last executing test programs: 7.8592848s ago: executing program 0 (id=2577): openat$auto_mon_fops_binary_mon_bin(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/usbmon0\x00', 0x400, 0x0) mmap$auto(0x0, 0x40009, 0xe2, 0x9b72, 0x7, 0x28000) openat$auto_trace_options_core_fops_trace(0xffffffffffffff9c, 0x0, 0x121882, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x9, 0x4, 0x7) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) madvise$auto(0x0, 0xffffffffffff0005, 0x17) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) clock_getres$auto(0x3, 0x0) socket(0x10, 0x2, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bus/usb/006/001\x00', 0xa901, 0x0) r1 = socket(0x1d, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$auto(r1, &(0x7f0000000000)=@can={0x1d, r2}, 0x6a) r3 = socket(0x1d, 0x2, 0x7) openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000000), 0x141143, 0x0) poll$auto(&(0x7f0000000180)={0x3, 0x9, 0x9}, 0x6, 0x9) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$auto(r3, &(0x7f0000000000)=@can={0x1d, r4}, 0x6a) ioctl$auto_USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000100)={0x2, 0x80, 0x8ffff, 0x5, &(0x7f0000000040)="5a47c610e193ca96", 0xc694, 0x43, 0x80006, @number_of_packets, 0x20047, 0xc, 0x0}) 7.086971676s ago: executing program 1 (id=2581): mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x1, 0x106) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x6, 0x0) ioctl$auto_XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, 0x0) r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) socket(0x28, 0x5, 0x0) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video3\x00', 0x2aa01, 0x0) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sda1\x00', 0x24040, 0x0) ioctl$auto_BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={"ef65ce6c00000000000000000000000000000000000000000000000000cadb00", 0x3ff, 0x408, 0xf, 0x400001, 0x200000000040000d}) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000540)='/dev/tty45\x00', 0x201, 0x0) write$auto_tty_fops_tty_io(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_gtp(&(0x7f0000000b00), r3) ioctl$auto_BLKSSZGET(r1, 0x1268, 0x0) sendmsg$auto_GTP_CMD_ECHOREQ(r3, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4091}, 0x80) select$auto(0x9, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0x3, 0x1, 0x9488, 0x9, 0x15f4da07, 0x6, 0x2, 0x64, 0x80000020, 0x1000, 0xb, 0x9, 0x2, 0xd8]}, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x8000000000001fd, 0x20000000007, 0x4, 0x1000000000000bc3, 0x7ff, 0x3, 0xff, 0x10001, 0x400000000003, 0x3, 0x8001, 0xfffffffffffffffe, 0x80000000, 0x335b0eef, 0xffffdfffffffff81, 0x4]}, 0x0) setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9) close_range$auto(0x2, 0x8, 0x0) 6.545838399s ago: executing program 1 (id=2584): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zram0\x00', 0x6e642, 0x0) arch_prctl$auto_ARCH_SHSTK_ENABLE(0x5001, 0x3) openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000001cc0), 0x101440, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/route/flush\x00', 0x40001, 0x0) write$auto(r1, &(0x7f0000001680)='\v\x90\xd1\xda\xbc>1\x8ag\x14\x18\xbe\xdc\x00', 0x1) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv6/conf/tunl0/disable_policy\x00', 0xd02, 0x0) close_range$auto(0x0, 0xe903, 0x2) socket(0x1e, 0x4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$auto(0x2, 0x20000001, 0x50, &(0x7f0000000000)='\x00', 0x2) sendfile$auto(0xffffffffffffffff, r2, 0x0, 0x800048) add_key$auto_KEY_SPEC_USER_SESSION_KEYRING(&(0x7f0000000180)='\\\x00', &(0x7f0000000200)='}&\x00', &(0x7f0000000240)="86c4e8730e2d45b88b70dff2710f80b65565eb78515022dbb52e52b6ea27a5ebc2f771399e969083b2c0db66d3811b8e3b7f05eb98e2db3e7562aba92df1df759a61f7cd31a5", 0x6, 0xfffffffffffffffb) r3 = openat$auto_nvram_misc_fops_nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x694800, 0x0) ioctl$auto_NVRAM_SETCKS(r3, 0x7041, 0x0) setitimer$auto_ITIMER_REAL(0x0, &(0x7f00000001c0)={{0x1, 0x10001}, {0x7fffffffffffffff, 0x7}}, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8c2, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/fs/nfs/net/nfs_client/identifier\x00', 0x82942, 0x0) acct$auto(&(0x7f0000000440)='\xff\xff\xff\xff\xff\xff\xff\xff\x0e\xa9[\x0e8\xa9\xcd6|\x03G\x00\x00}\xcd)a1H\xd4\x00\x00\x00\x00\x00\x00\x00T\xa0\xcb\x80\r!\xbe\x04\x82t\x10\xdfC\x9d\x1f\xa2\x06q\xc7\xa2\xd1\x98\x81LT\f\x8e.\xdb\xd0oX\xe3\x16\xa2\xe2\bd\x81\xc2o\xd9\xa4N\x83\xb9\xaf[f\x9c\xc4+A\xf1\xc9Y\x04X\xd65\xe1\xb2=?\x00\x00\x00\x00\x00\x00') sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) r4 = mq_open$auto(&(0x7f0000000580)='\x12\xe6D\b\x9e\x00\x80\x8d\f\xb9w-\xbd!\x9eb\xed\x9d\xe1\xe5\x9dZ\xc2\xfb\x01wBV\x91\x8f_\xc0.\x05\x00\x84\xd1se\x01\x06\x00\xb3\x13_Y&\xa9\x88\xe4\xa2\xb0V\x85\x92<\xb6\xdcT \\\xf2\v\xb1\xe2\xd8\xfa\xd8V\xe5\x00\xfa\xe9!\xc5<\xce\x18=\x06\xdagq\xb5\r\t\xb2\xde\x99\xd50\xbb\x192\x1c4\x86\xc0\xc1-\xd5\x10\xc3\xfc*[8\x89h\xc5\xba\xff\xc8u50xffffffffffffffff, 0x74b, "2af051a940806ec05be276cfc83ce63f", 0x0, 0xffffffffffffffff, 0x8, 0x4, 0xe5, 0x3, 0xffffffffffffffff, 0xffffffffffffffff}, 0x10) r2 = openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/ip6_tables_matches\x00', 0x43102, 0x0) read$auto_proc_iter_file_ops_compat_inode(r2, &(0x7f0000000180)=""/190, 0xbe) ioctl$auto_BLKBSZGET(r1, 0x80081270, &(0x7f0000000140)=0x7) socket$nl_generic(0x10, 0x3, 0x10) close_range$auto(0x2, 0x8, 0x0) openat$auto_ext4_dir_operations_ext4(0xffffffffffffff9c, &(0x7f0000000400)='/sys/devices/virtual/bluetooth/hci1/hci1:201\x00', 0x140, 0x0) fchmod$auto(0xffffffffffffffff, 0x8) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/reboot/type\x00', 0x180102, 0x0) write$auto(r3, &(0x7f0000000280)='\x81\xa3\xcaA\xb0\x12\xa1\xd3/de]/au\xff\xffg1\x00\x9e0\xa0XC\xd74\xde\buM\x9d~\xbe\x85\v\v\xab\v\xa14\xd1\x99\x7f#\xc3\xaf\xdfI\xb8\x8dS\xba@\xc1\xce\x1f1\xfdR\xbe%\xe07\x80\x9f\xab\xca\xfa\xd5G1\xc6,\x8a\x14\xee\x99u\xe3Y|\x18gP\x8a\xad2Za\x10\xee\x94du\x00\x11\xb2\x84`\xf7m\xe8\xc8\x19E\x10\x9a\x85\x89\xec\x1a\x05\xae\x1e\x7f\xde\x1a\xb7\x12\xa2n%$\xb6\xe0q8\xe4dA&A\xd1v\x8a<.\x1c \x85\"f\x0e\xd3\xbd\xf0\xff\x95\xab\vs\xa8\x82\f\xb3c\xf7q%;\xcd\xf3\xdc\xc5\x92M\xaa\fv`+\xbfu\xc9O\xb0\xf06}\x99\xa8\x8ej\r\x1dG\xb9!\x13\xf1b\xce\xc3\x81\xe0\x05\xf2\x9a\xc6Q.n:\xe3\xcdB\x18[S.b\xdc\xb8\\\x89\xfda:\x93\xf51v<\xb8\x99\xd4\xf71\f~\xcb\xebQ\xd5+\xc0\xfc\xa5S\xe3\v\xfe1\xce\x9b\xb0\xe2v`\xae\'\xdd\xc3{\x81\xb4\xd1\xbb\xc9\xd66.O\xda3\xd4\xab\xc3\x9e2\x88\"H\xbe#&\x9bO*\x8f\xb0\xff\x9e\xc6\xcdpN\xc5k\xa7\xd8\xd0\xd0\xab\xe1\x9f\xce', 0x7fffffff) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x14fa02, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0) write$auto_vcs_fops_vc_screen(r0, &(0x7f00000003c0)="8a87f24cea78072ce82d847b317429eeb8b8fc84dbe3b6e37e0450eaec89b194de4efec4b08f6198c82f3a44beb9bf03aba9beb5be0b402a7f7ca87f4d26aeabae41c06d5379b8ca9e93f46ca763ebad525cd0afbdeebfab2d212da1c2e88abaf12888f120f83a578530050877f9512b630b00b775ad0cc320d9c64a46f29d565fa7c07a85283f142f3e094f96f42d22b1e1a8d81349a8e5c1434a0312ac8fd740b14fe56612aa6958a438cc38029326db6ce6d6e601bc557891726e8df046df5f9f911ebef4510a0abc86456214c8be0624c2a69b133a1d1d0f486fa10a43699dfd16243acb7244fd502f19a694fd5dc97ef43f8ffeed7e3e011dc1bf", 0xfd) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) madvise$auto(0x0, 0x2000040080000004, 0xe) r4 = openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cec8\x00', 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000002580)={0x24, r6, 0x9ec6579d452c1f15, 0x70bd2e, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x25, 0x0, 0x0, @uid}]}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x20000080) r7 = socket(0x23, 0x805, 0x0) accept$auto(r7, 0x0, 0x0) ioctl$auto_CEC_DQEVENT(r4, 0xc0506107, 0x0) ioctl$auto_CEC_DQEVENT(r4, 0xc0506107, 0x0) 215.263743ms ago: executing program 0 (id=2603): openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/vm/mmap_min_addr\x00', 0x101302, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0x15, 0x2, 0x41) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/virtual/net/bond0/bonding/arp_validate\x00', 0x2002, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) fanotify_init$auto(0x5, 0x0) mmap$auto(0x0, 0x2000d, 0x7, 0xff, 0xffffffffffffffff, 0x10008000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) acct$auto(&(0x7f0000000480)='u[,&*}\x00\a\x00\'\x00?\xa4\x1fN\xa1~5Z\xc7\r\f}M4\xa8m\xe6\x19[11\xab\xff-E\xac9(\xb4O\xa0t4h\x9f-gn\x1f\x0f\x18\xc5\x82-s\x83\xe6\xaeR\x81\r_\x0e\x19\x12\x85\bvf(e\xday)\t\x15\xf6\xc8\xee\x04\x16\xc1\x9a!\x87I7\x8cD&zg\xb0a\xab|E\xde\x14\xee[\xc8\xc0\xa8Nh\x0f\xa3\xdbT\xb3\xb8\xd2F\xa0\xc4]\xaf\xc43&\xe4\x01\x05\xd2\x15\xf8\xf1!\x9d\x92\xbbHL9aD\xb4\x80\xed\xba>\"\xb6\x7f\xa3f\x1d\a\xa1\x87\x84uA\xd8\xe7\xd2\xf3[r\xc5S&}D[\x97\xf1\xd9\xf8Y\x03\x84\xb4\xd7\x16\x19\xe5\x17\x10\xd8fcG:\xfbY8\x17w\x98?\x03@\xe5\x02\x05\x93h\xb9\xf7\xef\x84\x8aGlN\a\x1e') open(&(0x7f0000000480)='./cgroup.cpu/cgroup.procs\x00', 0x880c2, 0xb3) r0 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/snd/controlC1\x00', 0x5d7900, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000001480)={{@raw=0x6845bd35, 0x2, 0xf86b, 0x0, "e462f5a29a0b2f987b9ea452a1bc9eaafd83a8eb9eea79a10397a3126cb6c4380ae1dc84e847c5ccf57f14eb", @raw=0x6}, 0x1, @integer64=@value=[0xd, 0x7, 0x0, 0x3, 0x3, 0x1000, 0x5, 0x9, 0x10, 0x6, 0x4, 0x4000000be1, 0x1, 0x0, 0x80000000, 0xffffffffffffff80, 0x40, 0x5, 0x4, 0x3, 0xfffffffffffff000, 0x5, 0x2, 0x6, 0x7, 0x8, 0x2, 0x1, 0x4, 0x5cb56b90, 0x0, 0x81, 0xfffffffffffffffb, 0x9, 0x0, 0x10, 0x2, 0x6, 0x0, 0x9, 0x5, 0x5, 0x8, 0x6, 0xe7d8, 0x8, 0xb, 0x2, 0x2, 0x0, 0x8000000000000001, 0x6, 0xc520000000000000, 0x2, 0x7, 0x0, 0x40, 0x4000000004, 0x1000005, 0x4, 0xe, 0xb, 0x800, 0x10000], "2ffa3e20e80e755123e1f42e350d190e3032fa30c3621af4571878aad95fb67f210e12883f526b4e566ef511611abf96d1d9b723613b1fce6def179ed465852003f47d532de2721cc6b407490cd09e96be8bf6d01dcaac750c48d1a4c1d889a0e6b6528742320c00"}) mmap$auto(0xfffffffffffffffc, 0x2020009, 0x3, 0xeb4, r0, 0x2) close_range$auto(0x2, 0xa, 0x0) io_uring_setup$auto(0xf00, 0x0) r1 = socket(0x28, 0x1, 0x0) unshare$auto(0x40000080) unshare$auto(0xffff) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) write$auto_console_fops_tty_io(0xffffffffffffffff, 0x0, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv6/conf/default/ignore_routes_with_linkdown\x00', 0x42a81, 0x0) pwrite64$auto(r2, &(0x7f0000000200)='/proc/sys/net/ipv6/coX\t/all/for\xdfry\x8d(\xcb\xadaH<-h\xef8\x0678]`\x1f\xe5\\\x9c\xb4\xbd 6\x9fP\x16\xb5\xa1.;d\xf5F7TgT\x908=l\x89\x05\x03\xcb\x04\x9c\x0e\x04\xb5a\xe6\xa6\x13\xf8\xb2\xe1\xab\vI;\x10\xa7\xcc\x84\x1d\xff(\x1c\x99\x90M\xba\xfe\xaa\x8e\x83\x98\xbb8\xc3\x02\x8d(\xb0\x9c@n\xb7\xd3TF\xc7\x7f\x11\x9e\x00\x00\x00\x00\x00', 0xbb) close_range$auto(0x2, 0xa, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) landlock_restrict_self$auto(r1, 0x0) prctl$auto_PR_SET_MM_ENV_START(0x1000, 0xa, 0x0, 0x401, 0xfff) clone$auto(0x10000, 0x2, &(0x7f00000001c0)=0x9, &(0x7f0000000300)=0xfffffffe, 0x7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond_slave_1\x00'}) close_range$auto(0x0, 0xffffffffffffffff, 0x2) socket(0x5, 0xa, 0x0) openat$auto_nodes_fops_netdebug(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x801, 0x84) socket(0x22, 0xc4633ac14d4adfed, 0xb) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/vtconsole/vtcon1/bind\x00', 0x182b02, 0x0) writev$auto(r2, 0x0, 0x2) r3 = openat$auto_xfs_dir_file_operations_xfs_file(0xffffffffffffff9c, &(0x7f0000000040)='/sys/devices/virtual/mac80211_hwsim/hwsim13\x00', 0x40a000, 0x0) ioctl$auto_XFS_IOC_RTGROUP_GEOMETRY(r3, 0xc0805841, &(0x7f0000000140)={0x8, 0x3, 0x0, 0x9, 0x8}) write$auto(r2, &(0x7f00000000c0)='7\x00\\\x1c\xe7k\x00\x00\x00\x00\x00\x00\x00\x00', 0x8083a) io_uring_register$auto(r2, 0x52a, &(0x7f00000000c0)="1bb2d1bb89671f477fb81c5cce632678544d284013a2d633cbfb4f11e1b269ba68e173e0ce785027d1f093ea2e51f652d3cdd5e99f02221c73e72efa989535ddf83eb444b9aff1d7ac3cec1a1da5d97bbe17e53a5567c3fc2ed38d33fce04113e1ff", 0x1) socket(0x18, 0x5, 0x1) sendto$auto(0x3, 0x0, 0x8, 0x101, 0x0, 0x1c) 0s ago: executing program 2 (id=2605): socket(0x10, 0x2, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="24051c27c100dedbdf250307cc0008000200", @ANYRES32=0x0, @ANYBLOB="060007000080000006000700050000000a00050000000000000000000a00010000000000000000000a0001000000000000000000060006000d00000006000600070000000a0001"], 0x6c}}, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4044040}, 0x24008890) mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x6, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$auto(r0, 0x6, 0x1b, 0x0, 0x3d) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="72010000", @ANYBLOB="13"], 0x1ac}}, 0x4004) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0d566b3dd008e4edd9650200000000000008"], 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x200000c4) sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010600bd7000fbdbdf250a"], 0x1c}, 0x1, 0x0, 0x0, 0x20040004}, 0x20008810) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x40000) r1 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r1, &(0x7f0000000080)={{0x0, 0x8002, &(0x7f00000002c0)={0x0, 0xc4}, 0x2, 0x0, 0x6, 0x1}, 0x5}, 0x3, 0x0) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x1, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) r2 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x40280, 0x0) ioctl$auto_SOUND_MIXER_WRITE_RECSRC2(r2, 0xc0044dff, &(0x7f00000005c0)="07d5") kernel console output (not intermixed with test programs): dump_stack_lvl+0x100/0x190 [ 628.108487][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 628.108525][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 628.108553][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 628.108578][ T5642] ? find_held_lock+0x2b/0x80 [ 628.108611][ T5642] ? kobject_add_internal+0x25f/0x930 [ 628.108651][ T5642] ? kobject_add_internal+0x25f/0x930 [ 628.108701][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 628.108733][ T5642] kobject_add_internal+0x2c8/0x930 [ 628.108778][ T5642] kobject_add+0x16a/0x1e0 [ 628.108817][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 628.108856][ T5642] ? class_to_subsys+0x10f/0x150 [ 628.108894][ T5642] ? kobject_put+0xb9/0x640 [ 628.108929][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 628.108964][ T5642] device_add+0x294/0x1950 [ 628.109000][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 628.109037][ T5642] ? __pfx_device_add+0x10/0x10 [ 628.109069][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 628.109108][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 628.109146][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 628.109188][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 628.109217][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 628.109265][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 628.109297][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 628.109334][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 628.109367][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 628.109403][ T5642] hci_event_packet+0x51c/0xcd0 [ 628.109433][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 628.109467][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 628.109500][ T5642] ? kcov_remote_start+0x374/0x660 [ 628.109537][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 628.109576][ T5642] hci_rx_work+0x451/0xfc0 [ 628.109611][ T5642] process_one_work+0xa0e/0x1980 [ 628.109650][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 628.109689][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 628.109721][ T5642] worker_thread+0x5ef/0xe50 [ 628.109757][ T5642] ? kthread+0x13a/0x450 [ 628.109777][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 628.109800][ T5642] kthread+0x370/0x450 [ 628.109821][ T5642] ? __pfx_kthread+0x10/0x10 [ 628.109844][ T5642] ret_from_fork+0x72b/0xd50 [ 628.109872][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 628.109901][ T5642] ? __switch_to+0x800/0x1100 [ 628.109936][ T5642] ? __switch_to_asm+0x39/0x70 [ 628.109969][ T5642] ? __pfx_kthread+0x10/0x10 [ 628.109993][ T5642] ret_from_fork_asm+0x1a/0x30 [ 628.110050][ T5642] [ 628.111486][ T5642] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 628.410471][T13228] vivid-008: ================= START STATUS ================= [ 628.420128][ T5642] Bluetooth: hci1: failed to register connection device [ 628.470921][T13228] vivid-008: ================== END STATUS ================== [ 629.011938][T13228] random: crng reseeded on system resumption [ 629.196281][T13233] openvswitch: &#$@\]\-: Dropping previously announced user features [ 629.537004][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 629.985619][T13247] netlink: zone id is out of range [ 630.018486][T13247] netlink: zone id is out of range [ 630.064934][T13247] netlink: zone id is out of range [ 630.102028][T13247] netlink: zone id is out of range [ 630.132143][T13247] netlink: zone id is out of range [ 630.161791][T13247] netlink: zone id is out of range [ 630.188040][T13247] netlink: zone id is out of range [ 630.211308][T13247] netlink: zone id is out of range [ 630.233790][T13247] netlink: zone id is out of range [ 630.258522][T13247] netlink: zone id is out of range [ 630.498117][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 630.958371][T13266] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1639'. [ 631.617001][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 631.695512][T13280] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1645'. [ 632.275960][ T5640] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 632.577312][ T5640] Bluetooth: hci1: command 0x0406 tx timeout [ 633.808864][T13294] openvswitch: &#$@\]\-: Dropping previously announced user features [ 634.337047][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 636.416921][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 637.461351][T13334] netlink: 354 bytes leftover after parsing attributes in process `syz.3.1656'. [ 638.406838][T13352] netlink: 29 bytes leftover after parsing attributes in process `syz.2.1659'. [ 639.531483][T13365] netlink: 350 bytes leftover after parsing attributes in process `syz.2.1663'. [ 639.684209][T13367] sd 0:0:1:0: PR command failed: 1026 [ 639.811550][T13367] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 639.935789][T13367] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 640.836222][T13382] futex_wake_op: syz.1.1668 tries to shift op by -2048; fix this program [ 641.844614][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 642.213212][ T30] audit: type=1804 audit(1778105309.669:5): pid=13398 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1670" name="file0" dev="tmpfs" ino=2342 res=1 errno=0 [ 642.316596][ T30] audit: type=1804 audit(1778105309.719:6): pid=13401 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1670" name="file0" dev="tmpfs" ino=2342 res=1 errno=0 [ 643.823468][T13419] openvswitch: &#$@\]\-: Dropping previously announced user features [ 643.937997][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 644.935408][T13443] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 644.935408][T13443] The task syz.0.1678 (13443) triggered the difference, watch for misbehavior. [ 644.991911][T13441] netlink: 17 bytes leftover after parsing attributes in process `syz.3.1682'. [ 646.017150][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 647.103714][T13458] netlink: 354 bytes leftover after parsing attributes in process `syz.2.1687'. [ 647.702027][T13462] netlink: 330 bytes leftover after parsing attributes in process `syz.3.1689'. [ 648.660649][T13479] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1699'. [ 649.857116][T13492] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1695'. [ 649.911947][T13496] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1695'. [ 654.419718][T13549] netlink: 29 bytes leftover after parsing attributes in process `syz.0.1712'. [ 656.273598][T13565] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1715'. [ 657.753582][ T5642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 659.776834][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 659.801979][T13609] net_ratelimit: 52 callbacks suppressed [ 659.801999][T13609] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 660.054425][T13606] FAULT_INJECTION: forcing a failure. [ 660.054425][T13606] name failslab, interval 1, probability 0, space 0, times 0 [ 660.076747][ T5642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 660.084525][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 660.094403][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 660.094435][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 660.094452][ T5642] Workqueue: hci1 hci_rx_work [ 660.094485][ T5642] Call Trace: [ 660.094493][ T5642] [ 660.094502][ T5642] dump_stack_lvl+0x100/0x190 [ 660.094531][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 660.094569][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 660.094597][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 660.094623][ T5642] ? find_held_lock+0x2b/0x80 [ 660.094655][ T5642] ? kobject_add_internal+0x25f/0x930 [ 660.094696][ T5642] ? kobject_add_internal+0x25f/0x930 [ 660.094738][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 660.094770][ T5642] kobject_add_internal+0x2c8/0x930 [ 660.094814][ T5642] kobject_add+0x16a/0x1e0 [ 660.094853][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 660.094891][ T5642] ? class_to_subsys+0x10f/0x150 [ 660.094930][ T5642] ? kobject_put+0xb9/0x640 [ 660.094965][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 660.095001][ T5642] device_add+0x294/0x1950 [ 660.095032][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 660.095069][ T5642] ? __pfx_device_add+0x10/0x10 [ 660.095101][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 660.095139][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 660.095176][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 660.095223][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 660.095252][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 660.095303][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 660.095337][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 660.095374][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 660.095409][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 660.095445][ T5642] hci_event_packet+0x51c/0xcd0 [ 660.095476][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 660.095510][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 660.095545][ T5642] ? kcov_remote_start+0x374/0x660 [ 660.095583][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 660.095622][ T5642] hci_rx_work+0x451/0xfc0 [ 660.095658][ T5642] process_one_work+0xa0e/0x1980 [ 660.095698][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 660.095733][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 660.095765][ T5642] worker_thread+0x5ef/0xe50 [ 660.095802][ T5642] ? kthread+0x13a/0x450 [ 660.095821][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 660.095845][ T5642] kthread+0x370/0x450 [ 660.095867][ T5642] ? __pfx_kthread+0x10/0x10 [ 660.095891][ T5642] ret_from_fork+0x72b/0xd50 [ 660.095920][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 660.095949][ T5642] ? __switch_to+0x800/0x1100 [ 660.095985][ T5642] ? __switch_to_asm+0x39/0x70 [ 660.096020][ T5642] ? __pfx_kthread+0x10/0x10 [ 660.096044][ T5642] ret_from_fork_asm+0x1a/0x30 [ 660.096093][ T5642] [ 660.359598][ T5642] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 660.373552][ T5642] Bluetooth: hci1: failed to register connection device [ 660.681865][T13616] vivid-008: ================= START STATUS ================= [ 660.738703][T13606] CPU: 0 UID: 0 PID: 13606 Comm: syz.0.1723 Not tainted syzkaller #0 PREEMPT(full) [ 660.738739][T13606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 660.738755][T13606] Call Trace: [ 660.738762][T13606] [ 660.738771][T13606] dump_stack_lvl+0x100/0x190 [ 660.738806][T13606] should_fail_ex.cold+0x5/0xa [ 660.738838][T13606] should_failslab+0xc2/0x120 [ 660.738867][T13606] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 660.738908][T13606] ? security_file_alloc+0x34/0x2c0 [ 660.738936][T13606] ? trace_kmem_cache_alloc+0xd5/0x100 [ 660.738971][T13606] security_file_alloc+0x34/0x2c0 [ 660.739000][T13606] init_file+0x95/0x480 [ 660.739036][T13606] alloc_empty_file+0x79/0x1c0 [ 660.739075][T13606] path_openat+0xe8/0x31a0 [ 660.739113][T13606] ? __kernel_text_address+0xd/0x30 [ 660.739139][T13606] ? unwind_get_return_address+0x59/0xa0 [ 660.739174][T13606] ? arch_stack_walk+0xa6/0xf0 [ 660.739213][T13606] ? __pfx_path_openat+0x10/0x10 [ 660.739248][T13606] ? stack_trace_save+0x8e/0xc0 [ 660.739283][T13606] ? __pfx_stack_trace_save+0x10/0x10 [ 660.739322][T13606] do_file_open+0x20e/0x430 [ 660.739355][T13606] ? __pfx_do_file_open+0x10/0x10 [ 660.739386][T13606] ? kasan_save_track+0x14/0x30 [ 660.739409][T13606] ? __kasan_slab_alloc+0x89/0x90 [ 660.739434][T13606] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 660.739505][T13606] do_open_execat+0xd1/0x360 [ 660.739530][T13606] ? __pfx_do_open_execat+0x10/0x10 [ 660.739557][T13606] ? __might_fault+0xc5/0x140 [ 660.739596][T13606] ? __might_fault+0xc5/0x140 [ 660.739640][T13606] alloc_bprm+0x2d/0x710 [ 660.739668][T13606] do_execveat_common.isra.0+0x19c/0x580 [ 660.739698][T13606] ? do_getname+0x191/0x390 [ 660.739737][T13606] __x64_sys_execve+0x93/0xd0 [ 660.739766][T13606] do_syscall_64+0x10b/0xf80 [ 660.739798][T13606] ? clear_bhb_loop+0x40/0x90 [ 660.739828][T13606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.739853][T13606] RIP: 0033:0x7fe11379cdd9 [ 660.739874][T13606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 660.739898][T13606] RSP: 002b:00007fe1145f2028 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 660.739922][T13606] RAX: ffffffffffffffda RBX: 00007fe113a15fa0 RCX: 00007fe11379cdd9 [ 660.739938][T13606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 [ 660.739953][T13606] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000000 [ 660.739968][T13606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 660.739982][T13606] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 660.740013][T13606] [ 661.329978][T13616] vivid-008: ================== END STATUS ================== [ 661.900025][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 662.202341][T13616] random: crng reseeded on system resumption [ 662.658969][ T5640] Bluetooth: hci1: command 0x0406 tx timeout [ 664.737757][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 664.871879][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 665.160355][T13664] FAULT_INJECTION: forcing a failure. [ 665.160355][T13664] name failslab, interval 1, probability 0, space 0, times 0 [ 665.316251][T13664] CPU: 0 UID: 0 PID: 13664 Comm: syz.0.1737 Not tainted syzkaller #0 PREEMPT(full) [ 665.316285][T13664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 665.316301][T13664] Call Trace: [ 665.316309][T13664] [ 665.316317][T13664] dump_stack_lvl+0x100/0x190 [ 665.316349][T13664] should_fail_ex.cold+0x5/0xa [ 665.316379][T13664] ? __register_sysctl_table+0xbe4/0x1650 [ 665.316413][T13664] should_failslab+0xc2/0x120 [ 665.316445][T13664] __kmalloc_noprof+0xe0/0x850 [ 665.316492][T13664] __register_sysctl_table+0xbe4/0x1650 [ 665.316532][T13664] ? __pfx___register_sysctl_table+0x10/0x10 [ 665.316566][T13664] ? mq_init_ns+0x470/0x820 [ 665.316608][T13664] ? __asan_memcpy+0x3c/0x60 [ 665.316649][T13664] setup_ipc_sysctls+0x1aa/0x300 [ 665.316687][T13664] copy_ipcs+0x57a/0x7e0 [ 665.316711][T13664] create_new_namespaces+0x20a/0xac0 [ 665.316753][T13664] ? security_capable+0x80/0x260 [ 665.316794][T13664] copy_namespaces+0x468/0x5e0 [ 665.316829][T13664] copy_process+0x3531/0x7e00 [ 665.316864][T13664] ? futex_unqueue+0x133/0x2c0 [ 665.316903][T13664] ? __pfx_copy_process+0x10/0x10 [ 665.316946][T13664] ? _copy_from_user+0x59/0xd0 [ 665.316991][T13664] kernel_clone+0x12e/0x9c0 [ 665.317028][T13664] ? __pfx_kernel_clone+0x10/0x10 [ 665.317070][T13664] ? __pfx_futex_wait+0x10/0x10 [ 665.317111][T13664] __do_sys_clone3+0x214/0x290 [ 665.317147][T13664] ? __pfx___do_sys_clone3+0x10/0x10 [ 665.317213][T13664] ? rcu_is_watching+0x12/0xc0 [ 665.317247][T13664] do_syscall_64+0x10b/0xf80 [ 665.317279][T13664] ? clear_bhb_loop+0x40/0x90 [ 665.317309][T13664] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 665.317335][T13664] RIP: 0033:0x7fe11379cdd9 [ 665.317355][T13664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 665.317379][T13664] RSP: 002b:00007fe1145f1ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 665.317403][T13664] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fe11379cdd9 [ 665.317419][T13664] RDX: 00007fe1145f1f10 RSI: 0000000000000058 RDI: 00007fe1145f1f10 [ 665.317434][T13664] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000058 [ 665.317450][T13664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 665.317464][T13664] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 665.317495][T13664] [ 666.900335][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 666.993177][T13664] sysctl could not get directory: /kernel -12 [ 667.341440][T13684] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1741'. [ 667.390688][T13684] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1741'. [ 667.756424][ T5640] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 667.764274][ T5640] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 667.773992][ T5640] CPU: 0 UID: 0 PID: 5640 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 667.774023][ T5640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 667.774040][ T5640] Workqueue: hci3 hci_rx_work [ 667.774072][ T5640] Call Trace: [ 667.774080][ T5640] [ 667.774088][ T5640] dump_stack_lvl+0x100/0x190 [ 667.774118][ T5640] sysfs_warn_dup.cold+0x1c/0x28 [ 667.774155][ T5640] sysfs_create_dir_ns+0x24b/0x2b0 [ 667.774183][ T5640] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 667.774208][ T5640] ? find_held_lock+0x2b/0x80 [ 667.774241][ T5640] ? kobject_add_internal+0x25f/0x930 [ 667.774281][ T5640] ? kobject_add_internal+0x25f/0x930 [ 667.774323][ T5640] ? do_raw_spin_unlock+0x145/0x1e0 [ 667.774354][ T5640] kobject_add_internal+0x2c8/0x930 [ 667.774399][ T5640] kobject_add+0x16a/0x1e0 [ 667.774438][ T5640] ? __pfx_kobject_add+0x10/0x10 [ 667.774476][ T5640] ? class_to_subsys+0x10f/0x150 [ 667.774515][ T5640] ? kobject_put+0xb9/0x640 [ 667.774558][ T5640] ? _raw_spin_unlock+0x28/0x50 [ 667.774593][ T5640] device_add+0x294/0x1950 [ 667.774625][ T5640] ? __pfx_dev_set_name+0x10/0x10 [ 667.774662][ T5640] ? __pfx_device_add+0x10/0x10 [ 667.774694][ T5640] ? mgmt_send_event_skb+0x2fb/0x460 [ 667.774734][ T5640] hci_conn_add_sysfs+0x1a3/0x260 [ 667.774770][ T5640] le_conn_complete_evt+0x11eb/0x1f60 [ 667.774809][ T5640] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 667.774838][ T5640] ? __pfx_bt_warn+0x10/0x10 [ 667.774885][ T5640] hci_le_conn_complete_evt+0x23c/0x3a0 [ 667.774917][ T5640] ? skb_pull_data+0x15f/0x1e0 [ 667.774955][ T5640] hci_le_meta_evt+0x34a/0x5f0 [ 667.774987][ T5640] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 667.775027][ T5640] hci_event_packet+0x51c/0xcd0 [ 667.775058][ T5640] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 667.775093][ T5640] ? __pfx_hci_event_packet+0x10/0x10 [ 667.775126][ T5640] ? kcov_remote_start+0x374/0x660 [ 667.775163][ T5640] ? lockdep_hardirqs_on+0x78/0x100 [ 667.775203][ T5640] hci_rx_work+0x451/0xfc0 [ 667.775238][ T5640] process_one_work+0xa0e/0x1980 [ 667.775277][ T5640] ? __pfx_process_one_work+0x10/0x10 [ 667.775311][ T5640] ? __pfx_hci_rx_work+0x10/0x10 [ 667.775343][ T5640] worker_thread+0x5ef/0xe50 [ 667.775379][ T5640] ? kthread+0x13a/0x450 [ 667.775398][ T5640] ? __pfx_worker_thread+0x10/0x10 [ 667.775422][ T5640] kthread+0x370/0x450 [ 667.775443][ T5640] ? __pfx_kthread+0x10/0x10 [ 667.775466][ T5640] ret_from_fork+0x72b/0xd50 [ 667.775494][ T5640] ? __pfx_ret_from_fork+0x10/0x10 [ 667.775528][ T5640] ? __switch_to+0x800/0x1100 [ 667.775564][ T5640] ? __switch_to_asm+0x39/0x70 [ 667.775597][ T5640] ? __pfx_kthread+0x10/0x10 [ 667.775621][ T5640] ret_from_fork_asm+0x1a/0x30 [ 667.775670][ T5640] [ 667.775717][ T5640] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 668.075229][ T5640] Bluetooth: hci3: failed to register connection device [ 668.083921][T13692] vivid-008: ================= START STATUS ================= [ 668.143447][ T30] audit: type=1804 audit(1843104527.370:7): pid=13687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1740" name="file0" dev="tmpfs" ino=2478 res=1 errno=0 [ 668.206744][T13692] vivid-008: ================== END STATUS ================== [ 668.252736][ T30] audit: type=1804 audit(1843104527.400:8): pid=13690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1740" name="file0" dev="tmpfs" ino=2478 res=1 errno=0 [ 668.566591][T13691] random: crng reseeded on system resumption [ 668.978445][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 670.020560][T13714] netlink: 330 bytes leftover after parsing attributes in process `syz.0.1747'. [ 670.097680][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 670.825453][T13722] netlink: 29 bytes leftover after parsing attributes in process `syz.2.1749'. [ 671.096597][T13727] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1750'. [ 671.111151][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 671.178971][T13730] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1750'. [ 672.176878][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 673.137795][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 674.251355][T13765] openvswitch: &#$@\]\-: Dropping previously announced user features [ 674.291041][ T51] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 674.644763][T13773] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1762'. [ 674.701135][T13774] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1762'. [ 675.217078][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 676.337674][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 677.529393][T13788] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 678.259299][T13815] FAULT_INJECTION: forcing a failure. [ 678.259299][T13815] name failslab, interval 1, probability 0, space 0, times 0 [ 678.321703][T13812] openvswitch: &#$@\]\-: Dropping previously announced user features [ 678.332942][T13815] CPU: 0 UID: 0 PID: 13815 Comm: syz.3.1770 Not tainted syzkaller #0 PREEMPT(full) [ 678.332975][T13815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 678.332991][T13815] Call Trace: [ 678.332998][T13815] [ 678.333007][T13815] dump_stack_lvl+0x100/0x190 [ 678.333040][T13815] should_fail_ex.cold+0x5/0xa [ 678.333071][T13815] should_failslab+0xc2/0x120 [ 678.333101][T13815] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 678.333141][T13815] ? security_inode_alloc+0x3b/0x2c0 [ 678.333182][T13815] ? lockdep_init_map_type+0x5c/0x250 [ 678.333211][T13815] security_inode_alloc+0x3b/0x2c0 [ 678.333253][T13815] inode_init_always_gfp+0xcc0/0x1000 [ 678.333290][T13815] alloc_inode+0x8e/0x250 [ 678.333330][T13815] new_inode+0x22/0x1c0 [ 678.333371][T13815] mqueue_get_inode+0x2e/0xe00 [ 678.333406][T13815] ? sget_fc+0x801/0xc70 [ 678.333433][T13815] ? __pfx_mqueue_fill_super+0x10/0x10 [ 678.333468][T13815] mqueue_fill_super+0x14d/0x260 [ 678.333504][T13815] get_tree_nodev+0xdd/0x190 [ 678.333533][T13815] mqueue_get_tree+0xf1/0x130 [ 678.333568][T13815] vfs_get_tree+0x92/0x320 [ 678.333591][T13815] fc_mount_longterm+0x1a/0x270 [ 678.333618][T13815] mq_init_ns+0x482/0x820 [ 678.333660][T13815] copy_ipcs+0x3dd/0x7e0 [ 678.333684][T13815] create_new_namespaces+0x20a/0xac0 [ 678.333724][T13815] ? security_capable+0x80/0x260 [ 678.333765][T13815] copy_namespaces+0x468/0x5e0 [ 678.333799][T13815] copy_process+0x3531/0x7e00 [ 678.333834][T13815] ? futex_unqueue+0x133/0x2c0 [ 678.333874][T13815] ? __pfx_copy_process+0x10/0x10 [ 678.333917][T13815] ? _copy_from_user+0x59/0xd0 [ 678.333963][T13815] kernel_clone+0x12e/0x9c0 [ 678.333998][T13815] ? futex_hash+0x141/0x370 [ 678.334020][T13815] ? __pfx_kernel_clone+0x10/0x10 [ 678.334062][T13815] ? __pfx_futex_wait+0x10/0x10 [ 678.334103][T13815] __do_sys_clone3+0x214/0x290 [ 678.334139][T13815] ? __pfx___do_sys_clone3+0x10/0x10 [ 678.334206][T13815] ? rcu_is_watching+0x12/0xc0 [ 678.334240][T13815] do_syscall_64+0x10b/0xf80 [ 678.334273][T13815] ? clear_bhb_loop+0x40/0x90 [ 678.334303][T13815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.334328][T13815] RIP: 0033:0x7fd85a99cdd9 [ 678.334353][T13815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.334377][T13815] RSP: 002b:00007fd858bedef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 678.334401][T13815] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fd85a99cdd9 [ 678.334417][T13815] RDX: 00007fd858bedf10 RSI: 0000000000000058 RDI: 00007fd858bedf10 [ 678.334433][T13815] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000058 [ 678.334448][T13815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 678.334463][T13815] R13: 00007fd85ac16038 R14: 00007fd85ac15fa0 R15: 00007ffe16a7c238 [ 678.334493][T13815] [ 678.972465][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 679.096575][T13824] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1771'. [ 679.144210][T13824] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1771'. [ 681.096512][T13845] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1781'. [ 681.645671][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 682.250381][T13864] openvswitch: &#$@\]\-: Dropping previously announced user features [ 683.566458][T13850] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 683.697573][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 683.831497][T13878] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1789'. [ 683.883924][T13882] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1789'. [ 685.658605][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 685.666406][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 685.675790][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 685.675822][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 685.675840][ T5642] Workqueue: hci2 hci_rx_work [ 685.675874][ T5642] Call Trace: [ 685.675881][ T5642] [ 685.675891][ T5642] dump_stack_lvl+0x100/0x190 [ 685.675920][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 685.675959][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 685.675986][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 685.676011][ T5642] ? find_held_lock+0x2b/0x80 [ 685.676044][ T5642] ? kobject_add_internal+0x25f/0x930 [ 685.676090][ T5642] ? kobject_add_internal+0x25f/0x930 [ 685.676133][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 685.676164][ T5642] kobject_add_internal+0x2c8/0x930 [ 685.676209][ T5642] kobject_add+0x16a/0x1e0 [ 685.676248][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 685.676286][ T5642] ? class_to_subsys+0x10f/0x150 [ 685.676324][ T5642] ? kobject_put+0xb9/0x640 [ 685.676359][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 685.676394][ T5642] device_add+0x294/0x1950 [ 685.676426][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 685.676463][ T5642] ? __pfx_device_add+0x10/0x10 [ 685.676495][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 685.676534][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 685.676570][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 685.676609][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 685.676642][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 685.676690][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 685.676722][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 685.676759][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 685.676792][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 685.676827][ T5642] hci_event_packet+0x51c/0xcd0 [ 685.676857][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 685.676891][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 685.676925][ T5642] ? kcov_remote_start+0x374/0x660 [ 685.676962][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 685.677001][ T5642] hci_rx_work+0x451/0xfc0 [ 685.677036][ T5642] process_one_work+0xa0e/0x1980 [ 685.677080][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 685.677114][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 685.677147][ T5642] worker_thread+0x5ef/0xe50 [ 685.677183][ T5642] ? kthread+0x13a/0x450 [ 685.677203][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 685.677227][ T5642] kthread+0x370/0x450 [ 685.677247][ T5642] ? __pfx_kthread+0x10/0x10 [ 685.677271][ T5642] ret_from_fork+0x72b/0xd50 [ 685.677300][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 685.677328][ T5642] ? __switch_to+0x800/0x1100 [ 685.677363][ T5642] ? __switch_to_asm+0x39/0x70 [ 685.677397][ T5642] ? __pfx_kthread+0x10/0x10 [ 685.677420][ T5642] ret_from_fork_asm+0x1a/0x30 [ 685.677469][ T5642] [ 686.227716][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.235730][ T5642] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 686.249997][ T5642] Bluetooth: hci2: failed to register connection device [ 686.266008][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.330389][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 687.662928][T13925] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1801'. [ 687.722051][T13926] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1801'. [ 688.417172][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 688.476134][T13934] openvswitch: &#$@\]\-: Dropping previously announced user features [ 688.729298][ T5640] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 688.737093][ T5640] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 688.746441][ T5640] CPU: 0 UID: 0 PID: 5640 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 688.746472][ T5640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 688.746489][ T5640] Workqueue: hci3 hci_rx_work [ 688.746522][ T5640] Call Trace: [ 688.746530][ T5640] [ 688.746539][ T5640] dump_stack_lvl+0x100/0x190 [ 688.746568][ T5640] sysfs_warn_dup.cold+0x1c/0x28 [ 688.746607][ T5640] sysfs_create_dir_ns+0x24b/0x2b0 [ 688.746637][ T5640] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 688.746663][ T5640] ? find_held_lock+0x2b/0x80 [ 688.746697][ T5640] ? kobject_add_internal+0x25f/0x930 [ 688.746737][ T5640] ? kobject_add_internal+0x25f/0x930 [ 688.746779][ T5640] ? do_raw_spin_unlock+0x145/0x1e0 [ 688.746810][ T5640] kobject_add_internal+0x2c8/0x930 [ 688.746870][ T5640] kobject_add+0x16a/0x1e0 [ 688.746909][ T5640] ? __pfx_kobject_add+0x10/0x10 [ 688.746947][ T5640] ? class_to_subsys+0x10f/0x150 [ 688.746985][ T5640] ? kobject_put+0xb9/0x640 [ 688.747019][ T5640] ? _raw_spin_unlock+0x28/0x50 [ 688.747055][ T5640] device_add+0x294/0x1950 [ 688.747086][ T5640] ? __pfx_dev_set_name+0x10/0x10 [ 688.747124][ T5640] ? __pfx_device_add+0x10/0x10 [ 688.747157][ T5640] ? mgmt_send_event_skb+0x2fb/0x460 [ 688.747196][ T5640] hci_conn_add_sysfs+0x1a3/0x260 [ 688.747233][ T5640] le_conn_complete_evt+0x11eb/0x1f60 [ 688.747271][ T5640] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 688.747299][ T5640] ? __pfx_bt_warn+0x10/0x10 [ 688.747347][ T5640] hci_le_conn_complete_evt+0x23c/0x3a0 [ 688.747379][ T5640] ? skb_pull_data+0x15f/0x1e0 [ 688.747416][ T5640] hci_le_meta_evt+0x34a/0x5f0 [ 688.747449][ T5640] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 688.747485][ T5640] hci_event_packet+0x51c/0xcd0 [ 688.747515][ T5640] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 688.747549][ T5640] ? __pfx_hci_event_packet+0x10/0x10 [ 688.747582][ T5640] ? kcov_remote_start+0x374/0x660 [ 688.747619][ T5640] ? lockdep_hardirqs_on+0x78/0x100 [ 688.747658][ T5640] hci_rx_work+0x451/0xfc0 [ 688.747693][ T5640] process_one_work+0xa0e/0x1980 [ 688.747731][ T5640] ? __pfx_process_one_work+0x10/0x10 [ 688.747765][ T5640] ? __pfx_hci_rx_work+0x10/0x10 [ 688.747798][ T5640] worker_thread+0x5ef/0xe50 [ 688.747833][ T5640] ? kthread+0x13a/0x450 [ 688.747858][ T5640] ? __pfx_worker_thread+0x10/0x10 [ 688.747882][ T5640] kthread+0x370/0x450 [ 688.747902][ T5640] ? __pfx_kthread+0x10/0x10 [ 688.747926][ T5640] ret_from_fork+0x72b/0xd50 [ 688.747954][ T5640] ? __pfx_ret_from_fork+0x10/0x10 [ 688.747983][ T5640] ? __switch_to+0x800/0x1100 [ 688.748018][ T5640] ? __switch_to_asm+0x39/0x70 [ 688.748051][ T5640] ? __pfx_kthread+0x10/0x10 [ 688.748074][ T5640] ret_from_fork_asm+0x1a/0x30 [ 688.748123][ T5640] [ 689.300857][ T5640] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 689.314939][ T5640] Bluetooth: hci3: failed to register connection device [ 689.340913][T13942] vivid-008: ================= START STATUS ================= [ 689.511077][T13942] vivid-008: ================== END STATUS ================== [ 689.611895][ T5642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 690.241388][T13957] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1810'. [ 690.281068][T13957] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1810'. [ 690.498293][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 691.376956][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 691.696891][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 691.744096][T13941] random: crng reseeded on system resumption [ 692.756539][T13987] openvswitch: &#$@\]\-: Dropping previously announced user features [ 692.919046][T13990] openvswitch: &#$@\]\-: Dropping previously announced user features [ 693.457226][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 693.777566][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 693.935270][T14001] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1820'. [ 694.048942][T14002] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1820'. [ 694.960110][T14019] ubi0: attaching mtd0 [ 695.232334][T14019] ubi0 error: ubi_add_to_av: two LEBs with same sequence number 1 [ 695.341906][T14019] eraseblock attaching information dump: [ 695.472820][T14019] ec 1 [ 695.557872][T14019] pnum 0 [ 695.619382][T14019] lnum 0 [ 695.678248][T14019] scrub 0 [ 695.688352][T14016] netlink: 334 bytes leftover after parsing attributes in process `syz.0.1823'. [ 695.754021][T14019] sqnum 1 [ 695.815553][T14019] Volume identifier header dump: [ 695.916983][T14019] magic 55424921 [ 695.997060][T14019] version 1 [ 696.060664][T14019] vol_type 1 [ 696.103825][T14019] copy_flag 0 [ 696.169212][T14019] compat 5 [ 696.222413][T14019] vol_id 2147479551 [ 696.280198][T14019] lnum 0 [ 696.333037][T14019] data_size 0 [ 696.388369][T14019] used_ebs 0 [ 696.446356][T14019] data_pad 0 [ 696.503105][T14019] sqnum 1 [ 696.536193][T14019] hdr_crc 65b3bd2d [ 696.553121][T14019] Volume identifier header hexdump: [ 696.723587][T14019] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 697.203764][T14046] openvswitch: &#$@\]\-: Dropping previously announced user features [ 697.536401][T14056] netlink: 29 bytes leftover after parsing attributes in process `syz.3.1832'. [ 697.964494][T14060] openvswitch: &#$@\]\-: Dropping previously announced user features [ 699.351344][ T51] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 699.359228][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 699.368774][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 699.368808][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 699.368825][ T51] Workqueue: hci1 hci_rx_work [ 699.368857][ T51] Call Trace: [ 699.368865][ T51] [ 699.368875][ T51] dump_stack_lvl+0x100/0x190 [ 699.368904][ T51] sysfs_warn_dup.cold+0x1c/0x28 [ 699.368941][ T51] sysfs_create_dir_ns+0x24b/0x2b0 [ 699.368968][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 699.369000][ T51] ? find_held_lock+0x2b/0x80 [ 699.369034][ T51] ? kobject_add_internal+0x25f/0x930 [ 699.369074][ T51] ? kobject_add_internal+0x25f/0x930 [ 699.369116][ T51] ? do_raw_spin_unlock+0x145/0x1e0 [ 699.369148][ T51] kobject_add_internal+0x2c8/0x930 [ 699.369193][ T51] kobject_add+0x16a/0x1e0 [ 699.369232][ T51] ? __pfx_kobject_add+0x10/0x10 [ 699.369271][ T51] ? class_to_subsys+0x10f/0x150 [ 699.369309][ T51] ? kobject_put+0xb9/0x640 [ 699.369343][ T51] ? _raw_spin_unlock+0x28/0x50 [ 699.369379][ T51] device_add+0x294/0x1950 [ 699.369410][ T51] ? __pfx_dev_set_name+0x10/0x10 [ 699.369447][ T51] ? __pfx_device_add+0x10/0x10 [ 699.369479][ T51] ? mgmt_send_event_skb+0x2fb/0x460 [ 699.369518][ T51] hci_conn_add_sysfs+0x1a3/0x260 [ 699.369554][ T51] le_conn_complete_evt+0x11eb/0x1f60 [ 699.369592][ T51] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 699.369621][ T51] ? __pfx_bt_warn+0x10/0x10 [ 699.369668][ T51] hci_le_conn_complete_evt+0x23c/0x3a0 [ 699.369701][ T51] ? skb_pull_data+0x15f/0x1e0 [ 699.369738][ T51] hci_le_meta_evt+0x34a/0x5f0 [ 699.369771][ T51] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 699.369806][ T51] hci_event_packet+0x51c/0xcd0 [ 699.369836][ T51] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 699.369870][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 699.369904][ T51] ? kcov_remote_start+0x374/0x660 [ 699.369941][ T51] ? lockdep_hardirqs_on+0x78/0x100 [ 699.369980][ T51] hci_rx_work+0x451/0xfc0 [ 699.370022][ T51] process_one_work+0xa0e/0x1980 [ 699.370060][ T51] ? __pfx_process_one_work+0x10/0x10 [ 699.370095][ T51] ? __pfx_hci_rx_work+0x10/0x10 [ 699.370130][ T51] worker_thread+0x5ef/0xe50 [ 699.370167][ T51] ? kthread+0x13a/0x450 [ 699.370186][ T51] ? __pfx_worker_thread+0x10/0x10 [ 699.370210][ T51] kthread+0x370/0x450 [ 699.370230][ T51] ? __pfx_kthread+0x10/0x10 [ 699.370255][ T51] ret_from_fork+0x72b/0xd50 [ 699.370283][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 699.370312][ T51] ? __switch_to+0x800/0x1100 [ 699.370347][ T51] ? __switch_to_asm+0x39/0x70 [ 699.370380][ T51] ? __pfx_kthread+0x10/0x10 [ 699.370403][ T51] ret_from_fork_asm+0x1a/0x30 [ 699.370452][ T51] [ 699.370498][ T51] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 699.665597][T14076] vivid-008: ================= START STATUS ================= [ 699.673429][ T51] Bluetooth: hci1: failed to register connection device [ 699.827617][T14076] vivid-008: ================== END STATUS ================== [ 701.189095][T14073] random: crng reseeded on system resumption [ 701.696848][ T5640] Bluetooth: hci1: command 0x0406 tx timeout [ 701.977673][T14095] bond0: Unable to set down delay as MII monitoring is disabled [ 702.734394][T14106] netlink: 29 bytes leftover after parsing attributes in process `syz.1.1843'. [ 703.776779][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 703.908608][T14094] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 703.998488][T14117] netlink: 'syz.1.1847': attribute type 12 has an invalid length. [ 705.529816][T14136] openvswitch: &#$@\]\-: Dropping previously announced user features [ 707.198860][T14148] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1855'. [ 707.317568][T14149] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1855'. [ 708.017808][T14153] __vm_enough_memory: pid: 14153, comm: syz.2.1851, bytes: 4398046511104 not enough memory for the allocation [ 708.153166][T14155] netlink: 29 bytes leftover after parsing attributes in process `syz.3.1857'. [ 709.930303][ T51] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 709.938082][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 709.947850][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 709.947882][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 709.947900][ T51] Workqueue: hci3 hci_rx_work [ 709.947931][ T51] Call Trace: [ 709.947939][ T51] [ 709.947947][ T51] dump_stack_lvl+0x100/0x190 [ 709.947977][ T51] sysfs_warn_dup.cold+0x1c/0x28 [ 709.948014][ T51] sysfs_create_dir_ns+0x24b/0x2b0 [ 709.948041][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 709.948066][ T51] ? find_held_lock+0x2b/0x80 [ 709.948100][ T51] ? kobject_add_internal+0x25f/0x930 [ 709.948139][ T51] ? kobject_add_internal+0x25f/0x930 [ 709.948193][ T51] ? do_raw_spin_unlock+0x145/0x1e0 [ 709.948225][ T51] kobject_add_internal+0x2c8/0x930 [ 709.948270][ T51] kobject_add+0x16a/0x1e0 [ 709.948309][ T51] ? __pfx_kobject_add+0x10/0x10 [ 709.948348][ T51] ? class_to_subsys+0x10f/0x150 [ 709.948386][ T51] ? kobject_put+0xb9/0x640 [ 709.948421][ T51] ? _raw_spin_unlock+0x28/0x50 [ 709.948456][ T51] device_add+0x294/0x1950 [ 709.948488][ T51] ? __pfx_dev_set_name+0x10/0x10 [ 709.948525][ T51] ? __pfx_device_add+0x10/0x10 [ 709.948557][ T51] ? mgmt_send_event_skb+0x2fb/0x460 [ 709.948596][ T51] hci_conn_add_sysfs+0x1a3/0x260 [ 709.948632][ T51] le_conn_complete_evt+0x11eb/0x1f60 [ 709.948671][ T51] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 709.948700][ T51] ? __pfx_bt_warn+0x10/0x10 [ 709.948747][ T51] hci_le_conn_complete_evt+0x23c/0x3a0 [ 709.948779][ T51] ? skb_pull_data+0x15f/0x1e0 [ 709.948816][ T51] hci_le_meta_evt+0x34a/0x5f0 [ 709.948849][ T51] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 709.948885][ T51] hci_event_packet+0x51c/0xcd0 [ 709.948921][ T51] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 709.948955][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 709.948988][ T51] ? kcov_remote_start+0x374/0x660 [ 709.949025][ T51] ? lockdep_hardirqs_on+0x78/0x100 [ 709.949065][ T51] hci_rx_work+0x451/0xfc0 [ 709.949100][ T51] process_one_work+0xa0e/0x1980 [ 709.949138][ T51] ? __pfx_process_one_work+0x10/0x10 [ 709.949185][ T51] ? __pfx_hci_rx_work+0x10/0x10 [ 709.949222][ T51] worker_thread+0x5ef/0xe50 [ 709.949258][ T51] ? kthread+0x13a/0x450 [ 709.949278][ T51] ? __pfx_worker_thread+0x10/0x10 [ 709.949302][ T51] kthread+0x370/0x450 [ 709.949323][ T51] ? __pfx_kthread+0x10/0x10 [ 709.949347][ T51] ret_from_fork+0x72b/0xd50 [ 709.949375][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 709.949404][ T51] ? __switch_to+0x800/0x1100 [ 709.949438][ T51] ? __switch_to_asm+0x39/0x70 [ 709.949471][ T51] ? __pfx_kthread+0x10/0x10 [ 709.949495][ T51] ret_from_fork_asm+0x1a/0x30 [ 709.949543][ T51] [ 709.949589][ T51] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 710.242396][T14179] vivid-008: ================= START STATUS ================= [ 710.264835][ T51] Bluetooth: hci3: failed to register connection device [ 710.368947][T14179] vivid-008: ================== END STATUS ================== [ 711.165532][T14184] netlink: 25 bytes leftover after parsing attributes in process `syz.2.1863'. [ 711.236443][T14177] random: crng reseeded on system resumption [ 712.286437][T14152] kexec: Could not allocate control_code_buffer [ 712.337335][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 713.603480][T14210] vivid-008: ================= START STATUS ================= [ 713.641213][T14195] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1865'. [ 713.760566][T14210] vivid-008: ================== END STATUS ================== [ 713.963501][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 714.325025][T14211] random: crng reseeded on system resumption [ 714.416986][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 716.016975][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 716.465750][T14230] openvswitch: &#$@\]\-: Dropping previously announced user features [ 718.097321][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 719.147067][T14256] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1877'. [ 719.227645][T14256] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1877'. [ 720.180795][T14252] FAULT_INJECTION: forcing a failure. [ 720.180795][T14252] name failslab, interval 1, probability 0, space 0, times 0 [ 720.234194][T14252] CPU: 0 UID: 0 PID: 14252 Comm: syz.3.1876 Not tainted syzkaller #0 PREEMPT(full) [ 720.234229][T14252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 720.234245][T14252] Call Trace: [ 720.234253][T14252] [ 720.234262][T14252] dump_stack_lvl+0x100/0x190 [ 720.234293][T14252] should_fail_ex.cold+0x5/0xa [ 720.234325][T14252] should_failslab+0xc2/0x120 [ 720.234362][T14252] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 720.234403][T14252] ? __mpol_dup+0x74/0x390 [ 720.234443][T14252] __mpol_dup+0x74/0x390 [ 720.234475][T14252] ? __pfx___mpol_dup+0x10/0x10 [ 720.234507][T14252] ? kmem_cache_alloc_noprof+0x292/0x6e0 [ 720.234548][T14252] ? sp_alloc+0x27/0x160 [ 720.234585][T14252] sp_alloc+0x4d/0x160 [ 720.234619][T14252] mpol_set_shared_policy+0xa5/0x890 [ 720.234660][T14252] ? __pfx_shmem_set_policy+0x10/0x10 [ 720.234690][T14252] mbind_range+0x339/0x550 [ 720.234728][T14252] do_mbind+0x7dc/0xfd0 [ 720.234768][T14252] ? __might_fault+0xc5/0x140 [ 720.234807][T14252] ? __pfx_do_mbind+0x10/0x10 [ 720.234847][T14252] ? _copy_from_user+0x59/0xd0 [ 720.234896][T14252] ? __pfx_get_nodes+0x10/0x10 [ 720.234928][T14252] kernel_mbind+0x1b7/0x200 [ 720.234966][T14252] ? __pfx_kernel_mbind+0x10/0x10 [ 720.235003][T14252] ? rcu_is_watching+0x12/0xc0 [ 720.235037][T14252] do_syscall_64+0x10b/0xf80 [ 720.235070][T14252] ? clear_bhb_loop+0x40/0x90 [ 720.235100][T14252] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.235126][T14252] RIP: 0033:0x7fd85a99cdd9 [ 720.235146][T14252] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.235171][T14252] RSP: 002b:00007fd858bee028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 720.235194][T14252] RAX: ffffffffffffffda RBX: 00007fd85ac15fa0 RCX: 00007fd85a99cdd9 [ 720.235211][T14252] RDX: 0000000000008003 RSI: 0000000000800605 RDI: 0000000000000000 [ 720.235226][T14252] RBP: 00007fd85aa32d69 R08: 0000000000000003 R09: 0000000000000003 [ 720.235241][T14252] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 720.235256][T14252] R13: 00007fd85ac16038 R14: 00007fd85ac15fa0 R15: 00007ffe16a7c238 [ 720.235287][T14252] [ 721.165717][ T5640] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 723.249971][ T5642] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 723.258534][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 723.268313][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 723.268345][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 723.268362][ T5642] Workqueue: hci3 hci_rx_work [ 723.268394][ T5642] Call Trace: [ 723.268402][ T5642] [ 723.268410][ T5642] dump_stack_lvl+0x100/0x190 [ 723.268438][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 723.268476][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 723.268504][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 723.268530][ T5642] ? find_held_lock+0x2b/0x80 [ 723.268562][ T5642] ? kobject_add_internal+0x25f/0x930 [ 723.268602][ T5642] ? kobject_add_internal+0x25f/0x930 [ 723.268644][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 723.268675][ T5642] kobject_add_internal+0x2c8/0x930 [ 723.268719][ T5642] kobject_add+0x16a/0x1e0 [ 723.268758][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 723.268797][ T5642] ? class_to_subsys+0x10f/0x150 [ 723.268834][ T5642] ? kobject_put+0xb9/0x640 [ 723.268869][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 723.268904][ T5642] device_add+0x294/0x1950 [ 723.268936][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 723.268974][ T5642] ? __pfx_device_add+0x10/0x10 [ 723.269005][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 723.269044][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 723.269081][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 723.269120][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 723.269156][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 723.269204][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 723.269244][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 723.269281][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 723.269314][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 723.269353][ T5642] hci_event_packet+0x51c/0xcd0 [ 723.269383][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 723.269417][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 723.269451][ T5642] ? kcov_remote_start+0x374/0x660 [ 723.269488][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 723.269527][ T5642] hci_rx_work+0x451/0xfc0 [ 723.269562][ T5642] process_one_work+0xa0e/0x1980 [ 723.269600][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 723.269634][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 723.269666][ T5642] worker_thread+0x5ef/0xe50 [ 723.269703][ T5642] ? kthread+0x13a/0x450 [ 723.269722][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 723.269746][ T5642] kthread+0x370/0x450 [ 723.269766][ T5642] ? __pfx_kthread+0x10/0x10 [ 723.269790][ T5642] ret_from_fork+0x72b/0xd50 [ 723.269818][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 723.269846][ T5642] ? __switch_to+0x800/0x1100 [ 723.269881][ T5642] ? __switch_to_asm+0x39/0x70 [ 723.269915][ T5642] ? __pfx_kthread+0x10/0x10 [ 723.269938][ T5642] ret_from_fork_asm+0x1a/0x30 [ 723.269986][ T5642] [ 723.270036][ T5642] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 723.554217][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 723.567776][ T5642] Bluetooth: hci3: failed to register connection device [ 723.586294][T14302] vivid-008: ================= START STATUS ================= [ 723.713192][T14302] vivid-008: ================== END STATUS ================== [ 725.321649][T14299] random: crng reseeded on system resumption [ 725.616877][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 725.623014][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 726.187113][T14331] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1894'. [ 726.250098][T14331] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1894'. [ 726.650602][T14334] netlink: 29 bytes leftover after parsing attributes in process `syz.3.1895'. [ 727.697007][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 728.281111][T14350] openvswitch: &#$@\]\-: Dropping previously announced user features [ 730.687346][ T5640] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 732.667460][T14405] bond0: Unable to set down delay as MII monitoring is disabled [ 732.737113][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 733.920872][T14402] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 734.816847][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 737.760682][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 739.776779][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 740.147971][T14492] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1930'. [ 740.234214][T14497] vivid-008: ================= START STATUS ================= [ 740.276856][T14497] vivid-008: ================== END STATUS ================== [ 741.000648][T14507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1935'. [ 741.490790][T14494] random: crng reseeded on system resumption [ 741.856795][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 742.665350][T14534] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1938'. [ 742.730342][T14534] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1938'. [ 743.374913][T14539] FAULT_INJECTION: forcing a failure. [ 743.374913][T14539] name fail_futex, interval 1, probability 0, space 0, times 1 [ 743.632550][T14539] CPU: 0 UID: 0 PID: 14539 Comm: syz.0.1939 Not tainted syzkaller #0 PREEMPT(full) [ 743.632585][T14539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 743.632601][T14539] Call Trace: [ 743.632608][T14539] [ 743.632617][T14539] dump_stack_lvl+0x100/0x190 [ 743.632649][T14539] should_fail_ex.cold+0x5/0xa [ 743.632681][T14539] get_futex_key+0x1d2/0x1510 [ 743.632709][T14539] ? __pfx_get_futex_key+0x10/0x10 [ 743.632734][T14539] ? __pfx_core_sys_select+0x10/0x10 [ 743.632771][T14539] futex_wake+0xea/0x530 [ 743.632813][T14539] ? __pfx_futex_wake+0x10/0x10 [ 743.632858][T14539] ? poll_select_finish+0x36e/0x670 [ 743.632887][T14539] ? __pfx_poll_select_finish+0x10/0x10 [ 743.632918][T14539] do_futex+0x32b/0x350 [ 743.632946][T14539] ? __pfx_do_futex+0x10/0x10 [ 743.632981][T14539] __x64_sys_futex+0x34f/0x4d0 [ 743.633013][T14539] ? __pfx___x64_sys_futex+0x10/0x10 [ 743.633050][T14539] ? rcu_is_watching+0x12/0xc0 [ 743.633084][T14539] do_syscall_64+0x10b/0xf80 [ 743.633116][T14539] ? clear_bhb_loop+0x40/0x90 [ 743.633146][T14539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.633171][T14539] RIP: 0033:0x7fe11379cdd9 [ 743.633191][T14539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 743.633215][T14539] RSP: 002b:00007fe1145b00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 743.633238][T14539] RAX: ffffffffffffffda RBX: 00007fe113a16188 RCX: 00007fe11379cdd9 [ 743.633255][T14539] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe113a1618c [ 743.633270][T14539] RBP: 00007fe113a16180 R08: 0000000000000001 R09: 0000000000000000 [ 743.633285][T14539] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 743.633300][T14539] R13: 00007fe113a16218 R14: 00007ffe5496c2b0 R15: 00007ffe5496c398 [ 743.633330][T14539] [ 745.820385][T14563] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1953'. [ 746.465397][T14581] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1948'. [ 746.539233][T14582] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1948'. [ 747.460423][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.467012][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.664636][T14611] can: request_module (can-proto-5) failed. [ 748.903305][T14624] netlink: 29 bytes leftover after parsing attributes in process `syz.1.1957'. [ 750.739025][T14657] openvswitch: &#$@\]\-: Dropping previously announced user features [ 751.232753][T14671] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1970'. [ 751.304307][T14673] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1970'. [ 752.042236][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 752.519594][ T5640] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 752.527421][ T5640] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 752.536865][ T5640] CPU: 0 UID: 0 PID: 5640 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 752.536896][ T5640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 752.536913][ T5640] Workqueue: hci3 hci_rx_work [ 752.536947][ T5640] Call Trace: [ 752.536955][ T5640] [ 752.536964][ T5640] dump_stack_lvl+0x100/0x190 [ 752.536993][ T5640] sysfs_warn_dup.cold+0x1c/0x28 [ 752.537031][ T5640] sysfs_create_dir_ns+0x24b/0x2b0 [ 752.537058][ T5640] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 752.537084][ T5640] ? find_held_lock+0x2b/0x80 [ 752.537116][ T5640] ? kobject_add_internal+0x25f/0x930 [ 752.537156][ T5640] ? kobject_add_internal+0x25f/0x930 [ 752.537198][ T5640] ? do_raw_spin_unlock+0x145/0x1e0 [ 752.537230][ T5640] kobject_add_internal+0x2c8/0x930 [ 752.537274][ T5640] kobject_add+0x16a/0x1e0 [ 752.537314][ T5640] ? __pfx_kobject_add+0x10/0x10 [ 752.537352][ T5640] ? class_to_subsys+0x10f/0x150 [ 752.537390][ T5640] ? kobject_put+0xb9/0x640 [ 752.537425][ T5640] ? _raw_spin_unlock+0x28/0x50 [ 752.537461][ T5640] device_add+0x294/0x1950 [ 752.537493][ T5640] ? __pfx_dev_set_name+0x10/0x10 [ 752.537531][ T5640] ? __pfx_device_add+0x10/0x10 [ 752.537563][ T5640] ? mgmt_send_event_skb+0x2fb/0x460 [ 752.537602][ T5640] hci_conn_add_sysfs+0x1a3/0x260 [ 752.537640][ T5640] le_conn_complete_evt+0x11eb/0x1f60 [ 752.537678][ T5640] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 752.537707][ T5640] ? __pfx_bt_warn+0x10/0x10 [ 752.537755][ T5640] hci_le_conn_complete_evt+0x23c/0x3a0 [ 752.537795][ T5640] ? skb_pull_data+0x15f/0x1e0 [ 752.537833][ T5640] hci_le_meta_evt+0x34a/0x5f0 [ 752.537866][ T5640] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 752.537901][ T5640] hci_event_packet+0x51c/0xcd0 [ 752.537932][ T5640] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 752.537966][ T5640] ? __pfx_hci_event_packet+0x10/0x10 [ 752.538000][ T5640] ? kcov_remote_start+0x374/0x660 [ 752.538036][ T5640] ? lockdep_hardirqs_on+0x78/0x100 [ 752.538076][ T5640] hci_rx_work+0x451/0xfc0 [ 752.538110][ T5640] process_one_work+0xa0e/0x1980 [ 752.538149][ T5640] ? __pfx_process_one_work+0x10/0x10 [ 752.538184][ T5640] ? __pfx_hci_rx_work+0x10/0x10 [ 752.538219][ T5640] worker_thread+0x5ef/0xe50 [ 752.538255][ T5640] ? kthread+0x13a/0x450 [ 752.538275][ T5640] ? __pfx_worker_thread+0x10/0x10 [ 752.538299][ T5640] kthread+0x370/0x450 [ 752.538319][ T5640] ? __pfx_kthread+0x10/0x10 [ 752.538343][ T5640] ret_from_fork+0x72b/0xd50 [ 752.538371][ T5640] ? __pfx_ret_from_fork+0x10/0x10 [ 752.538400][ T5640] ? __switch_to+0x800/0x1100 [ 752.538435][ T5640] ? __switch_to_asm+0x39/0x70 [ 752.538469][ T5640] ? __pfx_kthread+0x10/0x10 [ 752.538492][ T5640] ret_from_fork_asm+0x1a/0x30 [ 752.538541][ T5640] [ 752.538586][ T5640] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 752.828842][T14688] vivid-008: ================= START STATUS ================= [ 752.836654][ T5640] Bluetooth: hci3: failed to register connection device [ 752.887159][T14688] vivid-008: ================== END STATUS ================== [ 753.091931][T14685] Console: switching to colour VGA+ 80x25 [ 753.671956][T14687] random: crng reseeded on system resumption [ 754.097020][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 754.558957][T14714] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1979'. [ 754.613408][T14716] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1979'. [ 754.808435][T14713] openvswitch: &#$@\]\-: Dropping previously announced user features [ 754.896930][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 754.954440][T14720] netlink: 29 bytes leftover after parsing attributes in process `syz.2.1980'. [ 756.176863][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 756.978510][ T5640] Bluetooth: hci3: command 0x0406 tx timeout [ 757.144912][ T5640] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 757.160132][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 758.352247][T14752] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1989'. [ 758.461640][T14753] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1989'. [ 759.068895][T14762] random: crng reseeded on system resumption [ 759.216822][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 759.222914][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 759.373674][T14758] openvswitch: &#$@\]\-: Dropping previously announced user features [ 759.784993][T14764] hub 1-0:1.0: USB hub found [ 759.894822][T14764] hub 1-0:1.0: 1 port detected [ 761.297210][ T5640] Bluetooth: hci0: command 0x0406 tx timeout [ 761.303628][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 761.526183][ T5642] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 761.534858][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 761.544690][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 761.544724][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 761.544741][ T5642] Workqueue: hci3 hci_rx_work [ 761.544774][ T5642] Call Trace: [ 761.544782][ T5642] [ 761.544792][ T5642] dump_stack_lvl+0x100/0x190 [ 761.544820][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 761.544859][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 761.544886][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 761.544911][ T5642] ? find_held_lock+0x2b/0x80 [ 761.544944][ T5642] ? kobject_add_internal+0x25f/0x930 [ 761.544984][ T5642] ? kobject_add_internal+0x25f/0x930 [ 761.545026][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 761.545057][ T5642] kobject_add_internal+0x2c8/0x930 [ 761.545112][ T5642] kobject_add+0x16a/0x1e0 [ 761.545151][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 761.545189][ T5642] ? class_to_subsys+0x10f/0x150 [ 761.545227][ T5642] ? kobject_put+0xb9/0x640 [ 761.545263][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 761.545298][ T5642] device_add+0x294/0x1950 [ 761.545329][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 761.545379][ T5642] ? __pfx_device_add+0x10/0x10 [ 761.545410][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 761.545448][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 761.545483][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 761.545520][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 761.545548][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 761.545594][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 761.545625][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 761.545661][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 761.545698][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 761.545732][ T5642] hci_event_packet+0x51c/0xcd0 [ 761.545761][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 761.545794][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 761.545827][ T5642] ? kcov_remote_start+0x374/0x660 [ 761.545863][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 761.545901][ T5642] hci_rx_work+0x451/0xfc0 [ 761.545935][ T5642] process_one_work+0xa0e/0x1980 [ 761.545972][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 761.546005][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 761.546036][ T5642] worker_thread+0x5ef/0xe50 [ 761.546075][ T5642] ? kthread+0x13a/0x450 [ 761.546094][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 761.546117][ T5642] kthread+0x370/0x450 [ 761.546137][ T5642] ? __pfx_kthread+0x10/0x10 [ 761.546160][ T5642] ret_from_fork+0x72b/0xd50 [ 761.546188][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 761.546216][ T5642] ? __switch_to+0x800/0x1100 [ 761.546249][ T5642] ? __switch_to_asm+0x39/0x70 [ 761.546281][ T5642] ? __pfx_kthread+0x10/0x10 [ 761.546304][ T5642] ret_from_fork_asm+0x1a/0x30 [ 761.546351][ T5642] [ 761.546397][ T5642] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 761.851978][T14787] vivid-008: ================= START STATUS ================= [ 761.861114][ T5642] Bluetooth: hci3: failed to register connection device [ 761.971659][T14787] vivid-008: ================== END STATUS ================== [ 762.333334][ T51] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 762.352792][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 762.362746][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 762.362778][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 762.362795][ T51] Workqueue: hci1 hci_rx_work [ 762.362827][ T51] Call Trace: [ 762.362835][ T51] [ 762.362844][ T51] dump_stack_lvl+0x100/0x190 [ 762.362873][ T51] sysfs_warn_dup.cold+0x1c/0x28 [ 762.362911][ T51] sysfs_create_dir_ns+0x24b/0x2b0 [ 762.362939][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 762.362965][ T51] ? find_held_lock+0x2b/0x80 [ 762.362997][ T51] ? kobject_add_internal+0x25f/0x930 [ 762.363051][ T51] ? kobject_add_internal+0x25f/0x930 [ 762.363094][ T51] ? do_raw_spin_unlock+0x145/0x1e0 [ 762.363125][ T51] kobject_add_internal+0x2c8/0x930 [ 762.363170][ T51] kobject_add+0x16a/0x1e0 [ 762.363210][ T51] ? __pfx_kobject_add+0x10/0x10 [ 762.363249][ T51] ? class_to_subsys+0x10f/0x150 [ 762.363287][ T51] ? kobject_put+0xb9/0x640 [ 762.363322][ T51] ? _raw_spin_unlock+0x28/0x50 [ 762.363358][ T51] device_add+0x294/0x1950 [ 762.363390][ T51] ? __pfx_dev_set_name+0x10/0x10 [ 762.363427][ T51] ? __pfx_device_add+0x10/0x10 [ 762.363459][ T51] ? mgmt_send_event_skb+0x2fb/0x460 [ 762.363497][ T51] hci_conn_add_sysfs+0x1a3/0x260 [ 762.363535][ T51] le_conn_complete_evt+0x11eb/0x1f60 [ 762.363573][ T51] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 762.363607][ T51] ? __pfx_bt_warn+0x10/0x10 [ 762.363655][ T51] hci_le_conn_complete_evt+0x23c/0x3a0 [ 762.363687][ T51] ? skb_pull_data+0x15f/0x1e0 [ 762.363724][ T51] hci_le_meta_evt+0x34a/0x5f0 [ 762.363757][ T51] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 762.363792][ T51] hci_event_packet+0x51c/0xcd0 [ 762.363822][ T51] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 762.363856][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 762.363890][ T51] ? kcov_remote_start+0x374/0x660 [ 762.363926][ T51] ? lockdep_hardirqs_on+0x78/0x100 [ 762.363965][ T51] hci_rx_work+0x451/0xfc0 [ 762.364001][ T51] process_one_work+0xa0e/0x1980 [ 762.364044][ T51] ? __pfx_process_one_work+0x10/0x10 [ 762.364079][ T51] ? __pfx_hci_rx_work+0x10/0x10 [ 762.364111][ T51] worker_thread+0x5ef/0xe50 [ 762.364148][ T51] ? kthread+0x13a/0x450 [ 762.364168][ T51] ? __pfx_worker_thread+0x10/0x10 [ 762.364192][ T51] kthread+0x370/0x450 [ 762.364213][ T51] ? __pfx_kthread+0x10/0x10 [ 762.364236][ T51] ret_from_fork+0x72b/0xd50 [ 762.364265][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 762.364294][ T51] ? __switch_to+0x800/0x1100 [ 762.364330][ T51] ? __switch_to_asm+0x39/0x70 [ 762.364363][ T51] ? __pfx_kthread+0x10/0x10 [ 762.364387][ T51] ret_from_fork_asm+0x1a/0x30 [ 762.364435][ T51] [ 762.365339][ T51] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 762.665874][ T51] Bluetooth: hci1: failed to register connection device [ 763.165376][T14787] random: crng reseeded on system resumption [ 763.900710][T14797] random: crng reseeded on system resumption [ 763.938862][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 764.737302][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 765.115662][T14784] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 766.017243][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 766.089033][T14813] Process accounting resumed [ 766.816904][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 767.216738][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 768.194678][T14821] kexec: Could not allocate control_code_buffer [ 768.845839][T14865] vivid-008: ================= START STATUS ================= [ 768.965423][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 768.973234][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 768.982911][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 768.982944][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 768.982961][ T5642] Workqueue: hci2 hci_rx_work [ 768.982994][ T5642] Call Trace: [ 768.983001][ T5642] [ 768.983011][ T5642] dump_stack_lvl+0x100/0x190 [ 768.983040][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 768.983078][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 768.983105][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 768.983131][ T5642] ? find_held_lock+0x2b/0x80 [ 768.983164][ T5642] ? kobject_add_internal+0x25f/0x930 [ 768.983204][ T5642] ? kobject_add_internal+0x25f/0x930 [ 768.983246][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 768.983277][ T5642] kobject_add_internal+0x2c8/0x930 [ 768.983322][ T5642] kobject_add+0x16a/0x1e0 [ 768.983362][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 768.983400][ T5642] ? class_to_subsys+0x10f/0x150 [ 768.983438][ T5642] ? kobject_put+0xb9/0x640 [ 768.983480][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 768.983515][ T5642] device_add+0x294/0x1950 [ 768.983548][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 768.983585][ T5642] ? __pfx_device_add+0x10/0x10 [ 768.983617][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 768.983656][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 768.983693][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 768.983732][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 768.983761][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 768.983808][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 768.983841][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 768.983878][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 768.983911][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 768.983946][ T5642] hci_event_packet+0x51c/0xcd0 [ 768.983976][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 768.984011][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 768.984044][ T5642] ? kcov_remote_start+0x374/0x660 [ 768.984081][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 768.984125][ T5642] hci_rx_work+0x451/0xfc0 [ 768.984159][ T5642] process_one_work+0xa0e/0x1980 [ 768.984198][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 768.984233][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 768.984265][ T5642] worker_thread+0x5ef/0xe50 [ 768.984302][ T5642] ? kthread+0x13a/0x450 [ 768.984321][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 768.984345][ T5642] kthread+0x370/0x450 [ 768.984365][ T5642] ? __pfx_kthread+0x10/0x10 [ 768.984389][ T5642] ret_from_fork+0x72b/0xd50 [ 768.984417][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 768.984446][ T5642] ? __switch_to+0x800/0x1100 [ 768.984487][ T5642] ? __switch_to_asm+0x39/0x70 [ 768.984521][ T5642] ? __pfx_kthread+0x10/0x10 [ 768.984545][ T5642] ret_from_fork_asm+0x1a/0x30 [ 768.984593][ T5642] [ 768.984648][ T5642] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 769.284842][T14865] vivid-008: ================== END STATUS ================== [ 769.292652][ T5642] Bluetooth: hci2: failed to register connection device [ 769.350425][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 770.180590][T14865] random: crng reseeded on system resumption [ 771.083330][T14895] input: jJǸ-¶š9ã%vø“û¨lÐQ  J86Ö‘ as /devices/virtual/input/input8 [ 771.377165][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 771.928790][T14910] netlink: 29 bytes leftover after parsing attributes in process `syz.1.2023'. [ 772.989713][T14784] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 773.460664][T14784] Bluetooth: hci2: command 0x0406 tx timeout [ 775.066751][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 775.224821][T14951] openvswitch: &#$@\]\-: Dropping previously announced user features [ 775.642806][T14959] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2034'. [ 775.858351][T14962] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2035'. [ 776.599114][T14966] openvswitch: &#$@\]\-: Dropping previously announced user features [ 777.137675][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 777.849473][T14987] random: crng reseeded on system resumption [ 778.484452][T14989] hub 1-0:1.0: USB hub found [ 778.636852][T14989] hub 1-0:1.0: 1 port detected [ 779.672353][T15009] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2049'. [ 779.736554][T15009] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2049'. [ 780.511492][T15020] netlink: 29 bytes leftover after parsing attributes in process `syz.3.2051'. [ 783.535506][T15052] random: crng reseeded on system resumption [ 785.578142][T15073] openvswitch: &#$@\]\-: Dropping previously announced user features [ 786.385565][T15087] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2065'. [ 790.696778][T15135] openvswitch: &#$@\]\-: Dropping previously announced user features [ 793.393234][T14784] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 795.456896][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 797.534742][T15203] FAULT_INJECTION: forcing a failure. [ 797.534742][T15203] name failslab, interval 1, probability 0, space 0, times 0 [ 797.553882][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 797.634896][T15203] CPU: 0 UID: 0 PID: 15203 Comm: syz.0.2096 Not tainted syzkaller #0 PREEMPT(full) [ 797.634931][T15203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 797.634946][T15203] Call Trace: [ 797.634954][T15203] [ 797.634963][T15203] dump_stack_lvl+0x100/0x190 [ 797.634995][T15203] should_fail_ex.cold+0x5/0xa [ 797.635026][T15203] should_failslab+0xc2/0x120 [ 797.635057][T15203] __kmalloc_cache_noprof+0x7a/0x6f0 [ 797.635094][T15203] ? single_open+0x4d/0x1d0 [ 797.635115][T15203] ? __pfx___debugfs_file_get+0x10/0x10 [ 797.635147][T15203] ? __pfx_edid_show+0x10/0x10 [ 797.635179][T15203] ? __pfx_edid_open+0x10/0x10 [ 797.635207][T15203] single_open+0x4d/0x1d0 [ 797.635242][T15203] full_proxy_open_regular+0x1b6/0x370 [ 797.635278][T15203] do_dentry_open+0x6d8/0x1660 [ 797.635309][T15203] ? __pfx_full_proxy_open_regular+0x10/0x10 [ 797.635350][T15203] vfs_open+0x82/0x3f0 [ 797.635391][T15203] path_openat+0x208c/0x31a0 [ 797.635433][T15203] ? __pfx_path_openat+0x10/0x10 [ 797.635476][T15203] do_file_open+0x20e/0x430 [ 797.635522][T15203] ? __pfx_do_file_open+0x10/0x10 [ 797.635573][T15203] ? alloc_fd+0x476/0x790 [ 797.635604][T15203] ? do_getname+0x191/0x390 [ 797.635643][T15203] do_sys_openat2+0x10d/0x1e0 [ 797.635681][T15203] ? __pfx_do_sys_openat2+0x10/0x10 [ 797.635720][T15203] ? __fget_files+0x21f/0x3d0 [ 797.635754][T15203] __x64_sys_openat+0x12d/0x210 [ 797.635793][T15203] ? __pfx___x64_sys_openat+0x10/0x10 [ 797.635837][T15203] ? rcu_is_watching+0x12/0xc0 [ 797.635870][T15203] do_syscall_64+0x10b/0xf80 [ 797.635902][T15203] ? clear_bhb_loop+0x40/0x90 [ 797.635931][T15203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.635955][T15203] RIP: 0033:0x7fe11379cdd9 [ 797.635975][T15203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 797.635998][T15203] RSP: 002b:00007fe1145f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 797.636020][T15203] RAX: ffffffffffffffda RBX: 00007fe113a15fa0 RCX: 00007fe11379cdd9 [ 797.636036][T15203] RDX: 0000000000000400 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 797.636051][T15203] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000000 [ 797.636065][T15203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 797.636079][T15203] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 797.636108][T15203] [ 801.015876][T15250] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2108'. [ 801.059120][T15250] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2108'. [ 801.113757][T14784] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 801.123417][T15255] vivid-008: ================= START STATUS ================= [ 801.160723][T14784] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 801.170310][T14784] CPU: 0 UID: 0 PID: 14784 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) [ 801.170342][T14784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 801.170360][T14784] Workqueue: hci1 hci_rx_work [ 801.170393][T14784] Call Trace: [ 801.170400][T14784] [ 801.170409][T14784] dump_stack_lvl+0x100/0x190 [ 801.170437][T14784] sysfs_warn_dup.cold+0x1c/0x28 [ 801.170475][T14784] sysfs_create_dir_ns+0x24b/0x2b0 [ 801.170502][T14784] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 801.170527][T14784] ? find_held_lock+0x2b/0x80 [ 801.170559][T14784] ? kobject_add_internal+0x25f/0x930 [ 801.170599][T14784] ? kobject_add_internal+0x25f/0x930 [ 801.170641][T14784] ? do_raw_spin_unlock+0x145/0x1e0 [ 801.170673][T14784] kobject_add_internal+0x2c8/0x930 [ 801.170717][T14784] kobject_add+0x16a/0x1e0 [ 801.170756][T14784] ? __pfx_kobject_add+0x10/0x10 [ 801.170794][T14784] ? class_to_subsys+0x10f/0x150 [ 801.170831][T14784] ? kobject_put+0xb9/0x640 [ 801.170866][T14784] ? _raw_spin_unlock+0x28/0x50 [ 801.170901][T14784] device_add+0x294/0x1950 [ 801.170933][T14784] ? __pfx_dev_set_name+0x10/0x10 [ 801.170970][T14784] ? __pfx_device_add+0x10/0x10 [ 801.171017][T14784] ? mgmt_send_event_skb+0x2fb/0x460 [ 801.171056][T14784] hci_conn_add_sysfs+0x1a3/0x260 [ 801.171094][T14784] le_conn_complete_evt+0x11eb/0x1f60 [ 801.171132][T14784] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 801.171161][T14784] ? __pfx_bt_warn+0x10/0x10 [ 801.171208][T14784] hci_le_conn_complete_evt+0x23c/0x3a0 [ 801.171240][T14784] ? skb_pull_data+0x15f/0x1e0 [ 801.171277][T14784] hci_le_meta_evt+0x34a/0x5f0 [ 801.171310][T14784] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 801.171345][T14784] hci_event_packet+0x51c/0xcd0 [ 801.171375][T14784] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 801.171409][T14784] ? __pfx_hci_event_packet+0x10/0x10 [ 801.171442][T14784] ? kcov_remote_start+0x374/0x660 [ 801.171479][T14784] ? lockdep_hardirqs_on+0x78/0x100 [ 801.171519][T14784] hci_rx_work+0x451/0xfc0 [ 801.171558][T14784] process_one_work+0xa0e/0x1980 [ 801.171597][T14784] ? __pfx_process_one_work+0x10/0x10 [ 801.171631][T14784] ? __pfx_hci_rx_work+0x10/0x10 [ 801.171664][T14784] worker_thread+0x5ef/0xe50 [ 801.171696][T14784] ? __pfx_worker_thread+0x10/0x10 [ 801.171723][T14784] ? kthread+0x13a/0x450 [ 801.171742][T14784] ? __pfx_worker_thread+0x10/0x10 [ 801.171766][T14784] kthread+0x370/0x450 [ 801.171787][T14784] ? __pfx_kthread+0x10/0x10 [ 801.171810][T14784] ret_from_fork+0x72b/0xd50 [ 801.171838][T14784] ? __pfx_ret_from_fork+0x10/0x10 [ 801.171868][T14784] ? __switch_to+0x800/0x1100 [ 801.171903][T14784] ? __switch_to_asm+0x39/0x70 [ 801.171936][T14784] ? __pfx_kthread+0x10/0x10 [ 801.171960][T14784] ret_from_fork_asm+0x1a/0x30 [ 801.172013][T14784] [ 801.172060][T14784] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 801.470197][T14784] Bluetooth: hci1: failed to register connection device [ 801.515312][T15255] vivid-008: ================== END STATUS ================== [ 801.826170][T15255] random: crng reseeded on system resumption [ 803.538640][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 803.568927][T15261] netlink: 2468 bytes leftover after parsing attributes in process `syz.0.2111'. [ 804.835702][T14784] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 804.847871][T14784] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 804.857366][T14784] CPU: 0 UID: 0 PID: 14784 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) [ 804.857398][T14784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 804.857415][T14784] Workqueue: hci1 hci_rx_work [ 804.857448][T14784] Call Trace: [ 804.857457][T14784] [ 804.857467][T14784] dump_stack_lvl+0x100/0x190 [ 804.857496][T14784] sysfs_warn_dup.cold+0x1c/0x28 [ 804.857533][T14784] sysfs_create_dir_ns+0x24b/0x2b0 [ 804.857561][T14784] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 804.857587][T14784] ? find_held_lock+0x2b/0x80 [ 804.857620][T14784] ? kobject_add_internal+0x25f/0x930 [ 804.857660][T14784] ? kobject_add_internal+0x25f/0x930 [ 804.857702][T14784] ? do_raw_spin_unlock+0x145/0x1e0 [ 804.857739][T14784] kobject_add_internal+0x2c8/0x930 [ 804.857783][T14784] kobject_add+0x16a/0x1e0 [ 804.857823][T14784] ? __pfx_kobject_add+0x10/0x10 [ 804.857861][T14784] ? class_to_subsys+0x10f/0x150 [ 804.857899][T14784] ? kobject_put+0xb9/0x640 [ 804.857934][T14784] ? _raw_spin_unlock+0x28/0x50 [ 804.857969][T14784] device_add+0x294/0x1950 [ 804.858001][T14784] ? __pfx_dev_set_name+0x10/0x10 [ 804.858038][T14784] ? __pfx_device_add+0x10/0x10 [ 804.858070][T14784] ? mgmt_send_event_skb+0x2fb/0x460 [ 804.858109][T14784] hci_conn_add_sysfs+0x1a3/0x260 [ 804.858146][T14784] le_conn_complete_evt+0x11eb/0x1f60 [ 804.858184][T14784] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 804.858213][T14784] ? __pfx_bt_warn+0x10/0x10 [ 804.858260][T14784] hci_le_conn_complete_evt+0x23c/0x3a0 [ 804.858292][T14784] ? skb_pull_data+0x15f/0x1e0 [ 804.858329][T14784] hci_le_meta_evt+0x34a/0x5f0 [ 804.858362][T14784] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 804.858398][T14784] hci_event_packet+0x51c/0xcd0 [ 804.858428][T14784] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 804.858462][T14784] ? __pfx_hci_event_packet+0x10/0x10 [ 804.858495][T14784] ? kcov_remote_start+0x374/0x660 [ 804.858532][T14784] ? lockdep_hardirqs_on+0x78/0x100 [ 804.858571][T14784] hci_rx_work+0x451/0xfc0 [ 804.858606][T14784] process_one_work+0xa0e/0x1980 [ 804.858645][T14784] ? __pfx_process_one_work+0x10/0x10 [ 804.858679][T14784] ? __pfx_hci_rx_work+0x10/0x10 [ 804.858717][T14784] worker_thread+0x5ef/0xe50 [ 804.858754][T14784] ? __pfx_worker_thread+0x10/0x10 [ 804.858780][T14784] ? kthread+0x13a/0x450 [ 804.858800][T14784] ? __pfx_worker_thread+0x10/0x10 [ 804.858824][T14784] kthread+0x370/0x450 [ 804.858844][T14784] ? __pfx_kthread+0x10/0x10 [ 804.858868][T14784] ret_from_fork+0x72b/0xd50 [ 804.858896][T14784] ? __pfx_ret_from_fork+0x10/0x10 [ 804.858925][T14784] ? __switch_to+0x800/0x1100 [ 804.858960][T14784] ? __switch_to_asm+0x39/0x70 [ 804.858994][T14784] ? __pfx_kthread+0x10/0x10 [ 804.859017][T14784] ret_from_fork_asm+0x1a/0x30 [ 804.859066][T14784] [ 804.859112][T14784] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 805.160342][T14784] Bluetooth: hci1: failed to register connection device [ 805.198347][T15301] vivid-008: ================= START STATUS ================= [ 805.244154][T15301] vivid-008: ================== END STATUS ================== [ 805.453212][T15304] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2119'. [ 805.504978][T15304] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2119'. [ 805.616950][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 806.402341][T15299] random: crng reseeded on system resumption [ 806.459401][T15314] openvswitch: &#$@\]\-: Dropping previously announced user features [ 806.925679][T15307] kexec: Could not allocate control_code_buffer [ 807.496198][T15332] syz.3.2126 uses obsolete (PF_INET,SOCK_PACKET) [ 807.696817][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 808.552291][T15347] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2130'. [ 808.627412][T15351] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2130'. [ 808.780163][T15352] openvswitch: &#$@\]\-: Dropping previously announced user features [ 808.903722][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.912976][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.776949][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 810.215402][T14784] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 810.408977][T14784] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 811.158322][T15401] block2mtd: illegal erase size [ 811.925094][T15408] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2143'. [ 811.986161][T15408] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2143'. [ 812.256733][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 812.497066][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 813.256211][T15387] kexec: Could not allocate control_code_buffer [ 814.336729][T14784] Bluetooth: hci2: command 0x0406 tx timeout [ 814.448436][T15428] openvswitch: &#$@\]\-: Dropping previously announced user features [ 814.576874][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 815.244728][T15438] netlink: 342 bytes leftover after parsing attributes in process `syz.3.2152'. [ 815.316332][T15432] netlink: 2468 bytes leftover after parsing attributes in process `syz.2.2151'. [ 815.332529][ T51] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 815.340398][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 815.349831][ T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 815.349864][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 815.349881][ T51] Workqueue: hci3 hci_rx_work [ 815.349913][ T51] Call Trace: [ 815.349921][ T51] [ 815.349930][ T51] dump_stack_lvl+0x100/0x190 [ 815.349958][ T51] sysfs_warn_dup.cold+0x1c/0x28 [ 815.349996][ T51] sysfs_create_dir_ns+0x24b/0x2b0 [ 815.350023][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 815.350049][ T51] ? find_held_lock+0x2b/0x80 [ 815.350082][ T51] ? kobject_add_internal+0x25f/0x930 [ 815.350122][ T51] ? kobject_add_internal+0x25f/0x930 [ 815.350164][ T51] ? do_raw_spin_unlock+0x145/0x1e0 [ 815.350195][ T51] kobject_add_internal+0x2c8/0x930 [ 815.350240][ T51] kobject_add+0x16a/0x1e0 [ 815.350279][ T51] ? __pfx_kobject_add+0x10/0x10 [ 815.350318][ T51] ? class_to_subsys+0x10f/0x150 [ 815.350356][ T51] ? kobject_put+0xb9/0x640 [ 815.350391][ T51] ? _raw_spin_unlock+0x28/0x50 [ 815.350427][ T51] device_add+0x294/0x1950 [ 815.350458][ T51] ? __pfx_dev_set_name+0x10/0x10 [ 815.350495][ T51] ? __pfx_device_add+0x10/0x10 [ 815.350527][ T51] ? mgmt_send_event_skb+0x2fb/0x460 [ 815.350565][ T51] hci_conn_add_sysfs+0x1a3/0x260 [ 815.350602][ T51] le_conn_complete_evt+0x11eb/0x1f60 [ 815.350641][ T51] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 815.350670][ T51] ? __pfx_bt_warn+0x10/0x10 [ 815.350717][ T51] hci_le_conn_complete_evt+0x23c/0x3a0 [ 815.350749][ T51] ? skb_pull_data+0x15f/0x1e0 [ 815.350793][ T51] hci_le_meta_evt+0x34a/0x5f0 [ 815.350826][ T51] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 815.350862][ T51] hci_event_packet+0x51c/0xcd0 [ 815.350893][ T51] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 815.350927][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 815.350960][ T51] ? kcov_remote_start+0x374/0x660 [ 815.350997][ T51] ? lockdep_hardirqs_on+0x78/0x100 [ 815.351036][ T51] hci_rx_work+0x451/0xfc0 [ 815.351071][ T51] process_one_work+0xa0e/0x1980 [ 815.351110][ T51] ? __pfx_process_one_work+0x10/0x10 [ 815.351148][ T51] ? __pfx_hci_rx_work+0x10/0x10 [ 815.351180][ T51] worker_thread+0x5ef/0xe50 [ 815.351216][ T51] ? kthread+0x13a/0x450 [ 815.351236][ T51] ? __pfx_worker_thread+0x10/0x10 [ 815.351259][ T51] kthread+0x370/0x450 [ 815.351292][ T51] ? __pfx_kthread+0x10/0x10 [ 815.351315][ T51] ret_from_fork+0x72b/0xd50 [ 815.351342][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 815.351370][ T51] ? __switch_to+0x800/0x1100 [ 815.351403][ T51] ? __switch_to_asm+0x39/0x70 [ 815.351436][ T51] ? __pfx_kthread+0x10/0x10 [ 815.351458][ T51] ret_from_fork_asm+0x1a/0x30 [ 815.351505][ T51] [ 815.351550][ T51] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 815.639984][T15444] vivid-008: ================= START STATUS ================= [ 815.656712][ T51] Bluetooth: hci3: failed to register connection device [ 815.759408][T15444] vivid-008: ================== END STATUS ================== [ 817.472597][T15441] random: crng reseeded on system resumption [ 817.696999][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 819.623103][T15484] FAULT_INJECTION: forcing a failure. [ 819.623103][T15484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 819.681131][T15484] CPU: 0 UID: 0 PID: 15484 Comm: syz.0.2161 Not tainted syzkaller #0 PREEMPT(full) [ 819.681164][T15484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 819.681179][T15484] Call Trace: [ 819.681186][T15484] [ 819.681195][T15484] dump_stack_lvl+0x100/0x190 [ 819.681225][T15484] should_fail_ex.cold+0x5/0xa [ 819.681257][T15484] _copy_from_user+0x2e/0xd0 [ 819.681299][T15484] snd_rawmidi_kernel_write1+0x390/0x7c0 [ 819.681350][T15484] snd_rawmidi_write+0x2dc/0xc60 [ 819.681397][T15484] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 819.681438][T15484] ? __pfx_default_wake_function+0x10/0x10 [ 819.681481][T15484] ? bpf_lsm_file_permission+0x9/0x10 [ 819.681505][T15484] ? security_file_permission+0x76/0x210 [ 819.681534][T15484] ? rw_verify_area+0xce/0x6d0 [ 819.681560][T15484] vfs_write+0x2aa/0x1070 [ 819.681589][T15484] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 819.681631][T15484] ? __pfx_vfs_write+0x10/0x10 [ 819.681656][T15484] ? find_held_lock+0x2b/0x80 [ 819.681688][T15484] ? __fget_files+0x215/0x3d0 [ 819.681715][T15484] ? __fget_files+0x215/0x3d0 [ 819.681748][T15484] ? __fget_files+0x21f/0x3d0 [ 819.681783][T15484] ksys_write+0x1f8/0x250 [ 819.681811][T15484] ? __pfx_ksys_write+0x10/0x10 [ 819.681841][T15484] ? rcu_is_watching+0x12/0xc0 [ 819.681874][T15484] do_syscall_64+0x10b/0xf80 [ 819.681905][T15484] ? clear_bhb_loop+0x40/0x90 [ 819.681935][T15484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 819.681960][T15484] RIP: 0033:0x7fe11379cdd9 [ 819.681979][T15484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 819.682002][T15484] RSP: 002b:00007fe1145f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 819.682024][T15484] RAX: ffffffffffffffda RBX: 00007fe113a15fa0 RCX: 00007fe11379cdd9 [ 819.682040][T15484] RDX: 000000100000a3d9 RSI: 00002000000000c0 RDI: 0000000000000009 [ 819.682055][T15484] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000000 [ 819.682070][T15484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 819.682085][T15484] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 819.682114][T15484] [ 820.235022][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 821.984566][T15508] FAULT_INJECTION: forcing a failure. [ 821.984566][T15508] name failslab, interval 1, probability 0, space 0, times 0 [ 822.088314][T15508] CPU: 0 UID: 0 PID: 15508 Comm: syz.0.2176 Not tainted syzkaller #0 PREEMPT(full) [ 822.088349][T15508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 822.088364][T15508] Call Trace: [ 822.088372][T15508] [ 822.088381][T15508] dump_stack_lvl+0x100/0x190 [ 822.088413][T15508] should_fail_ex.cold+0x5/0xa [ 822.088444][T15508] should_failslab+0xc2/0x120 [ 822.088474][T15508] __kvmalloc_node_noprof+0xfa/0xa00 [ 822.088499][T15508] ? io_uring_setup.cold+0x171/0x1c6e [ 822.088540][T15508] ? lockdep_init_map_type+0x5c/0x250 [ 822.088570][T15508] io_uring_setup.cold+0x171/0x1c6e [ 822.088615][T15508] ? __pfx_io_uring_setup+0x10/0x10 [ 822.088647][T15508] ? do_futex+0x192/0x350 [ 822.088674][T15508] ? __pfx_do_futex+0x10/0x10 [ 822.088718][T15508] ? xfd_validate_state+0x129/0x190 [ 822.088752][T15508] __x64_sys_io_uring_setup+0xc2/0x170 [ 822.088783][T15508] do_syscall_64+0x10b/0xf80 [ 822.088815][T15508] ? clear_bhb_loop+0x40/0x90 [ 822.088845][T15508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.088871][T15508] RIP: 0033:0x7fe11379cdd9 [ 822.088891][T15508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 822.088915][T15508] RSP: 002b:00007fe1145f2028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 822.088939][T15508] RAX: ffffffffffffffda RBX: 00007fe113a15fa0 RCX: 00007fe11379cdd9 [ 822.088955][T15508] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000059 [ 822.088970][T15508] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000000 [ 822.088985][T15508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 822.088999][T15508] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 822.089030][T15508] [ 822.925594][T14784] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 824.976882][T14784] Bluetooth: hci2: command 0x0406 tx timeout [ 826.278700][ T51] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 827.057074][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 828.336719][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 828.549945][T15580] openvswitch: &#$@\]\-: Dropping previously announced user features [ 829.439857][T14784] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 829.453006][T14784] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 829.462922][T14784] CPU: 0 UID: 0 PID: 14784 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT(full) [ 829.462955][T14784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 829.462973][T14784] Workqueue: hci1 hci_rx_work [ 829.463005][T14784] Call Trace: [ 829.463013][T14784] [ 829.463023][T14784] dump_stack_lvl+0x100/0x190 [ 829.463052][T14784] sysfs_warn_dup.cold+0x1c/0x28 [ 829.463090][T14784] sysfs_create_dir_ns+0x24b/0x2b0 [ 829.463117][T14784] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 829.463143][T14784] ? find_held_lock+0x2b/0x80 [ 829.463176][T14784] ? kobject_add_internal+0x25f/0x930 [ 829.463216][T14784] ? kobject_add_internal+0x25f/0x930 [ 829.463258][T14784] ? do_raw_spin_unlock+0x145/0x1e0 [ 829.463290][T14784] kobject_add_internal+0x2c8/0x930 [ 829.463334][T14784] kobject_add+0x16a/0x1e0 [ 829.463374][T14784] ? __pfx_kobject_add+0x10/0x10 [ 829.463412][T14784] ? class_to_subsys+0x10f/0x150 [ 829.463451][T14784] ? kobject_put+0xb9/0x640 [ 829.463486][T14784] ? _raw_spin_unlock+0x28/0x50 [ 829.463521][T14784] device_add+0x294/0x1950 [ 829.463553][T14784] ? __pfx_dev_set_name+0x10/0x10 [ 829.463591][T14784] ? __pfx_device_add+0x10/0x10 [ 829.463622][T14784] ? mgmt_send_event_skb+0x2fb/0x460 [ 829.463661][T14784] hci_conn_add_sysfs+0x1a3/0x260 [ 829.463707][T14784] le_conn_complete_evt+0x11eb/0x1f60 [ 829.463746][T14784] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 829.463776][T14784] ? __pfx_bt_warn+0x10/0x10 [ 829.463823][T14784] hci_le_conn_complete_evt+0x23c/0x3a0 [ 829.463856][T14784] ? skb_pull_data+0x15f/0x1e0 [ 829.463894][T14784] hci_le_meta_evt+0x34a/0x5f0 [ 829.463927][T14784] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 829.463962][T14784] hci_event_packet+0x51c/0xcd0 [ 829.463996][T14784] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 829.464030][T14784] ? __pfx_hci_event_packet+0x10/0x10 [ 829.464064][T14784] ? kcov_remote_start+0x374/0x660 [ 829.464101][T14784] ? lockdep_hardirqs_on+0x78/0x100 [ 829.464140][T14784] hci_rx_work+0x451/0xfc0 [ 829.464175][T14784] process_one_work+0xa0e/0x1980 [ 829.464214][T14784] ? __pfx_process_one_work+0x10/0x10 [ 829.464248][T14784] ? __pfx_hci_rx_work+0x10/0x10 [ 829.464281][T14784] worker_thread+0x5ef/0xe50 [ 829.464313][T14784] ? __pfx_worker_thread+0x10/0x10 [ 829.464340][T14784] ? kthread+0x13a/0x450 [ 829.464359][T14784] ? __pfx_worker_thread+0x10/0x10 [ 829.464383][T14784] kthread+0x370/0x450 [ 829.464403][T14784] ? __pfx_kthread+0x10/0x10 [ 829.464426][T14784] ret_from_fork+0x72b/0xd50 [ 829.464455][T14784] ? __pfx_ret_from_fork+0x10/0x10 [ 829.464483][T14784] ? __switch_to+0x800/0x1100 [ 829.464518][T14784] ? __switch_to_asm+0x39/0x70 [ 829.464551][T14784] ? __pfx_kthread+0x10/0x10 [ 829.464575][T14784] ret_from_fork_asm+0x1a/0x30 [ 829.464623][T14784] [ 829.464675][T14784] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 829.764496][T14784] Bluetooth: hci1: failed to register connection device [ 829.888676][T15600] vivid-008: ================= START STATUS ================= [ 830.100730][T15600] vivid-008: ================== END STATUS ================== [ 830.277869][T15595] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2190'. [ 830.418339][T14784] Bluetooth: hci0: command 0x0406 tx timeout [ 831.776699][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 833.369663][T15644] openvswitch: &#$@\]\-: Dropping previously announced user features [ 833.856936][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 835.132493][T15658] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 835.213676][T15658] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 835.345858][T15658] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 835.372328][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.429589][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.467812][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.493715][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.514322][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.539236][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.561498][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.594490][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.643550][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.690253][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.743805][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.792929][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.851606][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.914666][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.943370][T15658] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 835.989075][T15658] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 836.018376][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.062972][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.114443][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.144461][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.173553][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.211358][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.253498][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.292563][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.331137][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.369362][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.412255][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.439800][ T51] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 836.465926][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.529087][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.571966][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.604998][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.647216][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.683923][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.731505][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.755677][T15687] openvswitch: &#$@\]\-: Dropping previously announced user features [ 836.779860][T15658] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 836.812645][T15658] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 836.837737][T15658] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 837.136975][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 837.377209][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 838.016775][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 838.403642][ T30] audit: type=1800 audit(1843104697.630:9): pid=15693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2211" name="members" dev="configfs" ino=53237 res=0 errno=0 [ 838.823001][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 839.219050][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 839.457290][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 840.097157][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 840.178015][T15730] vivid-008: ================= START STATUS ================= [ 840.244592][T15730] vivid-008: ================== END STATUS ================== [ 840.896761][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 841.296897][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 841.541046][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 841.572994][T15730] random: crng reseeded on system resumption [ 841.692892][T15737] openvswitch: &#$@\]\-: Dropping previously announced user features [ 842.177022][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 842.614932][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 843.380433][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 843.617042][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 844.257946][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 844.656734][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 845.058332][T15788] openvswitch: &#$@\]\-: Dropping previously announced user features [ 845.697251][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 846.336888][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 846.384579][T15804] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2234'. [ 846.475379][T15805] netlink: 354 bytes leftover after parsing attributes in process `syz.3.2234'. [ 846.736918][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 847.553979][T15815] openvswitch: &#$@\]\-: Dropping previously announced user features [ 847.777272][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 848.416643][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 849.857281][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 850.496699][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 850.732625][T15851] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2247'. [ 850.786100][T15854] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2247'. [ 851.939951][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 852.121896][T15871] openvswitch: &#$@\]\-: Dropping previously announced user features [ 852.576790][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 854.017880][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 854.658737][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 855.397206][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 856.099411][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 856.738862][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 857.460853][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 857.796768][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 857.804741][ T5642] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:0' [ 857.814161][ T5642] CPU: 0 UID: 0 PID: 5642 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) [ 857.814192][ T5642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 857.814209][ T5642] Workqueue: hci2 hci_rx_work [ 857.814242][ T5642] Call Trace: [ 857.814249][ T5642] [ 857.814258][ T5642] dump_stack_lvl+0x100/0x190 [ 857.814286][ T5642] sysfs_warn_dup.cold+0x1c/0x28 [ 857.814322][ T5642] sysfs_create_dir_ns+0x24b/0x2b0 [ 857.814348][ T5642] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 857.814372][ T5642] ? find_held_lock+0x2b/0x80 [ 857.814409][ T5642] ? kobject_add_internal+0x25f/0x930 [ 857.814448][ T5642] ? kobject_add_internal+0x25f/0x930 [ 857.814489][ T5642] ? do_raw_spin_unlock+0x145/0x1e0 [ 857.814519][ T5642] kobject_add_internal+0x2c8/0x930 [ 857.814562][ T5642] kobject_add+0x16a/0x1e0 [ 857.814600][ T5642] ? __pfx_kobject_add+0x10/0x10 [ 857.814637][ T5642] ? class_to_subsys+0x10f/0x150 [ 857.814673][ T5642] ? kobject_put+0xb9/0x640 [ 857.814707][ T5642] ? _raw_spin_unlock+0x28/0x50 [ 857.814741][ T5642] device_add+0x294/0x1950 [ 857.814772][ T5642] ? __pfx_dev_set_name+0x10/0x10 [ 857.814808][ T5642] ? __pfx_device_add+0x10/0x10 [ 857.814839][ T5642] ? mgmt_send_event_skb+0x2fb/0x460 [ 857.814876][ T5642] hci_conn_add_sysfs+0x1a3/0x260 [ 857.814911][ T5642] le_conn_complete_evt+0x11eb/0x1f60 [ 857.814948][ T5642] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 857.814976][ T5642] ? __pfx_bt_warn+0x10/0x10 [ 857.815021][ T5642] hci_le_conn_complete_evt+0x23c/0x3a0 [ 857.815053][ T5642] ? skb_pull_data+0x15f/0x1e0 [ 857.815088][ T5642] hci_le_meta_evt+0x34a/0x5f0 [ 857.815120][ T5642] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 857.815154][ T5642] hci_event_packet+0x51c/0xcd0 [ 857.815183][ T5642] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 857.815216][ T5642] ? __pfx_hci_event_packet+0x10/0x10 [ 857.815248][ T5642] ? kcov_remote_start+0x374/0x660 [ 857.815284][ T5642] ? lockdep_hardirqs_on+0x78/0x100 [ 857.815322][ T5642] hci_rx_work+0x451/0xfc0 [ 857.815356][ T5642] process_one_work+0xa0e/0x1980 [ 857.815393][ T5642] ? __pfx_process_one_work+0x10/0x10 [ 857.815432][ T5642] ? __pfx_hci_rx_work+0x10/0x10 [ 857.815464][ T5642] worker_thread+0x5ef/0xe50 [ 857.815499][ T5642] ? kthread+0x13a/0x450 [ 857.815518][ T5642] ? __pfx_worker_thread+0x10/0x10 [ 857.815544][ T5642] kthread+0x370/0x450 [ 857.815565][ T5642] ? __pfx_kthread+0x10/0x10 [ 857.815587][ T5642] ret_from_fork+0x72b/0xd50 [ 857.815615][ T5642] ? __pfx_ret_from_fork+0x10/0x10 [ 857.815642][ T5642] ? __switch_to+0x800/0x1100 [ 857.815695][ T5642] ? __switch_to_asm+0x39/0x70 [ 857.815729][ T5642] ? __pfx_kthread+0x10/0x10 [ 857.815752][ T5642] ret_from_fork_asm+0x1a/0x30 [ 857.815800][ T5642] [ 857.815845][ T5642] kobject: kobject_add_internal failed for hci2:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 858.116595][ T5642] Bluetooth: hci2: failed to register connection device [ 858.180205][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 858.820225][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 858.828982][ T5642] Bluetooth: hci1: unexpected event 0x31 length: 19 > 6 [ 859.540909][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 860.261344][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 860.695642][T15959] openvswitch: &#$@\]\-: Dropping previously announced user features [ 860.902075][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 861.577390][T15967] openvswitch: &#$@\]\-: Dropping previously announced user features [ 861.622474][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 862.023877][T15971] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2284'. [ 862.342582][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 862.986614][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 863.265959][ T5642] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 863.703176][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 864.423207][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 865.063818][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 865.306449][T14784] Bluetooth: hci0: command 0x0406 tx timeout [ 866.504213][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 867.144567][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 867.385232][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 868.127026][T16046] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2290'. [ 868.195506][T16046] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2290'. [ 868.480082][T14784] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 868.495028][T16053] vivid-008: ================= START STATUS ================= [ 868.537815][T16053] vivid-008: ================== END STATUS ================== [ 868.585409][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 869.225026][T14784] Bluetooth: hci3: command 0x0406 tx timeout [ 869.932108][T16050] random: crng reseeded on system resumption [ 870.348665][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.360106][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.656014][ T5642] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 871.306318][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 872.747419][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 872.792900][T16105] openvswitch: &#$@\]\-: Dropping previously announced user features [ 873.387277][T14784] Bluetooth: hci3: command 0x0406 tx timeout [ 874.026112][T16117] openvswitch: &#$@\]\-: Dropping previously announced user features [ 874.828249][T14784] Bluetooth: hci2: command 0x0406 tx timeout [ 875.469925][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 877.052942][T16156] vivid-008: ================= START STATUS ================= [ 877.313805][T16156] vivid-008: ================== END STATUS ================== [ 877.550492][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 879.631588][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 881.711702][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 882.233749][T16193] NFSD: Failed to start, no listeners configured. [ 884.188853][T16225] openvswitch: &#$@\]\-: Dropping previously announced user features [ 886.368337][T16253] NFSD: Failed to start, no listeners configured. [ 888.202477][T16283] netlink: 29 bytes leftover after parsing attributes in process `syz.2.2340'. [ 892.058297][ T5642] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 892.081868][T16321] vivid-008: ================= START STATUS ================= [ 892.151770][T16321] vivid-008: ================== END STATUS ================== [ 892.273613][T16326] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2353'. [ 892.979064][T16321] random: crng reseeded on system resumption [ 894.118033][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 896.199966][T14784] Bluetooth: hci3: command 0x0406 tx timeout [ 897.476283][T16384] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2362'. [ 897.520961][T16384] netlink: 342 bytes leftover after parsing attributes in process `syz.2.2362'. [ 898.257741][T16398] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2368'. [ 898.302528][T16398] netlink: 354 bytes leftover after parsing attributes in process `syz.2.2368'. [ 898.600329][T16407] netlink: 29 bytes leftover after parsing attributes in process `syz.2.2370'. [ 899.034983][T16411] openvswitch: &#$@\]\-: Dropping previously announced user features [ 901.759176][T16462] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2384'. [ 901.864901][T16462] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 902.068254][T16462] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 902.158979][T16461] openvswitch: &#$@\]\-: Dropping previously announced user features [ 903.790001][T16491] netlink: 186 bytes leftover after parsing attributes in process `syz.0.2392'. [ 903.829111][T16490] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2391'. [ 903.880409][T16487] can: request_module (can-proto-5) failed. [ 903.925565][T16494] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2391'. [ 904.015464][ T5642] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 904.041732][T16496] vivid-008: ================= START STATUS ================= [ 904.129684][T16496] vivid-008: ================== END STATUS ================== [ 904.757843][T16508] netlink: 29 bytes leftover after parsing attributes in process `syz.0.2396'. [ 905.155314][T16495] random: crng reseeded on system resumption [ 906.044179][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 906.686539][T14784] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 906.921860][T16544] netlink: 29 bytes leftover after parsing attributes in process `syz.0.2406'. [ 908.130069][T14784] Bluetooth: hci1: command 0x0406 tx timeout [ 908.765006][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 908.964023][T16573] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2413'. [ 910.846904][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 911.185247][T16587] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2416'. [ 911.447137][T16589] netlink: 29 bytes leftover after parsing attributes in process `syz.1.2417'. [ 911.923989][T16597] openvswitch: &#$@\]\-: Dropping previously announced user features [ 912.621847][T16611] capability: warning: `syz.0.2423' uses 32-bit capabilities (legacy support in use) [ 912.996272][T16617] random: crng reseeded on system resumption [ 913.498877][T16617] netlink: 25 bytes leftover after parsing attributes in process `syz.3.2425'. [ 914.055963][T16631] openvswitch: &#$@\]\-: Dropping previously announced user features [ 914.782370][T16644] openvswitch: &#$@\]\-: Dropping previously announced user features [ 914.929026][T16648] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2434'. [ 915.886846][T16653] netlink: 350 bytes leftover after parsing attributes in process `syz.3.2435'. [ 915.903770][T16658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2438'. [ 915.937573][T16658] netlink: 354 bytes leftover after parsing attributes in process `syz.1.2438'. [ 920.085014][T16704] FAULT_INJECTION: forcing a failure. [ 920.085014][T16704] name failslab, interval 1, probability 0, space 0, times 0 [ 920.240288][T16704] CPU: 0 UID: 0 PID: 16704 Comm: syz.3.2450 Tainted: G L syzkaller #0 PREEMPT(full) [ 920.240328][T16704] Tainted: [L]=SOFTLOCKUP [ 920.240337][T16704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 920.240353][T16704] Call Trace: [ 920.240360][T16704] [ 920.240369][T16704] dump_stack_lvl+0x100/0x190 [ 920.240401][T16704] should_fail_ex.cold+0x5/0xa [ 920.240435][T16704] should_failslab+0xc2/0x120 [ 920.240465][T16704] __kvmalloc_node_noprof+0xfa/0xa00 [ 920.240496][T16704] ? alloc_netdev_mqs+0xf0e/0x1560 [ 920.240530][T16704] alloc_netdev_mqs+0xf0e/0x1560 [ 920.240564][T16704] ppp_ioctl+0x954/0x27c0 [ 920.240606][T16704] ? find_held_lock+0x2b/0x80 [ 920.240639][T16704] ? __pfx_ppp_ioctl+0x10/0x10 [ 920.240682][T16704] ? __fget_files+0x21f/0x3d0 [ 920.240716][T16704] ? __pfx_ppp_ioctl+0x10/0x10 [ 920.240755][T16704] __x64_sys_ioctl+0x18e/0x210 [ 920.240782][T16704] do_syscall_64+0x10b/0xf80 [ 920.240814][T16704] ? clear_bhb_loop+0x40/0x90 [ 920.240844][T16704] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 920.240877][T16704] RIP: 0033:0x7fd85a99cdd9 [ 920.240897][T16704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 920.240922][T16704] RSP: 002b:00007fd858bee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 920.240945][T16704] RAX: ffffffffffffffda RBX: 00007fd85ac15fa0 RCX: 00007fd85a99cdd9 [ 920.240962][T16704] RDX: 0000000000000000 RSI: 00000000c004743e RDI: 000000000000000e [ 920.240977][T16704] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 920.240992][T16704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 920.241006][T16704] R13: 00007fd85ac16038 R14: 00007fd85ac15fa0 R15: 00007ffe16a7c238 [ 920.241038][T16704] [ 922.915131][T16717] openvswitch: &#$@\]\-: Dropping previously announced user features [ 928.036783][ T51] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 928.963769][T16817] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2475'. [ 930.055681][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 931.817913][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.829649][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.140780][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 936.118659][T16900] netlink: 186 bytes leftover after parsing attributes in process `syz.2.2491'. [ 937.943182][T16926] netlink: 342 bytes leftover after parsing attributes in process `syz.1.2496'. [ 939.607258][ T51] Bluetooth: hci2: unexpected subevent 0x01 length: 123 > 18 [ 939.663689][T16954] zswap: compressor not available [ 941.091173][ T51] Bluetooth: hci1: unexpected subevent 0x05 length: 123 > 12 [ 941.295680][T16980] netlink: 29 bytes leftover after parsing attributes in process `syz.1.2510'. [ 941.663275][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 943.101975][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 943.743562][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 943.929514][T17007] netlink: 'syz.0.2518': attribute type 1 has an invalid length. [ 943.948026][T17017] netlink: 25 bytes leftover after parsing attributes in process `syz.1.2520'. [ 943.997273][T17007] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2518'. [ 945.004494][T17033] netlink: 342 bytes leftover after parsing attributes in process `syz.3.2524'. [ 946.926509][T17037] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 946.992846][T17037] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 947.060621][T17037] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 947.137860][T17037] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 948.063272][T17081] netlink: 2468 bytes leftover after parsing attributes in process `syz.2.2535'. [ 948.464701][ T5642] Bluetooth: hci0: command 0x0406 tx timeout [ 949.025771][ T5642] Bluetooth: hci1: command 0x0406 tx timeout [ 949.105423][ T5642] Bluetooth: hci3: command 0x0406 tx timeout [ 949.135681][T17096] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2547'. [ 949.185510][ T5642] Bluetooth: hci2: command 0x0406 tx timeout [ 949.246012][T17098] HfR: entered promiscuous mode [ 949.399482][T17096] i: entered promiscuous mode [ 951.590503][T17135] netlink: 342 bytes leftover after parsing attributes in process `syz.0.2548'. [ 953.658575][T17154] bridge0: port 1(gretap0) entered blocking state [ 953.690857][T17154] bridge0: port 1(gretap0) entered disabled state [ 953.733607][T17154] gretap0: entered allmulticast mode [ 953.779762][T17154] FAULT_INJECTION: forcing a failure. [ 953.779762][T17154] name failslab, interval 1, probability 0, space 0, times 0 [ 953.833291][T17154] CPU: 0 UID: 0 PID: 17154 Comm: syz.3.2553 Tainted: G L syzkaller #0 PREEMPT(full) [ 953.833331][T17154] Tainted: [L]=SOFTLOCKUP [ 953.833340][T17154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 953.833355][T17154] Call Trace: [ 953.833363][T17154] [ 953.833372][T17154] dump_stack_lvl+0x100/0x190 [ 953.833404][T17154] should_fail_ex.cold+0x5/0xa [ 953.833436][T17154] should_failslab+0xc2/0x120 [ 953.833466][T17154] __kmalloc_cache_noprof+0x7a/0x6f0 [ 953.833503][T17154] ? __netdev_adjacent_dev_insert+0x22b/0xbf0 [ 953.833545][T17154] ? sysfs_do_create_link_sd+0xbb/0x140 [ 953.833578][T17154] __netdev_adjacent_dev_insert+0x22b/0xbf0 [ 953.833624][T17154] ? __pfx___netdev_adjacent_dev_insert+0x10/0x10 [ 953.833678][T17154] __netdev_upper_dev_link+0x413/0x7e0 [ 953.833717][T17154] ? __pfx___netdev_upper_dev_link+0x10/0x10 [ 953.833750][T17154] ? kernfs_root+0xf8/0x2a0 [ 953.833780][T17154] ? kernfs_add_one+0x214/0x850 [ 953.833820][T17154] netdev_master_upper_dev_link+0x9f/0xd0 [ 953.833856][T17154] ? __pfx_netdev_master_upper_dev_link+0x10/0x10 [ 953.833901][T17154] ? lockdep_rtnl_is_held+0x26/0x40 [ 953.833937][T17154] ? netdev_is_rx_handler_busy+0x83/0x140 [ 953.833970][T17154] br_add_if+0x9fd/0x1b40 [ 953.834013][T17154] ? security_capable+0x80/0x260 [ 953.834054][T17154] add_del_if+0x114/0x160 [ 953.834078][T17154] br_dev_siocdevprivate+0x8ac/0x1650 [ 953.834107][T17154] ? __pfx_br_dev_siocdevprivate+0x10/0x10 [ 953.834138][T17154] ? do_raw_spin_lock+0x128/0x260 [ 953.834169][T17154] ? find_held_lock+0x2b/0x80 [ 953.834201][T17154] ? debug_mutex_remove_waiter+0xa8/0x320 [ 953.834233][T17154] ? debug_mutex_remove_waiter+0xa8/0x320 [ 953.834276][T17154] ? netdev_name_node_lookup+0x107/0x150 [ 953.834318][T17154] ? __mutex_lock+0x838/0x1b10 [ 953.834356][T17154] dev_ifsioc+0xc2f/0x1f10 [ 953.834383][T17154] ? __pfx_dev_ifsioc+0x10/0x10 [ 953.834405][T17154] ? __pfx___mutex_lock+0x10/0x10 [ 953.834449][T17154] ? dev_load+0x8e/0x240 [ 953.834470][T17154] ? dev_load+0x8e/0x240 [ 953.834498][T17154] dev_ioctl+0x70e/0x1070 [ 953.834524][T17154] sock_ioctl+0x494/0x6b0 [ 953.834561][T17154] ? __pfx_sock_ioctl+0x10/0x10 [ 953.834595][T17154] ? hook_file_ioctl_common+0x149/0x410 [ 953.834628][T17154] ? __fget_files+0x21f/0x3d0 [ 953.834662][T17154] ? __pfx_sock_ioctl+0x10/0x10 [ 953.834699][T17154] __x64_sys_ioctl+0x18e/0x210 [ 953.834726][T17154] do_syscall_64+0x10b/0xf80 [ 953.834758][T17154] ? clear_bhb_loop+0x40/0x90 [ 953.834788][T17154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 953.834814][T17154] RIP: 0033:0x7fd85a99cdd9 [ 953.834834][T17154] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 953.834858][T17154] RSP: 002b:00007fd858bcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 953.834886][T17154] RAX: ffffffffffffffda RBX: 00007fd85ac16090 RCX: 00007fd85a99cdd9 [ 953.834902][T17154] RDX: 0000200000000040 RSI: 00000000000089fc RDI: 000000000000000a [ 953.834917][T17154] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 953.834932][T17154] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 953.834947][T17154] R13: 00007fd85ac16128 R14: 00007fd85ac16090 R15: 00007ffe16a7c238 [ 953.834978][T17154] [ 954.730724][T17154] gretap0: left allmulticast mode [ 955.173428][T17168] netlink: 29 bytes leftover after parsing attributes in process `syz.3.2559'. [ 956.187599][T17176] netlink: 'syz.3.2561': attribute type 1 has an invalid length. [ 956.187627][T17176] netlink: 9 bytes leftover after parsing attributes in process `syz.3.2561'. [ 957.870371][T17208] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2570'. [ 958.167566][T17214] HfR: entered promiscuous mode [ 958.412914][T17208] i: entered promiscuous mode [ 961.278160][T17256] FAULT_INJECTION: forcing a failure. [ 961.278160][T17256] name failslab, interval 1, probability 0, space 0, times 0 [ 961.339049][T17256] CPU: 0 UID: 0 PID: 17256 Comm: syz.3.2583 Tainted: G L syzkaller #0 PREEMPT(full) [ 961.339089][T17256] Tainted: [L]=SOFTLOCKUP [ 961.339098][T17256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 961.339113][T17256] Call Trace: [ 961.339121][T17256] [ 961.339130][T17256] dump_stack_lvl+0x100/0x190 [ 961.339162][T17256] should_fail_ex.cold+0x5/0xa [ 961.339193][T17256] should_failslab+0xc2/0x120 [ 961.339230][T17256] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 961.339271][T17256] ? __proc_create+0x2cb/0x8c0 [ 961.339309][T17256] __proc_create+0x2cb/0x8c0 [ 961.339342][T17256] ? __pfx___proc_create+0x10/0x10 [ 961.339386][T17256] proc_create_reg+0x75/0x170 [ 961.339423][T17256] proc_create_net_data+0x8e/0x1c0 [ 961.339458][T17256] ? __pfx_proc_create_net_data+0x10/0x10 [ 961.339491][T17256] ? net_generic+0xea/0x2a0 [ 961.339521][T17256] ? __pfx_phonet_init_net+0x10/0x10 [ 961.339546][T17256] phonet_init_net+0x66/0x120 [ 961.339570][T17256] ops_init+0x1e2/0x5f0 [ 961.339601][T17256] setup_net+0x118/0x3a0 [ 961.339630][T17256] ? __pfx_setup_net+0x10/0x10 [ 961.339658][T17256] ? mutex_init_lockdep+0xf1/0x120 [ 961.339690][T17256] copy_net_ns+0x46f/0x7c0 [ 961.339725][T17256] create_new_namespaces+0x3ea/0xac0 [ 961.339765][T17256] unshare_nsproxy_namespaces+0xf2/0x220 [ 961.339801][T17256] ksys_unshare+0x438/0xab0 [ 961.339841][T17256] ? __pfx_ksys_unshare+0x10/0x10 [ 961.339878][T17256] ? xfd_validate_state+0x129/0x190 [ 961.339917][T17256] __x64_sys_unshare+0x31/0x40 [ 961.339955][T17256] do_syscall_64+0x10b/0xf80 [ 961.339987][T17256] ? clear_bhb_loop+0x40/0x90 [ 961.340017][T17256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.340043][T17256] RIP: 0033:0x7fd85a99cdd9 [ 961.340062][T17256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.340086][T17256] RSP: 002b:00007fd858bee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 961.340109][T17256] RAX: ffffffffffffffda RBX: 00007fd85ac15fa0 RCX: 00007fd85a99cdd9 [ 961.340125][T17256] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 961.340140][T17256] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 961.340155][T17256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 961.340169][T17256] R13: 00007fd85ac16038 R14: 00007fd85ac15fa0 R15: 00007ffe16a7c238 [ 961.340201][T17256] [ 963.916600][T17289] FAULT_INJECTION: forcing a failure. [ 963.916600][T17289] name failslab, interval 1, probability 0, space 0, times 0 [ 963.947404][T17289] CPU: 0 UID: 0 PID: 17289 Comm: syz.0.2591 Tainted: G L syzkaller #0 PREEMPT(full) [ 963.947444][T17289] Tainted: [L]=SOFTLOCKUP [ 963.947452][T17289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 963.947468][T17289] Call Trace: [ 963.947475][T17289] [ 963.947484][T17289] dump_stack_lvl+0x100/0x190 [ 963.947515][T17289] should_fail_ex.cold+0x5/0xa [ 963.947546][T17289] should_failslab+0xc2/0x120 [ 963.947575][T17289] __kmalloc_cache_noprof+0x7a/0x6f0 [ 963.947612][T17289] ? device_add+0xd3a/0x1950 [ 963.947650][T17289] device_add+0xd3a/0x1950 [ 963.947678][T17289] ? dev_set_name+0xc7/0x100 [ 963.947714][T17289] ? __pfx_dev_set_name+0x10/0x10 [ 963.947753][T17289] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 963.947791][T17289] ? __pfx_device_add+0x10/0x10 [ 963.947822][T17289] ? lockdep_init_map_type+0x5c/0x250 [ 963.947848][T17289] ? __init_waitqueue_head+0xca/0x150 [ 963.947884][T17289] netdev_register_kobject+0x1a9/0x3d0 [ 963.947923][T17289] register_netdevice+0x151c/0x24b0 [ 963.947959][T17289] ? __pfx_register_netdevice+0x10/0x10 [ 963.947986][T17289] ? net_generic+0xea/0x2a0 [ 963.948036][T17289] ppp_dev_configure+0x986/0xcb0 [ 963.948081][T17289] ppp_ioctl+0x9d7/0x27c0 [ 963.948121][T17289] ? find_held_lock+0x2b/0x80 [ 963.948155][T17289] ? __pfx_ppp_ioctl+0x10/0x10 [ 963.948198][T17289] ? __fget_files+0x21f/0x3d0 [ 963.948232][T17289] ? __pfx_ppp_ioctl+0x10/0x10 [ 963.948271][T17289] __x64_sys_ioctl+0x18e/0x210 [ 963.948298][T17289] do_syscall_64+0x10b/0xf80 [ 963.948330][T17289] ? clear_bhb_loop+0x40/0x90 [ 963.948360][T17289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 963.948386][T17289] RIP: 0033:0x7fe11379cdd9 [ 963.948406][T17289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 963.948431][T17289] RSP: 002b:00007fe1145f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 963.948454][T17289] RAX: ffffffffffffffda RBX: 00007fe113a15fa0 RCX: 00007fe11379cdd9 [ 963.948471][T17289] RDX: 0000000000000000 RSI: 00000000c004743e RDI: 000000000000000b [ 963.948486][T17289] RBP: 00007fe113832d69 R08: 0000000000000000 R09: 0000000000000000 [ 963.948501][T17289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 963.948515][T17289] R13: 00007fe113a16038 R14: 00007fe113a15fa0 R15: 00007ffe5496c398 [ 963.948546][T17289] [ 967.537209][T17340] ================================================================== [ 967.537230][T17340] BUG: KASAN: use-after-free in fbcon_prepare_logo+0x94e/0xc60 [ 967.537267][T17340] Read of size 26 at addr ffff88806b16a7e8 by task syz.3.2604/17340 [ 967.537287][T17340] [ 967.537301][T17340] CPU: 0 UID: 0 PID: 17340 Comm: syz.3.2604 Tainted: G L syzkaller #0 PREEMPT(full) [ 967.537336][T17340] Tainted: [L]=SOFTLOCKUP [ 967.537344][T17340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 967.537360][T17340] Call Trace: [ 967.537368][T17340] [ 967.537377][T17340] dump_stack_lvl+0x100/0x190 [ 967.537402][T17340] print_report+0x13d/0x4b0 [ 967.537439][T17340] ? __virt_addr_valid+0x239/0x430 [ 967.537482][T17340] ? fbcon_prepare_logo+0x94e/0xc60 [ 967.537508][T17340] kasan_report+0xdf/0x1d0 [ 967.537536][T17340] ? fbcon_prepare_logo+0x94e/0xc60 [ 967.537567][T17340] kasan_check_range+0x10f/0x1e0 [ 967.537602][T17340] __asan_memcpy+0x23/0x60 [ 967.537640][T17340] fbcon_prepare_logo+0x94e/0xc60 [ 967.537672][T17340] fbcon_init+0x1065/0x1830 [ 967.537702][T17340] visual_init+0x320/0x620 [ 967.537739][T17340] do_bind_con_driver.isra.0+0x636/0x9c0 [ 967.537780][T17340] store_bind+0x609/0x730 [ 967.537818][T17340] ? __pfx_store_bind+0x10/0x10 [ 967.537852][T17340] dev_attr_store+0x58/0x80 [ 967.537884][T17340] ? __pfx_dev_attr_store+0x10/0x10 [ 967.537915][T17340] sysfs_kf_write+0xf2/0x150 [ 967.537956][T17340] kernfs_fop_write_iter+0x3e0/0x5f0 [ 967.537991][T17340] ? __pfx_sysfs_kf_write+0x10/0x10 [ 967.538032][T17340] vfs_write+0x6ac/0x1070 [ 967.538061][T17340] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 967.538098][T17340] ? __pfx_vfs_write+0x10/0x10 [ 967.538135][T17340] ksys_write+0x12a/0x250 [ 967.538163][T17340] ? __pfx_ksys_write+0x10/0x10 [ 967.538192][T17340] ? rcu_is_watching+0x12/0xc0 [ 967.538224][T17340] do_syscall_64+0x10b/0xf80 [ 967.538256][T17340] ? clear_bhb_loop+0x40/0x90 [ 967.538284][T17340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.538310][T17340] RIP: 0033:0x7fd85a99cdd9 [ 967.538328][T17340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.538353][T17340] RSP: 002b:00007fd858bcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 967.538377][T17340] RAX: ffffffffffffffda RBX: 00007fd85ac16090 RCX: 00007fd85a99cdd9 [ 967.538394][T17340] RDX: 000000000008083a RSI: 00002000000000c0 RDI: 0000000000000007 [ 967.538410][T17340] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 967.538425][T17340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 967.538441][T17340] R13: 00007fd85ac16128 R14: 00007fd85ac16090 R15: 00007ffe16a7c238 [ 967.538465][T17340] [ 967.538474][T17340] [ 967.538484][T17340] The buggy address belongs to the physical page: [ 967.538498][T17340] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806b16a280 pfn:0x6b16a [ 967.538524][T17340] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 967.538547][T17340] page_type: f0(buddy) [ 967.538567][T17340] raw: 00fff00000000000 ffffea0000abe408 ffffea0001a33b88 0000000000000000 [ 967.538590][T17340] raw: ffff88806b16a280 0000000000000001 00000000f0000000 0000000000000000 [ 967.538604][T17340] page dumped because: kasan: bad access detected [ 967.538619][T17340] page_owner tracks the page as freed [ 967.538627][T17340] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x10cc0(GFP_KERNEL|__GFP_NORETRY), pid 15387, tgid 15386 (syz.3.2141), ts 811491348568, free_ts 812818959948 [ 967.538669][T17340] post_alloc_hook+0x153/0x170 [ 967.538705][T17340] get_page_from_freelist+0x11a6/0x33b0 [ 967.538750][T17340] __alloc_frozen_pages_noprof+0x27c/0x2bc0 [ 967.538790][T17340] alloc_pages_mpol+0x1fb/0x540 [ 967.538816][T17340] alloc_pages_noprof+0x1a/0x160 [ 967.538848][T17340] kimage_alloc_pages+0x72/0x380 [ 967.538881][T17340] kimage_alloc_control_pages+0x157/0xa20 [ 967.538918][T17340] do_kexec_load+0x275/0x810 [ 967.538955][T17340] __x64_sys_kexec_load+0x1bf/0x230 [ 967.538993][T17340] do_syscall_64+0x10b/0xf80 [ 967.539024][T17340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.539048][T17340] page last free pid 15387 tgid 15386 stack trace: [ 967.539061][T17340] __free_frozen_pages+0x747/0x1040 [ 967.539094][T17340] kimage_free_page_list+0x130/0x240 [ 967.539129][T17340] kimage_alloc_control_pages+0x3f2/0xa20 [ 967.539165][T17340] do_kexec_load+0x275/0x810 [ 967.539202][T17340] __x64_sys_kexec_load+0x1bf/0x230 [ 967.539240][T17340] do_syscall_64+0x10b/0xf80 [ 967.539271][T17340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.539294][T17340] [ 967.539300][T17340] Memory state around the buggy address: [ 967.539312][T17340] ffff88806b16a680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 967.539334][T17340] ffff88806b16a700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 967.539351][T17340] >ffff88806b16a780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 967.539365][T17340] ^ [ 967.539379][T17340] ffff88806b16a800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 967.539396][T17340] ffff88806b16a880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 967.539410][T17340] ================================================================== [ 967.543511][T17340] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 967.543536][T17340] CPU: 0 UID: 0 PID: 17340 Comm: syz.3.2604 Tainted: G L syzkaller #0 PREEMPT(full) [ 967.543572][T17340] Tainted: [L]=SOFTLOCKUP [ 967.543581][T17340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 967.543597][T17340] Call Trace: [ 967.543605][T17340] [ 967.543615][T17340] dump_stack_lvl+0x100/0x190 [ 967.543644][T17340] vpanic+0x552/0x970 [ 967.543668][T17340] ? __pfx_vpanic+0x10/0x10 [ 967.543695][T17340] ? fbcon_prepare_logo+0x94e/0xc60 [ 967.543722][T17340] panic+0xd1/0xe0 [ 967.543751][T17340] ? __pfx_panic+0x10/0x10 [ 967.543776][T17340] ? fbcon_prepare_logo+0x94e/0xc60 [ 967.543802][T17340] ? preempt_schedule_common+0x42/0xc0 [ 967.543838][T17340] check_panic_on_warn.cold+0x19/0x34 [ 967.543874][T17340] end_report.part.0+0x3a/0x90 [ 967.543911][T17340] kasan_report.cold+0xe/0x18 [ 967.543948][T17340] ? fbcon_prepare_logo+0x94e/0xc60 [ 967.543979][T17340] kasan_check_range+0x10f/0x1e0 [ 967.544013][T17340] __asan_memcpy+0x23/0x60 [ 967.544054][T17340] fbcon_prepare_logo+0x94e/0xc60 [ 967.544088][T17340] fbcon_init+0x1065/0x1830 [ 967.544118][T17340] visual_init+0x320/0x620 [ 967.544149][T17340] do_bind_con_driver.isra.0+0x636/0x9c0 [ 967.544189][T17340] store_bind+0x609/0x730 [ 967.544227][T17340] ? __pfx_store_bind+0x10/0x10 [ 967.544260][T17340] dev_attr_store+0x58/0x80 [ 967.544290][T17340] ? __pfx_dev_attr_store+0x10/0x10 [ 967.544321][T17340] sysfs_kf_write+0xf2/0x150 [ 967.544362][T17340] kernfs_fop_write_iter+0x3e0/0x5f0 [ 967.544398][T17340] ? __pfx_sysfs_kf_write+0x10/0x10 [ 967.544440][T17340] vfs_write+0x6ac/0x1070 [ 967.544468][T17340] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 967.544507][T17340] ? __pfx_vfs_write+0x10/0x10 [ 967.544544][T17340] ksys_write+0x12a/0x250 [ 967.544572][T17340] ? __pfx_ksys_write+0x10/0x10 [ 967.544602][T17340] ? rcu_is_watching+0x12/0xc0 [ 967.544634][T17340] do_syscall_64+0x10b/0xf80 [ 967.544666][T17340] ? clear_bhb_loop+0x40/0x90 [ 967.544695][T17340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.544721][T17340] RIP: 0033:0x7fd85a99cdd9 [ 967.544748][T17340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.544773][T17340] RSP: 002b:00007fd858bcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 967.544798][T17340] RAX: ffffffffffffffda RBX: 00007fd85ac16090 RCX: 00007fd85a99cdd9 [ 967.544815][T17340] RDX: 000000000008083a RSI: 00002000000000c0 RDI: 0000000000000007 [ 967.544831][T17340] RBP: 00007fd85aa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 967.544848][T17340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 967.544863][T17340] R13: 00007fd85ac16128 R14: 00007fd85ac16090 R15: 00007ffe16a7c238 [ 967.544887][T17340] [ 967.544965][T17340] Kernel Offset: disabled