last executing test programs: 5m23.511342169s ago: executing program 1 (id=188): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004040) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x40800) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000001640)=""/139, &(0x7f0000000100)=0x8) 5m22.936969782s ago: executing program 1 (id=191): creat(&(0x7f0000000c40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x81) link(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000380)='./file0\x00') creat(&(0x7f0000000140)='./file0\x00', 0x49) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) unlink(&(0x7f00000001c0)='./file0\x00') open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) 5m22.478338772s ago: executing program 1 (id=195): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000680)={0x73622a85, 0x0, 0x4}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) 5m22.291942924s ago: executing program 2 (id=198): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x1}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x48885) ioctl$UBLK_U_CMD_GET_QUEUE_AFFINITY(0xffffffffffffffff, 0x80207501, 0x0) close(r1) 5m22.011734746s ago: executing program 2 (id=199): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000600)={@void, @val={0x2, 0x0, 0xdd86, 0x300, 0x6, 0x4}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x2, 0x2e, 0x24, 0x64, 0x0, 0xff, 0x21, 0x0, @multicast2, @private=0xa010100}, {{0x4e21, 0x4e23, 0x4, 0x1, 0x7, 0x0, 0x0, 0x6, 0x4, "be158f", 0x57, "1550d1"}}}}}, 0x2e) 5m22.000983844s ago: executing program 1 (id=200): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) 5m21.858645974s ago: executing program 1 (id=201): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008080) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) preadv(r0, &(0x7f0000000400)=[{&(0x7f00000000c0)=""/14, 0x1b}], 0x27, 0x0, 0xfffffffe) 5m20.763168011s ago: executing program 2 (id=211): setns(0xc9, 0x0) r0 = socket(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@generic={0x1f, "ffff0300"}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = socket(0x1f, 0x5, 0x8) setsockopt(r1, 0xc1, 0x5, 0x0, 0x0) 5m20.350196547s ago: executing program 2 (id=214): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 5m19.989427426s ago: executing program 2 (id=218): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) write(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000200)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x1, 0x0, @rand_addr=0x1c101003, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x6, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x4, 0x3, @private=0xa010102, @loopback}}}}}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x20, 0xfc, 0x1, 0x0, @rand_addr=0x1c101003, @multicast1=0xe0000300}, @dest_unreach={0x3, 0xa, 0x0, 0x0, 0xfa, 0x9, {0x5, 0x4, 0x0, 0x3d, 0xfff6, 0x65, 0x5, 0x1, 0x4, 0x3, @private=0xa010102, @loopback}}}}}}, 0x0) 5m19.6176021s ago: executing program 1 (id=219): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000090a010400000000000000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797ab10000000008000640ffffff000800084000000001080003400000011c14000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) 5m18.758573677s ago: executing program 32 (id=219): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000090a010400000000000000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797ab10000000008000640ffffff000800084000000001080003400000011c14000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30"], 0x7c}}, 0x0) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0xa, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x80) 5m17.761849665s ago: executing program 2 (id=226): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f00000000c0)=0x1051, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) 5m17.114399867s ago: executing program 33 (id=226): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f00000000c0)=0x1051, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) 4m56.299304007s ago: executing program 6 (id=246): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x4, 0xf39, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000480)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0xe1}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x5d, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x16, 0x0, {}, 0x1f, r0, '\x00', {0xfff7, 0x4, 0x0, 0x0}}, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000340)={0x2031}, 0x0) 4m55.142532688s ago: executing program 6 (id=252): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 4m53.822055812s ago: executing program 6 (id=258): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/net/ipv4/conf/all/route_localnet\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setuid(0xee01) read$FUSE(r0, 0x0, 0x0) 4m53.529846324s ago: executing program 6 (id=265): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0) umount2(&(0x7f0000000180)='./file0/../file0/file0\x00', 0x0) 4m53.159449758s ago: executing program 6 (id=268): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f00000002c0)=0x3d, 0x4) bind$can_j1939(r0, &(0x7f0000000300)={0x1d, r1, 0x102030405060708, {0x0, 0x1, 0x4}, 0xfe}, 0x18) connect$can_j1939(r0, &(0x7f0000000180)={0x1d, r1, 0x0, {0x0, 0xee}, 0xff}, 0x18) getpeername(r0, 0x0, &(0x7f0000000080)) 4m51.907452878s ago: executing program 6 (id=279): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) close(r0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x1018}, './file0\x00'}) 4m51.181945519s ago: executing program 34 (id=279): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r0) close(r0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x1018}, './file0\x00'}) 2m34.101257072s ago: executing program 7 (id=1270): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='100', 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x29305}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_INGRESS_QOS={0x4}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x48}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) 2m32.556549597s ago: executing program 7 (id=1279): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000140)=""/80, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000500)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000004100)={0x0, 0x1, 0x0, 0x0, 0x0, 0x25000}) 2m31.803728576s ago: executing program 7 (id=1284): syz_open_dev$evdev(&(0x7f00000001c0), 0x0, 0x2002) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000180)={0x2, 0x3}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff0000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000001000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 2m31.039031734s ago: executing program 7 (id=1287): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000300)='./file0\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) 2m30.665712889s ago: executing program 7 (id=1290): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="bf16000000000000620af0ff0100007f620af4ff0100007f6a0af8ff341200006a0afaff204e0000620ad8ff34124e20620adcff00000000620ae0ff00000000620ae4ff50020010620ae8ff00000000620ac0ff45000028620ac4ff00000000620ac8ff40060000620accff0100007f620ad0ff0100007fbf61000000000000bfa200000000000007020000f0ffffffb70300000c000000b7040000ffffffffb705000000000000850000005400000015000b0000000000bf07000000000000bf71000000000000bfa200000000000007020000c0ffffffb703000014000000bfa400000000000007040000d8ffffffb705000014000000850000006e000000bf710000000000008500000056000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r0, 0x0, 0xe, 0x0, &(0x7f0000000600)='\x00'/14, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2m28.163139306s ago: executing program 7 (id=1304): setgroups(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r0, 0x0, 0xee01) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000040)={{}, {}, [], {0x4, 0x5}, [{0x8, 0x0, 0xee00}], {0x10, 0x3}, {0x20, 0x7}}, 0x2c, 0x1) setreuid(0xffffffffffffffff, 0xee01) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xc408, 0x103) 2m26.993510423s ago: executing program 35 (id=1304): setgroups(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r0, 0x0, 0xee01) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000040)={{}, {}, [], {0x4, 0x5}, [{0x8, 0x0, 0xee00}], {0x10, 0x3}, {0x20, 0x7}}, 0x2c, 0x1) setreuid(0xffffffffffffffff, 0xee01) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xc408, 0x103) 1m30.244445052s ago: executing program 0 (id=1535): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0xf, &(0x7f0000000380)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2}, 0x94) close(r0) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000780)=@generic={0x0, r3}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000480)={r0, 0x0, 0x0}, 0x10) 1m28.313903838s ago: executing program 0 (id=1539): bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map, 0xffffffffffffffff, 0x7}, 0x10) r0 = socket$kcm(0x2b, 0x1, 0x0) close(r0) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f00000017c0)={&(0x7f0000000040)=@l2tp6={0xa, 0x80fe, 0x7, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x12, 0x2}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000004c0)="7f", 0x1}], 0x1, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000084000000070000007f00000000000000b8"], 0xd0}, 0x480c4) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000001c0), 0x45) close(r1) 1m27.832149506s ago: executing program 0 (id=1542): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="44000000100039042abd7000fbdbdf2500000000", @ANYRES32=r2, @ANYBLOB="0118020003110000240012800b000100697036746e6c00001400028008000100", @ANYRES32=r2], 0x44}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x8000}, 0x0) 1m27.333725169s ago: executing program 0 (id=1546): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c70000000000000000000000000000000008000100544545000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8923, &(0x7f0000000040)={'wlan1\x00', @random="2e2ee363a4b1"}) 1m26.073015815s ago: executing program 0 (id=1552): r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x15a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x8000, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x826, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) modify_ldt$write2(0x11, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x10) 1m24.504827562s ago: executing program 0 (id=1560): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000000)='270', 0x3) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x8000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x44) write(r0, &(0x7f0000000000)='3', 0x4e) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) unshare(0x40000000) 1m10.586703443s ago: executing program 3 (id=1596): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_set$pid(0x2, 0x0, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) sendfile(r0, r0, 0x0, 0x6) 1m10.158658299s ago: executing program 3 (id=1598): r0 = socket$unix(0x1, 0x1, 0x0) r1 = fsopen(&(0x7f0000000340)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x86) fchdir(r2) bind$unix(r0, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e24}, 0x6e) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) 1m9.135552323s ago: executing program 36 (id=1560): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000000)='270', 0x3) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x8000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x44) write(r0, &(0x7f0000000000)='3', 0x4e) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) unshare(0x40000000) 1m8.989756608s ago: executing program 3 (id=1601): sched_setscheduler(0x0, 0x2, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x80) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000030073797a6b616c6c65723000001800128008000100767266000c00028008000100e8"], 0x48}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@dellink={0x34, 0x11, 0x1, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x8500, 0x2}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'syzkaller0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) 58.905505071s ago: executing program 3 (id=1616): bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000400000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014004e8bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 58.473589664s ago: executing program 3 (id=1619): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x3000, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000180)={0x0, 0xea60}, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x100, 0x0) connect$unix(r2, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) 57.973132848s ago: executing program 3 (id=1623): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 42.92844865s ago: executing program 37 (id=1623): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 35.655048218s ago: executing program 4 (id=1687): r0 = syz_io_uring_setup(0x126b, &(0x7f0000000640)={0x0, 0x200072db, 0x0, 0x8001, 0x281}, &(0x7f00000006c0), &(0x7f0000000540), &(0x7f0000000500)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}}, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r0, 0x2, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0}, 0x20) 35.179497952s ago: executing program 4 (id=1689): bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000009b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x94}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 34.080403261s ago: executing program 4 (id=1693): sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x70bd28, 0x2, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x4}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4054}, 0x0) setns(0xc9, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000a29a75ac180000000200000000ddffff00000004010100000000000002"], 0x0, 0x32, 0x0, 0x1}, 0x28) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket(0x8, 0x2, 0x0) setsockopt(r0, 0x108, 0x42020054, &(0x7f0000000000)="010000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000005000000", 0x54) 33.638150304s ago: executing program 4 (id=1694): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_RUN(r3, 0xae80, 0x0) 33.434906373s ago: executing program 4 (id=1695): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000380)=""/70, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/85, 0x0, 0x1000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000002700)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x4008af04, &(0x7f0000000040)) 33.226213808s ago: executing program 4 (id=1697): syz_open_procfs(0x0, &(0x7f0000000840)='fdinfo/3\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000800)={r0, &(0x7f0000000840), &(0x7f0000000880)=@tcp6=r1, 0x2}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="8c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00420040000000060000000c003900ff04000000000000d8fd010006000000090000000600050088a8000008000a00", @ANYRES32=r2, @ANYBLOB="08000500", @ANYRES64=r2], 0x8c}, 0x1, 0xba01, 0x0, 0x400c085}, 0x0) 19.077995352s ago: executing program 5 (id=1723): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="c4000000190001000000000000000000fc0100000000000000000000000000000000000000000000000000000000000000000000100000000a00200011000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000deb000000000000000000000000000000fcffe7ffffffffff000900000000000000000000000000000000000000000000fbffffffffffffff0000000000000000000000000000000000000000000000020400000000000000000000000000004000000000000000000a00100001"], 0xc4}}, 0x2c000010) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) lstat(0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="b8000000140001000000000004000000e000000200000000000000000000000000000000000000000000000000000000000000000fff00000a00200000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00@'], 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x987a3a9f32350a5c) 18.815406173s ago: executing program 5 (id=1724): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) r2 = eventfd2(0x0, 0x80000) read(r2, &(0x7f0000002500)=""/126, 0x7e) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) write$eventfd(r1, &(0x7f0000000040)=0x9, 0x8) 18.397707235s ago: executing program 5 (id=1725): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x101}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) r0 = getpgid(0x0) r1 = syz_pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x21, 0x0, 0x4) 17.934051255s ago: executing program 38 (id=1697): syz_open_procfs(0x0, &(0x7f0000000840)='fdinfo/3\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000800)={r0, &(0x7f0000000840), &(0x7f0000000880)=@tcp6=r1, 0x2}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="8c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00420040000000060000000c003900ff04000000000000d8fd010006000000090000000600050088a8000008000a00", @ANYRES32=r2, @ANYBLOB="08000500", @ANYRES64=r2], 0x8c}, 0x1, 0xba01, 0x0, 0x400c085}, 0x0) 17.621904105s ago: executing program 5 (id=1727): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffe3e) sendmmsg$inet(r1, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000400)="1d", 0x1}], 0x1}}], 0x1, 0x40003) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x0, 0x0, 0xfffc, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 15.55308088s ago: executing program 5 (id=1728): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @remote}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000003c0)={0x0, 0x1, 0x6, @broadcast}, 0x10) 15.125423493s ago: executing program 5 (id=1729): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0xfffd}}}}}}]}, 0x48}}, 0x0) 0s ago: executing program 39 (id=1729): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0xfffd}}}}}}]}, 0x48}}, 0x0) kernel console output (not intermixed with test programs): oogle 07/24/2026 [ 254.055834][ T8813] Call Trace: [ 254.055843][ T8813] [ 254.055853][ T8813] dump_stack_lvl+0xe8/0x150 [ 254.055895][ T8813] should_fail_ex+0x46b/0x600 [ 254.055939][ T8813] should_failslab+0xa8/0x100 [ 254.055967][ T8813] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 254.056005][ T8813] ? smb3_parse_devname+0xe8/0x850 [ 254.056033][ T8813] ? smb3_parse_devname+0xe8/0x850 [ 254.056070][ T8813] kstrndup+0x7e/0x160 [ 254.056100][ T8813] smb3_parse_devname+0xe8/0x850 [ 254.056138][ T8813] smb3_fs_context_parse_param+0x4255/0x7b50 [ 254.056172][ T8813] ? smack_fs_context_parse_param+0x10a/0x180 [ 254.056202][ T8813] ? __pfx_smack_fs_context_parse_param+0x10/0x10 [ 254.056233][ T8813] ? __pfx_smb3_fs_context_parse_param+0x10/0x10 [ 254.056269][ T8813] ? static_key_count+0x41/0x70 [ 254.056307][ T8813] vfs_parse_fs_param+0x1a9/0x420 [ 254.056345][ T8813] __se_sys_fsconfig+0x6bf/0x810 [ 254.056376][ T8813] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 254.056403][ T8813] ? rcu_is_watching+0x16/0xb0 [ 254.056434][ T8813] ? __x64_sys_fsconfig+0x20/0xc0 [ 254.056459][ T8813] do_syscall_64+0x166/0x520 [ 254.056489][ T8813] ? trace_irq_disable+0x3b/0x140 [ 254.056517][ T8813] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.056539][ T8813] ? clear_bhb_loop+0x70/0xc0 [ 254.056565][ T8813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.056585][ T8813] RIP: 0033:0x7fd78480e1d9 [ 254.056607][ T8813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.056624][ T8813] RSP: 002b:00007fd782a66028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 254.056649][ T8813] RAX: ffffffffffffffda RBX: 00007fd784a95fa0 RCX: 00007fd78480e1d9 [ 254.056666][ T8813] RDX: 0000200000000000 RSI: 0000000000000001 RDI: 0000000000000003 [ 254.056681][ T8813] RBP: 00007fd7848a5888 R08: 0000000000000000 R09: 0000000000000000 [ 254.056695][ T8813] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000000 [ 254.056709][ T8813] R13: 00007fd784a96038 R14: 00007fd784a95fa0 R15: 00007ffff494a348 [ 254.056757][ T8813] [ 254.057000][ T8813] CIFS: VFS: Unable to allocate memory for devname [ 254.484772][ T8827] netlink: 108 bytes leftover after parsing attributes in process `syz.5.907'. [ 254.837382][ T8836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.911'. [ 254.936856][ T8838] netlink: 27 bytes leftover after parsing attributes in process `syz.0.912'. [ 256.008102][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.008172][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.259233][ T5723] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 256.431290][ T5723] usb 8-1: New USB device found, idVendor=0b95, idProduct=1790, bcdDevice= 1.00 [ 256.434138][ T5723] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 256.434201][ T5723] usb 8-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 256.434247][ T5723] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.467390][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 257.467412][ T36] audit: type=1400 audit(1791608673.607:10): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8887 comm="syz.3.931" src=65532 dest=20002 netif=wpan0 [ 257.598485][ T1237] libceph: connect (1)0.0.0.0:6789 error -22 [ 257.626611][ T1237] libceph: mon0 (1)0.0.0.0:6789 connect error [ 257.640431][ T1237] libceph: connect (1)0.0.0.0:6789 error -22 [ 257.640701][ T1237] libceph: mon0 (1)0.0.0.0:6789 connect error [ 257.899816][ T1237] libceph: connect (1)0.0.0.0:6789 error -22 [ 257.900170][ T1237] libceph: mon0 (1)0.0.0.0:6789 connect error [ 257.988093][ T8905] netlink: 'syz.3.938': attribute type 4 has an invalid length. [ 258.071837][ T5594] Bluetooth: hci0: command 0x0406 tx timeout [ 258.106551][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71 [ 258.106586][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 258.107197][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 258.116231][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 258.118349][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.118895][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.124673][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.129804][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.130335][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 258.132541][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.133756][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 258.134279][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 258.136165][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 258.136666][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 258.137185][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 258.151778][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 258.153939][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 258.163598][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 258.165573][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 258.166705][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 258.167422][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 258.172572][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 258.175429][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 258.176213][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 258.177665][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 258.179376][ T5723] ax88179_178a 8-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 258.295021][ T1244] libceph: connect (1)127.0.0.1:6789 error -101 [ 258.295241][ T1244] libceph: mon0 (1)127.0.0.1:6789 connect error [ 258.429642][ T8891] ceph: No mds server is up or the cluster is laggy [ 258.435279][ T8894] ceph: No mds server is up or the cluster is laggy [ 258.469939][ T1237] libceph: connect (1)0.0.0.0:6789 error -22 [ 258.470168][ T1237] libceph: mon0 (1)0.0.0.0:6789 connect error [ 258.625695][ T1244] libceph: connect (1)127.0.0.1:6789 error -101 [ 258.625937][ T1244] libceph: mon0 (1)127.0.0.1:6789 connect error [ 258.679214][ T5723] ax88179_178a 8-1:1.0 eth13: register 'ax88179_178a' at usb-dummy_hcd.7-1, ASIX AX88179 USB 3.0 Gigabit Ethernet, 1e:6e:b5:6f:d7:6e [ 258.704505][ T5723] usb 8-1: USB disconnect, device number 7 [ 258.708625][ T5723] ax88179_178a 8-1:1.0 eth13: unregister 'ax88179_178a' usb-dummy_hcd.7-1, ASIX AX88179 USB 3.0 Gigabit Ethernet [ 258.872113][ T36] audit: type=1400 audit(1791608675.017:11): lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied subject="*" object="_" requested=w pid=8920 comm="syz.0.953" src=65532 dest=20002 netif=wpan0 [ 258.946951][ T8919] EXT4-fs warning (device sda1): __ext4_ioctl:1564: Setting inode version is not supported with metadata_csum enabled. [ 259.129488][ T10] libceph: connect (1)127.0.0.1:6789 error -101 [ 259.144976][ T10] libceph: mon0 (1)127.0.0.1:6789 connect error [ 260.000199][ T8946] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 260.005821][ T8948] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 260.278544][ T8953] netlink: 8752 bytes leftover after parsing attributes in process `syz.7.956'. [ 260.957071][ T8968] syz0: rxe_newlink: already configured on bond0 [ 261.199627][ T8972] FAULT_INJECTION: forcing a failure. [ 261.199627][ T8972] name failslab, interval 1, probability 0, space 0, times 0 [ 261.199675][ T8972] CPU: 1 UID: 0 PID: 8972 Comm: syz.3.964 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 261.199718][ T8972] Tainted: [L]=SOFTLOCKUP [ 261.199727][ T8972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 261.199741][ T8972] Call Trace: [ 261.199750][ T8972] [ 261.199760][ T8972] dump_stack_lvl+0xe8/0x150 [ 261.199801][ T8972] should_fail_ex+0x46b/0x600 [ 261.199843][ T8972] should_failslab+0xa8/0x100 [ 261.199871][ T8972] __kmalloc_cache_noprof+0xa1/0x680 [ 261.199906][ T8972] ? virtio_fs_init_fs_context+0x93/0x120 [ 261.199935][ T8972] ? virtio_fs_init_fs_context+0x93/0x120 [ 261.199973][ T8972] virtio_fs_init_fs_context+0x93/0x120 [ 261.200004][ T8972] alloc_fs_context+0x9a3/0xd00 [ 261.200047][ T8972] __se_sys_fsopen+0xa5/0x2c0 [ 261.200074][ T8972] do_syscall_64+0x166/0x520 [ 261.200106][ T8972] ? trace_irq_disable+0x3b/0x140 [ 261.200135][ T8972] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.200158][ T8972] ? clear_bhb_loop+0x70/0xc0 [ 261.200184][ T8972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.200206][ T8972] RIP: 0033:0x7fcd365fe1d9 [ 261.200227][ T8972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 261.200246][ T8972] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 261.200272][ T8972] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 261.200289][ T8972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 261.200304][ T8972] RBP: 00007fcd36695888 R08: 0000000000000000 R09: 0000000000000000 [ 261.200317][ T8972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 261.200331][ T8972] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 261.200369][ T8972] [ 261.860238][ T5828] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 262.009279][ T5828] usb 4-1: Using ep0 maxpacket: 32 [ 262.365806][ T5828] usb 4-1: unable to get BOS descriptor or descriptor too short [ 262.365875][ T5828] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=27.24 [ 262.392147][ T5828] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 262.392193][ T5828] usb 4-1: can't read configurations, error -71 [ 262.661167][ T8999] syz0: rxe_newlink: already configured on bond0 [ 263.468344][ T9026] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 263.468367][ T9026] IPv6: NLM_F_CREATE should be set when creating new route [ 263.475333][ T5828] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 263.511316][ T9026] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 263.620220][ T5828] usb 4-1: Using ep0 maxpacket: 8 [ 263.623362][ T5828] usb 4-1: unable to get BOS descriptor or descriptor too short [ 263.623426][ T5828] usb 4-1: New USB device found, idVendor=05ac, idProduct=0236, bcdDevice=4b.37 [ 263.655952][ T5828] usb 4-1: config 4 has an invalid interface number: 96 but max is 0 [ 263.655984][ T5828] usb 4-1: config 4 has no interface number 0 [ 263.656018][ T5828] usb 4-1: config 4 interface 96 has no altsetting 0 [ 263.685303][ T5828] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.685337][ T5828] usb 4-1: Product: syz [ 263.685353][ T5828] usb 4-1: Manufacturer: syz [ 263.685369][ T5828] usb 4-1: SerialNumber: syz [ 264.104982][ T5828] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:4.96/input/input15 [ 264.192693][ T4942] bcm5974 4-1:4.96: could not read from device [ 264.333616][ T4942] bcm5974 4-1:4.96: could not read from device [ 264.555143][ T5828] usb 4-1: USB disconnect, device number 8 [ 264.625422][ T4942] bcm5974 4-1:4.96: could not read from device [ 264.667255][ T9048] overlayfs: failed to clone lowerpath [ 264.848908][ T8828] udevd[8828]: Error opening device "/dev/input/event4": No such file or directory [ 264.849030][ T8828] udevd[8828]: Unable to EVIOCGABS device "/dev/input/event4" [ 264.861152][ T8828] udevd[8828]: Unable to EVIOCGABS device "/dev/input/event4" [ 264.861287][ T8828] udevd[8828]: Unable to EVIOCGABS device "/dev/input/event4" [ 264.861410][ T8828] udevd[8828]: Unable to EVIOCGABS device "/dev/input/event4" [ 264.969475][ T5724] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 265.138104][ T5724] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 265.139425][ T5724] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 265.139489][ T5724] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 265.139512][ T5724] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 265.145634][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 265.145659][ T5724] usb 5-1: Product: syz [ 265.145672][ T5724] usb 5-1: Manufacturer: syz [ 265.256585][ T9046] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 265.333093][ T5724] garmin_gps 5-1:1.0: Garmin GPS usb/tty converter detected [ 265.742710][ T5724] usb 5-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 265.858355][ T5724] usb 5-1: USB disconnect, device number 10 [ 266.114701][ T5724] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 266.118535][ T5724] garmin_gps 5-1:1.0: device disconnected [ 267.283307][ T9094] FAULT_INJECTION: forcing a failure. [ 267.283307][ T9094] name failslab, interval 1, probability 0, space 0, times 0 [ 267.319251][ T9094] CPU: 0 UID: 0 PID: 9094 Comm: syz.7.1012 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 267.319291][ T9094] Tainted: [L]=SOFTLOCKUP [ 267.319299][ T9094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.319313][ T9094] Call Trace: [ 267.319323][ T9094] [ 267.319333][ T9094] dump_stack_lvl+0xe8/0x150 [ 267.319373][ T9094] should_fail_ex+0x46b/0x600 [ 267.319416][ T9094] should_failslab+0xa8/0x100 [ 267.319442][ T9094] kmem_cache_alloc_node_noprof+0xac/0x660 [ 267.319475][ T9094] ? __alloc_skb+0x1db/0x7a0 [ 267.319500][ T9094] ? __alloc_skb+0x1db/0x7a0 [ 267.319534][ T9094] __alloc_skb+0x1db/0x7a0 [ 267.319566][ T9094] tipc_msg_build+0x15f/0xf50 [ 267.319610][ T9094] ? __pfx_tipc_msg_build+0x10/0x10 [ 267.319646][ T9094] ? tipc_sk_filtering+0x13c/0x510 [ 267.319681][ T9094] __tipc_sendstream+0x8f4/0x12a0 [ 267.319752][ T9094] ? __pfx___tipc_sendstream+0x10/0x10 [ 267.319781][ T9094] ? __pfx_woken_wake_function+0x10/0x10 [ 267.319815][ T9094] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 267.319847][ T9094] ? lockdep_hardirqs_on+0x7b/0x110 [ 267.319885][ T9094] tipc_sendstream+0x55/0x70 [ 267.319913][ T9094] ? __pfx_tipc_sendstream+0x10/0x10 [ 267.319936][ T9094] sock_sendmsg_nosec+0x13a/0x180 [ 267.319963][ T9094] ____sys_sendmsg+0x565/0x870 [ 267.320006][ T9094] ? __pfx_____sys_sendmsg+0x10/0x10 [ 267.320048][ T9094] ? import_iovec+0x73/0xa0 [ 267.320079][ T9094] ___sys_sendmsg+0x2a5/0x360 [ 267.320108][ T9094] ? __lock_acquire+0x747/0x2de0 [ 267.320153][ T9094] ? __pfx____sys_sendmsg+0x10/0x10 [ 267.320189][ T9094] ? futex_wait+0x2a2/0x390 [ 267.320255][ T9094] ? __fget_files+0x2a/0x420 [ 267.320281][ T9094] ? __fget_files+0x3a8/0x420 [ 267.320321][ T9094] __x64_sys_sendmsg+0x1b7/0x290 [ 267.320357][ T9094] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 267.320433][ T9094] do_syscall_64+0x166/0x520 [ 267.320464][ T9094] ? trace_irq_disable+0x3b/0x140 [ 267.320493][ T9094] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.320517][ T9094] ? clear_bhb_loop+0x70/0xc0 [ 267.320545][ T9094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.320568][ T9094] RIP: 0033:0x7f685794e1d9 [ 267.320591][ T9094] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.320610][ T9094] RSP: 002b:00007f6855ba6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 267.320635][ T9094] RAX: ffffffffffffffda RBX: 00007f6857bd5fa0 RCX: 00007f685794e1d9 [ 267.320651][ T9094] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000004 [ 267.320666][ T9094] RBP: 00007f68579e5888 R08: 0000000000000000 R09: 0000000000000000 [ 267.320680][ T9094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.320695][ T9094] R13: 00007f6857bd6038 R14: 00007f6857bd5fa0 R15: 00007ffd02506a88 [ 267.320733][ T9094] [ 268.672538][ T1244] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 268.739323][ T10] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 268.882809][ T1244] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 268.887045][ T1244] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 268.887078][ T1244] usb 4-1: config 0 has no interface number 0 [ 268.887132][ T1244] usb 4-1: config 0 interface 41 has no altsetting 0 [ 268.931330][ T1244] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.931364][ T1244] usb 4-1: Product: syz [ 268.931381][ T1244] usb 4-1: Manufacturer: syz [ 268.931396][ T1244] usb 4-1: SerialNumber: syz [ 268.969374][ T1244] usb 4-1: config 0 descriptor?? [ 268.985898][ T10] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 268.996989][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.997053][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 268.997082][ T10] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 268.997126][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.613891][ T10] cxacru 5-1:1.0: send of cm 0x91 failed (-71) [ 269.613925][ T10] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 269.613940][ T10] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 269.734443][ T10] cxacru 5-1:1.0: probe with driver cxacru failed with error -71 [ 269.783983][ T10] usb 5-1: USB disconnect, device number 11 [ 269.834890][ T1244] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 270.038492][ T1244] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 270.038527][ T1244] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 270.061205][ T1244] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 270.093700][ T1244] usb 4-1: USB disconnect, device number 9 [ 270.127243][ T9162] netlink: 'syz.7.1043': attribute type 3 has an invalid length. [ 270.797958][ T9184] tipc: Enabling of bearer rejected, already enabled [ 271.374533][ T9176] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 271.804195][ T9205] FAULT_INJECTION: forcing a failure. [ 271.804195][ T9205] name failslab, interval 1, probability 0, space 0, times 0 [ 271.804228][ T9205] CPU: 0 UID: 0 PID: 9205 Comm: syz.3.1061 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 271.804247][ T9205] Tainted: [L]=SOFTLOCKUP [ 271.804252][ T9205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 271.804260][ T9205] Call Trace: [ 271.804265][ T9205] [ 271.804271][ T9205] dump_stack_lvl+0xe8/0x150 [ 271.804294][ T9205] should_fail_ex+0x46b/0x600 [ 271.804317][ T9205] should_failslab+0xa8/0x100 [ 271.804332][ T9205] __kmalloc_noprof+0xfb/0x790 [ 271.804351][ T9205] ? load_msg+0xd1/0x3b0 [ 271.804374][ T9205] ? load_msg+0xd1/0x3b0 [ 271.804417][ T9205] load_msg+0xd1/0x3b0 [ 271.804451][ T9205] do_msgsnd+0x1a9/0x14f0 [ 271.804482][ T9205] ? __pfx_do_futex+0x10/0x10 [ 271.804513][ T9205] ? lock_acquire+0x115/0x350 [ 271.804539][ T9205] ? __pfx_do_msgsnd+0x10/0x10 [ 271.804557][ T9205] ? __might_fault+0xaf/0x130 [ 271.804577][ T9205] ? __x64_sys_msgsnd+0xee/0x120 [ 271.804594][ T9205] do_syscall_64+0x166/0x520 [ 271.804611][ T9205] ? trace_irq_disable+0x3b/0x140 [ 271.804628][ T9205] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.804640][ T9205] ? clear_bhb_loop+0x70/0xc0 [ 271.804656][ T9205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.804668][ T9205] RIP: 0033:0x7fcd365fe1d9 [ 271.804681][ T9205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.804692][ T9205] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000045 [ 271.804707][ T9205] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 271.804717][ T9205] RDX: 0000000000002000 RSI: 0000200000000040 RDI: 0000000000000000 [ 271.804725][ T9205] RBP: 00007fcd36695888 R08: 0000000000000000 R09: 0000000000000000 [ 271.804732][ T9205] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 [ 271.804740][ T9205] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 271.804759][ T9205] [ 271.830748][ T1244] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 272.192506][ T1244] usb 8-1: Using ep0 maxpacket: 16 [ 272.193414][ T1244] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 272.214819][ T1244] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 272.214857][ T1244] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 272.217460][ T1244] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.217486][ T1244] usb 8-1: Product: syz [ 272.217502][ T1244] usb 8-1: Manufacturer: syz [ 272.217517][ T1244] usb 8-1: SerialNumber: syz [ 272.283821][ T1244] usb 8-1: config 0 descriptor?? [ 272.303510][ T1244] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 272.303548][ T1244] em28xx 8-1:0.0: Audio interface 0 found (Vendor Class) [ 272.861595][ T9221] bridge1: entered allmulticast mode [ 272.970746][ T1244] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 272.974018][ T1244] em28xx 8-1:0.0: Config register raw data: 0xfffffffb [ 273.176681][ T1244] em28xx 8-1:0.0: AC97 chip type couldn't be determined [ 273.176708][ T1244] em28xx 8-1:0.0: No AC97 audio processor [ 273.217130][ T1244] usb 8-1: USB disconnect, device number 8 [ 273.231575][ T1244] em28xx 8-1:0.0: Disconnecting em28xx [ 273.341362][ T1244] em28xx: Freeing device [ 274.165133][ T9248] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1077'. [ 274.165165][ T9248] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1077'. [ 275.308156][ T9269] netlink: 'syz.7.1085': attribute type 22 has an invalid length. [ 275.308183][ T9269] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1085'. [ 275.359948][ T9269] netlink: 'syz.7.1085': attribute type 22 has an invalid length. [ 275.359976][ T9269] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1085'. [ 275.372072][ T8228] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.373905][ T2958] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.373958][ T2958] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 275.373994][ T2958] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 277.139217][ T9294] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1095'. [ 277.201548][ T9274] syz.7.1087 (9274): drop_caches: 2 [ 277.740256][ T36] audit: type=1326 audit(1791608693.877:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.743757][ T36] audit: type=1326 audit(1791608693.887:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.823494][ T36] audit: type=1326 audit(1791608693.967:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.823808][ T36] audit: type=1326 audit(1791608693.967:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.828050][ T36] audit: type=1326 audit(1791608693.967:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fdb3431aed1 code=0x7ffc0000 [ 277.828104][ T36] audit: type=1326 audit(1791608693.967:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7fdb3435efc9 code=0x7ffc0000 [ 277.828143][ T36] audit: type=1326 audit(1791608693.967:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fdb3431af3b code=0x7ffc0000 [ 277.828181][ T36] audit: type=1326 audit(1791608693.967:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.828220][ T36] audit: type=1326 audit(1791608693.967:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdb3435e1d9 code=0x7ffc0000 [ 277.828258][ T36] audit: type=1326 audit(1791608693.967:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9310 comm="syz.0.1103" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fdb3431a62c code=0x7ffc0000 [ 278.171045][ T9328] FAULT_INJECTION: forcing a failure. [ 278.171045][ T9328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 278.171089][ T9328] CPU: 0 UID: 0 PID: 9328 Comm: syz.4.1105 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 278.171121][ T9328] Tainted: [L]=SOFTLOCKUP [ 278.171129][ T9328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 278.171143][ T9328] Call Trace: [ 278.171152][ T9328] [ 278.171163][ T9328] dump_stack_lvl+0xe8/0x150 [ 278.171204][ T9328] should_fail_ex+0x46b/0x600 [ 278.171246][ T9328] _copy_from_user+0x2d/0xb0 [ 278.171272][ T9328] vhost_net_ioctl+0xbd9/0x17e0 [ 278.171307][ T9328] ? smack_file_ioctl+0x265/0x370 [ 278.171337][ T9328] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 278.171378][ T9328] ? __fget_files+0x2a/0x420 [ 278.171405][ T9328] ? __fget_files+0x3a8/0x420 [ 278.171430][ T9328] ? __fget_files+0x2a/0x420 [ 278.171462][ T9328] ? bpf_lsm_file_ioctl+0x9/0x20 [ 278.171491][ T9328] ? __pfx_vhost_net_ioctl+0x10/0x10 [ 278.171521][ T9328] __se_sys_ioctl+0xff/0x170 [ 278.171560][ T9328] do_syscall_64+0x166/0x520 [ 278.171591][ T9328] ? trace_irq_disable+0x3b/0x140 [ 278.171622][ T9328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.171645][ T9328] ? clear_bhb_loop+0x70/0xc0 [ 278.171673][ T9328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.171696][ T9328] RIP: 0033:0x7fd78480e1d9 [ 278.171717][ T9328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.171737][ T9328] RSP: 002b:00007fd782a66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 278.171763][ T9328] RAX: ffffffffffffffda RBX: 00007fd784a95fa0 RCX: 00007fd78480e1d9 [ 278.171780][ T9328] RDX: 0000200000000000 RSI: 000000004008af83 RDI: 0000000000000004 [ 278.171795][ T9328] RBP: 00007fd7848a5888 R08: 0000000000000000 R09: 0000000000000000 [ 278.171810][ T9328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 278.171834][ T9328] R13: 00007fd784a96038 R14: 00007fd784a95fa0 R15: 00007ffff494a348 [ 278.171872][ T9328] [ 278.640140][ T60] Bluetooth: hci4: unexpected event for opcode 0x2005 [ 278.678325][ T9343] FAULT_INJECTION: forcing a failure. [ 278.678325][ T9343] name failslab, interval 1, probability 0, space 0, times 0 [ 278.678374][ T9343] CPU: 1 UID: 0 PID: 9343 Comm: syz.4.1114 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 278.678405][ T9343] Tainted: [L]=SOFTLOCKUP [ 278.678414][ T9343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 278.678426][ T9343] Call Trace: [ 278.678435][ T9343] [ 278.678445][ T9343] dump_stack_lvl+0xe8/0x150 [ 278.678486][ T9343] should_fail_ex+0x46b/0x600 [ 278.678525][ T9343] ? __d_alloc+0x37/0x6f0 [ 278.678555][ T9343] should_failslab+0xa8/0x100 [ 278.678586][ T9343] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 278.678622][ T9343] ? __d_alloc+0x37/0x6f0 [ 278.678657][ T9343] __d_alloc+0x37/0x6f0 [ 278.678692][ T9343] d_alloc_pseudo+0x21/0xc0 [ 278.678723][ T9343] alloc_path_pseudo+0x107/0x220 [ 278.678752][ T9343] ? __pfx_alloc_path_pseudo+0x10/0x10 [ 278.678788][ T9343] alloc_file_pseudo_noaccount+0xad/0x2b0 [ 278.678818][ T9343] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 278.678841][ T9343] ? iput+0x456/0xf00 [ 278.678881][ T9343] bdev_file_open_by_dev+0x181/0x240 [ 278.678912][ T9343] setup_bdev_super+0x5a/0x680 [ 278.678948][ T9343] get_tree_bdev_flags+0x388/0x4f0 [ 278.678979][ T9343] ? __pfx_xfs_fs_fill_super+0x10/0x10 [ 278.679004][ T9343] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 278.679039][ T9343] ? safesetid_security_capable+0xa9/0x1a0 [ 278.679077][ T9343] vfs_get_tree+0x92/0x2a0 [ 278.679109][ T9343] do_new_mount+0x325/0xb00 [ 278.679133][ T9343] ? cap_capable+0x123/0x460 [ 278.679169][ T9343] ? __pfx_do_new_mount+0x10/0x10 [ 278.679198][ T9343] ? ns_capable+0x89/0xe0 [ 278.679231][ T9343] ? path_mount+0x647/0x1050 [ 278.679260][ T9343] ? user_path_at+0xd4/0x160 [ 278.679291][ T9343] __se_sys_mount+0x31d/0x420 [ 278.679334][ T9343] ? __pfx___se_sys_mount+0x10/0x10 [ 278.679371][ T9343] ? __x64_sys_mount+0x20/0xc0 [ 278.679402][ T9343] do_syscall_64+0x166/0x520 [ 278.679433][ T9343] ? trace_irq_disable+0x3b/0x140 [ 278.679463][ T9343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.679487][ T9343] ? clear_bhb_loop+0x70/0xc0 [ 278.679517][ T9343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.679540][ T9343] RIP: 0033:0x7fd78480e1d9 [ 278.679562][ T9343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.679583][ T9343] RSP: 002b:00007fd782a66028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 278.679609][ T9343] RAX: ffffffffffffffda RBX: 00007fd784a95fa0 RCX: 00007fd78480e1d9 [ 278.679627][ T9343] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000140 [ 278.679643][ T9343] RBP: 00007fd7848a5888 R08: 0000000000000000 R09: 0000000000000000 [ 278.679658][ T9343] R10: 0000000000200001 R11: 0000000000000246 R12: 0000000000000000 [ 278.679672][ T9343] R13: 00007fd784a96038 R14: 00007fd784a95fa0 R15: 00007ffff494a348 [ 278.679709][ T9343] [ 278.717524][ T9343] /dev/nullb0: Can't open blockdev [ 279.014697][ T9353] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1116'. [ 279.600699][ T9382] netlink: 'syz.5.1128': attribute type 2 has an invalid length. [ 279.600728][ T9382] netlink: 'syz.5.1128': attribute type 8 has an invalid length. [ 279.600742][ T9382] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1128'. [ 279.688351][ T9388] netlink: 'syz.5.1128': attribute type 2 has an invalid length. [ 279.688376][ T9388] netlink: 'syz.5.1128': attribute type 8 has an invalid length. [ 279.688391][ T9388] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1128'. [ 279.941720][ T9396] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1130'. [ 280.491894][ T9411] FAULT_INJECTION: forcing a failure. [ 280.491894][ T9411] name fail_futex, interval 1, probability 0, space 0, times 0 [ 280.491937][ T9411] CPU: 0 UID: 0 PID: 9411 Comm: syz.7.1135 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 280.491966][ T9411] Tainted: [L]=SOFTLOCKUP [ 280.491974][ T9411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.491987][ T9411] Call Trace: [ 280.491994][ T9411] [ 280.492003][ T9411] dump_stack_lvl+0xe8/0x150 [ 280.492047][ T9411] should_fail_ex+0x46b/0x600 [ 280.492088][ T9411] get_futex_key+0x8e2/0x1580 [ 280.492135][ T9411] ? __pfx_get_futex_key+0x10/0x10 [ 280.492182][ T9411] futex_wake+0x119/0x600 [ 280.492210][ T9411] ? __pfx_futex_wait+0x10/0x10 [ 280.492237][ T9411] ? __pfx_futex_wake+0x10/0x10 [ 280.492283][ T9411] do_futex+0x458/0x4e0 [ 280.492311][ T9411] ? __pfx_do_futex+0x10/0x10 [ 280.492353][ T9411] __se_sys_futex+0x3a8/0x450 [ 280.492386][ T9411] ? __pfx___se_sys_futex+0x10/0x10 [ 280.492410][ T9411] ? rcu_is_watching+0x16/0xb0 [ 280.492440][ T9411] ? __x64_sys_futex+0x21/0xf0 [ 280.492465][ T9411] do_syscall_64+0x166/0x520 [ 280.492494][ T9411] ? trace_irq_disable+0x3b/0x140 [ 280.492523][ T9411] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.492543][ T9411] ? clear_bhb_loop+0x70/0xc0 [ 280.492569][ T9411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.492590][ T9411] RIP: 0033:0x7f685794e1d9 [ 280.492612][ T9411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.492630][ T9411] RSP: 002b:00007f6855ba6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 280.492656][ T9411] RAX: ffffffffffffffda RBX: 00007f6857bd5fa0 RCX: 00007f685794e1d9 [ 280.492672][ T9411] RDX: 0000000000000002 RSI: 0000000000000001 RDI: 0000000000000000 [ 280.492685][ T9411] RBP: 00007f68579e5888 R08: 0000000000000000 R09: 0000000000000000 [ 280.492698][ T9411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.492712][ T9411] R13: 00007f6857bd6038 R14: 00007f6857bd5fa0 R15: 00007ffd02506a88 [ 280.492751][ T9411] [ 282.349636][ T5724] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 282.629305][ T5724] usb 8-1: Using ep0 maxpacket: 16 [ 282.630445][ T5724] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 282.632703][ T5724] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.636796][ T5724] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.636824][ T5724] usb 8-1: Product: syz [ 282.636839][ T5724] usb 8-1: Manufacturer: syz [ 282.636854][ T5724] usb 8-1: SerialNumber: syz [ 283.773469][ T5724] cdc_ncm 8-1:1.0: bind() failure [ 283.816903][ T5724] cdc_ncm 8-1:1.1: probe with driver cdc_ncm failed with error -71 [ 283.821676][ T5724] cdc_mbim 8-1:1.1: probe with driver cdc_mbim failed with error -71 [ 283.824778][ T5724] usbtest 8-1:1.1: probe with driver usbtest failed with error -71 [ 283.888984][ T5724] usb 8-1: USB disconnect, device number 9 [ 285.348669][ T9521] io-wq is not configured for unbound workers [ 285.361676][ T9496] syz.4.1168 (9496) used greatest stack depth: 17688 bytes left [ 288.596063][ T9577] fuse: fd is not a fuse device [ 288.801853][ T5594] Bluetooth: hci1: command 0x0406 tx timeout [ 289.061697][ T9597] FAULT_INJECTION: forcing a failure. [ 289.061697][ T9597] name failslab, interval 1, probability 0, space 0, times 0 [ 289.061741][ T9597] CPU: 0 UID: 0 PID: 9597 Comm: syz.4.1204 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 289.061772][ T9597] Tainted: [L]=SOFTLOCKUP [ 289.061781][ T9597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 289.061795][ T9597] Call Trace: [ 289.061804][ T9597] [ 289.061815][ T9597] dump_stack_lvl+0xe8/0x150 [ 289.061856][ T9597] should_fail_ex+0x46b/0x600 [ 289.061901][ T9597] should_failslab+0xa8/0x100 [ 289.061933][ T9597] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 289.061970][ T9597] ? kasprintf+0xe2/0x140 [ 289.061994][ T9597] ? kasprintf+0xe2/0x140 [ 289.062027][ T9597] kvasprintf+0xeb/0x1a0 [ 289.062050][ T9597] ? stack_depot_save_flags+0x33/0x7f0 [ 289.062075][ T9597] ? __pfx_kvasprintf+0x10/0x10 [ 289.062102][ T9597] ? kasan_save_track+0x4f/0x80 [ 289.062134][ T9597] ? kasan_save_track+0x3e/0x80 [ 289.062164][ T9597] ? __kasan_kmalloc+0x93/0xb0 [ 289.062183][ T9597] ? __kmalloc_node_track_caller_noprof+0x56e/0x7b0 [ 289.062217][ T9597] ? memdup_user_nul+0x2c/0x110 [ 289.062254][ T9597] kasprintf+0xe2/0x140 [ 289.062287][ T9597] ? __pfx_kasprintf+0x10/0x10 [ 289.062330][ T9597] logfc+0x15b/0x520 [ 289.062373][ T9597] ? __pfx_logfc+0x10/0x10 [ 289.062404][ T9597] ? cgroup2_parse_param+0x116/0x200 [ 289.062430][ T9597] ? __pfx_cgroup2_parse_param+0x10/0x10 [ 289.062463][ T9597] ? static_key_count+0x41/0x70 [ 289.062501][ T9597] vfs_parse_fs_param+0x298/0x420 [ 289.062537][ T9597] __se_sys_fsconfig+0x6bf/0x810 [ 289.062569][ T9597] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 289.062596][ T9597] ? rcu_is_watching+0x16/0xb0 [ 289.062627][ T9597] ? __x64_sys_fsconfig+0x20/0xc0 [ 289.062652][ T9597] do_syscall_64+0x166/0x520 [ 289.062692][ T9597] ? trace_irq_disable+0x3b/0x140 [ 289.062721][ T9597] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.062742][ T9597] ? clear_bhb_loop+0x70/0xc0 [ 289.062770][ T9597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.062792][ T9597] RIP: 0033:0x7fd78480e1d9 [ 289.062812][ T9597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 289.062830][ T9597] RSP: 002b:00007fd782a66028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 289.062853][ T9597] RAX: ffffffffffffffda RBX: 00007fd784a95fa0 RCX: 00007fd78480e1d9 [ 289.062868][ T9597] RDX: 0000200000000180 RSI: 0000000000000002 RDI: 0000000000000003 [ 289.062882][ T9597] RBP: 00007fd7848a5888 R08: 0000000000000001 R09: 0000000000000000 [ 289.062895][ T9597] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 289.062907][ T9597] R13: 00007fd784a96038 R14: 00007fd784a95fa0 R15: 00007ffff494a348 [ 289.062937][ T9597] [ 289.891282][ T9] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 290.039287][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 290.040209][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 290.072179][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.072212][ T9] usb 4-1: Product: syz [ 290.072228][ T9] usb 4-1: Manufacturer: syz [ 290.072243][ T9] usb 4-1: SerialNumber: syz [ 290.122354][ T9] usb 4-1: config 0 descriptor?? [ 290.344140][ T9] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 290.939218][ T5708] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 291.090482][ T5708] usb 8-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice= 0.40 [ 291.092161][ T5708] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 291.092221][ T5708] usb 8-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 291.096089][ T5708] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.096116][ T5708] usb 8-1: Product: syz [ 291.096132][ T5708] usb 8-1: Manufacturer: syz [ 291.096148][ T5708] usb 8-1: SerialNumber: syz [ 291.466921][ T9] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 291.534399][ T9] usb 4-1: USB disconnect, device number 10 [ 291.641485][ T5708] usb 8-1: Can't get UAC3 power state for id 10 [ 291.765589][ T5708] usb 8-1: 2:1 : incorrect wMaxPacketSize for BADD profile [ 291.766863][ T5708] usb 8-1: 0:3 : does not exist [ 291.766887][ T5708] usb 8-1: 0:4 : does not exist [ 291.766904][ T5708] usb 8-1: 0:5 : does not exist [ 291.766993][ T5708] usb 8-1: incorrect wMaxPacketSize 0x200 for BADD profile [ 293.136131][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 293.136154][ T36] audit: type=1326 audit(1791608709.247:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9663 comm="syz.5.1228" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc6d203e1d9 code=0x0 [ 293.912485][ T9685] FAULT_INJECTION: forcing a failure. [ 293.912485][ T9685] name failslab, interval 1, probability 0, space 0, times 0 [ 293.912530][ T9685] CPU: 0 UID: 0 PID: 9685 Comm: syz.7.1234 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 293.912562][ T9685] Tainted: [L]=SOFTLOCKUP [ 293.912571][ T9685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 293.912585][ T9685] Call Trace: [ 293.912594][ T9685] [ 293.912604][ T9685] dump_stack_lvl+0xe8/0x150 [ 293.912643][ T9685] should_fail_ex+0x46b/0x600 [ 293.912692][ T9685] ? alloc_inode+0xb8/0x1b0 [ 293.912719][ T9685] should_failslab+0xa8/0x100 [ 293.912746][ T9685] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 293.912779][ T9685] ? alloc_inode+0xb8/0x1b0 [ 293.912811][ T9685] alloc_inode+0xb8/0x1b0 [ 293.912837][ T9685] new_inode+0x1f/0x170 [ 293.912867][ T9685] binderfs_fill_super+0x54b/0x1000 [ 293.912897][ T9685] ? __init_swait_queue_head+0xa8/0x150 [ 293.912926][ T9685] ? __pfx_binderfs_fill_super+0x10/0x10 [ 293.912982][ T9685] ? vfs_parse_monolithic_sep+0xd0/0x360 [ 293.913014][ T9685] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 293.913044][ T9685] ? vfs_parse_fs_qstr+0x163/0x1e0 [ 293.913078][ T9685] ? rcu_is_watching+0x16/0xb0 [ 293.913105][ T9685] ? cap_capable+0x123/0x460 [ 293.913137][ T9685] ? __pfx_binderfs_fill_super+0x10/0x10 [ 293.913160][ T9685] get_tree_nodev+0xbb/0x150 [ 293.913191][ T9685] vfs_get_tree+0x92/0x2a0 [ 293.913225][ T9685] do_new_mount+0x325/0xb00 [ 293.913250][ T9685] ? cap_capable+0x123/0x460 [ 293.913286][ T9685] ? __pfx_do_new_mount+0x10/0x10 [ 293.913316][ T9685] ? ns_capable+0x89/0xe0 [ 293.913348][ T9685] ? path_mount+0x647/0x1050 [ 293.913378][ T9685] ? user_path_at+0xd4/0x160 [ 293.913412][ T9685] __se_sys_mount+0x31d/0x420 [ 293.913445][ T9685] ? __pfx___se_sys_mount+0x10/0x10 [ 293.913480][ T9685] ? __x64_sys_mount+0x20/0xc0 [ 293.913507][ T9685] do_syscall_64+0x166/0x520 [ 293.913535][ T9685] ? trace_irq_disable+0x3b/0x140 [ 293.913564][ T9685] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.913586][ T9685] ? clear_bhb_loop+0x70/0xc0 [ 293.913612][ T9685] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.913635][ T9685] RIP: 0033:0x7f685794e1d9 [ 293.913655][ T9685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.913684][ T9685] RSP: 002b:00007f6855ba6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 293.913711][ T9685] RAX: ffffffffffffffda RBX: 00007f6857bd5fa0 RCX: 00007f685794e1d9 [ 293.913728][ T9685] RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000200000000080 [ 293.913745][ T9685] RBP: 00007f68579e5888 R08: 0000000000000000 R09: 0000000000000000 [ 293.913760][ T9685] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 293.913775][ T9685] R13: 00007f6857bd6038 R14: 00007f6857bd5fa0 R15: 00007ffd02506a88 [ 293.913813][ T9685] [ 295.009006][ T5708] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 295.125934][ T5708] usb 8-1: USB disconnect, device number 10 [ 295.326266][ T9711] udevd[9711]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.742511][ T9725] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1249'. [ 296.466451][ T36] audit: type=1326 audit(1791608712.607:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.466514][ T36] audit: type=1326 audit(1791608712.607:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.535465][ T36] audit: type=1326 audit(1791608712.677:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.535530][ T36] audit: type=1326 audit(1791608712.677:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.535578][ T36] audit: type=1326 audit(1791608712.677:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.545760][ T36] audit: type=1326 audit(1791608712.687:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.545814][ T36] audit: type=1326 audit(1791608712.687:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.545856][ T36] audit: type=1326 audit(1791608712.687:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.548683][ T36] audit: type=1326 audit(1791608712.687:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9743 comm="syz.4.1256" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd78480e1d9 code=0x7ffc0000 [ 296.881052][ T9752] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1258'. [ 296.978192][ T9759] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1258'. [ 297.028816][ T9757] IPv4: Oversized IP packet from 127.202.26.0 [ 297.430903][ T9767] FAULT_INJECTION: forcing a failure. [ 297.430903][ T9767] name failslab, interval 1, probability 0, space 0, times 0 [ 297.430950][ T9767] CPU: 0 UID: 0 PID: 9767 Comm: syz.7.1262 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 297.430982][ T9767] Tainted: [L]=SOFTLOCKUP [ 297.430990][ T9767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.431003][ T9767] Call Trace: [ 297.431012][ T9767] [ 297.431022][ T9767] dump_stack_lvl+0xe8/0x150 [ 297.431063][ T9767] should_fail_ex+0x46b/0x600 [ 297.431107][ T9767] should_failslab+0xa8/0x100 [ 297.431135][ T9767] __kmalloc_noprof+0xfb/0x790 [ 297.431169][ T9767] ? __memcg_list_lru_alloc+0x211/0x830 [ 297.431192][ T9767] ? __memcg_list_lru_alloc+0x211/0x830 [ 297.431223][ T9767] __memcg_list_lru_alloc+0x211/0x830 [ 297.431246][ T9767] ? xa_load+0x60/0x210 [ 297.431289][ T9767] ? __pfx___memcg_list_lru_alloc+0x10/0x10 [ 297.431313][ T9767] ? xa_load+0x60/0x210 [ 297.431375][ T9767] __memcg_slab_post_alloc_hook+0x407/0xde0 [ 297.431415][ T9767] ? __memcg_slab_post_alloc_hook+0x24b/0xde0 [ 297.431465][ T9767] ? alloc_inode+0xb8/0x1b0 [ 297.431491][ T9767] kmem_cache_alloc_lru_noprof+0x41c/0x680 [ 297.431527][ T9767] ? alloc_inode+0xb8/0x1b0 [ 297.431551][ T9767] ? alloc_inode+0xb8/0x1b0 [ 297.431584][ T9767] alloc_inode+0xb8/0x1b0 [ 297.431612][ T9767] new_inode+0x1f/0x170 [ 297.431643][ T9767] devpts_fill_super+0x145/0x520 [ 297.431671][ T9767] ? cap_capable+0x123/0x460 [ 297.431715][ T9767] ? __pfx_devpts_fill_super+0x10/0x10 [ 297.431746][ T9767] get_tree_nodev+0xbb/0x150 [ 297.431780][ T9767] vfs_get_tree+0x92/0x2a0 [ 297.431815][ T9767] vfs_cmd_create+0xa2/0x200 [ 297.431842][ T9767] __se_sys_fsconfig+0x6bf/0x810 [ 297.431872][ T9767] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 297.431899][ T9767] ? rcu_is_watching+0x16/0xb0 [ 297.431931][ T9767] ? __x64_sys_fsconfig+0x20/0xc0 [ 297.431957][ T9767] do_syscall_64+0x166/0x520 [ 297.431987][ T9767] ? trace_irq_disable+0x3b/0x140 [ 297.432018][ T9767] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.432041][ T9767] ? clear_bhb_loop+0x70/0xc0 [ 297.432070][ T9767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 297.432092][ T9767] RIP: 0033:0x7f685794e1d9 [ 297.432115][ T9767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.432135][ T9767] RSP: 002b:00007f6855ba6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 297.432161][ T9767] RAX: ffffffffffffffda RBX: 00007f6857bd5fa0 RCX: 00007f685794e1d9 [ 297.432178][ T9767] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 297.432192][ T9767] RBP: 00007f68579e5888 R08: 0000000000000000 R09: 0000000000000000 [ 297.432204][ T9767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 297.432215][ T9767] R13: 00007f6857bd6038 R14: 00007f6857bd5fa0 R15: 00007ffd02506a88 [ 297.432253][ T9767] [ 298.259444][ T9782] netlink: 'syz.4.1267': attribute type 1 has an invalid length. [ 298.355293][ T9782] bond2: entered promiscuous mode [ 298.356516][ T9782] 8021q: adding VLAN 0 to HW filter on device bond2 [ 298.391362][ T5724] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 298.574273][ T5724] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 298.605750][ T5724] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.605783][ T5724] usb 4-1: Product: syz [ 298.605798][ T5724] usb 4-1: Manufacturer: syz [ 298.605813][ T5724] usb 4-1: SerialNumber: syz [ 298.656508][ T5724] usb 4-1: config 0 descriptor?? [ 298.920791][ T5724] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 299.259219][ T5708] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 299.439236][ T5708] usb 5-1: Using ep0 maxpacket: 32 [ 299.440627][ T5708] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 299.443176][ T5708] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 299.443205][ T5708] usb 5-1: config 0 has no interface number 0 [ 299.443325][ T5708] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 299.495227][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.495257][ T5708] usb 5-1: Product: syz [ 299.495328][ T5708] usb 5-1: Manufacturer: syz [ 299.495343][ T5708] usb 5-1: SerialNumber: syz [ 299.871503][ T5708] usb 5-1: config 0 descriptor?? [ 299.883442][ T9788] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 300.043111][ T9793] vlan2: entered promiscuous mode [ 300.043231][ T9793] bond0: entered promiscuous mode [ 300.043275][ T9793] bond_slave_0: entered promiscuous mode [ 300.043801][ T9793] bond_slave_1: entered promiscuous mode [ 300.163193][ T5724] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 300.173513][ T9793] vlan2: entered allmulticast mode [ 300.173535][ T9793] bond0: entered allmulticast mode [ 300.173547][ T9793] bond_slave_0: entered allmulticast mode [ 300.173572][ T9793] bond_slave_1: entered allmulticast mode [ 300.276662][ T9788] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 300.333243][ T9797] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1273'. [ 300.405209][ T5724] usb 4-1: USB disconnect, device number 11 [ 301.551445][ T5708] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 301.551482][ T5708] asix 5-1:0.188 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x00b0: ffffffb9 [ 301.571816][ T5708] asix 5-1:0.188: probe with driver asix failed with error -71 [ 301.703723][ T5708] usb 5-1: USB disconnect, device number 12 [ 303.880962][ T7937] tipc: Resetting bearer [ 304.291035][ T7937] tipc: Disabling bearer [ 304.781857][ T5708] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 304.929776][ T5708] usb 5-1: Using ep0 maxpacket: 32 [ 304.930739][ T5708] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 304.932345][ T5708] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 304.932370][ T5708] usb 5-1: config 0 has no interface number 0 [ 304.935489][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.935515][ T5708] usb 5-1: Product: syz [ 304.935529][ T5708] usb 5-1: Manufacturer: syz [ 304.935543][ T5708] usb 5-1: SerialNumber: syz [ 305.046917][ T5708] usb 5-1: config 0 descriptor?? [ 305.477913][ T9864] mmap: syz.3.1300 (9864) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 305.530911][ T5708] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 305.530943][ T5708] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 305.949723][ T5708] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 305.950076][ T5708] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 306.008550][ T5708] usb 5-1: USB disconnect, device number 13 [ 306.895971][ T5594] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 307.028968][ T5594] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 307.057001][ T5594] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 307.063924][ T5594] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 307.089004][ T5594] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 307.127335][ T8236] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 307.127376][ T8236] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.464082][ T8236] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.464121][ T8236] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.294253][ T8236] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.294295][ T8236] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.429426][ T60] Bluetooth: hci1: command tx timeout [ 310.135907][ T8236] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.135949][ T8236] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.509456][ T60] Bluetooth: hci1: command tx timeout [ 313.599618][ T60] Bluetooth: hci1: command tx timeout [ 314.100127][ T8236] bridge_slave_1: left allmulticast mode [ 314.100167][ T8236] bridge_slave_1: left promiscuous mode [ 314.138810][ T8236] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.416804][ T8236] bridge_slave_0: left allmulticast mode [ 314.416845][ T8236] bridge_slave_0: left promiscuous mode [ 314.417151][ T8236] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.467030][ T9998] sock: sock_set_timeout: `syz.4.1347' (pid 9998) tries to set negative timeout [ 314.471748][ T1237] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 314.619243][ T1237] usb 4-1: Using ep0 maxpacket: 32 [ 314.620389][ T1237] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 314.622159][ T1237] usb 4-1: config 0 has no interfaces? [ 314.654663][ T1237] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.654813][ T1237] usb 4-1: Product: syz [ 314.654832][ T1237] usb 4-1: Manufacturer: syz [ 314.654847][ T1237] usb 4-1: SerialNumber: syz [ 314.694434][ T1237] usb 4-1: config 0 descriptor?? [ 314.960874][ T49] usb 4-1: USB disconnect, device number 12 [ 315.174337][T10011] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1352'. [ 315.670791][ T60] Bluetooth: hci1: command tx timeout [ 317.145108][ T8236] team0: Port device bridge0 removed [ 317.435782][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.435867][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.693752][ T8236] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 317.730623][ T8236] bond_slave_0: left promiscuous mode [ 317.730934][ T8236] bond_slave_0: left allmulticast mode [ 317.780701][ T8236] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 317.832152][ T8236] bond_slave_1: left promiscuous mode [ 317.832400][ T8236] bond_slave_1: left allmulticast mode [ 317.835107][ T8236] bond0 (unregistering): Released all slaves [ 317.967044][T10011] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 317.988078][T10021] mac80211_hwsim hwsim11 ..ãc¤±: renamed from wlan1 (while UP) [ 318.234566][T10050] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1368'. [ 318.360646][T10051] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1368'. [ 318.730579][T10050] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.029483][ T8236] tipc: Left network mode [ 319.750580][T10089] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 320.594539][ T5252] 8021q: adding VLAN 0 to HW filter on device eth13 [ 322.106685][T10147] FAULT_INJECTION: forcing a failure. [ 322.106685][T10147] name failslab, interval 1, probability 0, space 0, times 0 [ 322.106732][T10147] CPU: 0 UID: 0 PID: 10147 Comm: syz.3.1396 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 322.106766][T10147] Tainted: [L]=SOFTLOCKUP [ 322.106775][T10147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.106788][T10147] Call Trace: [ 322.106797][T10147] [ 322.106807][T10147] dump_stack_lvl+0xe8/0x150 [ 322.106848][T10147] should_fail_ex+0x46b/0x600 [ 322.106891][T10147] should_failslab+0xa8/0x100 [ 322.106915][T10147] ? __kernfs_new_node+0xe7/0xa70 [ 322.106948][T10147] kmem_cache_alloc_noprof+0x9e/0x690 [ 322.106982][T10147] ? __kernfs_new_node+0xe7/0xa70 [ 322.107023][T10147] __kernfs_new_node+0xe7/0xa70 [ 322.107059][T10147] ? wake_up_q+0x99/0xd0 [ 322.107095][T10147] ? __pfx___kernfs_new_node+0x10/0x10 [ 322.107128][T10147] ? kernfs_root+0x1c/0x230 [ 322.107167][T10147] ? kernfs_root+0x1c/0x230 [ 322.107197][T10147] ? kernfs_root+0x1c/0x230 [ 322.107225][T10147] ? kernfs_root+0x1c/0x230 [ 322.107262][T10147] kernfs_new_node+0xea/0x140 [ 322.107301][T10147] __kernfs_create_file+0x4b/0x2e0 [ 322.107330][T10147] sysfs_add_file_mode_ns+0x237/0x300 [ 322.107368][T10147] internal_create_group+0x679/0x1180 [ 322.107425][T10147] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 322.107462][T10147] ? __pfx_internal_create_group+0x10/0x10 [ 322.107498][T10147] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 322.107530][T10147] ? up_write+0x5a/0x190 [ 322.107558][T10147] sysfs_create_groups+0x59/0x120 [ 322.107594][T10147] device_add_attrs+0xde/0x600 [ 322.107624][T10147] ? __pfx_device_add_attrs+0x10/0x10 [ 322.107655][T10147] ? device_add_class_symlinks+0x222/0x240 [ 322.107688][T10147] device_add+0x488/0xb80 [ 322.107717][T10147] netdev_register_kobject+0x197/0x350 [ 322.107747][T10147] register_netdevice+0x1455/0x1ed0 [ 322.107797][T10147] ? __pfx_register_netdevice+0x10/0x10 [ 322.107827][T10147] ? alloc_netdev_mqs+0xd59/0x12c0 [ 322.107865][T10147] ? alloc_netdev_mqs+0xf0e/0x12c0 [ 322.107895][T10147] ? __ip_tunnel_create+0x3bb/0x550 [ 322.107923][T10147] __ip_tunnel_create+0x3e8/0x550 [ 322.107950][T10147] ? __pfx___ip_tunnel_create+0x10/0x10 [ 322.107974][T10147] ? bpf_lsm_capable+0x9/0x20 [ 322.108016][T10147] ip_tunnel_ctl+0x4fc/0xc50 [ 322.108057][T10147] vif_add+0x372/0x1690 [ 322.108100][T10147] ? __pfx_vif_add+0x10/0x10 [ 322.108131][T10147] ? lock_acquire+0x115/0x350 [ 322.108196][T10147] ip_mroute_setsockopt+0xf8a/0x10d0 [ 322.108234][T10147] ? __pfx_ip_mroute_setsockopt+0x10/0x10 [ 322.108280][T10147] ? __lock_acquire+0x747/0x2de0 [ 322.108317][T10147] do_ip_setsockopt+0xeba/0x2e30 [ 322.108351][T10147] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 322.108374][T10147] ? do_futex+0x458/0x4e0 [ 322.108414][T10147] ? lock_acquire+0x115/0x350 [ 322.108456][T10147] ? __fget_files+0x2a/0x420 [ 322.108489][T10147] ip_setsockopt+0x66/0x110 [ 322.108512][T10147] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 322.108541][T10147] do_sock_setsockopt+0x17c/0x1b0 [ 322.108577][T10147] __x64_sys_setsockopt+0x143/0x1b0 [ 322.108614][T10147] do_syscall_64+0x166/0x520 [ 322.108645][T10147] ? trace_irq_disable+0x3b/0x140 [ 322.108677][T10147] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.108700][T10147] ? clear_bhb_loop+0x70/0xc0 [ 322.108728][T10147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.108751][T10147] RIP: 0033:0x7fcd365fe1d9 [ 322.108774][T10147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.108793][T10147] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 322.108820][T10147] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 322.108837][T10147] RDX: 00000000000000ca RSI: 0000000000000000 RDI: 0000000000000003 [ 322.108852][T10147] RBP: 00007fcd36695888 R08: 0000000000000010 R09: 0000000000000000 [ 322.108867][T10147] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000000 [ 322.108881][T10147] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 322.108918][T10147] [ 323.503268][T10154] cgroup: fork rejected by pids controller in /syz4 [ 324.187668][ T1237] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 324.345006][ T1237] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 324.352030][ T1237] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 324.352060][ T1237] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 324.352097][ T1237] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.426265][ T1237] usb 4-1: probing VID:PID(0424:012C) [ 324.536767][ T1237] usb 4-1: vub300 testing BULK IN EndPoint(0) 81 [ 324.536798][ T1237] usb 4-1: vub300 testing BULK OUT EndPoint(1) 02 [ 324.536819][ T1237] usb 4-1: vub300 testing BULK IN EndPoint(2) 83 [ 324.536839][ T1237] usb 4-1: vub300 testing BULK OUT EndPoint(3) 04 [ 324.536858][ T1237] usb 4-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 324.998456][ T1237] usb 4-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 325.377463][ T1237] usb 4-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 325.952747][ T8236] hsr_slave_0: left promiscuous mode [ 326.289223][ T8236] hsr_slave_1: left promiscuous mode [ 326.306858][ T8236] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 326.306890][ T8236] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 326.415806][ T8236] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 326.415846][ T8236] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 327.028246][ T5708] usb 4-1: USB disconnect, device number 13 [ 327.153772][ T5828] usb 4-1: SET_CLOCK_SPEED 200kHz failed with retval=-71 [ 327.557871][ T5708] USB vub300 remote SDIO host controller[0] now disconnected [ 327.561590][ T8236] veth1_macvtap: left promiscuous mode [ 327.561699][ T8236] veth0_macvtap: left promiscuous mode [ 327.561952][ T8236] veth1_vlan: left promiscuous mode [ 327.562122][ T8236] veth0_vlan: left promiscuous mode [ 328.030015][T10243] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1413'. [ 330.069684][T10258] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1417'. [ 338.534758][T10341] netlink: 92 bytes leftover after parsing attributes in process `syz.4.1444'. [ 338.589388][T10342] netlink: 'syz.4.1444': attribute type 1 has an invalid length. [ 338.589413][T10342] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1444'. [ 340.283577][ T8236] team0 (unregistering): Port device team_slave_1 removed [ 340.410372][ T8236] team0 (unregistering): Port device team_slave_0 removed [ 341.262332][ T5252] 8021q: adding VLAN 0 to HW filter on device eth14 [ 341.263031][T10270] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1421'. [ 341.507061][T10268] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1421'. [ 342.100179][T10375] netlink: 100 bytes leftover after parsing attributes in process `syz.4.1454'. [ 342.422321][ T9882] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.422892][ T9882] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.423118][ T9882] bridge_slave_0: entered allmulticast mode [ 342.451611][ T9882] bridge_slave_0: entered promiscuous mode [ 342.532265][ T9882] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.532415][ T9882] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.532624][ T9882] bridge_slave_1: entered allmulticast mode [ 342.555886][ T9882] bridge_slave_1: entered promiscuous mode [ 343.188814][ T9882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.246984][ T9882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.515167][T10391] FAULT_INJECTION: forcing a failure. [ 343.515167][T10391] name failslab, interval 1, probability 0, space 0, times 0 [ 343.515213][T10391] CPU: 1 UID: 0 PID: 10391 Comm: syz.3.1460 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 343.515246][T10391] Tainted: [L]=SOFTLOCKUP [ 343.515254][T10391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 343.515266][T10391] Call Trace: [ 343.515275][T10391] [ 343.515286][T10391] dump_stack_lvl+0xe8/0x150 [ 343.515326][T10391] should_fail_ex+0x46b/0x600 [ 343.515369][T10391] should_failslab+0xa8/0x100 [ 343.515398][T10391] __kmalloc_noprof+0xfb/0x790 [ 343.515431][T10391] ? iter_file_splice_write+0x1ed/0x1240 [ 343.515458][T10391] ? iter_file_splice_write+0x1ed/0x1240 [ 343.515495][T10391] iter_file_splice_write+0x1ed/0x1240 [ 343.515524][T10391] ? __lock_acquire+0x747/0x2de0 [ 343.515582][T10391] ? __pfx_iter_file_splice_write+0x10/0x10 [ 343.515611][T10391] ? lock_acquire+0x115/0x350 [ 343.515661][T10391] ? __pfx_iter_file_splice_write+0x10/0x10 [ 343.515692][T10391] direct_splice_actor+0x104/0x160 [ 343.515736][T10391] splice_direct_to_actor+0x586/0xcc0 [ 343.515790][T10391] ? __pfx_direct_splice_actor+0x10/0x10 [ 343.515819][T10391] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 343.515862][T10391] do_splice_direct+0x19b/0x2a0 [ 343.515894][T10391] ? __pfx_do_splice_direct+0x10/0x10 [ 343.515924][T10391] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 343.515963][T10391] ? rw_verify_area+0x209/0x4d0 [ 343.515997][T10391] do_sendfile+0x540/0x7e0 [ 343.516031][T10391] ? __pfx_do_sendfile+0x10/0x10 [ 343.516072][T10391] __se_sys_sendfile64+0xdf/0x1a0 [ 343.516109][T10391] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 343.516159][T10391] do_syscall_64+0x166/0x520 [ 343.516195][T10391] ? trace_irq_disable+0x3b/0x140 [ 343.516224][T10391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.516247][T10391] ? clear_bhb_loop+0x70/0xc0 [ 343.516275][T10391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.516298][T10391] RIP: 0033:0x7fcd365fe1d9 [ 343.516321][T10391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.516343][T10391] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 343.516371][T10391] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 343.516387][T10391] RDX: 0000200000000080 RSI: 0000000000000003 RDI: 0000000000000003 [ 343.516401][T10391] RBP: 00007fcd36695888 R08: 0000000000000000 R09: 0000000000000000 [ 343.516414][T10391] R10: 0000000000007f03 R11: 0000000000000246 R12: 0000000000000000 [ 343.516428][T10391] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 343.516466][T10391] [ 344.007585][T10400] netlink: 606 bytes leftover after parsing attributes in process `syz.3.1462'. [ 344.023374][ T9882] team0: Port device team_slave_0 added [ 344.121003][ T9882] team0: Port device team_slave_1 added [ 344.644811][ T9882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.644834][ T9882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.644865][ T9882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.696071][ T9882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.696090][ T9882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.696115][ T9882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.829254][ T5708] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 345.010145][ T5708] usb 4-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 345.034167][ T5708] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.034200][ T5708] usb 4-1: Product: syz [ 345.034217][ T5708] usb 4-1: Manufacturer: syz [ 345.034232][ T5708] usb 4-1: SerialNumber: syz [ 345.093177][ T5708] usb 4-1: config 0 descriptor?? [ 345.184838][ T5708] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 346.039949][ T9882] hsr_slave_0: entered promiscuous mode [ 346.050098][ T9882] hsr_slave_1: entered promiscuous mode [ 346.059014][ T9882] debugfs: 'hsr0' already exists in 'hsr' [ 346.062519][ T9882] Cannot create hsr debugfs directory [ 346.278692][ T5708] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 346.289662][ T5708] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 346.289768][ T5708] usb 4-1: media controller created [ 346.331586][ T5708] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 347.561409][ T5708] DVB: Unable to find symbol mt352_attach() [ 348.091619][ T5708] DVB: Unable to find symbol nxt6000_attach() [ 348.091638][ T5708] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 348.200236][T10445] Set syz1 is full, maxelem 1038 reached [ 348.324875][ T5708] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input16 [ 348.527710][ T5708] dvb-usb: schedule remote query interval to 1000 msecs. [ 348.527739][ T5708] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 348.616728][ T5708] dvb-usb: bulk message failed: -22 (7/0) [ 348.616758][ T5708] dvb-usb: bulk message failed: -22 (7/0) [ 348.696939][ T8230] IPVS: starting estimator thread 0... [ 348.929398][T10466] IPVS: using max 7 ests per chain, 16800 per kthread [ 349.497602][ T5828] usb 4-1: USB disconnect, device number 14 [ 350.253875][ T5252] 8021q: adding VLAN 0 to HW filter on device eth15 [ 350.697116][ T5828] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 353.566259][ T9882] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 354.303282][ T9882] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 354.320549][ T9882] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 354.635078][ T9882] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 354.651174][ T9882] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 355.418471][ T9882] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 355.548911][ T5252] 8021q: adding VLAN 0 to HW filter on device eth16 [ 355.583378][ T9882] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 355.762787][ T9882] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 356.933979][ T9882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 357.216303][ T9882] 8021q: adding VLAN 0 to HW filter on device team0 [ 357.305724][ T8230] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.305897][ T8230] bridge0: port 1(bridge_slave_0) entered forwarding state [ 357.738022][ T8230] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.738568][ T8230] bridge0: port 2(bridge_slave_1) entered forwarding state [ 357.815443][T10602] netlink: 'syz.0.1514': attribute type 1 has an invalid length. [ 358.218068][T10602] 8021q: adding VLAN 0 to HW filter on device bond1 [ 358.783243][T10603] 8021q: adding VLAN 0 to HW filter on device team0 [ 359.117521][T10603] bond1: (slave team0): Enslaving as an active interface with an up link [ 364.255904][ T9882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 364.336830][T10687] Could not find key with description: [syz] [ 364.336912][T10687] process_request_key_err: No key [ 364.336924][T10687] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 364.336938][T10687] One or more global auth toks could not properly register; rc = [-2] [ 364.336984][T10687] Error validating options; rc = [-2] [ 365.394928][T10705] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1542'. [ 365.472259][T10706] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1542'. [ 365.856735][T10717] mac80211_hwsim hwsim3 ..ãc¤±: renamed from wlan1 (while UP) [ 365.887576][T10713] FAULT_INJECTION: forcing a failure. [ 365.887576][T10713] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.887622][T10713] CPU: 1 UID: 0 PID: 10713 Comm: syz.3.1544 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 365.887656][T10713] Tainted: [L]=SOFTLOCKUP [ 365.887664][T10713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 365.887678][T10713] Call Trace: [ 365.887687][T10713] [ 365.887697][T10713] dump_stack_lvl+0xe8/0x150 [ 365.887835][T10713] should_fail_ex+0x46b/0x600 [ 365.887918][T10713] _copy_from_user+0x2d/0xb0 [ 365.887959][T10713] ucma_set_option+0xf9/0xce0 [ 365.888142][T10713] ? futex_unqueue+0x22/0x240 [ 365.888201][T10713] ? __pfx_ucma_set_option+0x10/0x10 [ 365.888231][T10713] ? __lock_acquire+0x747/0x2de0 [ 365.888291][T10713] ? futex_unqueue+0x22/0x240 [ 365.888315][T10713] ? futex_unqueue+0x211/0x240 [ 365.888334][T10713] ? __futex_wait+0x1e3/0x410 [ 365.888365][T10713] ? __futex_wait+0x35a/0x410 [ 365.888405][T10713] ? lock_acquire+0x115/0x350 [ 365.888462][T10713] ucma_write+0x257/0x2f0 [ 365.888494][T10713] ? __pfx_ucma_write+0x10/0x10 [ 365.888524][T10713] ? security_file_permission+0x75/0x260 [ 365.888580][T10713] ? rw_verify_area+0x209/0x4d0 [ 365.888642][T10713] ? __pfx_ucma_write+0x10/0x10 [ 365.888672][T10713] vfs_write+0x29f/0xbb0 [ 365.888712][T10713] ? __pfx_vfs_write+0x10/0x10 [ 365.888742][T10713] ? __fget_files+0x2a/0x420 [ 365.888786][T10713] ? __fget_files+0x2a/0x420 [ 365.888811][T10713] ? __fget_files+0x3a8/0x420 [ 365.888835][T10713] ? __fget_files+0x2a/0x420 [ 365.888873][T10713] ksys_write+0x156/0x270 [ 365.888904][T10713] ? __pfx_ksys_write+0x10/0x10 [ 365.888946][T10713] do_syscall_64+0x166/0x520 [ 365.889073][T10713] ? trace_irq_disable+0x3b/0x140 [ 365.889109][T10713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.889175][T10713] ? clear_bhb_loop+0x70/0xc0 [ 365.889203][T10713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.889226][T10713] RIP: 0033:0x7fcd365fe1d9 [ 365.889248][T10713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.889268][T10713] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 365.889294][T10713] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 365.889309][T10713] RDX: 0000000000000020 RSI: 00002000000002c0 RDI: 0000000000000003 [ 365.889323][T10713] RBP: 00007fcd36695888 R08: 0000000000000000 R09: 0000000000000000 [ 365.889335][T10713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.889349][T10713] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 365.889386][T10713] [ 366.972910][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 367.014086][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 367.020957][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 367.029542][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 367.034499][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 367.832345][T10753] fuse: fd is not a fuse device [ 369.361138][ T5594] Bluetooth: hci5: command tx timeout [ 370.035376][T10789] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1564'. [ 370.819261][ T5708] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 370.970248][ T5708] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 370.971947][ T5708] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 370.972006][ T5708] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 370.972030][ T5708] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 370.972054][ T5708] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 370.972099][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.439545][ T5594] Bluetooth: hci5: command tx timeout [ 373.221306][ T5708] [drm] Initialized gud 1.0.0 for 4-1:1.0 on minor 1 [ 373.509593][ T5594] Bluetooth: hci5: command tx timeout [ 373.873903][T10825] sctp: [Deprecated]: syz.4.1572 (pid 10825) Use of int in max_burst socket option. [ 373.873903][T10825] Use struct sctp_assoc_value instead [ 374.007385][ T5708] gud 4-1:1.0: [drm] Cannot find any crtc or sizes [ 374.205165][ T5708] usb 4-1: USB disconnect, device number 15 [ 375.599181][ T5594] Bluetooth: hci5: command tx timeout [ 375.889130][T10828] netlink: 'syz.5.1574': attribute type 4 has an invalid length. [ 376.366699][T10873] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1581'. [ 378.899761][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.899846][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.957916][ T5594] Bluetooth: hci2: command 0x0406 tx timeout [ 382.758723][T10943] netlink: 'syz.5.1597': attribute type 1 has an invalid length. [ 383.971306][T10943] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 384.453950][ T5594] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 384.586347][ T5594] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 384.625818][ T5594] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 384.641958][ T5594] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 384.644309][ T5594] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 386.869258][ T60] Bluetooth: hci1: command tx timeout [ 387.234768][T10735] bridge0: port 1(bridge_slave_0) entered blocking state [ 387.238861][T10735] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.277385][T10735] bridge_slave_0: entered allmulticast mode [ 387.296507][T10735] bridge_slave_0: entered promiscuous mode [ 387.330343][T10735] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.330602][T10735] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.330812][T10735] bridge_slave_1: entered allmulticast mode [ 387.365043][T10735] bridge_slave_1: entered promiscuous mode [ 387.482832][T10735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 387.488646][T10735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.883274][T10735] team0: Port device team_slave_0 added [ 387.904235][T10735] team0: Port device team_slave_1 added [ 388.178483][T10735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 388.178501][T10735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.178525][T10735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 388.231445][T10735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 388.231466][T10735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 388.231495][T10735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 388.420043][T10998] netlink: 'syz.4.1606': attribute type 1 has an invalid length. [ 388.667767][T10998] 8021q: adding VLAN 0 to HW filter on device bond3 [ 388.832961][T10999] bond3: (slave geneve3): making interface the new active one [ 388.959624][ T60] Bluetooth: hci1: command tx timeout [ 388.989746][T10999] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 389.183172][T10735] hsr_slave_0: entered promiscuous mode [ 389.202700][T10735] hsr_slave_1: entered promiscuous mode [ 389.359188][T10735] debugfs: 'hsr0' already exists in 'hsr' [ 389.359221][T10735] Cannot create hsr debugfs directory [ 391.033777][ T60] Bluetooth: hci1: command tx timeout [ 393.111090][ T60] Bluetooth: hci1: command tx timeout [ 395.617601][T10958] bridge0: port 1(bridge_slave_0) entered blocking state [ 395.617753][T10958] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.617966][T10958] bridge_slave_0: entered allmulticast mode [ 395.654729][T10958] bridge_slave_0: entered promiscuous mode [ 395.657007][T11049] FAULT_INJECTION: forcing a failure. [ 395.657007][T11049] name failslab, interval 1, probability 0, space 0, times 0 [ 395.657047][T11049] CPU: 0 UID: 0 PID: 11049 Comm: syz.3.1623 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 395.657080][T11049] Tainted: [L]=SOFTLOCKUP [ 395.657087][T11049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 395.657101][T11049] Call Trace: [ 395.657109][T11049] [ 395.657119][T11049] dump_stack_lvl+0xe8/0x150 [ 395.657164][T11049] should_fail_ex+0x46b/0x600 [ 395.657201][T11049] ? __d_alloc+0x37/0x6f0 [ 395.657230][T11049] should_failslab+0xa8/0x100 [ 395.657292][T11049] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 395.657330][T11049] ? __d_lookup+0x66/0x790 [ 395.657357][T11049] ? __d_alloc+0x37/0x6f0 [ 395.657389][T11049] __d_alloc+0x37/0x6f0 [ 395.657421][T11049] d_alloc+0x4b/0x190 [ 395.657444][T11049] ? lookup_one_qstr_excl+0xc4/0x360 [ 395.657477][T11049] lookup_one_qstr_excl+0xd8/0x360 [ 395.657517][T11049] start_dirop+0x5c/0x90 [ 395.657542][T11049] simple_start_creating+0xcc/0x110 [ 395.657568][T11049] ? __pfx_simple_start_creating+0x10/0x10 [ 395.657596][T11049] ? mntput+0x65/0xc0 [ 395.657619][T11049] debugfs_start_creating+0xca/0x1b0 [ 395.657675][T11049] __debugfs_create_file+0x6f/0x400 [ 395.657702][T11049] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 395.657737][T11049] debugfs_create_file_full+0x3f/0x60 [ 395.657772][T11049] kvm_create_vm_debugfs+0x471/0x8f0 [ 395.657818][T11049] ? __pfx_kvm_create_vm_debugfs+0x10/0x10 [ 395.657838][T11049] ? alloc_pages_mpol+0x11b/0x280 [ 395.657868][T11049] ? __rt_spin_lock_init+0x3e/0x50 [ 395.657898][T11049] kvm_dev_ioctl+0x13ca/0x17e0 [ 395.657930][T11049] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 395.657950][T11049] ? __fget_files+0x2a/0x420 [ 395.657978][T11049] ? bpf_lsm_file_ioctl+0x9/0x20 [ 395.658021][T11049] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 395.658043][T11049] __se_sys_ioctl+0xff/0x170 [ 395.658076][T11049] do_syscall_64+0x166/0x520 [ 395.658106][T11049] ? trace_irq_disable+0x3b/0x140 [ 395.658132][T11049] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.658152][T11049] ? clear_bhb_loop+0x70/0xc0 [ 395.658178][T11049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.658198][T11049] RIP: 0033:0x7fcd365fe1d9 [ 395.658218][T11049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.658236][T11049] RSP: 002b:00007fcd34856028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 395.658260][T11049] RAX: ffffffffffffffda RBX: 00007fcd36885fa0 RCX: 00007fcd365fe1d9 [ 395.658276][T11049] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000004 [ 395.658289][T11049] RBP: 00007fcd36695888 R08: 0000000000000000 R09: 0000000000000000 [ 395.658302][T11049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 395.658315][T11049] R13: 00007fcd36886038 R14: 00007fcd36885fa0 R15: 00007ffd24074fe8 [ 395.658351][T11049] [ 396.043348][T10958] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.043494][T10958] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.043687][T10958] bridge_slave_1: entered allmulticast mode [ 396.076314][T10958] bridge_slave_1: entered promiscuous mode [ 397.381464][T10958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.088245][T11069] netlink: 7 bytes leftover after parsing attributes in process `syz.5.1631'. [ 398.477468][T10958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 398.855080][T10958] team0: Port device team_slave_0 added [ 398.880275][T10958] team0: Port device team_slave_1 added [ 399.085934][T10958] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.085954][T10958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.085981][T10958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.088716][T10958] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.088733][T10958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.088762][T10958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.274474][T10958] hsr_slave_0: entered promiscuous mode [ 399.275845][T10958] hsr_slave_1: entered promiscuous mode [ 399.276820][T10958] debugfs: 'hsr0' already exists in 'hsr' [ 399.276845][T10958] Cannot create hsr debugfs directory [ 402.739499][T11116] fuse: Bad value for 'fd' [ 405.365527][T11143] netlink: 'syz.4.1653': attribute type 10 has an invalid length. [ 410.838427][ T5594] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 410.914917][ T5594] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 410.955421][ T5594] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 410.987256][ T5594] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 410.988114][ T5594] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 413.190732][ T60] Bluetooth: hci3: command tx timeout [ 415.136664][T11224] netlink: 'syz.5.1681': attribute type 4 has an invalid length. [ 415.270239][ T60] Bluetooth: hci3: command tx timeout [ 417.349176][ T60] Bluetooth: hci3: command tx timeout [ 417.803214][T11188] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.803474][T11188] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.803671][T11188] bridge_slave_0: entered allmulticast mode [ 417.807022][T11188] bridge_slave_0: entered promiscuous mode [ 417.875742][T11188] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.875909][T11188] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.876130][T11188] bridge_slave_1: entered allmulticast mode [ 417.914664][T11188] bridge_slave_1: entered promiscuous mode [ 418.082029][T11188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.120874][T11188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.190333][T11188] team0: Port device team_slave_0 added [ 418.195069][T11188] team0: Port device team_slave_1 added [ 418.481071][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 418.481094][ T36] audit: type=1326 audit(1791608834.627:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.485343][ T36] audit: type=1326 audit(1791608834.627:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.485403][ T36] audit: type=1326 audit(1791608834.627:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.485452][ T36] audit: type=1326 audit(1791608834.627:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.485502][ T36] audit: type=1326 audit(1791608834.627:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.485551][ T36] audit: type=1326 audit(1791608834.627:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.487702][ T36] audit: type=1326 audit(1791608834.627:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.487758][ T36] audit: type=1326 audit(1791608834.627:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.487807][ T36] audit: type=1326 audit(1791608834.627:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc6d203e1d9 code=0x7ffc0000 [ 418.487854][ T36] audit: type=1326 audit(1791608834.627:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11252 comm="syz.5.1690" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fc6d1ffea0e code=0x7ffc0000 [ 419.028065][T11188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 419.028086][T11188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.028116][T11188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 419.096945][T11188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 419.096966][T11188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.096992][T11188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.257528][T11188] hsr_slave_0: entered promiscuous mode [ 419.266159][T11188] hsr_slave_1: entered promiscuous mode [ 419.267282][T11188] debugfs: 'hsr0' already exists in 'hsr' [ 419.267310][T11188] Cannot create hsr debugfs directory [ 419.429370][ T60] Bluetooth: hci3: command tx timeout [ 420.001788][T11267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1697'. [ 420.001830][T11267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1697'. [ 423.898750][T11299] netlink: 'syz.5.1710': attribute type 6 has an invalid length. [ 423.898775][T11299] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1710'. [ 425.517029][ T1237] libceph: connect (1)[c::]:6789 error -101 [ 425.517335][ T1237] libceph: mon0 (1)[c::]:6789 connect error [ 425.518689][ T1237] libceph: connect (1)[c::]:6789 error -101 [ 425.518918][ T1237] libceph: mon0 (1)[c::]:6789 connect error [ 425.839486][ T31] libceph: connect (1)[c::]:6789 error -101 [ 425.839718][ T31] libceph: mon0 (1)[c::]:6789 connect error [ 426.219664][T11311] ceph: No mds server is up or the cluster is laggy [ 426.362254][ T1237] libceph: connect (1)[c::]:6789 error -101 [ 426.362484][ T1237] libceph: mon0 (1)[c::]:6789 connect error [ 427.361245][ T7546] bridge_slave_1: left allmulticast mode [ 427.361288][ T7546] bridge_slave_1: left promiscuous mode [ 427.361571][ T7546] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.605572][ T5594] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 427.667160][ T5594] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 427.679364][ T5594] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 427.686484][ T5594] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 427.705234][ T5594] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 428.009226][ T7546] bridge_slave_0: left allmulticast mode [ 428.009290][ T7546] bridge_slave_0: left promiscuous mode [ 428.009600][ T7546] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.829276][ T60] Bluetooth: hci2: command tx timeout [ 430.830441][ T7546] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.021484][ T7546] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 431.043349][ T7546] bond0 (unregistering): Released all slaves [ 431.155429][ T5252] 8021q: adding VLAN 0 to HW filter on device eth17 [ 431.909240][ T60] Bluetooth: hci2: command tx timeout [ 432.294733][T11354] netlink: 'syz.5.1719': attribute type 10 has an invalid length. [ 432.540592][T11354] netlink: 'syz.5.1719': attribute type 10 has an invalid length. [ 433.989315][ T60] Bluetooth: hci2: command tx timeout [ 434.131187][T11376] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1723'. [ 435.434416][ T5252] 8021q: adding VLAN 0 to HW filter on device eth18 [ 435.734261][T11330] bridge0: port 1(bridge_slave_0) entered blocking state [ 435.734439][T11330] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.734680][T11330] bridge_slave_0: entered allmulticast mode [ 435.775847][T11330] bridge_slave_0: entered promiscuous mode [ 435.809765][T11330] bridge0: port 2(bridge_slave_1) entered blocking state [ 435.811681][T11330] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.811915][T11330] bridge_slave_1: entered allmulticast mode [ 435.863087][T11330] bridge_slave_1: entered promiscuous mode [ 436.071446][ T5591] Bluetooth: hci2: command tx timeout [ 436.096710][ T5594] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 436.159331][ T5594] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 436.163100][ T5594] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 436.164982][ T5594] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 436.184958][ T5594] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 436.241131][T11330] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 436.246556][T11330] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 437.637888][T11330] team0: Port device team_slave_0 added [ 437.711354][T11330] team0: Port device team_slave_1 added [ 437.880377][T11330] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 437.880397][T11330] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.880427][T11330] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 437.889640][T11330] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 437.889656][T11330] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.889682][T11330] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 438.120727][T11420] veth4: entered promiscuous mode [ 438.120758][T11420] veth4: entered allmulticast mode [ 438.549149][ T5594] Bluetooth: hci6: command tx timeout [ 439.012631][ T5252] 8021q: adding VLAN 0 to HW filter on device eth19 [ 439.064131][T11330] hsr_slave_0: entered promiscuous mode [ 439.068978][T11330] hsr_slave_1: entered promiscuous mode [ 439.081874][T11330] debugfs: 'hsr0' already exists in 'hsr' [ 439.081906][T11330] Cannot create hsr debugfs directory [ 440.322358][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.322445][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.629141][ T5594] Bluetooth: hci6: command tx timeout [ 441.192052][T11398] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.192265][T11398] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.192782][T11398] bridge_slave_0: entered allmulticast mode [ 441.196034][T11398] bridge_slave_0: entered promiscuous mode [ 441.231266][T11398] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.231519][T11398] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.231777][T11398] bridge_slave_1: entered allmulticast mode [ 441.234948][T11398] bridge_slave_1: entered promiscuous mode [ 441.327848][T11398] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 441.344415][T11398] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 441.456788][T11398] team0: Port device team_slave_0 added [ 441.468363][T11398] team0: Port device team_slave_1 added [ 441.591709][T11398] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 441.591730][T11398] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.591759][T11398] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 441.594518][T11398] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 441.594534][T11398] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.594572][T11398] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 441.790728][T11398] hsr_slave_0: entered promiscuous mode [ 441.792347][T11398] hsr_slave_1: entered promiscuous mode [ 441.794047][T11398] debugfs: 'hsr0' already exists in 'hsr' [ 441.794075][T11398] Cannot create hsr debugfs directory [ 442.709141][ T5594] Bluetooth: hci6: command tx timeout [ 444.270555][ T60] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 444.375538][ T60] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 444.387251][ T60] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 444.402749][ T60] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 444.405376][ T60] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 444.789203][ T5594] Bluetooth: hci6: command tx timeout [ 446.575814][T11444] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.576069][T11444] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.576279][T11444] bridge_slave_0: entered allmulticast mode [ 446.601656][T11444] bridge_slave_0: entered promiscuous mode [ 446.607726][T11444] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.607961][T11444] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.608161][T11444] bridge_slave_1: entered allmulticast mode [ 446.639134][T11444] bridge_slave_1: entered promiscuous mode [ 446.640713][ T5594] Bluetooth: hci7: command tx timeout [ 446.700109][T11444] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 446.705342][T11444] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.780015][T11444] team0: Port device team_slave_0 added [ 446.784343][T11444] team0: Port device team_slave_1 added [ 446.844656][T11444] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 446.844675][T11444] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.844703][T11444] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 446.848918][T11444] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 446.848935][T11444] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.848965][T11444] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 447.069853][T11444] hsr_slave_0: entered promiscuous mode [ 447.071647][T11444] hsr_slave_1: entered promiscuous mode [ 447.072797][T11444] debugfs: 'hsr0' already exists in 'hsr' [ 447.072826][T11444] Cannot create hsr debugfs directory [ 448.719124][ T5594] Bluetooth: hci7: command tx timeout [ 450.789179][ T5594] Bluetooth: hci7: command tx timeout [ 452.879184][ T5594] Bluetooth: hci7: command tx timeout [ 453.647682][ T60] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 453.730596][ T60] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 453.745840][ T60] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 453.747147][ T60] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 453.747989][ T60] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 455.989238][ T5594] Bluetooth: hci8: command tx timeout [ 456.052429][T11501] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.052679][T11501] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.052902][T11501] bridge_slave_0: entered allmulticast mode [ 456.055963][T11501] bridge_slave_0: entered promiscuous mode [ 456.060224][T11501] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.060461][T11501] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.060690][T11501] bridge_slave_1: entered allmulticast mode [ 456.063857][T11501] bridge_slave_1: entered promiscuous mode [ 456.110960][T11501] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 456.115112][T11501] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 456.210560][T11501] team0: Port device team_slave_0 added [ 456.215168][T11501] team0: Port device team_slave_1 added [ 456.278077][T11501] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 456.278099][T11501] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.278128][T11501] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 456.282063][T11501] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 456.282079][T11501] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.282103][T11501] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 456.432727][T11501] hsr_slave_0: entered promiscuous mode [ 456.434393][T11501] hsr_slave_1: entered promiscuous mode [ 456.435586][T11501] debugfs: 'hsr0' already exists in 'hsr' [ 456.435616][T11501] Cannot create hsr debugfs directory [ 458.069256][ T5594] Bluetooth: hci8: command tx timeout [ 460.149401][ T5594] Bluetooth: hci8: command tx timeout [ 461.080290][T11420] tipc: Disabling bearer [ 462.239137][ T5594] Bluetooth: hci8: command tx timeout [ 470.795262][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 470.871381][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 470.873405][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 470.876228][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 470.877090][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 472.675195][T11588] bridge0: port 1(bridge_slave_0) entered blocking state [ 472.675443][T11588] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.675725][T11588] bridge_slave_0: entered allmulticast mode [ 472.679978][T11588] bridge_slave_0: entered promiscuous mode [ 472.692699][T11588] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.692913][T11588] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.693335][T11588] bridge_slave_1: entered allmulticast mode [ 472.696273][T11588] bridge_slave_1: entered promiscuous mode [ 472.784655][T11588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 472.804269][T11588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 472.874460][T11588] team0: Port device team_slave_0 added [ 472.879554][T11588] team0: Port device team_slave_1 added [ 472.936278][T11588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 472.936298][T11588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 472.936327][T11588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 472.942916][T11588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 472.942933][T11588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 472.942959][T11588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 473.043144][T11588] hsr_slave_0: entered promiscuous mode [ 473.044830][T11588] hsr_slave_1: entered promiscuous mode [ 473.046031][T11588] debugfs: 'hsr0' already exists in 'hsr' [ 473.046059][T11588] Cannot create hsr debugfs directory [ 473.109552][ T5594] Bluetooth: hci0: command tx timeout [ 475.189418][ T5594] Bluetooth: hci0: command tx timeout [ 477.269437][ T5594] Bluetooth: hci0: command tx timeout [ 478.234855][ T7546] hsr_slave_0: left promiscuous mode [ 478.406361][ T7546] hsr_slave_1: left promiscuous mode [ 478.422072][ T7546] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 478.738751][ T7546] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 479.349522][ T5594] Bluetooth: hci0: command tx timeout [ 480.274087][ T7546] team0 (unregistering): Port device team_slave_1 removed [ 480.350809][ T7546] team0 (unregistering): Port device team_slave_0 removed [ 487.842550][ T5594] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 487.925096][ T5594] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 487.932198][ T5594] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 487.938528][ T5594] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 487.939561][ T5594] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 489.977489][T11661] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.977740][T11661] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.978405][T11661] bridge_slave_0: entered allmulticast mode [ 490.007285][T11661] bridge_slave_0: entered promiscuous mode [ 490.066899][T11661] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.067164][T11661] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.067826][T11661] bridge_slave_1: entered allmulticast mode [ 490.102371][T11661] bridge_slave_1: entered promiscuous mode [ 490.149255][ T60] Bluetooth: hci4: command tx timeout [ 490.198305][T11661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 490.232866][T11661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 490.306070][T11661] team0: Port device team_slave_0 added [ 490.330107][T11661] team0: Port device team_slave_1 added [ 490.394576][T11661] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 490.394597][T11661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 490.394626][T11661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 490.397418][T11661] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 490.397433][T11661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 490.397462][T11661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 490.597015][T11661] hsr_slave_0: entered promiscuous mode [ 490.598742][T11661] hsr_slave_1: entered promiscuous mode [ 490.639392][T11661] debugfs: 'hsr0' already exists in 'hsr' [ 490.639427][T11661] Cannot create hsr debugfs directory [ 492.229209][ T60] Bluetooth: hci4: command tx timeout [ 493.598131][ T60] Bluetooth: hci5: command 0x0406 tx timeout [ 494.309362][ T5594] Bluetooth: hci4: command tx timeout [ 495.800880][ T60] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 495.855661][ T60] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 495.892296][ T60] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 495.895987][ T60] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 495.896805][ T60] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 496.389528][ T5594] Bluetooth: hci4: command tx timeout [ 497.979777][T11683] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.980031][T11683] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.980250][T11683] bridge_slave_0: entered allmulticast mode [ 497.983413][T11683] bridge_slave_0: entered promiscuous mode [ 497.987323][T11683] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.987556][T11683] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.987772][T11683] bridge_slave_1: entered allmulticast mode [ 498.089413][T11683] bridge_slave_1: entered promiscuous mode [ 498.149363][ T5594] Bluetooth: hci9: command tx timeout [ 498.206917][T11683] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 498.238800][T11683] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 498.323249][T11683] team0: Port device team_slave_0 added [ 498.336119][T11683] team0: Port device team_slave_1 added [ 498.399521][T11683] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 498.399551][T11683] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 498.399580][T11683] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 498.460800][T11683] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 498.460821][T11683] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 498.460850][T11683] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 498.607265][T11683] hsr_slave_0: entered promiscuous mode [ 498.608859][T11683] hsr_slave_1: entered promiscuous mode [ 498.621697][T11683] debugfs: 'hsr0' already exists in 'hsr' [ 498.621727][T11683] Cannot create hsr debugfs directory [ 500.229267][ T5594] Bluetooth: hci9: command tx timeout [ 501.769926][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.770011][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.309211][ T5594] Bluetooth: hci9: command tx timeout [ 504.307583][ T60] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 504.355775][ T60] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 504.376077][ T60] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 504.389368][ T60] Bluetooth: hci9: command tx timeout [ 504.438654][ T60] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 504.465570][ T60] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 506.481827][T11702] bridge0: port 1(bridge_slave_0) entered blocking state [ 506.482082][T11702] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.482303][T11702] bridge_slave_0: entered allmulticast mode [ 506.485472][T11702] bridge_slave_0: entered promiscuous mode [ 506.490318][T11702] bridge0: port 2(bridge_slave_1) entered blocking state [ 506.490541][T11702] bridge0: port 2(bridge_slave_1) entered disabled state [ 506.490731][T11702] bridge_slave_1: entered allmulticast mode [ 506.493457][T11702] bridge_slave_1: entered promiscuous mode [ 506.564565][T11702] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 506.574382][T11702] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 506.629793][T11702] team0: Port device team_slave_0 added [ 506.637353][T11702] team0: Port device team_slave_1 added [ 506.639168][ T5594] Bluetooth: hci10: command tx timeout [ 506.693470][T11702] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 506.693491][T11702] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.693520][T11702] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 506.696479][T11702] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 506.696495][T11702] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.696524][T11702] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 506.773895][T11702] hsr_slave_0: entered promiscuous mode [ 506.775405][T11702] hsr_slave_1: entered promiscuous mode [ 506.776635][T11702] debugfs: 'hsr0' already exists in 'hsr' [ 506.776664][T11702] Cannot create hsr debugfs directory [ 508.709176][ T60] Bluetooth: hci10: command tx timeout [ 508.950735][ T60] Bluetooth: hci1: command 0x0406 tx timeout [ 510.789325][ T5594] Bluetooth: hci10: command tx timeout [ 512.869772][ T5594] Bluetooth: hci10: command tx timeout [ 513.887489][ T60] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 513.953479][ T60] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 513.957768][ T60] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 513.978797][ T60] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 514.021128][ T60] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 516.045727][T11722] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.045972][T11722] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.046195][T11722] bridge_slave_0: entered allmulticast mode [ 516.076161][T11722] bridge_slave_0: entered promiscuous mode [ 516.087020][T11722] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.087282][T11722] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.087534][T11722] bridge_slave_1: entered allmulticast mode [ 516.115917][T11722] bridge_slave_1: entered promiscuous mode [ 516.195919][T11722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 516.218493][T11722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 516.229301][ T5594] Bluetooth: hci11: command tx timeout [ 516.307948][T11722] team0: Port device team_slave_0 added [ 516.386626][T11722] team0: Port device team_slave_1 added [ 516.466987][T11722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 516.467008][T11722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 516.467038][T11722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 516.525606][T11722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 516.525628][T11722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 516.525658][T11722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 517.626350][T11722] hsr_slave_0: entered promiscuous mode [ 517.628106][T11722] hsr_slave_1: entered promiscuous mode [ 517.649357][T11722] debugfs: 'hsr0' already exists in 'hsr' [ 517.649393][T11722] Cannot create hsr debugfs directory [ 518.309138][ T5594] Bluetooth: hci11: command tx timeout [ 520.399069][ T5594] Bluetooth: hci11: command tx timeout [ 522.469146][ T5594] Bluetooth: hci11: command tx timeout [ 531.182215][ T60] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 531.287480][ T60] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 531.295747][ T60] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 531.297404][ T60] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 531.299915][ T60] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 533.429261][ T5594] Bluetooth: hci12: command tx timeout [ 533.477707][T11742] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.477947][T11742] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.478189][T11742] bridge_slave_0: entered allmulticast mode [ 533.481848][T11742] bridge_slave_0: entered promiscuous mode [ 533.485276][T11742] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.485493][T11742] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.485690][T11742] bridge_slave_1: entered allmulticast mode [ 533.488474][T11742] bridge_slave_1: entered promiscuous mode [ 533.553182][T11742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.564640][T11742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 533.626010][T11742] team0: Port device team_slave_0 added [ 533.631213][T11742] team0: Port device team_slave_1 added [ 533.710091][T11742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 533.710111][T11742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.710140][T11742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 533.712983][T11742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 533.712998][T11742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.713027][T11742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 533.817549][T11742] hsr_slave_0: entered promiscuous mode [ 533.820040][T11742] hsr_slave_1: entered promiscuous mode [ 533.821212][T11742] debugfs: 'hsr0' already exists in 'hsr' [ 533.821237][T11742] Cannot create hsr debugfs directory [ 534.549176][ T5594] Bluetooth: hci3: command 0x0406 tx timeout [ 535.510891][ T60] Bluetooth: hci12: command tx timeout [ 537.599133][ T60] Bluetooth: hci12: command tx timeout [ 539.669310][ T60] Bluetooth: hci12: command tx timeout [ 548.534944][ T5594] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 548.613275][ T5594] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 548.615111][ T5594] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 548.623463][ T5594] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 548.624933][ T5594] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 550.709638][ T60] Bluetooth: hci13: command tx timeout [ 550.719747][T11819] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.719949][T11819] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.720157][T11819] bridge_slave_0: entered allmulticast mode [ 550.723020][T11819] bridge_slave_0: entered promiscuous mode [ 550.726448][T11819] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.726670][T11819] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.726878][T11819] bridge_slave_1: entered allmulticast mode [ 550.733267][T11819] bridge_slave_1: entered promiscuous mode [ 550.796394][T11819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 550.817489][T11819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 550.912469][T11819] team0: Port device team_slave_0 added [ 550.922768][T11819] team0: Port device team_slave_1 added [ 550.988629][T11819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 550.988650][T11819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 550.988681][T11819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 550.996244][T11819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 550.996261][T11819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 550.996294][T11819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 551.088330][T11819] hsr_slave_0: entered promiscuous mode [ 551.090659][T11819] hsr_slave_1: entered promiscuous mode [ 551.091898][T11819] debugfs: 'hsr0' already exists in 'hsr' [ 551.091927][T11819] Cannot create hsr debugfs directory [ 552.789249][ T60] Bluetooth: hci13: command tx timeout [ 554.869532][ T60] Bluetooth: hci13: command tx timeout [ 554.889322][ T38] INFO: task syz-executor:10958 blocked for more than 143 seconds. [ 554.889351][ T38] Tainted: G L syzkaller #0 [ 554.889364][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 554.889374][ T38] task:syz-executor state:D stack:18752 pid:10958 tgid:10958 ppid:1 task_flags:0x400140 flags:0x00080002 [ 554.889441][ T38] Call Trace: [ 554.889449][ T38] [ 554.889465][ T38] __schedule+0x16d9/0x5700 ** replaying previous printk message ** [ 554.889465][ T38] __schedule+0x16d9/0x5700 [ 554.889578][ T38] ? preempt_schedule_thunk+0x16/0x40 [ 554.889627][ T38] ? __pfx___schedule+0x10/0x10 [ 554.889673][ T38] rt_mutex_schedule+0x76/0xf0 [ 554.889703][ T38] rt_mutex_slowlock_block+0x55e/0x690 [ 554.889763][ T38] ? rt_mutex_slowlock_block+0x33c/0x690 [ 554.889791][ T38] rt_mutex_slowlock+0x2d4/0x780 [ 554.889819][ T38] ? rt_mutex_slowlock+0x1f2/0x780 [ 554.889844][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 554.889891][ T38] ? del_device_store+0xd6/0x370 [ 554.889985][ T38] ? del_device_store+0xd6/0x370 [ 554.890005][ T38] mutex_lock_nested+0x168/0x1d0 [ 554.890026][ T38] ? sysfs_file_kobj+0x1a/0x230 [ 554.890079][ T38] del_device_store+0xd6/0x370 [ 554.890103][ T38] ? sysfs_file_kobj+0x1a/0x230 [ 554.890129][ T38] ? __pfx_del_device_store+0x10/0x10 [ 554.890155][ T38] ? sysfs_file_kobj+0x1e4/0x230 [ 554.890181][ T38] ? sysfs_kf_write+0x166/0x260 [ 554.890213][ T38] ? __pfx_sysfs_kf_write+0x10/0x10 [ 554.890238][ T38] kernfs_fop_write_iter+0x3a5/0x540 [ 554.890269][ T38] vfs_write+0x61e/0xbb0 [ 554.890311][ T38] ? __pfx_vfs_write+0x10/0x10 [ 554.890342][ T38] ? do_sys_openat2+0x14e/0x200 [ 554.890363][ T38] ? kmem_cache_free+0x187/0x6d0 [ 554.890434][ T38] ksys_write+0x156/0x270 [ 554.890468][ T38] ? __pfx_ksys_write+0x10/0x10 [ 554.890511][ T38] do_syscall_64+0x166/0x520 [ 554.890541][ T38] ? trace_irq_disable+0x3b/0x140 [ 554.890568][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.890592][ T38] ? clear_bhb_loop+0x70/0xc0 [ 554.893648][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.893677][ T38] RIP: 0033:0x7f280dc0ea0e [ 554.893696][ T38] RSP: 002b:00007ffd8ce2cfc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 554.893717][ T38] RAX: ffffffffffffffda RBX: 0000555576a64500 RCX: 00007f280dc0ea0e [ 554.893730][ T38] RDX: 0000000000000001 RSI: 00007ffd8ce2d050 RDI: 0000000000000005 [ 554.893742][ T38] RBP: 00007f280dce610b R08: 0000000000000000 R09: 0000000000000000 [ 554.893753][ T38] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 554.893764][ T38] R13: 00007ffd8ce2d050 R14: 00007f280ea04620 R15: 0000000000000003 [ 554.893793][ T38] [ 554.893838][ T38] [ 554.893838][ T38] Showing all locks held in the system: [ 554.893848][ T38] locks held by ksoftirqd/0/15: 8, last CPU#0: [ 554.893861][ T38] #0: ffffffff8f059540 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 554.893952][ T38] #1: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 554.894001][ T38] #2: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x261/0xc50 [ 554.894139][ T38] #3: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 554.894248][ T38] #4: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 [ 554.894296][ T38] #5: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x1100 [ 554.894342][ T38] #6: ffffffff8f059540 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 554.894387][ T38] #7: ffffffff8f1c3d20 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2a0/0x3a70 [ 554.894469][ T38] locks held by khungtaskd/38: 1, last CPU#0: [ 554.894483][ T38] #0: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 554.894570][ T38] locks held by klogd/4946: 8, last CPU#1: [ 554.894582][ T38] #0: ffffffff8f311930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 554.894630][ T38] #1: ffff8880b8543418 (&pcp->lock){+.+.}-{3:3}, at: free_frozen_page_commit+0x815/0x1850 [ 554.894678][ T38] #2: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 [ 554.894722][ T38] #3: ffff88813fffc2d8 (&zone->lock){+.+.}-{3:3}, at: free_pcppages_bulk+0x61/0x540 [ 554.894769][ T38] #4: ffffffff8f1c3cc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 554.894810][ T38] #5: ffff888012a48b00 (&p->pi_lock){-...}-{2:2}, at: _task_rq_lock+0x5b/0x440 [ 554.894866][ T38] #6: ffff8880b8524548 (psi_seq){-...}-{0:0}, at: psi_task_switch+0x57/0x790 [ 554.894911][ T38] #7: ffff8880b8528558 (hrtimer_bases.lock){-...}-{2:2}, at: hrtimer_start_range_ns+0x8c/0x3f0 [ 554.894965][ T38] locks held by getty/5350: 2, on CPU#0: [ 554.894986][ T38] #0: ffff8880376bc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 554.895128][ T38] #1: ffffc900044db2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 554.895191][ T38] locks held by kworker/u9:3/5594: 3, on CPU#1: [ 554.895206][ T38] #0: ffff888041fba138 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 554.895274][ T38] #1: ffffc90004b97c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 554.895335][ T38] #2: ffff888057534f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 [ 554.895450][ T38] locks held by kworker/u8:51/7546: 5, on CPU#1: [ 554.895464][ T38] #0: ffff88801beb0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 554.895521][ T38] #1: ffffc90006117c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 554.895580][ T38] #2: ffffffff905c7fc0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 554.895659][ T38] #3: ffff888035f99978 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x310 [ 554.895781][ T38] #4: ffffffff8f1c9f30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 554.895847][ T38] locks held by syz-executor/10735: 7, on CPU#1: [ 554.895862][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.895921][ T38] #1: ffff88805eb06c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.895971][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.896028][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.896082][ T38] #4: ffff88803b314160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 554.896205][ T38] #5: ffff888012586310 (&devlink->lock_key#10){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 554.896287][ T38] #6: ffffffff8f1c9f30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 554.896339][ T38] locks held by syz-executor/10958: 4, on CPU#1: [ 554.896356][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.896425][ T38] #1: ffff888013146078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.896477][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.896534][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.896589][ T38] locks held by syz-executor/11188: 4, on CPU#1: [ 554.896605][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.896664][ T38] #1: ffff88803c971878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.896715][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.896772][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.896821][ T38] locks held by syz-executor/11330: 4, on CPU#1: [ 554.896837][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.896896][ T38] #1: ffff88806268c078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.896949][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.897007][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.897061][ T38] locks held by syz-executor/11398: 4, on CPU#1: [ 554.897076][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.897136][ T38] #1: ffff88805bcfb078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.897189][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.897271][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.897321][ T38] locks held by syz-executor/11444: 4, on CPU#1: [ 554.897335][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.897384][ T38] #1: ffff88803cd44078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.897432][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.897477][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.897520][ T38] locks held by syz-executor/11501: 4, on CPU#1: [ 554.897531][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.897580][ T38] #1: ffff8880630a0078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.897621][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.897666][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.897710][ T38] locks held by syz-executor/11588: 4, on CPU#1: [ 554.897723][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.897773][ T38] #1: ffff88801333e078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.897814][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.897858][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.897900][ T38] locks held by syz-executor/11661: 4, on CPU#1: [ 554.897913][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.897960][ T38] #1: ffff888033a94478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.898000][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.898045][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.898087][ T38] locks held by syz-executor/11683: 4, on CPU#1: [ 554.898099][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.898150][ T38] #1: ffff8880440bd078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.898193][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.898238][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.898279][ T38] locks held by syz-executor/11702: 4, on CPU#1: [ 554.898291][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.898338][ T38] #1: ffff88807c6b9c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.898379][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.898437][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.898479][ T38] locks held by syz-executor/11722: 4, on CPU#1: [ 554.898491][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.898543][ T38] #1: ffff888057c2f078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.898592][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.898647][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.898700][ T38] locks held by syz-executor/11742: 4, on CPU#1: [ 554.898715][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.898777][ T38] #1: ffff88808a752078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.898827][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.898886][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.945855][ T38] locks held by syz-executor/11819: 4, on CPU#1: [ 554.945876][ T38] #0: ffff88803664c510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 554.945956][ T38] #1: ffff888058bdc078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 554.946013][ T38] #2: ffff88802a68b788 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 554.946073][ T38] #3: ffffffff8fe46c18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 554.946131][ T38] [ 554.946137][ T38] ============================================= [ 554.946137][ T38] [ 554.946147][ T38] NMI backtrace for cpu 1 [ 554.946164][ T38] CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 554.946193][ T38] Tainted: [L]=SOFTLOCKUP [ 554.946201][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 554.946213][ T38] Call Trace: [ 554.946222][ T38] [ 554.946230][ T38] dump_stack_lvl+0xe8/0x150 [ 554.946266][ T38] nmi_cpu_backtrace+0x274/0x2d0 [ 554.946370][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 554.946410][ T38] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 554.946439][ T38] sys_info+0x135/0x170 [ 554.946461][ T38] watchdog+0xfd7/0x1030 [ 554.946508][ T38] ? watchdog+0x1c7/0x1030 [ 554.946546][ T38] kthread+0x38b/0x470 [ 554.946571][ T38] ? __pfx_watchdog+0x10/0x10 [ 554.946613][ T38] ? __pfx_kthread+0x10/0x10 [ 554.946638][ T38] ret_from_fork+0x514/0xb70 [ 554.946665][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 554.946688][ T38] ? __switch_to+0xc89/0x1420 [ 554.946737][ T38] ? __pfx_kthread+0x10/0x10 [ 554.946762][ T38] ret_from_fork_asm+0x1a/0x30 [ 554.946802][ T38] [ 554.946823][ T38] Sending NMI from CPU 1 to CPUs 0: [ 554.946852][ C0] NMI backtrace for cpu 0 [ 554.946870][ C0] CPU: 0 UID: 0 PID: 20 Comm: rcuc/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 554.946894][ C0] Tainted: [L]=SOFTLOCKUP [ 554.946900][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 554.946910][ C0] RIP: 0010:unwind_next_frame+0x88/0x2550 [ 554.946936][ C0] Code: 49 c1 ef 03 43 0f b6 04 27 84 c0 0f 85 bd 1b 00 00 41 8b 06 85 c0 0f 84 46 02 00 00 89 44 24 5c 4c 89 6c 24 68 e8 88 09 34 00 <4c> 8d 2d 00 00 00 00 48 c7 c7 c0 3c 1c 8f 31 f6 31 d2 b9 02 00 00 [ 554.946951][ C0] RSP: 0018:ffffc90000197580 EFLAGS: 00000283 [ 554.946967][ C0] RAX: 0000000000000002 RBX: ffffffff81937455 RCX: dffffc0000000000 [ 554.946979][ C0] RDX: dffffc0000000000 RSI: ffffffff81937455 RDI: ffffc90000197660 [ 554.946991][ C0] RBP: 1ffff92000032ecc R08: ffffc900001976f0 R09: 0000000000000007 [ 554.947003][ C0] R10: ffffc90000197678 R11: ffffffff81b18190 R12: dffffc0000000000 [ 554.947015][ C0] R13: ffffc90000197d88 R14: ffffc90000197628 R15: 1ffff92000032ec5 [ 554.947028][ C0] FS: 0000000000000000(0000) GS:ffff8881249bb000(0000) knlGS:0000000000000000 [ 554.947042][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 554.947054][ C0] CR2: 00007fb19ffc2249 CR3: 000000002e32a000 CR4: 00000000003526f0 [ 554.947071][ C0] Call Trace: [ 554.947078][ C0] [ 554.947088][ C0] ? rcu_cpu_kthread+0xb2c/0x1740 [ 554.947111][ C0] ? unwind_next_frame+0x8f/0x2550 [ 554.947132][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 554.947153][ C0] arch_stack_walk+0x11b/0x150 [ 554.947175][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 554.947197][ C0] ? smpboot_thread_fn+0x565/0xa70 [ 554.947221][ C0] stack_trace_save+0xa9/0x100 [ 554.947241][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 554.947264][ C0] ? __lock_acquire+0x747/0x2de0 [ 554.947291][ C0] kasan_save_track+0x3e/0x80 [ 554.947314][ C0] ? kasan_save_track+0x3e/0x80 [ 554.947335][ C0] ? kasan_save_free_info+0x40/0x50 [ 554.947354][ C0] ? __kasan_slab_free+0x5c/0x80 [ 554.947368][ C0] ? kfree+0x1c5/0x6d0 [ 554.947388][ C0] ? ref_tracker_free+0x4fe/0x820 [ 554.947414][ C0] ? dst_destroy+0x108/0x340 [ 554.947436][ C0] ? rcu_cpu_kthread+0xb2c/0x1740 [ 554.947456][ C0] ? smpboot_thread_fn+0x565/0xa70 [ 554.947500][ C0] kasan_save_free_info+0x40/0x50 [ 554.947519][ C0] __kasan_slab_free+0x5c/0x80 [ 554.947536][ C0] kfree+0x1c5/0x6d0 [ 554.947555][ C0] ? ref_tracker_free+0x4fe/0x820 [ 554.947574][ C0] ref_tracker_free+0x4fe/0x820 [ 554.947592][ C0] ? __pfx_ref_tracker_free+0x10/0x10 [ 554.947608][ C0] ? dst_destroy+0x108/0x340 [ 554.947629][ C0] ? rcu_cpu_kthread+0xb2c/0x1740 [ 554.947649][ C0] ? smpboot_thread_fn+0x565/0xa70 [ 554.947670][ C0] ? kthread+0x38b/0x470 [ 554.947685][ C0] ? ret_from_fork+0x514/0xb70 [ 554.947700][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 554.947719][ C0] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 554.947740][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 554.947763][ C0] ? __pfx_ipv4_dst_destroy+0x10/0x10 [ 554.947780][ C0] dst_destroy+0x108/0x340 [ 554.947801][ C0] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 554.947823][ C0] ? rcu_cpu_kthread+0x217/0x1740 [ 554.947845][ C0] rcu_cpu_kthread+0xb2c/0x1740 [ 554.947877][ C0] ? __pfx_rcu_cpu_kthread+0x10/0x10 [ 554.947901][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 554.947928][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 554.947949][ C0] smpboot_thread_fn+0x565/0xa70 [ 554.947972][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 554.947998][ C0] kthread+0x38b/0x470 [ 554.948014][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 554.948036][ C0] ? __pfx_kthread+0x10/0x10 [ 554.948053][ C0] ret_from_fork+0x514/0xb70 [ 554.948071][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 554.948087][ C0] ? __switch_to+0xc89/0x1420 [ 554.948110][ C0] ? __pfx_kthread+0x10/0x10 [ 554.948127][ C0] ret_from_fork_asm+0x1a/0x30 [ 554.948150][ C0] [ 554.948854][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 556.647764][ T38] CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 556.658995][ T38] Tainted: [L]=SOFTLOCKUP [ 556.663343][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 556.673423][ T38] Call Trace: [ 556.676728][ T38] [ 556.679684][ T38] vpanic+0x56d/0xa60 [ 556.683718][ T38] ? __pfx___schedule+0x10/0x10 [ 556.688602][ T38] ? __pfx_vpanic+0x10/0x10 [ 556.693146][ T38] panic+0xc5/0xd0 [ 556.696895][ T38] ? __pfx_panic+0x10/0x10 [ 556.701332][ T38] ? preempt_schedule_common+0x7f/0xd0 [ 556.706828][ T38] ? preempt_schedule_thunk+0x16/0x40 [ 556.712229][ T38] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 556.718421][ T38] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 556.724618][ T38] watchdog+0x1030/0x1030 [ 556.728990][ T38] ? watchdog+0x1c7/0x1030 [ 556.733449][ T38] kthread+0x38b/0x470 [ 556.737549][ T38] ? __pfx_watchdog+0x10/0x10 [ 556.742256][ T38] ? __pfx_kthread+0x10/0x10 [ 556.746878][ T38] ret_from_fork+0x514/0xb70 [ 556.751500][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 556.756647][ T38] ? __switch_to+0xc89/0x1420 [ 556.761374][ T38] ? __pfx_kthread+0x10/0x10 [ 556.765995][ T38] ret_from_fork_asm+0x1a/0x30 [ 556.770805][ T38] [ 556.774001][ T38] Kernel Offset: disabled [ 556.778329][ T38] Rebooting in 86400 seconds..