last executing test programs: 11.655869514s ago: executing program 3 (id=2641): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x6, 0x8000) socket(0x11, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mq_open$auto(&(0x7f0000000000)='nlctrl\x00', 0x80, 0x8001, &(0x7f0000000040)={0x4, 0x1, 0x4c3, 0x28}) mmap$auto(0x0, 0x40006, 0xe2, 0x20009b72, 0x7, 0x28000) openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0x121980, 0x0) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3f) madvise$auto(0x3000, 0xffffffffffff0001, 0x15) 9.429647382s ago: executing program 3 (id=2643): socket(0x2, 0x3, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x54) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) setresuid$auto(0x0, 0x8, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0x11, 0x3, 0x2) setuid$auto(0x0) openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, 0x0, 0x84000, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0x240007, 0x19) migrate_pages$auto(0x0, 0xa, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socket(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) move_pages$auto(0x0, 0x1002, 0x0, &(0x7f0000001140), 0x0, 0x2) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/interrupts\x00', 0x18b202, 0x0) 9.423835779s ago: executing program 1 (id=2652): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x6, 0x8000) socket(0x11, 0x80003, 0x300) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x1000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mq_open$auto(&(0x7f0000000000)='nlctrl\x00', 0x80, 0x8001, &(0x7f0000000040)={0x4, 0x1, 0x4c3, 0x28}) mmap$auto(0x0, 0x40006, 0xe2, 0x20009b72, 0x7, 0x28000) openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0x121980, 0x0) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3f) madvise$auto(0x3000, 0xffffffffffff0001, 0x15) 8.469504048s ago: executing program 2 (id=2646): r0 = socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(r0, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) shmctl$auto(0xa0000000, 0x6, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) execve$auto(0x0, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/zram0/mem_limit\x00', 0x183841, 0x0) pwrite64$auto(r1, &(0x7f0000000280)='Mdev/loop-control\x00', 0x80000000, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x5, 0x14, 0x944, 0x1ffe0, 0x3, 0x6, 0x7, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0x2, 0x5, 0x3, 0x40, 0x7, 0x21, 0x309, 0x6, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xffffffff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x1fe, 0x81) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r2 = socket(0x10, 0x2, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$auto_BLKTRACESETUP32(r3, 0xc0401273, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) r4 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000000), 0x109002, 0x0) sendfile$auto(r4, r4, 0x0, 0x10000800000003) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) 7.333849765s ago: executing program 2 (id=2648): openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x2003f0, 0x15) mmap$auto(0x0, 0x2a, 0xdf, 0x9b72, 0x1000, 0x28000) openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/renderD128\x00', 0x20300, 0x0) pwrite64$auto(0xc8, &(0x7f0000000000)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x00\rs\x1cJ\x99\x00:c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2', 0x4e, 0x1) close_range$auto(0x0, 0xfffffffffffff000, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$auto(0x18, &(0x7f0000000040)=@raw_tracepoint={0x0, 0xffffffffffffffff, 0x0, 0x800}, 0x92) connect$auto(0x3, 0x0, 0x54) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) getsockopt$auto(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) openat$auto_drm_debugfs_entry_fops_drm_debugfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/dri/vgem/clients\x00', 0x60000, 0x0) mincore$auto(0x1000, 0x8001, 0x0) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r1, 0x0, 0xb4d3) write$auto(0x3, 0x0, 0xffd8) semget$auto(0x0, 0x13c, 0x1ff) 7.332864326s ago: executing program 1 (id=2658): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_netdev(&(0x7f0000000080), r0) bind$auto(r0, &(0x7f0000000000)=@nl=@unspec, 0x85f) r1 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x1000, 0x0) mmap$auto_tracing_buffers_fops_trace(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x8e051, r1, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8400) socket(0xa, 0x1, 0x100) r2 = openat$auto_sw_sync_debugfs_fops_sync_debug(0xffffffffffffff9c, &(0x7f0000000080), 0x101100, 0x0) ioctl$auto_SW_SYNC_GET_DEADLINE(r2, 0xc0105702, &(0x7f0000000000)={0x0, 0x0, r2}) openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x121900, 0x0) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x2000, 0x0) ioctl$auto(r4, 0x5410, r4) select$auto(0xe, 0x0, 0x0, &(0x7f0000000040)={[0x1ff, 0x7, 0xd, 0x8fd6, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x3, 0x62, 0x80000001, 0x7, 0x1, 0x9, 0x1, 0xfffffffffffffffe]}, 0x0) write$auto(r3, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, 0x0, 0x50b41, 0x0) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r5 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0) ioctl$auto_UBI_IOCATT(r5, 0x40186f40, 0x0) 7.276559617s ago: executing program 0 (id=2650): openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) socket(0x15, 0x5, 0x0) openat$auto_mousedev_fops_mousedev(0xffffffffffffff9c, 0x0, 0x2, 0x0) unshare$auto(0x40000080) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mbind$auto(0x2000, 0x100000004, 0x100000000, 0x0, 0x5, 0x2) prctl$auto(0x43, 0x17, 0x0, 0x0, 0x0) memfd_create$auto(0x0, 0xe) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000001180)='/sys/kernel/security/tomoyo/manager\x00', 0x2, 0x0) write$auto(0x3, 0x0, 0xfdf3) pwritev$auto(0x3, &(0x7f0000001000)={0x0, 0x8}, 0x5, 0x3, 0x9) openat$auto_u32_array_fops_file(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/netdevsim/netdevsim4/ports/3/udp_ports_table1\x00', 0x200, 0x0) r0 = geteuid() keyctl$auto(0x1f, r0, r0, 0x5, 0x8) process_vm_readv$auto(0x0, 0x0, 0x4, 0x0, 0x6, 0x0) timer_create$auto(0x0, 0x0, 0x0) capget$auto(&(0x7f0000000080)={0xde}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NFSD_CMD_LISTENER_GET(0xffffffffffffffff, 0x0, 0x24000005) openat$auto_full_fops_mem(0xffffffffffffff9c, &(0x7f0000000000), 0x103700, 0x0) openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000005280), 0x0, 0x0) 7.220963734s ago: executing program 3 (id=2651): mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) r0 = socket(0x2, 0x2, 0x0) setsockopt$auto_SO_BUSY_POLL(r0, 0x5, 0x2e, &(0x7f0000000000)='/dev/sequencer\x00', 0x6) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) r1 = openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/event0\x00', 0x820000, 0x0) ioctl$auto_EVIOCGKEYCODE_V2(r1, 0x80284504, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x801, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x9, 0x8, 0x1, 0x2, 0x4, 0x15f4da0e, 0x3, 0xd08, 0xc, 0x7, 0x4, 0x6d3f, 0x9, 0x2, 0x4000000000000d]}, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x20000a, 0x4) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x8000000000000, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000000000008000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x7f, 0x0) close_range$auto(0x2, 0xa, 0x0) 6.289248797s ago: executing program 2 (id=2653): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x6, 0x8000) socket(0x11, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mq_open$auto(&(0x7f0000000000)='nlctrl\x00', 0x80, 0x8001, &(0x7f0000000040)={0x4, 0x1, 0x4c3, 0x28}) mmap$auto(0x0, 0x40006, 0xe2, 0x20009b72, 0x7, 0x28000) openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0x121980, 0x0) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3f) madvise$auto(0x3000, 0xffffffffffff0001, 0x15) 4.777938006s ago: executing program 1 (id=2654): sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000200)={{0x0, 0x6, 0x0, 0x6, 0x0, 0x7, 0xa505}, 0x800}, 0x80000000, 0x4008) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) read$auto(0xffffffffffffffff, 0x0, 0x20) openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, 0x0, 0x101901, 0x0) open(0x0, 0x7ffd, 0x12) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) r0 = io_uring_setup$auto(0x406, 0x0) mmap$auto(0x0, 0x9, 0xffb, 0x8000000008011, 0x3, 0x0) getrandom$auto(0x0, 0x6000000, 0x3) io_uring_enter$auto(0x3, 0xa84, 0x80000001, 0xa, 0x0, 0x46) io_uring_enter$auto(r0, 0x7, 0x7ffffffb, 0x3, 0x0, 0x3) move_pages$auto(0x0, 0xa, 0x0, 0x0, 0x0, 0x2) io_uring_enter$auto(0x3, 0x5, 0x5f3, 0x3, 0x0, 0x2) rename$auto(0x0, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) mmap$auto(0x0, 0x2220009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0x4) syz_genetlink_get_family_id$auto_ovs_flow(0x0, 0xffffffffffffffff) 4.777313371s ago: executing program 2 (id=2655): madvise$auto(0x0, 0xffffffffffff0005, 0x19) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/block/nbd6/range\x00', 0x100, 0x0) keyctl$auto(0x200000000000020, 0xffffffffffffffff, 0x8, 0x5, 0x8) keyctl$auto(0x11, 0xdfffffffffffffff, 0x69c9, 0x0, 0xbcd) socket(0x10, 0x2, 0xc) read$auto(r0, 0x0, 0x20) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x62, 0x0) getsockopt$auto_SO_RCVTIMEO_OLD(0xffffffffffffffff, 0x4, 0x14, &(0x7f0000000040)='\x00', 0x0) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/hwdep\x00', 0x0, 0x0) ioctl$auto_BTRFS_IOC_SNAP_CREATE(0xffffffffffffffff, 0x50009401, 0x0) madvise$auto(0x110c230000, 0x8031ca, 0x9) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/dev_mcast\x00', 0x4001, 0x0) prctl$auto_PR_GET_SHADOW_STACK_STATUS(0x4a, 0x7fffffffffffffff, 0x0, 0x2, 0x8f) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) madvise$auto(0x0, 0xfffffffffffefffd, 0x17) madvise$auto(0x108000, 0x800034, 0x9) mount$auto(0x0, 0x0, &(0x7f00000001c0)='nfsd\x00\xee\x1a\x8f\xa2~?\xe2\x82fg\xb3G\xbe\xc8\x12\xae\xc3\xc0@[\x99\xec\xbf(\xec\xc3\xb2\xf2\x15Zi\xc4S6\'\x14\x05\t\x8c\xd5?\xa0\x00\xd8\xe4\xafW\xcc\xa3\xce\tI\x95\xe12\xaclJ\xba\xeb\xe4\x83Z\xaev\xd7\xd9\xdd_\x14O\x84\xaa\x13W\xb7\x06\'fvQ\x95\xc5\xd1\x98\xe3T\xcdfk\xc7\xe9\x96\r\x91\xb0\xc46\xf2\xfc\xef\xfe\xa0\xc9d\xb3h$\xeb\xad\xa4P\x8f\xc3bM{4RQ\x00\x9d)_\xd81(\x03\xfd\rw\xca1\x88|\xe5\x1e\x10\x89X\x01\xe9\xf6g\x95xx\xaf\xa9~m\x05\xe1\xa8\xda\x80\xc5\x8f\xb41\x81\xf0\xa3\xa2\xe4\x81\xb9\x92\xda\x13\xfe5\xfb\xc6\xd8>\x01\xd4\x14', 0x5, 0x0) mremap$auto(0x0, 0x7, 0x3fd6, 0x3, 0x20000000) 4.507806175s ago: executing program 3 (id=2656): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/block/nbd12/queue/optimal_io_size\x00', 0x121281, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x5, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x2, 0x500, 0xdf, 0xeb1, 0x401, 0x4) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) nanosleep$auto(&(0x7f0000000180)={0x0, 0x44d4}, 0x0) getpid() clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x4020009, 0xdb, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) mmap$auto(0xfffffffffffffffe, 0x400, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000080), 0x80082, 0x0) ioctl$auto_PPPIOCSMRU(r0, 0xc004743e, 0x0) write$auto_ppp_device_fops_ppp_generic(r0, &(0x7f0000000200)="c021", 0x2) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd3e, 0x1, 0x948b, 0x3, 0x95f4da0a, 0x10001, 0x8, 0x62, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0x11, 0x0, 0x0, &(0x7f00000002c0)={[0x1fd, 0x7, 0xd, 0x1, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x1000, 0x62, 0x4000008000001f, 0x7, 0x6d3e, 0x5, 0x0, 0x2]}, 0x0) 4.506941031s ago: executing program 0 (id=2665): socket(0x2, 0x3, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x54) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x800, 0x0) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) setresuid$auto(0x0, 0x8, 0x0) r0 = socket(0x11, 0x3, 0x2) getsockopt$auto(r0, 0x107, 0x1, 0x0, 0x0) setuid$auto(0x0) openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, 0x0, 0x84000, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0x240007, 0x19) migrate_pages$auto(0x0, 0xa, &(0x7f0000000100)=0x5, &(0x7f0000000140)=0x2) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socket(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) move_pages$auto(0x0, 0x1002, 0x0, &(0x7f0000001140), 0x0, 0x2) r1 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000180)='/proc/interrupts\x00', 0x18b202, 0x0) pread64$auto(r1, &(0x7f0000000340)='/proc/Nes\x00'/22, 0x100000001, 0x100) 3.357895965s ago: executing program 0 (id=2657): mmap$auto(0x0, 0x20007, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, 0x0, 0x40090) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x4c, 0x0, 0x1, 0x70bd2b, 0x25dfdbf9, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x8}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macvtap0\x00'}, @L2TP_ATTR_IP6_SADDR={0x14}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$auto_OVS_VPORT_CMD_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4100}, 0x20000000) mmap$auto(0x0, 0x80000002020009, 0x3, 0x410, 0xfffffffffffffffa, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) msgctl$auto_IPC_RMID(0x4, 0x0, &(0x7f0000000240)={{0x0, 0xffffffffffffffff, 0xee00, 0x9, 0x5, 0x8, 0x8}, &(0x7f00000001c0)=0x6, 0x0, 0x1, 0xfff, 0x0, 0x7, 0x9, 0x4, 0x9, 0xf}) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x109401, 0x0) close_range$auto(0x2, 0x8, 0x0) msgrcv$auto(0xb, 0x0, 0x0, 0x6e2d, 0xfffffffb) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x2003f0, 0x15) mmap$auto(0x0, 0x2a, 0xdf, 0x9b72, 0x1000, 0x28000) syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(0xffffffffffffffff, 0x0, 0x800) r1 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) write$auto(0x3, 0x0, 0xfdef) lseek$auto(0x3, 0x2, 0x4) read$auto(r1, 0x0, 0xb4d3) 2.94053729s ago: executing program 3 (id=2659): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x6, 0x8000) socket(0x11, 0x80003, 0x300) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x1000000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mq_open$auto(&(0x7f0000000000)='nlctrl\x00', 0x80, 0x8001, &(0x7f0000000040)={0x4, 0x1, 0x4c3, 0x28}) mmap$auto(0x0, 0x40006, 0xe2, 0x20009b72, 0x7, 0x28000) openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0x121980, 0x0) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3f) madvise$auto(0x3000, 0xffffffffffff0001, 0x15) 2.91923151s ago: executing program 1 (id=2660): r0 = socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(r0, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) shmctl$auto(0xa0000000, 0x6, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) execve$auto(0x0, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/zram0/mem_limit\x00', 0x183841, 0x0) pwrite64$auto(r1, &(0x7f0000000280)='Mdev/loop-control\x00', 0x80000000, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x1, 0x9, 0x5, 0x14, 0x944, 0x1ffe0, 0x3, 0x6, 0x7, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0x2, 0x5, 0x3, 0x40, 0x7, 0x21, 0x309, 0x6, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xffffffff, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x1fe, 0x81) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r2 = socket(0x10, 0x2, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$auto_BLKTRACESETUP32(r3, 0xc0401273, 0x0) sendmmsg$auto(r2, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) r4 = openat$auto_zero_fops_mem(0xffffffffffffff9c, &(0x7f0000000000), 0x109002, 0x0) sendfile$auto(r4, r4, 0x0, 0x10000800000003) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) 2.845860175s ago: executing program 0 (id=2661): r0 = socket(0x1b, 0x3, 0x76) madvise$auto(0x0, 0x2000040080000004, 0xe) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x60742, 0x0) write$auto(r1, &(0x7f0000000040)='//\xf2\x00', 0x80000000) getsockopt$auto_SO_RCVPRIORITY(r0, 0x2, 0x52, 0x0, &(0x7f0000000240)=0x7) openat$auto_vhost_vsock_fops_vsock(0xffffffffffffff9c, 0x0, 0x121900, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) r4 = openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_clone(0x4040400, 0x0, 0x0, 0x0, 0x0, 0x0) readv$auto(0x3, &(0x7f0000000a80)={0x0, 0xffff}, 0x1) mmap$auto(0x3, 0x400008, 0x3, 0x8000000000000011, r4, 0x6) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYRESDEC=r1, @ANYBLOB="7e5a999322dcea1636da6970e84c42ec96a38586d50cf6599cd838edc2ed879dcfba767c2db982d07ac41217bcb51a278077826b443ef2458acf7304b9c384064d2975b127daebd77fcfbb8ed1f0ca84d20140a29cd720a17966780620609bb7ffb64b5548ece51a3781c2c33617e11323b9ce2d2ea935cc9fbeac3c4c72d49914619d90ee87ed117339e5489fd4b8707ca316df05880aee58670a10eeeface64c86502e1b1253e0211e", @ANYRESHEX, @ANYRES64=0x0, @ANYRES8=r3, @ANYRES8=r0], 0x1ac}}, 0x24048871) sendmsg$auto_NL802154_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[], 0xf5c}, 0x1, 0x0, 0x0, 0x4044055}, 0x20008811) recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000180)={{0x0, 0xf240, 0x0, 0x0, 0x0, 0x7, 0x50}, 0x80000}, 0x10e, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) sendmsg$auto_HWSIM_CMD_GET_RADIO(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24044845}, 0x10) bpf$auto(0x7, &(0x7f0000000280)=@bpf_attr_7={@prog_id=0xffffffff, 0x8, 0x4, r2}, 0x90) socket(0x10, 0x5, 0x4) 2.641597235s ago: executing program 2 (id=2662): socket(0x2, 0x3, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000) r1 = socket(0x11, 0xa, 0x9) bind$auto(r1, &(0x7f0000000140), 0x10) openat$auto_generic(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x15, 0x5, 0x0) move_pages$auto(r3, 0x1002, 0x0, 0x0, 0x0, 0x2) r4 = getpid() sendmsg$auto_NL80211_CMD_DEL_TX_TS(r0, &(0x7f0000001a80)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001a40)={&(0x7f0000000640)=ANY=[], 0x1cc}, 0x1, 0x0, 0x0, 0x4000004}, 0x24004000) close_range$auto(0x2, 0x8, 0x0) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) fcntl$auto(0x3, 0x804, 0xa553) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) kcmp$auto(r3, r4, 0x7, 0xffffffffffffffff, r2) 1.697021453s ago: executing program 0 (id=2663): unshare$auto(0x40000080) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sda\x00', 0x202, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) keyctl$auto(0x4, 0xffffffffffffffff, 0x5, 0x800, 0xa) keyctl$auto(0x6, 0xffffffffffffffff, 0x8, 0x803, 0x4) ioctl$auto_IOC_PR_RELEASE(r1, 0x401070ca, 0x0) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) socket(0x29, 0x5, 0x0) bind$auto(0x3, &(0x7f0000000040)=@can, 0x6a) sendmmsg$auto(0x3, 0x0, 0x3, 0x0) io_uring_setup$auto(0xa, 0x0) mmap$auto(0x0, 0x80000400008, 0xdf, 0x13, 0xffffffffffffffff, 0x48ff) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3ec0) sendmmsg$auto(0x3, 0x0, 0x9a5, 0x101) r2 = syz_genetlink_get_family_id$auto_macsec(&(0x7f0000001900), 0xffffffffffffffff) sendmsg$auto_MACSEC_CMD_GET_TXSC(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001940)={0x14, r2, 0x186f202170196f7b, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x200008d0}, 0x40080c4) 1.334284991s ago: executing program 3 (id=2664): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x6, 0x8000) socket(0x11, 0x80003, 0x300) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) mq_open$auto(&(0x7f0000000000)='nlctrl\x00', 0x80, 0x8001, &(0x7f0000000040)={0x4, 0x1, 0x4c3, 0x28}) mmap$auto(0x0, 0x40006, 0xe2, 0x20009b72, 0x7, 0x28000) openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0x121980, 0x0) setsockopt$auto_SO_OOBINLINE(0xffffffffffffffff, 0x3, 0xa, &(0x7f0000000080)='nlctrl\x00', 0x2) close_range$auto(0x2, 0xa, 0x0) socket(0x18, 0xa, 0x1) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "ab06fdffff00fff500"}, 0x55) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mtrr\x00', 0xc0000, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x3f) madvise$auto(0x3000, 0xffffffffffff0001, 0x15) 1.155120221s ago: executing program 1 (id=2666): ioctl$auto_X86_IOC_WRMSR_REGS(0xffffffffffffffff, 0xc02063a1, 0x0) unshare$auto(0x40000080) syz_genetlink_get_family_id$auto_tipcv2(0x0, 0xffffffffffffffff) openat$auto_proc_uid_map_operations_base(0xffffffffffffff9c, 0x0, 0x20000, 0x0) syz_genetlink_get_family_id$auto_ovs_flow(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(r0, 0x0, 0x800) openat$auto_snd_mixer_oss_f_ops_mixer_oss(0xffffffffffffff9c, 0x0, 0x40000, 0x0) socket(0x2, 0x1, 0x0) openat$auto_bch_chardev_fops_chardev(0xffffffffffffff9c, 0x0, 0x101800, 0x0) memfd_create$auto(0x0, 0x4) mmap$auto(0x0, 0x8, 0x1000000016, 0x13, 0x3, 0x400180000000) ftruncate$auto(0x3, 0x400180200000) syslog$auto(0x3, 0x0, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000002480), 0xffffffffffffffff) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x101000, 0x0) preadv$auto(0x40000000000003, 0x0, 0x6, 0x5ff4, 0x1) sendmsg$auto_TIPC_NL_MON_GET(r1, &(0x7f00000083c0)={0x0, 0x0, &(0x7f0000008380)={&(0x7f0000003680)={0x14, r2, 0x32f, 0x70bd2a, 0x25dfdbff, {0x12, 0x0, 0xf0}}, 0x14}, 0x1, 0x0, 0x0, 0x4801}, 0x8080) r3 = openat$auto_msr_fops_msr(0xffffffffffffff9c, 0x0, 0xf82, 0x0) writev$auto(r3, 0x0, 0x3) 654.831293ms ago: executing program 1 (id=2667): openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0xd97f760c479e8c8e, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14f602, 0x0) mmap$auto(0x3, 0x660b, 0xa6e, 0x40eb4, 0xd, 0x4) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x10, 0x2, 0x19523306) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) read$auto(r0, 0x0, 0x9) r1 = openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000001e80)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x180400, 0x0) read$auto_ftrace_subsystem_filter_fops_trace_events(r1, 0x0, 0x0) r2 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) writev$auto(r2, &(0x7f00000000c0)={0x0, 0x7}, 0x2) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x40, 0x0) socket(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) clone$auto(0x5cedff2d, 0xf, &(0x7f0000000040)=0x6, &(0x7f0000000100)=0x9, 0xb5f) socket(0x2c, 0x3, 0x40000) getsockopt$auto(0x6, 0x11b, 0x1d05, 0xfffffffffffffffd, 0x0) socket(0x11, 0xa, 0x300) pwrite64$auto(0xc8, &(0x7f0000000340)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdds\x1cJ\x99\x00:+\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\xadCl\x9e\xeb\xcd\vp\x99\x00\xc8\x06\xa5\xdc3\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0A\x94\xa3\xaef\x87\xd8\x95I\xfd\xa8\t\xac\x87\xb7\x1d\xd5\x83\xdcyu]\xde\xbe\xbf$<.}\x8b`\x04\xfc\xa2\xab\xb5]\x80\x00\xb9D\xc5\xbc\xf2a\xd66\xa5\xd3\xc1r\x96\x1e\x8db\x05=`\x01\x11\x04Tz\x87A$\x115\x95PUf\xa7\xfe\x19\x00\x82go}@W\xd5\xaej\x01\xbf>5n\x17S\xc0\x8a\xaf%O\xd1W\xa3ua+sUJ\xea\xf9\xb7p-\x128\x9d\xbaM_\xff\x1c\xc3sG\x04\xf2\xd3\xf3{;\xd4\xd7\x1c\x1dZ\xe9\xe9\xc9\x9cu5\xe9\xa2\xb3N\xd2\xc1\xc8\xa5\xadt\xd5BKD\x86\xeb%\a*\x06\xbb\x1e\xfb\x11U\f&\xcbP\xf1\xcf\xccb\xe8Wb\xc5ae\xe3\xf9l\xa9vK\xed\x8cL\xfb%g\x83;\xe1\xe2w\xd6\xaa6\x16\x8fx\x1a\xd7\xc8\xf4[\xbc\b\xe1Z\x92\x14Q\xde 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 400.952035][T10292] RSP: 002b:00007f08e9bdb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 400.952061][T10292] RAX: ffffffffffffffda RBX: 00007f08e8fb6080 RCX: 00007f08e8d8e9a9 [ 400.952081][T10292] RDX: 0000200000000340 RSI: 0000000000000001 RDI: 0000000000000001 [ 400.952098][T10292] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 400.952116][T10292] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000000 [ 400.952132][T10292] R13: 0000000000000000 R14: 00007f08e8fb6080 R15: 00007ffd526733c8 [ 400.952168][T10292] [ 401.187561][T10292] Mem-Info: [ 401.191004][T10292] active_anon:11244 inactive_anon:32352 isolated_anon:0 [ 401.191004][T10292] active_file:18818 inactive_file:40972 isolated_file:0 [ 401.191004][T10292] unevictable:768 dirty:1667 writeback:0 [ 401.191004][T10292] slab_reclaimable:10740 slab_unreclaimable:93761 [ 401.191004][T10292] mapped:44109 shmem:33018 pagetables:1310 [ 401.191004][T10292] sec_pagetables:0 bounce:0 [ 401.191004][T10292] kernel_misc_reclaimable:0 [ 401.191004][T10292] free:1279941 free_pcp:17858 free_cma:0 [ 401.237423][T10292] Node 0 active_anon:44976kB inactive_anon:131608kB active_file:75268kB inactive_file:163692kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:176436kB dirty:6668kB writeback:0kB shmem:132736kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11404kB pagetables:5136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 401.271653][T10292] Node 1 active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:104kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 401.303246][T10292] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 401.332528][T10292] lowmem_reserve[]: 0 2480 2482 2482 2482 [ 401.338604][T10292] Node 0 DMA32 free:1223120kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44928kB inactive_anon:137408kB active_file:74284kB inactive_file:163352kB unevictable:1536kB writepending:6668kB present:3129332kB managed:2540456kB mlocked:0kB bounce:0kB free_pcp:28156kB local_pcp:10844kB free_cma:0kB [ 401.371601][T10292] lowmem_reserve[]: 0 0 1 1 1 [ 401.376391][T10292] Node 0 Normal free:16kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:984kB inactive_file:340kB unevictable:0kB writepending:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 401.405557][T10292] lowmem_reserve[]: 0 0 0 0 0 [ 401.410404][T10292] Node 1 Normal free:3881268kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:4kB inactive_file:196kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:35304kB local_pcp:26028kB free_cma:0kB [ 401.460245][T10292] lowmem_reserve[]: 0 0 0 0 0 [ 401.472998][T10292] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 401.559733][T10292] Node 0 DMA32: 2542*4kB (UME) 1263*8kB (UM) 570*16kB (UME) 761*32kB (UME) 225*64kB (UME) 220*128kB (UME) 307*256kB (UME) 153*512kB (UME) 61*1024kB (UME) 9*2048kB (UME) 216*4096kB (UM) = 1218864kB [ 401.634719][T10292] Node 0 Normal: 0*4kB 0*8kB 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 16kB [ 401.746854][T10292] Node 1 Normal: 10*4kB (UME) 8*8kB (UME) 10*16kB (UME) 11*32kB (UME) 64*64kB (UME) 16*128kB (UME) 5*256kB (UME) 5*512kB (UME) 2*1024kB (ME) 1*2048kB (E) 944*4096kB (UM) = 3881320kB [ 401.869518][T10292] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 401.914811][T10292] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 401.968823][T10292] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 402.019294][T10292] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 402.049302][T10292] 97421 total pagecache pages [ 402.090424][T10292] 2 pages in swap cache [ 402.094714][T10292] Free swap = 124988kB [ 402.139652][T10292] Total swap = 124996kB [ 402.144026][T10292] 2097051 pages RAM [ 402.148049][T10292] 0 pages HighMem/MovableOnly [ 402.168438][T10292] 429959 pages reserved [ 402.179972][T10292] 0 pages cma reserved [ 402.463699][T10304] block nbd0: Unsupported socket: shutdown callout must be supported. [ 402.734863][T10306] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 402.781152][T10306] CIFS mount error: No usable UNC path provided in device string! [ 402.781152][T10306] [ 402.794062][T10306] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 405.513669][T10336] netlink: 25 bytes leftover after parsing attributes in process `syz.1.1288'. [ 405.568056][T10335] ima: policy update failed [ 405.601622][ T30] audit: type=1802 audit(1753240825.505:26): pid=10335 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.1288" res=0 errno=0 [ 407.812191][T10382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1305'. [ 407.824795][T10382] netlink: 25 bytes leftover after parsing attributes in process `syz.2.1305'. [ 412.418595][T10432] warning: `syz.0.1317' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 413.011572][ T30] audit: type=1800 audit(1753240832.905:27): pid=10441 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1321" name="members" dev="configfs" ino=28027 res=0 errno=0 [ 415.187995][T10466] netlink: 25 bytes leftover after parsing attributes in process `syz.0.1331'. [ 415.325344][T10464] netlink: 354 bytes leftover after parsing attributes in process `syz.3.1330'. [ 417.709725][T10493] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1345'. [ 420.290911][T10545] netlink: 'syz.1.1348': attribute type 4 has an invalid length. [ 420.298954][T10545] netlink: 314 bytes leftover after parsing attributes in process `syz.1.1348'. [ 421.997940][T10569] netlink: 25 bytes leftover after parsing attributes in process `syz.1.1356'. [ 422.035499][T10563] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 422.059863][T10563] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 422.124863][T10563] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 422.144619][T10563] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 422.207101][T10563] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 422.254961][T10563] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 422.275234][T10563] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 422.289513][ T5846] Bluetooth: hci3: unexpected event 0x1d length: 6 > 5 [ 422.362964][T10563] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 422.386591][T10563] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 423.103731][T10592] lo: entered allmulticast mode [ 423.180561][T10593] lo: left allmulticast mode [ 423.379707][ T5846] Bluetooth: hci0: command 0x0406 tx timeout [ 423.513909][T10602] random: crng reseeded on system resumption [ 423.544557][T10600] netlink: set zone limit has 8 unknown bytes [ 424.027097][T10615] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1370'. [ 424.192316][ T5846] Bluetooth: hci1: command 0x0406 tx timeout [ 424.259752][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 424.439739][ T5846] Bluetooth: hci3: command 0x0406 tx timeout [ 425.459660][ T5846] Bluetooth: hci0: command 0x0406 tx timeout [ 426.288018][ T5846] Bluetooth: hci1: command 0x0406 tx timeout [ 426.350056][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 426.509633][ T5846] Bluetooth: hci3: command 0x0406 tx timeout [ 428.342688][ T5846] Bluetooth: hci1: command 0x0406 tx timeout [ 429.920346][T10705] openvswitch: netlink: nsh attribute has 14 unknown bytes. [ 431.253560][T10736] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1400'. [ 431.294372][T10736] hsr_slave_0: left promiscuous mode [ 431.317669][T10736] hsr_slave_1: left promiscuous mode [ 432.191791][T10749] zswap: compressor not available [ 433.587488][T10771] FAULT_INJECTION: forcing a failure. [ 433.587488][T10771] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 433.629259][T10771] CPU: 1 UID: 0 PID: 10771 Comm: syz.3.1407 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 433.629294][T10771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 433.629309][T10771] Call Trace: [ 433.629317][T10771] [ 433.629326][T10771] dump_stack_lvl+0x16c/0x1f0 [ 433.629355][T10771] should_fail_ex+0x512/0x640 [ 433.629385][T10771] should_fail_alloc_page+0xe7/0x130 [ 433.629417][T10771] prepare_alloc_pages+0x3c2/0x610 [ 433.629457][T10771] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 433.629487][T10771] ? __lock_acquire+0xb8a/0x1c90 [ 433.629536][T10771] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 433.629569][T10771] ? __mutex_trylock_common+0xe9/0x250 [ 433.629614][T10771] ? __pfx___mutex_trylock_common+0x10/0x10 [ 433.629651][T10771] ? __pfx___might_resched+0x10/0x10 [ 433.629682][T10771] ? trace_contention_end+0xdd/0x130 [ 433.629718][T10771] ? __mutex_lock+0x1ca/0xb90 [ 433.629744][T10771] ? misc_open+0x63/0x420 [ 433.629783][T10771] ? __pfx___mutex_lock+0x10/0x10 [ 433.629811][T10771] __alloc_pages_noprof+0xb/0x1b0 [ 433.629835][T10771] ___kmalloc_large_node+0x84/0x1e0 [ 433.629882][T10771] __kmalloc_large_noprof+0x1c/0x70 [ 433.629918][T10771] uhid_char_open+0x24/0x250 [ 433.629950][T10771] ? __pfx_uhid_char_open+0x10/0x10 [ 433.629982][T10771] misc_open+0x35a/0x420 [ 433.630020][T10771] ? __pfx_misc_open+0x10/0x10 [ 433.630056][T10771] chrdev_open+0x231/0x6a0 [ 433.630082][T10771] ? __pfx_apparmor_file_open+0x10/0x10 [ 433.630127][T10771] ? __pfx_chrdev_open+0x10/0x10 [ 433.630156][T10771] ? file_set_fsnotify_mode_from_watchers+0x163/0x640 [ 433.630201][T10771] do_dentry_open+0x744/0x1c10 [ 433.630227][T10771] ? __pfx_chrdev_open+0x10/0x10 [ 433.630259][T10771] vfs_open+0x82/0x3f0 [ 433.630295][T10771] path_openat+0x1de4/0x2cb0 [ 433.630327][T10771] ? __pfx_path_openat+0x10/0x10 [ 433.630353][T10771] ? __lock_acquire+0xb8a/0x1c90 [ 433.630390][T10771] do_filp_open+0x20b/0x470 [ 433.630419][T10771] ? __pfx_do_filp_open+0x10/0x10 [ 433.630463][T10771] ? alloc_fd+0x471/0x7d0 [ 433.630511][T10771] do_sys_openat2+0x11b/0x1d0 [ 433.630543][T10771] ? __pfx_do_sys_openat2+0x10/0x10 [ 433.630588][T10771] __x64_sys_openat+0x174/0x210 [ 433.630623][T10771] ? __pfx___x64_sys_openat+0x10/0x10 [ 433.630669][T10771] do_syscall_64+0xcd/0x490 [ 433.630696][T10771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.630721][T10771] RIP: 0033:0x7f08e8d8e9a9 [ 433.630739][T10771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 433.630764][T10771] RSP: 002b:00007f08e9bdb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 433.630786][T10771] RAX: ffffffffffffffda RBX: 00007f08e8fb6080 RCX: 00007f08e8d8e9a9 [ 433.630803][T10771] RDX: 0000000000000000 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 433.630818][T10771] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 433.630833][T10771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 433.630854][T10771] R13: 0000000000000000 R14: 00007f08e8fb6080 R15: 00007ffd526733c8 [ 433.630884][T10771]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  [ 472.122685][T11344] Unrecognized hibernate image header format! [ 472.203838][T11344] PM: hibernation: Image mismatch: architecture specific data [ 472.568325][T11349] [U] [ 472.571216][T11349] [U] [ 472.573972][T11349] [U] [ 472.576729][T11349] [U] [ 472.590193][T11349] [U] [ 472.592994][T11349] [U] [ 472.595740][T11349] [U] [ 472.598480][T11349] [U] [ 472.640110][T11349] [U] [ 472.642912][T11349] [U] [ 472.645666][T11349] [U] [ 472.648416][T11349] [U] [ 472.656596][T11349] [U] [ 472.659398][T11349] [U] [ 472.662180][T11349] [U] [ 472.664953][T11349] [U] [ 472.667945][T11349] [U] [ 472.670700][T11349] [U] [ 472.673463][T11349] [U] [ 472.676189][T11349] [U] [ 472.698666][T11349] [U] [ 472.701443][T11349] [U] [ 472.704202][T11349] [U] [ 472.706978][T11349] [U] [ 472.739708][T11349] [U] [ 472.742473][T11349] [U] [ 472.745226][T11349] [U] [ 472.747965][T11349] [U] [ 472.779709][T11349] [U] [ 472.782537][T11349] [U] [ 472.785354][T11349] [U] [ 472.788136][T11349] [U] [ 472.799833][T11349] [U] [ 472.802599][T11349] [U] [ 472.805452][T11349] [U] [ 472.808202][T11349] [U] [ 472.829888][T11349] [U] [ 472.832659][T11349] [U] [ 472.835415][T11349] [U] [ 472.838157][T11349] [U] [ 472.849683][T11349] [U] [ 472.852487][T11349] [U] [ 472.855243][T11349] [U] [ 472.857986][T11349] [U] [ 472.879747][T11349] [U] [ 472.882539][T11349] [U] [ 472.885302][T11349] [U] [ 472.888075][T11349] [U] [ 472.900150][T11349] [U] [ 472.902911][T11349] [U] [ 472.905844][T11349] [U] [ 472.908608][T11349] [U] [ 472.929746][T11349] [U] [ 472.932522][T11349] [U] [ 472.935278][T11349] [U] [ 472.938038][T11349] [U] [ 472.963576][T11349] [U] [ 472.966374][T11349] [U] [ 472.969131][T11349] [U] [ 472.971924][T11349] [U] [ 472.995285][T11349] [U] [ 472.998084][T11349] [U] [ 473.000844][T11349] [U] [ 473.003591][T11349] [U] [ 473.024366][T11349] [U] [ 473.027133][T11349] [U] [ 473.029865][T11349] [U] [ 473.032607][T11349] [U] [ 473.069737][T11349] [U] [ 473.072538][T11349] [U] [ 473.075299][T11349] [U] [ 473.078065][T11349] [U] [ 473.132632][T11349] [U] [ 473.135450][T11349] [U] [ 473.138205][T11349] [U] [ 473.140975][T11349] [U] [ 473.191291][T11349] [U] syzkaller syzkaller login: [ 473.594948][T11367] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1556'. [ 473.642427][T11358] zswap: compressor 000 not available [ 475.567806][T11374] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 476.562697][ T30] audit: type=1804 audit(6048208192.462:29): pid=11396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1562" name="/newroot/373/file0" dev="tmpfs" ino=1984 res=1 errno=0 [ 476.607128][T11409] ERROR: Out of memory at tomoyo_memory_ok. [ 477.878399][T11433] FAULT_INJECTION: forcing a failure. [ 477.878399][T11433] name failslab, interval 1, probability 0, space 0, times 0 [ 477.893285][T11421] program syz.1.1570 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 477.919774][T11433] CPU: 0 UID: 0 PID: 11433 Comm: syz.3.1573 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 477.919810][T11433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 477.919829][T11433] Call Trace: [ 477.919836][T11433] [ 477.919844][T11433] dump_stack_lvl+0x16c/0x1f0 [ 477.919869][T11433] should_fail_ex+0x512/0x640 [ 477.919889][T11433] ? __kmalloc_noprof+0xbf/0x510 [ 477.919917][T11433] ? xfrm_hash_alloc+0xd1/0x100 [ 477.919958][T11433] should_failslab+0xc2/0x120 [ 477.919989][T11433] __kmalloc_noprof+0xd2/0x510 [ 477.920014][T11433] ? xfrm_nat_keepalive_net_init+0x101/0x140 [ 477.920039][T11433] ? __pfx_xfrm_net_init+0x10/0x10 [ 477.920057][T11433] xfrm_hash_alloc+0xd1/0x100 [ 477.920087][T11433] xfrm_state_init+0xdd/0x630 [ 477.920121][T11433] ? __pfx_xfrm_net_init+0x10/0x10 [ 477.920139][T11433] xfrm_net_init+0x210/0xcc0 [ 477.920162][T11433] ? __pfx_xfrm_net_init+0x10/0x10 [ 477.920180][T11433] ops_init+0x1df/0x5f0 [ 477.920206][T11433] setup_net+0x1ff/0x510 [ 477.920228][T11433] ? lockdep_init_map_type+0x5c/0x280 [ 477.920259][T11433] ? __pfx_setup_net+0x10/0x10 [ 477.920284][T11433] ? debug_mutex_init+0x37/0x70 [ 477.920308][T11433] copy_net_ns+0x2a6/0x5f0 [ 477.920336][T11433] create_new_namespaces+0x3ea/0xa90 [ 477.920366][T11433] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 477.920401][T11433] ksys_unshare+0x45b/0xa40 [ 477.920431][T11433] ? __pfx_ksys_unshare+0x10/0x10 [ 477.920460][T11433] ? xfd_validate_state+0x61/0x180 [ 477.920496][T11433] __x64_sys_unshare+0x31/0x40 [ 477.920525][T11433] do_syscall_64+0xcd/0x490 [ 477.920549][T11433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.920570][T11433] RIP: 0033:0x7f08e8d8e9a9 [ 477.920588][T11433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 477.920609][T11433] RSP: 002b:00007f08e9bfc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 477.920628][T11433] RAX: ffffffffffffffda RBX: 00007f08e8fb5fa0 RCX: 00007f08e8d8e9a9 [ 477.920641][T11433] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 477.920654][T11433] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 477.920666][T11433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 477.920679][T11433] R13: 0000000000000000 R14: 00007f08e8fb5fa0 R15: 00007ffd526733c8 [ 477.920704][T11433] [ 478.768863][T11450] ERROR: Out of memory at tomoyo_memory_ok. [ 479.091961][ T30] audit: type=1804 audit(6048208194.992:30): pid=11451 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1578" name="/newroot/397/file0" dev="tmpfs" ino=2096 res=1 errno=0 [ 480.242241][T11464] Malformed UNC in devname [ 480.242241][T11464] [ 480.284796][T11464] CIFS: VFS: Malformed UNC in devname [ 481.084122][T11487] ip6_vti0: entered allmulticast mode [ 481.682147][T11502] ERROR: Out of memory at tomoyo_memory_ok. [ 482.219851][T11480] kexec: Could not allocate control_code_buffer [ 482.963599][T11527] netlink: 330 bytes leftover after parsing attributes in process `syz.3.1596'. [ 483.317282][T11527] : renamed from hsr0 (while UP) [ 483.706400][ T5856] Bluetooth: hci2: unexpected event 0x3e length: 726 > 260 [ 483.706443][ T5856] Bluetooth: hci2: unexpected subevent 0x0e length: 725 > 15 [ 483.723006][ T5856] Bluetooth: hci2: Unable to find connection for dst 00:a2:f2:94:be:c8 sid 0x4f [ 485.117168][T11555] input: jJǸ-9%vlQ J86 as /devices/virtual/input/input13 [ 485.294009][T11555] program syz.3.1601 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 487.431457][ T5856] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 496.860710][T11695] HfR: entered promiscuous mode [ 496.862963][T11697] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1637'. [ 496.925315][T11697] HfR: left promiscuous mode [ 497.078430][T11695] HfR: entered promiscuous mode [ 498.545894][T11719] device-mapper: ioctl: Unable to rename non-existent device, to uuid [ 499.504328][T11733] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1648'. [ 499.532742][T11733] netlink: 25 bytes leftover after parsing attributes in process `syz.1.1648'. [ 501.224258][T11769] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1656'. [ 501.563093][T11770] svc: failed to register nfsdv3 RPC service (errno 111). [ 501.589053][T11770] svc: failed to register nfsaclv3 RPC service (errno 111). [ 503.839870][T11814] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1670'. [ 503.985474][T11814] svc: failed to register nfsdv3 RPC service (errno 111). [ 504.078948][T11814] svc: failed to register nfsaclv3 RPC service (errno 111). [ 506.672683][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.679179][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 508.296791][ T5856] Bluetooth: hci0: unexpected event 0x04 length: 62 > 10 [ 508.297151][ T5856] Bluetooth: hci0: connection err: -111 [ 508.331716][T11864] netlink: 206 bytes leftover after parsing attributes in process `syz.2.1681'. [ 508.610859][T11869] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1682'. [ 511.150584][T11905] netlink: 25 bytes leftover after parsing attributes in process `syz.0.1695'. [ 511.856334][ T5856] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 514.209222][T11957] Invalid ELF header magic: != ELF [ 516.693091][T11989] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1714'. [ 517.644614][T11988] ALSA: mixer_oss: invalid OSS volume '' [ 518.278786][T12021] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input14 [ 518.578035][ T5202] ERROR: Out of memory at tomoyo_memory_ok. [ 520.206434][T12021] ovs_: entered promiscuous mode [ 520.855852][T12040] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1724'. [ 521.460624][T12055] kafs: addr_prefs: Invalid Command [ 522.640447][T12063] netlink: 'syz.2.1731': attribute type 1 has an invalid length. [ 523.141462][T12080] could not allocate digest TFM handle [ 523.177714][T12080] netlink: 338 bytes leftover after parsing attributes in process `syz.0.1737'. [ 523.339813][T12080] veth1_macvtap: entered promiscuous mode [ 523.389401][T12080] veth1_macvtap: entered allmulticast mode [ 537.780483][T12240] ovs_: entered promiscuous mode [ 538.314284][T12263] can0: slcan on ptm0. [ 538.483643][T12273] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 538.511581][T12262] can0 (unregistered): slcan off ptm0. [ 538.714137][T12279] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 538.791768][T12281] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 539.109391][T12285] mkiss: ax0: crc mode is auto. [ 540.220807][T12297] tipc: Started in network mode [ 540.225987][T12297] tipc: Node identity ee00, cluster identity 4711 [ 540.232916][T12297] tipc: Node number set to 60928 [ 540.294668][T12296] Process accounting resumed [ 540.856517][T12289] kexec: Could not allocate control_code_buffer [ 541.688499][T12323] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1803'. [ 541.751558][T12323] netlink: 354 bytes leftover after parsing attributes in process `syz.0.1803'. [ 542.595725][T12328] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1804'. [ 543.557722][ T59] EXT4-fs error (device sda1): ext4_validate_block_bitmap:423: comm kworker/u8:4: bg 2: bad block bitmap checksum [ 543.579795][ T59] EXT4-fs (sda1): Delayed block allocation failed for inode 2026 at logical offset 3 with max blocks 2 with error 74 [ 543.609756][ T59] EXT4-fs (sda1): This should not happen!! Data will be lost [ 543.609756][ T59] [ 543.640617][ T59] EXT4-fs error (device sda1): ext4_validate_block_bitmap:423: comm kworker/u8:4: bg 1: bad block bitmap checksum [ 543.670088][ T59] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 984 with max blocks 11 with error 74 [ 543.699750][ T59] EXT4-fs (sda1): This should not happen!! Data will be lost [ 543.699750][ T59] [ 543.929811][T12358] netlink: 25 bytes leftover after parsing attributes in process `syz.1.1812'. [ 545.713124][T12383] netlink: 186 bytes leftover after parsing attributes in process `syz.2.1819'. [ 547.262868][T12412] netlink: 326 bytes leftover after parsing attributes in process `syz.2.1825'. [ 547.377497][T12406] FAULT_INJECTION: forcing a failure. [ 547.377497][T12406] name failslab, interval 1, probability 0, space 0, times 0 [ 547.390975][T12406] CPU: 1 UID: 0 PID: 12406 Comm: syz.3.1824 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 547.391014][T12406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 547.391033][T12406] Call Trace: [ 547.391042][T12406] [ 547.391053][T12406] dump_stack_lvl+0x16c/0x1f0 [ 547.391089][T12406] should_fail_ex+0x512/0x640 [ 547.391121][T12406] ? __kmalloc_noprof+0xbf/0x510 [ 547.391155][T12406] ? do_handle_open+0x585/0xb70 [ 547.391196][T12406] should_failslab+0xc2/0x120 [ 547.391230][T12406] __kmalloc_noprof+0xd2/0x510 [ 547.391270][T12406] do_handle_open+0x585/0xb70 [ 547.391314][T12406] ? __pfx_do_handle_open+0x10/0x10 [ 547.391361][T12406] ? __x64_sys_futex+0x1e0/0x4c0 [ 547.391409][T12406] ? xfd_validate_state+0x61/0x180 [ 547.391459][T12406] ? do_syscall_64+0xcd/0x490 [ 547.391488][T12406] do_syscall_64+0xcd/0x490 [ 547.391520][T12406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.391550][T12406] RIP: 0033:0x7f08e8d8e9a9 [ 547.391572][T12406] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 547.391600][T12406] RSP: 002b:00007f08e9bfc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 547.391627][T12406] RAX: ffffffffffffffda RBX: 00007f08e8fb5fa0 RCX: 00007f08e8d8e9a9 [ 547.391646][T12406] RDX: 0000000000000042 RSI: 0000200000000140 RDI: 0000000000000007 [ 547.391664][T12406] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 547.391681][T12406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 547.391698][T12406] R13: 0000000000000000 R14: 00007f08e8fb5fa0 R15: 00007ffd526733c8 [ 547.391733][T12406] [ 547.863088][T12420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1835'. [ 549.848963][T12427] kexec: Could not allocate control_code_buffer [ 553.474442][T12479] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 561.365193][T12617] __vm_enough_memory: pid: 12617, comm: syz.3.1872, bytes: 4398046511104 not enough memory for the allocation [ 561.889418][T12624] FAULT_INJECTION: forcing a failure. [ 561.889418][T12624] name failslab, interval 1, probability 0, space 0, times 0 [ 561.910998][T12624] CPU: 1 UID: 0 PID: 12624 Comm: syz.3.1878 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 561.911039][T12624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 561.911056][T12624] Call Trace: [ 561.911065][T12624] [ 561.911077][T12624] dump_stack_lvl+0x16c/0x1f0 [ 561.911120][T12624] should_fail_ex+0x512/0x640 [ 561.911169][T12624] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 561.911227][T12624] should_failslab+0xc2/0x120 [ 561.911265][T12624] __kmalloc_cache_noprof+0x6a/0x3e0 [ 561.911314][T12624] ? alloc_ucounts+0x13d/0x440 [ 561.911359][T12624] alloc_ucounts+0x13d/0x440 [ 561.911400][T12624] ? __pfx_alloc_ucounts+0x10/0x10 [ 561.911480][T12624] set_cred_ucounts+0xcd/0x200 [ 561.911533][T12624] __sys_setresuid+0x67c/0x1160 [ 561.911578][T12624] do_syscall_64+0xcd/0x490 [ 561.911615][T12624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.911654][T12624] RIP: 0033:0x7f08e8d8e9a9 [ 561.911680][T12624] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 561.911714][T12624] RSP: 002b:00007f08e9bfc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000075 [ 561.911744][T12624] RAX: ffffffffffffffda RBX: 00007f08e8fb5fa0 RCX: 00007f08e8d8e9a9 [ 561.911764][T12624] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000008 [ 561.911782][T12624] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 561.911806][T12624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 561.911826][T12624] R13: 0000000000000000 R14: 00007f08e8fb5fa0 R15: 00007ffd526733c8 [ 561.911872][T12624] [ 562.161825][T12628] tc_dump_action: action bad kind [ 563.961731][T12663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1886'. [ 564.431215][T12669] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1889'. [ 564.453787][T12669] netlink: 354 bytes leftover after parsing attributes in process `syz.1.1889'. [ 565.815114][T12667] kexec: Could not allocate control_code_buffer [ 566.037097][T12658] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 568.103699][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.119577][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.449855][T12701] ERROR: Out of memory at tomoyo_memory_ok. [ 571.349043][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 571.406378][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 571.493353][T12670] Process accounting paused [ 571.552768][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 571.559126][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 571.577342][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 571.621940][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 571.632579][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 571.638951][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 575.092534][T12769] netlink: 'syz.2.1910': attribute type 8 has an invalid length. [ 575.196683][T12769] netlink: 'syz.2.1910': attribute type 8 has an invalid length. [ 575.271095][T12778] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1915'. [ 575.286849][T12778] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.418394][T12778] bridge_slave_1 (unregistering): left allmulticast mode [ 575.429749][T12778] bridge_slave_1 (unregistering): left promiscuous mode [ 575.438156][T12778] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.470613][T12802] __vm_enough_memory: pid: 12802, comm: syz.1.1919, bytes: 4398046511104 not enough memory for the allocation [ 576.530819][T12797] ERROR: Out of memory at tomoyo_memory_ok. [ 578.020369][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 578.028386][ T5931] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 578.658614][T12825] Invalid ELF header magic: != ELF [ 578.848584][T12822] zswap: compressor not available [ 579.350260][T12838] netlink: 'syz.1.1929': attribute type 8 has an invalid length. [ 579.436777][T12836] netlink: 'syz.1.1929': attribute type 8 has an invalid length. [ 580.104064][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 580.121096][ T5931] Bluetooth: hci2: Opcode 0x0406 failed: -110 [ 580.149777][T12849] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input15 [ 581.011643][T12854] __vm_enough_memory: pid: 12854, comm: syz.3.1933, bytes: 4398046511104 not enough memory for the allocation [ 582.099708][T12865] ICMPv6: process `syz.3.1936' is using deprecated sysctl (syscall) net.ipv6.neigh.ipvlan1.retrans_time - use net.ipv6.neigh.ipvlan1.retrans_time_ms instead [ 582.694472][T12869] EXT4-fs (sda1): Delayed block allocation failed for inode 2027 at logical offset 1388 with max blocks 15 with error 117 [ 582.789876][T12869] EXT4-fs (sda1): This should not happen!! Data will be lost [ 582.789876][T12869] [ 586.193048][T12902] __vm_enough_memory: pid: 12902, comm: syz.2.1945, bytes: 4398046511104 not enough memory for the allocation [ 586.202958][T12905] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input16 [ 586.230528][ T5202] ERROR: Out of memory at tomoyo_memory_ok. [ 586.471640][T12912] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1946'. [ 586.581293][T12906] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input17 [ 586.672735][T12914] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1947'. [ 586.763169][T12914] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.955139][T12914] bridge_slave_1 (unregistering): left allmulticast mode [ 587.008241][T12914] bridge_slave_1 (unregistering): left promiscuous mode [ 587.062054][T12914] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.035388][T12941] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 589.089209][T12942] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 589.160994][T12943] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 589.480679][T12947] FAULT_INJECTION: forcing a failure. [ 589.480679][T12947] name failslab, interval 1, probability 0, space 0, times 0 [ 589.496831][T12947] CPU: 1 UID: 0 PID: 12947 Comm: syz.3.1956 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 589.496865][T12947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 589.496880][T12947] Call Trace: [ 589.496887][T12947] [ 589.496896][T12947] dump_stack_lvl+0x16c/0x1f0 [ 589.496925][T12947] should_fail_ex+0x512/0x640 [ 589.496953][T12947] should_failslab+0xc2/0x120 [ 589.496982][T12947] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 589.497008][T12947] ? xas_split_alloc+0x11c/0x490 [ 589.497037][T12947] xas_split_alloc+0x11c/0x490 [ 589.497069][T12947] __folio_split+0xca8/0x48d0 [ 589.497117][T12947] ? find_held_lock+0x2b/0x80 [ 589.497142][T12947] ? shmem_writeout+0x59f/0x13b0 [ 589.497184][T12947] ? __pfx___folio_split+0x10/0x10 [ 589.497217][T12947] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 589.497252][T12947] ? folio_alloc_swap+0x96b/0xca0 [ 589.497282][T12947] split_folio_to_list+0x9b/0x180 [ 589.497330][T12947] shmem_writeout+0x608/0x13b0 [ 589.497368][T12947] ? __pfx_shmem_writeout+0x10/0x10 [ 589.497425][T12947] ? inode_to_bdi+0x9e/0x160 [ 589.497450][T12947] ? folio_clear_dirty_for_io+0x112/0x810 [ 589.497486][T12947] ? __pfx_shmem_writeout+0x10/0x10 [ 589.497538][T12947] pageout+0x38c/0xa50 [ 589.497570][T12947] ? __pfx_pageout+0x10/0x10 [ 589.497632][T12947] ? __pfx_try_to_unmap_one+0x10/0x10 [ 589.497666][T12947] ? __pfx_folio_not_mapped+0x10/0x10 [ 589.497697][T12947] ? __pfx_folio_lock_anon_vma_read+0x10/0x10 [ 589.497726][T12947] shrink_folio_list+0x2f4d/0x3fc0 [ 589.497769][T12947] ? __pfx_shrink_folio_list+0x10/0x10 [ 589.497821][T12947] ? __lock_acquire+0x622/0x1c90 [ 589.497857][T12947] ? __lock_acquire+0x622/0x1c90 [ 589.497908][T12947] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 589.497936][T12947] ? is_bpf_text_address+0x94/0x1a0 [ 589.497985][T12947] ? kernel_text_address+0x8d/0x100 [ 589.498066][T12947] reclaim_folio_list+0xda/0x5d0 [ 589.498107][T12947] ? __pfx_reclaim_folio_list+0x10/0x10 [ 589.498156][T12947] ? __lock_acquire+0xb8a/0x1c90 [ 589.498193][T12947] ? css_rstat_updated+0x9d/0xd30 [ 589.498218][T12947] ? lru_gen_del_folio+0x32b/0x540 [ 589.498255][T12947] reclaim_pages+0x47b/0x650 [ 589.498295][T12947] ? __pfx_reclaim_pages+0x10/0x10 [ 589.498334][T12947] ? madvise_cold_or_pageout_pte_range+0x1ee3/0x2180 [ 589.498374][T12947] madvise_cold_or_pageout_pte_range+0x16d5/0x2180 [ 589.498419][T12947] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 589.498453][T12947] ? __lock_acquire+0x622/0x1c90 [ 589.498493][T12947] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 589.498527][T12947] walk_pgd_range+0xc56/0x1f60 [ 589.498572][T12947] ? __pfx_walk_pgd_range+0x10/0x10 [ 589.498601][T12947] ? find_held_lock+0x2b/0x80 [ 589.498628][T12947] __walk_page_range+0x163/0x820 [ 589.498655][T12947] ? find_vma+0xbf/0x140 [ 589.498683][T12947] ? __pfx_find_vma+0x10/0x10 [ 589.498715][T12947] ? walk_page_test+0x9b/0x180 [ 589.498741][T12947] walk_page_range_mm+0x54d/0x8a0 [ 589.498770][T12947] ? __pfx_walk_page_range_mm+0x10/0x10 [ 589.498801][T12947] ? find_held_lock+0x2b/0x80 [ 589.498831][T12947] ? mlock_drain_local+0x22d/0x4f0 [ 589.498858][T12947] walk_page_range+0x63/0x90 [ 589.498886][T12947] madvise_pageout+0x254/0x540 [ 589.498917][T12947] ? __pfx_madvise_pageout+0x10/0x10 [ 589.498959][T12947] ? mtree_range_walk+0x718/0xc00 [ 589.498996][T12947] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 589.499037][T12947] madvise_vma_behavior+0x460/0x2420 [ 589.499068][T12947] ? mas_prev_setup.constprop.0+0x81/0x830 [ 589.499110][T12947] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 589.499141][T12947] ? __pfx_mas_prev+0x10/0x10 [ 589.499171][T12947] ? find_vma_prev+0xda/0x160 [ 589.499203][T12947] ? __pfx_find_vma_prev+0x10/0x10 [ 589.499251][T12947] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 589.499281][T12947] madvise_walk_vmas+0x1ce/0x2c0 [ 589.499311][T12947] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 589.499357][T12947] madvise_do_behavior+0x15d/0x3f0 [ 589.499388][T12947] ? __pfx_madvise_do_behavior+0x10/0x10 [ 589.499431][T12947] do_madvise+0x161/0x230 [ 589.499459][T12947] ? __pfx_do_madvise+0x10/0x10 [ 589.499535][T12947] ? syscall_user_dispatch+0x78/0x140 [ 589.499595][T12947] __x64_sys_madvise+0xa9/0x110 [ 589.499638][T12947] do_syscall_64+0xcd/0x490 [ 589.499676][T12947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.499710][T12947] RIP: 0033:0x7f08e8d8e9a9 [ 589.499736][T12947] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 589.499768][T12947] RSP: 002b:00007f08e9bfc038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 589.499799][T12947] RAX: ffffffffffffffda RBX: 00007f08e8fb5fa0 RCX: 00007f08e8d8e9a9 [ 589.499829][T12947] RDX: 0000000000000015 RSI: 00000000002003f2 RDI: 0000000000000000 [ 589.499860][T12947] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 589.499878][T12947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 589.499913][T12947] R13: 0000000000000000 R14: 00007f08e8fb5fa0 R15: 00007ffd526733c8 [ 589.499955][T12947] [ 591.659175][ T1080] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 1385 with max blocks 13 with error 117 [ 591.832443][ T1080] EXT4-fs (sda1): This should not happen!! Data will be lost [ 591.832443][ T1080] [ 592.173597][T12972] program syz.1.1962 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 593.305478][T12987] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1965'. [ 593.690313][T12996] netlink: 'syz.2.1968': attribute type 15 has an invalid length. [ 593.730047][T12996] netlink: 252 bytes leftover after parsing attributes in process `syz.2.1968'. [ 593.757592][T12992] can0: slcan on pty233. [ 593.766634][T12996] netlink: 'syz.2.1968': attribute type 15 has an invalid length. [ 593.792863][T12996] netlink: 252 bytes leftover after parsing attributes in process `syz.2.1968'. [ 593.871401][T12991] can0 (unregistered): slcan off pty233. [ 593.881758][T12997] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 593.916250][T12998] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 593.961739][T12999] EXT4-fs error (device sda1): xattr_find_entry:333: inode #90: comm dhcpcd: corrupted xattr entries [ 596.295199][T13021] capability: warning: `syz.2.1972' uses deprecated v2 capabilities in a way that may be insecure [ 599.760836][T13060] netlink: 'syz.0.1981': attribute type 10 has an invalid length. [ 599.768928][T13060] netlink: 230 bytes leftover after parsing attributes in process `syz.0.1981'. [ 599.788309][T13060] team_slave_1: left promiscuous mode [ 599.798362][T13060] team_slave_1: left allmulticast mode [ 599.858971][T13060] team0: Port device team_slave_1 removed [ 600.241819][T13081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1994'. [ 600.342982][T13082] Invalid ELF header magic: != ELF [ 600.458323][T13088] sysfs_service_op_show: Client not running :-5: [ 601.087001][T13087] Invalid ELF header magic: != ELF [ 601.390983][T13102] random: crng reseeded on system resumption                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            syzkaller syzkaller login: [ 713.689014][ T1080] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 965 with max blocks 1 with error 117 [ 713.732334][ T1080] EXT4-fs (sda1): This should not happen!! Data will be lost [ 713.732334][ T1080] [ 717.192980][T14700] openvswitch: netlink: IPv4 tunnel dst address is zero [ 717.287550][T14700] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 717.313726][T14696] ptrace attach of "./syz-executor exec"[5853] was attempted by "d\x0dQ)\x22Im/AUi\x09vTmk*(p[aZ6׸g$I).ewqs0*:RDUЗ/;I,&C\x1b~\x0c=cD<1 o-ΗޔFYuos8f~%76ψ&4K~eQ(ßL\x09WU{YΫն<\x09ٮa\x0d0LEe*9\x07:3גDRHq}8cІ\x22J\x07`9kWe:擔vB\x22{\x0bQ, b!Admta/Z(4S%’&HslAl#f\x09b;Ҵ\x0c|׬t4/+u%qK$x\x0d /`ʤW7HMIOSEmA4;gΨ 'GÈ07̘/\x1bH2LߨX'6HūoD+)}hG%`>z'D(vF*rq\x1bE\x07pj*HtqmxMniTk} 18 [ 722.256601][ T5846] Bluetooth: hci3: SCO packet for unknown connection handle 0 [ 724.000456][ T12] EXT4-fs (sda1): Delayed block allocation failed for inode 2028 at logical offset 2 with max blocks 1 with error 117 [ 724.126380][ T12] EXT4-fs (sda1): This should not happen!! Data will be lost [ 724.126380][ T12] [ 726.225687][ T30] audit: type=1804 audit(1843104558.590:36): pid=14817 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2383" name="file0" dev="tmpfs" ino=3437 res=1 errno=0 [ 727.487005][T14838] batman_adv: batadv0: adding TT local entry 00:00:03:00:00:00 to non-existent VLAN 3 [ 728.596952][T14850] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2393'. [ 728.608766][T14850] geneve1: entered promiscuous mode [ 728.614032][T14850] geneve1: entered allmulticast mode [ 728.706948][T14850] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2393'. [ 729.076333][T14831] Process accounting resumed [ 730.676827][T14880] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 731.109025][T14892] ERROR: Out of memory at tomoyo_memory_ok. [ 732.669961][T14913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2408'. [ 732.779053][T14912] Invalid ELF header magic: != ELF [ 732.974127][T14912] netlink: 330 bytes leftover after parsing attributes in process `syz.0.2407'. [ 733.972695][T14932] netlink: 'syz.0.2412': attribute type 5 has an invalid length. [ 734.223601][ T5846] Bluetooth: hci2: unexpected event 0x35 length: 13 > 6 [ 735.304225][ T36] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 963 with max blocks 3 with error 117 [ 735.385005][ T36] EXT4-fs (sda1): This should not happen!! Data will be lost [ 735.385005][ T36] [ 735.489206][ T36] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 1394 with max blocks 4 with error 117 [ 735.516093][ T36] EXT4-fs (sda1): This should not happen!! Data will be lost [ 735.516093][ T36] [ 736.408859][T14985] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 737.247287][T14999] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 737.708912][T15006] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1257: comm udevd: corrupted xattr entries [ 737.735007][T15006] udevd[15006]: failed to execute '/lib/udev/scsi_id' 'scsi_id --export --whitelisted -d /dev/sda': Structure needs cleaning [ 738.668821][T15018] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 738.826952][T15022] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 741.587522][T15059] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 742.200043][T15079] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 742.299736][T15077] ERROR: Out of memory at tomoyo_memory_ok. [ 742.984954][T15090] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2445'. [ 742.986365][T15087] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2446'. [ 743.073246][T15092] netlink: 354 bytes leftover after parsing attributes in process `syz.1.2446'. [ 743.505069][T15105] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 743.619437][T15107] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 744.002533][T15098] Invalid ELF header magic: != ELF [ 744.612183][T15122] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 744.962577][T15125] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1257: comm udevd: corrupted xattr entries [ 744.975772][T15125] udevd[15125]: failed to execute '/lib/udev/scsi_id' 'scsi_id --export --whitelisted -d /dev/sda': Structure needs cleaning [ 747.489132][T15157] ERROR: Out of memory at tomoyo_memory_ok. [ 748.310683][T15174] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 750.574202][T15198] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2466'. [ 752.409184][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.416120][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.470232][T15235] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 755.035324][T15260] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 756.144641][T15276] netlink: 13832 bytes leftover after parsing attributes in process `syz.3.2486'. [ 756.268540][T15280] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 756.480491][T15288] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 757.076202][T15298] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 757.832386][T15308] Invalid ELF header magic: != ELF [ 758.261584][ T5846] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 759.290556][T15332] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 759.373242][T15331] can: request_module (can-proto-3) failed. [ 760.370393][T15342] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 760.394777][T15335] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2499'. [ 760.542864][T15328] Process accounting paused [ 760.549050][T15335] bridge0: port 2(bridge_slave_1) entered disabled state [ 760.672250][T15335] bridge_slave_1 (unregistering): left allmulticast mode [ 760.692701][T15335] bridge_slave_1 (unregistering): left promiscuous mode [ 760.706017][T15335] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.516146][T15354] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 762.893945][T15367] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 952 with max blocks 14 with error 117 [ 762.930087][T15367] EXT4-fs (sda1): This should not happen!! Data will be lost [ 762.930087][T15367] [ 763.861275][T15379] netlink: 338 bytes leftover after parsing attributes in process `syz.2.2511'. [ 763.889910][T15374] ERROR: Out of memory at tomoyo_memory_ok. [ 763.967574][T15382] netlink: 338 bytes leftover after parsing attributes in process `syz.2.2511'. [ 764.037261][T15379] netlink: 290 bytes leftover after parsing attributes in process `syz.2.2511'. [ 764.113221][T15382] netlink: 290 bytes leftover after parsing attributes in process `syz.2.2511'. [ 764.989093][T15399] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 765.080967][T15404] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 765.751226][T15411] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 765.780228][ T1080] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 964 with max blocks 2 with error 117 [ 765.803099][ T1080] EXT4-fs (sda1): This should not happen!! Data will be lost [ 765.803099][ T1080] [ 765.826895][T15413] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 765.846838][ T1080] EXT4-fs (sda1): Delayed block allocation failed for inode 2027 at logical offset 1376 with max blocks 27 with error 117 [ 765.884783][T15414] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 765.886022][ T1080] EXT4-fs (sda1): This should not happen!! Data will be lost [ 765.886022][ T1080] [ 767.210845][T15432] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2522'. [ 768.042444][T15443] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 964 with max blocks 1 with error 117 [ 768.080417][T15443] EXT4-fs (sda1): This should not happen!! Data will be lost [ 768.080417][T15443] [ 768.887048][T15453] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 770.298550][T15472] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 771.355965][T15499] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 771.375604][T15502] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 771.408378][T15501] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 771.453247][T15503] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 771.480386][T15504] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 772.106055][T15514] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 772.595366][T15523] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 773.329165][T15530] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 775.295576][T15555] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:0: corrupted xattr entries [ 777.304067][T15588] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 778.613943][T15610] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 778.759692][T15613] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 778.846260][T15617] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 778.945116][T15618] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 779.363833][T15624] FAULT_INJECTION: forcing a failure. [ 779.363833][T15624] name failslab, interval 1, probability 0, space 0, times 0 [ 779.400402][T15624] CPU: 0 UID: 0 PID: 15624 Comm: syz.3.2559 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 779.400434][T15624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 779.400448][T15624] Call Trace: [ 779.400455][T15624] [ 779.400464][T15624] dump_stack_lvl+0x16c/0x1f0 [ 779.400492][T15624] should_fail_ex+0x512/0x640 [ 779.400514][T15624] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 779.400540][T15624] should_failslab+0xc2/0x120 [ 779.400566][T15624] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 779.400587][T15624] ? d_instantiate+0x77/0x90 [ 779.400612][T15624] ? alloc_empty_file+0x55/0x1e0 [ 779.400643][T15624] alloc_empty_file+0x55/0x1e0 [ 779.400672][T15624] alloc_file_pseudo+0x13a/0x230 [ 779.400703][T15624] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 779.400745][T15624] ? _raw_spin_unlock+0x28/0x50 [ 779.400782][T15624] ? alloc_fd+0x471/0x7d0 [ 779.400818][T15624] __anon_inode_getfile+0xe8/0x280 [ 779.400858][T15624] anon_inode_getfd+0x52/0xb0 [ 779.400896][T15624] __x64_sys_fsopen+0x18b/0x240 [ 779.400923][T15624] do_syscall_64+0xcd/0x490 [ 779.400947][T15624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.400971][T15624] RIP: 0033:0x7f08e8d8e9a9 [ 779.400989][T15624] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 779.401011][T15624] RSP: 002b:00007f08e9bdb038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 779.401032][T15624] RAX: ffffffffffffffda RBX: 00007f08e8fb6080 RCX: 00007f08e8d8e9a9 [ 779.401047][T15624] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 779.401060][T15624] RBP: 00007f08e8e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 779.401073][T15624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 779.401086][T15624] R13: 0000000000000000 R14: 00007f08e8fb6080 R15: 00007ffd526733c8 [ 779.401112][T15624] [ 779.817468][T15627] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 785.440090][T15687] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 785.902631][T15693] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input23 [ 786.623600][ T5202] ERROR: Out of memory at tomoyo_memory_ok. [ 788.082463][T15724] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 788.095774][T15722] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !PjE r҄y*"l-y– [ 788.886973][T15738] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 789.521599][T15753] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 789.593436][T15756] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 789.634159][T15757] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 789.704180][T15760] netlink: 306 bytes leftover after parsing attributes in process `syz.1.2586'. [ 789.821631][T15318] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 789.829765][T15318] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 790.893369][T15768] Process accounting resumed [ 793.141110][T15806] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 795.499990][T15831] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 796.561469][ T3490] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 965 with max blocks 1 with error 117 [ 796.625545][ T3490] EXT4-fs (sda1): This should not happen!! Data will be lost [ 796.625545][ T3490] [ 797.998926][T15851] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 798.613138][T15855] device-mapper: ioctl: dm_ctl_ioctl: unknown command 0xfffffd12 [ 799.030082][T15869] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 801.549998][T15890] vivid-003: ================= START STATUS ================= [ 801.572242][T15890] vivid-003: Radio HW Seek Mode: Bounded [ 801.604850][T15890] vivid-003: Radio Programmable HW Seek: false [ 801.612200][T15890] vivid-003: RDS Rx I/O Mode: Block I/O [ 801.662824][T15890] vivid-003: Generate RBDS Instead of RDS: false [ 801.670606][T15890] vivid-003: RDS Reception: true [ 801.676493][T15890] vivid-003: RDS Program Type: 0 inactive [ 801.727489][T15890] vivid-003: RDS PS Name: inactive [ 801.733160][T15890] vivid-003: RDS Radio Text: inactive [ 801.748539][T15890] vivid-003: RDS Traffic Announcement: false inactive [ 801.756359][T15890] vivid-003: RDS Traffic Program: false inactive [ 801.764374][T15890] vivid-003: RDS Music: false inactive [ 801.770024][T15890] vivid-003: ================== END STATUS ================== [ 801.811634][T15898] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 802.841782][ T5856] Bluetooth: hci0: unexpected event 0x3d length: 726 > 14 [ 802.885767][T15909] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 806.649816][T15947] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 806.862101][T15952] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1257: comm udevd: corrupted xattr entries [ 806.875219][T15952] udevd[15952]: failed to execute '/lib/udev/scsi_id' 'scsi_id --export --whitelisted -d /dev/sda': Structure needs cleaning [ 808.682219][T15972] bridge0: port 2(veth0_to_bridge) entered blocking state [ 808.695044][T15972] bridge0: port 2(veth0_to_bridge) entered disabled state [ 808.715192][T15972] veth0_to_bridge: entered allmulticast mode [ 808.767336][T15972] veth0_to_bridge: entered promiscuous mode [ 809.464144][T15972] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 809.502596][T15972] bridge0: port 2(veth0_to_bridge) entered blocking state [ 809.509997][T15972] bridge0: port 2(veth0_to_bridge) entered forwarding state [ 810.001800][T15981] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1257: comm udevd: corrupted xattr entries [ 810.044761][T15981] udevd[15981]: failed to execute '/lib/udev/scsi_id' 'scsi_id --export --whitelisted -d /dev/sda': Structure needs cleaning [ 811.049058][T15996] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2640'. [ 811.074282][T15996] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 811.177111][T15996] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 811.249016][T15996] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 811.350097][T15996] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 812.214188][T16004] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 812.847605][T16011] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 813.416478][T16019] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 813.437493][T16020] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 813.832484][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 813.839052][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 813.941407][T16028] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 814.856893][T16038] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 815.845105][T16041] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:3: corrupted xattr entries [ 815.877526][T16043] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 815.902744][T16047] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:8: corrupted xattr entries [ 816.970817][T16061] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2646'. [ 816.980077][T16061] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 817.000331][T16061] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 817.106446][T16061] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 817.122430][T16061] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 818.725735][T16082] EXT4-fs (sda1): Delayed block allocation failed for inode 2029 at logical offset 960 with max blocks 6 with error 117 [ 818.842712][T16084] ubi0: attaching mtd0 [ 818.929776][T16082] EXT4-fs (sda1): This should not happen!! Data will be lost [ 818.929776][T16082] [ 818.931997][T16084] ubi0: scanning is finished [ 818.945369][T16084] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 820.260618][T16084] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 821.624487][T16107] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:7: corrupted xattr entries [ 822.184760][T16098] Process accounting paused [ 822.439121][T16116] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:2: corrupted xattr entries [ 822.602676][T16121] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2660'. [ 822.611816][T16121] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 822.621894][T16121] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 822.833797][T16121] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 822.867842][T16121] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 823.750434][T16137] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:4: corrupted xattr entries [ 824.787284][T16153] EXT4-fs error (device sda1): xattr_find_entry:333: inode #1312: comm kworker/u8:5: corrupted xattr entries [ 824.805375][T16151] random: crng reseeded on system resumption [ 824.812224][T16151] FAULT_INJECTION: forcing a failure. [ 824.812224][T16151] name failslab, interval 1, probability 0, space 0, times 0 [ 824.874460][T16151] CPU: 0 UID: 0 PID: 16151 Comm: syz.1.2667 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 824.874496][T16151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 824.874512][T16151] Call Trace: [ 824.874520][T16151] [ 824.874530][T16151] dump_stack_lvl+0x16c/0x1f0 [ 824.874559][T16151] should_fail_ex+0x512/0x640 [ 824.874584][T16151] ? lockdep_hardirqs_on+0x7c/0x110 [ 824.874610][T16151] should_failslab+0xc2/0x120 [ 824.874639][T16151] __kmalloc_cache_noprof+0x6a/0x3e0 [ 824.874678][T16151] ? do_raw_spin_lock+0x12c/0x2b0 [ 824.874718][T16151] ? find_held_lock+0x2b/0x80 [ 824.874741][T16151] ? async_schedule_node_domain+0x54/0x120 [ 824.874773][T16151] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 824.874815][T16151] async_schedule_node_domain+0x54/0x120 [ 824.874848][T16151] dev_cache_fw_image+0x38e/0x490 [ 824.874888][T16151] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 824.874932][T16151] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 824.874971][T16151] dpm_for_each_dev+0x5d/0xb0 [ 824.875007][T16151] fw_pm_notify+0x81/0x150 [ 824.875051][T16151] notifier_call_chain+0xbc/0x410 [ 824.875088][T16151] ? __pfx_fw_pm_notify+0x10/0x10 [ 824.875131][T16151] blocking_notifier_call_chain_robust+0xc8/0x160 [ 824.875166][T16151] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 824.875210][T16151] pm_notifier_call_chain_robust+0x27/0x60 [ 824.875253][T16151] snapshot_open+0x218/0x2b0 [ 824.875283][T16151] ? __pfx_snapshot_open+0x10/0x10 [ 824.875315][T16151] misc_open+0x35a/0x420 [ 824.875353][T16151] ? __pfx_misc_open+0x10/0x10 [ 824.875389][T16151] chrdev_open+0x231/0x6a0 [ 824.875416][T16151] ? __pfx_apparmor_file_open+0x10/0x10 [ 824.875469][T16151] ? __pfx_chrdev_open+0x10/0x10 [ 824.875526][T16151] ? file_set_fsnotify_mode_from_watchers+0x163/0x640 [ 824.875596][T16151] do_dentry_open+0x744/0x1c10 [ 824.875623][T16151] ? __pfx_chrdev_open+0x10/0x10 [ 824.875657][T16151] vfs_open+0x82/0x3f0 [ 824.875704][T16151] path_openat+0x1de4/0x2cb0 [ 824.875738][T16151] ? __pfx_path_openat+0x10/0x10 [ 824.875763][T16151] ? __lock_acquire+0xb8a/0x1c90 [ 824.875798][T16151] do_filp_open+0x20b/0x470 [ 824.875822][T16151] ? __pfx_do_filp_open+0x10/0x10 [ 824.875868][T16151] ? alloc_fd+0x471/0x7d0 [ 824.875913][T16151] do_sys_openat2+0x11b/0x1d0 [ 824.875963][T16151] ? __pfx_do_sys_openat2+0x10/0x10 [ 824.876010][T16151] __x64_sys_openat+0x174/0x210 [ 824.876046][T16151] ? __pfx___x64_sys_openat+0x10/0x10 [ 824.876099][T16151] do_syscall_64+0xcd/0x490 [ 824.876128][T16151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.876154][T16151] RIP: 0033:0x7fe920d8e9a9 [ 824.876175][T16151] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 824.876204][T16151] RSP: 002b:00007fe921b39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 824.876231][T16151] RAX: ffffffffffffffda RBX: 00007fe920fb5fa0 RCX: 00007fe920d8e9a9 [ 824.876259][T16151] RDX: 0000000000184b01 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 824.876273][T16151] RBP: 00007fe920e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 824.876286][T16151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 824.876299][T16151] R13: 0000000000000000 R14: 00007fe920fb5fa0 R15: 00007ffc50a76518 [ 824.876327][T16151] [ 825.222546][T16151] [ 825.224934][T16151] ====================================================== [ 825.231984][T16151] WARNING: possible circular locking dependency detected [ 825.239027][T16151] 6.16.0-rc7-syzkaller #0 Not tainted [ 825.244421][T16151] ------------------------------------------------------ [ 825.251488][T16151] syz.1.2667/16151 is trying to acquire lock: [ 825.257557][T16151] ffff888073f6fd28 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}, at: process_measurement+0x7e0/0x23e0 [ 825.268207][T16151] [ 825.268207][T16151] but task is already holding lock: [ 825.275580][T16151] ffffffff8f50d528 (dpm_list_mtx){+.+.}-{4:4}, at: dpm_for_each_dev+0x2d/0xb0 [ 825.284519][T16151] [ 825.284519][T16151] which lock already depends on the new lock. [ 825.284519][T16151] [ 825.294941][T16151] [ 825.294941][T16151] the existing dependency chain (in reverse order) is: [ 825.303973][T16151] [ 825.303973][T16151] -> #4 (dpm_list_mtx){+.+.}-{4:4}: [ 825.311393][T16151] __mutex_lock+0x199/0xb90 [ 825.316441][T16151] device_pm_add+0x87/0x3e0 [ 825.321486][T16151] device_add+0x9cd/0x1a70 [ 825.326460][T16151] device_create_groups_vargs+0x1f8/0x270 [ 825.332721][T16151] device_create+0xed/0x130 [ 825.337765][T16151] msr_device_create+0x31/0x70 [ 825.343068][T16151] cpuhp_invoke_callback+0x3d5/0xa10 [ 825.348888][T16151] cpuhp_thread_fun+0x47e/0x6f0 [ 825.354303][T16151] smpboot_thread_fn+0x3f7/0xae0 [ 825.359807][T16151] kthread+0x3c2/0x780 [ 825.364440][T16151] ret_from_fork+0x5d7/0x6f0 [ 825.369591][T16151] ret_from_fork_asm+0x1a/0x30 [ 825.374908][T16151] [ 825.374908][T16151] -> #3 (cpuhp_state-up){+.+.}-{0:0}: [ 825.382506][T16151] cpuhp_thread_fun+0x193/0x6f0 [ 825.387899][T16151] smpboot_thread_fn+0x3f7/0xae0 [ 825.393377][T16151] kthread+0x3c2/0x780 [ 825.398012][T16151] ret_from_fork+0x5d7/0x6f0 [ 825.403153][T16151] ret_from_fork_asm+0x1a/0x30 [ 825.408478][T16151] [ 825.408478][T16151] -> #2 (cpu_hotplug_lock){++++}-{0:0}: [ 825.416236][T16151] cpus_read_lock+0x42/0x160 [ 825.421369][T16151] ring_buffer_resize+0x105/0x15c0 [ 825.427019][T16151] __tracing_resize_ring_buffer.part.0+0x52/0x1f0 [ 825.433984][T16151] tracing_free_buffer_release+0x104/0x270 [ 825.440373][T16151] __fput+0x402/0xb70 [ 825.444900][T16151] task_work_run+0x150/0x240 [ 825.450135][T16151] exit_to_user_mode_loop+0xeb/0x110 [ 825.455969][T16151] do_syscall_64+0x3f6/0x490 [ 825.461092][T16151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.467606][T16151] [ 825.467606][T16151] -> #1 (trace_types_lock){+.+.}-{4:4}: [ 825.475364][T16151] __mutex_lock+0x199/0xb90 [ 825.480412][T16151] tracing_check_open_get_tr.part.0+0x45/0x130 [ 825.487115][T16151] tracing_open_generic_tr+0x66/0xf0 [ 825.492945][T16151] do_dentry_open+0x744/0x1c10 [ 825.498255][T16151] vfs_open+0x82/0x3f0 [ 825.502874][T16151] dentry_open+0x71/0xd0 [ 825.507670][T16151] ima_calc_file_hash+0x2b6/0x490 [ 825.513240][T16151] ima_collect_measurement+0x897/0xa40 [ 825.519252][T16151] process_measurement+0x11fa/0x23e0 [ 825.525095][T16151] ima_file_check+0xc5/0x110 [ 825.530244][T16151] security_file_post_open+0x8e/0x210 [ 825.536168][T16151] path_openat+0x1404/0x2cb0 [ 825.541302][T16151] do_filp_open+0x20b/0x470 [ 825.546369][T16151] do_sys_openat2+0x11b/0x1d0 [ 825.551599][T16151] __x64_sys_openat+0x174/0x210 [ 825.556995][T16151] do_syscall_64+0xcd/0x490 [ 825.562038][T16151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.568472][T16151] [ 825.568472][T16151] -> #0 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 825.577102][T16151] __lock_acquire+0x126f/0x1c90 [ 825.582498][T16151] lock_acquire+0x179/0x350 [ 825.587559][T16151] __mutex_lock+0x199/0xb90 [ 825.592615][T16151] process_measurement+0x7e0/0x23e0 [ 825.598351][T16151] ima_file_check+0xc5/0x110 [ 825.603481][T16151] security_file_post_open+0x8e/0x210 [ 825.609420][T16151] path_openat+0x1404/0x2cb0 [ 825.614554][T16151] do_file_open_root+0x322/0x610 [ 825.620039][T16151] file_open_root+0x2a7/0x450 [ 825.625263][T16151] kernel_read_file_from_path_initns+0x189/0x260 [ 825.632579][T16151] _request_firmware+0x744/0x1470 [ 825.638154][T16151] __async_dev_cache_fw_image+0xb1/0x340 [ 825.644331][T16151] async_schedule_node_domain+0xd4/0x120 [ 825.650539][T16151] dev_cache_fw_image+0x38e/0x490 [ 825.656134][T16151] dpm_for_each_dev+0x5d/0xb0 [ 825.661384][T16151] fw_pm_notify+0x81/0x150 [ 825.666379][T16151] notifier_call_chain+0xbc/0x410 [ 825.671960][T16151] blocking_notifier_call_chain_robust+0xc8/0x160 [ 825.678931][T16151] pm_notifier_call_chain_robust+0x27/0x60 [ 825.685299][T16151] snapshot_open+0x218/0x2b0 [ 825.690489][T16151] misc_open+0x35a/0x420 [ 825.695302][T16151] chrdev_open+0x231/0x6a0 [ 825.700275][T16151] do_dentry_open+0x744/0x1c10 [ 825.705578][T16151] vfs_open+0x82/0x3f0 [ 825.710206][T16151] path_openat+0x1de4/0x2cb0 [ 825.715342][T16151] do_filp_open+0x20b/0x470 [ 825.720407][T16151] do_sys_openat2+0x11b/0x1d0 [ 825.725658][T16151] __x64_sys_openat+0x174/0x210 [ 825.731058][T16151] do_syscall_64+0xcd/0x490 [ 825.736105][T16151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.742546][T16151] [ 825.742546][T16151] other info that might help us debug this: [ 825.742546][T16151] [ 825.752782][T16151] Chain exists of: [ 825.752782][T16151] &ima_iint_mutex_key[depth] --> cpuhp_state-up --> dpm_list_mtx [ 825.752782][T16151] [ 825.766455][T16151] Possible unsafe locking scenario: [ 825.766455][T16151] [ 825.773910][T16151] CPU0 CPU1 [ 825.779296][T16151] ---- ---- [ 825.784676][T16151] lock(dpm_list_mtx); [ 825.788860][T16151] lock(cpuhp_state-up); [ 825.795844][T16151] lock(dpm_list_mtx); [ 825.802552][T16151] lock(&ima_iint_mutex_key[depth]); [ 825.807945][T16151] [ 825.807945][T16151] *** DEADLOCK *** [ 825.807945][T16151] [ 825.816102][T16151] 5 locks held by syz.1.2667/16151: [ 825.821308][T16151] #0: ffffffff8f3002e8 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x63/0x420 [ 825.829832][T16151] #1: ffffffff8e488228 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x87/0xa0 [ 825.840255][T16151] #2: ffffffff8e4c8910 ((pm_chain_head).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain_robust+0xa8/0x160 [ 825.852278][T16151] #3: ffffffff8f512b28 (fw_lock){+.+.}-{4:4}, at: fw_pm_notify+0x69/0x150 [ 825.860950][T16151] #4: ffffffff8f50d528 (dpm_list_mtx){+.+.}-{4:4}, at: dpm_for_each_dev+0x2d/0xb0 [ 825.870307][T16151] [ 825.870307][T16151] stack backtrace: [ 825.876318][T16151] CPU: 1 UID: 0 PID: 16151 Comm: syz.1.2667 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) [ 825.876348][T16151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 825.876363][T16151] Call Trace: [ 825.876370][T16151] [ 825.876379][T16151] dump_stack_lvl+0x116/0x1f0 [ 825.876404][T16151] print_circular_bug+0x275/0x350 [ 825.876436][T16151] check_noncircular+0x14c/0x170 [ 825.876470][T16151] __lock_acquire+0x126f/0x1c90 [ 825.876506][T16151] lock_acquire+0x179/0x350 [ 825.876536][T16151] ? process_measurement+0x7e0/0x23e0 [ 825.876560][T16151] ? __pfx___might_resched+0x10/0x10 [ 825.876588][T16151] __mutex_lock+0x199/0xb90 [ 825.876611][T16151] ? process_measurement+0x7e0/0x23e0 [ 825.876636][T16151] ? process_measurement+0x7e0/0x23e0 [ 825.876659][T16151] ? __pfx___mutex_lock+0x10/0x10 [ 825.876682][T16151] ? __pfx___might_resched+0x10/0x10 [ 825.876707][T16151] ? find_held_lock+0x2b/0x80 [ 825.876730][T16151] ? down_write+0x14d/0x200 [ 825.876767][T16151] ? process_measurement+0x7e0/0x23e0 [ 825.876790][T16151] process_measurement+0x7e0/0x23e0 [ 825.876819][T16151] ? __pfx_process_measurement+0x10/0x10 [ 825.876845][T16151] ? find_held_lock+0x2b/0x80 [ 825.876869][T16151] ? fscrypt_file_open+0x47c/0x590 [ 825.876920][T16151] ? __pfx___fsnotify_parent+0x10/0x10 [ 825.876956][T16151] ima_file_check+0xc5/0x110 [ 825.876979][T16151] ? __pfx_ima_file_check+0x10/0x10 [ 825.877004][T16151] ? vfs_open+0x2e3/0x3f0 [ 825.877034][T16151] security_file_post_open+0x8e/0x210 [ 825.877069][T16151] path_openat+0x1404/0x2cb0 [ 825.877099][T16151] ? trace_kmem_cache_alloc+0x28/0xc0 [ 825.877129][T16151] ? kmem_cache_alloc_noprof+0x21e/0x3b0 [ 825.877152][T16151] ? __pfx_path_openat+0x10/0x10 [ 825.877173][T16151] ? __asan_memcpy+0x3c/0x60 [ 825.877211][T16151] do_file_open_root+0x322/0x610 [ 825.877233][T16151] ? __pfx_do_file_open_root+0x10/0x10 [ 825.877269][T16151] ? vsnprintf+0x318/0x1160 [ 825.877306][T16151] file_open_root+0x2a7/0x450 [ 825.877329][T16151] ? __pfx_file_open_root+0x10/0x10 [ 825.877352][T16151] ? find_held_lock+0x2b/0x80 [ 825.877376][T16151] ? kernel_read_file_from_path_initns+0x17a/0x260 [ 825.877426][T16151] kernel_read_file_from_path_initns+0x189/0x260 [ 825.877460][T16151] ? __pfx_kernel_read_file_from_path_initns+0x10/0x10 [ 825.877493][T16151] ? trace_kmem_cache_alloc+0x28/0xc0 [ 825.877524][T16151] ? _request_firmware+0x503/0x1470 [ 825.877566][T16151] _request_firmware+0x744/0x1470 [ 825.877610][T16151] ? __pfx__request_firmware+0x10/0x10 [ 825.877651][T16151] ? dump_stack_lvl+0x1a3/0x1f0 [ 825.877675][T16151] __async_dev_cache_fw_image+0xb1/0x340 [ 825.877699][T16151] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 825.877741][T16151] ? mark_held_locks+0x49/0x80 [ 825.877773][T16151] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 825.877812][T16151] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 825.877854][T16151] async_schedule_node_domain+0xd4/0x120 [ 825.877884][T16151] dev_cache_fw_image+0x38e/0x490 [ 825.877923][T16151] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 825.877963][T16151] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 825.878000][T16151] dpm_for_each_dev+0x5d/0xb0 [ 825.878035][T16151] fw_pm_notify+0x81/0x150 [ 825.878069][T16151] notifier_call_chain+0xbc/0x410 [ 825.878104][T16151] ? __pfx_fw_pm_notify+0x10/0x10 [ 825.878142][T16151] blocking_notifier_call_chain_robust+0xc8/0x160 [ 825.878176][T16151] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 825.878215][T16151] pm_notifier_call_chain_robust+0x27/0x60 [ 825.878251][T16151] snapshot_open+0x218/0x2b0 [ 825.878282][T16151] ? __pfx_snapshot_open+0x10/0x10 [ 825.878312][T16151] misc_open+0x35a/0x420 [ 825.878349][T16151] ? __pfx_misc_open+0x10/0x10 [ 825.878385][T16151] chrdev_open+0x231/0x6a0 [ 825.878411][T16151] ? __pfx_apparmor_file_open+0x10/0x10 [ 825.878449][T16151] ? __pfx_chrdev_open+0x10/0x10 [ 825.878476][T16151] ? file_set_fsnotify_mode_from_watchers+0x163/0x640 [ 825.878517][T16151] do_dentry_open+0x744/0x1c10 [ 825.878541][T16151] ? __pfx_chrdev_open+0x10/0x10 [ 825.878570][T16151] vfs_open+0x82/0x3f0 [ 825.878602][T16151] path_openat+0x1de4/0x2cb0 [ 825.878629][T16151] ? __pfx_path_openat+0x10/0x10 [ 825.878652][T16151] ? __lock_acquire+0xb8a/0x1c90 [ 825.878686][T16151] do_filp_open+0x20b/0x470 [ 825.878709][T16151] ? __pfx_do_filp_open+0x10/0x10 [ 825.878742][T16151] ? alloc_fd+0x471/0x7d0 [ 825.878784][T16151] do_sys_openat2+0x11b/0x1d0 [ 825.878816][T16151] ? __pfx_do_sys_openat2+0x10/0x10 [ 825.878860][T16151] __x64_sys_openat+0x174/0x210 [ 825.878893][T16151] ? __pfx___x64_sys_openat+0x10/0x10 [ 825.878933][T16151] do_syscall_64+0xcd/0x490 [ 825.878958][T16151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.878984][T16151] RIP: 0033:0x7fe920d8e9a9 [ 825.879003][T16151] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 825.879028][T16151] RSP: 002b:00007fe921b39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 825.879050][T16151] RAX: ffffffffffffffda RBX: 00007fe920fb5fa0 RCX: 00007fe920d8e9a9 [ 825.879067][T16151] RDX: 0000000000184b01 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 825.879092][T16151] RBP: 00007fe920e10d69 R08: 0000000000000000 R09: 0000000000000000 [ 825.879107][T16151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 825.879122][T16151] R13: 0000000000000000 R14: 00007fe920fb5fa0 R15: 00007ffc50a76518 [ 825.879145][T16151]