last executing test programs: 3.218326968s ago: executing program 3 (id=5130): r0 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000180), 0x40900, 0x0) ioctl$auto_FIONREAD(r0, 0x541b, 0x5) 2.434490582s ago: executing program 3 (id=5137): mq_open$auto(&(0x7f00000000c0)='\x12\xe6D\b\x9e\x00\x80\x8d\f\xb9w-\xbd!\x9eb\xed\xfb\x0f\xe5\x9dZ\xc2\xd1\x01wBV\x91\x8f_\xc0.\x84\xfe\x84\xd1se\x01\x06\x00\xb3\x13_Y&\xa9\x88\xe4\xa2\xb0V\x85\x92<\xb6\xdcT \\\xf2\v\xb1\xe2\xd8\xfa\xd8V\xe5\x00\xfa\xe9!\xc5<\xce\x18=\x06\xdagq\xb5\r\t\xb2\xde\x99\xd50\xbb\x192\x1c4\x86\xc0\xc1-\xd5\x10\xc3\xfc*[8\x89h\xc5\xba\xff\xc8u5 1 [ 95.145841][ T5873] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 95.153919][ T5873] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 95.171618][ T5876] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 95.179404][ T5876] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 95.187027][ T5876] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 95.192665][ T5873] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 95.202632][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 95.210936][ T5876] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.212424][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 95.265248][ T5876] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 95.280108][ T5876] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 95.288159][ T5876] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 95.298723][ T5876] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 95.307069][ T5876] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 95.351482][ T5876] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 95.365410][ T5876] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 95.374351][ T5876] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 95.383569][ T5876] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 95.393133][ T5876] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 96.078996][ T5870] chnl_net:caif_netlink_parms(): no params data found [ 96.177996][ T5880] chnl_net:caif_netlink_parms(): no params data found [ 96.232878][ T5872] chnl_net:caif_netlink_parms(): no params data found [ 96.254034][ T5878] chnl_net:caif_netlink_parms(): no params data found [ 96.358483][ T5870] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.367038][ T5870] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.374321][ T5870] bridge_slave_0: entered allmulticast mode [ 96.382044][ T5870] bridge_slave_0: entered promiscuous mode [ 96.426779][ T5870] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.434249][ T5870] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.441656][ T5870] bridge_slave_1: entered allmulticast mode [ 96.449185][ T5870] bridge_slave_1: entered promiscuous mode [ 96.509268][ T5880] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.516568][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.524039][ T5880] bridge_slave_0: entered allmulticast mode [ 96.531640][ T5880] bridge_slave_0: entered promiscuous mode [ 96.565305][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.572640][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.580393][ T5880] bridge_slave_1: entered allmulticast mode [ 96.587820][ T5880] bridge_slave_1: entered promiscuous mode [ 96.598472][ T5870] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.646967][ T5870] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.716651][ T5872] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.723926][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.731656][ T5872] bridge_slave_0: entered allmulticast mode [ 96.738999][ T5872] bridge_slave_0: entered promiscuous mode [ 96.746706][ T5878] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.754066][ T5878] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.761788][ T5878] bridge_slave_0: entered allmulticast mode [ 96.769340][ T5878] bridge_slave_0: entered promiscuous mode [ 96.780369][ T5880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.793256][ T5870] team0: Port device team_slave_0 added [ 96.802493][ T5880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.825635][ T5872] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.833119][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.840751][ T5872] bridge_slave_1: entered allmulticast mode [ 96.848205][ T5872] bridge_slave_1: entered promiscuous mode [ 96.855580][ T5878] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.862928][ T5878] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.870346][ T5878] bridge_slave_1: entered allmulticast mode [ 96.877762][ T5878] bridge_slave_1: entered promiscuous mode [ 96.887270][ T5870] team0: Port device team_slave_1 added [ 96.920359][ T5880] team0: Port device team_slave_0 added [ 96.961627][ T5880] team0: Port device team_slave_1 added [ 96.970458][ T5872] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.017895][ T5872] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.030448][ T5878] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.047081][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.054232][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.080475][ T5870] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.117757][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.124948][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.151157][ T5880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.166543][ T5878] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.188037][ T5870] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.195133][ T5870] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.221465][ T5870] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.246644][ T5880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.253813][ T5880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.280195][ T5880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.314026][ T5872] team0: Port device team_slave_0 added [ 97.320744][ T5876] Bluetooth: hci1: command tx timeout [ 97.320749][ T5145] Bluetooth: hci0: command tx timeout [ 97.340648][ T5878] team0: Port device team_slave_0 added [ 97.350803][ T5872] team0: Port device team_slave_1 added [ 97.371757][ T5878] team0: Port device team_slave_1 added [ 97.399319][ T5145] Bluetooth: hci2: command tx timeout [ 97.441876][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.448889][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.475058][ T5872] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.489176][ T5145] Bluetooth: hci3: command tx timeout [ 97.521752][ T5870] hsr_slave_0: entered promiscuous mode [ 97.528483][ T5870] hsr_slave_1: entered promiscuous mode [ 97.536286][ T5872] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.543581][ T5872] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.570244][ T5872] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.582466][ T5878] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.589642][ T5878] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.615789][ T5878] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.633346][ T5880] hsr_slave_0: entered promiscuous mode [ 97.640142][ T5880] hsr_slave_1: entered promiscuous mode [ 97.646352][ T5880] debugfs: 'hsr0' already exists in 'hsr' [ 97.652587][ T5880] Cannot create hsr debugfs directory [ 97.682058][ T5878] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.689219][ T5878] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.715494][ T5878] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.885740][ T5872] hsr_slave_0: entered promiscuous mode [ 97.893089][ T5872] hsr_slave_1: entered promiscuous mode [ 97.899631][ T5872] debugfs: 'hsr0' already exists in 'hsr' [ 97.905399][ T5872] Cannot create hsr debugfs directory [ 97.955386][ T5878] hsr_slave_0: entered promiscuous mode [ 97.962516][ T5878] hsr_slave_1: entered promiscuous mode [ 97.968729][ T5878] debugfs: 'hsr0' already exists in 'hsr' [ 97.974599][ T5878] Cannot create hsr debugfs directory [ 98.342112][ T5870] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 98.371467][ T5870] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 98.392810][ T5870] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 98.404623][ T5870] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 98.468531][ T5872] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 98.487444][ T5872] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 98.503771][ T5872] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 98.517128][ T5872] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 98.605840][ T5880] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 98.635405][ T5880] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 98.653760][ T5880] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 98.679826][ T5880] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 98.779996][ T5878] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.796756][ T5878] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.816769][ T5878] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.834983][ T5878] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.897501][ T5870] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.941044][ T5870] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.972001][ T1040] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.979338][ T1040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.992841][ T1040] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.000020][ T1040] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.022296][ T5872] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.093855][ T5872] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.137166][ T5880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.154247][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.161412][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.190809][ T5880] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.206708][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.214005][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.263125][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.270341][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.284518][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.291671][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.373073][ T5878] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.400122][ T5145] Bluetooth: hci1: command tx timeout [ 99.405694][ T5145] Bluetooth: hci0: command tx timeout [ 99.480418][ T5145] Bluetooth: hci2: command tx timeout [ 99.492204][ T5878] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.515764][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.523021][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.556406][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.563630][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.566671][ T5145] Bluetooth: hci3: command tx timeout [ 99.794072][ T5870] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.985423][ T5870] veth0_vlan: entered promiscuous mode [ 100.015205][ T5870] veth1_vlan: entered promiscuous mode [ 100.093660][ T5872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.113197][ T5880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.133700][ T5870] veth0_macvtap: entered promiscuous mode [ 100.167721][ T5870] veth1_macvtap: entered promiscuous mode [ 100.235326][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.251447][ T5870] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.270881][ T5878] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.310536][ T5872] veth0_vlan: entered promiscuous mode [ 100.316841][ T5880] veth0_vlan: entered promiscuous mode [ 100.323304][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.333556][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.365261][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.374561][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.396616][ T5880] veth1_vlan: entered promiscuous mode [ 100.407396][ T5872] veth1_vlan: entered promiscuous mode [ 100.528092][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.545665][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.573799][ T5880] veth0_macvtap: entered promiscuous mode [ 100.582097][ T5878] veth0_vlan: entered promiscuous mode [ 100.607046][ T5880] veth1_macvtap: entered promiscuous mode [ 100.629532][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.637542][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.657488][ T5872] veth0_macvtap: entered promiscuous mode [ 100.672523][ T5878] veth1_vlan: entered promiscuous mode [ 100.692992][ T5872] veth1_macvtap: entered promiscuous mode [ 100.717260][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.744625][ T5870] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 100.765130][ T5880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.795093][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.824425][ T1144] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.835121][ T1144] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.865883][ T5872] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.877579][ T1144] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.927421][ T5878] veth0_macvtap: entered promiscuous mode [ 100.941088][ T1144] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.955566][ T1144] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.016737][ T5878] veth1_macvtap: entered promiscuous mode [ 101.038217][ T1144] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.057111][ T1144] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.084758][ T1144] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.203898][ T5878] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.270609][ T5878] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.315654][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.334372][ T146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.349125][ T146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.366298][ T1040] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.378197][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.387700][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.396319][ T1040] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.424552][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.480869][ T5145] Bluetooth: hci1: command tx timeout [ 101.482387][ T5876] Bluetooth: hci0: command tx timeout [ 101.528584][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.560315][ T5876] Bluetooth: hci2: command tx timeout [ 101.579899][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.635801][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.645032][ T5876] Bluetooth: hci3: command tx timeout [ 101.651348][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.748816][ T1144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.771253][ T1144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.845895][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.855439][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.559813][ T5876] Bluetooth: hci1: command tx timeout [ 103.565279][ T5876] Bluetooth: hci0: command tx timeout [ 103.649193][ T5876] Bluetooth: hci2: command tx timeout [ 103.719991][ T5876] Bluetooth: hci3: command tx timeout [ 104.388703][ T30] audit: type=1800 audit(1843104521.870:2): pid=6053 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="lu_gp_id" dev="configfs" ino=7946 res=0 errno=0 [ 105.066143][ T6077] ima: policy update failed [ 105.090264][ T30] audit: type=1802 audit(1843104522.580:3): pid=6077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.3.81" res=0 errno=0 [ 106.388873][ T6127] random: crng reseeded on system resumption [ 107.821036][ T6173] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 108.747015][ T30] audit: type=1800 audit(1843104526.230:4): pid=6214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.149" name="members" dev="configfs" ino=8890 res=0 errno=0 [ 109.159329][ T5876] Bluetooth: hci3: unexpected event 0x03 length: 123 > 11 [ 109.381315][ T30] audit: type=1800 audit(1843104526.860:5): pid=6239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.161" name="members" dev="configfs" ino=9248 res=0 errno=0 [ 109.597659][ T6247] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 110.539590][ T6283] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 114.031350][ T5876] Bluetooth: hci0: unexpected event 0x1c length: 725 > 5 [ 115.026349][ T6479] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 117.611208][ T5876] Bluetooth: hci2: unexpected event 0x3e length: 358 > 260 [ 117.611612][ T5876] Bluetooth: hci2: unexpected subevent 0x1b length: 357 > 260 [ 118.091237][ T6619] syz.2.351 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 119.657863][ T6698] mmap: syz.3.388 (6698) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 121.575103][ T5876] Bluetooth: hci0: unexpected event 0x32 length: 727 > 9 [ 121.994008][ T6811] nfs: Bad value for 'source' [ 123.974468][ T6911] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 126.729032][ T7041] futex_wake_op: syz.2.557 tries to shift op by -1; fix this program [ 132.951098][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.957652][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.586196][ T5876] Bluetooth: hci1: unexpected subevent 0x0c length: 118 > 5 [ 134.936757][ T5876] Bluetooth: hci0: unexpected event 0x3e length: 720 > 260 [ 135.773430][ T7463] __vm_enough_memory: pid: 7463, comm: syz.0.764, bytes: 4398046511104 not enough memory for the allocation [ 135.970211][ T30] audit: type=1800 audit(4294968336.919:6): pid=7465 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.765" name="dbroot" dev="configfs" ino=12189 res=0 errno=0 [ 139.012926][ T7617] capability: warning: `syz.3.840' uses deprecated v2 capabilities in a way that may be insecure [ 141.691574][ T30] audit: type=1800 audit(4294968342.639:7): pid=7741 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.903" name="version" dev="configfs" ino=13576 res=0 errno=0 [ 144.625939][ T7873] Invalid ELF header magic: != ELF [ 147.144538][ T7989] Invalid ELF header magic: != ELF [ 149.179074][ T8049] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 149.197308][ T8049] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 149.244759][ T8049] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 149.293211][ T8049] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 149.315356][ T8049] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 149.354891][ T8049] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 149.384608][ T8049] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 149.404273][ T8049] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 149.496461][ T8049] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 149.584391][ T8049] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 149.606891][ T8049] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 149.676358][ T8049] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 150.452107][ T5876] Bluetooth: hci0: command 0x0c1a tx timeout [ 151.331614][ T5876] Bluetooth: hci1: command 0x0c1a tx timeout [ 151.411686][ T5876] Bluetooth: hci2: command 0x0c1a tx timeout [ 151.652068][ T5876] Bluetooth: hci3: command 0x0c1a tx timeout [ 151.863444][ T5876] Bluetooth: hci1: unexpected event 0x33 length: 124 > 10 [ 152.531585][ T5876] Bluetooth: hci0: command 0x0c1a tx timeout [ 153.411910][ T5145] Bluetooth: hci1: command 0x0c1a tx timeout [ 153.499250][ T5145] Bluetooth: hci2: command 0x0c1a tx timeout [ 153.531691][ T8225] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 153.583251][ T30] audit: type=1800 audit(4294968354.539:8): pid=8225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1142" name="trace_pipe" dev="tracefs" ino=4287 res=0 errno=0 [ 153.731668][ T5145] Bluetooth: hci3: command 0x0c1a tx timeout [ 153.774738][ T30] audit: type=1326 audit(4294968354.729:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8232 comm="syz.0.1147" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f561699c799 code=0x0 [ 154.316367][ T8252] ======================================================= [ 154.316367][ T8252] WARNING: The mand mount option has been deprecated and [ 154.316367][ T8252] and is ignored by this kernel. Remove the mand [ 154.316367][ T8252] option from the mount to silence this warning. [ 154.316367][ T8252] ======================================================= [ 154.613037][ T5145] Bluetooth: hci0: command 0x0c1a tx timeout [ 155.491655][ T5145] Bluetooth: hci1: command 0x0c1a tx timeout [ 155.577370][ T5145] Bluetooth: hci2: command 0x0c1a tx timeout [ 155.811697][ T5145] Bluetooth: hci3: command 0x0c1a tx timeout [ 156.041979][ T5145] Bluetooth: hci0: unexpected event 0x01 length: 124 > 1 [ 156.118629][ T30] audit: type=1800 audit(4294968357.069:10): pid=8309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1184" name="features" dev="configfs" ino=15075 res=0 errno=0 [ 158.109295][ T8383] capability: warning: `syz.3.1220' uses 32-bit capabilities (legacy support in use) [ 159.432776][ T8441] syz_tun: tun_chr_ioctl cmd 2147767520 [ 160.289681][ T8482] syz.0.1269 (8482): attempted to duplicate a private mapping with mremap. This is not supported. [ 162.791035][ T5145] Bluetooth: hci2: unexpected event 0x3c length: 254 > 7 [ 163.162532][ T8607] ptrace attach of "./syz-executor exec"[5880] was attempted by "./syz-executor exec"[8607] [ 165.286981][ T8707] Unable to find swap-space signature [ 165.801331][ T30] audit: type=1800 audit(4294970414.770:11): pid=8728 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1389" name="trace_pipe" dev="tracefs" ino=4242 res=0 errno=0 [ 167.088170][ T30] audit: type=1800 audit(4294970416.057:12): pid=8792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1421" name="dummy_udc" dev="gadgetfs" ino=7254 res=0 errno=0 [ 169.633581][ T8818] kexec: Could not allocate control_code_buffer [ 169.857512][ T8887] syz_tun: tun_chr_ioctl cmd 2147767507 [ 170.346102][ T8909] can: request_module (can-proto-5) failed. [ 171.594637][ T8970] Unable to find swap-space signature [ 172.096971][ T8995] futex_wake_op: syz.1.1521 tries to shift op by -2048; fix this program [ 172.130914][ T8997] Unable to find swap-space signature [ 174.011666][ T9079] syz.1.1563(9079): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 175.578166][ T9148] ptrace attach of "./syz-executor exec"[5880] was attempted by "./syz-executor exec"[9148] [ 176.453824][ T9183] syz.2.1615 uses obsolete (PF_INET,SOCK_PACKET) [ 176.652757][ T9122] kexec: Could not allocate control_code_buffer [ 177.042880][ T30] audit: type=1800 audit(4294970426.069:13): pid=9214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1627" name="dbroot" dev="configfs" ino=18021 res=0 errno=0 [ 177.086088][ T9214] db_root: cannot open: /dev/audio1 [ 177.091963][ T9214] db_root: not a directory: /dev/audio1 [ 177.311403][ T9222] binder: 9220:9222 ioctl c0306201 0 returned -14 [ 177.566590][ T9232] scsi_strcpy_devinfo: vendor string '/&c~n] | [ 177.566590][ T9232] M' is too long [ 177.586762][ T9232] scsi_strcpy_devinfo: model string 'Dd5 K2b [ 177.586762][ T9232] W ' is too long [ 178.345162][ T9270] bond0: invalid ARP target specified [ 178.848518][ T9294] bond0: invalid ARP target specified [ 179.055189][ T9303] vhci_hcd vhci_hcd.2: invalid port number 16 [ 179.078969][ T9303] vhci_hcd vhci_hcd.2: invalid port number 16 [ 179.307192][ T9316] bond0: invalid ARP target specified [ 181.519338][ T9409] random: crng reseeded on system resumption [ 182.430710][ T9442] usbip-vudc usbip-vudc.0: gadget not bound [ 183.060617][ T9462] binder: 9461:9462 ioctl c0306201 200000000000 returned -14 [ 183.425731][ T9475] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 183.427943][ T9476] : Can't lookup blockdev [ 184.434955][ T9515] vhci_hcd vhci_hcd.2: invalid port number 0 [ 185.965606][ T9586] i2c i2c-0: new_device: Invalid device name [ 187.011136][ T9631] kafs: addr_prefs: Invalid Command [ 187.168758][ T9640] QAT: Invalid ioctl 21531 [ 189.104055][ T9721] warning: `syz.3.1871' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 189.311568][ T9734] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 189.922175][ T9762] [U]  [ 190.397832][ T9787] random: crng reseeded on system resumption [ 191.304435][ T9822] ACPI: \_SB_.LNKS: No IRQ available. Try pci=noacpi or acpi=off [ 191.313958][ T9822] pci 0000:00:01.3: PCI INT A: no GSI [ 191.478739][ T5145] Bluetooth: hci3: unexpected event 0x14 length: 16 > 6 [ 191.822913][ T9846] block2mtd: Using custom MTD label '' for dev [ 191.823314][ T9846] block2mtd: error: cannot open device [ 192.160978][ T9857] block2mtd: illegal erase size [ 192.615794][ T9867] smpboot: CPU 1 is now offline [ 194.214305][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.220805][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.597035][T10116] kAFS: Invalid Command on /proc/fs/afs/cells file [ 201.475712][T10142] vhci_hcd vhci_hcd.2: invalid port number 253 [ 201.501104][T10142] vhci_hcd vhci_hcd.2: USB_PORT_FEAT_U1/2_TIMEOUT req not supported for USB 2.0 roothub [ 203.264112][T10194] cougar: G6 mapped to F18 [ 204.457001][T10234] block loop4: the capability attribute has been deprecated. [ 206.071866][T10287] unchecked MSR access error: WRMSR to 0x418 (tried to write 0x0000000000000322) at rIP: 0xffffffff81b1221a (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 206.087633][T10287] Call Trace: [ 206.090928][T10287] [ 206.093874][T10287] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 206.100618][T10287] ? __pfx_debug_object_deactivate+0x10/0x10 [ 206.106629][T10287] mce_cpu_restart+0xd5/0x1f0 [ 206.111338][T10287] ? __pfx_mce_cpu_restart+0x10/0x10 [ 206.116652][T10287] smp_call_function_many_cond+0x11fc/0x1500 [ 206.122664][T10287] ? __pfx_mce_cpu_restart+0x10/0x10 [ 206.127978][T10287] ? mark_held_locks+0x40/0x70 [ 206.132764][T10287] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 206.138596][T10287] ? lockdep_hardirqs_on+0x78/0x100 [ 206.143819][T10287] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 206.149651][T10287] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 206.155998][T10287] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 206.162000][T10287] ? __timer_delete_sync+0x151/0x1c0 [ 206.167305][T10287] ? __pfx_mce_cpu_restart+0x10/0x10 [ 206.172639][T10287] on_each_cpu_cond_mask+0x40/0x90 [ 206.177770][T10287] set_bank+0x240/0x3a0 [ 206.181953][T10287] ? __pfx_set_bank+0x10/0x10 [ 206.186740][T10287] ? find_held_lock+0x2b/0x80 [ 206.191439][T10287] ? sysfs_file_kobj+0xe4/0x290 [ 206.196327][T10287] ? sysfs_file_kobj+0xe4/0x290 [ 206.201224][T10287] ? __pfx_set_bank+0x10/0x10 [ 206.205944][T10287] dev_attr_store+0x58/0x80 [ 206.210482][T10287] ? __pfx_dev_attr_store+0x10/0x10 [ 206.215710][T10287] sysfs_kf_write+0xf2/0x150 [ 206.220333][T10287] kernfs_fop_write_iter+0x3e0/0x5f0 [ 206.225668][T10287] ? __pfx_sysfs_kf_write+0x10/0x10 [ 206.230896][T10287] vfs_write+0x6ac/0x1070 [ 206.235384][T10287] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 206.241216][T10287] ? __pfx_vfs_write+0x10/0x10 [ 206.246015][T10287] ksys_write+0x12a/0x250 [ 206.250365][T10287] ? __pfx_ksys_write+0x10/0x10 [ 206.255247][T10287] do_syscall_64+0x106/0xf80 [ 206.259875][T10287] ? clear_bhb_loop+0x40/0x90 [ 206.264576][T10287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.270491][T10287] RIP: 0033:0x7f680db9c799 [ 206.274930][T10287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.294550][T10287] RSP: 002b:00007f680eaa6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 206.303005][T10287] RAX: ffffffffffffffda RBX: 00007f680de15fa0 RCX: 00007f680db9c799 [ 206.311001][T10287] RDX: 0000000000000003 RSI: 0000200000000240 RDI: 0000000000000003 [ 206.318983][T10287] RBP: 00007f680dc32c99 R08: 0000000000000000 R09: 0000000000000000 [ 206.326968][T10287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 206.334948][T10287] R13: 00007f680de16038 R14: 00007f680de15fa0 R15: 00007ffd90c94e58 [ 206.342952][T10287] [ 210.246867][T10395] Format for unlinking a device is "netnsfd:ifidx" (int uint). [ 210.818088][T10412] nvme_fcloop: unknown parameter or missing value '1' [ 211.683765][T10439] block2mtd: error: cannot open device inX±jFBB>U;߸Ilk [ 213.412673][T10068] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 215.193305][T10484] Bluetooth: hci0: unexpected event 0x3e length: 726 > 260 [ 215.193338][T10484] Bluetooth: hci0: unexpected subevent 0x0e length: 725 > 15 [ 215.209233][T10484] Bluetooth: hci0: Unable to find connection for dst 00:a2:f2:94:be:c8 sid 0x4f [ 215.459745][T10484] Bluetooth: hci1: command 0x0c1a tx timeout [ 217.333821][ T30] audit: type=1326 audit(4294970466.568:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10598 comm="syz.1.2293" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f680db9c799 code=0x0 [ 217.529113][T10068] Bluetooth: hci1: command 0x0c1a tx timeout [ 217.866908][T10610] usb usb13: check_ctrlrecip: process 10610 (syz.3.2299) requesting ep 01 but needs 81 [ 217.899678][T10610] usb usb13: usbfs: process 10610 (syz.3.2299) did not claim interface 0 before use [ 220.174633][T10667] tipc: Can't bind to reserved service type 1 [ 221.720225][T10484] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 223.113710][T10751] block2mtd: illegal erase size [ 223.508229][T10761] kernel read not supported for file /\*)A (pid: 10761 comm: syz.3.2373) [ 223.526285][ T30] audit: type=1800 audit(4294970472.781:15): pid=10761 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2373" name="\*)A" dev="mqueue" ino=23284 res=0 errno=0 [ 223.737683][T10068] Bluetooth: hci0: command 0x0c1a tx timeout [ 224.395203][T10787] Malformed UNC in devname [ 224.395203][T10787] [ 224.401969][T10787] CIFS: VFS: Malformed UNC in devname [ 225.343796][T10484] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 225.807426][T10816] Bluetooth: hci0: command 0x0c1a tx timeout [ 227.398223][T10068] Bluetooth: hci3: command 0x0c1a tx timeout [ 228.236937][T10068] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 229.479179][T10816] Bluetooth: hci3: command 0x0c1a tx timeout [ 230.124807][ T30] audit: type=1400 audit(4294970479.425:16): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=10940 comm="syz.3.2460" [ 230.263867][T10484] Bluetooth: hci2: command 0x0c1a tx timeout [ 231.318473][T10977] random: crng reseeded on system resumption [ 232.219852][T11001] delete_channel: no stack [ 232.333650][T10484] Bluetooth: hci2: command 0x0c1a tx timeout [ 233.863633][T11057] sysfs_service_op_show: Client not running :-5: [ 235.606653][T11107] kAFS: Invalid Command on /proc/fs/afs/cells file [ 236.490941][T11137] kafs: addr_prefs: Invalid Command [ 238.618771][T11205] wlan1: mtu less than device minimum [ 238.935463][T11217] bond0: no command found in slaves file - use +ifname or -ifname [ 239.648350][T11236] synth uevent: /bus/hid/drivers/zeroplus: unknown uevent action string [ 242.709881][T11338] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(12) [ 243.016688][T11347] Format for deleting device is "id" (uint). [ 247.891029][ T30] audit: type=1400 audit(4294970497.277:17): apparmor="DENIED" operation="setprocattr" info="current" error=-22 profile="unconfined" pid=11503 comm="syz.1.2735" [ 249.103550][T11541] Debayer A: ================= START STATUS ================= [ 249.136940][T11541] Debayer A: Debayer Mean Window Size: 3 [ 249.142906][T11541] Debayer A: ================== END STATUS ================== [ 249.845446][T11566] vhci_hcd vhci_hcd.2: USB_PORT_FEAT_BH_PORT_RESET req not supported for USB 2.0 roothub [ 250.249459][T11578] ubi31: attaching mtd0 [ 250.295223][T11578] ubi31: scanning is finished [ 250.321700][T11578] ubi31 error: ubi_read_volume_table: the layout volume was not found [ 250.652163][T11578] ubi31 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 254.259980][ T30] audit: type=1800 audit(4294970503.690:18): pid=11706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2832" name="dbroot" dev="configfs" ino=26379 res=0 errno=0 [ 254.741532][T11718] : Can't lookup blockdev [ 255.338578][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.344982][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.413463][T11807] WARNING! power/level is deprecated; use power/control instead [ 262.724799][T11977] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 262.785759][T11981] bonding: no command found in bonding_masters - use +ifname or -ifname [ 262.867450][T11977] CIFS mount error: No usable UNC path provided in device string! [ 262.867450][T11977] [ 262.937030][T11977] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 264.756929][T12039] uvcvideo: [Deprecated]: nodrop parameter will be eventually removed. [ 265.492695][T12062] syz.0.3005: vmalloc error: size 18446744073709551615, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 265.569354][T12062] CPU: 0 UID: 0 PID: 12062 Comm: syz.0.3005 Not tainted syzkaller #0 PREEMPT(full) [ 265.569395][T12062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 265.569422][T12062] Call Trace: [ 265.569430][T12062] [ 265.569439][T12062] dump_stack_lvl+0x100/0x190 [ 265.569509][T12062] warn_alloc.cold+0x95/0x1c1 [ 265.569588][T12062] ? __pfx_warn_alloc+0x10/0x10 [ 265.569648][T12062] ? __lock_acquire+0x4a5/0x2630 [ 265.569711][T12062] __vmalloc_node_range_noprof+0x1252/0x1530 [ 265.569747][T12062] ? rcu_is_watching+0x12/0xc0 [ 265.569797][T12062] ? trace_contention_end+0x140/0x180 [ 265.569834][T12062] ? dvb_dvr_do_ioctl+0x15d/0x270 [ 265.569930][T12062] ? dvb_dvr_do_ioctl+0x7e/0x270 [ 265.569954][T12062] ? tomoyo_path_number_perm+0x28f/0x580 [ 265.570040][T12062] ? tomoyo_path_number_perm+0x28f/0x580 [ 265.570071][T12062] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 265.570104][T12062] ? __pfx___mutex_lock+0x10/0x10 [ 265.570218][T12062] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 265.570246][T12062] ? futex_wake+0x1ad/0x530 [ 265.570294][T12062] ? dvb_dvr_do_ioctl+0x15d/0x270 [ 265.570319][T12062] __vmalloc_node_noprof+0xad/0xf0 [ 265.570351][T12062] ? dvb_dvr_do_ioctl+0x15d/0x270 [ 265.570383][T12062] dvb_dvr_do_ioctl+0x15d/0x270 [ 265.570414][T12062] dvb_usercopy+0x167/0x340 [ 265.570437][T12062] ? __pfx_dvb_dvr_do_ioctl+0x10/0x10 [ 265.570464][T12062] ? __pfx_dvb_usercopy+0x10/0x10 [ 265.570499][T12062] ? __fget_files+0x21f/0x3d0 [ 265.570539][T12062] dvb_dvr_ioctl+0x29/0x40 [ 265.570572][T12062] ? __pfx_dvb_dvr_ioctl+0x10/0x10 [ 265.570597][T12062] __x64_sys_ioctl+0x18e/0x210 [ 265.570646][T12062] do_syscall_64+0x106/0xf80 [ 265.570701][T12062] ? clear_bhb_loop+0x40/0x90 [ 265.570732][T12062] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.570761][T12062] RIP: 0033:0x7f561699c799 [ 265.570781][T12062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.570804][T12062] RSP: 002b:00007f5614bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 265.570832][T12062] RAX: ffffffffffffffda RBX: 00007f5616c15fa0 RCX: 00007f561699c799 [ 265.570848][T12062] RDX: ffffffffffffffff RSI: 0000000000006f2d RDI: 0000000000000003 [ 265.570863][T12062] RBP: 00007f5616a32c99 R08: 0000000000000000 R09: 0000000000000000 [ 265.570878][T12062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 265.570892][T12062] R13: 00007f5616c16038 R14: 00007f5616c15fa0 R15: 00007fff80dd31e8 [ 265.570924][T12062] [ 265.577945][T12062] Mem-Info: [ 266.777658][T12062] active_anon:10077 inactive_anon:9 isolated_anon:0 [ 266.777658][T12062] active_file:11348 inactive_file:43381 isolated_file:0 [ 266.777658][T12062] unevictable:768 dirty:194 writeback:0 [ 266.777658][T12062] slab_reclaimable:10697 slab_unreclaimable:91492 [ 266.777658][T12062] mapped:28579 shmem:6092 pagetables:1164 [ 266.777658][T12062] sec_pagetables:0 bounce:0 [ 266.777658][T12062] kernel_misc_reclaimable:0 [ 266.777658][T12062] free:1328325 free_pcp:13484 free_cma:0 [ 267.017215][T12062] Node 0 active_anon:42180kB inactive_anon:36kB active_file:45332kB inactive_file:173320kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116080kB dirty:776kB writeback:0kB shmem:24600kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11008kB pagetables:4632kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 267.214526][T12062] Node 1 active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:56kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 267.378410][T12062] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 267.537124][T12062] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 267.580930][T12062] Node 0 DMA32 free:1378528kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB free_highatomic:0KB active_anon:45496kB inactive_anon:36kB active_file:45332kB inactive_file:173320kB unevictable:1536kB writepending:820kB zspages:0kB present:3129332kB managed:2537344kB mlocked:0kB bounce:0kB free_pcp:26124kB local_pcp:26124kB free_cma:0kB [ 267.769239][T12062] lowmem_reserve[]: 0 0 1 1 1 [ 267.774005][T12062] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1056kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 267.955445][T12062] lowmem_reserve[]: 0 0 0 0 0 [ 268.001516][T12062] Node 1 Normal free:3914112kB boost:0kB min:55580kB low:69472kB high:83364kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:60kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:27968kB local_pcp:27968kB free_cma:0kB [ 268.185571][T12062] lowmem_reserve[]: 0 0 0 0 0 [ 268.203094][T12062] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 268.280258][T12062] Node 0 DMA32: 3047*4kB (UE) 1765*8kB (UE) 751*16kB (UM) 299*32kB (UME) 291*64kB (UM) 177*128kB (UME) 91*256kB (UM) 40*512kB (UM) 19*1024kB (UM) 2*2048kB (UM) 297*4096kB (UM) = 1373012kB [ 268.394451][T12062] Node 0 Normal: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 268.454504][T12062] Node 1 Normal: 6*4kB (UM) 9*8kB (UM) 16*16kB (UM) 13*32kB (UM) 8*64kB (U) 5*128kB (UM) 6*256kB (UM) 6*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 952*4096kB (UM) = 3914112kB [ 268.540441][T12062] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 268.583690][T12062] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 268.625621][T12062] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 268.683000][T12062] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 268.752906][T12062] 64290 total pagecache pages [ 268.772511][T12062] 0 pages in swap cache [ 268.791279][T12062] Free swap = 124996kB [ 268.827315][T12062] Total swap = 124996kB [ 268.842154][T12062] 2097051 pages RAM [ 268.856191][T12062] 0 pages HighMem/MovableOnly [ 268.891865][T12062] 430836 pages reserved [ 268.911772][T12062] 0 pages cma reserved [ 269.463788][ T30] audit: type=1800 audit(4294970518.969:19): pid=12152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3050" name="discovery_nqn" dev="configfs" ino=27810 res=0 errno=0 [ 270.603156][T12184] pci 0000:00:00.0: MSI/MSI-X allowed for future drivers [ 270.703940][ T30] audit: type=1807 audit(4294970520.206:20): UNKNOWN=0"]$|1j0B|dӉO+/xWӦ^gq%ḦrO res=0 [ 270.723069][T12185] ima: policy update failed [ 270.784903][ T30] audit: type=1802 audit(4294970520.236:21): pid=12186 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.1.3067" res=0 errno=0 [ 270.919954][ T30] audit: type=1802 audit(4294970520.236:22): pid=12185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.3067" res=0 errno=0 [ 271.412932][T12202] queue_state_write: operation too long [ 271.512250][T12202] queue_state_write: use 'run', 'start' or 'kick' [ 271.570365][T12208] usb usb13: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 271.892404][T12214] program syz.1.3081 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 275.577163][T12323] program syz.1.3133 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 277.364466][T12379] syz_tun: tun_chr_ioctl cmd 2147767521 [ 278.099488][T12402] scsi_dev_info_list_add_str: bad dev info string ')zD 5fk+*X#R84*VsndvqQW}~YrȀ-8VGDƘLB%v†v}Ypq|?O[,! 7xWDr%[}E$3?G9Ff=lrGH;2L<=|8 -c Fո"[v9q4Mmvqk[(iNDСMX PSqqX4X`V!;r֍)y]WzfIH0,v{q8שUܹ䑉m؛HTwCz-nR%2]x05oՕ|3>lS*L/Cdgӑ[C=Cwem)l#' ''S.sHgi-TY%ܹF*8nFTH?i{' '' [ 278.690998][T12418] Setting dangerous option i915.mitigations - tainting kernel [ 278.762665][T12419] usb usb13: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 278.931521][ T30] audit: type=1800 audit(4294970528.479:23): pid=12423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3174" name="lu_gp_id" dev="configfs" ino=28605 res=0 errno=0 [ 278.973234][T12423] ALUA LU Group already has a valid ID, ignoring request [ 279.559500][T12444] QAT: failed to copy from user cfg_data. [ 282.588913][T12533] [U] ^Z [ 282.836497][T12540] vhci_hcd vhci_hcd.1: default hub control req: 0000 v0000 i0000 l0 [ 283.151236][T12554] nfsd: Unknown parameter 'ԣ' [ 283.437574][T12562] kAFS: No cell specified [ 284.239099][T12590] program syz.3.3256 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 286.370796][T12659] ptrace attach of "./syz-executor exec"[5880] was attempted by "./syz-executor exec"[12659] [ 286.572821][T12664] ecryptfs_miscdev_write: Acceptable packet size range is [6-531], but amount of data written is [1]. [ 286.869190][T12673] cifs: Unknown parameter 'no+ 1`rsFn)aHāh`9kA}1\D@.ZCg^' [ 287.390622][ T30] audit: type=1800 audit(4294970536.983:24): pid=12690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3306" name="version" dev="configfs" ino=29460 res=0 errno=0 [ 291.782328][T12831] QAT: failed to copy from user cfg_data. [ 292.237054][T12844] aoe: invalid device specification [ 292.517198][T12853] deleting an unspecified loop device is not supported. [ 295.833108][T12963] program syz.2.3441 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 295.910641][T12963] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 295.948070][T12967] cougar: G6 mapped to space [ 296.907915][T12999] ima: Unable to open file: /suritRy/integrity?iqa/policy (-2) [ 296.908323][T12998] ima: policy update failed [ 296.989078][ T30] audit: type=1802 audit(4294970546.612:25): pid=12998 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.3.3459" res=0 errno=0 [ 298.428500][T13059] random: crng reseeded on system resumption [ 299.813837][T13116] ptp ptp0: only physical clock in use now [ 304.382082][T13304] ecryptfs_miscdev_write: Error while inspecting packet size [ 305.322530][T13342] scsi_dev_info_list_add_str: bad dev info string '' '' '' [ 306.604207][T13397] qrtr: Invalid version 0 [ 307.468722][T13432] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 308.348886][T13465] phram: not enough arguments [ 311.371398][T13576] mmap: syz.1.3684 (13576): VmData 45879296 exceed data ulimit 3. Update limits or use boot option ignore_rlimit_data. [ 312.333986][T13614] bond0: invalid ARP target specified [ 312.666703][T13630] kmem.tcp.limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 316.461261][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.469065][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.415705][T13813] ecryptfs_miscdev_response: (sizeof(*msg) + msg->data_len) = [1067213646]; data_size = [146]. Invalid packet. [ 317.460565][T13813] ecryptfs_miscdev_write: Failed to deliver miscdev response to requesting operation; rc = [-22] [ 318.483009][T13860] sd 0:0:1:0: PR command failed: 1026 [ 318.502860][T13860] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 318.533165][T13860] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 322.701212][T13987] syz_tun: tun_chr_ioctl cmd 1074025676 [ 322.739073][T13987] syz_tun: owner set to 111 [ 333.630015][T14298] [ 334.764987][T14341] bond0: option packets_per_slave: invalid value ( Xnp) [ 334.813996][T14341] bond0: option packets_per_slave: allowed values 0 - 65535 [ 335.527728][T14363] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x18000 [ 335.550088][T14363] flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) [ 335.600137][T14363] raw: 00fff00000002000 ffffea0000600008 ffffea0000600008 0000000000000000 [ 335.658646][T14363] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 335.714812][T14363] page dumped because: unmovable page [ 335.757945][T14363] page_owner info is not present (never set?) [ 341.295152][T14582] CIFS mount error: No usable UNC path provided in device string! [ 341.295152][T14582] [ 341.375093][T14582] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 342.069012][ T30] audit: type=1800 audit(4294970591.947:26): pid=14611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.4059" name="members" dev="configfs" ino=34360 res=0 errno=0 [ 345.765649][T14746] bdi 43:192: the stable_pages_required attribute has been removed. Use the stable_writes queue attribute instead. [ 345.824540][T14748] i8042 aux 00:02: in use; can't configure [ 348.176226][ T5918] Process accounting resumed [ 349.468046][T14896] random: crng reseeded on system resumption [ 350.240982][T14928] ptrace attach of "./syz-executor exec"[5880] was attempted by ""[14928] [ 350.904158][T14949] syz.2.4172 (14949): drop_caches: 0 [ 354.151939][T15075] delete_channel: no stack [ 364.318417][T15447] < [ 364.551988][T15455] bcache: register_bcache() error : Not a bcache superblock (bad offset) [ 368.743377][T15567] nvme_fcloop: unknown parameter or missing value '7' [ 371.049857][T15643] usb usb24: usbfs: process 15643 (syz.3.4438) did not claim interface 0 before use [ 372.615788][ T30] audit: type=1800 audit(4294970622.656:27): pid=15687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.4455" name="dbroot" dev="configfs" ino=36947 res=0 errno=0 [ 373.338805][T15710] udc dummy_udc.0: soft-connect without a gadget driver [ 374.292316][T15747] usb usb36: usbfs: process 15747 (syz.3.4479) did not claim interface 0 before use [ 376.466349][T15837] Line length is too long: Should be less than 4094 [ 377.585602][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.592616][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.141133][T15901] futex_wake_op: syz.0.4539 tries to shift op by -2048; fix this program [ 378.184761][T15901] futex_wake_op: syz.0.4539 tries to shift op by -2048; fix this program [ 378.966331][T15930] ima: Unable to open file: /sys/kernel/security/integrity/ima/policy (-26) [ 378.966887][T15928] ima: policy update failed [ 379.034691][ T30] audit: type=1802 audit(4294970629.109:28): pid=15928 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.1.4550" res=0 errno=0 [ 382.846846][T16088] ecryptfs_miscdev_write: Minimum acceptable packet size is [14], but amount of data written is only [5]. Discarding response packet. [ 383.260767][T16100] vhci_hcd vhci_hcd.2: invalid port number 194 [ 383.303923][T16100] vhci_hcd vhci_hcd.2: invalid port number 194 [ 383.849637][T16124] sd 0:0:1:0: PR command failed: 1026 [ 383.883610][T16124] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 383.924733][T16124] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 384.968390][T16169] vhci_hcd vhci_hcd.2: USB_PORT_FEAT_U1/2_TIMEOUT req not supported for USB 2.0 roothub [ 385.921781][T16209] program syz.1.4658 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 388.455038][ T30] audit: type=1800 audit(4294970638.558:29): pid=16296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.4695" name="dbroot" dev="configfs" ino=38502 res=0 errno=0 [ 389.337814][T16333] ICMPv6: process `syz.3.4710' is using deprecated sysctl (syscall) net.ipv6.neigh.wg1.retrans_time - use net.ipv6.neigh.wg1.retrans_time_ms instead [ 390.315339][T16361] zswap: compressor - not available [ 394.354337][T16496] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.289549][T16593] batman_adv: Routing algorithm '7' is not supported [ 397.491282][T16625] block2mtd: parameter too long [ 397.928297][T16638] i2c i2c-0: new_device: Can't parse I2C address [ 399.247546][T16672] : Can't lookup blockdev [ 400.060743][T16696] bcache: register_bcache() error : failed to open device [ 400.273352][ T30] audit: type=1800 audit(4294967304.370:30): pid=16702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4857" name="members" dev="configfs" ino=39548 res=0 errno=0 [ 401.111539][T16676] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 403.163779][T16792] ubi0: attaching mtd0 [ 403.172491][T16792] ubi0 error: ubi_attach_mtd_dev: bad VID header (63) or data offsets (127) [ 405.313599][T10068] Bluetooth: hci0: unexpected event 0x3e length: 0 < 1 [ 405.946562][T16862] QAT: failed to copy from user. [ 406.164925][T16865] delete_channel: no stack [ 408.959197][T16933] nvme_fcloop: unknown parameter or missing value '0' [ 411.403915][T17005] i2c i2c-0: delete_device: Can't parse I2C address [ 413.538116][T17075] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input24 [ 415.495561][T17149] sctp: Changing rto_alpha or rto_beta may lead to suboptimal rtt/srtt estimations! [ 419.129817][T10068] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 419.328408][T17266] kafs: addr_prefs: Too many elements in string [ 419.647176][ T30] audit: type=1800 audit(4294967323.841:31): pid=17273 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.5108" name="lu_gp_id" dev="configfs" ino=41186 res=0 errno=0 [ 420.523821][T17303] random: crng reseeded on system resumption [ 421.195164][T10484] Bluetooth: hci1: command 0x0c1a tx timeout [ 421.404180][T17326] vivid-007: ================= START STATUS ================= [ 421.455726][T17326] vivid-007: Generate PTS: true [ 421.487981][T17326] vivid-007: Generate SCR: true [ 421.525633][T17326] tpg source WxH: 320x240 (Y'CbCr) [ 421.562851][T17326] tpg field: 1 [ 421.580844][T17326] tpg crop: (0,0)/320x240 [ 421.610488][T17326] tpg compose: (0,0)/320x240 [ 421.644948][T17326] tpg colorspace: 8 [ 421.671113][T17326] tpg transfer function: 0/0 [ 421.687880][T17326] tpg Y'CbCr encoding: 0/0 [ 421.705482][T17326] tpg quantization: 0/0 [ 421.747235][T17326] tpg RGB range: 0/2 [ 421.757799][T17326] vivid-007: ================== END STATUS ================== [ 421.881803][T17338] writes to the poll attribute are ignored. [ 421.920459][T17338] please use driver specific parameters instead. [ 423.261059][T10068] Bluetooth: hci1: command 0x0c1a tx timeout [ 423.788273][T17396] process 'syz.1.5154' launched './file0' with NULL argv: empty string added [ 424.403240][ T9] ================================================================== [ 424.403282][ T9] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x19fb/0x1d60 [ 424.403405][ T9] Write of size 8 at addr ffffc90004239000 by task kworker/0:0/9 [ 424.403423][ T9] [ 424.403445][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G U syzkaller #0 PREEMPT(full) [ 424.403476][ T9] Tainted: [U]=USER [ 424.403484][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 424.403499][ T9] Workqueue: events_power_efficient fb_flashcursor [ 424.403524][ T9] Call Trace: [ 424.403531][ T9] [ 424.403540][ T9] dump_stack_lvl+0x100/0x190 [ 424.403577][ T9] print_report+0x156/0x4c9 [ 424.403610][ T9] ? _raw_spin_lock_irqsave+0x52/0x60 [ 424.403673][ T9] ? __virt_addr_valid+0x81/0x620 [ 424.403718][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 424.403750][ T9] kasan_report+0xdf/0x1e0 [ 424.403777][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 424.403814][ T9] sys_imageblit+0x19fb/0x1d60 [ 424.403852][ T9] ? __pfx_sys_imageblit+0x10/0x10 [ 424.403897][ T9] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 424.403960][ T9] soft_cursor+0x524/0xa10 [ 424.403993][ T9] bit_cursor+0xe58/0x16f0 [ 424.404024][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 424.404056][ T9] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 424.404086][ T9] ? get_color+0x1da/0x450 [ 424.404108][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 424.404134][ T9] fb_flashcursor+0x338/0x430 [ 424.404157][ T9] process_one_work+0xa23/0x19a0 [ 424.404203][ T9] ? __pfx_process_one_work+0x10/0x10 [ 424.404242][ T9] ? __pfx_fb_flashcursor+0x10/0x10 [ 424.404266][ T9] worker_thread+0x5ef/0xe50 [ 424.404304][ T9] ? kthread+0x13a/0x450 [ 424.404334][ T9] ? __pfx_worker_thread+0x10/0x10 [ 424.404367][ T9] kthread+0x370/0x450 [ 424.404397][ T9] ? __pfx_kthread+0x10/0x10 [ 424.404428][ T9] ret_from_fork+0x754/0xd80 [ 424.404472][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 424.404508][ T9] ? __switch_to+0x7b4/0x1120 [ 424.404534][ T9] ? __pfx_kthread+0x10/0x10 [ 424.404565][ T9] ret_from_fork_asm+0x1a/0x30 [ 424.404598][ T9] [ 424.404606][ T9] [ 424.404612][ T9] The buggy address belongs to a vmalloc virtual mapping [ 424.404628][ T9] Memory state around the buggy address: [ 424.404640][ T9] ffffc90004238f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 424.404656][ T9] ffffc90004238f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 424.404672][ T9] >ffffc90004239000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 424.404685][ T9] ^ [ 424.404696][ T9] ffffc90004239080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 424.404712][ T9] ffffc90004239100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 424.404725][ T9] ================================================================== [ 424.404744][ T9] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 424.404761][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G U syzkaller #0 PREEMPT(full) [ 424.404792][ T9] Tainted: [U]=USER [ 424.404799][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 424.404814][ T9] Workqueue: events_power_efficient fb_flashcursor [ 424.404836][ T9] Call Trace: [ 424.404843][ T9] [ 424.404851][ T9] dump_stack_lvl+0x100/0x190 [ 424.404890][ T9] vpanic+0x552/0x970 [ 424.404912][ T9] ? __pfx_vpanic+0x10/0x10 [ 424.404933][ T9] ? __pfx_vprintk_emit+0x10/0x10 [ 424.404960][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 424.404993][ T9] panic+0xd1/0xe0 [ 424.405013][ T9] ? __pfx_panic+0x10/0x10 [ 424.405039][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 424.405072][ T9] ? check_panic_on_warn+0x1f/0x90 [ 424.405107][ T9] check_panic_on_warn.cold+0x19/0x34 [ 424.405132][ T9] end_report.part.0+0x3a/0x90 [ 424.405164][ T9] kasan_report.cold+0xe/0x18 [ 424.405198][ T9] ? sys_imageblit+0x19fb/0x1d60 [ 424.405235][ T9] sys_imageblit+0x19fb/0x1d60 [ 424.405273][ T9] ? __pfx_sys_imageblit+0x10/0x10 [ 424.405313][ T9] drm_fbdev_shmem_defio_imageblit+0x20/0x130 [ 424.405339][ T9] soft_cursor+0x524/0xa10 [ 424.405372][ T9] bit_cursor+0xe58/0x16f0 [ 424.405403][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 424.405436][ T9] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 424.405460][ T9] ? get_color+0x1da/0x450 [ 424.405482][ T9] ? __pfx_bit_cursor+0x10/0x10 [ 424.405509][ T9] fb_flashcursor+0x338/0x430 [ 424.405533][ T9] process_one_work+0xa23/0x19a0 [ 424.405573][ T9] ? __pfx_process_one_work+0x10/0x10 [ 424.405612][ T9] ? __pfx_fb_flashcursor+0x10/0x10 [ 424.405637][ T9] worker_thread+0x5ef/0xe50 [ 424.405676][ T9] ? kthread+0x13a/0x450 [ 424.405706][ T9] ? __pfx_worker_thread+0x10/0x10 [ 424.405739][ T9] kthread+0x370/0x450 [ 424.405769][ T9] ? __pfx_kthread+0x10/0x10 [ 424.405801][ T9] ret_from_fork+0x754/0xd80 [ 424.405836][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 424.405872][ T9] ? __switch_to+0x7b4/0x1120 [ 424.405903][ T9] ? __pfx_kthread+0x10/0x10 [ 424.405935][ T9] ret_from_fork_asm+0x1a/0x30 [ 424.405968][ T9] [ 424.406039][ T9] Kernel Offset: disabled