last executing test programs: 10.021890133s ago: executing program 2 (id=91): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg(r0, &(0x7f0000000a40)={0x1, {&(0x7f0000000880)=""/224, 0xe0, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000ac0)=""/245, 0xf5, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000640)=""/285, 0x11d, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000003c0)={0x2, 0x0, {&(0x7f00000002c0)=""/119, 0xfca2, 0x0, 0x0, 0x3}}, 0x48) 7.244605191s ago: executing program 1 (id=94): sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x840) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.982114028s ago: executing program 2 (id=96): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x78e8, 0x1f480, 0x2, 0x2a0}) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0xa}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xb, 0x2}}]}, 0x28}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x2c0) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 6.633740886s ago: executing program 0 (id=99): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@arm64={0x6, 0xd8, 0x1, '\x00', 0xcc95}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000840)={0x2, 0x0, @ioapic={0x8000000, 0x11, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x85, '\x00', 0x8}, {0x8, 0x9c, 0x40, '\x00', 0xb}, {0xff, 0x60, 0xd, '\x00', 0x67}, {0x0, 0xc0, 0xd4, '\x00', 0xff}, {0x7, 0x9, 0xd, '\x00', 0xfb}, {0x0, 0x1, 0x54, '\x00', 0xff}, {0x9, 0xd5, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0x5}, {0xff, 0x1, 0xfe}, {0xfe, 0x7, 0x26, '\x00', 0x1}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0x7, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x9}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xe1, 0xb, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x6, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) 4.506661829s ago: executing program 3 (id=102): recvmmsg(0xffffffffffffffff, &(0x7f0000005c80), 0x0, 0x10122, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000100)={0x2, 0x3, 0x6, 0x6}) 4.423314031s ago: executing program 3 (id=103): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x8) 4.421898541s ago: executing program 1 (id=104): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg(r0, &(0x7f0000000a40)={0x1, {&(0x7f0000000880)=""/224, 0xe0, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000ac0)=""/245, 0xf5, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000640)=""/285, 0x11d, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000003c0)={0x2, 0x0, {&(0x7f00000002c0)=""/119, 0xfca2, 0x0, 0x0, 0x3}}, 0x48) 4.369790562s ago: executing program 2 (id=105): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/fs/orangefs/op_timeout_secs\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)="5fcac9", 0x3) 4.300007674s ago: executing program 0 (id=106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000030000000900010073797a300000000098020000160a01040000000000000000030000070c00054000000000000000040c00054000000000000000030900010073797a300000000008000740000000010c000540000000000000000508000740000000020900020073797a31000000009c000380"], 0x2f4}, 0x1, 0x0, 0x0, 0x20004010}, 0x0) 4.095570919s ago: executing program 2 (id=107): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x1}) 4.04583781s ago: executing program 3 (id=108): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0xb4dac462410a8f85, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f8864", 0xfdef}], 0x1) 4.008681661s ago: executing program 1 (id=109): epoll_create1(0x80000) socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) r3 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r3, 0x4221030) keyctl$KEYCTL_MOVE(0x3, r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f00000002c0)=0x80000000000003) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x39b3) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) fcntl$setstatus(r6, 0x4, 0x42400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r7, &(0x7f0000000040), 0x0}, 0x20) recvmmsg(r6, 0x0, 0x0, 0x23, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100), 0x4) 3.971308622s ago: executing program 0 (id=110): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)="36878cba1eff6e0004000098f9445adaa352046e40eea8ebc902bb7ca91a4e06a41481b0fc4ab3f62296f3a5a671d7faddde62f917c4c12d3b47217b7c8276819537308218ce57ef4dc19b317f2a2b8f8025dea7f072cb4f43c28ee24c3f193f171b8b61a4e4c1f9731fa3d7bd32042d8ce9ae3c4a8abc78b4c684597b2b7832c29f845c3f3f19b7dc9c2492620bca4433bf7c4ec14acb3e228762aaedb5e6783cbeda9874a71e000000000000000000000067e9ad6e3d426707182aec25a46553ed722fe8f71a78d2c740911f4a2f8511ec09ee158f03a3d0a0314c0e040b01a6469ec432099fde9b5e90904f96027a1c3bc8820d7557c9f3c8b6213fd17d239eaffe65383305d624070020dcd97ea5964e1452f7d477d6a50fa5811050338675daa0b040fbedc2a2ba461f7ffd4ad0e06f1221c4b1f8b72b842e0a91", 0x13d) 2.372095461s ago: executing program 1 (id=111): recvmmsg(0xffffffffffffffff, &(0x7f0000005c80), 0x0, 0x10122, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f0000000100)={0x2, 0x3, 0x6, 0x6}) 1.793856746s ago: executing program 0 (id=112): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', &(0x7f0000000140), 0x4000) 1.739276927s ago: executing program 3 (id=113): r0 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf9, 0x60000) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000240)={0x2}) 1.727227717s ago: executing program 1 (id=114): socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x40000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r4, 0x4140, 0x0) openat(0xffffffffffffffff, &(0x7f0000000c00)='auth.unix.ip/channel\x00', 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) r6 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x10, @mcast2}, 0x1c) sendto$inet6(r6, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000759, &(0x7f00000001c0)={[{@jqfmt_vfsold}, {@noblock_validity}, {@discard}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x6}, 0x0}, {@nobh}, {@max_batch_time={'max_batch_time', 0x3d, 0x17}}, {@jqfmt_vfsv1}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0xe}}, {@lazytime}, {@resuid}, {@dax_always}, {@test_dummy_encryption_v1}, {@resgid}, {@nodioread_nolock}, {@data_writeback}, {@journal_async_commit}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@obj_role}], 0x2c}, 0x0, 0x525, &(0x7f0000000440)="$eJzs3M9vG1kdAPCvHecXbUkoFPoLaigSEYimSX8eOLQVSL0gIYFQOZokrUrTFjVBaqOIpgi1EgdQ/wJ+3JD4Czgg9rLaXe1hV3vdaq+rlapVLs3uYTWrsWe8dm0nTuvEm+bzkey+N/PG874z85p573kcwK5VTt8KEXsj4v2IGKtlmwuUa/+srS7PfLK6PFOIJPnlx4VquWeryzN50Xy7PVlmohhR/HMhjrTudnjh3tKNyvz83J1sweRiMUvdrFybuzZ3a/r8+dOnRs+dnT7TkzjTOj07/MfbRw9d/s3jn89cefzbN/+T1jfJ1jfGUTNefR/qeg8DLUvKUW4+lnX/m107sJnaf/nta0gXSul7sX+VoWvpVZuersFq+x+LgWquZix+9qe+Vg7YUkmSJMMtS+t/y1aSRoVCbYMkeZAAr4BC9LsGQH/kf+ifraY91eWZ1n7wq+3pxaj2gNK417JXbU2p2oMtj9f6RoNbtP9vRMSVlU//nr6i7TgEAEBv/f9ixKNLtfuO/FVbU4xvNpT7ajY3NB4RX4uI/RHx9Wyq50BEtey3IuJgwzb7upgFKD+Xb73/eXc0SzTervZMev/3k2xuq/n+r17z8YEst68a/2Dh6vX5uZPZMZmIweE0P9X60fVhtdd++t7fOu2/3HD/l77S/ef3glk9Pio9N0A3W1msvGzcuacPqgd2pDX+QpQKeSriUEQc7vgpKx3XpMfs+g//fbTT+qb40zhb4v9r58qX1o+tG8k/I35QO/8rUY0/H/usBT+UpSYXb/5+cuHe0o+vN85PTp07O31mciTm505O5ldFq7feefiLLNnSjWg+/0nScP7zprGlE2lPHwzHV9pe//WZy/E0VZ+vXdj8Ph4+edSxT/Oi1/9Q4VfVdD4/e7eyuHhnKmKosNK6fPqLbe9WRpvKp9f/xPH27X9/xGf/yLY7EhHpRfztiPhORBzL6v7diPheRBxfJ/43Ln3/d526kBvHv7XS+Gc3df7vLY1GlqgvSRMX3o5oXpInBm68/t+WHf+l3BL/YHQ6/6erqYlsyWxlcWSjuNpUsG3ipQ8gAAAA7ADHImJvFIonsoGmvVEsnjgRsac+grKw+KOrt/9wa7b2jMB4DBbzka6xhvHQqWxsOM2nW0035NP1p6rjxkmSJKNpPu2/zx/sb+iw6+3p0P5TH7Y+0gK8ajY1j9b+iTZgh3q+/T/pesvefyED2F49+B4NsENp/7B7dd3+t+opOKBv2rX/+xFrfagKsM3atf9ftyy5sC11AbZXu/Zv7h92hxcf//NlANjpjP/DrtTVQ/IvkNh/eZ0yhVJ3n1Pq+jH+jRLFWP9XAMaj/psG+T3N+h/4QTGiN0dsoKdHfrTpnBbblhmJXuwrihuWKW3ihxi2N1GszM/nD7j0vT7DEbHB1Vu/2O7niaWtrlj12Pyrf/8zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9MbnAQAA///+mtCY") 1.645806709s ago: executing program 2 (id=115): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x13, 0xfa00, {0x2, &(0x7f0000002100)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea5, 0x5, @local, 0xff}, r2, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 501.544297ms ago: executing program 0 (id=116): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.bfq.io_merged_recursive\x00', 0x26e1, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8b05, &(0x7f0000000140)={'wlan1\x00'}) 382.54428ms ago: executing program 1 (id=117): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg(r0, &(0x7f0000000a40)={0x1, {&(0x7f0000000880)=""/224, 0xe0, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000ac0)=""/245, 0xf5, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000340)={0x2, 0x0, {&(0x7f0000000640)=""/285, 0x11d, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000780)=""/200, 0xc8, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r0, 0x0, 0x0) 189.680965ms ago: executing program 3 (id=118): r0 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x1b6c, 0x10, 0x8001, 0x804d}, &(0x7f0000000000)=0x0, &(0x7f0000000380)=0x0, 0x0) syz_ublk_add_dev(r0, r1, r2, 0x0, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000480)={'ip_vti0\x00', &(0x7f00000003c0)={'erspan0\x00', 0x0, 0x8, 0x40, 0xb, 0x4, {{0x1f, 0x4, 0x0, 0x1, 0x7c, 0x67, 0x0, 0x1, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@cipso={0x86, 0x28, 0x0, [{0x1, 0x6, "c76be734"}, {0x6, 0xb, "0d184b03dffee924b1"}, {0x1, 0x11, "1c0233b16341ed30ce30b7135f323d"}]}, @timestamp={0x44, 0x24, 0xba, 0x0, 0x9, [0x3, 0x2, 0x8, 0x4, 0x7, 0x0, 0x8001, 0x8]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x15, 0x2, [{0x5, 0x8, "fe1f0a8f443e"}, {0x6, 0x7, "3b83c3a4f8"}]}]}}}}}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000640), 0xf501, r3}, 0x38) 91.754067ms ago: executing program 0 (id=119): epoll_create1(0x80000) socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) r3 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r3, 0x4221030) keyctl$KEYCTL_MOVE(0x3, r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f00000002c0)=0x80000000000003) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x39b3) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) fcntl$setstatus(r6, 0x4, 0x42400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r7, &(0x7f0000000040), 0x0}, 0x20) recvmmsg(r6, 0x0, 0x0, 0x23, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100), 0x4) 70.222358ms ago: executing program 3 (id=120): syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) mkdir(&(0x7f0000000040)='./my_configfs\x00', 0x176) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x10040, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write$proc_mixer(r0, &(0x7f0000000080)=ANY=[], 0x1001) 0s ago: executing program 2 (id=121): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/devices/usb2/power/level\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)="36878cba1eff6e0004000098f9445adaa352046e40eea8ebc902bb7ca91a4e06a41481b0fc4ab3f62296f3a5a671d7faddde62f917c4c12d3b47217b7c8276819537308218ce57ef4dc19b317f2a2b8f8025dea7f072cb4f43c28ee24c3f193f171b8b61a4e4c1f9731fa3d7bd32042d8ce9ae3c4a8abc78b4c684597b2b7832c29f845c3f3f19b7dc9c2492620bca4433bf7c4ec14acb3e228762aaedb5e6783cbeda9874a71e000000000000000000000067e9ad6e3d426707182aec25a46553ed722fe8f71a78d2c740911f4a2f8511ec09ee158f03a3d0a0314c0e040b01a6469ec432099fde9b5e90904f96027a1c3bc8820d7557c9f3c8b6213fd17d239eaffe65383305d624070020dcd97ea5964e1452f7d477d6a50fa5811050338675daa0b040fbedc2a2ba461f7ffd4ad0e06f1221c4b1f8b72b842e0a91", 0x13d) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.168' (ED25519) to the list of known hosts. [ 83.055328][ T5763] cgroup: Unknown subsys name 'net' [ 83.190539][ T5763] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.944333][ T5763] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.671552][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.680540][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.719162][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.732128][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.752129][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.760255][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.767885][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.776162][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.776886][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 86.791096][ T5781] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.791327][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 86.805957][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.852060][ T5085] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.859765][ T5085] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.872571][ T5085] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.886519][ T5778] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.894813][ T5778] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.902732][ T5778] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.910579][ T5778] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.918837][ T5778] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 86.931725][ T5781] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.939653][ T5781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.949496][ T5781] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 86.956995][ T5781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.490672][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 87.575729][ T5786] chnl_net:caif_netlink_parms(): no params data found [ 87.661919][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 87.700496][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 87.858054][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.867317][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.875228][ T5779] bridge_slave_0: entered allmulticast mode [ 87.883160][ T5779] bridge_slave_0: entered promiscuous mode [ 87.893609][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.900872][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.908820][ T5779] bridge_slave_1: entered allmulticast mode [ 87.916568][ T5779] bridge_slave_1: entered promiscuous mode [ 87.989260][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.046686][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.067409][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.074723][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.082424][ T5786] bridge_slave_0: entered allmulticast mode [ 88.089400][ T5786] bridge_slave_0: entered promiscuous mode [ 88.098769][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.106320][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.113792][ T5786] bridge_slave_1: entered allmulticast mode [ 88.121251][ T5786] bridge_slave_1: entered promiscuous mode [ 88.128487][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.135790][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.143064][ T5775] bridge_slave_0: entered allmulticast mode [ 88.150475][ T5775] bridge_slave_0: entered promiscuous mode [ 88.189925][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.197418][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.204902][ T5775] bridge_slave_1: entered allmulticast mode [ 88.212394][ T5775] bridge_slave_1: entered promiscuous mode [ 88.219212][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.226772][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.234262][ T5784] bridge_slave_0: entered allmulticast mode [ 88.241804][ T5784] bridge_slave_0: entered promiscuous mode [ 88.253113][ T5779] team0: Port device team_slave_0 added [ 88.281264][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.288787][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.296161][ T5784] bridge_slave_1: entered allmulticast mode [ 88.303736][ T5784] bridge_slave_1: entered promiscuous mode [ 88.313707][ T5779] team0: Port device team_slave_1 added [ 88.322290][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.343954][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.379035][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.424964][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.477780][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.487967][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.495430][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.521469][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.536590][ T5786] team0: Port device team_slave_0 added [ 88.548924][ T5775] team0: Port device team_slave_0 added [ 88.557319][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.577926][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.587559][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.613967][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.626833][ T5786] team0: Port device team_slave_1 added [ 88.644347][ T5775] team0: Port device team_slave_1 added [ 88.692153][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.699160][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.731743][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.745201][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.752280][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.778320][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.793207][ T5784] team0: Port device team_slave_0 added [ 88.803474][ T5784] team0: Port device team_slave_1 added [ 88.837084][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.844344][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.870777][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.882175][ T5778] Bluetooth: hci1: command tx timeout [ 88.887947][ T51] Bluetooth: hci0: command tx timeout [ 88.895270][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.902485][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.928596][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.009540][ T5786] hsr_slave_0: entered promiscuous mode [ 89.016278][ T5786] hsr_slave_1: entered promiscuous mode [ 89.025550][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.032565][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.058791][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.064517][ T5778] Bluetooth: hci3: command tx timeout [ 89.072019][ T51] Bluetooth: hci2: command tx timeout [ 89.080485][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.087812][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.113923][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.132788][ T5779] hsr_slave_0: entered promiscuous mode [ 89.139480][ T5779] hsr_slave_1: entered promiscuous mode [ 89.145934][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.154297][ T5779] Cannot create hsr debugfs directory [ 89.316564][ T5775] hsr_slave_0: entered promiscuous mode [ 89.324075][ T5775] hsr_slave_1: entered promiscuous mode [ 89.330546][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.338952][ T5775] Cannot create hsr debugfs directory [ 89.430925][ T5784] hsr_slave_0: entered promiscuous mode [ 89.440357][ T5784] hsr_slave_1: entered promiscuous mode [ 89.446741][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.454728][ T5784] Cannot create hsr debugfs directory [ 89.755120][ T5779] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.773973][ T5779] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.807728][ T5779] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.818603][ T5779] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.878038][ T5786] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.909643][ T5786] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.920982][ T5786] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.933035][ T5786] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.037139][ T5784] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.058840][ T5784] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.075709][ T5784] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.121378][ T5784] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.206604][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.219727][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.237827][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.263886][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.347496][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.424975][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.436544][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.450995][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.458527][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.493363][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.500537][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.516120][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.540205][ T3446] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.547416][ T3446] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.581355][ T3446] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.588925][ T3446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.661298][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.674435][ T5779] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.696579][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.823293][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.838449][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.858424][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.865655][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.921440][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.928666][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.972886][ T51] Bluetooth: hci0: command tx timeout [ 90.978375][ T51] Bluetooth: hci1: command tx timeout [ 91.000051][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.007437][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.034371][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.041719][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.121761][ T51] Bluetooth: hci2: command tx timeout [ 91.134255][ T51] Bluetooth: hci3: command tx timeout [ 91.279350][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.437564][ T5779] veth0_vlan: entered promiscuous mode [ 91.453445][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.496802][ T5779] veth1_vlan: entered promiscuous mode [ 91.605125][ T5779] veth0_macvtap: entered promiscuous mode [ 91.637868][ T5779] veth1_macvtap: entered promiscuous mode [ 91.648027][ T5786] veth0_vlan: entered promiscuous mode [ 91.719616][ T5786] veth1_vlan: entered promiscuous mode [ 91.738006][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.756221][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.774196][ T5779] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.783561][ T5779] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.797336][ T5779] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.807002][ T5779] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.836052][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.915449][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.974055][ T3446] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.984558][ T5786] veth0_macvtap: entered promiscuous mode [ 91.995680][ T5786] veth1_macvtap: entered promiscuous mode [ 92.016241][ T3446] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.078308][ T5784] veth0_vlan: entered promiscuous mode [ 92.097370][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.108182][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.130390][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.148246][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.160853][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.170341][ T5784] veth1_vlan: entered promiscuous mode [ 92.214558][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.244062][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.276384][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.312610][ T5786] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.321417][ T5786] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.332847][ T5786] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.345422][ T5786] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.367468][ T5775] veth0_vlan: entered promiscuous mode [ 92.424500][ T5775] veth1_vlan: entered promiscuous mode [ 92.440023][ T5784] veth0_macvtap: entered promiscuous mode [ 92.503001][ T5784] veth1_macvtap: entered promiscuous mode [ 92.636524][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.653297][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.659186][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.672032][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.672071][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.672100][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.676730][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.717055][ T5775] veth0_macvtap: entered promiscuous mode [ 92.745117][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.764605][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.778588][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.791231][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.813732][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.835729][ T5775] veth1_macvtap: entered promiscuous mode [ 92.880688][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.908718][ T5784] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.919285][ T5784] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.928450][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.941250][ T5784] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.950270][ T5784] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.966307][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.980937][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.993765][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.004403][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.014610][ T5847] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 93.024497][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.035673][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.047308][ T51] Bluetooth: hci1: command tx timeout [ 93.052886][ T5778] Bluetooth: hci0: command tx timeout [ 93.061349][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.090570][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.114707][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.129975][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.140849][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.159464][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.170710][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.182944][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.211950][ T51] Bluetooth: hci3: command tx timeout [ 93.217416][ T51] Bluetooth: hci2: command tx timeout [ 93.242607][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.251422][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.261636][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.270947][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.302888][ T5849] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.465733][ T5853] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 93.500145][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.527600][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.680355][ T3487] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.699865][ T5837] wacom 0003:056A:003F.0001: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 93.708894][ T3487] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.750267][ T3446] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.767879][ T3446] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.871791][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.897194][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.941227][ T5857] fido_id[5857]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 94.076319][ T5861] autofs4:pid:5861:autofs_fill_super: called with bogus options [ 94.422553][ T8] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 94.627061][ T8] usb 1-1: config 0 interface 0 altsetting 12 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 94.655019][ T8] usb 1-1: config 0 interface 0 has no altsetting 0 [ 94.677897][ T8] usb 1-1: New USB device found, idVendor=06cd, idProduct=0115, bcdDevice=d9.c3 [ 94.696118][ T8] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.722266][ T8] usb 1-1: Product: syz [ 94.746339][ T8] usb 1-1: Manufacturer: syz [ 94.761257][ T8] usb 1-1: SerialNumber: syz [ 94.815651][ T8] usb 1-1: config 0 descriptor?? [ 94.880035][ T8] keyspan 1-1:0.0: Keyspan 2 port adapter converter detected [ 94.915139][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 87 [ 94.944119][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 7 [ 94.982882][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 81 [ 95.031554][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 1 [ 95.065693][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 2 [ 95.082592][ T5878] ftl_cs: FTL header not found. [ 95.105299][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 85 [ 95.124759][ T51] Bluetooth: hci1: command tx timeout [ 95.130332][ T51] Bluetooth: hci0: command tx timeout [ 95.144917][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 5 [ 95.182668][ T8] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 95.195046][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 83 [ 95.203405][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 3 [ 95.213320][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 4 [ 95.221026][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 86 [ 95.229497][ T8] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 6 [ 95.253160][ T8] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 95.281096][ T5878] block2mtd: mtd1: [/dev/zram0] erase_size = 0KiB [6] [ 95.292296][ T51] Bluetooth: hci2: command tx timeout [ 95.297764][ T51] Bluetooth: hci3: command tx timeout [ 95.321705][ T5814] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.345109][ T8] usb 1-1: USB disconnect, device number 2 [ 95.402398][ T8] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 95.455191][ T8] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 95.486503][ T8] keyspan 1-1:0.0: device disconnected [ 95.558317][ T5814] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 95.586108][ T5814] usb 2-1: config 0 has no interface number 0 [ 95.613641][ T5814] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 95.649706][ T5814] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 95.666741][ T5814] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.687973][ T5814] usb 2-1: Product: syz [ 95.701094][ T5814] usb 2-1: Manufacturer: syz [ 95.706511][ T5814] usb 2-1: SerialNumber: syz [ 95.729351][ T5814] usb 2-1: config 0 descriptor?? [ 95.753073][ T27] wacom 0003:056A:003F.0002: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 95.806651][ T5814] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 95.971800][ T175] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 96.037463][ T5899] fido_id[5899]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 96.140785][ T5814] usb 2-1: USB disconnect, device number 2 [ 96.184005][ T5814] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 96.192061][ T175] usb 3-1: Using ep0 maxpacket: 32 [ 96.220733][ T175] usb 3-1: unable to get BOS descriptor or descriptor too short [ 96.253379][ T175] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 96.271636][ T175] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 96.300304][ T175] usb 3-1: config 14 has no interface number 0 [ 96.312781][ T175] usb 3-1: config 14 has no interface number 1 [ 96.319076][ T175] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 96.365693][ T175] usb 3-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 96.384825][ T5907] FAULT_INJECTION: forcing a failure. [ 96.384825][ T5907] name failslab, interval 1, probability 0, space 0, times 1 [ 96.398728][ T175] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 96.425931][ T175] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 96.429944][ T5907] CPU: 1 PID: 5907 Comm: syz.0.19 Not tainted syzkaller #0 [ 96.446392][ T5907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 96.456519][ T5907] Call Trace: [ 96.459855][ T5907] [ 96.462836][ T5907] dump_stack_lvl+0x18c/0x250 [ 96.467585][ T5907] ? show_regs_print_info+0x20/0x20 [ 96.472854][ T5907] ? load_image+0x420/0x420 [ 96.477465][ T5907] ? __might_sleep+0xe0/0xe0 [ 96.479182][ T175] usb 3-1: config 14 interface 57 has no altsetting 0 [ 96.482097][ T5907] ? __lock_acquire+0x7eb0/0x7eb0 [ 96.482135][ T5907] should_fail_ex+0x394/0x4c0 [ 96.482174][ T5907] should_failslab+0x9/0x20 [ 96.482206][ T5907] slab_pre_alloc_hook+0x59/0x300 [ 96.482243][ T5907] ? kvmalloc_node+0x70/0x180 [ 96.482274][ T5907] ? kvmalloc_node+0x70/0x180 [ 96.482303][ T5907] __kmem_cache_alloc_node+0x53/0x250 [ 96.482342][ T5907] ? kvmalloc_node+0x70/0x180 [ 96.482371][ T5907] __kmalloc_node+0xa6/0x240 [ 96.482406][ T5907] kvmalloc_node+0x70/0x180 [ 96.520632][ T175] usb 3-1: config 14 interface 228 has no altsetting 0 [ 96.523274][ T5907] rhashtable_init+0x529/0xa60 [ 96.523309][ T5907] ? __asan_memcpy+0x40/0x70 [ 96.553507][ T5907] rhltable_init+0x1e/0x60 [ 96.557991][ T5907] nf_tables_newtable+0x69f/0x17b0 [ 96.563194][ T5907] nfnetlink_rcv+0x1133/0x2490 [ 96.568058][ T5907] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 96.573826][ T5907] ? __lock_acquire+0x7eb0/0x7eb0 [ 96.578923][ T5907] ? netlink_deliver_tap+0x2e/0x1b0 [ 96.584191][ T5907] netlink_unicast+0x7b1/0x930 [ 96.589065][ T5907] netlink_sendmsg+0x8d0/0xbf0 [ 96.593903][ T5907] ? netlink_getsockopt+0x590/0x590 [ 96.599174][ T5907] ? apparmor_socket_sendmsg+0x8e/0x330 [ 96.604790][ T5907] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 96.610137][ T5907] ? security_socket_sendmsg+0x80/0xa0 [ 96.615701][ T5907] ? netlink_getsockopt+0x590/0x590 [ 96.620978][ T5907] ____sys_sendmsg+0x61b/0x980 [ 96.625818][ T5907] ? __asan_memset+0x22/0x40 [ 96.630472][ T5907] ? __sys_sendmsg_sock+0x30/0x30 [ 96.635591][ T5907] ? __import_iovec+0x5f2/0x850 [ 96.640551][ T5907] ? import_iovec+0x73/0xa0 [ 96.645135][ T5907] ___sys_sendmsg+0x2a6/0x360 [ 96.650121][ T5907] ? __sys_sendmsg+0x2b0/0x2b0 [ 96.655965][ T5907] __se_sys_sendmsg+0x1d0/0x2c0 [ 96.660895][ T5907] ? __x64_sys_sendmsg+0x80/0x80 [ 96.665920][ T5907] ? lockdep_hardirqs_on+0x98/0x150 [ 96.671274][ T5907] do_syscall_64+0x55/0xb0 [ 96.675848][ T5907] ? clear_bhb_loop+0x40/0x90 [ 96.680585][ T5907] ? clear_bhb_loop+0x40/0x90 [ 96.685416][ T5907] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.691396][ T5907] RIP: 0033:0x7effd579e199 [ 96.695898][ T5907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.715660][ T5907] RSP: 002b:00007effd660e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.724151][ T5907] RAX: ffffffffffffffda RBX: 00007effd5a25fa0 RCX: 00007effd579e199 [ 96.732182][ T5907] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 96.740213][ T5907] RBP: 00007effd58358e0 R08: 0000000000000000 R09: 0000000000000000 [ 96.748245][ T5907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.756278][ T5907] R13: 00007effd5a26038 R14: 00007effd5a25fa0 R15: 00007fff6296fec8 [ 96.764504][ T5907] [ 96.778488][ T175] usb 3-1: language id specifier not provided by device, defaulting to English [ 96.853571][ T175] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 96.872837][ T175] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.907556][ T175] usb 3-1: Product: syz [ 96.931925][ T175] usb 3-1: Manufacturer: syz [ 96.942821][ T175] usb 3-1: SerialNumber: syz [ 97.370829][ T23] cfg80211: failed to load regulatory.db [ 97.382571][ T5924] FAULT_INJECTION: forcing a failure. [ 97.382571][ T5924] name fail_futex, interval 1, probability 0, space 0, times 1 [ 97.399717][ T5924] CPU: 1 PID: 5924 Comm: syz.1.23 Not tainted syzkaller #0 [ 97.406988][ T5924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 97.417109][ T5924] Call Trace: [ 97.420430][ T5924] [ 97.423427][ T5924] dump_stack_lvl+0x18c/0x250 [ 97.428169][ T5924] ? show_regs_print_info+0x20/0x20 [ 97.433438][ T5924] ? load_image+0x420/0x420 [ 97.438102][ T5924] ? asan.module_dtor+0x20/0x20 [ 97.443024][ T5924] should_fail_ex+0x394/0x4c0 [ 97.448116][ T5924] get_futex_key+0x136/0x1030 [ 97.452937][ T5924] ? futex_setup_timer+0xc0/0xc0 [ 97.457938][ T5924] futex_wake+0x127/0x4f0 [ 97.462333][ T5924] ? __lock_acquire+0x7eb0/0x7eb0 [ 97.467412][ T5924] ? rcu_is_watching+0x15/0xb0 [ 97.472244][ T5924] ? futex_wake_mark+0x150/0x150 [ 97.477238][ T5924] ? __mutex_lock+0x30d/0xc80 [ 97.482014][ T5924] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 97.487706][ T5924] do_futex+0x35d/0x3e0 [ 97.491912][ T5924] ? __ia32_sys_get_robust_list+0x110/0x110 [ 97.497863][ T5924] __se_sys_futex+0x3a9/0x440 [ 97.502596][ T5924] ? __x64_sys_futex+0xf0/0xf0 [ 97.507421][ T5924] ? __x64_sys_futex+0x21/0xf0 [ 97.512239][ T5924] do_syscall_64+0x55/0xb0 [ 97.516704][ T5924] ? clear_bhb_loop+0x40/0x90 [ 97.521416][ T5924] ? clear_bhb_loop+0x40/0x90 [ 97.526124][ T5924] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 97.532058][ T5924] RIP: 0033:0x7f178559e199 [ 97.536504][ T5924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.556147][ T5924] RSP: 002b:00007f178645e0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 97.564611][ T5924] RAX: ffffffffffffffda RBX: 00007f1785825fa8 RCX: 00007f178559e199 [ 97.572624][ T5924] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1785825fac [ 97.580637][ T5924] RBP: 00007f1785825fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 97.588737][ T5924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.596739][ T5924] R13: 00007f1785826038 R14: 00007ffe67f8ee30 R15: 00007ffe67f8ef18 [ 97.604763][ T5924] [ 97.653646][ T175] legousbtower 3-1:14.57: interrupt endpoints not found [ 97.826872][ T175] legousbtower 3-1:14.228: interrupt endpoints not found [ 98.013764][ T5930] block2mtd: error: cannot open device /dev/zram0 [ 98.208071][ T175] wacom 0003:056A:003F.0003: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 98.353524][ T5935] fido_id[5935]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 98.627021][ T5940] netlink: 148 bytes leftover after parsing attributes in process `syz.3.28'. [ 99.782173][ T5979] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 5 out of range (51000000..2150000000) [ 99.863142][ T175] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 99.882255][ T1197] usb 3-1: USB disconnect, device number 2 [ 100.087585][ T175] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 100.124179][ T175] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 100.155274][ T175] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.214599][ T175] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 100.250886][ T51] Bluetooth: hci3: command tx timeout [ 100.272014][ T175] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 100.280090][ T175] usb 2-1: Product: syz [ 100.293672][ T5992] netlink: 44 bytes leftover after parsing attributes in process `syz.3.44'. [ 100.311633][ T175] usb 2-1: Manufacturer: syz [ 100.332590][ T5992] tipc: Enabling of bearer rejected, media not registered [ 100.357690][ T5975] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 100.418139][ T175] garmin_gps 2-1:1.0: Garmin GPS usb/tty converter detected [ 100.452167][ T175] usb 2-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 100.612030][ T6002] Zero length message leads to an empty skb [ 100.710767][ T175] usb 2-1: USB disconnect, device number 3 [ 100.750323][ T175] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 100.772975][ T175] garmin_gps 2-1:1.0: device disconnected [ 101.347953][ T6026] netlink: 4 bytes leftover after parsing attributes in process `syz.3.55'. [ 101.687630][ T6039] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 101.694595][ T6039] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 102.071774][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 103.086954][ T6043] syz.3.62[6043]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 103.103266][ T6043] loop3: detected capacity change from 0 to 512 [ 103.111116][ T6043] ======================================================= [ 103.111116][ T6043] WARNING: The mand mount option has been deprecated and [ 103.111116][ T6043] and is ignored by this kernel. Remove the mand [ 103.111116][ T6043] option from the mount to silence this warning. [ 103.111116][ T6043] ======================================================= [ 103.172583][ T6043] EXT4-fs (loop3): Unsupported encryption level 190 [ 103.822520][ T6060] random: crng reseeded on system resumption [ 103.852968][ T6058] netlink: 12 bytes leftover after parsing attributes in process `syz.1.70'. [ 104.631721][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 105.286178][ T6065] loop0: detected capacity change from 0 to 512 [ 105.296801][ T6065] EXT4-fs (loop0): Unsupported encryption level 190 [ 105.762659][ T6070] overlayfs: conflicting options: userxattr,metacopy=on [ 107.191702][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 108.154495][ T6088] FAULT_INJECTION: forcing a failure. [ 108.154495][ T6088] name failslab, interval 1, probability 0, space 0, times 0 [ 108.171743][ T6088] CPU: 0 PID: 6088 Comm: syz.1.83 Not tainted syzkaller #0 [ 108.179018][ T6088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 108.189126][ T6088] Call Trace: [ 108.192450][ T6088] [ 108.195430][ T6088] dump_stack_lvl+0x18c/0x250 [ 108.200178][ T6088] ? show_regs_print_info+0x20/0x20 [ 108.205439][ T6088] ? load_image+0x420/0x420 [ 108.210009][ T6088] ? __might_sleep+0xe0/0xe0 [ 108.214654][ T6088] ? __lock_acquire+0x7eb0/0x7eb0 [ 108.219779][ T6088] should_fail_ex+0x394/0x4c0 [ 108.224541][ T6088] should_failslab+0x9/0x20 [ 108.229109][ T6088] slab_pre_alloc_hook+0x59/0x300 [ 108.234228][ T6088] kmem_cache_alloc+0x5a/0x2c0 [ 108.239138][ T6088] ? vm_area_dup+0x27/0x270 [ 108.243720][ T6088] vm_area_dup+0x27/0x270 [ 108.248094][ T6088] copy_mm+0x11a6/0x1e30 [ 108.252385][ T6088] ? copy_signal+0x640/0x640 [ 108.257045][ T6088] ? __init_rwsem+0x122/0x160 [ 108.261751][ T6088] ? copy_signal+0x51f/0x640 [ 108.266374][ T6088] copy_process+0x16c9/0x3da0 [ 108.271099][ T6088] ? plist_add+0x3db/0x490 [ 108.275555][ T6088] ? copy_process+0x98e/0x3da0 [ 108.280376][ T6088] ? futex_wait+0x4a7/0x5c0 [ 108.285014][ T6088] ? __pidfd_prepare+0x140/0x140 [ 108.290015][ T6088] kernel_clone+0x24b/0x8a0 [ 108.294567][ T6088] ? create_io_thread+0x190/0x190 [ 108.299725][ T6088] ? do_futex+0x2ff/0x3e0 [ 108.304182][ T6088] __x64_sys_clone+0x1b7/0x230 [ 108.308983][ T6088] ? __ia32_sys_vfork+0x140/0x140 [ 108.314065][ T6088] ? lock_chain_count+0x20/0x20 [ 108.318979][ T6088] ? lockdep_hardirqs_on+0x98/0x150 [ 108.324228][ T6088] do_syscall_64+0x55/0xb0 [ 108.328699][ T6088] ? clear_bhb_loop+0x40/0x90 [ 108.333418][ T6088] ? clear_bhb_loop+0x40/0x90 [ 108.338144][ T6088] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 108.344087][ T6088] RIP: 0033:0x7f178559e199 [ 108.348538][ T6088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.368181][ T6088] RSP: 002b:00007f178645dfd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 108.376633][ T6088] RAX: ffffffffffffffda RBX: 00007f1785825fa0 RCX: 00007f178559e199 [ 108.384639][ T6088] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 108.392638][ T6088] RBP: 00007f17856358e0 R08: 0000000000000000 R09: 0000000000000000 [ 108.400745][ T6088] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 108.408738][ T6088] R13: 00007f1785826038 R14: 00007f1785825fa0 R15: 00007ffe67f8ef18 [ 108.416750][ T6088] [ 108.637158][ T6090] loop2: detected capacity change from 0 to 512 [ 108.665287][ T6090] EXT4-fs (loop2): Unsupported encryption level 190 [ 109.077039][ T6096] loop1: detected capacity change from 0 to 512 [ 109.155275][ T6099] netlink: 12 bytes leftover after parsing attributes in process `syz.2.87'. [ 109.231947][ T6096] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 109.240830][ T6096] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e042e018, mo2=0002] [ 109.249708][ T6096] System zones: 0-1, 15-15, 18-18, 34-34 [ 109.256790][ T6096] EXT4-fs (loop1): orphan cleanup on readonly fs [ 109.263925][ T6096] Quota error (device loop1): v2_read_header: Failed header read: expected=8 got=0 [ 109.274005][ T6096] EXT4-fs warning (device loop1): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 109.289205][ T6096] EXT4-fs (loop1): Cannot turn on quotas: error -22 [ 109.296809][ T6096] EXT4-fs error (device loop1): ext4_orphan_get:1434: comm syz.1.86: bad orphan inode 16 [ 109.311759][ T6096] ext4_test_bit(bit=15, block=18) = 1 [ 109.337661][ T6096] is_bad_inode(inode)=0 [ 109.426710][ T6096] NEXT_ORPHAN(inode)=0 [ 110.225287][ T6096] max_ino=32 [ 110.228533][ T6096] i_nlink=2 [ 110.264183][ T6096] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 111.901816][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 113.336351][ T5784] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.756926][ T175] wacom 0003:056A:003F.0004: hidraw0: USB HID v0.00 Gamepad [syz0] on syz0 [ 113.954805][ T6133] fido_id[6133]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 116.373508][ T6155] netlink: 412 bytes leftover after parsing attributes in process `syz.0.106'. [ 116.507938][ T6155] netlink: 412 bytes leftover after parsing attributes in process `syz.0.106'. [ 119.581853][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 119.986888][ T6174] loop1: detected capacity change from 0 to 512 [ 119.992584][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 120.042985][ T6174] EXT4-fs (loop1): Unsupported encryption level 190 [ 120.304053][ T6182] warning: `syz.0.116' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 121.631712][ C1] ------------[ cut here ]------------ [ 121.641877][ C1] WARNING: CPU: 1 PID: 6190 at net/mac80211/tx.c:5057 __ieee80211_beacon_get+0x1141/0x1520 [ 121.655102][ C1] Modules linked in: [ 121.659041][ C1] CPU: 1 PID: 6190 Comm: syz.0.119 Not tainted syzkaller #0 [ 121.666374][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 121.676492][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 121.682894][ C1] Code: f7 4c 89 ef e8 f0 56 b5 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 bb 4b 77 f7 0f 0b e9 61 f8 ff ff e8 af 4b 77 f7 <0f> 0b e9 85 fb ff ff e8 a3 4b 77 f7 48 c7 c7 40 99 65 8e 4c 89 e6 [ 121.702612][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 121.708743][ C1] RAX: ffffffff8a104501 RBX: dffffc0000000000 RCX: ffff888077263c00 [ 121.716768][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 121.724787][ C1] RBP: 0000000000000000 R08: ffff888077263c00 R09: 0000000000000003 [ 121.732813][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805dff2440 [ 121.740839][ C1] R13: ffff88802c366424 R14: ffff88805dff2930 R15: ffff88802c366400 [ 121.748847][ C1] FS: 00007effd65ed6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 121.757831][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 121.764447][ C1] CR2: 00007effd5787300 CR3: 000000002ea52000 CR4: 00000000003506e0 [ 121.772485][ C1] Call Trace: [ 121.775777][ C1] [ 121.778644][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 121.784237][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 121.789730][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 121.796554][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 121.802151][ C1] __iterate_interfaces+0x225/0x4c0 [ 121.807390][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 121.813676][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 121.820909][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 121.827190][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 121.834368][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 121.839633][ C1] ? hw_scan_work+0xf10/0xf10 [ 121.844352][ C1] __hrtimer_run_queues+0x525/0xc10 [ 121.849668][ C1] ? hrtimer_interrupt+0x980/0x980 [ 121.854912][ C1] ? read_tsc+0x9/0x20 [ 121.859004][ C1] hrtimer_run_softirq+0x177/0x290 [ 121.864162][ C1] handle_softirqs+0x27d/0x820 [ 121.868934][ C1] ? read_tsc+0x9/0x20 [ 121.873047][ C1] ? ktime_get+0x24b/0x280 [ 121.877478][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 121.882273][ C1] ? do_softirq+0x1a0/0x1a0 [ 121.886798][ C1] __irq_exit_rcu+0xd3/0x190 [ 121.891433][ C1] ? irq_exit_rcu+0x20/0x20 [ 121.895975][ C1] irq_exit_rcu+0x9/0x20 [ 121.900228][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 121.906022][ C1] [ 121.908968][ C1] [ 121.911929][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 121.917928][ C1] RIP: 0010:lock_acquire+0xde/0x420 [ 121.923167][ C1] Code: a0 77 00 4c 0f a3 35 99 c8 23 0d 73 0d e8 8a bc 08 00 84 c0 0f 84 2e 02 00 00 48 c7 c0 2c 97 8c 8e 48 c1 e8 03 42 0f b6 04 38 <84> c0 0f 85 1d 02 00 00 83 3d 2f fd 23 0d 00 0f 84 0c 01 00 00 65 [ 121.942929][ C1] RSP: 0000:ffffc9000b4d6e00 EFLAGS: 00000a03 [ 121.949009][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 10bc1ff1091ed600 [ 121.957248][ C1] RDX: 0000000000000000 RSI: ffffffff8b1d4000 RDI: ffffffff8b1d3fc0 [ 121.965278][ C1] RBP: ffffc9000b4d6f08 R08: ffffffff8e8c626f R09: 1ffffffff1d18c4d [ 121.973392][ C1] R10: dffffc0000000000 R11: fffffbfff1d18c4e R12: 1ffff9200169adcc [ 121.981396][ C1] R13: ffffffff8d1320e0 R14: 0000000000000001 R15: dffffc0000000000 [ 121.989451][ C1] ? read_lock_is_recursive+0x20/0x20 [ 121.994870][ C1] ? verify_lock_unused+0x140/0x140 [ 122.000093][ C1] ? mark_lock+0x94/0x320 [ 122.004487][ C1] ? filemap_get_entry+0xce/0x3f0 [ 122.009545][ C1] filemap_get_entry+0xea/0x3f0 [ 122.014428][ C1] ? filemap_get_entry+0xce/0x3f0 [ 122.019474][ C1] ? page_cache_prev_miss+0x390/0x390 [ 122.024993][ C1] shmem_get_folio_gfp+0x2a4/0x2b40 [ 122.030237][ C1] shmem_write_begin+0xf2/0x430 [ 122.035135][ C1] generic_perform_write+0x2fe/0x5c0 [ 122.040495][ C1] ? generic_file_direct_write+0x3e0/0x3e0 [ 122.046374][ C1] ? down_write+0x16e/0x200 [ 122.050900][ C1] ? file_update_time+0x98/0x1a0 [ 122.055890][ C1] shmem_file_write_iter+0xfb/0x120 [ 122.061132][ C1] __kernel_write_iter+0x29f/0x6d0 [ 122.066399][ C1] ? vfs_read+0x990/0x990 [ 122.070792][ C1] ? get_dump_page+0x156/0x200 [ 122.075628][ C1] ? __asan_memset+0x22/0x40 [ 122.080260][ C1] ? iov_iter_bvec+0xd4/0x1b0 [ 122.085017][ C1] dump_user_range+0x418/0x840 [ 122.089884][ C1] ? dump_skip+0x40/0x40 [ 122.094172][ C1] ? dump_emit+0x78/0xe0 [ 122.098460][ C1] ? dump_emit+0xa6/0xe0 [ 122.102743][ C1] ? elf_core_dump+0x2dbb/0x37c0 [ 122.107731][ C1] elf_core_dump+0x320e/0x37c0 [ 122.112550][ C1] ? load_elf_binary+0x2850/0x2850 [ 122.118428][ C1] ? verify_lock_unused+0x140/0x140 [ 122.123701][ C1] ? __lock_acquire+0x7eb0/0x7eb0 [ 122.128757][ C1] ? mas_next_slot+0x94c/0x980 [ 122.133594][ C1] ? rcu_read_lock_any_held+0xb4/0x140 [ 122.139100][ C1] ? 0xffffffffff600000 [ 122.143012][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 122.143400][ C1] do_coredump+0x1791/0x24a0 [ 122.156217][ C1] ? nfs_stat_to_errno+0x170/0x170 [ 122.161374][ C1] ? lock_chain_count+0x20/0x20 [ 122.166268][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 122.171505][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 122.176772][ C1] get_signal+0x10da/0x1390 [ 122.181303][ C1] arch_do_signal_or_restart+0xc2/0x7b0 [ 122.186913][ C1] ? get_sigframe_size+0x20/0x20 [ 122.191891][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 122.197893][ C1] ? exit_to_user_mode_loop+0x3b/0x110 [ 122.203392][ C1] exit_to_user_mode_loop+0x70/0x110 [ 122.208715][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 122.214299][ C1] irqentry_exit_to_user_mode+0x9/0x30 [ 122.219768][ C1] exc_page_fault+0x8c/0x100 [ 122.224428][ C1] asm_exc_page_fault+0x26/0x30 [ 122.229313][ C1] RIP: 0033:0x7effd579e1a1 [ 122.233799][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 122.253484][ C1] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 122.259631][ C1] RAX: 0000000000000000 RBX: 00007effd5a26090 RCX: 00007effd579e199 [ 122.267654][ C1] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 122.275691][ C1] RBP: 00007effd58358e0 R08: 0000000000000000 R09: 0000000000000000 [ 122.283728][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 122.291772][ C1] R13: 00007effd5a26128 R14: 00007effd5a26090 R15: 00007fff6296fec8 [ 122.299782][ C1] [ 122.302844][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 122.310137][ C1] CPU: 1 PID: 6190 Comm: syz.0.119 Not tainted syzkaller #0 [ 122.317429][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 122.327516][ C1] Call Trace: [ 122.330851][ C1] [ 122.331954][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 122.342155][ C1] dump_stack_lvl+0x18c/0x250 [ 122.346901][ C1] ? show_regs_print_info+0x20/0x20 [ 122.352147][ C1] ? load_image+0x420/0x420 [ 122.356678][ C1] panic+0x2ca/0x720 [ 122.360590][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 122.365555][ C1] __warn+0x2e0/0x470 [ 122.369546][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.375280][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.381011][ C1] report_bug+0x2be/0x4f0 [ 122.385346][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.391073][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.396897][ C1] ? __ieee80211_beacon_get+0x1143/0x1520 [ 122.402722][ C1] handle_bug+0xcf/0x120 [ 122.406989][ C1] exc_invalid_op+0x1a/0x50 [ 122.411499][ C1] asm_exc_invalid_op+0x1a/0x20 [ 122.416401][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 122.422746][ C1] Code: f7 4c 89 ef e8 f0 56 b5 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 bb 4b 77 f7 0f 0b e9 61 f8 ff ff e8 af 4b 77 f7 <0f> 0b e9 85 fb ff ff e8 a3 4b 77 f7 48 c7 c7 40 99 65 8e 4c 89 e6 [ 122.442364][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 122.448445][ C1] RAX: ffffffff8a104501 RBX: dffffc0000000000 RCX: ffff888077263c00 [ 122.456471][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 122.464451][ C1] RBP: 0000000000000000 R08: ffff888077263c00 R09: 0000000000000003 [ 122.472428][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805dff2440 [ 122.480401][ C1] R13: ffff88802c366424 R14: ffff88805dff2930 R15: ffff88802c366400 [ 122.488399][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.494238][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 122.499982][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 122.505548][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 122.511019][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 122.517803][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 122.523394][ C1] __iterate_interfaces+0x225/0x4c0 [ 122.528608][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 122.534863][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 122.542072][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 122.548755][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 122.552686][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 122.564064][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 122.569282][ C1] ? hw_scan_work+0xf10/0xf10 [ 122.573975][ C1] __hrtimer_run_queues+0x525/0xc10 [ 122.579201][ C1] ? hrtimer_interrupt+0x980/0x980 [ 122.584349][ C1] ? read_tsc+0x9/0x20 [ 122.588448][ C1] hrtimer_run_softirq+0x177/0x290 [ 122.593661][ C1] handle_softirqs+0x27d/0x820 [ 122.598432][ C1] ? read_tsc+0x9/0x20 [ 122.602516][ C1] ? ktime_get+0x24b/0x280 [ 122.606940][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 122.611722][ C1] ? do_softirq+0x1a0/0x1a0 [ 122.616252][ C1] __irq_exit_rcu+0xd3/0x190 [ 122.620852][ C1] ? irq_exit_rcu+0x20/0x20 [ 122.625373][ C1] irq_exit_rcu+0x9/0x20 [ 122.629623][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 122.635284][ C1] [ 122.638225][ C1] [ 122.641163][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 122.647180][ C1] RIP: 0010:lock_acquire+0xde/0x420 [ 122.652409][ C1] Code: a0 77 00 4c 0f a3 35 99 c8 23 0d 73 0d e8 8a bc 08 00 84 c0 0f 84 2e 02 00 00 48 c7 c0 2c 97 8c 8e 48 c1 e8 03 42 0f b6 04 38 <84> c0 0f 85 1d 02 00 00 83 3d 2f fd 23 0d 00 0f 84 0c 01 00 00 65 [ 122.672040][ C1] RSP: 0000:ffffc9000b4d6e00 EFLAGS: 00000a03 [ 122.678234][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 10bc1ff1091ed600 [ 122.686220][ C1] RDX: 0000000000000000 RSI: ffffffff8b1d4000 RDI: ffffffff8b1d3fc0 [ 122.694287][ C1] RBP: ffffc9000b4d6f08 R08: ffffffff8e8c626f R09: 1ffffffff1d18c4d [ 122.702272][ C1] R10: dffffc0000000000 R11: fffffbfff1d18c4e R12: 1ffff9200169adcc [ 122.710251][ C1] R13: ffffffff8d1320e0 R14: 0000000000000001 R15: dffffc0000000000 [ 122.718252][ C1] ? read_lock_is_recursive+0x20/0x20 [ 122.723647][ C1] ? verify_lock_unused+0x140/0x140 [ 122.728860][ C1] ? mark_lock+0x94/0x320 [ 122.733292][ C1] ? filemap_get_entry+0xce/0x3f0 [ 122.738348][ C1] filemap_get_entry+0xea/0x3f0 [ 122.743212][ C1] ? filemap_get_entry+0xce/0x3f0 [ 122.748285][ C1] ? page_cache_prev_miss+0x390/0x390 [ 122.753681][ C1] shmem_get_folio_gfp+0x2a4/0x2b40 [ 122.758938][ C1] shmem_write_begin+0xf2/0x430 [ 122.763812][ C1] generic_perform_write+0x2fe/0x5c0 [ 122.769206][ C1] ? generic_file_direct_write+0x3e0/0x3e0 [ 122.775026][ C1] ? down_write+0x16e/0x200 [ 122.779542][ C1] ? file_update_time+0x98/0x1a0 [ 122.784514][ C1] shmem_file_write_iter+0xfb/0x120 [ 122.789727][ C1] __kernel_write_iter+0x29f/0x6d0 [ 122.795309][ C1] ? vfs_read+0x990/0x990 [ 122.799649][ C1] ? get_dump_page+0x156/0x200 [ 122.804442][ C1] ? __asan_memset+0x22/0x40 [ 122.809051][ C1] ? iov_iter_bvec+0xd4/0x1b0 [ 122.813762][ C1] dump_user_range+0x418/0x840 [ 122.818547][ C1] ? dump_skip+0x40/0x40 [ 122.822797][ C1] ? dump_emit+0x78/0xe0 [ 122.827056][ C1] ? dump_emit+0xa6/0xe0 [ 122.831304][ C1] ? elf_core_dump+0x2dbb/0x37c0 [ 122.836272][ C1] elf_core_dump+0x320e/0x37c0 [ 122.841097][ C1] ? load_elf_binary+0x2850/0x2850 [ 122.846228][ C1] ? verify_lock_unused+0x140/0x140 [ 122.851445][ C1] ? __lock_acquire+0x7eb0/0x7eb0 [ 122.856480][ C1] ? mas_next_slot+0x94c/0x980 [ 122.861286][ C1] ? rcu_read_lock_any_held+0xb4/0x140 [ 122.866759][ C1] ? 0xffffffffff600000 [ 122.870928][ C1] do_coredump+0x1791/0x24a0 [ 122.875545][ C1] ? nfs_stat_to_errno+0x170/0x170 [ 122.880683][ C1] ? lock_chain_count+0x20/0x20 [ 122.885555][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 122.890769][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 122.895984][ C1] get_signal+0x10da/0x1390 [ 122.900517][ C1] arch_do_signal_or_restart+0xc2/0x7b0 [ 122.906098][ C1] ? get_sigframe_size+0x20/0x20 [ 122.911054][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 122.917070][ C1] ? exit_to_user_mode_loop+0x3b/0x110 [ 122.922545][ C1] exit_to_user_mode_loop+0x70/0x110 [ 122.927867][ C1] exit_to_user_mode_prepare+0xee/0x180 [ 122.933426][ C1] irqentry_exit_to_user_mode+0x9/0x30 [ 122.938892][ C1] exc_page_fault+0x8c/0x100 [ 122.943502][ C1] asm_exc_page_fault+0x26/0x30 [ 122.948370][ C1] RIP: 0033:0x7effd579e1a1 [ 122.952791][ C1] Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f [ 122.962136][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 122.980669][ C1] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 122.986747][ C1] RAX: 0000000000000000 RBX: 00007effd5a26090 RCX: 00007effd579e199 [ 122.994728][ C1] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 123.002709][ C1] RBP: 00007effd58358e0 R08: 0000000000000000 R09: 0000000000000000 [ 123.010715][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 123.018867][ C1] R13: 00007effd5a26128 R14: 00007effd5a26090 R15: 00007fff6296fec8 [ 123.026872][ C1] [ 123.030497][ C1] Kernel Offset: disabled [ 123.034883][ C1] Rebooting in 86400 seconds..