last executing test programs: 7.324802446s ago: executing program 1 (id=896): unshare$auto(0x40000082) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0x2, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4ea2, @remote}, 0x6a) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7, 0x20020000) preadv$auto(0x40000000000003, 0x0, 0x6, 0x5ff4, 0x1) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty36\x00', 0x400201, 0x0) write$auto(0x3, 0x0, 0x7fffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$auto_MACSEC_CMD_ADD_RXSC(r1, 0x0, 0x4000040) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) sendmsg$auto_NL80211_CMD_PROBE_MESH_LINK(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB], 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x400c080) syslog$auto(0x4, 0x0, 0x0) write$auto(0x3, 0x0, 0xfffffdef) rt_sigqueueinfo$auto(0x0, 0x0, &(0x7f00000002c0)={@_si_pad}) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x100000000000001c, 0x280000000000, 0x63, 0x0, 0xee01, 0x0, 0x1002, 0x4, 0x80000008040000a, 0x40000402, 0x7, 0x8, 0xffffffff80000000, 0x800000000000b, 0x6, 0x240000100105}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r4 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004) write$auto_split_huge_pages_fops_huge_memory(r3, &(0x7f0000000340)="8c7f501d8f050494aeeaad77698848c810e5cd81e9fbfe4f4f3fa803de89ff6b1a900d6576dcc709f7785754dcb2916794ca8f18958c1c7da78d62963287794b9c785d5d215030e91f57f60064de64a082cd347433068429d08ca96cf1fb4c9b025cb2264bf91c5e03d660c187b445eab29cfb0de364c66920831b24392974701ecb0ea4c7e1e1be2fdc331aaaca52f20b2df55f00fd0d22106d9190673d92ee833361a9", 0xa4) io_setup$auto(0x401, 0x0) 6.316168433s ago: executing program 0 (id=902): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/ip_vs_conn\x00', 0x62240, 0x0) close_range$auto(0x2, 0x8, 0x0) ftruncate$auto(0xffffffffffffffff, 0x3) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$auto_KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r1) close_range$auto(0x2, 0x8, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x801, 0x0) socket(0xf, 0x3, 0x2) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r4 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = socket(0x1e, 0x1, 0x0) syz_clone3(&(0x7f0000000600)={0x100, &(0x7f0000000280), &(0x7f0000000340)=0x0, 0x0, {0x24}, &(0x7f0000000440)=""/213, 0xd5, &(0x7f0000000540)=""/136, &(0x7f00000003c0)=[0x0], 0x1, {r4}}, 0x58) sendmsg$auto_OVS_FLOW_CMD_GET(r5, &(0x7f00000019c0)={&(0x7f0000000040), 0xc, &(0x7f0000001980)={&(0x7f0000001a00)=ANY=[@ANYBLOB="f4120000", @ANYRES16=0x0, @ANYBLOB="d9da3c3337beebc7918b07636ccfc1a9c951333857c313e216285eb3327c7a0c0009007e00000000009b2591ad00000800", @ANYBLOB, @ANYRES32=r6, @ANYRES32=r2, @ANYBLOB], 0x12f4}, 0x1, 0x0, 0x0, 0x4000}, 0x20000880) openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000026d00)='/dev/dri/card0\x00', 0x2000, 0x0) fanotify_init$auto(0x5, 0x2000000000002) select$auto(0x6, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x6, 0xfff, 0x6, 0x5, 0x3, 0x95f4da2d, 0xc, 0x6, 0x62, 0x7, 0x7, 0x6d3f, 0xa, 0x4, 0x5]}, 0x0) write$auto(r3, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x3, 0x400000000009, 0x1, 0x948b, 0x3, 0x15f4da0c, 0x1, 0x2000000000000004, 0x62, 0x80000001, 0x6, 0xffff, 0x9, 0x40000000002, 0xfffffffffffffffe]}, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae80, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x3c3842, 0x0) socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) close_range$auto(0x2, 0x8, 0x0) read$auto_proc_reg_file_ops_compat_inode(r0, 0x0, 0x0) 6.212494235s ago: executing program 2 (id=903): openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0x2, 0x1, 0x106) read$auto(r0, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x4) bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) io_uring_setup$auto(0x6, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x400000000008000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r1, r1, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r2 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 5.840916534s ago: executing program 1 (id=905): mmap$auto(0x0, 0x0, 0xc00000072, 0xfffffffffffffff7, 0x1000000002, 0x8000) r0 = io_uring_setup$auto(0x86, 0x0) r1 = getpid() prctl$auto_PR_SCHED_CORE_SHARE_FROM(0x8, 0x3, r1, 0x0, 0x6) socket(0x28, 0x4, 0xffffffc0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) ustat$auto(0x12, &(0x7f0000000340)={0x2, 0x80, "417acc606935", "db5f19b5a360"}) write$auto(r2, &(0x7f0000000840)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xf3\x8dz \xee\x04\x18U\xd9\xfeZ\x1a\xe2\x9cK\fE\a\xca\xd36\xe8k8\x83\xcf\xc5D\xcc>\xb2\x9a|y\xfa\xb6\xa6\xeb\xba\xac\xd561\v\x96\xe2 #5\xf6j<\x9a\xc7KG\xa0\xdf\x82\x068k\x05\x9d\xa6\x99\xa3\x91;\xeb\xf8\xff\xae\xe6\x82N\nF\x12\xc5\xc2>k\x9a{o\xaa\xe5n\x97\t\xbd\x06\xaep\b\xc7\xc9\xa4\r\x17s\x86\xf1\x97\x84\x84jL;q\xb5UNO\x0e5\xe1A\x17\x19B\x12t\xb5\xe9]\x94\x95\xe2R\x8d$\x1bm\x9e<\x8f\x11\xab1<\x8b\\\xc1\x94\xbd\x84t\xdbs\xcf\xeb\x84\x8b\x80\xc8u\x93Q\xe2K\xcf7\xd2Y\xc0\xc2\x06\xc3\xbb\x8d\x7faO\x15\xb6ACQ$\x1a\x85\xe6y\xc2\x06\xc9\xff\xdd\xb6\x80\xd9tc\xcb\x01\x1e\xe0\x9a\xc5\x81\xa8\xd2F\x82\xd2\xa3\xe5\xb4&\x84\xe8\x11X\x06:\xd4\xe3ou\xbd\xa3T\xb4@V\x1f\x8f\x19\xa9N\xaf0\xc7\xb7\xccQ;\xcc\x9f\x95\xcf\x92\xa6\xf1!\xf7\x02Dq6\x96\x80\xfaD\xccw*\xae\xdfl.F\x1c\x8c\xe89\x01\xf6\xe3f:\xccys\xda\xc1\xbc],\x10\x1f\xe1\xc6\x909\x88IHJ\xb0\x1a\x9f!\xa0\xcc\f+\x96\xd8\x06F\xd2\xd3\xf0\xf0\xcam\xa4:2\x81\xf8F\xce&3\x1f|\x17n<\xbdGv\xf1/\x1c\xf0f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) madvise$auto(0x0, 0x2003f0, 0x15) io_uring_setup$auto(0x1, 0x0) bpf$auto(0x5, 0x0, 0x102) getpid() r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/graphics/fbcon/cursor_blink\x00', 0xa001, 0x0) write$auto(r3, &(0x7f0000000140)='7\x81=\"\xad\xff\x8d\xf9P\x18\xa4\xb0\xb4\xd9\x82=\xe1P\x05\x00\xfb&\xe8\xbf\x901\a2\xa2X`\a\xf1y\xb3\"=', 0xd4d0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000164c0), 0xffffffffffffffff) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) madvise$auto(0x0, 0xfffffffffffefffd, 0x17) madvise$auto(0x0, 0xffffffffffff0005, 0x19) io_uring_setup$auto(0x59, &(0x7f0000000080)={0x7fffffff, 0xd, 0x4002, 0x6, 0x7, 0x8, 0xffffffffffffffff, [], {0xa, 0x6, 0xf, 0x29f, 0x103, 0x7f, 0x101, 0x6, 0x2000}, {0x100, 0x1, 0x52, 0x5, 0x1, 0x40, 0x76c5, 0x8, 0x100000000}}) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) madvise$auto(0x0, 0x400053, 0x9) read$auto(r2, 0x0, 0xb4d3) write$auto(0x3, 0x0, 0xffd8) 5.052253435s ago: executing program 3 (id=907): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r1 = socket(0x2, 0x1, 0x106) read$auto(r1, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x4) bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) io_uring_setup$auto(0x6, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r2, r2, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r3 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 4.717571125s ago: executing program 0 (id=908): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r1 = socket(0x2, 0x1, 0x106) read$auto(r1, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x4) bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) io_uring_setup$auto(0x6, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x400000000008000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r2, r2, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r3 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 4.41282092s ago: executing program 1 (id=909): r0 = openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0) socket(0x2, 0x1, 0x106) ioctl$auto(0xffffffffffffffff, 0xab07, 0xffffffffffffffff) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$auto_NL80211_CMD_SET_COALESCE(0xffffffffffffffff, 0x0, 0x0) setsockopt$auto_SO_MARK(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000380)='\x00', 0x163fdb7e) r2 = socket$nl_generic(0x10, 0x3, 0x10) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) semctl$auto(0x8, 0x806, 0x13, 0x46) msgctl$auto_IPC_INFO(0x7, 0x3, &(0x7f0000000200)={{0x13b8, 0x0, 0xee01, 0x100, 0x3, 0x7fffffff, 0x3afa}, &(0x7f0000000180)=0x3, &(0x7f00000001c0)=0xa, 0x7, 0x3, 0x9, 0x4, 0x8, 0xffff, 0xfffd, 0x6498, @raw=0x71, @raw=0xa}) setsockopt$auto(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x10000) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/kvm/halt_poll_fail_hist\x00', 0xa2500, 0x0) read$auto_stat_fops_per_vm_kvm_main(r4, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x14, r3, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x68, 0x0, 0x24000000}, 0xd0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/nbd12\x00', 0x10000, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) write$auto(r2, 0x0, 0x100082) read$auto(0xffffffffffffffff, 0x0, 0x1f) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000000c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) pread64$auto(r0, 0x0, 0x4, 0x7fff) 3.973418797s ago: executing program 0 (id=910): socket(0x11, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ioam6(&(0x7f0000001c00), r0) sendmsg$auto_IOAM6_CMD_ADD_NAMESPACE(r0, &(0x7f0000001d00)={0x0, 0x0, &(0x7f0000001cc0)={&(0x7f0000000000)={0x28, r1, 0xa2d601c1e7b11e31, 0x70bd27, 0x25dfdbfd, {}, [@IOAM6_ATTR_NS_ID={0x6}, @IOAM6_ATTR_NS_DATA_WIDE={0xc, 0x3, 0x72c}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff) epoll_create$auto(0x4) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000) mmap$auto(0x3ff, 0x3, 0xffffffff, 0x100000eb1, 0x40000000000a1, 0x4000008000) r2 = socket(0x11, 0x80003, 0x300) sendfile$auto(0x1, r2, 0x0, 0x8fb5) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x60000000) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/kernel/hung_task_check_interval_secs\x00', 0x88542, 0x0) 3.973182197s ago: executing program 3 (id=911): mmap$auto(0x0, 0x400005, 0xe2, 0x9b72, 0x2, 0x8000) r0 = openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$auto(r0, 0x80a86f3d, 0x38) keyctl$auto_KEY_REQKEY_DEFL_PROCESS_KEYRING(0xc, 0x2, 0x0, 0x0, 0x1) mmap$auto(0x0, 0x400408, 0xdf, 0x9b72, 0x2, 0x8000) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$auto_KVM_CREATE_VM(r1, 0xae01, 0x0) write$auto(0x4, 0x0, 0x100082) unshare$auto(0x40000080) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) vmsplice$auto(0xffffffffffffffff, 0x0, 0x6, 0x1) close_range$auto(0x2, 0x8, 0x0) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000004240)={0x0, 0x0, &(0x7f0000004200)={&(0x7f0000000080)={0x2c, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@HWSIM_ATTR_PMSR_SUPPORT={0x18, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0x49, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0x2}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI, @NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40c8}, 0x4048000) shutdown$auto(r1, 0x463) madvise$auto(0x7a8, 0xbfffffffffff0005, 0x19) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram4\x00', 0xdd01, 0x0) rt_sigprocmask$auto(0x0, &(0x7f0000000000)={0xfffffffffffffe01}, 0x0, 0x8) r4 = gettid() r5 = getpid() rt_tgsigqueueinfo$auto(r5, r4, 0x1, &(0x7f0000000600)={@siginfo_0_0={0xffffff88, 0x1, 0x40, @_rt={0x0, 0xee01, @sival_int=0x9ae}}}) rt_sigsuspend$auto(&(0x7f0000000380)={0xe}, 0x8) madvise$auto(0x0, 0x2003ec, 0x14) 3.720357314s ago: executing program 2 (id=912): statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x401bf, 0x734f, 0x36, 0x67f, 0x1ffde, 0x7, 0x3, 0x20000002, 0xd, 0x3, 0x1, 0x2091, 0xb4, 0x9, 0x6, 0x6, 0x80, 0x4, 0x1cd7, 0x1000, 0x2000, 0x203, 0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x1fe, 0xd) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x42, 0x0) r0 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, 0x0, 0x101440, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000000c0)={{0x0, 0x2, 0x200800, 0xffffffff, 0xfffffffb}, "0dd7fd004929347eeeccdf0732f77b1f6de0d6d51768a257a97ca5e9ca6310ea"}) ioctl$auto_SNDRV_TIMER_IOCTL_STATUS64(r0, 0x80605414, &(0x7f0000000000)={0x8, 0x3, 0x4, 0xba44, 0x2, 0xc, "e000265b7222b141ecb9fb5793abe8fdffdbcd2c02d3c293fa98882f5336d79fc5b8202cb37f6b6d22c42432352deb58e78afdbae76900"}) r1 = socket(0xa, 0x2, 0x0) setsockopt$auto(r1, 0x29, 0x30, 0x0, 0x56b) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x28b42, 0x0) sendfile$auto(r2, r2, 0x0, 0x1ff) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_PAUSE_GET(r3, 0x0, 0x4000840) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) open(0x0, 0x22240, 0x155) setpriority$auto_PRIO_USER(0x2, 0x0, 0xfffff8b0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) connect$auto(0x4, 0x0, 0x10) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x13, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8040) r4 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r4, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000080)={0x0, 0xfc2}, 0x2, &(0x7f0000000140), 0x7, 0xa505}, 0x800}, 0x7, 0x4008) 3.09441231s ago: executing program 1 (id=913): openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x101202, 0x0) socket(0x2, 0x1, 0x106) ioctl$auto(0xffffffffffffffff, 0xab07, 0xffffffffffffffff) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$auto_NL80211_CMD_SET_COALESCE(0xffffffffffffffff, 0x0, 0x0) setsockopt$auto_SO_MARK(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000380)='\x00', 0x163fdb7e) r1 = socket$nl_generic(0x10, 0x3, 0x10) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) semctl$auto(0x8, 0x806, 0x13, 0x46) sendmsg$auto_NL802154_CMD_STOP_BEACONS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x20000844}, 0x50) msgctl$auto_IPC_INFO(0x7, 0x3, &(0x7f0000000200)={{0x13b8, 0x0, 0xee01, 0x100, 0x3, 0x7fffffff, 0x3afa}, &(0x7f0000000180)=0x3, &(0x7f00000001c0)=0xa, 0x7, 0x3, 0x9, 0x4, 0x8, 0xffff, 0xfffd, 0x6498, @raw=0x71, @raw=0xa}) setsockopt$auto(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x10000) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x68, 0x0, 0x24000000}, 0xd0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/nbd12\x00', 0x10000, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) write$auto(r1, 0x0, 0x100082) read$auto(0xffffffffffffffff, 0x0, 0x1f) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000000c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0xeffd) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7) 3.094111392s ago: executing program 2 (id=914): r0 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, 0x0, 0x4000, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) socket(0xa, 0x3, 0x3b) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) sysfs$auto(0x2, 0x23, 0x0) r1 = openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) write$auto(r1, 0x0, 0x3) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa}, 0x58) r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) ioctl$auto(0x3, 0x40081271, 0x38) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x1, 0x2020009, 0x3, 0xebe, 0xfffffffffffffffa, 0x8000) shmctl$auto_IPC_SET(0xc, 0x1, &(0x7f0000000300)={{0xffffffff, 0xffffffffffffffff, 0xee01, 0x1000, 0xae, 0x9, 0x6}, 0x1, 0x7, 0x2, 0x280, @raw, @raw=0x5, 0x3, 0x0, &(0x7f0000000140)="4666def67af41b4f051e39fd6511fd6cfab11faa93fdd757f3a42ab52c0db46c7c57737a54cb9ad1fccd9f47e3400debebecee8c4b3ab4b0ecd15cb89799d7a8a423d738e2914ff98f43b494873650cfa841ca9b379cdbceb067f222f9852e4e248e519e6e2d25bc83b3fb9ec16cbc5fe503b9662d19861c9bb377749418140efde7024c7215d323a6c79c5be94bc04ed0d9afbb9c9574ff829522a54b91ef7bcef85e226564639c87b944203a6814a00eea8134d42bc137511ab276827b7ee17d85c2722c34b6d9cd3c095bd1094df859fd44defb05f086d48e42b8cfe4f20b057126cfb78738004716a5e21149cc372c89149624db4102", &(0x7f0000000240)="41b431f15aa64d11716c2908cc9f948827ddb702f4ae4ad578a4d9e2fa81507ca870d066e25696b0b2ac35abb53a8fc6e9df9fdbbc11fe705ab85e88111e5684e28f8599bc486b93eea020ee76a340a548c82e805e2d182d741e51d53c799f7bb722a591e8ac4c48f3317ac8926b8bfb8d1ffa178e0f324273421083410618838dc3"}) socket(0xb, 0xa, 0xd9) setpgid$auto(0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r3 = socket(0xa, 0x1, 0x84) bind$auto(r3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) mq_timedsend$auto(0xffffffffffffffff, 0x0, 0xffffffffbffffff9, 0x5, 0x0) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @loopback}, 0x54) epoll_ctl$auto_EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f00000000c0)={0x4, 0x3}) write$auto(0x3, 0x0, 0xfdef) read$auto(0x3, 0x0, 0x1f40) 2.993174776s ago: executing program 0 (id=915): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r1 = socket(0x2, 0x1, 0x106) read$auto(r1, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x4) bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) io_uring_setup$auto(0x6, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x400000000008000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r2, r2, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r3 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 2.739347064s ago: executing program 3 (id=916): futex$auto(&(0x7f00000003c0)=0x58, 0x5, 0x3, 0x0, &(0x7f0000000440)=0x2, 0x2000005) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty17\x00', 0x1, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram6\x00', 0x4040, 0x0) preadv2$auto(0x3, 0x0, 0x5, 0xffffffffffffffff, 0x7, 0x2e) mmap$auto(0x0, 0x6, 0x2, 0x40eb2, 0xffffffffffffffff, 0x308000000000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xfffffffffffffffe, 0x8000) ustat$auto(0x801, 0x0) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x40}, 0x8) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) madvise$auto(0x0, 0x2003f0, 0x15) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x1, 0x0) r1 = socket(0x15, 0x5, 0x0) bind$auto(r1, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) ustat$auto(0x801, 0x0) sendmsg$auto(r1, &(0x7f0000000180)={&(0x7f0000000040), 0x7fc, 0x0, 0x8, 0x0, 0x1, 0x4}, 0x0) bpf$auto(0x5, 0x0, 0x102) getpid() r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NL80211_CMD_GET_SCAN(r3, &(0x7f00000165c0)={0x0, 0x0, &(0x7f0000016580)={&(0x7f0000000140)={0x14, 0x0, 0xd3ac6c422733a379, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) read$auto(r2, 0x0, 0xb4d3) write$auto(0x3, 0x0, 0xffd8) 2.18869735s ago: executing program 0 (id=917): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snd/midiC2D0\x00', 0x82002, 0x0) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) mmap$auto(0x8000000002000, 0x128009, 0x8000000000000001, 0x200000eb1, r0, 0x20000018000) socket(0x21, 0x2, 0x2) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) mmap$auto(0x0, 0x7ffffffff000, 0x8004, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x7fffffff, 0x7f, 0x2eb1, 0x401, 0x2000000000008000) socket$nl_generic(0x10, 0x3, 0x10) ioctl$auto_SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2200, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_percpu_stats_fops_(0xffffffffffffff9c, &(0x7f0000000040), 0x40040, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WIPHY(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf250800030008000300", @ANYRES32=r3], 0x24}, 0x1, 0x0, 0x0, 0x5c5fd097d751f33e}, 0x80) r4 = openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000006c0)='/sys/kernel/debug/tracing/events/vmalloc/filter\x00', 0x103041, 0x0) write$auto(r4, &(0x7f0000000200)='ev_\x00\x00\x00\x00\x00`F\xfa\x89\x1a?\xba\x98\xba\xda\x93\xd7\x87\x88\rR\a\x94\a\xc5pd[\xdc\x05c!\xa6\xcc\xb5\xbeoTx\xf1\x96\xc0\x80\xbb\"\x00\xc2\'s\xdd\'\xd0\xc1i\a\xca\x0e\xf8\xc55C_\xfd\xe1\xa3\xeb\xc3\xddf\xb8&\x959-\n\xccWw\xf3\x8dz \xee\x04\x18U\xd9\xfeZ\x1a\xe2\x9cK\fE\a\xca\xd36\xe8k8\x83\xcf\xc5D\xcc>\xb2\x9a|y\xfa\xb6\xa6\xeb\xba\xac\xd561\v\x96\xe2 #5\xf6j<\x9a\xc7KG\xa0\xdf\x82\x068k\x05\x9d\xa6\x99\xa3\x91;\xeb\xf8\xff\xae\xe6\x82N\nF\x12\xc5\xc2>k\x9a{o\xaa\xe5n\x97\t\xbd\x06\xaep\b\xc7\xc9\xa4\r\x17s\x86\xf1\x97\x84\x84jL;q\xb5UNO\x0e5\xe1A\x17\x19B\x12t\xb5\xe9]\x94\x95\xe2R\x8d$\x1bm\x9e<\x8f\x11\xab1<\x8b\\\xc1\x94\xbd\x84t\xdbs\xcf\xeb\x84\x8b\x80\xc8u\x93Q\xe2K\xcf7\xd2Y\xc0\xc2\x06\xc3\xbb\x8d\x7faO\x15\xb6ACQ$\x1a\x85\xe6y\xc2\x06\xc9\xff\xdd\xb6\x80\xd9tc\xcb\x01\x1e\xe0\x9a\xc5\x81\xa8\xd2F\x82\xd2\xa3\xe5\xb4&\x84\xe8\x11X\x06:\xd4\xe3ou\xbd\xa3T\xb4@V\x1f\x8f\x19\xa9N\xaf0\xc7\xb7\xccQ;\xcc\x9f\x95\xcf\x92\xa6\xf1!\xf7\x02Dq6\x96\x80\xfaD\xccw*\xae\xdfl.F\x1c\x8c\xe89\x01\xf6\xe3f:\xccys\xda\xc1\xbc],\x10\x1f\xe1\xc6\x909\x88IHJ\xb0\x1a\x9f!\xa0\xcc\f+\x96\xd8\x06F\xd2\xd3\xf0\xf0\xcam\xa4:2\x81\xf8F\xce&3\x1f|\x17n<\xbdGv\xf1/\x1c\xf0f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r2, r2, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r3 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 1.470352469s ago: executing program 1 (id=920): r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x2, 0x0) setsockopt$auto(0x400000000000003, 0x29, 0x23, 0x0, 0x568) r1 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video3\x00', 0x2aa01, 0x0) socket(0x2, 0x2, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x482b01, 0x0) r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x82000, 0x0) r3 = semctl$auto(0x1, 0x10, 0x1, 0x7fffffff) pidfd_open$auto(r3, 0x8) mmap$auto(0x0, 0x400008, 0xde, 0x9b72, r2, 0x8000) r4 = openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/lru_gen\x00', 0xc0040, 0x0) pread64$auto(r4, 0x0, 0x7ff, 0x400) r5 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x100, 0x8, 0x0, 0xfffffffffffffffe, 0x4) select$auto(0xf, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0x7, 0x2a, 0x400000000000948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x7, 0x40, 0x3, 0x1, 0x5, 0x8d, 0xffffffdffffffffe]}, 0x0) write$auto(r5, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) fsconfig$auto_EROFS_MOUNT_DAX_NEVER(r1, 0x0, 0x0, &(0x7f0000000500), 0x80) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x20000000001ff, 0x7, 0xd3e, 0x1, 0x948b, 0x3, 0x6, 0xfffffffffffffffd, 0x10001, 0xaa9, 0x7ffffffd, 0x3, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffa]}, 0x0) sendmsg$auto_TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000003a80)={0x0, 0x0, &(0x7f0000003a40)={&(0x7f0000000600)={0x20, 0x0, 0x1, 0x70bd2e, 0x25dfdbfb, {}, [@TIPC_NLA_UNSPEC={0xc, 0x0, "1938b0b02fe19b63"}]}, 0x20}, 0x1, 0x0, 0x0, 0x40801}, 0x24000084) close_range$auto(0x2, 0x8, 0x0) 1.151554897s ago: executing program 3 (id=921): openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0x2, 0x1, 0x106) read$auto(r0, &(0x7f0000000180)='/dev/snd/midiC2D0\x00', 0x4) bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) io_uring_setup$auto(0x6, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x40001, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x400000000008000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80802, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) sendfile$auto(r1, r1, 0x0, 0x15) lstat$auto(0x0, &(0x7f0000000180)={0x4, 0x9, 0x6, 0x63, 0x0, 0x0, 0x0, 0xac, 0x200, 0xa, 0x40000402, 0x9, 0x9, 0xffffffffffbfffff, 0x6, 0x6, 0x200000100103}) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0f"], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x4) r2 = socket(0x10, 0x2, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) mlockall$auto(0x800000000000005) 871.12ms ago: executing program 2 (id=922): mmap$auto(0x0, 0x400005, 0xe2, 0x9b72, 0x2, 0x8000) r0 = openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$auto(r0, 0x80a86f3d, 0x38) keyctl$auto_KEY_REQKEY_DEFL_PROCESS_KEYRING(0xc, 0x2, 0x0, 0x0, 0x1) mmap$auto(0x0, 0x400408, 0xdf, 0x9b72, 0x2, 0x8000) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$auto_KVM_CREATE_VM(r1, 0xae01, 0x0) write$auto(0x4, 0x0, 0x100082) unshare$auto(0x40000080) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) vmsplice$auto(0xffffffffffffffff, 0x0, 0x6, 0x1) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sg0\x00', 0x8081, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000004240)={0x0, 0x0, &(0x7f0000004200)={&(0x7f0000000080)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@HWSIM_ATTR_PMSR_SUPPORT={0x18, 0x1a, 0x0, 0x1, [@NL80211_PMSR_ATTR_TYPE_CAPA={0x49, 0x4, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES={0x8, 0x5, 0x2}, @NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI, @NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40c8}, 0x4048000) shutdown$auto(r1, 0x463) madvise$auto(0x7a8, 0xbfffffffffff0005, 0x19) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram4\x00', 0xdd01, 0x0) rt_sigprocmask$auto(0x0, &(0x7f0000000000)={0xfffffffffffffe01}, 0x0, 0x8) r3 = gettid() r4 = getpid() rt_tgsigqueueinfo$auto(r4, r3, 0x1, &(0x7f0000000600)={@siginfo_0_0={0xffffff88, 0x1, 0x40, @_rt={0x0, 0xee01, @sival_int=0x9ae}}}) rt_sigsuspend$auto(&(0x7f0000000380)={0xe}, 0x8) madvise$auto(0x0, 0x2003ec, 0x14) 737.098251ms ago: executing program 0 (id=923): mmap$auto(0x0, 0x0, 0xc00000072, 0xfffffffffffffff7, 0x1000000002, 0x8000) r0 = io_uring_setup$auto(0x86, 0x0) r1 = getpid() prctl$auto_PR_SCHED_CORE_SHARE_FROM(0x8, 0x3, r1, 0x0, 0x6) socket(0x28, 0x4, 0xffffffc0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) ustat$auto(0x12, &(0x7f0000000340)={0x2, 0x80, "417acc606935", "db5f19b5a360"}) write$auto(r2, &(0x7f0000000840)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xf3\x8dz \xee\x04\x18U\xd9\xfeZ\x1a\xe2\x9cK\fE\a\xca\xd36\xe8k8\x83\xcf\xc5D\xcc>\xb2\x9a|y\xfa\xb6\xa6\xeb\xba\xac\xd561\v\x96\xe2 #5\xf6j<\x9a\xc7KG\xa0\xdf\x82\x068k\x05\x9d\xa6\x99\xa3\x91;\xeb\xf8\xff\xae\xe6\x82N\nF\x12\xc5\xc2>k\x9a{o\xaa\xe5n\x97\t\xbd\x06\xaep\b\xc7\xc9\xa4\r\x17s\x86\xf1\x97\x84\x84jL;q\xb5UNO\x0e5\xe1A\x17\x19B\x12t\xb5\xe9]\x94\x95\xe2R\x8d$\x1bm\x9e<\x8f\x11\xab1<\x8b\\\xc1\x94\xbd\x84t\xdbs\xcf\xeb\x84\x8b\x80\xc8u\x93Q\xe2K\xcf7\xd2Y\xc0\xc2\x06\xc3\xbb\x8d\x7faO\x15\xb6ACQ$\x1a\x85\xe6y\xc2\x06\xc9\xff\xdd\xb6\x80\xd9tc\xcb\x01\x1e\xe0\x9a\xc5\x81\xa8\xd2F\x82\xd2\xa3\xe5\xb4&\x84\xe8\x11X\x06:\xd4\xe3ou\xbd\xa3T\xb4@V\x1f\x8f\x19\xa9N\xaf0\xc7\xb7\xccQ;\xcc\x9f\x95\xcf\x92\xa6\xf1!\xf7\x02Dq6\x96\x80\xfaD\xccw*\xae\xdfl.F\x1c\x8c\xe89\x01\xf6\xe3f:\xccys\xda\xc1\xbc],\x10\x1f\xe1\xc6\x909\x88IHJ\xb0\x1a\x9f!\xa0\xcc\f+\x96\xd8\x06F\xd2\xd3\xf0\xf0\xcam\xa4:2\x81\xf8F\xce&3\x1f|\x17n<\xbdGv\xf1/\x1c\xf0f\xb8&\x959-\n\xccWw\xf3\x8dz \xee\x04\x18U\xd9\xfeZ\x1a\xe2\x9cK\fE\a\xca\xd36\xe8k8\x83\xcf\xc5D\xcc>\xb2\x9a|y\xfa\xb6\xa6\xeb\xba\xac\xd561\v\x96\xe2 #5\xf6j<\x9a\xc7KG\xa0\xdf\x82\x068k\x05\x9d\xa6\x99\xa3\x91;\xeb\xf8\xff\xae\xe6\x82N\nF\x12\xc5\xc2>k\x9a{o\xaa\xe5n\x97\t\xbd\x06\xaep\b\xc7\xc9\xa4\r\x17s\x86\xf1\x97\x84\x84jL;q\xb5UNO\x0e5\xe1A\x17\x19B\x12t\xb5\xe9]\x94\x95\xe2R\x8d$\x1bm\x9e<\x8f\x11\xab1<\x8b\\\xc1\x94\xbd\x84t\xdbs\xcf\xeb\x84\x8b\x80\xc8u\x93Q\xe2K\xcf7\xd2Y\xc0\xc2\x06\xc3\xbb\x8d\x7faO\x15\xb6ACQ$\x1a\x85\xe6y\xc2\x06\xc9\xff\xdd\xb6\x80\xd9tc\xcb\x01\x1e\xe0\x9a\xc5\x81\xa8\xd2F\x82\xd2\xa3\xe5\xb4&\x84\xe8\x11X\x06:\xd4\xe3ou\xbd\xa3T\xb4@V\x1f\x8f\x19\xa9N\xaf0\xc7\xb7\xccQ;\xcc\x9f\x95\xcf\x92\xa6\xf1!\xf7\x02Dq6\x96\x80\xfaD\xccw*\xae\xdfl.F\x1c\x8c\xe89\x01\xf6\xe3f:\xccys\xda\xc1\xbc],\x10\x1f\xe1\xc6\x909\x88IHJ\xb0\x1a\x9f!\xa0\xcc\f+\x96\xd8\x06F\xd2\xd3\xf0\xf0\xcam\xa4:2\x81\xf8F\xce&3\x1f|\x17n<\xbdGv\xf1/\x1c\xf0 1 [ 86.922485][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.935317][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.954658][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.964950][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.972890][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.981913][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.990512][ T5836] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.013363][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.018775][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.033046][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.041528][ T5836] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.044319][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.050439][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.056679][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.064393][ T5836] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.078985][ T5832] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.087019][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.088908][ T5150] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.103906][ T5150] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.608069][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 87.690840][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 87.855157][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 87.892446][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.899865][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.907527][ T5833] bridge_slave_0: entered allmulticast mode [ 87.915989][ T5833] bridge_slave_0: entered promiscuous mode [ 87.951605][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.958884][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.966397][ T5833] bridge_slave_1: entered allmulticast mode [ 87.973405][ T5833] bridge_slave_1: entered promiscuous mode [ 88.026646][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 88.042756][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.050232][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.057507][ T5829] bridge_slave_0: entered allmulticast mode [ 88.064822][ T5829] bridge_slave_0: entered promiscuous mode [ 88.106857][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.114176][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.121324][ T5829] bridge_slave_1: entered allmulticast mode [ 88.129037][ T5829] bridge_slave_1: entered promiscuous mode [ 88.139769][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.153049][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.218427][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.225984][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.233200][ T5837] bridge_slave_0: entered allmulticast mode [ 88.240569][ T5837] bridge_slave_0: entered promiscuous mode [ 88.279468][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.286878][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.295220][ T5837] bridge_slave_1: entered allmulticast mode [ 88.302369][ T5837] bridge_slave_1: entered promiscuous mode [ 88.324633][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.335928][ T5833] team0: Port device team_slave_0 added [ 88.344838][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.383166][ T5833] team0: Port device team_slave_1 added [ 88.396987][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.447395][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.458450][ T5829] team0: Port device team_slave_0 added [ 88.500691][ T5829] team0: Port device team_slave_1 added [ 88.520835][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.527838][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.554055][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.571768][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.579457][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.587174][ T5825] bridge_slave_0: entered allmulticast mode [ 88.594884][ T5825] bridge_slave_0: entered promiscuous mode [ 88.627849][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.634876][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.661325][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.672482][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.679934][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.687547][ T5825] bridge_slave_1: entered allmulticast mode [ 88.694908][ T5825] bridge_slave_1: entered promiscuous mode [ 88.703059][ T5837] team0: Port device team_slave_0 added [ 88.710359][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.717435][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.743438][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.774468][ T5837] team0: Port device team_slave_1 added [ 88.791768][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.799014][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.825297][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.861186][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.905952][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.938751][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.945842][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.972798][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.001154][ T5833] hsr_slave_0: entered promiscuous mode [ 89.007639][ T5833] hsr_slave_1: entered promiscuous mode [ 89.019864][ T5829] hsr_slave_0: entered promiscuous mode [ 89.026393][ T5829] hsr_slave_1: entered promiscuous mode [ 89.032519][ T5829] debugfs: 'hsr0' already exists in 'hsr' [ 89.038382][ T5829] Cannot create hsr debugfs directory [ 89.044765][ T5150] Bluetooth: hci2: command tx timeout [ 89.060107][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.067283][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.094283][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.120435][ T5825] team0: Port device team_slave_0 added [ 89.134231][ T5150] Bluetooth: hci0: command tx timeout [ 89.141579][ T5825] team0: Port device team_slave_1 added [ 89.214626][ T5828] Bluetooth: hci3: command tx timeout [ 89.220382][ T5150] Bluetooth: hci1: command tx timeout [ 89.256498][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.263461][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.290220][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.308197][ T5837] hsr_slave_0: entered promiscuous mode [ 89.315198][ T5837] hsr_slave_1: entered promiscuous mode [ 89.321575][ T5837] debugfs: 'hsr0' already exists in 'hsr' [ 89.327496][ T5837] Cannot create hsr debugfs directory [ 89.346263][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.353500][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.379896][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.576017][ T5825] hsr_slave_0: entered promiscuous mode [ 89.582553][ T5825] hsr_slave_1: entered promiscuous mode [ 89.589379][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 89.595205][ T5825] Cannot create hsr debugfs directory [ 89.856761][ T5829] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.883583][ T5829] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.926966][ T5829] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.941032][ T5829] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.023944][ T5833] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.046769][ T5833] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.073025][ T5833] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.123002][ T5833] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.197922][ T5837] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.249119][ T5837] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.284611][ T5837] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.295684][ T5837] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.310795][ T5825] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.330054][ T5825] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.340467][ T5825] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.351562][ T5825] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.433634][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.490692][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.517536][ T3537] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.524874][ T3537] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.546786][ T3537] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.553973][ T3537] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.627605][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.689161][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.705388][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.727457][ T3537] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.734654][ T3537] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.757110][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.775985][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.783151][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.798001][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.815379][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.822534][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.857886][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.865097][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.878786][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.935407][ T3479] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.942581][ T3479] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.991761][ T3479] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.999193][ T3479] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.125537][ T5150] Bluetooth: hci2: command tx timeout [ 91.200786][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.214562][ T5150] Bluetooth: hci0: command tx timeout [ 91.298532][ T5150] Bluetooth: hci1: command tx timeout [ 91.304628][ T5828] Bluetooth: hci3: command tx timeout [ 91.372051][ T5829] veth0_vlan: entered promiscuous mode [ 91.390948][ T5829] veth1_vlan: entered promiscuous mode [ 91.472254][ T5829] veth0_macvtap: entered promiscuous mode [ 91.501267][ T5829] veth1_macvtap: entered promiscuous mode [ 91.565127][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.581706][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.606386][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.622005][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.630388][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.640291][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.661769][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.669465][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.678543][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.785151][ T5837] veth0_vlan: entered promiscuous mode [ 91.842831][ T5837] veth1_vlan: entered promiscuous mode [ 91.875904][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.881221][ T5825] veth0_vlan: entered promiscuous mode [ 91.891228][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.935074][ T5833] veth0_vlan: entered promiscuous mode [ 91.960426][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.962953][ T5825] veth1_vlan: entered promiscuous mode [ 91.973968][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.995697][ T5833] veth1_vlan: entered promiscuous mode [ 92.010129][ T5837] veth0_macvtap: entered promiscuous mode [ 92.031233][ T5837] veth1_macvtap: entered promiscuous mode [ 92.059152][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.107719][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.139630][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.193511][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.206571][ T5825] veth0_macvtap: entered promiscuous mode [ 92.221016][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.231329][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.242212][ T5833] veth0_macvtap: entered promiscuous mode [ 92.266389][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.278530][ T5825] veth1_macvtap: entered promiscuous mode [ 92.296692][ T5833] veth1_macvtap: entered promiscuous mode [ 92.321674][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.366286][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.398446][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.434475][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.545296][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.562873][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.634495][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.723039][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.744597][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.759212][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.784337][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.807520][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.825406][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.867265][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.889096][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.918958][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.974794][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 92.998187][ T3537] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.010915][ T3537] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.081634][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.099369][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.108170][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.116350][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.204388][ T5150] Bluetooth: hci2: command tx timeout [ 93.283920][ T5150] Bluetooth: hci0: command tx timeout [ 93.308199][ T5921] FAULT_INJECTION: forcing a failure. [ 93.308199][ T5921] name failslab, interval 1, probability 0, space 0, times 1 [ 93.323121][ T5921] CPU: 0 UID: 0 PID: 5921 Comm: syz.0.5 Not tainted syzkaller #0 PREEMPT(full) [ 93.323159][ T5921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 93.323180][ T5921] Call Trace: [ 93.323190][ T5921] [ 93.323201][ T5921] dump_stack_lvl+0x16c/0x1f0 [ 93.323242][ T5921] should_fail_ex+0x512/0x640 [ 93.323286][ T5921] ? __kmalloc_cache_node_noprof+0x62/0x7a0 [ 93.323323][ T5921] should_failslab+0xc2/0x120 [ 93.323360][ T5921] __kmalloc_cache_node_noprof+0x75/0x7a0 [ 93.323388][ T5921] ? __pfx_vmap_small_pages_range_noflush+0x10/0x10 [ 93.323418][ T5921] ? __get_vm_area_node+0x101/0x330 [ 93.323457][ T5921] ? __get_vm_area_node+0x101/0x330 [ 93.323486][ T5921] __get_vm_area_node+0x101/0x330 [ 93.323520][ T5921] __vmalloc_node_range_noprof+0x271/0x1480 [ 93.323556][ T5921] ? n_tty_open+0x1a/0x170 [ 93.323599][ T5921] ? n_tty_open+0x1a/0x170 [ 93.323636][ T5921] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 93.323675][ T5921] ? find_held_lock+0x2b/0x80 [ 93.323706][ T5921] ? n_tty_open+0x12b/0x170 [ 93.323738][ T5921] ? n_tty_open+0x1a/0x170 [ 93.323767][ T5921] __vmalloc_node_noprof+0xad/0xf0 [ 93.323799][ T5921] ? n_tty_open+0x1a/0x170 [ 93.323825][ T5921] ? __pfx_n_tty_open+0x10/0x10 [ 93.323854][ T5921] n_tty_open+0x1a/0x170 [ 93.323883][ T5921] ? __pfx_n_tty_open+0x10/0x10 [ 93.323910][ T5921] tty_ldisc_open+0x9f/0x120 [ 93.323946][ T5921] tty_ldisc_setup+0x87/0x100 [ 93.323969][ T5921] tty_init_dev.part.0+0x1ec/0x500 [ 93.323999][ T5921] tty_init_dev+0x60/0x80 [ 93.324025][ T5921] ? __pfx_ptmx_open+0x10/0x10 [ 93.324052][ T5921] ptmx_open+0x10d/0x360 [ 93.324081][ T5921] ? __pfx_ptmx_open+0x10/0x10 [ 93.324109][ T5921] chrdev_open+0x234/0x6a0 [ 93.324140][ T5921] ? __pfx_chrdev_open+0x10/0x10 [ 93.324170][ T5921] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 93.324202][ T5921] do_dentry_open+0x982/0x1530 [ 93.324229][ T5921] ? __pfx_chrdev_open+0x10/0x10 [ 93.324273][ T5921] vfs_open+0x82/0x3f0 [ 93.324314][ T5921] path_openat+0x1de4/0x2cb0 [ 93.324356][ T5921] ? __pfx_path_openat+0x10/0x10 [ 93.324386][ T5921] ? __lock_acquire+0xb8a/0x1c90 [ 93.324422][ T5921] do_filp_open+0x20b/0x470 [ 93.324449][ T5921] ? __pfx_do_filp_open+0x10/0x10 [ 93.324499][ T5921] ? alloc_fd+0x471/0x7d0 [ 93.324529][ T5921] do_sys_openat2+0x11b/0x1d0 [ 93.324558][ T5921] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.324603][ T5921] __x64_sys_openat+0x174/0x210 [ 93.324638][ T5921] ? __pfx___x64_sys_openat+0x10/0x10 [ 93.324687][ T5921] do_syscall_64+0xcd/0xfa0 [ 93.324718][ T5921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.324744][ T5921] RIP: 0033:0x7f5cbf78efc9 [ 93.324776][ T5921] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 93.324801][ T5921] RSP: 002b:00007f5cc0613038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 93.324826][ T5921] RAX: ffffffffffffffda RBX: 00007f5cbf9e5fa0 RCX: 00007f5cbf78efc9 [ 93.324841][ T5921] RDX: 0000000000040001 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 93.324854][ T5921] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 93.324868][ T5921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.324884][ T5921] R13: 00007f5cbf9e6038 R14: 00007f5cbf9e5fa0 R15: 00007ffd103529f8 [ 93.324924][ T5921] [ 93.350471][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.372229][ T5923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5'. [ 93.406028][ T5150] Bluetooth: hci1: command tx timeout [ 93.411707][ T5828] Bluetooth: hci3: command tx timeout [ 93.426979][ T5921] syz.0.5: vmalloc error: size 9128, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 93.458745][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.704539][ T5921] ,cpuset=/,mems_allowed=0-1 [ 93.780780][ T5925] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3'. [ 93.789998][ T5925] bridge_slave_1: left allmulticast mode [ 93.795909][ T5925] bridge_slave_1: left promiscuous mode [ 93.802165][ T5925] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.814344][ T5921] CPU: 0 UID: 0 PID: 5921 Comm: syz.0.5 Not tainted syzkaller #0 PREEMPT(full) [ 93.814376][ T5921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 93.814390][ T5921] Call Trace: [ 93.814399][ T5921] [ 93.814408][ T5921] dump_stack_lvl+0x16c/0x1f0 [ 93.814442][ T5921] warn_alloc+0x248/0x3a0 [ 93.814479][ T5921] ? __pfx_warn_alloc+0x10/0x10 [ 93.814500][ T5921] ? rcu_is_watching+0x12/0xc0 [ 93.814527][ T5921] ? __kmalloc_cache_node_noprof+0x2df/0x7a0 [ 93.814563][ T5921] ? __kasan_kmalloc+0x8a/0xb0 [ 93.814592][ T5921] ? __get_vm_area_node+0x208/0x330 [ 93.814634][ T5921] __vmalloc_node_range_noprof+0xaf5/0x1480 [ 93.814680][ T5921] ? n_tty_open+0x1a/0x170 [ 93.814719][ T5921] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 93.814757][ T5921] ? find_held_lock+0x2b/0x80 [ 93.814783][ T5921] ? n_tty_open+0x12b/0x170 [ 93.814814][ T5921] ? n_tty_open+0x1a/0x170 [ 93.814841][ T5921] __vmalloc_node_noprof+0xad/0xf0 [ 93.814875][ T5921] ? n_tty_open+0x1a/0x170 [ 93.814904][ T5921] ? __pfx_n_tty_open+0x10/0x10 [ 93.814934][ T5921] n_tty_open+0x1a/0x170 [ 93.814963][ T5921] ? __pfx_n_tty_open+0x10/0x10 [ 93.814991][ T5921] tty_ldisc_open+0x9f/0x120 [ 93.815027][ T5921] tty_ldisc_setup+0x87/0x100 [ 93.815053][ T5921] tty_init_dev.part.0+0x1ec/0x500 [ 93.815083][ T5921] tty_init_dev+0x60/0x80 [ 93.815112][ T5921] ? __pfx_ptmx_open+0x10/0x10 [ 93.815144][ T5921] ptmx_open+0x10d/0x360 [ 93.815177][ T5921] ? __pfx_ptmx_open+0x10/0x10 [ 93.815210][ T5921] chrdev_open+0x234/0x6a0 [ 93.815241][ T5921] ? __pfx_chrdev_open+0x10/0x10 [ 93.815271][ T5921] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 93.815306][ T5921] do_dentry_open+0x982/0x1530 [ 93.815335][ T5921] ? __pfx_chrdev_open+0x10/0x10 [ 93.815371][ T5921] vfs_open+0x82/0x3f0 [ 93.815409][ T5921] path_openat+0x1de4/0x2cb0 [ 93.815449][ T5921] ? __pfx_path_openat+0x10/0x10 [ 93.815486][ T5921] ? __lock_acquire+0xb8a/0x1c90 [ 93.815522][ T5921] do_filp_open+0x20b/0x470 [ 93.815550][ T5921] ? __pfx_do_filp_open+0x10/0x10 [ 93.815603][ T5921] ? alloc_fd+0x471/0x7d0 [ 93.815639][ T5921] do_sys_openat2+0x11b/0x1d0 [ 93.815672][ T5921] ? __pfx_do_sys_openat2+0x10/0x10 [ 93.815722][ T5921] __x64_sys_openat+0x174/0x210 [ 93.815757][ T5921] ? __pfx___x64_sys_openat+0x10/0x10 [ 93.815806][ T5921] do_syscall_64+0xcd/0xfa0 [ 93.815836][ T5921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.815860][ T5921] RIP: 0033:0x7f5cbf78efc9 [ 93.815882][ T5921] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 93.815905][ T5921] RSP: 002b:00007f5cc0613038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 93.815928][ T5921] RAX: ffffffffffffffda RBX: 00007f5cbf9e5fa0 RCX: 00007f5cbf78efc9 [ 93.815952][ T5921] RDX: 0000000000040001 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 93.815967][ T5921] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 93.815982][ T5921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.815996][ T5921] R13: 00007f5cbf9e6038 R14: 00007f5cbf9e5fa0 R15: 00007ffd103529f8 [ 93.816032][ T5921] [ 93.816042][ T5921] Mem-Info: [ 94.050259][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 94.162533][ T5921] active_anon:6494 inactive_anon:0 isolated_anon:0 [ 94.162533][ T5921] active_file:1903 inactive_file:39868 isolated_file:0 [ 94.162533][ T5921] unevictable:768 dirty:1581 writeback:0 [ 94.162533][ T5921] slab_reclaimable:10140 slab_unreclaimable:89504 [ 94.162533][ T5921] mapped:24011 shmem:1359 pagetables:1024 [ 94.162533][ T5921] sec_pagetables:0 bounce:0 [ 94.162533][ T5921] kernel_misc_reclaimable:0 [ 94.162533][ T5921] free:1348095 free_pcp:16694 free_cma:0 [ 94.219859][ T5921] Node 0 active_anon:22976kB inactive_anon:0kB active_file:7712kB inactive_file:159272kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:96844kB dirty:6320kB writeback:0kB shmem:4700kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11420kB pagetables:3932kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 94.264775][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.278376][ T5921] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 94.310514][ T5921] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 94.311384][ T5925] bridge_slave_0: left allmulticast mode [ 94.350739][ T5921] lowmem_reserve[]: 0 2485 2487 2487 2487 [ 94.359442][ T5921] Node 0 DMA32 free:1490716kB boost:0kB min:34108kB low:42632kB high:51156kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23676kB inactive_anon:0kB active_file:7712kB inactive_file:159272kB unevictable:1536kB writepending:6320kB zspages:0kB present:3129332kB managed:2545108kB mlocked:0kB bounce:0kB free_pcp:48248kB local_pcp:10332kB free_cma:0kB [ 94.400875][ T5925] bridge_slave_0: left promiscuous mode [ 94.414685][ T5925] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.442850][ T5921] lowmem_reserve[]: 0 0 1 1 1 [ 94.471744][ T5921] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 94.507795][ T5921] lowmem_reserve[]: 0 0 0 0 0 [ 94.512585][ T5921] Node 1 Normal free:3886104kB boost:0kB min:55768kB low:69708kB high:83648kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:20788kB local_pcp:9724kB free_cma:0kB [ 94.545785][ T5921] lowmem_reserve[]: 0 0 0 0 0 [ 94.550566][ T5921] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 94.574597][ T5921] Node 0 DMA32: 3*4kB (UME) 2*8kB (ME) 1*16kB (E) 1*32kB (E) 2*64kB (UE) 1*128kB (M) 2*256kB (UM) 1*512kB (E) 2*1024kB (ME) 4*2048kB (UME) 360*4096kB (M) = 1486156kB [ 94.618988][ T5925] Zero length message leads to an empty skb [ 94.684724][ T5921] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 94.699004][ T5921] Node 1 Normal: 65*4kB (UE) 48*8kB (UME) 50*16kB (UME) 54*32kB (UME) 14*64kB (UME) 8*128kB (UME) 6*256kB (UME) 5*512kB (UME) 2*1024kB (UM) 2*2048kB (UE) 945*4096kB (M) = 3886052kB [ 94.752081][ T5921] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 94.762551][ T5921] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 94.775772][ T5921] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 94.787505][ T5921] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 94.798681][ T5921] 44101 total pagecache pages [ 94.805319][ T5921] 0 pages in swap cache [ 94.809845][ T5921] Free swap = 123368kB [ 94.818086][ T5921] Total swap = 124996kB [ 94.822748][ T5921] 2097051 pages RAM [ 94.827154][ T5921] 0 pages HighMem/MovableOnly [ 94.831911][ T5921] 428684 pages reserved [ 94.843907][ T5921] 0 pages cma reserved [ 94.848518][ T5921] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 94.913205][ T5936] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2'. [ 95.094118][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.102896][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.302722][ T5941] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 95.303848][ T5828] Bluetooth: hci2: command tx timeout [ 95.331187][ T5938] HfR: entered promiscuous mode [ 95.340966][ T5934] futex_wake_op: syz.3.4 tries to shift op by -2048; fix this program [ 95.373831][ T5828] Bluetooth: hci0: command tx timeout [ 95.384393][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 95.453969][ T5828] Bluetooth: hci3: command tx timeout [ 95.459426][ T5828] Bluetooth: hci1: command tx timeout [ 95.544127][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.553397][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.562461][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.791591][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 96.268951][ T5963] netlink: 330 bytes leftover after parsing attributes in process `syz.0.10'. [ 96.278647][ T5963] mac80211_hwsim hwsim2 ›: renamed from wlan0 (while UP) [ 96.392809][ T5966] mmap: syz.3.11 (5966) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 96.448869][ T5950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 97.492789][ T5975] syz.3.13 uses obsolete (PF_INET,SOCK_PACKET) [ 98.644766][ T5990] netlink: 220 bytes leftover after parsing attributes in process `syz.2.15'. [ 99.252892][ T6008] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 99.699201][ T6000] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(2) [ 100.101515][ T983] cfg80211: failed to load regulatory.db [ 101.170987][ T6046] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 101.744950][ T6042] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(2) [ 104.228393][ T6084] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 104.249667][ T6084] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 104.279345][ T6084] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 104.551279][ T6084] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 104.568431][ T6084] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 104.656964][ T6084] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 104.697063][ T6084] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 104.714069][ T6084] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 104.731095][ T6084] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 104.780541][ T6084] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 104.924119][ T5828] Bluetooth: hci3: unexpected event 0x3d length: 726 > 14 [ 104.944115][ T6084] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 105.050957][ T6084] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 105.849300][ T5828] Bluetooth: hci0: command 0x0c1a tx timeout [ 106.565432][ T5828] Bluetooth: hci1: command 0x0c1a tx timeout [ 106.724400][ T5828] Bluetooth: hci2: command 0x0c1a tx timeout [ 106.805834][ T5828] Bluetooth: hci3: command 0x0c1a tx timeout [ 107.849767][ T6150] syz.1.42 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 107.861255][ T6150] HfR: entered promiscuous mode [ 107.923953][ T5828] Bluetooth: hci0: command 0x0c1a tx timeout [ 108.045652][ T6141] Console: switching to colour VGA+ 80x25 [ 108.155475][ T6156] Console: switching to colour frame buffer device 128x48 [ 108.594388][ T6148] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 108.649944][ T5828] Bluetooth: hci1: command 0x0c1a tx timeout [ 108.658658][ T6148] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 108.689004][ T6148] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 108.740133][ T6148] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 110.091185][ T5828] Bluetooth: hci0: command 0x0c1a tx timeout [ 110.342480][ T6181] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 110.724250][ T5828] Bluetooth: hci2: command 0x0c1a tx timeout [ 110.730299][ T5150] Bluetooth: hci1: command 0x0c1a tx timeout [ 110.806106][ T5828] Bluetooth: hci3: command 0x0c1a tx timeout [ 111.644272][ T6200] netlink: 330 bytes leftover after parsing attributes in process `syz.3.51'. [ 111.719564][ T6200] mac80211_hwsim hwsim5 ›: renamed from wlan0 (while UP) [ 111.856764][ T6203] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 111.929539][ T6203] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 111.949046][ T6203] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 112.131284][ T6203] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 112.406856][ T6208] netlink: 28 bytes leftover after parsing attributes in process `syz.2.56'. [ 113.923817][ T5828] Bluetooth: hci0: command 0x0c1a tx timeout [ 114.004218][ T5150] Bluetooth: hci1: command 0x0c1a tx timeout [ 114.010401][ T5828] Bluetooth: hci2: command 0x0c1a tx timeout [ 114.175992][ T5828] Bluetooth: hci3: command 0x0c1a tx timeout [ 115.263977][ T6248] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(2) [ 115.639504][ T6254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.67'. [ 116.687800][ T6266] Console: switching to colour VGA+ 80x25 [ 117.028670][ T6271] Console: switching to colour frame buffer device 128x48 [ 118.686621][ T6281] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 119.497629][ T6296] netlink: 28 bytes leftover after parsing attributes in process `syz.3.85'. [ 119.652826][ T6301] netlink: 330 bytes leftover after parsing attributes in process `syz.1.76'. [ 119.728944][ T6301] mac80211_hwsim hwsim7 ›: renamed from wlan0 (while UP) [ 122.183944][ T6325] syz.2.82 (6325) used greatest stack depth: 19720 bytes left [ 126.041119][ T6370] futex_wake_op: syz.2.89 tries to shift op by -2048; fix this program [ 128.529268][ T6414] netlink: 28 bytes leftover after parsing attributes in process `syz.0.101'. [ 130.826377][ T6450] FAULT_INJECTION: forcing a failure. [ 130.826377][ T6450] name failslab, interval 1, probability 0, space 0, times 0 [ 130.840339][ T6450] CPU: 0 UID: 0 PID: 6450 Comm: syz.0.107 Not tainted syzkaller #0 PREEMPT(full) [ 130.840375][ T6450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 130.840402][ T6450] Call Trace: [ 130.840412][ T6450] [ 130.840423][ T6450] dump_stack_lvl+0x16c/0x1f0 [ 130.840481][ T6450] should_fail_ex+0x512/0x640 [ 130.840522][ T6450] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 130.840555][ T6450] should_failslab+0xc2/0x120 [ 130.840589][ T6450] kmem_cache_alloc_noprof+0x75/0x6e0 [ 130.840614][ T6450] ? __lock_acquire+0x622/0x1c90 [ 130.840645][ T6450] ? alloc_empty_file+0x55/0x1e0 [ 130.840685][ T6450] ? alloc_empty_file+0x55/0x1e0 [ 130.840717][ T6450] alloc_empty_file+0x55/0x1e0 [ 130.840751][ T6450] path_openat+0xda/0x2cb0 [ 130.840790][ T6450] ? __pfx_path_openat+0x10/0x10 [ 130.840820][ T6450] ? __lock_acquire+0xb8a/0x1c90 [ 130.840856][ T6450] do_filp_open+0x20b/0x470 [ 130.840884][ T6450] ? __pfx_do_filp_open+0x10/0x10 [ 130.840938][ T6450] ? alloc_fd+0x471/0x7d0 [ 130.840973][ T6450] do_sys_openat2+0x11b/0x1d0 [ 130.841009][ T6450] ? __pfx_do_sys_openat2+0x10/0x10 [ 130.841056][ T6450] __x64_sys_openat+0x174/0x210 [ 130.841091][ T6450] ? __pfx___x64_sys_openat+0x10/0x10 [ 130.841141][ T6450] do_syscall_64+0xcd/0xfa0 [ 130.841171][ T6450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 130.841196][ T6450] RIP: 0033:0x7f5cbf78efc9 [ 130.841230][ T6450] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 130.841255][ T6450] RSP: 002b:00007f5cc05d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 130.841283][ T6450] RAX: ffffffffffffffda RBX: 00007f5cbf9e6180 RCX: 00007f5cbf78efc9 [ 130.841301][ T6450] RDX: 0000000000181482 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 130.841320][ T6450] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 130.841337][ T6450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 130.841354][ T6450] R13: 00007f5cbf9e6218 R14: 00007f5cbf9e6180 R15: 00007ffd103529f8 [ 130.841390][ T6450] [ 134.066601][ T6490] netlink: 28 bytes leftover after parsing attributes in process `syz.1.115'. [ 137.168729][ T6522] process 'syz.3.121' launched './file0' with NULL argv: empty string added [ 138.467404][ T6539] netlink: 28 bytes leftover after parsing attributes in process `syz.3.126'. [ 141.054455][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 141.060978][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 142.984047][ T5828] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 145.378367][ T6625] netlink: 20 bytes leftover after parsing attributes in process `syz.3.142'. [ 145.387844][ T6625] netlink: 20 bytes leftover after parsing attributes in process `syz.3.142'. [ 145.420873][ T6627] random: crng reseeded on system resumption [ 146.780365][ T6640] random: crng reseeded on system resumption [ 148.004921][ T6663] netlink: 186 bytes leftover after parsing attributes in process `syz.1.152'. [ 150.485267][ T6681] sd 0:0:1:0: PR command failed: 1026 [ 150.485332][ T6681] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 150.485366][ T6681] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 151.748728][ T30] audit: type=1800 audit(1761840022.241:2): pid=6715 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.161" name="lu_gp_id" dev="configfs" ino=11786 res=0 errno=0 [ 158.068743][ T6814] netlink: 5 bytes leftover after parsing attributes in process `syz.2.181'. [ 159.207649][ T6828] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(2) [ 163.610107][ T6890] binder: 6889:6890 ioctl 541b 38 returned -22 [ 165.558796][ T30] audit: type=1326 audit(1761840036.071:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6907 comm="syz.1.201" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9cb518efc9 code=0x0 [ 165.741814][ T6924] netlink: 268 bytes leftover after parsing attributes in process `syz.1.201'. [ 168.032900][ T6968] deleting an unspecified loop device is not supported. [ 175.019003][ T7120] netlink: 28 bytes leftover after parsing attributes in process `syz.3.237'. [ 179.159371][ T30] audit: type=1800 audit(1761840049.661:4): pid=7185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.245" name="file0" dev="tmpfs" ino=303 res=0 errno=0 [ 182.267483][ T7227] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(2) [ 193.651949][ T7400] netlink: 28 bytes leftover after parsing attributes in process `syz.1.286'. [ 194.866074][ T5150] Bluetooth: hci0: unexpected event 0x02 length: 726 > 260 [ 197.923581][ T7454] bond0: invalid ARP target specified [ 200.548020][ T7518] netlink: 28 bytes leftover after parsing attributes in process `syz.1.306'. [ 201.894348][ T7554] FAULT_INJECTION: forcing a failure. [ 201.894348][ T7554] name failslab, interval 1, probability 0, space 0, times 0 [ 201.960238][ T7554] CPU: 0 UID: 0 PID: 7554 Comm: syz.0.311 Not tainted syzkaller #0 PREEMPT(full) [ 201.960274][ T7554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 201.960291][ T7554] Call Trace: [ 201.960300][ T7554] [ 201.960311][ T7554] dump_stack_lvl+0x16c/0x1f0 [ 201.960345][ T7554] should_fail_ex+0x512/0x640 [ 201.960384][ T7554] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 201.960411][ T7554] should_failslab+0xc2/0x120 [ 201.960444][ T7554] kmem_cache_alloc_noprof+0x75/0x6e0 [ 201.960470][ T7554] ? security_file_alloc+0x34/0x2b0 [ 201.960499][ T7554] ? security_file_alloc+0x34/0x2b0 [ 201.960533][ T7554] security_file_alloc+0x34/0x2b0 [ 201.960562][ T7554] init_file+0x93/0x4c0 [ 201.960593][ T7554] alloc_empty_file+0x73/0x1e0 [ 201.960627][ T7554] path_openat+0xda/0x2cb0 [ 201.960666][ T7554] ? __pfx_path_openat+0x10/0x10 [ 201.960692][ T7554] ? __lock_acquire+0xb8a/0x1c90 [ 201.960726][ T7554] do_filp_open+0x20b/0x470 [ 201.960753][ T7554] ? __pfx_do_filp_open+0x10/0x10 [ 201.960797][ T7554] ? alloc_fd+0x471/0x7d0 [ 201.960829][ T7554] do_sys_openat2+0x11b/0x1d0 [ 201.960868][ T7554] ? __pfx_do_sys_openat2+0x10/0x10 [ 201.960904][ T7554] ? __sys_sendmsg+0x18c/0x220 [ 201.960934][ T7554] __x64_sys_openat+0x174/0x210 [ 201.960973][ T7554] ? __pfx___x64_sys_openat+0x10/0x10 [ 201.961017][ T7554] do_syscall_64+0xcd/0xfa0 [ 201.961047][ T7554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.961074][ T7554] RIP: 0033:0x7f5cbf78efc9 [ 201.961097][ T7554] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.961118][ T7554] RSP: 002b:00007f5cc05d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 201.961150][ T7554] RAX: ffffffffffffffda RBX: 00007f5cbf9e6180 RCX: 00007f5cbf78efc9 [ 201.961168][ T7554] RDX: 0000000000008000 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 201.961185][ T7554] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 201.961202][ T7554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.961216][ T7554] R13: 00007f5cbf9e6218 R14: 00007f5cbf9e6180 R15: 00007ffd103529f8 [ 201.961253][ T7554] [ 202.489564][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 202.497582][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 208.351533][ T7700] netlink: 28 bytes leftover after parsing attributes in process `syz.0.331'. [ 209.166007][ T7710] netlink: 20 bytes leftover after parsing attributes in process `syz.3.333'. [ 209.269124][ T7710] bridge_slave_1: left allmulticast mode [ 209.303026][ T7710] bridge_slave_1: left promiscuous mode [ 209.328751][ T7710] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.402335][ T7710] bridge_slave_0: left allmulticast mode [ 209.409107][ T7710] bridge_slave_0: left promiscuous mode [ 209.429822][ T7710] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.871780][ T7718] netlink: 4 bytes leftover after parsing attributes in process `syz.0.337'. [ 214.138217][ T7810] capability: warning: `syz.1.351' uses 32-bit capabilities (legacy support in use) [ 216.076427][ T7835] netlink: 28 bytes leftover after parsing attributes in process `syz.0.357'. [ 216.805312][ T7848] netlink: 186 bytes leftover after parsing attributes in process `syz.2.358'. [ 220.329399][ T7917] netlink: set zone limit has 8 unknown bytes [ 220.332972][ T7913] netlink: zone id is out of range [ 220.420449][ T7913] sd 0:0:1:0: PR command failed: 1026 [ 220.448701][ T7913] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 220.490435][ T7913] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 223.414453][ T7965] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 223.420577][ T7965] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 223.429331][ T7965] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 223.443986][ T7965] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 223.514052][ T7965] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 225.363981][ T5150] Bluetooth: hci0: command 0x0c1a tx timeout [ 225.444011][ T5150] Bluetooth: hci2: command 0x0c1a tx timeout [ 225.450091][ T5828] Bluetooth: hci1: command 0x0c1a tx timeout [ 225.524050][ T5150] Bluetooth: hci3: command 0x0c1a tx timeout [ 227.523864][ T5150] Bluetooth: hci2: command 0x0c1a tx timeout [ 228.329159][ T8056] netlink: 186 bytes leftover after parsing attributes in process `syz.2.399'. [ 229.889967][ T8084] netlink: 186 bytes leftover after parsing attributes in process `syz.1.404'. [ 230.056566][ T8088] netlink: 28 bytes leftover after parsing attributes in process `syz.3.406'. [ 230.546603][ T8096] netlink: 28 bytes leftover after parsing attributes in process `syz.0.410'. [ 230.772178][ T5150] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 232.147543][ T8136] netlink: 28 bytes leftover after parsing attributes in process `syz.3.418'. [ 233.002490][ T8151] netlink: 28 bytes leftover after parsing attributes in process `syz.2.421'. [ 233.209880][ T30] audit: type=1800 audit(6056807399.718:5): pid=8149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.419" name="lu_gp_id" dev="configfs" ino=20927 res=0 errno=0 [ 234.375795][ T8179] netlink: 186 bytes leftover after parsing attributes in process `syz.0.422'. [ 236.518218][ T30] audit: type=1800 audit(6056807403.018:6): pid=8213 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.430" name="file0" dev="tmpfs" ino=711 res=0 errno=0 [ 237.976635][ T5150] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 238.264930][ T8246] netlink: 186 bytes leftover after parsing attributes in process `syz.3.438'. [ 240.304833][ T8284] netlink: 20 bytes leftover after parsing attributes in process `syz.3.449'. [ 240.329207][ T8284] netlink: 20 bytes leftover after parsing attributes in process `syz.3.449'. [ 241.409239][ T8301] netlink: 20 bytes leftover after parsing attributes in process `syz.3.454'. [ 241.466063][ T8301] netlink: 20 bytes leftover after parsing attributes in process `syz.3.454'. [ 242.294678][ T8324] netlink: 28 bytes leftover after parsing attributes in process `syz.2.460'. [ 244.299910][ T8366] netlink: 28 bytes leftover after parsing attributes in process `syz.0.471'. [ 245.771698][ T8381] netlink: 20 bytes leftover after parsing attributes in process `syz.2.475'. [ 245.892229][ T8381] netlink: 20 bytes leftover after parsing attributes in process `syz.2.475'. [ 251.399455][ T30] audit: type=1800 audit(6056807417.868:7): pid=8485 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.493" name="file0" dev="tmpfs" ino=668 res=0 errno=0 [ 253.522751][ T8507] netlink: 20 bytes leftover after parsing attributes in process `syz.0.500'. [ 253.531927][ T8507] netlink: 20 bytes leftover after parsing attributes in process `syz.0.500'. [ 255.427717][ T8554] netlink: 186 bytes leftover after parsing attributes in process `syz.0.509'. [ 255.457882][ T8563] netlink: 28 bytes leftover after parsing attributes in process `syz.3.511'. [ 257.621708][ T8595] netlink: 186 bytes leftover after parsing attributes in process `syz.3.518'. [ 257.937449][ T8600] netlink: 186 bytes leftover after parsing attributes in process `syz.2.519'. [ 258.175569][ T8605] netlink: 28 bytes leftover after parsing attributes in process `syz.3.521'. [ 259.998979][ T8645] netlink: 186 bytes leftover after parsing attributes in process `syz.1.529'. [ 262.430762][ T8707] FAULT_INJECTION: forcing a failure. [ 262.430762][ T8707] name failslab, interval 1, probability 0, space 0, times 0 [ 262.455277][ T8707] CPU: 1 UID: 0 PID: 8707 Comm: syz.1.541 Not tainted syzkaller #0 PREEMPT(full) [ 262.455317][ T8707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 262.455335][ T8707] Call Trace: [ 262.455344][ T8707] [ 262.455355][ T8707] dump_stack_lvl+0x16c/0x1f0 [ 262.455392][ T8707] should_fail_ex+0x512/0x640 [ 262.455428][ T8707] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 262.455461][ T8707] should_failslab+0xc2/0x120 [ 262.455498][ T8707] kmem_cache_alloc_noprof+0x75/0x6e0 [ 262.455525][ T8707] ? security_file_alloc+0x34/0x2b0 [ 262.455558][ T8707] ? security_file_alloc+0x34/0x2b0 [ 262.455583][ T8707] security_file_alloc+0x34/0x2b0 [ 262.455609][ T8707] init_file+0x93/0x4c0 [ 262.455643][ T8707] alloc_empty_file+0x73/0x1e0 [ 262.455677][ T8707] path_openat+0xda/0x2cb0 [ 262.455716][ T8707] ? __pfx_path_openat+0x10/0x10 [ 262.455746][ T8707] ? __lock_acquire+0xb8a/0x1c90 [ 262.455784][ T8707] do_filp_open+0x20b/0x470 [ 262.455813][ T8707] ? __pfx_do_filp_open+0x10/0x10 [ 262.455866][ T8707] ? alloc_fd+0x471/0x7d0 [ 262.455901][ T8707] do_sys_openat2+0x11b/0x1d0 [ 262.455935][ T8707] ? __pfx_do_sys_openat2+0x10/0x10 [ 262.455972][ T8707] ? __sys_sendmsg+0x18c/0x220 [ 262.456004][ T8707] __x64_sys_openat+0x174/0x210 [ 262.456047][ T8707] ? __pfx___x64_sys_openat+0x10/0x10 [ 262.456098][ T8707] do_syscall_64+0xcd/0xfa0 [ 262.456129][ T8707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.456154][ T8707] RIP: 0033:0x7f9cb518efc9 [ 262.456177][ T8707] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 262.456200][ T8707] RSP: 002b:00007f9cb5f91038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 262.456225][ T8707] RAX: ffffffffffffffda RBX: 00007f9cb53e6180 RCX: 00007f9cb518efc9 [ 262.456249][ T8707] RDX: 0000000000008000 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 262.456269][ T8707] RBP: 00007f9cb5211f91 R08: 0000000000000000 R09: 0000000000000000 [ 262.456286][ T8707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 262.456301][ T8707] R13: 00007f9cb53e6218 R14: 00007f9cb53e6180 R15: 00007ffff76304b8 [ 262.456336][ T8707] [ 262.730953][ T8691] netlink: 20 bytes leftover after parsing attributes in process `syz.0.538'. [ 262.740080][ T8691] netlink: 20 bytes leftover after parsing attributes in process `syz.0.538'. [ 263.826577][ T8728] netlink: 20 bytes leftover after parsing attributes in process `syz.0.542'. [ 263.836321][ T8728] netlink: 20 bytes leftover after parsing attributes in process `syz.0.542'. [ 263.927225][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 263.934274][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 267.161259][ T8797] netlink: 20 bytes leftover after parsing attributes in process `syz.1.557'. [ 267.197300][ T8802] netlink: 28 bytes leftover after parsing attributes in process `syz.3.561'. [ 267.205326][ T8797] netlink: 20 bytes leftover after parsing attributes in process `syz.1.557'. [ 268.057607][ T8821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.565'. [ 269.485959][ T8846] netlink: 28 bytes leftover after parsing attributes in process `syz.3.571'. [ 270.264079][ T8854] netlink: 20 bytes leftover after parsing attributes in process `syz.3.573'. [ 270.298119][ T8854] netlink: 20 bytes leftover after parsing attributes in process `syz.3.573'. [ 270.913560][ T8864] netlink: 20 bytes leftover after parsing attributes in process `syz.0.575'. [ 270.995976][ T8864] netlink: 20 bytes leftover after parsing attributes in process `syz.0.575'. [ 272.417424][ T8900] netlink: 20 bytes leftover after parsing attributes in process `syz.3.583'. [ 272.437881][ T8900] netlink: 20 bytes leftover after parsing attributes in process `syz.3.583'. [ 274.835564][ T8924] kexec: Could not allocate control_code_buffer [ 274.965823][ T8948] netlink: 28 bytes leftover after parsing attributes in process `syz.3.592'. [ 275.338542][ T8947] netlink: 20 bytes leftover after parsing attributes in process `syz.2.594'. [ 275.384148][ T8956] netlink: 186 bytes leftover after parsing attributes in process `syz.0.595'. [ 275.480470][ T8947] netlink: 20 bytes leftover after parsing attributes in process `syz.2.594'. [ 276.174012][ T8958] kexec: Could not allocate control_code_buffer [ 277.576494][ T8993] netlink: 20 bytes leftover after parsing attributes in process `syz.2.604'. [ 277.636910][ T8993] netlink: 20 bytes leftover after parsing attributes in process `syz.2.604'. [ 278.192083][ T8989] kexec: Could not allocate control_code_buffer [ 278.555795][ T9010] netlink: 28 bytes leftover after parsing attributes in process `syz.3.608'. [ 278.578795][ T9012] netlink: 186 bytes leftover after parsing attributes in process `syz.0.606'. [ 278.966396][ T9017] netlink: 5 bytes leftover after parsing attributes in process `syz.3.609'. [ 280.211269][ T9029] netlink: 20 bytes leftover after parsing attributes in process `syz.3.613'. [ 280.266481][ T9029] netlink: 20 bytes leftover after parsing attributes in process `syz.3.613'. [ 280.400712][ T9019] kexec: Could not allocate control_code_buffer [ 280.756796][ T9048] netlink: 28 bytes leftover after parsing attributes in process `syz.3.617'. [ 280.996732][ T9046] netlink: 20 bytes leftover after parsing attributes in process `syz.2.616'. [ 281.024087][ T9046] netlink: 20 bytes leftover after parsing attributes in process `syz.2.616'. [ 283.233463][ T9090] __nla_validate_parse: 3 callbacks suppressed [ 283.233480][ T9090] netlink: 20 bytes leftover after parsing attributes in process `syz.2.624'. [ 283.250481][ T9090] netlink: 20 bytes leftover after parsing attributes in process `syz.2.624'. [ 283.672167][ T9104] netlink: 28 bytes leftover after parsing attributes in process `syz.0.627'. [ 284.575253][ T9118] netlink: 28 bytes leftover after parsing attributes in process `syz.0.633'. [ 285.934648][ T9124] kexec: Could not allocate control_code_buffer [ 288.298927][ T30] audit: type=1800 audit(6056807454.808:8): pid=9182 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.643" name="file0" dev="tmpfs" ino=980 res=0 errno=0 [ 288.542043][ T9186] netlink: 186 bytes leftover after parsing attributes in process `syz.0.645'. [ 289.876923][ T9204] netlink: 20 bytes leftover after parsing attributes in process `syz.0.654'. [ 289.895991][ T9204] netlink: 20 bytes leftover after parsing attributes in process `syz.0.654'. [ 290.373494][ T9193] kexec: Could not allocate control_code_buffer [ 290.722924][ T9218] netlink: 28 bytes leftover after parsing attributes in process `syz.2.650'. [ 291.351439][ T9225] netlink: 20 bytes leftover after parsing attributes in process `syz.0.652'. [ 291.382492][ T9225] netlink: 20 bytes leftover after parsing attributes in process `syz.0.652'. [ 291.710274][ T9233] netlink: 186 bytes leftover after parsing attributes in process `syz.2.655'. [ 292.216117][ T9239] netlink: 186 bytes leftover after parsing attributes in process `syz.1.656'. [ 292.546891][ T9228] kexec: Could not allocate control_code_buffer [ 293.818027][ T9268] netlink: 28 bytes leftover after parsing attributes in process `syz.1.663'. [ 294.880395][ T9283] netlink: 20 bytes leftover after parsing attributes in process `syz.3.666'. [ 294.891319][ T9283] netlink: 20 bytes leftover after parsing attributes in process `syz.3.666'. [ 295.056263][ T9289] netlink: 186 bytes leftover after parsing attributes in process `syz.2.669'. [ 295.303441][ T9294] netlink: 186 bytes leftover after parsing attributes in process `syz.1.668'. [ 297.235967][ T9334] netlink: 28 bytes leftover after parsing attributes in process `syz.2.676'. [ 298.543626][ T9350] netlink: 186 bytes leftover after parsing attributes in process `syz.0.679'. [ 298.955001][ T9348] netlink: 20 bytes leftover after parsing attributes in process `syz.2.680'. [ 299.022802][ T9348] netlink: 20 bytes leftover after parsing attributes in process `syz.2.680'. [ 299.089830][ T9359] netlink: 186 bytes leftover after parsing attributes in process `syz.3.683'. [ 299.498835][ T9368] netlink: 28 bytes leftover after parsing attributes in process `syz.2.685'. [ 299.805172][ T9373] netlink: 28 bytes leftover after parsing attributes in process `syz.2.687'. [ 300.009835][ T9379] netlink: 186 bytes leftover after parsing attributes in process `syz.3.688'. [ 301.145416][ T9397] netlink: 186 bytes leftover after parsing attributes in process `syz.2.692'. [ 301.558115][ T9399] netlink: 20 bytes leftover after parsing attributes in process `syz.1.693'. [ 301.570021][ T9399] netlink: 20 bytes leftover after parsing attributes in process `syz.1.693'. [ 301.723144][ T9411] netlink: 20 bytes leftover after parsing attributes in process `syz.0.694'. [ 302.532439][ T5150] Bluetooth: hci1: unexpected event 0x02 length: 726 > 260 [ 304.466603][ T9456] __nla_validate_parse: 2 callbacks suppressed [ 304.466618][ T9456] netlink: 186 bytes leftover after parsing attributes in process `syz.1.704'. [ 304.634407][ T9463] netlink: 186 bytes leftover after parsing attributes in process `syz.3.706'. [ 304.818940][ T9464] netlink: 186 bytes leftover after parsing attributes in process `syz.0.705'. [ 305.086843][ T9467] netlink: 186 bytes leftover after parsing attributes in process `syz.2.707'. [ 305.206800][ T9471] netlink: 28 bytes leftover after parsing attributes in process `syz.1.709'. [ 305.655979][ T9481] netlink: 186 bytes leftover after parsing attributes in process `syz.3.712'. [ 305.781753][ T9478] netlink: 20 bytes leftover after parsing attributes in process `syz.0.710'. [ 305.820897][ T9478] netlink: 20 bytes leftover after parsing attributes in process `syz.0.710'. [ 307.315485][ T9508] netlink: 186 bytes leftover after parsing attributes in process `syz.2.716'. [ 308.217671][ T9525] netlink: 20 bytes leftover after parsing attributes in process `syz.2.718'. [ 309.718518][ T9538] __nla_validate_parse: 3 callbacks suppressed [ 309.718532][ T9538] netlink: 186 bytes leftover after parsing attributes in process `syz.3.723'. [ 309.739823][ T9550] netlink: 28 bytes leftover after parsing attributes in process `syz.1.724'. [ 311.164837][ T9567] netlink: 186 bytes leftover after parsing attributes in process `syz.1.736'. [ 312.238025][ T9588] netlink: 186 bytes leftover after parsing attributes in process `syz.2.733'. [ 312.328880][ T9585] netlink: 20 bytes leftover after parsing attributes in process `syz.1.732'. [ 312.353859][ T9585] netlink: 20 bytes leftover after parsing attributes in process `syz.1.732'. [ 312.686456][ T9594] netlink: 186 bytes leftover after parsing attributes in process `syz.3.734'. [ 313.637892][ T9602] netlink: 20 bytes leftover after parsing attributes in process `syz.0.744'. [ 313.654107][ T9602] netlink: 20 bytes leftover after parsing attributes in process `syz.0.744'. [ 314.577634][ T9626] netlink: 186 bytes leftover after parsing attributes in process `syz.3.741'. [ 315.332429][ T9630] __nla_validate_parse: 1 callbacks suppressed [ 315.332450][ T9630] netlink: 4 bytes leftover after parsing attributes in process `syz.2.742'. [ 315.760705][ T9639] netlink: 186 bytes leftover after parsing attributes in process `syz.0.743'. [ 315.829005][ T9633] netlink: 20 bytes leftover after parsing attributes in process `syz.1.745'. [ 315.838321][ T9633] netlink: 20 bytes leftover after parsing attributes in process `syz.1.745'. [ 316.413333][ T9648] netlink: 28 bytes leftover after parsing attributes in process `syz.2.747'. [ 316.670755][ T9656] netlink: 20 bytes leftover after parsing attributes in process `syz.3.755'. [ 316.733844][ T9656] netlink: 20 bytes leftover after parsing attributes in process `syz.3.755'. [ 317.845631][ T9670] netlink: 20 bytes leftover after parsing attributes in process `syz.1.749'. [ 317.856535][ T9670] netlink: 20 bytes leftover after parsing attributes in process `syz.1.749'. [ 318.507827][ T9689] netlink: 28 bytes leftover after parsing attributes in process `syz.1.762'. [ 320.902000][ T9720] __nla_validate_parse: 1 callbacks suppressed [ 320.902016][ T9720] netlink: 20 bytes leftover after parsing attributes in process `syz.0.760'. [ 320.917917][ T9720] netlink: 20 bytes leftover after parsing attributes in process `syz.0.760'. [ 321.875086][ T9734] netlink: 186 bytes leftover after parsing attributes in process `syz.3.765'. [ 321.967108][ T9731] netlink: 20 bytes leftover after parsing attributes in process `syz.2.764'. [ 321.976738][ T9731] netlink: 20 bytes leftover after parsing attributes in process `syz.2.764'. [ 322.982351][ T9759] netlink: 28 bytes leftover after parsing attributes in process `syz.1.770'. [ 323.613531][ T9765] netlink: 20 bytes leftover after parsing attributes in process `syz.1.771'. [ 323.686894][ T9765] netlink: 20 bytes leftover after parsing attributes in process `syz.1.771'. [ 325.197589][ T9796] netlink: 186 bytes leftover after parsing attributes in process `syz.3.777'. [ 325.324893][ T9801] netlink: 186 bytes leftover after parsing attributes in process `syz.1.778'. [ 325.368999][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 325.375900][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 326.063377][ T9812] __nla_validate_parse: 2 callbacks suppressed [ 326.063399][ T9812] netlink: 186 bytes leftover after parsing attributes in process `syz.3.780'. [ 326.768170][ T9819] FAULT_INJECTION: forcing a failure. [ 326.768170][ T9819] name failslab, interval 1, probability 0, space 0, times 0 [ 326.783440][ T9819] CPU: 1 UID: 0 PID: 9819 Comm: syz.1.790 Not tainted syzkaller #0 PREEMPT(full) [ 326.783476][ T9819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 326.783492][ T9819] Call Trace: [ 326.783502][ T9819] [ 326.783512][ T9819] dump_stack_lvl+0x16c/0x1f0 [ 326.783550][ T9819] should_fail_ex+0x512/0x640 [ 326.783586][ T9819] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 326.783616][ T9819] should_failslab+0xc2/0x120 [ 326.783649][ T9819] kmem_cache_alloc_noprof+0x75/0x6e0 [ 326.783675][ T9819] ? __kernfs_new_node+0xd2/0x8e0 [ 326.783715][ T9819] ? __kernfs_new_node+0xd2/0x8e0 [ 326.783744][ T9819] __kernfs_new_node+0xd2/0x8e0 [ 326.783782][ T9819] ? __pfx___kernfs_new_node+0x10/0x10 [ 326.783821][ T9819] ? find_held_lock+0x2b/0x80 [ 326.783847][ T9819] ? kernfs_root+0xee/0x2a0 [ 326.783884][ T9819] kernfs_new_node+0x13c/0x1e0 [ 326.783928][ T9819] __kernfs_create_file+0x53/0x350 [ 326.783957][ T9819] sysfs_add_file_mode_ns+0x207/0x3c0 [ 326.783996][ T9819] internal_create_group+0x578/0xf30 [ 326.784043][ T9819] ? __pfx_internal_create_group+0x10/0x10 [ 326.784087][ T9819] ? kernfs_create_link+0x1bd/0x240 [ 326.784118][ T9819] internal_create_groups+0x9d/0x150 [ 326.784155][ T9819] device_add+0x6d1/0x1aa0 [ 326.784196][ T9819] ? __pfx_device_add+0x10/0x10 [ 326.784232][ T9819] ? lockdep_init_map_type+0x5c/0x280 [ 326.784263][ T9819] ? __init_waitqueue_head+0xca/0x150 [ 326.784305][ T9819] netdev_register_kobject+0x1a9/0x3d0 [ 326.784341][ T9819] register_netdevice+0x13dc/0x2270 [ 326.784389][ T9819] ? __pfx_register_netdevice+0x10/0x10 [ 326.784429][ T9819] __ip_tunnel_create+0x540/0x6e0 [ 326.784464][ T9819] ? __pfx___ip_tunnel_create+0x10/0x10 [ 326.784507][ T9819] ip_tunnel_init_net+0x22f/0x7d0 [ 326.784542][ T9819] ? __pfx_ip_tunnel_init_net+0x10/0x10 [ 326.784581][ T9819] ? ops_init+0x77/0x5f0 [ 326.784608][ T9819] ? __pfx_ipgre_tap_init_net+0x10/0x10 [ 326.784633][ T9819] ops_init+0x1e2/0x5f0 [ 326.784661][ T9819] setup_net+0x100/0x390 [ 326.784686][ T9819] ? __pfx_setup_net+0x10/0x10 [ 326.784712][ T9819] ? debug_mutex_init+0x37/0x70 [ 326.784742][ T9819] copy_net_ns+0x2f8/0x690 [ 326.784773][ T9819] create_new_namespaces+0x3ea/0xa90 [ 326.784810][ T9819] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 326.784840][ T9819] ksys_unshare+0x45b/0xa40 [ 326.784871][ T9819] ? __pfx_ksys_unshare+0x10/0x10 [ 326.784904][ T9819] ? xfd_validate_state+0x61/0x180 [ 326.784947][ T9819] __x64_sys_unshare+0x31/0x40 [ 326.784976][ T9819] do_syscall_64+0xcd/0xfa0 [ 326.785005][ T9819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.785031][ T9819] RIP: 0033:0x7f9cb518efc9 [ 326.785052][ T9819] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 326.785075][ T9819] RSP: 002b:00007f9cb5fd3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 326.785098][ T9819] RAX: ffffffffffffffda RBX: 00007f9cb53e5fa0 RCX: 00007f9cb518efc9 [ 326.785114][ T9819] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 326.785129][ T9819] RBP: 00007f9cb5211f91 R08: 0000000000000000 R09: 0000000000000000 [ 326.785144][ T9819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 326.785158][ T9819] R13: 00007f9cb53e6038 R14: 00007f9cb53e5fa0 R15: 00007ffff76304b8 [ 326.785195][ T9819] [ 329.073341][ T9850] netlink: 28 bytes leftover after parsing attributes in process `syz.0.795'. [ 329.273144][ T9851] netlink: 20 bytes leftover after parsing attributes in process `syz.1.787'. [ 329.309108][ T9851] netlink: 20 bytes leftover after parsing attributes in process `syz.1.787'. [ 329.747410][ T9861] netlink: 186 bytes leftover after parsing attributes in process `syz.2.789'. [ 330.596154][ T9876] netlink: 186 bytes leftover after parsing attributes in process `syz.1.791'. [ 330.846427][ T9883] netlink: 186 bytes leftover after parsing attributes in process `syz.0.793'. [ 330.971510][ T9882] netlink: 186 bytes leftover after parsing attributes in process `syz.2.794'. [ 331.664399][ T9892] FAULT_INJECTION: forcing a failure. [ 331.664399][ T9892] name failslab, interval 1, probability 0, space 0, times 0 [ 331.714216][ T9892] CPU: 0 UID: 0 PID: 9892 Comm: syz.0.796 Not tainted syzkaller #0 PREEMPT(full) [ 331.714254][ T9892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 331.714270][ T9892] Call Trace: [ 331.714279][ T9892] [ 331.714290][ T9892] dump_stack_lvl+0x16c/0x1f0 [ 331.714324][ T9892] should_fail_ex+0x512/0x640 [ 331.714359][ T9892] ? __kmalloc_node_track_caller_noprof+0xcb/0x8a0 [ 331.714397][ T9892] should_failslab+0xc2/0x120 [ 331.714430][ T9892] __kmalloc_node_track_caller_noprof+0xde/0x8a0 [ 331.714460][ T9892] ? kstrdup_const+0x63/0x80 [ 331.714493][ T9892] ? kstrdup+0x53/0x100 [ 331.714515][ T9892] kstrdup+0x53/0x100 [ 331.714553][ T9892] kstrdup_const+0x63/0x80 [ 331.714584][ T9892] kvasprintf_const+0x10f/0x1a0 [ 331.714613][ T9892] kobject_set_name_vargs+0x5a/0x140 [ 331.714647][ T9892] dev_set_name+0xc7/0x100 [ 331.714671][ T9892] ? __pfx_dev_set_name+0x10/0x10 [ 331.714700][ T9892] ? lockdep_init_map_type+0x5c/0x280 [ 331.714736][ T9892] ? __init_waitqueue_head+0xca/0x150 [ 331.714781][ T9892] netdev_register_kobject+0xc5/0x3d0 [ 331.714817][ T9892] register_netdevice+0x13dc/0x2270 [ 331.714853][ T9892] ? __pfx_register_netdevice+0x10/0x10 [ 331.714891][ T9892] __ip_tunnel_create+0x540/0x6e0 [ 331.714923][ T9892] ? __pfx___ip_tunnel_create+0x10/0x10 [ 331.714963][ T9892] ip_tunnel_init_net+0x22f/0x7d0 [ 331.714997][ T9892] ? __pfx_ip_tunnel_init_net+0x10/0x10 [ 331.715036][ T9892] ? ops_init+0x77/0x5f0 [ 331.715063][ T9892] ? __pfx_ipgre_tap_init_net+0x10/0x10 [ 331.715089][ T9892] ops_init+0x1e2/0x5f0 [ 331.715118][ T9892] setup_net+0x100/0x390 [ 331.715144][ T9892] ? __pfx_setup_net+0x10/0x10 [ 331.715172][ T9892] ? debug_mutex_init+0x37/0x70 [ 331.715202][ T9892] copy_net_ns+0x2f8/0x690 [ 331.715233][ T9892] create_new_namespaces+0x3ea/0xa90 [ 331.715270][ T9892] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 331.715301][ T9892] ksys_unshare+0x45b/0xa40 [ 331.715335][ T9892] ? __pfx_ksys_unshare+0x10/0x10 [ 331.715368][ T9892] ? xfd_validate_state+0x61/0x180 [ 331.715412][ T9892] __x64_sys_unshare+0x31/0x40 [ 331.715443][ T9892] do_syscall_64+0xcd/0xfa0 [ 331.715474][ T9892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 331.715499][ T9892] RIP: 0033:0x7f5cbf78efc9 [ 331.715520][ T9892] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 331.715554][ T9892] RSP: 002b:00007f5cc0613038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 331.715582][ T9892] RAX: ffffffffffffffda RBX: 00007f5cbf9e5fa0 RCX: 00007f5cbf78efc9 [ 331.715601][ T9892] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 331.715617][ T9892] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 331.715634][ T9892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 331.715650][ T9892] R13: 00007f5cbf9e6038 R14: 00007f5cbf9e5fa0 R15: 00007ffd103529f8 [ 331.715688][ T9892] [ 332.866259][ T9911] netlink: 186 bytes leftover after parsing attributes in process `syz.2.800'. [ 333.512617][ T9921] ecryptfs_miscdev_write: Dropping miscdev message of unrecognized type [0] [ 335.127015][ T9943] netlink: 186 bytes leftover after parsing attributes in process `syz.3.806'. [ 335.485348][ T9949] netlink: 186 bytes leftover after parsing attributes in process `syz.1.807'. [ 337.436301][ T9984] ecryptfs_miscdev_write: Minimum acceptable packet size is [14], but amount of data written is only [5]. Discarding response packet. [ 338.041035][ T9992] openvswitch: netlink: Message has 4 unknown bytes. [ 339.567398][T10030] netlink: 28 bytes leftover after parsing attributes in process `syz.3.825'. [ 340.062686][T10036] netlink: 186 bytes leftover after parsing attributes in process `syz.2.827'. [ 340.382711][T10044] netlink: 186 bytes leftover after parsing attributes in process `syz.0.828'. [ 341.747498][T10075] netlink: 28 bytes leftover after parsing attributes in process `syz.3.835'. [ 342.097383][T10078] netlink: 186 bytes leftover after parsing attributes in process `syz.3.836'. [ 342.875362][T10094] netlink: 186 bytes leftover after parsing attributes in process `syz.2.839'. [ 343.795810][T10110] netlink: 28 bytes leftover after parsing attributes in process `syz.2.844'. [ 344.022889][T10119] netlink: 186 bytes leftover after parsing attributes in process `syz.1.845'. [ 345.190144][T10140] netlink: 186 bytes leftover after parsing attributes in process `syz.2.850'. [ 346.410231][T10155] netlink: 186 bytes leftover after parsing attributes in process `syz.2.853'. [ 346.695523][T10163] netlink: 28 bytes leftover after parsing attributes in process `syz.3.855'. [ 347.389959][T10179] netlink: 24 bytes leftover after parsing attributes in process `syz.1.859'. [ 347.738582][T10179] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 347.753209][T10179] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 347.768996][T10179] bond0 (unregistering): Released all slaves [ 348.427487][T10198] netlink: 28 bytes leftover after parsing attributes in process `syz.2.863'. [ 348.447485][T10196] netlink: 186 bytes leftover after parsing attributes in process `syz.0.861'. [ 349.024382][T10202] netlink: 28 bytes leftover after parsing attributes in process `syz.2.864'. [ 350.322236][T10220] netlink: 186 bytes leftover after parsing attributes in process `syz.3.869'. [ 351.570390][T10199] kexec: Could not allocate control_code_buffer [ 351.654346][T10230] netlink: 20 bytes leftover after parsing attributes in process `syz.3.871'. [ 351.663510][T10230] netlink: 20 bytes leftover after parsing attributes in process `syz.3.871'. [ 351.798373][T10236] netlink: 28 bytes leftover after parsing attributes in process `syz.1.873'. [ 352.276075][T10253] netlink: 28 bytes leftover after parsing attributes in process `syz.3.875'. [ 352.627775][T10257] netlink: 8 bytes leftover after parsing attributes in process `syz.3.876'. [ 353.913982][T10275] netlink: 186 bytes leftover after parsing attributes in process `syz.2.880'. [ 354.466929][T10263] kexec: Could not allocate control_code_buffer [ 354.577413][T10287] netlink: 28 bytes leftover after parsing attributes in process `syz.1.883'. [ 354.837842][T10295] netlink: 186 bytes leftover after parsing attributes in process `syz.0.885'. [ 355.066680][T10297] netlink: 28 bytes leftover after parsing attributes in process `syz.2.886'. [ 355.414737][T10306] ecryptfs_miscdev_write: Minimum acceptable packet size is [14], but amount of data written is only [5]. Discarding response packet. [ 356.410075][T10321] netlink: 186 bytes leftover after parsing attributes in process `syz.2.891'. [ 356.458542][T10325] bond0: invalid ARP target specified [ 356.529653][T10323] netlink: 186 bytes leftover after parsing attributes in process `syz.3.899'. [ 357.704418][T10341] netlink: 186 bytes leftover after parsing attributes in process `syz.3.894'. [ 357.765665][T10343] netlink: 186 bytes leftover after parsing attributes in process `syz.1.893'. [ 358.757314][T10362] netlink: 186 bytes leftover after parsing attributes in process `syz.1.896'. [ 359.710519][T10372] netlink: 186 bytes leftover after parsing attributes in process `syz.2.903'. [ 360.782425][T10394] netlink: 186 bytes leftover after parsing attributes in process `syz.3.907'. [ 361.324412][T10396] netlink: 186 bytes leftover after parsing attributes in process `syz.0.908'. [ 362.437279][T10406] netlink: 20 bytes leftover after parsing attributes in process `syz.3.911'. [ 362.447378][T10406] netlink: 20 bytes leftover after parsing attributes in process `syz.3.911'. [ 362.950583][T10423] netlink: 186 bytes leftover after parsing attributes in process `syz.0.915'. [ 363.724180][T10439] netlink: 8 bytes leftover after parsing attributes in process `syz.0.917'. [ 363.956827][T10444] netlink: 186 bytes leftover after parsing attributes in process `syz.2.919'. [ 364.903119][T10455] netlink: 186 bytes leftover after parsing attributes in process `syz.3.921'. [ 365.744648][T10468] ================================================================== [ 365.744666][T10468] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1a6f/0x1e60 [ 365.744708][T10468] Write of size 8 at addr ffffc900037c9580 by task syz.0.923/10468 [ 365.744731][T10468] [ 365.744743][T10468] CPU: 1 UID: 0 PID: 10468 Comm: syz.0.923 Not tainted syzkaller #0 PREEMPT(full) [ 365.744773][T10468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 365.744795][T10468] Call Trace: [ 365.744804][T10468] [ 365.744814][T10468] dump_stack_lvl+0x116/0x1f0 [ 365.744847][T10468] print_report+0xcd/0x630 [ 365.744882][T10468] ? __virt_addr_valid+0x81/0x610 [ 365.744920][T10468] ? sys_imageblit+0x1a6f/0x1e60 [ 365.744949][T10468] kasan_report+0xe0/0x110 [ 365.744983][T10468] ? sys_imageblit+0x1a6f/0x1e60 [ 365.745015][T10468] sys_imageblit+0x1a6f/0x1e60 [ 365.745048][T10468] ? __pfx_sys_imageblit+0x10/0x10 [ 365.745082][T10468] ? do_raw_spin_lock+0x12c/0x2b0 [ 365.745126][T10468] ? find_held_lock+0x2b/0x80 [ 365.745154][T10468] ? debug_object_activate+0x2ec/0x4c0 [ 365.745181][T10468] ? do_raw_spin_unlock+0x172/0x230 [ 365.745220][T10468] ? debug_object_activate+0x2ec/0x4c0 [ 365.745247][T10468] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 365.745287][T10468] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 365.745316][T10468] soft_cursor+0x524/0xa10 [ 365.745355][T10468] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 365.745381][T10468] ? fb_get_color_depth+0x120/0x250 [ 365.745417][T10468] bit_cursor+0xe8c/0x17e0 [ 365.745456][T10468] ? __pfx_bit_cursor+0x10/0x10 [ 365.745495][T10468] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 365.745535][T10468] ? get_color+0x1da/0x450 [ 365.745566][T10468] ? __pfx_bit_cursor+0x10/0x10 [ 365.745600][T10468] fbcon_cursor+0x40c/0x5a0 [ 365.745631][T10468] ? add_softcursor+0x1/0x290 [ 365.745669][T10468] set_cursor+0x1db/0x250 [ 365.745691][T10468] con_write+0x89/0xb0 [ 365.745717][T10468] n_tty_write+0x41e/0x11e0 [ 365.745755][T10468] ? __pfx_n_tty_write+0x10/0x10 [ 365.745786][T10468] ? trace_kmalloc+0x2b/0xd0 [ 365.745817][T10468] ? __pfx_woken_wake_function+0x10/0x10 [ 365.745853][T10468] ? kfree+0x252/0x6d0 [ 365.745875][T10468] ? __pfx_n_tty_write+0x10/0x10 [ 365.745906][T10468] file_tty_write.constprop.0+0x503/0x9b0 [ 365.745939][T10468] redirected_tty_write+0xd4/0x150 [ 365.745966][T10468] vfs_write+0x7d3/0x11d0 [ 365.745992][T10468] ? __pfx_redirected_tty_write+0x10/0x10 [ 365.746022][T10468] ? __pfx_vfs_write+0x10/0x10 [ 365.746045][T10468] ? find_held_lock+0x2b/0x80 [ 365.746088][T10468] ksys_write+0x12a/0x250 [ 365.746116][T10468] ? __pfx_ksys_write+0x10/0x10 [ 365.746151][T10468] do_syscall_64+0xcd/0xfa0 [ 365.746183][T10468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.746209][T10468] RIP: 0033:0x7f5cbf78efc9 [ 365.746229][T10468] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 365.746253][T10468] RSP: 002b:00007f5cc05d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 365.746277][T10468] RAX: ffffffffffffffda RBX: 00007f5cbf9e6180 RCX: 00007f5cbf78efc9 [ 365.746291][T10468] RDX: 0000000000000cb6 RSI: 0000200000000e00 RDI: 0000000000000007 [ 365.746305][T10468] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 365.746319][T10468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.746332][T10468] R13: 00007f5cbf9e6218 R14: 00007f5cbf9e6180 R15: 00007ffd103529f8 [ 365.746358][T10468] [ 365.746367][T10468] [ 365.746373][T10468] The buggy address belongs to a vmalloc virtual mapping [ 365.746394][T10468] Memory state around the buggy address: [ 365.746408][T10468] ffffc900037c9480: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 365.746426][T10468] ffffc900037c9500: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 365.746444][T10468] >ffffc900037c9580: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 365.746458][T10468] ^ [ 365.746471][T10468] ffffc900037c9600: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 365.746488][T10468] ffffc900037c9680: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 365.746503][T10468] ================================================================== [ 365.746566][T10468] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 365.746585][T10468] CPU: 1 UID: 0 PID: 10468 Comm: syz.0.923 Not tainted syzkaller #0 PREEMPT(full) [ 365.746618][T10468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 365.746634][T10468] Call Trace: [ 365.746644][T10468] [ 365.746655][T10468] dump_stack_lvl+0x3d/0x1f0 [ 365.746684][T10468] vpanic+0x640/0x6f0 [ 365.746722][T10468] panic+0xca/0xd0 [ 365.746755][T10468] ? __pfx_panic+0x10/0x10 [ 365.746793][T10468] ? sys_imageblit+0x1a6f/0x1e60 [ 365.746821][T10468] ? preempt_schedule_common+0x44/0xc0 [ 365.746848][T10468] ? preempt_schedule_thunk+0x16/0x30 [ 365.746888][T10468] check_panic_on_warn+0xab/0xb0 [ 365.746924][T10468] end_report+0x107/0x170 [ 365.746954][T10468] kasan_report+0xee/0x110 [ 365.746986][T10468] ? sys_imageblit+0x1a6f/0x1e60 [ 365.747017][T10468] sys_imageblit+0x1a6f/0x1e60 [ 365.747050][T10468] ? __pfx_sys_imageblit+0x10/0x10 [ 365.747088][T10468] ? do_raw_spin_lock+0x12c/0x2b0 [ 365.747130][T10468] ? find_held_lock+0x2b/0x80 [ 365.747159][T10468] ? debug_object_activate+0x2ec/0x4c0 [ 365.747192][T10468] ? do_raw_spin_unlock+0x172/0x230 [ 365.747222][T10468] ? debug_object_activate+0x2ec/0x4c0 [ 365.747244][T10468] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 365.747278][T10468] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 365.747305][T10468] soft_cursor+0x524/0xa10 [ 365.747348][T10468] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 365.747377][T10468] ? fb_get_color_depth+0x120/0x250 [ 365.747410][T10468] bit_cursor+0xe8c/0x17e0 [ 365.747443][T10468] ? __pfx_bit_cursor+0x10/0x10 [ 365.747478][T10468] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 365.747515][T10468] ? get_color+0x1da/0x450 [ 365.747548][T10468] ? __pfx_bit_cursor+0x10/0x10 [ 365.747583][T10468] fbcon_cursor+0x40c/0x5a0 [ 365.747613][T10468] ? add_softcursor+0x1/0x290 [ 365.747648][T10468] set_cursor+0x1db/0x250 [ 365.747669][T10468] con_write+0x89/0xb0 [ 365.747695][T10468] n_tty_write+0x41e/0x11e0 [ 365.747734][T10468] ? __pfx_n_tty_write+0x10/0x10 [ 365.747766][T10468] ? trace_kmalloc+0x2b/0xd0 [ 365.747793][T10468] ? __pfx_woken_wake_function+0x10/0x10 [ 365.747829][T10468] ? kfree+0x252/0x6d0 [ 365.747850][T10468] ? __pfx_n_tty_write+0x10/0x10 [ 365.747879][T10468] file_tty_write.constprop.0+0x503/0x9b0 [ 365.747907][T10468] redirected_tty_write+0xd4/0x150 [ 365.747932][T10468] vfs_write+0x7d3/0x11d0 [ 365.747955][T10468] ? __pfx_redirected_tty_write+0x10/0x10 [ 365.747983][T10468] ? __pfx_vfs_write+0x10/0x10 [ 365.748007][T10468] ? find_held_lock+0x2b/0x80 [ 365.748042][T10468] ksys_write+0x12a/0x250 [ 365.748067][T10468] ? __pfx_ksys_write+0x10/0x10 [ 365.748108][T10468] do_syscall_64+0xcd/0xfa0 [ 365.748134][T10468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.748159][T10468] RIP: 0033:0x7f5cbf78efc9 [ 365.748178][T10468] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 365.748201][T10468] RSP: 002b:00007f5cc05d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 365.748226][T10468] RAX: ffffffffffffffda RBX: 00007f5cbf9e6180 RCX: 00007f5cbf78efc9 [ 365.748242][T10468] RDX: 0000000000000cb6 RSI: 0000200000000e00 RDI: 0000000000000007 [ 365.748255][T10468] RBP: 00007f5cbf811f91 R08: 0000000000000000 R09: 0000000000000000 [ 365.748268][T10468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.748282][T10468] R13: 00007f5cbf9e6218 R14: 00007f5cbf9e6180 R15: 00007ffd103529f8 [ 365.748302][T10468] [ 365.748588][T10468] Kernel Offset: disabled