last executing test programs: 12.960600198s ago: executing program 3 (id=3740): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) preadv2$auto(r0, &(0x7f00000002c0)={0x0, 0x80000000}, 0x6, 0x3, 0x41, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x20c400, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, &(0x7f0000000080)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x86\xdde\x1cJ\x99\x00\x00/\x00\x00\x00\xfd\xfdX\xd3\x1d\xf8\xbebZ\xddL\x01\x00\x00\x00^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x88\v\xae\xa9i8W\xe5\x00!\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xa2E\xd8?\'\x8dg\x81K*&\xab\xaf\x94\x90\xd7\xa6+,\xc3\xc2g\x01JZ\xbb*\xb5\xa1;0\x81\x11\x9a?g`sFh\x00\x00,,\x93\xba\x88\x93\xc6#\xe5\xaae\x9d\xb6\x1a\x7f\xc0%\xb0\rfOJ+\x02\x9b#)\x9b\x17\x82\xd7\xee\xd1\xbf2[\xd0\xbdn\x1d\x00\xeb]B\xa0\x99\xb0R\xb4J}\xa8\xa1\x84]F\xe0\x83/\xc0\xd8\x05f_\xfa\x19\a\x00\xf1\x12lwU&[\xde?\xde8\xf7\xc1\xa6\xf2\xc1\"\xact\xee\xc9\x00'/232, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) madvise$auto(0x6, 0x4, 0x3) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/tracing/events/vmalloc/filter\x00', 0xc54748b24ee604b7, 0x0) mq_timedsend$auto(r2, &(0x7f0000000300)=').,\r^[\x00\x16Bo\x9e$\xb5\xf4', 0x3ff, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) r3 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/overcommit_ratio\x00', 0x202, 0x0) sendfile$auto(r3, 0x3, 0x0, 0x7ffff000) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/module/bareudp/uevent\x00', 0x6f8363, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r4, &(0x7f0000000000)="b40c25", 0x3) sysfs$auto(0x2, 0x3b, 0x0) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) ioctl$auto_UI_SET_PROPBIT(r2, 0x4004556e, &(0x7f00000001c0)=0x6) write$auto_kernfs_file_fops_kernfs_internal(r5, &(0x7f0000000440)="8056ab37e673a484bf472959f1195cf318e0a1b98e62f21c3967416bd058f3012cfa068481b0f394c17a17674d3d71db1b9fd587e89289c5356684939e0ef7aea2ad79278df0f43e6bb52fef726e8705bda4b9fffb7be3c8992ecdeac300a7896e25000000000000e4dfc08a118ce426a525ecf2b14bee3f0716856ae96fdf1ae574157b9f910bbb9c6057f50864edd8eb801c8d67cce377614e1c56ceec3cbde0fd22b9965f74e5ed73813a61f785dde0670f2b1ad3cb739acedcec010e077ac62a01fd515f085ebd7eccd140a7d74d4a0a034e19ca6db68804719e4a367837d5d10aab1cd5be068abc42cdb5af6dbc04c2d620ec295045bfab81d7de481152ff152b160f76b1c271e789f2ceb8e8825825e35eff6e666116107552ace3369caee7fafdac65dda7b0e4913165f5885011095c821c60d5e23b3291425ffe17c3ba0fa10821385445d09d8737e8d9b0", 0x14f) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 12.66931483s ago: executing program 1 (id=3741): landlock_restrict_self$auto(0xffffffffffffffff, 0x7) r0 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000040), 0x42001, 0x0) ioctl$auto(r0, 0xc0bc5310, 0x38) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) pread64$auto(0xffffffffffffffff, 0x0, 0x4, 0x3a) unshare$auto(0x40000080) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) pwrite64$auto(0xc8, &(0x7f0000000600)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x00\rBBJ\x99\x00:c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x99\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xb3\x9c2\xa2\xacyl\xb8\x00Y\xc8\'\xb6S(\xf2\xc2\xf2\x9dP\b\x88J\xae8\xf9>\xb6\xed\xb5/\xc9\xaa\xd8\xc4\xba\x94\xe6jv\x12Bp+\xb8\x16\x19kw\xbc\xbb5-i\xf0\xb9\xac\x9f&6\x89g\x9bh\x83D\xb3\x9fxe\x13\xd1\xb9\xe4\x7f|a\xf2\xdd\xa0\xfb\xfau-7\x94\x13\xa8\xec\xf6~\xacV\xa2S)\xc2\xce\x9b{+\x9ct2>\x98D\t\xc5HP\xc4\xb7\x84\xda*\x82)\x01\xd1\f\x1e\xd4\x8d0K\xa8\xd6\xa1\xa7\xd8VP\xfd\x19\x1cd\x84\xe7\xc6#\x9c\xdd\x88\xf9\x128\x0e\xe2\n\xd3\xd33\x01\xda\x83]\xd6\xd5U\xb0^\xaf\x12\x91\x85\x86\xfd\x95\'f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) bind$auto(r0, &(0x7f0000000180)=@tipc=@name={0x1e, 0x2, 0x1, {{0x42, 0x4}, 0x2}}, 0x6) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001140), 0x9}, 0x7) r1 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0xfffffffffffffdf1, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fcdbdf2504000000"], 0x20}, 0x1, 0x0, 0x0, 0x1f2459b591bb9c6e}, 0x18800) sendmsg$auto_CTRL_CMD_GETPOLICY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00n', @ANYRES16=r1, @ANYBLOB="010329bd7000fbdbdf250a000000060001004002000005000200000000000800020048535200"], 0x2c}, 0x1, 0x0, 0x0, 0x400c859}, 0x0) fchmod$auto(r2, 0x9) bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x1}, 0xe) bind$auto(0xffffffffffffffff, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbff}, 0x65) ioctl$auto_RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000200)={0x0, 0xc, {0xfffffffc, 0x5, 0xa, 0x2, 0x5, 0xff, 0xfffffe93, 0x1, 0x7}}) ioctl$auto_SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) io_uring_enter$auto(0xffffffffffffffff, 0x9, 0x820e, 0x8b, 0x0, 0x18) close_range$auto(0x2, 0x8, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 10.090672058s ago: executing program 0 (id=3746): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x80000, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, 0x0, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x48800, 0x0) mq_timedsend$auto(r2, &(0x7f0000000000)='(.,\r^[\x00', 0x5, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x2, 0x0) socket(0xa, 0x1, 0x106) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa}, 0x55) sysfs$auto(0x2, 0x3b, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x20681, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 9.719227039s ago: executing program 2 (id=3747): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x80000, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, 0x0, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) madvise$auto(0x6, 0x4, 0x3) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x48800, 0x0) mq_timedsend$auto(r2, &(0x7f0000000000)='(.,\r^[\x00', 0x5, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa}, 0x55) sysfs$auto(0x2, 0x3b, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 8.121985697s ago: executing program 1 (id=3748): landlock_restrict_self$auto(0xffffffffffffffff, 0x7) openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f0000000040), 0x42001, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) pread64$auto(0xffffffffffffffff, 0x0, 0x4, 0x3a) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) pwrite64$auto(0xc8, &(0x7f0000000600)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x00\rBBJ\x99\x00:c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x99\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xa2@X\xb9_\xdd*\xd1\x14^\xbe\xb3\x9c2\xa2\xacyl\xb8\x00Y\xc8\'\xb6S(\xf2\xc2\xf2\x9dP\b\x88J\xae8\xf9>\xb6\xed\xb5/\xc9\xaa\xd8\xc4\xba\x94\xe6jv\x12Bp+\xb8\x16\x19kw\xbc\xbb5-i\xf0\xb9\xac\x9f&6\x89g\x9bh\x83D\xb3\x9fxe\x13\xd1\xb9\xe4\x7f|a\xf2\xdd\xa0\xfb\xfau-7\x94\x13\xa8\xec\xf6~\xacV\xa2S)\xc2\xce\x9b{+\x9ct2>\x98D\t\xc5HP\xc4\xb7\x84\xda*\x82)\x01\xd1\f\x1e\xd4\x8d0K\xa8\xd6\xa1\xa7\xd8VP\xfd\x19\x1cd\x84\xe7\xc6#\x9c\xdd\x88\xf9\x128\x0e\xe2\n\xd3\xd33\x01\xda\x83]\xd6\xd5U\xb0^\xaf\x12\x91\x85\x86\xfd\x95\'f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) r4 = openat$auto_proc_projid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/projid_map\x00', 0x40, 0x0) close_range$auto(0xffffffffffffffff, r4, 0xa) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) pwrite64$auto(0xc8, &(0x7f0000000600)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x00\rBBJ\x99\x00:c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x99\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xdd*\xd1\x14^\xbe\xb3\x9c2\xa2\xacyl\xb8\x00Y\xc8\'\xb6S(\xf2\xc2\xf2\x9dP\b\x88J\xae8\xf9>\xb6\xed\xb5/\xc9\xaa\xd8\xc4\xba\x94\xe6jv\x12Bp+\xb8\x16\x19kw\xbc\xbb5-i\xf0\xb9\xac\x9f&6\x89g\x9bh\x83D\xb3\x9fxe\x13\xd1\xb9\xe4\x7f|a\xf2\xdd\xa0\xfb\xfau-7\x94\x13\xa8\xec\xf6~\xacV\xa2S)\xc2\xce\x9b{+\x9ct2>\x98D\t\xc5HP\xc4\xb7\x84\xda*\x82)\xf3&@\x1e\xd4\x8d0K\xa8\xd6\xa1\xa7\xd8VP\xfd\x19\x1cd\x84\xe7\xc6#\x9c\xdd\x88\xf9\x128\x0e\xe2\n\xd3\xd33\x01\xda\x83]\xd6\xd5U\xb0^\xaf\x12\x91\x85\x86\xfd\x95\'\xb6\xed\xb5/\xc9\xaa\xd8\xc4\xba\x94\xe6jv\x12Bp+\xb8\x16\x19kw\xbc\xbb5-i\xf0\xb9\xac\x9f&6\x89g\x9bh\x83D\xb3\x9fxe\x13\xd1\xb9\xe4\x7f|a\xf2\xdd\xa0\xfb\xfau-7\x94\x13\xa8\xec\xf6~\xacV\xa2S)\xc2\xce\x9b{+\x9ct2>\x98D\t\xc5HP\xc4\xb7\x84\xda*\x82)\x01\xd1\f\x1e\xd4\x8d0K\xa8\xd6\xa1\xa7\xd8VP\xfd\x19\x1cd\x84\xe7\xc6#\x9c\xdd\x88\xf9\x128\x0e\xe2\n\xd3\xd33\x01\xda\x83]\xd6\xd5U\xb0^\xaf\x12\x91\x85\x86\xfd\x95\'f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) bind$auto(r0, &(0x7f0000000180)=@tipc=@name={0x1e, 0x2, 0x1, {{0x42, 0x4}, 0x2}}, 0x6) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001140), 0x9}, 0x7) r1 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0xfffffffffffffdf1, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fcdbdf2504000000"], 0x20}, 0x1, 0x0, 0x0, 0x1f2459b591bb9c6e}, 0x18800) sendmsg$auto_CTRL_CMD_GETPOLICY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00n', @ANYRES16=r1, @ANYBLOB="010329bd7000fbdbdf250a000000060001004002000005000200000000000800020048535200"], 0x2c}, 0x1, 0x0, 0x0, 0x400c859}, 0x0) fchmod$auto(r2, 0x9) bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x1}, 0xe) bind$auto(0xffffffffffffffff, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbff}, 0x65) ioctl$auto_RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000200)={0x0, 0xc, {0xfffffffc, 0x5, 0xa, 0x2, 0x5, 0xff, 0xfffffe93, 0x1, 0x7}}) socket(0xa, 0x2, 0x3a) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) io_uring_enter$auto(0xffffffffffffffff, 0x9, 0x820e, 0x8b, 0x0, 0x18) close_range$auto(0x2, 0x8, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 5.419324329s ago: executing program 1 (id=3752): mmap$auto(0x0, 0x4009, 0xb, 0x11, 0x401, 0x10) move_pages$auto(0x0, 0xf56, 0x0, 0x0, 0x0, 0x8000000000000000) pread64$auto(0xffffffffffffffff, 0x0, 0x4, 0x3a) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000280), r0) sendmsg$auto_HWSIM_CMD_REGISTER(r0, 0x0, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x40141, 0x0) write$auto_proc_sys_file_operations_proc_sysctl(r1, 0x0, 0x0) unshare$auto(0x40000080) r2 = prctl$auto(0xe, 0xe, 0x0, 0x9c, 0x80000000) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(r3, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) r4 = openat$auto_proc_projid_map_operations_base(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/projid_map\x00', 0x40, 0x0) close_range$auto(0xffffffffffffffff, r4, 0xa) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) pwrite64$auto(0xc8, &(0x7f0000000600)='\vX\xb5n\x91p\xe6\x1eRN8\x99\x00\rBBJ\x99\x00:c\x14\r>\x94\x1a\xd3\xd3\x1d\xf8\xbebZ\xddL\'\x99\x03\xf1`\x9f\x1e\xf9\xa4\xf8\x15\x02l@\x18*\xc0\xc1\xf2\x14^\x0fo\x84\xfc\x89\v\xea\x1b\x95\xafQ;CL\"\x01\x0e\xa4\xdf\xdav\x1cC\x8a\xeeq\xf0\xcdr\xfa\xdd*\xd1\x14^\xbe\xb3\x9c2\xa2\xacyl\xb8\x00Y\xc8\'\xb6S(\xf2\xc2\xf2\x9dP\b\x88J\xae8\xf9>\xb6\xed\xb5/\xc9\xaa\xd8\xc4\xba\x94\xe6jv\x12Bp+\xb8\x16\x19kw\xbc\xbb5-i\xf0\xb9\xac\x9f&6\x89g\x9bh\x83D\xb3\x9fxe\x13\xd1\xb9\xe4\x7f|a\xf2\xdd\xa0\xfb\xfau-7\x94\x13\xa8\xec\xf6~\xacV\xa2S)\xc2\xce\x9b{+\x9ct2>\x98D\t\xc5HP\xc4\xb7\x84\xda*\x82)\xf3&@\x1e\xd4\x8d0K\xa8\xd6\xa1\xa7\xd8VP\xfd\x19\x1cd\x84\xe7\xc6#\x9c\xdd\x88\xf9\x128\x0e\xe2\n\xd3\xd33\x01\xda\x83]\xd6\xd5U\xb0^\xaf\x12\x91\x85\x86\xfd\x95\'f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) bind$auto(r0, &(0x7f0000000180)=@tipc=@name={0x1e, 0x2, 0x1, {{0x42, 0x4}, 0x2}}, 0x6) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/bus/usb/025/001\x00', 0x8000, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001140), 0x9}, 0x7) r1 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0xfffffffffffffdf1, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fcdbdf2504000000"], 0x20}, 0x1, 0x0, 0x0, 0x1f2459b591bb9c6e}, 0x18800) sendmsg$auto_CTRL_CMD_GETPOLICY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00n', @ANYRES16=r1, @ANYBLOB="010329bd7000fbdbdf250a000000060001004002000005000200000000000800020048535200"], 0x2c}, 0x1, 0x0, 0x0, 0x400c859}, 0x0) fchmod$auto(r2, 0x9) bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x1}, 0xe) bind$auto(0xffffffffffffffff, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbff}, 0x65) ioctl$auto_RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000200)={0x0, 0xc, {0xfffffffc, 0x5, 0xa, 0x2, 0x5, 0xff, 0xfffffe93, 0x1, 0x7}}) ioctl$auto_SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3, 0x0) socket(0xa, 0x2, 0x3a) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) io_uring_enter$auto(0xffffffffffffffff, 0x9, 0x820e, 0x8b, 0x0, 0x18) close_range$auto(0x2, 0x8, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 2.689461882s ago: executing program 2 (id=3758): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x80000, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, 0x0, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) madvise$auto(0x6, 0x4, 0x3) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x48800, 0x0) mq_timedsend$auto(r2, &(0x7f0000000000)='(.,\r^[\x00', 0x5, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) sysfs$auto(0x2, 0x3b, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x20681, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 2.067905779s ago: executing program 0 (id=3759): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x80000, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, 0x0, 0x101202, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, 0x0, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) madvise$auto(0x6, 0x4, 0x3) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x48800, 0x0) mq_timedsend$auto(r2, &(0x7f0000000000)='(.,\r^[\x00', 0x5, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x2, 0x0) socket(0xa, 0x1, 0x106) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa}, 0x55) sysfs$auto(0x2, 0x3b, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x20681, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 746.705256ms ago: executing program 1 (id=3760): openat$auto_i2cdev_fops_i2c_dev(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) pread64$auto(0xffffffffffffffff, 0x0, 0x4, 0x3a) unshare$auto(0x40000080) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/amidi2\x00', 0x8b0000, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) unshare$auto(0x40000080) bind$auto(r0, &(0x7f0000000180)=@tipc=@name={0x1e, 0x2, 0x1, {{0x42, 0x4}, 0x2}}, 0x6) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x40040, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) writev$auto(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001140), 0x9}, 0x7) r1 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0xfffffffffffffdf1, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fcdbdf2504000000"], 0x20}, 0x1, 0x0, 0x0, 0x1f2459b591bb9c6e}, 0x18800) sendmsg$auto_CTRL_CMD_GETPOLICY(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00n', @ANYRES16=r1, @ANYBLOB="010329bd7000fbdbdf250a000000060001004002000005000200000000000800020048535200"], 0x2c}, 0x1, 0x0, 0x0, 0x400c859}, 0x0) fchmod$auto(r2, 0x9) bind$auto(0xffffffffffffffff, &(0x7f0000000040)=@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x1}, 0xe) bind$auto(0xffffffffffffffff, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbff}, 0x65) ioctl$auto_RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000200)={0x0, 0xc, {0xfffffffc, 0x5, 0xa, 0x2, 0x5, 0xff, 0xfffffe93, 0x1, 0x7}}) ioctl$auto_SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3, 0x0) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) prctl$auto(0x26, 0x1, 0x0, 0x0, 0x0) io_uring_enter$auto(0xffffffffffffffff, 0x9, 0x820e, 0x8b, 0x0, 0x18) close_range$auto(0x2, 0x8, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) 660.757233ms ago: executing program 3 (id=3761): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, 0x0, 0x6, 0x3, 0x4, 0x2a) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x4891c0, 0x0) writev$auto(0xffffffffffffffff, 0x0, 0x3) mmap$auto(0x0, 0x8, 0x45bd, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r1 = openat$auto_mtd_fops_mtdchar(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mtd0ro\x00', 0x80000, 0x0) ioctl$auto_MEMGETBADBLOCK(r1, 0x40084d0b, &(0x7f0000000040)=0xffff) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/sched_rt_period_us\x00', 0x101202, 0x0) pselect6$auto(0x5, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = io_uring_setup$auto(0x6, 0x0) unshare$auto(0x40000080) unshare$auto(0x40000080) pwrite64$auto(0xc8, 0x0, 0xfded, 0x3) clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) unshare$auto(0x40000080) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) madvise$auto(0x6, 0x4, 0x3) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x48800, 0x0) mq_timedsend$auto(r2, &(0x7f0000000000)='(.,\r^[\x00', 0x5, 0x2b3, &(0x7f0000000040)={0x1, 0x1}) close_range$auto(0x2, 0x8, 0x0) socket(0xa, 0x2, 0x0) socket(0xa, 0x1, 0x106) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa}, 0x55) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x20681, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x0, 0x3ff) 151.661839ms ago: executing program 2 (id=3762): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bind$auto(0x3, 0x0, 0x6d) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0xa, 0x3, 0x5) sendmmsg$auto(r0, &(0x7f0000000180)={{&(0x7f0000000040), 0x200001, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x8000005}, 0x3b8b, 0xa) ioctl$auto(0x3, 0x80000541b, 0x38) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) syz_genetlink_get_family_id$auto_ipvs(0x0, 0xffffffffffffffff) ioctl$auto_UBI_IOCATT(0xffffffffffffffff, 0x40186f40, 0x0) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), r0) sendmsg$auto_NL80211_CMD_SET_TID_TO_LINK_MAPPING(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x88, r1, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_DISABLE_EHT={0x4}, @NL80211_ATTR_PMKR0_NAME={0x6f, 0x102, "fd83eca4e83f4ef0aebae65c54e51626f2665089665a9202bf5b3837fbeb4a99ce8285266f95126561b885ba87f193ea8769968a25d4ae3ee9acaa94853cd55060ede7e7262d4d2ca997c9bd78a82111eacfce710d17525e7010ebe48ed3851004e861191481fa501f0c44"}]}, 0x88}, 0x1, 0x0, 0x0, 0xc000000}, 0x4040) r2 = socket(0x11, 0x80003, 0xffff20a8) setsockopt$auto(r2, 0x107, 0x2, 0x0, 0x28) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) rseq$auto(0x0, 0x8002, 0x2, 0x6) r3 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f000000c340)='/proc/thread-self/pagemap\x00', 0x8000, 0x0) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x4400, 0x0) ioctl$auto_PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x2, 0x7, 0xbff, 0x2c, 0x2c, 0x3, 0x2}) pwritev2$auto(0xffffffffffffffff, 0x0, 0x8000000000000001, 0x100020001, 0x7, 0x4) write$auto_proc_clear_refs_operations_internal(0xffffffffffffffff, 0x0, 0x0) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x1010001, 0x100000003) 0s ago: executing program 0 (id=3763): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) bind$auto(0x3, 0x0, 0x6d) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0xa, 0x3, 0x5) sendmmsg$auto(r0, &(0x7f0000000180)={{&(0x7f0000000040), 0x200001, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x8000005}, 0x3b8b, 0xa) ioctl$auto(0x3, 0x80000541b, 0x38) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) syz_genetlink_get_family_id$auto_ipvs(0x0, 0xffffffffffffffff) ioctl$auto_UBI_IOCATT(0xffffffffffffffff, 0x40186f40, 0x0) r1 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000040), r0) sendmsg$auto_NL80211_CMD_SET_TID_TO_LINK_MAPPING(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x88, r1, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_DISABLE_EHT={0x4}, @NL80211_ATTR_PMKR0_NAME={0x6f, 0x102, "fd83eca4e83f4ef0aebae65c54e51626f2665089665a9202bf5b3837fbeb4a99ce8285266f95126561b885ba87f193ea8769968a25d4ae3ee9acaa94853cd55060ede7e7262d4d2ca997c9bd78a82111eacfce710d17525e7010ebe48ed3851004e861191481fa501f0c44"}]}, 0x88}, 0x1, 0x0, 0x0, 0xc000000}, 0x4040) r2 = socket(0x11, 0x80003, 0xffff20a8) setsockopt$auto(r2, 0x107, 0x2, 0x0, 0x28) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) write$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) rseq$auto(&(0x7f0000000300)={0xd, 0x401, 0xfffffffffffffffd, 0x20000006, 0xe}, 0x8002, 0x2, 0x6) r3 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, 0x0, 0x8000, 0x0) openat$auto_rfcomm_sock_debugfs_fops_(0xffffffffffffff9c, 0x0, 0x4400, 0x0) ioctl$auto_PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x2, 0x7, 0xbff, 0x2c, 0x2c, 0x3, 0x2}) pwritev2$auto(0xffffffffffffffff, 0x0, 0x8000000000000001, 0x100020001, 0x7, 0x4) write$auto_proc_clear_refs_operations_internal(0xffffffffffffffff, 0x0, 0x0) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x1010001, 0x100000003) kernel console output (not intermixed with test programs): ve interface with an up link [ 1062.537978][ T13] hsr_slave_0: left promiscuous mode [ 1062.554219][ T13] hsr_slave_1: left promiscuous mode [ 1062.566319][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1062.582118][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1062.609437][ T13] veth1_macvtap: left promiscuous mode [ 1062.625182][ T13] veth0_macvtap: left promiscuous mode [ 1062.966539][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1063.004480][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1063.228402][ T13] smc: removing net device dummy0 with user defined pnetid DUMMY0 [ 1063.538449][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1063.554574][T17590] team0: Port device team_slave_0 added [ 1063.569960][T17589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1063.712592][T17590] team0: Port device team_slave_1 added [ 1063.725955][T17589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1063.926050][T17589] team0: Port device team_slave_0 added [ 1063.959924][T17589] team0: Port device team_slave_1 added [ 1063.985545][T17590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1064.004297][T17590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1064.056424][T15571] Bluetooth: hci4: command tx timeout [ 1064.062334][ T50] Bluetooth: hci1: command tx timeout [ 1064.076683][T17590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1064.142114][T17590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1064.170977][T17590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1064.268897][T17590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1064.383322][T17589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1064.412247][T17589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1064.554119][T17589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1064.644118][T17589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1064.667533][T17589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1064.750979][T17589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1064.966716][T17724] Device name cannot be null; rc = [-22] [ 1065.000998][T17590] hsr_slave_0: entered promiscuous mode [ 1065.024845][T17590] hsr_slave_1: entered promiscuous mode [ 1065.045360][ T30] audit: type=1804 audit(4294967967.174:71): pid=17724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1899" name="/newroot/469/file0" dev="tmpfs" ino=2486 res=1 errno=0 [ 1065.070142][T17590] debugfs: 'hsr0' already exists in 'hsr' [ 1065.094735][T17590] Cannot create hsr debugfs directory [ 1065.365596][T17589] hsr_slave_0: entered promiscuous mode [ 1065.388281][T17589] hsr_slave_1: entered promiscuous mode [ 1065.414550][T17589] debugfs: 'hsr0' already exists in 'hsr' [ 1065.438058][T17589] Cannot create hsr debugfs directory [ 1065.521564][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1066.284015][T17590] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1066.652665][T17590] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1066.706494][T17752] zram: Cannot change disksize for initialized device [ 1066.879265][T17590] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.066749][T17590] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.085509][T17743] Process accounting paused [ 1068.426505][T17590] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1068.472359][T17590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1068.487871][T17590] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1068.513228][T17590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1068.927217][T17590] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1068.968493][T17590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1069.117419][T17590] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1069.211789][T17590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1071.135936][T17589] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1071.202325][T17589] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1071.245913][T17589] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1071.328051][T17589] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1071.387175][T17589] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1071.437179][T17589] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1071.463447][T17822] sctp: [Deprecated]: syz.0.1907 (pid 17822) Use of int in maxseg socket option. [ 1071.463447][T17822] Use struct sctp_assoc_value instead [ 1071.485949][T17589] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1071.573533][T17589] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1071.685266][T17590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1071.811172][T17590] 8021q: adding VLAN 0 to HW filter on device team0 [ 1071.983056][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 1071.990280][ T3314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1072.077279][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 1072.084498][ T3314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1073.223998][T17589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1073.705748][T17876] zram: Cannot change disksize for initialized device [ 1074.477257][T17589] 8021q: adding VLAN 0 to HW filter on device team0 [ 1074.696705][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 1074.703914][ T3314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1074.961702][ T1061] bridge0: port 2(bridge_slave_1) entered blocking state [ 1074.968911][ T1061] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1076.139269][T17590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1076.487201][T17590] veth0_vlan: entered promiscuous mode [ 1076.599641][T17590] veth1_vlan: entered promiscuous mode [ 1077.467935][T17590] veth0_macvtap: entered promiscuous mode [ 1077.581837][T17590] veth1_macvtap: entered promiscuous mode [ 1077.882618][T17590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1077.952458][T17590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1078.421971][T12267] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1078.496152][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1078.978121][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1079.185100][ T1061] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1079.402558][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1079.484006][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1079.811608][T17589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1079.846480][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1079.887002][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1080.496786][T17990] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1889'. [ 1082.053264][T17589] veth0_vlan: entered promiscuous mode [ 1082.404650][T18019] vivid-007: ================= START STATUS ================= [ 1082.435851][T18019] vivid-007: Generate PTS: true [ 1082.455643][T18019] vivid-007: Generate SCR: true [ 1082.472195][T18019] tpg source WxH: 320x240 (Y'CbCr) [ 1082.504610][T18019] tpg field: 1 [ 1082.517098][T18019] tpg crop: (0,0)/320x240 [ 1082.532251][T18019] tpg compose: (0,0)/320x240 [ 1082.551725][T18019] tpg colorspace: 8 [ 1082.581882][T18019] tpg transfer function: 0/0 [ 1082.625258][T18019] tpg Y'CbCr encoding: 0/0 [ 1082.711634][T17589] veth1_vlan: entered promiscuous mode [ 1082.721164][T18019] tpg quantization: 0/0 [ 1082.772587][T18019] tpg RGB range: 0/2 [ 1082.856670][T18019] vivid-007: ================== END STATUS ================== [ 1084.214237][T17589] veth0_macvtap: entered promiscuous mode [ 1084.355886][T17589] veth1_macvtap: entered promiscuous mode [ 1084.461816][T17589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1084.513510][T17589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1084.623118][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.902483][T12267] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1084.962652][ T1061] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.552689][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1085.597433][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1086.006151][ T1102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1086.027053][ T1102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1086.122224][ T1102] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.883642][T18157] Device name cannot be null; rc = [-22] [ 1092.911244][ T30] audit: type=1804 audit(4294967995.058:72): pid=18157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1944" name="/newroot/493/file0" dev="tmpfs" ino=2624 res=1 errno=0 [ 1095.816944][T18206] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1095.963618][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.601681][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.670070][T15571] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1096.685663][T15571] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1096.694392][T15571] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1096.712138][T15571] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1096.721525][T15571] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1097.330916][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.594170][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.642502][T18215] Process accounting resumed [ 1098.709702][ T13] bridge_slave_1: left allmulticast mode [ 1098.732110][ T13] bridge_slave_1: left promiscuous mode [ 1098.750518][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1098.805091][ T13] bridge_slave_0: left allmulticast mode [ 1098.837260][T15571] Bluetooth: hci1: command tx timeout [ 1098.849177][ T13] bridge_slave_0: left promiscuous mode [ 1098.882276][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.631656][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1099.691858][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1099.727943][ T13] bond0 (unregistering): Released all slaves [ 1100.556062][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1100.915240][T15571] Bluetooth: hci1: command tx timeout [ 1100.936500][ T13] hsr_slave_0: left promiscuous mode [ 1100.943117][ T13] hsr_slave_1: left promiscuous mode [ 1100.963641][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1100.974239][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1100.994342][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1101.007477][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1101.073773][ T13] veth1_macvtap: left promiscuous mode [ 1101.089955][ T13] veth0_macvtap: left promiscuous mode [ 1101.099146][ T13] veth1_vlan: left promiscuous mode [ 1101.105575][ T13] veth0_vlan: left promiscuous mode [ 1101.444824][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1101.492913][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1102.586748][T18287] FAULT_INJECTION: forcing a failure. [ 1102.586748][T18287] name failslab, interval 1, probability 0, space 0, times 0 [ 1102.651305][T18287] CPU: 0 UID: 0 PID: 18287 Comm: syz.1.1961 Tainted: G L syzkaller #0 PREEMPT(full) [ 1102.651347][T18287] Tainted: [L]=SOFTLOCKUP [ 1102.651355][T18287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1102.651369][T18287] Call Trace: [ 1102.651377][T18287] [ 1102.651386][T18287] dump_stack_lvl+0x100/0x190 [ 1102.651418][T18287] should_fail_ex.cold+0x5/0xa [ 1102.651444][T18287] should_failslab+0xc2/0x120 [ 1102.651479][T18287] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1102.651511][T18287] ? vm_area_alloc+0x1f/0x160 [ 1102.651539][T18287] vm_area_alloc+0x1f/0x160 [ 1102.651561][T18287] __mmap_region+0x1033/0x2db0 [ 1102.651593][T18287] ? __pfx___mmap_region+0x10/0x10 [ 1102.651616][T18287] ? __pfx___might_resched+0x10/0x10 [ 1102.651660][T18287] ? down_write+0x146/0x1f0 [ 1102.651702][T18287] ? process_measurement+0x1f4/0x2350 [ 1102.651805][T18287] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 1102.651854][T18287] ? __lock_acquire+0x49f/0x1a40 [ 1102.651907][T18287] ? find_held_lock+0x2b/0x80 [ 1102.651936][T18287] ? is_bpf_text_address+0x8a/0x1a0 [ 1102.652026][T18287] mmap_region+0x35d/0x620 [ 1102.652056][T18287] ? __pfx_mmap_region+0x10/0x10 [ 1102.652088][T18287] ? bpf_lsm_capable+0x9/0x10 [ 1102.652115][T18287] ? security_capable+0x80/0x260 [ 1102.652144][T18287] do_mmap+0xc63/0x12f0 [ 1102.652182][T18287] ? __pfx_do_mmap+0x10/0x10 [ 1102.652216][T18287] ? __pfx_down_write_killable+0x10/0x10 [ 1102.652255][T18287] vm_mmap_pgoff+0x29e/0x470 [ 1102.652293][T18287] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1102.652329][T18287] ? __fget_files+0x215/0x3d0 [ 1102.652357][T18287] ? __fget_files+0x21f/0x3d0 [ 1102.652384][T18287] ksys_mmap_pgoff+0x3cb/0x610 [ 1102.652419][T18287] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 1102.652451][T18287] ? fput+0x79/0x100 [ 1102.652478][T18287] ? ksys_write+0x1ac/0x250 [ 1102.652499][T18287] ? __pfx_ksys_write+0x10/0x10 [ 1102.652525][T18287] __x64_sys_mmap+0x125/0x190 [ 1102.652559][T18287] do_syscall_64+0x115/0x840 [ 1102.652588][T18287] ? clear_bhb_loop+0x40/0x90 [ 1102.652617][T18287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.652641][T18287] RIP: 0033:0x7fb63739e019 [ 1102.652660][T18287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1102.652683][T18287] RSP: 002b:00007fb6381f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1102.652706][T18287] RAX: ffffffffffffffda RBX: 00007fb637625fa0 RCX: 00007fb63739e019 [ 1102.652721][T18287] RDX: 0000000000000001 RSI: 00000000000040f4 RDI: 0000200000ffc000 [ 1102.652739][T18287] RBP: 00007fb6381f2090 R08: 0000000000000002 R09: 0000000000004000 [ 1102.652753][T18287] R10: 000000000008e051 R11: 0000000000000246 R12: 0000000000000001 [ 1102.652768][T18287] R13: 00007fb637626038 R14: 00007fb637625fa0 R15: 00007fff414cf968 [ 1102.652797][T18287] [ 1103.306541][T15571] Bluetooth: hci1: command tx timeout [ 1104.378642][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1105.392344][T15571] Bluetooth: hci1: command tx timeout [ 1106.059608][T18214] bridge0: port 1(bridge_slave_0) entered blocking state [ 1106.092518][T18214] bridge0: port 1(bridge_slave_0) entered disabled state [ 1106.127682][T18214] bridge_slave_0: entered allmulticast mode [ 1106.161721][T18214] bridge_slave_0: entered promiscuous mode [ 1106.321149][T18214] bridge0: port 2(bridge_slave_1) entered blocking state [ 1106.359563][T18214] bridge0: port 2(bridge_slave_1) entered disabled state [ 1106.404982][T18214] bridge_slave_1: entered allmulticast mode [ 1106.442099][T18214] bridge_slave_1: entered promiscuous mode [ 1106.766157][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1107.077784][T18214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1107.254507][T18214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1107.698175][T18214] team0: Port device team_slave_0 added [ 1108.002729][T18214] team0: Port device team_slave_1 added [ 1108.361013][T18214] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1108.406673][T18214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1108.480967][T18356] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1108.542011][T18214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1108.605929][T18356] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1108.630176][T18214] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1108.654405][T18356] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1108.664717][T18214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1108.769644][T18214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1108.836683][T18356] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1108.969554][T18356] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1109.077348][T18356] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1109.252863][T18356] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1109.323854][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1109.384672][T18214] hsr_slave_0: entered promiscuous mode [ 1109.413072][T18214] hsr_slave_1: entered promiscuous mode [ 1109.435678][T18214] debugfs: 'hsr0' already exists in 'hsr' [ 1109.454329][T18214] Cannot create hsr debugfs directory [ 1109.870343][T15571] Bluetooth: hci3: command 0x0406 tx timeout [ 1110.669636][T15571] Bluetooth: hci4: command 0x0c1a tx timeout [ 1110.989289][T15571] Bluetooth: hci1: command 0x0c1a tx timeout [ 1112.750258][T15571] Bluetooth: hci4: command 0x0c1a tx timeout [ 1113.073138][T15571] Bluetooth: hci1: command 0x0c1a tx timeout [ 1114.827452][T15571] Bluetooth: hci4: command 0x0c1a tx timeout [ 1115.147123][T15571] Bluetooth: hci1: command 0x0c1a tx timeout [ 1115.630037][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.638520][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.765750][T18214] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1115.806795][T18214] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1115.923246][T18214] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1115.955951][T18214] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1116.204064][T18214] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1116.237226][T18214] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1116.335457][T18214] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1116.379068][T18214] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1117.050656][T18214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1117.180326][T18214] 8021q: adding VLAN 0 to HW filter on device team0 [ 1117.258105][T12267] bridge0: port 1(bridge_slave_0) entered blocking state [ 1117.265354][T12267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1117.416751][T12267] bridge0: port 2(bridge_slave_1) entered blocking state [ 1117.424091][T12267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1121.644827][T18214] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1124.017925][T18214] veth0_vlan: entered promiscuous mode [ 1124.087718][T18214] veth1_vlan: entered promiscuous mode [ 1124.248680][T18214] veth0_macvtap: entered promiscuous mode [ 1124.495274][T18214] veth1_macvtap: entered promiscuous mode [ 1124.749625][T18214] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1124.830541][T18214] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1125.622682][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1125.786223][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1125.866281][T12267] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1126.922090][T12267] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1127.318521][ T1061] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1127.372405][ T1061] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1127.520023][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1127.563506][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1128.622503][T18676] netlink: 'syz.3.2000': attribute type 16 has an invalid length. [ 1128.686493][T18676] netlink: 330 bytes leftover after parsing attributes in process `syz.3.2000'. [ 1130.357992][T18686] NFSD: Failed to start, no listeners configured. [ 1130.824471][T18688] NFSD: Failed to start, no listeners configured. [ 1131.470127][T18667] Process accounting paused [ 1134.536238][T18745] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2011'. [ 1134.747372][T18747] usb usb20: check_ctrlrecip: process 18747 (syz.3.2011) requesting ep 01 but needs 81 [ 1134.798865][T18747] usb usb20: usbfs: process 18747 (syz.3.2011) did not claim interface 0 before use [ 1142.754992][T18812] zswap: compressor not available [ 1143.341434][T18829] zram: Cannot change disksize for initialized device [ 1143.489593][ T30] audit: type=1800 audit(4294968045.664:73): pid=18829 uid=2 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2026" name="SYSV00000008" dev="tmpfs" ino=0 res=0 errno=0 [ 1147.379023][T18882] FAULT_INJECTION: forcing a failure. [ 1147.379023][T18882] name failslab, interval 1, probability 0, space 0, times 0 [ 1147.425920][T18882] CPU: 0 UID: 0 PID: 18882 Comm: syz.3.2038 Tainted: G L syzkaller #0 PREEMPT(full) [ 1147.425957][T18882] Tainted: [L]=SOFTLOCKUP [ 1147.425965][T18882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1147.425979][T18882] Call Trace: [ 1147.425986][T18882] [ 1147.425996][T18882] dump_stack_lvl+0x100/0x190 [ 1147.426035][T18882] should_fail_ex.cold+0x5/0xa [ 1147.426069][T18882] should_failslab+0xc2/0x120 [ 1147.426106][T18882] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1147.426136][T18882] ? trace_kmem_cache_alloc+0xdd/0x100 [ 1147.426171][T18882] ? security_file_alloc+0x34/0x2c0 [ 1147.426213][T18882] security_file_alloc+0x34/0x2c0 [ 1147.426246][T18882] init_file+0x95/0x480 [ 1147.426276][T18882] alloc_empty_file+0x79/0x1c0 [ 1147.426308][T18882] alloc_file_pseudo+0x183/0x290 [ 1147.426340][T18882] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1147.426375][T18882] ? tipc_sk_finish_conn+0x600/0x7a0 [ 1147.426495][T18882] sock_alloc_file+0x50/0x210 [ 1147.426534][T18882] __sys_socketpair+0x321/0x5b0 [ 1147.426562][T18882] ? __pfx___sys_socketpair+0x10/0x10 [ 1147.426593][T18882] ? __pfx_ksys_write+0x10/0x10 [ 1147.426620][T18882] __x64_sys_socketpair+0x96/0x100 [ 1147.426646][T18882] ? lockdep_hardirqs_on+0x78/0x100 [ 1147.426677][T18882] do_syscall_64+0x115/0x840 [ 1147.426706][T18882] ? clear_bhb_loop+0x40/0x90 [ 1147.426735][T18882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1147.426760][T18882] RIP: 0033:0x7f9d5979e019 [ 1147.426785][T18882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1147.426808][T18882] RSP: 002b:00007f9d5a64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 1147.426830][T18882] RAX: ffffffffffffffda RBX: 00007f9d59a25fa0 RCX: 00007f9d5979e019 [ 1147.426847][T18882] RDX: 8000000000000000 RSI: 0000000000000004 RDI: 000000000000001e [ 1147.426867][T18882] RBP: 00007f9d5a64f090 R08: 0000000000000000 R09: 0000000000000000 [ 1147.426881][T18882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1147.426895][T18882] R13: 00007f9d59a26038 R14: 00007f9d59a25fa0 R15: 00007ffdb34a7998 [ 1147.426924][T18882] [ 1158.684538][T19002] netlink: 330 bytes leftover after parsing attributes in process `syz.0.2056'. [ 1158.749957][T19002] mac80211_hwsim hwsim37 ›: renamed from wlan0 [ 1159.278914][T19020] binder: 19017:19020 ioctl 541b 0 returned -22 [ 1161.781876][T19041] Process accounting resumed [ 1162.050783][T19045] netlink: 'syz.2.2064': attribute type 11 has an invalid length. [ 1162.176950][ T81] bridge_slave_1: left allmulticast mode [ 1162.197515][ T81] bridge_slave_1: left promiscuous mode [ 1162.218278][ T81] bridge0: port 2(bridge_slave_1) entered disabled state [ 1162.256043][ T81] bridge_slave_0: left allmulticast mode [ 1162.278029][ T81] bridge_slave_0: left promiscuous mode [ 1162.303316][ T81] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.718456][ T81] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1162.772717][ T81] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1162.799453][ T81] bond0 (unregistering): Released all slaves [ 1162.809906][T19055] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2067'. [ 1163.948610][ T81] hsr_slave_0: left promiscuous mode [ 1163.978412][ T81] hsr_slave_1: left promiscuous mode [ 1164.003491][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1164.027378][ T81] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1164.045820][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1164.063429][ T81] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1164.107583][ T81] veth1_macvtap: left promiscuous mode [ 1164.120727][ T81] veth0_macvtap: left promiscuous mode [ 1164.134448][ T81] veth1_vlan: left promiscuous mode [ 1164.150064][ T81] veth0_vlan: left promiscuous mode [ 1164.334554][T19084] FAULT_INJECTION: forcing a failure. [ 1164.334554][T19084] name failslab, interval 1, probability 0, space 0, times 0 [ 1164.361486][T19084] CPU: 0 UID: 0 PID: 19084 Comm: syz.0.2073 Tainted: G L syzkaller #0 PREEMPT(full) [ 1164.361534][T19084] Tainted: [L]=SOFTLOCKUP [ 1164.361542][T19084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1164.361558][T19084] Call Trace: [ 1164.361566][T19084] [ 1164.361575][T19084] dump_stack_lvl+0x100/0x190 [ 1164.361608][T19084] should_fail_ex.cold+0x5/0xa [ 1164.361635][T19084] should_failslab+0xc2/0x120 [ 1164.361673][T19084] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1164.361707][T19084] ? create_new_namespaces+0x30/0xac0 [ 1164.361740][T19084] create_new_namespaces+0x30/0xac0 [ 1164.361766][T19084] ? bpf_lsm_capable+0x9/0x10 [ 1164.361794][T19084] ? security_capable+0x80/0x260 [ 1164.361825][T19084] unshare_nsproxy_namespaces+0xf2/0x220 [ 1164.361855][T19084] ksys_unshare+0x438/0xab0 [ 1164.361889][T19084] ? __pfx_ksys_unshare+0x10/0x10 [ 1164.361932][T19084] __x64_sys_unshare+0x31/0x40 [ 1164.361964][T19084] do_syscall_64+0x115/0x840 [ 1164.361998][T19084] ? clear_bhb_loop+0x40/0x90 [ 1164.362028][T19084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1164.362054][T19084] RIP: 0033:0x7f42cf99e019 [ 1164.362075][T19084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1164.362100][T19084] RSP: 002b:00007f42d07d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1164.362123][T19084] RAX: ffffffffffffffda RBX: 00007f42cfc26180 RCX: 00007f42cf99e019 [ 1164.362140][T19084] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 1164.362155][T19084] RBP: 00007f42cfa3500c R08: 0000000000000000 R09: 0000000000000000 [ 1164.362171][T19084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1164.362186][T19084] R13: 00007f42cfc26218 R14: 00007f42cfc26180 R15: 00007ffc75a19d68 [ 1164.362216][T19084] [ 1164.735653][ T81] team0 (unregistering): Port device team_slave_1 removed [ 1164.756704][ T81] team0 (unregistering): Port device team_slave_0 removed [ 1171.705823][T19170] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1173.930357][T19183] kexec: Could not allocate control_code_buffer [ 1177.039933][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.048164][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.802342][T19259] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2106'. [ 1186.089960][T19352] netlink: 338 bytes leftover after parsing attributes in process `syz.1.2118'. [ 1188.548302][T19378] Process accounting resumed [ 1191.036319][T19417] vivid-011: ================= START STATUS ================= [ 1191.084494][T19417] vivid-011: Radio HW Seek Mode: Bounded [ 1191.155044][T19417] vivid-011: Radio Programmable HW Seek: false [ 1191.194543][T19417] vivid-011: RDS Rx I/O Mode: Block I/O [ 1191.224145][T19417] vivid-011: Generate RBDS Instead of RDS: false [ 1191.283258][T19420] vivid-007: ================= START STATUS ================= [ 1191.300721][T19417] vivid-011: RDS Reception: true [ 1191.323200][T19420] vivid-007: Generate PTS: true [ 1191.330004][T19417] vivid-011: RDS Program Type: 0 inactive [ 1191.353322][T19420] vivid-007: Generate SCR: true [ 1191.363442][T19417] vivid-011: RDS PS Name: inactive [ 1191.408417][T19417] vivid-011: RDS Radio Text: inactive [ 1191.417043][T19420] tpg source WxH: 320x240 (Y'CbCr) [ 1191.434706][T19420] tpg field: 1 [ 1191.450934][T19417] vivid-011: RDS Traffic Announcement: false inactive [ 1191.458435][T19420] tpg crop: (0,0)/320x240 [ 1191.473671][T19420] tpg compose: (0,0)/320x240 [ 1191.495489][T19420] tpg colorspace: 8 [ 1191.513563][T19420] tpg transfer function: 0/0 [ 1191.532167][T19417] vivid-011: RDS Traffic Program: false inactive [ 1191.542768][T19420] tpg Y'CbCr encoding: 0/0 [ 1191.565595][T19420] tpg quantization: 0/0 [ 1191.579719][T19417] vivid-011: RDS Music: false inactive [ 1191.586392][T19420] tpg RGB range: 0/2 [ 1191.607121][T19420] vivid-007: ================== END STATUS ================== [ 1191.618608][T19417] vivid-011: ================== END STATUS ================== [ 1192.126553][T19422] Process accounting paused [ 1200.466957][ T30] audit: type=1326 audit(4294968102.672:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19517 comm="syz.2.2147" exe="/root/ci-qemu-gce-upstream-auto/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdd6eb9e019 code=0x0 [ 1209.562183][T19631] nbd: socks must be embedded in a SOCK_ITEM attr [ 1209.598042][T19630] bond0: invalid ARP target specified [ 1209.650017][T19631] block nbd0: shutting down sockets [ 1209.754509][T19630] hub 1-0:1.0: USB hub found [ 1209.788387][T19630] hub 1-0:1.0: 1 port detected [ 1212.686518][T19682] zram: Cannot change disksize for initialized device [ 1212.948144][T19688] zram: Cannot change disksize for initialized device [ 1214.793592][T19701] Device name cannot be null; rc = [-22] [ 1214.869549][ T30] audit: type=1804 audit(4294968117.069:75): pid=19701 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2180" name="/newroot/70/file0" dev="tmpfs" ino=375 res=1 errno=0 [ 1219.450227][T19754] Process accounting paused [ 1220.739656][T19802] hub 1-0:1.0: USB hub found [ 1220.769435][T19802] hub 1-0:1.0: 1 port detected [ 1222.735233][T19795] Process accounting resumed [ 1223.287521][T19824] binder: 19820:19824 unknown command 1969382756 [ 1223.302761][T19824] binder: 19820:19824 ioctl c0306201 0 returned -22 [ 1225.377728][T19848] zram: Cannot change disksize for initialized device [ 1225.772743][ T30] audit: type=1800 audit(4294968127.995:76): pid=19848 uid=2 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2204" name="SYSV00000008" dev="tmpfs" ino=0 res=0 errno=0 [ 1226.429845][T19865] zram: Cannot change disksize for initialized device [ 1229.695934][T19915] FAULT_INJECTION: forcing a failure. [ 1229.695934][T19915] name failslab, interval 1, probability 0, space 0, times 0 [ 1229.731584][T19915] CPU: 0 UID: 0 PID: 19915 Comm: syz.1.2218 Tainted: G L syzkaller #0 PREEMPT(full) [ 1229.731622][T19915] Tainted: [L]=SOFTLOCKUP [ 1229.731630][T19915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1229.731644][T19915] Call Trace: [ 1229.731651][T19915] [ 1229.731660][T19915] dump_stack_lvl+0x100/0x190 [ 1229.731692][T19915] should_fail_ex.cold+0x5/0xa [ 1229.731719][T19915] should_failslab+0xc2/0x120 [ 1229.731754][T19915] __kmalloc_noprof+0xfc/0x820 [ 1229.731782][T19915] ? rcu_is_watching+0x12/0xc0 [ 1229.731812][T19915] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1229.731857][T19915] tomoyo_realpath_from_path+0xb6/0x690 [ 1229.731900][T19915] tomoyo_path_number_perm+0x23c/0x580 [ 1229.731930][T19915] ? tomoyo_path_number_perm+0x22e/0x580 [ 1229.731963][T19915] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1229.732022][T19915] ? find_held_lock+0x2b/0x80 [ 1229.732051][T19915] ? __fget_files+0x215/0x3d0 [ 1229.732072][T19915] ? hook_file_ioctl_common+0x140/0x440 [ 1229.732102][T19915] ? __fget_files+0x215/0x3d0 [ 1229.732129][T19915] ? __fget_files+0x21f/0x3d0 [ 1229.732161][T19915] security_file_ioctl+0xd3/0x230 [ 1229.732192][T19915] __x64_sys_ioctl+0xb7/0x210 [ 1229.732229][T19915] do_syscall_64+0x115/0x840 [ 1229.732258][T19915] ? clear_bhb_loop+0x40/0x90 [ 1229.732287][T19915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.732311][T19915] RIP: 0033:0x7fb63739e019 [ 1229.732337][T19915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1229.732360][T19915] RSP: 002b:00007fb6381f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1229.732395][T19915] RAX: ffffffffffffffda RBX: 00007fb637625fa0 RCX: 00007fb63739e019 [ 1229.732417][T19915] RDX: 0000000000000000 RSI: 0000000000005608 RDI: 0000000000000003 [ 1229.732432][T19915] RBP: 00007fb6381f2090 R08: 0000000000000000 R09: 0000000000000000 [ 1229.732446][T19915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1229.732465][T19915] R13: 00007fb637626038 R14: 00007fb637625fa0 R15: 00007fff414cf968 [ 1229.732500][T19915] [ 1229.732526][T19915] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1230.282366][T19895] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 1238.449668][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.457880][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1240.908818][T20044] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1240.955915][T20044] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1241.002920][T20044] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1242.923250][T15571] Bluetooth: hci3: command 0x0406 tx timeout [ 1243.003256][T15571] Bluetooth: hci1: command 0x0c1a tx timeout [ 1243.009441][ T50] Bluetooth: hci4: command 0x0c1a tx timeout [ 1249.058278][T20146] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2256'. [ 1249.126403][T20146] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2256'. [ 1250.257374][T20164] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2261'. [ 1250.785743][T20170] netlink: 'syz.1.2262': attribute type 1 has an invalid length. [ 1251.148784][T20152] Process accounting resumed [ 1252.819256][T20208] zram: Cannot change disksize for initialized device [ 1252.913769][T20207] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2267'. [ 1254.612623][T20203] Process accounting paused [ 1255.290700][T20242] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2276'. [ 1255.661684][T20246] zram: Cannot change disksize for initialized device [ 1257.202723][T20276] Device name cannot be null; rc = [-22] [ 1257.394327][ T30] audit: type=1804 audit(4294968159.621:77): pid=20270 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2281" name="/newroot/581/file0" dev="tmpfs" ino=3060 res=1 errno=0 [ 1257.982249][T20281] zram: Cannot change disksize for initialized device [ 1258.395980][T20285] FAULT_INJECTION: forcing a failure. [ 1258.395980][T20285] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1258.469131][T20285] CPU: 0 UID: 0 PID: 20285 Comm: syz.0.2283 Tainted: G L syzkaller #0 PREEMPT(full) [ 1258.469171][T20285] Tainted: [L]=SOFTLOCKUP [ 1258.469180][T20285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1258.469196][T20285] Call Trace: [ 1258.469203][T20285] [ 1258.469213][T20285] dump_stack_lvl+0x100/0x190 [ 1258.469246][T20285] should_fail_ex.cold+0x5/0xa [ 1258.469275][T20285] get_futex_key+0x1d2/0x14f0 [ 1258.469304][T20285] ? __pfx_get_futex_key+0x10/0x10 [ 1258.469339][T20285] futex_wake+0xf4/0x5e0 [ 1258.469375][T20285] ? __pfx___vma_start_write+0x10/0x10 [ 1258.469417][T20285] ? __pfx_futex_wake+0x10/0x10 [ 1258.469455][T20285] ? ksm_add_vmas+0x27b/0x360 [ 1258.469487][T20285] do_futex+0x2b2/0x440 [ 1258.469515][T20285] ? __pfx_do_futex+0x10/0x10 [ 1258.469541][T20285] ? find_held_lock+0x2b/0x80 [ 1258.469572][T20285] ? __do_sys_prctl+0x114d/0x2270 [ 1258.469609][T20285] ? __do_sys_prctl+0x114d/0x2270 [ 1258.469651][T20285] __x64_sys_futex+0x34f/0x4d0 [ 1258.469683][T20285] ? __pfx___x64_sys_futex+0x10/0x10 [ 1258.469722][T20285] do_syscall_64+0x115/0x840 [ 1258.469753][T20285] ? clear_bhb_loop+0x40/0x90 [ 1258.469790][T20285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.469816][T20285] RIP: 0033:0x7f42cf99e019 [ 1258.469836][T20285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1258.469861][T20285] RSP: 002b:00007f42d08160e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1258.469884][T20285] RAX: ffffffffffffffda RBX: 00007f42cfc25fa8 RCX: 00007f42cf99e019 [ 1258.469901][T20285] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f42cfc25fac [ 1258.469916][T20285] RBP: 00007f42cfc25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1258.469931][T20285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1258.469946][T20285] R13: 00007f42cfc26038 R14: 00007ffc75a19c80 R15: 00007ffc75a19d68 [ 1258.469977][T20285] [ 1259.284619][T20302] random: crng reseeded on system resumption [ 1260.915082][T20336] FAULT_INJECTION: forcing a failure. [ 1260.915082][T20336] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1260.981364][T20336] CPU: 0 UID: 0 PID: 20336 Comm: syz.1.2295 Tainted: G L syzkaller #0 PREEMPT(full) [ 1260.981401][T20336] Tainted: [L]=SOFTLOCKUP [ 1260.981409][T20336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1260.981423][T20336] Call Trace: [ 1260.981430][T20336] [ 1260.981439][T20336] dump_stack_lvl+0x100/0x190 [ 1260.981472][T20336] should_fail_ex.cold+0x5/0xa [ 1260.981500][T20336] _copy_to_user+0x32/0xd0 [ 1260.981541][T20336] keyctl_capabilities+0x5a/0x160 [ 1260.981573][T20336] __do_sys_keyctl+0x427/0x5a0 [ 1260.981601][T20336] do_syscall_64+0x115/0x840 [ 1260.981631][T20336] ? clear_bhb_loop+0x40/0x90 [ 1260.981663][T20336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.981687][T20336] RIP: 0033:0x7fb63739e019 [ 1260.981706][T20336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1260.981729][T20336] RSP: 002b:00007fb6355f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1260.981751][T20336] RAX: ffffffffffffffda RBX: 00007fb637626360 RCX: 00007fb63739e019 [ 1260.981767][T20336] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 000000000000001f [ 1260.981780][T20336] RBP: 00007fb6355f6090 R08: 00000000000003ff R09: 0000000000000000 [ 1260.981795][T20336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1260.981809][T20336] R13: 00007fb6376263f8 R14: 00007fb637626360 R15: 00007fff414cf968 [ 1260.981839][T20336] [ 1263.161451][T18723] bridge_slave_1: left allmulticast mode [ 1263.201626][T18723] bridge_slave_1: left promiscuous mode [ 1263.228064][T18723] bridge0: port 2(bridge_slave_1) entered disabled state [ 1263.269725][T18723] bridge_slave_0: left allmulticast mode [ 1263.290924][T18723] bridge_slave_0: left promiscuous mode [ 1263.318410][T18723] bridge0: port 1(bridge_slave_0) entered disabled state [ 1263.949079][T18723] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1263.983040][T18723] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1264.001820][T18723] bond0 (unregistering): Released all slaves [ 1264.540050][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1264.556170][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1264.568998][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1264.580676][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1264.592039][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1266.675888][T15571] Bluetooth: hci0: command tx timeout [ 1268.521008][T18723] hsr_slave_0: left promiscuous mode [ 1268.538318][T18723] hsr_slave_1: left promiscuous mode [ 1268.557744][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1268.582612][T18723] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1268.604953][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1268.634680][T18723] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1268.713944][T18723] veth1_macvtap: left promiscuous mode [ 1268.738946][T18723] veth0_macvtap: left promiscuous mode [ 1268.751185][T15571] Bluetooth: hci0: command tx timeout [ 1269.322295][T18723] team0 (unregistering): Port device team_slave_1 removed [ 1269.387207][T18723] team0 (unregistering): Port device team_slave_0 removed [ 1270.829612][T15571] Bluetooth: hci0: command tx timeout [ 1271.729715][T20376] bridge0: port 1(bridge_slave_0) entered blocking state [ 1271.737089][T20376] bridge0: port 1(bridge_slave_0) entered disabled state [ 1271.746559][T20376] bridge_slave_0: entered allmulticast mode [ 1271.755386][T20376] bridge_slave_0: entered promiscuous mode [ 1271.786069][T20376] bridge0: port 2(bridge_slave_1) entered blocking state [ 1271.814273][T20376] bridge0: port 2(bridge_slave_1) entered disabled state [ 1271.846447][T20376] bridge_slave_1: entered allmulticast mode [ 1271.874013][T20376] bridge_slave_1: entered promiscuous mode [ 1271.961176][T20376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1272.004430][T20376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1272.247785][T20452] zram: Cannot change disksize for initialized device [ 1272.321386][T20376] team0: Port device team_slave_0 added [ 1272.403985][T20376] team0: Port device team_slave_1 added [ 1272.480858][T20456] FAULT_INJECTION: forcing a failure. [ 1272.480858][T20456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1272.594172][T20456] CPU: 0 UID: 0 PID: 20456 Comm: syz.3.2314 Tainted: G L syzkaller #0 PREEMPT(full) [ 1272.594208][T20456] Tainted: [L]=SOFTLOCKUP [ 1272.594215][T20456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1272.594229][T20456] Call Trace: [ 1272.594236][T20456] [ 1272.594245][T20456] dump_stack_lvl+0x100/0x190 [ 1272.594274][T20456] should_fail_ex.cold+0x5/0xa [ 1272.594299][T20456] _copy_from_user+0x2e/0xd0 [ 1272.594337][T20456] copy_msghdr_from_user+0x9f/0x4c0 [ 1272.594366][T20456] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1272.594395][T20456] ? rcu_is_watching+0x12/0xc0 [ 1272.594423][T20456] ? ___sys_recvmsg+0x177/0x1a0 [ 1272.594445][T20456] ? kfree+0x1e5/0x6c0 [ 1272.594472][T20456] ___sys_recvmsg+0xdd/0x1a0 [ 1272.594496][T20456] ? __pfx____sys_recvmsg+0x10/0x10 [ 1272.594534][T20456] ? __pfx___might_resched+0x10/0x10 [ 1272.594575][T20456] do_recvmmsg+0x2f3/0x740 [ 1272.594603][T20456] ? __pfx_do_recvmmsg+0x10/0x10 [ 1272.594646][T20456] ? __mutex_unlock_slowpath+0x35d/0x930 [ 1272.594686][T20456] ? __fget_files+0x21f/0x3d0 [ 1272.594713][T20456] __x64_sys_recvmmsg+0x22a/0x280 [ 1272.594748][T20456] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1272.594789][T20456] do_syscall_64+0x115/0x840 [ 1272.594836][T20456] ? clear_bhb_loop+0x40/0x90 [ 1272.594865][T20456] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1272.594889][T20456] RIP: 0033:0x7f9d5979e019 [ 1272.594908][T20456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1272.594931][T20456] RSP: 002b:00007f9d5a60d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1272.594953][T20456] RAX: ffffffffffffffda RBX: 00007f9d59a26180 RCX: 00007f9d5979e019 [ 1272.594968][T20456] RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1272.594995][T20456] RBP: 00007f9d5a60d090 R08: 0000000000000000 R09: 0000000000000000 [ 1272.595008][T20456] R10: 0000000000000700 R11: 0000000000000246 R12: 0000000000000001 [ 1272.595021][T20456] R13: 00007f9d59a26218 R14: 00007f9d59a26180 R15: 00007ffdb34a7998 [ 1272.595050][T20456] [ 1272.913697][T20376] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1272.920757][T20376] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1272.946720][T20376] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1272.960290][T20376] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1272.967262][T20376] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1272.993328][T20376] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1273.072198][T15571] Bluetooth: hci0: command tx timeout [ 1273.159346][T20376] hsr_slave_0: entered promiscuous mode [ 1273.166011][T20376] hsr_slave_1: entered promiscuous mode [ 1275.392195][T20376] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1275.420257][T20376] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1275.529757][T20376] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1275.552666][T20376] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1275.578670][T20376] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1275.634404][T20376] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1275.658054][T20376] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1275.676522][T20376] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1276.421022][T20503] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2322'. [ 1277.564263][T20376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1277.973199][T20376] 8021q: adding VLAN 0 to HW filter on device team0 [ 1278.244617][T18724] bridge0: port 1(bridge_slave_0) entered blocking state [ 1278.251878][T18724] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1278.457425][T18724] bridge0: port 2(bridge_slave_1) entered blocking state [ 1278.464631][T18724] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1281.276326][T20376] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1281.453461][T20552] Process accounting paused [ 1281.481091][T20376] veth0_vlan: entered promiscuous mode [ 1281.606481][T20376] veth1_vlan: entered promiscuous mode [ 1283.252618][T20376] veth0_macvtap: entered promiscuous mode [ 1283.340846][T20376] veth1_macvtap: entered promiscuous mode [ 1283.449288][T20376] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1283.511418][T20376] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1283.584088][T18724] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.639683][T18724] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.712998][T18723] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.757443][T18723] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1284.161787][T18723] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1284.220410][T18723] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1284.480979][T18723] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1284.514171][T18723] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1286.975768][T20648] zram: Cannot change disksize for initialized device [ 1287.385063][ T30] audit: type=1800 audit(4294968189.636:78): pid=20642 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2342" name="dbroot" dev="configfs" ino=149873 res=0 errno=0 [ 1289.618911][T20689] bond0: invalid ARP target specified [ 1296.070222][T20736] netlink: 330 bytes leftover after parsing attributes in process `syz.3.2357'. [ 1296.220609][T20736] mac80211_hwsim hwsim52 ›: renamed from wlan0 (while UP) [ 1299.860433][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1299.868390][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1302.778050][T20823] ACPI: Can not change Invalid GPE/Fixed Event status [ 1303.380558][T20828] ACPI: Can not change Invalid GPE/Fixed Event status [ 1306.692140][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2382'. [ 1311.257899][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1311.273217][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1311.288406][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1311.303719][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1311.316347][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1311.470076][ T5842] Process accounting resumed [ 1312.959150][ T81] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.185954][ T81] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1313.368709][T15571] Bluetooth: hci3: command tx timeout [ 1313.457556][ T81] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1314.120455][T20968] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1315.420279][ T81] bridge_slave_1: left allmulticast mode [ 1315.437333][ T81] bridge_slave_1: left promiscuous mode [ 1315.447077][T15571] Bluetooth: hci3: command tx timeout [ 1315.455047][ T81] bridge0: port 2(bridge_slave_1) entered disabled state [ 1315.489768][ T81] bridge_slave_0: left allmulticast mode [ 1315.507470][ T81] bridge_slave_0: left promiscuous mode [ 1315.519165][ T81] bridge0: port 1(bridge_slave_0) entered disabled state [ 1315.902199][ T81] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1315.925606][ T81] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1315.952644][ T81] bond0 (unregistering): Released all slaves [ 1316.491260][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1316.537119][T20932] bridge0: port 1(bridge_slave_0) entered blocking state [ 1316.577646][T20932] bridge0: port 1(bridge_slave_0) entered disabled state [ 1316.625558][T20932] bridge_slave_0: entered allmulticast mode [ 1316.654461][T20932] bridge_slave_0: entered promiscuous mode [ 1316.815808][T20932] bridge0: port 2(bridge_slave_1) entered blocking state [ 1316.854149][T20932] bridge0: port 2(bridge_slave_1) entered disabled state [ 1316.891457][T20932] bridge_slave_1: entered allmulticast mode [ 1316.913885][T20932] bridge_slave_1: entered promiscuous mode [ 1317.363433][T21008] FAULT_INJECTION: forcing a failure. [ 1317.363433][T21008] name failslab, interval 1, probability 0, space 0, times 0 [ 1317.386005][T20932] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1317.422394][T21008] CPU: 0 UID: 0 PID: 21008 Comm: syz.3.2401 Tainted: G L syzkaller #0 PREEMPT(full) [ 1317.422433][T21008] Tainted: [L]=SOFTLOCKUP [ 1317.422441][T21008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1317.422455][T21008] Call Trace: [ 1317.422463][T21008] [ 1317.422471][T21008] dump_stack_lvl+0x100/0x190 [ 1317.422503][T21008] should_fail_ex.cold+0x5/0xa [ 1317.422528][T21008] should_failslab+0xc2/0x120 [ 1317.422564][T21008] __kmalloc_noprof+0xfc/0x820 [ 1317.422592][T21008] ? rcu_is_watching+0x12/0xc0 [ 1317.422622][T21008] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1317.422672][T21008] tomoyo_realpath_from_path+0xb6/0x690 [ 1317.422716][T21008] tomoyo_check_open_permission+0x2af/0x3c0 [ 1317.422750][T21008] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 1317.422781][T21008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.422814][T21008] ? hook_file_open+0x24f/0x8f0 [ 1317.422861][T21008] ? lock_acquire+0x1b9/0x370 [ 1317.422907][T21008] tomoyo_file_open+0x6b/0x90 [ 1317.422933][T21008] security_file_open+0xb5/0x1e0 [ 1317.422968][T21008] do_dentry_open+0x588/0x14d0 [ 1317.423000][T21008] vfs_open+0x82/0x3f0 [ 1317.423034][T21008] path_openat+0x2873/0x4280 [ 1317.423071][T21008] ? __pfx_path_openat+0x10/0x10 [ 1317.423103][T21008] do_file_open+0x20e/0x430 [ 1317.423130][T21008] ? __pfx_do_file_open+0x10/0x10 [ 1317.423174][T21008] ? alloc_fd+0x471/0x7a0 [ 1317.423200][T21008] ? do_getname+0x191/0x390 [ 1317.423232][T21008] do_sys_openat2+0x10f/0x1e0 [ 1317.423264][T21008] ? __pfx_do_sys_openat2+0x10/0x10 [ 1317.423297][T21008] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1317.423330][T21008] ? __fget_files+0x21f/0x3d0 [ 1317.423357][T21008] __x64_sys_openat+0x12d/0x210 [ 1317.423390][T21008] ? __pfx___x64_sys_openat+0x10/0x10 [ 1317.423421][T21008] ? ksys_write+0x1ac/0x250 [ 1317.423452][T21008] do_syscall_64+0x115/0x840 [ 1317.423481][T21008] ? clear_bhb_loop+0x40/0x90 [ 1317.423510][T21008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.423534][T21008] RIP: 0033:0x7f9d5979e019 [ 1317.423553][T21008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1317.423576][T21008] RSP: 002b:00007f9d5a64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1317.423599][T21008] RAX: ffffffffffffffda RBX: 00007f9d59a25fa0 RCX: 00007f9d5979e019 [ 1317.423615][T21008] RDX: 0000000000040342 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 1317.423630][T21008] RBP: 00007f9d5a64f090 R08: 0000000000000000 R09: 0000000000000000 [ 1317.423651][T21008] R10: 0000000000000163 R11: 0000000000000246 R12: 0000000000000001 [ 1317.423665][T21008] R13: 00007f9d59a26038 R14: 00007f9d59a25fa0 R15: 00007ffdb34a7998 [ 1317.423695][T21008] [ 1317.760212][T21008] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1317.848427][T15571] Bluetooth: hci3: command tx timeout [ 1318.056142][T20932] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1318.337921][T20932] team0: Port device team_slave_0 added [ 1318.366857][T20932] team0: Port device team_slave_1 added [ 1318.770117][T20932] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1318.801625][T20932] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1318.904248][T20932] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1318.965682][T20932] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1318.989444][T20932] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1319.053328][T20932] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1319.656318][T20932] hsr_slave_0: entered promiscuous mode [ 1319.683654][T20932] hsr_slave_1: entered promiscuous mode [ 1319.716630][T20932] debugfs: 'hsr0' already exists in 'hsr' [ 1319.747015][T20932] Cannot create hsr debugfs directory [ 1319.925274][ T50] Bluetooth: hci3: command tx timeout [ 1320.383191][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1320.977198][ T81] hsr_slave_0: left promiscuous mode [ 1321.028812][ T81] hsr_slave_1: left promiscuous mode [ 1321.080714][ T81] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1321.117146][ T81] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1321.217196][ T81] veth1_macvtap: left promiscuous mode [ 1321.251412][ T81] veth0_macvtap: left promiscuous mode [ 1322.071417][ T81] team0 (unregistering): Port device team_slave_1 removed [ 1322.137916][ T81] team0 (unregistering): Port device team_slave_0 removed [ 1322.930675][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1324.914182][T21092] can: request_module (can-proto-0) failed. [ 1329.402303][T20932] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1329.462733][T20932] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1329.509569][T20932] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1329.563311][T20932] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1329.637762][T20932] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1329.728625][T20932] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1329.781266][T20932] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1329.870854][T20932] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1333.677246][T20932] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1334.492224][T20932] 8021q: adding VLAN 0 to HW filter on device team0 [ 1334.778741][T18724] bridge0: port 1(bridge_slave_0) entered blocking state [ 1334.785952][T18724] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1334.943012][ T1102] bridge0: port 2(bridge_slave_1) entered blocking state [ 1334.950252][ T1102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1335.872085][T21236] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2419'. [ 1339.243220][T20932] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1341.048292][T20932] veth0_vlan: entered promiscuous mode [ 1341.146370][T20932] veth1_vlan: entered promiscuous mode [ 1342.231358][T20932] veth0_macvtap: entered promiscuous mode [ 1342.444614][T20932] veth1_macvtap: entered promiscuous mode [ 1343.747132][T20932] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1343.816349][T20932] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1343.885753][T18728] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.944270][T18728] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.415188][T18724] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.465150][T18724] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.082672][T18724] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1345.135554][T18724] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1345.594780][ T1102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1345.613768][ T1102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1350.548106][T21419] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2443'. [ 1350.716245][ T30] audit: type=1804 audit(4294968252.987:79): pid=21422 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2444" name="/newroot/sys/kernel/tracing/events/vmalloc/filter" dev="tracefs" ino=19680823 res=1 errno=0 [ 1354.327512][T15571] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1354.342482][T15571] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1354.356102][T15571] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1354.365090][T15571] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1354.374676][T15571] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1354.423414][T18723] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1354.834121][T18723] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1355.190269][T18723] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1355.381284][T18723] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1356.467246][ T50] Bluetooth: hci2: command tx timeout [ 1356.562318][T18723] bridge_slave_1: left allmulticast mode [ 1356.589942][T18723] bridge_slave_1: left promiscuous mode [ 1356.609411][T18723] bridge0: port 2(bridge_slave_1) entered disabled state [ 1356.647574][T18723] bridge_slave_0: left allmulticast mode [ 1356.670784][T18723] bridge_slave_0: left promiscuous mode [ 1356.697161][T18723] bridge0: port 1(bridge_slave_0) entered disabled state [ 1357.451879][T18723] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1357.511483][T18723] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1357.564016][T18723] bond0 (unregistering): Released all slaves [ 1358.272954][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1358.514783][T18723] hsr_slave_0: left promiscuous mode [ 1358.523289][T18723] hsr_slave_1: left promiscuous mode [ 1358.530809][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1358.539186][T18723] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1358.546855][ T50] Bluetooth: hci2: command tx timeout [ 1358.557473][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1358.565103][T18723] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1358.582576][T18723] veth1_macvtap: left promiscuous mode [ 1358.588487][T18723] veth0_macvtap: left promiscuous mode [ 1358.594143][T18723] veth1_vlan: left promiscuous mode [ 1358.603096][T18723] veth0_vlan: left promiscuous mode [ 1358.877492][T18723] team0 (unregistering): Port device team_slave_1 removed [ 1358.900137][T18723] team0 (unregistering): Port device team_slave_0 removed [ 1359.762308][T21454] bridge0: port 1(bridge_slave_0) entered blocking state [ 1359.795497][T21454] bridge0: port 1(bridge_slave_0) entered disabled state [ 1359.822204][T21454] bridge_slave_0: entered allmulticast mode [ 1359.842741][T21454] bridge_slave_0: entered promiscuous mode [ 1359.926593][T21454] bridge0: port 2(bridge_slave_1) entered blocking state [ 1359.960978][T21454] bridge0: port 2(bridge_slave_1) entered disabled state [ 1359.989375][T21454] bridge_slave_1: entered allmulticast mode [ 1360.015133][T21454] bridge_slave_1: entered promiscuous mode [ 1360.624584][ T50] Bluetooth: hci2: command tx timeout [ 1360.810106][T21454] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1361.172316][T21454] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1361.267449][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.276642][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.430086][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1361.733108][T21454] team0: Port device team_slave_0 added [ 1361.766904][T21454] team0: Port device team_slave_1 added [ 1362.088290][T21454] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1362.121659][T21454] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1362.261817][T21454] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1362.514310][T21454] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1362.559936][T21454] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1362.651270][T21454] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1362.706235][ T50] Bluetooth: hci2: command tx timeout [ 1363.686993][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1363.729849][T21454] hsr_slave_0: entered promiscuous mode [ 1363.748355][T21454] hsr_slave_1: entered promiscuous mode [ 1363.765704][T21454] debugfs: 'hsr0' already exists in 'hsr' [ 1363.779807][T21454] Cannot create hsr debugfs directory [ 1367.814466][T21642] FAULT_INJECTION: forcing a failure. [ 1367.814466][T21642] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1367.908844][T21642] CPU: 0 UID: 0 PID: 21642 Comm: syz.3.2469 Tainted: G L syzkaller #0 PREEMPT(full) [ 1367.908884][T21642] Tainted: [L]=SOFTLOCKUP [ 1367.908893][T21642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1367.908908][T21642] Call Trace: [ 1367.908915][T21642] [ 1367.908924][T21642] dump_stack_lvl+0x100/0x190 [ 1367.908957][T21642] should_fail_ex.cold+0x5/0xa [ 1367.908984][T21642] get_futex_key+0x1d2/0x14f0 [ 1367.909014][T21642] ? __pfx_get_futex_key+0x10/0x10 [ 1367.909048][T21642] futex_wake+0xf4/0x5e0 [ 1367.909083][T21642] ? __pfx___vma_start_write+0x10/0x10 [ 1367.909126][T21642] ? __pfx_futex_wake+0x10/0x10 [ 1367.909163][T21642] ? ksm_add_vmas+0x27b/0x360 [ 1367.909207][T21642] do_futex+0x2b2/0x440 [ 1367.909236][T21642] ? __pfx_do_futex+0x10/0x10 [ 1367.909262][T21642] ? find_held_lock+0x2b/0x80 [ 1367.909293][T21642] ? __do_sys_prctl+0x114d/0x2270 [ 1367.909330][T21642] ? __do_sys_prctl+0x114d/0x2270 [ 1367.909373][T21642] __x64_sys_futex+0x34f/0x4d0 [ 1367.909404][T21642] ? __pfx___x64_sys_futex+0x10/0x10 [ 1367.909434][T21642] ? __pfx___do_sys_prctl+0x10/0x10 [ 1367.909479][T21642] do_syscall_64+0x115/0x840 [ 1367.909510][T21642] ? clear_bhb_loop+0x40/0x90 [ 1367.909540][T21642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.909566][T21642] RIP: 0033:0x7f9d5979e019 [ 1367.909586][T21642] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1367.909611][T21642] RSP: 002b:00007f9d5a64f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1367.909635][T21642] RAX: ffffffffffffffda RBX: 00007f9d59a25fa8 RCX: 00007f9d5979e019 [ 1367.909651][T21642] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f9d59a25fac [ 1367.909667][T21642] RBP: 00007f9d59a25fa0 R08: 0000000000000001 R09: 0000000000000000 [ 1367.909682][T21642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1367.909697][T21642] R13: 00007f9d59a26038 R14: 00007ffdb34a78b0 R15: 00007ffdb34a7998 [ 1367.909728][T21642] [ 1368.258930][T21454] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1368.357340][T21454] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1368.904652][T21454] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1368.916302][T21454] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1368.924535][T21454] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1368.980968][T21454] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1369.108354][T21454] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1369.165255][T21454] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1372.435821][T21454] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1372.665816][ T50] Bluetooth: hci1: unexpected event for opcode 0x7c89 [ 1372.698020][T21454] 8021q: adding VLAN 0 to HW filter on device team0 [ 1372.786690][T18728] bridge0: port 1(bridge_slave_0) entered blocking state [ 1372.793933][T18728] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1372.883136][T18728] bridge0: port 2(bridge_slave_1) entered blocking state [ 1372.890381][T18728] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1374.944039][T21760] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2479'. [ 1375.483708][T21778] netlink: 'syz.3.2481': attribute type 1 has an invalid length. [ 1377.308098][T21454] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1377.938251][T21454] veth0_vlan: entered promiscuous mode [ 1378.040018][T21454] veth1_vlan: entered promiscuous mode [ 1378.387823][T18723] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1378.580198][T21454] veth0_macvtap: entered promiscuous mode [ 1378.642931][T21454] veth1_macvtap: entered promiscuous mode [ 1378.817655][T18723] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1379.114748][T21820] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1379.132101][T21820] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1379.142347][T21820] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1379.154432][T21820] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1379.163008][T21820] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1379.366300][T18723] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1379.751589][T18723] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1379.821257][T21454] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1379.888787][T21454] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1380.038269][T18728] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1380.070721][T18728] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1380.145843][ T1102] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1380.304916][T18728] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1380.691341][T18723] bridge_slave_1: left allmulticast mode [ 1380.717275][T18723] bridge_slave_1: left promiscuous mode [ 1380.749356][T18723] bridge0: port 2(bridge_slave_1) entered disabled state [ 1380.817360][T18723] bridge_slave_0: left allmulticast mode [ 1380.849984][T18723] bridge_slave_0: left promiscuous mode [ 1380.875525][T18723] bridge0: port 1(bridge_slave_0) entered disabled state [ 1381.254842][T21820] Bluetooth: hci3: command tx timeout [ 1381.656841][T18723] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1381.721198][T18723] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1381.782347][T18723] bond0 (unregistering): Released all slaves [ 1381.841846][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1381.932907][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1382.421062][T18722] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1382.460708][T18722] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1383.002474][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1383.333108][T21820] Bluetooth: hci3: command tx timeout [ 1383.504878][T21867] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1383.890567][T18723] hsr_slave_0: left promiscuous mode [ 1383.912224][T18723] hsr_slave_1: left promiscuous mode [ 1383.929068][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1383.956232][T18723] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1383.981447][T18723] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1384.008152][T18723] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1384.054041][T18723] veth1_macvtap: left promiscuous mode [ 1384.069926][T18723] veth0_macvtap: left promiscuous mode [ 1384.479795][T18723] team0 (unregistering): Port device team_slave_1 removed [ 1384.524026][T18723] team0 (unregistering): Port device team_slave_0 removed [ 1384.859455][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1385.413150][T21820] Bluetooth: hci3: command tx timeout [ 1386.744406][T21906] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2491'. [ 1387.279505][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1387.492889][T21820] Bluetooth: hci3: command tx timeout [ 1387.653598][T21819] bridge0: port 1(bridge_slave_0) entered blocking state [ 1387.704793][T21819] bridge0: port 1(bridge_slave_0) entered disabled state [ 1387.736103][T21819] bridge_slave_0: entered allmulticast mode [ 1387.784117][T21819] bridge_slave_0: entered promiscuous mode [ 1387.830063][T21819] bridge0: port 2(bridge_slave_1) entered blocking state [ 1387.873967][T21819] bridge0: port 2(bridge_slave_1) entered disabled state [ 1387.910841][T21819] bridge_slave_1: entered allmulticast mode [ 1387.946482][T21819] bridge_slave_1: entered promiscuous mode [ 1388.142436][T21819] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1388.214097][T21819] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1388.738795][T21819] team0: Port device team_slave_0 added [ 1388.859749][T21819] team0: Port device team_slave_1 added [ 1388.933084][T21820] Bluetooth: hci0: command 0x0406 tx timeout [ 1389.177192][T21819] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1389.232406][T21819] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1389.368020][T21819] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1389.529200][T21819] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1389.577495][T21819] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1389.728840][T21819] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1390.017359][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1390.617586][T21819] hsr_slave_0: entered promiscuous mode [ 1390.643914][T21819] hsr_slave_1: entered promiscuous mode [ 1390.668974][T21819] debugfs: 'hsr0' already exists in 'hsr' [ 1390.696116][T21819] Cannot create hsr debugfs directory [ 1397.375480][T21819] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1397.421993][T21819] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1397.677361][T21819] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1397.723896][T21819] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1397.803271][T21819] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1397.870929][T21819] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1397.912872][T21819] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1397.993829][T21819] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1398.973653][T22058] ERROR: Out of memory at tomoyo_memory_ok. [ 1399.060043][T22058] ERROR: Domain ' /sbin/init /etc/init.d/rcS /etc/init.d/S50sshd /sbin/start-stop-daemon /usr/sbin/sshd /usr/libexec/sshd-session /bin/sh /root/ci-qemu-gce-upstream-auto/syz-executor /root/ci-qemu-gce-upstream-auto/syz-executor /newroot/140/:,' not defined. [ 1402.407371][T21819] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1402.861767][T22141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2511'. [ 1402.951066][T21819] 8021q: adding VLAN 0 to HW filter on device team0 [ 1403.545359][T18723] bridge0: port 1(bridge_slave_0) entered blocking state [ 1403.552547][T18723] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1403.785748][T18723] bridge0: port 2(bridge_slave_1) entered blocking state [ 1403.792972][T18723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1404.970281][T22176] FAULT_INJECTION: forcing a failure. [ 1404.970281][T22176] name failslab, interval 1, probability 0, space 0, times 0 [ 1405.044442][T22176] CPU: 0 UID: 0 PID: 22176 Comm: syz.0.2514 Tainted: G L syzkaller #0 PREEMPT(full) [ 1405.044483][T22176] Tainted: [L]=SOFTLOCKUP [ 1405.044492][T22176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1405.044507][T22176] Call Trace: [ 1405.044515][T22176] [ 1405.044524][T22176] dump_stack_lvl+0x100/0x190 [ 1405.044558][T22176] should_fail_ex.cold+0x5/0xa [ 1405.044588][T22176] should_failslab+0xc2/0x120 [ 1405.044625][T22176] __kmalloc_cache_noprof+0x91/0x6c0 [ 1405.044653][T22176] ? xfd_validate_state+0x129/0x190 [ 1405.044686][T22176] ? __do_sys_memfd_create+0x170/0x3d0 [ 1405.044728][T22176] __do_sys_memfd_create+0x170/0x3d0 [ 1405.044767][T22176] do_syscall_64+0x115/0x840 [ 1405.044800][T22176] ? clear_bhb_loop+0x40/0x90 [ 1405.044831][T22176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1405.044857][T22176] RIP: 0033:0x7fa27559e019 [ 1405.044877][T22176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1405.044901][T22176] RSP: 002b:00007fa2763e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 1405.044925][T22176] RAX: ffffffffffffffda RBX: 00007fa275826090 RCX: 00007fa27559e019 [ 1405.044942][T22176] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 1405.044957][T22176] RBP: 00007fa27563500c R08: 0000000000000000 R09: 0000000000000000 [ 1405.044972][T22176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1405.044987][T22176] R13: 00007fa275826128 R14: 00007fa275826090 R15: 00007ffe887b1e48 [ 1405.045018][T22176] [ 1408.336767][T21819] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1409.096259][T22245] random: crng reseeded on system resumption [ 1409.626226][T21819] veth0_vlan: entered promiscuous mode [ 1409.815767][T21819] veth1_vlan: entered promiscuous mode [ 1409.914772][T21819] veth0_macvtap: entered promiscuous mode [ 1409.955145][T21819] veth1_macvtap: entered promiscuous mode [ 1410.176275][T21819] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1410.251076][T21819] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1410.699749][T18723] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1411.454259][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1411.494543][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1411.590433][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1411.786390][T18728] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1411.829266][T18728] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1411.952696][T18728] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1412.011531][T18728] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1412.246059][T22276] sg_write: data in/out 65500/1048664 bytes for SCSI command 0x0-- guessing data in; [ 1412.246059][T22276] program syz.3.2525 not setting count and/or reply_len properly [ 1415.255718][T22309] FAULT_INJECTION: forcing a failure. [ 1415.255718][T22309] name failslab, interval 1, probability 0, space 0, times 0 [ 1415.346917][T22309] CPU: 0 UID: 0 PID: 22309 Comm: syz.0.2530 Tainted: G L syzkaller #0 PREEMPT(full) [ 1415.346954][T22309] Tainted: [L]=SOFTLOCKUP [ 1415.346962][T22309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1415.346976][T22309] Call Trace: [ 1415.346983][T22309] [ 1415.346991][T22309] dump_stack_lvl+0x100/0x190 [ 1415.347023][T22309] should_fail_ex.cold+0x5/0xa [ 1415.347045][T22309] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1415.347073][T22309] should_failslab+0xc2/0x120 [ 1415.347115][T22309] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1415.347146][T22309] ? skb_clone+0x190/0x400 [ 1415.347186][T22309] skb_clone+0x190/0x400 [ 1415.347219][T22309] netlink_deliver_tap+0xaed/0xcc0 [ 1415.347250][T22309] netlink_dump+0x631/0xd00 [ 1415.347276][T22309] ? __pfx_netlink_dump+0x10/0x10 [ 1415.347296][T22309] ? __kasan_kmalloc+0xaa/0xb0 [ 1415.347339][T22309] ? __asan_memset+0x23/0x50 [ 1415.347364][T22309] ? genl_start+0x67a/0x970 [ 1415.347395][T22309] __netlink_dump_start+0x6d6/0x990 [ 1415.347423][T22309] genl_family_rcv_msg_dumpit+0x1e2/0x2e0 [ 1415.347456][T22309] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 1415.347494][T22309] ? __pfx_genl_get_cmd+0x10/0x10 [ 1415.347518][T22309] ? __pfx_genl_start+0x10/0x10 [ 1415.347544][T22309] ? __pfx_genl_dumpit+0x10/0x10 [ 1415.347570][T22309] ? __pfx_genl_done+0x10/0x10 [ 1415.347600][T22309] ? __dev_queue_xmit+0xa33/0x4970 [ 1415.347706][T22309] ? __radix_tree_lookup+0x217/0x2b0 [ 1415.347763][T22309] genl_rcv_msg+0x471/0x800 [ 1415.347795][T22309] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1415.347825][T22309] ? __pfx_tipc_nl_media_dump+0x10/0x10 [ 1415.347906][T22309] netlink_rcv_skb+0x159/0x420 [ 1415.347931][T22309] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1415.347962][T22309] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1415.347999][T22309] ? netlink_deliver_tap+0x1ae/0xcc0 [ 1415.348026][T22309] genl_rcv+0x28/0x40 [ 1415.348051][T22309] netlink_unicast+0x585/0x850 [ 1415.348085][T22309] ? __pfx_netlink_unicast+0x10/0x10 [ 1415.348118][T22309] netlink_sendmsg+0x8b0/0xda0 [ 1415.348149][T22309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1415.348178][T22309] ? apparmor_socket_sendmsg+0x15b/0x270 [ 1415.348210][T22309] ____sys_sendmsg+0xa4d/0xbe0 [ 1415.348233][T22309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1415.348261][T22309] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1415.348297][T22309] ___sys_sendmsg+0x190/0x1e0 [ 1415.348323][T22309] ? __pfx____sys_sendmsg+0x10/0x10 [ 1415.348346][T22309] ? __lock_acquire+0x49f/0x1a40 [ 1415.348387][T22309] ? get_pid_task+0x106/0x250 [ 1415.348449][T22309] __sys_sendmsg+0x160/0x210 [ 1415.348482][T22309] ? __pfx___sys_sendmsg+0x10/0x10 [ 1415.348530][T22309] do_syscall_64+0x115/0x840 [ 1415.348559][T22309] ? clear_bhb_loop+0x40/0x90 [ 1415.348587][T22309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1415.348611][T22309] RIP: 0033:0x7fa27559e019 [ 1415.348630][T22309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1415.348653][T22309] RSP: 002b:00007fa276409028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1415.348676][T22309] RAX: ffffffffffffffda RBX: 00007fa275825fa0 RCX: 00007fa27559e019 [ 1415.348691][T22309] RDX: 0000000000000010 RSI: 00002000000003c0 RDI: 0000000000000003 [ 1415.348705][T22309] RBP: 00007fa276409090 R08: 0000000000000000 R09: 0000000000000000 [ 1415.348720][T22309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1415.348733][T22309] R13: 00007fa275826038 R14: 00007fa275825fa0 R15: 00007ffe887b1e48 [ 1415.348763][T22309] [ 1419.028913][T22367] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1421.444877][T22391] netlink: 'syz.2.2544': attribute type 8 has an invalid length. [ 1422.678704][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.720493][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1431.544533][T22493] usb usb3: usbfs: process 22493 (syz.0.2562) did not claim interface 0 before use [ 1434.566406][T22534] nbd: socks must be embedded in a SOCK_ITEM attr [ 1434.613461][T22534] block nbd0: shutting down sockets [ 1434.668966][T22539] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1434.971470][T22545] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2573'. [ 1434.982035][T22530] netlink: 'syz.0.2570': attribute type 1 has an invalid length. [ 1450.975571][T22726] zram: Cannot change disksize for initialized device [ 1455.910497][T21820] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1455.927095][T21820] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1455.943329][T21820] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1455.951410][T21820] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1455.963870][T21820] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1456.348310][T18728] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1456.700810][T18728] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1456.924749][T18728] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1457.171543][T18728] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1457.208829][T22792] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2611'. [ 1457.648377][T22796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2613'. [ 1458.015921][T21820] Bluetooth: hci3: command tx timeout [ 1458.431983][T18728] bridge_slave_1: left allmulticast mode [ 1458.454409][T18728] bridge_slave_1: left promiscuous mode [ 1458.473792][T18728] bridge0: port 2(bridge_slave_1) entered disabled state [ 1458.518053][T18728] bridge_slave_0: left allmulticast mode [ 1458.550107][T18728] bridge_slave_0: left promiscuous mode [ 1458.571890][T18728] bridge0: port 1(bridge_slave_0) entered disabled state [ 1459.076630][T18728] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1459.098092][T18728] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1459.121492][T18728] bond0 (unregistering): Released all slaves [ 1460.012975][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1460.096611][T21820] Bluetooth: hci3: command tx timeout [ 1460.119235][T18728] hsr_slave_0: left promiscuous mode [ 1460.128713][T18728] hsr_slave_1: left promiscuous mode [ 1460.135516][T18728] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1460.143085][T18728] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1460.154620][T18728] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1460.162393][T18728] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1460.177554][T18728] veth1_macvtap: left promiscuous mode [ 1460.183255][T18728] veth0_macvtap: left promiscuous mode [ 1460.189830][T18728] veth1_vlan: left promiscuous mode [ 1460.195645][T18728] veth0_vlan: left promiscuous mode [ 1460.442438][T18728] team0 (unregistering): Port device team_slave_1 removed [ 1460.469747][T18728] team0 (unregistering): Port device team_slave_0 removed [ 1461.072487][T22781] bridge0: port 1(bridge_slave_0) entered blocking state [ 1461.134766][T22781] bridge0: port 1(bridge_slave_0) entered disabled state [ 1461.183714][T22781] bridge_slave_0: entered allmulticast mode [ 1461.223955][T22781] bridge_slave_0: entered promiscuous mode [ 1461.412849][T22781] bridge0: port 2(bridge_slave_1) entered blocking state [ 1461.455259][T22781] bridge0: port 2(bridge_slave_1) entered disabled state [ 1461.505990][T22781] bridge_slave_1: entered allmulticast mode [ 1461.556118][T22781] bridge_slave_1: entered promiscuous mode [ 1461.912787][T22781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1462.173679][T21820] Bluetooth: hci3: command tx timeout [ 1462.562565][T22781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1463.028917][T22877] futex_wake_op: syz.0.2619 tries to shift op by -2048; fix this program [ 1463.155714][T22877] futex_wake_op: syz.0.2619 tries to shift op by -2048; fix this program [ 1463.331792][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1463.528569][T22781] team0: Port device team_slave_0 added [ 1463.681345][T22781] team0: Port device team_slave_1 added [ 1464.048136][T22781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1464.067049][T22781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1464.125893][T22781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1464.252974][T21820] Bluetooth: hci3: command tx timeout [ 1464.311316][T22781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1464.332145][T22781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1464.390987][T22781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1464.765993][T22781] hsr_slave_0: entered promiscuous mode [ 1464.789752][T22781] hsr_slave_1: entered promiscuous mode [ 1464.815646][T22781] debugfs: 'hsr0' already exists in 'hsr' [ 1464.836647][T22781] Cannot create hsr debugfs directory [ 1465.991044][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1471.499568][T22781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1471.546492][T22781] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1471.702644][T22781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1471.734394][T22781] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1471.901963][T22781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1471.954744][T22781] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1472.000839][T22781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1472.050102][T22781] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1473.846010][T22781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1473.993356][T22781] 8021q: adding VLAN 0 to HW filter on device team0 [ 1474.300401][ T81] bridge0: port 1(bridge_slave_0) entered blocking state [ 1474.307621][ T81] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1474.575186][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1474.582409][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1479.770705][T22781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1479.986391][T22781] veth0_vlan: entered promiscuous mode [ 1480.042628][T22781] veth1_vlan: entered promiscuous mode [ 1480.226803][T22781] veth0_macvtap: entered promiscuous mode [ 1480.275291][T22781] veth1_macvtap: entered promiscuous mode [ 1480.379728][T22781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1480.528645][T22781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1481.048670][T21820] Bluetooth: hci2: command 0x0406 tx timeout [ 1481.197046][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1481.548996][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1482.001373][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1482.027824][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1482.237893][T18728] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1482.356461][T18722] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1482.421237][T18722] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1482.478748][T18722] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1484.084270][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.090943][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1489.477062][T23245] FAULT_INJECTION: forcing a failure. [ 1489.477062][T23245] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1489.536559][T23245] CPU: 0 UID: 0 PID: 23245 Comm: syz.1.2664 Tainted: G L syzkaller #0 PREEMPT(full) [ 1489.536597][T23245] Tainted: [L]=SOFTLOCKUP [ 1489.536605][T23245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1489.536620][T23245] Call Trace: [ 1489.536627][T23245] [ 1489.536636][T23245] dump_stack_lvl+0x100/0x190 [ 1489.536668][T23245] should_fail_ex.cold+0x5/0xa [ 1489.536695][T23245] _copy_to_user+0x32/0xd0 [ 1489.536735][T23245] simple_read_from_buffer+0xcb/0x170 [ 1489.536778][T23245] proc_fail_nth_read+0x1af/0x230 [ 1489.536815][T23245] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1489.536854][T23245] ? rw_verify_area+0xce/0x6d0 [ 1489.536889][T23245] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1489.536921][T23245] vfs_read+0x1e4/0xb40 [ 1489.536946][T23245] ? __pfx_vfs_read+0x10/0x10 [ 1489.536966][T23245] ? __fget_files+0x215/0x3d0 [ 1489.536995][T23245] ? __fget_files+0x21f/0x3d0 [ 1489.537024][T23245] ksys_read+0x12a/0x250 [ 1489.537045][T23245] ? __pfx_ksys_read+0x10/0x10 [ 1489.537074][T23245] do_syscall_64+0x115/0x840 [ 1489.537104][T23245] ? clear_bhb_loop+0x40/0x90 [ 1489.537133][T23245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1489.537157][T23245] RIP: 0033:0x7fc8fd15e84e [ 1489.537177][T23245] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1489.537199][T23245] RSP: 002b:00007fc8fe04bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1489.537221][T23245] RAX: ffffffffffffffda RBX: 00007fc8fe04c6c0 RCX: 00007fc8fd15e84e [ 1489.537237][T23245] RDX: 000000000000000f RSI: 00007fc8fe04c0a0 RDI: 0000000000000006 [ 1489.537251][T23245] RBP: 00007fc8fe04c090 R08: 0000000000000000 R09: 0000000000000000 [ 1489.537265][T23245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1489.537279][T23245] R13: 00007fc8fd4263f8 R14: 00007fc8fd426360 R15: 00007fffbc595088 [ 1489.537308][T23245] [ 1511.384029][T23490] nbd: must specify a size in bytes for the device [ 1511.451437][T23487] bond0: invalid ARP target specified [ 1511.726065][T23487] hub 1-0:1.0: USB hub found [ 1511.754608][T23487] hub 1-0:1.0: 1 port detected [ 1512.195673][T23499] netlink: 334 bytes leftover after parsing attributes in process `syz.1.2706'. [ 1526.225701][T23665] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1526.954666][T23675] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2738'. [ 1545.502612][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.513069][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.836853][T23897] random: crng reseeded on system resumption [ 1548.008760][T23931] FAULT_INJECTION: forcing a failure. [ 1548.008760][T23931] name failslab, interval 1, probability 0, space 0, times 0 [ 1548.076049][T23931] CPU: 0 UID: 0 PID: 23931 Comm: syz.2.2783 Tainted: G L syzkaller #0 PREEMPT(full) [ 1548.076087][T23931] Tainted: [L]=SOFTLOCKUP [ 1548.076094][T23931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1548.076110][T23931] Call Trace: [ 1548.076118][T23931] [ 1548.076127][T23931] dump_stack_lvl+0x100/0x190 [ 1548.076161][T23931] should_fail_ex.cold+0x5/0xa [ 1548.076188][T23931] should_failslab+0xc2/0x120 [ 1548.076223][T23931] __kmalloc_noprof+0xfc/0x820 [ 1548.076253][T23931] ? copy_splice_read+0x1a3/0xbb0 [ 1548.076283][T23931] copy_splice_read+0x1a3/0xbb0 [ 1548.076314][T23931] ? __pfx_copy_splice_read+0x10/0x10 [ 1548.076355][T23931] ? lockdep_init_map_type+0x5c/0x250 [ 1548.076381][T23931] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 1548.076422][T23931] ? __pfx_filemap_splice_read+0x10/0x10 [ 1548.076449][T23931] do_splice_read+0x2bd/0x370 [ 1548.076476][T23931] splice_direct_to_actor+0x2a1/0xa30 [ 1548.076503][T23931] ? __pfx_direct_splice_actor+0x10/0x10 [ 1548.076533][T23931] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1548.076566][T23931] do_splice_direct+0x174/0x240 [ 1548.076593][T23931] ? __pfx_do_splice_direct+0x10/0x10 [ 1548.076618][T23931] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1548.076644][T23931] ? bpf_lsm_file_permission+0x9/0x10 [ 1548.076667][T23931] ? security_file_permission+0x76/0x210 [ 1548.076705][T23931] ? rw_verify_area+0xce/0x6d0 [ 1548.076743][T23931] do_sendfile+0xadc/0xe20 [ 1548.076786][T23931] ? __pfx_do_sendfile+0x10/0x10 [ 1548.076821][T23931] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1548.076857][T23931] ? __fget_files+0x21f/0x3d0 [ 1548.076885][T23931] __x64_sys_sendfile64+0x1d8/0x220 [ 1548.076912][T23931] ? ksys_write+0x1ac/0x250 [ 1548.076933][T23931] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1548.076969][T23931] do_syscall_64+0x115/0x840 [ 1548.076998][T23931] ? clear_bhb_loop+0x40/0x90 [ 1548.077027][T23931] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.077052][T23931] RIP: 0033:0x7f3e66b9e019 [ 1548.077074][T23931] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1548.077097][T23931] RSP: 002b:00007f3e64df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1548.077119][T23931] RAX: ffffffffffffffda RBX: 00007f3e66e25fa0 RCX: 00007f3e66b9e019 [ 1548.077135][T23931] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 1548.077149][T23931] RBP: 00007f3e64df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1548.077163][T23931] R10: 0000400000000006 R11: 0000000000000246 R12: 0000000000000002 [ 1548.077177][T23931] R13: 00007f3e66e26038 R14: 00007f3e66e25fa0 R15: 00007ffe410c4cd8 [ 1548.077206][T23931] [ 1556.144158][T23140] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1556.161679][T23140] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1556.170016][T23140] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1556.181601][T23140] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1556.191316][T23140] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1556.343394][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1556.833860][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1557.110830][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1557.637943][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1558.285585][T23140] Bluetooth: hci3: command tx timeout [ 1559.087423][ T13] bridge_slave_1: left allmulticast mode [ 1559.113930][ T13] bridge_slave_1: left promiscuous mode [ 1559.139424][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1559.168130][ T13] bridge_slave_0: left allmulticast mode [ 1559.189541][ T13] bridge_slave_0: left promiscuous mode [ 1559.208708][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1559.758892][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1559.788858][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1559.821589][ T13] bond0 (unregistering): Released all slaves [ 1560.364302][T23140] Bluetooth: hci3: command tx timeout [ 1560.612194][ T81] EXT4-fs error (device sda1): ext4_validate_block_bitmap:423: comm kworker/u8:5: bg 2: bad block bitmap checksum [ 1560.683158][ T81] EXT4-fs (sda1): Delayed block allocation failed for inode 2031 at logical offset 6 with max blocks 7 with error 74 [ 1560.768638][ T81] EXT4-fs (sda1): This should not happen!! Data will be lost [ 1560.768638][ T81] [ 1560.942487][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1561.160476][ T13] hsr_slave_0: left promiscuous mode [ 1561.171667][ T13] hsr_slave_1: left promiscuous mode [ 1561.179124][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1561.188177][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1561.196431][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1561.204894][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1561.221251][ T13] veth1_macvtap: left promiscuous mode [ 1561.227370][ T13] veth0_macvtap: left promiscuous mode [ 1561.233565][ T13] veth1_vlan: left promiscuous mode [ 1561.241113][ T13] veth0_vlan: left promiscuous mode [ 1561.483262][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1561.506528][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1562.443601][T23140] Bluetooth: hci3: command tx timeout [ 1562.999064][T24017] bridge0: port 1(bridge_slave_0) entered blocking state [ 1563.036777][T24017] bridge0: port 1(bridge_slave_0) entered disabled state [ 1563.074668][T24017] bridge_slave_0: entered allmulticast mode [ 1563.107904][T24017] bridge_slave_0: entered promiscuous mode [ 1563.222569][T24017] bridge0: port 2(bridge_slave_1) entered blocking state [ 1563.252327][T24017] bridge0: port 2(bridge_slave_1) entered disabled state [ 1563.289477][T24017] bridge_slave_1: entered allmulticast mode [ 1563.325784][T24017] bridge_slave_1: entered promiscuous mode [ 1563.684389][T24017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1563.916278][T24017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1563.928058][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1564.129830][T24017] team0: Port device team_slave_0 added [ 1564.364205][T24017] team0: Port device team_slave_1 added [ 1564.523227][T23140] Bluetooth: hci3: command tx timeout [ 1564.868285][T24017] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1564.902108][T24017] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1564.973187][T24017] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1565.015728][T24017] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1565.032365][T24017] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1565.087368][T24017] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1565.836913][T24017] hsr_slave_0: entered promiscuous mode [ 1565.865878][T24017] hsr_slave_1: entered promiscuous mode [ 1565.903023][T24017] debugfs: 'hsr0' already exists in 'hsr' [ 1565.937200][T24017] Cannot create hsr debugfs directory [ 1566.436997][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1571.656148][T24017] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1571.685850][T24017] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1571.903265][T24017] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1571.932298][T24017] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1572.078113][T24017] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1572.110663][T24017] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1572.252609][T24017] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1572.290885][T24017] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1573.156466][T24017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1573.877167][T24017] 8021q: adding VLAN 0 to HW filter on device team0 [ 1574.207778][T18728] bridge0: port 1(bridge_slave_0) entered blocking state [ 1574.214997][T18728] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1574.469182][T18728] bridge0: port 2(bridge_slave_1) entered blocking state [ 1574.476441][T18728] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1578.322902][T24017] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1578.498731][T24017] veth0_vlan: entered promiscuous mode [ 1578.576463][T24017] veth1_vlan: entered promiscuous mode [ 1578.762820][T24017] veth0_macvtap: entered promiscuous mode [ 1578.802931][T24017] veth1_macvtap: entered promiscuous mode [ 1578.940665][T24017] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1578.996767][T24017] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1579.007044][T24340] FAULT_INJECTION: forcing a failure. [ 1579.007044][T24340] name failslab, interval 1, probability 0, space 0, times 0 [ 1579.062436][T24340] CPU: 0 UID: 0 PID: 24340 Comm: syz.3.2822 Tainted: G L syzkaller #0 PREEMPT(full) [ 1579.062476][T24340] Tainted: [L]=SOFTLOCKUP [ 1579.062485][T24340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1579.062500][T24340] Call Trace: [ 1579.062507][T24340] [ 1579.062517][T24340] dump_stack_lvl+0x100/0x190 [ 1579.062549][T24340] should_fail_ex.cold+0x5/0xa [ 1579.062578][T24340] should_failslab+0xc2/0x120 [ 1579.062614][T24340] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1579.062648][T24340] ? __anon_vma_prepare+0x344/0x5e0 [ 1579.062679][T24340] __anon_vma_prepare+0x344/0x5e0 [ 1579.062710][T24340] __vmf_anon_prepare+0x11f/0x250 [ 1579.062750][T24340] do_anonymous_page+0x51b/0x2080 [ 1579.062776][T24340] ? rcu_read_unlock+0x2d/0xb0 [ 1579.062808][T24340] __handle_mm_fault+0x1d2c/0x2a00 [ 1579.062837][T24340] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1579.062869][T24340] ? __pfx___handle_mm_fault+0x10/0x10 [ 1579.062896][T24340] ? pte_offset_map_lock+0x174/0x320 [ 1579.062930][T24340] ? find_held_lock+0x2b/0x80 [ 1579.062971][T24340] ? follow_page_pte+0x4d0/0x13f0 [ 1579.063012][T24340] handle_mm_fault+0x37b/0xa30 [ 1579.063043][T24340] __get_user_pages+0x1178/0x32a0 [ 1579.063098][T24340] ? __pfx___get_user_pages+0x10/0x10 [ 1579.063143][T24340] populate_vma_page_range+0x267/0x3f0 [ 1579.063184][T24340] ? __pfx_populate_vma_page_range+0x10/0x10 [ 1579.063222][T24340] ? __pfx_find_vma_intersection+0x10/0x10 [ 1579.063259][T24340] ? do_mmap+0x93f/0x12f0 [ 1579.063298][T24340] __mm_populate+0x107/0x3a0 [ 1579.063338][T24340] ? __pfx___mm_populate+0x10/0x10 [ 1579.063378][T24340] ? up_write+0x2e5/0x5c0 [ 1579.063406][T24340] vm_mmap_pgoff+0x37f/0x470 [ 1579.063445][T24340] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1579.063485][T24340] ? __pfx_do_futex+0x10/0x10 [ 1579.063514][T24340] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1579.063552][T24340] ksys_mmap_pgoff+0xe4/0x610 [ 1579.063587][T24340] ? __x64_sys_futex+0x358/0x4d0 [ 1579.063616][T24340] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 1579.063651][T24340] ? xfd_validate_state+0x129/0x190 [ 1579.063687][T24340] __x64_sys_mmap+0x125/0x190 [ 1579.063721][T24340] do_syscall_64+0x115/0x840 [ 1579.063752][T24340] ? clear_bhb_loop+0x40/0x90 [ 1579.063782][T24340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.063807][T24340] RIP: 0033:0x7f9d5979e019 [ 1579.063828][T24340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1579.063853][T24340] RSP: 002b:00007f9d5a64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1579.063877][T24340] RAX: ffffffffffffffda RBX: 00007f9d59a25fa0 RCX: 00007f9d5979e019 [ 1579.063893][T24340] RDX: 0000000000000036 RSI: 0000000000400008 RDI: 0000000000001000 [ 1579.063908][T24340] RBP: 00007f9d5983500c R08: 0000000000000002 R09: 0000000080000000 [ 1579.063924][T24340] R10: 0000000000009b72 R11: 0000000000000246 R12: 0000000000000000 [ 1579.063939][T24340] R13: 00007f9d59a26038 R14: 00007f9d59a25fa0 R15: 00007ffdb34a7998 [ 1579.063970][T24340] [ 1579.528782][T24332] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1579.548585][T24332] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1579.558021][T24332] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1579.567916][T24332] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1579.651697][T24332] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1579.659753][T24332] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1579.667325][T24332] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1579.675187][T24332] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1580.257217][T24360] FAULT_INJECTION: forcing a failure. [ 1580.257217][T24360] name failslab, interval 1, probability 0, space 0, times 0 [ 1580.361953][T24360] CPU: 0 UID: 0 PID: 24360 Comm: syz.3.2824 Tainted: G L syzkaller #0 PREEMPT(full) [ 1580.361995][T24360] Tainted: [L]=SOFTLOCKUP [ 1580.362004][T24360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1580.362019][T24360] Call Trace: [ 1580.362027][T24360] [ 1580.362036][T24360] dump_stack_lvl+0x100/0x190 [ 1580.362068][T24360] should_fail_ex.cold+0x5/0xa [ 1580.362096][T24360] should_failslab+0xc2/0x120 [ 1580.362133][T24360] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1580.362166][T24360] ? anon_vma_clone+0x2ba/0xcd0 [ 1580.362211][T24360] anon_vma_clone+0x2ba/0xcd0 [ 1580.362259][T24360] __split_vma+0x51f/0xda0 [ 1580.362287][T24360] ? __pfx___split_vma+0x10/0x10 [ 1580.362310][T24360] ? vma_link+0x5ee/0x8d0 [ 1580.362349][T24360] vms_gather_munmap_vmas+0x1d2/0x1720 [ 1580.362383][T24360] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1580.362410][T24360] ? alloc_new_pud+0x217/0x320 [ 1580.362435][T24360] ? get_old_pud+0xd8/0x360 [ 1580.362462][T24360] ? move_page_tables+0x11c/0x4610 [ 1580.362491][T24360] ? __pfx_copy_vma+0x10/0x10 [ 1580.362528][T24360] do_vmi_align_munmap+0x287/0x5f0 [ 1580.362559][T24360] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1580.362627][T24360] do_vmi_munmap+0x1f8/0x3e0 [ 1580.362658][T24360] move_vma+0xe5b/0x1920 [ 1580.362690][T24360] ? __pfx_move_vma+0x10/0x10 [ 1580.362720][T24360] ? mm_get_unmapped_area_vmflags+0xd7/0x130 [ 1580.362768][T24360] ? vrm_set_new_addr+0x204/0x290 [ 1580.362798][T24360] mremap_to+0x234/0x4c0 [ 1580.362823][T24360] ? mas_walk+0x6ef/0x9b0 [ 1580.362855][T24360] ? __pfx_mremap_to+0x10/0x10 [ 1580.362881][T24360] ? check_prep_vma+0x912/0xe60 [ 1580.362913][T24360] __do_sys_mremap+0x88c/0x1850 [ 1580.362959][T24360] ? __pfx___do_sys_mremap+0x10/0x10 [ 1580.362986][T24360] ? ksys_write+0x190/0x250 [ 1580.363016][T24360] ? __pfx_do_futex+0x10/0x10 [ 1580.363053][T24360] ? __x64_sys_futex+0x34f/0x4d0 [ 1580.363097][T24360] do_syscall_64+0x115/0x840 [ 1580.363128][T24360] ? clear_bhb_loop+0x40/0x90 [ 1580.363159][T24360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1580.363185][T24360] RIP: 0033:0x7f9d5979e019 [ 1580.363205][T24360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1580.363230][T24360] RSP: 002b:00007f9d5a5cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1580.363253][T24360] RAX: ffffffffffffffda RBX: 00007f9d59a26360 RCX: 00007f9d5979e019 [ 1580.363270][T24360] RDX: 0000000000000004 RSI: 0000000000000004 RDI: 0000200000400000 [ 1580.363285][T24360] RBP: 00007f9d5983500c R08: 0000000100000000 R09: 0000000000000000 [ 1580.363301][T24360] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 1580.363316][T24360] R13: 00007f9d59a263f8 R14: 00007f9d59a26360 R15: 00007ffdb34a7998 [ 1580.363347][T24360] [ 1591.877464][T24496] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2845'. [ 1593.662883][T24520] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2848'. [ 1601.810724][T24614] FAULT_INJECTION: forcing a failure. [ 1601.810724][T24614] name failslab, interval 1, probability 0, space 0, times 0 [ 1601.904991][T24614] CPU: 0 UID: 0 PID: 24614 Comm: syz.2.2863 Tainted: G L syzkaller #0 PREEMPT(full) [ 1601.905030][T24614] Tainted: [L]=SOFTLOCKUP [ 1601.905040][T24614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1601.905054][T24614] Call Trace: [ 1601.905062][T24614] [ 1601.905072][T24614] dump_stack_lvl+0x100/0x190 [ 1601.905104][T24614] should_fail_ex.cold+0x5/0xa [ 1601.905133][T24614] should_failslab+0xc2/0x120 [ 1601.905169][T24614] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1601.905200][T24614] ? __pfx___might_resched+0x10/0x10 [ 1601.905241][T24614] ? __ksm_enter+0x3c/0x630 [ 1601.905275][T24614] __ksm_enter+0x3c/0x630 [ 1601.905308][T24614] ksm_enable_merge_any+0xbf/0x120 [ 1601.905339][T24614] __do_sys_prctl+0x1086/0x2270 [ 1601.905380][T24614] ? __pfx___do_sys_prctl+0x10/0x10 [ 1601.905425][T24614] do_syscall_64+0x115/0x840 [ 1601.905457][T24614] ? clear_bhb_loop+0x40/0x90 [ 1601.905487][T24614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1601.905521][T24614] RIP: 0033:0x7f3e66b9e019 [ 1601.905541][T24614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1601.905566][T24614] RSP: 002b:00007f3e64dd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 1601.905589][T24614] RAX: ffffffffffffffda RBX: 00007f3e66e26090 RCX: 00007f3e66b9e019 [ 1601.905606][T24614] RDX: 0000000000000000 RSI: 0000000000000017 RDI: 0000000000000043 [ 1601.905621][T24614] RBP: 00007f3e66c3500c R08: 0000000000000000 R09: 0000000000000000 [ 1601.905636][T24614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1601.905651][T24614] R13: 00007f3e66e26128 R14: 00007f3e66e26090 R15: 00007ffe410c4cd8 [ 1601.905682][T24614] [ 1602.532164][T24613] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2864'. [ 1606.906177][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1606.917656][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1608.806129][T24704] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1611.093781][T24729] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2880'. [ 1618.479052][T24806] FAULT_INJECTION: forcing a failure. [ 1618.479052][T24806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1618.581629][T24806] CPU: 0 UID: 8 PID: 24806 Comm: syz.3.2892 Tainted: G L syzkaller #0 PREEMPT(full) [ 1618.581665][T24806] Tainted: [L]=SOFTLOCKUP [ 1618.581673][T24806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1618.581687][T24806] Call Trace: [ 1618.581694][T24806] [ 1618.581702][T24806] dump_stack_lvl+0x100/0x190 [ 1618.581741][T24806] should_fail_ex.cold+0x5/0xa [ 1618.581767][T24806] _copy_to_user+0x32/0xd0 [ 1618.581808][T24806] kvm_arch_vm_ioctl+0xc80/0x18d0 [ 1618.581884][T24806] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 1618.581920][T24806] ? __lock_acquire+0x49f/0x1a40 [ 1618.581965][T24806] ? __lock_acquire+0x49f/0x1a40 [ 1618.582010][T24806] ? __lock_acquire+0x49f/0x1a40 [ 1618.582054][T24806] ? __lock_acquire+0x49f/0x1a40 [ 1618.582115][T24806] ? find_held_lock+0x2b/0x80 [ 1618.582144][T24806] ? is_bpf_text_address+0x8a/0x1a0 [ 1618.582178][T24806] ? is_bpf_text_address+0x8a/0x1a0 [ 1618.582213][T24806] ? bpf_ksym_find+0x124/0x1c0 [ 1618.582238][T24806] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1618.582274][T24806] ? is_bpf_text_address+0x94/0x1a0 [ 1618.582307][T24806] ? kernel_text_address+0x8d/0x100 [ 1618.582342][T24806] ? __pfx_widen_string+0x10/0x10 [ 1618.582364][T24806] ? __kernel_text_address+0xd/0x30 [ 1618.582399][T24806] ? unwind_get_return_address+0x59/0xa0 [ 1618.582442][T24806] ? arch_stack_walk+0xa6/0xf0 [ 1618.582483][T24806] ? tomoyo_path_number_perm+0x46d/0x580 [ 1618.582515][T24806] ? stack_trace_save+0x8e/0xc0 [ 1618.582547][T24806] ? __pfx_stack_trace_save+0x10/0x10 [ 1618.582580][T24806] ? stack_depot_save_flags+0x27/0x9d0 [ 1618.582665][T24806] ? __lock_acquire+0x49f/0x1a40 [ 1618.582702][T24806] ? tomoyo_path_number_perm+0x46d/0x580 [ 1618.582743][T24806] kvm_vm_ioctl+0x1560/0x4180 [ 1618.582781][T24806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1618.582817][T24806] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1618.582868][T24806] ? kasan_quarantine_put+0x104/0x240 [ 1618.582897][T24806] ? lockdep_hardirqs_on+0x78/0x100 [ 1618.582927][T24806] ? find_held_lock+0x2b/0x80 [ 1618.582956][T24806] ? tomoyo_path_number_perm+0x28f/0x580 [ 1618.582987][T24806] ? tomoyo_path_number_perm+0x28f/0x580 [ 1618.583023][T24806] ? tomoyo_path_number_perm+0x188/0x580 [ 1618.583056][T24806] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1618.583096][T24806] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1618.583134][T24806] ? do_vfs_ioctl+0x226/0x13e0 [ 1618.583169][T24806] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1618.583213][T24806] ? hook_file_ioctl_common+0x140/0x440 [ 1618.583258][T24806] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 1618.583293][T24806] __x64_sys_ioctl+0x18e/0x210 [ 1618.583329][T24806] do_syscall_64+0x115/0x840 [ 1618.583358][T24806] ? clear_bhb_loop+0x40/0x90 [ 1618.583387][T24806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1618.583411][T24806] RIP: 0033:0x7f9d5979e019 [ 1618.583430][T24806] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1618.583453][T24806] RSP: 002b:00007f9d5a64f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1618.583475][T24806] RAX: ffffffffffffffda RBX: 00007f9d59a25fa0 RCX: 00007f9d5979e019 [ 1618.583491][T24806] RDX: 0000000000000000 RSI: 00000000c048aec8 RDI: 0000000000000003 [ 1618.583505][T24806] RBP: 00007f9d5a64f090 R08: 0000000000000000 R09: 0000000000000000 [ 1618.583519][T24806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1618.583533][T24806] R13: 00007f9d59a26038 R14: 00007f9d59a25fa0 R15: 00007ffdb34a7998 [ 1618.583562][T24806] [ 1629.988199][T24947] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2913'. [ 1630.384499][T24941] ERROR: Out of memory at tomoyo_memory_ok. [ 1638.554531][T25044] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2928'. [ 1654.783726][T25222] FAULT_INJECTION: forcing a failure. [ 1654.783726][T25222] name failslab, interval 1, probability 0, space 0, times 0 [ 1654.857380][T25222] CPU: 0 UID: 0 PID: 25222 Comm: syz.1.2956 Tainted: G L syzkaller #0 PREEMPT(full) [ 1654.857418][T25222] Tainted: [L]=SOFTLOCKUP [ 1654.857426][T25222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1654.857446][T25222] Call Trace: [ 1654.857454][T25222] [ 1654.857462][T25222] dump_stack_lvl+0x100/0x190 [ 1654.857495][T25222] should_fail_ex.cold+0x5/0xa [ 1654.857522][T25222] should_failslab+0xc2/0x120 [ 1654.857558][T25222] kmem_cache_alloc_noprof+0x91/0x6a0 [ 1654.857595][T25222] ? __pfx_acct_collect+0x10/0x10 [ 1654.857627][T25222] ? taskstats_exit+0x6d3/0xca0 [ 1654.857666][T25222] taskstats_exit+0x6d3/0xca0 [ 1654.857700][T25222] ? __pfx_acct_update_integrals+0x10/0x10 [ 1654.857736][T25222] ? __pfx_taskstats_exit+0x10/0x10 [ 1654.857773][T25222] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1654.857810][T25222] do_exit+0x65c/0x2ae0 [ 1654.857848][T25222] ? __pfx_do_exit+0x10/0x10 [ 1654.857881][T25222] ? do_raw_spin_lock+0x128/0x260 [ 1654.857908][T25222] ? find_held_lock+0x2b/0x80 [ 1654.857937][T25222] ? get_signal+0x7e0/0x21e0 [ 1654.857966][T25222] do_group_exit+0xd5/0x2a0 [ 1654.858002][T25222] get_signal+0x1ec7/0x21e0 [ 1654.858039][T25222] ? __pfx_get_signal+0x10/0x10 [ 1654.858067][T25222] ? do_futex+0x190/0x440 [ 1654.858099][T25222] arch_do_signal_or_restart+0x91/0x7a0 [ 1654.858143][T25222] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1654.858199][T25222] exit_to_user_mode_loop+0x139/0x6f0 [ 1654.858224][T25222] ? rcu_is_watching+0x12/0xc0 [ 1654.858255][T25222] do_syscall_64+0x652/0x840 [ 1654.858287][T25222] ? clear_bhb_loop+0x40/0x90 [ 1654.858322][T25222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1654.858346][T25222] RIP: 0033:0x7fd4ea39e019 [ 1654.858365][T25222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1654.858388][T25222] RSP: 002b:00007fd4eb1980e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1654.858410][T25222] RAX: fffffffffffffe00 RBX: 00007fd4ea626278 RCX: 00007fd4ea39e019 [ 1654.858426][T25222] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd4ea626278 [ 1654.858440][T25222] RBP: 00007fd4ea626270 R08: 0000000000000000 R09: 0000000000000000 [ 1654.858454][T25222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1654.858468][T25222] R13: 00007fd4ea626308 R14: 00007fff36842310 R15: 00007fff368423f8 [ 1654.858498][T25222] [ 1659.352385][T25286] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2967'. [ 1668.314496][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.324603][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1680.631786][T23140] Bluetooth: hci3: command 0x0406 tx timeout [ 1686.429652][T25614] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3016'. [ 1689.222878][T25645] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3020'. [ 1702.660036][T25814] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3045'. [ 1709.874349][T25900] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3057'. [ 1728.628800][T26122] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3089'. [ 1729.721630][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1729.732607][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1736.312487][T26210] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3100'. [ 1742.440520][T26282] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3112'. [ 1746.670439][T26333] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3119'. [ 1751.574342][T26394] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3128'. [ 1757.202067][T26456] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3137'. [ 1767.054362][T26567] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3153'. [ 1767.268504][T26569] ptp ptp0: only physical clock in use now [ 1767.319625][T26567] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1767.367767][T26567] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1791.130348][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.139171][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1793.359214][T26886] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3199'. [ 1799.302674][T26957] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3209'. [ 1804.228461][T27013] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3218'. [ 1847.759282][T27485] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3289'. [ 1848.398064][T27489] futex_wake_op: syz.3.3289 tries to shift op by -2048; fix this program [ 1852.543052][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1852.551879][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1913.953167][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1913.965652][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1917.262399][T28292] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3405'. [ 1922.186662][T28355] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3413'. [ 1941.543004][T28567] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3444'. [ 1965.871671][T28842] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3485'. [ 1973.284877][T28924] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3496'. [ 1975.360187][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1975.372980][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1994.899928][T29190] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3532'. [ 2006.641002][T29333] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3553'. [ 2017.648362][T29462] netlink: 'syz.0.3572': attribute type 5 has an invalid length. [ 2017.710777][T29462] netlink: 4158 bytes leftover after parsing attributes in process `syz.0.3572'. [ 2018.303369][T29476] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3574'. [ 2027.786904][T29590] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3589'. [ 2036.768080][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 2036.776647][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 2042.830281][T29760] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3616'. [ 2050.815468][T29850] netlink: 'syz.2.3630': attribute type 8 has an invalid length. [ 2057.521414][ T30] audit: type=1800 audit(4294967823.202:80): pid=29926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3640" name="lu_gp_id" dev="configfs" ino=249108 res=0 errno=0 [ 2062.051866][T29989] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3650'. [ 2066.202486][T30030] netlink: 'syz.0.3658': attribute type 1 has an invalid length. [ 2070.137574][T30081] kAFS: No cell specified [ 2075.741718][T30152] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3676'. [ 2079.817574][T30205] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3683'. [ 2082.869415][T30236] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3688'. [ 2087.115668][T30283] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3695'. [ 2088.647811][T30300] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3697'. [ 2098.182969][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 2098.196061][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 2103.646959][T30474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3722'. [ 2110.357903][T30543] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3732'. [ 2113.866737][T30592] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3738'. [ 2117.852403][T30637] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3745'. [ 2121.767494][T30684] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3751'. [ 2125.595431][T30729] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3757'. [ 2127.615064][T30751] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3760'. [ 2128.340181][T30761] ------------[ cut here ]------------ [ 2128.345804][T30761] __lockdep_enabled && this_cpu_read(hardirqs_enabled) [ 2128.345859][T30761] WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit+0x718/0xa00, CPU#0: syz.2.3762/30761 [ 2128.363888][T30761] Modules linked in: [ 2128.367875][T30761] CPU: 0 UID: 0 PID: 30761 Comm: syz.2.3762 Tainted: G L syzkaller #0 PREEMPT(full) [ 2128.379059][T30761] Tainted: [L]=SOFTLOCKUP [ 2128.384354][T30761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2128.395129][T30761] RIP: 0010:irqentry_exit+0x718/0xa00 [ 2128.401357][T30761] Code: 00 00 00 80 e8 c9 ee 58 f6 fb 83 3d 95 d1 69 05 00 74 1a 65 8b 05 d8 2a ab 08 85 c0 75 0f 65 8b 05 29 26 ab 08 85 c0 74 04 90 <0f> 0b 90 41 f7 c5 00 10 00 00 0f 84 74 fc ff ff f0 41 80 64 24 01 [ 2128.421264][T30761] RSP: 0000:ffffc9000414ff00 EFLAGS: 00010202 [ 2128.427370][T30761] RAX: 0000000000000001 RBX: ffffc9000414ff48 RCX: 0000000000000000 [ 2128.435430][T30761] RDX: 0000000000000000 RSI: ffffffff8e1a8f2e RDI: ffffffff8c400a80 [ 2128.443546][T30761] RBP: ffffc9000414ff38 R08: 0000000000000001 R09: 0000000000000000 [ 2128.451829][T30761] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888022f39f00 [ 2128.459998][T30761] R13: 0000000000000010 R14: 000001efbbd43bba R15: 0000000000000000 [ 2128.468008][T30761] FS: 00007f3e64dd56c0(0000) GS:ffff888123de1000(0000) knlGS:0000000000000000 [ 2128.477092][T30761] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2128.483825][T30761] CR2: 0000001b2ddddff8 CR3: 0000000034bd6000 CR4: 00000000003526f0 [ 2128.492771][T30761] Call Trace: [ 2128.496116][T30761] [ 2128.499068][T30761] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2128.505682][T30761] RIP: 0033:0x7f3e66b9e019 [ 2128.510305][T30761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2128.530127][T30761] RSP: 002b:00007f3e64dd50e8 EFLAGS: 00000246 [ 2128.536246][T30761] RAX: 0000000000000000 RBX: 00007f3e66e26098 RCX: 00007f3e66b9e019 [ 2128.544304][T30761] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3e66e26098 [ 2128.552354][T30761] RBP: 00007f3e66e26090 R08: 0000000000000000 R09: 0000000000000000 [ 2128.560607][T30761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2128.568637][T30761] R13: 00007f3e66e26128 R14: 00007ffe410c4bf0 R15: 00007ffe410c4cd8 [ 2128.576749][T30761] [ 2128.579863][T30761] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2128.587189][T30761] CPU: 0 UID: 0 PID: 30761 Comm: syz.2.3762 Tainted: G L syzkaller #0 PREEMPT(full) [ 2128.598180][T30761] Tainted: [L]=SOFTLOCKUP [ 2128.602524][T30761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2128.612608][T30761] Call Trace: [ 2128.615914][T30761] [ 2128.618870][T30761] dump_stack_lvl+0x100/0x190 [ 2128.623591][T30761] vpanic+0x552/0x970 [ 2128.627594][T30761] ? __pfx_vpanic+0x10/0x10 [ 2128.632128][T30761] panic+0xd1/0xe0 [ 2128.635869][T30761] ? __pfx_panic+0x10/0x10 [ 2128.640318][T30761] check_panic_on_warn.cold+0x19/0x34 [ 2128.645715][T30761] ? irqentry_exit+0x718/0xa00 [ 2128.650531][T30761] __warn.cold+0x191/0x318 [ 2128.654983][T30761] __report_bug+0x30f/0x440 [ 2128.659628][T30761] ? irqentry_exit+0x718/0xa00 [ 2128.664431][T30761] ? __pfx___report_bug+0x10/0x10 [ 2128.669510][T30761] ? rcu_is_watching+0x12/0xc0 [ 2128.674335][T30761] ? kvm_sched_clock_read+0x11/0x20 [ 2128.679578][T30761] ? sched_clock+0x38/0x60 [ 2128.684020][T30761] ? sched_clock_cpu+0x6c/0x570 [ 2128.688924][T30761] ? tmigr_handle_remote+0x132/0x380 [ 2128.694266][T30761] ? __pfx_tmigr_handle_remote+0x10/0x10 [ 2128.699938][T30761] ? __pfx_sched_clock_cpu+0x10/0x10 [ 2128.705266][T30761] ? irqentry_exit+0x718/0xa00 [ 2128.710079][T30761] report_bug+0xb2/0x220 [ 2128.714349][T30761] ? irqentry_exit+0x718/0xa00 [ 2128.719164][T30761] handle_bug+0x16a/0x2a0 [ 2128.723531][T30761] exc_invalid_op+0x17/0x50 [ 2128.728097][T30761] asm_exc_invalid_op+0x1a/0x20 [ 2128.732973][T30761] RIP: 0010:irqentry_exit+0x718/0xa00 [ 2128.738372][T30761] Code: 00 00 00 80 e8 c9 ee 58 f6 fb 83 3d 95 d1 69 05 00 74 1a 65 8b 05 d8 2a ab 08 85 c0 75 0f 65 8b 05 29 26 ab 08 85 c0 74 04 90 <0f> 0b 90 41 f7 c5 00 10 00 00 0f 84 74 fc ff ff f0 41 80 64 24 01 [ 2128.758008][T30761] RSP: 0000:ffffc9000414ff00 EFLAGS: 00010202 [ 2128.764113][T30761] RAX: 0000000000000001 RBX: ffffc9000414ff48 RCX: 0000000000000000 [ 2128.772201][T30761] RDX: 0000000000000000 RSI: ffffffff8e1a8f2e RDI: ffffffff8c400a80 [ 2128.780206][T30761] RBP: ffffc9000414ff38 R08: 0000000000000001 R09: 0000000000000000 [ 2128.788207][T30761] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888022f39f00 [ 2128.796204][T30761] R13: 0000000000000010 R14: 000001efbbd43bba R15: 0000000000000000 [ 2128.804236][T30761] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2128.810248][T30761] RIP: 0033:0x7f3e66b9e019 [ 2128.814683][T30761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2128.834311][T30761] RSP: 002b:00007f3e64dd50e8 EFLAGS: 00000246 [ 2128.840400][T30761] RAX: 0000000000000000 RBX: 00007f3e66e26098 RCX: 00007f3e66b9e019 [ 2128.848400][T30761] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3e66e26098 [ 2128.856393][T30761] RBP: 00007f3e66e26090 R08: 0000000000000000 R09: 0000000000000000 [ 2128.864387][T30761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2128.872402][T30761] R13: 00007f3e66e26128 R14: 00007ffe410c4bf0 R15: 00007ffe410c4cd8 [ 2128.880442][T30761] [ 2128.883580][T30761] Kernel Offset: disabled [ 2128.887956][T30761] Rebooting in 86400 seconds..