 519.958238][T13572] RAX: ffffffffffffffda RBX: 00007faaebe376c0 RCX: 00007faaeaf5d04e [ 519.958254][T13572] RDX: 0000000000000020 RSI: 00007faaebe36000 RDI: 0000000000000003 [ 519.958269][T13572] RBP: 0000000000000000 R08: 00007faaebe35f04 R09: 000000000000000c [ 519.958283][T13572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 519.958298][T13572] R13: 00007faaebe35f58 R14: 00007faaebe36000 R15: 0000000000000000 [ 519.958328][T13572] [ 520.389765][T13580] FAULT_INJECTION: forcing a failure. [ 520.389765][T13580] name failslab, interval 1, probability 0, space 0, times 0 [ 520.411420][ T5838] Bluetooth: hci5: command 0x2016 tx timeout [ 520.429694][T13580] CPU: 0 UID: 0 PID: 13580 Comm: syz.4.1819 Not tainted syzkaller #0 PREEMPT(full) [ 520.429728][T13580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 520.429742][T13580] Call Trace: [ 520.429750][T13580] [ 520.429759][T13580] dump_stack_lvl+0x100/0x190 [ 520.429801][T13580] should_fail_ex.cold+0x5/0xa [ 520.429832][T13580] ? get_callchain_buffers+0x123/0x380 [ 520.429863][T13580] should_failslab+0xc2/0x120 [ 520.429890][T13580] __kmalloc_noprof+0xe0/0x850 [ 520.429928][T13580] ? rcu_is_cpu_rrupt_from_idle+0x210/0x270 [ 520.429981][T13580] get_callchain_buffers+0x123/0x380 [ 520.430013][T13580] ? bpf_lsm_capable+0x9/0x10 [ 520.430041][T13580] ? security_capable+0x80/0x260 [ 520.430067][T13580] stack_map_alloc+0x316/0x610 [ 520.430098][T13580] ? __pfx_stack_map_mem_usage+0x10/0x10 [ 520.430128][T13580] map_create+0x84e/0x2ba0 [ 520.430150][T13580] ? futex_unqueue+0x13d/0x2c0 [ 520.430182][T13580] ? __futex_wait+0x256/0x300 [ 520.430227][T13580] ? __pfx_map_create+0x10/0x10 [ 520.430251][T13580] ? __might_fault+0xc5/0x140 [ 520.430286][T13580] ? __might_fault+0xc5/0x140 [ 520.430334][T13580] __sys_bpf+0x2091/0x4b90 [ 520.430367][T13580] ? __pfx___sys_bpf+0x10/0x10 [ 520.430396][T13580] ? __pfx_futex_wait+0x10/0x10 [ 520.430451][T13580] ? do_futex+0x192/0x350 [ 520.430501][T13580] ? xfd_validate_state+0x129/0x190 [ 520.430545][T13580] __x64_sys_bpf+0x7b/0xc0 [ 520.430575][T13580] ? lockdep_hardirqs_on+0x78/0x100 [ 520.430601][T13580] do_syscall_64+0x106/0xf80 [ 520.430626][T13580] ? clear_bhb_loop+0x40/0x90 [ 520.430656][T13580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.430687][T13580] RIP: 0033:0x7faaeaf9c819 [ 520.430706][T13580] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.430730][T13580] RSP: 002b:00007faaebe37028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 520.430754][T13580] RAX: ffffffffffffffda RBX: 00007faaeb215fa0 RCX: 00007faaeaf9c819 [ 520.430770][T13580] RDX: 00000000000006f4 RSI: 0000200000000580 RDI: 0000000000000000 [ 520.430785][T13580] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 520.430800][T13580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 520.430820][T13580] R13: 00007faaeb216038 R14: 00007faaeb215fa0 R15: 00007ffdb433b798 [ 520.430851][T13580] [ 521.473586][T13600] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1823'. [ 521.726893][T13605] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1825'. [ 522.438825][ T5838] Bluetooth: hci5: command 0x2016 tx timeout [ 523.453757][T13628] FAULT_INJECTION: forcing a failure. [ 523.453757][T13628] name failslab, interval 1, probability 0, space 0, times 0 [ 523.679006][T13628] CPU: 0 UID: 0 PID: 13628 Comm: syz.4.1830 Not tainted syzkaller #0 PREEMPT(full) [ 523.679043][T13628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 523.679058][T13628] Call Trace: [ 523.679066][T13628] [ 523.679075][T13628] dump_stack_lvl+0x100/0x190 [ 523.679118][T13628] should_fail_ex.cold+0x5/0xa [ 523.679148][T13628] should_failslab+0xc2/0x120 [ 523.679176][T13628] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 523.679215][T13628] ? __pmd_alloc+0xbf/0x950 [ 523.679251][T13628] __pmd_alloc+0xbf/0x950 [ 523.679279][T13628] ? mt_find+0x687/0x8e0 [ 523.679310][T13628] huge_pte_alloc+0x5ee/0x730 [ 523.679346][T13628] hugetlb_fault+0x363/0x1450 [ 523.679383][T13628] ? __pfx_hugetlb_fault+0x10/0x10 [ 523.679436][T13628] ? find_vma+0xbf/0x140 [ 523.679461][T13628] ? __pfx_find_vma+0x10/0x10 [ 523.679489][T13628] handle_mm_fault+0x5f1/0xa20 [ 523.679531][T13628] do_user_addr_fault+0x74c/0x12f0 [ 523.679565][T13628] exc_page_fault+0x6f/0xd0 [ 523.679591][T13628] asm_exc_page_fault+0x26/0x30 [ 523.679615][T13628] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 523.679654][T13628] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 523.679678][T13628] RSP: 0018:ffffc90003c47e48 EFLAGS: 00050212 [ 523.679697][T13628] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 523.679712][T13628] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90003c47ea0 [ 523.679727][T13628] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff52000788fd5 [ 523.679742][T13628] R10: ffffc90003c47eaf R11: 0000000000000000 R12: 0000000000000000 [ 523.679756][T13628] R13: ffffc90003c47ea0 R14: 0000000000000000 R15: 0000000000000000 [ 523.679786][T13628] _copy_from_user+0x98/0xd0 [ 523.679820][T13628] __x64_sys_setrlimit+0xc6/0x160 [ 523.679859][T13628] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 523.679902][T13628] do_syscall_64+0x106/0xf80 [ 523.679928][T13628] ? clear_bhb_loop+0x40/0x90 [ 523.679957][T13628] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.679981][T13628] RIP: 0033:0x7faaeaf9c819 [ 523.680000][T13628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 523.680023][T13628] RSP: 002b:00007faaebe16028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 523.680045][T13628] RAX: ffffffffffffffda RBX: 00007faaeb216090 RCX: 00007faaeaf9c819 [ 523.680061][T13628] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 523.680075][T13628] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 523.680090][T13628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 523.680104][T13628] R13: 00007faaeb216128 R14: 00007faaeb216090 R15: 00007ffdb433b798 [ 523.680135][T13628] [ 524.569196][T13652] netlink: 266 bytes leftover after parsing attributes in process `syz.0.1836'. [ 524.601603][T13652] IPv6: NLM_F_CREATE should be specified when creating new route [ 525.261648][T13670] binder: 13668:13670 ioctl c0306201 0 returned -14 [ 527.801786][T13720] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1849'. [ 528.331464][T13711] Process accounting resumed [ 529.693501][T13754] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 530.410422][T13764] netlink: 148 bytes leftover after parsing attributes in process `syz.5.1860'. [ 531.999252][T12684] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 532.022798][T12684] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 532.031832][T12684] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 532.040714][T12684] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 532.056669][T12684] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 533.099519][T13771] Process accounting resumed [ 533.865863][T13823] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1869'. [ 533.895364][T13795] chnl_net:caif_netlink_parms(): no params data found [ 534.111119][T12684] Bluetooth: hci6: command tx timeout [ 534.320730][T13836] bridge_slave_1: left allmulticast mode [ 534.346337][T13836] bridge_slave_1: left promiscuous mode [ 534.376947][T13836] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.470000][T13838] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !PjE r҄y*"l-y– [ 534.845697][T13795] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.884076][T13795] bridge0: port 1(bridge_slave_0) entered disabled state [ 534.917198][T13795] bridge_slave_0: entered allmulticast mode [ 534.958379][T13795] bridge_slave_0: entered promiscuous mode [ 534.988856][T13795] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.027971][T13795] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.075624][T13795] bridge_slave_1: entered allmulticast mode [ 535.105659][T13795] bridge_slave_1: entered promiscuous mode [ 535.257485][T13795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 535.308856][T13795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 535.561925][T13795] team0: Port device team_slave_0 added [ 535.594269][T13795] team0: Port device team_slave_1 added [ 535.687385][T13795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 535.704206][T13795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 535.770492][T13795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 535.859677][T13795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 535.900855][T13795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 535.993937][T13795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 536.191057][T12684] Bluetooth: hci6: command tx timeout [ 536.266527][T13795] hsr_slave_0: entered promiscuous mode [ 536.289897][T13795] hsr_slave_1: entered promiscuous mode [ 536.315747][T13795] debugfs: 'hsr0' already exists in 'hsr' [ 536.335377][T13795] Cannot create hsr debugfs directory [ 537.620423][T13795] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 537.666168][T13886] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1880'. [ 537.723021][T13871] Process accounting resumed [ 537.754408][T13795] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 537.940673][T13795] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 538.051254][T13795] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 538.271500][T12684] Bluetooth: hci6: command tx timeout [ 538.814586][T13795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 538.914553][T13795] 8021q: adding VLAN 0 to HW filter on device team0 [ 539.033308][ T8739] bridge0: port 1(bridge_slave_0) entered blocking state [ 539.040486][ T8739] bridge0: port 1(bridge_slave_0) entered forwarding state [ 539.108862][ T8739] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.116061][ T8739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 539.349164][T13795] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 539.418073][T13795] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 539.636097][T13956] netlink: 146 bytes leftover after parsing attributes in process `syz.5.1888'. [ 540.279172][T13969] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 540.351611][T12684] Bluetooth: hci6: command tx timeout [ 540.438210][T13795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 541.680207][T13795] veth0_vlan: entered promiscuous mode [ 541.702586][T13998] bridge0: port 2(bond0) entered blocking state [ 541.721930][T13998] bridge0: port 2(bond0) entered disabled state [ 541.751122][T13998] bond0: entered allmulticast mode [ 541.757915][T13998] bond_slave_0: entered allmulticast mode [ 541.777207][T13998] bond_slave_1: entered allmulticast mode [ 541.820761][T13998] bond0: entered promiscuous mode [ 541.832747][T13998] bond_slave_0: entered promiscuous mode [ 541.853851][T13998] bond_slave_1: entered promiscuous mode [ 541.874835][T13998] bridge0: port 2(bond0) entered blocking state [ 541.881291][T13998] bridge0: port 2(bond0) entered forwarding state [ 541.974328][T13795] veth1_vlan: entered promiscuous mode [ 542.175397][T13795] veth0_macvtap: entered promiscuous mode [ 542.251948][T13795] veth1_macvtap: entered promiscuous mode [ 542.450321][T13795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.644711][T13795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.898292][ T8736] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.962998][ T8736] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.073877][ T8736] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.097525][ T8736] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.549859][ T8739] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.587662][ T8739] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.723260][ T8730] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.751976][ T8730] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.762727][T14022] FAULT_INJECTION: forcing a failure. [ 543.762727][T14022] name failslab, interval 1, probability 0, space 0, times 0 [ 543.941719][T14022] CPU: 0 UID: 0 PID: 14022 Comm: syz.4.1899 Not tainted syzkaller #0 PREEMPT(full) [ 543.941756][T14022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.941771][T14022] Call Trace: [ 543.941778][T14022] [ 543.941788][T14022] dump_stack_lvl+0x100/0x190 [ 543.941831][T14022] should_fail_ex.cold+0x5/0xa [ 543.941861][T14022] should_failslab+0xc2/0x120 [ 543.941888][T14022] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 543.941939][T14022] ? __pmd_alloc+0xbf/0x950 [ 543.941973][T14022] __pmd_alloc+0xbf/0x950 [ 543.942000][T14022] ? mt_find+0x687/0x8e0 [ 543.942030][T14022] huge_pte_alloc+0x5ee/0x730 [ 543.942065][T14022] hugetlb_fault+0x363/0x1450 [ 543.942100][T14022] ? __pfx_hugetlb_fault+0x10/0x10 [ 543.942166][T14022] ? find_vma+0xbf/0x140 [ 543.942190][T14022] ? __pfx_find_vma+0x10/0x10 [ 543.942218][T14022] handle_mm_fault+0x5f1/0xa20 [ 543.942258][T14022] do_user_addr_fault+0x74c/0x12f0 [ 543.942290][T14022] exc_page_fault+0x6f/0xd0 [ 543.942316][T14022] asm_exc_page_fault+0x26/0x30 [ 543.942339][T14022] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 543.942374][T14022] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 543.942404][T14022] RSP: 0018:ffffc90004b5fe48 EFLAGS: 00050212 [ 543.942423][T14022] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 543.942437][T14022] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90004b5fea0 [ 543.942452][T14022] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff5200096bfd5 [ 543.942466][T14022] R10: ffffc90004b5feaf R11: 0000000000000000 R12: 0000000000000000 [ 543.942481][T14022] R13: ffffc90004b5fea0 R14: 0000000000000000 R15: 0000000000000000 [ 543.942511][T14022] _copy_from_user+0x98/0xd0 [ 543.942544][T14022] __x64_sys_setrlimit+0xc6/0x160 [ 543.942600][T14022] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 543.942643][T14022] do_syscall_64+0x106/0xf80 [ 543.942669][T14022] ? clear_bhb_loop+0x40/0x90 [ 543.942711][T14022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.942735][T14022] RIP: 0033:0x7faaeaf9c819 [ 543.942753][T14022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.942775][T14022] RSP: 002b:00007faaebe16028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 543.942796][T14022] RAX: ffffffffffffffda RBX: 00007faaeb216090 RCX: 00007faaeaf9c819 [ 543.942811][T14022] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 543.942825][T14022] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 543.942838][T14022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 543.942852][T14022] R13: 00007faaeb216128 R14: 00007faaeb216090 R15: 00007ffdb433b798 [ 543.942882][T14022] [ 544.971160][T14040] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1862'. [ 545.636692][T14043] Process accounting resumed [ 545.903891][T14064] FAULT_INJECTION: forcing a failure. [ 545.903891][T14064] name failslab, interval 1, probability 0, space 0, times 0 [ 546.037788][T14064] CPU: 0 UID: 0 PID: 14064 Comm: syz.5.1906 Not tainted syzkaller #0 PREEMPT(full) [ 546.037820][T14064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 546.037834][T14064] Call Trace: [ 546.037842][T14064] [ 546.037851][T14064] dump_stack_lvl+0x100/0x190 [ 546.037892][T14064] should_fail_ex.cold+0x5/0xa [ 546.037921][T14064] should_failslab+0xc2/0x120 [ 546.037948][T14064] __kmalloc_cache_noprof+0x7a/0x6f0 [ 546.037982][T14064] ? shrinker_alloc+0xf5/0xbc0 [ 546.038010][T14064] shrinker_alloc+0xf5/0xbc0 [ 546.038037][T14064] ? mark_held_locks+0x40/0x70 [ 546.038068][T14064] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 546.038093][T14064] ? rcu_is_watching+0x12/0xc0 [ 546.038133][T14064] ? __pfx_shrinker_alloc+0x10/0x10 [ 546.038160][T14064] ? lockdep_init_map_type+0x5c/0x250 [ 546.038193][T14064] ? lockdep_init_map_type+0x5c/0x250 [ 546.038227][T14064] ? __raw_spin_lock_init+0x3a/0x110 [ 546.038269][T14064] ? __init_rwsem+0x12d/0x1b0 [ 546.038308][T14064] alloc_super+0x7c7/0xd20 [ 546.038350][T14064] ? __pfx_mqueue_fill_super+0x10/0x10 [ 546.038372][T14064] sget_fc+0x117/0xc70 [ 546.038410][T14064] ? __pfx_set_anon_super_fc+0x10/0x10 [ 546.038447][T14064] ? __pfx_mqueue_fill_super+0x10/0x10 [ 546.038469][T14064] get_tree_nodev+0x28/0x190 [ 546.038494][T14064] mqueue_get_tree+0xf1/0x130 [ 546.038517][T14064] vfs_get_tree+0x92/0x320 [ 546.038552][T14064] fc_mount_longterm+0x1a/0x270 [ 546.038591][T14064] mq_init_ns+0x482/0x820 [ 546.038620][T14064] copy_ipcs+0x3dd/0x7e0 [ 546.038649][T14064] create_new_namespaces+0x20a/0xac0 [ 546.038676][T14064] ? security_capable+0x80/0x260 [ 546.038703][T14064] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 546.038733][T14064] ksys_unshare+0x473/0xad0 [ 546.038765][T14064] ? __pfx_ksys_unshare+0x10/0x10 [ 546.038830][T14064] __x64_sys_unshare+0x31/0x40 [ 546.038862][T14064] do_syscall_64+0x106/0xf80 [ 546.038888][T14064] ? clear_bhb_loop+0x40/0x90 [ 546.038918][T14064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.038943][T14064] RIP: 0033:0x7f90d3b9c819 [ 546.038963][T14064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 546.038986][T14064] RSP: 002b:00007f90d49c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 546.039009][T14064] RAX: ffffffffffffffda RBX: 00007f90d3e15fa0 RCX: 00007f90d3b9c819 [ 546.039025][T14064] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 546.039040][T14064] RBP: 00007f90d3c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 546.039055][T14064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 546.039069][T14064] R13: 00007f90d3e16038 R14: 00007f90d3e15fa0 R15: 00007ffc90aa9f38 [ 546.039100][T14064] [ 546.319520][T14067] netlink: Conntrack attr has 5 unknown bytes [ 546.751509][T14084] FAULT_INJECTION: forcing a failure. [ 546.751509][T14084] name failslab, interval 1, probability 0, space 0, times 0 [ 546.765335][T14084] CPU: 0 UID: 0 PID: 14084 Comm: syz.5.1913 Not tainted syzkaller #0 PREEMPT(full) [ 546.765367][T14084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 546.765382][T14084] Call Trace: [ 546.765390][T14084] [ 546.765399][T14084] dump_stack_lvl+0x100/0x190 [ 546.765442][T14084] should_fail_ex.cold+0x5/0xa [ 546.765472][T14084] should_failslab+0xc2/0x120 [ 546.765500][T14084] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 546.765540][T14084] ? __pmd_alloc+0xbf/0x950 [ 546.765576][T14084] __pmd_alloc+0xbf/0x950 [ 546.765604][T14084] ? mt_find+0x687/0x8e0 [ 546.765634][T14084] huge_pte_alloc+0x5ee/0x730 [ 546.765671][T14084] hugetlb_fault+0x363/0x1450 [ 546.765708][T14084] ? __pfx_hugetlb_fault+0x10/0x10 [ 546.765752][T14084] ? find_vma+0xbf/0x140 [ 546.765777][T14084] ? __pfx_find_vma+0x10/0x10 [ 546.765806][T14084] handle_mm_fault+0x5f1/0xa20 [ 546.765848][T14084] do_user_addr_fault+0x74c/0x12f0 [ 546.765881][T14084] exc_page_fault+0x6f/0xd0 [ 546.765908][T14084] asm_exc_page_fault+0x26/0x30 [ 546.765932][T14084] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 546.765968][T14084] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 546.765992][T14084] RSP: 0018:ffffc90004ebfe48 EFLAGS: 00050212 [ 546.766012][T14084] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 546.766027][T14084] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90004ebfea0 [ 546.766042][T14084] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff520009d7fd5 [ 546.766057][T14084] R10: ffffc90004ebfeaf R11: 0000000000000000 R12: 0000000000000000 [ 546.766072][T14084] R13: ffffc90004ebfea0 R14: 0000000000000000 R15: 0000000000000000 [ 546.766102][T14084] _copy_from_user+0x98/0xd0 [ 546.766136][T14084] __x64_sys_setrlimit+0xc6/0x160 [ 546.766186][T14084] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 546.766228][T14084] do_syscall_64+0x106/0xf80 [ 546.766278][T14084] ? clear_bhb_loop+0x40/0x90 [ 546.766309][T14084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.766348][T14084] RIP: 0033:0x7f90d3b9c819 [ 546.766367][T14084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 546.766389][T14084] RSP: 002b:00007f90d49a4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 546.766410][T14084] RAX: ffffffffffffffda RBX: 00007f90d3e16090 RCX: 00007f90d3b9c819 [ 546.766426][T14084] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 546.766440][T14084] RBP: 00007f90d3c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 546.766454][T14084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 546.766468][T14084] R13: 00007f90d3e16128 R14: 00007f90d3e16090 R15: 00007ffc90aa9f38 [ 546.766498][T14084] [ 547.072756][T14090] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1909'. [ 548.856707][ T30] audit: type=1800 audit(1775931086.845:17): pid=14115 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1918" name="dbroot" dev="configfs" ino=55382 res=0 errno=0 [ 548.892298][T14115] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1918'. [ 549.009123][T14118] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1918'. [ 549.142951][T14128] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1919'. [ 549.195981][T14128] nbd: must specify a size in bytes for the device [ 549.412987][T14136] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 549.710253][T14144] netlink: 1324 bytes leftover after parsing attributes in process `syz.0.1924'. [ 550.462829][T14160] netlink: 346 bytes leftover after parsing attributes in process `syz.5.1928'. [ 550.960139][T12684] Bluetooth: hci6: unexpected subevent 0x0c length: 118 > 5 [ 551.745804][T14177] binder: BINDER_SET_CONTEXT_MGR already set [ 551.840377][T14177] binder: 14175:14177 ioctl 4018620d 2000000027c0 returned -16 [ 555.563050][T14239] bridge_slave_1: left allmulticast mode [ 555.596601][T14239] bridge_slave_1: left promiscuous mode [ 555.630134][T14239] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.643309][T14246] FAULT_INJECTION: forcing a failure. [ 555.643309][T14246] name failslab, interval 1, probability 0, space 0, times 0 [ 555.698964][T14246] CPU: 0 UID: 0 PID: 14246 Comm: syz.5.1950 Not tainted syzkaller #0 PREEMPT(full) [ 555.698996][T14246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 555.699010][T14246] Call Trace: [ 555.699018][T14246] [ 555.699027][T14246] dump_stack_lvl+0x100/0x190 [ 555.699068][T14246] should_fail_ex.cold+0x5/0xa [ 555.699098][T14246] should_failslab+0xc2/0x120 [ 555.699126][T14246] __kmalloc_cache_noprof+0x7a/0x6f0 [ 555.699160][T14246] ? mqueue_init_fs_context+0x4b/0x690 [ 555.699193][T14246] mqueue_init_fs_context+0x4b/0x690 [ 555.699223][T14246] alloc_fs_context+0x60c/0xf40 [ 555.699259][T14246] mq_init_ns+0x16e/0x820 [ 555.699288][T14246] copy_ipcs+0x3dd/0x7e0 [ 555.699319][T14246] create_new_namespaces+0x20a/0xac0 [ 555.699346][T14246] ? security_capable+0x80/0x260 [ 555.699375][T14246] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 555.699405][T14246] ksys_unshare+0x473/0xad0 [ 555.699443][T14246] ? __pfx_ksys_unshare+0x10/0x10 [ 555.699486][T14246] __x64_sys_unshare+0x31/0x40 [ 555.699518][T14246] do_syscall_64+0x106/0xf80 [ 555.699544][T14246] ? clear_bhb_loop+0x40/0x90 [ 555.699574][T14246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.699598][T14246] RIP: 0033:0x7f90d3b9c819 [ 555.699618][T14246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.699642][T14246] RSP: 002b:00007f90d49c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 555.699666][T14246] RAX: ffffffffffffffda RBX: 00007f90d3e15fa0 RCX: 00007f90d3b9c819 [ 555.699682][T14246] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 555.699697][T14246] RBP: 00007f90d3c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 555.699712][T14246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 555.699726][T14246] R13: 00007f90d3e16038 R14: 00007f90d3e15fa0 R15: 00007ffc90aa9f38 [ 555.699756][T14246] [ 557.408742][T14277] queue_state_write: unsupported operation '' [ 557.479219][T14277] queue_state_write: use 'run', 'start' or 'kick' [ 558.702186][T14295] FAULT_INJECTION: forcing a failure. [ 558.702186][T14295] name failslab, interval 1, probability 0, space 0, times 0 [ 558.954598][T14295] CPU: 0 UID: 0 PID: 14295 Comm: syz.4.1963 Not tainted syzkaller #0 PREEMPT(full) [ 558.954631][T14295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 558.954645][T14295] Call Trace: [ 558.954654][T14295] [ 558.954663][T14295] dump_stack_lvl+0x100/0x190 [ 558.954705][T14295] should_fail_ex.cold+0x5/0xa [ 558.954735][T14295] should_failslab+0xc2/0x120 [ 558.954764][T14295] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 558.954807][T14295] ? __pmd_alloc+0xbf/0x950 [ 558.954844][T14295] __pmd_alloc+0xbf/0x950 [ 558.954873][T14295] ? mt_find+0x687/0x8e0 [ 558.954903][T14295] huge_pte_alloc+0x5ee/0x730 [ 558.954939][T14295] hugetlb_fault+0x363/0x1450 [ 558.954976][T14295] ? __pfx_hugetlb_fault+0x10/0x10 [ 558.955020][T14295] ? find_vma+0xbf/0x140 [ 558.955045][T14295] ? __pfx_find_vma+0x10/0x10 [ 558.955074][T14295] handle_mm_fault+0x5f1/0xa20 [ 558.955116][T14295] do_user_addr_fault+0x74c/0x12f0 [ 558.955149][T14295] exc_page_fault+0x6f/0xd0 [ 558.955175][T14295] asm_exc_page_fault+0x26/0x30 [ 558.955200][T14295] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 558.955237][T14295] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 558.955261][T14295] RSP: 0018:ffffc90005cdfe48 EFLAGS: 00050212 [ 558.955281][T14295] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 558.955295][T14295] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90005cdfea0 [ 558.955310][T14295] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff52000b9bfd5 [ 558.955325][T14295] R10: ffffc90005cdfeaf R11: 0000000000000000 R12: 0000000000000000 [ 558.955340][T14295] R13: ffffc90005cdfea0 R14: 0000000000000000 R15: 0000000000000000 [ 558.955370][T14295] _copy_from_user+0x98/0xd0 [ 558.955426][T14295] __x64_sys_setrlimit+0xc6/0x160 [ 558.955464][T14295] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 558.955507][T14295] do_syscall_64+0x106/0xf80 [ 558.955532][T14295] ? clear_bhb_loop+0x40/0x90 [ 558.955562][T14295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.955586][T14295] RIP: 0033:0x7faaeaf9c819 [ 558.955610][T14295] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.955633][T14295] RSP: 002b:00007faaebe16028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 558.955655][T14295] RAX: ffffffffffffffda RBX: 00007faaeb216090 RCX: 00007faaeaf9c819 [ 558.955671][T14295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 558.955686][T14295] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 558.955701][T14295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 558.955716][T14295] R13: 00007faaeb216128 R14: 00007faaeb216090 R15: 00007ffdb433b798 [ 558.955748][T14295] [ 559.424433][T14318] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1970'. [ 560.559068][T14315] Process accounting resumed [ 560.846834][T14348] mkiss: ax0: crc mode is auto. [ 562.052912][T14370] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 562.100124][T14370] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 562.122388][T14370] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 562.143096][T14370] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 562.190132][T14370] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 562.240860][T14370] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 562.305806][T14370] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 562.328403][T14370] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 562.344842][T14370] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 562.364150][T14370] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 562.385028][T14370] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 562.407679][T14370] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 562.440267][T14370] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 563.156408][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.162852][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.583509][T14388] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1986'. [ 563.651827][T14388] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 563.680210][T14388] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 563.734532][T14388] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 563.765785][T14388] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 564.111986][T12684] Bluetooth: hci1: command 0x0c1a tx timeout [ 564.118270][T12684] Bluetooth: hci0: command 0x0c1a tx timeout [ 564.191622][T12684] Bluetooth: hci4: command 0x0c1a tx timeout [ 564.197707][ T5838] Bluetooth: hci3: command 0x0c1a tx timeout [ 564.206000][ T5838] Bluetooth: hci2: command 0x0c1a tx timeout [ 564.280212][T14381] Process accounting paused [ 564.362534][T14401] Bluetooth: hci5: command 0x2016 tx timeout [ 564.431725][T14401] Bluetooth: hci6: command 0x0c1a tx timeout [ 565.070183][ T30] audit: type=1804 audit(1775931103.055:18): pid=14407 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.1991" name="/newroot/sys/kernel/debug/tracing/set_event_notrace_pid" dev="tracefs" ino=1065 res=1 errno=0 [ 566.274297][T14401] Bluetooth: hci4: command 0x0c1a tx timeout [ 566.431628][T14401] Bluetooth: hci5: command 0x2016 tx timeout [ 566.512116][T14401] Bluetooth: hci6: command 0x0c1a tx timeout [ 567.441639][T14401] Bluetooth: hci6: Malformed Event: 0x02 [ 568.351164][T14401] Bluetooth: hci4: command 0x0c1a tx timeout [ 568.512089][T14401] Bluetooth: hci5: command 0x2016 tx timeout [ 568.594845][T14401] Bluetooth: hci6: command 0x0c1a tx timeout [ 569.037074][T14502] FAULT_INJECTION: forcing a failure. [ 569.037074][T14502] name failslab, interval 1, probability 0, space 0, times 0 [ 569.186625][T14502] CPU: 0 UID: 0 PID: 14502 Comm: syz.6.2012 Not tainted syzkaller #0 PREEMPT(full) [ 569.186658][T14502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 569.186672][T14502] Call Trace: [ 569.186679][T14502] [ 569.186688][T14502] dump_stack_lvl+0x100/0x190 [ 569.186729][T14502] should_fail_ex.cold+0x5/0xa [ 569.186757][T14502] should_failslab+0xc2/0x120 [ 569.186785][T14502] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 569.186822][T14502] ? copy_net_ns+0xe8/0x7c0 [ 569.186855][T14502] copy_net_ns+0xe8/0x7c0 [ 569.186881][T14502] ? copy_cgroup_ns+0x71/0x970 [ 569.186912][T14502] create_new_namespaces+0x3ea/0xac0 [ 569.186945][T14502] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 569.186975][T14502] ksys_unshare+0x473/0xad0 [ 569.187008][T14502] ? __pfx_ksys_unshare+0x10/0x10 [ 569.187079][T14502] __x64_sys_unshare+0x31/0x40 [ 569.187111][T14502] do_syscall_64+0x106/0xf80 [ 569.187137][T14502] ? clear_bhb_loop+0x40/0x90 [ 569.187167][T14502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.187192][T14502] RIP: 0033:0x7fe215f9c819 [ 569.187212][T14502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.187236][T14502] RSP: 002b:00007fe216e05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 569.187258][T14502] RAX: ffffffffffffffda RBX: 00007fe216215fa0 RCX: 00007fe215f9c819 [ 569.187274][T14502] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 569.187289][T14502] RBP: 00007fe216032c91 R08: 0000000000000000 R09: 0000000000000000 [ 569.187304][T14502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 569.187318][T14502] R13: 00007fe216216038 R14: 00007fe216215fa0 R15: 00007ffd097ad288 [ 569.187349][T14502] [ 570.338097][T14509] netlink: 342 bytes leftover after parsing attributes in process `syz.6.2014'. [ 570.858015][T14401] Bluetooth: hci2: unexpected event 0x1c length: 725 > 5 [ 572.071097][T14539] FAULT_INJECTION: forcing a failure. [ 572.071097][T14539] name failslab, interval 1, probability 0, space 0, times 0 [ 572.333029][T14539] CPU: 0 UID: 0 PID: 14539 Comm: syz.6.2023 Not tainted syzkaller #0 PREEMPT(full) [ 572.333062][T14539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 572.333078][T14539] Call Trace: [ 572.333085][T14539] [ 572.333094][T14539] dump_stack_lvl+0x100/0x190 [ 572.333137][T14539] should_fail_ex.cold+0x5/0xa [ 572.333167][T14539] should_failslab+0xc2/0x120 [ 572.333195][T14539] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 572.333234][T14539] ? __pmd_alloc+0xbf/0x950 [ 572.333270][T14539] __pmd_alloc+0xbf/0x950 [ 572.333298][T14539] ? mt_find+0x687/0x8e0 [ 572.333329][T14539] huge_pte_alloc+0x5ee/0x730 [ 572.333365][T14539] hugetlb_fault+0x363/0x1450 [ 572.333402][T14539] ? __pfx_hugetlb_fault+0x10/0x10 [ 572.333446][T14539] ? find_vma+0xbf/0x140 [ 572.333471][T14539] ? __pfx_find_vma+0x10/0x10 [ 572.333500][T14539] handle_mm_fault+0x5f1/0xa20 [ 572.333542][T14539] do_user_addr_fault+0x74c/0x12f0 [ 572.333575][T14539] exc_page_fault+0x6f/0xd0 [ 572.333602][T14539] asm_exc_page_fault+0x26/0x30 [ 572.333626][T14539] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 572.333662][T14539] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 572.333714][T14539] RSP: 0018:ffffc900058bfe48 EFLAGS: 00050212 [ 572.333733][T14539] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 572.333748][T14539] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc900058bfea0 [ 572.333768][T14539] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff52000b17fd5 [ 572.333783][T14539] R10: ffffc900058bfeaf R11: 0000000000000000 R12: 0000000000000000 [ 572.333798][T14539] R13: ffffc900058bfea0 R14: 0000000000000000 R15: 0000000000000000 [ 572.333829][T14539] _copy_from_user+0x98/0xd0 [ 572.333863][T14539] __x64_sys_setrlimit+0xc6/0x160 [ 572.333901][T14539] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 572.333950][T14539] do_syscall_64+0x106/0xf80 [ 572.333976][T14539] ? clear_bhb_loop+0x40/0x90 [ 572.334007][T14539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.334032][T14539] RIP: 0033:0x7fe215f9c819 [ 572.334054][T14539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 572.334078][T14539] RSP: 002b:00007fe216de4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 572.334099][T14539] RAX: ffffffffffffffda RBX: 00007fe216216090 RCX: 00007fe215f9c819 [ 572.334115][T14539] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 572.334129][T14539] RBP: 00007fe216032c91 R08: 0000000000000000 R09: 0000000000000000 [ 572.334144][T14539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 572.334158][T14539] R13: 00007fe216216128 R14: 00007fe216216090 R15: 00007ffd097ad288 [ 572.334190][T14539] [ 573.809720][T14571] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2029'. [ 573.853196][T14571] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 573.892560][T14571] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 573.956171][T14571] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 574.048164][T14571] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 576.004335][T14589] kexec: Could not allocate control_code_buffer [ 577.038793][T14604] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 577.054046][T14604] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 577.066880][T14604] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 577.086333][T14604] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 577.099235][T14604] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 577.114803][T14604] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 577.131206][T14604] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 577.170317][ T51] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 577.180624][ T51] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 577.189775][ T51] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 577.201045][ T51] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 577.210173][ T51] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 577.966060][T14614] chnl_net:caif_netlink_parms(): no params data found [ 578.351439][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 578.488331][T14614] bridge0: port 1(bridge_slave_0) entered blocking state [ 578.520362][T14614] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.559118][T14614] bridge_slave_0: entered allmulticast mode [ 578.596059][T14614] bridge_slave_0: entered promiscuous mode [ 578.815250][T14614] bridge0: port 2(bridge_slave_1) entered blocking state [ 578.846824][T14614] bridge0: port 2(bridge_slave_1) entered disabled state [ 578.900363][T14614] bridge_slave_1: entered allmulticast mode [ 578.933720][T14614] bridge_slave_1: entered promiscuous mode [ 579.075432][ T51] Bluetooth: hci2: command 0x0c1a tx timeout [ 579.082008][T14401] Bluetooth: hci1: command 0x0c1a tx timeout [ 579.147844][T14614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 579.159513][ T51] Bluetooth: hci6: command 0x0c1a tx timeout [ 579.166966][T14401] Bluetooth: hci5: command 0x2016 tx timeout [ 579.173075][ T5838] Bluetooth: hci4: command 0x0c1a tx timeout [ 579.179082][ T5838] Bluetooth: hci3: command 0x0c1a tx timeout [ 579.231407][T14654] Bluetooth: hci7: command tx timeout [ 579.376844][T14614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 579.628396][T14614] team0: Port device team_slave_0 added [ 579.678163][T14614] team0: Port device team_slave_1 added [ 579.865010][T14614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 579.934174][T14614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.134066][T14614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 580.212676][T14614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 580.235276][T14614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.360484][T14614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 580.793336][T14614] hsr_slave_0: entered promiscuous mode [ 580.808385][T14614] hsr_slave_1: entered promiscuous mode [ 580.823197][T14614] debugfs: 'hsr0' already exists in 'hsr' [ 580.834586][T14614] Cannot create hsr debugfs directory [ 581.312829][T14654] Bluetooth: hci7: command tx timeout [ 581.764361][T14680] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2053'. [ 581.805537][T14680] netlink: 'syz.6.2053': attribute type 1 has an invalid length. [ 581.898885][T14680] netlink: 13 bytes leftover after parsing attributes in process `syz.6.2053'. [ 581.925484][T14614] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 582.044025][T14614] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 582.171696][T14614] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 582.288919][T14614] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 582.461285][T14699] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2055'. [ 582.777285][T14688] FAULT_INJECTION: forcing a failure. [ 582.777285][T14688] name failslab, interval 1, probability 0, space 0, times 0 [ 582.816998][T14614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 582.897534][T14614] 8021q: adding VLAN 0 to HW filter on device team0 [ 582.942368][T14688] CPU: 0 UID: 0 PID: 14688 Comm: syz.6.2054 Not tainted syzkaller #0 PREEMPT(full) [ 582.942399][T14688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 582.942414][T14688] Call Trace: [ 582.942422][T14688] [ 582.942431][T14688] dump_stack_lvl+0x100/0x190 [ 582.942473][T14688] should_fail_ex.cold+0x5/0xa [ 582.942503][T14688] should_failslab+0xc2/0x120 [ 582.942532][T14688] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 582.942571][T14688] ? __anon_vma_prepare+0x344/0x5e0 [ 582.942613][T14688] __anon_vma_prepare+0x344/0x5e0 [ 582.942647][T14688] ? __filemap_get_folio_mpol+0x3ba/0xe70 [ 582.942676][T14688] __vmf_anon_prepare+0x11f/0x250 [ 582.942708][T14688] hugetlb_no_page+0xe28/0x1970 [ 582.942751][T14688] hugetlb_fault+0x5df/0x1450 [ 582.942788][T14688] ? __pfx_hugetlb_fault+0x10/0x10 [ 582.942832][T14688] ? find_vma+0xbf/0x140 [ 582.942857][T14688] ? __pfx_find_vma+0x10/0x10 [ 582.942886][T14688] handle_mm_fault+0x5f1/0xa20 [ 582.942927][T14688] do_user_addr_fault+0x74c/0x12f0 [ 582.942961][T14688] exc_page_fault+0x6f/0xd0 [ 582.942988][T14688] asm_exc_page_fault+0x26/0x30 [ 582.943013][T14688] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 582.943049][T14688] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 fd 93 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 582.943073][T14688] RSP: 0018:ffffc90004fefe48 EFLAGS: 00050212 [ 582.943092][T14688] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000010 [ 582.943107][T14688] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc90004fefea0 [ 582.943122][T14688] RBP: 0000000000000010 R08: 0000000000000001 R09: fffff520009fdfd5 [ 582.943137][T14688] R10: ffffc90004fefeaf R11: 0000000000000000 R12: 0000000000000000 [ 582.943151][T14688] R13: ffffc90004fefea0 R14: 0000000000000000 R15: 0000000000000000 [ 582.943181][T14688] _copy_from_user+0x98/0xd0 [ 582.943227][T14688] __x64_sys_setrlimit+0xc6/0x160 [ 582.943263][T14688] ? __pfx___x64_sys_setrlimit+0x10/0x10 [ 582.943305][T14688] do_syscall_64+0x106/0xf80 [ 582.943329][T14688] ? clear_bhb_loop+0x40/0x90 [ 582.943364][T14688] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.943388][T14688] RIP: 0033:0x7fe215f9c819 [ 582.943407][T14688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.943429][T14688] RSP: 002b:00007fe216de4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a0 [ 582.943450][T14688] RAX: ffffffffffffffda RBX: 00007fe216216090 RCX: 00007fe215f9c819 [ 582.943465][T14688] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 [ 582.943479][T14688] RBP: 00007fe216032c91 R08: 0000000000000000 R09: 0000000000000000 [ 582.943493][T14688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 582.943507][T14688] R13: 00007fe216216128 R14: 00007fe216216090 R15: 00007ffd097ad288 [ 582.943537][T14688] [ 582.949461][ T8735] bridge0: port 1(bridge_slave_0) entered blocking state [ 583.242953][ T8735] bridge0: port 1(bridge_slave_0) entered forwarding state [ 583.397811][T14654] Bluetooth: hci7: command tx timeout [ 583.969352][ T8735] bridge0: port 2(bridge_slave_1) entered blocking state [ 583.976584][ T8735] bridge0: port 2(bridge_slave_1) entered forwarding state [ 584.632070][T14734] ovs_: entered promiscuous mode [ 585.352751][T14614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 585.472500][T14654] Bluetooth: hci7: command tx timeout [ 585.860076][T14752] netlink: 206 bytes leftover after parsing attributes in process `syz.4.2065'. Ijn9_UVQ[ 586.457538][T14614] veth0_vlan: entered promiscuous mode [ 586.535924][T14614] veth1_vlan: entered promiscuous mode [ 586.818671][T14614] veth0_macvtap: entered promiscuous mode [ 586.877817][T14614] veth1_macvtap: entered promiscuous mode [ 587.283314][T14614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.363659][T14614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.449451][ T8735] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.481244][T14786] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2072'. [ 587.490229][ T8735] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.649344][ T8735] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.725199][ T8735] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.232158][ T8736] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.291750][ T8736] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.504714][T12625] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.504737][T12625] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.021399][T14817] FAULT_INJECTION: forcing a failure. [ 589.021399][T14817] name failslab, interval 1, probability 0, space 0, times 0 [ 589.093370][T14817] CPU: 0 UID: 0 PID: 14817 Comm: syz.7.2037 Not tainted syzkaller #0 PREEMPT(full) [ 589.093403][T14817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 589.093417][T14817] Call Trace: [ 589.093426][T14817] [ 589.093435][T14817] dump_stack_lvl+0x100/0x190 [ 589.093478][T14817] should_fail_ex.cold+0x5/0xa [ 589.093507][T14817] should_failslab+0xc2/0x120 [ 589.093535][T14817] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 589.093573][T14817] ? copy_net_ns+0xe8/0x7c0 [ 589.093607][T14817] copy_net_ns+0xe8/0x7c0 [ 589.093634][T14817] ? copy_cgroup_ns+0x71/0x970 [ 589.093666][T14817] create_new_namespaces+0x3ea/0xac0 [ 589.093701][T14817] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 589.093731][T14817] ksys_unshare+0x473/0xad0 [ 589.093765][T14817] ? __pfx_ksys_unshare+0x10/0x10 [ 589.093808][T14817] __x64_sys_unshare+0x31/0x40 [ 589.093839][T14817] do_syscall_64+0x106/0xf80 [ 589.093865][T14817] ? clear_bhb_loop+0x40/0x90 [ 589.093894][T14817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.093920][T14817] RIP: 0033:0x7f7d0919c819 [ 589.093939][T14817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.093963][T14817] RSP: 002b:00007f7d09fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 589.093995][T14817] RAX: ffffffffffffffda RBX: 00007f7d09415fa0 RCX: 00007f7d0919c819 [ 589.094011][T14817] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 589.094026][T14817] RBP: 00007f7d09232c91 R08: 0000000000000000 R09: 0000000000000000 [ 589.094041][T14817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 589.094055][T14817] R13: 00007f7d09416038 R14: 00007f7d09415fa0 R15: 00007ffec4422068 [ 589.094086][T14817] [ 589.814908][T14831] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 590.372303][T14842] netlink: 334 bytes leftover after parsing attributes in process `syz.0.2084'. [ 592.370786][T14873] ovs_: entered promiscuous mode [ 593.174185][T14892] netlink: 148 bytes leftover after parsing attributes in process `syz.6.2095'. [ 597.510443][T14938] Process accounting resumed [ 597.783215][T14959] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 598.455403][T14979] FAULT_INJECTION: forcing a failure. [ 598.455403][T14979] name failslab, interval 1, probability 0, space 0, times 0 [ 598.536790][T14979] CPU: 0 UID: 0 PID: 14979 Comm: syz.7.2111 Not tainted syzkaller #0 PREEMPT(full) [ 598.536823][T14979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 598.536838][T14979] Call Trace: [ 598.536845][T14979] [ 598.536854][T14979] dump_stack_lvl+0x100/0x190 [ 598.536896][T14979] should_fail_ex.cold+0x5/0xa [ 598.536926][T14979] should_failslab+0xc2/0x120 [ 598.536954][T14979] __kmalloc_cache_noprof+0x7a/0x6f0 [ 598.536988][T14979] ? shrinker_alloc+0xf5/0xbc0 [ 598.537019][T14979] shrinker_alloc+0xf5/0xbc0 [ 598.537046][T14979] ? mark_held_locks+0x40/0x70 [ 598.537079][T14979] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 598.537105][T14979] ? rcu_is_watching+0x12/0xc0 [ 598.537146][T14979] ? __pfx_shrinker_alloc+0x10/0x10 [ 598.537175][T14979] ? lockdep_init_map_type+0x5c/0x250 [ 598.537208][T14979] ? lockdep_init_map_type+0x5c/0x250 [ 598.537243][T14979] ? __raw_spin_lock_init+0x3a/0x110 [ 598.537284][T14979] ? __init_rwsem+0x12d/0x1b0 [ 598.537323][T14979] alloc_super+0x7c7/0xd20 [ 598.537366][T14979] ? __pfx_mqueue_fill_super+0x10/0x10 [ 598.537389][T14979] sget_fc+0x117/0xc70 [ 598.537428][T14979] ? __pfx_set_anon_super_fc+0x10/0x10 [ 598.537467][T14979] ? __pfx_mqueue_fill_super+0x10/0x10 [ 598.537497][T14979] get_tree_nodev+0x28/0x190 [ 598.537523][T14979] mqueue_get_tree+0xf1/0x130 [ 598.537546][T14979] vfs_get_tree+0x92/0x320 [ 598.537583][T14979] fc_mount_longterm+0x1a/0x270 [ 598.537623][T14979] mq_init_ns+0x482/0x820 [ 598.537653][T14979] copy_ipcs+0x3dd/0x7e0 [ 598.537684][T14979] create_new_namespaces+0x20a/0xac0 [ 598.537711][T14979] ? security_capable+0x80/0x260 [ 598.537739][T14979] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 598.537770][T14979] ksys_unshare+0x473/0xad0 [ 598.537804][T14979] ? __pfx_ksys_unshare+0x10/0x10 [ 598.537848][T14979] __x64_sys_unshare+0x31/0x40 [ 598.537879][T14979] do_syscall_64+0x106/0xf80 [ 598.537905][T14979] ? clear_bhb_loop+0x40/0x90 [ 598.537935][T14979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.537960][T14979] RIP: 0033:0x7f7d0919c819 [ 598.537979][T14979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.538003][T14979] RSP: 002b:00007f7d09fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 598.538027][T14979] RAX: ffffffffffffffda RBX: 00007f7d09415fa0 RCX: 00007f7d0919c819 [ 598.538043][T14979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 598.538058][T14979] RBP: 00007f7d09232c91 R08: 0000000000000000 R09: 0000000000000000 [ 598.538073][T14979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 598.538088][T14979] R13: 00007f7d09416038 R14: 00007f7d09415fa0 R15: 00007ffec4422068 [ 598.538119][T14979] [ 598.830190][T14982] futex_wake_op: syz.4.2110 tries to shift op by -2048; fix this program [ 598.840316][T14982] FAULT_INJECTION: forcing a failure. [ 598.840316][T14982] name failslab, interval 1, probability 0, space 0, times 0 [ 598.853074][T14982] CPU: 0 UID: 0 PID: 14982 Comm: syz.4.2110 Not tainted syzkaller #0 PREEMPT(full) [ 598.853104][T14982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 598.853119][T14982] Call Trace: [ 598.853127][T14982] [ 598.853136][T14982] dump_stack_lvl+0x100/0x190 [ 598.853179][T14982] should_fail_ex.cold+0x5/0xa [ 598.853209][T14982] should_failslab+0xc2/0x120 [ 598.853237][T14982] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 598.853280][T14982] ? security_inode_alloc+0x3b/0x2c0 [ 598.853308][T14982] ? lockdep_init_map_type+0x5c/0x250 [ 598.853347][T14982] security_inode_alloc+0x3b/0x2c0 [ 598.853377][T14982] inode_init_always_gfp+0xced/0x1040 [ 598.853408][T14982] alloc_inode+0x8e/0x250 [ 598.853443][T14982] sock_alloc+0x44/0x280 [ 598.853468][T14982] ? security_socket_create+0x7f/0x250 [ 598.853495][T14982] __sock_create+0xc2/0x860 [ 598.853532][T14982] __sys_socket+0x14d/0x260 [ 598.853564][T14982] ? exc_page_fault+0x6f/0xd0 [ 598.853589][T14982] ? __pfx___sys_socket+0x10/0x10 [ 598.853626][T14982] ? do_user_addr_fault+0x8d6/0x12f0 [ 598.853654][T14982] __x64_sys_socket+0x72/0xb0 [ 598.853686][T14982] ? lockdep_hardirqs_on+0x78/0x100 [ 598.853712][T14982] do_syscall_64+0x106/0xf80 [ 598.853738][T14982] ? clear_bhb_loop+0x40/0x90 [ 598.853774][T14982] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.853799][T14982] RIP: 0033:0x7faaeaf9e087 [ 598.853819][T14982] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.853843][T14982] RSP: 002b:00007faaebe35f98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 598.853866][T14982] RAX: ffffffffffffffda RBX: 00007faaeb215fa0 RCX: 00007faaeaf9e087 [ 598.853881][T14982] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 598.853896][T14982] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 598.853911][T14982] R10: 0000200000000680 R11: 0000000000000286 R12: 0000000000000000 [ 598.853926][T14982] R13: 00007faaeb216038 R14: 00007faaeb215fa0 R15: 00007ffdb433b798 [ 598.853956][T14982] [ 598.854012][T14982] socket: no more sockets Ijn9_UVQ[ 601.756926][T15029] FAULT_INJECTION: forcing a failure. [ 601.756926][T15029] name failslab, interval 1, probability 0, space 0, times 0 [ 601.846463][T15029] CPU: 0 UID: 0 PID: 15029 Comm: syz.7.2120 Not tainted syzkaller #0 PREEMPT(full) [ 601.846495][T15029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 601.846509][T15029] Call Trace: [ 601.846517][T15029] [ 601.846525][T15029] dump_stack_lvl+0x100/0x190 [ 601.846603][T15029] should_fail_ex.cold+0x5/0xa [ 601.846631][T15029] should_failslab+0xc2/0x120 [ 601.846658][T15029] __kmalloc_cache_noprof+0x7a/0x6f0 [ 601.846692][T15029] ? shrinker_alloc+0xf5/0xbc0 [ 601.846721][T15029] shrinker_alloc+0xf5/0xbc0 [ 601.846747][T15029] ? mark_held_locks+0x40/0x70 [ 601.846778][T15029] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 601.846805][T15029] ? rcu_is_watching+0x12/0xc0 [ 601.846844][T15029] ? __pfx_shrinker_alloc+0x10/0x10 [ 601.846872][T15029] ? lockdep_init_map_type+0x5c/0x250 [ 601.846904][T15029] ? lockdep_init_map_type+0x5c/0x250 [ 601.846938][T15029] ? __raw_spin_lock_init+0x3a/0x110 [ 601.846974][T15029] ? __init_rwsem+0x12d/0x1b0 [ 601.847012][T15029] alloc_super+0x7c7/0xd20 [ 601.847053][T15029] ? __pfx_mqueue_fill_super+0x10/0x10 [ 601.847076][T15029] sget_fc+0x117/0xc70 [ 601.847113][T15029] ? __pfx_set_anon_super_fc+0x10/0x10 [ 601.847151][T15029] ? __pfx_mqueue_fill_super+0x10/0x10 [ 601.847173][T15029] get_tree_nodev+0x28/0x190 [ 601.847197][T15029] mqueue_get_tree+0xf1/0x130 [ 601.847219][T15029] vfs_get_tree+0x92/0x320 [ 601.847255][T15029] fc_mount_longterm+0x1a/0x270 [ 601.847293][T15029] mq_init_ns+0x482/0x820 [ 601.847322][T15029] copy_ipcs+0x3dd/0x7e0 [ 601.847358][T15029] create_new_namespaces+0x20a/0xac0 [ 601.847384][T15029] ? security_capable+0x80/0x260 [ 601.847412][T15029] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 601.847442][T15029] ksys_unshare+0x473/0xad0 [ 601.847475][T15029] ? __pfx_ksys_unshare+0x10/0x10 [ 601.847517][T15029] __x64_sys_unshare+0x31/0x40 [ 601.847547][T15029] do_syscall_64+0x106/0xf80 [ 601.847572][T15029] ? clear_bhb_loop+0x40/0x90 [ 601.847601][T15029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.847625][T15029] RIP: 0033:0x7f7d0919c819 [ 601.847643][T15029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 601.847666][T15029] RSP: 002b:00007f7d09fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 601.847688][T15029] RAX: ffffffffffffffda RBX: 00007f7d09415fa0 RCX: 00007f7d0919c819 [ 601.847704][T15029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c000000 [ 601.847718][T15029] RBP: 00007f7d09232c91 R08: 0000000000000000 R09: 0000000000000000 [ 601.847733][T15029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 601.847746][T15029] R13: 00007f7d09416038 R14: 00007f7d09415fa0 R15: 00007ffec4422068 [ 601.847777][T15029] [ 604.798765][T15063] Process accounting resumed [ 605.857568][T12684] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 605.875266][T12684] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 605.884181][T12684] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 605.894243][T12684] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 605.922033][T12684] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 606.092186][T15120] netlink: 330 bytes leftover after parsing attributes in process `syz.6.2135'. [ 606.151106][T15116] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2134'. [ 606.226493][T15120] mac80211_hwsim hwsim19 : renamed from wlan0 (while UP) [ 606.426495][T15116] ipvlan1: entered promiscuous mode [ 606.433322][T15116] ipvlan1: entered allmulticast mode [ 606.454469][T15116] veth0_vlan: entered allmulticast mode [ 607.140408][ T8735] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.588512][ T8735] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.957014][T12684] Bluetooth: hci8: command tx timeout [ 608.152736][ T8735] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 608.340668][T15112] chnl_net:caif_netlink_parms(): no params data found [ 609.073511][ T8735] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.031185][T12684] Bluetooth: hci8: command tx timeout [ 610.297375][T15112] bridge0: port 1(bridge_slave_0) entered blocking state [ 610.321483][T15112] bridge0: port 1(bridge_slave_0) entered disabled state [ 610.360285][T15112] bridge_slave_0: entered allmulticast mode [ 610.418471][T15112] bridge_slave_0: entered promiscuous mode [ 610.634849][T15112] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.661357][T15112] bridge0: port 2(bridge_slave_1) entered disabled state [ 610.706700][T15112] bridge_slave_1: entered allmulticast mode [ 610.724937][T15112] bridge_slave_1: entered promiscuous mode [ 610.767525][T15192] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2147'. [ 610.952144][T15192] hsr_slave_1 (unregistering): left promiscuous mode [ 611.006076][T15112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 611.082169][T15112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 611.134203][ T8735] bridge_slave_0: left allmulticast mode [ 611.140136][ T8735] bridge_slave_0: left promiscuous mode [ 611.177391][ T8735] bridge0: port 1(bridge_slave_0) entered disabled state [ 612.115584][T12684] Bluetooth: hci8: command tx timeout [ 612.199713][ T8735] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 612.214289][ T8735] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 612.224970][ T8735] bond0 (unregistering): Released all slaves [ 612.337432][ T8735] : left promiscuous mode [ 612.573489][ T8735] ovs_: left promiscuous mode [ 612.624613][T15112] team0: Port device team_slave_0 added [ 612.661880][T15112] team0: Port device team_slave_1 added [ 612.755263][T15206] FAULT_INJECTION: forcing a failure. [ 612.755263][T15206] name failslab, interval 1, probability 0, space 0, times 0 [ 612.821279][T15206] CPU: 0 UID: 0 PID: 15206 Comm: syz.4.2151 Not tainted syzkaller #0 PREEMPT(full) [ 612.821311][T15206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 612.821326][T15206] Call Trace: [ 612.821333][T15206] [ 612.821342][T15206] dump_stack_lvl+0x100/0x190 [ 612.821384][T15206] should_fail_ex.cold+0x5/0xa [ 612.821413][T15206] should_failslab+0xc2/0x120 [ 612.821440][T15206] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 612.821478][T15206] ? __kernfs_new_node+0xd2/0x960 [ 612.821520][T15206] __kernfs_new_node+0xd2/0x960 [ 612.821559][T15206] ? __pfx___kernfs_new_node+0x10/0x10 [ 612.821603][T15206] ? find_held_lock+0x2b/0x80 [ 612.821627][T15206] ? kernfs_root+0xee/0x2a0 [ 612.821661][T15206] ? kernfs_root+0xee/0x2a0 [ 612.821703][T15206] kernfs_new_node+0x11b/0x1a0 [ 612.821730][T15206] __kernfs_create_file+0x53/0x350 [ 612.821783][T15206] sysfs_add_file_mode_ns+0x207/0x3c0 [ 612.821826][T15206] sysfs_merge_group+0x194/0x340 [ 612.821866][T15206] ? __pfx_sysfs_merge_group+0x10/0x10 [ 612.821903][T15206] ? bus_add_device+0x368/0x6b0 [ 612.821929][T15206] ? __pfx_bus_add_device+0x10/0x10 [ 612.821952][T15206] ? __pfx_dev_add_physical_location+0x10/0x10 [ 612.821991][T15206] dpm_sysfs_add+0x237/0x280 [ 612.822031][T15206] device_add+0x9ef/0x1950 [ 612.822068][T15206] ? __pfx_device_add+0x10/0x10 [ 612.822113][T15206] __add_disk+0x518/0xe40 [ 612.822141][T15206] ? find_held_lock+0x2b/0x80 [ 612.822168][T15206] add_disk_fwnode+0x3d4/0x5c0 [ 612.822200][T15206] zram_add+0x4d2/0x610 [ 612.822237][T15206] ? __pfx_zram_add+0x10/0x10 [ 612.822293][T15206] ? find_held_lock+0x2b/0x80 [ 612.822321][T15206] ? sysfs_file_kobj+0xe4/0x290 [ 612.822357][T15206] ? __pfx_hot_add_show+0x10/0x10 [ 612.822395][T15206] hot_add_show+0x21/0x80 [ 612.822432][T15206] class_attr_show+0x72/0xa0 [ 612.822465][T15206] ? __pfx_class_attr_show+0x10/0x10 [ 612.822497][T15206] sysfs_kf_seq_show+0x217/0x3a0 [ 612.822536][T15206] seq_read_iter+0x32f/0x1270 [ 612.822572][T15206] kernfs_fop_read_iter+0x46c/0x610 [ 612.822602][T15206] ? rw_verify_area+0xce/0x6d0 [ 612.822640][T15206] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 612.822672][T15206] vfs_read+0x825/0xb30 [ 612.822699][T15206] ? __pfx_vfs_read+0x10/0x10 [ 612.822742][T15206] ksys_read+0x12a/0x250 [ 612.822766][T15206] ? __pfx_ksys_read+0x10/0x10 [ 612.822798][T15206] do_syscall_64+0x106/0xf80 [ 612.822825][T15206] ? clear_bhb_loop+0x40/0x90 [ 612.822856][T15206] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.822881][T15206] RIP: 0033:0x7faaeaf9c819 [ 612.822901][T15206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 612.822925][T15206] RSP: 002b:00007faaebe37028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 612.822948][T15206] RAX: ffffffffffffffda RBX: 00007faaeb215fa0 RCX: 00007faaeaf9c819 [ 612.822964][T15206] RDX: 0000000000001000 RSI: 0000200000000ec0 RDI: 0000000000000008 [ 612.822980][T15206] RBP: 00007faaeb032c91 R08: 0000000000000000 R09: 0000000000000000 [ 612.822995][T15206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 612.823014][T15206] R13: 00007faaeb216038 R14: 00007faaeb215fa0 R15: 00007ffdb433b798 [ 612.823046][T15206] [ 613.387329][T15112] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 613.399499][T15112] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 613.511664][T15205] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 613.517870][T15112] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 613.543397][T15205] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 613.575681][T15205] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 613.586548][T15112] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 613.611422][T15205] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 613.634500][T15112] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 613.663220][T15205] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 613.669274][T15205] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 613.741504][T15205] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 613.747516][T15205] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 613.827828][T15112] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 613.880016][T15205] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 613.954599][T15222] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2154'. [ 613.987297][T15205] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 614.040251][T15205] Bluetooth: hci8: Opcode 0x0406 failed: -4 [ 614.130750][T15205] Bluetooth: hci8: Opcode 0x0406 failed: -4 [ 614.394242][T15112] hsr_slave_0: entered promiscuous mode [ 614.430787][T15112] hsr_slave_1: entered promiscuous mode [ 614.479961][T15112] debugfs: 'hsr0' already exists in 'hsr' [ 614.551056][T15112] Cannot create hsr debugfs directory [ 614.752203][T14654] Bluetooth: hci0: command 0x0c1a tx timeout [ 615.439303][ T8735] hsr_slave_0: left promiscuous mode [ 615.449395][ T8735] hsr_slave_1: left promiscuous mode [ 615.466950][ T8735] veth1_macvtap: left promiscuous mode [ 615.480426][ T8735] veth1_vlan: left promiscuous mode [ 615.498305][ T8735] veth0_vlan: left promiscuous mode [ 615.551802][T14654] Bluetooth: hci1: command 0x0c1a tx timeout [ 615.635196][T14654] Bluetooth: hci4: command 0x0c1a tx timeout [ 615.641367][T12684] Bluetooth: hci3: command 0x0c1a tx timeout [ 615.715279][T14654] Bluetooth: hci6: command 0x0c1a tx timeout [ 615.723385][T12684] Bluetooth: hci5: command 0x2016 tx timeout [ 615.793057][T14654] Bluetooth: hci7: command 0x0c1a tx timeout [ 616.013785][ T8735] team0 (unregistering): Port device team_slave_1 removed [ 616.031037][T14654] Bluetooth: hci8: command 0x0c1a tx timeout [ 616.062217][ T8735] team0 (unregistering): Port device team_slave_0 removed [ 616.146162][T15258] netlink: 330 bytes leftover after parsing attributes in process `syz.4.2160'. [ 616.298418][T15258] mac80211_hwsim hwsim12 : renamed from wlan0 (while UP) [ 617.872067][T14654] Bluetooth: hci7: command 0x0c1a tx timeout [ 618.111168][T14654] Bluetooth: hci8: command 0x0c1a tx timeout [ 618.327984][T15112] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 618.490061][T15112] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 618.530072][T15112] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 618.571955][T15112] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 619.171385][T15112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.263751][T15112] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.408423][T12625] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.415635][T12625] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.453121][T12625] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.460350][T12625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.938875][T15318] bridge_slave_1: left allmulticast mode [ 619.951839][T14654] Bluetooth: hci7: command 0x0c1a tx timeout [ 619.958195][T15318] bridge_slave_1: left promiscuous mode [ 619.982233][T15318] bridge0: port 2(bridge_slave_1) entered disabled state [ 620.111814][ T31] INFO: task syz.3.1625:12599 blocked for more than 143 seconds. [ 620.125611][ T31] Not tainted syzkaller #0 [ 620.130597][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 620.201996][T14654] Bluetooth: hci8: command 0x0c1a tx timeout [ 620.261439][ T31] task:syz.3.1625 state:D stack:28008 pid:12599 tgid:12597 ppid:5824 task_flags:0x400140 flags:0x00080002 [ 620.371878][ T31] Call Trace: [ 620.375214][ T31] [ 620.378169][ T31] __schedule+0xfee/0x6120 [ 620.460958][ T31] ? __lock_acquire+0x4a5/0x2630 [ 620.465984][ T31] ? __pfx___schedule+0x10/0x10 [ 620.470851][ T31] ? find_held_lock+0x2b/0x80 [ 620.538980][ T31] ? schedule+0x2bf/0x390 [ 620.614621][ T31] schedule+0xdd/0x390 [ 620.642943][ T31] schedule_preempt_disabled+0x13/0x30 [ 620.648553][ T31] rwsem_down_write_slowpath+0x530/0x1280 [ 620.704379][ T31] ? __pfx_rwsem_down_write_slowpath+0x10/0x10 [ 620.710601][ T31] ? kernel_text_address+0x8d/0x100 [ 620.872227][ T31] ? unwind_get_return_address+0x59/0xa0 [ 620.954893][ T31] ? __pfx___might_resched+0x10/0x10 [ 620.960265][ T31] down_write+0x1c7/0x1f0 [ 621.026403][ T31] ? __pfx_down_write+0x10/0x10 [ 621.042598][ T31] ? __pfx___might_resched+0x10/0x10 [ 621.092257][ T31] super_lock+0x1ca/0x3f0 [ 621.096688][ T31] ? __pfx_super_lock+0x10/0x10 [ 621.130299][ T31] ? find_held_lock+0x2b/0x80 [ 621.148635][ T31] ? grab_super+0x9d/0x420 [ 621.182292][ T31] ? grab_super+0x9d/0x420 [ 621.186789][ T31] grab_super+0xaa/0x420 [ 621.213373][ T31] ? __pfx_grab_super+0x10/0x10 [ 621.218292][ T31] ? do_raw_spin_lock+0x128/0x260 [ 621.266863][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 621.301011][ T31] ? __pfx_test_keyed_super+0x10/0x10 [ 621.306449][ T31] sget_fc+0x655/0xc70 [ 621.310550][ T31] ? __pfx_set_anon_super_fc+0x10/0x10 [ 621.353450][ T31] ? __pfx_nfsd_fill_super+0x10/0x10 [ 621.358831][ T31] get_tree_keyed+0x59/0x1d0 [ 621.387595][ T31] vfs_get_tree+0x92/0x320 [ 621.411347][ T31] path_mount+0x7d0/0x23d0 [ 621.415849][ T31] ? __pfx_path_mount+0x10/0x10 [ 621.420719][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 621.491099][ T31] ? putname+0xb1/0x110 [ 621.495427][ T31] ? kmem_cache_free+0x124/0x6a0 [ 621.500429][ T31] ? __x64_sys_mount+0x293/0x310 [ 621.542251][ T31] __x64_sys_mount+0x293/0x310 [ 621.560942][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 621.566327][ T31] do_syscall_64+0x106/0xf80 [ 621.591065][ T31] ? clear_bhb_loop+0x40/0x90 [ 621.595809][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.617913][ T31] RIP: 0033:0x7f973659c819 [ 621.629981][ T31] RSP: 002b:00007f9737431028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 621.660726][ T31] RAX: ffffffffffffffda RBX: 00007f9736815fa0 RCX: 00007f973659c819 [ 621.680939][ T31] RDX: 0000200000000140 RSI: 00002000000000c0 RDI: 0000000000000000 [ 621.688976][ T31] RBP: 00007f9736632c91 R08: 0000000000000000 R09: 0000000000000000 [ 621.712363][ T31] R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000000 [ 621.720390][ T31] R13: 00007f9736816038 R14: 00007f9736815fa0 R15: 00007fff48173ad8 [ 621.747735][ T31] [ 621.900111][ T31] INFO: task syz.3.1625:12600 blocked for more than 145 seconds. [ 621.954596][ T31] Not tainted syzkaller #0 [ 621.959584][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 622.050951][ T31] task:syz.3.1625 state:D stack:28760 pid:12600 tgid:12597 ppid:5824 task_flags:0x400140 flags:0x00080002 [ 622.127636][ T31] Call Trace: [ 622.141632][ T31] [ 622.144650][ T31] __schedule+0xfee/0x6120 [ 622.149084][ T31] ? __lock_acquire+0x4a5/0x2630 [ 622.223149][ T31] ? __pfx___schedule+0x10/0x10 [ 622.228056][ T31] ? find_held_lock+0x2b/0x80 [ 622.274975][ T31] ? schedule+0x2bf/0x390 [ 622.279374][ T31] schedule+0xdd/0x390 [ 622.330937][ T31] schedule_preempt_disabled+0x13/0x30 [ 622.336466][ T31] __mutex_lock+0xc9a/0x1b90 [ 622.391012][ T31] ? nfsd_shutdown_threads+0x5b/0xf0 [ 622.396459][ T31] ? __lock_acquire+0x4a5/0x2630 [ 622.461682][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 622.511169][ T31] ? net_generic+0xea/0x2a0 [ 622.515750][ T31] ? net_generic+0xea/0x2a0 [ 622.520293][ T31] ? nfsd_shutdown_threads+0x5b/0xf0 [ 622.601798][ T31] nfsd_shutdown_threads+0x5b/0xf0 [ 622.606978][ T31] nfsd_umount+0x3b/0x60 [ 622.654575][ T31] deactivate_locked_super+0xc1/0x1b0 [ 622.660109][ T31] deactivate_super+0xe7/0x110 [ 622.721203][ T31] cleanup_mnt+0x21f/0x450 [ 622.725703][ T31] task_work_run+0x150/0x240 [ 622.730328][ T31] ? __pfx_task_work_run+0x10/0x10 [ 622.761246][ T31] ? __x64_sys_mount+0x23e/0x310 [ 622.766273][ T31] exit_to_user_mode_loop+0x100/0x4a0 [ 622.787166][ T31] do_syscall_64+0x668/0xf80 [ 622.801012][ T31] ? clear_bhb_loop+0x40/0x90 [ 622.805740][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.818959][ T31] RIP: 0033:0x7f973659c819 [ 622.831496][ T31] RSP: 002b:00007f9737410028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 622.839949][ T31] RAX: fffffffffffffffe RBX: 00007f9736816090 RCX: 00007f973659c819 [ 622.861142][ T31] RDX: 0000200000000140 RSI: 00002000000000c0 RDI: 0000000000000000 [ 622.869169][ T31] RBP: 00007f9736632c91 R08: 0000000000000000 R09: 0000000000000000 [ 622.899593][ T31] R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000000 [ 622.920964][ T31] R13: 00007f9736816128 R14: 00007f9736816090 R15: 00007fff48173ad8 [ 622.928994][ T31] [ 622.951010][ T31] [ 622.951010][ T31] Showing all locks held in the system: [ 622.958794][ T31] 1 lock held by pool_workqueue_/3: [ 623.057418][ T31] #0: ffffffff8e7f32b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 623.081721][ T31] 2 locks held by kworker/0:1/10: [ 623.086804][ T31] #0: ffff88813fe63148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 623.125828][ T31] #1: ffffc900000f7d08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 623.151301][ T31] 1 lock held by khungtaskd/31: [ 623.156276][ T31] #0: ffffffff8e7e7760 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 623.181040][ T31] 2 locks held by getty/8146: [ 623.196573][ T31] #0: ffff88803405e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 623.220957][ T31] #1: ffffc90003c5d2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 623.237925][ T31] 5 locks held by kworker/u8:22/8735: [ 623.260990][ T31] #0: ffff88801c6b6948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 623.280922][ T31] #1: ffffc900033f7d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 623.311373][ T31] #2: ffffffff905fead0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 [ 623.325032][ T31] #3: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 [ 623.351001][ T31] #4: ffffffff8e7f32b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 623.371190][ T31] 3 locks held by kworker/u8:30/9788: [ 623.376594][ T31] #0: ffff888033020148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1310/0x19a0 [ 623.411247][ T31] #1: ffffc900023afd08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x19a0 [ 623.440980][ T31] #2: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 [ 623.450548][ T31] 2 locks held by syz.1.1582/12420: [ 623.478221][ T31] #0: ffffffff906c3670 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 623.500948][ T31] #1: ffffffff8ec58ea8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x6c1/0xc00 [ 623.521101][ T31] 1 lock held by syz.3.1625/12599: [ 623.526245][ T31] #0: ffff88803d5ba0e0 (&type->s_umount_key#58){+.+.}-{4:4}, at: super_lock+0x1ca/0x3f0 [ 623.555100][ T31] 2 locks held by syz.3.1625/12600: [ 623.560366][ T31] #0: ffff88803d5ba0e0 (&type->s_umount_key#58){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 [ 623.578446][ T31] #1: ffffffff8ec58ea8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 [ 623.594923][ T31] 1 lock held by syz-executor/12683: [ 623.600235][ T31] #0: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 623.611088][ T31] 2 locks held by syz-executor/12838: [ 623.616476][ T31] #0: ffff88802cc120e0 (&type->s_umount_key#58){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 [ 623.627505][ T31] #1: ffffffff8ec58ea8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 [ 623.643347][ T31] 2 locks held by syz.2.1803/13506: [ 623.648586][ T31] #0: ffffffff906c3670 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 623.657165][ T31] #1: ffffffff8ec58ea8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0xd5/0x1a80 [ 623.667541][ T31] 1 lock held by syz-executor/14614: [ 623.673065][ T31] #0: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 623.682285][ T31] 1 lock held by syz-executor/15112: [ 623.687578][ T31] #0: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 623.703687][ T31] 1 lock held by syz.6.2167/15337: [ 623.710190][ T31] #0: ffffffff90617328 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 [ 623.748003][ T31] [ 623.750368][ T31] ============================================= [ 623.750368][ T31] [ 623.849196][ T31] NMI backtrace for cpu 0 [ 623.849216][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 623.849241][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 623.849255][ T31] Call Trace: [ 623.849262][ T31] [ 623.849271][ T31] dump_stack_lvl+0x100/0x190 [ 623.849310][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 623.849348][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 623.849386][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 623.849423][ T31] sys_info+0x141/0x190 [ 623.849451][ T31] watchdog+0xd25/0x1050 [ 623.849482][ T31] ? __pfx_watchdog+0x10/0x10 [ 623.849506][ T31] ? __kthread_parkme+0x18c/0x230 [ 623.849536][ T31] ? kthread+0x13a/0x450 [ 623.849565][ T31] ? __pfx_watchdog+0x10/0x10 [ 623.849586][ T31] kthread+0x370/0x450 [ 623.849616][ T31] ? __pfx_kthread+0x10/0x10 [ 623.849667][ T31] ret_from_fork+0x754/0xd80 [ 623.849708][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 623.849746][ T31] ? __switch_to+0x7b4/0x1120 [ 623.849773][ T31] ? __pfx_kthread+0x10/0x10 [ 623.849806][ T31] ret_from_fork_asm+0x1a/0x30 [ 623.849846][ T31] [ 624.089495][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 624.096400][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 624.105523][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 624.115588][ T31] Call Trace: [ 624.118895][ T31] [ 624.121831][ T31] dump_stack_lvl+0x100/0x190 [ 624.126539][ T31] vpanic+0x552/0x970 [ 624.130537][ T31] ? __pfx_vpanic+0x10/0x10 [ 624.135088][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 624.141283][ T31] panic+0xd1/0xe0 [ 624.145014][ T31] ? __pfx_panic+0x10/0x10 [ 624.149467][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 624.155661][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 624.161841][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 624.168017][ T31] ? watchdog.cold+0x198/0x1ca [ 624.172799][ T31] ? watchdog+0xd35/0x1050 [ 624.177247][ T31] watchdog.cold+0x1a9/0x1ca [ 624.181863][ T31] ? __pfx_watchdog+0x10/0x10 [ 624.186653][ T31] ? __kthread_parkme+0x18c/0x230 [ 624.191714][ T31] ? kthread+0x13a/0x450 [ 624.195975][ T31] ? __pfx_watchdog+0x10/0x10 [ 624.200666][ T31] kthread+0x370/0x450 [ 624.204778][ T31] ? __pfx_kthread+0x10/0x10 [ 624.209393][ T31] ret_from_fork+0x754/0xd80 [ 624.214015][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 624.219162][ T31] ? __switch_to+0x7b4/0x1120 [ 624.223881][ T31] ? __pfx_kthread+0x10/0x10 [ 624.228511][ T31] ret_from_fork_asm+0x1a/0x30 [ 624.233305][ T31] [ 624.236399][ T31] Kernel Offset: disabled [ 624.240737][ T31] Rebooting in 86400 seconds..