last executing test programs: 23.68684689s ago: executing program 0 (id=48): ioctl$auto_SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x80102, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\v\xba\x8av\xf0\x85\x9e`\x1fN$\xd4\x1c\xe0\xa6\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x89\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI', 0x100000a3db) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x5, 0x5, 0x2009, 0x0, 0x0) r1 = openat$auto_proc_pid_numa_maps_operations_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x40000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x40001, 0x0) ioctl$auto_TCFLSH2(r2, 0x80045439, 0x0) ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0) ioctl$auto(r2, 0x8926, r2) read$auto_proc_sessionid_operations_base(r1, 0x0, 0x0) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) openat$auto_media_devnode_fops_mc_devnode(0xffffffffffffff9c, &(0x7f0000000040)='/dev/media15\x00', 0x40801, 0x0) madvise$auto(0x0, 0x200007, 0x19) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000005800), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_TX_INFO_FRAME(0xffffffffffffffff, &(0x7f0000006940)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000041}, 0x800) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, 0x0, 0x1, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000012c0)='/sys/devices/virtual/block/ram4/queue/physical_block_size\x00', 0xa00, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f00000004c0)=""/206, 0xce) syz_open_procfs$namespace(0x0, 0x0) write$auto(0xffffffffffffffff, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00x \xec(\x1d\x98\xe9\xc4\xe8\xfc@6=\xab\xf4\x89\x01\x93\xdc\x19\xffv\'\xa1\xd5\x14\x06S\xae\xadB}\xdf]\x99\xc9\x9f4\xbb\xc5\x81\x9d\x8ak\xdeB\xcbd\xd3\x05\xe4P\x84\xcb\xb8#\x13\nYU\'\x95R\xc8\x9d\xb7*\xe0.\xd2\xdf\x1b\x88D\x8c{k\xcec\xe1\xa2j\xec\xc9\xd2\x98\x94I\x102h\x06\x8c\xa2\xc8\x8a7\xb7t', 0x7f1) modify_ldt$auto(0x40, 0x0, 0x7ff) r4 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/can/rcvlist_sff\x00', 0x400, 0x0) pread64$auto(r4, 0x0, 0x101fb, 0x8800000005) 21.53877204s ago: executing program 0 (id=52): mmap$auto(0x0, 0x8, 0xdf, 0x9b73, 0x2, 0xa281) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) rseq$auto(0x0, 0xfffffff5, 0x0, 0x5) sysfs$auto(0x2, 0x10000000000002a, 0x0) socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x48041, 0x0) ioctl$auto_USB_RAW_IOCTL_EP0_STALL(r0, 0x550c, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendto$auto(0x3, 0x0, 0x2000f, 0x0, 0x0, 0x1c) sendmsg$auto_NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x8000800) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) r1 = openat$auto_ftrace_system_enable_fops_trace_events(0xffffffffffffff9c, &(0x7f0000001580)='/sys/kernel/debug/tracing/events/vmalloc/enable\x00', 0x20204, 0x1a00) r2 = openat$auto_show_traces_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/available_tracers\x00', 0x7f1143, 0x0) read$auto_show_traces_fops_trace(r2, &(0x7f0000000640)=""/188, 0xbc) read$auto(r1, 0x0, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x22240, 0x154) fcntl$auto(r3, 0x400, 0x1) fcntl$auto(0x3, 0xc, 0x0) open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) fcntl$auto(0xffffffffffffffff, 0x7, 0x0) mmap$auto(0x0, 0x404008, 0xdf, 0x9b72, 0x2, 0x8000) futex_waitv$auto(&(0x7f0000000300)={0x7f, 0x100000001, 0x2}, 0x80, 0x0, &(0x7f0000000340)={0x92, 0x6}, 0x8) openat$auto_proc_environ_operations_base(0xffffffffffffff9c, 0x0, 0x80040, 0x0) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0xc2902, 0x0) read$auto(r4, 0x0, 0x20) getsockopt$auto(0xffffffffffffffff, 0x6b, 0x3, 0xfffffffffffffffe, 0x0) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self/fail-nth\x00', 0x4d2800, 0x0) 15.213671064s ago: executing program 0 (id=61): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) socket(0x15, 0x5, 0x0) openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x20342, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptybd\x00', 0x6202, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snd/midiC2D0\x00', 0x109302, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000005280), 0x0, 0x0) select$auto(0x7, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0x3, 0x1, 0x2, 0x3, 0x95f4da0a, 0xefffffffffffffff, 0x3, 0x62, 0x80000001, 0x10000000000004, 0x6d40, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe]}, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0x2b, 0x5, 0x1) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, &(0x7f0000000140)={[0x1ff, 0x7, 0xc45d, 0x80, 0x6, 0x3, 0x2, 0x3, 0x3, 0x62, 0x80000022, 0x7, 0x6d3e, 0x2000000004000009, 0x2, 0x6]}, 0x0) mmap$auto(0xf87f, 0x400108, 0xdf, 0x9b72, 0x2, 0x8000) ioctl$auto_USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, &(0x7f0000000040)={0x6, 0x0}) sendmsg$auto_ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, 0x0, 0x4) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio1\x00', 0x20b42, 0x0) quotactl_fd$auto(0x0, 0x80000201, 0x0, 0xfffffffffffffffd) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card1/pcm0c/sub0/sw_params\x00', 0x40, 0x0) mknod$auto(&(0x7f0000000040)='./file0\x00', 0x1001, 0x4) syz_clone3(&(0x7f00000001c0)={0x2000000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioperm$auto(0xffffffffffffffff, 0x389, 0xd) 14.693287799s ago: executing program 1 (id=63): r0 = socket(0x15, 0x5, 0x0) openat$auto_qrtr_tun_ops_tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) r1 = openat$auto_uhid_fops_uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2201, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, 0x0, 0x6) openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000000200)='/proc/thread-self/mem\x00', 0x402, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x78, 0xffffffffffffffff, 0x300000000000) write$auto(0x3, 0x0, 0x2a9) mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000) mremap$auto(0x4000, 0xfee0, 0x3fd6, 0x3, 0x18000) write$auto(0x3, 0x0, 0xffd8) r3 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/024/001\x00', 0xc8101, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd6, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80000001, 0x7, 0x1, 0x9, 0x1, 0xfffffffffffffffe]}, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x8000001f, 0x7, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0) bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) select$auto(0x5, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$auto_FIONBIO(r3, 0x5421, 0x2) sendmsg$auto_SMC_NETLINK_DISABLE_SEID(r4, 0x0, 0x810) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) shmctl$auto_SHM_LOCK(0x1, 0xb, 0x0) socketcall$auto_SYS_SOCKETPAIR(0x8, &(0x7f00000001c0)=0x4) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4ea2, @remote}, 0x6a) sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0x101}, 0x8}, 0x7, 0x20020000) 11.425630683s ago: executing program 1 (id=68): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) nanosleep$auto(0x0, 0x0) getpid() clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x4020009, 0xdb, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xc3e, 0x1, 0x948b, 0x3, 0x95f4da0a, 0x10001, 0x3, 0x62, 0x8, 0x7, 0x6d3f, 0x4000000000000009, 0x2, 0xfdfffffffffffffe]}, 0x0) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/cpuid/cpu0/uevent\x00', 0x20400, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000002140)=""/64, 0x40) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, 0x0, 0x440, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) close_range$auto(0x2, 0x8, 0x0) socketpair$auto(0x1, 0x0, 0x0, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0xc7f16bff2a10ba01, 0x0) ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0) socketpair$auto(0x20004, 0x1, 0x1, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101e81, 0x0) ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0) ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0) 9.711350192s ago: executing program 1 (id=72): mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x801, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x9, 0x8, 0x1, 0x2, 0x4, 0x15f4da0e, 0x3, 0xd08, 0xc, 0x8, 0x4, 0xfca, 0x9, 0x2, 0x4000000000000d]}, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) socket(0x2c, 0x1, 0x3) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) prctl$auto(0x400, 0x7fff, 0x0, 0x10000, 0x100000000000007) madvise$auto(0x0, 0xffffffffffff0005, 0x19) bind$auto(0x3, 0x0, 0x6a) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x7f, 0x0) close_range$auto(0x2, 0xa, 0x0) io_uring_setup$auto(0x6, 0x0) io_uring_register$auto(0x2, 0x0, &(0x7f0000000000), 0x1000) close_range$auto(0x2, 0x8, 0x0) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/ieee80211/phy16/wep_iv\x00', 0x2, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x6, 0x4f, 0x5) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000400), 0xffffffffffffffff) 9.594520176s ago: executing program 3 (id=73): close_range$auto(0x2, 0xa, 0x0) r0 = socket(0xa, 0x3, 0x3b) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) setsockopt$auto(0x3, 0x1, 0x23, 0x0, 0x9) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x9) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) getsockopt$auto_SO_NOFCS(r0, 0x7, 0x2b, &(0x7f0000000040)='/dev/uinput\x00', &(0x7f0000000080)=0x7) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) pwrite64$auto(0xc8, &(0x7f0000000080)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdde\x1cJ\x99\x00\x00/\x00\x00\x00\xfd\xfdX\xd3\x1d\xf8\xbebZ\xddL\x01\x00\x00\x00^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x88\v\xae\xa9i8W\xe5\x00!\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8dg\x81K*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,,\x93\xba\x88\x93\xc6#\xe5\xaae\x9d\xb6\x1a\x7f\xc0%\xb0\rfOJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd0\xbdn\x1d\x00\xeb]B\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00'/232, 0xfded, 0x3) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) read$auto_force_wakeup_fops_hci_vhci(0xffffffffffffffff, 0x0, 0x0) r1 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$auto_UI_SET_SNDBIT(r1, 0x4004556a, &(0x7f0000000140)=0x80000001) msgctl$auto_IPC_STAT(0x25, 0x2, 0x0) r2 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000080), 0x420, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) readv$auto(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x4000001070a719d}, 0x400) socket(0x10, 0x2, 0x0) set_mempolicy$auto(0x6, &(0x7f0000000000)=0x3, 0x21) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0x2, 0x8000) 8.330027192s ago: executing program 3 (id=75): openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x40000008000) openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) select$auto(0xd, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x6, 0x62, 0x80000000, 0x9, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) ioctl$auto_TUNSETVNETBE2(r1, 0x400454de, &(0x7f00000000c0)=0x400) getpid() mlockall$auto(0x5) rt_sigprocmask$auto(0x6, &(0x7f0000000080)={0x6}, 0xffffffffffffffff, 0x8) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) unshare$auto(0x4) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) socket(0x23, 0x2, 0x0) socket(0x11, 0xa, 0x300) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) sendmmsg$auto(0x4, 0x0, 0x400, 0x7) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) io_uring_setup$auto(0x406, 0x0) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0) getrandom$auto(0x0, 0x6000000, 0x3) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyp4\x00', 0x2, 0x0) io_uring_enter$auto(0x3, 0xa84, 0x80000001, 0xa, 0x0, 0x46) 7.665311372s ago: executing program 0 (id=76): close_range$auto(0x0, 0x5, 0x0) inotify_init1$auto(0x800) r0 = openat$auto_lowpan_enable_fops_(0xffffffffffffff9c, &(0x7f0000000000), 0x109500, 0x0) read$auto(r0, 0x0, 0x4b) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000001f00), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000003a80)={0x0, 0x0, &(0x7f0000003a40)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = io_uring_setup$auto(0x4, 0x0) open(0x0, 0x22240, 0x55) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, 0x0, 0x173180, 0x0) mmap$auto(0x9, 0x6, 0x4000000000df, 0x800000000000eb1, r2, 0x5) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/devices/virtual/block/loop5/queue/scheduler\x00', 0x3a3180, 0x0) mmap$auto(0x0, 0x2000d, 0x7, 0xeb1, r3, 0x10008000) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r4, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/block/ram10/queue/discard_max_hw_bytes\x00', 0x68e00, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f00000001c0)=""/112, 0x70) openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mtd0\x00', 0x228800, 0x0) r6 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0) ioctl$auto_UI_DEV_SETUP(r6, 0x405c5503, &(0x7f00000000c0)={{0x9, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fb4a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f00", 0xa}) ioctl$auto_UI_DEV_CREATE(r6, 0x5501, 0x0) writev$auto(r6, &(0x7f0000000340)={0x0, 0xda7e}, 0x9) socket(0x5, 0x5, 0xe) unshare$auto(0x40000080) r7 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bus/usb/024/001\x00', 0x40001, 0x0) ioctl$auto_USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000180)={0x2, 0x2, 0x4a47, 0x81, 0x9f, 0x8, 0x0}) 6.46415861s ago: executing program 1 (id=78): socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) read$auto_long_retry_limit_ops_(r0, 0x0, 0x0) sendmsg$auto_HSR_C_GET_NODE_STATUS(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = socket(0x2, 0x801, 0x106) getsockopt$auto(r2, 0x11c, 0x1, 0x0, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) r3 = openat$auto_hwflags_ops_debugfs(0xffffffffffffff9c, 0x0, 0x101000, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_tcp_metrics(&(0x7f0000000c00), r4) sendmsg$auto_TCP_METRICS_CMD_DEL(r4, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000000)={0x14, r5, 0x901, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40) sendmsg$auto_TCP_METRICS_CMD_GET(r1, &(0x7f00000018c0)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001880)={&(0x7f0000001800)={0x14, r5, 0x0, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000004}, 0x40000) close_range$auto(0x2, 0x8, 0x0) socket(0x2b, 0x1, 0x0) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ieee80211/phy1/aql_txq_limit\x00', 0x28402, 0x0) write$auto(0x3, 0x0, 0xfffffdef) migrate_pages$auto(0x0, 0x2, &(0x7f0000000040)=0x29, &(0x7f0000000140)=0x36f) close_range$auto(0x0, 0xfffffffffffff000, 0x0) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0x1, 0xb5, 0x10, 0x7, 0x4, 0xffffffffffffffff, 0xa, "2af051a940806ec05be276cfc83ce63f", 0x0, r3, 0x5, 0x7, 0xe5, 0x3}, 0x10) r7 = bpf$auto(0x1a, &(0x7f0000000380)=@link_create={@map_fd, @target_ifindex=r6, 0x3, 0x81, @uprobe_multi={0x81, 0x1ff, 0x3d7e, 0x0, 0x1, 0x4}}, 0x92) syz_clone3(&(0x7f0000001600)={0x800000, &(0x7f0000000340)=0xffffffffffffffff, 0x0, &(0x7f0000000540), {0x12}, &(0x7f0000000580)=""/47, 0x2f, &(0x7f00000005c0)=""/4096, &(0x7f00000015c0), 0x0, {r7}}, 0x58) waitid$auto(0x6, r8, &(0x7f0000001680)={@_si_pad}, 0x5, &(0x7f0000001700)={{0x7, 0xd}, {0xf04, 0x9}, 0x5b0f5de8, 0x8000000000000001, 0x5, 0x800, 0x1, 0x8001, 0x6, 0x0, 0x7ff, 0x3, 0x4, 0xc6f8, 0x6, 0x4}) 5.303018336s ago: executing program 3 (id=80): r0 = socket(0x1b, 0x3, 0x76) madvise$auto(0x0, 0x2000040080000004, 0xe) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0) write$auto(r1, &(0x7f0000000040)='//\xf2\x00', 0x80000000) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nfsd(&(0x7f0000002f00), 0xffffffffffffffff) sendmsg$auto_NFSD_CMD_LISTENER_SET(r3, &(0x7f0000005380)={0x0, 0x0, &(0x7f0000005340)={&(0x7f0000000180)={0x28, r4, 0x1, 0x870bd2b, 0x25dfdbfc, {}, [@NFSD_A_SERVER_SOCK_ADDR={0x14, 0x1, 0x0, 0x1, [@NFSD_A_SOCK_TRANSPORT_NAME={0x9, 0x2, 'nfsd\x00'}, @NFSD_A_SOCK_ADDR={0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0x20000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20008000}, 0x10004090) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a00"], 0x1ac}}, 0x40000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) recvmmsg$auto(r5, &(0x7f0000000100)={{0x0, 0x4, &(0x7f0000000080)={&(0x7f0000000040), 0x100000000cb}, 0x3, 0x0, 0x80000000, 0x80000000}, 0x9}, 0x7, 0x6, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="720100", @ANYBLOB=' \x00\''], 0x1ac}}, 0x40000) r6 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="18"], 0x1ac}}, 0x20000000) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) syz_clone(0x4040400, 0x0, 0x0, 0x0, 0x0, 0x0) readv$auto(0x3, 0x0, 0x1) sendmsg$auto_NL80211_CMD_GET_WOWLAN(r3, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004810}, 0x800) syz_genetlink_get_family_id$auto_nlctrl(0x0, r0) close_range$auto(0x2, 0x8, 0x0) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) 4.812740905s ago: executing program 0 (id=82): openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0\x00', 0x8002, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000080)={0x0, 0x80000000}, 0x6, 0xffffffffffffffff, 0x4, 0x2e) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x408802, 0x0) openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/lru_gen\x00', 0xc0000, 0x0) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/net/rpc/nfs4.idtoname/content\x00', 0x181b80, 0x0) read$auto(r1, &(0x7f0000000440)='2\x06J Nwe0\xbd\"\x8f\xe5h_b\xde\x19\xa5\x0e\xfa\xe0\xcb\xb7\xaceW\x1a\x1f\xae\xd8\xfe\x01Y\xd6\xba\xde3\xc7\xf8\x91\xda\xf6_%\xf30\xdc\x97<\xf3A\xa7\xb4\x8dj\xbd\x02\xb1}{e\xf64\xecC\x83,\xecp7j\xf8<\xc8x\xd4\xb0\x1d\b\xb08\x01\x9e\x9et\x8aa\xe1\re\xcf\x8e\x02\xeeW\xf0z\vk\x02_\xdb\x15f8>;zM\xa95\x16\xe9l\xf5\xaa\xaa\x03\x18p\x0e\xde$\xc3\xa9\xac\xc7\x98\x05<\xef\xcd@z\fx}F\x93\xe1\xbd\xb3s\x80\xc1e\xe9T1\xbf\xc8_^\a\x03\xad\ni\n~-u)\x88\x97\xed\xa7\x9b\x0f\xef\x99\x13\xdc<\xd1{\br\xd6[\xd3\xa9-(KH\b\xdfJ\xdek\xef\xc9\xd7\n\x83m\x86\xf2\a\x8d\x19\xe0\\\xf0lg?\x98\xc8\x8e\xbd2?C\xa5\x8a\xe3\xc6\xd7\x00\x14n\xb8<\xab\x96\x8d\xa1\xf4\x87\xe5\a:z\xea\xcc\xa1\x8d\xae8\x12\xa6\xb9\xd99\xaa\xc5\x10\xad\xdd\x89\xddC\xf5\xd2Q\x92\xcd\xcc\x9f\x1a\xdbR\xeeL:\x87\xb3\xb0\x84\x1bR\xf2\xe2/\xa3\x0e\x90\x98\x8c\xc0\xa4\xda+U\b\x88\xa7\x88\x1fC\xbb\xa8\xce\x0f\xd5\xdew\x99\x18G.s\x16\xfa\xf2\x96|\x1e]\xe5\xf8\xb1\x8b.}\x841\xd8\x98\xd8f86h\xab\x94\x7f\xc4<\x03\xdd\x86=\xb6\x1e@\xab6\x81\xce\xaa\xcf\xfd\x947\xc3\x86\xfe\xb7O\xd9\xa9\xb6[\xcc\xd8\xe1\xa9\x84[\xe0\xd4\x03\x90@\x03\xbe\xba\xee\xed\xe9\xb1\xd2\xf1\x8cgn\xb7m/\xf1\"\xc2\xeb\x1d\x04\xf3\xf1\x96\xf2\x00C\xf0wg\xd6\x11\x18\xb5o\x9d\xd7`\xce\x81\x9b1b\x8ce\x99*\xa3\xd2\x8dAw\xd9\xa6l\\\x17\xbb\xf6\xe2\xa2<\n\xc0\f:\x97\xff\xc6y\x05<\xa6\x81\xd92\xc9\x9e\f[\xf9\xfc\xf1ih\"J\x92\xd2\xd4\xc2\xe8\x89 \x81\xbf8C\xa9\x1at\xa1\xdc\x94\xc5\xc8K\xbb\x14h\xa9)\xaa\xf2\xda\xaf\xb1\rs\xe6\x97\x1e\xcc6\x94\xff\x1b\x8e\x98\xf7\xa0', 0x67b) socket(0x1e, 0x3, 0x5ef) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f0000000340)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccW\x1c\x94t\x98\xc6\xd7\x9dh\xdf\x91\xd9\x1ew\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5,\xcc\xfa`\xfa\x90\xf0C\xdc\xbebBW\x8a\x95\xf4\x14\xc7\x90V\xe7a\xfb*\xcc6\xba\x9ef\x19R\xff\xd2\xd8\x98\xa8\x17\xcb\x84\xe8\xfb\x00`\xc2\xce~U\xca\\\xc1\xb7\xf1\n\xb9\xbfk\x1e\xdb\xed\x81{\x1f\x18j\x16\rk\x0eO\xe3\xa78&Z\x9e\xbf\x84\xd6\x1f\xe8\x88\x1f\xbc\x1eT\xa6{9hb\xbc\x1a\\\xb3\x846&\x1a\xbb\x9c:e\x9c\x18\x11\xf0\x8eQ\xd8\x8a3^?\x13\x00\xcbx\xb2\x18e\x95$\x9d\x804', 0x100000a3d9) setsockopt$auto(0xffffffffffffffff, 0x9, 0x69ce, &(0x7f0000000040)='(%}[\x00', 0x3) r3 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_TIPC_NL_LINK_GET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000051c0)={&(0x7f0000000440)={0x1c, r3, 0x301, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x8, 0x4, 0x0, 0x1, [@nested={0x4, 0x1}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000055}, 0x4) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000340)='/sys/devices/virtual/tty/ptyqe/power/control\x00', 0xa0b02, 0x0) r5 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/security/tomoyo/profile\x00', 0x48802, 0x0) read$auto(r5, 0x0, 0xb4d3) write$auto(0x3, 0x0, 0x70) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000) mmap$auto(0x0, 0x400004, 0xdf, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) 4.007531226s ago: executing program 2 (id=83): socket(0x2, 0x5, 0x0) socket(0x2, 0x801, 0x100) socket(0x25, 0x1, 0x0) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/block/parameters/events_dfl_poll_msecs\x00', 0x80002, 0x0) mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) inotify_init1$auto(0x3000000000000) socket$nl_generic(0x10, 0x3, 0x10) socket(0x25, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x15, 0x5, 0x0) openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/cgroup\x00', 0x100382, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x2, 0x0) inotify_init1$auto(0x3000000000000) socket(0xa, 0x2, 0x3a) r0 = io_uring_setup$auto(0x4, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0) socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) close_range$auto(0x2, r0, 0x0) open(0x0, 0x22240, 0x55) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$auto(0x3, 0x40106f52, r1) 3.966023433s ago: executing program 1 (id=84): socket(0x1d, 0x2, 0x7) socket(0xa, 0x5, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/drm/version\x00', 0x0, 0x0) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000840)='/dev/ttyS1\x00', 0x20000, 0x0) ioctl$auto_TIOCGDEV2(r0, 0x80045432, &(0x7f0000000880)=0x5) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snd/controlC2\x00', 0x400, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400004, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000640), r3) sendmsg$auto_NL80211_CMD_GET_WIPHY(r3, &(0x7f0000001180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000", @ANYRES16=r4, @ANYBLOB="810b25bd7080fbdbdf250100"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0xc004) recvmmsg$auto(r3, &(0x7f0000000180)={{0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x6}, 0x803}, 0x10a, 0x6, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r5 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0) ioctl$auto_PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x1, 0x8, 0xc00, 0x2c, 0x2c, 0x3, 0x2}) openat$auto_aoe_fops_aoechr(0xffffffffffffff9c, &(0x7f0000000040)='/dev/etherd/flush\x00', 0x1, 0x0) recvmmsg$auto(r2, &(0x7f0000000500)={{0x0, 0x4, 0x0, 0x5, 0x0, 0x2, 0x8}, 0xd1}, 0x10a, 0x8, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/virtual/misc/userfaultfd/power/control\x00', 0x668000, 0x0) socket(0x2, 0x1, 0x106) socket(0x2, 0x1, 0x0) shutdown$auto(0xffffffffffffffff, 0x2) mmap$auto(0xfffffffffffffffc, 0x8, 0x8, 0x7fffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffd) ioctl$auto_SOUND_MIXER_READ_DEVMASK2(0xffffffffffffffff, 0x80044dfe, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x3ff, 0x0) 3.794565926s ago: executing program 2 (id=85): mmap$auto(0x0, 0x2020007, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0) preadv$auto(0x40000000000003, &(0x7f0000000080)={0x0, 0xfffffffd}, 0x6, 0x8, 0x5) lseek$auto(0x3, 0x0, 0x1) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x20000800) r0 = socket(0x11, 0x3, 0x2) r1 = openat$auto_media_devnode_fops_mc_devnode(0xffffffffffffff9c, &(0x7f0000000040)='/dev/media1\x00', 0x22001, 0x0) write$auto_media_devnode_fops_mc_devnode(r1, 0x0, 0x0) ioctl$auto_IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) shmctl$auto(0x0, 0xd, 0x0) getrandom$auto(0x0, 0xe06, 0x3) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0xa901, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x101000, 0x0) connect$auto(r0, 0x0, 0xfffffff7) setreuid$auto(0x0, 0x0) shmat$auto(0x0, 0x0, 0xfffffffa) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) poll$auto(0x0, 0x7f, 0x0) ioctl$auto_VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$auto(0x3, 0x4008af03, 0x0) capset$auto(0x0, 0x0) ioctl$auto_VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, 0x0) shmat$auto(0x0, 0x0, 0xfffffffa) write$auto(0x3, 0x0, 0xfdef) munmap$auto(0x8000, 0xffffffff) munmap$auto(0x1, 0x7) 3.094267912s ago: executing program 2 (id=86): openat$auto_sw_sync_debugfs_fops_sync_debug(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2200, 0x0) ioctl$auto_FIDEDUPERANGE(r0, 0xc0189436, 0x7) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) sysfs$auto(0x2, 0x10, 0x0) r1 = fsopen$auto(0x0, 0x1) fsconfig$auto(r1, 0x8, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x300) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = openat$auto_generic(0xffffffffffffff9c, &(0x7f0000000040)='/proc/kmsg\x00', 0x80900, 0x0) remap_file_pages$auto(0x0, 0x4e49, 0x878, 0x3, 0x4) r4 = socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_WOL_SET(r4, 0x0, 0x40) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, 0x0, 0x6b27c3, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd3e, 0x5, 0x948b, 0x3, 0x95f4da08, 0xffffffffffffffff, 0x200000000000002, 0x62, 0x8000000000000000, 0x1, 0x6d3f, 0x40000000000009, 0x2, 0xfffffffffffffffe]}, 0x0) ioctl$auto_TUNGETFILTER(r3, 0x801054db, 0x0) ioctl$auto_RNDRESEEDCRNG2(0xffffffffffffffff, 0x5207, 0x0) write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x4, 0xd, 0x1, 0x948b, 0x3, 0x15f4da07, 0x3, 0xfffffffffffffff6, 0x0, 0x3f80, 0x79d, 0x338, 0x9, 0x2, 0xb]}, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000000100), r4) sendmsg$auto_SMC_NETLINK_GET_DEV_SMCR(r5, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r6, 0x8, 0x70bd2b, 0x25dfdbfe, {}, "83c9524fd8b1e3b0bf17fbbb15f205c384596ee05960b40696edb843c9d0c381e7b33b23467e350f0cfb66502879410ac530a8a2ca3ee3559d"}, 0x50}, 0x1, 0x0, 0x0, 0x44800}, 0x0) 2.83005558s ago: executing program 3 (id=87): r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/random/urandom_min_reseed_secs\x00', 0x80a02, 0x0) r1 = socket(0x18, 0x80000, 0x2) sendfile$auto(r1, r0, 0x0, 0x7ffff000) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/module/zswap/parameters/compressor\x00', 0x80002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x60742, 0x0) r4 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) sendfile$auto(r4, r3, 0x0, 0xa15) socket(0x2c, 0x8180b, 0x67) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000280)=""/233, 0xe9) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000001080)='/sys/module/i915/parameters/mitigations\x00', 0x88302, 0x0) sendfile$auto(r5, r5, 0x0, 0x7ffff000) bind$auto(r2, 0x0, 0x8) openat$auto_ocfs2_control_fops_stack_user(0xffffffffffffff9c, &(0x7f0000000040), 0x669400, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/pcm0p/oss\x00', 0xaa102, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv6/conf/batadv_slave_0/proxy_ndp\x00', 0x382, 0x0) mmap$auto(0x0, 0x4000b, 0x7, 0x9b72, 0x7, 0x28000) openat$auto_generic(0xffffffffffffff9c, &(0x7f0000000000)='/proc/kpagecount\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card1/pcm0c/info\x00', 0x20000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) inotify_init1$auto(0x3000000000000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) close_range$auto(0x2, 0xffffffffffffffff, 0x0) open(0x0, 0x22240, 0x55) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$auto(0x3, 0x80106f53, r6) 2.219580798s ago: executing program 2 (id=88): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) msgctl$auto_IPC_RMID(0x4, 0x0, &(0x7f0000000240)={{0x0, 0xffffffffffffffff, 0xee00, 0x9, 0x5, 0x8, 0x5}, &(0x7f00000001c0)=0x6, &(0x7f0000000200)=0x1, 0x1, 0xfff, 0x0, 0x7, 0x9, 0x4, 0x9, 0xf}) ioctl$auto_KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000002c0)={0x8, r1, 0x1, 0x33}) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x40}, 0x8) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x109401, 0x0) ioctl$auto(r2, 0x540a, 0x0) close_range$auto(0x2, 0x8, 0x0) msgrcv$auto(0x9, 0x0, 0xfffffffffffffffd, 0x6, 0x80008) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x2003f0, 0x15) mmap$auto(0x0, 0x2a, 0xdf, 0x9b72, 0x1000, 0x28000) madvise$auto(0x2, 0x5c61fa2c, 0xf) r3 = syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@OVS_FLOW_ATTR_PROBE={0x4}, @OVS_FLOW_ATTR_KEY={0x14, 0x1, 0x0, 0x1, [@nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x1d}]}, @typed={0x8, 0x14, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x800) r5 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r5, 0x0, 0xb4d3) write$auto(0x3, 0x0, 0xffd8) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, 0x0, 0x24000044) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0x8000000000000024, 0x8000) openat$auto_kmsg_fops_printk(0xffffffffffffff9c, 0x0, 0x40001, 0x0) select$auto(0x0, 0x0, 0x0, 0x0, 0x0) 1.38143393s ago: executing program 3 (id=89): socket(0x1f, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff) epoll_create$auto(0x4) move_mount$auto(0xffffffffffffffff, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0, 0x6) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x20080, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0) write$auto(0xffffffffffffffff, 0x0, 0xa3d9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) bpf$auto(0x3, 0x0, 0x6f2) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x200) listmount$auto(&(0x7f0000000040)={0x200, @inferred=r0, 0x7f, 0x81, 0x400}, &(0x7f0000000140)=0x10000, 0xf, 0x5) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/net/afs/rootcell\x00', 0x1cb842, 0x0) write$auto(r1, &(0x7f0000000300)='*o\xd3\xa49\xaf\xa9\xe4\xe17\x12\xb3Z\x17I\x82\xdc\xbeiw\xc1\xd1\x8d\x9b\r\x9aR\xe7\x9f\xd8\xab\x16`f\nT\xaa\xfap \xe6\xdaV\xdeD\x8dR5\xd2\xe58\n\xff\x19+\xeb\xb3+\xf6\xc6\a\x00\x00\x00\xf1A\xa5\x95\x1fk\x1f\xff\x99gP\x9e\x88\x97]\x93\xf4\xdd<\xe7p\x0e\xd4C\xdc\x84\v\xafz\xfd\x81\xa3\xb2\xbb\xa4\xd9\xf2P\xa8\xe9\x8f\x13\xa7\x98\x85\xf8\v\aB\xfc\xfa\x14E\xb8y\x884<\xa7\xffyb\x8a\b\xbb\x1b\x13W\xe3\xf7\xd8\x83\xc9\xd7\x8c', 0x6) syz_genetlink_get_family_id$auto_nlctrl(0x0, 0xffffffffffffffff) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, 0x0, 0x0) mmap$auto(0x0, 0x4, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/nfs/parameters/nfs_idmap_cache_timeout\x00', 0xc2902, 0x0) read$auto(r2, 0x0, 0x20) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/cpu.weight\x00', 0x128082, 0x0) write$auto(r3, 0x0, 0x4) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) 1.308951636s ago: executing program 2 (id=90): io_uring_setup$auto(0x6, 0x0) r0 = openat$auto__ctl_fops_dm_ioctl(0xffffffffffffff9c, &(0x7f0000000180), 0x1541, 0x0) ioctl$auto__ctl_fops_dm_ioctl(r0, 0xfffffffffffffd0e, &(0x7f00000001c0)) bind$auto(0xffffffffffffffff, &(0x7f0000000140)=@phonet={0x23, 0x6, 0x0, 0xa3}, 0x80) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0xaa102, 0x0) ioperm$auto(0x7, 0x800, 0x0) openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, 0x0, 0xc0000, 0x0) socket(0x2, 0x1, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) select$auto(0x7, 0x0, 0x0, 0x0, 0x0) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) select$auto(0x0, 0x0, 0x0, 0x0, 0x0) mmap$auto(0xc, 0x20009, 0x5, 0x14, 0xffffffffffffffff, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x200007, 0x19) openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, 0x0, 0x50b41, 0x0) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000440)='/sys/devices/virtual/misc/cpu_dma_latency/power/runtime_active_time\x00', 0x200, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000) madvise$auto(0x0, 0x2003f0, 0x18) close_range$auto(0x0, 0xfffffffffffff000, 0x0) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0xa, 0xb8, 0x10, 0x4, 0x4, 0xffffffffffffffff, 0xa, "2af051b26b658a20d8dc6b36c83ce63f", 0x0, 0xffffffffffffffff, 0x5, 0x7, 0x7, 0x6}, 0xf) bpf$auto(0x1a, &(0x7f0000000380)=@link_create={@map_fd, @target_ifindex=r2, 0x3, 0x81, @uprobe_multi={0x81, 0x1ff, 0x3d7e, 0x0, 0x1, 0x4}}, 0x92) socket(0x23, 0x5, 0x0) 619.291133ms ago: executing program 0 (id=91): ioctl$auto_PPPIOCSMRU(0xffffffffffffffff, 0xc004743e, 0x0) ioperm$auto(0x7, 0x5ad2, 0x8) ioctl$auto_USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) read$auto(r0, &(0x7f00000001c0)='\t]^)\\\'-.-\x00', 0x3) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bus/usb/008/001\x00', 0x248880, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd2, 0x400000000000948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80100001, 0x3, 0x1, 0x4, 0x1, 0xfffffffffffffffe]}, 0x0) write$auto(r0, &(0x7f0000000540)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100080a3d9) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r1 = userfaultfd$auto(0x1) statx$auto(r1, 0x0, 0x1000, 0x8, 0x0) sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000440)={{0x0, 0x80000000, &(0x7f0000000300)={0x0, 0x7}, 0x3, &(0x7f0000000340)="f92c0bd05bc4110f9c8e988f1e573eadfc4b262ba12d02ee44d5f5f0f66f9c6b7c1232f72b43c14d0d4f76e6cf0a7c5bf86b6ebce5c46e72796de5369764b7f3f5ff08cf0887799011735092a327f8b941b68ddc454b0d04eeaf6fa246b4181a1ee99c9e2e9e2ae2f26fa8f7ba2b8ab19c0ebf606b5f5c2c87c523047cebc715f086e265c5cf8b06701082312e821f0585d2a0a71a1c319bba53590751995b81111c02ad81dddfbdfbe9c5d4274832e15fca038e591e354669d457d1e624ad945f3ffaa8b6094d", 0x4000100000000, 0x80}, 0x2}, 0x0, 0x6) keyctl$auto(0x4, 0xffffffffffffffff, 0x5, 0x800, 0xa) write$auto(0x3, 0x0, 0xffd8) unshare$auto(0x40000080) utimes$auto(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x100000000, 0xc000000000000}) bpf$auto(0x100000, 0x0, 0x6f2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) bpf$auto(0x4, 0x0, 0xc) bpf$auto_BPF_ENABLE_STATS(0x20, &(0x7f0000000480)=@token_create={0x1, r0}, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/pci0000:00/0000:00:04.0/resource0\x00', 0xc0082, 0x0) socket(0x2, 0x801, 0x100) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000001140)='/sys/devices/virtual/block/zram0/comp_algorithm\x00', 0x20b42, 0x0) sendfile$auto(r2, 0x3, 0x0, 0x7) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x8e40, 0x0) 151.458924ms ago: executing program 3 (id=92): madvise$auto(0x0, 0x2000040080000003, 0xe) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000100), r1) sendmsg$auto_ETHTOOL_MSG_PSE_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x2c, r2, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_PSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x400c0c4) write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000) getsockopt$auto_SO_RCVPRIORITY(0xffffffffffffffff, 0x2, 0x52, 0x0, &(0x7f0000000240)=0x7) openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, 0x0, 0x121900, 0x0) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r3, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) syz_clone(0x4040400, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/module/nfs/parameters/nfs_mountpoint_expiry_timeout\x00', 0xa001, 0x0) write$auto(r4, &(0x7f0000000080)='0\x00\\\xa0\xe2\xff\xaa8nr\xec\x13Dy\xe9\xd2-\xec\xb7F\x92\x05\x1e\xfa\x1c\x80\xc2);\x11\xfemdV\x9cc\x8e\x88A\xb7(\xcc\x04\xff;k\xa5\x1b=yYp4-\x89\x189\xba<\x83\xee\xc4&-\x81\xa8\x98\xaf\xaac\x06g\x84\x9e\x9f\x00\x00\x00\x00\xfed\xfdvT,', 0x81) mmap$auto(0x0, 0x8, 0xdf, 0x13, 0x2, 0x1008000) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$auto(0xffffffffffffffff, 0x11c, 0x2, 0x0, 0x0) pread64$auto(0xffffffffffffffff, &(0x7f0000000040)='\x00\x00\x00\x88\xde\x90\a\'\x9bM\xa0\x848\xbbz(\xe9\x05<\x82\xfe\xe2\xf6 \x0f8\xfb\xa7\xb4\xa0\x9e\xcb\xec\x9e{o2?\x0f\x11\x90^\xdf/\x84\x99!*\xe3\x99}x\xd4\xa5D\xfa\xe5\xf9od^\xa6', 0x7ff, 0x5) r6 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/fib_triestat\x00', 0x0, 0x0) pread64$auto(r6, &(0x7f0000000040)='veth1\x00', 0x200000000006, 0x8) msgctl$auto_IPC_INFO(0xaf86, 0x3, &(0x7f00000003c0)={{0x1, 0xffffffffffffffff, 0x0, 0x6, 0x8, 0xfffffff7, 0xc2}, &(0x7f0000000340)=0x5, &(0x7f0000000380)=0xff, 0x4, 0x4, 0x3, 0x7, 0x4, 0x7f, 0x7fff, 0xfff, @inferred=r5, @inferred=r5}) r7 = openat$auto_aoe_fops_aoechr(0xffffffffffffff9c, &(0x7f0000000040)='/dev/etherd/flush\x00', 0x1, 0x0) r8 = socket(0x2, 0x1, 0x0) ioctl$auto_KVM_GET_DEVICE_ATTR(r8, 0x4018aee2, &(0x7f0000000480)={0x80000000, 0xee00, 0x5, 0xd032}) r10 = setfsgid$auto(r9) fchown$auto(r7, 0xee00, r10) fsconfig$auto(0xffffffffffffffff, 0x6, &(0x7f0000000080)=',\xd6{/@){--\xd4\x00', 0x0, r10) 91.464305ms ago: executing program 1 (id=93): r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv6/neigh/ipvlan1/retrans_time\x00', 0x242, 0x0) sendfile$auto(r0, r0, 0x0, 0x200) openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/clients\x00', 0x280, 0x0) socket(0xf, 0x3, 0x2) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket(0x2, 0x2, 0x0) socket(0x1a, 0x5, 0xfffffffd) bind$auto(0xffffffffffffffff, 0x0, 0x67) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd3e, 0x1, 0x948b, 0x3, 0x95f4da0a, 0xffffffffffffffff, 0x3, 0x62, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan1\x00'}) sendmsg$auto_NL80211_CMD_DEL_PMK(0xffffffffffffffff, 0x0, 0x8000) socket(0xa, 0x5, 0x8) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) ioctl$auto_SOUND_MIXER_READ_DEVMASK2(0xffffffffffffffff, 0x80044dfe, &(0x7f0000000040)) unshare$auto(0x200) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') madvise$auto(0x0, 0x7fffffffffffffff, 0xa) setns(r2, 0x0) syz_clone(0x16221400, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000001080)='/dev/v4l-touch5\x00', 0x2040, 0x0) read$auto_v4l2_fops_v4l2_dev(r3, &(0x7f00000010c0)=""/22, 0x16) 0s ago: executing program 2 (id=94): mmap$auto(0x1, 0x20009, 0x8, 0xeb1, 0x7f, 0x8000) mmap$auto(0x1, 0x4, 0x7ff, 0x8000012, 0xffffffffffffffff, 0x4006) openat$auto_tun_fops_tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x110) io_uring_setup$auto(0x1, 0x0) unshare$auto(0x40000080) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x20342, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000200)='/dev/tty53\x00', 0x200, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snd/midiC2D0\x00', 0x109302, 0x0) pivot_root$auto(&(0x7f0000000080)='..\x00', 0x0) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000001280)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x2, 0x0) write$auto_tomoyo_operations_securityfs_if(r1, &(0x7f00000012c0)="0a1b9a3c3e3efd6ea3d31791840bd7886d8ea582574c58e9865c33d76e1cadd6a7b7b426b7fcdc8e357080d70b5ab848770dc8f745d1c76eedaa12b9db050000000000000030aeb5dfce3531f694dabdbc08f62cb37e5bc82e660cfd70f603b20416c7bf0e95345b899b4466bf6a70b1274b19782b41ac172a25e65be53e69c6369b67a4cbd6383a0d767d84516183587530a17dbfd83a7678c6dad9917b91c7c9de3d61af452f90cf22400c4bcbb841f7d7641b3bccd058f9f2bad31f2ce81e389e210b34f43b4a5af377a6d4353989b4e9d49b2537b0a63a5cf6ae230d1296ef8b30c6bcdf7a6edf5c3258be46ae9d15fc0417e6070000007b9a8b05b4ad586c7b72db5ae55e9d149330720a", 0x10d) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r2 = socket(0x2b, 0x1, 0x1) setsockopt$auto(r2, 0x0, 0x1, 0x0, 0x1e) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, &(0x7f0000000140)={[0x1ff, 0x7, 0xc45d, 0x80, 0x6, 0x3, 0x2, 0x3, 0x3, 0x62, 0x80000022, 0x7, 0x6d3e, 0x2000000004000009, 0x2, 0x6]}, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r3 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0xa901, 0x0) ioctl$auto(r3, 0x5523, r3) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) futex$auto(0x0, 0x89, 0x808, 0x0, 0x0, 0xfffffffa) r4 = openat$auto_aoe_fops_aoechr(0xffffffffffffff9c, &(0x7f0000000000)='/dev/etherd/discover\x00', 0x80101, 0x0) writev$auto(r4, &(0x7f0000000140)={0x0, 0xe4}, 0x4) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram11\x00', 0x2c2200, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. [ 81.671479][ T5853] cgroup: Unknown subsys name 'net' [ 81.801748][ T5853] cgroup: Unknown subsys name 'cpuset' [ 81.811089][ T5853] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.297822][ T5853] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.290587][ T5865] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.308747][ T5865] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.331237][ T5865] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.341392][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.349306][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.356930][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.366016][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.374297][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.382957][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.391421][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.466563][ T5865] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.477126][ T5865] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.479745][ T5186] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.486256][ T5865] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.492655][ T5186] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.499924][ T5865] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.507103][ T5186] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.521891][ T5186] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.528310][ T5865] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.537858][ T5865] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.061568][ T5867] chnl_net:caif_netlink_parms(): no params data found [ 86.123978][ T5862] chnl_net:caif_netlink_parms(): no params data found [ 86.214395][ T5874] chnl_net:caif_netlink_parms(): no params data found [ 86.342084][ T5872] chnl_net:caif_netlink_parms(): no params data found [ 86.374417][ T5862] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.381792][ T5862] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.389879][ T5862] bridge_slave_0: entered allmulticast mode [ 86.397176][ T5862] bridge_slave_0: entered promiscuous mode [ 86.452144][ T5862] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.460164][ T5862] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.468202][ T5862] bridge_slave_1: entered allmulticast mode [ 86.475410][ T5862] bridge_slave_1: entered promiscuous mode [ 86.482760][ T5867] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.490239][ T5867] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.498344][ T5867] bridge_slave_0: entered allmulticast mode [ 86.505816][ T5867] bridge_slave_0: entered promiscuous mode [ 86.532409][ T5874] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.540300][ T5874] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.547561][ T5874] bridge_slave_0: entered allmulticast mode [ 86.554582][ T5874] bridge_slave_0: entered promiscuous mode [ 86.573855][ T5867] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.581382][ T5867] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.589285][ T5867] bridge_slave_1: entered allmulticast mode [ 86.596393][ T5867] bridge_slave_1: entered promiscuous mode [ 86.624738][ T5874] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.632992][ T5874] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.640796][ T5874] bridge_slave_1: entered allmulticast mode [ 86.648640][ T5874] bridge_slave_1: entered promiscuous mode [ 86.701295][ T5862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.714259][ T5867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.727980][ T5867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.757062][ T5862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.808202][ T5874] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.842568][ T5872] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.850021][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.857163][ T5872] bridge_slave_0: entered allmulticast mode [ 86.866218][ T5872] bridge_slave_0: entered promiscuous mode [ 86.876796][ T5874] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.911218][ T5867] team0: Port device team_slave_0 added [ 86.920086][ T5862] team0: Port device team_slave_0 added [ 86.926442][ T5872] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.934042][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.941459][ T5872] bridge_slave_1: entered allmulticast mode [ 86.949647][ T5872] bridge_slave_1: entered promiscuous mode [ 87.003319][ T5874] team0: Port device team_slave_0 added [ 87.016733][ T5867] team0: Port device team_slave_1 added [ 87.044767][ T5862] team0: Port device team_slave_1 added [ 87.084544][ T5874] team0: Port device team_slave_1 added [ 87.151495][ T5872] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.186037][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.194743][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.221097][ T5867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.252678][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.259857][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.286650][ T5862] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.301219][ T5872] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.324659][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.331826][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.358310][ T5874] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.370162][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.377143][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.404516][ T5867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.416650][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.424373][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.451472][ T5862] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.451486][ T51] Bluetooth: hci0: command tx timeout [ 87.468602][ T5865] Bluetooth: hci1: command tx timeout [ 87.485450][ T5874] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.492591][ T5874] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.520242][ T5874] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.544348][ T5872] team0: Port device team_slave_0 added [ 87.582159][ T5872] team0: Port device team_slave_1 added [ 87.588457][ T51] Bluetooth: hci3: command tx timeout [ 87.598010][ T51] Bluetooth: hci2: command tx timeout [ 87.648957][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.656020][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.683773][ T5872] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.700998][ T5867] hsr_slave_0: entered promiscuous mode [ 87.709139][ T5867] hsr_slave_1: entered promiscuous mode [ 87.720227][ T5862] hsr_slave_0: entered promiscuous mode [ 87.726525][ T5862] hsr_slave_1: entered promiscuous mode [ 87.733343][ T5862] debugfs: 'hsr0' already exists in 'hsr' [ 87.739287][ T5862] Cannot create hsr debugfs directory [ 87.758227][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.765305][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.792151][ T5872] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.865435][ T5874] hsr_slave_0: entered promiscuous mode [ 87.872297][ T5874] hsr_slave_1: entered promiscuous mode [ 87.880057][ T5874] debugfs: 'hsr0' already exists in 'hsr' [ 87.886025][ T5874] Cannot create hsr debugfs directory [ 88.016143][ T5872] hsr_slave_0: entered promiscuous mode [ 88.022665][ T5872] hsr_slave_1: entered promiscuous mode [ 88.029528][ T5872] debugfs: 'hsr0' already exists in 'hsr' [ 88.035452][ T5872] Cannot create hsr debugfs directory [ 88.402288][ T5867] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.431270][ T5867] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.443232][ T5867] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.464181][ T5867] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.524087][ T5874] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.534758][ T5874] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.548392][ T5874] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.561390][ T5874] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.670606][ T5862] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.705016][ T5862] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.716889][ T5862] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.731111][ T5862] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.828248][ T5872] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.851789][ T5872] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.870331][ T5867] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.883820][ T5872] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.895920][ T5872] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.977995][ T5867] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.024825][ T3501] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.032416][ T3501] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.054053][ T5874] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.068450][ T3501] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.076317][ T3501] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.148711][ T5862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.170739][ T5874] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.191698][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.199013][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.213467][ T79] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.220845][ T79] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.298374][ T5862] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.329735][ T3479] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.336994][ T3479] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.382996][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.390380][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.505442][ T5872] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.515428][ T51] Bluetooth: hci0: command tx timeout [ 89.521795][ T51] Bluetooth: hci1: command tx timeout [ 89.552731][ T5862] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 89.564638][ T5862] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.653349][ T5872] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.669302][ T5865] Bluetooth: hci2: command tx timeout [ 89.675017][ T5865] Bluetooth: hci3: command tx timeout [ 89.707637][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.714853][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.769715][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.777066][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.832779][ T5867] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.957380][ T5874] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.023559][ T5867] veth0_vlan: entered promiscuous mode [ 90.052161][ T5862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.092665][ T5867] veth1_vlan: entered promiscuous mode [ 90.186863][ T5874] veth0_vlan: entered promiscuous mode [ 90.213037][ T5867] veth0_macvtap: entered promiscuous mode [ 90.225268][ T5862] veth0_vlan: entered promiscuous mode [ 90.246014][ T5874] veth1_vlan: entered promiscuous mode [ 90.256793][ T5867] veth1_macvtap: entered promiscuous mode [ 90.304068][ T5862] veth1_vlan: entered promiscuous mode [ 90.326868][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.362983][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.402091][ T1146] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.411883][ T1146] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.422108][ T5874] veth0_macvtap: entered promiscuous mode [ 90.434843][ T5874] veth1_macvtap: entered promiscuous mode [ 90.449565][ T5872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.456783][ T1146] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.466849][ T1146] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.510303][ T5862] veth0_macvtap: entered promiscuous mode [ 90.556351][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.575680][ T5862] veth1_macvtap: entered promiscuous mode [ 90.593311][ T5874] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.657283][ T1146] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.678793][ T1146] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.689857][ T1146] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.705989][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.718164][ T3501] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.720608][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.726196][ T3501] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.750489][ T1146] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.829111][ T1146] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.838919][ T1146] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.856366][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.868874][ T1146] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.878263][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.881394][ T1146] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.916004][ T5872] veth0_vlan: entered promiscuous mode [ 90.962408][ T5872] veth1_vlan: entered promiscuous mode [ 91.006925][ T5867] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.043303][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.082158][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.113993][ T5872] veth0_macvtap: entered promiscuous mode [ 91.162370][ T5872] veth1_macvtap: entered promiscuous mode [ 91.172744][ T3479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.203251][ T3479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.210420][ T5955] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 91.242285][ T5955] FAULT_INJECTION: forcing a failure. [ 91.242285][ T5955] name failslab, interval 1, probability 0, space 0, times 1 [ 91.256397][ T5955] CPU: 0 UID: 0 PID: 5955 Comm: syz.3.4 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 91.256436][ T5955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 91.256455][ T5955] Call Trace: [ 91.256464][ T5955] [ 91.256475][ T5955] dump_stack_lvl+0x16c/0x1f0 [ 91.256525][ T5955] should_fail_ex+0x512/0x640 [ 91.256564][ T5955] ? fs_reclaim_acquire+0xae/0x150 [ 91.256615][ T5955] should_failslab+0xc2/0x120 [ 91.256651][ T5955] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 91.256684][ T5955] ? security_inode_alloc+0x3b/0x2b0 [ 91.256716][ T5955] security_inode_alloc+0x3b/0x2b0 [ 91.256743][ T5955] inode_init_always_gfp+0xce4/0x1030 [ 91.256779][ T5955] alloc_inode+0x86/0x240 [ 91.256814][ T5955] new_inode+0x22/0x1c0 [ 91.256853][ T5955] __debugfs_create_file+0x11c/0x6b0 [ 91.256886][ T5955] debugfs_create_file_full+0x41/0x60 [ 91.256917][ T5955] kvm_dev_ioctl+0x153f/0x1af0 [ 91.256957][ T5955] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 91.256997][ T5955] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 91.257027][ T5955] __x64_sys_ioctl+0x18e/0x210 [ 91.257070][ T5955] do_syscall_64+0xcd/0x490 [ 91.257097][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.257124][ T5955] RIP: 0033:0x7f451038eb69 [ 91.257150][ T5955] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 91.257175][ T5955] RSP: 002b:00007f45112af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 91.257201][ T5955] RAX: ffffffffffffffda RBX: 00007f45105b5fa0 RCX: 00007f451038eb69 [ 91.257219][ T5955] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000002 [ 91.257236][ T5955] RBP: 00007f4510411df1 R08: 0000000000000000 R09: 0000000000000000 [ 91.257252][ T5955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.257269][ T5955] R13: 0000000000000000 R14: 00007f45105b5fa0 R15: 00007fffa2dc1f58 [ 91.257306][ T5955] [ 91.257343][ T5955] debugfs: out of free dentries, can not create file 'remote_tlb_flush' [ 91.259159][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.479359][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.492932][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.493943][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.534360][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.554479][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.572424][ T3501] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.590706][ T51] Bluetooth: hci0: command tx timeout [ 91.600574][ T5865] Bluetooth: hci1: command tx timeout [ 91.633506][ T3501] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.649797][ T3501] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.673334][ T3501] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.749350][ T5865] Bluetooth: hci3: command tx timeout [ 91.755104][ T51] Bluetooth: hci2: command tx timeout [ 92.038858][ T1146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.054741][ T1146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.079191][ T981] cfg80211: failed to load regulatory.db [ 92.097974][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.122976][ T3479] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.156987][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 92.166252][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.206897][ T3479] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.258248][ T30] audit: type=1800 audit(1754319947.281:2): pid=5970 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5" name="features" dev="configfs" ino=7379 res=0 errno=0 [ 92.279483][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.447937][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.941193][ T5969] random: crng reseeded on system resumption [ 93.279281][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 93.682896][ T5975] hub 8-0:1.0: USB hub found [ 93.690038][ T5865] Bluetooth: hci1: command tx timeout [ 93.690048][ T51] Bluetooth: hci0: command tx timeout [ 93.722831][ T5975] hub 8-0:1.0: 1 port detected [ 93.829371][ T5865] Bluetooth: hci3: command tx timeout [ 93.835058][ T5865] Bluetooth: hci2: command tx timeout [ 94.068716][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 94.216815][ T5986] can: request_module (can-proto-0) failed. [ 94.296875][ T5984] netlink: Unknown conntrack attr (0) [ 94.307499][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 94.497841][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.507940][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.048131][ T5998] process 'syz.1.8' launched ':,' with NULL argv: empty string added [ 97.341629][ T6027] input: jJǸ;9%vlQ J86 as /devices/virtual/input/input5 [ 97.483063][ T5909] Process accounting resumed [ 97.552593][ T6034] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 100.114720][ T6068] input: jJǸ-9%vJ86 as /devices/virtual/input/input6 [ 101.914656][ T6083] [U] [ 101.917846][ T6083] [U] [ 101.920573][ T6083] [U] [ 101.923468][ T6083] [U] [ 101.964270][ T6083] [U] [ 101.967317][ T6083] [U] [ 101.970040][ T6083] [U] [ 101.972780][ T6083] [U] [ 101.976366][ T6083] [U] [ 101.979095][ T6083] [U] [ 101.981846][ T6083] [U] [ 101.984572][ T6083] [U] [ 101.988758][ T6083] [U] [ 101.991510][ T6083] [U] [ 101.994232][ T6083] [U] [ 101.997139][ T6083] [U] [ 102.002934][ T6083] [U] [ 102.004575][ T6081] hub 1-0:1.0: USB hub found [ 102.005787][ T6083] [U] [ 102.013070][ T6083] [U] [ 102.015782][ T6083] [U] [ 102.019974][ T6083] [U] [ 102.022718][ T6083] [U] [ 102.025651][ T6083] [U] [ 102.028399][ T6083] [U] [ 102.031993][ T6083] [U] [ 102.034801][ T6083] [U] [ 102.037595][ T6083] [U] [ 102.040325][ T6083] [U] [ 102.045838][ T6083] [U] [ 102.048618][ T6083] [U] [ 102.051335][ T6083] [U] [ 102.054087][ T6083] [U] [ 102.064307][ T6083] [U] [ 102.067045][ T6083] [U] [ 102.069727][ T6083] [U] [ 102.072505][ T6083] [U] [ 102.083559][ T6083] [U] [ 102.086367][ T6083] [U] [ 102.089135][ T6083] [U] [ 102.091857][ T6083] [U] [ 102.093097][ T6081] hub 1-0:1.0: 1 port detected [ 102.097538][ T6083] [U] [ 102.101989][ T6083] [U] [ 102.104690][ T6083] [U] [ 102.107396][ T6083] [U] [ 102.121178][ T6083] [U] [ 102.124074][ T6083] [U] [ 102.126809][ T6083] [U] [ 102.129542][ T6083] [U] [ 102.133282][ T6083] [U] [ 102.136125][ T6083] [U] [ 102.139029][ T6083] [U] [ 102.141932][ T6083] [U] [ 102.146730][ T6083] [U] [ 102.149475][ T6083] [U] [ 102.152198][ T6083] [U] [ 102.154926][ T6083] [U] [ 102.197752][ T6083] [U] [ 102.200696][ T6083] [U] [ 102.203587][ T6083] [U] [ 102.206490][ T6083] [U] [ 102.219169][ T6083] [U] [ 102.222123][ T6083] [U] [ 102.224825][ T6083] [U] [ 102.227524][ T6083] [U] [ 102.231247][ T6083] [U] [ 102.234285][ T6083] [U] [ 102.236995][ T6083] [U] [ 102.239690][ T6083] [U] [ 102.242726][ T6083] [U] [ 102.245617][ T6083] [U] [ 102.248315][ T6083] [U] [ 102.251009][ T6083] [U] [ 102.254151][ T6083] [U] [ 102.256847][ T6083] [U] [ 102.259539][ T6083] [U] [ 102.262221][ T6083] [U] [ 102.265149][ T6083] [U] [ 102.267844][ T6083] [U] [ 102.270527][ T6083] [U] [ 102.273297][ T6083] [U] [ 102.276225][ T6083] [U] [ 102.278907][ T6083] [U] [ 102.281579][ T6083] [U] [ 102.284253][ T6083] [U] [ 102.287165][ T6083] [U] [ 102.289937][ T6083] [U] [ 102.292637][ T6083] [U] [ 102.295421][ T6083] [U] [ 102.298743][ T6083] [U] [ 102.301957][ T6083] [U] [ 102.304642][ T6083] [U] [ 102.307320][ T6083] [U] [ 102.312617][ T6083] [U] [ 102.315328][ T6083] [U] [ 102.318165][ T6083] [U] [ 102.320850][ T6083] [U] [ 102.325767][ T6083] [U] [ 102.328508][ T6083] [U] [ 102.331224][ T6083] [U] [ 102.333916][ T6083] [U] [ 102.336821][ T6083] [U] [ 102.339544][ T6083] [U] [ 102.342325][ T6083] [U] [ 102.345009][ T6083] [U] [ 102.348048][ T6083] [U] [ 102.350743][ T6083] [U] [ 102.353529][ T6083] [U] [ 102.356314][ T6083] [U] [ 102.359378][ T6083] [U] [ 102.362078][ T6083] [U] [ 102.364788][ T6083] [U] [ 102.367483][ T6083] [U] [ 102.370395][ T6083] [U] [ 102.373086][ T6083] [U] [ 102.375883][ T6083] [U] [ 102.378572][ T6083] [U] [ 102.381492][ T6083] [U] [ 102.384233][ T6083] [U] [ 102.386921][ T6083] [U] [ 102.389688][ T6083] [U] [ 102.392886][ T6083] [U] [ 102.395600][ T6083] [U] [ 102.398290][ T6083] [U] [ 102.400996][ T6083] [U] [ 102.404268][ T6083] [U] [ 102.406962][ T6083] [U] [ 102.409744][ T6083] [U] [ 102.412443][ T6083] [U] [ 102.415149][ T6083] [U] [ 102.418224][ T6083] [U] [ 102.420921][ T6083] [U] [ 102.423734][ T6083] [U] [ 102.426455][ T6083] [U] [ 102.429477][ T6083] [U] [ 102.432181][ T6083] [U] [ 102.434959][ T6083] [U] [ 102.437635][ T6083] [U] [ 102.440620][ T6083] [U] [ 102.443403][ T6083] [U] [ 102.446328][ T6083] [U] [ 102.449101][ T6083] [U] [ 102.452112][ T6083] [U] [ 102.454865][ T6083] [U] [ 102.457552][ T6083] [U] [ 102.460342][ T6083] [U] [ 102.463371][ T6083] [U] [ 102.466060][ T6083] [U] [ 102.468757][ T6083] [U] [ 102.471436][ T6083] [U] [ 102.474495][ T6083] [U] [ 102.477196][ T6083] [U] [ 102.479970][ T6083] [U] [ 102.482692][ T6083] [U] [ 102.485593][ T6083] [U] [ 102.488272][ T6083] [U] [ 102.490946][ T6083] [U] [ 102.493617][ T6083] [U] [ 102.496483][ T6083] [U] [ 102.499287][ T6083] [U] [ 102.502075][ T6083] [U] [ 102.504968][ T6083] [U] [ 102.508264][ T6083] [U] [ 102.511139][ T6083] [U] [ 102.513822][ T6083] [U] [ 102.516528][ T6083] [U] [ 102.519506][ T6083] [U] [ 102.522280][ T6083] [U] [ 102.525043][ T6083] [U] [ 102.527719][ T6083] [U] [ 102.530762][ T6083] [U] [ 102.533538][ T6083] [U] [ 102.536246][ T6083] [U] [ 102.538929][ T6083] [U] [ 102.542016][ T6083] [U] [ 102.544714][ T6083] [U] [ 102.547438][ T6083] [U] [ 102.550219][ T6083] [U] [ 102.553153][ T6083] [U] [ 102.555875][ T6083] [U] [ 102.558578][ T6083] [U] [ 102.561321][ T6083] [U] [ 102.564478][ T6083] [U] [ 102.567286][ T6083] [U] [ 102.570006][ T6083] [U] [ 102.572732][ T6083] [U] [ 102.576980][ T6083] [U] [ 102.579810][ T6083] [U] [ 102.582520][ T6083] [U] [ 102.585193][ T6083] [U] [ 102.588206][ T6083] [U] [ 102.591093][ T6083] [U] [ 102.593849][ T6083] [U] [ 102.596560][ T6083] [U] [ 102.607898][ T6083] [U] [ 102.610662][ T6083] [U] [ 102.613544][ T6083] [U] [ 102.616272][ T6083] [U] [ 102.619393][ T6083] [U] [ 102.622129][ T6083] [U] [ 102.624984][ T6083] [U] [ 102.627709][ T6083] [U] [ 102.630948][ T6083] [U] [ 102.633661][ T6083] [U] [ 102.636370][ T6083] [U] [ 102.639156][ T6083] [U] [ 102.642219][ T6083] [U] [ 102.644942][ T6083] [U] [ 102.647715][ T6083] [U] [ 102.650417][ T6083] [U] [ 102.653448][ T6083] [U] [ 102.656165][ T6083] [U] [ 102.658879][ T6083] [U] [ 102.661594][ T6083] [U] [ 102.664672][ T6083] [U] [ 102.667395][ T6083] [U] [ 102.670106][ T6083] [U] [ 102.672924][ T6083] [U] [ 102.677853][ T6083] [U] [ 102.680600][ T6083] [U] [ 102.683420][ T6083] [U] [ 102.686227][ T6083] [U] [ 102.689723][ T6083] [U] [ 102.692534][ T6083] [U] [ 102.695245][ T6083] [U] [ 102.697965][ T6083] [U] [ 102.701059][ T6083] [U] [ 102.703871][ T6083] [U] [ 102.706591][ T6083] [U] [ 102.709318][ T6083] [U] [ 102.713567][ T6083] [U] [ 102.716295][ T6083] [U] [ 102.719068][ T6083] [U] [ 102.721923][ T6083] [U] [ 102.725271][ T6083] [U] [ 102.728006][ T6083] [U] [ 102.730823][ T6083] [U] [ 102.733562][ T6083] [U] [ 102.737814][ T6083] [U] [ 102.740645][ T6083] [U] [ 102.743379][ T6083] [U] [ 102.746347][ T6083] [U] [ 102.749987][ T6083] [U] [ 102.752772][ T6083] [U] [ 102.755845][ T6083] [U] [ 102.758565][ T6083] [U] [ 102.762104][ T6083] [U] [ 102.764888][ T6083] [U] [ 102.767654][ T6083] [U] [ 102.770371][ T6083] [U] [ 102.774198][ T6083] [U] [ 102.776946][ T6083] [U] [ 102.779752][ T6083] [U] [ 102.782464][ T6083] [U] [ 102.807710][ T6083] [U] [ 104.183380][ T6107] zram: Added device: zram1 [ 104.213253][ T6107] Zero length message leads to an empty skb [ 105.047176][ T6118] GUP no longer grows the stack in syz.2.29 (6118): 5000-401000 (4000) [ 105.056140][ T6118] CPU: 1 UID: 0 PID: 6118 Comm: syz.2.29 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 105.056168][ T6118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 105.056178][ T6118] Call Trace: [ 105.056185][ T6118] [ 105.056191][ T6118] dump_stack_lvl+0x16c/0x1f0 [ 105.056218][ T6118] gup_vma_lookup+0x1d2/0x220 [ 105.056241][ T6118] __get_user_pages+0x243/0x34a0 [ 105.056267][ T6118] ? down_read_killable+0x220/0x4b0 [ 105.056282][ T6118] ? __lock_acquire+0x62e/0x1ce0 [ 105.056303][ T6118] ? __pfx___get_user_pages+0x10/0x10 [ 105.056324][ T6118] ? __lock_acquire+0x62e/0x1ce0 [ 105.056344][ T6118] __gup_longterm_locked+0xa92/0x17e0 [ 105.056368][ T6118] ? try_get_folio+0x1d2/0x730 [ 105.056386][ T6118] ? __pfx___gup_longterm_locked+0x10/0x10 [ 105.056407][ T6118] ? try_get_folio+0x255/0x730 [ 105.056424][ T6118] ? find_held_lock+0x2b/0x80 [ 105.056437][ T6118] ? sanity_check_pinned_pages+0x58a/0x11d0 [ 105.056460][ T6118] gup_fast_fallback+0xf78/0x23f0 [ 105.056492][ T6118] ? blkdev_write_iter+0x703/0xe00 [ 105.056512][ T6118] ? __pfx_gup_fast_fallback+0x10/0x10 [ 105.056530][ T6118] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.056553][ T6118] pin_user_pages_fast+0xa7/0xf0 [ 105.056573][ T6118] ? __pfx_pin_user_pages_fast+0x10/0x10 [ 105.056598][ T6118] iov_iter_extract_pages+0x3a2/0x1ed0 [ 105.056690][ T6118] ? __pfx_iov_iter_extract_pages+0x10/0x10 [ 105.056711][ T6118] ? find_held_lock+0x2b/0x80 [ 105.056725][ T6118] ? bio_associate_blkg_from_css+0x394/0x13e0 [ 105.056752][ T6118] bio_iov_iter_get_pages+0x384/0x10d0 [ 105.056769][ T6118] ? bio_associate_blkg+0x137/0x2a0 [ 105.056796][ T6118] ? __pfx_bio_iov_iter_get_pages+0x10/0x10 [ 105.056812][ T6118] ? __pfx_bio_alloc_bioset+0x10/0x10 [ 105.056826][ T6118] ? ktime_get_coarse_real_ts64_mg+0x240/0x300 [ 105.056845][ T6118] ? rcu_is_watching+0x12/0xc0 [ 105.056858][ T6118] ? iov_iter_is_aligned+0xf2/0x5a0 [ 105.056875][ T6118] ? set_normalized_timespec64+0x69/0xc0 [ 105.056893][ T6118] blkdev_direct_IO+0x1401/0x1fe0 [ 105.056922][ T6118] ? __pfx_blkdev_direct_IO+0x10/0x10 [ 105.056944][ T6118] ? filemap_check_errors+0xa9/0x160 [ 105.056970][ T6118] blkdev_write_iter+0x703/0xe00 [ 105.056994][ T6118] vfs_write+0x6c4/0x1150 [ 105.057010][ T6118] ? __pfx_blkdev_write_iter+0x10/0x10 [ 105.057032][ T6118] ? __pfx_vfs_write+0x10/0x10 [ 105.057046][ T6118] ? find_held_lock+0x2b/0x80 [ 105.057070][ T6118] ksys_write+0x12a/0x250 [ 105.057085][ T6118] ? __pfx_ksys_write+0x10/0x10 [ 105.057106][ T6118] do_syscall_64+0xcd/0x490 [ 105.057120][ T6118] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.057134][ T6118] RIP: 0033:0x7f610018eb69 [ 105.057146][ T6118] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 105.057160][ T6118] RSP: 002b:00007f6100f3e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.057173][ T6118] RAX: ffffffffffffffda RBX: 00007f61003b6240 RCX: 00007f610018eb69 [ 105.057182][ T6118] RDX: 000000100000a3d9 RSI: 0000000000000000 RDI: 0000000000000004 [ 105.057191][ T6118] RBP: 00007f6100211df1 R08: 0000000000000000 R09: 0000000000000000 [ 105.057199][ T6118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.057207][ T6118] R13: 0000000000000000 R14: 00007f61003b6240 R15: 00007ffee5726248 [ 105.057226][ T6118] [ 106.509743][ T6129] ubi0: attaching mtd0 [ 106.524030][ T6129] ubi0: scanning is finished [ 106.531495][ T6129] ubi0: empty MTD device detected [ 106.986968][ T6129] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 106.997054][ T6129] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 107.007563][ T6129] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 107.014769][ T6129] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 107.027371][ T6129] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 107.034456][ T6129] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 107.087803][ T6129] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 497482795 [ 107.130505][ T6129] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 107.151152][ T6131] ubi0: background thread "ubi_bgt0d" started, PID 6131 [ 111.251570][ T6165] netlink: 342 bytes leftover after parsing attributes in process `syz.1.37'. [ 111.640852][ T6187] random: crng reseeded on system resumption [ 114.548127][ T6236] netlink: set zone limit has 8 unknown bytes [ 116.744504][ T6259] syz.2.49 uses obsolete (PF_INET,SOCK_PACKET) [ 116.828457][ T6262] random: crng reseeded on system resumption [ 118.071515][ T6274] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 120.205934][ T6292] FAULT_INJECTION: forcing a failure. [ 120.205934][ T6292] name failslab, interval 1, probability 0, space 0, times 0 [ 120.268209][ T6292] CPU: 1 UID: 0 PID: 6292 Comm: syz.3.54 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 120.268236][ T6292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 120.268246][ T6292] Call Trace: [ 120.268251][ T6292] [ 120.268258][ T6292] dump_stack_lvl+0x16c/0x1f0 [ 120.268285][ T6292] should_fail_ex+0x512/0x640 [ 120.268300][ T6292] ? __kvmalloc_node_noprof+0x124/0x620 [ 120.268318][ T6292] should_failslab+0xc2/0x120 [ 120.268338][ T6292] __kvmalloc_node_noprof+0x137/0x620 [ 120.268354][ T6292] ? bucket_table_alloc.isra.0+0x83/0x460 [ 120.268372][ T6292] ? bucket_table_alloc.isra.0+0x83/0x460 [ 120.268386][ T6292] bucket_table_alloc.isra.0+0x83/0x460 [ 120.268403][ T6292] rhashtable_init_noprof+0x41a/0x7e0 [ 120.268418][ T6292] ? __pfx_ipmr_new_table_set+0x10/0x10 [ 120.268438][ T6292] rhltable_init_noprof+0x20/0x60 [ 120.268452][ T6292] mr_table_alloc+0x116/0x2e0 [ 120.268470][ T6292] ? __pfx_ipmr_expire_process+0x10/0x10 [ 120.268491][ T6292] ? __pfx_ipmr_net_init+0x10/0x10 [ 120.268504][ T6292] ipmr_net_init+0x3c4/0x4e0 [ 120.268516][ T6292] ? __pfx_ipmr_net_init+0x10/0x10 [ 120.268529][ T6292] ops_init+0x1e2/0x5f0 [ 120.268545][ T6292] setup_net+0x10f/0x380 [ 120.268556][ T6292] ? lockdep_init_map_type+0x5c/0x280 [ 120.268576][ T6292] ? __pfx_setup_net+0x10/0x10 [ 120.268589][ T6292] ? debug_mutex_init+0x37/0x70 [ 120.268604][ T6292] copy_net_ns+0x2a6/0x5f0 [ 120.268620][ T6292] create_new_namespaces+0x3ea/0xa90 [ 120.268642][ T6292] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 120.268665][ T6292] ksys_unshare+0x45b/0xa40 [ 120.268687][ T6292] ? __pfx_ksys_unshare+0x10/0x10 [ 120.268707][ T6292] ? xfd_validate_state+0x61/0x180 [ 120.268735][ T6292] __x64_sys_unshare+0x31/0x40 [ 120.268754][ T6292] do_syscall_64+0xcd/0x490 [ 120.268769][ T6292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.268784][ T6292] RIP: 0033:0x7f451038eb69 [ 120.268796][ T6292] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 120.268808][ T6292] RSP: 002b:00007f45112af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 120.268827][ T6292] RAX: ffffffffffffffda RBX: 00007f45105b5fa0 RCX: 00007f451038eb69 [ 120.268836][ T6292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 120.268848][ T6292] RBP: 00007f4510411df1 R08: 0000000000000000 R09: 0000000000000000 [ 120.268856][ T6292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.268864][ T6292] R13: 0000000000000000 R14: 00007f45105b5fa0 R15: 00007fffa2dc1f58 [ 120.268883][ T6292] [ 121.776111][ T6295] syz.2.55 (6295) used greatest stack depth: 19752 bytes left [ 122.977784][ T6322] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 123.209598][ T6318] FAULT_INJECTION: forcing a failure. [ 123.209598][ T6318] name failslab, interval 1, probability 0, space 0, times 0 [ 123.541144][ T6318] CPU: 0 UID: 0 PID: 6318 Comm: syz.3.57 Not tainted 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 123.541184][ T6318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 123.541199][ T6318] Call Trace: [ 123.541208][ T6318] [ 123.541218][ T6318] dump_stack_lvl+0x16c/0x1f0 [ 123.541263][ T6318] should_fail_ex+0x512/0x640 [ 123.541290][ T6318] ? __kmalloc_noprof+0xbf/0x510 [ 123.541324][ T6318] ? __netlink_kernel_create+0x17f/0x750 [ 123.541484][ T6318] should_failslab+0xc2/0x120 [ 123.541514][ T6318] __kmalloc_noprof+0xd2/0x510 [ 123.541549][ T6318] ? __netlink_create+0x208/0x2c0 [ 123.541586][ T6318] __netlink_kernel_create+0x17f/0x750 [ 123.541619][ T6318] ? __pfx___netlink_kernel_create+0x10/0x10 [ 123.541661][ T6318] ? fib4_semantics_init+0x25/0x100 [ 123.541710][ T6318] fib_net_init+0x26d/0x3f0 [ 123.541735][ T6318] ? __pfx___register_sysctl_table+0x10/0x10 [ 123.541774][ T6318] ? __pfx_fib_net_init+0x10/0x10 [ 123.541799][ T6318] ? lockdep_init_map_type+0x5c/0x280 [ 123.541835][ T6318] ? __pfx_nl_fib_input+0x10/0x10 [ 123.541866][ T6318] ? devinet_init_net+0x5c2/0x910 [ 123.541915][ T6318] ? __pfx_fib_net_init+0x10/0x10 [ 123.541939][ T6318] ops_init+0x1e2/0x5f0 [ 123.541968][ T6318] setup_net+0x10f/0x380 [ 123.541985][ T6318] ? lockdep_init_map_type+0x5c/0x280 [ 123.542018][ T6318] ? __pfx_setup_net+0x10/0x10 [ 123.542043][ T6318] ? debug_mutex_init+0x37/0x70 [ 123.542073][ T6318] copy_net_ns+0x2a6/0x5f0 [ 123.542104][ T6318] create_new_namespaces+0x3ea/0xa90 [ 123.542140][ T6318] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 123.542172][ T6318] ksys_unshare+0x45b/0xa40 [ 123.542215][ T6318] ? __pfx_ksys_unshare+0x10/0x10 [ 123.542257][ T6318] __x64_sys_unshare+0x31/0x40 [ 123.542288][ T6318] do_syscall_64+0xcd/0x490 [ 123.542310][ T6318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.542351][ T6318] RIP: 0033:0x7f451038eb69 [ 123.542372][ T6318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 123.542396][ T6318] RSP: 002b:00007f451126d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 123.542421][ T6318] RAX: ffffffffffffffda RBX: 00007f45105b6160 RCX: 00007f451038eb69 [ 123.542438][ T6318] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 123.542450][ T6318] RBP: 00007f4510411df1 R08: 0000000000000000 R09: 0000000000000000 [ 123.542460][ T6318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.542467][ T6318] R13: 0000000000000000 R14: 00007f45105b6160 R15: 00007fffa2dc1f58 [ 123.542486][ T6318] [ 127.657572][ T6369] delete_channel: no stack [ 129.341618][ T6408] netlink: 334 bytes leftover after parsing attributes in process `syz.2.70'. [ 132.234233][ T6441] input: jJǸ-9%vJ86 as /devices/virtual/input/input10 [ 133.030689][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.037377][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.837016][ T6472] netlink: 'syz.2.81': attribute type 11 has an invalid length. [ 134.850287][ T6472] netlink: 'syz.2.81': attribute type 11 has an invalid length. [ 134.859467][ T6472] netlink: 'syz.2.81': attribute type 11 has an invalid length. [ 135.180586][ T6466] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 135.191659][ T6466] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 135.201940][ T6466] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 135.210191][ T6466] page_type: f5(slab) [ 135.214391][ T6466] raw: 00fff00000000040 ffff88801b84b640 dead000000000122 0000000000000000 [ 135.223575][ T6466] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 135.232639][ T6466] head: 00fff00000000040 ffff88801b84b640 dead000000000122 0000000000000000 [ 135.241742][ T6466] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 135.250717][ T6466] head: 00fff00000000003 ffffea0001e00001 00000000ffffffff 00000000ffffffff [ 135.259909][ T6466] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 135.269548][ T6466] page dumped because: unmovable page [ 135.275246][ T6466] page_owner tracks the page as allocated [ 135.283031][ T6466] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5531, tgid 5531 (dhcpcd), ts 58579060977, free_ts 30316388382 [ 135.308185][ T6466] post_alloc_hook+0x1c0/0x230 [ 135.313452][ T6466] get_page_from_freelist+0x132b/0x38e0 [ 135.319506][ T6466] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 135.325700][ T6466] alloc_pages_mpol+0x1fb/0x550 [ 135.331081][ T6466] new_slab+0x247/0x330 [ 135.335685][ T6466] ___slab_alloc+0xcf2/0x1740 [ 135.340774][ T6466] __slab_alloc.constprop.0+0x56/0xb0 [ 135.347737][ T6466] __kvmalloc_node_noprof+0x3b1/0x620 [ 135.357028][ T6466] alloc_netdev_mqs+0xd2/0x1500 [ 135.367494][ T6466] lapbeth_device_event+0x272/0xbe0 [ 135.373783][ T6466] notifier_call_chain+0xbc/0x410 [ 135.379622][ T6466] call_netdevice_notifiers_info+0xbe/0x140 [ 135.391117][ T6466] __dev_notify_flags+0x12c/0x2e0 [ 135.396938][ T6466] netif_change_flags+0x108/0x160 [ 135.404068][ T6466] dev_change_flags+0xba/0x250 [ 135.414804][ T6466] devinet_ioctl+0x11d5/0x1f50 [ 135.421445][ T6466] page last free pid 1 tgid 1 stack trace: [ 135.428391][ T6466] __free_frozen_pages+0x7d5/0x10f0 [ 135.455936][ T6466] free_contig_range+0x183/0x4b0 [ 135.467300][ T6466] destroy_args+0x7f6/0xa60 [ 135.476274][ T6466] debug_vm_pgtable+0x1a32/0x3640 [ 135.483174][ T6466] do_one_initcall+0x120/0x6e0 [ 135.488261][ T6466] kernel_init_freeable+0x5c2/0x910 [ 135.494109][ T6466] kernel_init+0x1c/0x2b0 [ 135.498535][ T6466] ret_from_fork+0x5d4/0x6f0 [ 135.503344][ T6466] ret_from_fork_asm+0x1a/0x30 [ 135.689542][ T6480] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 136.496897][ T6496] mmap: syz.2.86 (6496) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 136.672342][ T6490] netlink: 4 bytes leftover after parsing attributes in process `syz.1.84'. [ 136.745281][ T6501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.86'. [ 137.558716][ T6502] Setting dangerous option i915.mitigations - tainting kernel [ 137.860599][ T6511] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 138.257853][ T6516] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(14) [ 139.938090][ T6542] ICMPv6: process `syz.1.93' is using deprecated sysctl (syscall) net.ipv6.neigh.ipvlan1.retrans_time - use net.ipv6.neigh.ipvlan1.retrans_time_ms instead [ 139.967960][ T5916] ================================================================== [ 139.967978][ T5916] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1a6f/0x1e60 [ 139.968018][ T5916] Write of size 8 at addr ffffc90003c69440 by task kworker/0:4/5916 [ 139.968040][ T5916] [ 139.968063][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: kworker/0:4 Tainted: G U 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 139.968103][ T5916] Tainted: [U]=USER [ 139.968112][ T5916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 139.968128][ T5916] Workqueue: events_power_efficient fb_flashcursor [ 139.968165][ T5916] Call Trace: [ 139.968173][ T5916] [ 139.968183][ T5916] dump_stack_lvl+0x116/0x1f0 [ 139.968222][ T5916] print_report+0xcd/0x630 [ 139.968375][ T5916] ? __virt_addr_valid+0x81/0x610 [ 139.968424][ T5916] ? sys_imageblit+0x1a6f/0x1e60 [ 139.968451][ T5916] kasan_report+0xe0/0x110 [ 139.968484][ T5916] ? sys_imageblit+0x1a6f/0x1e60 [ 139.968517][ T5916] sys_imageblit+0x1a6f/0x1e60 [ 139.968553][ T5916] ? __pfx_sys_imageblit+0x10/0x10 [ 139.968599][ T5916] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 139.968641][ T5916] soft_cursor+0x521/0xa10 [ 139.968669][ T5916] ? fb_get_color_depth+0x120/0x250 [ 139.968717][ T5916] bit_cursor+0xe8c/0x17e0 [ 139.968746][ T5916] ? __pfx_bit_cursor+0x10/0x10 [ 139.968776][ T5916] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 139.968814][ T5916] ? get_color+0x1da/0x450 [ 139.968848][ T5916] ? __pfx_bit_cursor+0x10/0x10 [ 139.968872][ T5916] fb_flashcursor+0x310/0x400 [ 139.968908][ T5916] process_one_work+0x9cc/0x1b70 [ 139.968951][ T5916] ? __pfx_nsim_dev_hwstats_traffic_work+0x10/0x10 [ 139.968993][ T5916] ? __pfx_process_one_work+0x10/0x10 [ 139.969035][ T5916] ? assign_work+0x1a0/0x250 [ 139.969069][ T5916] worker_thread+0x6c8/0xf10 [ 139.969110][ T5916] ? __kthread_parkme+0x19e/0x250 [ 139.969141][ T5916] ? __pfx_worker_thread+0x10/0x10 [ 139.969178][ T5916] kthread+0x3c5/0x780 [ 139.969211][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.969253][ T5916] ? rcu_is_watching+0x12/0xc0 [ 139.969279][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.969313][ T5916] ret_from_fork+0x5d4/0x6f0 [ 139.969349][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.969383][ T5916] ret_from_fork_asm+0x1a/0x30 [ 139.969421][ T5916] [ 139.969430][ T5916] [ 139.969437][ T5916] The buggy address belongs to a vmalloc virtual mapping [ 139.969456][ T5916] Memory state around the buggy address: [ 139.969469][ T5916] ffffc90003c69300: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 139.969486][ T5916] ffffc90003c69380: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 139.969503][ T5916] >ffffc90003c69400: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 139.969516][ T5916] ^ [ 139.969530][ T5916] ffffc90003c69480: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 139.969547][ T5916] ffffc90003c69500: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 139.969561][ T5916] ================================================================== [ 139.969574][ T5916] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 139.969593][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: kworker/0:4 Tainted: G U 6.16.0-syzkaller-11489-gd2eedaa3909b #0 PREEMPT(full) [ 139.969630][ T5916] Tainted: [U]=USER [ 139.969639][ T5916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 139.969655][ T5916] Workqueue: events_power_efficient fb_flashcursor [ 139.969689][ T5916] Call Trace: [ 139.969698][ T5916] [ 139.969707][ T5916] dump_stack_lvl+0x3d/0x1f0 [ 139.969743][ T5916] vpanic+0x6e8/0x7a0 [ 139.969776][ T5916] ? __pfx_vpanic+0x10/0x10 [ 139.969809][ T5916] ? __pfx_vprintk_emit+0x10/0x10 [ 139.969840][ T5916] ? sys_imageblit+0x1a6f/0x1e60 [ 139.969869][ T5916] panic+0xca/0xd0 [ 139.969902][ T5916] ? __pfx_panic+0x10/0x10 [ 139.969934][ T5916] ? check_panic_on_warn+0x1f/0xb0 [ 139.969968][ T5916] check_panic_on_warn+0xab/0xb0 [ 139.969998][ T5916] end_report+0x107/0x170 [ 139.970024][ T5916] kasan_report+0xee/0x110 [ 139.970047][ T5916] ? sys_imageblit+0x1a6f/0x1e60 [ 139.970065][ T5916] sys_imageblit+0x1a6f/0x1e60 [ 139.970083][ T5916] ? __pfx_sys_imageblit+0x10/0x10 [ 139.970107][ T5916] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 139.970129][ T5916] soft_cursor+0x521/0xa10 [ 139.970143][ T5916] ? fb_get_color_depth+0x120/0x250 [ 139.970164][ T5916] bit_cursor+0xe8c/0x17e0 [ 139.970179][ T5916] ? __pfx_bit_cursor+0x10/0x10 [ 139.970195][ T5916] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 139.970214][ T5916] ? get_color+0x1da/0x450 [ 139.970233][ T5916] ? __pfx_bit_cursor+0x10/0x10 [ 139.970252][ T5916] fb_flashcursor+0x310/0x400 [ 139.970271][ T5916] process_one_work+0x9cc/0x1b70 [ 139.970294][ T5916] ? __pfx_nsim_dev_hwstats_traffic_work+0x10/0x10 [ 139.970316][ T5916] ? __pfx_process_one_work+0x10/0x10 [ 139.970339][ T5916] ? assign_work+0x1a0/0x250 [ 139.970358][ T5916] worker_thread+0x6c8/0xf10 [ 139.970381][ T5916] ? __kthread_parkme+0x19e/0x250 [ 139.970397][ T5916] ? __pfx_worker_thread+0x10/0x10 [ 139.970417][ T5916] kthread+0x3c5/0x780 [ 139.970436][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.970455][ T5916] ? rcu_is_watching+0x12/0xc0 [ 139.970468][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.970487][ T5916] ret_from_fork+0x5d4/0x6f0 [ 139.970509][ T5916] ? __pfx_kthread+0x10/0x10 [ 139.970528][ T5916] ret_from_fork_asm+0x1a/0x30 [ 139.970548][ T5916] [ 139.971041][ T5916] Kernel Offset: disabled