last executing test programs: 17.269825707s ago: executing program 2 (id=2769): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, 0x0, &(0x7f00000000c0)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdir(&(0x7f00000000c0)='./file0\x00', 0x80) bpf$BPF_BTF_LOAD(0x26, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) 17.040103208s ago: executing program 2 (id=2772): openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r0, 0xae80, 0x0) 16.800957949s ago: executing program 2 (id=2774): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYRES16=r1, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0) 16.564887911s ago: executing program 2 (id=2779): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) umount2(&(0x7f00000001c0)='./file0/../file0\x00', 0xa) 16.36371297s ago: executing program 2 (id=2782): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(&(0x7f00000000c0), 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d3120900"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16.200216348s ago: executing program 2 (id=2783): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r2 = accept(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000020), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000030)=@gcm_128={{0x303}}, 0x28) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000020), 0x4) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000080)=@gcm_128={{0x303}}, 0x28) sendmsg$inet(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000002980)=[{&(0x7f00000005c0)="0031d69c1763114f09661ee053f1c246559b6b24cdc2ccb6e7db4a7e7b58f772c88cce51c9bba713bcd1a9cbcedb2c8668ca5fec734b4b4582a146c0e1477f47c6b85e8588be5e99038a50c35643a84ce2d85f966b3427b14976c693d7529fb66459e519e650caca2d93fb6ae4b86a140447d6e6c337a86b9941b3d98abb07edb76adceb489ac29ba71628d7aff988fcdd24b85087ea96fa7c6824a86ae148a035195f8236ab8d5f4a9005e6bdbfd3f1d2de6dd68c17bbe67eb11c8f74eba19cf5deb007c8e7880f4ca16019b8261c6800c4a405ede096dfc5738366ea073fb80c132f87d7e42adea38200000086287d32a624a20cb3cac2d63d77eed2c65dac845e40be457cde5db036320b65f0dfe078d5832d714fc9df807dff8f3f483ee523efe451318982bac900885f70dacf2f22ac2718bdda3615f32aebc69c419420e4524b", 0x143}], 0x1}, 0x0) recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000780)=""/261, 0x105}], 0x1}, 0x40) 15.772202159s ago: executing program 32 (id=2783): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r2 = accept(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000020), 0x4) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000030)=@gcm_128={{0x303}}, 0x28) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000020), 0x4) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000080)=@gcm_128={{0x303}}, 0x28) sendmsg$inet(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000002980)=[{&(0x7f00000005c0)="0031d69c1763114f09661ee053f1c246559b6b24cdc2ccb6e7db4a7e7b58f772c88cce51c9bba713bcd1a9cbcedb2c8668ca5fec734b4b4582a146c0e1477f47c6b85e8588be5e99038a50c35643a84ce2d85f966b3427b14976c693d7529fb66459e519e650caca2d93fb6ae4b86a140447d6e6c337a86b9941b3d98abb07edb76adceb489ac29ba71628d7aff988fcdd24b85087ea96fa7c6824a86ae148a035195f8236ab8d5f4a9005e6bdbfd3f1d2de6dd68c17bbe67eb11c8f74eba19cf5deb007c8e7880f4ca16019b8261c6800c4a405ede096dfc5738366ea073fb80c132f87d7e42adea38200000086287d32a624a20cb3cac2d63d77eed2c65dac845e40be457cde5db036320b65f0dfe078d5832d714fc9df807dff8f3f483ee523efe451318982bac900885f70dacf2f22ac2718bdda3615f32aebc69c419420e4524b", 0x143}], 0x1}, 0x0) recvmsg(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000780)=""/261, 0x105}], 0x1}, 0x40) 10.436366523s ago: executing program 4 (id=2830): r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 10.241322782s ago: executing program 4 (id=2832): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.962942716s ago: executing program 4 (id=2836): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40280, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r0 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r0, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0", 0x49}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b4", 0x3a}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 9.836670382s ago: executing program 4 (id=2837): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129642, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x202000, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x6, 0x99, 0x9, 0x5, 0x6, 0x40000007, 0xfffffff7, 0x6d, 0x2, 0x9, 0xd05, 0x1000044, 0x4, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x5, 0x7, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0x5, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0xf06, 0x8, 0x2, 0x0, 0x9, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x5, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x5, 0x40fff, 0x1ff, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0x0, 0xd, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x80000000, 0x1, 0x0, 0x7, 0x8001, 0x2, 0x6, 0x4, 0xc, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x10000002, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0x8, 0x8001, 0x4, 0x6, 0x7, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0x8001, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x48001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0xffff6f3c, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0x80, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x6, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x1, 0x9da, 0x9, 0x6, 0xea6, 0x3, 0x5, 0x10, 0x8, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0x6, 0x9, 0x5, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x4, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x7ff, 0xfffffffe, 0x0, 0xb, 0xfffffff7, 0x8000008, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0x0, 0xf, 0x1982, 0x1, 0x80000000, 0x1, 0x9, 0x6, 0x7ffc, 0x2, 0x1, 0x2, 0x2, 0x9, 0x5, 0xffffff1c, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x9, 0x1b8f, 0x14, 0x65, 0xc00, 0x9, 0xd, 0x3, 0x88, 0x10004, 0x295, 0x6, 0xcb1, 0x1, 0xb7e, 0x10001, 0x8000002, 0xa, 0x6, 0x1, 0x2, 0x3ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d4, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x5, 0x7fffffff, 0x80, 0x2, 0x90, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xfffffffe, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xfff, 0x421, 0x3ff, 0x2, 0xd, 0xfb6, 0xc, 0xfffffffd, 0xac, 0x4a0, 0xa, 0x0, 0x1, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 9.523527286s ago: executing program 4 (id=2839): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(0x0, 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x2) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e9"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 8.894686886s ago: executing program 4 (id=2840): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(&(0x7f00000000c0), 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 5.198931723s ago: executing program 3 (id=2876): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_setup(0x162e, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}, 0x80) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r5], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 4.813541021s ago: executing program 3 (id=2878): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060001"], 0x38}}, 0x0) 4.62538901s ago: executing program 3 (id=2879): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.230633408s ago: executing program 3 (id=2881): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(&(0x7f00000000c0), 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e9"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.228316749s ago: executing program 5 (id=2882): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a3000000000080041007369770014003300776c616e30"], 0x38}}, 0x0) 3.974037521s ago: executing program 5 (id=2885): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) write$uinput_user_dev(r1, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x3, 0x7}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x63, 0x0, 0x7f, 0xc, 0x4, 0x9, 0x1, 0x4, 0x8001000, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x5, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0xda40, 0x4, 0xa, 0x6, 0x3, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x3, 0x7, 0x5, 0x0, 0x24a, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0xfffffff8, 0x40, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x8, 0x7ff, 0x6, 0x7, 0x0, 0x6, 0xffff3f16, 0xa, 0x2, 0x9, 0xb, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xffff7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x9, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x13, 0x4, 0x8, 0x1, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x3, 0x0, 0x8, 0xdd, 0x1, 0x1400, 0xc3, 0x17a1, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xf, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8, 0x1900, 0x4, 0xc, 0x8, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 3.691582164s ago: executing program 3 (id=2887): recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="c744240077dd0000c74424027fbe0000c744240600000000c4021590347bb8010000000f01c1440f21ebdede0f01f866baf80cb8e4f61882ef66b8795966ef7c5e0080010066b8de000f00d02e0f5ffa0f01c9460fc79b06940000", 0x5b}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.241144725s ago: executing program 3 (id=2890): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129642, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, 0x0, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x6, 0x99, 0x9, 0x5, 0x6, 0x40000007, 0xfffffff7, 0x6d, 0x2, 0x9, 0xd05, 0x1000044, 0x4, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x5, 0x7, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0x5, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0xf06, 0x8, 0x2, 0x0, 0x9, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x2, 0x5, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x5, 0x40fff, 0x1ff, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x9b4, 0x1, 0x8, 0x0, 0x8, 0x0, 0xd, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x80000000, 0x1, 0x0, 0x7, 0x8001, 0x2, 0x6, 0x4, 0xc, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x10000002, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0x8, 0x8001, 0x4, 0x6, 0x7, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0x8001, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x48001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0xffff6f3c, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0x80, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x6, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x1, 0x9da, 0x9, 0x6, 0xea6, 0x3, 0x5, 0x10, 0x8, 0xffffffff, 0x3ff, 0x96, 0x7, 0x2, 0x6, 0x9, 0x5, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x4, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x7ff, 0xfffffffe, 0x0, 0xb, 0xfffffff7, 0x8000008, 0x101, 0xc57, 0x5, 0x2, 0x5, 0x8, 0x0, 0xf, 0x1982, 0x1, 0x80000000, 0x1, 0x9, 0x6, 0x7ffc, 0x2, 0x1, 0x2, 0x2, 0x9, 0x5, 0xffffff1c, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x9, 0x1b8f, 0x14, 0x65, 0xc00, 0x9, 0xd, 0x3, 0x88, 0x10004, 0x295, 0x6, 0xcb1, 0x1, 0xb7e, 0x10001, 0x8000002, 0xa, 0x6, 0x1, 0x2, 0x3ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d4, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xfffffeff, 0x2, 0x5, 0x7fffffff, 0x80, 0x2, 0x90, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xfffffffe, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xfff, 0x421, 0x3ff, 0x2, 0xd, 0xfb6, 0xc, 0xfffffffd, 0xac, 0x4a0, 0xa, 0x0, 0x1, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 2.73728669s ago: executing program 5 (id=2894): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000"], 0x18}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.534577439s ago: executing program 1 (id=2896): socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000000)={@empty, @multicast, @void, {@can={0xc, {{0x4, 0x0, 0x1}, 0x5, 0x2, 0x0, 0x0, "fbd4e54ac3821fd5"}}}}, &(0x7f0000000040)={0x800001, 0x4, [0x8f1, 0xe0f, 0xd9f, 0xaba]}) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0xfffffffffffffdf4}], 0x1, 0x3b, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x4, 0x80000000002, 0x183, 0x400000004, 0x0, 0x8, 0x80000001, 0x3, 0x1000045, 0xfffc, 0x9, 0xf, 0x6, 0x0, 0x1], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000040)=0x8, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeeb, 0x8031, 0xffffffffffffffff, 0xc369d000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xe0042, 0x1ff) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e25, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) 2.534387879s ago: executing program 5 (id=2897): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(&(0x7f00000000c0), 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e9"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.357319458s ago: executing program 0 (id=2898): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000440)='./proc\x00', 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdir(&(0x7f00000000c0)='./file0\x00', 0x80) bpf$BPF_BTF_LOAD(0x26, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) 2.198611245s ago: executing program 0 (id=2899): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(0x0, 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x2) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.185048116s ago: executing program 5 (id=2900): recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="c744240077dd0000c74424027fbe0000c744240600000000c4021590347bb8010000000f01c1440f21ebdede0f01f866baf80cb8e4f61882ef66b8795966ef7c5e0080010066b8de000f00d02e0f5ffa0f01c9460fc79b06940000", 0x5b}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.874402821s ago: executing program 5 (id=2901): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000940)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x200}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0xa4}}, 0x0) 1.806338094s ago: executing program 0 (id=2902): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_uring_setup(0x162e, &(0x7f0000000080)={0x0, 0x5869, 0x10, 0x4, 0x26}) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa0}, 0x80) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r5], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.485974009s ago: executing program 1 (id=2903): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.440178292s ago: executing program 0 (id=2904): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x8) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000240)={0x200a00000, 0x0, 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r0}}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xfffff000) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x4c831, r0, 0x0) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') 1.26003203s ago: executing program 1 (id=2906): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000"], 0x18}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 1.112167067s ago: executing program 1 (id=2907): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080)={0x1, 0x4e10db25}, 0x8) shutdown(r0, 0x1) 901.176447ms ago: executing program 1 (id=2908): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, 0x0, 0x0, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 839.96993ms ago: executing program 1 (id=2909): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, &(0x7f00000000c0)="0f01ca66b82c010f00d0b9800000c00f3235000400000f30670f01cf660f38810c87c4e27d58954fd287989afcffffff57003e0f215bc4e2f93306c4c27924b0a5000000", 0x44}], 0x1, 0x56, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 804.433732ms ago: executing program 0 (id=2910): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdir(&(0x7f00000000c0)='./file0\x00', 0x80) bpf$BPF_BTF_LOAD(0x26, 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) 0s ago: executing program 0 (id=2911): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mtd(&(0x7f00000000c0), 0x51e, 0x141002) openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e9"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000840}, 0x8000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 190.829712][ T8485] kvm [8482]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 190.870966][ T8485] kvm [8482]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 191.221354][ T4277] Bluetooth: hci1: command 0x0406 tx timeout [ 191.221328][ T4279] Bluetooth: hci3: command 0x0406 tx timeout [ 191.227386][ T4277] Bluetooth: hci2: command 0x0406 tx timeout [ 191.227411][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 191.227435][ T4277] Bluetooth: hci0: command 0x0406 tx timeout [ 191.267943][ T8505] netlink: 'syz.0.1271': attribute type 1 has an invalid length. [ 192.757748][ T26] audit: type=1326 audit(1789780923.447:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8561 comm="syz.4.1283" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f962dd9e159 code=0x0 [ 192.965367][ T8570] netlink: 'syz.3.1285': attribute type 1 has an invalid length. [ 193.047336][ T8565] kvm [8561]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 193.074192][ T8565] kvm [8561]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 193.539950][ T4279] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 193.540235][ T49] Bluetooth: hci5: command 0x1003 tx timeout [ 194.271417][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.277927][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.026070][ T8635] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1297'. [ 195.177760][ T8640] netlink: 'syz.3.1298': attribute type 1 has an invalid length. [ 195.221983][ T8640] netlink: 'syz.3.1298': attribute type 1 has an invalid length. [ 195.395253][ T26] audit: type=1326 audit(1789780926.087:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8645 comm="syz.0.1301" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f113b19e159 code=0x0 [ 195.633345][ T8649] kvm_pr_unimpl_wrmsr: 5 callbacks suppressed [ 195.633360][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 195.720847][ T8649] kvm [8645]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 195.757383][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 195.769628][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 195.798790][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 195.826703][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 195.850579][ T8649] kvm [8645]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 196.754363][ T8694] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1309'. [ 196.936035][ T8700] netlink: 'syz.1.1311': attribute type 1 has an invalid length. [ 196.961070][ T8700] netlink: 'syz.1.1311': attribute type 1 has an invalid length. [ 197.460332][ T4279] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 197.460412][ T49] Bluetooth: hci5: command 0x1003 tx timeout [ 198.133895][ T26] audit: type=1326 audit(1789780928.827:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8730 comm="syz.3.1319" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcbe59e159 code=0x0 [ 198.281267][ T8738] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1320'. [ 198.578444][ T8753] netlink: 'syz.0.1323': attribute type 1 has an invalid length. [ 198.584223][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 198.606134][ T8753] netlink: 'syz.0.1323': attribute type 1 has an invalid length. [ 198.668681][ T8739] kvm [8730]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 198.703994][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 198.760781][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 198.812075][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 198.860517][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 198.911770][ T8739] kvm [8730]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 199.554669][ T8792] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1332'. [ 199.784976][ T8804] Failed to get privilege flags for destination (handle=0x2:0x2) [ 200.086437][ T8811] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 200.093017][ T8811] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 200.111174][ T8811] vhci_hcd vhci_hcd.0: Device attached [ 200.117656][ T8814] vhci_hcd: connection closed [ 200.118433][ T11] vhci_hcd: stop threads [ 200.136768][ T11] vhci_hcd: release socket [ 200.148103][ T11] vhci_hcd: disconnect device [ 200.231447][ T8819] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1337'. [ 200.241305][ T8819] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1337'. [ 200.809967][ T26] audit: type=1326 audit(1789780931.497:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8840 comm="syz.3.1342" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcbe59e159 code=0x0 [ 200.900003][ T49] Bluetooth: hci5: command 0x1003 tx timeout [ 200.900070][ T4279] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 201.454932][ T8864] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1346'. [ 201.548187][ T8866] netlink: 'syz.4.1347': attribute type 4 has an invalid length. [ 201.623264][ T8870] netlink: 'syz.4.1347': attribute type 4 has an invalid length. [ 201.972442][ T8884] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1350'. [ 202.054100][ T8884] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1350'. [ 202.688958][ T8918] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1360'. [ 202.854183][ T26] audit: type=1326 audit(1789780933.547:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8925 comm="syz.1.1362" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fecf099e159 code=0x0 [ 203.156859][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 203.161252][ T8945] netlink: 'syz.0.1364': attribute type 4 has an invalid length. [ 203.187069][ T8936] kvm [8925]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 203.210186][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 203.231986][ T8947] netlink: 'syz.0.1364': attribute type 4 has an invalid length. [ 203.249617][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 203.267015][ T8949] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1365'. [ 203.277682][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 203.294184][ T8949] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1365'. [ 203.299927][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 203.337283][ T8936] kvm [8925]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 204.219425][ T8991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1372'. [ 204.252313][ T8991] netlink: 'syz.2.1372': attribute type 7 has an invalid length. [ 204.277213][ T8991] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1372'. [ 204.420074][ T49] Bluetooth: hci5: command 0x1003 tx timeout [ 204.420134][ T4279] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 204.897813][ T9013] netlink: 'syz.3.1377': attribute type 4 has an invalid length. [ 204.969835][ T9012] netlink: 'syz.3.1377': attribute type 4 has an invalid length. [ 205.133170][ T26] audit: type=1326 audit(1789780935.827:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9021 comm="syz.4.1381" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f962dd9e159 code=0x0 [ 205.434578][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 205.457405][ T9026] kvm [9021]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 205.506468][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 205.553432][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 205.568419][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 205.570975][ T9041] __nla_validate_parse: 2 callbacks suppressed [ 205.570989][ T9041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1386'. [ 205.581141][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 205.594550][ T9041] netlink: 'syz.3.1386': attribute type 7 has an invalid length. [ 205.607667][ T9026] kvm [9021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 205.645510][ T9041] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1386'. [ 206.296362][ T9062] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1393'. [ 206.341257][ T9062] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1393'. [ 206.559184][ T9072] netlink: 'syz.1.1396': attribute type 4 has an invalid length. [ 206.647635][ T9075] netlink: 'syz.1.1396': attribute type 4 has an invalid length. [ 206.975119][ T9089] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1400'. [ 206.986295][ T9094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1401'. [ 207.017001][ T9094] netlink: 'syz.1.1401': attribute type 7 has an invalid length. [ 207.046312][ T9094] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1401'. [ 207.275969][ T26] audit: type=1326 audit(1789780937.967:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9097 comm="syz.1.1403" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fecf099e159 code=0x0 [ 207.537136][ T9104] kvm [9097]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 207.564388][ T9104] kvm [9097]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 207.780421][ T4279] Bluetooth: hci2: command 0x0409 tx timeout [ 207.780570][ T9124] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1407'. [ 207.824798][ T9124] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1407'. [ 208.459493][ T9144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1414'. [ 208.509629][ T9144] netlink: 'syz.0.1414': attribute type 1 has an invalid length. [ 209.214216][ T9180] netlink: 'syz.1.1422': attribute type 7 has an invalid length. [ 209.246416][ T26] audit: type=1326 audit(1789780939.937:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9183 comm="syz.3.1423" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcbe59e159 code=0x0 [ 209.273887][ T9189] netlink: 'syz.1.1422': attribute type 7 has an invalid length. [ 209.611992][ T9191] kvm_pr_unimpl_wrmsr: 5 callbacks suppressed [ 209.612008][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 209.749606][ T9191] kvm [9183]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 209.816919][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 209.856503][ T9208] netlink: 'syz.4.1429': attribute type 1 has an invalid length. [ 209.897592][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 209.936783][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 209.990245][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 210.027781][ T9191] kvm [9183]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 210.780630][ T9237] __nla_validate_parse: 7 callbacks suppressed [ 210.780645][ T9237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1437'. [ 210.838577][ T9237] netlink: 'syz.2.1437': attribute type 7 has an invalid length. [ 210.878337][ T9237] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1437'. [ 210.941055][ T9243] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1437'. [ 210.994447][ T9243] netlink: 'syz.2.1437': attribute type 7 has an invalid length. [ 211.030359][ T9243] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1437'. [ 211.231343][ T9254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1440'. [ 211.256629][ T9254] netlink: 'syz.4.1440': attribute type 1 has an invalid length. [ 211.276641][ T9254] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1440'. [ 211.290016][ T9220] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 211.546776][ T9269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1453'. [ 211.728906][ T26] audit: type=1326 audit(1789780942.417:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9275 comm="syz.4.1445" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f962dd9e159 code=0x0 [ 212.057160][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 212.103285][ T9282] kvm [9275]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 212.130944][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 212.168646][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 212.204968][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 212.245788][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 212.280615][ T9282] kvm [9275]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 212.390851][ T9306] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1452'. [ 212.404386][ T9306] validate_nla: 1 callbacks suppressed [ 212.404400][ T9306] netlink: 'syz.0.1452': attribute type 7 has an invalid length. [ 212.433771][ T9306] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1452'. [ 212.462911][ T9308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1452'. [ 212.489039][ T9308] netlink: 'syz.0.1452': attribute type 7 has an invalid length. [ 212.728497][ T9311] netlink: 'syz.0.1464': attribute type 1 has an invalid length. [ 212.746112][ T9311] netlink: 'syz.0.1464': attribute type 1 has an invalid length. [ 212.934577][ T9322] netlink: 'syz.0.1456': attribute type 1 has an invalid length. [ 213.554394][ T26] audit: type=1326 audit(1789780944.247:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9344 comm="syz.0.1465" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f113b19e159 code=0x0 [ 213.706737][ T9352] netlink: 'syz.3.1467': attribute type 1 has an invalid length. [ 213.730147][ T9352] netlink: 'syz.3.1467': attribute type 1 has an invalid length. [ 213.881984][ T9348] kvm [9344]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 213.919621][ T9348] kvm [9344]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 213.979013][ T9360] netlink: 'syz.1.1470': attribute type 1 has an invalid length. [ 215.017204][ T26] audit: type=1326 audit(1789780945.707:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9385 comm="syz.0.1482" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f113b19e159 code=0x0 [ 215.320404][ T9397] kvm_pr_unimpl_wrmsr: 5 callbacks suppressed [ 215.320421][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 215.388105][ T9397] kvm [9385]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 215.415176][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 215.458988][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 215.496340][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 215.528814][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 215.580632][ T9397] kvm [9385]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 215.636755][ T9417] netlink: 'syz.3.1481': attribute type 1 has an invalid length. [ 215.652084][ T9417] netlink: 'syz.3.1481': attribute type 1 has an invalid length. [ 216.902600][ T9459] __nla_validate_parse: 16 callbacks suppressed [ 216.902615][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1494'. [ 216.978177][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1494'. [ 217.230003][ T26] audit: type=1326 audit(1789780947.917:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9468 comm="syz.1.1499" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fecf099e159 code=0x0 [ 217.246565][ T9469] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1498'. [ 217.513166][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 217.562879][ T9478] kvm [9468]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 217.594453][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 217.625050][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 217.645278][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 217.710968][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 217.737174][ T9478] kvm [9468]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 218.231267][ T9512] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1509'. [ 218.291021][ T9512] validate_nla: 4 callbacks suppressed [ 218.291034][ T9512] netlink: 'syz.0.1509': attribute type 1 has an invalid length. [ 218.359412][ T9514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1509'. [ 218.385301][ T9514] netlink: 'syz.0.1509': attribute type 1 has an invalid length. [ 218.406333][ T9518] netlink: 'syz.4.1510': attribute type 1 has an invalid length. [ 219.031682][ T9538] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1518'. [ 219.473012][ T26] audit: type=1326 audit(1789780950.167:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9556 comm="syz.2.1522" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f695b99e159 code=0x0 [ 219.496422][ C1] vkms_vblank_simulate: vblank timer overrun [ 219.535253][ T9557] netlink: 'syz.3.1524': attribute type 1 has an invalid length. [ 219.560316][ T9560] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1523'. [ 219.612715][ T9560] netlink: 'syz.4.1523': attribute type 1 has an invalid length. [ 219.676751][ T9566] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1523'. [ 219.755790][ T9566] netlink: 'syz.4.1523': attribute type 1 has an invalid length. [ 219.817721][ T9562] kvm [9556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 219.906038][ T9562] kvm [9556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 220.682696][ T26] audit: type=1326 audit(1789780951.377:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9606 comm="syz.2.1546" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f695b99e159 code=0x0 [ 220.864007][ T9611] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1536'. [ 221.013793][ T9614] kvm_pr_unimpl_wrmsr: 5 callbacks suppressed [ 221.013857][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 221.055916][ T9614] kvm [9606]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 221.090288][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 221.131559][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 221.196962][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 221.206740][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 221.219575][ T9623] netlink: 'syz.1.1539': attribute type 1 has an invalid length. [ 221.229407][ T9614] kvm [9606]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 221.290697][ T9627] netlink: 'syz.3.1541': attribute type 1 has an invalid length. [ 221.319606][ T9627] netlink: 'syz.3.1541': attribute type 1 has an invalid length. [ 223.070936][ T9685] netlink: 'syz.3.1557': attribute type 1 has an invalid length. [ 223.260999][ T9693] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1554'. [ 223.362431][ T26] audit: type=1326 audit(1789780954.057:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9705 comm="syz.3.1561" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcbe59e159 code=0x0 [ 223.653402][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 223.726376][ T9711] kvm [9705]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 223.770526][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 223.795896][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 223.819492][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 223.850462][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 223.898976][ T9711] kvm [9705]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 224.419458][ T9744] validate_nla: 2 callbacks suppressed [ 224.419473][ T9744] netlink: 'syz.1.1570': attribute type 1 has an invalid length. [ 224.535577][ T9750] netlink: 'syz.3.1571': attribute type 1 has an invalid length. [ 224.550770][ T9750] netlink: 'syz.3.1571': attribute type 1 has an invalid length. [ 225.287273][ T26] audit: type=1326 audit(1789780955.977:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9780 comm="syz.0.1582" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f113b19e159 code=0x0 [ 225.573425][ T9788] kvm [9780]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 225.583323][ T9792] netlink: 'syz.4.1584': attribute type 1 has an invalid length. [ 225.601214][ T9788] kvm [9780]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 225.722156][ T9798] netlink: 'syz.2.1586': attribute type 1 has an invalid length. [ 225.760882][ T9798] netlink: 'syz.2.1586': attribute type 1 has an invalid length. [ 226.820009][ T9837] netlink: 'syz.4.1599': attribute type 1 has an invalid length. [ 226.855708][ T9839] netlink: 'syz.1.1600': attribute type 1 has an invalid length. [ 226.878472][ T9839] netlink: 'syz.1.1600': attribute type 1 has an invalid length. [ 227.192888][ T26] audit: type=1326 audit(1789780957.887:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9849 comm="syz.2.1605" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f695b99e159 code=0x0 [ 227.726020][ T9873] fuse: Bad value for 'fd' [ 228.008999][ T9886] netlink: 'syz.0.1614': attribute type 1 has an invalid length. [ 228.789552][ T9904] kvm_pr_unimpl_wrmsr: 5 callbacks suppressed [ 228.789569][ T9904] kvm [9903]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 228.850465][ T9904] kvm [9903]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 228.880578][ T9904] kvm [9903]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 228.920005][ T9904] kvm [9903]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 228.950584][ T9904] kvm [9903]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 228.969624][ T9904] kvm [9903]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 229.087132][ T9924] fuse: Bad value for 'fd' [ 229.096411][ T26] audit: type=1326 audit(1789780959.787:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9926 comm="syz.3.1628" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efcbe59e159 code=0x0 [ 229.375590][ T9935] kvm [9926]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 229.445606][ T9935] kvm [9926]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 229.445657][ T9935] kvm [9926]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 229.446624][ T9935] kvm [9926]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 229.447612][ T9935] kvm [9926]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 229.448605][ T9935] kvm [9926]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 230.190460][ T9973] validate_nla: 3 callbacks suppressed [ 230.190473][ T9973] netlink: 'syz.3.1641': attribute type 1 has an invalid length. [ 230.276852][ T9973] netlink: 'syz.3.1641': attribute type 1 has an invalid length. [ 230.526176][ T9987] fuse: Bad value for 'fd' [ 230.897074][ T26] audit: type=1326 audit(1789780961.587:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10003 comm="syz.2.1652" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f695b99e159 code=0x0 [ 231.239344][T10014] kvm [10003]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 231.270981][T10014] kvm [10003]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 231.387308][T10029] netlink: 'syz.3.1658': attribute type 1 has an invalid length. [ 231.438708][T10029] netlink: 'syz.3.1658': attribute type 1 has an invalid length. [ 232.808627][T10088] ======================================================= [ 232.808627][T10088] WARNING: The mand mount option has been deprecated and [ 232.808627][T10088] and is ignored by this kernel. Remove the mand [ 232.808627][T10088] option from the mount to silence this warning. [ 232.808627][T10088] ======================================================= [ 232.843562][ C1] vkms_vblank_simulate: vblank timer overrun [ 234.516262][T10160] kvm_pr_unimpl_wrmsr: 26 callbacks suppressed [ 234.516280][T10160] kvm [10159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 234.524344][T10158] kvm [10157]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x500 [ 234.544268][T10158] kvm [10157]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc2) = 0x501 [ 234.550321][T10160] kvm [10159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 234.579583][T10160] kvm [10159]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 234.589102][T10160] kvm [10159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 234.613694][T10160] kvm [10159]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 234.642587][T10160] kvm [10159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 236.323838][T10228] kvm [10227]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x500 [ 236.385278][T10228] kvm [10227]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc2) = 0x501 [ 238.249640][T10320] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1737'. [ 238.888091][T10348] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1746'. [ 239.382827][T10380] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1752'. [ 239.885825][T10392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1756'. [ 240.492590][T10423] kvm_pr_unimpl_wrmsr: 22 callbacks suppressed [ 240.492607][T10423] kvm [10422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 240.552141][T10434] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1767'. [ 240.553021][T10423] kvm [10422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 240.596171][T10423] kvm [10422]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 240.626131][T10423] kvm [10422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 240.676965][T10423] kvm [10422]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 240.710168][T10423] kvm [10422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 240.789985][ T34] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 240.878692][T10440] kvm [10438]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x500 [ 240.947223][T10440] kvm [10438]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc2) = 0x501 [ 240.993888][ T34] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 241.020025][ T34] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.057413][ T34] usb 4-1: Product: syz [ 241.071012][ T34] usb 4-1: Manufacturer: syz [ 241.086882][ T34] usb 4-1: SerialNumber: syz [ 241.368907][ T34] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 241.595653][ T127] usb 4-1: USB disconnect, device number 3 [ 241.857664][T10494] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1776'. [ 242.274296][T10510] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1780'. [ 242.419927][ T34] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 242.427817][ T34] ath9k_htc: Failed to initialize the device [ 242.462060][ T127] usb 4-1: ath9k_htc: USB layer deinitialized [ 242.513791][T10512] kvm [10507]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 242.567088][T10512] kvm [10507]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 243.365782][T10546] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1792'. [ 243.662679][T10556] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1796'. [ 243.740264][T10561] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1797'. [ 243.766543][T10561] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1797'. [ 244.865836][T10607] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1810'. [ 245.035495][T10614] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1812'. [ 245.070496][T10614] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1812'. [ 245.113488][T10612] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1811'. [ 245.823270][T10630] kvm_pr_unimpl_wrmsr: 14 callbacks suppressed [ 245.823288][T10630] kvm [10629]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 245.870519][T10630] kvm [10629]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 245.911374][T10630] kvm [10629]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 245.960606][T10630] kvm [10629]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 245.991129][T10630] kvm [10629]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 246.014864][T10630] kvm [10629]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 246.048981][T10645] kvm [10642]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x500 [ 246.059171][T10654] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1822'. [ 246.085073][T10645] kvm [10642]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc2) = 0x501 [ 246.401797][T10666] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1825'. [ 247.680015][T10707] kvm [10706]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 247.721601][T10707] kvm [10706]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 247.812806][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 247.928024][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.026914][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.086530][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.114890][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.145749][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.164558][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.187483][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.235703][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 248.287753][T10714] kvm [10712]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 249.120004][T10771] __nla_validate_parse: 5 callbacks suppressed [ 249.120021][T10771] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1854'. [ 249.193661][T10778] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1854'. [ 249.522207][T10788] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1859'. [ 250.127482][T10812] fuse: Bad value for 'group_id' [ 250.386403][T10825] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1869'. [ 250.557990][T10827] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1870'. [ 250.600247][T10827] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1870'. [ 250.889138][T10845] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1876'. [ 251.018715][T10836] kvm_pr_unimpl_wrmsr: 68 callbacks suppressed [ 251.018734][T10836] kvm [10835]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 251.069576][T10836] kvm [10835]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 251.095750][T10836] kvm [10835]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 251.114722][T10836] kvm [10835]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 251.154691][T10836] kvm [10835]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 251.185827][T10836] kvm [10835]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 251.620948][T10867] fuse: Bad value for 'group_id' [ 251.858997][T10877] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1883'. [ 251.952807][T10886] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1885'. [ 251.972549][T10886] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1885'. [ 252.266685][T10893] kvm [10891]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 252.292890][T10893] kvm [10891]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 252.322382][T10893] kvm [10891]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 252.378071][T10893] kvm [10891]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 252.844373][T10915] fuse: Bad value for 'group_id' [ 253.931985][T10955] kvm_pr_unimpl_wrmsr: 8 callbacks suppressed [ 253.932002][T10955] kvm [10953]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 254.022215][T10955] kvm [10953]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 254.376612][T10983] __nla_validate_parse: 4 callbacks suppressed [ 254.376629][T10983] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1912'. [ 254.410412][T10984] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1913'. [ 254.440232][T10984] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1913'. [ 255.308746][T11017] kvm [11016]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 255.325806][T11017] kvm [11016]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 255.661496][T11034] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1927'. [ 255.704740][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.711300][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.872036][T11037] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1928'. [ 255.933627][T11041] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1928'. [ 256.082494][T11048] Bluetooth: MGMT ver 1.22 [ 256.144057][T11048] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 256.191551][T11048] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 256.225556][T11049] fuse: Bad value for 'user_id' [ 256.251439][T11048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 256.279282][T11048] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 256.527899][T11064] FAULT_INJECTION: forcing a failure. [ 256.527899][T11064] name failslab, interval 1, probability 0, space 0, times 0 [ 256.571985][T11064] CPU: 1 PID: 11064 Comm: syz.0.1935 Not tainted syzkaller #0 [ 256.579511][T11064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 256.590396][T11064] Call Trace: [ 256.593705][T11064] [ 256.596745][T11064] dump_stack_lvl+0x188/0x24e [ 256.601474][T11064] ? show_regs_print_info+0x12/0x12 [ 256.606705][T11064] ? load_image+0x410/0x410 [ 256.611255][T11064] ? __might_sleep+0xd0/0xd0 [ 256.615873][T11064] ? __lock_acquire+0x7c40/0x7c40 [ 256.620939][T11064] should_fail_ex+0x390/0x4c0 [ 256.625685][T11064] should_failslab+0x5/0x20 [ 256.630226][T11064] slab_pre_alloc_hook+0x59/0x300 [ 256.635287][T11064] ? __rwlock_init+0x140/0x140 [ 256.640082][T11064] kmem_cache_alloc+0x56/0x2f0 [ 256.644879][T11064] ? key_alloc+0x302/0x1030 [ 256.649417][T11064] key_alloc+0x302/0x1030 [ 256.653784][T11064] keyring_alloc+0x41/0xa0 [ 256.658276][T11064] lookup_user_key+0x4da/0x1110 [ 256.663252][T11064] ? lookup_user_key_possessed+0x40/0x40 [ 256.668922][T11064] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 256.674945][T11064] ? _copy_from_user+0x10b/0x170 [ 256.679919][T11064] __se_sys_request_key+0x224/0x350 [ 256.685169][T11064] ? __x64_sys_request_key+0xa0/0xa0 [ 256.690497][T11064] ? lockdep_hardirqs_on+0x94/0x140 [ 256.695910][T11064] do_syscall_64+0x4c/0xa0 [ 256.700371][T11064] ? clear_bhb_loop+0x60/0xb0 [ 256.705249][T11064] ? clear_bhb_loop+0x60/0xb0 [ 256.709957][T11064] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 256.715891][T11064] RIP: 0033:0x7f113b19e159 [ 256.720334][T11064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 256.739973][T11064] RSP: 002b:00007f113c128028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 256.748522][T11064] RAX: ffffffffffffffda RBX: 00007f113b425fa0 RCX: 00007f113b19e159 [ 256.756525][T11064] RDX: 0000200000001fee RSI: 0000000000000000 RDI: 0000200000000040 [ 256.764551][T11064] RBP: 00007f113b23506b R08: 0000000000000000 R09: 0000000000000000 [ 256.772549][T11064] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 256.780546][T11064] R13: 00007f113b426038 R14: 00007f113b425fa0 R15: 00007fff8e74a9b8 [ 256.788547][T11064] [ 257.153127][T11085] kvm_pr_unimpl_wrmsr: 29 callbacks suppressed [ 257.153144][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 257.222921][T11085] kvm [11084]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 257.224588][T11094] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1940'. [ 257.259046][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 257.287384][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 257.346752][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 257.377643][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 257.417914][T11085] kvm [11084]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 257.431974][T11097] kvm [11096]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 257.451627][T11097] kvm [11096]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 257.473193][T11097] kvm [11096]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 257.514227][T11097] kvm [11096]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 257.521138][T11104] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1943'. [ 257.538338][T11097] kvm [11096]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 257.543779][T11104] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1943'. [ 257.998006][T11124] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 258.009420][T11128] FAULT_INJECTION: forcing a failure. [ 258.009420][T11128] name failslab, interval 1, probability 0, space 0, times 0 [ 258.019890][T11124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 258.055111][T11128] CPU: 1 PID: 11128 Comm: syz.1.1950 Not tainted syzkaller #0 [ 258.062627][T11128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.067721][T11129] fuse: Bad value for 'user_id' [ 258.072734][T11128] Call Trace: [ 258.072746][T11128] [ 258.072754][T11128] dump_stack_lvl+0x188/0x24e [ 258.072781][T11128] ? show_regs_print_info+0x12/0x12 [ 258.072799][T11128] ? load_image+0x410/0x410 [ 258.098229][T11128] ? __might_sleep+0xd0/0xd0 [ 258.102842][T11128] ? __lock_acquire+0x7c40/0x7c40 [ 258.107905][T11128] should_fail_ex+0x390/0x4c0 [ 258.112614][T11128] should_failslab+0x5/0x20 [ 258.117179][T11128] slab_pre_alloc_hook+0x59/0x300 [ 258.122224][T11128] ? __lock_acquire+0x7c40/0x7c40 [ 258.127275][T11128] ? security_prepare_creds+0x47/0x130 [ 258.132770][T11128] __kmem_cache_alloc_node+0x4f/0x270 [ 258.138174][T11128] ? security_prepare_creds+0x47/0x130 [ 258.143679][T11128] __kmalloc+0xa3/0x240 [ 258.147868][T11128] security_prepare_creds+0x47/0x130 [ 258.153178][T11128] prepare_creds+0x450/0x610 [ 258.157785][T11128] lookup_user_key+0x337/0x1110 [ 258.162661][T11128] ? lookup_user_key_possessed+0x40/0x40 [ 258.168300][T11128] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 258.174284][T11128] ? _copy_from_user+0x10b/0x170 [ 258.179223][T11128] __se_sys_request_key+0x224/0x350 [ 258.184441][T11128] ? __x64_sys_request_key+0xa0/0xa0 [ 258.189729][T11128] ? lockdep_hardirqs_on+0x94/0x140 [ 258.194933][T11128] do_syscall_64+0x4c/0xa0 [ 258.199347][T11128] ? clear_bhb_loop+0x60/0xb0 [ 258.204031][T11128] ? clear_bhb_loop+0x60/0xb0 [ 258.208745][T11128] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 258.214657][T11128] RIP: 0033:0x7fecf099e159 [ 258.219070][T11128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.238683][T11128] RSP: 002b:00007fecf17c3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 258.247101][T11128] RAX: ffffffffffffffda RBX: 00007fecf0c25fa0 RCX: 00007fecf099e159 [ 258.255244][T11128] RDX: 0000200000001fee RSI: 0000000000000000 RDI: 0000200000000040 [ 258.263240][T11128] RBP: 00007fecf0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 258.271309][T11128] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 258.279360][T11128] R13: 00007fecf0c26038 R14: 00007fecf0c25fa0 R15: 00007ffc18bb9c38 [ 258.287341][T11128] [ 258.300089][ T4279] Bluetooth: hci2: command 0x0401 tx timeout [ 258.302003][ T49] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 258.316053][T11124] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 258.353635][T11124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 258.655701][T11146] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1954'. [ 258.968969][T11150] kvm [11149]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 259.033256][T11150] kvm [11149]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 259.702884][T11191] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 259.730011][T11191] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 259.756867][T11194] FAULT_INJECTION: forcing a failure. [ 259.756867][T11194] name failslab, interval 1, probability 0, space 0, times 0 [ 259.776928][T11196] fuse: Bad value for 'user_id' [ 259.783697][T11191] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 259.794737][T11194] CPU: 1 PID: 11194 Comm: syz.3.1966 Not tainted syzkaller #0 [ 259.802256][T11194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 259.812328][T11194] Call Trace: [ 259.815623][T11194] [ 259.818571][T11194] dump_stack_lvl+0x188/0x24e [ 259.823295][T11194] ? show_regs_print_info+0x12/0x12 [ 259.828530][T11194] ? load_image+0x410/0x410 [ 259.833070][T11194] ? __might_sleep+0xd0/0xd0 [ 259.837680][T11194] ? __lock_acquire+0x7c40/0x7c40 [ 259.842742][T11194] should_fail_ex+0x390/0x4c0 [ 259.847461][T11194] should_failslab+0x5/0x20 [ 259.850913][T11191] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 259.851967][T11194] slab_pre_alloc_hook+0x59/0x300 [ 259.851993][T11194] ? __lock_acquire+0x7c40/0x7c40 [ 259.869176][T11194] ? security_prepare_creds+0x47/0x130 [ 259.874753][T11194] __kmem_cache_alloc_node+0x4f/0x270 [ 259.880164][T11194] ? security_prepare_creds+0x47/0x130 [ 259.885661][T11194] __kmalloc+0xa3/0x240 [ 259.889847][T11194] security_prepare_creds+0x47/0x130 [ 259.895161][T11194] prepare_creds+0x450/0x610 [ 259.899832][T11194] lookup_user_key+0x337/0x1110 [ 259.904717][T11194] ? lookup_user_key_possessed+0x40/0x40 [ 259.910379][T11194] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 259.916392][T11194] ? _copy_from_user+0x10b/0x170 [ 259.921358][T11194] __se_sys_request_key+0x224/0x350 [ 259.926568][T11194] ? __x64_sys_request_key+0xa0/0xa0 [ 259.931854][T11194] ? lockdep_hardirqs_on+0x94/0x140 [ 259.937054][T11194] do_syscall_64+0x4c/0xa0 [ 259.941464][T11194] ? clear_bhb_loop+0x60/0xb0 [ 259.946130][T11194] ? clear_bhb_loop+0x60/0xb0 [ 259.950799][T11194] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 259.956793][T11194] RIP: 0033:0x7efcbe59e159 [ 259.961216][T11194] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.980834][T11194] RSP: 002b:00007efcbc7f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 259.989247][T11194] RAX: ffffffffffffffda RBX: 00007efcbe825fa0 RCX: 00007efcbe59e159 [ 259.997231][T11194] RDX: 0000200000001fee RSI: 0000000000000000 RDI: 0000200000000040 [ 260.005211][T11194] RBP: 00007efcbe63506b R08: 0000000000000000 R09: 0000000000000000 [ 260.013173][T11194] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 260.021133][T11194] R13: 00007efcbe826038 R14: 00007efcbe825fa0 R15: 00007ffdaaba6168 [ 260.029107][T11194] [ 260.182834][T11203] __nla_validate_parse: 2 callbacks suppressed [ 260.182851][T11203] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1968'. [ 260.386620][T11211] netlink: 'syz.2.1970': attribute type 1 has an invalid length. [ 261.047591][T11234] kvm [11233]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 261.111190][T11234] kvm [11233]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 261.168338][T11244] 9pnet_virtio: no channels available for device syz [ 261.471784][ T4336] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 261.501328][T11258] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1982'. [ 261.682037][ T4336] usb 2-1: Using ep0 maxpacket: 32 [ 261.687858][T11268] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 261.690341][ T4336] usb 2-1: unable to get BOS descriptor or descriptor too short [ 261.699946][ T49] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 261.703221][ T4279] Bluetooth: hci2: command 0x0401 tx timeout [ 261.712758][T11268] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 261.741709][ T4336] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 261.759373][ T4336] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 261.768117][ T4336] usb 2-1: config 14 has no interface number 0 [ 261.776309][T11271] fuse: Bad value for 'user_id' [ 261.776773][T11268] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 261.783786][ T4336] usb 2-1: config 14 has no interface number 1 [ 261.795491][ T4336] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 261.808651][ T4336] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 261.822123][ T4336] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 261.837221][ T4336] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 261.853800][ T4336] usb 2-1: config 14 interface 57 has no altsetting 0 [ 261.861158][ T4336] usb 2-1: config 14 interface 228 has no altsetting 0 [ 261.867752][T11268] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 261.883144][ T4336] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 261.902010][ T4336] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.916373][ T4336] usb 2-1: Product: syz [ 261.923847][T11273] FAULT_INJECTION: forcing a failure. [ 261.923847][T11273] name failslab, interval 1, probability 0, space 0, times 0 [ 261.929803][ T4336] usb 2-1: Manufacturer: syz [ 261.950992][ T4336] usb 2-1: SerialNumber: syz [ 261.978158][T11273] CPU: 1 PID: 11273 Comm: syz.2.1984 Not tainted syzkaller #0 [ 261.985670][T11273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 261.995757][T11273] Call Trace: [ 261.999056][T11273] [ 262.002004][T11273] dump_stack_lvl+0x188/0x24e [ 262.006721][T11273] ? show_regs_print_info+0x12/0x12 [ 262.011945][T11273] ? load_image+0x410/0x410 [ 262.016477][T11273] ? __might_sleep+0xd0/0xd0 [ 262.021085][T11273] ? __lock_acquire+0x7c40/0x7c40 [ 262.026145][T11273] should_fail_ex+0x390/0x4c0 [ 262.030855][T11273] should_failslab+0x5/0x20 [ 262.035380][T11273] slab_pre_alloc_hook+0x59/0x300 [ 262.040432][T11273] ? __lock_acquire+0x7c40/0x7c40 [ 262.045486][T11273] ? security_prepare_creds+0x47/0x130 [ 262.050967][T11273] __kmem_cache_alloc_node+0x4f/0x270 [ 262.056372][T11273] ? security_prepare_creds+0x47/0x130 [ 262.061858][T11273] __kmalloc+0xa3/0x240 [ 262.066048][T11273] security_prepare_creds+0x47/0x130 [ 262.071364][T11273] prepare_creds+0x450/0x610 [ 262.075976][T11273] lookup_user_key+0x337/0x1110 [ 262.080864][T11273] ? lookup_user_key_possessed+0x40/0x40 [ 262.086515][T11273] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 262.092510][T11273] ? _copy_from_user+0x10b/0x170 [ 262.097448][T11273] __se_sys_request_key+0x224/0x350 [ 262.102643][T11273] ? __x64_sys_request_key+0xa0/0xa0 [ 262.107929][T11273] ? lockdep_hardirqs_on+0x94/0x140 [ 262.113143][T11273] do_syscall_64+0x4c/0xa0 [ 262.117554][T11273] ? clear_bhb_loop+0x60/0xb0 [ 262.122224][T11273] ? clear_bhb_loop+0x60/0xb0 [ 262.126925][T11273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 262.132820][T11273] RIP: 0033:0x7f695b99e159 [ 262.137229][T11273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.156837][T11273] RSP: 002b:00007f695c786028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 262.165250][T11273] RAX: ffffffffffffffda RBX: 00007f695bc25fa0 RCX: 00007f695b99e159 [ 262.173218][T11273] RDX: 0000200000001fee RSI: 0000000000000000 RDI: 0000200000000040 [ 262.181274][T11273] RBP: 00007f695ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 262.189240][T11273] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 262.197221][T11273] R13: 00007f695bc26038 R14: 00007f695bc25fa0 R15: 00007ffc01f8ca18 [ 262.205209][T11273] [ 262.410116][T11277] netlink: 'syz.3.1985': attribute type 1 has an invalid length. [ 262.434505][ T4336] legousbtower 2-1:14.57: interrupt endpoints not found [ 262.635466][ T4336] legousbtower 2-1:14.228: interrupt endpoints not found [ 263.161928][T11316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1994'. [ 263.312968][T11312] kvm_pr_unimpl_wrmsr: 29 callbacks suppressed [ 263.312983][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 263.356292][T11320] kvm [11319]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 263.369312][T11312] kvm [11311]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 263.378756][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 263.404128][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 263.414226][T11320] kvm [11319]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 263.423918][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 263.434238][T11320] kvm [11319]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 263.443461][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 263.445501][T11320] kvm [11319]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 263.462528][T11320] kvm [11319]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 263.473867][T11312] kvm [11311]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 263.678832][T11339] netlink: 'syz.0.1999': attribute type 1 has an invalid length. [ 264.281243][T11369] device syzkaller0 entered promiscuous mode [ 264.303268][T11369] tipc: Enabled bearer , priority 0 [ 264.316014][T11368] tipc: Resetting bearer [ 264.366302][T11370] fuse: Unknown parameter 'grou00000000000000000000' [ 264.381995][T11368] tipc: Disabling bearer [ 264.612754][T11379] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2008'. [ 264.655109][ T4336] usb 2-1: USB disconnect, device number 4 [ 265.072122][T11393] kvm [11392]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 265.111400][T11393] kvm [11392]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 265.466822][T11420] device syzkaller0 entered promiscuous mode [ 265.501405][T11420] tipc: Started in network mode [ 265.525749][T11420] tipc: Node identity f6a3b9c82ba2, cluster identity 4711 [ 265.539204][T11420] tipc: Enabled bearer , priority 0 [ 265.602344][T11419] tipc: Resetting bearer [ 265.651315][T11431] fuse: Unknown parameter 'grou00000000000000000000' [ 265.670685][T11419] tipc: Disabling bearer [ 265.683140][T11435] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2023'. [ 265.849886][ T7] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 266.075985][ T7] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 266.089237][ T7] usb 1-1: config 1 has no interface number 0 [ 266.116638][ T7] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 266.143167][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.163071][ T7] usb 1-1: Product: syz [ 266.174573][ T7] usb 1-1: Manufacturer: syz [ 266.184175][ T7] usb 1-1: SerialNumber: syz [ 266.311606][T11459] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2028'. [ 266.337411][T11459] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2028'. [ 266.382959][T11459] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.392257][T11459] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.401102][T11459] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.409878][T11459] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 266.410402][ T7] usb 1-1: 3:1 : does not exist [ 266.481263][ T7] usb 1-1: 3:2 : does not exist [ 266.583031][ T7] usb 1-1: USB disconnect, device number 4 [ 266.617821][T11463] MPTCP: kernel_bind error, err=-99 [ 267.208823][T11475] kvm [11474]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 267.263308][T11475] kvm [11474]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 267.396449][T11493] device syzkaller0 entered promiscuous mode [ 267.415643][T11493] tipc: Enabled bearer , priority 0 [ 267.434204][T11491] tipc: Resetting bearer [ 267.491930][T11491] tipc: Disabling bearer [ 267.562262][T11497] fuse: Unknown parameter 'grou00000000000000000000' [ 267.865995][T11515] jffs2: notice: (11515) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 268.279836][ T4319] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 268.472437][ T4319] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 268.494185][ T4319] usb 5-1: config 1 has no interface number 0 [ 268.519692][ T4319] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 268.538598][ T4319] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.559113][T11541] syz.2.2050 (11541) used greatest stack depth: 20800 bytes left [ 268.574545][ T4319] usb 5-1: Product: syz [ 268.599076][ T4319] usb 5-1: Manufacturer: syz [ 268.610222][ T4319] usb 5-1: SerialNumber: syz [ 268.847376][ T4319] usb 5-1: 3:1 : does not exist [ 268.855672][ T4319] usb 5-1: 3:2 : does not exist [ 268.926580][ T4319] usb 5-1: USB disconnect, device number 3 [ 269.012202][T11555] device syzkaller0 entered promiscuous mode [ 269.075026][T11555] tipc: Enabled bearer , priority 0 [ 269.128374][T11554] tipc: Resetting bearer [ 269.179982][T11554] tipc: Disabling bearer [ 269.225380][ T5706] udevd[5706]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 269.342297][T11565] fuse: Unknown parameter 'group_i00000000000000000000' [ 269.568436][T11581] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2058'. [ 269.777439][T11584] kvm_pr_unimpl_wrmsr: 23 callbacks suppressed [ 269.777458][T11584] kvm [11583]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 269.807696][T11584] kvm [11583]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 269.830956][T11584] kvm [11583]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 269.852239][T11584] kvm [11583]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 269.882450][T11584] kvm [11583]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 269.914281][T11595] kvm [11593]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 269.923671][T11584] kvm [11583]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 269.958853][T11595] kvm [11593]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 269.974760][T11595] kvm [11593]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 270.000035][T11595] kvm [11593]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 270.019506][T11595] kvm [11593]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 270.049057][T11595] kvm [11593]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 270.263437][T11607] MPTCP: kernel_bind error, err=-99 [ 270.721145][T11620] tipc: Enabling of bearer rejected, failed to enable media [ 271.172323][T11636] fuse: Unknown parameter 'group_i00000000000000000000' [ 271.190029][ T7] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 271.210064][ T4355] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 271.371528][ T7] usb 4-1: config 1 has an invalid interface number: 3 but max is 0 [ 271.389849][ T7] usb 4-1: config 1 has no interface number 0 [ 271.398248][ T7] usb 4-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 271.409436][ T4355] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 271.442274][ T4355] usb 5-1: config 0 has no interfaces? [ 271.451063][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.473914][ T4355] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 271.486733][ T7] usb 4-1: Product: syz [ 271.500913][ T7] usb 4-1: Manufacturer: syz [ 271.505685][ T4355] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 271.514298][ T7] usb 4-1: SerialNumber: syz [ 271.524449][ T4355] usb 5-1: Product: syz [ 271.528660][ T4355] usb 5-1: Manufacturer: syz [ 271.553766][ T4355] usb 5-1: SerialNumber: syz [ 271.579654][ T4355] usb 5-1: config 0 descriptor?? [ 271.752460][ T7] usb 4-1: 3:1 : does not exist [ 271.757475][ T7] usb 4-1: 3:2 : does not exist [ 271.818635][T11631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 271.832164][ T7] usb 4-1: USB disconnect, device number 4 [ 271.859656][T11631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.960089][ T4336] usb 5-1: USB disconnect, device number 4 [ 272.161588][ T5706] udevd[5706]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 272.586520][T11673] kvm [11672]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 272.596834][T11681] tipc: Enabling of bearer rejected, failed to enable media [ 272.620364][T11673] kvm [11672]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 273.511492][T11736] MPTCP: kernel_bind error, err=-99 [ 273.648091][T11744] fuse: Unknown parameter 'group_i00000000000000000000' [ 273.716143][T11747] kvm [11731]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 273.728085][T11747] kvm [11731]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 274.542372][ T7] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 274.755061][ T7] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 274.768231][ T7] usb 2-1: config 1 has no interface number 0 [ 274.804691][ T7] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 274.832495][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.853741][ T7] usb 2-1: Product: syz [ 274.864409][ T7] usb 2-1: Manufacturer: syz [ 274.876331][ T7] usb 2-1: SerialNumber: syz [ 275.126997][ T7] usb 2-1: 3:1 : does not exist [ 275.134147][ T7] usb 2-1: 3:2 : does not exist [ 275.199426][T11789] tipc: Enabling of bearer rejected, failed to enable media [ 275.202698][ T7] usb 2-1: USB disconnect, device number 5 [ 275.395371][T11796] fuse: Unknown parameter 'group_id00000000000000000000' [ 275.818156][T11805] kvm_pr_unimpl_wrmsr: 17 callbacks suppressed [ 275.818171][T11805] kvm [11804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 275.882108][T11805] kvm [11804]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 275.887722][T11811] kvm [11807]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 275.913391][T11811] kvm [11807]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 275.923698][T11805] kvm [11804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 275.925210][T11811] kvm [11807]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 275.944551][T11818] MPTCP: kernel_bind error, err=-99 [ 275.950225][T11811] kvm [11807]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 275.966921][T11811] kvm [11807]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 275.976473][T11805] kvm [11804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 275.988226][T11811] kvm [11807]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 276.015904][T11805] kvm [11804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 276.047780][T11805] kvm [11804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 276.498176][T11840] device syzkaller0 entered promiscuous mode [ 276.512579][T11840] tipc: Enabled bearer , priority 0 [ 276.528421][T11837] tipc: Resetting bearer [ 276.587444][T11837] tipc: Disabling bearer [ 276.700435][T11849] fuse: Unknown parameter 'group_id00000000000000000000' [ 277.722188][T11872] kvm [11871]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 277.747353][T11872] kvm [11871]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 278.115855][T11897] device syzkaller0 entered promiscuous mode [ 278.185831][T11900] MPTCP: kernel_bind error, err=-99 [ 278.311055][T11903] fuse: Unknown parameter 'group_id00000000000000000000' [ 279.255666][T11938] kvm [11936]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 279.273764][T11938] kvm [11936]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 279.355976][T11952] device syzkaller0 entered promiscuous mode [ 279.490854][T11956] MPTCP: kernel_bind error, err=-99 [ 279.894343][T11975] fuse: Bad value for 'user_id' [ 280.606695][T12007] kvm [12001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 280.673310][T12007] kvm [12001]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 280.755479][T12017] device syzkaller0 entered promiscuous mode [ 281.138460][T12023] kvm_pr_unimpl_wrmsr: 34 callbacks suppressed [ 281.138478][T12023] kvm [12021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 281.161579][T12023] kvm [12021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 281.212075][T12023] kvm [12021]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 281.242234][T12023] kvm [12021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 281.258159][T12034] fuse: Bad value for 'user_id' [ 281.282441][T12023] kvm [12021]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 281.313641][T12023] kvm [12021]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 282.014395][T12066] tipc: Enabled bearer , priority 0 [ 282.062282][T12063] tipc: Disabling bearer [ 282.117362][T12064] kvm [12061]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 282.133226][T12064] kvm [12061]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 282.207969][T12064] kvm [12061]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 282.232343][T12064] kvm [12061]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 282.247883][T12064] kvm [12061]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 282.259510][T12064] kvm [12061]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 282.529346][T12088] fuse: Bad value for 'user_id' [ 283.355163][T12144] tipc: Enabled bearer , priority 0 [ 283.406498][T12142] tipc: Disabling bearer [ 283.702005][ T4279] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 283.710785][ T4279] Bluetooth: hci1: Injecting HCI hardware error event [ 283.719822][ T4277] Bluetooth: hci1: hardware error 0x00 [ 284.024319][T12163] kvm [12159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 284.100312][T12163] kvm [12159]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 284.204296][T12188] fuse: Bad value for 'fd' [ 284.560752][T12201] tipc: Enabled bearer , priority 0 [ 284.622938][T12200] tipc: Disabling bearer [ 285.474766][T12232] kvm [12231]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 285.504038][T12232] kvm [12231]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 285.532414][T12241] fuse: Bad value for 'fd' [ 285.779909][ T4277] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 285.909184][T12261] device syzkaller0 entered promiscuous mode [ 285.921687][T12261] tipc: Enabled bearer , priority 0 [ 285.931416][T12260] tipc: Resetting bearer [ 285.961480][T12260] tipc: Disabling bearer [ 286.269858][ T4336] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 286.462593][ T4336] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 286.481030][ T4336] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 286.512350][ T4336] usb 1-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 286.538176][ T4336] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 286.567238][ T4336] spcp8x5 1-1:1.0: SPCP8x5 converter detected [ 286.599701][ T4336] usb 1-1: SPCP8x5 converter now attached to ttyUSB0 [ 286.930204][T12266] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 286.939907][T12266] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 286.959246][T12266] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 286.968176][T12301] fuse: Bad value for 'fd' [ 287.135706][T12303] kvm_pr_unimpl_wrmsr: 29 callbacks suppressed [ 287.135723][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 287.142647][T12264] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 287.181899][ T4319] usb 1-1: USB disconnect, device number 5 [ 287.192245][T12303] kvm [12300]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 287.219194][ T4319] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 287.229937][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 287.260714][ T4319] spcp8x5 1-1:1.0: device disconnected [ 287.281090][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 287.311039][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 287.339304][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 287.370948][T12303] kvm [12300]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 287.801557][T12327] device syzkaller0 entered promiscuous mode [ 287.825389][T12327] tipc: Enabled bearer , priority 0 [ 287.860247][T12326] tipc: Resetting bearer [ 287.919155][T12325] kvm [12324]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 287.922882][T12326] tipc: Disabling bearer [ 287.958359][T12325] kvm [12324]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 288.003317][T12325] kvm [12324]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 288.024955][T12325] kvm [12324]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 288.035677][T12325] kvm [12324]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 288.724361][T12368] fuse: Bad value for 'fd' [ 288.731521][T12362] kvm [12359]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 288.756669][T12362] kvm [12359]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 289.154407][T12383] device syzkaller0 entered promiscuous mode [ 289.184282][T12383] tipc: Enabled bearer , priority 0 [ 289.222711][T12382] tipc: Resetting bearer [ 289.311472][T12382] tipc: Disabling bearer [ 290.045226][T12419] fuse: Bad value for 'fd' [ 290.244933][T12423] kvm [12422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 290.291291][T12423] kvm [12422]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 290.474572][T12438] device syzkaller0 entered promiscuous mode [ 290.514269][T12438] tipc: Enabled bearer , priority 0 [ 290.562927][T12437] tipc: Resetting bearer [ 290.622787][T12437] tipc: Disabling bearer [ 291.420470][T12475] fuse: Bad value for 'fd' [ 291.601220][T12490] device syzkaller0 entered promiscuous mode [ 291.642315][T12490] tipc: Enabled bearer , priority 0 [ 291.658807][T12489] tipc: Resetting bearer [ 291.715405][T12489] tipc: Disabling bearer [ 291.726776][T12486] kvm [12485]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 291.761067][T12486] kvm [12485]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 292.689222][T12505] FAULT_INJECTION: forcing a failure. [ 292.689222][T12505] name failslab, interval 1, probability 0, space 0, times 0 [ 292.719189][T12505] CPU: 0 PID: 12505 Comm: syz.4.2279 Not tainted syzkaller #0 [ 292.726719][T12505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 292.736807][T12505] Call Trace: [ 292.740120][T12505] [ 292.743084][T12505] dump_stack_lvl+0x188/0x24e [ 292.747793][T12505] ? show_regs_print_info+0x12/0x12 [ 292.753019][T12505] ? load_image+0x410/0x410 [ 292.757554][T12505] ? __might_sleep+0xd0/0xd0 [ 292.762168][T12505] ? __lock_acquire+0x7c40/0x7c40 [ 292.767220][T12505] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 292.773279][T12505] should_fail_ex+0x390/0x4c0 [ 292.778024][T12505] should_failslab+0x5/0x20 [ 292.782548][T12505] slab_pre_alloc_hook+0x59/0x300 [ 292.787597][T12505] ? lockdep_hardirqs_on+0x94/0x140 [ 292.792831][T12505] kmem_cache_alloc+0x56/0x2f0 [ 292.797624][T12505] ? taskstats_exit+0x149/0xcd0 [ 292.802512][T12505] taskstats_exit+0x149/0xcd0 [ 292.807215][T12505] ? sysctl_delayacct+0x220/0x220 [ 292.812250][T12505] ? rcu_is_watching+0x11/0xa0 [ 292.817016][T12505] ? mm_trace_rss_stat+0xa7/0x250 [ 292.822041][T12505] ? sync_mm_rss+0x211/0x350 [ 292.826630][T12505] do_exit+0x94b/0x2570 [ 292.830790][T12505] ? put_task_struct+0x80/0x80 [ 292.835556][T12505] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 292.841534][T12505] ? lock_chain_count+0x20/0x20 [ 292.846378][T12505] ? _raw_spin_lock_irq+0xb7/0xf0 [ 292.851405][T12505] do_group_exit+0x229/0x2e0 [ 292.855997][T12505] ? lockdep_hardirqs_on+0x94/0x140 [ 292.861198][T12505] get_signal+0x1259/0x1340 [ 292.865799][T12505] arch_do_signal_or_restart+0xc4/0x1310 [ 292.871457][T12505] ? do_futex+0x310/0x320 [ 292.875779][T12505] ? get_sigframe_size+0x10/0x10 [ 292.880719][T12505] ? __ia32_sys_get_robust_list+0x100/0x100 [ 292.886621][T12505] ? exit_to_user_mode_loop+0x3b/0x110 [ 292.892076][T12505] exit_to_user_mode_loop+0x70/0x110 [ 292.897876][T12505] exit_to_user_mode_prepare+0xee/0x180 [ 292.903420][T12505] syscall_exit_to_user_mode+0x16/0x40 [ 292.908872][T12505] do_syscall_64+0x58/0xa0 [ 292.913281][T12505] ? clear_bhb_loop+0x60/0xb0 [ 292.917949][T12505] ? clear_bhb_loop+0x60/0xb0 [ 292.922622][T12505] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 292.928514][T12505] RIP: 0033:0x7f962dd9e159 [ 292.932920][T12505] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.952521][T12505] RSP: 002b:00007f962ec770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 292.960940][T12505] RAX: fffffffffffffe00 RBX: 00007f962e026098 RCX: 00007f962dd9e159 [ 292.968907][T12505] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f962e026098 [ 292.976871][T12505] RBP: 00007f962e026090 R08: 0000000000000000 R09: 0000000000000000 [ 292.984833][T12505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 292.992795][T12505] R13: 00007f962e026128 R14: 00007fff369dcf50 R15: 00007fff369dd038 [ 293.000767][T12505] [ 293.003852][ C0] vkms_vblank_simulate: vblank timer overrun [ 293.012695][T12542] fuse: Invalid rootmode [ 293.079027][T12552] device syzkaller0 entered promiscuous mode [ 293.102756][T12552] tipc: Enabled bearer , priority 0 [ 293.118651][T12551] tipc: Resetting bearer [ 293.205859][T12551] tipc: Disabling bearer [ 293.439171][T12557] kvm_pr_unimpl_wrmsr: 34 callbacks suppressed [ 293.439189][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 293.568568][T12557] kvm [12556]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 293.621263][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 293.661527][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 293.702692][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 293.736828][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 293.773987][T12557] kvm [12556]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 293.795580][T12567] kvm [12565]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 293.815409][T12567] kvm [12565]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 293.860689][T12567] kvm [12565]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 293.892026][T12567] kvm [12565]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 293.911569][T12567] kvm [12565]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 294.276767][T12596] device syzkaller0 entered promiscuous mode [ 294.303276][T12596] tipc: Enabled bearer , priority 0 [ 294.325954][T12594] tipc: Resetting bearer [ 294.420384][T12601] fuse: Invalid rootmode [ 294.446249][T12594] tipc: Disabling bearer [ 294.890380][T12627] random: crng reseeded on system resumption [ 295.717278][T12657] comedi comedi3: driver 'ni_daq_700' does not support attach using comedi_config [ 295.767285][T12660] device syzkaller0 entered promiscuous mode [ 295.798198][T12660] tipc: Enabled bearer , priority 0 [ 295.818596][T12659] tipc: Resetting bearer [ 295.881467][T12659] tipc: Disabling bearer [ 295.938299][T12663] fuse: Invalid rootmode [ 296.474697][T12687] kvm [12685]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 296.506959][T12687] kvm [12685]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 296.823591][T12705] 9pnet_virtio: no channels available for device syz [ 297.091517][T12713] FAULT_INJECTION: forcing a failure. [ 297.091517][T12713] name failslab, interval 1, probability 0, space 0, times 0 [ 297.183924][T12713] CPU: 0 PID: 12713 Comm: syz.2.2338 Not tainted syzkaller #0 [ 297.191452][T12713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.201531][T12713] Call Trace: [ 297.204833][T12713] [ 297.207772][T12713] dump_stack_lvl+0x188/0x24e [ 297.212483][T12713] ? show_regs_print_info+0x12/0x12 [ 297.217715][T12713] ? load_image+0x410/0x410 [ 297.222249][T12713] ? __might_sleep+0xd0/0xd0 [ 297.226864][T12713] ? __lock_acquire+0x7c40/0x7c40 [ 297.231921][T12713] should_fail_ex+0x390/0x4c0 [ 297.236634][T12713] should_failslab+0x5/0x20 [ 297.241161][T12713] slab_pre_alloc_hook+0x59/0x300 [ 297.246389][T12713] kmem_cache_alloc_lru+0x49/0x2e0 [ 297.251524][T12713] ? shmem_alloc_inode+0x24/0x40 [ 297.256493][T12713] shmem_alloc_inode+0x24/0x40 [ 297.261282][T12713] ? shmem_match+0x160/0x160 [ 297.265893][T12713] new_inode_pseudo+0x5f/0x1c0 [ 297.270684][T12713] new_inode+0x25/0x1d0 [ 297.274875][T12713] shmem_get_inode+0x327/0xbc0 [ 297.279675][T12713] shmem_fill_super+0x738/0xb60 [ 297.284560][T12713] ? shmem_reconfigure+0x790/0x790 [ 297.289703][T12713] get_tree_nodev+0xb0/0x160 [ 297.294319][T12713] vfs_get_tree+0x88/0x270 [ 297.298763][T12713] do_new_mount+0x247/0xa40 [ 297.303298][T12713] __se_sys_mount+0x2e3/0x3d0 [ 297.308003][T12713] ? __x64_sys_mount+0xc0/0xc0 [ 297.312799][T12713] ? lockdep_hardirqs_on+0x94/0x140 [ 297.312919][T12722] device syzkaller0 entered promiscuous mode [ 297.317999][T12713] ? __x64_sys_mount+0x1c/0xc0 [ 297.318062][T12713] do_syscall_64+0x4c/0xa0 [ 297.318080][T12713] ? clear_bhb_loop+0x60/0xb0 [ 297.318096][T12713] ? clear_bhb_loop+0x60/0xb0 [ 297.318112][T12713] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.318134][T12713] RIP: 0033:0x7f695b99e159 [ 297.318149][T12713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.318162][T12713] RSP: 002b:00007f695c786028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 297.318181][T12713] RAX: ffffffffffffffda RBX: 00007f695bc25fa0 RCX: 00007f695b99e159 [ 297.318193][T12713] RDX: 00002000000001c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 297.318205][T12713] RBP: 00007f695ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 297.318217][T12713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 297.318226][T12713] R13: 00007f695bc26038 R14: 00007f695bc25fa0 R15: 00007ffc01f8ca18 [ 297.318251][T12713] [ 297.318340][ C0] vkms_vblank_simulate: vblank timer overrun [ 297.346976][T12722] tipc: Enabled bearer , priority 0 [ 297.476857][T12719] tipc: Resetting bearer [ 297.537592][T12719] tipc: Disabling bearer [ 297.544002][T12729] fuse: Bad value for 'rootmode' [ 297.849872][T12749] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 4294967295 out of range (51000000..2150000000) [ 297.909338][T12745] kvm [12744]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 297.927421][T12745] kvm [12744]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 299.187635][T12790] device syzkaller0 entered promiscuous mode [ 299.235935][T12790] tipc: Enabled bearer , priority 0 [ 299.260580][T12792] FAULT_INJECTION: forcing a failure. [ 299.260580][T12792] name failslab, interval 1, probability 0, space 0, times 0 [ 299.281166][T12789] tipc: Resetting bearer [ 299.319909][T12792] CPU: 0 PID: 12792 Comm: syz.4.2356 Not tainted syzkaller #0 [ 299.327421][T12792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 299.337489][T12792] Call Trace: [ 299.340766][T12792] [ 299.343687][T12792] dump_stack_lvl+0x188/0x24e [ 299.348369][T12792] ? show_regs_print_info+0x12/0x12 [ 299.353560][T12792] ? load_image+0x410/0x410 [ 299.358060][T12792] ? __might_sleep+0xd0/0xd0 [ 299.362648][T12792] ? __lock_acquire+0x7c40/0x7c40 [ 299.367678][T12792] should_fail_ex+0x390/0x4c0 [ 299.372369][T12792] should_failslab+0x5/0x20 [ 299.376861][T12792] slab_pre_alloc_hook+0x59/0x300 [ 299.381884][T12792] kmem_cache_alloc_lru+0x49/0x2e0 [ 299.386988][T12792] ? shmem_alloc_inode+0x24/0x40 [ 299.391928][T12792] shmem_alloc_inode+0x24/0x40 [ 299.396694][T12792] ? shmem_match+0x160/0x160 [ 299.401284][T12792] new_inode_pseudo+0x5f/0x1c0 [ 299.406058][T12792] new_inode+0x25/0x1d0 [ 299.410214][T12792] shmem_get_inode+0x327/0xbc0 [ 299.414989][T12792] shmem_fill_super+0x738/0xb60 [ 299.419841][T12792] ? shmem_reconfigure+0x790/0x790 [ 299.424949][T12792] get_tree_nodev+0xb0/0x160 [ 299.429533][T12792] vfs_get_tree+0x88/0x270 [ 299.433945][T12792] do_new_mount+0x247/0xa40 [ 299.438447][T12792] __se_sys_mount+0x2e3/0x3d0 [ 299.443127][T12792] ? __x64_sys_mount+0xc0/0xc0 [ 299.447886][T12792] ? lockdep_hardirqs_on+0x94/0x140 [ 299.453080][T12792] ? __x64_sys_mount+0x1c/0xc0 [ 299.457838][T12792] do_syscall_64+0x4c/0xa0 [ 299.462247][T12792] ? clear_bhb_loop+0x60/0xb0 [ 299.466920][T12792] ? clear_bhb_loop+0x60/0xb0 [ 299.471590][T12792] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 299.477487][T12792] RIP: 0033:0x7f962dd9e159 [ 299.481895][T12792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.501496][T12792] RSP: 002b:00007f962ec98028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 299.509921][T12792] RAX: ffffffffffffffda RBX: 00007f962e025fa0 RCX: 00007f962dd9e159 [ 299.517986][T12792] RDX: 00002000000001c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 299.525949][T12792] RBP: 00007f962de3506b R08: 0000000000000000 R09: 0000000000000000 [ 299.533926][T12792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 299.541915][T12792] R13: 00007f962e026038 R14: 00007f962e025fa0 R15: 00007fff369dd038 [ 299.549994][T12792] [ 299.553094][ C0] vkms_vblank_simulate: vblank timer overrun [ 299.632082][T12789] tipc: Disabling bearer [ 299.878340][T12805] kvm_pr_unimpl_wrmsr: 23 callbacks suppressed [ 299.878358][T12805] kvm [12804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 299.914680][T12805] kvm [12804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 299.954553][T12805] kvm [12804]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 299.989950][T12805] kvm [12804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 299.991890][T12816] kvm [12814]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 300.007970][T12805] kvm [12804]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 300.012573][T12824] fuse: Bad value for 'rootmode' [ 300.033647][T12805] kvm [12804]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 300.036172][T12816] kvm [12814]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x100000000 [ 300.054036][T12816] kvm [12814]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x100000001 [ 300.064585][T12816] kvm [12814]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x1 [ 300.101328][T12816] kvm [12814]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 300.125597][T12816] kvm [12814]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 301.130202][T12865] device syzkaller0 entered promiscuous mode [ 301.179908][T12865] tipc: Enabled bearer , priority 0 [ 301.230007][T12863] tipc: Resetting bearer [ 301.313066][T12863] tipc: Disabling bearer [ 301.379203][T12872] FAULT_INJECTION: forcing a failure. [ 301.379203][T12872] name failslab, interval 1, probability 0, space 0, times 0 [ 301.417622][T12872] CPU: 1 PID: 12872 Comm: syz.1.2377 Not tainted syzkaller #0 [ 301.425141][T12872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 301.435262][T12872] Call Trace: [ 301.438563][T12872] [ 301.441510][T12872] dump_stack_lvl+0x188/0x24e [ 301.446213][T12872] ? show_regs_print_info+0x12/0x12 [ 301.451434][T12872] ? load_image+0x410/0x410 [ 301.455979][T12872] ? __might_sleep+0xd0/0xd0 [ 301.460595][T12872] ? __lock_acquire+0x7c40/0x7c40 [ 301.465642][T12872] should_fail_ex+0x390/0x4c0 [ 301.470359][T12872] should_failslab+0x5/0x20 [ 301.474873][T12872] slab_pre_alloc_hook+0x59/0x300 [ 301.479899][T12872] kmem_cache_alloc_lru+0x49/0x2e0 [ 301.485002][T12872] ? shmem_alloc_inode+0x24/0x40 [ 301.489944][T12872] shmem_alloc_inode+0x24/0x40 [ 301.494707][T12872] ? shmem_match+0x160/0x160 [ 301.499301][T12872] new_inode_pseudo+0x5f/0x1c0 [ 301.504066][T12872] new_inode+0x25/0x1d0 [ 301.508237][T12872] shmem_get_inode+0x327/0xbc0 [ 301.513012][T12872] shmem_fill_super+0x738/0xb60 [ 301.517864][T12872] ? shmem_reconfigure+0x790/0x790 [ 301.522976][T12872] get_tree_nodev+0xb0/0x160 [ 301.527587][T12872] vfs_get_tree+0x88/0x270 [ 301.532013][T12872] do_new_mount+0x247/0xa40 [ 301.536528][T12872] __se_sys_mount+0x2e3/0x3d0 [ 301.541232][T12872] ? __x64_sys_mount+0xc0/0xc0 [ 301.545998][T12872] ? lockdep_hardirqs_on+0x94/0x140 [ 301.551197][T12872] ? __x64_sys_mount+0x1c/0xc0 [ 301.555960][T12872] do_syscall_64+0x4c/0xa0 [ 301.560373][T12872] ? clear_bhb_loop+0x60/0xb0 [ 301.565044][T12872] ? clear_bhb_loop+0x60/0xb0 [ 301.569714][T12872] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 301.575609][T12872] RIP: 0033:0x7fecf099e159 [ 301.580025][T12872] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.599651][T12872] RSP: 002b:00007fecf17c3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 301.608062][T12872] RAX: ffffffffffffffda RBX: 00007fecf0c25fa0 RCX: 00007fecf099e159 [ 301.616032][T12872] RDX: 00002000000001c0 RSI: 0000200000000040 RDI: 0000000000000000 [ 301.624027][T12872] RBP: 00007fecf0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 301.632098][T12872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 301.640064][T12872] R13: 00007fecf0c26038 R14: 00007fecf0c25fa0 R15: 00007ffc18bb9c38 [ 301.648043][T12872] [ 301.825182][T12878] device syzkaller0 entered promiscuous mode [ 301.875151][T12878] tipc: Enabled bearer , priority 0 [ 301.900787][T12877] tipc: Resetting bearer [ 301.971144][T12877] tipc: Disabling bearer [ 302.019255][T12883] fuse: Bad value for 'rootmode' [ 302.164189][T12889] kvm [12886]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 302.191175][T12889] kvm [12886]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x1 [ 302.657588][T12921] netlink: 'syz.4.2391': attribute type 83 has an invalid length. [ 303.082965][T12939] device syzkaller0 entered promiscuous mode [ 303.111332][T12939] tipc: Enabled bearer , priority 0 [ 303.144730][T12938] tipc: Resetting bearer [ 303.202284][T12938] tipc: Disabling bearer [ 303.371761][T12949] fuse: Unknown parameter 'use00000000000000000000' [ 304.772981][T13002] device syzkaller0 entered promiscuous mode [ 304.795171][T13002] tipc: Enabled bearer , priority 0 [ 304.803884][T13001] tipc: Resetting bearer [ 304.835419][T13001] tipc: Disabling bearer [ 304.894840][T13004] fuse: Unknown parameter 'use00000000000000000000' [ 305.196581][T13012] kvm_pr_unimpl_wrmsr: 18 callbacks suppressed [ 305.196602][T13012] kvm [13010]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 305.268932][T13012] kvm [13010]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 305.311062][T13012] kvm [13010]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 305.339450][T13012] kvm [13010]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 305.373182][T13012] kvm [13010]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x4000000000 [ 305.382224][T13012] kvm [13010]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x187) = 0x4000000001 [ 306.219361][T13057] device syzkaller0 entered promiscuous mode [ 306.257748][T13057] tipc: Enabled bearer , priority 0 [ 306.302899][T13056] tipc: Resetting bearer [ 306.350659][T13056] tipc: Disabling bearer [ 306.440570][T13064] fuse: Unknown parameter 'use00000000000000000000' [ 306.989407][T13080] kvm [13079]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 307.032178][T13080] kvm [13079]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0xc1) = 0x1 [ 307.061457][T13080] kvm [13079]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x4000000000 [ 307.096815][T13080] kvm [13079]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x186) = 0x4000000001 [ 307.443848][T13104] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 307.761638][T13116] tipc: Enabled bearer , priority 0 [ 307.834095][T13115] tipc: Disabling bearer [ 307.934267][T13119] fuse: Unknown parameter 'user_i00000000000000000000' [ 309.039671][T13167] tipc: Enabled bearer , priority 0 [ 309.142093][T13166] tipc: Disabling bearer [ 309.303246][T13177] fuse: Unknown parameter 'user_i00000000000000000000' [ 310.449289][T13225] tipc: Enabled bearer , priority 0 [ 310.521615][T13224] tipc: Disabling bearer [ 310.728505][T13233] fuse: Unknown parameter 'user_i00000000000000000000' [ 311.677354][T13276] tipc: Enabled bearer , priority 0 [ 311.720948][T13275] tipc: Disabling bearer [ 312.132368][T13290] fuse: Unknown parameter 'user_id00000000000000000000' [ 313.009130][T13332] tipc: Enabled bearer , priority 0 [ 313.085400][T13331] tipc: Disabling bearer [ 313.375346][T13346] fuse: Unknown parameter 'user_id00000000000000000000' [ 314.163237][T13377] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2510'. [ 314.618101][T13395] tipc: Enabled bearer , priority 0 [ 314.668752][T13394] tipc: Disabling bearer [ 314.826307][T13404] fuse: Unknown parameter 'user_id00000000000000000000' [ 315.216719][T13422] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2522'. [ 316.019028][T13451] device syzkaller0 entered promiscuous mode [ 316.289324][T13458] fuse: Bad value for 'fd' [ 316.737592][T13480] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2537'. [ 317.125381][T13498] device syzkaller0 entered promiscuous mode [ 317.159094][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.165560][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.769338][T13522] fuse: Bad value for 'fd' [ 318.321106][T13550] device syzkaller0 entered promiscuous mode [ 318.857316][T13579] fuse: Bad value for 'fd' [ 319.777056][T13614] tipc: Enabling of bearer rejected, failed to enable media [ 320.449326][T13640] fuse: Unknown parameter '0x0000000000000007' [ 321.201827][T13687] tipc: Enabling of bearer rejected, failed to enable media [ 321.620657][T13703] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2593'. [ 321.893784][T13722] FAULT_INJECTION: forcing a failure. [ 321.893784][T13722] name failslab, interval 1, probability 0, space 0, times 0 [ 321.950995][T13719] fuse: Unknown parameter '0x0000000000000007' [ 321.969928][T13722] CPU: 0 PID: 13722 Comm: syz.1.2598 Not tainted syzkaller #0 [ 321.977478][T13722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 321.987553][T13722] Call Trace: [ 321.990850][T13722] [ 321.993802][T13722] dump_stack_lvl+0x188/0x24e [ 321.998506][T13722] ? show_regs_print_info+0x12/0x12 [ 322.003729][T13722] ? load_image+0x410/0x410 [ 322.008261][T13722] ? __might_sleep+0xd0/0xd0 [ 322.012882][T13722] ? __lock_acquire+0x7c40/0x7c40 [ 322.017939][T13722] should_fail_ex+0x390/0x4c0 [ 322.022647][T13722] should_failslab+0x5/0x20 [ 322.027165][T13722] slab_pre_alloc_hook+0x59/0x300 [ 322.032219][T13722] kmem_cache_alloc+0x56/0x2f0 [ 322.037002][T13722] ? getname_flags+0xb7/0x500 [ 322.041702][T13722] getname_flags+0xb7/0x500 [ 322.046223][T13722] __x64_sys_mkdir+0x5b/0x80 [ 322.050843][T13722] do_syscall_64+0x4c/0xa0 [ 322.055282][T13722] ? clear_bhb_loop+0x60/0xb0 [ 322.059979][T13722] ? clear_bhb_loop+0x60/0xb0 [ 322.064677][T13722] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.070596][T13722] RIP: 0033:0x7fecf099e159 [ 322.075022][T13722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.094628][T13722] RSP: 002b:00007fecf17c3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 322.103043][T13722] RAX: ffffffffffffffda RBX: 00007fecf0c25fa0 RCX: 00007fecf099e159 [ 322.111012][T13722] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00002000000000c0 [ 322.118975][T13722] RBP: 00007fecf0a3506b R08: 0000000000000000 R09: 0000000000000000 [ 322.126944][T13722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 322.134933][T13722] R13: 00007fecf0c26038 R14: 00007fecf0c25fa0 R15: 00007ffc18bb9c38 [ 322.142934][T13722] [ 322.987808][T13768] tipc: Enabling of bearer rejected, failed to enable media [ 323.246286][T13780] fuse: Unknown parameter '0x0000000000000007' [ 323.548138][T13797] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2612'. [ 323.623110][T13804] FAULT_INJECTION: forcing a failure. [ 323.623110][T13804] name failslab, interval 1, probability 0, space 0, times 0 [ 323.699291][T13804] CPU: 0 PID: 13804 Comm: syz.3.2614 Not tainted syzkaller #0 [ 323.706810][T13804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.716888][T13804] Call Trace: [ 323.720461][T13804] [ 323.723415][T13804] dump_stack_lvl+0x188/0x24e [ 323.728166][T13804] ? show_regs_print_info+0x12/0x12 [ 323.733398][T13804] ? load_image+0x410/0x410 [ 323.737945][T13804] ? __might_sleep+0xd0/0xd0 [ 323.742569][T13804] ? __lock_acquire+0x7c40/0x7c40 [ 323.747627][T13804] should_fail_ex+0x390/0x4c0 [ 323.752341][T13804] should_failslab+0x5/0x20 [ 323.756871][T13804] slab_pre_alloc_hook+0x59/0x300 [ 323.761928][T13804] kmem_cache_alloc+0x56/0x2f0 [ 323.766737][T13804] ? getname_flags+0xb7/0x500 [ 323.771482][T13804] getname_flags+0xb7/0x500 [ 323.776208][T13804] __x64_sys_mkdir+0x5b/0x80 [ 323.780833][T13804] do_syscall_64+0x4c/0xa0 [ 323.785256][T13804] ? clear_bhb_loop+0x60/0xb0 [ 323.789932][T13804] ? clear_bhb_loop+0x60/0xb0 [ 323.794623][T13804] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.800582][T13804] RIP: 0033:0x7efcbe59e159 [ 323.805000][T13804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 323.824703][T13804] RSP: 002b:00007efcbc7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 323.833124][T13804] RAX: ffffffffffffffda RBX: 00007efcbe825fa0 RCX: 00007efcbe59e159 [ 323.841091][T13804] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00002000000000c0 [ 323.849065][T13804] RBP: 00007efcbe63506b R08: 0000000000000000 R09: 0000000000000000 [ 323.857033][T13804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 323.865030][T13804] R13: 00007efcbe826038 R14: 00007efcbe825fa0 R15: 00007ffdaaba6168 [ 323.873047][T13804] [ 324.710840][T13879] tipc: Enabling of bearer rejected, failed to enable media [ 324.881424][T13885] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2627'. [ 324.893230][T13882] fuse: Unknown parameter '0x0000000000000007' [ 325.181833][T13893] FAULT_INJECTION: forcing a failure. [ 325.181833][T13893] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 325.215481][T13893] CPU: 0 PID: 13893 Comm: syz.4.2630 Not tainted syzkaller #0 [ 325.223014][T13893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 325.233098][T13893] Call Trace: [ 325.236403][T13893] [ 325.239394][T13893] dump_stack_lvl+0x188/0x24e [ 325.244095][T13893] ? show_regs_print_info+0x12/0x12 [ 325.249300][T13893] ? load_image+0x410/0x410 [ 325.253806][T13893] ? __lock_acquire+0x7c40/0x7c40 [ 325.258829][T13893] ? __kasan_slab_alloc+0x6b/0x80 [ 325.263855][T13893] should_fail_ex+0x390/0x4c0 [ 325.268534][T13893] strncpy_from_user+0x32/0x340 [ 325.273388][T13893] getname_flags+0xf2/0x500 [ 325.277887][T13893] __x64_sys_mkdir+0x5b/0x80 [ 325.282475][T13893] do_syscall_64+0x4c/0xa0 [ 325.286886][T13893] ? clear_bhb_loop+0x60/0xb0 [ 325.291587][T13893] ? clear_bhb_loop+0x60/0xb0 [ 325.296262][T13893] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 325.302156][T13893] RIP: 0033:0x7f962dd9e159 [ 325.306569][T13893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 325.326270][T13893] RSP: 002b:00007f962ec98028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 325.334680][T13893] RAX: ffffffffffffffda RBX: 00007f962e025fa0 RCX: 00007f962dd9e159 [ 325.342646][T13893] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00002000000000c0 [ 325.350611][T13893] RBP: 00007f962de3506b R08: 0000000000000000 R09: 0000000000000000 [ 325.358577][T13893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 325.366622][T13893] R13: 00007f962e026038 R14: 00007f962e025fa0 R15: 00007fff369dd038 [ 325.374639][T13893] [ 325.600166][T13904] fuse: Unknown parameter '0x0000000000000007' [ 326.292809][T13946] tipc: Enabling of bearer rejected, failed to enable media [ 326.994226][T13973] fuse: Unknown parameter '0x0000000000000007' [ 327.784778][T14015] tipc: Enabling of bearer rejected, failed to enable media [ 328.555400][T14053] fuse: Unknown parameter 'fd0x0000000000000007' [ 329.091959][T14085] device syzkaller0 entered promiscuous mode [ 329.138316][T14085] tipc: Enabled bearer , priority 0 [ 329.173887][T14084] tipc: Resetting bearer [ 329.262260][T14084] tipc: Disabling bearer [ 329.675240][T14110] fuse: Unknown parameter 'fd0x0000000000000007' [ 330.292492][T14140] device syzkaller0 entered promiscuous mode [ 330.303180][T14140] tipc: Enabled bearer , priority 0 [ 330.330905][T14139] tipc: Resetting bearer [ 330.431218][T14139] tipc: Disabling bearer [ 330.848212][T14163] fuse: Unknown parameter 'fd0x0000000000000007' [ 331.563235][T14200] device syzkaller0 entered promiscuous mode [ 331.616814][T14203] tipc: Enabled bearer , priority 0 [ 331.657594][T14198] tipc: Resetting bearer [ 331.766285][T14198] tipc: Disabling bearer [ 332.735587][T14254] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2725'. [ 332.938552][T14267] tipc: Enabling of bearer rejected, failed to enable media [ 333.437183][T14286] netlink: 'syz.1.2735': attribute type 5 has an invalid length. [ 334.711051][T14342] tipc: Enabling of bearer rejected, failed to enable media [ 335.074306][ T4277] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 335.084360][ T4277] CPU: 0 PID: 4277 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 335.091931][ T4277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 335.102004][ T4277] Workqueue: hci0 hci_rx_work [ 335.106698][ T4277] Call Trace: [ 335.109973][ T4277] [ 335.112898][ T4277] dump_stack_lvl+0x188/0x24e [ 335.117575][ T4277] ? show_regs_print_info+0x12/0x12 [ 335.122770][ T4277] ? load_image+0x410/0x410 [ 335.127291][ T4277] sysfs_create_dir_ns+0x26a/0x290 [ 335.132401][ T4277] ? __lock_acquire+0x7c40/0x7c40 [ 335.137447][ T4277] ? sysfs_warn_dup+0xa0/0xa0 [ 335.142216][ T4277] ? do_raw_spin_unlock+0x11d/0x230 [ 335.147414][ T4277] kobject_add_internal+0x617/0xca0 [ 335.152625][ T4277] kobject_add+0x160/0x230 [ 335.157039][ T4277] ? kobject_init+0x1c0/0x1c0 [ 335.161721][ T4277] ? __raw_spin_lock_init+0x41/0x100 [ 335.166999][ T4277] ? klist_children_get+0x50/0x50 [ 335.172018][ T4277] ? get_device_parent+0x121/0x3e0 [ 335.177129][ T4277] device_add+0x470/0x1050 [ 335.181554][ T4277] hci_conn_add_sysfs+0xd1/0x1e0 [ 335.186490][ T4277] le_conn_complete_evt+0xf93/0x15c0 [ 335.191893][ T4277] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 335.198154][ T4277] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 335.203792][ T4277] ? mutex_unlock+0x10/0x10 [ 335.208295][ T4277] ? skb_pull_data+0xec/0x1f0 [ 335.212973][ T4277] hci_le_conn_complete_evt+0x183/0x440 [ 335.218533][ T4277] ? hci_remote_host_features_evt+0x230/0x230 [ 335.224608][ T4277] hci_event_packet+0x7b3/0x1290 [ 335.229549][ T4277] ? lock_chain_count+0x20/0x20 [ 335.234397][ T4277] ? bis_list+0x280/0x280 [ 335.238725][ T4277] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 335.244622][ T4277] ? kcov_remote_start+0x50f/0x810 [ 335.249748][ T4277] ? lockdep_hardirqs_on+0x94/0x140 [ 335.255316][ T4277] ? hci_send_to_monitor+0x9c/0x4a0 [ 335.260539][ T4277] hci_rx_work+0x3eb/0xd40 [ 335.264971][ T4277] ? _raw_spin_unlock+0x40/0x40 [ 335.269848][ T4277] ? process_one_work+0x7b4/0x1160 [ 335.274973][ T4277] process_one_work+0x8ab/0x1160 [ 335.279923][ T4277] ? worker_detach_from_pool+0x240/0x240 [ 335.285558][ T4277] ? _raw_spin_lock_irq+0xb7/0xf0 [ 335.290587][ T4277] ? _raw_spin_lock_irqsave+0x100/0x100 [ 335.296225][ T4277] ? wq_worker_running+0x97/0x190 [ 335.301245][ T4277] worker_thread+0xaf5/0x12a0 [ 335.305941][ T4277] kthread+0x29d/0x330 [ 335.310000][ T4277] ? worker_clr_flags+0x1a0/0x1a0 [ 335.315020][ T4277] ? kthread_blkcg+0xd0/0xd0 [ 335.319612][ T4277] ret_from_fork+0x1f/0x30 [ 335.324035][ T4277] [ 335.328674][ T4277] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 335.342877][ T4277] Bluetooth: hci0: failed to register connection device [ 336.249839][T14400] FAULT_INJECTION: forcing a failure. [ 336.249839][T14400] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 336.295106][T14400] CPU: 1 PID: 14400 Comm: syz.3.2767 Not tainted syzkaller #0 [ 336.302622][T14400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 336.312706][T14400] Call Trace: [ 336.316006][T14400] [ 336.318951][T14400] dump_stack_lvl+0x188/0x24e [ 336.323657][T14400] ? show_regs_print_info+0x12/0x12 [ 336.328881][T14400] ? load_image+0x410/0x410 [ 336.333423][T14400] ? __lock_acquire+0x7c40/0x7c40 [ 336.338488][T14400] should_fail_ex+0x390/0x4c0 [ 336.343237][T14400] _copy_from_user+0x2c/0x170 [ 336.347919][T14400] __tun_chr_ioctl+0x222/0x1ed0 [ 336.352774][T14400] ? tun_flow_create+0x310/0x310 [ 336.357735][T14400] ? bpf_lsm_file_ioctl+0x5/0x10 [ 336.362789][T14400] ? security_file_ioctl+0x7c/0xa0 [ 336.367911][T14400] ? tun_chr_poll+0x630/0x630 [ 336.372593][T14400] __se_sys_ioctl+0xfa/0x170 [ 336.377275][T14400] do_syscall_64+0x4c/0xa0 [ 336.381685][T14400] ? clear_bhb_loop+0x60/0xb0 [ 336.386354][T14400] ? clear_bhb_loop+0x60/0xb0 [ 336.391078][T14400] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 336.396969][T14400] RIP: 0033:0x7efcbe59e159 [ 336.401382][T14400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 336.420980][T14400] RSP: 002b:00007efcbc7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 336.429389][T14400] RAX: ffffffffffffffda RBX: 00007efcbe825fa0 RCX: 00007efcbe59e159 [ 336.437352][T14400] RDX: 0000200000000040 RSI: 00000000400454ca RDI: 0000000000000004 [ 336.445313][T14400] RBP: 00007efcbe63506b R08: 0000000000000000 R09: 0000000000000000 [ 336.453300][T14400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 336.461281][T14400] R13: 00007efcbe826038 R14: 00007efcbe825fa0 R15: 00007ffdaaba6168 [ 336.469271][T14400] [ 336.774296][T14415] tipc: Enabling of bearer rejected, failed to enable media [ 337.303031][T14444] netlink: 27 bytes leftover after parsing attributes in process `syz.1.2777'. [ 337.331905][T14446] can0: slcan on pts0. [ 337.499831][ T4322] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 337.702237][ T4322] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 337.727789][ T4322] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 337.753303][ T4322] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 337.775482][ T4322] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 337.803493][ T4322] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 337.828677][ T4322] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.837349][T14445] can0 (unregistered): slcan off pts0. [ 337.859041][ T4322] usb 5-1: Product: syz [ 337.874398][ T4322] usb 5-1: Manufacturer: syz [ 337.889259][ T4322] usb 5-1: SerialNumber: syz [ 337.910262][ T4322] usb 5-1: config 0 descriptor?? [ 338.147023][ T4322] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 338.350092][ T4322] usb 5-1: USB disconnect, device number 5 [ 338.743150][ T4279] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 338.754686][ T4279] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 338.763085][ T4279] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 338.771334][ T4279] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 338.778907][ T4279] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 338.788119][ T4279] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 338.848020][T14497] tipc: Enabling of bearer rejected, failed to enable media [ 338.911099][ T4279] Bluetooth: Wrong link type (-22) [ 338.913852][T14496] netlink: 27 bytes leftover after parsing attributes in process `syz.0.2792'. [ 339.209461][T14488] chnl_net:caif_netlink_parms(): no params data found [ 339.384003][T14488] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.440145][T14488] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.450529][T14488] device bridge_slave_0 entered promiscuous mode [ 339.498612][T14488] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.516437][T14488] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.535703][T14488] device bridge_slave_1 entered promiscuous mode [ 339.636017][T14488] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.675598][T14488] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.772679][T14488] team0: Port device team_slave_0 added [ 339.832003][T14488] team0: Port device team_slave_1 added [ 339.878981][T14488] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 339.916570][T14488] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 340.009304][T14488] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 340.066390][T14488] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 340.083915][T14488] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 340.186012][T14488] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 340.296377][T14488] device hsr_slave_0 entered promiscuous mode [ 340.335607][T14488] device hsr_slave_1 entered promiscuous mode [ 340.345605][T14488] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 340.393527][T14488] Cannot create hsr debugfs directory [ 340.522247][T14555] netlink: 27 bytes leftover after parsing attributes in process `syz.3.2805'. [ 340.669800][ T34] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 340.804518][T14570] tipc: Enabling of bearer rejected, failed to enable media [ 340.820103][ T4279] Bluetooth: hci2: command 0x0409 tx timeout [ 340.871251][ T34] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 340.881660][T14488] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 340.907059][T14488] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 340.916843][ T34] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 340.929428][T14488] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 340.971065][ T34] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 341.012735][ T34] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 341.064050][ T34] usb 2-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 341.083349][ T34] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.091909][ T34] usb 2-1: Product: syz [ 341.096112][ T34] usb 2-1: Manufacturer: syz [ 341.101384][ T34] usb 2-1: SerialNumber: syz [ 341.108899][T14488] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 341.111048][ T34] usb 2-1: config 0 descriptor?? [ 341.334645][ T34] adutux 2-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 341.359610][T14488] 8021q: adding VLAN 0 to HW filter on device bond0 [ 341.405981][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 341.442462][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 341.474635][T14488] 8021q: adding VLAN 0 to HW filter on device team0 [ 341.491138][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 341.502262][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 341.526399][ T6658] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.533574][ T6658] bridge0: port 1(bridge_slave_0) entered forwarding state [ 341.550193][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 341.602693][ T34] usb 2-1: USB disconnect, device number 6 [ 341.613968][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 341.629295][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 341.677674][ T47] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.684884][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state [ 341.733868][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 341.783561][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 341.803226][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 341.830217][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 341.858234][T14488] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 341.899816][T14488] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 341.927995][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 341.946968][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 341.970743][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 342.017807][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 342.055526][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 342.092102][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 342.124594][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 342.154894][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 342.590878][T14638] tipc: Enabling of bearer rejected, failed to enable media [ 342.900432][ T4279] Bluetooth: hci2: command 0x041b tx timeout [ 342.925054][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 342.960904][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 342.976361][T14488] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 343.657578][T14647] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 344.071056][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 344.088640][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 344.142075][T14696] tipc: Enabled bearer , priority 0 [ 344.191416][T14695] tipc: Disabling bearer [ 344.210926][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 344.231678][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 344.245397][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.249995][ T34] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 344.254035][T14488] device veth0_vlan entered promiscuous mode [ 344.273316][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 344.282420][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 344.294482][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.307135][T14488] device veth1_vlan entered promiscuous mode [ 344.356214][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.383868][T14699] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 344.417841][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 344.436777][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 344.451117][T14699] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 344.461605][ T34] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 344.467785][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 344.493140][ T34] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 344.530953][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 344.531440][ T34] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 344.570189][T14488] device veth0_macvtap entered promiscuous mode [ 344.606244][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.607499][T14488] device veth1_macvtap entered promiscuous mode [ 344.616378][ T34] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 344.663475][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.684056][ T34] usb 1-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 344.722206][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.726640][ T34] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.742914][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.743688][T14488] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 344.772387][ T34] usb 1-1: Product: syz [ 344.784448][ T34] usb 1-1: Manufacturer: syz [ 344.796010][ T34] usb 1-1: SerialNumber: syz [ 344.799742][T14488] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 344.823637][ T34] usb 1-1: config 0 descriptor?? [ 344.834499][T14488] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 344.884906][T14699] wlan0 speed is unknown, defaulting to 1000 [ 344.893597][ T4332] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 344.903895][ T4332] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 344.914407][ T4332] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 344.923954][ T4332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 344.941186][T14488] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 344.960159][T14488] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 344.989745][ T4279] Bluetooth: hci2: command 0x040f tx timeout [ 344.997160][T14488] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 345.006882][T14699] wlan0 speed is unknown, defaulting to 1000 [ 345.014627][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 345.044350][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 345.077019][ T34] adutux 1-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 345.108340][T14488] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.118315][T14488] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.128035][T14488] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.155456][T14488] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.291939][ T76] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.300245][ T6658] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.308095][ T6658] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.338116][ T76] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.355207][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 345.374740][ T6658] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 345.401537][ T34] usb 1-1: USB disconnect, device number 6 [ 345.827184][T14754] 9pnet_virtio: no channels available for device syz [ 345.832551][T14751] kvm: pic: non byte read [ 345.845374][T14751] kvm: pic: non byte read [ 346.049140][T14758] tipc: Enabled bearer , priority 0 [ 346.113868][T14757] tipc: Disabling bearer [ 346.356294][T14763] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2852'. [ 346.560119][T14769] siw: device registration error -23 [ 346.614102][T14764] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 346.915404][ T6658] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.041347][ T4277] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 347.052518][ T4277] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 347.060391][ T49] Bluetooth: hci2: command 0x0419 tx timeout [ 347.070904][ T4277] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 347.078677][ T4277] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 347.089053][ T4277] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 347.097446][ T4277] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 347.154613][ T6658] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.309525][ T6658] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.365359][T14782] wlan0 speed is unknown, defaulting to 1000 [ 347.375677][T14793] tipc: Enabled bearer , priority 0 [ 347.456507][ T6658] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.693121][T14791] tipc: Disabling bearer [ 347.754045][T14811] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2865'. [ 347.918990][ T6658] tipc: Left network mode [ 348.204495][T14782] chnl_net:caif_netlink_parms(): no params data found [ 348.270029][ T4318] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 348.330555][T14833] siw: device registration error -23 [ 348.462063][ T4318] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 348.476799][ T4318] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 348.491750][ T4318] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 348.503889][ T4318] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 348.516139][ T4318] usb 6-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 348.525702][ T4318] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.535228][ T4318] usb 6-1: Product: syz [ 348.539562][ T4318] usb 6-1: Manufacturer: syz [ 348.559896][ T4318] usb 6-1: SerialNumber: syz [ 348.568050][ T4318] usb 6-1: config 0 descriptor?? [ 348.633732][T14782] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.661612][T14782] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.698712][T14782] device bridge_slave_0 entered promiscuous mode [ 348.741471][T14782] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.748829][T14782] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.762887][T14782] device bridge_slave_1 entered promiscuous mode [ 348.792497][ T4318] adutux 6-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 348.871756][T14782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 348.964924][T14782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 349.015843][ T4317] usb 6-1: USB disconnect, device number 2 [ 349.065907][T14858] device syzkaller0 entered promiscuous mode [ 349.104955][T14782] team0: Port device team_slave_0 added [ 349.130811][T14860] tipc: Enabled bearer , priority 0 [ 349.154230][ T4279] Bluetooth: hci4: command 0x0409 tx timeout [ 349.204544][T14782] team0: Port device team_slave_1 added [ 349.215273][T14856] tipc: Resetting bearer [ 349.313635][T14856] tipc: Disabling bearer [ 349.520289][T14852] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 349.547576][T14782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 349.555076][T14782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 349.586625][T14782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.660621][T14876] netlink: 43 bytes leftover after parsing attributes in process `syz.1.2880'. [ 349.690442][T14782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.710844][T14782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 349.739573][T14880] siw: device registration error -23 [ 349.810851][T14782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 350.048686][T14782] device hsr_slave_0 entered promiscuous mode [ 350.060173][T14782] device hsr_slave_1 entered promiscuous mode [ 350.071795][T14782] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 350.088399][T14782] Cannot create hsr debugfs directory [ 350.153866][ T6658] device hsr_slave_0 left promiscuous mode [ 350.210482][ T6658] device hsr_slave_1 left promiscuous mode [ 350.217239][ T6658] device bridge_slave_1 left promiscuous mode [ 350.241845][ T6658] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.300922][ T6658] device bridge_slave_0 left promiscuous mode [ 350.330186][ T6658] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.439442][ T6658] device veth1_macvtap left promiscuous mode [ 350.477376][ T6658] device veth0_macvtap left promiscuous mode [ 350.493164][ T6658] device veth1_vlan left promiscuous mode [ 350.513335][ T6658] device veth0_vlan left promiscuous mode [ 351.221293][ T4279] Bluetooth: hci4: command 0x041b tx timeout [ 351.505666][T14946] kvm: pic: non byte read [ 351.526973][T14946] kvm: pic: non byte read [ 352.078868][T14962] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 352.189038][ T6658] team0 (unregistering): Port device team_slave_1 removed [ 352.261088][ T6658] team0 (unregistering): Port device team_slave_0 removed [ 352.340943][ T6658] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 352.431074][ T6658] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 352.928912][ T6658] bond0 (unregistering): Released all slaves [ 353.061379][T14929] tipc: Enabled bearer , priority 0 [ 353.101796][T14912] tipc: Disabling bearer [ 353.103993][T14985] FAULT_INJECTION: forcing a failure. [ 353.103993][T14985] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.137729][T14985] CPU: 0 PID: 14985 Comm: syz.0.2910 Not tainted syzkaller #0 [ 353.145270][T14985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 353.155334][T14985] Call Trace: [ 353.158624][T14985] [ 353.161565][T14985] dump_stack_lvl+0x188/0x24e [ 353.166299][T14985] ? show_regs_print_info+0x12/0x12 [ 353.171507][T14985] ? load_image+0x410/0x410 [ 353.176046][T14985] ? __lock_acquire+0x7c40/0x7c40 [ 353.181142][T14985] ? __kasan_slab_alloc+0x6b/0x80 [ 353.186278][T14985] should_fail_ex+0x390/0x4c0 [ 353.191060][T14985] strncpy_from_user+0x32/0x340 [ 353.195939][T14985] getname_flags+0xf2/0x500 [ 353.200480][T14985] __x64_sys_mkdir+0x5b/0x80 [ 353.205082][T14985] do_syscall_64+0x4c/0xa0 [ 353.209506][T14985] ? clear_bhb_loop+0x60/0xb0 [ 353.214255][T14985] ? clear_bhb_loop+0x60/0xb0 [ 353.218944][T14985] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 353.224903][T14985] RIP: 0033:0x7f113b19e159 [ 353.229329][T14985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.248962][T14985] RSP: 002b:00007f113c128028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 353.257389][T14985] RAX: ffffffffffffffda RBX: 00007f113b425fa0 RCX: 00007f113b19e159 [ 353.265370][T14985] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00002000000000c0 [ 353.273346][T14985] RBP: 00007f113b23506b R08: 0000000000000000 R09: 0000000000000000 [ 353.281322][T14985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 353.289298][T14985] R13: 00007f113b426038 R14: 00007f113b425fa0 R15: 00007fff8e74a9b8 [ 353.297292][T14985] [ 353.691879][ C1] hrtimer: interrupt took 563156686 ns [ 353.706204][ T4279] Bluetooth: hci4: command 0x040f tx timeout [ 458.809674][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 458.816684][ C0] rcu: 1-...!: (1 GPs behind) idle=88d4/1/0x4000000000000000 softirq=61668/61669 fqs=2 [ 458.827834][ C0] (detected by 0, t=10506 jiffies, g=70073, q=155 ncpus=2) [ 458.835157][ C0] Sending NMI from CPU 0 to CPUs 1: [ 458.840376][ C1] NMI backtrace for cpu 1 [ 458.840386][ C1] CPU: 1 PID: 14782 Comm: syz-executor Not tainted syzkaller #0 [ 458.840400][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 458.840408][ C1] RIP: 0010:mark_lock+0x9/0x320 [ 458.840440][ C1] Code: 20 8e e8 9a c3 6e 00 4c 89 f7 41 89 d9 e9 79 ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 <53> 50 89 d5 49 89 f6 48 89 fb 49 bd 00 00 00 00 00 fc ff df 83 fa [ 458.840452][ C1] RSP: 0018:ffffc900001e0910 EFLAGS: 00000046 [ 458.840464][ C1] RAX: 00000000000c4060 RBX: 0000000000000000 RCX: 0000000000000001 [ 458.840473][ C1] RDX: 0000000000000000 RSI: ffff888055984708 RDI: ffff888055983c00 [ 458.840483][ C1] RBP: ffffc900001e0b70 R08: dffffc0000000000 R09: 1ffffffff2161e49 [ 458.840493][ C1] R10: dffffc0000000000 R11: fffffbfff2161e4a R12: ffff8880559846d8 [ 458.840503][ C1] R13: ffff888055983c00 R14: ffff888055984708 R15: ffff888055984728 [ 458.840513][ C1] FS: 000055558f678500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 458.840525][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 458.840535][ C1] CR2: 00007f113c106ff8 CR3: 000000005f4f9000 CR4: 00000000003526e0 [ 458.840548][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 458.840556][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 458.840564][ C1] Call Trace: [ 458.840571][ C1] [ 458.840584][ C1] __lock_acquire+0xc9a/0x7c40 [ 458.840608][ C1] ? verify_lock_unused+0x140/0x140 [ 458.840629][ C1] ? verify_lock_unused+0x140/0x140 [ 458.840647][ C1] ? debug_objects_fill_pool+0x87/0x780 [ 458.840726][ C1] lock_acquire+0x1bb/0x4a0 [ 458.840744][ C1] ? __hrtimer_run_queues+0x5e9/0xc90 [ 458.840817][ C1] ? read_lock_is_recursive+0x10/0x10 [ 458.840835][ C1] ? __rwlock_init+0x140/0x140 [ 458.840851][ C1] _raw_spin_lock_irq+0xab/0xf0 [ 458.840871][ C1] ? __hrtimer_run_queues+0x5e9/0xc90 [ 458.840886][ C1] ? _raw_spin_lock_irqsave+0x100/0x100 [ 458.840908][ C1] __hrtimer_run_queues+0x5e9/0xc90 [ 458.840923][ C1] ? ktime_get_update_offsets_now+0x95/0x3e0 [ 458.840942][ C1] ? taprio_free_sched_cb+0x190/0x190 [ 458.841020][ C1] ? hrtimer_interrupt+0x980/0x980 [ 458.841034][ C1] ? ktime_get_update_offsets_now+0x3ce/0x3e0 [ 458.841054][ C1] hrtimer_interrupt+0x399/0x980 [ 458.841076][ C1] __sysvec_apic_timer_interrupt+0x153/0x5a0 [ 458.841128][ C1] sysvec_apic_timer_interrupt+0x9b/0xc0 [ 458.841148][ C1] [ 458.841158][ C1] [ 458.841162][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 458.841177][ C1] RIP: 0010:lock_acquire+0x225/0x4a0 [ 458.841195][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04 [ 458.841207][ C1] RSP: 0018:ffffc90003d0f320 EFLAGS: 00000206 [ 458.841218][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: bbf36abf9e63f800 [ 458.841227][ C1] RDX: 0000000000000000 RSI: ffffffff8a8c2a20 RDI: ffffffff8adf68a0 [ 458.841237][ C1] RBP: ffffc90003d0f438 R08: dffffc0000000000 R09: 1ffffffff2161e48 [ 458.841247][ C1] R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 0000000000000001 [ 458.841256][ C1] R13: 1ffff920007a1e70 R14: 0000000000000246 R15: dffffc0000000000 [ 458.841274][ C1] ? read_lock_is_recursive+0x10/0x10 [ 458.841293][ C1] ? mark_lock+0x94/0x320 [ 458.841312][ C1] ? unwind_next_frame+0x1719/0x1fd0 [ 458.841358][ C1] ? deref_stack_reg+0x18e/0x220 [ 458.841374][ C1] is_bpf_text_address+0x43/0x2a0 [ 458.841416][ C1] ? is_bpf_text_address+0x22/0x2a0 [ 458.841428][ C1] ? is_bpf_text_address+0x22/0x2a0 [ 458.841441][ C1] kernel_text_address+0x9c/0xd0 [ 458.841509][ C1] __kernel_text_address+0x9/0x30 [ 458.841526][ C1] unwind_get_return_address+0x49/0x80 [ 458.841542][ C1] ? stack_trace_save+0xf0/0xf0 [ 458.841559][ C1] arch_stack_walk+0xf2/0x140 [ 458.841584][ C1] stack_trace_save+0xa6/0xf0 [ 458.841601][ C1] ? stack_trace_snprint+0xe0/0xe0 [ 458.841621][ C1] kasan_set_track+0x4b/0x70 [ 458.841640][ C1] ? kasan_set_track+0x4b/0x70 [ 458.841656][ C1] ? __kasan_slab_alloc+0x6b/0x80 [ 458.841674][ C1] ? slab_post_alloc_hook+0x4b/0x490 [ 458.841689][ C1] ? kmem_cache_alloc+0x18b/0x2f0 [ 458.841703][ C1] ? __alloc_file+0x25/0x230 [ 458.841741][ C1] ? alloc_empty_file+0x90/0x180 [ 458.841754][ C1] ? path_openat+0x11c/0x2f10 [ 458.841768][ C1] ? do_filp_open+0x1ee/0x420 [ 458.841781][ C1] ? do_sys_openat2+0x14b/0x4f0 [ 458.841822][ C1] ? __x64_sys_openat+0x135/0x160 [ 458.841840][ C1] ? do_syscall_64+0x4c/0xa0 [ 458.841853][ C1] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 458.841888][ C1] __kasan_slab_alloc+0x6b/0x80 [ 458.841907][ C1] slab_post_alloc_hook+0x4b/0x490 [ 458.841923][ C1] ? slab_pre_alloc_hook+0x8c/0x300 [ 458.841937][ C1] ? is_bpf_text_address+0x22/0x2a0 [ 458.841951][ C1] kmem_cache_alloc+0x18b/0x2f0 [ 458.841965][ C1] ? __alloc_file+0x25/0x230 [ 458.841980][ C1] __alloc_file+0x25/0x230 [ 458.841994][ C1] alloc_empty_file+0x90/0x180 [ 458.842008][ C1] path_openat+0x11c/0x2f10 [ 458.842022][ C1] ? __lock_acquire+0x1465/0x7c40 [ 458.842044][ C1] ? verify_lock_unused+0x140/0x140 [ 458.842063][ C1] ? kasan_set_track+0x4b/0x70 [ 458.842081][ C1] ? verify_lock_unused+0x140/0x140 [ 458.842098][ C1] ? do_sys_openat2+0xdd/0x4f0 [ 458.842115][ C1] ? __x64_sys_openat+0x135/0x160 [ 458.842133][ C1] ? do_syscall_64+0x4c/0xa0 [ 458.842146][ C1] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 458.842174][ C1] ? do_filp_open+0x420/0x420 [ 458.842195][ C1] do_filp_open+0x1ee/0x420 [ 458.842210][ C1] ? vfs_tmpfile+0x470/0x470 [ 458.842231][ C1] ? _raw_spin_unlock+0x24/0x40 [ 458.842249][ C1] ? alloc_fd+0x590/0x640 [ 458.842276][ C1] do_sys_openat2+0x14b/0x4f0 [ 458.842295][ C1] ? do_sys_open+0xe0/0xe0 [ 458.842312][ C1] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 458.842332][ C1] ? lock_chain_count+0x20/0x20 [ 458.842351][ C1] __x64_sys_openat+0x135/0x160 [ 458.842371][ C1] do_syscall_64+0x4c/0xa0 [ 458.842384][ C1] ? clear_bhb_loop+0x60/0xb0 [ 458.842397][ C1] ? clear_bhb_loop+0x60/0xb0 [ 458.842411][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 458.842432][ C1] RIP: 0033:0x7f6f4c75e98e [ 458.842444][ C1] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 458.842456][ C1] RSP: 002b:00007fff646775b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 458.842469][ C1] RAX: ffffffffffffffda RBX: 000055558f678500 RCX: 00007f6f4c75e98e [ 458.842479][ C1] RDX: 0000000000080001 RSI: 00007f6f4c8358ee RDI: ffffffffffffff9c [ 458.842488][ C1] RBP: 00007f6f4c8358ee R08: 0000000000000000 R09: 0000000000000000 [ 458.842497][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 458.842505][ C1] R13: 00007fff64677690 R14: 00007f6f4d554620 R15: 0000000000000003 [ 458.842519][ C1] [ 458.843373][ C0] rcu: rcu_preempt kthread starved for 10497 jiffies! g70073 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 459.536542][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 459.546532][ C0] rcu: RCU grace-period kthread stack dump: [ 459.552428][ C0] task:rcu_preempt state:R running task stack:27744 pid:16 ppid:2 flags:0x00004000 [ 459.563260][ C0] Call Trace: [ 459.566540][ C0] [ 459.569477][ C0] __schedule+0x107f/0x4030 [ 459.574010][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 459.579218][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 459.585471][ C0] ? _raw_spin_unlock+0x40/0x40 [ 459.590336][ C0] ? release_firmware_map_entry+0x187/0x187 [ 459.596250][ C0] schedule+0xb9/0x180 [ 459.600328][ C0] schedule_timeout+0x184/0x2d0 [ 459.605191][ C0] ? console_conditional_schedule+0x40/0x40 [ 459.611092][ C0] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 459.616992][ C0] ? update_process_times+0x1b0/0x1b0 [ 459.622371][ C0] ? prepare_to_swait_event+0x340/0x360 [ 459.627933][ C0] rcu_gp_fqs_loop+0x303/0x1350 [ 459.632856][ C0] ? dyntick_save_progress_counter+0x2b0/0x2b0 [ 459.639018][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 459.644048][ C0] ? rcu_gp_init+0x14f0/0x14f0 [ 459.648835][ C0] ? rcu_gp_cleanup+0xade/0xc30 [ 459.653711][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 459.658927][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 459.664154][ C0] rcu_gp_kthread+0x99/0x3b0 [ 459.668768][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 459.673914][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 459.679821][ C0] ? __kthread_parkme+0x71/0x1c0 [ 459.684772][ C0] ? __kthread_parkme+0x15b/0x1c0 [ 459.689811][ C0] kthread+0x29d/0x330 [ 459.693884][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 459.698995][ C0] ? kthread_blkcg+0xd0/0xd0 [ 459.703599][ C0] ret_from_fork+0x1f/0x30 [ 459.708107][ C0] [ 459.711125][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 459.717444][ C0] CPU: 0 PID: 76 Comm: kworker/u4:4 Not tainted syzkaller #0 [ 459.724829][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 459.734894][ C0] Workqueue: events_unbound toggle_allocation_gate [ 459.741475][ C0] RIP: 0010:smp_call_function_many_cond+0x1148/0x1250 [ 459.748286][ C0] Code: 41 8b 1f 89 de 83 e6 01 31 ff e8 53 02 0b 00 83 e3 01 48 bb 00 00 00 00 00 fc ff df 75 0a e8 df fe 0a 00 e9 34 ff ff ff f3 90 <41> 0f b6 04 1c 84 c0 75 14 41 f7 07 01 00 00 00 0f 84 17 ff ff ff [ 459.768079][ C0] RSP: 0018:ffffc9000255f800 EFLAGS: 00000293 [ 459.774180][ C0] RAX: ffffffff81773423 RBX: dffffc0000000000 RCX: ffff888018f30000 [ 459.782164][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 459.790143][ C0] RBP: ffffc9000255f960 R08: ffffffff90b0f247 R09: 1ffffffff2161e48 [ 459.798470][ C0] R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 1ffff110171e820d [ 459.806453][ C0] R13: ffff8880b8e3bd80 R14: 0000000000000001 R15: ffff8880b8f41068 [ 459.814426][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 459.823357][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 459.829941][ C0] CR2: 00007f1798ded158 CR3: 000000000c88e000 CR4: 00000000003526f0 [ 459.837922][ C0] Call Trace: [ 459.841202][ C0] [ 459.844139][ C0] ? kmem_cache_alloc_bulk+0x11a/0x4e0 [ 459.849616][ C0] ? text_poke_sync+0x20/0x20 [ 459.854365][ C0] ? smp_call_function_many+0x30/0x30 [ 459.859739][ C0] ? kmem_cache_alloc_bulk+0x11a/0x4e0 [ 459.865202][ C0] ? text_poke+0x90/0x90 [ 459.869451][ C0] ? trace_raw_output_contention_end+0xd0/0xd0 [ 459.875611][ C0] ? text_poke_loc_init+0x105/0x560 [ 459.880828][ C0] ? text_poke_sync+0x20/0x20 [ 459.885510][ C0] on_each_cpu_cond_mask+0x3b/0x80 [ 459.890623][ C0] ? kmem_cache_alloc_bulk+0x11a/0x4e0 [ 459.896090][ C0] text_poke_bp_batch+0x2b7/0x850 [ 459.901147][ C0] ? text_poke_loc_init+0x560/0x560 [ 459.906368][ C0] ? arch_jump_label_transform_queue+0x76/0xd0 [ 459.912555][ C0] ? __jump_label_update+0x39a/0x3c0 [ 459.917916][ C0] ? process_one_work+0x7b4/0x1160 [ 459.923038][ C0] text_poke_finish+0x16/0x30 [ 459.927722][ C0] arch_jump_label_transform_apply+0x13/0x20 [ 459.933704][ C0] static_key_enable_cpuslocked+0x11f/0x240 [ 459.939602][ C0] static_key_enable+0x16/0x20 [ 459.944368][ C0] toggle_allocation_gate+0xba/0x470 [ 459.949658][ C0] ? show_object+0xa0/0xa0 [ 459.954081][ C0] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 459.960090][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 459.965137][ C0] ? read_lock_is_recursive+0x10/0x10 [ 459.970527][ C0] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 459.976446][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 459.981656][ C0] ? process_one_work+0x7b4/0x1160 [ 459.986795][ C0] process_one_work+0x8ab/0x1160 [ 459.991769][ C0] ? worker_detach_from_pool+0x240/0x240 [ 459.997421][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 460.002480][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 460.008086][ C0] ? wq_worker_running+0x97/0x190 [ 460.013124][ C0] worker_thread+0xaf5/0x12a0 [ 460.017883][ C0] kthread+0x29d/0x330 [ 460.021972][ C0] ? worker_clr_flags+0x1a0/0x1a0 [ 460.027022][ C0] ? kthread_blkcg+0xd0/0xd0 [ 460.031630][ C0] ret_from_fork+0x1f/0x30 [ 460.036074][ C0]