last executing test programs: 10m44.642344765s ago: executing program 0 (id=265): fallocate$auto(0xffffffffffffffff, 0x1, 0x820, 0x7fff) (async, rerun: 64) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14fa02, 0x0) (async, rerun: 64) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) (async) ioctl$auto_EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0xee00, 0x7, 0x10, 0x7ff, 0x2, 0x6}) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/virtio_mmio/parameters/device\x00', 0x80480, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000003c0)=""/4096, 0x1000) (async, rerun: 64) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) (async, rerun: 64) close_range$auto(0x2, 0x8000, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'ip_vti0\x00', 0x0}) (rerun: 64) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r5, r4, 0x4, 0x401, 0xffffffffffffffff, @relative_id=0x13, 0xe600}, 0xf) r6 = open(&(0x7f0000000000)='./file0\x00', 0x261c2, 0x84) bpf$auto(0x2, &(0x7f00000000c0)=@raw_tracepoint={0x5, r6, 0x0, 0x3}, 0x91) quotactl_fd$auto(r0, 0x8, r1, &(0x7f0000000180)="8f213a7b009914551e206001d1305388c2c3043a7ed6eb3980788ba90829737cf9ee53b56363bac32f29d588720a9ab36dc399bb53c6611565641c40d933ce25fc010f60977b1847e4c24eaf9e5e0482fa42d432c283294b3d166c05a2a89d16c05b1a38295dbee6b1ad4546e7c743b0e78b") memfd_secret$auto(0x9) (async) openat$auto_snd_pcm_f_ops_pcm1(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async, rerun: 32) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) (async, rerun: 32) fanotify_init$auto(0x400, 0x2000000000002) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/time\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_mac80211_hwsim(0x0, 0xffffffffffffffff) (async, rerun: 64) sendmsg$auto_HWSIM_CMD_GET_RADIO(r8, 0x0, 0x0) (async, rerun: 64) sendmsg$auto_HWSIM_CMD_TX_INFO_FRAME(r7, 0x0, 0x11) socket$nl_generic(0x10, 0x3, 0x10) sysfs$auto(0x2, 0xe, 0x0) (async) open(0x0, 0x1652c2, 0xe1d2b27bdc14aa98) fanotify_mark$auto(0x0, 0x1, 0x9, 0x4, 0x0) 10m43.494495797s ago: executing program 0 (id=269): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x20009, 0x4000000000db, 0x12, 0x400, 0x18002) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(0xffffffffffffffff, 0x0, 0xfff) write$auto(0xffffffffffffffff, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) r1 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB='&\x00', @ANYBLOB="5de1"], 0x1ac}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) setresuid$auto(0xee00, 0x0, 0x0) read$auto(r1, &(0x7f0000002300)='MAC802154_HWSIM\x00', 0xfdef) mmap$auto(0x0, 0x200006, 0x2, 0x40eb1, 0x602, 0x300000000000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) getcpu$auto(0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000001a40)='/dev/input/event1\x00', 0x34d802, 0x0) r2 = openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binderfs/binder1\x00', 0x0, 0x0) ioctl$auto_BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) io_uring_enter$auto(0xffffffffffffffff, 0x3, 0x9, 0x5e, &(0x7f0000000340)="6ec84abb6b9ce1d2f3a119faacb5f5cb98ebfa9be3db2859dda78daa456d203e026630da3c4f494059ee3f582861f82018708c16c9529ec9d0e13c73c287fc4f748350710181c419d179adf29f8fa2ed4666db49d9599b91097725bcba017738a3eb363e35203a121a43a6ac47b0b3ec1d727d454bdbcfa49b38f0bbe3bcd9053eff5ea8ab", 0x9) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) r3 = openat$auto_state_fops_(0xffffffffffffff9c, &(0x7f0000000040), 0x1e9482, 0x0) read$auto_state_fops_(r3, &(0x7f0000000180)=""/61, 0xfffffeeb) syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x4, 0x4000000000df, 0x18, 0x401, 0x300000000000) prctl$auto_SECCOMP_MODE_STRICT(0xf, 0x1, 0x0, 0x9, 0x2) openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/config/target/core/alua/lu_gps/default_lu_gp/lu_gp_id\x00', 0x189002, 0x0) ptrace$auto(0x3, r0, 0x5, 0x4) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/tracing/set_event\x00', 0x20201, 0x0) keyctl$auto(0x2000000000000017, 0x3ff, 0x0, 0x0, 0x3) 10m41.442687566s ago: executing program 0 (id=275): close_range$auto(0x2, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/net/nr14/proto_down\x00', 0x82942, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/net/bond0/bonding/packets_per_slave\x00', 0x182b02, 0x0) pwrite64$auto(r0, &(0x7f0000000340)='\vX\xb5n\x91p\xe6\x15\x00p\x01\x99\x88c\x14\r>\x14\x1a\xd3\xd3\x1d\xf8?\xdb\xdb\xc1\xf5\xe3o\x8e\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\xe5}\xea\x1b\x95\xafQ;_L\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2\x10\x00\x00\x00\x00\x00/TX:\xfe\xe8\xe0\x96\xb1x\xc5\x1f\xd2\xe2\xf6^\xfdo\x00\x9a>T\xd5\x1e\xe3\xeb\x89q\a\xd6h\xc9\xbc\x8f\x1dBk\x95\x174\xdc\x03\x05> -\xb6\x9d[\xe42(\xe4\n\x98u\xc9\xa1\xc4Zb\x04\xc2\xf1 \x8a\xbe]\xde\xfd8u\xb4\xde\xb3\xa1T/\xdfx\x14Y\xfe\x1e\x1f\x91\x19\xb7\xfc\xcd\x7fl\xb3\xa8#\xa0\xb9P\x8d\x04C\x87\xebR\x93\x12\x18H&N\x8b\'i)\xab@\xaf\xcb\xda\x00\x067\xce\xd6V4\xc2\xeeX\xb4\xe9\f\xee\xe8\xd8\x91\x1b\xcd\x00j\x14H\xcc-\x14\xde\xaaN\x87\x8d\x9b\xa05\xacHX\xc1\xce\x91\xee\xad\r\xbe\xb2&f\xa3\xe2\x8bp\xba\x8a\"\xf1\xfc\xa13\xfe\xe0JG\xe1v\x82s}v~`X%pJ\xbf\xc3`\xa9\x8f\"l\xc7XX\xa4\xb6\x0e\xbe\xa0wy\xfe\x03n\xb5\r\xf149*(\x15\xaa\xc2\x8aB\xf1\xbb$M\xfe%\xc7\x84\xf0\xa4}bd\xac\xa8T\xda\xffm\x86\xca\x80\xde3\xa7\xba\xc7Y]\xd7\xa2\xec)\xd6\xad\xbcI\x10\xa3#\xd4/J\xa8\x14\x1b<\x04\xbd\x89\xefQf\xc0Q\x92\x92\xa7\x99\xcf\xaekR\xf5\xb7\x14r[\x9fx\xaf+\xb3@\xf4\x83\xbf\xc7e\xe7\xc2\xd6\x10\x0fk\xee)\x92\bO\xa1\x1a\x9e\xef:5\x1e\x1c\"9\xd8\xdf\xa9C\xe2SHG6\xf2\xd5.\x12]\x17J\x8b\xc52\xe9\x9e\xbc\xdc\xae\xef\xed\xf9\xa6\x9e-\x92pZ\x12j/\x1dD{\xac\x17\\O\xee\x11\x10$\x12\xfc \xb0\xb7cA;\xa1,\x040\xa7\xd9\xb2\x19@1\x92\x10\xc4\xc0\x1f\x1d\xe1\xf6\x80lW\v,\xa2\x134no\xa0\x00l\xd8\xe4\xd3\x16\xd3%\x8b\xf5\x1e\x12{\xe6\xdb\xde\a\xdedH\x90\xf7\x19\xff\xcb\xacC\xeadOf\xb8\x15\xc39\xefLt\t\x11\xa1\x0e\x85\xac\xcc+\xc0\xb4.\xaa3>\xc0\x96\x84\xd5\x02\xc1\x94=\xb0\xfe\xda\x1d\xe9\xa7\xe1\xcf\x80|k\xdd\x95\xc9\xb0y\xb4\xbd\xc2W\x9c\xa4\x80\x13\xbc\x7fb=y\xdb]U\xd1HC\xe1\xa7\x94q\xb0C\xb8\x86\xd0\x9d\xe0\x8aD\x91x\'\xd6\x17\xd1\x9d\x16\xa7oZ\x8a\xce:\x9e@\x04\x00\x05f+\xee\xd8\xe6D\x9e\xb18Aw\x92\xe8\xb8>\x81{', 0x8001, 0x1) ioperm$auto(0x3, 0xe, 0x2000000000000149) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) socket(0x2, 0x5, 0x0) listen$auto(0x3, 0x83) madvise$auto(0x20, 0x7fffffffffffffff, 0xa) clone$auto(0x21, 0x7, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x6) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x801, 0x106) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0xa0801, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = socketcall$auto(0x8000, 0x0) r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r2) ioctl$auto_KVM_GET_MSRS(r1, 0x4008ae89, &(0x7f0000000380)={0xdd, 0x0, [{0x40000002, 0x9, 0x3b0}]}) 10m40.880037786s ago: executing program 0 (id=278): r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/virtual/net/dummy0/flags\x00', 0x2c62, 0x0) ioctl$auto_UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000040)={{0x0, 0xf2cf, 0x1ff, 0x4}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0x8}) r1 = socket(0x11, 0x3, 0x9) capset$auto(0x0, &(0x7f0000000000)={0xb213, 0x2c, 0x800}) sendmmsg$auto(r1, &(0x7f00000006c0)={{&(0x7f0000000000), 0x5ac, &(0x7f00000000c0)={&(0x7f0000000080)='L', 0x49}, 0x2, &(0x7f0000000700), 0x5, 0x1}, 0x5}, 0x2, 0x100) write$auto(r0, &(0x7f0000000580)='0\x00\xa6\xcc\r\x91QU\x9d\x15\x84\xab`\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04\x7f\x00\x00\x00\xd9\x94\xf8F\xbb\xa2\xbb>\xade\x18K\xb0D\x91OO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\xef\xc0\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfdFq\xe7\x03\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10)kcsZ^3H\xf1\xdf\x96\xfd)\xf3\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xacA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xaeO\x03\x91p6\xa0\xb9g.\xde\xd4`\xfa\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(\x95\xdfH\xf4\v\xf3CRnz\xc2\x13<\xf0\v\x1f\x14\xf3\xd0\xf2\xd1L!\x81\xea\x83\xa0\r|%\xbf\x02trg\x9a\xe7)\a\xf4\xaa\x05\xc0\xa0r\xd2\x85\x8dH\xd0>\xca\xfc5\x01\x95O4\xca\x95\x1d\x83\xec\nD\x8e\xfb\xce\xd1w\x15:\xe9\x81/B#\xc6\xa1\xfa-\x1b\x8cr\x92nM\xa1\xbb\xe4pd$\xd7\x1b\v\x82\rd\xd2\xaa\v!\xb1}\x92\x89\x8d\xcd\x1e\xc7N\xeeO\x8dO\xe9\xfc\x91\xa1\xa8=R+\a\xb7R\t\f+\x7f\xd5H\x90G=\x9a\r\xb10\x17n\x1b\xf8\v\x11\v\xbb\x88\xd8\'\xe4\xf8\xe9f{\xf7gl\r\xdf\xc8n)J\xa2\xfa\x03\xbe%\xf6\xd1\xfb\xbcg\"\a\x03\xdef\x10K\xa1\x80z\xd1Z{\xb0\x91\ft\xf5\xaf:\xc9\x02~`\x11\x15\xa3\xd9y\xb3)~\xb6\xaaB\x16O\x1c\xdeY2\x8f*R\xf6\xb5m\xc6\x91+\x14\x04\xf7*9\x9e\x04\xe3\x03\b\x02kud\xf8j\x95I.\x04\\\x80S\xa5\n\x14\x05\x12\n^\xc9|\xf8.>\x8b\xb1y\xe7\x96\x9asW\x10}(\x9c\xc9\x84\xec\xf68\xb7\xd7\xec\xc9F\xe1v\x9aD\t\xc6f\ay\xafX\x96\xcc\xa8\xae\xcb\xac\xd5\xd4\xee1\"L\xacC\t\x81\x8b3\xc6\x1e\xbbwlK\xd2\x9e\xc8\xde\xed\xb6\xbeX\xe4`s\xec\xec]\xb3\xfa\xd8\x86\x1bP\xa3\xc4\xb4\x84\xd2\x94Z\xbeA\x1f,a\a\xf7\x7f\x12\xa9E\xfb\xcd\xa2@\x83<\xe0\xaf\xc5\'\xcf\xa3\xf2KD\x80\x8c\xac\xb1\xd6\r\xf4+\x9cSx\xa3\xf3mE\xbbD\xd3\x1bK\xdc\xc7\x9c\xa6M3\x1f\xac{\xc1\x036\xd16\b\x00\xa7\xc9&\x92\x0e~\x05LM \xb8\xf6.,\xf8\xa8\a\xa5)\x91\xc4\xe9P\xa6\xda\xef\xe1\xbdu\xa2\xb7\xa3\x0eZ\xdf\xaf\x87\xa10\xa0\xc8\xa4\xa0O\x96\xeb\xb9\x10\xf3]\\8\v\xcc\x16\xca\xadm\xd3\xcc\xa4\\\x192\xc6\xb1i/\x90$\x05Y>soi)\x12\x05@\a\xe9c\x17\x818\x1e\x8fn\\)\x1a\x96\xc0\xf6\xa4\xf1]\xfe\xa7\x1e\x02\xd3\x1f\x97MT\xd5g\x1e\x04sD\x92+', 0x9) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0x19, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0006, 0x16) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth0\x00'}) close_range$auto(0x0, 0xffffffffffffffff, 0x2) socket(0x2, 0x2, 0x0) r2 = socket(0x18, 0x5, 0x1) connect$auto(r2, &(0x7f0000000000)=@in={0x2, 0x100}, 0x3a) close_range$auto(0x0, 0xfffffffffffff000, 0x0) mmap$auto(0x0, 0x20009, 0x5, 0xeb2, 0x8, 0x1008000) r3 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="f21e8858", @ANYBLOB="1e00df45"], 0x1ac}}, 0x4010) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB='R'], 0x1ac}}, 0x40000) recvmmsg$auto(r3, &(0x7f0000000100)={{0x0, 0x4, 0x0, 0x3, 0x0, 0x80000000, 0x6}, 0x9}, 0x7, 0x6, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYBLOB="1e00df"], 0x1ac}, 0x1, 0x0, 0x0, 0x5}, 0x40000d0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB='f'], 0x1ac}}, 0x40000) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc8}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x1f00) ioctl$auto_TCFLSH2(0xffffffffffffffff, 0x540b, &(0x7f0000000000)="cfa2098fa774a826efe5b9ffa458dcd55b343abe635f566f2cb179004217577e3658df260a5fcda727a2d15d6c746813629d6c8bc82c0d742ad9f15d87c26213924cf70d1759553ba724a7fa945da1d914f16e98e1d9e6d603b06cd032535c9cb49ab3970eb9ea8819a4f231810bdd06129d3c01c870fd701d08fb3c311a") 10m39.26721856s ago: executing program 0 (id=283): r0 = socket(0x11, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) r1 = socket(0x18, 0x3, 0x2) recvmmsg$auto(r0, 0x0, 0xc, 0x0, 0x0) epoll_create$auto(0x4) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, 0x0, 0x2) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), r1) sendmsg$auto_NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4020044}, 0xc, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x88}, 0x1, 0x0, 0x0, 0x4040490}, 0x20000000) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0x9f967fc65f29d173, "31000000f7ffffffffffffff00"}, 0x55) sendmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0x8) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='./cgroup\x00', 0x1c001, 0x10a) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r2 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000140)=@can, 0x3) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) r3 = fcntl$auto(0x3, 0x20005, 0xa553) syz_genetlink_get_family_id$auto_ethtool(0x0, r2) r4 = socket(0xb, 0x1, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bind$auto(0x3, 0x0, 0x6a) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'pim6reg\x00'}) 10m37.832249518s ago: executing program 0 (id=287): mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0x8000000000000024, 0x8000) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) (async) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) (async) close_range$auto(0x2, 0x8, 0x0) (async) socket(0x2, 0x80002, 0x6) openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async) move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000) (async) socket(0xa, 0x5, 0x0) (async) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop13\x00', 0x60742, 0x0) write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000) mmap$auto(0x76dc, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async) timer_create$auto(0x0, 0x0, 0x0) (async) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0) (async) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) madvise$auto(0x0, 0xffffffffffff0005, 0x17) unshare$auto(0x4000007d) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f0000001a00), 0x801, 0x0) (async) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0) mmap$auto(0x0, 0x2020008, 0x3, 0x17, r2, 0x7) (async) close_range$auto(0x2, 0x8, 0x0) (async) r3 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv6/conf/ip_vti0/rpl_seg_enabled\x00', 0x14b142, 0x0) r4 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/sctp/udp_port\x00', 0x202, 0x0) sendfile$auto(r4, r3, 0x0, 0x6) (async) io_uring_register$auto(0x2, 0x11, 0x0, 0x83) madvise$auto(0x0, 0xffffffffffff0005, 0x17) (async) set_mempolicy_home_node$auto(0x0, 0x200fffd, 0x5, 0x0) 10m22.556101223s ago: executing program 32 (id=287): mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0x8000000000000024, 0x8000) unshare$auto(0x40000080) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) (async) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) (async) close_range$auto(0x2, 0x8, 0x0) (async) socket(0x2, 0x80002, 0x6) openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async) move_pages$auto(0x1, 0x2000000000003, 0x0, 0x0, 0x0, 0x8000400000000000) (async) socket(0xa, 0x5, 0x0) (async) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop13\x00', 0x60742, 0x0) write$auto(r0, &(0x7f0000000040)='//\xf2\x00', 0x80000000) mmap$auto(0x76dc, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) (async) timer_create$auto(0x0, 0x0, 0x0) (async) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r1, 0x0, 0x0) (async) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) madvise$auto(0x0, 0xffffffffffff0005, 0x17) unshare$auto(0x4000007d) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) openat$auto_nvmf_dev_fops_fabrics(0xffffffffffffff9c, &(0x7f0000001a00), 0x801, 0x0) (async) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x60742, 0x0) mmap$auto(0x0, 0x2020008, 0x3, 0x17, r2, 0x7) (async) close_range$auto(0x2, 0x8, 0x0) (async) r3 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv6/conf/ip_vti0/rpl_seg_enabled\x00', 0x14b142, 0x0) r4 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/sctp/udp_port\x00', 0x202, 0x0) sendfile$auto(r4, r3, 0x0, 0x6) (async) io_uring_register$auto(0x2, 0x11, 0x0, 0x83) madvise$auto(0x0, 0xffffffffffff0005, 0x17) (async) set_mempolicy_home_node$auto(0x0, 0x200fffd, 0x5, 0x0) 8.767594672s ago: executing program 4 (id=2550): openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/events/vmalloc/filter\x00', 0x2a0001, 0x0) ioctl$auto(0x4000000000000c8, 0x800454cf, 0x3) r0 = socket(0x10, 0x2, 0x6) r1 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="ed290000", @ANYRES16=r1, @ANYBLOB="010028bd7000fcdbdf25110000002c001e8028005e80080046800400f7801c0010801800278014003f0000000000000000000000000000000001"], 0x40}, 0x1, 0x0, 0x0, 0x20008000}, 0x8044) r2 = socket(0x11, 0x80003, 0x300) setsockopt$auto(r2, 0x107, 0x12, 0x0, 0x4) r3 = socket(0x11, 0x80003, 0x300) mmap$auto(0x3, 0x8001, 0x62, 0x10, r2, 0x7) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) mmap$auto(0x0, 0x9, 0xdf, 0xeb1, 0x1, 0x8000) mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb2, 0x40000000000a1, 0x8000) setsockopt$auto(r3, 0x107, 0x12, 0x0, 0x4) 8.222839802s ago: executing program 4 (id=2551): request_key$auto_KEY_SPEC_THREAD_KEYRING(&(0x7f00000000c0)='.\x00', 0x0, 0x0, 0xffffffffffffffff) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram5\x00', 0x14fa02, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0x400000000e31, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x3, 0x2) getsockopt$auto(r0, 0x107, 0x9, 0x0, 0x0) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) getrandom$auto(0x0, 0x6000000, 0x3) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) setreuid$auto(0xffffffffffffffff, 0x8) r1 = pidfd_open$auto(0x1, 0x0) setns(r1, 0x4000000) msync$auto(0x1ffff000, 0x17ffffffffffffc, 0x400000004) mmap$auto(0x0, 0x7f, 0xdf, 0x9b72, 0x2, 0x4) 6.149803921s ago: executing program 4 (id=2557): mmap$auto(0x0, 0xe980, 0x6, 0xffffffffffffffff, 0xffffffffffffffff, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pts/ptmx\x00', 0x40001, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) unshare$auto(0x40000080) mmap$auto(0x0, 0x20009, 0xdf, 0x40000000eb1, 0x40000000000a5, 0x8000) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/net/rpc/auth.rpcsec.context/channel\x00', 0x129002, 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/dev\x00', 0x40100, 0x0) pread64$auto(r1, 0x0, 0x10001, 0x80082e) openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000140), 0x2002, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x6, 0x2, 0x40eb2, 0xffffffffffffffff, 0x308000000000) semctl$auto(0x7, 0x2, 0x13, 0x1) r3 = openat$auto_iommufd_fops_main(0xffffffffffffff9c, &(0x7f0000000400), 0x80001, 0x0) ioctl$auto(r3, 0x3b8f, r2) write$auto(r1, 0x0, 0xc) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, r1, 0x8000) open(&(0x7f0000000240)='./cgroup.cpu/cgroup.procs\x00', 0x1c5082, 0x18) open_by_handle_at$auto(r1, &(0x7f0000000140)={0x8, 0x30004, "b190a905237d4b53"}, 0x42) prctl$auto_PR_SET_VMA(0x53564d41, 0x0, 0x0, 0x0, 0x2) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000100)={0x200100, 0x11d, 0x11}, 0x18) socket(0x1d, 0xa, 0xff) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snd/midiC2D0\x00', 0x0, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r4, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) mmap$auto(0x0, 0x40009, 0x3203, 0x9b72, r0, 0x27ffc) mmap$auto(0x0, 0x40000a, 0x2737, 0x12, r4, 0x8000) set_mempolicy$auto(0x6, &(0x7f0000000080)=0x3, 0x21) unshare$auto(0x40000080) 6.066196712s ago: executing program 3 (id=2559): openat$auto_ptdump_fops_(0xffffffffffffff9c, &(0x7f0000001a00), 0x8000, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0xffffffffffffffff, 0x0) socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) socket(0xa, 0x2, 0x3a) io_uring_setup$auto(0x6, 0x0) r0 = socket(0xa, 0x2, 0x88) close_range$auto(0x0, 0xfffffffffffff000, 0x2) bpf$auto(0x0, &(0x7f0000000000)=@link_update={r0, @new_prog_fd=0x4, 0x4, @old_prog_fd=r0}, 0xa3) r1 = openat$auto_xfs_dir_file_operations_xfs_file(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/virtual/bluetooth/hci1/hci1:201\x00', 0x200000, 0x0) ioctl$auto_XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f00000012c0)={0xffffffffffffffff, &(0x7f0000000140), 0x1ff, &(0x7f0000000180)="8c3ab2e6b4a02a9ee919aeb9aef1a5293c00ba0362c8db5b0be454200b99ae5cede3b2e61b989bfcf260bc8b6bccc5360015f145119197919b835ac857c1f7785b4474be5768ee52f4e6fe8b53e135c69410b957f28c0c6a43ae535c216ac80e9f3791c1c06c9d61dae723fe9efe57225c28fe81eef61236fff4a8e82d58100e0d7fa8791149709571dbae3c247c14c051ff8f61911842663432da006dc1c59d5a6034bd3cf58293b2f16343ab1afb4fd7987ade035f9445380c52c7a8acf14b7e7eb746c16838d9c9c78875", 0x1ff, &(0x7f0000000280)="4ef290bc9f22d8addb9b880b7ff6d5a77369f29302fae37ef0f95d7f79d3e66023bb94658576374b3c3703fc059255cb6088a236056d80062d670f85afc8e739658cb813cff6752852241932999a4592f090c37fd49772f3046f5293e017bab1111a976aa1a05cb01d0f7ac6ebe18f184be30b50a28216cf27064b721e12115f7d35e9554db06adb1f8d0402e98ec51d52e00c3911124c6c886982876e8b84cbca842d7bf8849d91899f9bcb7ac971b2f5059b0127ade8e8f7fe9e82a45162055ab469da2f7dd858310911c7e42632442ef48b152340258348f4347512075d028b4b1a1e124d922bec7e19a4b96a1028e77c22703827e167dc68323488a95627123e61b669d0eadb352b5642c75bbabc09bf81a8b9690e9d2ce3c0e8ed5a01cf0666f55258031c50fad0d13afaccd4b4ad4c87747ad933ae04440d5569e4cbb424d13584ed7c53673c193fdaa92895e80b61e24dec10667af1493f60423163c1f4d08c03bb244530c9129632bdadc2950518cd189ccda4f6ceb5fcde78615da31931402f6c6ac416d2f493852404c7b18a1c1f0203075e5c8148ca05bdecf08ef8aeebf18e321de61ae556663a55a71c66c7768e3884f06a56bfa0b0bdc0db024a87a11e5cef05a9e06f5ae3f662a8cbf3ada850d8bad1ba8ef89d21803c18be5099373a697f61904b56946c06d3c8c99fed26024211ec91820edb42a33b58063a1d7c161920543978ea75b2dd02ba9f97a7b03c64a6f466eff67c56d128ecd3fe6ff4b483b9d7cf63c93d201dab97f6529a19e7b69cae374c49a869b4d8cf3449f38594c64182e09f4fc28c0dafa534edfd9bfd0d6205a06f842ff06e3cbee4da9c1d826fc5be41157955be5718d8d62be7638efd9fa2352927911005a30ee5509a7e538fd418e12ed1b20270cd2cbe2cbb67469ced71f27ee279434e0c3e2c3d4330eef8792fb1819a7a639f027fe01ebb2dc088002622566c78367df506b937fe32172e94340e79d0868b914cd927e656d844a172bf2cb02ce279f507c12600dc02f6004395f04892fa86af46596b9f5dd3484cb5eceaf9cdde02f88a9e934dcd681f87dfa275301eda560c15ee4e0cd61fa3c401094b37176c19033f0715530181dfba3dfe257000bd617c046c1ac78a8418f4a93d1fc3983f4f287aad22426db82b3448c79bb566ee61d3c500b7b06c63bdbba7a95e48d2844b3563d7b8724eb305cdf73e3bcbc5c7f64b29f8c7a45c45d6ec7d63eb25d662421958e8df3d2039bb921af09c06fb618cddda58bb32d80ef82dc3821d253b271ce73b82518f614054c3ef54ad0bbdbc236ce3f4498e20901cff5ef321fac0fbbd9403c473b0abbee9e4ce30ef34ec9f36e4408a0cd20416cfe5d38b03c476aefeedeff0f258278544ae6689922044b2077dbdb94b4220df05fd5fa017391397b873a0d4511a8a4e617a6a9c06cf503318579fa7055ac45ba1a3784af935d0ce9816e71738d5adf57b93caabeabb92fa637cac0afbc2fc515a9a8bf78c1e0e223e9d95c3bdb3fec4ed985539887657044522f1444c0f6970fa3c21d94aa991a8929d2ccc3ad52c837cdd0fe12248be85614ef0036e5f238b17abc25e2d31471b991f38fcf7369811c890c34cc6b562f680edb04e3a795608ef5741513ce6ae641664ad0ea2aeb76cd53aafa3226de8c835cb8d6f704e2b5f4db7c890c3313bae2b602ac8cfe6aba3ffe2bda0099a4f7f52d56dd9ef5a143abc8887035a17c6fca4d9f325dba65057a6a3feb4b9d577791fcc19ad1cadbf6d21321f5807749a870013bceaf68e720ed77e2d1121b2b47637baf281f30d474bd662a08cf2734787b10d5e59de038cdc8a35d886c3cabb5c60e4ef0ffe8eadf196ed53f75c169d0bf06b3dd20bd8c4f2529e307c401e1995d184f601621a864711a3843f3355545afdd0c184921a7888f7dadf960a6884e7b4a78b7ad810f4d0487ee65b1839b5d889a156065770e0034554a9e8cf2eeea8989d8c52c381bbb00571cde3105ef4b11ffa9bd391a831823c381edc07a2d41038db6464be0e1274277de30eecf5f134fd99a345e2be02302d45f5035b89f932f95459f26c2c2b828f7d45a9c5dffc9298aabd4c161094d0ccd679230a567952da7e32ae58b4b5488469261bdaf5fd93605a4f6b3d7eee14311186cc64c531bef3e4070578161f8f0d36724e0ce2ad720b3a7f66329ecc302fa49390c1df127d6bf1986a2be21a5bc25dc1dc4b3a79ba4950d5e1672514f2a0fd77e517a0c8a489ad2489142bb7caf0b23e47b653b6d1087258481bed68e8c17c408a0f83886db19c77c7de5775192c6f24d9ccdb371cfd9cbfc44f86056f64122ad117aa34185435ab51c853c23b9dd14c3606dd502c452d604a06c246a9485bab5659686339d4103fe8e3fa182cbf5e126886984b66ad64a89f3aeb918e52375e0557aa7b5282ee9c12a4054a1adbefa42334a3a4925131505029043df31353ca0b5e28d67c8048f9f8c56d1883270d28b50ab9ba8fb7878dd45c0f218b83340c4988c3be325feecabfba68de3cccf9a24afea0735c1e1eacd7ec23b91e71cbd77ce95c61004778146ec046d888b9b7a8eea887dcb7575f1774117b39c0ffc0127ab1c2b3988763fdf18f27933524c0567e5ab228c9b845971a18873a8f491ec360f96acaed8cfaf34c5662383f4b620832fe570b3a7a10f655cb6b34004f05f6e8a487379701edabbd53fd789c5db70986e7b4b624839207b72a8d4614d9cd4e8d551f7222b03c2ec2648d09584dcc9bdfabadc260099695d1025b8310079ff41cd10a7f000e39de80af2ebcd90d3993773f0d8304f3d9f4f38285088f6f85d87352234c3c2fdd8413d2e5b44365e136db6a52daf5771b1b8aa1f7ef55bc46e92f58dec9f36b1cec4ce26f8449096642f83e7af8bbcb0233ac7ebc980b81c2fdfed3f7d26cb07710180417a6499cb7749d5be6eefaaa05c52a7e5516a55e32dab34421dab6368a0d6f28c6c4be2a25dbec70ae5614f3d6ce3b707e3bc447ab8cbb438b701cadc04b0f31371748c5bc6dcf42a6dcd6270b6125ea229368e3dff3ca1110d4772b137a2138e6c7f65d10e142231d4281e8d6cf13e367f01899d49c2126b0593fd2a81b1ce3e25837c6171404e10bf17a95098549b0cd76cbd48d57aa63341a74fd815e74297875af802b78c1f808277d9dcdfd2e07b59e20ec370aaa227326d7399f2abd4744c1a661bcbbde50a24f926a90278bd6198efd9f11378f43ce8baf06b703fe84b924afb3ceaf6fc8a445775814bb263774fdd680686c9aa3b9cd7baa6814d8b2c8d674fb26e531a1788a239e01c83a1d420bb99c66c3d2c532636e42a4fe8a9897d83eb387e8e56cffb1913dc35e6a7e495247f2366e64b02ee1b502bd9588a44eba08bee9f68b5bb6e88f3a5a973733eb5688139c38562ca3a6244e3b79216bc3aa4d1f8cce9b52eec72cd642878b9c72a7c7b6708b9205d7b6c9e4e6c85f3a779d15d8f052f7d44f7911846ac233a41d71a2558a770e6fabf97d758855dbace80cc22dddc055016e6e9584f3d62adf5d78c5b477141c4830a0286b498b502b7f51fbd7f5bdf15fd898aa6a4157554b8d599a73af4910fec2c500ce98528c19df71dcca3bf1e33d052e95459b89055a08ca2b4ea8ea807a48a454b137956b55f34e0b0f14dfaca727bec1549e5b965ebb5846f9d3993754eeb5b90123159a1fd285719ad3412d259f27db895e2f9f8288ec95849db741c436f31dad290f41d903935bae352faddea8eaacb8366a14453d593ccabbe8ca832d2399064b739b4ed934f2408839943d1a9e512a1366f8768269097ffa3f13bd2da4fdb6e3b1b0526130d1ed925cfb405beba9a0b32138dd763be4c065ab9682446b27d1d07af46abb65365fc35abab54c812088d6ad40fd3f50f0a121a7d266d6e59aa8ff140f10a753d6d595b9373a8bb188fe3a5c6eb71c97ebd07417e4a2b9176b52865e3a37a4c520b288b42a1cf03d5a0a54e1025a8faa456a21e65417587a2c16a40fb27dd0b74a56c669e388a1c64121ae659c20f4143a4219bf0220cdfff7607f5ca3db1f61b902b5b2eadaa4801f4a29aeebb3aecf2582d26285fcb04e2e928d5db359a637a063340d7fe509ae4b31695047b5d7d913c31bd0d367ab239414cc0e1cdc1cb15563afed89420d51c29ace8590dd5a93d159035bfec6a089e1f6289eff904fc01c9068dfab126fbee1c1154e30faa4a823085bf60d2a2211ee67363cc586987efaceb6f0064d6bd4a5816907addfc04479d29719865e5b70d05c02f81903a78c707c6fbdfac02d03bbdc308ab181b76e0a466128bf0ef054966ec69997e5543170db236beb331bcb9cd515b90257a8461aaa2a9623d6156db3e3602f8deb6751d8232b77e8c286edff20edceef0ff5956cc26ae3b21328ca318aadff911b72f0eb30000b1edab8776939b7d4a73034b9d5694bc5b1ada0a54fb89db5c7ca258a996073b5a08b2a4694c91b92b8bc23d185484eb487c7895d5f83c6d4a53b03e2e928a2c777fa256c773370636dd73462aa28fce74278f8c753e5af69a56263cb2da49b31809eee7b133f25c721877de545b947a9a3e2068c6c0bd15627338dff56593709d4b514cec924d14a8202e0d449b5b68174347004daf1f405568714b384010c2c56a1fcad9ae4c3fa6f9c6cb10c6abb837a27642bba9f8ee0dd12b2885b9ca35d691af99af54a90ff770d2139f1d587b9ee309e439d6c4f0924bebddfa5de05e44b6f5836f58991a02ccd3c57f3facafeddbea72096fe35fcdf9663cc6b027ba11d3dc4b1c86ce71bb7adb35ec05f47e4add8f223caef97f20b4bf6546c5d1d76e1a1eafab0a39aa01057756bf5bb46c8cdf805575d39d9cd1088736e284cb2313d298ecb7f0ee962f4994f3d2503e7a5e745f91dcdf68f133f8c39ee645fdbe7c2e6f818117c949b1d5332884eff07202d30ed1c0da09dd920c7be1d487ac6c78ead9052bdd55b180bff0da1c272290b7180d8a9e39633ee269eb43637f9a340c38286329ea97785e3b01ae50c885c0bf3f72bdda3c383c28abf5d8941744a6795e9e546edcfedbedb81bbd590b792b0878b2ce8012b8755860f8c1c08a8c68e06590444c40674fde8e50236b13df88b42a7df2892f882aaa4d459acd463b7c4be0bc263fdc689e77e96056d12cc2b3ab00d925b1f8f057e010bdf233ae3cb3318c9a38ff9dfa99a49b49210ff96f4404df60f9dde10d3288b77a94e8e20332e8a53e504774a08c8dc061ee030932f644466f3bf562c0d7b7e678a3a6e250e067fa0bd635785ca374473460e57b0258d94628c47d0ae325c6642decce9c1b4a7ab587782e62833559544994466962e4e8f180bf0d584aa01530fe1f6c96539a10696ec4fdd54faa0c65b015f5e34e0e5b8bc4ad9184e131ce7477b488aa7b9dca9e1723e1dc98aa44a08a4a342891ded499c755251be2515f26881122fc8c167659c5af60dd375095867e4d5d1bf293ac2775edf36b90cca84fc998737be694f2d3e557a0d56f2f1471186651790e631ec23377c028ba766f9301f6109b62a9455aaa787a5af8e7d8b2345d0f8c19db964b70c40fc48e8ce58079338ef047b40afa52d05276fb000f5c7cf9c48591e11ed32747c02ad47e75f3fd289e3ab354ca10917bc2b3d48c42931c54a9ab50abcde72c38752ee77d6833ac8b26b7427072e7f5d3ceb6a4e42b3dbaed3872f8a829fb1afd4bbbff643de09b2c19018c86c771de38bfebfe79f9ba2", &(0x7f0000001280)=0x7}) bpf$auto(0x1, &(0x7f0000000040)=@query={@target_ifindex, 0x4, 0x7, 0x9, 0x7f, @prog_cnt=0x4, 0x0, 0x80000000, 0xc, 0xb, 0x5}, 0x7) 5.716309479s ago: executing program 1 (id=2561): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000240), 0xffffffffffffffff) (async) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x88000, 0x0) close_range$auto(0x2, 0x8, 0x0) (async, rerun: 64) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) (async, rerun: 64) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) openat$auto_vhci_fops_hci_vhci(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket(0x11, 0x3, 0x9) (async) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) (async) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/ieee80211/phy1/force_tx_status\x00', 0x81300, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer\x00', 0x783a06, 0x0) sendmsg$auto_TCP_METRICS_CMD_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="9aa2738b", @ANYRES16=0x0, @ANYBLOB="1500"], 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x0) (async) close_range$auto(0x2, 0x8, 0x0) r5 = socket(0x10, 0x2, 0x4) close_range$auto(0x2, 0x8, 0x0) (async) socket(0x10, 0x2, 0xc) (async) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r3, @ANYRES8=r4], 0x18}, 0x1, 0x0, 0x0, 0x64008084}, 0x2000c082) (async) write$auto(r5, &(0x7f0000000000)='-\x00', 0xfdef) (async) ioctl$auto_KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000040)={0x1000, 0x0, 0x0, 0x8000000000000001}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$auto_MACSEC_CMD_ADD_RXSC(r0, &(0x7f0000004100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010026bd7000f9dbdf25010000000400028008000100", @ANYRES32=r6, @ANYBLOB="a5e9e1e3c034a0592caa236c12cddb1f6dd0411e132136dce7f6f0525317f6b5f22bf09484d6fa815eca9666dc8beb5a1de84f14ebff837899e3fd52e8f8cbfd8e0cc6e20531017805905bf699776196186c52e11d4b9cb6b050cdd5da4aebf1f481161538aa1536582497ab3358b6fa165efdfb70916cf0d2c7e8dd9ce668dddad9e32c1ec3ec75dca03a8bfa5870fb6ca4ffb1b279980ed3fb02610c8906dbf4b16a40cdbb1a2251139ee32732b406ad1120e4f89d62a4b39893b7ef00fde59a0a2c34b0dfcefaa866d27fda636198d43ffdef369786b5f0691200e8265a157c16b21ffe583c675fae2de2ca661cbc8dc7ca29b9fb0f467cc464e6db6b43aee2c3321c664e4a9547cc019435ced4626ac774b8bd0ae179fdb3a9a71d498f1c06b0fe79332d30758eacf168ce184fc147d69810047f81b8c24626"], 0x20}, 0x1, 0x0, 0x0, 0x20040801}, 0x4000040) 5.466138652s ago: executing program 3 (id=2562): r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000280)='/sys/devices/system/node/node1/hugepages/hugepages-1048576kB/demote\x00', 0x183841, 0x0) write$auto(r0, &(0x7f00000003c0)='0\x00\xa6\xcc\r\x91QU\x9dI\xda\x1b\xad\xb1\x9e\xc8Tt\xa8\x94\x9c\x8a\xe2\xc7cOM\xb6\xa3,!o\x9e\xb0\xadT\xfbR\xa1Y\x94V[8\x04c\xdf:]\xd9\x94&\x81\xe2\x13\x8f\xea#\xf8F\xbbOO]e[\xbb\xf9\xcd\xc0\xc9\x00\xda\xac\xdd\x1a\xdd\xdd\xb9o\x1a\xab\xd5\b\xc1\x04z\xd0I>\x8f\x00\xe5\x1c*\xed`\xfd\x15\x88\x0f\x9a\xd5\xa7\x14\f};\xabt\xd1ak\xe5\x98\xea\xe3}\x10\xab\f_\x19\x9b\x11\xb25VUK\x93\xcdd\x17\xe4\xcbA\xa5[\b\xb8;\x02tcf\x06\xfbD\x91\xcaG\xdaa:k[r\x06\xeb\xf0\xc4\xcb\x10\xae\xc8\xe9u\x9f\xdeK\xa5\x8e\xd6\x8f\xd0UV\x11\xcb\xdd\x81\xbe\xdeL/\x06(\x1d\xa5\xc5\x9b\xb2\x96\x05`\xe7\xd5Y\a\xc1\xe9(', 0xa) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snd/controlC2\x00', 0xa802, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000000080)=0x551) read$auto(r1, 0x0, 0x3) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pts/ptmx\x00', 0xa0540, 0x0) ioctl$auto(r2, 0x80045432, 0x38) ioctl$auto_FIDEDUPERANGE(r2, 0xc0189436, 0x8) bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) connect$auto(0xffffffffffffffff, &(0x7f0000000000)=@in={0x2, 0xa, @remote}, 0x54) r3 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r3, &(0x7f0000000200)={{0x0, 0xffc3, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f0000000340), 0x8, 0x3}, 0x800}, 0x7, 0x4008) sendmsg$auto_NL80211_CMD_SET_MAC_ACL(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="90010000", @ANYRES16=0x0, @ANYBLOB="000227bd7000fcdbdf255d0000001000d700c954f5400e07fd91f6e35e4c0600f70007070000390049014478257d2efee1df0de464eb0504e50f45069912c9a11b6acd9baf6c4ded4132c4d1837d54c3a8de532a2d12abf90207ae3dc6915c0000000400160108000c010300000010cfa75bd740c7a2550a01a4eb00fa00dd98b92e5e7d744859e2907cb477c31a9cd3b114a7573ede00a9e1e5b93412d6848e4252566814ab1fae88149ced6a9fecb18c061bf14af027d603736f831ad341ee43e5770a52f581186a549c881a39495f2f7f2c769674b39ae00df167bfe65c34f7245a585df00d88365eb6aef107b5930887cfce9fba27ccce30f4c4bc332f2d7f306eaea1736ac6f27567e15e77ff30563dfd0aa3d58ac7b5c432c8dd2e5d0d015d0ac033dafdcd100e601adb345ebc6da738561390978bb47925a1a1c9daf432c26c698b74a946698b6ec8a36925739f292dcd3004c71aceb4a560ef22d5e5985998d7860006004f010400000008000900fcffffff0d000a0071920062edaa9f3ea800000000000000"], 0x190}, 0x1, 0x0, 0x0, 0x24008000}, 0x2404c000) epoll_ctl$auto_EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x9, 0x80000000}) sethostname$auto(0x0, 0xfffffff8) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) 5.083149736s ago: executing program 1 (id=2563): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a) setsockopt$auto(0x3, 0x1, 0x2a, 0x0, 0x9) sendmmsg$auto(r0, &(0x7f0000000000)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1, 0xb}, 0x800009}, 0x5, 0x20000000) recvmmsg$auto(0x3, 0x0, 0xfffe, 0x52, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x800008000) r1 = socketcall$auto(0xffe, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$auto(0x3, 0xae60, 0xffffffffffffffff) ioctl$auto(0x3, 0x4010ae67, r1) 5.078005671s ago: executing program 2 (id=2564): mmap$auto(0x0, 0x4020009, 0xdf, 0x400000000e31, 0xffffffffffffffff, 0x0) r0 = prctl$auto(0x17, 0xffffffffffffb269, 0xffffffffffffffff, 0x5f7, 0x2) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x2, 0x15) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1300f51c230ca8d57a148353e98649c41bf6760b7a44722d45d95d1e6ce26828263b6cd180728dad2b9deb7397d42716d660f3ea89bb42d7cb2ac26cae3b4d600247614007f59bc5d7c0796f"], 0x1ac}, 0x1, 0x0, 0x0, 0x10}, 0x4004) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_GET_WIPHY(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="810b25bd7000ffdbdf251100000008000300", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) sendmsg$auto_NL80211_CMD_LEAVE_IBSS(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0x90, r4, 0x430, 0x70bd2a, 0x25dfdbfd, {}, [@NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_REG_ALPHA2={0x70, 0x21, "5990e877d87eff1e9602e5a8ff0516caa28e13deca604ba81842fbf2b28eb8a77208af65f6f1f8f53d369cc7f33a26b056a2b6ea44d03085d9d8503f759d71b5ece7865d716ccaa9c183114f6ecc9436f76e9a05e43beb447ff70aa51b78d4fb1962a6581134820c73f2fa65"}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000051}, 0x0) pread64$auto(0xffffffffffffffff, 0x0, 0x100000001, 0x101) openat$auto_proc_setgroups_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/setgroups\x00', 0x8102, 0x0) write$auto_proc_setgroups_operations_base(r0, &(0x7f00000000c0)="15e53ac8dda97d23", 0x8) r7 = open_tree$auto(r0, &(0x7f0000000280)='./file0\x00', 0x7) sendmsg$auto_NL80211_CMD_GET_REG(r7, &(0x7f0000000d00)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000cc0)={&(0x7f00000003c0)={0x8e8, r4, 0x300, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x9}, @NL80211_ATTR_PROBE_RESP={0x7cc, 0x91, "8d7dd857abc30b9b73bd80037a19f61e15e077c7f9336cfb903135265990108cd198a63d1d79817ca1da39682fd50007527512cb15b3e9ae3551abc311056e10629f5740fa81f9a97c97fcf6225984498cdac5247d230528cb7ae8701e157d15c24330d4dcea6bbb929f3e0db758039b05b77f9b10f52448acb03607269a37bd7508f67f7e572acc7dde1a267830b147677d74b74a230475fa91b6f08f8a6bc066e632802e673839654cf81dadf93fbe2f1799c5eac28657d55a86485cc195d03f7bc5ae343b8edd4ce8af7fb490a26d90eec11fc5f3f4c0b0814d40a060931994ecc2a46a07c2cb6492afa7777b0a22a60fce2c0ad1d3fa52cf95ef51bdcdbb995fdafff330f089e9106576438427b14d6896e23d6a4d772f71d4e5f56ecf8dacc40c07816613b2328650a015dec3c7fb4b3f3b756b52f538692f81e56bae4cf87ff65bc21f799368ac0a410d7a54d17fee06c79283bdeb9f1240ef4a0080cc653e5cdf2ac2eb3cfd6cdb6aaa867a81a29af966c1257f74d8f69aa4cc8accc6f1116c40ee75a0c8974f23b2737f2a1f344d87f69d15590f757de331f11bbfc42532debf5f63660067ad1f6f9801931b255cd72a756b9ed40159861ecd039bf6a874e8ca4bc49bd6974af7f7fe48a81b2db0e79057f5be9f2dbab444b6abfe3c72752aad6444ebff66cbf9213cb9c33a71a62044b1defabc31ab9fae891347a8bce11bd676ade4149e6ae4611ae60d4589174ca44b03dfb5b901853697fa0cc3d047b6edd4a6ef85dfaf39c61de878783e1f1aada3c2085ae824d177ea17b7e53399c335484cbf7672a6c97623d235f94b40cf0440d15a3690de8305cf4150e24e5745b28b9d1e31a92016ba08411f95addc05551297bd7c6e339335fbbb124c1949d716df43a2214f125eca7acd911f3c03dd82f3d824d61a421235b8e28f8dbf8c8e817897bfd6a77173068a75644b9feb565be3648b327a501d3e851617565e5531b315e12730743f663d77d19ea0ad280ff9c0700c4786cd521d9135051e24243065e881c23c7d47e12d7567f266b9e72c75d169bae6901cbc88aca77a2920a3264face9185f0829c94ca7c9d277c056a70699fc05b96f24b24023afb74dc04fc580e0d9e02b9d68813ac739679db292677be0c967a0062cf0da26b1020c6400c485b5668e6dec98cc49f3f5395ef501c5cd071b46124607961b33f08ece58263fc335305b4446f554c68af7f39e4ae53a821dd8154da27e050b28d8cecb5abae486bb254af002bfd3a813be820e9859844c823238da8b7f9344352919899f325f9fa16c6c8d8325831faf0cb30e7bc553200436835ee8e760bd060a42ca89fbca811ecfa1899f56bbc8c4ff97baf058bbf2d89455ff260fe433c744978fb21a68fe6f6039a497aa80c59dbc543a6bab1ace7a419137b96178d348342c189898a78cd838692193b08b558a3fc39f85f8ce9cbb4bbe19b98f48964f43bf7beba820f3ca35d29c04661cb089cccbe4fea7df1d769e780de652ad37e6c676da13dc3fcbc0ccc8cd6c004e2c93e9eb73b285457564af23bf188c46555c3a9df64010d83b7bec2fe57c2a69b002413517e6a4ca8bc614e61545cc2cecc197bbc3e500d20e280c5ef4fddc4423f4a1500dea75678749c4803214d436bebfcba4b6a85b8ecc9842a9aa8154f5b6166a2364ca6e37a071fca3fc6b062a536100ee0266c077dfbd23672d7efea269fe25a0efa78e51dd18db4b0fbc328bb684d74cb003c86f9b367bb6a41285d95f005963d3938f9c5cd7933753e6a9e038a82c4914c6fa2d92653a1839a92d670348ad7fcc03eff38bf0646ae371b1ee106ba19522f5b6abe37de27c325920cdc068eee36da3fba2e063d77c596a5684ade58feaef082e0dc89e39dbf655c880229fd92c30c2405211347ab359ea2888fbd40e120c17d9d5f25f7c0f2be9e2d8ee1e2eb25e4de816713780a59e092e6b8c5fb98ef667ac25aa64a740847dc606f32529356d554c7bb3d890ad6521edb66bd4f6aeb50eaefa1ceed7316ccbe11d29b3f92999b76d2996e7df54efb2176f29a6a4397b8b0a326cd1cd40eaf2c0cdb54a559f38e7a04294b8d2700aab840acb42cdf1fbaa8b150c0263cc4ece90db9e7506e5e5098714f1cd6e554123a5c90e891ae30206f32f3ec94321ba786ac990455b3bc5d91a1a32c8e898012109eb6e0d8b7709c8ce70125a92ed093a2c7ab210025c867ab0a98478d3e2a3423d539504ff7e96870cfa11419d7b1304ea1c216a3ac9569b23fc880930709557ce9bc856ccf1c5c869cc2a499e9c4609767e123b98ad9804e575903d1d96c9bb32782831dea99d076edbe1a60a1caa0526dff4582b9d8d9d47c99c49ddb526d62afeecba9c03484a95183b7fa05e1965701a4a55bf6a613b54245fcc11964af91236796451f06aaa8fa9a48217c4d1191bc7726bdcbc20205595f980b7e286b61eac8e4c05198439baaf6ba116c76de6f0a7ff6d92dbdc7111135ed18296e022054e9b6a1abc8d409854ad337619d795195cdf79ac7eae713e93a13a6c3f8cc0a3bd2b91345ea18551f9d85530161700c473ea93ae7b1e9719ab89eda6a2aa3cc5e3fe8a5db35f4ee94cdfff2e78f4281b9d54ee68d312252468d1a579f062bde423c44eb44e8f50c8b662c2226a19c2bed1e475d598f5b4bcf4bd8fb4820df8f787e9b4d0bba24fafc9f272b950efe988f2e017154b4d99a94f3fb9236486018ad4c583431aa6bbab0f68d525d40aef564d9ec5e6ccc5889ca74db633f94842ed6bef5868cc813a104683dbdb3c80"}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x5}, @NL80211_ATTR_MESH_CONFIG={0xe6, 0x23, 0x0, 0x1, [@generic="0085a8272bfad223cc4600faa0c13c604cbc12d2b781726fd1b56d87fc4f7be85b9c5c7bf51b47e98b6c2e013502ef61c23f2f029493b474fb6a2e3c8c8865cbee05420384b3280ab8a3aa656e7b56324d8e580780306d4642c8e6b1abc63ac19b0b8fb5b785aa25a9ad26aeecbaf4713a176459057042bce763db194e556f9b99f12a266ed26ada0655623115c63369cd86756920897928a96bfa7f4b5b238b23ae2ddf6fecdf60c325ce4f4f7dbdbc3a73aa98ec10573553f83441c6555c922c3d1df7e096abd35a93bb90dc35", @typed={0xc, 0xb7, 0x0, 0x0, @u64=0x2}, @typed={0x8, 0x3, 0x0, 0x0, @fd=r2}]}, @NL80211_ATTR_OPER_CLASS={0x5}, @NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS={0x6, 0x143, 0xa}]}, 0x8e8}, 0x1, 0x0, 0x0, 0x4004}, 0x20000000) 4.902375324s ago: executing program 3 (id=2565): timer_create$auto_CLOCK_TAI(0xb, &(0x7f0000000200)={@sival_ptr=&(0x7f0000000300)="873b6e0875f2", @raw=0x1976, 0x81, @_sigev_thread={&(0x7f00000001c0)=&(0x7f0000000500)=0x3, 0x0}}, &(0x7f0000000280)=0x2000) sendmsg$auto_NL80211_CMD_SET_REG(0xffffffffffffffff, 0x0, 0x40) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) clone$auto(0x100000020003b49, 0x80000000002, 0x0, 0x0, 0x4) close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x2) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(r0, &(0x7f0000000200)='7\x00\\\xa0\x04|\x03\'\x00\xc9\n\xbf\xb9\x12\xfa\x00\x00\xcfk', 0xb7f) sendmsg$auto_ETHTOOL_MSG_MODULE_EEPROM_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) 4.664691139s ago: executing program 4 (id=2566): r0 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000fddbdf2501000003000007018008000180000000000c0002000600000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x8880) mkdir$auto(&(0x7f0000000040)='./file0\x00', 0x2) mkdir$auto(&(0x7f0000000000)='./file0/file1\x00', 0x2) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x8000, 0x70) mknodat$auto(r1, &(0x7f00000003c0)='./file0\x00', 0xfff, 0xfffffff8) r2 = openat$auto_binder_ctl_fops_binderfs(0xffffffffffffff9c, &(0x7f0000000200), 0xc0400, 0x0) ioctl$auto_BINDER_CTL_ADD(r2, 0xc1086201, &(0x7f0000000240)={"afc2b1ca92f66d6202000000000000000b20551d19ecba0a4aba723aa74284078ca298c23c09ce2f013cf795fb146dbb52f4c2c591720393044153446ead73a6d0d4e1aaee41af1ec4c0bf648f4702619de28dab3e030000000000000076f0e4246fa36f846c02cc2402d0fc7f8b6f84841c7bd4816934fe9754c906cf66454d154b0a198706f27ab92651e1aa6856ee9bb79124f4712e6f117b13c3b8704e9ec9344c4b59ce49bbf943968bd8bb951575d5932d08a387b96e6679d40511096c5aa292672f18a47748befa7cc5b10cc721f41e62982ebb5543972030b39cc4dea1cc387fc6ebbf4e9c917507ad84e3315313192786fde94536de560500", 0x4, 0x1}) socket(0xa, 0x5, 0x0) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop13\x00', 0x60742, 0x0) write$auto(r3, &(0x7f0000000040)='//\xf2\x00', 0x80000000) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) timer_create$auto(0x0, 0x0, 0x0) r4 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r4, 0x0, 0x0) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) unshare$auto(0x40000080) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0) io_uring_register$auto(0x2, 0x11, &(0x7f0000000180), 0x83) sendmsg$auto_NL80211_CMD_LEAVE_OCB(r5, 0x0, 0x40000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) mbind$auto(0x8002, 0xfa9d, 0x8000000000000000, &(0x7f0000000280)=0x20000000000000fb, 0x3, 0x1) set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0) mmap$auto(0x0, 0xa, 0xdb, 0x9b72, 0x5, 0x8000) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f00000000c0), r4) sendmsg$auto_HWSIM_CMD_DEL_RADIO(r6, &(0x7f0000001a00)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='D`\x00\x00', @ANYRES16=r7, @ANYBLOB="01002dbd7000fddbdf250500000008000a0002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000010) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x8000, 0x70) 4.630708733s ago: executing program 2 (id=2567): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f0000000580)=@task_fd_query={0x7, 0x4, 0x200, 0x37e, 0x0, 0xf, 0xffffffffffffffff, 0x2, 0x5}, 0x6f4) socket(0x1e, 0x4, 0x0) r0 = socket(0x1e, 0x4, 0x0) get_robust_list$auto(0x0, 0x0, 0x0) setsockopt$auto(r0, 0x10f, 0x87, 0x0, 0x14) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$auto(0x3, 0x10f, 0x87, 0x0, 0x14) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/ram9/diskseq\x00', 0x20000, 0x0) read$auto(r2, 0x0, 0x20) writev$auto(r1, &(0x7f0000000200)={0x0, 0x3}, 0x3) bind$auto(0x3, 0x0, 0x9) close_range$auto(0x2, 0xa, 0x0) 4.572439024s ago: executing program 1 (id=2568): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000001a80)='/dev/bus/usb/001/001\x00', 0x29202, 0x0) socket(0x10, 0x2, 0xc) socket$nl_generic(0x10, 0x3, 0x10) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mincore$auto(0x0, 0x8000000000005a, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) mremap$auto(0x0, 0x1, 0x3fd8, 0xb, 0x7) prctl$auto(0x23, 0x200000000000009, 0x7fffffffefff, 0x0, 0x0) r0 = openat$auto_proc_pid_cmdline_ops_base(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/cmdline\x00', 0x60502, 0x0) read$auto_proc_pid_cmdline_ops_base(r0, &(0x7f0000000040)=""/159, 0x9f) sysfs$auto(0x2, 0x1f, 0x0) fsopen$auto(0x0, 0x1) 4.193429451s ago: executing program 3 (id=2569): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$auto_XFS_IOC_ERROR_CLEARALL(0xffffffffffffffff, 0x40085875, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x14, 0x2, 0x8000) r0 = socket(0x2, 0x1, 0x106) bind$auto(r0, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D2\x00', 0x1, 0x0) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0x9, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da07, 0x3, 0x3, 0x65, 0x8000001f, 0x1000, 0x6d3e, 0x9, 0x2, 0x8]}, 0x0) syz_genetlink_get_family_id$auto_mac802154_hwsim(&(0x7f0000000280), r0) sendmsg$auto_MAC802154_HWSIM_CMD_NEW_EDGE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004010}, 0x29882fe5309675a8) open(0x0, 0x0, 0x0) shutdown$auto(0x200000003, 0x2) openat$auto_generic(0xffffffffffffff9c, &(0x7f0000000100)='/proc/kpageflags\x00', 0x2, 0x0) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) read$auto(0x3, 0x0, 0x80) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$auto(0x3, 0x40a0ae49, 0x38) 4.119596697s ago: executing program 2 (id=2570): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x900, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_set_tracer_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/current_tracer\x00', 0x101042, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000900)='/proc/sys/kernel/pid_max\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_nst_seq_fops_netdebug(0xffffffffffffff9c, &(0x7f0000000000), 0x101080, 0x0) openat$auto_proc_single_file_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/io\x00', 0x180780, 0x0) socket$nl_generic(0x10, 0x3, 0x10) inotify_init1$auto(0x3000000000000) socketpair$auto(0x1, 0x3, 0x8000000000000000, 0x0) close_range$auto(0x2, 0xffffffffffffffff, 0x0) open(0x0, 0x22240, 0x55) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$auto(0x3, 0x40106f52, r0) 3.723207571s ago: executing program 2 (id=2571): waitid$auto(0x8, 0xffffffffffffffff, &(0x7f0000000100)={@siginfo_0_0={0x5, 0x98, 0xd, @_timer={0x0, 0x2, @sival_int=0x7, 0x2}}}, 0x3, &(0x7f0000000180)={{0xfffffffffffffff9, 0x80}, {0x2, 0x6}, 0x4, 0x5, 0x1, 0x3, 0x0, 0x8000, 0x80000000, 0x7, 0xb7, 0x5d9, 0x5, 0x7ff, 0x2055}) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000080)={0x0, 0x80000000}, 0x6, 0xffffffffffffffff, 0x4, 0x2e) ioctl$auto_BLKFLSBUF(r0, 0x1261, 0x0) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, 0x0, 0x40, 0x0) mmap$auto(0x0, 0x202000a, 0x5, 0xeb1, 0xfffffffffffffffa, 0x8000) r1 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$auto_VHOST_SET_BACKEND_FEATURES(r1, 0x4008af25, &(0x7f0000000000)=0x7) mmap$auto(0x4, 0xa00006, 0x2, 0x100000000040eb1, 0x602, 0x300000000000) rseq$auto(&(0x7f0000000580)={0x5, 0x85, 0x9416, 0x1, 0x7, 0x6, "551e7285968d8e86bd4794a0e875ee9f7b35db28d0a7e72b7a19039c336389cb57a05ba0582cc612c6c0be4beb4cc54d8337d40c93638ba34c4a0435c32a206e808194584d8c359d418662d18943a5e3c6234e712a096205457b56f0a1e5d4d19835696295a54f38117d9d751e23b5fb61daa5a6b2c75148106dc167a20061e3fe55cc53ffadf62b0945da4b27515a0102a8d2d002a842362b4744b8972a5e11e8a6aab89c7b85947f3901d696d459641aa7e6b89b73387ec5fa2d2af6c992213d82c5774c4bcd4187585bcf652af094e988e75002e01f607abf5e25ae0f5548fd13175b681fc059c1f9160aef893bae78cf6cf62c30fa3f0c5c60cbe383a9c0cc1289519b0c7cff81cc3b4fec739fad19c662b0f98d607b61d825d10e2dd3b27b0f7a6b1adc5a452f344c39da5f086ea7c5d99674ca69c4f5635776e67c151bad72f906cd65231da3a55d6056e23b00686723714fabd752f3e2c86dafdee9d379230c0abeabfde9cf88cae099f3ccc76ea7e64a3734ced5ffe749a8012db53ad4d6a5e347bdd83bb409c1bdb762f4aba145df74833d73ccd583797d4fb4ed3e0c7c29d502aacaef02e114d9e60ca6b0bcb28f825f5d49e94ccd2f830933c39a3ba3782505453e3de872ad8da84a6a22aaa62970428bb9a95d1817dbeeded1c53c5d508dea6cc53d80153b05f954c263278bb9c8bc02f3b1805dd9299dc8b97ebff0165d615ba7bf5ce8c490f4dd273642a18267b0a61a594cb1d608f3dffb292991ea32bb647a6f9b951f283e118dc73b45843b5aa883410e402e3bec9ba889ec237462042cedaed761cca0c3b7058d3ffc276c9a75e18b79804f4e21650d911edbedb9fedd31959a8783b1e39d7d6408554bddb2a5d67703d225fe4422bf2367ca483e77fe479495be3235f4c77b3872a9e33946d2602486b83e84e7d8d1742d369e2d00b9dbb552385502c0f597b3615bed54de65af106b58d2b6bebbdd3fe625152527af965b67e9424da7be2e2574e1492aed568d4faaa9da508e0a2e687876fa291e38b7c3ef38643e2c49e0d46d0f2d53352da2f184c4ced2305865ab0ad1435644419773ea82336ffdf62dd325a6a8b2d199d96dba8a13bb5a86ff65b80818ceb37ee8a2b2a8813b33e474e5b110e1ed13dbc4f52efabbce38935a8ada53a0ed5a1a01453a254a1dc528492159591aa192ff6cfa0b372caf236c78d1a0c94dc37916746358b4cf3cc1c0132657818ce6465e58936dbf5991dfb74ff97382c066ba0ceb06ac4f0c005e4c9166e94161bc08e1c23df7ed3419b10ae229aa6bafb19e6af003c9e319956723d839dc50a7edd8d80bce971ba504e0aac811d76e65acffdc4f7e9836396ba98b824be6cc704c59f5849642b191437a5cf902fc1ac491e8c59241586c6791b282b5cfae57eb7e6792048c4769b5b3f21987ec5097e530fd001da5d2999db4ded708225e9a53a2b48d2be3401a063da3c19168769eccaef710d7c2e06818bb05c4a9aa0ce2785a5a6d2846bac9836f1905a9b042029dcc59d918450b6affb522fbf78116941c5cef4ecb82a2134ee8e67ea6091170b67bfc3abec9e2cfc8208d4ba3bb732230fe6a9470c1152ebdc31bbce93cb742b4484bc1cef4298ce897a36c7e8b3ef8bd1b0e3d4dfa46da8bf89b06d67d8a5da465e8f68f999ec38ef8d1b7972125d2d8492680f6698419313afb74b5f715c90aa5ca0a6ea5561acd89a25d0fd066234b1752d6535251be347d8e69afea162f0ae84aa08a1a5475e6860af5956babe0530b6349e918fa97f14e6a83f7e2054c85ec37424757c49c6b76a889cde8473eebc495ac1088fda54f5c70bb17ef4873bf7b524ae892cd8267adfcd1e7054ac0c8b904855f816cbab8a6c5332d2221060b97931130187e1f07b0b9fad917c06f56d3f9fbca9d0ad93c300d88a6025359eb609e86c2b604d6834cde1351ccb0ba238715d6a77953f58b23a78db05bc38cf1e47d5336226a966af0a88fa19b4d992fc82310b7fceee45a202bfdf759dedee618361082881f91f85020e5282fd6a4ff376455f09bd1ca73b16549"}, 0x6, 0x3, 0xff) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='/sys/devices/platform/vivid.0/cec28/power/runtime_suspended_time\x00', 0x22040, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) read$auto(r3, 0x0, 0x2e) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$auto(0x3, 0x0, 0x100082) r4 = epoll_create$auto(0x4) r5 = socket(0x2, 0x5, 0x0) epoll_ctl$auto(r4, 0x1, r5, 0x0) r6 = epoll_create$auto(0x3e) epoll_ctl$auto(r6, 0x1, r4, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) 2.738347274s ago: executing program 1 (id=2572): listmount$auto(&(0x7f0000000100)={0xba, @raw, 0x8000000000, 0xfffffffffffffff7}, 0x0, 0xf4240, 0x0) mount_setattr$auto(0x5, 0x0, 0x0, &(0x7f0000000640)={0x100010, 0x7f}, 0x283) r0 = pidfd_open$auto(0x1, 0x0) setns(r0, 0x60020000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000100), r1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_SET_WOWLAN(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010028bd7000fedbdf257a00000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x2400c815}, 0x804) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) setreuid$auto(0x3, 0x7) syz_clone3(&(0x7f0000000300)={0x10120000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, &(0x7f0000000100)=[0x0], 0x1}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0xc642, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) r4 = socket(0x2, 0x2, 0x1) cachestat$auto(0xffffffffffffffff, &(0x7f00000000c0)={0x401, 0x428a}, 0x0, 0x0) close_range$auto(r4, 0xffffffffffffffff, 0x2) bpf$auto(0x0, &(0x7f0000000000)=@bpf_attr_4={0x1b, r4, 0x10000}, 0x10) ppoll$auto(&(0x7f0000000080)={0xffffffffffffffff, 0xf7f, 0x81}, 0x10, 0x0, 0x0, 0x8) r5 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000040), 0xffffffffffffffff) r6 = openat2$auto(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0xda6, 0xfffffffffffff2da, 0x2}, 0x5) sendmsg$auto_MACSEC_CMD_UPD_RXSC(r6, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r5, 0x400, 0x70ad27, 0x25dfdbfb, {}, [@MACSEC_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x880}, 0x40000) 2.554225293s ago: executing program 4 (id=2573): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r1 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, 0x0, 0x100000a3d9) socket(0xa, 0x801, 0x84) connect$auto(r1, 0x0, 0x54) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) mknod$auto(&(0x7f0000000040)='./file0\x00', 0x1001, 0x4) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x7, 0x734f, 0x33, 0x67f, 0x1ffde, 0x7, 0x3, 0x20000002, 0xd, 0x3, 0x1, 0x2091, 0x83ad, 0x9, 0x6, 0x6, 0x81, 0x4, 0x1cd7, 0x4, 0x2000, 0x203, 0x0, 0x84, 0xfffffffffffffffa, 0x0, 0x0, 0x1, 0x101, [0x0, 0x0, 0x8003, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa04, 0x76, 0xfffffffffffffffc, 0x3, 0x4, 0x1ff, 0x20, 0x9, 0x80000, 0x40000000, 0x0, 0x7, 0x0, 0x2, 0x7ff, 0x0, 0x7fffffff, 0x3, 0x40000000000000, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8, 0x0, 0x3c3, 0x0, 0x2]}, 0x1fe, 0x1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x2, 0x1, 0x84) ioctl$auto_BLKTRACESTOP(r1, 0x1275, 0x0) socketpair$auto(0x1, 0x5, 0x8000000000000000, 0x0) setsockopt$auto(0x3, 0x10000000084, 0x7d, 0x0, 0x8) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000003000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x24000044) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x13, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8040) r2 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000080)={0x0, 0xfc2}, 0x2, &(0x7f0000000100), 0x3, 0x2}, 0x10000}, 0xffffffff, 0x4008) 2.05370745s ago: executing program 3 (id=2574): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000000340), 0xffffffffffffffff) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/irq.pressure\x00', 0x101102, 0x0) read$auto(0x3, 0x0, 0x7fffffff) r2 = pidfd_open$auto(0x0, 0x280000) r3 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), r0) write$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f00000001c0)="947e3e44c2d92998efed", 0xa) sendmsg$auto_NL80211_CMD_GET_WIPHY(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r3, 0x20, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_STA_VLAN={0x8, 0x14, 0x4}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x3}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, 0xfffffffa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000005}, 0x4000804) sendmsg$auto_NBD_CMD_CONNECT(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x2c, r1, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40080}, 0x20040000) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/fs/ext4/sda1/last_trim_minblks\x00', 0x2400, 0x0) read$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f00000000c0)=""/7, 0x7) 1.252954952s ago: executing program 2 (id=2575): syz_genetlink_get_family_id$auto_batadv(0x0, 0xffffffffffffffff) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r3 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r3, 0xc004743e, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_gtp(0x0, 0xffffffffffffffff) sendmsg$auto_GTP_CMD_NEWPDP(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, r5, 0xc1b, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x7a5}, [@GTPA_FLOW={0x6, 0x6, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x800) bind$auto(0xffffffffffffffff, &(0x7f0000000200)=@generic={0x11, "00030f00"}, 0x80) r6 = openat$auto_proc_oom_adj_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/oom_adj\x00', 0x48402, 0x0) read$auto(r6, 0x0, 0x1f40) r7 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) writev$auto(r7, &(0x7f0000000200)={0x0, 0x9}, 0x3) close_range$auto(0x2, 0x8, 0x0) close_range$auto(0x2, 0x8, 0x0) r8 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r1) ioctl$auto_KVM_GET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0xdd, 0x0, [{0x40000021, 0x400, 0xfff}]}) ioctl$auto_KVM_CREATE_VM(r0, 0xae80, 0x0) openat$auto_bridges_fops_(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/dri/vkms/encoder-1/bridges\x00', 0x4c8683, 0x0) 1.198939935s ago: executing program 3 (id=2576): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) (async) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) (async) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) close_range$auto(0x2, 0x8, 0x0) openat$auto_rtc_dev_fops_dev(0xffffffffffffff9c, &(0x7f0000000340), 0x189400, 0x0) pwrite64$auto(r0, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x88\xa8s\x1c\b\x06\x8a>)\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0x4e, 0x3) (async) pwrite64$auto(r0, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x88\xa8s\x1c\b\x06\x8a>)\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0x4e, 0x3) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cgroup.threads\x00', 0x80302, 0x0) (async) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cgroup.threads\x00', 0x80302, 0x0) preadv$auto(0x3, &(0x7f0000000040)={0x0, 0x5}, 0x3, 0xf8, 0xffffffffffffffff) mmap$auto(0x0, 0x7069, 0x8, 0x19, 0x401, 0x8ffd) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) (async) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) (async) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r2) (async) ioctl$auto(0x3, 0xae41, r2) ioctl$auto_KVM_CREATE_VM(r1, 0xae80, 0x0) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000080)={0x7fffffff, 0xfffffeff, 0x2, 0x6, 0x7, 0x8, 0xffffffffffffffff, [], {0x6, 0x6, 0xf, 0x29f, 0x2, 0x83, 0x101, 0x17f, 0x2}, {0xff, 0x1, 0x52, 0x5, 0x1, 0x40, 0x4, 0x8, 0x100000004}}) mmap$auto(0x0, 0x1, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x0) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) read$auto(r3, 0x0, 0x20) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x140082, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) (async) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) (async) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) 1.156995999s ago: executing program 4 (id=2577): mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = socket(0x11, 0x80003, 0x300) io_uring_setup$auto(0x8, 0x0) setsockopt$auto(r0, 0x107, 0x14, 0x0, 0x4) sendto$auto(r0, 0x0, 0x13, 0xc, &(0x7f0000000000)=@tipc=@name={0x1e, 0x2, 0x3, {{0x40, 0x4}, 0x2}}, 0x1e) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) r1 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x82802, 0x0) kexec_load$auto(0x5, 0x2, 0x0, 0x4) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, r1, 0x0) mbind$auto(0x0, 0x800605, 0x8003, &(0x7f0000000100)=0xfffe, 0x3, 0x3) 1.154499636s ago: executing program 1 (id=2578): timer_create$auto_CLOCK_TAI(0xb, &(0x7f0000000200)={@sival_ptr=&(0x7f0000000300)="873b6e0875f2", @raw=0x1976, 0x81, @_sigev_thread={&(0x7f00000001c0)=&(0x7f0000000500)=0x3, 0x0}}, &(0x7f0000000280)=0x2000) sendmsg$auto_NL80211_CMD_SET_REG(0xffffffffffffffff, 0x0, 0x40) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) clone$auto(0x100000020003b49, 0x80000000002, 0x0, 0x0, 0x4) close_range$auto(0xffffffffffffffff, 0xfffffffffffff000, 0x2) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(r0, &(0x7f0000000200)='7\x00\\\xa0\x04|\x03\'\x00\xc9\n\xbf\xb9\x12\xfa\x00\x00\xcfk', 0xb7f) sendmsg$auto_ETHTOOL_MSG_MODULE_EEPROM_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x0) mmap$auto(0x13, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) 171.053828ms ago: executing program 1 (id=2579): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) bpf$auto(0x5, 0x0, 0x80) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) socket(0x2b, 0x1, 0x0) listen$auto(0x3, 0x81) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) r1 = syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000980)={0x14, r1, 0x1, 0x70bd31, 0x25dfdbfd}, 0x14}}, 0x24048084) madvise$auto(0x0, 0x200007, 0x19) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x101001, 0x0) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000340), 0x80200, 0x0) pread64$auto(r3, &(0x7f0000000240)='\x03W\x96l\x15\x00'/21, 0x100000002, 0x100000001) madvise$auto(0x0, 0xffffffffffff0005, 0x19) socket(0x2, 0x3, 0xa) mmap$auto(0x2, 0x200000000002, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) mkdir$auto(&(0x7f0000000100)='}[,&*}\x00', 0x8003) 0s ago: executing program 2 (id=2580): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram5\x00', 0x1eba02, 0x0) setresuid$auto(0x0, 0x0, 0x0) ioctl$auto_BLKALIGNOFF(r0, 0x127a, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/mtd/mtd0/bitflip_threshold\x00', 0x2062, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f0000002680), 0xffffffffffffffff) sendmsg$auto_IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010800000000fedbdf250f00"/30], 0x24}, 0x1, 0x0, 0x0, 0x40014}, 0x0) syz_clone(0x20000000, &(0x7f00000001c0)="5d72feef34fdd0a27eb7e56df38f250987e0b8310f39e532cdbde8cec75ce9f048e94dfcea0d8baa52e6066d3de97f52d6f6759adafcb54ea5eaf500c90ed43cbbd056ee311eb07318bce86195a2af8c5eefebf3bf73a44746899517887b74b3fe27ecefeae5006b3b51d1891fb12b60b6a576fefe084a9d6ca9bcfc53e50918e8f8faaa9743f30409a28a69907879cc9a387311dc6292fb1308764cced3b7b8fd20fff070f3e0854070d7b45f6660ad29105c", 0xb3, &(0x7f0000000280), 0x0, &(0x7f0000000b00)="2918758169251555183442853a27ba37074b62633f338d1a7b74c6ff4c91676d9a5e0078ab1db0f30dc404f23fd5820a80ed88704e31ac2c5f3169cb36f22141f45b35a2e04fe71bc918ec46671bf5d28d8d26ce4970c811a8b669c7011c3e9ff8b2109640b7b624fde03bb975adc229120a01000000cf8a90044854f04b55f429540f9fc390d24df293299b9c4395aed65212fdd9a1597ffcfaf9b3008f77bcc5a593486eb61127560aa974af592514e14d762263bcb4be4099bd44e63da3b0fe72d6ace5e3d7110a89d2be9d2b7968b4c25bcf9f05ac447e5db076afdf8ea2fa699dfdd9f0079ca304a36419bd7eb65bead94607fefc899113f0955f8b569f6d9808c8e59817a1c64d729476e7fd3c3bb79985e07d5cdc3226a255a2ae84e34bb3969653") waitid$auto_P_PID(0x1, 0xffffffffffffffff, &(0x7f00000003c0)={@_si_pad}, 0x1ecc, &(0x7f0000000440)={{0xffffffff, 0x2}, {0x7, 0x19}, 0x9, 0x80000000, 0x4, 0x5, 0x8000000000000001, 0x6, 0x6, 0x0, 0x9, 0x0, 0x0, 0x1000, 0x0, 0x4}) set_tid_address$auto(&(0x7f0000000500)=0x5) getpgid$auto(0x0) r4 = openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, &(0x7f0000000080), 0x8203, 0x0) ioctl$auto(r4, 0x80046f45, 0x38) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) sched_setattr$auto(0x0, 0x0, 0x7b) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) mmap$auto(0x0, 0x7f, 0xdf, 0x9b72, 0x2, 0x8000) r5 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$auto_tomoyo_operations_securityfs_if(r5, &(0x7f0000000100)="0a1b9a3c3e3e006e163bb154d7886d8ea5c2574c58e9867ecec3371cadb84877", 0x20) open(&(0x7f0000000100)='.\x00', 0x0, 0x408) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) prctl$auto(0x10, 0x6, 0x7, 0xffffffffffffff78, 0x8) setsockopt$auto(0xffffffffffffffff, 0x10000000084, 0x22, 0x0, 0x10) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) kernel console output (not intermixed with test programs): 7f [ 684.103725][T14928] RIP: 0033:0x7f6d5239aeb9 [ 684.103752][T14928] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 684.103786][T14928] RSP: 002b:00007f6d53194028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 684.103820][T14928] RAX: ffffffffffffffda RBX: 00007f6d52615fa0 RCX: 00007f6d5239aeb9 [ 684.103842][T14928] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 [ 684.103863][T14928] RBP: 00007f6d52408c1f R08: 0000000000000000 R09: 0000000000000000 [ 684.103883][T14928] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 684.103902][T14928] R13: 00007f6d52616038 R14: 00007f6d52615fa0 R15: 00007ffe330a4ed8 [ 684.103948][T14928] [ 684.103968][T14928] hub 1-0:1.0: config failed, out of memory (err -12) [ 686.243962][T14974] CIFS: VFS: Invalid SecurityFlags: 0 [ 686.243962][T14974] [ 686.298136][T14974] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2060'. [ 686.861811][T14978] FAULT_INJECTION: forcing a failure. [ 686.861811][T14978] name fail_futex, interval 1, probability 0, space 0, times 0 [ 686.879997][T14978] CPU: 0 UID: 0 PID: 14978 Comm: syz.1.2059 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 686.880041][T14978] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 686.880053][T14978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 686.880067][T14978] Call Trace: [ 686.880074][T14978] [ 686.880084][T14978] dump_stack_lvl+0x100/0x190 [ 686.880117][T14978] should_fail_ex.cold+0x5/0xa [ 686.880156][T14978] get_futex_key+0x295/0x1620 [ 686.880190][T14978] ? __pfx_get_futex_key+0x10/0x10 [ 686.880230][T14978] futex_wake+0xea/0x530 [ 686.880269][T14978] ? __pfx_futex_wake+0x10/0x10 [ 686.880307][T14978] ? exit_mm_release+0x19/0x30 [ 686.880347][T14978] do_futex+0x32b/0x350 [ 686.880380][T14978] ? __pfx_do_futex+0x10/0x10 [ 686.880411][T14978] ? __might_fault+0xc5/0x140 [ 686.880446][T14978] mm_release+0x24a/0x2f0 [ 686.880474][T14978] do_exit+0x675/0x2a30 [ 686.880513][T14978] ? __pfx_do_exit+0x10/0x10 [ 686.880548][T14978] ? do_raw_spin_lock+0x128/0x260 [ 686.880583][T14978] ? find_held_lock+0x2b/0x80 [ 686.880606][T14978] ? get_signal+0x7e0/0x21e0 [ 686.880637][T14978] do_group_exit+0xd5/0x2a0 [ 686.880675][T14978] get_signal+0x1ec7/0x21e0 [ 686.880713][T14978] ? __pfx_get_signal+0x10/0x10 [ 686.880742][T14978] ? do_futex+0x192/0x350 [ 686.880785][T14978] arch_do_signal_or_restart+0x91/0x770 [ 686.880820][T14978] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 686.880861][T14978] ? __pfx___x64_sys_futex+0x10/0x10 [ 686.880900][T14978] exit_to_user_mode_loop+0x86/0x4b0 [ 686.880933][T14978] ? rcu_is_watching+0x12/0xc0 [ 686.880962][T14978] do_syscall_64+0x4ea/0xf80 [ 686.880994][T14978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 686.881018][T14978] RIP: 0033:0x7f6d5239aeb9 [ 686.881036][T14978] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 686.881060][T14978] RSP: 002b:00007f6d505b40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 686.881082][T14978] RAX: fffffffffffffe00 RBX: 00007f6d52616368 RCX: 00007f6d5239aeb9 [ 686.881098][T14978] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6d52616368 [ 686.881113][T14978] RBP: 00007f6d52616360 R08: 0000000000000000 R09: 0000000000000000 [ 686.881127][T14978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 686.881141][T14978] R13: 00007f6d526163f8 R14: 00007ffe330a4df0 R15: 00007ffe330a4ed8 [ 686.881221][T14978] [ 687.183739][T14987] hub 1-0:1.0: USB hub found [ 687.188961][T14987] hub 1-0:1.0: 1 port detected [ 687.201544][T14987] FAULT_INJECTION: forcing a failure. [ 687.201544][T14987] name failslab, interval 1, probability 0, space 0, times 0 [ 687.322302][T14987] CPU: 1 UID: 0 PID: 14987 Comm: syz.2.2061 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 687.322369][T14987] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 687.322386][T14987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 687.322407][T14987] Call Trace: [ 687.322419][T14987] [ 687.322433][T14987] dump_stack_lvl+0x100/0x190 [ 687.322482][T14987] should_fail_ex.cold+0x5/0xa [ 687.322540][T14987] should_failslab+0xc2/0x120 [ 687.322588][T14987] ? usb_alloc_urb+0x66/0xa0 [ 687.322619][T14987] __kmalloc_noprof+0xf6/0x9c0 [ 687.322667][T14987] ? usb_alloc_urb+0x66/0xa0 [ 687.322696][T14987] usb_alloc_urb+0x66/0xa0 [ 687.322730][T14987] usb_control_msg+0x1d3/0x4a0 [ 687.322772][T14987] ? __pfx_usb_control_msg+0x10/0x10 [ 687.322807][T14987] ? __kmalloc_noprof+0x365/0x9c0 [ 687.322853][T14987] usb_get_status+0xdc/0x280 [ 687.322932][T14987] hub_probe.cold+0x1c9a/0x2f2b [ 687.322999][T14987] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 687.323052][T14987] ? __pfx_hub_probe+0x10/0x10 [ 687.323098][T14987] ? percpu_rwsem_wake_function+0x250/0x4a0 [ 687.323133][T14987] ? find_held_lock+0x2b/0x80 [ 687.323171][T14987] ? mark_held_locks+0x40/0x70 [ 687.323216][T14987] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 687.323259][T14987] usb_probe_interface+0x303/0x8f0 [ 687.323318][T14987] ? __pfx_usb_probe_interface+0x10/0x10 [ 687.323372][T14987] really_probe+0x241/0xa60 [ 687.323419][T14987] __driver_probe_device+0x1de/0x400 [ 687.323465][T14987] driver_probe_device+0x4c/0x1b0 [ 687.323509][T14987] __device_attach_driver+0x1df/0x340 [ 687.323553][T14987] ? __pfx___device_attach_driver+0x10/0x10 [ 687.323596][T14987] bus_for_each_drv+0x159/0x1e0 [ 687.323651][T14987] ? __pfx_bus_for_each_drv+0x10/0x10 [ 687.323706][T14987] ? lockdep_hardirqs_on+0x78/0x100 [ 687.323746][T14987] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 687.323788][T14987] __device_attach+0x1e4/0x4d0 [ 687.323829][T14987] ? __pfx___device_attach+0x10/0x10 [ 687.323874][T14987] ? do_raw_spin_unlock+0x145/0x1e0 [ 687.323940][T14987] device_initial_probe+0xaf/0xd0 [ 687.323986][T14987] bus_probe_device+0x64/0x160 [ 687.324027][T14987] device_add+0x11d9/0x1950 [ 687.324078][T14987] ? __pfx_device_add+0x10/0x10 [ 687.324126][T14987] ? mark_held_locks+0x40/0x70 [ 687.324183][T14987] usb_set_configuration+0xd97/0x1c60 [ 687.324258][T14987] bConfigurationValue_store+0x100/0x180 [ 687.324308][T14987] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 687.324355][T14987] ? find_held_lock+0x2b/0x80 [ 687.324388][T14987] ? sysfs_file_kobj+0xe4/0x290 [ 687.324427][T14987] ? sysfs_file_kobj+0xe4/0x290 [ 687.324470][T14987] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 687.324516][T14987] dev_attr_store+0x58/0x80 [ 687.324562][T14987] ? __pfx_dev_attr_store+0x10/0x10 [ 687.324608][T14987] sysfs_kf_write+0xf2/0x150 [ 687.324652][T14987] kernfs_fop_write_iter+0x3e0/0x5f0 [ 687.324686][T14987] ? __pfx_sysfs_kf_write+0x10/0x10 [ 687.324732][T14987] iter_file_splice_write+0x82b/0x10a0 [ 687.324797][T14987] ? __pfx_iter_file_splice_write+0x10/0x10 [ 687.324849][T14987] ? __pfx_copy_splice_read+0x10/0x10 [ 687.324917][T14987] ? __pfx_iter_file_splice_write+0x10/0x10 [ 687.324962][T14987] direct_splice_actor+0x192/0x6c0 [ 687.325008][T14987] splice_direct_to_actor+0x345/0xa30 [ 687.325051][T14987] ? __pfx_direct_splice_actor+0x10/0x10 [ 687.325099][T14987] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 687.325152][T14987] do_splice_direct+0x174/0x240 [ 687.325192][T14987] ? __pfx_do_splice_direct+0x10/0x10 [ 687.325228][T14987] ? common_file_perm+0x1ab/0x4f0 [ 687.325279][T14987] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 687.325325][T14987] ? rw_verify_area+0xce/0x6d0 [ 687.325363][T14987] do_sendfile+0xadc/0xe20 [ 687.325409][T14987] ? __pfx_do_sendfile+0x10/0x10 [ 687.325443][T14987] ? __sys_sendmsg+0x18f/0x220 [ 687.325499][T14987] ? __x64_sys_futex+0x34f/0x4d0 [ 687.325533][T14987] ? __x64_sys_futex+0x358/0x4d0 [ 687.325570][T14987] __x64_sys_sendfile64+0x1d8/0x220 [ 687.325603][T14987] ? xfd_validate_state+0x129/0x190 [ 687.325642][T14987] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 687.325685][T14987] do_syscall_64+0xc9/0xf80 [ 687.325718][T14987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.325744][T14987] RIP: 0033:0x7fd15cf9aeb9 [ 687.325766][T14987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 687.325789][T14987] RSP: 002b:00007fd15df41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 687.325813][T14987] RAX: ffffffffffffffda RBX: 00007fd15d215fa0 RCX: 00007fd15cf9aeb9 [ 687.325829][T14987] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 [ 687.325844][T14987] RBP: 00007fd15d008c1f R08: 0000000000000000 R09: 0000000000000000 [ 687.325859][T14987] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 687.325874][T14987] R13: 00007fd15d216038 R14: 00007fd15d215fa0 R15: 00007ffd4d5f1bc8 [ 687.325911][T14987] [ 687.325969][T14987] hub 1-0:1.0: config failed, can't get hub status (err -5) [ 689.888916][T15026] netlink: 'syz.3.2074': attribute type 2 has an invalid length. [ 690.026402][T15027] netlink: 'syz.1.2072': attribute type 2 has an invalid length. [ 691.885139][ T7403] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 3534 with max blocks 26 with error 117 [ 691.939536][ T7403] EXT4-fs (sda1): This should not happen!! Data will be lost [ 691.939536][ T7403] [ 693.254410][T15076] FAULT_INJECTION: forcing a failure. [ 693.254410][T15076] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 693.296643][T15076] CPU: 0 UID: 0 PID: 15076 Comm: syz.2.2086 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 693.296709][T15076] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 693.296726][T15076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 693.296747][T15076] Call Trace: [ 693.296758][T15076] [ 693.296772][T15076] dump_stack_lvl+0x100/0x190 [ 693.296824][T15076] should_fail_ex.cold+0x5/0xa [ 693.296866][T15076] _copy_from_iter+0x43a/0x1690 [ 693.296911][T15076] ? __pfx__copy_from_iter+0x10/0x10 [ 693.296950][T15076] ? __asan_memset+0x23/0x50 [ 693.296976][T15076] ? __build_skb_around+0x278/0x390 [ 693.297008][T15076] ? is_vmalloc_addr+0x86/0xa0 [ 693.297039][T15076] netlink_sendmsg+0x808/0xda0 [ 693.297083][T15076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 693.297125][T15076] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 693.297160][T15076] sock_write_iter+0x566/0x610 [ 693.297188][T15076] ? __pfx_sock_write_iter+0x10/0x10 [ 693.297214][T15076] ? futex_unqueue+0x133/0x2c0 [ 693.297255][T15076] ? __futex_wait+0x256/0x300 [ 693.297283][T15076] do_iter_readv_writev+0x6ee/0x920 [ 693.297311][T15076] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 693.297335][T15076] ? common_file_perm+0x1ab/0x4f0 [ 693.297379][T15076] ? bpf_lsm_file_permission+0x9/0x10 [ 693.297414][T15076] ? security_file_permission+0x76/0x210 [ 693.297455][T15076] ? rw_verify_area+0xce/0x6d0 [ 693.297522][T15076] vfs_writev+0x360/0xe10 [ 693.297569][T15076] ? __pfx_vfs_writev+0x10/0x10 [ 693.297640][T15076] ? __fget_files+0x21f/0x3d0 [ 693.297676][T15076] ? do_writev+0x28a/0x340 [ 693.297700][T15076] do_writev+0x28a/0x340 [ 693.297727][T15076] ? __pfx_do_writev+0x10/0x10 [ 693.297765][T15076] do_syscall_64+0xc9/0xf80 [ 693.297798][T15076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.297824][T15076] RIP: 0033:0x7fd15cf9aeb9 [ 693.297844][T15076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 693.297869][T15076] RSP: 002b:00007fd15df41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 693.297893][T15076] RAX: ffffffffffffffda RBX: 00007fd15d215fa0 RCX: 00007fd15cf9aeb9 [ 693.297910][T15076] RDX: 0000000000000008 RSI: 0000200000000100 RDI: 0000000000000003 [ 693.297926][T15076] RBP: 00007fd15d008c1f R08: 0000000000000000 R09: 0000000000000000 [ 693.297941][T15076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 693.297955][T15076] R13: 00007fd15d216038 R14: 00007fd15d215fa0 R15: 00007ffd4d5f1bc8 [ 693.297986][T15076] [ 696.231310][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 696.237996][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 698.417927][T15104] FAULT_INJECTION: forcing a failure. [ 698.417927][T15104] name failslab, interval 1, probability 0, space 0, times 0 [ 698.447149][T15104] CPU: 1 UID: 0 PID: 15104 Comm: syz.2.2095 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 698.447201][T15104] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 698.447213][T15104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 698.447228][T15104] Call Trace: [ 698.447236][T15104] [ 698.447246][T15104] dump_stack_lvl+0x100/0x190 [ 698.447281][T15104] should_fail_ex.cold+0x5/0xa [ 698.447323][T15104] should_failslab+0xc2/0x120 [ 698.447359][T15104] kmem_cache_alloc_noprof+0x83/0x780 [ 698.447393][T15104] ? vm_area_alloc+0x1f/0x160 [ 698.447424][T15104] ? vm_area_alloc+0x1f/0x160 [ 698.447448][T15104] vm_area_alloc+0x1f/0x160 [ 698.447473][T15104] __mmap_region+0x101e/0x2820 [ 698.447507][T15104] ? __pfx___mmap_region+0x10/0x10 [ 698.447556][T15104] ? finish_task_switch.isra.0+0x204/0xb70 [ 698.447585][T15104] ? lockdep_hardirqs_on+0x78/0x100 [ 698.447615][T15104] ? finish_task_switch.isra.0+0x204/0xb70 [ 698.447698][T15104] ? rcu_is_watching+0x12/0xc0 [ 698.447731][T15104] mmap_region+0x180/0x3e0 [ 698.447766][T15104] do_mmap+0xc63/0x12f0 [ 698.447808][T15104] ? __pfx_do_mmap+0x10/0x10 [ 698.447845][T15104] ? __pfx_down_write_killable+0x10/0x10 [ 698.447886][T15104] vm_mmap_pgoff+0x29e/0x470 [ 698.447928][T15104] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 698.447972][T15104] ? __x64_sys_futex+0x34f/0x4d0 [ 698.448005][T15104] ? __x64_sys_futex+0x358/0x4d0 [ 698.448044][T15104] ksys_mmap_pgoff+0x7d/0x5b0 [ 698.448084][T15104] __x64_sys_mmap+0x125/0x190 [ 698.448111][T15104] do_syscall_64+0xc9/0xf80 [ 698.448144][T15104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.448169][T15104] RIP: 0033:0x7fd15cf9aeb9 [ 698.448196][T15104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.448221][T15104] RSP: 002b:00007fd15df41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 698.448245][T15104] RAX: ffffffffffffffda RBX: 00007fd15d215fa0 RCX: 00007fd15cf9aeb9 [ 698.448261][T15104] RDX: 00000000000000df RSI: 0000000000040009 RDI: 0000000000000000 [ 698.448277][T15104] RBP: 00007fd15d008c1f R08: 0000000000000007 R09: 0000000000028000 [ 698.448293][T15104] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 698.448309][T15104] R13: 00007fd15d216038 R14: 00007fd15d215fa0 R15: 00007ffd4d5f1bc8 [ 698.448340][T15104] [ 700.685787][T15124] netlink: 'syz.1.2099': attribute type 2 has an invalid length. [ 701.129406][T15133] FAULT_INJECTION: forcing a failure. [ 701.129406][T15133] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 701.198843][T15133] CPU: 0 UID: 0 PID: 15133 Comm: syz.3.2101 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 701.198905][T15133] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 701.198921][T15133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 701.198942][T15133] Call Trace: [ 701.198953][T15133] [ 701.198966][T15133] dump_stack_lvl+0x100/0x190 [ 701.199012][T15133] should_fail_ex.cold+0x5/0xa [ 701.199062][T15133] ? prepare_alloc_pages+0x16d/0x5f0 [ 701.199122][T15133] should_fail_alloc_page+0xeb/0x140 [ 701.199173][T15133] prepare_alloc_pages+0x1f0/0x5f0 [ 701.199226][T15133] ? css_rstat_updated+0x1ce/0x5a0 [ 701.199272][T15133] __alloc_frozen_pages_noprof+0x193/0x2410 [ 701.199315][T15133] ? lock_acquire+0x17c/0x330 [ 701.199368][T15133] ? rcu_is_watching+0x12/0xc0 [ 701.199401][T15133] ? mod_memcg_lruvec_state+0x1a6/0x5d0 [ 701.199437][T15133] ? find_held_lock+0x2b/0x80 [ 701.199472][T15133] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 701.199528][T15133] ? folio_remove_rmap_pmd+0x69c/0xed0 [ 701.199572][T15133] ? split_huge_pmd_locked+0x3bd/0x3c90 [ 701.199608][T15133] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 701.199648][T15133] ? policy_nodemask+0xed/0x4f0 [ 701.199712][T15133] alloc_pages_mpol+0x1fb/0x550 [ 701.199764][T15133] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 701.199811][T15133] ? __split_huge_pmd+0x203/0x350 [ 701.199844][T15133] ? __split_huge_pmd+0x203/0x350 [ 701.199889][T15133] alloc_pages_noprof+0x131/0x390 [ 701.199941][T15133] pte_alloc_one+0x1e/0x3e0 [ 701.199987][T15133] __pte_alloc+0x6d/0x3f0 [ 701.200034][T15133] ? __pfx___pte_alloc+0x10/0x10 [ 701.200084][T15133] ? _raw_spin_unlock+0x28/0x50 [ 701.200118][T15133] ? __pmd_alloc+0x6aa/0x9c0 [ 701.200174][T15133] move_page_tables+0x24eb/0x43e0 [ 701.200236][T15133] ? __pfx_move_page_tables+0x10/0x10 [ 701.200296][T15133] ? lock_acquire+0x17c/0x330 [ 701.200348][T15133] copy_vma_and_data+0x25c/0x7c0 [ 701.200393][T15133] ? __pfx_copy_vma_and_data+0x10/0x10 [ 701.200452][T15133] ? find_held_lock+0x2b/0x80 [ 701.200484][T15133] ? move_vma+0x50c/0x1990 [ 701.200520][T15133] ? move_vma+0x50c/0x1990 [ 701.200557][T15133] ? __vm_enough_memory+0x184/0x390 [ 701.200620][T15133] move_vma+0x51e/0x1990 [ 701.200666][T15133] ? __pfx_move_vma+0x10/0x10 [ 701.200717][T15133] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 701.200772][T15133] ? cap_mmap_addr+0x4b/0x120 [ 701.200814][T15133] ? bpf_lsm_mmap_addr+0x9/0x10 [ 701.200860][T15133] ? security_mmap_addr+0x71/0x1e0 [ 701.200915][T15133] ? __get_unmapped_area+0x255/0x3e0 [ 701.200973][T15133] ? vrm_set_new_addr+0x204/0x290 [ 701.201017][T15133] mremap_to+0x1b7/0x450 [ 701.201058][T15133] do_mremap+0xb76/0x2130 [ 701.201116][T15133] ? __pfx_do_mremap+0x10/0x10 [ 701.201167][T15133] ? ksys_write+0x190/0x250 [ 701.201217][T15133] __do_sys_mremap+0x126/0x170 [ 701.201258][T15133] ? __pfx___do_sys_mremap+0x10/0x10 [ 701.201310][T15133] ? __x64_sys_futex+0x34f/0x4d0 [ 701.201385][T15133] do_syscall_64+0xc9/0xf80 [ 701.201431][T15133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.201467][T15133] RIP: 0033:0x7fc00959aeb9 [ 701.201496][T15133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 701.201530][T15133] RSP: 002b:00007fc00a4fa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 701.201564][T15133] RAX: ffffffffffffffda RBX: 00007fc009816180 RCX: 00007fc00959aeb9 [ 701.201587][T15133] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000000000 [ 701.201607][T15133] RBP: 00007fc009608c1f R08: 0000000100000000 R09: 0000000000000000 [ 701.201628][T15133] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 701.201649][T15133] R13: 00007fc009816218 R14: 00007fc009816180 R15: 00007ffc5b37b708 [ 701.201700][T15133] [ 703.842765][T15155] FAULT_INJECTION: forcing a failure. [ 703.842765][T15155] name failslab, interval 1, probability 0, space 0, times 0 [ 703.882636][T15160] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2106'. [ 703.986279][T15155] CPU: 0 UID: 0 PID: 15155 Comm: syz.4.2105 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 703.986340][T15155] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 703.986357][T15155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 703.986376][T15155] Call Trace: [ 703.986396][T15155] [ 703.986410][T15155] dump_stack_lvl+0x100/0x190 [ 703.986458][T15155] should_fail_ex.cold+0x5/0xa [ 703.986518][T15155] should_failslab+0xc2/0x120 [ 703.986569][T15155] kmem_cache_alloc_noprof+0x83/0x780 [ 703.986619][T15155] ? vm_area_alloc+0x1f/0x160 [ 703.986664][T15155] ? vm_area_alloc+0x1f/0x160 [ 703.986699][T15155] vm_area_alloc+0x1f/0x160 [ 703.986735][T15155] __mmap_region+0x101e/0x2820 [ 703.986783][T15155] ? __pfx___mmap_region+0x10/0x10 [ 703.986835][T15155] ? __lock_acquire+0x4a5/0x2630 [ 703.986898][T15155] ? lock_acquire+0x17c/0x330 [ 703.986943][T15155] ? find_held_lock+0x2b/0x80 [ 703.986996][T15155] ? rcu_is_watching+0x12/0xc0 [ 703.987036][T15155] ? trace_sched_exit_tp+0xcd/0x100 [ 703.987070][T15155] ? __schedule+0xf65/0x5e10 [ 703.987134][T15155] ? rcu_is_watching+0x12/0xc0 [ 703.987165][T15155] mmap_region+0x180/0x3e0 [ 703.987201][T15155] do_mmap+0xc63/0x12f0 [ 703.987244][T15155] ? __pfx_do_mmap+0x10/0x10 [ 703.987281][T15155] ? __pfx_down_write_killable+0x10/0x10 [ 703.987321][T15155] vm_mmap_pgoff+0x29e/0x470 [ 703.987364][T15155] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 703.987428][T15155] ? __x64_sys_futex+0x34f/0x4d0 [ 703.987461][T15155] ? __x64_sys_futex+0x358/0x4d0 [ 703.987500][T15155] ksys_mmap_pgoff+0x7d/0x5b0 [ 703.987541][T15155] __x64_sys_mmap+0x125/0x190 [ 703.987569][T15155] do_syscall_64+0xc9/0xf80 [ 703.987601][T15155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.987627][T15155] RIP: 0033:0x7f833159aeb9 [ 703.987647][T15155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.987671][T15155] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 703.987695][T15155] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 703.987711][T15155] RDX: 00000000000000df RSI: 0000000000040009 RDI: 0000000000000000 [ 703.987726][T15155] RBP: 00007f8331608c1f R08: 0000000000000007 R09: 0000000000028000 [ 703.987742][T15155] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 703.987757][T15155] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 703.987788][T15155] [ 704.610318][T15159] futex_wake_op: syz.2.2104 tries to shift op by -2048; fix this program [ 707.641274][T15188] hub 1-0:1.0: USB hub found [ 707.661804][T15188] FAULT_INJECTION: forcing a failure. [ 707.661804][T15188] name failslab, interval 1, probability 0, space 0, times 0 [ 707.723990][T15188] CPU: 0 UID: 0 PID: 15188 Comm: syz.1.2109 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 707.724052][T15188] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 707.724069][T15188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 707.724089][T15188] Call Trace: [ 707.724102][T15188] [ 707.724116][T15188] dump_stack_lvl+0x100/0x190 [ 707.724165][T15188] should_fail_ex.cold+0x5/0xa [ 707.724224][T15188] should_failslab+0xc2/0x120 [ 707.724272][T15188] ? usb_hcd_submit_urb+0x601/0x2150 [ 707.724304][T15188] __kmalloc_noprof+0xf6/0x9c0 [ 707.724362][T15188] ? usb_hcd_submit_urb+0x601/0x2150 [ 707.724393][T15188] usb_hcd_submit_urb+0x601/0x2150 [ 707.724439][T15188] usb_submit_urb+0x8aa/0x1910 [ 707.724494][T15188] ? __init_swait_queue_head+0xca/0x150 [ 707.724557][T15188] usb_start_wait_urb+0x106/0x4c0 [ 707.724601][T15188] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 707.724655][T15188] ? __asan_memset+0x23/0x50 [ 707.724701][T15188] usb_control_msg+0x326/0x4a0 [ 707.724743][T15188] ? __pfx_usb_control_msg+0x10/0x10 [ 707.724794][T15188] hub_probe.cold+0xd56/0x2f2b [ 707.724881][T15188] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 707.724935][T15188] ? __pfx_hub_probe+0x10/0x10 [ 707.724981][T15188] ? percpu_rwsem_wake_function+0x250/0x4a0 [ 707.725018][T15188] ? find_held_lock+0x2b/0x80 [ 707.725057][T15188] ? mark_held_locks+0x40/0x70 [ 707.725101][T15188] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 707.725145][T15188] usb_probe_interface+0x303/0x8f0 [ 707.725206][T15188] ? __pfx_usb_probe_interface+0x10/0x10 [ 707.725263][T15188] really_probe+0x241/0xa60 [ 707.725310][T15188] __driver_probe_device+0x1de/0x400 [ 707.725363][T15188] driver_probe_device+0x4c/0x1b0 [ 707.725406][T15188] __device_attach_driver+0x1df/0x340 [ 707.725452][T15188] ? __pfx___device_attach_driver+0x10/0x10 [ 707.725492][T15188] bus_for_each_drv+0x159/0x1e0 [ 707.725549][T15188] ? __pfx_bus_for_each_drv+0x10/0x10 [ 707.725606][T15188] ? lockdep_hardirqs_on+0x78/0x100 [ 707.725647][T15188] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 707.725690][T15188] __device_attach+0x1e4/0x4d0 [ 707.725732][T15188] ? __pfx___device_attach+0x10/0x10 [ 707.725776][T15188] ? do_raw_spin_unlock+0x145/0x1e0 [ 707.725839][T15188] device_initial_probe+0xaf/0xd0 [ 707.725884][T15188] bus_probe_device+0x64/0x160 [ 707.725925][T15188] device_add+0x11d9/0x1950 [ 707.725977][T15188] ? __pfx_device_add+0x10/0x10 [ 707.726026][T15188] ? mark_held_locks+0x40/0x70 [ 707.726083][T15188] usb_set_configuration+0xd97/0x1c60 [ 707.726158][T15188] bConfigurationValue_store+0x100/0x180 [ 707.726209][T15188] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 707.726259][T15188] ? find_held_lock+0x2b/0x80 [ 707.726291][T15188] ? sysfs_file_kobj+0xe4/0x290 [ 707.726333][T15188] ? sysfs_file_kobj+0xe4/0x290 [ 707.726385][T15188] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 707.726430][T15188] dev_attr_store+0x58/0x80 [ 707.726472][T15188] ? __pfx_dev_attr_store+0x10/0x10 [ 707.726517][T15188] sysfs_kf_write+0xf2/0x150 [ 707.726560][T15188] kernfs_fop_write_iter+0x3e0/0x5f0 [ 707.726593][T15188] ? __pfx_sysfs_kf_write+0x10/0x10 [ 707.726637][T15188] iter_file_splice_write+0x82b/0x10a0 [ 707.726704][T15188] ? __pfx_iter_file_splice_write+0x10/0x10 [ 707.726751][T15188] ? __pfx_copy_splice_read+0x10/0x10 [ 707.726808][T15188] ? __pfx_iter_file_splice_write+0x10/0x10 [ 707.726850][T15188] direct_splice_actor+0x192/0x6c0 [ 707.726896][T15188] splice_direct_to_actor+0x345/0xa30 [ 707.726938][T15188] ? __pfx_direct_splice_actor+0x10/0x10 [ 707.726986][T15188] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 707.727038][T15188] do_splice_direct+0x174/0x240 [ 707.727087][T15188] ? __pfx_do_splice_direct+0x10/0x10 [ 707.727125][T15188] ? common_file_perm+0x1ab/0x4f0 [ 707.727178][T15188] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 707.727222][T15188] ? rw_verify_area+0xce/0x6d0 [ 707.727259][T15188] do_sendfile+0xadc/0xe20 [ 707.727309][T15188] ? __pfx_do_sendfile+0x10/0x10 [ 707.727353][T15188] ? __sys_sendmsg+0x18f/0x220 [ 707.727410][T15188] ? __x64_sys_futex+0x34f/0x4d0 [ 707.727457][T15188] ? __x64_sys_futex+0x358/0x4d0 [ 707.727509][T15188] __x64_sys_sendfile64+0x1d8/0x220 [ 707.727555][T15188] ? xfd_validate_state+0x129/0x190 [ 707.727608][T15188] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 707.727666][T15188] do_syscall_64+0xc9/0xf80 [ 707.727711][T15188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.727748][T15188] RIP: 0033:0x7f6d5239aeb9 [ 707.727776][T15188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 707.727810][T15188] RSP: 002b:00007f6d53194028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 707.727844][T15188] RAX: ffffffffffffffda RBX: 00007f6d52615fa0 RCX: 00007f6d5239aeb9 [ 707.727867][T15188] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 707.727887][T15188] RBP: 00007f6d52408c1f R08: 0000000000000000 R09: 0000000000000000 [ 707.727908][T15188] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 707.727929][T15188] R13: 00007f6d52616038 R14: 00007f6d52615fa0 R15: 00007ffe330a4ed8 [ 707.727972][T15188] [ 708.245076][T15188] hub 1-0:1.0: 1 port detected [ 711.267235][T15213] netlink: 252 bytes leftover after parsing attributes in process `syz.4.2115'. [ 711.694574][T15224] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 712.198410][ T7401] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 1353 with max blocks 44 with error 117 [ 712.282809][ T7401] EXT4-fs (sda1): This should not happen!! Data will be lost [ 712.282809][ T7401] [ 712.458952][ T30] audit: type=1800 audit(4294968473.418:19): pid=15241 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2122" name="dbroot" dev="configfs" ino=69576 res=0 errno=0 [ 714.685851][T15266] netlink: 252 bytes leftover after parsing attributes in process `syz.3.2129'. [ 716.549805][T15309] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 716.607530][T15308] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 716.647371][T15313] netlink: 252 bytes leftover after parsing attributes in process `syz.3.2139'. [ 716.738561][T15308] FAULT_INJECTION: forcing a failure. [ 716.738561][T15308] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 716.755266][T15308] CPU: 1 UID: 0 PID: 15308 Comm: syz.4.2137 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 716.755324][T15308] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 716.755341][T15308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 716.755361][T15308] Call Trace: [ 716.755372][T15308] [ 716.755385][T15308] dump_stack_lvl+0x100/0x190 [ 716.755431][T15308] should_fail_ex.cold+0x5/0xa [ 716.755479][T15308] ? prepare_alloc_pages+0x16d/0x5f0 [ 716.755544][T15308] should_fail_alloc_page+0xeb/0x140 [ 716.755595][T15308] prepare_alloc_pages+0x1f0/0x5f0 [ 716.755646][T15308] ? __pfx___might_resched+0x10/0x10 [ 716.755702][T15308] __alloc_frozen_pages_noprof+0x193/0x2410 [ 716.755743][T15308] ? rcu_is_watching+0x12/0xc0 [ 716.755776][T15308] ? trace_pelt_se_tp+0xed/0x130 [ 716.755821][T15308] ? __update_load_avg_se+0x5c7/0xe80 [ 716.755873][T15308] ? update_load_avg+0x234/0x2090 [ 716.755918][T15308] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 716.755962][T15308] ? __lock_acquire+0x4a5/0x2630 [ 716.756006][T15308] ? set_next_entity+0x11a/0x9b0 [ 716.756060][T15308] ? __lock_acquire+0x4a5/0x2630 [ 716.756112][T15308] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 716.756148][T15308] ? policy_nodemask+0xed/0x4f0 [ 716.756197][T15308] alloc_pages_mpol+0x1fb/0x550 [ 716.756245][T15308] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 716.756313][T15308] alloc_pages_noprof+0x131/0x390 [ 716.756364][T15308] __pmd_alloc+0x3b/0x9c0 [ 716.756418][T15308] __handle_mm_fault+0xa99/0x2b50 [ 716.756460][T15308] ? mt_find+0x45e/0x8e0 [ 716.756506][T15308] ? __pfx___handle_mm_fault+0x10/0x10 [ 716.756547][T15308] ? __pfx_mt_find+0x10/0x10 [ 716.756610][T15308] ? find_vma+0xbf/0x140 [ 716.756655][T15308] ? __pfx_find_vma+0x10/0x10 [ 716.756705][T15308] handle_mm_fault+0x36d/0xa20 [ 716.756750][T15308] do_user_addr_fault+0x74c/0x12f0 [ 716.756799][T15308] exc_page_fault+0x6f/0xd0 [ 716.756838][T15308] asm_exc_page_fault+0x26/0x30 [ 716.756871][T15308] RIP: 0010:strncpy_from_user+0xfd/0x2d0 [ 716.756919][T15308] Code: 00 4d 89 64 1d 00 48 83 ed 08 bf 07 00 00 00 48 83 c3 08 48 89 ee e8 82 08 ed fc 48 83 fd 07 0f 86 bb 00 00 00 e8 93 0d ed fc <4d> 8b 24 1e e8 8a 0d ed fc 4c 89 e2 31 ff 4d 8d 7c 1d 00 48 b8 ff [ 716.756952][T15308] RSP: 0018:ffffc90003087ce8 EFLAGS: 00050293 [ 716.756979][T15308] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff85193c96 [ 716.757000][T15308] RDX: ffff8880288abd00 RSI: ffffffff85193ced RDI: ffff8880288abd00 [ 716.757022][T15308] RBP: 0000000000000fe0 R08: 0000000000000007 R09: 0000000000000007 [ 716.757041][T15308] R10: 0000000000000fe0 R11: 0000000000000000 R12: 0000000000000000 [ 716.757060][T15308] R13: ffff888059db4420 R14: 0000000000000000 R15: 0000000000000fe0 [ 716.757091][T15308] ? strncpy_from_user+0xa6/0x2d0 [ 716.757136][T15308] ? strncpy_from_user+0xfd/0x2d0 [ 716.757188][T15308] ? strncpy_from_user+0xfd/0x2d0 [ 716.757240][T15308] getname_flags.part.0+0x8f/0x540 [ 716.757297][T15308] getname_flags+0x93/0xf0 [ 716.757333][T15308] do_sys_openat2+0xc5/0x220 [ 716.757384][T15308] ? __pfx_do_sys_openat2+0x10/0x10 [ 716.757449][T15308] __x64_sys_openat+0x12d/0x210 [ 716.757502][T15308] ? __pfx___x64_sys_openat+0x10/0x10 [ 716.757560][T15308] ? xfd_validate_state+0x129/0x190 [ 716.757627][T15308] do_syscall_64+0xc9/0xf80 [ 716.757672][T15308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 716.757706][T15308] RIP: 0033:0x7f833159aeb9 [ 716.757732][T15308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 716.757766][T15308] RSP: 002b:00007f8332521028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 716.757796][T15308] RAX: ffffffffffffffda RBX: 00007f8331816090 RCX: 00007f833159aeb9 [ 716.757817][T15308] RDX: 0000000000000080 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 716.757838][T15308] RBP: 00007f8331608c1f R08: 0000000000000000 R09: 0000000000000000 [ 716.757857][T15308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 716.757877][T15308] R13: 00007f8331816128 R14: 00007f8331816090 R15: 00007fff7ee66468 [ 716.757919][T15308] [ 717.851409][T15320] netlink: 'syz.4.2141': attribute type 2 has an invalid length. [ 722.713642][T15394] FAULT_INJECTION: forcing a failure. [ 722.713642][T15394] name failslab, interval 1, probability 0, space 0, times 0 [ 722.809367][T15394] CPU: 0 UID: 0 PID: 15394 Comm: syz.4.2156 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 722.809414][T15394] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 722.809426][T15394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 722.809440][T15394] Call Trace: [ 722.809449][T15394] [ 722.809459][T15394] dump_stack_lvl+0x100/0x190 [ 722.809494][T15394] should_fail_ex.cold+0x5/0xa [ 722.809536][T15394] should_failslab+0xc2/0x120 [ 722.809571][T15394] kmem_cache_alloc_noprof+0x83/0x780 [ 722.809605][T15394] ? vm_area_alloc+0x1f/0x160 [ 722.809636][T15394] ? vm_area_alloc+0x1f/0x160 [ 722.809660][T15394] vm_area_alloc+0x1f/0x160 [ 722.809685][T15394] __mmap_region+0x101e/0x2820 [ 722.809719][T15394] ? __pfx___mmap_region+0x10/0x10 [ 722.809763][T15394] ? __pfx___pv_queued_spin_lock_slowpath+0x10/0x10 [ 722.809807][T15394] ? finish_task_switch.isra.0+0x1ff/0xb70 [ 722.809836][T15394] ? finish_task_switch.isra.0+0x1ff/0xb70 [ 722.809879][T15394] ? __schedule+0xff6/0x5e10 [ 722.809945][T15394] ? rcu_is_watching+0x12/0xc0 [ 722.809977][T15394] mmap_region+0x180/0x3e0 [ 722.810012][T15394] do_mmap+0xc63/0x12f0 [ 722.810054][T15394] ? __pfx_do_mmap+0x10/0x10 [ 722.810091][T15394] ? __pfx_down_write_killable+0x10/0x10 [ 722.810131][T15394] vm_mmap_pgoff+0x29e/0x470 [ 722.810175][T15394] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 722.810219][T15394] ? __x64_sys_futex+0x34f/0x4d0 [ 722.810253][T15394] ? __x64_sys_futex+0x358/0x4d0 [ 722.810291][T15394] ksys_mmap_pgoff+0x7d/0x5b0 [ 722.810332][T15394] __x64_sys_mmap+0x125/0x190 [ 722.810359][T15394] do_syscall_64+0xc9/0xf80 [ 722.810391][T15394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.810417][T15394] RIP: 0033:0x7f833159aeb9 [ 722.810437][T15394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.810462][T15394] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 722.810487][T15394] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 722.810504][T15394] RDX: 00000000000000df RSI: 0000000000040009 RDI: 0000000000000000 [ 722.810519][T15394] RBP: 00007f8331608c1f R08: 0000000000000007 R09: 0000000000028000 [ 722.810534][T15394] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 722.810549][T15394] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 722.810581][T15394] [ 723.953050][T15413] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 724.575065][T15429] netlink: 330 bytes leftover after parsing attributes in process `syz.3.2165'. [ 724.654136][T15429] mac80211_hwsim hwsim6 : renamed from wlan0 (while UP) [ 726.483277][T15462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2172'. [ 727.722926][T15480] hub 1-0:1.0: USB hub found [ 727.728250][T15480] hub 1-0:1.0: 1 port detected [ 728.151919][ T30] audit: type=1800 audit(4294969512.098:20): pid=15490 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2179" name="lu_gp_id" dev="configfs" ino=71744 res=0 errno=0 [ 732.492991][T15568] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 732.620562][T15568] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 732.695308][T15568] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 732.738519][T15568] page_type: f5(slab) [ 732.770545][T15568] raw: 00fff00000000040 ffff88813ff27140 dead000000000100 dead000000000122 [ 732.805164][T15568] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 732.826091][T15568] head: 00fff00000000040 ffff88813ff27140 dead000000000100 dead000000000122 [ 732.858547][T15568] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 732.874388][T15568] head: 00fff00000000003 ffffea0001e00001 00000000ffffffff 00000000ffffffff [ 732.895117][T15568] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 732.962153][T15568] page dumped because: unmovable page [ 732.992825][T15568] page_owner tracks the page as allocated [ 733.037485][T15568] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5195, tgid 5195 (udevd), ts 427742017999, free_ts 427713647294 [ 733.114449][T15568] post_alloc_hook+0x1e1/0x250 [ 733.119344][T15568] get_page_from_freelist+0xe3d/0x2e10 [ 733.219700][T15568] __alloc_frozen_pages_noprof+0x26c/0x2410 [ 733.250273][T15568] alloc_pages_mpol+0x1fb/0x550 [ 733.269349][T15568] new_slab+0x2c4/0x440 [ 733.291299][T15568] ___slab_alloc+0xda3/0x1ca0 [ 733.316669][T15568] __slab_alloc.isra.0+0x63/0x110 [ 733.352536][T15568] __kmalloc_noprof+0x618/0x9c0 [ 733.378746][T15568] tomoyo_realpath_from_path+0xb6/0x690 [ 733.397053][T15568] tomoyo_check_open_permission+0x2af/0x3c0 [ 733.403103][T15568] tomoyo_file_open+0x6b/0x90 [ 733.425238][T15568] security_file_open+0xb5/0x1e0 [ 733.430545][T15568] do_dentry_open+0x58c/0x1570 [ 733.464520][T15568] vfs_open+0x82/0x3f0 [ 733.474567][T15568] path_openat+0x21dc/0x3120 [ 733.489465][T15568] do_filp_open+0x1f7/0x420 [ 733.505020][T15568] page last free pid 5195 tgid 5195 stack trace: [ 733.521692][T15568] __free_frozen_pages+0x822/0x1130 [ 733.544594][T15568] __put_partials+0x127/0x160 [ 733.549388][T15568] qlist_free_all+0x47/0xe0 [ 733.574643][T15568] kasan_quarantine_reduce+0x1a0/0x1f0 [ 733.580250][T15568] __kasan_slab_alloc+0x69/0x90 [ 733.594619][T15568] kmem_cache_alloc_noprof+0x2ad/0x780 [ 733.600219][T15568] getname_flags.part.0+0x4c/0x540 [ 733.625019][T15568] getname_flags+0x93/0xf0 [ 733.633308][T15568] do_readlinkat+0xb9/0x390 [ 733.664129][T15568] __x64_sys_readlink+0x78/0xc0 [ 733.675491][T15568] do_syscall_64+0xc9/0xf80 [ 733.680133][T15568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.774902][T15565] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78000 [ 733.785741][T15565] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 733.794331][T15565] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 733.884598][T15565] page_type: f5(slab) [ 733.888755][T15565] raw: 00fff00000000040 ffff88813ff27140 ffffea0000aa1400 dead000000000002 [ 733.938516][T15565] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 734.005601][T15565] head: 00fff00000000040 ffff88813ff27140 ffffea0000aa1400 dead000000000002 [ 734.058068][T15565] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 734.084896][T15565] head: 00fff00000000003 ffffea0001e00001 00000000ffffffff 00000000ffffffff [ 734.125059][T15565] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 734.172558][T15565] page dumped because: unmovable page [ 734.214024][T15565] page_owner tracks the page as allocated [ 734.221573][T15565] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5195, tgid 5195 (udevd), ts 427742017999, free_ts 427713647294 [ 734.305043][T15565] post_alloc_hook+0x1e1/0x250 [ 734.315255][T15565] get_page_from_freelist+0xe3d/0x2e10 [ 734.325290][T15565] __alloc_frozen_pages_noprof+0x26c/0x2410 [ 734.341562][T15565] alloc_pages_mpol+0x1fb/0x550 [ 734.348401][T15565] new_slab+0x2c4/0x440 [ 734.383392][T15565] ___slab_alloc+0xda3/0x1ca0 [ 734.393567][T15565] __slab_alloc.isra.0+0x63/0x110 [ 734.403770][T15565] __kmalloc_noprof+0x618/0x9c0 [ 734.435012][T15565] tomoyo_realpath_from_path+0xb6/0x690 [ 734.465141][T15565] tomoyo_check_open_permission+0x2af/0x3c0 [ 734.495061][T15565] tomoyo_file_open+0x6b/0x90 [ 734.499859][T15565] security_file_open+0xb5/0x1e0 [ 734.510377][T15565] do_dentry_open+0x58c/0x1570 [ 734.542554][T15565] vfs_open+0x82/0x3f0 [ 734.547561][T15565] path_openat+0x21dc/0x3120 [ 734.552250][T15565] do_filp_open+0x1f7/0x420 [ 734.585049][T15565] page last free pid 5195 tgid 5195 stack trace: [ 734.591472][T15565] __free_frozen_pages+0x822/0x1130 [ 734.615103][T15565] __put_partials+0x127/0x160 [ 734.619901][T15565] qlist_free_all+0x47/0xe0 [ 734.624551][T15565] kasan_quarantine_reduce+0x1a0/0x1f0 [ 734.675356][T15565] __kasan_slab_alloc+0x69/0x90 [ 734.680342][T15565] kmem_cache_alloc_noprof+0x2ad/0x780 [ 734.695164][T15565] getname_flags.part.0+0x4c/0x540 [ 734.700417][T15565] getname_flags+0x93/0xf0 [ 734.705009][T15565] do_readlinkat+0xb9/0x390 [ 734.724310][T15565] __x64_sys_readlink+0x78/0xc0 [ 734.740242][T15565] do_syscall_64+0xc9/0xf80 [ 734.744875][T15565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.538062][T15587] hub 1-0:1.0: USB hub found [ 735.571177][T15587] hub 1-0:1.0: 1 port detected [ 736.407500][T15596] zswap: compressor not available [ 737.667760][ T7415] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 919 with max blocks 10 with error 117 [ 737.700693][ T7415] EXT4-fs (sda1): This should not happen!! Data will be lost [ 737.700693][ T7415] [ 738.363854][T15634] netlink: 252 bytes leftover after parsing attributes in process `syz.2.2210'. [ 739.878039][T15658] misc userio: Invalid payload size [ 741.686319][ T52] Bluetooth: hci3: unexpected event 0x3e length: 726 > 260 [ 741.686371][ T52] Bluetooth: hci3: unexpected subevent 0x03 length: 725 > 9 [ 741.793885][T15689] zswap: compressor not available [ 742.145807][ T52] Bluetooth: hci0: unexpected event 0x33 length: 124 > 10 [ 742.172528][T15703] FAULT_INJECTION: forcing a failure. [ 742.172528][T15703] name failslab, interval 1, probability 0, space 0, times 0 [ 742.247868][T15703] CPU: 1 UID: 0 PID: 15703 Comm: syz.4.2228 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 742.247953][T15703] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 742.247972][T15703] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 742.247994][T15703] Call Trace: [ 742.248008][T15703] [ 742.248021][T15703] dump_stack_lvl+0x100/0x190 [ 742.248069][T15703] should_fail_ex.cold+0x5/0xa [ 742.248128][T15703] should_failslab+0xc2/0x120 [ 742.248178][T15703] kmem_cache_alloc_noprof+0x83/0x780 [ 742.248224][T15703] ? d_instantiate+0x90/0xb0 [ 742.248268][T15703] ? alloc_empty_file+0x55/0x1c0 [ 742.248327][T15703] ? alloc_empty_file+0x55/0x1c0 [ 742.248374][T15703] alloc_empty_file+0x55/0x1c0 [ 742.248426][T15703] alloc_file_pseudo+0x13a/0x230 [ 742.248479][T15703] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 742.248533][T15703] ? hugetlbfs_get_inode+0x36e/0x6f0 [ 742.248574][T15703] hugetlb_file_setup+0x2a8/0x5b0 [ 742.248614][T15703] ksys_mmap_pgoff+0x185/0x5b0 [ 742.248668][T15703] __x64_sys_mmap+0x125/0x190 [ 742.248706][T15703] do_syscall_64+0xc9/0xf80 [ 742.248753][T15703] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.248789][T15703] RIP: 0033:0x7f833159aeb9 [ 742.248822][T15703] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 742.248857][T15703] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 742.248892][T15703] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 742.248914][T15703] RDX: 00004000000000df RSI: 0000000000000004 RDI: 0000000000000000 [ 742.248936][T15703] RBP: 00007f8331608c1f R08: 0000000000000402 R09: 0000300000000000 [ 742.248967][T15703] R10: 0000000000040eb2 R11: 0000000000000246 R12: 0000000000000000 [ 742.248989][T15703] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 742.249034][T15703] [ 742.664114][T15713] netlink: 334 bytes leftover after parsing attributes in process `syz.2.2231'. [ 742.827535][ T7396] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 3439 with max blocks 140 with error 117 [ 742.889294][ T7396] EXT4-fs (sda1): This should not happen!! Data will be lost [ 742.889294][ T7396] [ 743.017737][T15723] netlink: 252 bytes leftover after parsing attributes in process `syz.2.2232'. [ 744.357980][T15750] hub 1-0:1.0: USB hub found [ 744.366382][T15750] hub 1-0:1.0: 1 port detected [ 744.374320][T15751] input: f as /devices/virtual/input/input31 [ 744.480530][T15751] FAULT_INJECTION: forcing a failure. [ 744.480530][T15751] name failslab, interval 1, probability 0, space 0, times 0 [ 744.540141][T15751] CPU: 1 UID: 0 PID: 15751 Comm: syz.1.2240 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 744.540204][T15751] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 744.540220][T15751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 744.540243][T15751] Call Trace: [ 744.540255][T15751] [ 744.540268][T15751] dump_stack_lvl+0x100/0x190 [ 744.540316][T15751] should_fail_ex.cold+0x5/0xa [ 744.540374][T15751] should_failslab+0xc2/0x120 [ 744.540425][T15751] kmem_cache_alloc_noprof+0x83/0x780 [ 744.540468][T15751] ? d_instantiate+0x90/0xb0 [ 744.540512][T15751] ? alloc_empty_file+0x55/0x1c0 [ 744.540569][T15751] ? alloc_empty_file+0x55/0x1c0 [ 744.540617][T15751] alloc_empty_file+0x55/0x1c0 [ 744.540669][T15751] alloc_file_pseudo+0x13a/0x230 [ 744.540722][T15751] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 744.540785][T15751] ? alloc_fd+0x476/0x790 [ 744.540833][T15751] sock_alloc_file+0x50/0x210 [ 744.540890][T15751] __sys_socket+0x1c0/0x260 [ 744.540931][T15751] ? __pfx___sys_socket+0x10/0x10 [ 744.540969][T15751] ? xfd_validate_state+0x129/0x190 [ 744.541037][T15751] __x64_sys_socket+0x72/0xb0 [ 744.541078][T15751] ? lockdep_hardirqs_on+0x78/0x100 [ 744.541118][T15751] do_syscall_64+0xc9/0xf80 [ 744.541162][T15751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.541196][T15751] RIP: 0033:0x7f6d5239aeb9 [ 744.541223][T15751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 744.541255][T15751] RSP: 002b:00007f6d53194028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 744.541291][T15751] RAX: ffffffffffffffda RBX: 00007f6d52615fa0 RCX: 00007f6d5239aeb9 [ 744.541312][T15751] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000010 [ 744.541332][T15751] RBP: 00007f6d52408c1f R08: 0000000000000000 R09: 0000000000000000 [ 744.541358][T15751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 744.541377][T15751] R13: 00007f6d52616038 R14: 00007f6d52615fa0 R15: 00007ffe330a4ed8 [ 744.541414][T15751] [ 744.910101][T15758] netlink: 252 bytes leftover after parsing attributes in process `syz.2.2243'. [ 745.155080][T15762] FAULT_INJECTION: forcing a failure. [ 745.155080][T15762] name failslab, interval 1, probability 0, space 0, times 0 [ 745.231349][T15762] CPU: 1 UID: 0 PID: 15762 Comm: syz.4.2245 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 745.231408][T15762] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 745.231424][T15762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 745.231444][T15762] Call Trace: [ 745.231455][T15762] [ 745.231468][T15762] dump_stack_lvl+0x100/0x190 [ 745.231514][T15762] should_fail_ex.cold+0x5/0xa [ 745.231569][T15762] should_failslab+0xc2/0x120 [ 745.231617][T15762] ? tomoyo_realpath_from_path+0xb6/0x690 [ 745.231651][T15762] __kmalloc_noprof+0xf6/0x9c0 [ 745.231684][T15762] ? kfree+0x2a9/0x690 [ 745.231724][T15762] ? tomoyo_realpath_from_path+0xb6/0x690 [ 745.231757][T15762] tomoyo_realpath_from_path+0xb6/0x690 [ 745.231801][T15762] tomoyo_check_open_permission+0x2af/0x3c0 [ 745.231852][T15762] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 745.231946][T15762] ? lock_acquire+0x17c/0x330 [ 745.231991][T15762] ? find_held_lock+0x2b/0x80 [ 745.232034][T15762] tomoyo_file_open+0x6b/0x90 [ 745.232076][T15762] security_file_open+0xb5/0x1e0 [ 745.232109][T15762] do_dentry_open+0x58c/0x1570 [ 745.232152][T15762] ? security_inode_permission+0xbf/0x250 [ 745.232209][T15762] vfs_open+0x82/0x3f0 [ 745.232264][T15762] path_openat+0x21dc/0x3120 [ 745.232318][T15762] ? __pfx_path_openat+0x10/0x10 [ 745.232373][T15762] do_filp_open+0x1f7/0x420 [ 745.232416][T15762] ? __pfx_do_filp_open+0x10/0x10 [ 745.232485][T15762] ? _raw_spin_unlock+0x28/0x50 [ 745.232518][T15762] ? alloc_fd+0x476/0x790 [ 745.232569][T15762] do_sys_openat2+0x12e/0x220 [ 745.232619][T15762] ? __pfx_do_sys_openat2+0x10/0x10 [ 745.232685][T15762] __x64_sys_openat+0x12d/0x210 [ 745.232738][T15762] ? __pfx___x64_sys_openat+0x10/0x10 [ 745.232788][T15762] ? xfd_validate_state+0x129/0x190 [ 745.232855][T15762] do_syscall_64+0xc9/0xf80 [ 745.232899][T15762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.232939][T15762] RIP: 0033:0x7f833159aeb9 [ 745.232965][T15762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 745.232997][T15762] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 745.233030][T15762] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 745.233053][T15762] RDX: 00000000000ec502 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 745.233074][T15762] RBP: 00007f8331608c1f R08: 0000000000000000 R09: 0000000000000000 [ 745.233095][T15762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 745.233115][T15762] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 745.233159][T15762] [ 745.233234][T15762] ERROR: Out of memory at tomoyo_realpath_from_path. [ 747.265303][T15796] FAULT_INJECTION: forcing a failure. [ 747.265303][T15796] name failslab, interval 1, probability 0, space 0, times 0 [ 747.307114][T15796] CPU: 0 UID: 0 PID: 15796 Comm: syz.3.2242 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 747.307180][T15796] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 747.307197][T15796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 747.307219][T15796] Call Trace: [ 747.307230][T15796] [ 747.307244][T15796] dump_stack_lvl+0x100/0x190 [ 747.307294][T15796] should_fail_ex.cold+0x5/0xa [ 747.307351][T15796] should_failslab+0xc2/0x120 [ 747.307402][T15796] kmem_cache_alloc_noprof+0x83/0x780 [ 747.307451][T15796] ? alloc_empty_file+0x55/0x1c0 [ 747.307509][T15796] ? alloc_empty_file+0x55/0x1c0 [ 747.307558][T15796] alloc_empty_file+0x55/0x1c0 [ 747.307611][T15796] path_openat+0xe8/0x3120 [ 747.307650][T15796] ? getname_flags+0x93/0xf0 [ 747.307683][T15796] ? do_sys_openat2+0xc5/0x220 [ 747.307731][T15796] ? __x64_sys_openat+0x12d/0x210 [ 747.307794][T15796] ? do_syscall_64+0xc9/0xf80 [ 747.307834][T15796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.307882][T15796] ? __pfx_path_openat+0x10/0x10 [ 747.307940][T15796] do_filp_open+0x1f7/0x420 [ 747.307986][T15796] ? __pfx_do_filp_open+0x10/0x10 [ 747.308057][T15796] ? _raw_spin_unlock+0x28/0x50 [ 747.308091][T15796] ? alloc_fd+0x476/0x790 [ 747.308141][T15796] do_sys_openat2+0x12e/0x220 [ 747.308195][T15796] ? __pfx_do_sys_openat2+0x10/0x10 [ 747.308263][T15796] __x64_sys_openat+0x12d/0x210 [ 747.308320][T15796] ? __pfx___x64_sys_openat+0x10/0x10 [ 747.308371][T15796] ? xfd_validate_state+0x129/0x190 [ 747.308441][T15796] do_syscall_64+0xc9/0xf80 [ 747.308486][T15796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.308522][T15796] RIP: 0033:0x7fc00959aeb9 [ 747.308550][T15796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 747.308585][T15796] RSP: 002b:00007fc00a53c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 747.308619][T15796] RAX: ffffffffffffffda RBX: 00007fc009815fa0 RCX: 00007fc00959aeb9 [ 747.308642][T15796] RDX: 0000000000000c81 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 747.308664][T15796] RBP: 00007fc009608c1f R08: 0000000000000000 R09: 0000000000000000 [ 747.308685][T15796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 747.308706][T15796] R13: 00007fc009816038 R14: 00007fc009815fa0 R15: 00007ffc5b37b708 [ 747.308756][T15796] [ 748.348881][T15803] netlink: 252 bytes leftover after parsing attributes in process `syz.3.2253'. [ 749.134520][T15814] hub 1-0:1.0: USB hub found [ 749.184705][T15814] hub 1-0:1.0: 1 port detected [ 750.405783][T15846] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 750.875627][T15853] hub 1-0:1.0: USB hub found [ 750.880945][T15853] hub 1-0:1.0: 1 port detected [ 751.259382][T15863] netlink: 252 bytes leftover after parsing attributes in process `syz.3.2265'. [ 751.974018][T15882] EXT4-fs error (device sda1): ext4_validate_block_bitmap:423: comm syz.2.2270: bg 5: bad block bitmap checksum [ 752.051802][T15882] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2050 with max blocks 1 with error 74 [ 752.183290][T15882] EXT4-fs (sda1): This should not happen!! Data will be lost [ 752.183290][T15882] [ 752.229679][T15886] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2057 with max blocks 1 with error 117 [ 752.313449][T15886] EXT4-fs (sda1): This should not happen!! Data will be lost [ 752.313449][T15886] [ 752.614647][T15890] sp0: Synchronizing with TNC [ 752.835138][T15895] hub 1-0:1.0: USB hub found [ 752.888470][T15895] hub 1-0:1.0: 1 port detected [ 753.034874][T15901] netlink: 252 bytes leftover after parsing attributes in process `syz.4.2276'. [ 753.374255][T15915] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2282'. [ 753.480747][T15915] bond0: (slave bond_slave_0): Releasing backup interface [ 753.489543][T15915] bond_slave_0 (unregistering): left promiscuous mode [ 753.497682][T15915] bond_slave_0 (unregistering): left allmulticast mode [ 754.609410][T15932] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:104: comm syz-executor: Corrupt inode bitmap - block_group = 2, inode_bitmap = 139 [ 754.829287][T15937] netlink: 252 bytes leftover after parsing attributes in process `syz.4.2288'. [ 755.093243][T11111] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 755.104285][T11111] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 755.113904][T11111] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 755.122527][T11111] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 755.132922][T11111] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 755.422628][T15951] hub 1-0:1.0: USB hub found [ 755.428027][T15951] hub 1-0:1.0: 1 port detected [ 755.792361][ T36] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.087866][ T36] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.203262][ T36] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.480149][ T36] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.874136][T15942] chnl_net:caif_netlink_parms(): no params data found [ 756.979004][T15976] netlink: 252 bytes leftover after parsing attributes in process `syz.3.2298'. [ 757.142733][ T36] bridge_slave_1: left allmulticast mode [ 757.156731][ T36] bridge_slave_1: left promiscuous mode [ 757.168983][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.200108][T11111] Bluetooth: hci2: command tx timeout [ 757.209215][ T36] bridge_slave_0: left allmulticast mode [ 757.216265][ T36] bridge_slave_0: left promiscuous mode [ 757.255182][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 757.309792][T15986] FAULT_INJECTION: forcing a failure. [ 757.309792][T15986] name failslab, interval 1, probability 0, space 0, times 0 [ 757.342000][T15986] CPU: 1 UID: 0 PID: 15986 Comm: syz.3.2300 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 757.342062][T15986] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 757.342080][T15986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 757.342102][T15986] Call Trace: [ 757.342113][T15986] [ 757.342127][T15986] dump_stack_lvl+0x100/0x190 [ 757.342175][T15986] should_fail_ex.cold+0x5/0xa [ 757.342232][T15986] should_failslab+0xc2/0x120 [ 757.342279][T15986] ? tomoyo_realpath_from_path+0xb6/0x690 [ 757.342314][T15986] __kmalloc_noprof+0xf6/0x9c0 [ 757.342347][T15986] ? kfree+0x2a9/0x690 [ 757.342388][T15986] ? tomoyo_realpath_from_path+0xb6/0x690 [ 757.342423][T15986] tomoyo_realpath_from_path+0xb6/0x690 [ 757.342467][T15986] tomoyo_check_open_permission+0x2af/0x3c0 [ 757.342518][T15986] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 757.342568][T15986] ? do_syscall_64+0xc9/0xf80 [ 757.342642][T15986] ? lock_acquire+0x17c/0x330 [ 757.342687][T15986] ? find_held_lock+0x2b/0x80 [ 757.342732][T15986] tomoyo_file_open+0x6b/0x90 [ 757.342775][T15986] security_file_open+0xb5/0x1e0 [ 757.342808][T15986] do_dentry_open+0x58c/0x1570 [ 757.342850][T15986] ? lockdep_init_map_type+0x5c/0x250 [ 757.342913][T15986] vfs_open+0x82/0x3f0 [ 757.342969][T15986] dentry_open+0x71/0xd0 [ 757.343023][T15986] pidfs_alloc_file+0x18f/0x290 [ 757.343061][T15986] ? __pfx_pidfs_alloc_file+0x10/0x10 [ 757.343110][T15986] pidfd_prepare+0x129/0x200 [ 757.343160][T15986] __x64_sys_pidfd_open+0x105/0x1a0 [ 757.343213][T15986] ? __pfx___x64_sys_pidfd_open+0x10/0x10 [ 757.343270][T15986] ? rcu_is_watching+0x12/0xc0 [ 757.343309][T15986] do_syscall_64+0xc9/0xf80 [ 757.343355][T15986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.343389][T15986] RIP: 0033:0x7fc00959aeb9 [ 757.343417][T15986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.343451][T15986] RSP: 002b:00007fc00a4fa028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 757.343484][T15986] RAX: ffffffffffffffda RBX: 00007fc009816180 RCX: 00007fc00959aeb9 [ 757.343508][T15986] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 757.343528][T15986] RBP: 00007fc009608c1f R08: 0000000000000000 R09: 0000000000000000 [ 757.343548][T15986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 757.343568][T15986] R13: 00007fc009816218 R14: 00007fc009816180 R15: 00007ffc5b37b708 [ 757.343615][T15986] [ 757.403313][T15986] ERROR: Out of memory at tomoyo_realpath_from_path. [ 757.568992][T15991] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2050 with max blocks 1 with error 117 [ 757.569133][T15991] EXT4-fs (sda1): This should not happen!! Data will be lost [ 757.569133][T15991] [ 757.692475][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 757.965190][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 758.087330][T12185] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2057 with max blocks 2 with error 117 [ 758.151762][T12185] EXT4-fs (sda1): This should not happen!! Data will be lost [ 758.151762][T12185] [ 758.496125][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 758.535534][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 758.571488][ T36] bond0 (unregistering): Released all slaves [ 758.718765][ T36] HfR: left promiscuous mode [ 758.857529][T15942] bridge0: port 1(bridge_slave_0) entered blocking state [ 758.877562][T15942] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.895320][T15942] bridge_slave_0: entered allmulticast mode [ 758.911773][T15942] bridge_slave_0: entered promiscuous mode [ 758.964340][T15942] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.979409][T15942] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.994826][T15942] bridge_slave_1: entered allmulticast mode [ 759.013740][T15942] bridge_slave_1: entered promiscuous mode [ 759.276270][T15942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 759.295225][T11111] Bluetooth: hci2: command tx timeout [ 759.320532][T15942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 759.490785][T15942] team0: Port device team_slave_0 added [ 759.555369][T15942] team0: Port device team_slave_1 added [ 759.749116][T15942] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 759.756207][T15942] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 759.786466][T15942] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 759.840809][ T36] hsr_slave_0: left promiscuous mode [ 759.847045][ T36] hsr_slave_1: left promiscuous mode [ 759.854855][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 759.883080][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 759.914885][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 759.958008][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 760.052690][T16011] FAULT_INJECTION: forcing a failure. [ 760.052690][T16011] name failslab, interval 1, probability 0, space 0, times 0 [ 760.078993][ T36] veth0_macvtap: left promiscuous mode [ 760.090897][T16011] CPU: 0 UID: 0 PID: 16011 Comm: syz.4.2306 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 760.090962][T16011] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 760.090980][T16011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 760.091002][T16011] Call Trace: [ 760.091014][T16011] [ 760.091028][T16011] dump_stack_lvl+0x100/0x190 [ 760.091079][T16011] should_fail_ex.cold+0x5/0xa [ 760.091138][T16011] should_failslab+0xc2/0x120 [ 760.091187][T16011] kmem_cache_alloc_noprof+0x83/0x780 [ 760.091235][T16011] ? getname_flags.part.0+0x4c/0x540 [ 760.091293][T16011] ? getname_flags.part.0+0x4c/0x540 [ 760.091356][T16011] getname_flags.part.0+0x4c/0x540 [ 760.091413][T16011] getname_flags+0x93/0xf0 [ 760.091449][T16011] do_sys_openat2+0xc5/0x220 [ 760.091505][T16011] ? __pfx_do_sys_openat2+0x10/0x10 [ 760.091560][T16011] ? __sys_sendmsg+0x18f/0x220 [ 760.091621][T16011] __x64_sys_openat+0x12d/0x210 [ 760.091677][T16011] ? __pfx___x64_sys_openat+0x10/0x10 [ 760.091730][T16011] ? xfd_validate_state+0x129/0x190 [ 760.091797][T16011] do_syscall_64+0xc9/0xf80 [ 760.091842][T16011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 760.091878][T16011] RIP: 0033:0x7f833159aeb9 [ 760.091907][T16011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 760.091941][T16011] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 760.091977][T16011] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 760.092000][T16011] RDX: 0000000000028082 RSI: 0000200000001900 RDI: ffffffffffffff9c [ 760.092023][T16011] RBP: 00007f8331608c1f R08: 0000000000000000 R09: 0000000000000000 [ 760.092044][T16011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 760.092065][T16011] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 760.092109][T16011] [ 760.094463][ T36] veth1_vlan: left promiscuous mode [ 760.394226][ T36] veth0_vlan: left promiscuous mode [ 761.358688][T11111] Bluetooth: hci2: command tx timeout [ 761.492148][T16031] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2064 with max blocks 1 with error 117 [ 761.567089][T16031] EXT4-fs (sda1): This should not happen!! Data will be lost [ 761.567089][T16031] [ 761.827404][T16045] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2314'. [ 763.400978][ T36] team0 (unregistering): Port device team_slave_1 removed [ 763.442282][T11111] Bluetooth: hci2: command tx timeout [ 764.972716][T15942] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 764.984131][T15942] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 765.050677][T15942] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 765.258581][T15942] hsr_slave_0: entered promiscuous mode [ 765.291285][T15942] hsr_slave_1: entered promiscuous mode [ 765.303219][T16089] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2328'. [ 767.767565][ T30] audit: type=1800 audit(4294969551.699:21): pid=16124 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2333" name="members" dev="configfs" ino=76296 res=0 errno=0 [ 767.844957][T16122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2333'. [ 768.242862][ T7394] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 919 with max blocks 1 with error 117 [ 768.267863][T15942] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 768.280246][ T7394] EXT4-fs (sda1): This should not happen!! Data will be lost [ 768.280246][ T7394] [ 768.307441][T15942] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 768.345461][T15942] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 768.376493][T15942] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 768.571078][T15942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.621068][T15942] 8021q: adding VLAN 0 to HW filter on device team0 [ 768.651910][T12185] bridge0: port 1(bridge_slave_0) entered blocking state [ 768.659317][T12185] bridge0: port 1(bridge_slave_0) entered forwarding state [ 768.684307][T12185] bridge0: port 2(bridge_slave_1) entered blocking state [ 768.691585][T12185] bridge0: port 2(bridge_slave_1) entered forwarding state [ 769.254607][T15942] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 769.415967][T15942] veth0_vlan: entered promiscuous mode [ 769.478537][T15942] veth1_vlan: entered promiscuous mode [ 769.777714][T15942] veth0_macvtap: entered promiscuous mode [ 769.849114][T15942] veth1_macvtap: entered promiscuous mode [ 769.981179][T15942] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 770.144609][T15942] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 770.328426][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.366945][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.434128][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 770.556278][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 771.049949][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 771.085331][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 771.248124][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 771.280419][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 771.772506][T16213] hub 1-0:1.0: USB hub found [ 771.801389][T16213] hub 1-0:1.0: 1 port detected [ 772.627937][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 772.640761][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 772.652502][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 772.661567][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 772.669772][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 773.366468][ T7395] EXT4-fs (sda1): Delayed block allocation failed for inode 2027 at logical offset 923 with max blocks 14 with error 117 [ 773.414965][ T7395] EXT4-fs (sda1): This should not happen!! Data will be lost [ 773.414965][ T7395] [ 773.892022][ T7394] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.221362][ T7394] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.279419][T16253] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 774.726037][T11111] Bluetooth: hci3: command tx timeout [ 774.763912][ T7394] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.115743][T16262] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 775.223899][ T7394] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.306539][T16234] chnl_net:caif_netlink_parms(): no params data found [ 775.382625][T16267] hub 1-0:1.0: USB hub found [ 775.393646][T16267] hub 1-0:1.0: 1 port detected [ 775.895509][ T7394] bridge_slave_1: left allmulticast mode [ 775.905968][ T7394] bridge_slave_1: left promiscuous mode [ 775.918744][ T7394] bridge0: port 2(bridge_slave_1) entered disabled state [ 775.937973][ T7394] bridge_slave_0: left allmulticast mode [ 775.949163][ T7394] bridge_slave_0: left promiscuous mode [ 775.960771][ T7394] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.447582][T16283] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 776.816431][T11111] Bluetooth: hci3: command tx timeout [ 777.320033][ T7394] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 777.380457][ T7394] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 777.407265][ T7394] bond0 (unregistering): Released all slaves [ 777.445243][T16234] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.478417][T16234] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.485727][T16234] bridge_slave_0: entered allmulticast mode [ 777.518572][T16234] bridge_slave_0: entered promiscuous mode [ 777.551488][T16234] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.566941][T16234] bridge0: port 2(bridge_slave_1) entered disabled state [ 777.574295][T16234] bridge_slave_1: entered allmulticast mode [ 777.600423][T16234] bridge_slave_1: entered promiscuous mode [ 777.631997][ T7394] i: left promiscuous mode [ 777.733255][ T7394] HfR: left promiscuous mode [ 777.775549][T16234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 777.895590][T16234] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 778.104172][T16234] team0: Port device team_slave_0 added [ 778.125057][T16234] team0: Port device team_slave_1 added [ 778.273140][T16234] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 778.284242][T16234] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 778.346236][T16234] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 778.369757][T16234] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 778.397033][T16234] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 778.453799][T16234] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 778.694378][T16234] hsr_slave_0: entered promiscuous mode [ 778.713215][T16234] hsr_slave_1: entered promiscuous mode [ 778.728338][T16234] debugfs: 'hsr0' already exists in 'hsr' [ 778.734147][T16234] Cannot create hsr debugfs directory [ 778.830303][T16307] netlink: 'syz.1.2376': attribute type 2 has an invalid length. [ 778.887352][T11111] Bluetooth: hci3: command tx timeout [ 779.232921][ T7394] hsr_slave_0: left promiscuous mode [ 779.279452][ T7394] hsr_slave_1: left promiscuous mode [ 779.286020][ T7394] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 779.307477][ T7394] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 779.328383][ T7394] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 779.335865][ T7394] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 779.398498][ T7394] veth1_macvtap: left promiscuous mode [ 780.973403][T11111] Bluetooth: hci3: command tx timeout [ 781.200852][ T7394] team0 (unregistering): Port device team_slave_1 removed [ 781.351080][ T7394] team0 (unregistering): Port device team_slave_0 removed [ 784.365307][T16234] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 784.378742][T16234] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 784.404298][T16234] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 784.429065][T16234] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 785.169464][T16234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 785.203281][T16234] 8021q: adding VLAN 0 to HW filter on device team0 [ 785.236744][ T7395] bridge0: port 1(bridge_slave_0) entered blocking state [ 785.244066][ T7395] bridge0: port 1(bridge_slave_0) entered forwarding state [ 785.263571][ T7395] bridge0: port 2(bridge_slave_1) entered blocking state [ 785.270946][ T7395] bridge0: port 2(bridge_slave_1) entered forwarding state [ 785.560721][T16349] netlink: 252 bytes leftover after parsing attributes in process `syz.1.2381'. [ 785.697692][T16234] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 785.857372][T16357] netlink: 'syz.1.2384': attribute type 2 has an invalid length. [ 785.948367][T16234] veth0_vlan: entered promiscuous mode [ 785.999709][T16234] veth1_vlan: entered promiscuous mode [ 786.214286][T16234] veth0_macvtap: entered promiscuous mode [ 786.285767][T16234] veth1_macvtap: entered promiscuous mode [ 786.396929][T16234] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 786.445787][T16234] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 786.556770][ T7395] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.643063][ T7395] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.692443][T16365] netlink: 62 bytes leftover after parsing attributes in process `syz.1.2386'. [ 786.772183][ T7395] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.781667][ T7395] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 786.967460][ T7395] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 786.987528][ T7395] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 787.101928][T12188] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 787.120523][T12188] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 787.164256][T16372] FAULT_INJECTION: forcing a failure. [ 787.164256][T16372] name failslab, interval 1, probability 0, space 0, times 0 [ 787.213828][T16372] CPU: 0 UID: 0 PID: 16372 Comm: syz.4.2389 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 787.213885][T16372] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 787.213901][T16372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 787.213920][T16372] Call Trace: [ 787.213931][T16372] [ 787.213944][T16372] dump_stack_lvl+0x100/0x190 [ 787.213989][T16372] should_fail_ex.cold+0x5/0xa [ 787.214044][T16372] should_failslab+0xc2/0x120 [ 787.214090][T16372] __kmalloc_cache_noprof+0x80/0x810 [ 787.214126][T16372] ? allocate_file_region_entries+0x15d/0x620 [ 787.214165][T16372] ? allocate_file_region_entries+0x1a0/0x620 [ 787.214203][T16372] ? allocate_file_region_entries+0x15d/0x620 [ 787.214258][T16372] ? allocate_file_region_entries+0x1a0/0x620 [ 787.214296][T16372] ? _raw_spin_unlock+0x28/0x50 [ 787.214328][T16372] allocate_file_region_entries+0x1a0/0x620 [ 787.214377][T16372] ? __pfx_allocate_file_region_entries+0x10/0x10 [ 787.214431][T16372] region_chg+0x85/0x140 [ 787.214470][T16372] __vma_reservation_common+0x376/0x720 [ 787.214514][T16372] ? __pfx___vma_reservation_common+0x10/0x10 [ 787.214559][T16372] ? huge_pte_alloc+0x4ce/0x730 [ 787.214617][T16372] hugetlb_fault+0x6e6/0x14f0 [ 787.214655][T16372] ? __pfx_hugetlb_fault+0x10/0x10 [ 787.214684][T16372] ? __lock_acquire+0x4a5/0x2630 [ 787.214743][T16372] ? __pfx___up_read+0x10/0x10 [ 787.214788][T16372] ? hugetlb_vma_unlock_read+0x109/0x140 [ 787.214828][T16372] ? hugetlb_vma_unlock_read+0x109/0x140 [ 787.214874][T16372] handle_mm_fault+0x5f1/0xa20 [ 787.214918][T16372] __get_user_pages+0xf9c/0x34d0 [ 787.214977][T16372] ? __pfx___get_user_pages+0x10/0x10 [ 787.215029][T16372] __gup_longterm_locked+0x87d/0x16f0 [ 787.215083][T16372] ? __pfx___gup_longterm_locked+0x10/0x10 [ 787.215132][T16372] ? find_held_lock+0x2b/0x80 [ 787.215159][T16372] ? gup_fast_fallback+0x146d/0x2460 [ 787.215201][T16372] ? gup_fast_fallback+0x146d/0x2460 [ 787.215256][T16372] gup_fast_fallback+0x18c6/0x2460 [ 787.215300][T16372] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 787.215335][T16372] ? is_bpf_text_address+0x94/0x1a0 [ 787.215398][T16372] ? __pfx_gup_fast_fallback+0x10/0x10 [ 787.215446][T16372] ? _parse_integer_limit+0x17f/0x1d0 [ 787.215488][T16372] get_user_pages_fast+0xa7/0xf0 [ 787.215531][T16372] ? __pfx_get_user_pages_fast+0x10/0x10 [ 787.215585][T16372] get_futex_key+0x2c8/0x1620 [ 787.215626][T16372] ? __pfx_get_futex_key+0x10/0x10 [ 787.215674][T16372] futex_wake_op+0x12d/0xdc0 [ 787.215716][T16372] ? get_pid_task+0xfc/0x250 [ 787.215762][T16372] ? __pfx_futex_wake_op+0x10/0x10 [ 787.215804][T16372] ? proc_fail_nth_write+0x9f/0x220 [ 787.215838][T16372] ? find_held_lock+0x2b/0x80 [ 787.215873][T16372] ? ksys_write+0x190/0x250 [ 787.215904][T16372] ? ksys_write+0x190/0x250 [ 787.215941][T16372] do_futex+0x2f1/0x350 [ 787.215982][T16372] ? __pfx_do_futex+0x10/0x10 [ 787.216030][T16372] __x64_sys_futex+0x34f/0x4d0 [ 787.216071][T16372] ? fput+0x79/0x100 [ 787.216108][T16372] ? __pfx___x64_sys_futex+0x10/0x10 [ 787.216147][T16372] ? syscall_user_dispatch+0x76/0x130 [ 787.216201][T16372] do_syscall_64+0xc9/0xf80 [ 787.216242][T16372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.216271][T16372] RIP: 0033:0x7f833159aeb9 [ 787.216293][T16372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 787.216321][T16372] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 787.216348][T16372] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 787.216366][T16372] RDX: 0000000000000002 RSI: 0000000000000005 RDI: 0000000000000000 [ 787.216383][T16372] RBP: 00007f8332542090 R08: 0000000000000000 R09: 0000000000000007 [ 787.216401][T16372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 787.216418][T16372] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 787.216455][T16372] [ 788.339900][T16392] FAULT_INJECTION: forcing a failure. [ 788.339900][T16392] name failslab, interval 1, probability 0, space 0, times 0 [ 788.339939][T16392] CPU: 1 UID: 0 PID: 16392 Comm: syz.2.2393 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 788.339977][T16392] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 788.339988][T16392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 788.340002][T16392] Call Trace: [ 788.340010][T16392] [ 788.340019][T16392] dump_stack_lvl+0x100/0x190 [ 788.340051][T16392] should_fail_ex.cold+0x5/0xa [ 788.340101][T16392] should_failslab+0xc2/0x120 [ 788.340133][T16392] ? lsm_blob_alloc+0x68/0x90 [ 788.340157][T16392] __kmalloc_noprof+0xf6/0x9c0 [ 788.340179][T16392] ? sk_prot_alloc+0x10b/0x2a0 [ 788.340203][T16392] ? rcu_is_watching+0x12/0xc0 [ 788.340225][T16392] ? sk_prot_alloc+0x10b/0x2a0 [ 788.340253][T16392] ? lsm_blob_alloc+0x68/0x90 [ 788.340276][T16392] lsm_blob_alloc+0x68/0x90 [ 788.340301][T16392] security_sk_alloc+0x2d/0x290 [ 788.340333][T16392] sk_prot_alloc+0x12a/0x2a0 [ 788.340359][T16392] sk_alloc+0x36/0xe80 [ 788.340391][T16392] __netlink_create+0x5e/0x2c0 [ 788.340421][T16392] ? __wake_up+0x3f/0x60 [ 788.340449][T16392] netlink_create+0x293/0x610 [ 788.340481][T16392] ? __pfx_genl_bind+0x10/0x10 [ 788.340503][T16392] ? __pfx_genl_unbind+0x10/0x10 [ 788.340523][T16392] ? __pfx_genl_release+0x10/0x10 [ 788.340549][T16392] __sock_create+0x339/0x860 [ 788.340581][T16392] __sys_socket+0x14d/0x260 [ 788.340608][T16392] ? __pfx___sys_socket+0x10/0x10 [ 788.340639][T16392] ? do_user_addr_fault+0x8d6/0x12f0 [ 788.340668][T16392] __x64_sys_socket+0x72/0xb0 [ 788.340695][T16392] ? lockdep_hardirqs_on+0x78/0x100 [ 788.340723][T16392] do_syscall_64+0xc9/0xf80 [ 788.340753][T16392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.340777][T16392] RIP: 0033:0x7ff1a399c747 [ 788.340795][T16392] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 788.340821][T16392] RSP: 002b:00007ff1a4848f98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 788.340844][T16392] RAX: ffffffffffffffda RBX: 00007ff1a3c16090 RCX: 00007ff1a399c747 [ 788.340859][T16392] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 788.340874][T16392] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 788.340888][T16392] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 788.340902][T16392] R13: 00007ff1a3c16128 R14: 00007ff1a3c16090 R15: 00007ffc0742e688 [ 788.340932][T16392] [ 788.598876][T12185] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2057 with max blocks 1 with error 117 [ 788.598929][T12185] EXT4-fs (sda1): This should not happen!! Data will be lost [ 788.598929][T12185] [ 789.085193][T16412] FAULT_INJECTION: forcing a failure. [ 789.085193][T16412] name fail_futex, interval 1, probability 0, space 0, times 0 [ 789.085246][T16412] CPU: 1 UID: 0 PID: 16412 Comm: syz.2.2398 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 789.085298][T16412] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 789.085314][T16412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 789.085333][T16412] Call Trace: [ 789.085344][T16412] [ 789.085356][T16412] dump_stack_lvl+0x100/0x190 [ 789.085400][T16412] should_fail_ex.cold+0x5/0xa [ 789.085454][T16412] get_futex_key+0x106f/0x1620 [ 789.085502][T16412] ? __pfx_get_futex_key+0x10/0x10 [ 789.085556][T16412] futex_wake_op+0x12d/0xdc0 [ 789.085603][T16412] ? get_pid_task+0xfc/0x250 [ 789.085653][T16412] ? __pfx_futex_wake_op+0x10/0x10 [ 789.085701][T16412] ? proc_fail_nth_write+0x9f/0x220 [ 789.085741][T16412] ? find_held_lock+0x2b/0x80 [ 789.085793][T16412] ? ksys_write+0x190/0x250 [ 789.085829][T16412] ? ksys_write+0x190/0x250 [ 789.085874][T16412] do_futex+0x2f1/0x350 [ 789.085921][T16412] ? __pfx_do_futex+0x10/0x10 [ 789.085976][T16412] __x64_sys_futex+0x34f/0x4d0 [ 789.086026][T16412] ? fput+0x79/0x100 [ 789.086070][T16412] ? __pfx___x64_sys_futex+0x10/0x10 [ 789.086118][T16412] ? syscall_user_dispatch+0x76/0x130 [ 789.086181][T16412] do_syscall_64+0xc9/0xf80 [ 789.086225][T16412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 789.086259][T16412] RIP: 0033:0x7ff1a399aeb9 [ 789.086285][T16412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 789.086316][T16412] RSP: 002b:00007ff1a486b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 789.086348][T16412] RAX: ffffffffffffffda RBX: 00007ff1a3c15fa0 RCX: 00007ff1a399aeb9 [ 789.086370][T16412] RDX: 0000000000000002 RSI: 0000000000000005 RDI: 0000000000000000 [ 789.086389][T16412] RBP: 00007ff1a486b090 R08: 0000000000000000 R09: 0000000000000007 [ 789.086410][T16412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 789.086431][T16412] R13: 00007ff1a3c16038 R14: 00007ff1a3c15fa0 R15: 00007ffc0742e688 [ 789.086474][T16412] [ 790.119358][T16434] nfs: Unknown parameter 'BlY 7wEɮHs[ؐu`]e6zcޕ[$(uҞ%EtO2*p[OugrtsQZ׀z' [ 790.257144][T16435] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 791.910489][T16472] netlink: 'syz.3.2411': attribute type 2 has an invalid length. [ 792.227105][T16476] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2048 with max blocks 1 with error 117 [ 792.455904][T16476] EXT4-fs (sda1): This should not happen!! Data will be lost [ 792.455904][T16476] [ 793.883286][T16493] FAULT_INJECTION: forcing a failure. [ 793.883286][T16493] name fail_futex, interval 1, probability 0, space 0, times 0 [ 793.953563][T16493] CPU: 1 UID: 0 PID: 16493 Comm: syz.3.2416 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 793.953637][T16493] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 793.953654][T16493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 793.953676][T16493] Call Trace: [ 793.953687][T16493] [ 793.953701][T16493] dump_stack_lvl+0x100/0x190 [ 793.953753][T16493] should_fail_ex.cold+0x5/0xa [ 793.953806][T16493] ? __kmalloc_noprof+0x347/0x9c0 [ 793.953846][T16493] get_futex_key+0x1d2/0x1620 [ 793.953896][T16493] ? __pfx_get_futex_key+0x10/0x10 [ 793.953957][T16493] futex_wake+0xea/0x530 [ 793.954016][T16493] ? __pfx_futex_wake+0x10/0x10 [ 793.954079][T16493] ? _setid_policy_lookup+0x218/0x3e0 [ 793.954117][T16493] ? __pfx__setid_policy_lookup+0x10/0x10 [ 793.954158][T16493] do_futex+0x32b/0x350 [ 793.954207][T16493] ? __pfx_do_futex+0x10/0x10 [ 793.954265][T16493] __x64_sys_futex+0x34f/0x4d0 [ 793.954319][T16493] ? __pfx___x64_sys_futex+0x10/0x10 [ 793.954370][T16493] ? set_current_groups+0x91/0xd0 [ 793.954422][T16493] ? __do_sys_setgroups+0xa4/0x4f0 [ 793.954481][T16493] do_syscall_64+0xc9/0xf80 [ 793.954528][T16493] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.954565][T16493] RIP: 0033:0x7fc00959aeb9 [ 793.954600][T16493] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.954657][T16493] RSP: 002b:00007fc00a53c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 793.954688][T16493] RAX: ffffffffffffffda RBX: 00007fc009815fa8 RCX: 00007fc00959aeb9 [ 793.954711][T16493] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc009815fac [ 793.954732][T16493] RBP: 00007fc009815fa0 R08: 0000000000000000 R09: 0000000000000000 [ 793.954752][T16493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 793.954772][T16493] R13: 00007fc009816038 R14: 00007ffc5b37b620 R15: 00007ffc5b37b708 [ 793.954816][T16493] [ 798.357425][T16547] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2050 with max blocks 1 with error 117 [ 798.406045][T16547] EXT4-fs (sda1): This should not happen!! Data will be lost [ 798.406045][T16547] [ 798.677334][ T7394] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 1362 with max blocks 19 with error 117 [ 798.714913][ T7394] EXT4-fs (sda1): This should not happen!! Data will be lost [ 798.714913][ T7394] [ 799.487786][T16576] netlink: 'syz.4.2441': attribute type 2 has an invalid length. [ 799.785077][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 799.798637][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 799.809333][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 799.817700][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 799.826853][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 800.814460][T16605] netlink: 146 bytes leftover after parsing attributes in process `syz.4.2448'. [ 801.155073][ T36] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.263892][T16578] chnl_net:caif_netlink_parms(): no params data found [ 801.409336][T16615] netlink: 'syz.4.2451': attribute type 2 has an invalid length. [ 801.800417][ T36] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.896360][T16623] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 801.938849][T11111] Bluetooth: hci5: command tx timeout [ 802.527674][ T36] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.882073][ T36] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.004075][T16578] bridge0: port 1(bridge_slave_0) entered blocking state [ 803.080219][T16578] bridge0: port 1(bridge_slave_0) entered disabled state [ 803.099963][T16578] bridge_slave_0: entered allmulticast mode [ 803.121482][T16578] bridge_slave_0: entered promiscuous mode [ 803.155642][T16578] bridge0: port 2(bridge_slave_1) entered blocking state [ 803.173323][T16578] bridge0: port 2(bridge_slave_1) entered disabled state [ 803.193662][T16578] bridge_slave_1: entered allmulticast mode [ 803.220900][T16578] bridge_slave_1: entered promiscuous mode [ 803.343303][T16578] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 803.394621][T16578] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 803.662829][T16578] team0: Port device team_slave_0 added [ 803.693537][T16578] team0: Port device team_slave_1 added [ 803.914850][T12188] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 1392 with max blocks 5 with error 117 [ 803.945833][T12188] EXT4-fs (sda1): This should not happen!! Data will be lost [ 803.945833][T12188] [ 804.036340][T11111] Bluetooth: hci5: command tx timeout [ 804.572810][T16646] FAULT_INJECTION: forcing a failure. [ 804.572810][T16646] name failslab, interval 1, probability 0, space 0, times 0 [ 804.603767][T16646] CPU: 1 UID: 0 PID: 16646 Comm: syz.4.2458 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 804.603827][T16646] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 804.603842][T16646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 804.603862][T16646] Call Trace: [ 804.603874][T16646] [ 804.603887][T16646] dump_stack_lvl+0x100/0x190 [ 804.603933][T16646] should_fail_ex.cold+0x5/0xa [ 804.603989][T16646] should_failslab+0xc2/0x120 [ 804.604035][T16646] ? tomoyo_realpath_from_path+0xb6/0x690 [ 804.604069][T16646] __kmalloc_noprof+0xf6/0x9c0 [ 804.604115][T16646] ? tomoyo_realpath_from_path+0xb6/0x690 [ 804.604147][T16646] tomoyo_realpath_from_path+0xb6/0x690 [ 804.604190][T16646] tomoyo_path_number_perm+0x23c/0x580 [ 804.604238][T16646] ? tomoyo_path_number_perm+0x22e/0x580 [ 804.604289][T16646] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 804.604377][T16646] ? find_held_lock+0x2b/0x80 [ 804.604419][T16646] ? hook_file_ioctl_common+0x146/0x410 [ 804.604469][T16646] ? __fget_files+0x215/0x3d0 [ 804.604514][T16646] ? __fget_files+0x21f/0x3d0 [ 804.604558][T16646] security_file_ioctl+0xd3/0x230 [ 804.604610][T16646] __x64_sys_ioctl+0xb7/0x210 [ 804.604667][T16646] do_syscall_64+0xc9/0xf80 [ 804.604713][T16646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.604798][T16646] RIP: 0033:0x7f833159aeb9 [ 804.604827][T16646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.604861][T16646] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 804.604894][T16646] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 804.604915][T16646] RDX: 0010000000000402 RSI: 000000000000541b RDI: 0000000000000003 [ 804.604937][T16646] RBP: 00007f8332542090 R08: 0000000000000000 R09: 0000000000000000 [ 804.604956][T16646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 804.604976][T16646] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 804.605021][T16646] [ 804.605036][T16646] ERROR: Out of memory at tomoyo_realpath_from_path. [ 805.144578][T16653] netlink: 'syz.4.2460': attribute type 2 has an invalid length. [ 805.331230][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 805.367589][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 805.420000][ T36] bond0 (unregistering): Released all slaves [ 805.501857][T16578] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 805.509063][T16578] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 805.620589][T16578] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 805.708019][T16578] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 805.736642][T16578] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 805.830885][T16578] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 806.062906][T16666] sp0: Synchronizing with TNC [ 806.104285][T11111] Bluetooth: hci5: command tx timeout [ 806.144192][T16578] hsr_slave_0: entered promiscuous mode [ 806.166306][T16578] hsr_slave_1: entered promiscuous mode [ 806.183367][T16578] debugfs: 'hsr0' already exists in 'hsr' [ 806.189181][T16578] Cannot create hsr debugfs directory [ 806.283674][T16667] netlink: 338 bytes leftover after parsing attributes in process `syz.2.2466'. [ 806.402636][T16674] : Can't lookup blockdev [ 806.646882][T16679] FAULT_INJECTION: forcing a failure. [ 806.646882][T16679] name failslab, interval 1, probability 0, space 0, times 0 [ 806.680970][T16679] CPU: 1 UID: 0 PID: 16679 Comm: syz.2.2469 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 806.681029][T16679] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 806.681043][T16679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 806.681061][T16679] Call Trace: [ 806.681071][T16679] [ 806.681083][T16679] dump_stack_lvl+0x100/0x190 [ 806.681124][T16679] should_fail_ex.cold+0x5/0xa [ 806.681174][T16679] should_failslab+0xc2/0x120 [ 806.681215][T16679] ? tomoyo_encode2+0xfb/0x3c0 [ 806.681243][T16679] __kmalloc_noprof+0xf6/0x9c0 [ 806.681284][T16679] ? tomoyo_encode2+0xfb/0x3c0 [ 806.681318][T16679] tomoyo_encode2+0xfb/0x3c0 [ 806.681352][T16679] tomoyo_encode+0x29/0x50 [ 806.681384][T16679] tomoyo_realpath_from_path+0x18c/0x690 [ 806.681424][T16679] tomoyo_path_number_perm+0x23c/0x580 [ 806.681466][T16679] ? tomoyo_path_number_perm+0x22e/0x580 [ 806.681521][T16679] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 806.681667][T16679] ? find_held_lock+0x2b/0x80 [ 806.681698][T16679] ? hook_file_ioctl_common+0x146/0x410 [ 806.681742][T16679] ? __fget_files+0x215/0x3d0 [ 806.681782][T16679] ? __fget_files+0x21f/0x3d0 [ 806.681821][T16679] security_file_ioctl+0xd3/0x230 [ 806.681866][T16679] __x64_sys_ioctl+0xb7/0x210 [ 806.681917][T16679] do_syscall_64+0xc9/0xf80 [ 806.681957][T16679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.681988][T16679] RIP: 0033:0x7ff1a399aeb9 [ 806.682013][T16679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.682042][T16679] RSP: 002b:00007ff1a486b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 806.682072][T16679] RAX: ffffffffffffffda RBX: 00007ff1a3c15fa0 RCX: 00007ff1a399aeb9 [ 806.682092][T16679] RDX: 0010000000000402 RSI: 000000000000541b RDI: 0000000000000003 [ 806.682110][T16679] RBP: 00007ff1a486b090 R08: 0000000000000000 R09: 0000000000000000 [ 806.682128][T16679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 806.682146][T16679] R13: 00007ff1a3c16038 R14: 00007ff1a3c15fa0 R15: 00007ffc0742e688 [ 806.682185][T16679] [ 807.161844][T16679] ERROR: Out of memory at tomoyo_realpath_from_path. [ 807.534604][T16687] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 807.565118][ T36] hsr_slave_0: left promiscuous mode [ 807.585648][ T36] hsr_slave_1: left promiscuous mode [ 807.600324][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 807.613156][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 807.652426][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 807.659888][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 807.738234][ T36] veth1_macvtap: left promiscuous mode [ 807.764163][ T36] veth0_macvtap: left promiscuous mode [ 807.769865][ T36] veth1_vlan: left promiscuous mode [ 807.791789][ T36] veth0_vlan: left promiscuous mode [ 808.182995][T11111] Bluetooth: hci5: command tx timeout [ 808.768975][T16693] ima: policy update failed [ 808.775418][ T30] audit: type=1802 audit(4294969592.698:22): pid=16693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.2475" res=0 errno=0 [ 809.266484][ T36] team0 (unregistering): Port device team_slave_1 removed [ 809.331726][ T36] team0 (unregistering): Port device team_slave_0 removed [ 810.968130][T16578] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 811.014817][T16578] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 811.034232][T16578] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 811.059423][T16578] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 811.318318][T16724] vivid-007: ================= START STATUS ================= [ 811.386185][T16724] vivid-007: Generate PTS: true [ 811.391539][T16724] vivid-007: Generate SCR: true [ 811.427150][T16724] tpg source WxH: 320x240 (Y'CbCr) [ 811.530289][T16724] tpg field: 1 [ 811.535968][T16724] tpg crop: (0,0)/320x240 [ 811.540788][T16724] tpg compose: (0,0)/320x240 [ 811.546916][T16724] tpg colorspace: 8 [ 811.571539][T16724] tpg transfer function: 0/0 [ 811.578060][T16724] tpg Y'CbCr encoding: 0/0 [ 811.584090][T16724] tpg quantization: 0/0 [ 811.588615][T16724] tpg RGB range: 0/2 [ 811.593196][T16724] vivid-007: ================== END STATUS ================== [ 812.138351][T16578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 812.231167][T16578] 8021q: adding VLAN 0 to HW filter on device team0 [ 812.308347][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 812.315568][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 812.547300][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 812.554532][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 813.811026][T16578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 814.111391][T16578] veth0_vlan: entered promiscuous mode [ 814.168260][T16578] veth1_vlan: entered promiscuous mode [ 814.356052][T16578] veth0_macvtap: entered promiscuous mode [ 814.416545][T16578] veth1_macvtap: entered promiscuous mode [ 814.489988][T16578] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 814.539046][T16578] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 814.579680][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.595125][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.637473][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.667513][ T1326] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.915405][T11111] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 814.924046][T11111] Bluetooth: hci3: Invalid handle: 0x3a4a > 0x0eff [ 815.066911][T16767] netlink: 252 bytes leftover after parsing attributes in process `syz.4.2488'. [ 815.177173][ T1326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.186817][ T1326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 815.334073][T16769] Line length is too long: Should be less than 4094 [ 815.643079][ T7394] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.651117][ T7394] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.578344][T16793] netlink: 330 bytes leftover after parsing attributes in process `syz.3.2493'. [ 816.822166][T16793] mac80211_hwsim hwsim37 : renamed from wlan0 (while UP) [ 817.499809][T11111] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 817.835037][T16812] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 818.462562][T16820] FAULT_INJECTION: forcing a failure. [ 818.462562][T16820] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.512400][T16820] CPU: 1 UID: 0 PID: 16820 Comm: syz.3.2502 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 818.512467][T16820] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 818.512482][T16820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 818.512501][T16820] Call Trace: [ 818.512512][T16820] [ 818.512526][T16820] dump_stack_lvl+0x100/0x190 [ 818.512571][T16820] should_fail_ex.cold+0x5/0xa [ 818.512627][T16820] _copy_from_user+0x2e/0xd0 [ 818.512677][T16820] memdup_user+0x6b/0xe0 [ 818.512722][T16820] strndup_user+0x78/0xe0 [ 818.512767][T16820] __x64_sys_fsopen+0x9e/0x220 [ 818.512817][T16820] do_syscall_64+0xc9/0xf80 [ 818.512861][T16820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.512894][T16820] RIP: 0033:0x7efcb4b9aeb9 [ 818.512921][T16820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.512954][T16820] RSP: 002b:00007efcb5ab2028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 818.512986][T16820] RAX: ffffffffffffffda RBX: 00007efcb4e15fa0 RCX: 00007efcb4b9aeb9 [ 818.513008][T16820] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 818.513028][T16820] RBP: 00007efcb5ab2090 R08: 0000000000000000 R09: 0000000000000000 [ 818.513047][T16820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 818.513067][T16820] R13: 00007efcb4e16038 R14: 00007efcb4e15fa0 R15: 00007ffd42872e48 [ 818.513111][T16820] [ 818.748906][T16823] FAULT_INJECTION: forcing a failure. [ 818.748906][T16823] name failslab, interval 1, probability 0, space 0, times 0 [ 818.787232][T16823] CPU: 0 UID: 0 PID: 16823 Comm: syz.2.2504 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 818.787293][T16823] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 818.787309][T16823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 818.787336][T16823] Call Trace: [ 818.787347][T16823] [ 818.787360][T16823] dump_stack_lvl+0x100/0x190 [ 818.787405][T16823] should_fail_ex.cold+0x5/0xa [ 818.787460][T16823] should_failslab+0xc2/0x120 [ 818.787508][T16823] kmem_cache_alloc_noprof+0x83/0x780 [ 818.787553][T16823] ? copy_net_ns+0xe8/0x7c0 [ 818.787594][T16823] ? copy_net_ns+0xe8/0x7c0 [ 818.787624][T16823] copy_net_ns+0xe8/0x7c0 [ 818.787655][T16823] ? copy_cgroup_ns+0x71/0x970 [ 818.787700][T16823] create_new_namespaces+0x3ea/0xab0 [ 818.787748][T16823] unshare_nsproxy_namespaces+0xc3/0x1f0 [ 818.787791][T16823] ksys_unshare+0x455/0xab0 [ 818.787841][T16823] ? __pfx_ksys_unshare+0x10/0x10 [ 818.787887][T16823] ? xfd_validate_state+0x129/0x190 [ 818.787951][T16823] __x64_sys_unshare+0x31/0x40 [ 818.787999][T16823] do_syscall_64+0xc9/0xf80 [ 818.788043][T16823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.788076][T16823] RIP: 0033:0x7ff1a399aeb9 [ 818.788109][T16823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 818.788141][T16823] RSP: 002b:00007ff1a486b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 818.788173][T16823] RAX: ffffffffffffffda RBX: 00007ff1a3c15fa0 RCX: 00007ff1a399aeb9 [ 818.788195][T16823] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 818.788214][T16823] RBP: 00007ff1a3a08c1f R08: 0000000000000000 R09: 0000000000000000 [ 818.788234][T16823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 818.788253][T16823] R13: 00007ff1a3c16038 R14: 00007ff1a3c15fa0 R15: 00007ffc0742e688 [ 818.788296][T16823] [ 819.155862][ T7394] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2057 with max blocks 1 with error 117 [ 819.168587][ T7394] EXT4-fs (sda1): This should not happen!! Data will be lost [ 819.168587][ T7394] [ 819.190682][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 819.197080][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 821.596002][T16861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2514'. [ 822.278468][T16871] sock: sock_timestamping_bind_phc: sock not bind to device [ 823.335748][T16886] netlink: 330 bytes leftover after parsing attributes in process `syz.1.2521'. [ 823.423080][T16888] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2051 with max blocks 1 with error 117 [ 823.469649][T16888] EXT4-fs (sda1): This should not happen!! Data will be lost [ 823.469649][T16888] [ 825.979077][T16928] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2055 with max blocks 1 with error 117 [ 826.023085][T16928] EXT4-fs (sda1): This should not happen!! Data will be lost [ 826.023085][T16928] [ 826.392808][T16919] FAULT_INJECTION: forcing a failure. [ 826.392808][T16919] name failslab, interval 1, probability 0, space 0, times 0 [ 826.473851][T16919] CPU: 0 UID: 0 PID: 16919 Comm: syz.4.2527 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 826.473903][T16919] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 826.473916][T16919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 826.473931][T16919] Call Trace: [ 826.473940][T16919] [ 826.473950][T16919] dump_stack_lvl+0x100/0x190 [ 826.473984][T16919] should_fail_ex.cold+0x5/0xa [ 826.474026][T16919] should_failslab+0xc2/0x120 [ 826.474061][T16919] kmem_cache_alloc_noprof+0x83/0x780 [ 826.474094][T16919] ? __anon_vma_prepare+0xae/0x5e0 [ 826.474127][T16919] ? __anon_vma_prepare+0xae/0x5e0 [ 826.474152][T16919] __anon_vma_prepare+0xae/0x5e0 [ 826.474179][T16919] ? rcu_read_unlock+0x2d/0xb0 [ 826.474209][T16919] __vmf_anon_prepare+0x11f/0x250 [ 826.474265][T16919] do_wp_page+0xe2e/0x4c10 [ 826.474312][T16919] ? __pfx_do_wp_page+0x10/0x10 [ 826.474353][T16919] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 826.474400][T16919] __handle_mm_fault+0x1ac0/0x2b50 [ 826.474436][T16919] ? __pfx___handle_mm_fault+0x10/0x10 [ 826.474465][T16919] ? __pte_offset_map_lock+0x174/0x320 [ 826.474501][T16919] ? find_held_lock+0x2b/0x80 [ 826.474534][T16919] ? follow_page_pte+0x5b4/0x1410 [ 826.474577][T16919] handle_mm_fault+0x36d/0xa20 [ 826.474609][T16919] __get_user_pages+0xf9c/0x34d0 [ 826.474664][T16919] ? __pfx___get_user_pages+0x10/0x10 [ 826.474710][T16919] populate_vma_page_range+0x267/0x3f0 [ 826.474753][T16919] ? __pfx_populate_vma_page_range+0x10/0x10 [ 826.474793][T16919] ? __pfx_find_vma_intersection+0x10/0x10 [ 826.474832][T16919] ? do_mmap+0x93f/0x12f0 [ 826.474872][T16919] __mm_populate+0x107/0x3a0 [ 826.474913][T16919] ? __pfx___mm_populate+0x10/0x10 [ 826.474954][T16919] ? up_write+0x290/0x4f0 [ 826.474994][T16919] vm_mmap_pgoff+0x37f/0x470 [ 826.475034][T16919] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 826.475070][T16919] ? __fget_files+0x215/0x3d0 [ 826.475102][T16919] ? __fget_files+0x21f/0x3d0 [ 826.475134][T16919] ksys_mmap_pgoff+0x328/0x5b0 [ 826.475175][T16919] __x64_sys_mmap+0x125/0x190 [ 826.475202][T16919] do_syscall_64+0xc9/0xf80 [ 826.475235][T16919] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.475260][T16919] RIP: 0033:0x7f833159aeb9 [ 826.475280][T16919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.475305][T16919] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 826.475329][T16919] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 826.475345][T16919] RDX: 0000000000000003 RSI: 0000000000000009 RDI: 0000000000000000 [ 826.475361][T16919] RBP: 00007f8331608c1f R08: 0000000000000003 R09: 0000000000008000 [ 826.475376][T16919] R10: 0000000000008012 R11: 0000000000000246 R12: 0000000000000000 [ 826.475391][T16919] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 826.475422][T16919] [ 828.405624][T16957] hub 1-0:1.0: USB hub found [ 828.424761][T16957] FAULT_INJECTION: forcing a failure. [ 828.424761][T16957] name failslab, interval 1, probability 0, space 0, times 0 [ 828.461574][T16957] CPU: 0 UID: 0 PID: 16957 Comm: syz.4.2538 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 828.461636][T16957] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 828.461653][T16957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 828.461674][T16957] Call Trace: [ 828.461686][T16957] [ 828.461701][T16957] dump_stack_lvl+0x100/0x190 [ 828.461751][T16957] should_fail_ex.cold+0x5/0xa [ 828.461810][T16957] should_failslab+0xc2/0x120 [ 828.461861][T16957] __kmalloc_cache_noprof+0x80/0x810 [ 828.461901][T16957] ? hub_probe.cold+0xba6/0x2f2b [ 828.461961][T16957] ? hub_probe.cold+0xba6/0x2f2b [ 828.462012][T16957] hub_probe.cold+0xba6/0x2f2b [ 828.462070][T16957] ? do_raw_spin_lock+0x128/0x260 [ 828.462123][T16957] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 828.462176][T16957] ? __pfx_hub_probe+0x10/0x10 [ 828.462223][T16957] ? percpu_rwsem_wake_function+0x250/0x4a0 [ 828.462260][T16957] ? find_held_lock+0x2b/0x80 [ 828.462298][T16957] ? mark_held_locks+0x40/0x70 [ 828.462342][T16957] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 828.462386][T16957] usb_probe_interface+0x303/0x8f0 [ 828.462445][T16957] ? __pfx_usb_probe_interface+0x10/0x10 [ 828.462515][T16957] really_probe+0x241/0xa60 [ 828.462563][T16957] __driver_probe_device+0x1de/0x400 [ 828.462611][T16957] driver_probe_device+0x4c/0x1b0 [ 828.462654][T16957] __device_attach_driver+0x1df/0x340 [ 828.462701][T16957] ? __pfx___device_attach_driver+0x10/0x10 [ 828.462743][T16957] bus_for_each_drv+0x159/0x1e0 [ 828.462802][T16957] ? __pfx_bus_for_each_drv+0x10/0x10 [ 828.462862][T16957] ? lockdep_hardirqs_on+0x78/0x100 [ 828.462904][T16957] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 828.462949][T16957] __device_attach+0x1e4/0x4d0 [ 828.462993][T16957] ? __pfx___device_attach+0x10/0x10 [ 828.463039][T16957] ? do_raw_spin_unlock+0x145/0x1e0 [ 828.463101][T16957] device_initial_probe+0xaf/0xd0 [ 828.463148][T16957] bus_probe_device+0x64/0x160 [ 828.463190][T16957] device_add+0x11d9/0x1950 [ 828.463243][T16957] ? __pfx_device_add+0x10/0x10 [ 828.463293][T16957] ? mark_held_locks+0x40/0x70 [ 828.463352][T16957] usb_set_configuration+0xd97/0x1c60 [ 828.463428][T16957] bConfigurationValue_store+0x100/0x180 [ 828.463489][T16957] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 828.463541][T16957] ? find_held_lock+0x2b/0x80 [ 828.463575][T16957] ? sysfs_file_kobj+0xe4/0x290 [ 828.463616][T16957] ? sysfs_file_kobj+0xe4/0x290 [ 828.463661][T16957] ? __pfx_bConfigurationValue_store+0x10/0x10 [ 828.463708][T16957] dev_attr_store+0x58/0x80 [ 828.463756][T16957] ? __pfx_dev_attr_store+0x10/0x10 [ 828.463804][T16957] sysfs_kf_write+0xf2/0x150 [ 828.463849][T16957] kernfs_fop_write_iter+0x3e0/0x5f0 [ 828.463883][T16957] ? __pfx_sysfs_kf_write+0x10/0x10 [ 828.463930][T16957] iter_file_splice_write+0x82b/0x10a0 [ 828.463996][T16957] ? __pfx_iter_file_splice_write+0x10/0x10 [ 828.464048][T16957] ? __pfx_copy_splice_read+0x10/0x10 [ 828.464111][T16957] ? __pfx_iter_file_splice_write+0x10/0x10 [ 828.464157][T16957] direct_splice_actor+0x192/0x6c0 [ 828.464204][T16957] splice_direct_to_actor+0x345/0xa30 [ 828.464247][T16957] ? __pfx_direct_splice_actor+0x10/0x10 [ 828.464298][T16957] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 828.464353][T16957] do_splice_direct+0x174/0x240 [ 828.464394][T16957] ? __pfx_do_splice_direct+0x10/0x10 [ 828.464431][T16957] ? common_file_perm+0x1ab/0x4f0 [ 828.464492][T16957] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 828.464540][T16957] ? rw_verify_area+0xce/0x6d0 [ 828.464580][T16957] do_sendfile+0xadc/0xe20 [ 828.464627][T16957] ? __pfx_do_sendfile+0x10/0x10 [ 828.464665][T16957] ? __sys_sendmsg+0x18f/0x220 [ 828.464722][T16957] ? __x64_sys_futex+0x34f/0x4d0 [ 828.464769][T16957] ? __x64_sys_futex+0x358/0x4d0 [ 828.464822][T16957] __x64_sys_sendfile64+0x1d8/0x220 [ 828.464869][T16957] ? xfd_validate_state+0x129/0x190 [ 828.464925][T16957] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 828.464987][T16957] do_syscall_64+0xc9/0xf80 [ 828.465033][T16957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.465068][T16957] RIP: 0033:0x7f833159aeb9 [ 828.465099][T16957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.465134][T16957] RSP: 002b:00007f8332542028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 828.465168][T16957] RAX: ffffffffffffffda RBX: 00007f8331815fa0 RCX: 00007f833159aeb9 [ 828.465192][T16957] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006 [ 828.465212][T16957] RBP: 00007f8331608c1f R08: 0000000000000000 R09: 0000000000000000 [ 828.465234][T16957] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 828.465255][T16957] R13: 00007f8331816038 R14: 00007f8331815fa0 R15: 00007fff7ee66468 [ 828.465298][T16957] [ 829.204326][T16957] hub 1-0:1.0: config failed, out of memory (err -12) [ 830.151061][T16979] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 830.695896][T16981] kexec: Could not allocate control_code_buffer [ 831.572436][T16991] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2051 with max blocks 1 with error 117 [ 831.605251][T16991] EXT4-fs (sda1): This should not happen!! Data will be lost [ 831.605251][T16991] [ 832.104611][T17025] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2055 with max blocks 1 with error 117 [ 832.165424][T17025] EXT4-fs (sda1): This should not happen!! Data will be lost [ 832.165424][T17025] [ 832.542917][T17035] FAULT_INJECTION: forcing a failure. [ 832.542917][T17035] name failslab, interval 1, probability 0, space 0, times 0 [ 832.597106][T17035] CPU: 1 UID: 0 PID: 17035 Comm: syz.3.2554 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 832.597173][T17035] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 832.597189][T17035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 832.597209][T17035] Call Trace: [ 832.597220][T17035] [ 832.597233][T17035] dump_stack_lvl+0x100/0x190 [ 832.597283][T17035] should_fail_ex.cold+0x5/0xa [ 832.597340][T17035] should_failslab+0xc2/0x120 [ 832.597388][T17035] kmem_cache_alloc_noprof+0x83/0x780 [ 832.597430][T17035] ? __pfx_map_id_range_down+0x10/0x10 [ 832.597459][T17035] ? security_inode_alloc+0x3b/0x2c0 [ 832.597510][T17035] ? security_inode_alloc+0x3b/0x2c0 [ 832.597550][T17035] security_inode_alloc+0x3b/0x2c0 [ 832.597597][T17035] inode_init_always_gfp+0xced/0x1040 [ 832.597644][T17035] alloc_inode+0x8e/0x250 [ 832.597696][T17035] new_inode+0x22/0x1c0 [ 832.597750][T17035] shmem_get_inode+0x197/0xf30 [ 832.597783][T17035] ? __vm_enough_memory+0x184/0x390 [ 832.597840][T17035] __shmem_file_setup+0x279/0x330 [ 832.597880][T17035] shmem_zero_setup+0x93/0x1b0 [ 832.597927][T17035] __mmap_region+0x2101/0x2820 [ 832.597984][T17035] ? __pfx___mmap_region+0x10/0x10 [ 832.598021][T17035] ? set_next_entity+0x11a/0x9b0 [ 832.598081][T17035] ? __lock_acquire+0x4a5/0x2630 [ 832.598150][T17035] ? lock_acquire+0x17c/0x330 [ 832.598196][T17035] ? find_held_lock+0x2b/0x80 [ 832.598249][T17035] ? rcu_is_watching+0x12/0xc0 [ 832.598285][T17035] ? trace_sched_exit_tp+0xcd/0x100 [ 832.598327][T17035] ? __schedule+0xf65/0x5e10 [ 832.598413][T17035] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 832.598470][T17035] ? rcu_is_watching+0x12/0xc0 [ 832.598516][T17035] mmap_region+0x180/0x3e0 [ 832.598565][T17035] do_mmap+0xc63/0x12f0 [ 832.598621][T17035] ? __pfx_do_mmap+0x10/0x10 [ 832.598674][T17035] ? __pfx_down_write_killable+0x10/0x10 [ 832.598729][T17035] vm_mmap_pgoff+0x29e/0x470 [ 832.598784][T17035] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 832.598840][T17035] ? __x64_sys_futex+0x34f/0x4d0 [ 832.598883][T17035] ? __x64_sys_futex+0x358/0x4d0 [ 832.598935][T17035] ksys_mmap_pgoff+0x7d/0x5b0 [ 832.598983][T17035] ? __pfx_from_kuid_munged+0x10/0x10 [ 832.599028][T17035] __x64_sys_mmap+0x125/0x190 [ 832.599066][T17035] do_syscall_64+0xc9/0xf80 [ 832.599120][T17035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 832.599157][T17035] RIP: 0033:0x7efcb4b9aeb9 [ 832.599185][T17035] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 832.599218][T17035] RSP: 002b:00007efcb5a91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 832.599254][T17035] RAX: ffffffffffffffda RBX: 00007efcb4e16090 RCX: 00007efcb4b9aeb9 [ 832.599279][T17035] RDX: 0000000000000003 RSI: 0000000002020009 RDI: 0000000000000000 [ 832.599299][T17035] RBP: 00007efcb4c08c1f R08: fffffffffffffffa R09: 0000000000008000 [ 832.599322][T17035] R10: 0000000000000eb1 R11: 0000000000000246 R12: 0000000000000000 [ 832.599342][T17035] R13: 00007efcb4e16128 R14: 00007efcb4e16090 R15: 00007ffd42872e48 [ 832.599385][T17035] [ 833.157143][T17030] FAULT_INJECTION: forcing a failure. [ 833.157143][T17030] name failslab, interval 1, probability 0, space 0, times 0 [ 833.254565][T17030] CPU: 0 UID: 0 PID: 17030 Comm: syz.3.2554 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 833.254625][T17030] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 833.254641][T17030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 833.254663][T17030] Call Trace: [ 833.254674][T17030] [ 833.254688][T17030] dump_stack_lvl+0x100/0x190 [ 833.254737][T17030] should_fail_ex.cold+0x5/0xa [ 833.254795][T17030] should_failslab+0xc2/0x120 [ 833.254844][T17030] kmem_cache_alloc_noprof+0x83/0x780 [ 833.254889][T17030] ? __kernfs_new_node+0xd2/0x960 [ 833.254944][T17030] ? __kernfs_new_node+0xd2/0x960 [ 833.254987][T17030] __kernfs_new_node+0xd2/0x960 [ 833.255040][T17030] ? __pfx___kernfs_new_node+0x10/0x10 [ 833.255109][T17030] ? find_held_lock+0x2b/0x80 [ 833.255143][T17030] ? kernfs_root+0xee/0x2a0 [ 833.255187][T17030] ? kernfs_root+0xee/0x2a0 [ 833.255244][T17030] kernfs_new_node+0x11b/0x1a0 [ 833.255304][T17030] __kernfs_create_file+0x53/0x350 [ 833.255347][T17030] sysfs_add_file_mode_ns+0x207/0x3c0 [ 833.255402][T17030] internal_create_group+0x593/0xf40 [ 833.255471][T17030] ? __pfx_internal_create_group+0x10/0x10 [ 833.255529][T17030] ? kernfs_create_link+0x1bd/0x240 [ 833.255574][T17030] internal_create_groups+0x9d/0x150 [ 833.255627][T17030] device_add+0xf5b/0x1950 [ 833.255680][T17030] ? __pfx_device_add+0x10/0x10 [ 833.255729][T17030] ? lockdep_init_map_type+0x5c/0x250 [ 833.255777][T17030] ? __init_waitqueue_head+0xca/0x150 [ 833.255840][T17030] netdev_register_kobject+0x1a9/0x3d0 [ 833.255883][T17030] register_netdevice+0x12b3/0x21d0 [ 833.255926][T17030] ? __pfx_register_netdevice+0x10/0x10 [ 833.255993][T17030] __tun_chr_ioctl+0x1ded/0x47c0 [ 833.256046][T17030] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 833.256118][T17030] ? __pfx___tun_chr_ioctl+0x10/0x10 [ 833.256175][T17030] ? find_held_lock+0x2b/0x80 [ 833.256210][T17030] ? hook_file_ioctl_common+0x146/0x410 [ 833.256272][T17030] ? __fget_files+0x21f/0x3d0 [ 833.256315][T17030] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 833.256367][T17030] __x64_sys_ioctl+0x18e/0x210 [ 833.256421][T17030] do_syscall_64+0xc9/0xf80 [ 833.256464][T17030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 833.256498][T17030] RIP: 0033:0x7efcb4b9aeb9 [ 833.256525][T17030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 833.256559][T17030] RSP: 002b:00007efcb5ab2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 833.256594][T17030] RAX: ffffffffffffffda RBX: 00007efcb4e15fa0 RCX: 00007efcb4b9aeb9 [ 833.256618][T17030] RDX: 0000000000000038 RSI: 00000000400454ca RDI: 0000000000000007 [ 833.256640][T17030] RBP: 00007efcb4c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 833.256661][T17030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 833.256688][T17030] R13: 00007efcb4e16038 R14: 00007efcb4e15fa0 R15: 00007ffd42872e48 [ 833.256734][T17030] [ 834.539108][ T7398] EXT4-fs (sda1): Delayed block allocation failed for inode 2027 at logical offset 3524 with max blocks 60 with error 117 [ 834.669520][ T7398] EXT4-fs (sda1): This should not happen!! Data will be lost [ 834.669520][ T7398] [ 834.758438][ T7398] EXT4-fs (sda1): Delayed block allocation failed for inode 2033 at logical offset 1394 with max blocks 3 with error 117 [ 834.829401][ T7398] EXT4-fs (sda1): This should not happen!! Data will be lost [ 834.829401][ T7398] [ 835.045729][T17072] netlink: 146 bytes leftover after parsing attributes in process `syz.2.2564'. [ 836.076656][T17091] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 837.691464][T17107] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2573'. [ 839.049179][T17124] FAULT_INJECTION: forcing a failure. [ 839.049179][T17124] name failslab, interval 1, probability 0, space 0, times 0 [ 839.087416][T17124] CPU: 0 UID: 0 PID: 17124 Comm: syz.2.2575 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 839.087479][T17124] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 839.087495][T17124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 839.087516][T17124] Call Trace: [ 839.087528][T17124] [ 839.087542][T17124] dump_stack_lvl+0x100/0x190 [ 839.087591][T17124] should_fail_ex.cold+0x5/0xa [ 839.087649][T17124] should_failslab+0xc2/0x120 [ 839.087700][T17124] kmem_cache_alloc_node_noprof+0x8c/0x880 [ 839.087750][T17124] ? __alloc_skb+0x156/0x410 [ 839.087805][T17124] ? __alloc_skb+0x156/0x410 [ 839.087848][T17124] __alloc_skb+0x156/0x410 [ 839.087892][T17124] ? __alloc_skb+0x35d/0x410 [ 839.087938][T17124] ? __pfx___alloc_skb+0x10/0x10 [ 839.087990][T17124] ? kfree+0x1c7/0x690 [ 839.088021][T17124] ? unregister_sysctl_table+0x4d/0x60 [ 839.088082][T17124] mpls_netconf_notify_devconf+0x4a/0x100 [ 839.088130][T17124] mpls_dev_notify+0x6ce/0x920 [ 839.088178][T17124] notifier_call_chain+0x99/0x3b0 [ 839.088236][T17124] call_netdevice_notifiers_info+0xbe/0x110 [ 839.088279][T17124] unregister_netdevice_many_notify+0x1208/0x2580 [ 839.088363][T17124] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 839.088427][T17124] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 839.088470][T17124] ? __pfx___mutex_lock+0x10/0x10 [ 839.088528][T17124] unregister_netdevice_queue+0x30b/0x3c0 [ 839.088588][T17124] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 839.088648][T17124] ? __pfx_locks_remove_file+0x10/0x10 [ 839.088696][T17124] ppp_release+0x211/0x230 [ 839.088738][T17124] ? __pfx_ppp_release+0x10/0x10 [ 839.088776][T17124] __fput+0x3ff/0xb40 [ 839.088834][T17124] task_work_run+0x150/0x240 [ 839.088890][T17124] ? __pfx_task_work_run+0x10/0x10 [ 839.088957][T17124] exit_to_user_mode_loop+0x100/0x4b0 [ 839.089006][T17124] ? rcu_is_watching+0x12/0xc0 [ 839.089043][T17124] do_syscall_64+0x4ea/0xf80 [ 839.089090][T17124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.089126][T17124] RIP: 0033:0x7ff1a399aeb9 [ 839.089155][T17124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 839.089190][T17124] RSP: 002b:00007ff1a484a028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 839.089225][T17124] RAX: 0000000000000000 RBX: 00007ff1a3c16090 RCX: 00007ff1a399aeb9 [ 839.089247][T17124] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000002 [ 839.089268][T17124] RBP: 00007ff1a3a08c1f R08: 0000000000000000 R09: 0000000000000000 [ 839.089288][T17124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 839.089308][T17124] R13: 00007ff1a3c16128 R14: 00007ff1a3c16090 R15: 00007ffc0742e688 [ 839.089362][T17124] [ 840.230018][T17138] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2580'. [ 840.584893][T17138] ================================================================== [ 840.593057][T17138] BUG: KASAN: slab-use-after-free in dvb_device_open+0x33f/0x3b0 [ 840.600950][T17138] Read of size 8 at addr ffff88802b600818 by task syz.2.2580/17138 [ 840.608901][T17138] [ 840.611291][T17138] CPU: 1 UID: 0 PID: 17138 Comm: syz.2.2580 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 840.611355][T17138] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 840.611374][T17138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 840.611401][T17138] Call Trace: [ 840.611413][T17138] [ 840.611427][T17138] dump_stack_lvl+0x100/0x190 [ 840.611475][T17138] print_report+0x156/0x4c9 [ 840.611525][T17138] ? __virt_addr_valid+0x81/0x620 [ 840.611577][T17138] ? __phys_addr+0xe8/0x180 [ 840.611628][T17138] ? dvb_device_open+0x33f/0x3b0 [ 840.611674][T17138] kasan_report+0xdf/0x1a0 [ 840.611724][T17138] ? dvb_device_open+0x33f/0x3b0 [ 840.611773][T17138] ? __pfx_dvb_device_open+0x10/0x10 [ 840.611818][T17138] dvb_device_open+0x33f/0x3b0 [ 840.611864][T17138] ? __pfx_dvb_device_open+0x10/0x10 [ 840.611910][T17138] chrdev_open+0x234/0x6a0 [ 840.611953][T17138] ? __pfx_apparmor_file_open+0x10/0x10 [ 840.612000][T17138] ? __pfx_chrdev_open+0x10/0x10 [ 840.612044][T17138] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 840.612092][T17138] do_dentry_open+0x73e/0x1570 [ 840.612146][T17138] ? __pfx_chrdev_open+0x10/0x10 [ 840.612190][T17138] ? security_inode_permission+0xbf/0x250 [ 840.612249][T17138] vfs_open+0x82/0x3f0 [ 840.612302][T17138] path_openat+0x21dc/0x3120 [ 840.612350][T17138] ? __pfx_path_openat+0x10/0x10 [ 840.612401][T17138] do_filp_open+0x1f7/0x420 [ 840.612444][T17138] ? __pfx_do_filp_open+0x10/0x10 [ 840.612501][T17138] ? _raw_spin_unlock+0x28/0x50 [ 840.612537][T17138] ? alloc_fd+0x476/0x790 [ 840.612582][T17138] do_sys_openat2+0x12e/0x220 [ 840.612635][T17138] ? __pfx_do_sys_openat2+0x10/0x10 [ 840.612697][T17138] __x64_sys_openat+0x12d/0x210 [ 840.612752][T17138] ? __pfx___x64_sys_openat+0x10/0x10 [ 840.612806][T17138] ? xfd_validate_state+0x129/0x190 [ 840.612868][T17138] do_syscall_64+0xc9/0xf80 [ 840.612913][T17138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.612950][T17138] RIP: 0033:0x7ff1a399aeb9 [ 840.613004][T17138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 840.613042][T17138] RSP: 002b:00007ff1a486b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 840.613076][T17138] RAX: ffffffffffffffda RBX: 00007ff1a3c15fa0 RCX: 00007ff1a399aeb9 [ 840.613106][T17138] RDX: 0000000000008203 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 840.613130][T17138] RBP: 00007ff1a3a08c1f R08: 0000000000000000 R09: 0000000000000000 [ 840.613152][T17138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 840.613174][T17138] R13: 00007ff1a3c16038 R14: 00007ff1a3c15fa0 R15: 00007ffc0742e688 [ 840.613209][T17138] [ 840.613221][T17138] [ 840.879421][T17138] Allocated by task 1: [ 840.883516][T17138] kasan_save_stack+0x30/0x50 [ 840.888237][T17138] kasan_save_track+0x14/0x30 [ 840.892975][T17138] __kasan_kmalloc+0xaa/0xb0 [ 840.897605][T17138] dvb_register_device+0x1d6/0x1e60 [ 840.902933][T17138] dvb_register_frontend+0x5a8/0x8a0 [ 840.908269][T17138] vidtv_bridge_probe+0x44b/0xa30 [ 840.913342][T17138] platform_probe+0x106/0x1d0 [ 840.918051][T17138] really_probe+0x241/0xa60 [ 840.922597][T17138] __driver_probe_device+0x1de/0x400 [ 840.927921][T17138] driver_probe_device+0x4c/0x1b0 [ 840.932993][T17138] __driver_attach+0x217/0x5c0 [ 840.937800][T17138] bus_for_each_dev+0x13e/0x1d0 [ 840.942703][T17138] bus_add_driver+0x305/0x5b0 [ 840.947412][T17138] driver_register+0x1e2/0x360 [ 840.952217][T17138] vidtv_bridge_init+0x38/0x70 [ 840.957120][T17138] do_one_initcall+0x11d/0x690 [ 840.961930][T17138] kernel_init_freeable+0x6e5/0x790 [ 840.967158][T17138] kernel_init+0x1f/0x1e0 [ 840.971529][T17138] ret_from_fork+0x754/0xaf0 [ 840.976165][T17138] ret_from_fork_asm+0x1a/0x30 [ 840.980976][T17138] [ 840.983319][T17138] Freed by task 17091: [ 840.987423][T17138] kasan_save_stack+0x30/0x50 [ 840.992145][T17138] kasan_save_track+0x14/0x30 [ 840.996872][T17138] kasan_save_free_info+0x3b/0x70 [ 841.001939][T17138] __kasan_slab_free+0x5f/0x80 [ 841.006797][T17138] kfree+0x1c7/0x690 [ 841.010809][T17138] dvb_device_put.part.0+0x57/0x90 [ 841.015962][T17138] dvb_device_open+0x2ba/0x3b0 [ 841.020765][T17138] chrdev_open+0x234/0x6a0 [ 841.025220][T17138] do_dentry_open+0x73e/0x1570 [ 841.030017][T17138] vfs_open+0x82/0x3f0 [ 841.034132][T17138] path_openat+0x21dc/0x3120 [ 841.038755][T17138] do_filp_open+0x1f7/0x420 [ 841.043292][T17138] do_sys_openat2+0x12e/0x220 [ 841.048019][T17138] __x64_sys_openat+0x12d/0x210 [ 841.052923][T17138] do_syscall_64+0xc9/0xf80 [ 841.057498][T17138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.063427][T17138] [ 841.065771][T17138] The buggy address belongs to the object at ffff88802b600800 [ 841.065771][T17138] which belongs to the cache kmalloc-256 of size 256 [ 841.079859][T17138] The buggy address is located 24 bytes inside of [ 841.079859][T17138] freed 256-byte region [ffff88802b600800, ffff88802b600900) [ 841.093615][T17138] [ 841.095971][T17138] The buggy address belongs to the physical page: [ 841.102505][T17138] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b600 [ 841.111299][T17138] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 841.119830][T17138] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 841.127406][T17138] page_type: f5(slab) [ 841.131432][T17138] raw: 00fff00000000040 ffff88813ff26b40 dead000000000122 0000000000000000 [ 841.140225][T17138] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 841.148861][T17138] head: 00fff00000000040 ffff88813ff26b40 dead000000000122 0000000000000000 [ 841.157561][T17138] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 841.166260][T17138] head: 00fff00000000001 ffffea0000ad8001 00000000ffffffff 00000000ffffffff [ 841.174986][T17138] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 841.183682][T17138] page dumped because: kasan: bad access detected [ 841.190117][T17138] page_owner tracks the page as allocated [ 841.195938][T17138] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 26561352053, free_ts 0 [ 841.215693][T17138] post_alloc_hook+0x1e1/0x250 [ 841.220500][T17138] get_page_from_freelist+0xe3d/0x2e10 [ 841.225993][T17138] __alloc_frozen_pages_noprof+0x26c/0x2410 [ 841.231920][T17138] alloc_pages_mpol+0x1fb/0x550 [ 841.236814][T17138] new_slab+0x2c4/0x440 [ 841.240999][T17138] ___slab_alloc+0xda3/0x1ca0 [ 841.245716][T17138] __slab_alloc.isra.0+0x63/0x110 [ 841.250766][T17138] __kmalloc_cache_noprof+0x531/0x810 [ 841.256172][T17138] bus_add_driver+0x92/0x5b0 [ 841.260797][T17138] driver_register+0x1e2/0x360 [ 841.265612][T17138] do_one_initcall+0x11d/0x690 [ 841.270420][T17138] kernel_init_freeable+0x6e5/0x790 [ 841.275651][T17138] kernel_init+0x1f/0x1e0 [ 841.280025][T17138] ret_from_fork+0x754/0xaf0 [ 841.285023][T17138] ret_from_fork_asm+0x1a/0x30 [ 841.289926][T17138] page_owner free stack trace missing [ 841.295315][T17138] [ 841.297662][T17138] Memory state around the buggy address: [ 841.303322][T17138] ffff88802b600700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 841.311429][T17138] ffff88802b600780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 841.319611][T17138] >ffff88802b600800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.327693][T17138] ^ [ 841.332562][T17138] ffff88802b600880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.340646][T17138] ffff88802b600900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 841.348737][T17138] ================================================================== [ 841.520403][T17141] EXT4-fs (sda1): Delayed block allocation failed for inode 2021 at logical offset 2064 with max blocks 1 with error 117 [ 841.628068][T17138] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 841.635399][T17138] CPU: 1 UID: 0 PID: 17138 Comm: syz.2.2580 Tainted: G U I L syzkaller #0 PREEMPT(full) [ 841.646431][T17138] Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP [ 841.653854][T17138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 841.664054][T17138] Call Trace: [ 841.667381][T17138] [ 841.670358][T17138] dump_stack_lvl+0x100/0x190 [ 841.675151][T17138] vpanic+0x20d/0x630 [ 841.679188][T17138] panic+0xd1/0xd1 [ 841.682971][T17138] ? __pfx_panic+0x10/0x10 [ 841.687451][T17138] ? dvb_device_open+0x33f/0x3b0 [ 841.692464][T17138] ? preempt_schedule_common+0x42/0xc0 [ 841.698002][T17138] check_panic_on_warn.cold+0x19/0x34 [ 841.703449][T17138] end_report.part.0+0x3a/0x90 [ 841.708349][T17138] kasan_report.cold+0xe/0x18 [ 841.713116][T17138] ? dvb_device_open+0x33f/0x3b0 [ 841.718132][T17138] ? __pfx_dvb_device_open+0x10/0x10 [ 841.723492][T17138] dvb_device_open+0x33f/0x3b0 [ 841.728329][T17138] ? __pfx_dvb_device_open+0x10/0x10 [ 841.733686][T17138] chrdev_open+0x234/0x6a0 [ 841.738178][T17138] ? __pfx_apparmor_file_open+0x10/0x10 [ 841.744057][T17138] ? __pfx_chrdev_open+0x10/0x10 [ 841.749064][T17138] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 841.755547][T17138] do_dentry_open+0x73e/0x1570 [ 841.760377][T17138] ? __pfx_chrdev_open+0x10/0x10 [ 841.765382][T17138] ? security_inode_permission+0xbf/0x250 [ 841.771185][T17138] vfs_open+0x82/0x3f0 [ 841.775334][T17138] path_openat+0x21dc/0x3120 [ 841.779960][T17138] ? __pfx_path_openat+0x10/0x10 [ 841.784928][T17138] do_filp_open+0x1f7/0x420 [ 841.789568][T17138] ? __pfx_do_filp_open+0x10/0x10 [ 841.794641][T17138] ? _raw_spin_unlock+0x28/0x50 [ 841.799517][T17138] ? alloc_fd+0x476/0x790 [ 841.803905][T17138] do_sys_openat2+0x12e/0x220 [ 841.808622][T17138] ? __pfx_do_sys_openat2+0x10/0x10 [ 841.813880][T17138] __x64_sys_openat+0x12d/0x210 [ 841.818781][T17138] ? __pfx___x64_sys_openat+0x10/0x10 [ 841.824207][T17138] ? xfd_validate_state+0x129/0x190 [ 841.829498][T17138] do_syscall_64+0xc9/0xf80 [ 841.834024][T17138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 841.839932][T17138] RIP: 0033:0x7ff1a399aeb9 [ 841.844361][T17138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 841.863989][T17138] RSP: 002b:00007ff1a486b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 841.872419][T17138] RAX: ffffffffffffffda RBX: 00007ff1a3c15fa0 RCX: 00007ff1a399aeb9 [ 841.880404][T17138] RDX: 0000000000008203 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 841.888478][T17138] RBP: 00007ff1a3a08c1f R08: 0000000000000000 R09: 0000000000000000 [ 841.897278][T17138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 841.905616][T17138] R13: 00007ff1a3c16038 R14: 00007ff1a3c15fa0 R15: 00007ffc0742e688 [ 841.914839][T17138] [ 841.919043][T17138] Kernel Offset: disabled [ 841.923565][T17138] Rebooting in 86400 seconds..