last executing test programs: 30.905244278s ago: executing program 4 (id=115): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) 30.456695622s ago: executing program 4 (id=118): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x0) ioctl$CEC_ADAP_G_CAPS(r1, 0xc04c6100, &(0x7f0000000140)) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x10100, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x23) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000240)={0x0, 0x1, {0x12, 0xa, 0xe, 0x15, 0x9, 0x1, 0x2, 0x5f, 0xffffffffffffffff}}) getsockopt(r2, 0x7, 0x0, &(0x7f0000000280)=""/252, &(0x7f0000000380)=0xfc) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f00000003c0)={0x1, r1, 'id0\x00'}) open_by_handle_at(r2, &(0x7f0000000440)=@ceph_nfs_fh={0x8, 0x1, {0xffffffffffffffff}}, 0x60700) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000500)) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000540)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x6, @random="8640ba7c39f5"}, 0x8, {0x2, 0x4e24, @local}, 'ip_vti0\x00'}) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f00000005c0)) sendmsg$IPCTNL_MSG_EXP_DELETE(r3, &(0x7f0000000880)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f00000006c0)={0x154, 0x2, 0x2, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x29}, @CTA_EXPECT_MASTER={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_MASTER={0x70, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_NAT={0x20, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xb53}, @CTA_EXPECT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x40041}, 0x1) ioctl$SOUND_MIXER_READ_DEVMASK(r0, 0x80044dfe, &(0x7f00000008c0)) ioctl$PPPIOCSCOMPRESS(r3, 0x4010744d) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000cc0)={@map, r2, 0xd, 0x12, r0, @void, @value=r2}, 0x20) 27.715637128s ago: executing program 4 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d70617468300000") write(r1, &(0x7f0000001138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00multipath\x00\x00\x00\x00\x00\x00\x002 queue_mode bio 0 0 0\x00\x00', 0x40) ioctl(r0, 0xc138fd09, &(0x7f0000001000)="0400000000000000000000007801000038010000010000000000000000000000000000000000000000000000000000006d70617468300000") ioctl(0xffffffffffffffff, 0x80, &(0x7f0000002000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d70617468300000") write(r1, 0x0, 0x0) ioctl(r0, 0xc138fd0e, &(0x7f0000003000)="0400000000000000000000005001000038010000000000000000000000000000000000000000000000000000000000006d70617468300000") r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r4) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x44) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYRES32=r5, @ANYBLOB="01990000419a0400600012800b000100697036746e6c000050000280060010000200000014000300"], 0x80}}, 0x0) sendto$packet(r3, &(0x7f0000000400)="05d936277c6f", 0x6, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r5, 0x1, 0x4, 0x6, @local}, 0x14) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r6, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd60038d08001806fffe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22ec03a4dae709ec6410d3fb435bf07e0868b35b030000007ef9394b394626ddd40f7bf3a3278ac015ef1c0915866c175c230ecec66abe8921dc7f4b7fe2d0ada516d06da2835538cf54cbbca0bbad6a9275521231353c2c795f5fcf59f16d9b27a919675f868284997b49ed8271a7ec7f70363beb1707a9517fe7b9d523a51b0fab2183cc6c3f46154d1d24ad4c1d657bd70b9db82cd9309030", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="60c2000090780004020422ec"], 0x0) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) recvmmsg(r7, &(0x7f0000007580)=[{{0x0, 0x0, 0x0}, 0x7fffffff}], 0x1, 0x8020, 0x0) setsockopt$sock_int(r7, 0x1, 0x28, &(0x7f0000000000)=0x3, 0x4) sendmsg$802154_dgram(r7, &(0x7f000000b8c0)={&(0x7f000000b800)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f000000b880)={0x0}}, 0x0) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) dup2(r8, r2) 23.345045648s ago: executing program 4 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) 22.665272695s ago: executing program 4 (id=132): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) semctl$SEM_STAT(0x0, 0x3, 0x12, &(0x7f0000000040)=""/42) listen(0xffffffffffffffff, 0x5) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) msync(&(0x7f0000ffb000/0x1000)=nil, 0xffffffffdf004fff, 0x4) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) 15.927784883s ago: executing program 4 (id=151): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x0) ioctl$CEC_ADAP_G_CAPS(r1, 0xc04c6100, &(0x7f0000000140)) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x10100, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x23) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000240)={0x0, 0x1, {0x12, 0xa, 0xe, 0x15, 0x9, 0x1, 0x2, 0x5f, 0xffffffffffffffff}}) getsockopt(r2, 0x7, 0x0, &(0x7f0000000280)=""/252, &(0x7f0000000380)=0xfc) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f00000003c0)={0x1, r1, 'id0\x00'}) open_by_handle_at(r2, &(0x7f0000000440)=@ceph_nfs_fh={0x8, 0x1, {0xffffffffffffffff}}, 0x60700) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000500)) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000540)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x6, @random="8640ba7c39f5"}, 0x8, {0x2, 0x4e24, @local}, 'ip_vti0\x00'}) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f00000005c0)) sendmsg$IPCTNL_MSG_EXP_DELETE(r3, &(0x7f0000000880)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f00000006c0)={0x154, 0x2, 0x2, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x29}, @CTA_EXPECT_MASTER={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_MASTER={0x70, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_NAT={0x20, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xb53}, @CTA_EXPECT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x40041}, 0x1) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000cc0)={@map, r2, 0xd, 0x12, r0, @void, @value=r2}, 0x20) 15.009938644s ago: executing program 32 (id=151): r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x0) ioctl$CEC_ADAP_G_CAPS(r1, 0xc04c6100, &(0x7f0000000140)) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x10100, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x23) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000240)={0x0, 0x1, {0x12, 0xa, 0xe, 0x15, 0x9, 0x1, 0x2, 0x5f, 0xffffffffffffffff}}) getsockopt(r2, 0x7, 0x0, &(0x7f0000000280)=""/252, &(0x7f0000000380)=0xfc) ioctl$SNDRV_TIMER_IOCTL_CREATE(r2, 0xc02054a5, &(0x7f00000003c0)={0x1, r1, 'id0\x00'}) open_by_handle_at(r2, &(0x7f0000000440)=@ceph_nfs_fh={0x8, 0x1, {0xffffffffffffffff}}, 0x60700) syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000500)) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000540)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x6, @random="8640ba7c39f5"}, 0x8, {0x2, 0x4e24, @local}, 'ip_vti0\x00'}) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f00000005c0)) sendmsg$IPCTNL_MSG_EXP_DELETE(r3, &(0x7f0000000880)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f00000006c0)={0x154, 0x2, 0x2, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x29}, @CTA_EXPECT_MASTER={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_MASTER={0x70, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @loopback}}}]}, @CTA_EXPECT_NAT={0x20, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xb53}, @CTA_EXPECT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @rand_addr=0x64010102}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @broadcast}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x40041}, 0x1) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000cc0)={@map, r2, 0xd, 0x12, r0, @void, @value=r2}, 0x20) 14.083384375s ago: executing program 3 (id=156): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5032}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000200)="010000000000220010000000000000010000000000020800450000740001400040063c817f0000017f00000104", 0x2d}, {&(0x7f0000000ec0)="00d8e1269d20050000005b731e4eb5071febe9", 0x13}], 0x2) 9.122760839s ago: executing program 3 (id=165): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5032}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000200)="010000000000220010000000000000010000000000020800450000740001400040063c817f0000017f000001", 0x2c}, {&(0x7f0000000ec0)="00d8e1269d20050000005b731e4eb5071febe9f8cb54afe2e5e68b", 0x1b}], 0x2) 6.604158214s ago: executing program 3 (id=168): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) unshare(0x6020400) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x0, 0x3, 0x10007e, 0x20000006, 0x53, 0x6, 0x10000, 0x80005, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x3, 0x7, 0x7, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x800080ee, 0xa, 0x17, 0x1, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0x10000007, 0x9, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x42f, 0xe, 0x312, 0x78, 0x1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x4400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x101, 0x1, 0x4, 0xffff80f1, 0x1, 0x6, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x101, 0x3, 0x3, 0xbc45, 0x48c93695, 0x43, 0x9], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x5, 0x8, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0xd, 0x802003, 0x200, 0x400080, 0x3, 0x8001, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0x7, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x24], [0x9, 0x40bb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x3, 0xbb, 0xce7, 0x1ff, 0x40002, 0x57, 0x4, 0x3, 0x101, 0x9, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0x1, 0xfffff000, 0x4010080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x200, 0x2, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 6.441251006s ago: executing program 3 (id=169): r0 = socket(0xa, 0x3, 0x87) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x18, r2}) syz_io_uring_setup(0x48ce, &(0x7f0000000140)={0x0, 0xd353, 0x3000, 0x2, 0x19a}, &(0x7f0000000040), &(0x7f0000000200), &(0x7f0000000000)) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x8936, &(0x7f0000000000)) 5.71739008s ago: executing program 3 (id=172): getpid() setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x80, 0x2020}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000081}, 0x0) 5.109679211s ago: executing program 3 (id=179): unshare(0x60040000) r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r0, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) 4.22272888s ago: executing program 2 (id=190): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) 4.046968423s ago: executing program 2 (id=193): syz_clone3(&(0x7f00000004c0)={0x3100280, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x42, 0xc0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) acct(&(0x7f0000000100)='./file1\x00') acct(0x0) acct(0x0) 2.80135405s ago: executing program 2 (id=201): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x5, &(0x7f00000006c0)=ANY=[@ANYBLOB="180200000900000000000000000000008500000007000000850000000f00000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e1ff46bd3bf574b7c1f6f585862b", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 2.057754807s ago: executing program 2 (id=206): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmmsg$inet(r0, &(0x7f0000002740)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000480)="8dc1694e13", 0x5}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000", @ANYRES32, @ANYBLOB="64010102ac0f34120000000011000000000000000000000001000000060000000080000024000000000000000000007a72b2a41cd163f3001000000000001400000000000000000000000100ff"], 0xa8}}], 0x1, 0x200c844) 1.901676575s ago: executing program 2 (id=208): r0 = syz_io_uring_setup(0x4b6, &(0x7f0000000100)={0x0, 0x0, 0x10, 0x0, 0x20e}, &(0x7f0000ff0000), &(0x7f0000000000), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000600)={0x0, 0x40000000, &(0x7f0000000540)=[{0x0}], 0x0, 0x1}, 0x20) 1.770338633s ago: executing program 2 (id=209): r0 = socket$netlink(0x10, 0x3, 0x0) listen(r0, 0x7) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) 1.183453109s ago: executing program 0 (id=213): r0 = add_key$keyring(&(0x7f0000000680), &(0x7f0000000000)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x64, 0x30, 0x30, 0x6c, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000400), &(0x7f0000000880)={'fscrypt:', @auto=[0x63, 0x39, 0x64, 0x65, 0x64, 0x66, 0x36, 0x38, 0x36, 0x62, 0x37, 0x31, 0x8, 0x34, 0x62, 0x34]}, &(0x7f00000008c0)={0x0, "83be91e3956f7eeab185c5532a737cbf86a019abc3c6c5b882e77c6b66c6d809ae8c0052697af3e28ee0d067c73f9e8f2c1af82447d244584968c7ffb982e9b4", 0x1e}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000001c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x33]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000200)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000600), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x6d, 0x30, 0x30, 0x30, 0x32, 0x30, 0x30, 0x61, 0x30, 0x35]}, &(0x7f0000000800)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabb0600000000000000445566778899aabbccddeeff", 0x36}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000480)={'fscrypt:', @desc3}, &(0x7f0000000780)={0x0, "fe1b5c4bf346207d87478c27b86bb51289055bc124bb60432572800f18aa4fd90aabed9d0fe61c88c11301a15ee3f0f5cdf737eba09fed73da1807ecb5b00d17", 0x24}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000340)={'fscrypt:', @desc1}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x27}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x32, 0x64, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r0) add_key$keyring(&(0x7f0000000640), &(0x7f00000006c0)={'syz', 0x2}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x30, 0x30, 0x0, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x6f, 0x30, 0x30, 0x30, 0x8, 0x64]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000004c0)={'fscrypt:', @auto=[0x30, 0x58425c31ab49816a, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64, 0x67, 0x30, 0x38, 0x33, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112200080000778899aabbccddeeff00aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) 1.091899735s ago: executing program 1 (id=214): io_uring_enter(0xffffffffffffffff, 0x47e8, 0x13c0, 0x1, &(0x7f0000001800)={[0x4]}, 0x8) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)=@gettaction={0x24, 0x5a, 0x1, 0x70bd25, 0x25cfdbf4, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x0) 962.85407ms ago: executing program 0 (id=215): chdir(&(0x7f0000000000)='./cgroup\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file7/file0\x00', 0x0) 916.808641ms ago: executing program 1 (id=216): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x2f, &(0x7f0000000200)=r0, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x2f, &(0x7f0000000380)=r0, 0x4) 793.37758ms ago: executing program 1 (id=217): setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @local}, {0xfffe, 0x4e24, 0x4d, 0x0, @wg=@initiation={0x1, 0x4, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98e3943f6892078bb952854743fe4dddd2e7c0ce70a4ac7d", {"a851525b16af17fe87acbae2ab0b233d", "01422d01cd53c3abe94331d0b7918724"}}}}}}}, 0x0) 708.852713ms ago: executing program 1 (id=218): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r1, 0x0, 0x0) 647.739975ms ago: executing program 0 (id=219): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, 0x0, &(0x7f0000000840)) 517.381767ms ago: executing program 1 (id=220): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="180200000000ff0100000000000000008500000020000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000001700000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) 466.277581ms ago: executing program 0 (id=221): socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0) write(r0, &(0x7f0000000480)='0', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='active', 0x6) 442.584678ms ago: executing program 1 (id=222): preadv2(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x40008, 0xfffffff8, 0x3e) getuid() r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xe, 0xb}}}, 0x24}}, 0x800) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001840)=@bpf_ext={0x1c, 0x1, &(0x7f0000000300)=@raw=[@alu={0x4, 0x1, 0xf3767c68fa0481d3, 0x4, 0x7, 0x20, 0x8}], &(0x7f0000000340)='GPL\x00', 0xfffffc00, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x3, 0x3, 0x9, 0xc}, 0x10, 0x2469, r2, 0x0, 0x0, 0x0, 0x10, 0x878}, 0x94) 301.439916ms ago: executing program 0 (id=223): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, 0x0, &(0x7f00000000c0)) 0s ago: executing program 0 (id=224): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x9, 0x180062) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/address_bits', 0x2000, 0xa9) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000280)={r1, 0x0, {0x0, 0x0, 0x0, 0x7, 0x404000000ff, 0x0, 0x0, 0x16, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d81a17f7061a74df2cfc06c89f3d9e234b30c50997d3bef4090ebcdda37bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b063cc14ad3300", [0x2002, 0x6]}}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.188' (ED25519) to the list of known hosts. [ 85.669054][ T5568] cgroup: Unknown subsys name 'net' [ 85.891594][ T5568] cgroup: Unknown subsys name 'cpuset' [ 85.945439][ T5568] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 87.885834][ T5568] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 90.570425][ T5581] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 90.574291][ T5581] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 90.583743][ T5581] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 90.588915][ T5581] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 90.592607][ T5581] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.724261][ T4897] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 90.758063][ T4897] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 90.783220][ T5590] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 90.797400][ T5595] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 90.816621][ T5597] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 90.828132][ T5597] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 90.837435][ T5595] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 90.880485][ T5597] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 90.888760][ T5597] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 90.902441][ T5597] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 90.904813][ T5600] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.906396][ T5595] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.912930][ T5598] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 90.924852][ T4897] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 90.945713][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 90.948231][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.953606][ T5602] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 90.977364][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 91.012488][ T5602] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 91.025765][ T5602] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 92.020983][ T1245] cfg80211: failed to load regulatory.db [ 92.625815][ T60] Bluetooth: hci0: command tx timeout [ 93.026305][ T60] Bluetooth: hci3: command tx timeout [ 93.104692][ T5590] Bluetooth: hci2: command tx timeout [ 93.104818][ T5590] Bluetooth: hci1: command tx timeout [ 93.105032][ T60] Bluetooth: hci4: command tx timeout [ 93.285105][ T5579] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.286320][ T5579] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.286447][ T5579] bridge_slave_0: entered allmulticast mode [ 93.288365][ T5579] bridge_slave_0: entered promiscuous mode [ 93.345630][ T5579] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.345741][ T5579] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.345898][ T5579] bridge_slave_1: entered allmulticast mode [ 93.348847][ T5579] bridge_slave_1: entered promiscuous mode [ 93.539163][ T5579] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.570149][ T5584] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.570340][ T5584] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.570492][ T5584] bridge_slave_0: entered allmulticast mode [ 93.572297][ T5584] bridge_slave_0: entered promiscuous mode [ 93.583376][ T5579] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.647778][ T5584] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.647909][ T5584] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.648020][ T5584] bridge_slave_1: entered allmulticast mode [ 93.649779][ T5584] bridge_slave_1: entered promiscuous mode [ 93.826229][ T5583] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.826352][ T5583] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.826928][ T5583] bridge_slave_0: entered allmulticast mode [ 93.828792][ T5583] bridge_slave_0: entered promiscuous mode [ 93.833041][ T5579] team0: Port device team_slave_0 added [ 93.886038][ T5586] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.886168][ T5586] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.886329][ T5586] bridge_slave_0: entered allmulticast mode [ 93.888234][ T5586] bridge_slave_0: entered promiscuous mode [ 93.891553][ T5583] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.891653][ T5583] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.891770][ T5583] bridge_slave_1: entered allmulticast mode [ 93.894333][ T5583] bridge_slave_1: entered promiscuous mode [ 93.950835][ T5579] team0: Port device team_slave_1 added [ 93.955206][ T5584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.956743][ T5585] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.957061][ T5585] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.957509][ T5585] bridge_slave_0: entered allmulticast mode [ 93.968949][ T5585] bridge_slave_0: entered promiscuous mode [ 93.992305][ T5586] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.992630][ T5586] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.004359][ T5586] bridge_slave_1: entered allmulticast mode [ 94.012375][ T5586] bridge_slave_1: entered promiscuous mode [ 94.049196][ T5584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.050187][ T5585] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.050288][ T5585] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.050615][ T5585] bridge_slave_1: entered allmulticast mode [ 94.052247][ T5585] bridge_slave_1: entered promiscuous mode [ 94.183192][ T5583] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.184410][ T5579] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.184421][ T5579] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.184439][ T5579] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.259433][ T5586] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.262056][ T5583] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.262776][ T5579] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.262786][ T5579] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.262803][ T5579] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.277704][ T5584] team0: Port device team_slave_0 added [ 94.333536][ T5585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.344812][ T5586] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.379083][ T5584] team0: Port device team_slave_1 added [ 94.381448][ T5585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.469507][ T5583] team0: Port device team_slave_0 added [ 94.506312][ T5586] team0: Port device team_slave_0 added [ 94.526276][ T5583] team0: Port device team_slave_1 added [ 94.526953][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.526968][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.526998][ T5584] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.529719][ T5585] team0: Port device team_slave_0 added [ 94.531770][ T5586] team0: Port device team_slave_1 added [ 94.606670][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.606682][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.606699][ T5584] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.609054][ T5585] team0: Port device team_slave_1 added [ 94.669162][ T5579] hsr_slave_0: entered promiscuous mode [ 94.670236][ T5579] hsr_slave_1: entered promiscuous mode [ 94.704723][ T60] Bluetooth: hci0: command tx timeout [ 94.735275][ T5583] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.735294][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.735322][ T5583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.782495][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.782553][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.782614][ T5586] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.800829][ T5583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.800917][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.801006][ T5583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.810593][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.810630][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.810689][ T5585] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.815850][ T5586] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.815885][ T5586] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.815942][ T5586] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.974453][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.974470][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.974494][ T5585] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.104850][ T60] Bluetooth: hci3: command tx timeout [ 95.184779][ T60] Bluetooth: hci4: command tx timeout [ 95.184802][ T4897] Bluetooth: hci1: command tx timeout [ 95.184816][ T60] Bluetooth: hci2: command tx timeout [ 95.547780][ T5584] hsr_slave_0: entered promiscuous mode [ 95.548623][ T5584] hsr_slave_1: entered promiscuous mode [ 95.549239][ T5584] debugfs: 'hsr0' already exists in 'hsr' [ 95.549311][ T5584] Cannot create hsr debugfs directory [ 95.694160][ T5583] hsr_slave_0: entered promiscuous mode [ 95.697888][ T5583] hsr_slave_1: entered promiscuous mode [ 95.700190][ T5583] debugfs: 'hsr0' already exists in 'hsr' [ 95.700253][ T5583] Cannot create hsr debugfs directory [ 95.733527][ T5586] hsr_slave_0: entered promiscuous mode [ 95.734471][ T5586] hsr_slave_1: entered promiscuous mode [ 95.739703][ T5586] debugfs: 'hsr0' already exists in 'hsr' [ 95.739759][ T5586] Cannot create hsr debugfs directory [ 95.777278][ T5585] hsr_slave_0: entered promiscuous mode [ 95.778338][ T5585] hsr_slave_1: entered promiscuous mode [ 95.779012][ T5585] debugfs: 'hsr0' already exists in 'hsr' [ 95.779033][ T5585] Cannot create hsr debugfs directory [ 96.572062][ T5579] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.641485][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.654425][ T5579] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.699385][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.703692][ T5579] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.738945][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.767124][ T5579] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.794701][ T4897] Bluetooth: hci0: command tx timeout [ 96.804373][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.901274][ T5584] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 96.939931][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.953092][ T5584] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 96.978133][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.979776][ T5584] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 97.031108][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.053541][ T5584] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 97.089125][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.184668][ T4897] Bluetooth: hci3: command tx timeout [ 97.264851][ T4897] Bluetooth: hci1: command tx timeout [ 97.265901][ T4897] Bluetooth: hci2: command tx timeout [ 97.265929][ T4897] Bluetooth: hci4: command tx timeout [ 97.292956][ T5586] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 97.310466][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.316463][ T5586] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 97.349067][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.364412][ T5586] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.378404][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.409186][ T5586] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.439096][ T5586] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.590905][ T5585] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 97.618626][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.633784][ T5585] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 97.660024][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.686116][ T5585] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 97.719921][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.747539][ T5585] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 97.777940][ T5585] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.854652][ T5579] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.949573][ T5583] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 97.978847][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.995736][ T5583] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.029462][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.043957][ T5583] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.070121][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.083122][ T5583] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.108795][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.112050][ T5579] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.191648][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.193033][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.241988][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.266080][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.266213][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.363264][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.427851][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.428025][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.433897][ T5586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.478901][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.479058][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.563608][ T5586] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.621605][ T5585] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.681827][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.683135][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.746953][ T88] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.747758][ T88] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.841457][ T5585] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.865195][ T5590] Bluetooth: hci0: command tx timeout [ 98.898176][ T1286] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.898299][ T1286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.931685][ T5583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.970516][ T1286] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.970648][ T1286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.110684][ T5583] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.212015][ T1134] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.214178][ T1134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.265226][ T5590] Bluetooth: hci3: command tx timeout [ 99.319325][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.319509][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.344719][ T4897] Bluetooth: hci2: command tx timeout [ 99.344759][ T4897] Bluetooth: hci1: command tx timeout [ 99.344840][ T5590] Bluetooth: hci4: command tx timeout [ 99.760175][ T5579] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.242367][ T5579] veth0_vlan: entered promiscuous mode [ 100.262160][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.360265][ T5579] veth1_vlan: entered promiscuous mode [ 100.627981][ T5579] veth0_macvtap: entered promiscuous mode [ 100.658802][ T5579] veth1_macvtap: entered promiscuous mode [ 100.837527][ T5579] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.883803][ T5579] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.931381][ T5586] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.031764][ T5585] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.355668][ T5583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.582827][ T5586] veth0_vlan: entered promiscuous mode [ 101.601386][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.601414][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.654017][ T5584] veth0_vlan: entered promiscuous mode [ 101.676869][ T5585] veth0_vlan: entered promiscuous mode [ 101.709639][ T5586] veth1_vlan: entered promiscuous mode [ 101.756323][ T5584] veth1_vlan: entered promiscuous mode [ 101.758175][ T5585] veth1_vlan: entered promiscuous mode [ 101.778981][ T1406] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.779000][ T1406] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.837957][ T5583] veth0_vlan: entered promiscuous mode [ 101.902412][ T5583] veth1_vlan: entered promiscuous mode [ 101.938935][ T5586] veth0_macvtap: entered promiscuous mode [ 101.973988][ T5586] veth1_macvtap: entered promiscuous mode [ 101.981862][ T5585] veth0_macvtap: entered promiscuous mode [ 102.000752][ T5584] veth0_macvtap: entered promiscuous mode [ 102.036248][ T5585] veth1_macvtap: entered promiscuous mode [ 102.039714][ T5584] veth1_macvtap: entered promiscuous mode [ 102.108436][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.109931][ T5579] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 102.173674][ T5583] veth0_macvtap: entered promiscuous mode [ 102.188826][ T5585] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.190618][ T5586] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.231656][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.280297][ T5583] veth1_macvtap: entered promiscuous mode [ 102.309442][ T5585] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.341460][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.504216][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.744408][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.683016][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.683037][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.203011][ T819] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.203032][ T819] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.318673][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.318693][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.563703][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.563725][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.589480][ T56] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.786871][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.816271][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.816289][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.974580][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 106.994562][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.004564][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.014568][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.024563][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.034561][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.044544][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.054565][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.064548][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.074560][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 108.804897][ T5802] netlink: 'syz.2.3': attribute type 7 has an invalid length. [ 109.004736][ T5802] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'. [ 109.227086][ T819] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.405757][ T819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.405780][ T819] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.693828][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.693849][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.816017][ T1286] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.836388][ T819] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.836962][ T819] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.876857][ T819] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.878353][ T819] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.878809][ T819] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.879031][ T819] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.879228][ T819] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.879766][ T819] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.880253][ T819] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.880651][ T819] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.158741][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.158764][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.376495][ T1286] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.377068][ T33] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.377319][ T33] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.377885][ T33] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.476660][ T5825] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 111.561837][ T33] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.562566][ T33] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.515344][ T5842] sd 0:0:1:0: PR command failed: 1026 [ 112.515419][ T5842] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 112.515467][ T5842] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 113.066980][ T5847] FAULT_INJECTION: forcing a failure. [ 113.066980][ T5847] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 113.067096][ T5847] CPU: 1 UID: 0 PID: 5847 Comm: syz.4.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 113.067122][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.067142][ T5847] Call Trace: [ 113.067151][ T5847] [ 113.067160][ T5847] dump_stack_lvl+0xe8/0x150 [ 113.067208][ T5847] should_fail_ex+0x46b/0x600 [ 113.067241][ T5847] copy_fpstate_to_sigframe+0xac0/0xd80 [ 113.067290][ T5847] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 113.067329][ T5847] ? lock_acquire+0x115/0x350 [ 113.067363][ T5847] ? do_raw_spin_lock+0x12b/0x2f0 [ 113.067390][ T5847] ? fpu__alloc_mathframe+0xac/0x130 [ 113.067424][ T5847] get_sigframe+0x603/0x830 [ 113.067463][ T5847] ? __pfx_get_sigframe+0x10/0x10 [ 113.067496][ T5847] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 113.067531][ T5847] x64_setup_rt_frame+0x164/0xc50 [ 113.067565][ T5847] ? rt_spin_unlock+0x159/0x200 [ 113.067595][ T5847] ? rt_spin_unlock+0x165/0x200 [ 113.067624][ T5847] ? get_signal+0x10de/0x12c0 [ 113.067659][ T5847] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 113.067700][ T5847] arch_do_signal_or_restart+0x45b/0x860 [ 113.067734][ T5847] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 113.067773][ T5847] ? ksys_write+0x248/0x270 [ 113.067806][ T5847] exit_to_user_mode_loop+0x10e/0x770 [ 113.067835][ T5847] ? rcu_is_watching+0x16/0xb0 [ 113.067870][ T5847] do_syscall_64+0x328/0x520 [ 113.067889][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.067910][ T5847] ? clear_bhb_loop+0x70/0xc0 [ 113.067936][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.067957][ T5847] RIP: 0033:0x7f06f86ce98e [ 113.067986][ T5847] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 113.068003][ T5847] RSP: 002b:00007f06f6965fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 113.068029][ T5847] RAX: 0000000000000001 RBX: 00007f06f69666c0 RCX: 00007f06f86ce98e [ 113.068044][ T5847] RDX: 0000000000000001 RSI: 00007f06f6966090 RDI: 0000000000000005 [ 113.068057][ T5847] RBP: 00007f06f6966090 R08: 0000000000000000 R09: 0000000000000000 [ 113.068070][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.068082][ T5847] R13: 00007f06f8996038 R14: 00007f06f8995fa0 R15: 00007ffc438502f8 [ 113.068113][ T5847] [ 115.615916][ T5875] netlink: 20 bytes leftover after parsing attributes in process `syz.1.25'. [ 115.752287][ T5877] FAULT_INJECTION: forcing a failure. [ 115.752287][ T5877] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 115.752341][ T5877] CPU: 0 UID: 0 PID: 5877 Comm: syz.4.26 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 115.752364][ T5877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.752381][ T5877] Call Trace: [ 115.752389][ T5877] [ 115.752397][ T5877] dump_stack_lvl+0xe8/0x150 [ 115.752444][ T5877] should_fail_ex+0x46b/0x600 [ 115.752477][ T5877] _copy_from_user+0x2d/0xb0 [ 115.752507][ T5877] iommufd_fops_ioctl+0x419/0x600 [ 115.752539][ T5877] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 115.752585][ T5877] ? __fget_files+0x2a/0x420 [ 115.752611][ T5877] ? bpf_lsm_file_ioctl+0x9/0x20 [ 115.752634][ T5877] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 115.752660][ T5877] __se_sys_ioctl+0xff/0x170 [ 115.752690][ T5877] do_syscall_64+0x166/0x520 [ 115.752709][ T5877] ? trace_irq_disable+0x3b/0x140 [ 115.752735][ T5877] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.752754][ T5877] ? clear_bhb_loop+0x70/0xc0 [ 115.752778][ T5877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.752798][ T5877] RIP: 0033:0x7f06f870e159 [ 115.752830][ T5877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.752847][ T5877] RSP: 002b:00007f06f6966028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 115.752872][ T5877] RAX: ffffffffffffffda RBX: 00007f06f8995fa0 RCX: 00007f06f870e159 [ 115.752891][ T5877] RDX: 0000200000000100 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 115.752904][ T5877] RBP: 00007f06f6966090 R08: 0000000000000000 R09: 0000000000000000 [ 115.752916][ T5877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 115.752928][ T5877] R13: 00007f06f8996038 R14: 00007f06f8995fa0 R15: 00007ffc438502f8 [ 115.752959][ T5877] [ 116.411772][ T5884] FAULT_INJECTION: forcing a failure. [ 116.411772][ T5884] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 116.411807][ T5884] CPU: 1 UID: 0 PID: 5884 Comm: syz.2.29 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 116.411832][ T5884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 116.411845][ T5884] Call Trace: [ 116.411853][ T5884] [ 116.411862][ T5884] dump_stack_lvl+0xe8/0x150 [ 116.411900][ T5884] should_fail_ex+0x46b/0x600 [ 116.411960][ T5884] _copy_from_user+0x2d/0xb0 [ 116.411994][ T5884] get_timespec64+0x96/0x1b0 [ 116.412028][ T5884] ? __pfx_get_timespec64+0x10/0x10 [ 116.412070][ T5884] __x64_sys_recvmmsg+0x14b/0x250 [ 116.412100][ T5884] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 116.412138][ T5884] do_syscall_64+0x166/0x520 [ 116.412159][ T5884] ? trace_irq_disable+0x3b/0x140 [ 116.412187][ T5884] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.412210][ T5884] ? clear_bhb_loop+0x70/0xc0 [ 116.412237][ T5884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.412259][ T5884] RIP: 0033:0x7fe40a1de159 [ 116.412278][ T5884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.412296][ T5884] RSP: 002b:00007fe408436028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 116.412320][ T5884] RAX: ffffffffffffffda RBX: 00007fe40a465fa0 RCX: 00007fe40a1de159 [ 116.412337][ T5884] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 116.412352][ T5884] RBP: 00007fe408436090 R08: 0000200000003700 R09: 0000000000000000 [ 116.412366][ T5884] R10: 0000000002040000 R11: 0000000000000246 R12: 0000000000000001 [ 116.412380][ T5884] R13: 00007fe40a466038 R14: 00007fe40a465fa0 R15: 00007ffefb71ffd8 [ 116.412413][ T5884] [ 117.634671][ T5891] netlink: 'syz.0.31': attribute type 7 has an invalid length. [ 117.834635][ T5891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.31'. [ 118.621364][ T5893] FAULT_INJECTION: forcing a failure. [ 118.621364][ T5893] name failslab, interval 1, probability 0, space 0, times 0 [ 118.621418][ T5893] CPU: 0 UID: 0 PID: 5893 Comm: syz.2.32 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 118.621442][ T5893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 118.621454][ T5893] Call Trace: [ 118.621461][ T5893] [ 118.621470][ T5893] dump_stack_lvl+0xe8/0x150 [ 118.621504][ T5893] should_fail_ex+0x46b/0x600 [ 118.621537][ T5893] should_failslab+0xa8/0x100 [ 118.621568][ T5893] ? alloc_empty_file+0x5b/0x1d0 [ 118.621600][ T5893] kmem_cache_alloc_noprof+0x9e/0x690 [ 118.621628][ T5893] ? alloc_empty_file+0x5b/0x1d0 [ 118.621664][ T5893] alloc_empty_file+0x5b/0x1d0 [ 118.621695][ T5893] path_openat+0xa2/0x1d60 [ 118.621739][ T5893] do_file_open+0x23e/0x4a0 [ 118.621769][ T5893] ? __pfx_do_file_open+0x10/0x10 [ 118.621817][ T5893] ? alloc_fd+0x654/0x6d0 [ 118.621847][ T5893] do_sys_openat2+0x115/0x200 [ 118.621882][ T5893] ? __pfx_do_sys_openat2+0x10/0x10 [ 118.621915][ T5893] ? ksys_write+0x248/0x270 [ 118.621942][ T5893] ? __pfx_ksys_write+0x10/0x10 [ 118.621970][ T5893] __x64_sys_openat+0x138/0x170 [ 118.622006][ T5893] do_syscall_64+0x166/0x520 [ 118.622024][ T5893] ? trace_irq_disable+0x3b/0x140 [ 118.622051][ T5893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.622071][ T5893] ? clear_bhb_loop+0x70/0xc0 [ 118.622094][ T5893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.622119][ T5893] RIP: 0033:0x7fe40a1de159 [ 118.622137][ T5893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.622153][ T5893] RSP: 002b:00007fe408415028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 118.622175][ T5893] RAX: ffffffffffffffda RBX: 00007fe40a466090 RCX: 00007fe40a1de159 [ 118.622190][ T5893] RDX: 0000000000000041 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 118.622211][ T5893] RBP: 00007fe408415090 R08: 0000000000000000 R09: 0000000000000000 [ 118.622224][ T5893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 118.622237][ T5893] R13: 00007fe40a466128 R14: 00007fe40a466090 R15: 00007ffefb71ffd8 [ 118.622268][ T5893] [ 118.829612][ T5791] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 119.164662][ T5791] usb 4-1: Invalid ep0 maxpacket: 16 [ 119.364050][ T5901] netlink: 208 bytes leftover after parsing attributes in process `syz.4.35'. [ 120.607696][ T5916] FAULT_INJECTION: forcing a failure. [ 120.607696][ T5916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 120.607733][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz.4.39 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 120.607758][ T5916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 120.607771][ T5916] Call Trace: [ 120.607779][ T5916] [ 120.607788][ T5916] dump_stack_lvl+0xe8/0x150 [ 120.607826][ T5916] should_fail_ex+0x46b/0x600 [ 120.607861][ T5916] _copy_from_iter+0x1d3/0x1660 [ 120.607887][ T5916] ? rcu_is_watching+0x16/0xb0 [ 120.607933][ T5916] ? trace_kmalloc+0x2a/0xf0 [ 120.607959][ T5916] ? __pfx__copy_from_iter+0x10/0x10 [ 120.607990][ T5916] ? netlink_sendmsg+0x5d4/0xb40 [ 120.608014][ T5916] ? netlink_sendmsg+0x5d4/0xb40 [ 120.608043][ T5916] ? netlink_sendmsg+0x650/0xb40 [ 120.608066][ T5916] ? skb_put+0x112/0x210 [ 120.608087][ T5916] netlink_sendmsg+0x6c0/0xb40 [ 120.608115][ T5916] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.608141][ T5916] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 120.608174][ T5916] ? __kernel_text_address+0xd/0x30 [ 120.608208][ T5916] ? unwind_get_return_address+0x4d/0x90 [ 120.608235][ T5916] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.608257][ T5916] sock_sendmsg_nosec+0x13a/0x180 [ 120.608285][ T5916] ____sys_sendmsg+0x565/0x870 [ 120.608315][ T5916] ? __pfx_____sys_sendmsg+0x10/0x10 [ 120.608343][ T5916] ? import_iovec+0x73/0xa0 [ 120.608375][ T5916] ___sys_sendmsg+0x2a5/0x360 [ 120.608394][ T5916] ? __lock_acquire+0x747/0x2de0 [ 120.608424][ T5916] ? __pfx____sys_sendmsg+0x10/0x10 [ 120.608471][ T5916] ? __fget_files+0x2a/0x420 [ 120.608491][ T5916] ? __fget_files+0x3a8/0x420 [ 120.608517][ T5916] __x64_sys_sendmsg+0x1b7/0x290 [ 120.608539][ T5916] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 120.608582][ T5916] do_syscall_64+0x166/0x520 [ 120.608600][ T5916] ? trace_irq_disable+0x3b/0x140 [ 120.608622][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.608640][ T5916] ? clear_bhb_loop+0x70/0xc0 [ 120.608663][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.608681][ T5916] RIP: 0033:0x7f06f870e159 [ 120.608699][ T5916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.608715][ T5916] RSP: 002b:00007f06f6966028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 120.608736][ T5916] RAX: ffffffffffffffda RBX: 00007f06f8995fa0 RCX: 00007f06f870e159 [ 120.608749][ T5916] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 120.608761][ T5916] RBP: 00007f06f6966090 R08: 0000000000000000 R09: 0000000000000000 [ 120.608773][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.608785][ T5916] R13: 00007f06f8996038 R14: 00007f06f8995fa0 R15: 00007ffc438502f8 [ 120.608815][ T5916] [ 121.183842][ T5925] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 121.221178][ T5925] CIFS: Attempting to mount //127.0.0.1/share [ 122.046923][ T5925] CIFS: VFS: cifs_mount failed w/return code = -512 [ 122.624182][ T5947] tipc: Failed to remove unknown binding: 66,0,0/0:3007679243/3007679244 [ 122.678616][ T5947] tipc: Failed to remove unknown binding: 66,0,0/0:3007679243/3007679244 [ 123.902002][ T5962] FAULT_INJECTION: forcing a failure. [ 123.902002][ T5962] name failslab, interval 1, probability 0, space 0, times 0 [ 123.902037][ T5962] CPU: 1 UID: 0 PID: 5962 Comm: syz.3.51 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.902060][ T5962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 123.902073][ T5962] Call Trace: [ 123.902081][ T5962] [ 123.902089][ T5962] dump_stack_lvl+0xe8/0x150 [ 123.902126][ T5962] should_fail_ex+0x46b/0x600 [ 123.902158][ T5962] should_failslab+0xa8/0x100 [ 123.902192][ T5962] __kvmalloc_node_noprof+0x176/0x890 [ 123.902226][ T5962] ? vmemdup_user+0x2b/0xd0 [ 123.902245][ T5962] ? vmemdup_user+0x2b/0xd0 [ 123.902271][ T5962] vmemdup_user+0x2b/0xd0 [ 123.902292][ T5962] path_setxattrat+0x2d0/0x450 [ 123.902329][ T5962] ? __pfx_path_setxattrat+0x10/0x10 [ 123.902380][ T5962] ? ksys_write+0x248/0x270 [ 123.902407][ T5962] ? __pfx_ksys_write+0x10/0x10 [ 123.902436][ T5962] __x64_sys_lsetxattr+0xbf/0xe0 [ 123.902464][ T5962] do_syscall_64+0x166/0x520 [ 123.902483][ T5962] ? trace_irq_disable+0x3b/0x140 [ 123.902514][ T5962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.902535][ T5962] ? clear_bhb_loop+0x70/0xc0 [ 123.902561][ T5962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.902581][ T5962] RIP: 0033:0x7f1bcf9de159 [ 123.902600][ T5962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.902617][ T5962] RSP: 002b:00007f1bcdc36028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 123.902654][ T5962] RAX: ffffffffffffffda RBX: 00007f1bcfc65fa0 RCX: 00007f1bcf9de159 [ 123.902670][ T5962] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000200000000280 [ 123.902685][ T5962] RBP: 00007f1bcdc36090 R08: 0000000000000001 R09: 0000000000000000 [ 123.902698][ T5962] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001 [ 123.902710][ T5962] R13: 00007f1bcfc66038 R14: 00007f1bcfc65fa0 R15: 00007ffcd7c89ea8 [ 123.902741][ T5962] [ 124.231552][ T5970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.53'. [ 124.231588][ T5970] netlink: 12 bytes leftover after parsing attributes in process `syz.1.53'. [ 124.236962][ T5968] netlink: 8 bytes leftover after parsing attributes in process `syz.1.53'. [ 124.274771][ T999] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 124.441342][ T5872] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.504750][ T5871] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.504802][ T5871] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.514706][ T5871] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 124.604595][ T999] usb 3-1: Using ep0 maxpacket: 32 [ 124.606172][ T999] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5c.8a [ 124.672660][ T999] usb 3-1: config 245 has an invalid interface number: 182 but max is 0 [ 124.672688][ T999] usb 3-1: config 245 has no interface number 0 [ 124.672736][ T999] usb 3-1: config 245 interface 182 altsetting 70 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 124.672765][ T999] usb 3-1: config 245 interface 182 has no altsetting 0 [ 124.722662][ T999] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.722691][ T999] usb 3-1: Product: syz [ 124.722708][ T999] usb 3-1: Manufacturer: syz [ 124.722724][ T999] usb 3-1: SerialNumber: syz [ 124.900268][ T5974] netlink: 128 bytes leftover after parsing attributes in process `syz.3.54'. [ 124.947141][ T5977] netlink: 16410 bytes leftover after parsing attributes in process `syz.1.55'. [ 125.151006][ T999] usb 3-1: Limiting number of CPorts to U8_MAX [ 125.180311][ T999] usb 3-1: Unknown endpoint type found, address 0x08 [ 125.180336][ T999] usb 3-1: Unknown endpoint type found, address 0x0a [ 125.180353][ T999] usb 3-1: Not enough endpoints found in device, aborting! [ 127.576728][ T999] usb 3-1: USB disconnect, device number 2 [ 127.974714][ T5990] CIFS: Attempting to mount //127.0.0.1/share [ 128.052016][ T5994] netlink: 24 bytes leftover after parsing attributes in process `syz.1.58'. [ 128.780186][ T5990] CIFS: VFS: Error connecting to socket. Aborting operation. [ 128.780257][ T5990] CIFS: VFS: cifs_mount failed w/return code = -4 [ 128.849670][ T5990] syz.4.56 (5990) used greatest stack depth: 18880 bytes left [ 129.319458][ T6009] capability: warning: `syz.2.64' uses deprecated v2 capabilities in a way that may be insecure [ 129.334647][ T5702] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 129.432749][ T6015] FAULT_INJECTION: forcing a failure. [ 129.432749][ T6015] name failslab, interval 1, probability 0, space 0, times 0 [ 129.432783][ T6015] CPU: 0 UID: 0 PID: 6015 Comm: syz.0.65 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.432805][ T6015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 129.432817][ T6015] Call Trace: [ 129.432824][ T6015] [ 129.432833][ T6015] dump_stack_lvl+0xe8/0x150 [ 129.432868][ T6015] should_fail_ex+0x46b/0x600 [ 129.432899][ T6015] should_failslab+0xa8/0x100 [ 129.432931][ T6015] __kmalloc_noprof+0xfb/0x790 [ 129.432957][ T6015] ? tomoyo_encode+0x2ad/0x570 [ 129.432984][ T6015] ? tomoyo_encode+0x2ad/0x570 [ 129.433018][ T6015] tomoyo_encode+0x2ad/0x570 [ 129.433052][ T6015] tomoyo_realpath_from_path+0x5fa/0x640 [ 129.433098][ T6015] ? tomoyo_path_number_perm+0x219/0x5f0 [ 129.433124][ T6015] tomoyo_path_number_perm+0x246/0x5f0 [ 129.433151][ T6015] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 129.433174][ T6015] ? __lock_acquire+0x747/0x2de0 [ 129.433213][ T6015] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 129.433244][ T6015] ? hook_file_ioctl+0x1f5/0x610 [ 129.433282][ T6015] ? __fget_files+0x2a/0x420 [ 129.433306][ T6015] ? __fget_files+0x2a/0x420 [ 129.433325][ T6015] ? __fget_files+0x3a8/0x420 [ 129.433345][ T6015] ? __fget_files+0x2a/0x420 [ 129.433369][ T6015] security_file_ioctl+0xc3/0x2a0 [ 129.433397][ T6015] __se_sys_ioctl+0x47/0x170 [ 129.433425][ T6015] do_syscall_64+0x166/0x520 [ 129.433443][ T6015] ? trace_irq_disable+0x3b/0x140 [ 129.433467][ T6015] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.433488][ T6015] ? clear_bhb_loop+0x70/0xc0 [ 129.433511][ T6015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.433531][ T6015] RIP: 0033:0x7fd350fbe159 [ 129.433549][ T6015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.433564][ T6015] RSP: 002b:00007fd34f1f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 129.433585][ T6015] RAX: ffffffffffffffda RBX: 00007fd351246090 RCX: 00007fd350fbe159 [ 129.433599][ T6015] RDX: 0000000000000000 RSI: 0000000000009201 RDI: 0000000000000003 [ 129.433611][ T6015] RBP: 00007fd34f1f5090 R08: 0000000000000000 R09: 0000000000000000 [ 129.433623][ T6015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 129.433635][ T6015] R13: 00007fd351246128 R14: 00007fd351246090 R15: 00007fff967be398 [ 129.433665][ T6015] [ 129.433683][ T6015] ERROR: Out of memory at tomoyo_realpath_from_path. [ 130.564698][ T5702] usb 2-1: Using ep0 maxpacket: 16 [ 130.569197][ T5702] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 130.571934][ T5702] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 130.571967][ T5702] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 130.571987][ T5702] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 130.572005][ T5702] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 130.572026][ T5702] usb 2-1: config 0 has no interface number 0 [ 130.598657][ T5702] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.598720][ T5702] usb 2-1: Product: syz [ 130.598742][ T5702] usb 2-1: Manufacturer: syz [ 130.598758][ T5702] usb 2-1: SerialNumber: syz [ 132.900863][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.900964][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.935483][ T6023] netlink: 'syz.2.68': attribute type 3 has an invalid length. [ 133.023579][ T5702] usb 2-1: config 0 descriptor?? [ 133.118512][ T6030] ======================================================= [ 133.118512][ T6030] WARNING: The mand mount option has been deprecated and [ 133.118512][ T6030] and is ignored by this kernel. Remove the mand [ 133.118512][ T6030] option from the mount to silence this warning. [ 133.118512][ T6030] ======================================================= [ 133.368143][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 133.544643][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 133.553172][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 133.553226][ T31] usb 3-1: New USB device found, idVendor=1a0a, idProduct=0108, bcdDevice=c2.5a [ 133.573510][ T999] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 133.616497][ T31] usb 3-1: config 137 has an invalid interface number: 5 but max is 0 [ 133.616528][ T31] usb 3-1: config 137 has no interface number 0 [ 133.616564][ T31] usb 3-1: config 137 interface 5 has no altsetting 0 [ 133.666573][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=13 [ 133.666592][ T31] usb 3-1: Product: syz [ 133.666602][ T31] usb 3-1: Manufacturer: syz [ 133.666616][ T31] usb 3-1: SerialNumber: syz [ 133.794697][ T999] usb 1-1: Using ep0 maxpacket: 8 [ 133.799977][ T999] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 133.816320][ T999] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 133.858959][ T999] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.858985][ T999] usb 1-1: Product: syz [ 133.859000][ T999] usb 1-1: Manufacturer: syz [ 133.859015][ T999] usb 1-1: SerialNumber: syz [ 133.903116][ T999] usb 1-1: config 0 descriptor?? [ 133.940212][ T999] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 134.567936][ T999] gspca_zc3xx: reg_w_i err -71 [ 134.585626][ T5591] usb 2-1: USB disconnect, device number 2 [ 135.164730][ T999] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 135.164848][ T999] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 135.250078][ T6047] device-mapper: ioctl: Empty message received. [ 135.274796][ T999] usb 1-1: USB disconnect, device number 2 [ 135.423864][ T6047] Bluetooth: ISO socket layer initialized [ 135.875751][ T5716] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 136.080280][ T5716] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 136.139451][ T5716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.139716][ T5716] usb 4-1: Product: syz [ 136.139733][ T5716] usb 4-1: Manufacturer: syz [ 136.139749][ T5716] usb 4-1: SerialNumber: syz [ 136.465463][ T5709] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 136.506859][ T5716] usb 4-1: config 0 descriptor?? [ 136.649685][ T5709] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 136.653518][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.862882][ T5709] usb 1-1: config 0 descriptor?? [ 136.898198][ T5716] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 136.921152][ T31] usb_ehset_test 3-1:137.5: probe with driver usb_ehset_test failed with error -32 [ 137.168749][ T31] usb 3-1: USB disconnect, device number 3 [ 137.208677][ T5709] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 138.086928][ T5709] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 138.088153][ T5709] [drm] Initialized udl on minor 1 [ 138.200803][ T6076] netlink: Conntrack attr has 12 unknown bytes [ 138.201054][ T6076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 138.326532][ T6077] netlink: 'syz.1.78': attribute type 13 has an invalid length. [ 138.327312][ T6077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.78'. [ 138.327489][ T6077] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 138.654927][ T6072] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 139.140358][ T5709] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 139.197972][ T5709] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 139.243736][ T5709] usb 1-1: USB disconnect, device number 3 [ 139.683294][ T5716] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 140.147611][ T6090] netlink: 'syz.0.81': attribute type 1 has an invalid length. [ 140.147634][ T6090] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.81'. [ 140.147659][ T6090] netlink: 'syz.0.81': attribute type 1 has an invalid length. [ 140.147672][ T6090] netlink: 2016 bytes leftover after parsing attributes in process `syz.0.81'. [ 140.568888][ T6087] netlink: Failed to add proc helper -22 [ 140.568951][ T6087] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 140.625378][ T31] usb 4-1: USB disconnect, device number 4 [ 141.102238][ T6112] FAULT_INJECTION: forcing a failure. [ 141.102238][ T6112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 141.102271][ T6112] CPU: 0 UID: 0 PID: 6112 Comm: syz.3.84 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 141.102291][ T6112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.102302][ T6112] Call Trace: [ 141.102308][ T6112] [ 141.102316][ T6112] dump_stack_lvl+0xe8/0x150 [ 141.102348][ T6112] should_fail_ex+0x46b/0x600 [ 141.102378][ T6112] _copy_from_iter+0x1d3/0x1660 [ 141.102407][ T6112] ? trace_kmem_cache_alloc+0x29/0xe0 [ 141.102435][ T6112] ? __pfx__copy_from_iter+0x10/0x10 [ 141.102458][ T6112] ? __alloc_skb+0x27a/0x7a0 [ 141.102484][ T6112] ? __alloc_skb+0x27a/0x7a0 [ 141.102515][ T6112] ? netlink_sendmsg+0x650/0xb40 [ 141.102539][ T6112] ? skb_put+0x112/0x210 [ 141.102558][ T6112] netlink_sendmsg+0x6c0/0xb40 [ 141.102589][ T6112] ? __pfx_netlink_sendmsg+0x10/0x10 [ 141.102614][ T6112] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 141.102646][ T6112] ? __kernel_text_address+0xd/0x30 [ 141.102668][ T6112] ? unwind_get_return_address+0x4d/0x90 [ 141.102697][ T6112] ? __pfx_netlink_sendmsg+0x10/0x10 [ 141.102718][ T6112] sock_sendmsg_nosec+0x13a/0x180 [ 141.102743][ T6112] ____sys_sendmsg+0x565/0x870 [ 141.102769][ T6112] ? __pfx_____sys_sendmsg+0x10/0x10 [ 141.102796][ T6112] ? import_iovec+0x73/0xa0 [ 141.102825][ T6112] ___sys_sendmsg+0x2a5/0x360 [ 141.102857][ T6112] ? __lock_acquire+0x747/0x2de0 [ 141.102888][ T6112] ? __pfx____sys_sendmsg+0x10/0x10 [ 141.102941][ T6112] ? __fget_files+0x2a/0x420 [ 141.102965][ T6112] ? __fget_files+0x3a8/0x420 [ 141.102996][ T6112] __x64_sys_sendmsg+0x1b7/0x290 [ 141.103019][ T6112] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 141.103058][ T6112] do_syscall_64+0x166/0x520 [ 141.103074][ T6112] ? trace_irq_disable+0x3b/0x140 [ 141.103097][ T6112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.103115][ T6112] ? clear_bhb_loop+0x70/0xc0 [ 141.103149][ T6112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 141.103166][ T6112] RIP: 0033:0x7f1bcf9de159 [ 141.103184][ T6112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.103199][ T6112] RSP: 002b:00007f1bcdbf4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 141.103219][ T6112] RAX: ffffffffffffffda RBX: 00007f1bcfc66180 RCX: 00007f1bcf9de159 [ 141.103230][ T6112] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000c [ 141.103240][ T6112] RBP: 00007f1bcdbf4090 R08: 0000000000000000 R09: 0000000000000000 [ 141.103250][ T6112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.103259][ T6112] R13: 00007f1bcfc66218 R14: 00007f1bcfc66180 R15: 00007ffcd7c89ea8 [ 141.103286][ T6112] [ 142.205647][ T6128] FAULT_INJECTION: forcing a failure. [ 142.205647][ T6128] name failslab, interval 1, probability 0, space 0, times 0 [ 142.205683][ T6128] CPU: 0 UID: 0 PID: 6128 Comm: syz.4.88 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 142.205719][ T6128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.205732][ T6128] Call Trace: [ 142.205740][ T6128] [ 142.205749][ T6128] dump_stack_lvl+0xe8/0x150 [ 142.205787][ T6128] should_fail_ex+0x46b/0x600 [ 142.205820][ T6128] should_failslab+0xa8/0x100 [ 142.205865][ T6128] __kmalloc_cache_noprof+0xa1/0x680 [ 142.205896][ T6128] ? ceph_get_tree+0x1b7/0x1a40 [ 142.205922][ T6128] ? ceph_get_tree+0x1b7/0x1a40 [ 142.205965][ T6128] ceph_get_tree+0x1b7/0x1a40 [ 142.205990][ T6128] ? cap_capable+0x123/0x460 [ 142.206016][ T6128] ? safesetid_security_capable+0xa9/0x1a0 [ 142.206048][ T6128] vfs_get_tree+0x92/0x2a0 [ 142.206074][ T6128] vfs_cmd_create+0xa2/0x200 [ 142.206107][ T6128] __se_sys_fsconfig+0x6bf/0x810 [ 142.206140][ T6128] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 142.206171][ T6128] ? rcu_is_watching+0x16/0xb0 [ 142.206206][ T6128] ? arch_syscall_is_vdso_sigreturn+0x11f/0x1a0 [ 142.206230][ T6128] ? __x64_sys_fsconfig+0x20/0xc0 [ 142.206263][ T6128] do_syscall_64+0x166/0x520 [ 142.206280][ T6128] ? trace_irq_disable+0x3b/0x140 [ 142.206305][ T6128] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.206326][ T6128] ? clear_bhb_loop+0x70/0xc0 [ 142.206353][ T6128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.206374][ T6128] RIP: 0033:0x7f06f870e159 [ 142.206393][ T6128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.206411][ T6128] RSP: 002b:00007f06f6966028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 142.206433][ T6128] RAX: ffffffffffffffda RBX: 00007f06f8995fa0 RCX: 00007f06f870e159 [ 142.206448][ T6128] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 142.206461][ T6128] RBP: 00007f06f87a506b R08: 0000000000000000 R09: 0000000000000000 [ 142.206475][ T6128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.206489][ T6128] R13: 00007f06f8996038 R14: 00007f06f8995fa0 R15: 00007ffc438502f8 [ 142.206521][ T6128] [ 142.469542][ T6138] FAULT_INJECTION: forcing a failure. [ 142.469542][ T6138] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 142.469579][ T6138] CPU: 1 UID: 0 PID: 6138 Comm: syz.3.90 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 142.469604][ T6138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.469618][ T6138] Call Trace: [ 142.469626][ T6138] [ 142.469636][ T6138] dump_stack_lvl+0xe8/0x150 [ 142.469675][ T6138] should_fail_ex+0x46b/0x600 [ 142.469724][ T6138] _copy_from_user+0x2d/0xb0 [ 142.469758][ T6138] dm_ctl_ioctl+0x14c/0xe10 [ 142.469793][ T6138] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 142.469834][ T6138] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 142.469899][ T6138] ? __fget_files+0x2a/0x420 [ 142.469921][ T6138] ? __fget_files+0x3a8/0x420 [ 142.469944][ T6138] ? __fget_files+0x2a/0x420 [ 142.469971][ T6138] ? bpf_lsm_file_ioctl+0x9/0x20 [ 142.469997][ T6138] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 142.470031][ T6138] __se_sys_ioctl+0xff/0x170 [ 142.470064][ T6138] do_syscall_64+0x166/0x520 [ 142.470084][ T6138] ? trace_irq_disable+0x3b/0x140 [ 142.470114][ T6138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.470137][ T6138] ? clear_bhb_loop+0x70/0xc0 [ 142.470165][ T6138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.470188][ T6138] RIP: 0033:0x7f1bcf9de159 [ 142.470208][ T6138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.470227][ T6138] RSP: 002b:00007f1bcdbf4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 142.470251][ T6138] RAX: ffffffffffffffda RBX: 00007f1bcfc66180 RCX: 00007f1bcf9de159 [ 142.470268][ T6138] RDX: 0000200000002000 RSI: 00000000c138fd06 RDI: 0000000000000003 [ 142.470283][ T6138] RBP: 00007f1bcdbf4090 R08: 0000000000000000 R09: 0000000000000000 [ 142.470297][ T6138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 142.470311][ T6138] R13: 00007f1bcfc66218 R14: 00007f1bcfc66180 R15: 00007ffcd7c89ea8 [ 142.470358][ T6138] [ 142.483685][ T6138] device-mapper: ioctl: Empty message received. [ 143.037680][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 143.178803][ T6155] netlink: 24 bytes leftover after parsing attributes in process `syz.2.96'. [ 143.205444][ T31] usb 1-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 143.208602][ T31] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 143.236763][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.236785][ T31] usb 1-1: Product: syz [ 143.236798][ T31] usb 1-1: Manufacturer: syz [ 143.236811][ T31] usb 1-1: SerialNumber: syz [ 143.271926][ T31] usb 1-1: config 0 descriptor?? [ 143.296664][ T31] kvaser_usb 1-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 143.461919][ T6160] vlan2: entered promiscuous mode [ 143.461946][ T6160] batadv0: entered promiscuous mode [ 143.462242][ T6160] vlan2: entered allmulticast mode [ 143.462263][ T6160] batadv0: entered allmulticast mode [ 143.501433][ T5709] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 143.536898][ T31] usb 1-1: USB disconnect, device number 4 [ 144.486617][ T5709] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 144.632398][ T5850] libceph: connect (1)[c::]:6789 error -101 [ 144.868836][ T5850] libceph: mon0 (1)[c::]:6789 connect error [ 145.147470][ T5709] usb 3-1: config 0 has an invalid interface number: 11 but max is 0 [ 145.147502][ T5709] usb 3-1: config 0 has no interface number 0 [ 145.147560][ T5709] usb 3-1: config 0 interface 11 altsetting 253 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 145.147590][ T5709] usb 3-1: config 0 interface 11 altsetting 253 has a duplicate endpoint with address 0x87, skipping [ 145.147613][ T5709] usb 3-1: config 0 interface 11 has no altsetting 0 [ 145.147647][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.308528][ T5850] libceph: connect (1)[c::]:6789 error -101 [ 145.320900][ T6167] ceph: No mds server is up or the cluster is laggy [ 145.343931][ T5850] libceph: mon0 (1)[c::]:6789 connect error [ 145.389432][ T5709] usb 3-1: config 0 descriptor?? [ 145.424419][ T5709] keyspan 3-1:0.11: Keyspan 2 port adapter converter detected [ 145.425226][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 87 [ 145.439278][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 81 [ 145.439633][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 82 [ 145.439847][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 1 [ 145.440032][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 2 [ 145.440220][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 85 [ 145.440401][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 5 [ 145.501628][ T5709] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 145.513704][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 83 [ 145.513818][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 84 [ 145.513897][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 3 [ 145.513989][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 4 [ 145.517497][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 86 [ 145.517580][ T5709] keyspan 3-1:0.11: found no endpoint descriptor for endpoint 6 [ 145.525840][ T5709] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 145.910244][ T6176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.910889][ T6176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.051456][ T6182] capability: warning: `syz.0.100' uses 32-bit capabilities (legacy support in use) [ 147.182969][ T5850] usb 3-1: USB disconnect, device number 4 [ 147.540560][ T5850] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 147.579753][ T5591] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 147.736872][ T5591] usb 5-1: New USB device found, idVendor=046d, idProduct=c704, bcdDevice= 0.00 [ 147.738488][ T5591] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 147.738517][ T5591] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 147.738545][ T5591] usb 5-1: config 0 interface 0 has no altsetting 0 [ 147.738580][ T5591] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.741401][ T5850] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 147.814341][ T5850] keyspan 3-1:0.11: device disconnected [ 148.068799][ T5591] usb 5-1: config 0 descriptor?? [ 148.897859][ T5591] input: HID 046d:c704 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:046D:C704.0001/input/input5 [ 149.023770][ T6208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.043052][ T6208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.100585][ T5716] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 149.382311][ T5850] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 149.451837][ T6207] ALSA: mixer_oss: invalid OSS volume '' [ 149.460572][ T6207] ALSA: mixer_oss: invalid OSS volume '' [ 149.577342][ T5850] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 149.580796][ T5850] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 149.580851][ T5850] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 149.580875][ T5850] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 149.580900][ T5850] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 149.580943][ T5850] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.693742][ T5591] logitech 0003:046D:C704.0001: input,hidraw0: USB HID v0.00 Joystick [HID 046d:c704] on usb-dummy_hcd.4-1/input0 [ 150.713290][ T5850] usb 3-1: USB disconnect, device number 5 [ 150.880409][ T5716] usb 1-1: device descriptor read/all, error -71 [ 150.925848][ T5591] usb 5-1: USB disconnect, device number 2 [ 151.114704][ T6216] netlink: 24 bytes leftover after parsing attributes in process `syz.0.114'. [ 151.258694][ T6211] fido_id[6211]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 151.544738][ T5716] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 151.567482][ T6226] process 'syz.2.117' launched './file2' with NULL argv: empty string added [ 151.687473][ T6224] FAULT_INJECTION: forcing a failure. [ 151.687473][ T6224] name fail_futex, interval 1, probability 0, space 0, times 1 [ 151.687509][ T6224] CPU: 0 UID: 0 PID: 6224 Comm: syz.2.117 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 151.687532][ T6224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 151.687544][ T6224] Call Trace: [ 151.687552][ T6224] [ 151.687560][ T6224] dump_stack_lvl+0xe8/0x150 [ 151.687614][ T6224] should_fail_ex+0x46b/0x600 [ 151.687649][ T6224] get_futex_key+0x1b4/0x1580 [ 151.687693][ T6224] ? __pfx_get_futex_key+0x10/0x10 [ 151.687722][ T6224] ? kasan_save_free_info+0x40/0x50 [ 151.687747][ T6224] ? __kasan_slab_free+0x5c/0x80 [ 151.687777][ T6224] ? kfree+0x1c5/0x6d0 [ 151.687801][ T6224] ? __se_sys_request_key+0x329/0x350 [ 151.687826][ T6224] ? do_syscall_64+0x166/0x520 [ 151.687846][ T6224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.687879][ T6224] futex_wake+0x119/0x600 [ 151.687911][ T6224] ? __pfx_futex_wake+0x10/0x10 [ 151.687953][ T6224] do_futex+0x458/0x4e0 [ 151.687980][ T6224] ? __pfx_do_futex+0x10/0x10 [ 151.688011][ T6224] __se_sys_futex+0x3a8/0x450 [ 151.688040][ T6224] ? __pfx___se_sys_futex+0x10/0x10 [ 151.688073][ T6224] ? rcu_is_watching+0x16/0xb0 [ 151.688110][ T6224] ? __x64_sys_futex+0x21/0xf0 [ 151.688133][ T6224] do_syscall_64+0x166/0x520 [ 151.688151][ T6224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.688172][ T6224] ? clear_bhb_loop+0x70/0xc0 [ 151.688212][ T6224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.688268][ T6224] RIP: 0033:0x7fe40a1de159 [ 151.688288][ T6224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 151.688306][ T6224] RSP: 002b:00007fe4084150e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 151.688329][ T6224] RAX: ffffffffffffffda RBX: 00007fe40a466098 RCX: 00007fe40a1de159 [ 151.688346][ T6224] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe40a46609c [ 151.688361][ T6224] RBP: 00007fe40a466090 R08: 3fffffffffffffff R09: 0000000000000000 [ 151.688376][ T6224] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 151.688391][ T6224] R13: 00007fe40a466128 R14: 00007ffefb71fef0 R15: 00007ffefb71ffd8 [ 151.688425][ T6224] [ 151.744674][ T5716] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 151.773160][ T5716] usb 1-1: config 0 has an invalid interface number: 11 but max is 0 [ 151.773189][ T5716] usb 1-1: config 0 has no interface number 0 [ 151.773300][ T5716] usb 1-1: config 0 interface 11 altsetting 253 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 151.773330][ T5716] usb 1-1: config 0 interface 11 altsetting 253 has a duplicate endpoint with address 0x87, skipping [ 151.773354][ T5716] usb 1-1: config 0 interface 11 has no altsetting 0 [ 151.773386][ T5716] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.439167][ T5716] usb 1-1: config 0 descriptor?? [ 152.455240][ T5716] keyspan 1-1:0.11: Keyspan 2 port adapter converter detected [ 152.455528][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 87 [ 152.459186][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 81 [ 152.459269][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 82 [ 152.459348][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 1 [ 152.459426][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 2 [ 152.459501][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 85 [ 152.459573][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 5 [ 152.463165][ T5716] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 152.555779][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 83 [ 152.555869][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 84 [ 152.555950][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 3 [ 152.556029][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 4 [ 152.556109][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 86 [ 152.564683][ T5716] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 6 [ 152.628863][ T5716] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 152.659690][ T6216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.796673][ T6216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.225546][ T5716] usb 1-1: USB disconnect, device number 6 [ 154.004108][ T6244] FAULT_INJECTION: forcing a failure. [ 154.004108][ T6244] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 154.004146][ T6244] CPU: 0 UID: 0 PID: 6244 Comm: syz.2.120 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 154.004171][ T6244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 154.004185][ T6244] Call Trace: [ 154.004193][ T6244] [ 154.004202][ T6244] dump_stack_lvl+0xe8/0x150 [ 154.004240][ T6244] should_fail_ex+0x46b/0x600 [ 154.004274][ T6244] _copy_from_user+0x2d/0xb0 [ 154.004308][ T6244] memdup_user+0x5e/0xd0 [ 154.004332][ T6244] strndup_user+0x68/0xd0 [ 154.004354][ T6244] __se_sys_mount+0x9d/0x420 [ 154.004378][ T6244] ? ksys_write+0x248/0x270 [ 154.004406][ T6244] ? __pfx___se_sys_mount+0x10/0x10 [ 154.004437][ T6244] ? __x64_sys_mount+0x20/0xc0 [ 154.004462][ T6244] do_syscall_64+0x166/0x520 [ 154.004487][ T6244] ? trace_irq_disable+0x3b/0x140 [ 154.004515][ T6244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.004538][ T6244] ? clear_bhb_loop+0x70/0xc0 [ 154.004583][ T6244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.004606][ T6244] RIP: 0033:0x7fe40a1de159 [ 154.004626][ T6244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.004645][ T6244] RSP: 002b:00007fe4083f4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 154.004670][ T6244] RAX: ffffffffffffffda RBX: 00007fe40a466180 RCX: 00007fe40a1de159 [ 154.004687][ T6244] RDX: 00002000000002c0 RSI: 0000200000000180 RDI: 0000000000000000 [ 154.004702][ T6244] RBP: 00007fe4083f4090 R08: 0000200000000200 R09: 0000000000000000 [ 154.004717][ T6244] R10: 0000000002000400 R11: 0000000000000246 R12: 0000000000000001 [ 154.004731][ T6244] R13: 00007fe40a466218 R14: 00007fe40a466180 R15: 00007ffefb71ffd8 [ 154.004767][ T6244] [ 154.494853][ T5716] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 155.009028][ T5716] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 155.040533][ T5716] keyspan 1-1:0.11: device disconnected [ 155.553092][ T6261] device-mapper: ioctl: Empty message received. [ 158.783465][ T6270] netlink: 92 bytes leftover after parsing attributes in process `syz.0.127'. [ 158.795262][ T6270] netlink: 92 bytes leftover after parsing attributes in process `syz.0.127'. [ 158.795447][ T6270] Zero length message leads to an empty skb [ 158.980897][ T6275] FAULT_INJECTION: forcing a failure. [ 158.980897][ T6275] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.980936][ T6275] CPU: 0 UID: 0 PID: 6275 Comm: syz.1.128 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 158.980961][ T6275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.980985][ T6275] Call Trace: [ 158.980994][ T6275] [ 158.981003][ T6275] dump_stack_lvl+0xe8/0x150 [ 158.981043][ T6275] should_fail_ex+0x46b/0x600 [ 158.981077][ T6275] _copy_from_user+0x2d/0xb0 [ 158.981111][ T6275] __keyctl_dh_compute+0x1c3/0xd10 [ 158.981140][ T6275] ? __lock_acquire+0x747/0x2de0 [ 158.981173][ T6275] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 158.981234][ T6275] keyctl_dh_compute+0x124/0x180 [ 158.981261][ T6275] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 158.981287][ T6275] ? do_raw_spin_lock+0x12b/0x2f0 [ 158.981321][ T6275] __se_sys_keyctl+0x44c/0x9d0 [ 158.981354][ T6275] ? __pfx___se_sys_keyctl+0x10/0x10 [ 158.981382][ T6275] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 158.981417][ T6275] ? rt_mutex_slowunlock+0x219/0x460 [ 158.981445][ T6275] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 158.981479][ T6275] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 158.981515][ T6275] ? fput+0xa0/0xd0 [ 158.981549][ T6275] ? ksys_write+0x248/0x270 [ 158.981576][ T6275] ? __pfx_ksys_write+0x10/0x10 [ 158.981619][ T6275] ? __x64_sys_keyctl+0x20/0xc0 [ 158.981649][ T6275] do_syscall_64+0x166/0x520 [ 158.981672][ T6275] ? trace_irq_disable+0x3b/0x140 [ 158.981699][ T6275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.981720][ T6275] ? clear_bhb_loop+0x70/0xc0 [ 158.981745][ T6275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.981766][ T6275] RIP: 0033:0x7f3c8d47e159 [ 158.981785][ T6275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.981802][ T6275] RSP: 002b:00007f3c8b6d6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 158.981824][ T6275] RAX: ffffffffffffffda RBX: 00007f3c8d705fa0 RCX: 00007f3c8d47e159 [ 158.981839][ T6275] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 0000000000000017 [ 158.981852][ T6275] RBP: 00007f3c8b6d6090 R08: 0000200000000280 R09: 0000000000000000 [ 158.981866][ T6275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.981879][ T6275] R13: 00007f3c8d706038 R14: 00007f3c8d705fa0 R15: 00007ffdd3064b38 [ 158.981910][ T6275] [ 160.796136][ T6298] FAULT_INJECTION: forcing a failure. [ 160.796136][ T6298] name failslab, interval 1, probability 0, space 0, times 0 [ 160.796213][ T6298] CPU: 1 UID: 0 PID: 6298 Comm: syz.3.136 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 160.796238][ T6298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 160.796250][ T6298] Call Trace: [ 160.796264][ T6298] [ 160.796272][ T6298] dump_stack_lvl+0xe8/0x150 [ 160.796307][ T6298] should_fail_ex+0x46b/0x600 [ 160.796339][ T6298] should_failslab+0xa8/0x100 [ 160.796372][ T6298] __kmalloc_noprof+0xfb/0x790 [ 160.796399][ T6298] ? alloc_pipe_info+0x1f9/0x4c0 [ 160.796425][ T6298] ? alloc_pipe_info+0x1f9/0x4c0 [ 160.796456][ T6298] alloc_pipe_info+0x1f9/0x4c0 [ 160.796485][ T6298] splice_direct_to_actor+0xa52/0xcc0 [ 160.796508][ T6298] ? __lock_acquire+0x747/0x2de0 [ 160.796538][ T6298] ? __pfx_futex_wake_mark+0x10/0x10 [ 160.796561][ T6298] ? __pfx___schedule+0x10/0x10 [ 160.796592][ T6298] ? try_to_wake_up+0x887/0x1430 [ 160.796614][ T6298] ? __pfx_direct_splice_actor+0x10/0x10 [ 160.796632][ T6298] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 160.796651][ T6298] ? irqentry_exit+0x218/0x910 [ 160.796680][ T6298] do_splice_direct+0x19b/0x2a0 [ 160.796699][ T6298] ? __pfx_do_splice_direct+0x10/0x10 [ 160.796718][ T6298] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 160.796742][ T6298] ? rw_verify_area+0x209/0x4d0 [ 160.796781][ T6298] do_sendfile+0x540/0x7e0 [ 160.796812][ T6298] ? __pfx_do_sendfile+0x10/0x10 [ 160.796845][ T6298] __se_sys_sendfile64+0xdf/0x1a0 [ 160.796870][ T6298] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 160.796902][ T6298] do_syscall_64+0x166/0x520 [ 160.796916][ T6298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.796934][ T6298] ? clear_bhb_loop+0x70/0xc0 [ 160.796954][ T6298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.796970][ T6298] RIP: 0033:0x7f1bcf9de159 [ 160.796985][ T6298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.796999][ T6298] RSP: 002b:00007f1bcdbf4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 160.797017][ T6298] RAX: ffffffffffffffda RBX: 00007f1bcfc66180 RCX: 00007f1bcf9de159 [ 160.797029][ T6298] RDX: 0000200000000080 RSI: 0000000000000006 RDI: 0000000000000006 [ 160.797040][ T6298] RBP: 00007f1bcfa7506b R08: 0000000000000000 R09: 0000000000000000 [ 160.797050][ T6298] R10: 0000000000007f03 R11: 0000000000000246 R12: 0000000000000000 [ 160.797060][ T6298] R13: 00007f1bcfc66218 R14: 00007f1bcfc66180 R15: 00007ffcd7c89ea8 [ 160.797085][ T6298] [ 161.468308][ T6305] netlink: 224 bytes leftover after parsing attributes in process `syz.2.139'. [ 163.286511][ T6336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.148'. [ 165.525074][ T5850] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 165.880213][ T5850] usb 1-1: Using ep0 maxpacket: 32 [ 166.122153][ T5850] usb 1-1: device descriptor read/all, error -71 [ 168.320063][ T6357] FAULT_INJECTION: forcing a failure. [ 168.320063][ T6357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 168.323926][ T6357] CPU: 0 UID: 0 PID: 6357 Comm: syz.2.152 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 168.323965][ T6357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.323980][ T6357] Call Trace: [ 168.323989][ T6357] [ 168.324000][ T6357] dump_stack_lvl+0xe8/0x150 [ 168.324040][ T6357] should_fail_ex+0x46b/0x600 [ 168.324079][ T6357] _copy_from_user+0x2d/0xb0 [ 168.324115][ T6357] vhost_vring_ioctl+0x5c4/0x18f0 [ 168.324150][ T6357] ? __pfx_vhost_vring_ioctl+0x10/0x10 [ 168.324180][ T6357] ? irqentry_exit+0x218/0x910 [ 168.324217][ T6357] ? lockdep_hardirqs_on+0x7b/0x110 [ 168.324253][ T6357] ? irqentry_exit+0x218/0x910 [ 168.324305][ T6357] ? vhost_vsock_dev_ioctl+0x25a/0xee0 [ 168.324340][ T6357] vhost_vsock_dev_ioctl+0x268/0xee0 [ 168.324376][ T6357] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 168.324407][ T6357] ? __fget_files+0x3b0/0x420 [ 168.324438][ T6357] ? bpf_lsm_file_ioctl+0x9/0x20 [ 168.324476][ T6357] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 168.324506][ T6357] __se_sys_ioctl+0xff/0x170 [ 168.324540][ T6357] do_syscall_64+0x166/0x520 [ 168.324561][ T6357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.324585][ T6357] ? clear_bhb_loop+0x70/0xc0 [ 168.324633][ T6357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.324656][ T6357] RIP: 0033:0x7fe40a1de159 [ 168.324678][ T6357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 168.324697][ T6357] RSP: 002b:00007fe4083d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 168.324722][ T6357] RAX: ffffffffffffffda RBX: 00007fe40a466270 RCX: 00007fe40a1de159 [ 168.324739][ T6357] RDX: 0000200000000000 RSI: 000000004008af20 RDI: 0000000000000006 [ 168.324755][ T6357] RBP: 00007fe4083d3090 R08: 0000000000000000 R09: 0000000000000000 [ 168.324769][ T6357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 168.324783][ T6357] R13: 00007fe40a466308 R14: 00007fe40a466270 R15: 00007ffefb71ffd8 [ 168.324821][ T6357] [ 169.332214][ T5872] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.802894][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 169.889488][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 169.904352][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 169.919040][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 169.919726][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 170.142475][ T6381] tipc: Failed to remove unknown binding: 66,0,0/0:2742007147/2742007148 [ 170.211452][ T6384] netlink: 24 bytes leftover after parsing attributes in process `syz.1.160'. [ 170.285213][ T37] audit: type=1326 audit(1790008515.266:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6382 comm="syz.2.159" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe40a1de159 code=0x0 [ 170.444669][ T5850] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 171.325768][ T5850] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 171.331127][ T5850] usb 2-1: config 0 has an invalid interface number: 11 but max is 0 [ 171.331153][ T5850] usb 2-1: config 0 has no interface number 0 [ 171.331197][ T5850] usb 2-1: config 0 interface 11 altsetting 253 endpoint 0x7 has an invalid bInterval 129, changing to 11 [ 171.331226][ T5850] usb 2-1: config 0 interface 11 altsetting 253 has a duplicate endpoint with address 0x87, skipping [ 171.331250][ T5850] usb 2-1: config 0 interface 11 has no altsetting 0 [ 171.331282][ T5850] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.959992][ T5850] usb 2-1: config 0 descriptor?? [ 171.976424][ T5850] keyspan 2-1:0.11: Keyspan 2 port adapter converter detected [ 171.976677][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 87 [ 171.980433][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 81 [ 171.980510][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 82 [ 171.981723][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 1 [ 171.981798][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 2 [ 171.981906][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 85 [ 171.981984][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 5 [ 172.087363][ T5850] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 172.106759][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 83 [ 172.106862][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 84 [ 172.106942][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 3 [ 172.107019][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 4 [ 172.107101][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 86 [ 172.107204][ T5850] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 6 [ 172.111403][ T5850] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 172.144672][ T5590] Bluetooth: hci2: command tx timeout [ 172.320856][ T6400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.321457][ T6400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.953472][ T9] usb 2-1: USB disconnect, device number 3 [ 173.020091][ T9] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 173.036704][ T9] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 173.036982][ T6411] syz.0.164 uses obsolete (PF_INET,SOCK_PACKET) [ 173.038017][ T9] keyspan 2-1:0.11: device disconnected [ 173.257788][ T5872] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.417571][ T6419] batadv_slave_1: entered promiscuous mode [ 174.237784][ T5590] Bluetooth: hci2: command tx timeout [ 175.392428][ T6405] batadv_slave_1: left promiscuous mode [ 175.969941][ T5872] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.388095][ T5590] Bluetooth: hci2: command tx timeout [ 176.641842][ T5872] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.464656][ T60] Bluetooth: hci2: command tx timeout [ 179.076664][ T6511] Illegal XDP return value 4294967274 on prog (id 19) dev N/A, expect packet loss! [ 179.148785][ T6497] Process accounting resumed [ 180.167161][ T5872] bridge_slave_1: left allmulticast mode [ 180.196613][ T5872] bridge_slave_1: left promiscuous mode [ 180.248496][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.471566][ T5872] bridge_slave_0: left allmulticast mode [ 180.471600][ T5872] bridge_slave_0: left promiscuous mode [ 180.472476][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.084725][ T6543] netlink: 'syz.1.214': attribute type 1 has an invalid length. [ 181.748637][ T6559] netlink: 4 bytes leftover after parsing attributes in process `syz.1.222'. [ 182.219274][ T6564] loop9: detected capacity change from 0 to 7 [ 182.376917][ T6565] [ 182.379307][ T6565] ====================================================== [ 182.386325][ T6565] WARNING: possible circular locking dependency detected [ 182.393404][ T6565] syzkaller #0 Not tainted [ 182.397837][ T6565] ------------------------------------------------------ [ 182.404878][ T6565] syz.0.224/6565 is trying to acquire lock: [ 182.410795][ T6565] ffff88813ff772c0 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_getattr+0x9e/0x450 [ 182.421193][ T6565] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 182.421193][ T6565] but task is already holding lock: [ 182.428556][ T6565] ffff8880271be550 (&q->q_usage_counter(io)#26){++++}-{0:0}, at: lo_ioctl+0x19e5/0x2030 [ 182.438322][ T6565] [ 182.438322][ T6565] which lock already depends on the new lock. [ 182.438322][ T6565] [ 182.448833][ T6565] [ 182.448833][ T6565] the existing dependency chain (in reverse order) is: [ 182.457862][ T6565] [ 182.457862][ T6565] -> #2 (&q->q_usage_counter(io)#26){++++}-{0:0}: [ 182.466497][ T6565] blk_alloc_queue+0x54c/0x690 [ 182.471828][ T6565] __blk_mq_alloc_disk+0x194/0x390 [ 182.477495][ T6565] loop_add+0x480/0xb50 [ 182.482202][ T6565] loop_init+0xd7/0x160 [ 182.486916][ T6565] do_one_initcall+0x250/0x870 [ 182.492228][ T6565] do_initcall_level+0x10a/0x1a0 [ 182.497706][ T6565] do_initcalls+0x59/0xa0 [ 182.502611][ T6565] kernel_init_freeable+0x29d/0x3e0 [ 182.508367][ T6565] kernel_init+0x22/0x1d0 [ 182.513252][ T6565] ret_from_fork+0x514/0xb70 [ 182.518377][ T6565] ret_from_fork_asm+0x1a/0x30 [ 182.523685][ T6565] [ 182.523685][ T6565] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 182.530931][ T6565] fs_reclaim_acquire+0x71/0x100 [ 182.536423][ T6565] kmem_cache_alloc_noprof+0x5c/0x690 [ 182.542356][ T6565] __kernfs_iattrs+0xdd/0x380 [ 182.547578][ T6565] kernfs_iop_setattr+0xe6/0x3f0 [ 182.553069][ T6565] notify_change+0xbb8/0xec0 [ 182.558205][ T6565] do_truncate+0x1c2/0x250 [ 182.563158][ T6565] path_openat+0x15ba/0x1d60 [ 182.568371][ T6565] do_file_open+0x23e/0x4a0 [ 182.573408][ T6565] do_sys_openat2+0x115/0x200 [ 182.578627][ T6565] __x64_sys_openat+0x138/0x170 [ 182.584050][ T6565] do_syscall_64+0x166/0x520 [ 182.589216][ T6565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.595671][ T6565] [ 182.595671][ T6565] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 182.604249][ T6565] __lock_acquire+0x164c/0x2de0 [ 182.609653][ T6565] lock_acquire+0x115/0x350 [ 182.614712][ T6565] down_read+0x97/0x200 [ 182.619415][ T6565] kernfs_iop_getattr+0x9e/0x450 [ 182.624921][ T6565] vfs_getattr_nosec+0x2e1/0x430 [ 182.630429][ T6565] loop_assign_backing_file+0x28e/0x620 [ 182.636531][ T6565] lo_ioctl+0x1a5e/0x2030 [ 182.641421][ T6565] blkdev_ioctl+0x5e6/0x750 [ 182.646488][ T6565] __se_sys_ioctl+0xff/0x170 [ 182.651634][ T6565] do_syscall_64+0x166/0x520 [ 182.656759][ T6565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.663205][ T6565] [ 182.663205][ T6565] other info that might help us debug this: [ 182.663205][ T6565] [ 182.673471][ T6565] Chain exists of: [ 182.673471][ T6565] &root->kernfs_iattr_rwsem --> fs_reclaim --> &q->q_usage_counter(io)#26 [ 182.673471][ T6565] [ 182.687915][ T6565] Possible unsafe locking scenario: [ 182.687915][ T6565] [ 182.695386][ T6565] CPU0 CPU1 [ 182.700772][ T6565] ---- ---- [ 182.706154][ T6565] lock(&q->q_usage_counter(io)#26); [ 182.711553][ T6565] lock(fs_reclaim); [ 182.718077][ T6565] lock(&q->q_usage_counter(io)#26); [ 182.725998][ T6565] rlock(&root->kernfs_iattr_rwsem); [ 182.731398][ T6565] [ 182.731398][ T6565] *** DEADLOCK *** [ 182.731398][ T6565] [ 182.739553][ T6565] locks held by syz.0.224/6565: 3, last CPU#1: [ 182.745737][ T6565] #0: ffff888026d83498 (&lo->lo_mutex){+.+.}-{4:4}, at: lo_ioctl+0x14a4/0x2030 [ 182.754846][ T6565] #1: ffff8880271be550 (&q->q_usage_counter(io)#26){++++}-{0:0}, at: lo_ioctl+0x19e5/0x2030 [ 182.765086][ T6565] #2: ffff8880271be588 (&q->q_usage_counter(queue)#10){+.+.}-{0:0}, at: lo_ioctl+0x19e5/0x2030 [ 182.775595][ T6565] [ 182.775595][ T6565] stack backtrace: [ 182.781505][ T6565] CPU: 1 UID: 0 PID: 6565 Comm: syz.0.224 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 182.791255][ T6565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 182.801341][ T6565] Call Trace: [ 182.804641][ T6565] [ 182.807602][ T6565] dump_stack_lvl+0xe8/0x150 [ 182.812246][ T6565] print_circular_bug+0x2e2/0x300 [ 182.817325][ T6565] check_noncircular+0x12f/0x150 [ 182.822296][ T6565] __lock_acquire+0x164c/0x2de0 [ 182.827212][ T6565] lock_acquire+0x115/0x350 [ 182.831749][ T6565] ? kernfs_iop_getattr+0x9e/0x450 [ 182.836890][ T6565] down_read+0x97/0x200 [ 182.841083][ T6565] ? kernfs_iop_getattr+0x9e/0x450 [ 182.846251][ T6565] ? __pfx_down_read+0x10/0x10 [ 182.851040][ T6565] ? kernfs_root+0x1c/0x230 [ 182.855574][ T6565] ? kernfs_root+0x1c/0x230 [ 182.860119][ T6565] kernfs_iop_getattr+0x9e/0x450 [ 182.865117][ T6565] vfs_getattr_nosec+0x2e1/0x430 [ 182.870097][ T6565] loop_assign_backing_file+0x28e/0x620 [ 182.875673][ T6565] ? rt_spin_unlock+0x159/0x200 [ 182.880572][ T6565] ? __pfx_loop_assign_backing_file+0x10/0x10 [ 182.886706][ T6565] lo_ioctl+0x1a5e/0x2030 [ 182.891076][ T6565] ? __pfx_lo_ioctl+0x10/0x10 [ 182.895792][ T6565] ? lock_acquire+0x115/0x350 [ 182.900499][ T6565] ? lock_acquire+0x115/0x350 [ 182.905215][ T6565] ? is_bpf_text_address+0x26/0x2b0 [ 182.910467][ T6565] ? is_bpf_text_address+0x292/0x2b0 [ 182.915799][ T6565] ? is_bpf_text_address+0x26/0x2b0 [ 182.921029][ T6565] ? kernel_text_address+0xa5/0xe0 [ 182.926197][ T6565] ? __lock_acquire+0x747/0x2de0 [ 182.931166][ T6565] ? __lock_acquire+0x747/0x2de0 [ 182.936148][ T6565] ? __lock_acquire+0x747/0x2de0 [ 182.941116][ T6565] ? __lock_acquire+0x747/0x2de0 [ 182.946082][ T6565] ? __lock_acquire+0x747/0x2de0 [ 182.951068][ T6565] ? lock_acquire+0x115/0x350 [ 182.955782][ T6565] ? lock_acquire+0x115/0x350 [ 182.960507][ T6565] ? is_bpf_text_address+0x26/0x2b0 [ 182.965763][ T6565] ? is_bpf_text_address+0x292/0x2b0 [ 182.971081][ T6565] ? is_bpf_text_address+0x26/0x2b0 [ 182.976415][ T6565] ? kernel_text_address+0xa5/0xe0 [ 182.981561][ T6565] ? __kernel_text_address+0xd/0x30 [ 182.986809][ T6565] ? unwind_get_return_address+0x4d/0x90 [ 182.992487][ T6565] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 182.998666][ T6565] ? arch_stack_walk+0xfb/0x150 [ 183.003552][ T6565] ? stack_trace_save+0xa9/0x100 [ 183.008518][ T6565] ? __pfx_stack_trace_save+0x10/0x10 [ 183.013929][ T6565] ? stack_depot_save_flags+0x33/0x7f0 [ 183.019439][ T6565] ? __lock_acquire+0x747/0x2de0 [ 183.024431][ T6565] ? kasan_save_track+0x4f/0x80 [ 183.029324][ T6565] ? kasan_save_track+0x3e/0x80 [ 183.034224][ T6565] ? kasan_save_free_info+0x40/0x50 [ 183.039459][ T6565] ? __kasan_slab_free+0x5c/0x80 [ 183.044438][ T6565] ? kfree+0x1c5/0x6d0 [ 183.048538][ T6565] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 183.054220][ T6565] ? security_file_ioctl+0xc3/0x2a0 [ 183.059450][ T6565] ? __se_sys_ioctl+0x47/0x170 [ 183.064247][ T6565] ? do_syscall_64+0x166/0x520 [ 183.069030][ T6565] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.075122][ T6565] ? __asan_memset+0x22/0x50 [ 183.079747][ T6565] ? blk_get_meta_cap+0x19d/0x780 [ 183.084805][ T6565] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 183.090210][ T6565] ? blkdev_common_ioctl+0x14b7/0x3250 [ 183.095713][ T6565] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 183.101394][ T6565] ? kasan_quarantine_put+0xbb/0x1f0 [ 183.106714][ T6565] ? tomoyo_path_number_perm+0x219/0x5f0 [ 183.112371][ T6565] ? tomoyo_path_number_perm+0x219/0x5f0 [ 183.118040][ T6565] ? do_vfs_ioctl+0x1184/0x1550 [ 183.122923][ T6565] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 183.128005][ T6565] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 183.133851][ T6565] ? hook_file_ioctl+0x1f5/0x610 [ 183.138812][ T6565] ? __asan_memset+0x22/0x50 [ 183.143427][ T6565] ? smack_file_ioctl+0x265/0x370 [ 183.148503][ T6565] ? __pfx_smack_file_ioctl+0x10/0x10 [ 183.153917][ T6565] ? __pfx_lo_ioctl+0x10/0x10 [ 183.158636][ T6565] blkdev_ioctl+0x5e6/0x750 [ 183.163186][ T6565] ? __pfx_blkdev_ioctl+0x10/0x10 [ 183.168228][ T6565] ? __fget_files+0x2a/0x420 [ 183.172854][ T6565] ? bpf_lsm_file_ioctl+0x9/0x20 [ 183.177835][ T6565] ? __pfx_blkdev_ioctl+0x10/0x10 [ 183.182880][ T6565] __se_sys_ioctl+0xff/0x170 [ 183.187486][ T6565] do_syscall_64+0x166/0x520 [ 183.192106][ T6565] ? trace_irq_disable+0x3b/0x140 [ 183.197157][ T6565] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.203245][ T6565] ? clear_bhb_loop+0x70/0xc0 [ 183.207949][ T6565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.213874][ T6565] RIP: 0033:0x7fd350fbe159 [ 183.218312][ T6565] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.237944][ T6565] RSP: 002b:00007fd34f1f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 183.246401][ T6565] RAX: ffffffffffffffda RBX: 00007fd351246090 RCX: 00007fd350fbe159 [ 183.254384][ T6565] RDX: 0000000000000004 RSI: 0000000000004c06 RDI: 0000000000000003 [ 183.262377][ T6565] RBP: 00007fd35105506b R08: 0000000000000000 R09: 0000000000000000 [ 183.270371][ T6565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 183.278373][ T6565] R13: 00007fd351246128 R14: 00007fd351246090 R15: 00007fff967be398 [ 183.286390][ T6565] [ 183.319153][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.319236][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.319398][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.319450][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.319551][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.319602][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.319726][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.319776][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.319914][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.319971][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.320214][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.320265][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.320353][ T6564] ldm_validate_partition_table(): Disk read failed. [ 183.320412][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.320461][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.320579][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.320737][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.320936][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.320977][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.321120][ C0] I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 183.321169][ C0] Buffer I/O error on dev loop9, logical block 0, async page read [ 183.321276][ T6564] Dev loop9: unable to read RDB block 0 [ 183.321852][ T6564] loop9: unable to read partition table [ 183.321999][ T6564] loop9: partition table beyond EOD, truncated [ 183.322150][ T6564] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 183.348732][ T6565] ldm_validate_partition_table(): Disk read failed. [ 183.350333][ T6565] Dev loop9: unable to read RDB block 0 [ 183.352179][ T6565] loop9: unable to read partition table [ 183.352514][ T6565] loop9: partition table beyond EOD, truncated [ 183.357797][ T6565] loop_reread_partitions: partition scan of loop9 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 183.728044][ T5872] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 183.785153][ T5872] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 183.826312][ T5872] bond0 (unregistering): Released all slaves [ 183.871684][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.209'. [ 184.906773][ T5243] 8021q: adding VLAN 0 to HW filter on device eth1 [ 186.234636][ T5872] hsr_slave_0: left promiscuous mode [ 186.254619][ T5872] hsr_slave_1: left promiscuous mode [ 186.255204][ T5872] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.255219][ T5872] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 186.295675][ T5872] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.295692][ T5872] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 186.375095][ T5872] veth1_macvtap: left promiscuous mode [ 186.375145][ T5872] veth0_macvtap: left promiscuous mode [ 186.375239][ T5872] veth1_vlan: left promiscuous mode [ 186.375305][ T5872] veth0_vlan: left promiscuous mode [ 186.895038][ T5872] team0 (unregistering): Port device team_slave_1 removed [ 186.955421][ T5872] team0 (unregistering): Port device team_slave_0 removed [ 187.056153][ T5243] 8021q: adding VLAN 0 to HW filter on device eth2 [ 187.355916][ T5243] 8021q: adding VLAN 0 to HW filter on device eth3 [ 187.682960][ T5243] 8021q: adding VLAN 0 to HW filter on device eth4 [ 188.126125][ T5872] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.336781][ T5872] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.546676][ T5872] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.805834][ T5872] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.226282][ T5872] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.226331][ T5872] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.310639][ T5243] 8021q: adding VLAN 0 to HW filter on device eth5 [ 189.496134][ T5872] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.496171][ T5872] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.622669][ T5243] 8021q: adding VLAN 0 to HW filter on device eth6 [ 189.776446][ T5872] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 189.776473][ T5872] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.056178][ T5872] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 190.056217][ T5872] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.110246][ T5243] 8021q: adding VLAN 0 to HW filter on device eth7 [ 190.527026][ T5872] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.553170][ T5243] 8021q: adding VLAN 0 to HW filter on device eth8 [ 190.787799][ T5872] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 190.835651][ T5243] 8021q: adding VLAN 0 to HW filter on device eth9 [ 191.066128][ T5872] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.149488][ T5243] 8021q: adding VLAN 0 to HW filter on device eth10 [ 191.346183][ T5872] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 191.431179][ T5243] 8021q: adding VLAN 0 to HW filter on device eth11 [ 191.804845][ T5872] bridge_slave_1: left allmulticast mode [ 191.804868][ T5872] bridge_slave_1: left promiscuous mode [ 191.805002][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.905448][ T5872] bridge_slave_0: left allmulticast mode [ 191.905472][ T5872] bridge_slave_0: left promiscuous mode [ 191.905605][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.104916][ T5872] bridge_slave_1: left allmulticast mode [ 192.104938][ T5872] bridge_slave_1: left promiscuous mode [ 192.105066][ T5872] bridge0: port 2(bridge_slave_1) entered disabled state [ 192.205135][ T5872] bridge_slave_0: left allmulticast mode [ 192.205157][ T5872] bridge_slave_0: left promiscuous mode [ 192.205274][ T5872] bridge0: port 1(bridge_slave_0) entered disabled state