last executing test programs: 5.050021212s ago: executing program 1 (id=9): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@bridge_newneigh={0x28, 0x1d, 0x1, 0x70bd2a, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x80, 0x6e, 0x1}, [@NDA_LLADDR={0xa, 0x2, @link_local}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040804) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 4.667742012s ago: executing program 1 (id=12): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r2, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000500)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @local, @broadcast}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x6}}], 0x38}, 0x200000e0) 4.594813283s ago: executing program 3 (id=13): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x8}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800053, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 4.252906322s ago: executing program 1 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) chdir(&(0x7f0000000140)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) mount_setattr(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x8000, &(0x7f0000000100)={0x5, 0x8, 0x100000}, 0x20) 4.019417478s ago: executing program 1 (id=15): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYRES16], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) close(0x4) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 3.990414839s ago: executing program 3 (id=17): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-blowfish-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000004c00)=[{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="bd1cd2136acc3269b7cad67f65152dda65fd77c2e371b3d28a8d43f881be3adbceb190009d7a11fd", 0x28}], 0x1, 0x0, 0x0, 0x10}], 0x1, 0x20044051) recvmsg$can_bcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000680)=""/112, 0xfffffef2}], 0x2}, 0x10150) 3.681542767s ago: executing program 3 (id=19): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x1, 0x4, 0x8}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r3, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)='T', 0x1}], 0x1}, 0x0) 3.512728341s ago: executing program 3 (id=21): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0xefff, @loopback}}, 0x1e) r1 = socket$pptp(0x18, 0x1, 0x2) r2 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r2, &(0x7f0000000140)={0x18, 0x2, {0xffff, @dev={0xac, 0x14, 0x14, 0x34}}}, 0x1e) connect$pptp(r1, &(0x7f0000000080)={0x18, 0x2, {0xe0, @loopback}}, 0x1e) 3.348117715s ago: executing program 3 (id=22): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) pselect6(0x40, &(0x7f0000000080)={0xc, 0x4, 0x401, 0x5, 0x6, 0x81, 0x3, 0x400}, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x0, 0x0, 0x0) 2.309414241s ago: executing program 1 (id=28): r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000380)=0x5, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000300)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x10}]}, 0x10) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e200023b0"], 0x0) 2.064387647s ago: executing program 1 (id=31): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000400)={0x0, 0x10}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) 1.845752462s ago: executing program 0 (id=34): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r0, 0x5) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "1234"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}], 0x18}, 0x0) 1.701662126s ago: executing program 0 (id=36): syz_mount_image$fuse(0x0, &(0x7f00000001c0)='./file1\x00', 0x1810090, 0x0, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x158) lsetxattr$security_capability(&(0x7f0000000100)='./file1\x00', &(0x7f0000000200), 0x0, 0x0, 0x1) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@userxattr}]}) setxattr$trusted_overlay_origin(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000080), 0x0, 0x0, 0x3) 1.53696021s ago: executing program 0 (id=38): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f00000010c0)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r1, &(0x7f0000000480)='task\x00') wait4(r1, 0x0, 0x2, 0x0) 1.384517534s ago: executing program 2 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = dup(r1) r3 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000001c0), 0x2000000, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@dfltgid={'dfltgid', 0x3d, r4}}]}}) 1.242958438s ago: executing program 2 (id=41): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x15) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r1, &(0x7f0000000140)={'full'}, 0xfffffdef) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.091391572s ago: executing program 0 (id=42): unshare(0xa020480) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r3 = syz_open_procfs$namespace(0x0, &(0x7f00000003c0)='ns/net\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x24, r1, 0xd66771a5e8224ded, 0x0, 0x25dfdbfd, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r3}]}, 0x24}}, 0x8040) 956.866685ms ago: executing program 0 (id=43): r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000340)={0x14, r2, 0x70d, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) 844.204198ms ago: executing program 0 (id=44): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) 829.935379ms ago: executing program 2 (id=45): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x94) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000003f00)=[{&(0x7f00000003c0)={0x24, 0x3c, 0x2, 0x70bd2a, 0x25dfdbfd, "", [@typed={0xc, 0x3d, 0x0, 0x0, @u64=0x6}, @typed={0x8, 0x52, 0x0, 0x0, @fd=r0}]}, 0x24}], 0x1, 0x0, 0x0, 0x44011}, 0x40830) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000005000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/19, 0x13}, 0x3}], 0x4000169, 0x60, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 721.780771ms ago: executing program 2 (id=46): r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) chdir(&(0x7f00000003c0)='./bus\x00') syz_read_part_table(0x5e4, &(0x7f0000000000)="$eJzs3C+oZFUcB/Dvmbn3vhncpxOMhoUtYvCZTIqLIA+biLZFTDZF1qBBeTPBJAajVTS4CrImBYOCGLQZhcUii11QEfTI/Te7YPONQfbzCXd+9/z7ncP93Xgn/L/VxT7skveWySrJIrmrb7qZvNkmu02So3FUO40uSZ699sTdty9WUrLJduo9utUxh00uTtEXTd6+dvpHrTXZpuRsbN4m7cddmkwbSPLuPzf9e8n6QOfnXJov6/hsu3yfT5N8fjx3bfNBshnKKTlJzbLWejb29I9v0RfcufPnm91jU/zraizisUTXQyU/NBVfm1prXeTs0jxzmdz3yMnV/UrD1p4bj9LX8a67rdj72e2FoSzHt2OKsk73eB9vXhvvd6shc7/69Go9/E5/vbFOXr7x9INJu6sltZz/6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/Afuf+WBrxbzzeXhWvrLC581ST7M3Ncl5a9a55F9Z64eIP8nZVvrnOSlN346/Tm/JFnm5PRCcrQf9/z4c/2tMX0tB8jde/HPRffR+1+/vl+vGX9K8u2lH7oskyuZN7JMXr331tzjR5sD7QIAAAAAAAAAAAAAAAAAAIA73fU8efGpRZ7pUnIl+8/9U7NKSjmebleX+7b6Wx2sxsab7X6Z735M6SellnRz4xDcs0vSTn8rME6stTZDikN9xM+/9ncAAAD//+D4XzU=") 326.324831ms ago: executing program 2 (id=47): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000003200)='./file1\x00', 0x2204206, &(0x7f0000003240)=ANY=[], 0x4, 0x33f, &(0x7f0000000500)="$eJzs3EtrM1UYwPEn98vLm2QhioL0oBvdDG10LQZ5C2LA0jZiKwjTdqIhY1IyoRIR267cintXgovSZXcF9Qt04043btx1I7iwC3Vkbk1mkjRtTE3f9v+Ddk6ec57JXE7KM0Mn5+9/9Umzbml1vSvxrJKYiMiFSEniEoj5y7jbTsugA3n10R8/v7i2sflOpVp9sqrUcmX9tbJSqrDw/aef5/xhpxk5K314/nv5t7Nnz54//2f944alGpZqtbtKV1vtX7v6lmmonYbV1JRaMQ3dMlSjZRkdr7/t9dfN9u5uT+mtnccpf82tnmoaPdVtq26np/SP9EZLaZqmHucFk9SOVlf1ypTJ2zPeGMxAZkSs06noCRHJDfXUjv6XjQIAAHdKtP6POyX9VPW/FNz63xncr/+PX/qx++i9k4Jf/5+mR9X/r//irStU/2ed2v6K+j+/2zEsS+nR+v8buUH9P1wRPSz/qf7H3bCQHgrFQq+c+j/vf35dhx8cL7oN6n8AAAAAAAAAAAAAAAAAAAAAAJ4GF7ZdtG27GCyDn/4jBP5r3Evjzn9GRLLO2bc5//fZ2samZN0H95xzbH65V9ureUun92/bI4YsSlH+cudDEBPbDp48Uo6S/GDu+/n7e7WE21OpS0NMMWRJilKK5tv28tvVJ0vK4+dfPqaUH8wvS1GeGZ1fDuf775+WV14eyNekKD9tS1tM2XHndT//iyWl3nq3GsnPueMAAAAAALgPNHUpdP2eE+/6XdNG9zu/Y971eVZk3P0B7/p6ceT1ebL4QnLeew8AAAAAwMNg9T5r6qZpdK5o5GTymOkbyesNTkciqasGJwb28Lrbk3ZvZIiMG5OIHLHUmDV/e82jGmoE/0gR6sr6wekOb7D/MztfB4ORuEzOyiSjG7/gBNQN3/3Q35HLSHDbKD3mOMvK8HrioZlQCM2N1Mzm83Nff/fn7D4gb5wEM2Dy4MOByLiZObKRjc46t5G6rb83AAAAAOanX/QHkTcHu2Nz2SgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB6YW/lKv0hj3vsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3BX/BgAA//+vq/Iq") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x842, 0x22) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0}, 0x10) fsync(r0) 118.960506ms ago: executing program 3 (id=48): r0 = open(&(0x7f0000000600)='./file0\x00', 0x1e1142, 0xfb) writev(r0, &(0x7f0000000580)=[{&(0x7f0000000480)="22514ed0aa7087c079040000004ad0a9c6ca476099ab8508809ad3506332bbff05000000000000006899a8a593fd4946f99fa87a69f4912afdc49542883f226de78b543ccdd5000000000000", 0x4c}], 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000400)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80000) sendfile(r2, r0, &(0x7f0000000280)=0x42, 0xc) 0s ago: executing program 2 (id=49): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000000000010711e0920000000000001090224000100000000090400090103000100092105000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x0) read$hidraw(r1, &(0x7f0000002340)=""/147, 0x93) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000000)='0') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.114' (ED25519) to the list of known hosts. [ 82.992226][ T5765] cgroup: Unknown subsys name 'net' [ 83.129905][ T5765] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.868171][ T5765] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.903013][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.931221][ T5778] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.939167][ T5778] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.947410][ T5778] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.971462][ T5778] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 86.978898][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.039410][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.048318][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.060547][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.076720][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.101585][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.123093][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.146212][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.154722][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 87.165344][ T5784] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.172632][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.180238][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.189141][ T5785] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 87.196986][ T5785] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.223165][ T5785] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.257139][ T5788] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.265927][ T5788] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.294212][ T5788] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 87.301877][ T5788] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.816644][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 87.944154][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 88.076150][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.087994][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.097814][ T5776] bridge_slave_0: entered allmulticast mode [ 88.107004][ T5776] bridge_slave_0: entered promiscuous mode [ 88.128327][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.136251][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.143759][ T5776] bridge_slave_1: entered allmulticast mode [ 88.151072][ T5776] bridge_slave_1: entered promiscuous mode [ 88.168712][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 88.206833][ T5786] chnl_net:caif_netlink_parms(): no params data found [ 88.283330][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.290615][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.298468][ T5781] bridge_slave_0: entered allmulticast mode [ 88.305724][ T5781] bridge_slave_0: entered promiscuous mode [ 88.316772][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.330110][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.364200][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.372273][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.379451][ T5781] bridge_slave_1: entered allmulticast mode [ 88.387244][ T5781] bridge_slave_1: entered promiscuous mode [ 88.463647][ T5776] team0: Port device team_slave_0 added [ 88.484929][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.497212][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.527871][ T5776] team0: Port device team_slave_1 added [ 88.567094][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.574624][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.581964][ T5780] bridge_slave_0: entered allmulticast mode [ 88.589021][ T5780] bridge_slave_0: entered promiscuous mode [ 88.608572][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.616034][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.623999][ T5786] bridge_slave_0: entered allmulticast mode [ 88.631492][ T5786] bridge_slave_0: entered promiscuous mode [ 88.639666][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.647354][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.655129][ T5786] bridge_slave_1: entered allmulticast mode [ 88.664411][ T5786] bridge_slave_1: entered promiscuous mode [ 88.686306][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.694414][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.702448][ T5780] bridge_slave_1: entered allmulticast mode [ 88.710132][ T5780] bridge_slave_1: entered promiscuous mode [ 88.718326][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.725664][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.753584][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.779507][ T5781] team0: Port device team_slave_0 added [ 88.805017][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.812169][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.838424][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.864697][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.878152][ T5781] team0: Port device team_slave_1 added [ 88.916883][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.945187][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.974498][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.984592][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.011296][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.024931][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.042372][ T51] Bluetooth: hci0: command tx timeout [ 89.077294][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.084707][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.111180][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.149682][ T5776] hsr_slave_0: entered promiscuous mode [ 89.156530][ T5776] hsr_slave_1: entered promiscuous mode [ 89.167540][ T5786] team0: Port device team_slave_0 added [ 89.176846][ T5786] team0: Port device team_slave_1 added [ 89.201315][ T51] Bluetooth: hci1: command tx timeout [ 89.211436][ T5780] team0: Port device team_slave_0 added [ 89.232153][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.239167][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.265771][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.292617][ T5780] team0: Port device team_slave_1 added [ 89.312174][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.319255][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.345880][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.371310][ T5788] Bluetooth: hci3: command tx timeout [ 89.377030][ T51] Bluetooth: hci2: command tx timeout [ 89.447708][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.455444][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.482159][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.495843][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.503433][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.529998][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.560702][ T5781] hsr_slave_0: entered promiscuous mode [ 89.569433][ T5781] hsr_slave_1: entered promiscuous mode [ 89.576995][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.585588][ T5781] Cannot create hsr debugfs directory [ 89.617576][ T5786] hsr_slave_0: entered promiscuous mode [ 89.624188][ T5786] hsr_slave_1: entered promiscuous mode [ 89.630441][ T5786] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.638969][ T5786] Cannot create hsr debugfs directory [ 89.716323][ T5780] hsr_slave_0: entered promiscuous mode [ 89.723259][ T5780] hsr_slave_1: entered promiscuous mode [ 89.729624][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.737871][ T5780] Cannot create hsr debugfs directory [ 90.151805][ T5776] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.168989][ T5776] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.192472][ T5776] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.207012][ T5776] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.249581][ T5786] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.275038][ T5786] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.290814][ T5786] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.302003][ T5786] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.389208][ T5781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.411011][ T5781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.422439][ T5781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.437201][ T5781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.528564][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.546974][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.576753][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.587979][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.727503][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.797700][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.824156][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.837879][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.845266][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.856834][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.864120][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.915050][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.967614][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.986185][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.018124][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.025419][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.043033][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.089008][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.103245][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.110922][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.126466][ T51] Bluetooth: hci0: command tx timeout [ 91.133891][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.141001][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.169672][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.177102][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.216188][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.223638][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.244955][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.252462][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.281886][ T51] Bluetooth: hci1: command tx timeout [ 91.435145][ T5786] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.446874][ T51] Bluetooth: hci2: command tx timeout [ 91.452443][ T5788] Bluetooth: hci3: command tx timeout [ 91.549594][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.703374][ T5776] veth0_vlan: entered promiscuous mode [ 91.734754][ T5776] veth1_vlan: entered promiscuous mode [ 91.838299][ T5776] veth0_macvtap: entered promiscuous mode [ 91.886289][ T5776] veth1_macvtap: entered promiscuous mode [ 91.979503][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.019539][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.038917][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.067148][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.078694][ T5776] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.096550][ T5776] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.105632][ T5776] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.114836][ T5776] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.170861][ T9] cfg80211: failed to load regulatory.db [ 92.221230][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.297661][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.327591][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.386904][ T5786] veth0_vlan: entered promiscuous mode [ 92.405987][ T5781] veth0_vlan: entered promiscuous mode [ 92.420227][ T5781] veth1_vlan: entered promiscuous mode [ 92.440229][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.449413][ T5780] veth0_vlan: entered promiscuous mode [ 92.458614][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.476681][ T5780] veth1_vlan: entered promiscuous mode [ 92.498966][ T5786] veth1_vlan: entered promiscuous mode [ 92.580348][ T5781] veth0_macvtap: entered promiscuous mode [ 92.597183][ T5781] veth1_macvtap: entered promiscuous mode [ 92.606358][ T5780] veth0_macvtap: entered promiscuous mode [ 92.645375][ T5786] veth0_macvtap: entered promiscuous mode [ 92.659083][ T5780] veth1_macvtap: entered promiscuous mode [ 92.678460][ T5786] veth1_macvtap: entered promiscuous mode [ 92.688371][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.704148][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.716921][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.765178][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.791513][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.808702][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.827990][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.848007][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.858004][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.868684][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.880167][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.904238][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.914935][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.925760][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.937569][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.947587][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.958743][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.974643][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.985225][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.995921][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.006430][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.016975][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.029795][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.040044][ T5781] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.052001][ T5781] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.060775][ T5781] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.070127][ T5781] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.088575][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.099330][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.109896][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.120823][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.138326][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.149279][ T5817] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 93.158104][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.173245][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.189431][ T5786] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.198993][ T5786] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.202572][ T51] Bluetooth: hci0: command tx timeout [ 93.210438][ T5786] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.222880][ T5786] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.262348][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.275049][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.288938][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.298283][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.361652][ T51] Bluetooth: hci1: command tx timeout [ 93.371651][ T5817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 93.383547][ T5817] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 93.394957][ T5817] usb 1-1: New USB device found, idVendor=046d, idProduct=c293, bcdDevice= 0.00 [ 93.404621][ T5817] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.433593][ T5817] usb 1-1: config 0 descriptor?? [ 93.441075][ T5844] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 93.521752][ T51] Bluetooth: hci2: command tx timeout [ 93.527304][ T51] Bluetooth: hci3: command tx timeout [ 93.558245][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.567927][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.619123][ T745] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.629740][ T745] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.684678][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.694094][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.726962][ T5817] usbhid 1-1:0.0: can't add hid device: -71 [ 93.740582][ T5817] usbhid: probe of 1-1:0.0 failed with error -71 [ 93.760145][ T5817] usb 1-1: USB disconnect, device number 2 [ 93.780580][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.793398][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.863912][ T745] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.907722][ T745] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.981463][ T745] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.989368][ T745] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.301220][ T5817] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 94.503534][ T5817] usb 1-1: config 4 has an invalid interface number: 44 but max is 0 [ 94.511986][ T5817] usb 1-1: config 4 has no interface number 0 [ 94.520877][ T5817] usb 1-1: config 4 interface 44 altsetting 0 endpoint 0x2 has invalid maxpacket 256, setting to 64 [ 94.533558][ T5817] usb 1-1: config 4 interface 44 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 94.549481][ T5817] usb 1-1: config 4 interface 44 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 94.567411][ T5817] usb 1-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 94.577501][ T5817] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.600886][ T5817] usb 1-1: Product: syz [ 94.605865][ T5817] usb 1-1: Manufacturer: syz [ 94.610921][ T5817] usb 1-1: SerialNumber: syz [ 94.663116][ T5844] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 94.743687][ T5864] syz.2.8[5864]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 94.767524][ T5864] loop2: detected capacity change from 0 to 128 [ 94.826060][ T5864] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 94.848888][ T5864] ext4 filesystem being mounted at /2/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 95.069438][ T5786] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 95.167993][ T5817] dvb-usb: found a 'Gigabyte U7000' in warm state. [ 95.248044][ T5817] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 95.281729][ T51] Bluetooth: hci0: command tx timeout [ 95.304959][ T5817] dvbdev: DVB: registering new adapter (Gigabyte U7000) [ 95.312761][ T5817] usb 1-1: media controller created [ 95.328980][ T5876] loop3: detected capacity change from 0 to 512 [ 95.336027][ T5817] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 95.351812][ T5876] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 95.375252][ T5876] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 95.441398][ T51] Bluetooth: hci1: command tx timeout [ 95.471291][ T5876] EXT4-fs error (device loop3): ext4_orphan_get:1430: comm syz.3.13: bad orphan inode 131083 [ 95.542949][ T5876] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.586734][ T5817] DVB: Unable to find symbol dib7000p_attach() [ 95.601735][ T5788] Bluetooth: hci2: command tx timeout [ 95.607526][ T51] Bluetooth: hci3: command tx timeout [ 95.617670][ T5817] dvb-usb: no frontend was attached by 'Gigabyte U7000' [ 95.798025][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.822742][ T5817] rc_core: IR keymap rc-dib0700-rc5 not found [ 95.834111][ T5817] Registered IR keymap rc-empty [ 95.860080][ T5817] dvb-usb: could not initialize remote control. [ 95.881192][ T5817] dvb-usb: Gigabyte U7000 successfully initialized and connected. [ 96.151333][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 96.275800][ T5817] usb 1-1: USB disconnect, device number 3 [ 96.334938][ T5817] dvb-usb: Gigabyte U7000 successfully deinitialized and disconnected. [ 96.364802][ T8] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 96.381217][ T8] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.411694][ T8] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 96.420815][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 96.468591][ T8] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 96.487789][ T8] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 96.497717][ T8] usb 2-1: Product: syz [ 96.506423][ T8] usb 2-1: Manufacturer: syz [ 96.518145][ T8] cdc_wdm 2-1:1.0: skipping garbage [ 96.526082][ T8] cdc_wdm 2-1:1.0: skipping garbage [ 96.546322][ T8] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 96.554889][ T8] cdc_wdm 2-1:1.0: Unknown control protocol [ 96.630573][ T8] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 96.665052][ T8] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 96.831030][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 96.838109][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 96.848154][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 96.854836][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 96.868448][ T8] usb 2-1: USB disconnect, device number 2 [ 97.129922][ T5914] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 97.553448][ T5921] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 98.022515][ T5845] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 98.231264][ T5845] usb 2-1: Using ep0 maxpacket: 8 [ 98.258176][ T5845] usb 2-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 98.286230][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 98.313415][ T5845] usb 2-1: Product: syz [ 98.323736][ T5845] usb 2-1: Manufacturer: syz [ 98.338408][ T5845] usb 2-1: SerialNumber: syz [ 98.354621][ T5845] usb 2-1: config 0 descriptor?? [ 98.365851][ T5845] gspca_main: sq905-2.14.0 probing 2770:9120 [ 99.138279][ T5963] loop2: detected capacity change from 0 to 2048 [ 99.195856][ T5963] loop2: p1 p2 p3 < > p4 < p5 p6 > [ 99.210432][ T5963] loop2: partition table partially beyond EOD, truncated [ 99.232307][ T5963] loop2: p1 size 393216 extends beyond EOD, truncated [ 99.246748][ T5963] loop2: p3 start 4225 is beyond EOD, truncated [ 99.255933][ T5963] loop2: p5 size 393216 extends beyond EOD, truncated [ 99.383115][ T5845] gspca_sq905: bulk read fail (-22) len 0/4 [ 99.410393][ T5845] sq905: probe of 2-1:0.0 failed with error -5 [ 99.630456][ T8] usb 2-1: USB disconnect, device number 3 [ 99.687997][ T5791] udevd[5791]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 99.700573][ T5877] udevd[5877]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 99.717307][ T5891] udevd[5891]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 99.736226][ T5779] udevd[5779]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 99.750717][ T5790] udevd[5790]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 133.126304][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.133258][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 157.403236][ T5141] udevd[5141]: worker [5892] /devices/virtual/misc/uhid/0000:0000:0000.0001/hidraw/hidraw0 is taking a long time [ 194.564846][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.571348][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 212.004959][ T5789] Bluetooth: hci3: command 0x0406 tx timeout [ 212.011219][ T5789] Bluetooth: hci0: command 0x0406 tx timeout [ 212.017263][ T5789] Bluetooth: hci2: command 0x0406 tx timeout [ 212.023377][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 246.401467][ T28] INFO: task syz.1.31:5926 blocked for more than 143 seconds. [ 246.409250][ T28] Not tainted syzkaller #0 [ 246.418353][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 246.427217][ T28] task:syz.1.31 state:D stack:24808 pid:5926 ppid:5781 flags:0x00004004 [ 246.436793][ T28] Call Trace: [ 246.440124][ T28] [ 246.443283][ T28] __schedule+0x15ae/0x4660 [ 246.448658][ T28] ? mark_lock+0x94/0x320 [ 246.453445][ T28] ? asan.module_dtor+0x20/0x20 [ 246.458366][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 246.463815][ T28] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 246.469767][ T28] ? lockdep_hardirqs_on+0x98/0x150 [ 246.475378][ T28] schedule+0xbd/0x170 [ 246.479497][ T28] io_schedule+0x80/0xd0 [ 246.484212][ T28] bit_wait_io+0x11/0xd0 [ 246.488523][ T28] __wait_on_bit+0x9f/0x2c0 [ 246.494106][ T28] ? bit_wait+0xd0/0xd0 [ 246.498367][ T28] out_of_line_wait_on_bit+0x13c/0x190 [ 246.504179][ T28] ? bit_wait+0xd0/0xd0 [ 246.508436][ T28] ? __wait_on_bit+0x2c0/0x2c0 [ 246.513385][ T28] ? do_raw_spin_lock+0x11f/0x2b0 [ 246.518466][ T28] ? bit_waitqueue+0x30/0x30 [ 246.523316][ T28] ? do_raw_spin_unlock+0x121/0x230 [ 246.528573][ T28] do_get_write_access+0x5c9/0xe00 [ 246.533800][ T28] jbd2_journal_get_write_access+0x10c/0x140 [ 246.539826][ T28] __ext4_journal_get_write_access+0x208/0x6d0 [ 246.546070][ T28] ? __ext4_journal_ensure_credits+0x450/0x450 [ 246.553666][ T28] ? __might_sleep+0xe0/0xe0 [ 246.558335][ T28] ext4_reserve_inode_write+0x205/0x2a0 [ 246.564224][ T28] __ext4_mark_inode_dirty+0x13f/0x6d0 [ 246.570030][ T28] ext4_dirty_inode+0xcb/0x110 [ 246.574915][ T28] ? __ext4_expand_extra_isize+0x400/0x400 [ 246.580864][ T28] __mark_inode_dirty+0x2cc/0xc90 [ 246.586034][ T28] file_update_time+0x187/0x1a0 [ 246.590935][ T28] ext4_page_mkwrite+0x1f9/0x11a0 [ 246.596072][ T28] ? filemap_fault+0x103c/0x1540 [ 246.601140][ T28] ? mapping_seek_hole_data+0x1330/0x1330 [ 246.607973][ T28] ? ext4_change_inode_journal_flag+0x8a0/0x8a0 [ 246.614341][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 246.619409][ T28] ? __pte_offset_map+0x20d/0x280 [ 246.625669][ T28] do_page_mkwrite+0x153/0x3f0 [ 246.630467][ T28] handle_mm_fault+0x1a2c/0x4a50 [ 246.635481][ T28] ? handle_mm_fault+0xe6/0x4a50 [ 246.640478][ T28] ? numa_migrate_prep+0x350/0x350 [ 246.645773][ T28] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 246.651968][ T28] do_user_addr_fault+0x736/0x12d0 [ 246.657209][ T28] exc_page_fault+0x64/0x100 [ 246.662056][ T28] asm_exc_page_fault+0x26/0x30 [ 246.667009][ T28] RIP: 0033:0x7f6fb8072729 [ 246.671528][ T28] RSP: 002b:00007ffcee986f80 EFLAGS: 00010202 [ 246.677650][ T28] RAX: 0000001b2df14000 RBX: ffffffff854da6c3 RCX: 0000001b2df13ff8 [ 246.685745][ T28] RDX: 0000001b2d924220 RSI: 0000000000000008 RDI: 00007f6fb8f55720 [ 246.693823][ T28] RBP: 000000000000011e R08: 00007f6fb8410000 R09: 00007f6fb8412000 [ 246.701990][ T28] R10: 00000000854da6c7 R11: 00000000000000ff R12: 00007f6fb8425f40 [ 246.710009][ T28] R13: 0000000000007e74 R14: ffffffff854da222 R15: 00007f6fb8f55720 [ 246.718138][ T28] ? device_remove_bin_file+0x12/0x40 [ 246.723689][ T28] ? virtual_device_parent+0x13/0x50 [ 246.729042][ T28] [ 246.732461][ T28] INFO: task syz.0.44:5956 blocked for more than 143 seconds. [ 246.740056][ T28] Not tainted syzkaller #0 [ 246.747914][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 246.757564][ T28] task:syz.0.44 state:D stack:25384 pid:5956 ppid:5776 flags:0x00004004 [ 246.767096][ T28] Call Trace: [ 246.770451][ T28] [ 246.774844][ T28] __schedule+0x15ae/0x4660 [ 246.779422][ T28] ? mark_lock+0x94/0x320 [ 246.784060][ T28] ? asan.module_dtor+0x20/0x20 [ 246.788990][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 246.794292][ T28] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 246.800342][ T28] ? lockdep_hardirqs_on+0x98/0x150 [ 246.805725][ T28] schedule+0xbd/0x170 [ 246.809924][ T28] io_schedule+0x80/0xd0 [ 246.814387][ T28] bit_wait_io+0x11/0xd0 [ 246.818692][ T28] __wait_on_bit+0x9f/0x2c0 [ 246.823411][ T28] ? bit_wait+0xd0/0xd0 [ 246.827641][ T28] out_of_line_wait_on_bit+0x13c/0x190 [ 246.833381][ T28] ? bit_wait+0xd0/0xd0 [ 246.837617][ T28] ? __wait_on_bit+0x2c0/0x2c0 [ 246.842614][ T28] ? do_raw_spin_lock+0x11f/0x2b0 [ 246.847701][ T28] ? bit_waitqueue+0x30/0x30 [ 246.852462][ T28] ? do_raw_spin_unlock+0x121/0x230 [ 246.858631][ T28] do_get_write_access+0x5c9/0xe00 [ 246.863946][ T28] jbd2_journal_get_write_access+0x10c/0x140 [ 246.870008][ T28] __ext4_journal_get_write_access+0x208/0x6d0 [ 246.876347][ T28] ? __ext4_journal_ensure_credits+0x450/0x450 [ 246.883861][ T28] ? __might_sleep+0xe0/0xe0 [ 246.888524][ T28] ext4_reserve_inode_write+0x205/0x2a0 [ 246.894194][ T28] __ext4_mark_inode_dirty+0x13f/0x6d0 [ 246.899737][ T28] ext4_dirty_inode+0xcb/0x110 [ 246.904793][ T28] ? __ext4_expand_extra_isize+0x400/0x400 [ 246.910677][ T28] __mark_inode_dirty+0x2cc/0xc90 [ 246.915815][ T28] file_update_time+0x187/0x1a0 [ 246.920811][ T28] ext4_page_mkwrite+0x1f9/0x11a0 [ 246.926159][ T28] ? filemap_fault+0x103c/0x1540 [ 246.931254][ T28] ? mapping_seek_hole_data+0x1330/0x1330 [ 246.937048][ T28] ? ext4_change_inode_journal_flag+0x8a0/0x8a0 [ 246.943402][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 246.948543][ T28] ? __pte_offset_map+0x20d/0x280 [ 246.953677][ T28] do_page_mkwrite+0x153/0x3f0 [ 246.959535][ T28] handle_mm_fault+0x1a2c/0x4a50 [ 246.965176][ T28] ? handle_mm_fault+0xe6/0x4a50 [ 246.970194][ T28] ? numa_migrate_prep+0x350/0x350 [ 246.975463][ T28] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 246.981114][ T28] do_user_addr_fault+0x736/0x12d0 [ 246.986316][ T28] exc_page_fault+0x64/0x100 [ 246.990991][ T28] asm_exc_page_fault+0x26/0x30 [ 246.996039][ T28] RIP: 0033:0x7fb8c8272eb2 [ 247.000506][ T28] RSP: 002b:00007ffe7c1cbcc0 EFLAGS: 00010202 [ 247.006730][ T28] RAX: 0000000000004008 RBX: 00007fb8c9155720 RCX: 0000000000000000 [ 247.014957][ T28] RDX: 0000001b2de20000 RSI: 0000000000000008 RDI: 00007fb8c9155720 [ 247.023159][ T28] RBP: 00000000000001d1 R08: 00007fb8c8610000 R09: 00007fb8c8626038 [ 247.031275][ T28] R10: 0000000000000001 R11: 0000000000000003 R12: ffffffff813c6929 [ 247.039297][ T28] R13: 00007fb8c8626038 R14: 00000000000001a5 R15: ffffffffffffc000 [ 247.051130][ T28] ? do_user_addr_fault+0x109/0x12d0 [ 247.056514][ T28] [ 247.059579][ T28] INFO: task syz.3.48:5967 blocked for more than 144 seconds. [ 247.070665][ T28] Not tainted syzkaller #0 [ 247.075786][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.084686][ T28] task:syz.3.48 state:D stack:27560 pid:5967 ppid:5780 flags:0x00004004 [ 247.094130][ T28] Call Trace: [ 247.097490][ T28] [ 247.100470][ T28] __schedule+0x15ae/0x4660 [ 247.105145][ T28] ? mark_lock+0x94/0x320 [ 247.109630][ T28] ? asan.module_dtor+0x20/0x20 [ 247.114649][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 247.119932][ T28] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 247.126161][ T28] ? lockdep_hardirqs_on+0x98/0x150 [ 247.131638][ T28] schedule+0xbd/0x170 [ 247.135781][ T28] io_schedule+0x80/0xd0 [ 247.140079][ T28] bit_wait_io+0x11/0xd0 [ 247.144475][ T28] __wait_on_bit+0x9f/0x2c0 [ 247.149122][ T28] ? bit_wait+0xd0/0xd0 [ 247.153384][ T28] out_of_line_wait_on_bit+0x13c/0x190 [ 247.158912][ T28] ? bit_wait+0xd0/0xd0 [ 247.164453][ T28] ? __wait_on_bit+0x2c0/0x2c0 [ 247.169290][ T28] ? do_raw_spin_lock+0x11f/0x2b0 [ 247.174462][ T28] ? bit_waitqueue+0x30/0x30 [ 247.179161][ T28] ? do_raw_spin_unlock+0x121/0x230 [ 247.184527][ T28] do_get_write_access+0x5c9/0xe00 [ 247.189793][ T28] jbd2_journal_get_write_access+0x10c/0x140 [ 247.195874][ T28] __ext4_journal_get_write_access+0x208/0x6d0 [ 247.202304][ T28] ? __ext4_journal_ensure_credits+0x450/0x450 [ 247.208886][ T28] ? __might_sleep+0xe0/0xe0 [ 247.213643][ T28] ext4_reserve_inode_write+0x205/0x2a0 [ 247.219259][ T28] __ext4_mark_inode_dirty+0x13f/0x6d0 [ 247.225048][ T28] ext4_dirty_inode+0xcb/0x110 [ 247.229857][ T28] ? __ext4_expand_extra_isize+0x400/0x400 [ 247.235920][ T28] __mark_inode_dirty+0x2cc/0xc90 [ 247.241191][ T28] file_update_time+0x187/0x1a0 [ 247.246298][ T28] ext4_page_mkwrite+0x1f9/0x11a0 [ 247.251580][ T28] ? filemap_fault+0x103c/0x1540 [ 247.256622][ T28] ? mapping_seek_hole_data+0x1330/0x1330 [ 247.262594][ T28] ? pte_alloc_one+0x3b6/0x540 [ 247.268672][ T28] ? ext4_change_inode_journal_flag+0x8a0/0x8a0 [ 247.275052][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 247.280137][ T28] do_page_mkwrite+0x153/0x3f0 [ 247.285163][ T28] handle_mm_fault+0x1a2c/0x4a50 [ 247.290238][ T28] ? handle_mm_fault+0xe6/0x4a50 [ 247.295291][ T28] ? numa_migrate_prep+0x350/0x350 [ 247.300460][ T28] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 247.306212][ T28] do_user_addr_fault+0x736/0x12d0 [ 247.311449][ T28] exc_page_fault+0x64/0x100 [ 247.316178][ T28] ? clear_bhb_loop+0x40/0x90 [ 247.321123][ T28] asm_exc_page_fault+0x26/0x30 [ 247.326036][ T28] RIP: 0033:0x7f2bb986ba23 [ 247.330504][ T28] RSP: 002b:00007ffc1e0ebc20 EFLAGS: 00010246 [ 247.336709][ T28] RAX: 00000000005ffde8 RBX: 0000000000000000 RCX: 0000001b2db64000 [ 247.344924][ T28] RDX: 0000001b2db24000 RSI: 0000000000600000 RDI: 00007f2bb9be0708 [ 247.353144][ T28] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 247.361488][ T28] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 247.370499][ T28] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc1e0ebeb0 [ 247.378840][ T28] [ 247.382429][ T28] INFO: task syz.2.49:5968 blocked for more than 144 seconds. [ 247.389934][ T28] Not tainted syzkaller #0 [ 247.394998][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.403754][ T28] task:syz.2.49 state:D stack:27560 pid:5968 ppid:5786 flags:0x00004004 [ 247.413060][ T28] Call Trace: [ 247.416381][ T28] [ 247.419374][ T28] __schedule+0x15ae/0x4660 [ 247.424080][ T28] ? mark_lock+0x94/0x320 [ 247.428460][ T28] ? asan.module_dtor+0x20/0x20 [ 247.433415][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 247.438496][ T28] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 247.444584][ T28] ? lockdep_hardirqs_on+0x98/0x150 [ 247.450046][ T28] schedule+0xbd/0x170 [ 247.454347][ T28] io_schedule+0x80/0xd0 [ 247.458651][ T28] bit_wait_io+0x11/0xd0 [ 247.463027][ T28] __wait_on_bit+0x9f/0x2c0 [ 247.467713][ T28] ? bit_wait+0xd0/0xd0 [ 247.472736][ T28] out_of_line_wait_on_bit+0x13c/0x190 [ 247.478287][ T28] ? bit_wait+0xd0/0xd0 [ 247.482610][ T28] ? __wait_on_bit+0x2c0/0x2c0 [ 247.487428][ T28] ? do_raw_spin_lock+0x11f/0x2b0 [ 247.492571][ T28] ? bit_waitqueue+0x30/0x30 [ 247.497216][ T28] ? do_raw_spin_unlock+0x121/0x230 [ 247.502669][ T28] do_get_write_access+0x5c9/0xe00 [ 247.507935][ T28] jbd2_journal_get_write_access+0x10c/0x140 [ 247.514056][ T28] __ext4_journal_get_write_access+0x208/0x6d0 [ 247.520370][ T28] ? __ext4_journal_ensure_credits+0x450/0x450 [ 247.526951][ T28] ? __might_sleep+0xe0/0xe0 [ 247.531675][ T28] ext4_reserve_inode_write+0x205/0x2a0 [ 247.537379][ T28] __ext4_mark_inode_dirty+0x13f/0x6d0 [ 247.543021][ T28] ext4_dirty_inode+0xcb/0x110 [ 247.547843][ T28] ? __ext4_expand_extra_isize+0x400/0x400 [ 247.553754][ T28] __mark_inode_dirty+0x2cc/0xc90 [ 247.558914][ T28] file_update_time+0x187/0x1a0 [ 247.564107][ T28] ext4_page_mkwrite+0x1f9/0x11a0 [ 247.569287][ T28] ? filemap_fault+0x103c/0x1540 [ 247.575784][ T28] ? mapping_seek_hole_data+0x1330/0x1330 [ 247.581700][ T28] ? pte_alloc_one+0x3b6/0x540 [ 247.586532][ T28] ? ext4_change_inode_journal_flag+0x8a0/0x8a0 [ 247.593198][ T28] ? __lock_acquire+0x7d80/0x7d80 [ 247.598389][ T28] do_page_mkwrite+0x153/0x3f0 [ 247.603427][ T28] handle_mm_fault+0x1a2c/0x4a50 [ 247.608510][ T28] ? handle_mm_fault+0xe6/0x4a50 [ 247.613674][ T28] ? numa_migrate_prep+0x350/0x350 [ 247.618855][ T28] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 247.624375][ T28] do_user_addr_fault+0x736/0x12d0 [ 247.629568][ T28] exc_page_fault+0x64/0x100 [ 247.634321][ T28] ? clear_bhb_loop+0x40/0x90 [ 247.639057][ T28] asm_exc_page_fault+0x26/0x30 [ 247.644053][ T28] RIP: 0033:0x7f930ca6ba23 [ 247.648516][ T28] RSP: 002b:00007ffc220e9040 EFLAGS: 00010246 [ 247.654689][ T28] RAX: 00000000005ffde8 RBX: 0000000000000000 RCX: 0000001b2da64000 [ 247.663333][ T28] RDX: 0000001b2da24000 RSI: 0000000000600000 RDI: 00007f930cde0708 [ 247.671742][ T28] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 247.680696][ T28] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 247.688920][ T28] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc220e92d0 [ 247.697086][ T28] [ 247.700175][ T28] [ 247.700175][ T28] Showing all locks held in the system: [ 247.708075][ T28] 1 lock held by khungtaskd/28: [ 247.713087][ T28] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 247.723359][ T28] 6 locks held by kworker/u4:5/745: [ 247.728607][ T28] #0: ffff888141641138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 247.740023][ T28] #1: ffffc90003aafd00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 247.752649][ T28] #2: ffff88814dfca0e0 (&type->s_umount_key#32){++++}-{3:3}, at: super_trylock_shared+0x20/0xf0 [ 247.763324][ T28] #3: ffff88814dfccc58 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x1a4/0x350 [ 247.773937][ T28] #4: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 247.784696][ T28] #5: ffff888076e0be88 (&ei->i_data_sem){++++}-{3:3}, at: ext4_map_blocks+0x918/0x1a90 [ 247.794722][ T28] 2 locks held by getty/5534: [ 247.799447][ T28] #0: ffff888031b710a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 247.809332][ T28] #1: ffffc900032832f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 247.819597][ T28] 3 locks held by syz-executor/5765: [ 247.825004][ T28] #0: ffff888031848b20 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 247.835214][ T28] #1: ffff88814dfca510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 247.845699][ T28] #2: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 247.855558][ T28] 1 lock held by udevd/5906: [ 247.860190][ T28] #0: ffff88802461dd08 (&sig->cred_guard_mutex){+.+.}-{3:3}, at: bprm_execve+0xc8/0x1730 [ 247.870379][ T28] 3 locks held by syz.1.31/5926: [ 247.875445][ T28] #0: ffff888025a9a7a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 247.886688][ T28] #1: ffff88814dfca510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 247.896721][ T28] #2: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 247.906539][ T28] 3 locks held by syz.0.44/5956: [ 247.911622][ T28] #0: ffff8880246401a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 247.922113][ T28] #1: ffff88814dfca510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 247.932072][ T28] #2: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 247.941966][ T28] 3 locks held by syz.3.48/5967: [ 247.947064][ T28] #0: ffff88807e4873a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 247.957121][ T28] #1: ffff88814dfca510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 247.966989][ T28] #2: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 247.976791][ T28] 3 locks held by syz.2.49/5968: [ 247.983402][ T28] #0: ffff88807e486a20 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x32/0x2f0 [ 247.993496][ T28] #1: ffff88814dfca510 (sb_pagefaults){.+.+}-{0:0}, at: ext4_page_mkwrite+0x1e2/0x11a0 [ 248.003532][ T28] #2: ffff88814dfce990 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1f3f/0x2170 [ 248.013402][ T28] [ 248.015792][ T28] ============================================= [ 248.015792][ T28] [ 248.024318][ T28] NMI backtrace for cpu 1 [ 248.028696][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 248.035949][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.046054][ T28] Call Trace: [ 248.049352][ T28] [ 248.052295][ T28] dump_stack_lvl+0x18c/0x250 [ 248.056984][ T28] ? __wake_up_klogd+0xd9/0x100 [ 248.061854][ T28] ? show_regs_print_info+0x20/0x20 [ 248.067167][ T28] ? load_image+0x420/0x420 [ 248.071733][ T28] nmi_cpu_backtrace+0x3a6/0x3e0 [ 248.076684][ T28] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 248.082970][ T28] ? load_image+0x420/0x420 [ 248.087533][ T28] ? wq_watchdog_touch+0xef/0x170 [ 248.092611][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 248.098816][ T28] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 248.104855][ T28] watchdog+0xf59/0xfa0 [ 248.109114][ T28] ? watchdog+0x1e1/0xfa0 [ 248.113577][ T28] kthread+0x2fa/0x390 [ 248.117685][ T28] ? hungtask_pm_notify+0x50/0x50 [ 248.122742][ T28] ? kthread_blkcg+0xd0/0xd0 [ 248.127377][ T28] ret_from_fork+0x48/0x80 [ 248.131854][ T28] ? kthread_blkcg+0xd0/0xd0 [ 248.136494][ T28] ret_from_fork_asm+0x11/0x20 [ 248.141335][ T28] [ 248.145290][ T28] Sending NMI from CPU 1 to CPUs 0: [ 248.150741][ C0] NMI backtrace for cpu 0 [ 248.150752][ C0] CPU: 0 PID: 11 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 248.150768][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.150778][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 248.150802][ C0] RIP: 0010:ieee80211_parse_ch_switch_ie+0x0/0xdd0 [ 248.150828][ C0] Code: e8 15 58 d7 f7 89 e8 e9 55 ff ff ff 44 89 f1 80 e1 07 38 c1 0f 8c 72 ff ff ff 4c 89 f7 e8 b8 57 d7 f7 e9 65 ff ff ff cc cc cc 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 [ 248.150841][ C0] RSP: 0018:ffffc90000107530 EFLAGS: 00000282 [ 248.150854][ C0] RAX: ffffc90000107770 RBX: fffff52000020eb0 RCX: 0000000000000000 [ 248.150865][ C0] RDX: 0000000000000000 RSI: ffff888025712800 RDI: ffff88805c7a8d00 [ 248.150876][ C0] RBP: ffffc90000107810 R08: 0000000000000007 R09: ffff88805c7a9ae2 [ 248.150887][ C0] R10: ffffc900001075a0 R11: fffff52000020ee6 R12: ffff88805c7a9ae2 [ 248.150899][ C0] R13: 1ffff1100b8f5363 R14: ffff88801ae83618 R15: ffff88805c7a8d00 [ 248.150912][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 248.150925][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 248.150936][ C0] CR2: 000055c75fea8168 CR3: 000000000cf32000 CR4: 00000000003506f0 [ 248.150951][ C0] Call Trace: [ 248.150956][ C0] [ 248.150961][ C0] ieee80211_ibss_process_chanswitch+0x329/0xcf0 [ 248.150988][ C0] ? trace_drv_return_int+0x1c0/0x1c0 [ 248.151031][ C0] ? ieee80211_inform_bss+0xfd0/0xfd0 [ 248.151065][ C0] ? ieee80211_mandatory_rates+0x1cc/0x230 [ 248.151090][ C0] ieee80211_ibss_rx_queued_mgmt+0x1b2d/0x2dc0 [ 248.151128][ C0] ? verify_lock_unused+0x140/0x140 [ 248.151155][ C0] ? ieee80211_ibss_rx_queued_mgmt+0xecc/0x2dc0 [ 248.151176][ C0] ? ieee80211_ibss_rx_no_sta+0x790/0x790 [ 248.151200][ C0] ? mark_lock+0x94/0x320 [ 248.151220][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 248.151240][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 248.151259][ C0] ? lock_chain_count+0x20/0x20 [ 248.151276][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 248.151306][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 248.151330][ C0] ? skb_dequeue+0x124/0x160 [ 248.151352][ C0] ieee80211_iface_work+0x730/0xc90 [ 248.151376][ C0] cfg80211_wiphy_work+0x228/0x260 [ 248.151396][ C0] ? process_scheduled_works+0x975/0x1600 [ 248.151420][ C0] process_scheduled_works+0xa60/0x1600 [ 248.151455][ C0] ? worker_attach_to_pool+0x370/0x370 [ 248.151479][ C0] ? assign_work+0x3cc/0x5d0 [ 248.151508][ C0] worker_thread+0xa5e/0xfe0 [ 248.151541][ C0] kthread+0x2fa/0x390 [ 248.151556][ C0] ? pr_cont_work+0x550/0x550 [ 248.151577][ C0] ? kthread_blkcg+0xd0/0xd0 [ 248.151593][ C0] ret_from_fork+0x48/0x80 [ 248.151612][ C0] ? kthread_blkcg+0xd0/0xd0 [ 248.151629][ C0] ret_from_fork_asm+0x11/0x20 [ 248.151658][ C0] [ 248.161387][ T28] Kernel panic - not syncing: hung_task: blocked tasks [ 248.161419][ T28] CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 [ 248.161470][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 248.161519][ T28] Call Trace: [ 248.161539][ T28] [ 248.161560][ T28] dump_stack_lvl+0x18c/0x250 [ 248.161632][ T28] ? show_regs_print_info+0x20/0x20 [ 248.161693][ T28] ? load_image+0x420/0x420 [ 248.161836][ T28] panic+0x2ca/0x720 [ 248.161925][ T28] ? bpf_jit_dump+0xd0/0xd0 [ 248.162006][ T28] ? __irq_work_queue_local+0x13a/0x3b0 [ 248.162070][ T28] ? preempt_schedule_thunk+0x1a/0x30 [ 248.162151][ T28] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 248.162233][ T28] watchdog+0xf98/0xfa0 [ 248.162312][ T28] ? watchdog+0x1e1/0xfa0 [ 248.162396][ T28] kthread+0x2fa/0x390 [ 248.162447][ T28] ? hungtask_pm_notify+0x50/0x50 [ 248.162513][ T28] ? kthread_blkcg+0xd0/0xd0 [ 248.162565][ T28] ret_from_fork+0x48/0x80 [ 248.162633][ T28] ? kthread_blkcg+0xd0/0xd0 [ 248.162686][ T28] ret_from_fork_asm+0x11/0x20 [ 248.162789][ T28] [ 248.164055][ T28] Kernel Offset: disabled [ 248.544671][ T28] Rebooting in 86400 seconds..