last executing test programs: 8m37.713793824s ago: executing program 3 (id=5469): socket(0x15, 0x5, 0x0) ioctl$auto(0x3, 0x89e0, 0xfffffffffffff4e0) 8m37.408890338s ago: executing program 3 (id=5472): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/state\x00', 0x20a42, 0x0) sendfile$auto(0x3, 0x3, 0x0, 0x400000000006) 8m37.223625265s ago: executing program 3 (id=5474): r0 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f00000098c0)='/dev/sg0\x00', 0x40, 0x0) ioctl$auto_BLKTRACESETUP2(r0, 0xc0481273, &(0x7f0000009900)={"9c79bece76127589a33a968f51b2aaadc76a2d360a5d6917323688f527ff0804", 0x5, 0xffffffff, 0x5a, 0xe57, 0x7fff}) 8m36.994711098s ago: executing program 3 (id=5476): r0 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/vm/compact_unevictable_allowed\x00', 0xa0202, 0x0) sendfile$auto(r0, r0, 0x0, 0x3) 8m36.776445273s ago: executing program 3 (id=5478): rseq$auto(&(0x7f0000000280)={0xe, 0x403, 0x7, 0x80b, 0x83, 0x2}, 0x20, 0x0, 0x8000006) tkill$auto(0x80000000000001, 0x7) 8m35.960335459s ago: executing program 3 (id=5481): r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/pagemap\x00', 0x200, 0x0) ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x80000000, 0x7fffffffeffb, 0x5, 0x50b0, 0x2f6, 0x50b301a, 0xe4, 0x0, 0x1, 0x3}) 8m35.134807465s ago: executing program 32 (id=5481): r0 = openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/pagemap\x00', 0x200, 0x0) ioctl$auto_PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x80000000, 0x7fffffffeffb, 0x5, 0x50b0, 0x2f6, 0x50b301a, 0xe4, 0x0, 0x1, 0x3}) 2.83545604s ago: executing program 1 (id=11383): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) r0 = socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) waitid$auto(0x3, r0, 0x0, 0x2, 0x0) 2.554743995s ago: executing program 1 (id=11394): mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x1, 0x0) r0 = fanotify_init$auto(0x4, 0x0) ioctl$auto(r0, 0x541b, r0) 2.268449457s ago: executing program 1 (id=11389): io_uring_setup$auto(0x59, &(0x7f0000000200)={0x0, 0x1d, 0x3800, 0x2, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6, 0xfffffffffffffffd}, {0x100, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x9, 0x100000000}}) io_uring_setup$auto(0x59, &(0x7f0000000080)={0xb, 0x40000d, 0x10400, 0x6, 0x4, 0x3, 0xffffffffffffffff, [], {0x7, 0x200004, 0x7, 0x2a3, 0x100, 0x3, 0x40100101, 0x6}, {0xf8, 0x4, 0x9, 0x1, 0x3, 0x40, 0xcc, 0x8, 0x100000000}}) pselect6$auto(0x5, &(0x7f0000000400)={[0x8, 0x5, 0x0, 0x5, 0x8001, 0x6, 0xac, 0x2000009, 0x3, 0xffffffff, 0x7fffffffffffffff, 0x0, 0x1000, 0x2, 0x8, 0x3ff]}, 0x0, 0x0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) 1.9948884s ago: executing program 1 (id=11392): mmap$auto(0x0, 0x400, 0xdf, 0xeb1, 0x1272, 0x8000) socket(0x2, 0x5, 0x0) io_uring_setup$auto(0x1, 0x0) setsockopt$auto(0x3, 0x10000000084, 0x6, 0x0, 0x84) 1.76630656s ago: executing program 1 (id=11397): sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x4000804) lstat$auto(0x0, &(0x7f0000000180)={0x8, 0x2, 0x7ff, 0x9, 0x0, 0x0, 0x0, 0xfa9a, 0x8, 0x7fffffffffffffff, 0x8000000004, 0x8, 0x8000000005, 0x0, 0x7, 0x8000000004, 0x3}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x89fc, &(0x7f0000000040)={'bridge0\x00'}) 1.740492115s ago: executing program 0 (id=11398): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0x2b, 0x1, 0x0) fcntl$auto(0x3, 0x4, 0xa553) syz_genetlink_get_family_id$auto_ethtool(0x0, r0) 1.539906046s ago: executing program 1 (id=11400): r0 = gettid() kexec_load$auto(0x5, 0x2, &(0x7f0000000040)={@buf=0x0, 0x8ab0, 0x6c0000c000, 0xc000}, 0x4) kill$auto(r0, 0x7) syz_clone(0x5004000, 0x0, 0x0, 0x0, 0x0, 0x0) 1.485006066s ago: executing program 0 (id=11402): open(&(0x7f0000000000)='./file0\x00', 0x121342, 0x130) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x31) fallocate$auto(0x8000000000000003, 0x0, 0x9, 0x4cbd5d) mmap$auto(0x0, 0x1, 0xfd5, 0x12, r0, 0x40000000) 1.295788547s ago: executing program 4 (id=11404): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sysfs$auto(0x2, 0x23, 0x0) r0 = io_uring_setup$auto(0x1d48, &(0x7f0000000340)={0x7fffffff, 0x10, 0x1, 0x6, 0x7, 0x8, 0xffffffffffffffff, [], {0x6, 0x3, 0x1, 0x80000000, 0x10000100, 0x83, 0x101, 0x6, 0x8000000000000001}, {0x100, 0x1, 0x10000052, 0x5, 0x11, 0x10101, 0x876c5, 0xc9, 0x3}}) io_uring_register$auto(r0, 0x14, 0x0, 0x9) 1.276556938s ago: executing program 2 (id=11405): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) capset$auto(&(0x7f0000000180)={0x19980330}, 0x0) setrlimit$auto(0x8, 0x0) io_uring_setup$auto(0x59, 0x0) 1.049073735s ago: executing program 4 (id=11406): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0x43, 0x0) fsopen$auto(0x0, 0x1) close_range$auto(0x2, 0x8, 0x0) 1.035606712s ago: executing program 2 (id=11407): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) mprotect$auto(0x200000000000, 0x806121, 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) 823.448332ms ago: executing program 4 (id=11408): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0x1a, 0x0) r0 = fsopen$auto(0x0, 0x1) fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0) 817.12094ms ago: executing program 2 (id=11409): r0 = socket(0x11, 0x80003, 0x0) mmap$auto(0x0, 0x2a, 0xdf, 0x9b72, 0x1000, 0x28000) semctl$auto(0x201, 0xfffffffffffffffa, 0x3, 0x0) setsockopt$auto(r0, 0x107, 0xd, 0x0, 0x8000) 784.895779ms ago: executing program 0 (id=11410): close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) socket(0xa, 0x3, 0x3a) setsockopt$auto(0x400000000000003, 0x29, 0xd0, 0x0, 0x567) 612.013512ms ago: executing program 2 (id=11411): mmap$auto(0x0, 0x402000b, 0xdf, 0xeb1, 0x401, 0x8000) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r0, 0x4, 0x7ff) ptrace$auto_PTRACE_GETEVENTMSG(0x4201, r0, 0x1, 0x9) 598.992479ms ago: executing program 4 (id=11412): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r0 = socket(0xa, 0x5, 0x84) getsockopt$auto(r0, 0x84, 0x1f, 0x0, &(0x7f0000000080)=0x49b) 468.30316ms ago: executing program 0 (id=11413): mmap$auto(0x0, 0x20009, 0x386, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x1, 0x0) r0 = socket(0x2, 0x3, 0x2) setsockopt$auto_SO_ATTACH_FILTER(r0, 0x0, 0x1a, 0x0, 0x7) 367.486995ms ago: executing program 4 (id=11414): socket(0x28, 0x5, 0x0) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000001400c72da808bf9779d790fb28"], 0x2c}, 0x1, 0x0, 0x0, 0x4000014}, 0x400c000) r0 = socket(0x10, 0x2, 0x4) write$auto(r0, &(0x7f0000000000)='-\x00', 0x2fb) 290.567476ms ago: executing program 2 (id=11415): socket(0x1d, 0x2, 0x7) r0 = socket(0x2, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) getsockname$auto(0x3, &(0x7f0000000d00), &(0x7f0000000d40)=0x4) 228.386829ms ago: executing program 0 (id=11416): r0 = socket(0xa, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) capset$auto(0x0, 0xfffffffffffffffe) setsockopt$auto(r0, 0x10000000084, 0x4, 0x0, 0x4) 152.810495ms ago: executing program 4 (id=11417): mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = epoll_create$auto(0x3e) mprotect$auto(0x200000000000, 0x806121, 0x4) newfstatat$auto(r0, &(0x7f0000000340)='./file0\x00', 0x0, 0x7fffffff) 15.994214ms ago: executing program 0 (id=11418): mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) io_uring_setup$auto(0x1, 0x0) r0 = fanotify_init$auto(0x4, 0x0) ioctl$auto(r0, 0x541b, r0) 0s ago: executing program 2 (id=11419): mlockall$auto(0x7) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0x1d, 0x2, 0x6) getsockopt$auto(r0, 0x6a, 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): [ 553.098321][T21200] netlink: 'syz.1.7385': attribute type 1 has an invalid length. [ 553.473603][ T9880] Bluetooth: hci2: command 0x0c1a tx timeout [ 554.437031][T21229] openvswitch: netlink: Key type 29 is not supported [ 555.541771][ T9880] Bluetooth: hci2: command 0x0c1a tx timeout [ 555.582355][ T9880] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 555.641274][ T9880] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 555.655360][ T9880] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 555.665162][ T9880] CPU: 0 UID: 0 PID: 9880 Comm: kworker/u11:1 Tainted: G U L syzkaller #0 PREEMPT(full) [ 555.665204][ T9880] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 555.665213][ T9880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 555.665230][ T9880] Workqueue: hci1 hci_rx_work [ 555.665261][ T9880] Call Trace: [ 555.665269][ T9880] [ 555.665278][ T9880] dump_stack_lvl+0x100/0x190 [ 555.665311][ T9880] sysfs_warn_dup.cold+0x1c/0x28 [ 555.665347][ T9880] sysfs_create_dir_ns+0x24b/0x2b0 [ 555.665390][ T9880] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 555.665426][ T9880] ? find_held_lock+0x2b/0x80 [ 555.665456][ T9880] ? kobject_add_internal+0x25f/0x930 [ 555.665479][ T9880] ? kobject_add_internal+0x25f/0x930 [ 555.665504][ T9880] ? do_raw_spin_unlock+0x145/0x1e0 [ 555.665533][ T9880] kobject_add_internal+0x2c8/0x930 [ 555.665566][ T9880] kobject_add+0x16a/0x1e0 [ 555.665589][ T9880] ? __pfx_kobject_add+0x10/0x10 [ 555.665610][ T9880] ? class_to_subsys+0x10f/0x150 [ 555.665639][ T9880] ? kobject_put+0xb9/0x640 [ 555.665674][ T9880] ? _raw_spin_unlock+0x28/0x50 [ 555.665708][ T9880] device_add+0x294/0x1970 [ 555.665730][ T9880] ? __pfx_dev_set_name+0x10/0x10 [ 555.665757][ T9880] ? __pfx_device_add+0x10/0x10 [ 555.665786][ T9880] ? mgmt_send_event_skb+0x2fb/0x460 [ 555.665826][ T9880] hci_conn_add_sysfs+0x1a3/0x260 [ 555.665862][ T9880] le_conn_complete_evt+0x11eb/0x1f60 [ 555.665901][ T9880] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 555.665929][ T9880] ? __pfx_bt_warn+0x10/0x10 [ 555.665950][ T9880] ? hci_event_packet+0x186/0xcd0 [ 555.665985][ T9880] hci_le_conn_complete_evt+0x23c/0x3a0 [ 555.666017][ T9880] ? skb_pull_data+0x15f/0x1e0 [ 555.666045][ T9880] hci_le_meta_evt+0x34a/0x5f0 [ 555.666077][ T9880] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 555.666112][ T9880] hci_event_packet+0x51c/0xcd0 [ 555.666142][ T9880] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 555.666179][ T9880] ? __pfx_hci_event_packet+0x10/0x10 [ 555.666212][ T9880] ? kcov_remote_start+0x384/0x670 [ 555.666247][ T9880] ? lockdep_hardirqs_on+0x78/0x100 [ 555.666286][ T9880] hci_rx_work+0x451/0xfc0 [ 555.666321][ T9880] process_one_work+0xa23/0x1940 [ 555.666369][ T9880] ? __pfx_process_one_work+0x10/0x10 [ 555.666413][ T9880] ? __pfx_hci_rx_work+0x10/0x10 [ 555.666453][ T9880] worker_thread+0x5ef/0xe50 [ 555.666497][ T9880] ? __pfx_worker_thread+0x10/0x10 [ 555.666533][ T9880] ? kthread+0x13a/0x450 [ 555.666564][ T9880] ? __pfx_worker_thread+0x10/0x10 [ 555.666597][ T9880] kthread+0x370/0x450 [ 555.666634][ T9880] ? __pfx_kthread+0x10/0x10 [ 555.666669][ T9880] ret_from_fork+0x72b/0xd50 [ 555.666700][ T9880] ? __pfx_ret_from_fork+0x10/0x10 [ 555.666729][ T9880] ? rcu_is_watching+0x12/0xc0 [ 555.666758][ T9880] ? __switch_to+0x800/0x10f0 [ 555.666801][ T9880] ? __switch_to_asm+0x39/0x70 [ 555.666835][ T9880] ? __pfx_kthread+0x10/0x10 [ 555.666869][ T9880] ret_from_fork_asm+0x1a/0x30 [ 555.666916][ T9880] [ 555.668415][ T9880] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 556.018718][ T9880] Bluetooth: hci1: failed to register connection device [ 557.337482][T21293] binder: 21292:21293 ioctl c0046209 3 returned -22 [ 557.614066][ T9880] Bluetooth: hci1: command 0x0406 tx timeout [ 557.622912][T15898] Bluetooth: hci2: command 0x0c1a tx timeout [ 557.767397][T21302] netlink: NAT attribute has 5 unknown bytes [ 558.017576][T21297] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 558.048398][ T9801] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 558.056807][ T9801] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 558.066855][ T9801] CPU: 0 UID: 0 PID: 9801 Comm: kworker/u11:0 Tainted: G U L syzkaller #0 PREEMPT(full) [ 558.066896][ T9801] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 558.066905][ T9801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 558.066921][ T9801] Workqueue: hci3 hci_rx_work [ 558.066954][ T9801] Call Trace: [ 558.066961][ T9801] [ 558.066971][ T9801] dump_stack_lvl+0x100/0x190 [ 558.067002][ T9801] sysfs_warn_dup.cold+0x1c/0x28 [ 558.067039][ T9801] sysfs_create_dir_ns+0x24b/0x2b0 [ 558.067077][ T9801] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 558.067112][ T9801] ? find_held_lock+0x2b/0x80 [ 558.067142][ T9801] ? kobject_add_internal+0x25f/0x930 [ 558.067165][ T9801] ? kobject_add_internal+0x25f/0x930 [ 558.067190][ T9801] ? do_raw_spin_unlock+0x145/0x1e0 [ 558.067228][ T9801] kobject_add_internal+0x2c8/0x930 [ 558.067256][ T9801] kobject_add+0x16a/0x1e0 [ 558.067279][ T9801] ? __pfx_kobject_add+0x10/0x10 [ 558.067300][ T9801] ? class_to_subsys+0x10f/0x150 [ 558.067330][ T9801] ? kobject_put+0xb9/0x640 [ 558.067366][ T9801] ? _raw_spin_unlock+0x28/0x50 [ 558.067400][ T9801] device_add+0x294/0x1970 [ 558.067422][ T9801] ? __pfx_dev_set_name+0x10/0x10 [ 558.067449][ T9801] ? __pfx_device_add+0x10/0x10 [ 558.067472][ T9801] ? mgmt_send_event_skb+0x2fb/0x460 [ 558.067518][ T9801] hci_conn_add_sysfs+0x1a3/0x260 [ 558.067556][ T9801] le_conn_complete_evt+0x11eb/0x1f60 [ 558.067594][ T9801] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 558.067623][ T9801] ? __pfx_bt_warn+0x10/0x10 [ 558.067644][ T9801] ? hci_event_packet+0x186/0xcd0 [ 558.067680][ T9801] hci_le_conn_complete_evt+0x23c/0x3a0 [ 558.067711][ T9801] ? skb_pull_data+0x15f/0x1e0 [ 558.067745][ T9801] hci_le_meta_evt+0x34a/0x5f0 [ 558.067777][ T9801] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 558.067812][ T9801] hci_event_packet+0x51c/0xcd0 [ 558.067842][ T9801] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 558.067875][ T9801] ? __pfx_hci_event_packet+0x10/0x10 [ 558.067909][ T9801] ? kcov_remote_start+0x384/0x670 [ 558.067945][ T9801] ? lockdep_hardirqs_on+0x78/0x100 [ 558.067982][ T9801] hci_rx_work+0x451/0xfc0 [ 558.068020][ T9801] process_one_work+0xa23/0x1940 [ 558.068068][ T9801] ? __pfx_process_one_work+0x10/0x10 [ 558.068113][ T9801] ? __pfx_hci_rx_work+0x10/0x10 [ 558.068145][ T9801] worker_thread+0x5ef/0xe50 [ 558.068191][ T9801] ? kthread+0x13a/0x450 [ 558.068222][ T9801] ? __pfx_worker_thread+0x10/0x10 [ 558.068256][ T9801] kthread+0x370/0x450 [ 558.068288][ T9801] ? __pfx_kthread+0x10/0x10 [ 558.068323][ T9801] ret_from_fork+0x72b/0xd50 [ 558.068354][ T9801] ? __pfx_ret_from_fork+0x10/0x10 [ 558.068385][ T9801] ? __switch_to+0x800/0x10f0 [ 558.068422][ T9801] ? __switch_to_asm+0x39/0x70 [ 558.068455][ T9801] ? __pfx_kthread+0x10/0x10 [ 558.068495][ T9801] ret_from_fork_asm+0x1a/0x30 [ 558.068544][ T9801] [ 558.673315][ T9801] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 558.687709][ T9801] Bluetooth: hci3: failed to register connection device [ 558.815578][T21314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7436'. [ 559.534983][T21334] binder: 21333:21334 ioctl c0046209 3 returned -22 [ 559.684680][T17063] Bluetooth: hci2: command 0x0c1a tx timeout [ 559.690958][ T9801] Bluetooth: hci1: command 0x0406 tx timeout [ 560.044177][T21345] openvswitch: netlink: Key type 29 is not supported [ 560.078651][ T9801] Bluetooth: hci3: command 0x0c1a tx timeout [ 561.036757][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 561.046442][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 561.265453][T21381] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7468'. [ 561.749538][T21297] Bluetooth: hci1: command 0x0406 tx timeout [ 562.118756][T21401] netlink: 'syz.2.7477': attribute type 1 has an invalid length. [ 562.147964][T15898] Bluetooth: hci3: command 0x0c1a tx timeout [ 562.952553][T21424] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7488'. [ 563.713059][T21443] openvswitch: netlink: IPv4 tunnel dst address is zero [ 563.819230][T15898] Bluetooth: hci1: command 0x0406 tx timeout [ 564.218044][T15898] Bluetooth: hci3: command 0x0c1a tx timeout [ 564.302659][T21462] nbd: illegal input index -1024 [ 566.286984][ T9801] Bluetooth: hci3: command 0x0c1a tx timeout [ 567.296396][T21541] netlink: 'syz.0.7543': attribute type 1 has an invalid length. [ 569.923579][T21600] HfR: entered promiscuous mode [ 570.468607][ T9801] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 570.511498][T15898] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 570.519772][T15898] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 570.529457][T15898] CPU: 0 UID: 0 PID: 15898 Comm: kworker/u11:2 Tainted: G U L syzkaller #0 PREEMPT(full) [ 570.529497][T15898] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 570.529506][T15898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 570.529522][T15898] Workqueue: hci1 hci_rx_work [ 570.529566][T15898] Call Trace: [ 570.529574][T15898] [ 570.529583][T15898] dump_stack_lvl+0x100/0x190 [ 570.529613][T15898] sysfs_warn_dup.cold+0x1c/0x28 [ 570.529650][T15898] sysfs_create_dir_ns+0x24b/0x2b0 [ 570.529692][T15898] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 570.529731][T15898] ? find_held_lock+0x2b/0x80 [ 570.529775][T15898] ? kobject_add_internal+0x25f/0x930 [ 570.529802][T15898] ? kobject_add_internal+0x25f/0x930 [ 570.529827][T15898] ? do_raw_spin_unlock+0x145/0x1e0 [ 570.529857][T15898] kobject_add_internal+0x2c8/0x930 [ 570.529885][T15898] kobject_add+0x16a/0x1e0 [ 570.529907][T15898] ? __pfx_kobject_add+0x10/0x10 [ 570.529929][T15898] ? class_to_subsys+0x10f/0x150 [ 570.529961][T15898] ? kobject_put+0xb9/0x640 [ 570.529997][T15898] ? _raw_spin_unlock+0x28/0x50 [ 570.530031][T15898] device_add+0x294/0x1970 [ 570.530054][T15898] ? __pfx_dev_set_name+0x10/0x10 [ 570.530085][T15898] ? __pfx_device_add+0x10/0x10 [ 570.530110][T15898] ? mgmt_send_event_skb+0x2fb/0x460 [ 570.530153][T15898] hci_conn_add_sysfs+0x1a3/0x260 [ 570.530201][T15898] le_conn_complete_evt+0x11eb/0x1f60 [ 570.530246][T15898] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 570.530282][T15898] ? __pfx_bt_warn+0x10/0x10 [ 570.530305][T15898] ? hci_event_packet+0x186/0xcd0 [ 570.530341][T15898] hci_le_conn_complete_evt+0x23c/0x3a0 [ 570.530379][T15898] ? skb_pull_data+0x15f/0x1e0 [ 570.530410][T15898] hci_le_meta_evt+0x34a/0x5f0 [ 570.530451][T15898] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 570.530489][T15898] hci_event_packet+0x51c/0xcd0 [ 570.530519][T15898] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 570.530555][T15898] ? __pfx_hci_event_packet+0x10/0x10 [ 570.530588][T15898] ? kcov_remote_start+0x384/0x670 [ 570.530623][T15898] ? lockdep_hardirqs_on+0x78/0x100 [ 570.530668][T15898] hci_rx_work+0x451/0xfc0 [ 570.530703][T15898] process_one_work+0xa23/0x1940 [ 570.530754][T15898] ? __pfx_process_one_work+0x10/0x10 [ 570.530807][T15898] ? __pfx_hci_rx_work+0x10/0x10 [ 570.530839][T15898] worker_thread+0x5ef/0xe50 [ 570.530886][T15898] ? kthread+0x13a/0x450 [ 570.530917][T15898] ? __pfx_worker_thread+0x10/0x10 [ 570.530950][T15898] kthread+0x370/0x450 [ 570.530982][T15898] ? __pfx_kthread+0x10/0x10 [ 570.531016][T15898] ret_from_fork+0x72b/0xd50 [ 570.531047][T15898] ? __pfx_ret_from_fork+0x10/0x10 [ 570.531076][T15898] ? rcu_is_watching+0x12/0xc0 [ 570.531105][T15898] ? __switch_to+0x800/0x10f0 [ 570.531142][T15898] ? __switch_to_asm+0x39/0x70 [ 570.531174][T15898] ? __pfx_kthread+0x10/0x10 [ 570.531208][T15898] ret_from_fork_asm+0x1a/0x30 [ 570.531256][T15898] [ 570.531463][T15898] kobject: kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 570.854189][T15898] Bluetooth: hci1: failed to register connection device [ 572.494047][T15898] Bluetooth: hci1: command 0x0406 tx timeout [ 572.529341][T21667] openvswitch: netlink: Key type 261 is out of range max 32 [ 572.928938][T21675] : entered promiscuous mode [ 573.653929][T21699] openvswitch: netlink: Message has 4 unknown bytes. [ 574.215662][T21718] netlink: 334 bytes leftover after parsing attributes in process `syz.1.7628'. [ 574.563425][T15898] Bluetooth: hci1: command 0x0406 tx timeout [ 575.323466][T21741] openvswitch: netlink: IP tunnel dst address not specified [ 575.944718][T21759] openvswitch: netlink: Missing valid actions attribute. [ 576.632762][T15898] Bluetooth: hci1: command 0x0406 tx timeout [ 577.134028][T21788] MTRR 1 not used [ 578.930554][T21837] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !PjE r҄y*"l-y– [ 579.223579][ T9800] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.530873][T21843] netlink: 'syz.0.7687': attribute type 2 has an invalid length. [ 579.588801][ T9800] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.841662][ T9800] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.042342][T15898] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 580.061926][T15898] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 580.074485][T15898] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 580.086978][T15898] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 580.104338][T15898] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 580.320260][ T9800] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.530409][T21848] could not allocate digest TFM handle [ 581.027757][T21874] RDS: rds_bind could not find a transport for 7bc:c94c:4e37:70c4::, load rds_tcp or rds_rdma? [ 581.386348][ T9800] bridge_slave_1: left allmulticast mode [ 581.438586][ T9800] bridge_slave_1: left promiscuous mode [ 581.490119][ T9800] bridge0: port 2(bridge_slave_1) entered disabled state [ 581.620887][ T9800] bridge_slave_0: left allmulticast mode [ 581.668819][ T9800] bridge_slave_0: left promiscuous mode [ 581.714822][ T9800] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.206454][T15898] Bluetooth: hci1: command tx timeout [ 583.054261][ T9800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 583.106903][ T9800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 583.140959][ T9800] bond0 (unregistering): Released all slaves [ 583.633773][ T5288] 8021q: adding VLAN 0 to HW filter on device eth5 [ 584.272712][T15898] Bluetooth: hci1: command tx timeout [ 584.367351][ T9800] hsr_slave_0: left promiscuous mode [ 584.384433][ T9800] hsr_slave_1: left promiscuous mode [ 584.403415][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 584.419577][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 584.443090][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 584.461518][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 584.503848][ T9800] veth1_macvtap: left promiscuous mode [ 584.514511][ T9800] veth0_macvtap: left promiscuous mode [ 584.528102][ T9800] veth1_vlan: left promiscuous mode [ 584.540429][ T9800] veth0_vlan: left promiscuous mode [ 585.093058][ T9800] team0 (unregistering): Port device team_slave_1 removed [ 585.114626][ T9800] team0 (unregistering): Port device team_slave_0 removed [ 585.261329][ T5288] 8021q: adding VLAN 0 to HW filter on device eth6 [ 585.711224][ T9800] bridge_slave_1: left allmulticast mode [ 585.725184][ T9800] bridge_slave_1: left promiscuous mode [ 585.735506][ T9800] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.757354][ T9800] bridge_slave_0: left allmulticast mode [ 585.763087][ T9800] bridge_slave_0: left promiscuous mode [ 585.786801][ T9800] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.180347][ T9800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 586.206164][ T9800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 586.229875][ T9800] bond0 (unregistering): Released all slaves [ 586.258674][T21855] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.295400][T21855] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.312189][T21855] bridge_slave_0: entered allmulticast mode [ 586.335406][T21855] bridge_slave_0: entered promiscuous mode [ 586.341957][T15898] Bluetooth: hci1: command tx timeout [ 586.362398][T21855] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.381908][T21855] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.403775][T21855] bridge_slave_1: entered allmulticast mode [ 586.417139][T21855] bridge_slave_1: entered promiscuous mode [ 586.442601][ T9800] HfR: left promiscuous mode [ 586.535702][ T5288] 8021q: adding VLAN 0 to HW filter on device eth7 [ 586.564386][ T9800] : left promiscuous mode [ 586.587407][T21855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 586.615940][T21855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 586.768773][T21855] team0: Port device team_slave_0 added [ 586.811120][T21855] team0: Port device team_slave_1 added [ 586.940084][T21855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 586.981142][T21855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.034599][T21855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 587.084551][T21855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 587.108099][T21855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 587.168951][T21855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 587.305321][ T9800] hsr_slave_0: left promiscuous mode [ 587.321609][ T9800] hsr_slave_1: left promiscuous mode [ 587.335028][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.354146][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.378374][ T9800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.393706][ T9800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 587.426398][ T9800] veth1_macvtap: left promiscuous mode [ 587.439459][ T9800] veth0_macvtap: left promiscuous mode [ 587.457294][ T9800] veth1_vlan: left promiscuous mode [ 587.462717][ T9800] veth0_vlan: left promiscuous mode [ 587.936460][ T9800] team0 (unregistering): Port device team_slave_1 removed [ 587.957896][ T9800] team0 (unregistering): Port device team_slave_0 removed [ 588.106826][ T5288] 8021q: adding VLAN 0 to HW filter on device eth8 [ 588.198117][T21855] hsr_slave_0: entered promiscuous mode [ 588.213204][T21855] hsr_slave_1: entered promiscuous mode [ 588.411725][T15898] Bluetooth: hci1: command tx timeout [ 589.686218][T21855] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 589.715997][T21855] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 589.735211][T21855] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 589.756770][T21855] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 589.778001][T21855] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 589.814693][T21855] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 589.829926][T21855] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 589.856330][T21855] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 590.059147][T21855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 590.101363][T21855] 8021q: adding VLAN 0 to HW filter on device team0 [ 590.138054][ T9800] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.145282][ T9800] bridge0: port 1(bridge_slave_0) entered forwarding state [ 590.188821][ T9805] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.196621][ T9805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 591.160246][T21855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 591.715745][T21855] veth0_vlan: entered promiscuous mode [ 591.739870][T21855] veth1_vlan: entered promiscuous mode [ 591.830932][T21855] veth0_macvtap: entered promiscuous mode [ 591.875627][T21855] veth1_macvtap: entered promiscuous mode [ 591.934129][T21855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 591.956812][T21855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 592.002584][ T9800] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.115830][ T9805] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.273116][ T9805] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.286548][ T9901] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.308268][ T9805] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.324194][ T9901] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.403561][ T9901] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.427409][ T9901] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 593.235434][ T9801] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 593.254338][ T9801] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 593.268531][ T9801] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 593.283031][ T9801] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 593.300087][ T9801] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 595.335827][ T9801] Bluetooth: hci2: command tx timeout [ 596.803298][T22055] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.858588][T22055] bridge0: port 1(bridge_slave_0) entered disabled state [ 596.895944][T22055] bridge_slave_0: entered allmulticast mode [ 596.940877][T22055] bridge_slave_0: entered promiscuous mode [ 597.066912][T22055] bridge0: port 2(bridge_slave_1) entered blocking state [ 597.108725][T22055] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.147852][T22055] bridge_slave_1: entered allmulticast mode [ 597.212625][T22055] bridge_slave_1: entered promiscuous mode [ 597.400539][T22055] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 597.416006][ T9801] Bluetooth: hci2: command tx timeout [ 597.479751][T22055] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.656381][T22055] team0: Port device team_slave_0 added [ 597.696763][T22055] team0: Port device team_slave_1 added [ 597.863960][T22055] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 597.900873][T22055] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 597.958528][T22183] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7754'. [ 598.019008][T22055] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 598.097091][T22055] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 598.130672][T22055] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 598.254437][T22055] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 598.425557][T22197] ksmbd: Unknown IPC event: 14, ignore. [ 598.499997][T22055] hsr_slave_0: entered promiscuous mode [ 598.524595][T22055] hsr_slave_1: entered promiscuous mode [ 598.551132][T22055] debugfs: 'hsr0' already exists in 'hsr' [ 598.582653][T22055] Cannot create hsr debugfs directory [ 598.893291][T22206] nbd: must specify an index to disconnect [ 599.473478][ T9801] Bluetooth: hci2: command tx timeout [ 599.995143][T22055] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 600.037602][T22055] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 600.064016][T22055] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 600.137072][T22055] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 600.175230][T22055] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 600.226223][T22055] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 600.266915][T22055] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 600.291863][T22236] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7780'. [ 600.364909][T22055] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 600.848771][T22055] 8021q: adding VLAN 0 to HW filter on device bond0 [ 600.982568][T22055] 8021q: adding VLAN 0 to HW filter on device team0 [ 601.044935][ T9811] bridge0: port 1(bridge_slave_0) entered blocking state [ 601.052185][ T9811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 601.111338][T22262] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 601.162289][ T9811] bridge0: port 2(bridge_slave_1) entered blocking state [ 601.169658][ T9811] bridge0: port 2(bridge_slave_1) entered forwarding state [ 601.542859][ T9801] Bluetooth: hci2: command tx timeout [ 601.687799][T22274] debugfs: '!PjE r҄y*"l-y–L̓]' already exists in 'ieee80211' [ 602.710163][T22304] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 602.987817][T22312] debugfs: '!PjE r҄y*"l-y–L̓]' already exists in 'ieee80211' [ 603.224706][T22055] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 603.475146][T22055] veth0_vlan: entered promiscuous mode [ 603.548882][T22055] veth1_vlan: entered promiscuous mode [ 603.723818][T22055] veth0_macvtap: entered promiscuous mode [ 603.771576][T22055] veth1_macvtap: entered promiscuous mode [ 603.883997][T22055] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 603.939044][T22055] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 604.010366][ T9800] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.055547][ T9800] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.111408][ T9800] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.224741][ T9800] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.566580][ T9901] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.615461][ T9901] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.761685][ T9800] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.803308][ T9800] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 605.447526][T22366] nbd: must specify a device to reconfigure [ 605.891303][ T9801] Bluetooth: hci2: unexpected event 0x3e length: 508 > 260 [ 605.891334][ T9801] Bluetooth: hci2: unexpected subevent 0x02 length: 507 > 260 [ 605.906438][ T9801] Bluetooth: hci2: Dropping invalid advertising data [ 605.913764][ T9801] Bluetooth: hci2: unknown advertising packet type: 0xe9 [ 605.913828][ T9801] Bluetooth: hci2: unknown advertising packet type: 0x8b [ 605.926411][ T9801] Bluetooth: hci2: unknown advertising packet type: 0xee [ 605.969278][T22382] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 607.425281][T22425] netlink: 'syz.2.7862': attribute type 12 has an invalid length. [ 608.763089][T22466] vmstat_refresh: nr_hugetlb -6144 [ 609.607949][T22490] FAULT_INJECTION: forcing a failure. [ 609.607949][T22490] name failslab, interval 1, probability 0, space 0, times 1 [ 609.673341][T22490] CPU: 0 UID: 0 PID: 22490 Comm: syz.2.7893 Tainted: G U L syzkaller #0 PREEMPT(full) [ 609.673383][T22490] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 609.673392][T22490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 609.673407][T22490] Call Trace: [ 609.673414][T22490] [ 609.673423][T22490] dump_stack_lvl+0x100/0x190 [ 609.673455][T22490] should_fail_ex.cold+0x5/0xa [ 609.673494][T22490] should_failslab+0xc2/0x120 [ 609.673538][T22490] __kmalloc_cache_noprof+0x91/0x6c0 [ 609.673564][T22490] ? call_usermodehelper_setup+0xaf/0x360 [ 609.673607][T22490] ? __pfx_free_modprobe_argv+0x10/0x10 [ 609.673639][T22490] call_usermodehelper_setup+0xaf/0x360 [ 609.673683][T22490] __request_module+0x3c7/0x6a0 [ 609.673711][T22490] ? __pfx___request_module+0x10/0x10 [ 609.673750][T22490] ? find_held_lock+0x2b/0x80 [ 609.673780][T22490] ? inet6_create+0xb9f/0x12b0 [ 609.673855][T22490] inet6_create+0xd65/0x12b0 [ 609.673890][T22490] ? inet6_create+0x7f/0x12b0 [ 609.673921][T22490] __sock_create+0x339/0x860 [ 609.673984][T22490] __sys_socket+0x14d/0x260 [ 609.674012][T22490] ? __pfx___sys_socket+0x10/0x10 [ 609.674047][T22490] __x64_sys_socket+0x72/0xb0 [ 609.674073][T22490] ? lockdep_hardirqs_on+0x78/0x100 [ 609.674105][T22490] do_syscall_64+0x115/0x840 [ 609.674159][T22490] ? clear_bhb_loop+0x40/0x90 [ 609.674192][T22490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.674217][T22490] RIP: 0033:0x7f14f219e019 [ 609.674237][T22490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 609.674260][T22490] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 609.674289][T22490] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 609.674304][T22490] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 000000000000000a [ 609.674318][T22490] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 609.674332][T22490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 609.674346][T22490] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 609.674376][T22490] [ 611.771326][T22555] netlink: 'syz.4.7924': attribute type 8 has an invalid length. syzkaller syzkaller login: [ 612.173117][ T9801] Bluetooth: hci0: ACL packet too small [ 612.464985][T22578] netlink: 'syz.1.7933': attribute type 12 has an invalid length. [ 612.736589][T22588] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 612.912391][T22592] netlink: Invalid conntrack helper [ 613.121719][ T29] audit: type=1107 audit(4294967293.361:38): pid=22595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 613.194598][ T29] audit: type=1107 audit(4294967293.412:39): pid=22595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 614.255133][T22611] NFSD: Failed to start, no listeners configured. [ 614.718043][T22637] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7960'. [ 614.973208][T22645] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(4.262144.67108862), cmd(12) [ 615.035478][T22647] netlink: 'syz.1.7967': attribute type 1 has an invalid length. [ 615.484658][T22661] nfsd: Unknown parameter '' [ 616.695752][T22694] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 616.731193][T22694] audit: out of memory in audit_log_start [ 616.836556][T22700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7993'. [ 617.185357][T22710] netlink: set zone limit has 4 unknown bytes [ 617.722331][T22727] netlink: 'syz.0.8007': attribute type 2 has an invalid length. [ 617.980249][T22734] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 618.411127][T22749] netlink: zone id is out of range [ 618.439856][T22749] netlink: get zone limit has 8 unknown bytes [ 618.557905][T22755] cifs: Unknown parameter 'T.żc[$⁍)UÑnE-ʙl- -_5Z omfwYh*/xDlݩgkǐA79Xa/f_ARxM vp$^;q3n-6+ek [ 635.668494][T23270] dump_stack_lvl+0x100/0x190 [ 635.668530][T23270] should_fail_ex.cold+0x5/0xa [ 635.668559][T23270] should_failslab+0xc2/0x120 [ 635.668596][T23270] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 635.668627][T23270] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 635.668661][T23270] ? sock_alloc_inode+0x26/0x2c0 [ 635.668701][T23270] ? __pfx_sock_alloc_inode+0x10/0x10 [ 635.668727][T23270] sock_alloc_inode+0x26/0x2c0 [ 635.668748][T23270] ? __pfx_sock_alloc_inode+0x10/0x10 [ 635.668770][T23270] alloc_inode+0x68/0x250 [ 635.668803][T23270] sock_alloc+0x44/0x280 [ 635.668903][T23270] ? security_socket_create+0x7f/0x250 [ 635.668973][T23270] __sock_create+0xc2/0x860 [ 635.668999][T23270] ? lockdep_init_map_type+0x5c/0x250 [ 635.669027][T23270] smc_create+0x163/0x290 [ 635.669093][T23270] __sock_create+0x339/0x860 [ 635.669124][T23270] __sys_socket+0x14d/0x260 [ 635.669151][T23270] ? __pfx___sys_socket+0x10/0x10 [ 635.669230][T23270] __x64_sys_socket+0x72/0xb0 [ 635.669257][T23270] ? lockdep_hardirqs_on+0x78/0x100 [ 635.669289][T23270] do_syscall_64+0x115/0x840 [ 635.669320][T23270] ? clear_bhb_loop+0x40/0x90 [ 635.669350][T23270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.669375][T23270] RIP: 0033:0x7f14f219e019 [ 635.669395][T23270] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.669418][T23270] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 635.669441][T23270] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 635.669457][T23270] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 000000000000002b [ 635.669471][T23270] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 635.669485][T23270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 635.669499][T23270] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 635.669529][T23270] [ 635.669546][T23270] socket: no more sockets [ 637.124536][T23311] FAULT_INJECTION: forcing a failure. [ 637.124536][T23311] name failslab, interval 1, probability 0, space 0, times 0 [ 637.189682][T23311] CPU: 0 UID: 0 PID: 23311 Comm: syz.2.8277 Tainted: G U L syzkaller #0 PREEMPT(full) [ 637.189723][T23311] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 637.189732][T23311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 637.189746][T23311] Call Trace: [ 637.189754][T23311] [ 637.189763][T23311] dump_stack_lvl+0x100/0x190 [ 637.189797][T23311] should_fail_ex.cold+0x5/0xa [ 637.189824][T23311] should_failslab+0xc2/0x120 [ 637.189860][T23311] __kvmalloc_node_noprof+0x116/0x970 [ 637.189893][T23311] ? percpu_ref_init+0xec/0x3f0 [ 637.190013][T23311] ? io_alloc_cache_init+0x38/0x170 [ 637.190067][T23311] io_alloc_cache_init+0x38/0x170 [ 637.190101][T23311] io_uring_setup.cold+0x450/0x1c2e [ 637.190138][T23311] ? ksys_write+0x190/0x250 [ 637.190160][T23311] ? ksys_write+0x190/0x250 [ 637.190182][T23311] ? __pfx_io_uring_setup+0x10/0x10 [ 637.190224][T23311] ? do_futex+0x190/0x440 [ 637.190260][T23311] ? __pfx_do_futex+0x10/0x10 [ 637.190300][T23311] ? xfd_validate_state+0x129/0x190 [ 637.190338][T23311] __x64_sys_io_uring_setup+0xc2/0x170 [ 637.190365][T23311] do_syscall_64+0x115/0x840 [ 637.190397][T23311] ? clear_bhb_loop+0x40/0x90 [ 637.190433][T23311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.190458][T23311] RIP: 0033:0x7f14f219e019 [ 637.190477][T23311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 637.190500][T23311] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 637.190523][T23311] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 637.190539][T23311] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000b63 [ 637.190553][T23311] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 637.190567][T23311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 637.190581][T23311] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 637.190611][T23311] [ 638.714947][T23358] dyndbg: expected <4096 bytes into control [ 639.395215][T23379] openvswitch: netlink: Port -2134900732 exceeds max allowable 65535 [ 640.417788][T23405] netlink: NAT attribute type 0 has unexpected length (4 != 0) [ 642.228667][T23463] netlink: 'syz.2.8345': attribute type 11 has an invalid length. [ 642.255228][T23463] netlink: 'syz.2.8345': attribute type 11 has an invalid length. [ 642.285837][T23463] netlink: 'syz.2.8345': attribute type 11 has an invalid length. [ 642.334571][T23463] netlink: 'syz.2.8345': attribute type 11 has an invalid length. [ 642.770412][T23477] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8352'. [ 645.104565][T23544] openvswitch: netlink: Multiple metadata blocks provided [ 646.210973][T23579] netlink: 'syz.1.8401': attribute type 11 has an invalid length. [ 646.253298][T23579] netlink: 'syz.1.8401': attribute type 11 has an invalid length. [ 646.298022][T23579] netlink: 'syz.1.8401': attribute type 11 has an invalid length. [ 647.242340][ T29] audit: type=1326 audit(4294967319.537:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23612 comm="syz.4.8418" exe="/root/ci-qemu-gce-upstream-auto/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f532259e019 code=0x0 [ 649.389223][T23681] netlink: 'syz.2.8450': attribute type 11 has an invalid length. [ 649.431727][T23681] netlink: 'syz.2.8450': attribute type 11 has an invalid length. [ 649.469691][T23681] netlink: 'syz.2.8450': attribute type 11 has an invalid length. [ 649.965941][T23698] netlink: 'syz.2.8458': attribute type 1 has an invalid length. [ 654.072622][T23831] binder: 23830:23831 ioctl c0306201 2000000000c0 returned -14 [ 654.834380][T23855] netlink: Unknown NAT attribute (type=262, max=9) [ 656.274906][T23897] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8555'. [ 660.786703][T24039] netlink: 'syz.4.8619': attribute type 1 has an invalid length. [ 660.822984][T24039] netlink: 33 bytes leftover after parsing attributes in process `syz.4.8619'. [ 661.188280][T24047] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[5637] was attempted by "ci-qemu-gce-upstream-auto/syz-executor exec"[24047] [ 661.356777][T24053] netlink: 'syz.4.8626': attribute type 1 has an invalid length. [ 666.708430][T24182] netlink: 3 bytes leftover after parsing attributes in process `syz.2.8686'. [ 668.627873][T24225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8706'. [ 669.085062][T24234] program syz.4.8712 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 670.598788][ T29] audit: type=1326 audit(4294967343.018:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24264 comm="syz.0.8726" exe="/root/ci-qemu-gce-upstream-auto/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f67e899e019 code=0x0 [ 670.657612][T24269] No such timeout policy "" [ 670.685619][T24269] netlink: Failed to associated timeout policy '' [ 670.957883][T24274] nbd: couldn't find device at index 158 [ 671.982074][T24287] NFSD: Failed to start, no listeners configured. [ 673.845246][T24334] netlink: 'syz.2.8758': attribute type 1 has an invalid length. [ 674.128800][T24337] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8752'. [ 675.173775][T24362] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 675.360459][T24369] netlink: 'syz.4.8775': attribute type 2 has an invalid length. [ 676.178472][T24387] syz_tun: tun_chr_ioctl cmd 35108 [ 676.561921][T24395] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 676.637691][T24398] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8788'. [ 676.680960][T24398] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8788'. [ 677.409213][T24418] netlink: 'syz.0.8800': attribute type 1 has an invalid length. [ 677.669881][T24425] netlink: 342 bytes leftover after parsing attributes in process `syz.0.8803'. [ 677.828165][T24423] &#$@\]\-: entered promiscuous mode [ 678.718964][T24451] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 678.764098][T24451] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 679.899187][T24439] kexec: Could not allocate control_code_buffer [ 681.257313][T24508] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 683.282602][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 683.292299][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 683.988222][T24584] netlink: 'syz.0.8881': attribute type 1 has an invalid length. [ 684.969010][T24609] netlink: 'syz.0.8893': attribute type 23 has an invalid length. [ 685.700426][T24629] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 687.135277][T24666] usb usb36: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 687.178241][T24666] vhci_hcd vhci_hcd.1: default hub control req: 0000 v0000 i0000 l0 [ 687.950908][T24685] NFSD: Failed to start, no listeners configured. [ 689.038061][T24716] netlink: 'syz.0.8945': attribute type 3 has an invalid length. [ 689.707837][T24734] netlink: 'syz.2.8953': attribute type 1 has an invalid length. [ 689.749952][T24734] nbd: error processing sock list [ 692.729883][T23990] syz.1.8596 (23990) used greatest stack depth: 19320 bytes left [ 694.298786][T24858] sctp: [Deprecated]: syz.2.9012 (pid 24858) Use of struct sctp_assoc_value in delayed_ack socket option. [ 694.298786][T24858] Use struct sctp_sack_info instead [ 694.924411][T24872] netlink: Invalid conntrack timeout [ 698.160147][T24945] FAULT_INJECTION: forcing a failure. [ 698.160147][T24945] name failslab, interval 1, probability 0, space 0, times 0 [ 698.240705][T24945] CPU: 0 UID: 0 PID: 24945 Comm: syz.2.9050 Tainted: G U L syzkaller #0 PREEMPT(full) [ 698.240746][T24945] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 698.240755][T24945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 698.240770][T24945] Call Trace: [ 698.240778][T24945] [ 698.240787][T24945] dump_stack_lvl+0x100/0x190 [ 698.240820][T24945] should_fail_ex.cold+0x5/0xa [ 698.240848][T24945] should_failslab+0xc2/0x120 [ 698.240884][T24945] __kmalloc_node_noprof+0x101/0x830 [ 698.240924][T24945] ? __kmalloc_noprof+0x251/0x820 [ 698.240955][T24945] ? get_callchain_buffers+0x1e5/0x380 [ 698.241005][T24945] get_callchain_buffers+0x1e5/0x380 [ 698.241038][T24945] ? security_capable+0x80/0x260 [ 698.241147][T24945] stack_map_alloc+0x316/0x610 [ 698.241179][T24945] map_create+0x874/0x3120 [ 698.241235][T24945] ? __lock_acquire+0x49f/0x1a40 [ 698.241289][T24945] ? __pfx_map_create+0x10/0x10 [ 698.241335][T24945] ? __might_fault+0xc5/0x140 [ 698.241372][T24945] __sys_bpf+0x2a6e/0x4e80 [ 698.241409][T24945] ? __pfx___sys_bpf+0x10/0x10 [ 698.241434][T24945] ? __pfx_futex_hash+0x10/0x10 [ 698.241456][T24945] ? get_pid_task+0xfc/0x250 [ 698.241488][T24945] ? get_pid_task+0xfc/0x250 [ 698.241524][T24945] ? futex_wait+0x11e/0x370 [ 698.241556][T24945] ? __pfx_futex_wait+0x10/0x10 [ 698.241587][T24945] ? find_held_lock+0x2b/0x80 [ 698.241623][T24945] ? rcu_read_lock_any_held+0x6a/0xa0 [ 698.241656][T24945] ? find_held_lock+0x2b/0x80 [ 698.241685][T24945] ? ksys_write+0x190/0x250 [ 698.241707][T24945] ? ksys_write+0x190/0x250 [ 698.241746][T24945] ? __x64_sys_futex+0x34f/0x4d0 [ 698.241772][T24945] ? __x64_sys_futex+0x358/0x4d0 [ 698.241802][T24945] ? xfd_validate_state+0x129/0x190 [ 698.241834][T24945] ? __x64_sys_bpf+0xce/0x140 [ 698.241859][T24945] __x64_sys_bpf+0xce/0x140 [ 698.241886][T24945] ? do_syscall_64+0x90/0x840 [ 698.241929][T24945] do_syscall_64+0x115/0x840 [ 698.241961][T24945] ? clear_bhb_loop+0x40/0x90 [ 698.241991][T24945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.242016][T24945] RIP: 0033:0x7f14f219e019 [ 698.242036][T24945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.242060][T24945] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 698.242084][T24945] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 698.242100][T24945] RDX: 00000000000006f4 RSI: 0000200000000580 RDI: 0000000000000000 [ 698.242115][T24945] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 698.242129][T24945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 698.242143][T24945] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 698.242174][T24945] [ 699.106867][T24948] netlink: 'syz.4.9060': attribute type 11 has an invalid length. [ 699.138246][T24948] netlink: 'syz.4.9060': attribute type 11 has an invalid length. [ 699.171533][T24948] netlink: 'syz.4.9060': attribute type 11 has an invalid length. [ 699.501463][T24952] phram: parameter too long [ 705.058372][T25068] openvswitch: netlink: IP tunnel dst address not specified [ 705.726947][ T9801] Bluetooth: hci1: command 0x0406 tx timeout [ 706.466495][T25105] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9133'. [ 706.762396][T25112] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9127'. [ 707.865295][T25138] openvswitch: netlink: IP tunnel dst address not specified [ 708.300352][T25148] openvswitch: netlink: IP tunnel dst address not specified [ 709.244410][T25169] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.0.9156:25169 [ 713.717768][T25284] sd 0:0:1:0: PR command failed: 1026 [ 713.743537][T25284] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 713.771837][T25284] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 714.318375][T25298] netlink: 'syz.4.9216': attribute type 2 has an invalid length. [ 715.908759][ T9801] Bluetooth: hci2: command 0x0406 tx timeout [ 716.031461][T25340] netlink: 'syz.0.9236': attribute type 11 has an invalid length. [ 718.182279][T25386] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 719.169571][T25410] netlink: Setting conntrack mark requires 'commit' flag. [ 719.194069][T25409] openvswitch: netlink: Tunnel attr 242 out of range max 16 [ 719.680517][T25424] netlink: 'syz.0.9276': attribute type 1 has an invalid length. [ 720.326073][T24738] syz.1.8950 (24738) used greatest stack depth: 18088 bytes left [ 722.066893][T25495] .^: entered promiscuous mode [ 722.914881][T25518] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 723.213362][T25527] netlink: zone id is out of range [ 723.244595][T25527] netlink: zone id is out of range [ 723.276637][T25527] netlink: zone id is out of range [ 723.292700][T25527] netlink: zone id is out of range [ 723.320936][T25527] netlink: zone id is out of range [ 723.345233][T25527] netlink: zone id is out of range [ 723.370062][T25527] netlink: zone id is out of range [ 723.395447][T25527] netlink: zone id is out of range [ 723.423697][T25527] netlink: zone id is out of range [ 723.448104][T25527] netlink: zone id is out of range [ 727.824484][T25673] futex_wake_op: syz.4.9392 tries to shift op by -2048; fix this program [ 727.870722][T25673] futex_wake_op: syz.4.9392 tries to shift op by -2048; fix this program [ 728.298712][T25683] net_ratelimit: 106 callbacks suppressed [ 728.298734][T25683] netlink: zone id is out of range [ 728.347004][T25683] netlink: zone id is out of range [ 728.372117][T25683] netlink: zone id is out of range [ 728.398074][T25683] netlink: zone id is out of range [ 728.425448][T25683] netlink: zone id is out of range [ 728.447921][T25683] netlink: zone id is out of range [ 728.477478][T25683] netlink: zone id is out of range [ 728.506397][T25683] netlink: zone id is out of range [ 728.530226][T25683] netlink: zone id is out of range [ 728.561701][T25683] netlink: zone id is out of range [ 728.988926][T25656] syz.1.9385 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 729.003092][T25656] CPU: 0 UID: 0 PID: 25656 Comm: syz.1.9385 Tainted: G U L syzkaller #0 PREEMPT(full) [ 729.003141][T25656] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 729.003151][T25656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 729.003166][T25656] Call Trace: [ 729.003175][T25656] [ 729.003185][T25656] dump_stack_lvl+0x100/0x190 [ 729.003220][T25656] dump_header+0xfb/0x606 [ 729.003250][T25656] oom_kill_process.cold+0xd/0x330 [ 729.003282][T25656] out_of_memory+0x340/0x14f0 [ 729.003333][T25656] ? __pfx_out_of_memory+0x10/0x10 [ 729.003385][T25656] mem_cgroup_out_of_memory+0xc6/0x130 [ 729.003422][T25656] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 729.003451][T25656] ? find_held_lock+0x2b/0x80 [ 729.003491][T25656] ? do_raw_spin_unlock+0x145/0x1e0 [ 729.003522][T25656] ? _raw_spin_unlock+0x28/0x50 [ 729.003554][T25656] try_charge_memcg+0x6e5/0xdf0 [ 729.003600][T25656] ? __pfx_try_charge_memcg+0x10/0x10 [ 729.003638][T25656] ? find_held_lock+0x2b/0x80 [ 729.003670][T25656] ? rcu_read_unlock+0x17/0x60 [ 729.003711][T25656] ? rcu_read_unlock+0x17/0x60 [ 729.003752][T25656] ? find_held_lock+0x2b/0x80 [ 729.003786][T25656] ? rcu_read_unlock+0x17/0x60 [ 729.003833][T25656] charge_memcg+0x187/0x1e0 [ 729.003875][T25656] mem_cgroup_swapin_charge_folio+0xc1/0x450 [ 729.003906][T25656] swap_cache_alloc_folio+0x548/0xc50 [ 729.003943][T25656] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 729.003974][T25656] ? swap_cache_get_folio+0x28d/0x360 [ 729.004005][T25656] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 729.004032][T25656] ? lockdep_hardirqs_on+0x78/0x100 [ 729.004067][T25656] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 729.004104][T25656] swap_cache_read_folio+0x47/0x140 [ 729.004138][T25656] swap_cluster_readahead+0x387/0x5f0 [ 729.004176][T25656] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 729.004236][T25656] ? __lock_acquire+0x49f/0x1a40 [ 729.004278][T25656] ? get_vma_policy+0x23d/0x3b0 [ 729.004327][T25656] swapin_readahead+0x159/0x1200 [ 729.004368][T25656] ? __pfx_swapin_readahead+0x10/0x10 [ 729.004406][T25656] ? swap_table_get+0x10d/0x2c0 [ 729.004439][T25656] ? swap_cache_get_folio+0x28d/0x360 [ 729.004469][T25656] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 729.004498][T25656] ? __pfx_softleaf_type+0x10/0x10 [ 729.004533][T25656] ? do_swap_page+0xf98/0x5780 [ 729.004557][T25656] do_swap_page+0xf98/0x5780 [ 729.004597][T25656] ? __pfx_do_swap_page+0x10/0x10 [ 729.004623][T25656] ? __lock_acquire+0x49f/0x1a40 [ 729.004669][T25656] ? rcu_is_watching+0x12/0xc0 [ 729.004700][T25656] ? __pte_offset_map+0x179/0x310 [ 729.004739][T25656] __handle_mm_fault+0x192f/0x2a00 [ 729.004772][T25656] ? reacquire_held_locks+0xce/0x1e0 [ 729.004814][T25656] ? __pfx___handle_mm_fault+0x10/0x10 [ 729.004846][T25656] ? lock_vma_under_rcu+0x17c/0x590 [ 729.004890][T25656] handle_mm_fault+0x37b/0xa30 [ 729.004923][T25656] do_user_addr_fault+0x5a3/0x12f0 [ 729.005002][T25656] exc_page_fault+0x6f/0xd0 [ 729.005041][T25656] asm_exc_page_fault+0x26/0x30 [ 729.005068][T25656] RIP: 0033:0x7fe19dc517fc [ 729.005088][T25656] Code: 23 83 c0 01 44 39 d0 75 dc 48 89 f0 25 ff 1f 00 00 49 89 34 c1 41 88 3c 00 31 c0 c3 66 90 41 38 3c 10 74 0b 41 88 3c 10 31 c0 <49> 89 34 d1 c3 b8 01 00 00 00 c3 66 0f 1f 84 00 00 00 00 00 48 83 [ 729.005113][T25656] RSP: 002b:00007fffbfcbcd08 EFLAGS: 00010246 [ 729.005134][T25656] RAX: 0000000000000000 RBX: ffffffff81c59d11 RCX: 0000000000000000 [ 729.005150][T25656] RDX: 0000000000001d11 RSI: ffffffff81c59d11 RDI: 0000000000000000 [ 729.005166][T25656] RBP: 0000000000000006 R08: 00007fe19e010000 R09: 00007fe19e012000 [ 729.005182][T25656] R10: 0000000081c59d15 R11: 0000000000000000 R12: 00007fe19e026038 [ 729.005197][T25656] R13: 0000000000000006 R14: ffffffff81c590ba R15: 00007fe19eb55720 [ 729.005215][T25656] ? copy_clone_args_from_user+0x13a/0x7d0 [ 729.005245][T25656] ? mmput_async+0x1/0x1a0 [ 729.005274][T25656] ? mmput_async+0x1/0x1a0 [ 729.005304][T25656] [ 729.005440][T25656] memory: usage 3072kB, limit 3072kB, failcnt 66053 [ 729.445818][T25656] memory+swap: usage 3336kB, limit 9007199254740988kB, failcnt 0 [ 729.455800][T25656] kmem: usage 2912kB, limit 9007199254740988kB, failcnt 0 [ 729.463829][T25656] Memory cgroup stats for /syz1: [ 729.464379][T25656] cache 155648 [ 729.474045][T25656] rss 0 [ 729.476953][T25656] rss_huge 0 [ 729.481134][T25656] shmem 0 [ 729.487511][T25656] mapped_file 0 [ 729.491265][T25656] dirty 0 [ 729.494403][T25656] writeback 4096 [ 729.498806][T25656] workingset_refault_anon 3668 [ 729.504696][T25656] workingset_refault_file 30322 [ 729.510142][T25656] swap 270336 [ 729.513604][T25656] swapcached 229138432 [ 729.518739][T25656] pgpgin 204865 [ 729.522508][T25656] pgpgout 213512 [ 729.526194][T25656] pgfault 269980 [ 729.533155][T25656] pgmajfault 1730 [ 729.538017][T25656] inactive_anon 0 [ 729.541824][T25656] active_anon 0 [ 729.546509][T25656] inactive_file 155648 [ 729.551165][T25656] active_file 0 [ 729.554781][T25656] unevictable 0 [ 729.560803][T25656] hierarchical_memory_limit 3145728 [ 729.568164][T25656] hierarchical_memsw_limit 9223372036854771712 [ 729.574778][T25656] total_cache 155648 [ 729.579737][T25656] total_rss 0 [ 729.583170][T25656] total_rss_huge 0 [ 729.590145][T25656] total_shmem 0 [ 729.593800][T25656] total_mapped_file 0 [ 729.600379][T25656] total_dirty 0 [ 729.604051][T25656] total_writeback 4096 [ 729.608559][T25656] total_workingset_refault_anon 3668 [ 729.614144][T25656] total_workingset_refault_file 30322 [ 729.620216][T25656] total_swap 270336 [ 729.624362][T25656] total_swapcached 229138432 [ 729.629908][T25656] total_pgpgin 204865 [ 729.634061][T25656] total_pgpgout 213512 [ 729.641948][T25656] total_pgfault 269980 [ 729.647311][T25656] total_pgmajfault 1730 [ 729.651663][T25656] total_inactive_anon 0 [ 729.656629][T25656] total_active_anon 0 [ 729.661397][T25656] total_inactive_file 155648 [ 729.666695][T25656] total_active_file 0 [ 729.670823][T25656] total_unevictable 0 [ 729.674950][T25656] anon_cost 0 [ 729.679040][T25656] file_cost 14 [ 729.682524][T25656] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.9385,pid=25656,uid=0 [ 729.706605][T25656] Memory cgroup out of memory: Killed process 25656 (syz.1.9385) total-vm:104564kB, anon-rss:1244kB, file-rss:21724kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 732.091009][T25758] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 732.638911][T25774] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9437'. [ 733.172460][T25785] netlink: 'syz.1.9442': attribute type 2 has an invalid length. [ 733.223126][T25788] netlink: 'syz.0.9444': attribute type 1 has an invalid length. [ 733.593088][T25799] netlink: 'syz.2.9449': attribute type 1 has an invalid length. [ 733.750716][T25802] net_ratelimit: 48 callbacks suppressed [ 733.750737][T25802] netlink: ct_mark mask cannot be 0 [ 734.143122][T25815] netlink: 'syz.2.9457': attribute type 1 has an invalid length. [ 734.194079][T25815] netlink: 33 bytes leftover after parsing attributes in process `syz.2.9457'. [ 736.115024][T25866] nfs: Unknown parameter 'm?LH>｢^eko}* ' [ 736.337024][T25871] program syz.4.9481 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 736.839989][T25883] openvswitch: netlink: IP tunnel attribute has 3 unknown bytes. [ 737.639452][T25906] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9497'. [ 737.680667][T25906] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 738.685425][T25943] netlink: 'syz.2.9515': attribute type 1 has an invalid length. [ 742.563989][T17348] Process accounting resumed [ 744.356095][T26101] block nbd2: not configured, cannot reconfigure [ 744.404197][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 744.416111][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 746.186078][T26144] sysfs: cannot create duplicate filename '/class/ieee80211/!PjE r҄y*"l-y–L̓]' [ 746.241993][T26144] CPU: 0 UID: 0 PID: 26144 Comm: syz.1.9610 Tainted: G U L syzkaller #0 PREEMPT(full) [ 746.242035][T26144] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 746.242045][T26144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 746.242061][T26144] Call Trace: [ 746.242068][T26144] [ 746.242077][T26144] dump_stack_lvl+0x100/0x190 [ 746.242111][T26144] sysfs_warn_dup.cold+0x1c/0x28 [ 746.242151][T26144] sysfs_do_create_link_sd+0x113/0x140 [ 746.242197][T26144] sysfs_create_link+0x61/0xc0 [ 746.242235][T26144] device_add+0x675/0x1970 [ 746.242264][T26144] ? __pfx_device_add+0x10/0x10 [ 746.242286][T26144] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 746.242326][T26144] ? ieee80211_set_bitrate_flags+0x41b/0x6b0 [ 746.242469][T26144] wiphy_register+0x2151/0x3110 [ 746.242505][T26144] ? __pfx_wiphy_register+0x10/0x10 [ 746.242532][T26144] ? __asan_memset+0x23/0x50 [ 746.242559][T26144] ? minstrel_ht_alloc+0x5e6/0x7f0 [ 746.242661][T26144] ieee80211_register_hw+0x3053/0x4580 [ 746.242750][T26144] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 746.242785][T26144] ? __pfx___debug_object_init+0x10/0x10 [ 746.242914][T26144] ? find_held_lock+0x2b/0x80 [ 746.242947][T26144] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 746.242984][T26144] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 746.243050][T26144] ? __hrtimer_setup+0x208/0x330 [ 746.243080][T26144] mac80211_hwsim_new_radio+0x2acc/0x64c0 [ 746.243151][T26144] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 746.243195][T26144] ? hwsim_new_radio_nl+0xbcf/0x13f0 [ 746.243235][T26144] hwsim_new_radio_nl+0xc6b/0x13f0 [ 746.243277][T26144] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 746.243325][T26144] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 746.243406][T26144] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 746.243452][T26144] genl_family_rcv_msg_doit+0x214/0x300 [ 746.243487][T26144] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 746.243520][T26144] ? genl_get_cmd+0x3e7/0x760 [ 746.243556][T26144] ? bpf_lsm_capable+0x9/0x10 [ 746.243583][T26144] ? security_capable+0x80/0x260 [ 746.243610][T26144] ? ns_capable+0xd2/0xf0 [ 746.243645][T26144] genl_rcv_msg+0x560/0x800 [ 746.243680][T26144] ? __pfx_genl_rcv_msg+0x10/0x10 [ 746.243712][T26144] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 746.243758][T26144] netlink_rcv_skb+0x159/0x420 [ 746.243787][T26144] ? __pfx_genl_rcv_msg+0x10/0x10 [ 746.243821][T26144] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 746.243860][T26144] ? netlink_deliver_tap+0x1ae/0xcc0 [ 746.243891][T26144] genl_rcv+0x28/0x40 [ 746.243918][T26144] netlink_unicast+0x585/0x850 [ 746.243949][T26144] ? __pfx_netlink_unicast+0x10/0x10 [ 746.243985][T26144] netlink_sendmsg+0x8b0/0xda0 [ 746.244017][T26144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 746.244049][T26144] ? apparmor_socket_sendmsg+0x15b/0x270 [ 746.244120][T26144] ____sys_sendmsg+0xa4d/0xbe0 [ 746.244145][T26144] ? __pfx_netlink_sendmsg+0x10/0x10 [ 746.244175][T26144] ? __pfx_____sys_sendmsg+0x10/0x10 [ 746.244214][T26144] ___sys_sendmsg+0x190/0x1e0 [ 746.244244][T26144] ? __pfx____sys_sendmsg+0x10/0x10 [ 746.244269][T26144] ? __lock_acquire+0x49f/0x1a40 [ 746.244343][T26144] __sys_sendmsg+0x160/0x210 [ 746.244400][T26144] ? __pfx___sys_sendmsg+0x10/0x10 [ 746.244452][T26144] do_syscall_64+0x115/0x840 [ 746.244484][T26144] ? clear_bhb_loop+0x40/0x90 [ 746.244514][T26144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 746.244539][T26144] RIP: 0033:0x7fe19dd9e019 [ 746.244560][T26144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 746.244584][T26144] RSP: 002b:00007fe19ece7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 746.244608][T26144] RAX: ffffffffffffffda RBX: 00007fe19e025fa0 RCX: 00007fe19dd9e019 [ 746.244629][T26144] RDX: 0000000000040800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 746.244645][T26144] RBP: 00007fe19de3500c R08: 0000000000000000 R09: 0000000000000000 [ 746.244660][T26144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 746.244674][T26144] R13: 00007fe19e026038 R14: 00007fe19e025fa0 R15: 00007fffbfcbcc78 [ 746.244705][T26144] [ 747.115638][T26160] openvswitch: netlink: Flow key attr not present in new flow. [ 748.276027][T26196] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9634'. [ 748.384512][T26196] netlink: 29 bytes leftover after parsing attributes in process `syz.1.9634'. [ 749.138987][T26214] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 750.311931][T26246] netlink: Conntrack attr has 5 unknown bytes [ 750.812590][T26260] tipc: Started in network mode [ 750.838265][T26260] tipc: Node identity ee00, cluster identity 4711 [ 750.868325][T26260] tipc: Node number set to 60928 [ 751.099307][T26267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9668'. [ 751.142093][T26267] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 751.357786][T26275] netlink: Conntrack attr has 5 unknown bytes [ 753.875382][T26333] openvswitch: netlink: Duplicate or invalid key (type 0). [ 754.773176][T26356] netlink: 'syz.0.9709': attribute type 1 has an invalid length. [ 755.518246][T26374] capability: warning: `syz.0.9718' uses 32-bit capabilities (legacy support in use) [ 755.815434][T26379] netlink: 'syz.0.9729': attribute type 4 has an invalid length. [ 755.852509][T26379] netlink: 'syz.0.9729': attribute type 1 has an invalid length. [ 756.812906][T26405] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 757.164653][T26414] netlink: 148 bytes leftover after parsing attributes in process `syz.1.9738'. [ 758.425222][T26447] aoe: could not set interface list: too many interfaces [ 759.806455][T26488] netlink: 'syz.0.9772': attribute type 11 has an invalid length. [ 762.225271][T26556] openvswitch: netlink: IP tunnel TTL not specified. [ 763.139927][T26579] netlink: 'syz.4.9814': attribute type 1 has an invalid length. [ 764.321891][T26609] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 764.760609][T26618] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 767.366866][T26685] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9862'. [ 769.443783][T26752] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9891'. [ 770.364334][T26775] netlink: 'syz.1.9902': attribute type 33 has an invalid length. [ 770.853368][T26791] netlink: 206 bytes leftover after parsing attributes in process `syz.0.9909'. [ 772.152606][ T29] audit: type=1800 audit(4295032906.489:45): pid=26799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9913" name="regulatory.db.p7s" dev="sda1" ino=449 res=0 errno=0 [ 772.200475][T26799] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -4 [ 772.299878][T26799] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -4 [ 772.390590][T26799] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 773.264453][T26827] NFSD: Failed to start, no listeners configured. [ 774.421181][T26860] netlink: 342 bytes leftover after parsing attributes in process `syz.2.9937'. [ 778.739338][T26960] bridge0: port 3(team0) entered blocking state [ 778.778628][T26960] bridge0: port 3(team0) entered disabled state [ 778.822385][T26960] team0: entered allmulticast mode [ 778.846485][T26960] team_slave_0: entered allmulticast mode [ 778.874173][T26960] team_slave_1: entered allmulticast mode [ 778.916068][T26960] team0: entered promiscuous mode [ 778.943285][T26960] team_slave_0: entered promiscuous mode [ 778.966266][T26960] team_slave_1: entered promiscuous mode [ 779.003811][T26960] bridge0: port 3(team0) entered blocking state [ 779.013130][T26960] bridge0: port 3(team0) entered forwarding state [ 780.788225][T27012] bridge0: port 3(syz_tun) entered blocking state [ 780.813529][T27012] bridge0: port 3(syz_tun) entered disabled state [ 780.837347][T27012] syz_tun: entered allmulticast mode [ 780.861876][T27012] syz_tun: entered promiscuous mode [ 780.879589][T27012] bridge0: port 3(syz_tun) entered blocking state [ 780.886305][T27012] bridge0: port 3(syz_tun) entered forwarding state [ 782.038927][T27038] FAULT_INJECTION: forcing a failure. [ 782.038927][T27038] name failslab, interval 1, probability 0, space 0, times 0 [ 782.115572][T27038] CPU: 0 UID: 0 PID: 27038 Comm: syz.2.10018 Tainted: G U L syzkaller #0 PREEMPT(full) [ 782.115616][T27038] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 782.115625][T27038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 782.115640][T27038] Call Trace: [ 782.115647][T27038] [ 782.115657][T27038] dump_stack_lvl+0x100/0x190 [ 782.115689][T27038] should_fail_ex.cold+0x5/0xa [ 782.115717][T27038] should_failslab+0xc2/0x120 [ 782.115757][T27038] __kmalloc_noprof+0xfc/0x820 [ 782.115789][T27038] ? sk_prot_alloc+0x10b/0x2a0 [ 782.115820][T27038] sk_prot_alloc+0x10b/0x2a0 [ 782.115846][T27038] sk_alloc+0x36/0xe80 [ 782.115879][T27038] mctp_pf_create+0xe8/0x360 [ 782.116008][T27038] __sock_create+0x339/0x860 [ 782.116040][T27038] __sys_socket+0x14d/0x260 [ 782.116068][T27038] ? __pfx___sys_socket+0x10/0x10 [ 782.116104][T27038] __x64_sys_socket+0x72/0xb0 [ 782.116131][T27038] ? lockdep_hardirqs_on+0x78/0x100 [ 782.116163][T27038] do_syscall_64+0x115/0x840 [ 782.116194][T27038] ? clear_bhb_loop+0x40/0x90 [ 782.116224][T27038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.116259][T27038] RIP: 0033:0x7f14f219e019 [ 782.116279][T27038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.116303][T27038] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 782.116326][T27038] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 782.116342][T27038] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 000000000000002d [ 782.116358][T27038] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 782.116373][T27038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 782.116387][T27038] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 782.116418][T27038] [ 783.370864][T27070] tunl0: entered allmulticast mode [ 784.468230][T27107] bridge0: port 3(syz_tun) entered blocking state [ 784.502645][T27107] bridge0: port 3(syz_tun) entered disabled state [ 784.534194][T27107] syz_tun: entered allmulticast mode [ 784.606311][T27107] syz_tun: entered promiscuous mode [ 784.629260][T27107] bridge0: port 3(syz_tun) entered blocking state [ 784.635972][T27107] bridge0: port 3(syz_tun) entered forwarding state [ 785.800526][T27143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10067'. [ 785.813465][T27145] bridge0: port 3(syz_tun) entered blocking state [ 785.845825][T27145] bridge0: port 3(syz_tun) entered disabled state [ 785.866672][T27145] syz_tun: entered allmulticast mode [ 785.890683][T27145] syz_tun: entered promiscuous mode [ 785.910730][T27145] bridge0: port 3(syz_tun) entered blocking state [ 785.917418][T27145] bridge0: port 3(syz_tun) entered forwarding state [ 786.160317][T27152] sctp: [Deprecated]: syz.4.10072 (pid 27152) Use of int in max_burst socket option. [ 786.160317][T27152] Use struct sctp_assoc_value instead [ 786.490761][ T29] audit: type=1800 audit(4295032920.914:46): pid=27163 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.10076" name=04 dev="tmpfs" ino=13115 res=0 errno=0 [ 786.697157][T27165] netlink: 342 bytes leftover after parsing attributes in process `syz.4.10077'. [ 786.789795][T27168] ovs_: entered promiscuous mode [ 787.975652][ T29] audit: type=1800 audit(4295032922.401:47): pid=27205 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.10096" name=22050820 dev="tmpfs" ino=2933 res=0 errno=0 [ 790.738274][T27286] FAULT_INJECTION: forcing a failure. [ 790.738274][T27286] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 790.787091][T27286] CPU: 0 UID: 0 PID: 27286 Comm: syz.2.10132 Tainted: G U L syzkaller #0 PREEMPT(full) [ 790.787132][T27286] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 790.787142][T27286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 790.787156][T27286] Call Trace: [ 790.787167][T27286] [ 790.787176][T27286] dump_stack_lvl+0x100/0x190 [ 790.787209][T27286] should_fail_ex.cold+0x5/0xa [ 790.787232][T27286] ? prepare_alloc_pages+0x16d/0x5f0 [ 790.787271][T27286] should_fail_alloc_page+0xeb/0x140 [ 790.787308][T27286] prepare_alloc_pages+0x1f0/0x5f0 [ 790.787349][T27286] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 790.787392][T27286] ? lock_acquire+0x1b9/0x370 [ 790.787433][T27286] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 790.787462][T27286] ? page_table_check_set+0x48f/0x930 [ 790.787494][T27286] ? page_table_check_set+0x48f/0x930 [ 790.787533][T27286] ? page_table_check_set+0x4f7/0x930 [ 790.787575][T27286] ? xas_find+0x32c/0x8e0 [ 790.787614][T27286] ? find_held_lock+0x2b/0x80 [ 790.787644][T27286] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 790.787691][T27286] ? policy_nodemask+0xed/0x4f0 [ 790.787729][T27286] alloc_pages_mpol+0x1fb/0x540 [ 790.787767][T27286] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 790.787812][T27286] folio_alloc_mpol_noprof+0x36/0x260 [ 790.787856][T27286] vma_alloc_folio_noprof+0xed/0x1d0 [ 790.787897][T27286] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 790.787947][T27286] do_anonymous_page+0xb2b/0x2080 [ 790.787973][T27286] ? rcu_read_unlock+0x2d/0xb0 [ 790.788005][T27286] __handle_mm_fault+0x1d2c/0x2a00 [ 790.788036][T27286] ? reacquire_held_locks+0xce/0x1e0 [ 790.788077][T27286] ? __pfx___handle_mm_fault+0x10/0x10 [ 790.788107][T27286] ? lock_vma_under_rcu+0x17c/0x590 [ 790.788148][T27286] handle_mm_fault+0x37b/0xa30 [ 790.788178][T27286] do_user_addr_fault+0x5a3/0x12f0 [ 790.788221][T27286] exc_page_fault+0x6f/0xd0 [ 790.788254][T27286] asm_exc_page_fault+0x26/0x30 [ 790.788278][T27286] RIP: 0033:0x7f14f205f6cb [ 790.788298][T27286] Code: 00 00 00 48 8d 3d 15 b1 1a 00 48 89 c1 31 c0 e8 0b 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d 49 b1 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 790.788322][T27286] RSP: 002b:00007f14f3021fa0 EFLAGS: 00010206 [ 790.788341][T27286] RAX: 0000000000000000 RBX: 00007f14f2425fa0 RCX: 0000000000000000 [ 790.788357][T27286] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000200000000140 [ 790.788372][T27286] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 790.788387][T27286] R10: 0000200000000140 R11: 0000000000000000 R12: 0000000000000000 [ 790.788402][T27286] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 790.788433][T27286] [ 791.708060][T27296] bridge0: port 4(syz_tun) entered blocking state [ 791.730860][T27296] bridge0: port 4(syz_tun) entered disabled state [ 791.766032][T27296] syz_tun: entered allmulticast mode [ 791.800554][T27296] syz_tun: entered promiscuous mode [ 791.819633][T27296] bridge0: port 4(syz_tun) entered blocking state [ 791.826265][T27296] bridge0: port 4(syz_tun) entered forwarding state [ 792.057465][T27303] sctp: [Deprecated]: syz.1.10139 (pid 27303) Use of int in maxseg socket option. [ 792.057465][T27303] Use struct sctp_assoc_value instead [ 792.100531][T27286] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 795.010042][T27363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10165'. [ 796.286461][T27394] FAULT_INJECTION: forcing a failure. [ 796.286461][T27394] name failslab, interval 1, probability 0, space 0, times 0 [ 796.345287][T27394] CPU: 0 UID: 0 PID: 27394 Comm: syz.4.10179 Tainted: G U L syzkaller #0 PREEMPT(full) [ 796.345330][T27394] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 796.345339][T27394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 796.345354][T27394] Call Trace: [ 796.345362][T27394] [ 796.345377][T27394] dump_stack_lvl+0x100/0x190 [ 796.345414][T27394] should_fail_ex.cold+0x5/0xa [ 796.345442][T27394] should_failslab+0xc2/0x120 [ 796.345477][T27394] __kmalloc_noprof+0xfc/0x820 [ 796.345507][T27394] ? __lock_acquire+0x49f/0x1a40 [ 796.345546][T27394] ? sk_prot_alloc+0x10b/0x2a0 [ 796.345575][T27394] sk_prot_alloc+0x10b/0x2a0 [ 796.345606][T27394] sk_alloc+0x36/0xe80 [ 796.345654][T27394] pppol2tp_create+0x32/0x250 [ 796.345766][T27394] pppox_create+0x15c/0x2c0 [ 796.345883][T27394] __sock_create+0x339/0x860 [ 796.345914][T27394] __sys_socket+0x14d/0x260 [ 796.345949][T27394] ? __pfx___sys_socket+0x10/0x10 [ 796.345985][T27394] __x64_sys_socket+0x72/0xb0 [ 796.346011][T27394] ? lockdep_hardirqs_on+0x78/0x100 [ 796.346044][T27394] do_syscall_64+0x115/0x840 [ 796.346075][T27394] ? clear_bhb_loop+0x40/0x90 [ 796.346105][T27394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 796.346130][T27394] RIP: 0033:0x7f532259e019 [ 796.346149][T27394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 796.346173][T27394] RSP: 002b:00007f5323494028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 796.346197][T27394] RAX: ffffffffffffffda RBX: 00007f5322825fa0 RCX: 00007f532259e019 [ 796.346213][T27394] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000018 [ 796.346227][T27394] RBP: 00007f532263500c R08: 0000000000000000 R09: 0000000000000000 [ 796.346242][T27394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 796.346262][T27394] R13: 00007f5322826038 R14: 00007f5322825fa0 R15: 00007fff52acba18 [ 796.346292][T27394] [ 798.017676][T27416] binder: 27415:27416 ioctl c0306201 200000000000 returned -11 [ 798.507948][T27441] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 801.708189][T27523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10236'. [ 802.819145][T27552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10249'. [ 805.526048][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 805.538515][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 806.682902][T27648] GUP no longer grows the stack in syz.2.10292 (27648): 5000-401000 (4000) [ 806.730239][T27648] CPU: 0 UID: 0 PID: 27648 Comm: syz.2.10292 Tainted: G U L syzkaller #0 PREEMPT(full) [ 806.730283][T27648] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 806.730292][T27648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 806.730309][T27648] Call Trace: [ 806.730317][T27648] [ 806.730326][T27648] dump_stack_lvl+0x100/0x190 [ 806.730358][T27648] gup_vma_lookup.cold+0x83/0x96 [ 806.730395][T27648] __get_user_pages+0x241/0x32a0 [ 806.730439][T27648] ? down_read_killable+0x35e/0x520 [ 806.730477][T27648] ? __lock_acquire+0x49f/0x1a40 [ 806.730516][T27648] ? __pfx___get_user_pages+0x10/0x10 [ 806.730551][T27648] ? __pfx_validate_mm+0x10/0x10 [ 806.730583][T27648] __gup_longterm_locked+0x87d/0x16f0 [ 806.730637][T27648] ? __pfx___gup_longterm_locked+0x10/0x10 [ 806.730675][T27648] ? lock_acquire+0x1b9/0x370 [ 806.730723][T27648] gup_fast_fallback+0x16dc/0x2790 [ 806.730780][T27648] ? __pfx_gup_fast_fallback+0x10/0x10 [ 806.730820][T27648] ? __lock_acquire+0x49f/0x1a40 [ 806.730859][T27648] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 806.730892][T27648] get_user_pages_fast+0xa7/0xf0 [ 806.730928][T27648] ? __pfx_get_user_pages_fast+0x10/0x10 [ 806.730975][T27648] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 806.731086][T27648] ? pipe_lock+0x69/0x80 [ 806.731114][T27648] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 806.731155][T27648] ? __pfx___mutex_lock+0x10/0x10 [ 806.731190][T27648] ? iovec_from_user+0xda/0x140 [ 806.731237][T27648] iov_iter_get_pages2+0xa3/0x100 [ 806.731275][T27648] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 806.731313][T27648] ? wait_for_space+0x2ca/0x3b0 [ 806.731367][T27648] __do_sys_vmsplice+0x7dd/0x13c0 [ 806.731406][T27648] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 806.731441][T27648] ? __pfx_futex_wait+0x10/0x10 [ 806.731485][T27648] ? __pfx___do_sys_mremap+0x10/0x10 [ 806.731549][T27648] ? do_syscall_64+0x115/0x840 [ 806.731580][T27648] do_syscall_64+0x115/0x840 [ 806.731616][T27648] ? clear_bhb_loop+0x40/0x90 [ 806.731647][T27648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.731672][T27648] RIP: 0033:0x7f14f219e019 [ 806.731693][T27648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.731718][T27648] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 806.731741][T27648] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 806.731758][T27648] RDX: 0000000000000006 RSI: 0000200000000000 RDI: 0000000000000000 [ 806.731773][T27648] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 806.731788][T27648] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 806.731803][T27648] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 806.731833][T27648] [ 807.997700][T27680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10306'. [ 809.412655][T27725] FAULT_INJECTION: forcing a failure. [ 809.412655][T27725] name failslab, interval 1, probability 0, space 0, times 0 [ 809.446998][T27709] zswap: compressor F not available [ 809.476024][T27725] CPU: 0 UID: 0 PID: 27725 Comm: syz.2.10322 Tainted: G U L syzkaller #0 PREEMPT(full) [ 809.476072][T27725] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 809.476081][T27725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 809.476096][T27725] Call Trace: [ 809.476103][T27725] [ 809.476113][T27725] dump_stack_lvl+0x100/0x190 [ 809.476144][T27725] should_fail_ex.cold+0x5/0xa [ 809.476172][T27725] should_failslab+0xc2/0x120 [ 809.476215][T27725] kmem_cache_alloc_noprof+0x91/0x6a0 [ 809.476247][T27725] ? key_alloc+0x3c5/0x1310 [ 809.476370][T27725] key_alloc+0x3c5/0x1310 [ 809.476413][T27725] ? __pfx_key_alloc+0x10/0x10 [ 809.476446][T27725] ? lsm_blob_alloc+0x68/0x90 [ 809.476509][T27725] keyring_alloc+0x44/0xc0 [ 809.476548][T27725] install_thread_keyring_to_cred+0xc1/0x140 [ 809.476583][T27725] keyctl_set_reqkey_keyring+0xd3/0x1c0 [ 809.476613][T27725] __do_sys_keyctl+0x316/0x5a0 [ 809.476642][T27725] do_syscall_64+0x115/0x840 [ 809.476675][T27725] ? clear_bhb_loop+0x40/0x90 [ 809.476704][T27725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.476729][T27725] RIP: 0033:0x7f14f219e019 [ 809.476748][T27725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 809.476772][T27725] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 809.476795][T27725] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 809.476811][T27725] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000e [ 809.476825][T27725] RBP: 00007f14f223500c R08: 0000000000000008 R09: 0000000000000000 [ 809.476840][T27725] R10: 0000000000005eaf R11: 0000000000000246 R12: 0000000000000000 [ 809.476854][T27725] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 809.476884][T27725] [ 809.913896][T27733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10325'. [ 810.334146][T27746] usb usb39: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 810.355063][T27746] vhci_hcd vhci_hcd.3: invalid port number 108 [ 810.374100][T27746] vhci_hcd vhci_hcd.3: default hub control req: 2e2f v6966 i006c l48 [ 811.688792][T27781] ovs_: entered promiscuous mode [ 811.740814][T27784] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10349'. [ 814.382745][T27850] Device name cannot be null; rc = [-22] [ 814.789040][ T29] audit: type=1800 audit(4295032949.355:48): pid=27858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.10380" name="lu_gp_id" dev="configfs" ino=83781 res=0 errno=0 [ 814.945282][T27862] ALUA LU Group already has a valid ID, ignoring request [ 815.015312][ T5630] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 815.195728][ T5630] CPU: 0 UID: 0 PID: 5630 Comm: syz-executor Tainted: G U L syzkaller #0 PREEMPT(full) [ 815.195769][ T5630] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 815.195778][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 815.195792][ T5630] Call Trace: [ 815.195800][ T5630] [ 815.195808][ T5630] dump_stack_lvl+0x100/0x190 [ 815.195840][ T5630] dump_header+0xfb/0x606 [ 815.195866][ T5630] oom_kill_process.cold+0xd/0x330 [ 815.195895][ T5630] out_of_memory+0x340/0x14f0 [ 815.195940][ T5630] ? __pfx_out_of_memory+0x10/0x10 [ 815.195986][ T5630] mem_cgroup_out_of_memory+0xc6/0x130 [ 815.196015][ T5630] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 815.196040][ T5630] ? find_held_lock+0x2b/0x80 [ 815.196082][ T5630] ? do_raw_spin_unlock+0x145/0x1e0 [ 815.196109][ T5630] ? _raw_spin_unlock+0x28/0x50 [ 815.196139][ T5630] try_charge_memcg+0x6e5/0xdf0 [ 815.196179][ T5630] ? __pfx_try_charge_memcg+0x10/0x10 [ 815.196213][ T5630] ? find_held_lock+0x2b/0x80 [ 815.196244][ T5630] ? rcu_read_unlock+0x17/0x60 [ 815.196282][ T5630] ? rcu_read_unlock+0x17/0x60 [ 815.196317][ T5630] ? find_held_lock+0x2b/0x80 [ 815.196347][ T5630] ? rcu_read_unlock+0x17/0x60 [ 815.196388][ T5630] charge_memcg+0x187/0x1e0 [ 815.196424][ T5630] __mem_cgroup_charge+0x2b/0x1c0 [ 815.196448][ T5630] filemap_add_folio+0xe7/0x630 [ 815.196473][ T5630] ? __pfx_filemap_add_folio+0x10/0x10 [ 815.196504][ T5630] __filemap_get_folio_mpol+0x584/0x1320 [ 815.196536][ T5630] filemap_fault+0x879/0x3130 [ 815.196567][ T5630] ? __pfx_filemap_fault+0x10/0x10 [ 815.196600][ T5630] ? find_held_lock+0x2b/0x80 [ 815.196631][ T5630] __do_fault+0x10b/0x440 [ 815.196663][ T5630] do_fault+0xa99/0x1750 [ 815.196701][ T5630] __handle_mm_fault+0x187d/0x2a00 [ 815.196731][ T5630] ? reacquire_held_locks+0xce/0x1e0 [ 815.196769][ T5630] ? __pfx___handle_mm_fault+0x10/0x10 [ 815.196798][ T5630] ? lock_vma_under_rcu+0x17c/0x590 [ 815.196837][ T5630] handle_mm_fault+0x37b/0xa30 [ 815.196866][ T5630] do_user_addr_fault+0x5a3/0x12f0 [ 815.196907][ T5630] exc_page_fault+0x6f/0xd0 [ 815.196938][ T5630] asm_exc_page_fault+0x26/0x30 [ 815.196961][ T5630] RIP: 0033:0x7fe19dc6bf54 [ 815.196979][ T5630] Code: 85 62 0a 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 60 98 ee 00 48 69 8c 24 90 00 00 00 e8 03 00 00 <8b> 78 08 48 8b 44 24 18 48 c1 ea 12 4c 8b 0d 59 97 ee 00 48 01 d1 [ 815.197003][ T5630] RSP: 002b:00007fffbfcbcfe0 EFLAGS: 00010206 [ 815.197021][ T5630] RAX: 0000001b34624000 RBX: 00000000000013c9 RCX: 00000000000c7b50 [ 815.197036][ T5630] RDX: 000000000256e664 RSI: 00007fffbfcbd070 RDI: 00007fe19ece8010 [ 815.197051][ T5630] RBP: 00007fffbfcbd01c R08: 00084bef8c4ffafc R09: 0000000000000001 [ 815.197065][ T5630] R10: 00000000000269d2 R11: 0000000000000246 R12: 0000000000001388 [ 815.197084][ T5630] R13: 00000000000927c0 R14: 00000000000c7aff R15: 00007fffbfcbd070 [ 815.197114][ T5630] [ 815.529087][ T5630] memory: usage 3072kB, limit 3072kB, failcnt 81321 [ 815.537366][ T5630] memory+swap: usage 3280kB, limit 9007199254740988kB, failcnt 0 [ 815.545206][ T5630] kmem: usage 3072kB, limit 9007199254740988kB, failcnt 0 [ 815.552475][ T5630] Memory cgroup stats for /syz1: [ 815.552760][ T5630] cache 0 [ 815.560750][ T5630] rss 8192 [ 815.563787][ T5630] rss_huge 0 [ 815.568904][ T5630] shmem 0 [ 815.572004][ T5630] mapped_file 0 [ 815.575539][ T5630] dirty 0 [ 815.578531][ T5630] writeback 4096 [ 815.582165][ T5630] workingset_refault_anon 4970 [ 815.586938][ T5630] workingset_refault_file 30896 [ 815.591901][ T5630] swap 200704 [ 815.595217][ T5630] swapcached 291045376 [ 815.599341][ T5630] pgpgin 236676 [ 815.603136][ T5630] pgpgout 245361 [ 815.606790][ T5630] pgfault 319589 [ 815.610465][ T5630] pgmajfault 2322 [ 815.614113][ T5630] inactive_anon 4096 [ 815.618017][ T5630] active_anon 8192 [ 815.621805][ T5630] inactive_file 0 [ 815.625460][ T5630] active_file 0 [ 815.628980][ T5630] unevictable 0 [ 815.632516][ T5630] hierarchical_memory_limit 3145728 [ 815.637739][ T5630] hierarchical_memsw_limit 9223372036854771712 [ 815.643987][ T5630] total_cache 0 [ 815.647453][ T5630] total_rss 8192 [ 815.651052][ T5630] total_rss_huge 0 [ 815.654793][ T5630] total_shmem 0 [ 815.658271][ T5630] total_mapped_file 0 [ 815.662318][ T5630] total_dirty 0 [ 815.665783][ T5630] total_writeback 4096 [ 815.671767][ T5630] total_workingset_refault_anon 4970 [ 815.677099][ T5630] total_workingset_refault_file 30896 [ 815.682547][ T5630] total_swap 200704 [ 815.686378][ T5630] total_swapcached 291045376 [ 815.691009][ T5630] total_pgpgin 236676 [ 815.695167][ T5630] total_pgpgout 245361 [ 815.699339][ T5630] total_pgfault 319589 [ 815.703427][ T5630] total_pgmajfault 2322 [ 815.707599][ T5630] total_inactive_anon 4096 [ 815.713300][ T5630] total_active_anon 8192 [ 815.717621][ T5630] total_inactive_file 0 [ 815.721890][ T5630] total_active_file 0 [ 815.725939][ T5630] total_unevictable 0 [ 815.730035][ T5630] anon_cost 29 [ 815.733425][ T5630] file_cost 0 [ 815.736733][ T5630] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.10377,pid=27851,uid=0 [ 815.757368][ T5630] Memory cgroup out of memory: Killed process 27851 (syz.1.10377) total-vm:104360kB, anon-rss:1244kB, file-rss:22528kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 816.990331][T15898] Bluetooth: hci0: Malformed Event: 0x13 [ 817.864484][T27932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10414'. [ 818.328243][T27946] sctp: [Deprecated]: syz.2.10421 (pid 27946) Use of struct sctp_assoc_value in delayed_ack socket option. [ 818.328243][T27946] Use struct sctp_sack_info instead [ 818.840778][T27962] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10429'. [ 823.567053][T28086] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10485'. [ 825.593781][T28147] FAULT_INJECTION: forcing a failure. [ 825.593781][T28147] name failslab, interval 1, probability 0, space 0, times 0 [ 825.643703][T28147] CPU: 0 UID: 0 PID: 28147 Comm: syz.2.10511 Tainted: G U L syzkaller #0 PREEMPT(full) [ 825.643756][T28147] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 825.643766][T28147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 825.643781][T28147] Call Trace: [ 825.643789][T28147] [ 825.643797][T28147] dump_stack_lvl+0x100/0x190 [ 825.643829][T28147] should_fail_ex.cold+0x5/0xa [ 825.643857][T28147] should_failslab+0xc2/0x120 [ 825.643898][T28147] kmem_cache_alloc_noprof+0x91/0x6a0 [ 825.643929][T28147] ? trace_kmem_cache_alloc+0xdd/0x100 [ 825.643965][T28147] ? security_file_alloc+0x34/0x2c0 [ 825.644011][T28147] security_file_alloc+0x34/0x2c0 [ 825.644046][T28147] init_file+0x95/0x480 [ 825.644076][T28147] alloc_empty_file+0x79/0x1c0 [ 825.644115][T28147] alloc_file_pseudo+0x183/0x290 [ 825.644148][T28147] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 825.644178][T28147] ? alloc_fd+0x471/0x7a0 [ 825.644203][T28147] ? do_raw_spin_unlock+0x145/0x1e0 [ 825.644233][T28147] __anon_inode_getfile+0xe8/0x280 [ 825.644331][T28147] anon_inode_getfile_fmode+0x37/0xa0 [ 825.644375][T28147] do_eventfd+0x159/0x2b0 [ 825.644435][T28147] __x64_sys_eventfd+0x32/0x50 [ 825.644473][T28147] do_syscall_64+0x115/0x840 [ 825.644507][T28147] ? clear_bhb_loop+0x40/0x90 [ 825.644536][T28147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.644560][T28147] RIP: 0033:0x7f14f219e019 [ 825.644580][T28147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 825.644604][T28147] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 000000000000011c [ 825.644627][T28147] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 825.644643][T28147] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 825.644657][T28147] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 825.644671][T28147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 825.644685][T28147] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 825.644715][T28147] [ 828.746197][T28235] FAULT_INJECTION: forcing a failure. [ 828.746197][T28235] name failslab, interval 1, probability 0, space 0, times 0 [ 828.810233][T28235] CPU: 0 UID: 0 PID: 28235 Comm: syz.1.10549 Tainted: G U L syzkaller #0 PREEMPT(full) [ 828.810278][T28235] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 828.810287][T28235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 828.810302][T28235] Call Trace: [ 828.810310][T28235] [ 828.810319][T28235] dump_stack_lvl+0x100/0x190 [ 828.810351][T28235] should_fail_ex.cold+0x5/0xa [ 828.810379][T28235] should_failslab+0xc2/0x120 [ 828.810420][T28235] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 828.810455][T28235] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 828.810583][T28235] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 828.810611][T28235] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 828.810641][T28235] alloc_inode+0x68/0x250 [ 828.810674][T28235] new_inode+0x22/0x1c0 [ 828.810708][T28235] hugetlbfs_get_inode+0x39a/0x700 [ 828.810742][T28235] hugetlb_file_setup+0x15b/0x5b0 [ 828.810775][T28235] ksys_mmap_pgoff+0x242/0x610 [ 828.810812][T28235] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 828.810846][T28235] ? xfd_validate_state+0x129/0x190 [ 828.810881][T28235] __x64_sys_mmap+0x125/0x190 [ 828.810913][T28235] do_syscall_64+0x115/0x840 [ 828.810945][T28235] ? clear_bhb_loop+0x40/0x90 [ 828.810992][T28235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.811022][T28235] RIP: 0033:0x7fe19dd9e019 [ 828.811042][T28235] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.811066][T28235] RSP: 002b:00007fe19ece7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 828.811089][T28235] RAX: ffffffffffffffda RBX: 00007fe19e025fa0 RCX: 00007fe19dd9e019 [ 828.811105][T28235] RDX: 00000000003ffffe RSI: 0000000000a00006 RDI: 0000000000000000 [ 828.811120][T28235] RBP: 00007fe19de3500c R08: 0000000000000602 R09: 0000300000000000 [ 828.811135][T28235] R10: 0000000000040eb1 R11: 0000000000000246 R12: 0000000000000000 [ 828.811150][T28235] R13: 00007fe19e026038 R14: 00007fe19e025fa0 R15: 00007fffbfcbcc78 [ 828.811180][T28235] [ 829.430859][T28254] sock: sock_timestamping_bind_phc: sock not bind to device [ 831.039156][T28306] netlink: 186 bytes leftover after parsing attributes in process `syz.1.10581'. [ 831.343947][T28315] syz_tun: left allmulticast mode [ 831.376553][T28315] syz_tun: left promiscuous mode [ 831.421585][T28315] bridge0: port 3(syz_tun) entered disabled state [ 832.097810][T28336] smc: net device dummy0 applied user defined pnetid DUMMY0 [ 834.307802][T28393] hub 1-0:1.0: USB hub found [ 834.357663][T28393] hub 1-0:1.0: 1 port detected [ 836.342858][T28441] bridge0: port 4(dummy0) entered blocking state [ 836.384665][T28441] bridge0: port 4(dummy0) entered disabled state [ 836.411926][T28441] dummy0: entered allmulticast mode [ 836.452772][T28441] dummy0: entered promiscuous mode [ 836.469875][T28441] bridge0: port 4(dummy0) entered blocking state [ 836.476450][T28441] bridge0: port 4(dummy0) entered forwarding state [ 838.960921][T15898] Bluetooth: hci3: Malformed HCI Event [ 839.667676][T28517] zswap: compressor not available [ 841.943362][T28570] netlink: 13 bytes leftover after parsing attributes in process `syz.1.10696'. [ 843.307777][T28599] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10717'. [ 844.130514][T28619] netlink: 350 bytes leftover after parsing attributes in process `syz.4.10719'. [ 844.196812][T28621] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 844.205731][T28621] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 846.569419][T28677] random: crng reseeded on system resumption [ 847.268861][T28690] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10753'. [ 848.244163][T28713] netlink: Unknown conntrack attr (0) [ 853.677694][T28840] netlink: 'syz.0.10827': attribute type 1 has an invalid length. [ 856.842489][T28923] syz_tun: tun_chr_ioctl cmd 2147767506 [ 859.843361][T29006] netlink: 2468 bytes leftover after parsing attributes in process `syz.0.10896'. [ 862.419565][T29078] program syz.2.10928 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 864.354686][T29126] IPVS: length: 537396514 != 24 [ 864.771317][T29065] syz.1.10922 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 864.867573][T29143] sctp: [Deprecated]: syz.2.10953 (pid 29143) Use of struct sctp_assoc_value in delayed_ack socket option. [ 864.867573][T29143] Use struct sctp_sack_info instead [ 864.943719][T29135] zswap: compressor not available [ 864.965149][T29065] CPU: 0 UID: 0 PID: 29065 Comm: syz.1.10922 Tainted: G U L syzkaller #0 PREEMPT(full) [ 864.965189][T29065] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 864.965197][T29065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 864.965212][T29065] Call Trace: [ 864.965219][T29065] [ 864.965228][T29065] dump_stack_lvl+0x100/0x190 [ 864.965262][T29065] dump_header+0xfb/0x606 [ 864.965290][T29065] oom_kill_process.cold+0xd/0x330 [ 864.965318][T29065] out_of_memory+0x340/0x14f0 [ 864.965363][T29065] ? __pfx_out_of_memory+0x10/0x10 [ 864.965410][T29065] mem_cgroup_out_of_memory+0xc6/0x130 [ 864.965444][T29065] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 864.965475][T29065] ? find_held_lock+0x2b/0x80 [ 864.965517][T29065] ? do_raw_spin_unlock+0x145/0x1e0 [ 864.965549][T29065] ? _raw_spin_unlock+0x28/0x50 [ 864.965579][T29065] try_charge_memcg+0x6e5/0xdf0 [ 864.965625][T29065] ? __pfx_try_charge_memcg+0x10/0x10 [ 864.965658][T29065] ? find_held_lock+0x2b/0x80 [ 864.965686][T29065] ? rcu_read_unlock+0x17/0x60 [ 864.965722][T29065] ? rcu_read_unlock+0x17/0x60 [ 864.965757][T29065] ? find_held_lock+0x2b/0x80 [ 864.965786][T29065] ? rcu_read_unlock+0x17/0x60 [ 864.965828][T29065] charge_memcg+0x187/0x1e0 [ 864.965864][T29065] mem_cgroup_swapin_charge_folio+0xc1/0x450 [ 864.965895][T29065] swap_cache_alloc_folio+0x548/0xc50 [ 864.965929][T29065] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 864.965956][T29065] ? swap_cache_get_folio+0x28d/0x360 [ 864.965982][T29065] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 864.966006][T29065] ? hrtimer_start_range_ns_common+0x78e/0x18b0 [ 864.966046][T29065] swap_cache_read_folio+0x47/0x140 [ 864.966077][T29065] swap_cluster_readahead+0x479/0x5f0 [ 864.966113][T29065] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 864.966155][T29065] ? __lock_acquire+0x49f/0x1a40 [ 864.966191][T29065] ? get_vma_policy+0x23d/0x3b0 [ 864.966230][T29065] swapin_readahead+0x159/0x1200 [ 864.966266][T29065] ? __pfx_swapin_readahead+0x10/0x10 [ 864.966303][T29065] ? swap_table_get+0x10d/0x2c0 [ 864.966328][T29065] ? swap_cache_get_folio+0x28d/0x360 [ 864.966354][T29065] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 864.966380][T29065] ? __pfx_softleaf_type+0x10/0x10 [ 864.966411][T29065] ? do_swap_page+0xf98/0x5780 [ 864.966432][T29065] do_swap_page+0xf98/0x5780 [ 864.966468][T29065] ? __pfx_do_swap_page+0x10/0x10 [ 864.966491][T29065] ? __lock_acquire+0x49f/0x1a40 [ 864.966532][T29065] ? rcu_is_watching+0x12/0xc0 [ 864.966560][T29065] ? __pte_offset_map+0x179/0x310 [ 864.966599][T29065] __handle_mm_fault+0x192f/0x2a00 [ 864.966628][T29065] ? reacquire_held_locks+0xce/0x1e0 [ 864.966667][T29065] ? __pfx___handle_mm_fault+0x10/0x10 [ 864.966695][T29065] ? lock_vma_under_rcu+0x17c/0x590 [ 864.966735][T29065] handle_mm_fault+0x37b/0xa30 [ 864.966764][T29065] do_user_addr_fault+0x5a3/0x12f0 [ 864.966805][T29065] exc_page_fault+0x6f/0xd0 [ 864.966836][T29065] asm_exc_page_fault+0x26/0x30 [ 864.966859][T29065] RIP: 0033:0x7fe19dc5ba56 [ 864.966879][T29065] Code: 0a ff ff 4c 8b 67 38 48 89 fb 4c 39 e2 0f 82 ca 0a ff ff 29 d0 48 39 f0 72 22 8b 43 18 39 43 30 0f 83 98 0a ff ff 48 83 c4 18 <5b> 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 80 00 00 00 00 4c 8b 6f 28 [ 864.966902][T29065] RSP: 002b:00007fffbfcbcce8 EFLAGS: 00010206 [ 864.966920][T29065] RAX: 000000007fffffff RBX: 00007fe19eb55720 RCX: 0000000000000000 [ 864.966935][T29065] RDX: 0000001b34624228 RSI: 0000000000000003 RDI: 00007fe19eb55720 [ 864.966950][T29065] RBP: 00007fe19eb55720 R08: 00007fe19e010000 R09: 00007fe19e026038 [ 864.966965][T29065] R10: 0000000000000007 R11: 0000000000000004 R12: 0000001b34624218 [ 864.966979][T29065] R13: 000000000003774c R14: 0000000000041c0c R15: 0000000000000003 [ 864.967008][T29065] [ 865.383044][T29065] memory: usage 3072kB, limit 3072kB, failcnt 105488 [ 865.390620][T29065] memory+swap: usage 70040kB, limit 9007199254740988kB, failcnt 0 [ 865.398505][T29065] kmem: usage 3072kB, limit 9007199254740988kB, failcnt 0 [ 865.405695][T29065] Memory cgroup stats for /syz1: [ 865.405847][T29065] cache 0 [ 865.413763][T29065] rss 0 [ 865.416558][T29065] rss_huge 0 [ 865.419773][T29065] shmem 0 [ 865.422745][T29065] mapped_file 0 [ 865.426209][T29065] dirty 0 [ 865.429146][T29065] writeback 0 [ 865.432497][T29065] workingset_refault_anon 8129 [ 865.437265][T29065] workingset_refault_file 42669 [ 865.442162][T29065] swap 68571136 [ 865.445627][T29065] swapcached 383897600 [ 865.449717][T29065] pgpgin 275407 [ 865.453258][T29065] pgpgout 284136 [ 865.456809][T29065] pgfault 339770 [ 865.460396][T29065] pgmajfault 3290 [ 865.464054][T29065] inactive_anon 4096 [ 865.467950][T29065] active_anon 0 [ 865.471443][T29065] inactive_file 0 [ 865.475082][T29065] active_file 0 [ 865.478562][T29065] unevictable 0 [ 865.483947][T29065] hierarchical_memory_limit 3145728 [ 865.489163][T29065] hierarchical_memsw_limit 9223372036854771712 [ 865.495399][T29065] total_cache 0 [ 865.498907][T29065] total_rss 0 [ 865.502328][T29065] total_rss_huge 0 [ 865.506075][T29065] total_shmem 0 [ 865.509551][T29065] total_mapped_file 0 [ 865.513651][T29065] total_dirty 0 [ 865.517168][T29065] total_writeback 0 [ 865.521037][T29065] total_workingset_refault_anon 8129 [ 865.526364][T29065] total_workingset_refault_file 42669 [ 865.532104][T29065] total_swap 68571136 [ 865.536130][T29065] total_swapcached 383897600 [ 865.540847][T29065] total_pgpgin 275407 [ 865.544840][T29065] total_pgpgout 284136 [ 865.548969][T29065] total_pgfault 339770 [ 865.553127][T29065] total_pgmajfault 3290 [ 865.557292][T29065] total_inactive_anon 4096 [ 865.561766][T29065] total_active_anon 0 [ 865.565777][T29065] total_inactive_file 0 [ 865.570013][T29065] total_active_file 0 [ 865.574005][T29065] total_unevictable 0 [ 865.577989][T29065] anon_cost 22 [ 865.581432][T29065] file_cost 0 [ 865.586724][T29065] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.10616,pid=28409,uid=0 [ 865.605102][T29065] Memory cgroup out of memory: Killed process 28409 (syz.1.10616) total-vm:106484kB, anon-rss:1244kB, file-rss:54096kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 865.712150][ T5630] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 865.741939][ T5630] CPU: 0 UID: 0 PID: 5630 Comm: syz-executor Tainted: G U L syzkaller #0 PREEMPT(full) [ 865.741981][ T5630] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 865.741990][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 865.742003][ T5630] Call Trace: [ 865.742014][ T5630] [ 865.742024][ T5630] dump_stack_lvl+0x100/0x190 [ 865.742055][ T5630] dump_header+0xfb/0x606 [ 865.742082][ T5630] oom_kill_process.cold+0xd/0x330 [ 865.742110][ T5630] out_of_memory+0x340/0x14f0 [ 865.742154][ T5630] ? __pfx_out_of_memory+0x10/0x10 [ 865.742200][ T5630] mem_cgroup_out_of_memory+0xc6/0x130 [ 865.742229][ T5630] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 865.742255][ T5630] ? find_held_lock+0x2b/0x80 [ 865.742290][ T5630] ? do_raw_spin_unlock+0x145/0x1e0 [ 865.742317][ T5630] ? _raw_spin_unlock+0x28/0x50 [ 865.742354][ T5630] try_charge_memcg+0x6e5/0xdf0 [ 865.742396][ T5630] ? __pfx_try_charge_memcg+0x10/0x10 [ 865.742430][ T5630] ? find_held_lock+0x2b/0x80 [ 865.742457][ T5630] ? rcu_read_unlock+0x17/0x60 [ 865.742493][ T5630] ? rcu_read_unlock+0x17/0x60 [ 865.742538][ T5630] ? find_held_lock+0x2b/0x80 [ 865.742567][ T5630] ? rcu_read_unlock+0x17/0x60 [ 865.742608][ T5630] charge_memcg+0x187/0x1e0 [ 865.742644][ T5630] mem_cgroup_swapin_charge_folio+0xc1/0x450 [ 865.742671][ T5630] swap_cache_alloc_folio+0x548/0xc50 [ 865.742704][ T5630] ? __pfx_swap_cache_alloc_folio+0x10/0x10 [ 865.742732][ T5630] ? swap_cache_get_folio+0x28d/0x360 [ 865.742758][ T5630] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 865.742792][ T5630] swap_cache_read_folio+0x47/0x140 [ 865.742822][ T5630] swap_cluster_readahead+0x479/0x5f0 [ 865.742856][ T5630] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 865.742884][ T5630] ? __schedule+0x126e/0x6730 [ 865.742921][ T5630] ? __lock_acquire+0x49f/0x1a40 [ 865.742957][ T5630] ? get_vma_policy+0x23d/0x3b0 [ 865.742996][ T5630] swapin_readahead+0x159/0x1200 [ 865.743031][ T5630] ? __pfx_swapin_readahead+0x10/0x10 [ 865.743065][ T5630] ? swap_table_get+0x10d/0x2c0 [ 865.743089][ T5630] ? swap_cache_get_folio+0x28d/0x360 [ 865.743116][ T5630] ? __pfx_swap_cache_get_folio+0x10/0x10 [ 865.743141][ T5630] ? __pfx_softleaf_type+0x10/0x10 [ 865.743172][ T5630] ? do_swap_page+0xf98/0x5780 [ 865.743193][ T5630] do_swap_page+0xf98/0x5780 [ 865.743229][ T5630] ? __pfx_do_swap_page+0x10/0x10 [ 865.743253][ T5630] ? __lock_acquire+0x49f/0x1a40 [ 865.743289][ T5630] ? lockdep_hardirqs_on+0x78/0x100 [ 865.743321][ T5630] ? rcu_is_watching+0x12/0xc0 [ 865.743349][ T5630] ? __pte_offset_map+0x179/0x310 [ 865.743384][ T5630] __handle_mm_fault+0x192f/0x2a00 [ 865.743413][ T5630] ? reacquire_held_locks+0xce/0x1e0 [ 865.743452][ T5630] ? __pfx___handle_mm_fault+0x10/0x10 [ 865.743480][ T5630] ? lock_vma_under_rcu+0x17c/0x590 [ 865.743524][ T5630] handle_mm_fault+0x37b/0xa30 [ 865.743553][ T5630] do_user_addr_fault+0x5a3/0x12f0 [ 865.743595][ T5630] exc_page_fault+0x6f/0xd0 [ 865.743625][ T5630] asm_exc_page_fault+0x26/0x30 [ 865.743648][ T5630] RIP: 0033:0x7fe19dd5e84e [ 865.743668][ T5630] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 865.743691][ T5630] RSP: 002b:00007fffbfcbcf58 EFLAGS: 00010246 [ 865.743710][ T5630] RAX: 0000000000000000 RBX: 000055559043e500 RCX: 00007fe19dd5e84e [ 865.743724][ T5630] RDX: 00007fffbfcbcfb0 RSI: 0000000000000000 RDI: 0000000000000000 [ 865.743738][ T5630] RBP: 00007fffbfcbd01c R08: 0000000000000000 R09: 0000000000000000 [ 865.743752][ T5630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 865.743765][ T5630] R13: 00000000000927c0 R14: 00000000000d3b7e R15: 00007fffbfcbd070 [ 865.743795][ T5630] [ 865.743803][ T5630] memory: usage 3072kB, limit 3072kB, failcnt 105505 [ 866.649808][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 866.656390][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 866.838440][ T5630] memory+swap: usage 7124kB, limit 9007199254740988kB, failcnt 0 [ 866.925634][ T5630] kmem: usage 2636kB, limit 9007199254740988kB, failcnt 0 [ 866.957073][ T5630] Memory cgroup stats for /syz1: [ 866.957363][ T5630] cache 258048 [ 866.987912][ T5630] rss 0 [ 867.013078][ T5630] rss_huge 0 [ 867.031187][ T5630] shmem 0 [ 867.045584][ T5630] mapped_file 4096 [ 867.065318][ T5630] dirty 4096 [ 867.079651][ T5630] writeback 0 [ 867.095828][ T5630] workingset_refault_anon 8132 [ 867.120200][ T5630] workingset_refault_file 42778 [ 867.146376][ T5630] swap 4419584 [ 867.162568][ T5630] swapcached 383909888 [ 867.188013][ T5630] pgpgin 275519 [ 867.221356][ T5630] pgpgout 284185 [ 867.241356][ T5630] pgfault 339775 [ 867.256649][ T5630] pgmajfault 3294 [ 867.277004][ T5630] inactive_anon 0 [ 867.294387][ T5630] active_anon 0 [ 867.310992][ T5630] inactive_file 258048 [ 867.338003][ T5630] active_file 0 [ 867.365486][ T5630] unevictable 0 [ 867.385232][ T5630] hierarchical_memory_limit 3145728 [ 867.408393][ T5630] hierarchical_memsw_limit 9223372036854771712 [ 867.442715][ T5630] total_cache 258048 [ 867.459371][ T5630] total_rss 0 [ 867.475652][ T5630] total_rss_huge 0 [ 867.507764][ T5630] total_shmem 0 [ 867.542460][ T5630] total_mapped_file 4096 [ 867.585665][ T5630] total_dirty 4096 [ 867.632997][ T5630] total_writeback 0 [ 867.641751][T29183] netlink: 5316 bytes leftover after parsing attributes in process `syz.4.10969'. [ 867.672535][ T5630] total_workingset_refault_anon 8132 [ 867.718762][ T5630] total_workingset_refault_file 42778 [ 867.779750][ T5630] total_swap 4419584 [ 867.827173][ T5630] total_swapcached 383909888 [ 867.864388][ T5630] total_pgpgin 275519 [ 867.883274][ T5630] total_pgpgout 284185 [ 867.920657][ T5630] total_pgfault 339775 [ 867.958736][ T5630] total_pgmajfault 3294 [ 868.008459][ T5630] total_inactive_anon 0 [ 868.055119][ T5630] total_active_anon 0 [ 868.072794][ T5630] total_inactive_file 258048 [ 868.099490][ T5630] total_active_file 0 [ 868.117889][ T5630] total_unevictable 0 [ 868.134432][ T5630] anon_cost 0 [ 868.151480][ T5630] file_cost 21 [ 868.170888][ T5630] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.10922,pid=29065,uid=0 [ 868.297953][ T5630] Memory cgroup out of memory: OOM victim 29065 (syz.1.10922) is already exiting. Skip killing the task [ 868.585733][T29204] NFSD: Failed to start, no listeners configured. [ 868.884560][T29214] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10984'. [ 869.572890][T29231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10991'. [ 872.020355][T29299] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11021'. [ 872.439534][T29315] netlink: 'syz.4.11026': attribute type 2 has an invalid length. [ 874.121674][T29351] FAULT_INJECTION: forcing a failure. [ 874.121674][T29351] name fail_futex, interval 1, probability 0, space 0, times 1 [ 874.170503][T29351] CPU: 0 UID: 0 PID: 29351 Comm: syz.2.11044 Tainted: G U L syzkaller #0 PREEMPT(full) [ 874.170545][T29351] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 874.170554][T29351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 874.170569][T29351] Call Trace: [ 874.170577][T29351] [ 874.170586][T29351] dump_stack_lvl+0x100/0x190 [ 874.170619][T29351] should_fail_ex.cold+0x5/0xa [ 874.170647][T29351] get_futex_key+0x1d2/0x14f0 [ 874.170676][T29351] ? __pfx_get_futex_key+0x10/0x10 [ 874.170710][T29351] futex_wake+0xf4/0x5e0 [ 874.170745][T29351] ? __pfx_futex_wake+0x10/0x10 [ 874.170782][T29351] ? __lock_acquire+0x49f/0x1a40 [ 874.170827][T29351] do_futex+0x2b2/0x440 [ 874.170854][T29351] ? __pfx_do_futex+0x10/0x10 [ 874.170879][T29351] ? __pfx__setid_policy_lookup+0x10/0x10 [ 874.170992][T29351] ? find_held_lock+0x2b/0x80 [ 874.171022][T29351] ? setid_policy_lookup+0x10c/0x350 [ 874.171096][T29351] __x64_sys_futex+0x34f/0x4d0 [ 874.171128][T29351] ? __pfx___x64_sys_futex+0x10/0x10 [ 874.171167][T29351] do_syscall_64+0x115/0x840 [ 874.171201][T29351] ? clear_bhb_loop+0x40/0x90 [ 874.171231][T29351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.171256][T29351] RIP: 0033:0x7f14f219e019 [ 874.171276][T29351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 874.171300][T29351] RSP: 002b:00007f14f30230e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 874.171323][T29351] RAX: ffffffffffffffda RBX: 00007f14f2425fa8 RCX: 00007f14f219e019 [ 874.171339][T29351] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f14f2425fac [ 874.171354][T29351] RBP: 00007f14f2425fa0 R08: 0000000000000001 R09: 0000000000000000 [ 874.171369][T29351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 874.171386][T29351] R13: 00007f14f2426038 R14: 00007ffcba133e80 R15: 00007ffcba133f68 [ 874.171417][T29351] [ 876.058064][T29409] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[22055] was attempted by ""[29409] [ 881.343388][T29539] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 881.379926][T29539] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 881.400881][T29539] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 881.411533][T29543] block nbd1: Unsupported socket: should be TCP or UNIX. [ 881.423721][T29539] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 881.522276][T29539] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 881.551209][T29539] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 882.111534][T29562] FAULT_INJECTION: forcing a failure. [ 882.111534][T29562] name failslab, interval 1, probability 0, space 0, times 0 [ 882.174015][T29562] CPU: 0 UID: 0 PID: 29562 Comm: syz.4.11133 Tainted: G U L syzkaller #0 PREEMPT(full) [ 882.174057][T29562] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 882.174066][T29562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 882.174080][T29562] Call Trace: [ 882.174088][T29562] [ 882.174096][T29562] dump_stack_lvl+0x100/0x190 [ 882.174128][T29562] should_fail_ex.cold+0x5/0xa [ 882.174156][T29562] should_failslab+0xc2/0x120 [ 882.174191][T29562] kmem_cache_alloc_noprof+0x91/0x6a0 [ 882.174224][T29562] ? sk_prot_alloc+0x60/0x2a0 [ 882.174254][T29562] sk_prot_alloc+0x60/0x2a0 [ 882.174281][T29562] sk_alloc+0x36/0xe80 [ 882.174315][T29562] kcm_create+0xfc/0x6a0 [ 882.174434][T29562] __sock_create+0x339/0x860 [ 882.174465][T29562] __sys_socket+0x14d/0x260 [ 882.174494][T29562] ? __pfx___sys_socket+0x10/0x10 [ 882.174530][T29562] __x64_sys_socket+0x72/0xb0 [ 882.174557][T29562] ? lockdep_hardirqs_on+0x78/0x100 [ 882.174595][T29562] do_syscall_64+0x115/0x840 [ 882.174629][T29562] ? clear_bhb_loop+0x40/0x90 [ 882.174660][T29562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.174686][T29562] RIP: 0033:0x7f532259e019 [ 882.174705][T29562] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 882.174730][T29562] RSP: 002b:00007f5323494028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 882.174753][T29562] RAX: ffffffffffffffda RBX: 00007f5322825fa0 RCX: 00007f532259e019 [ 882.174769][T29562] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000029 [ 882.174784][T29562] RBP: 00007f532263500c R08: 0000000000000000 R09: 0000000000000000 [ 882.174798][T29562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 882.174812][T29562] R13: 00007f5322826038 R14: 00007f5322825fa0 R15: 00007fff52acba18 [ 882.174843][T29562] [ 882.945895][T29576] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 882.954711][T29576] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 882.962801][T29576] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 882.981689][T29576] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 885.028851][ T9801] Bluetooth: hci2: command 0x0406 tx timeout [ 885.035241][ T9801] Bluetooth: hci1: command 0x0406 tx timeout [ 885.045784][ T9801] Bluetooth: hci3: command 0x0c1a tx timeout [ 885.052570][ T9801] Bluetooth: hci0: command 0x0c1a tx timeout [ 885.917424][T29624] netlink: 338 bytes leftover after parsing attributes in process `syz.1.11159'. [ 886.816774][T29646] FAULT_INJECTION: forcing a failure. [ 886.816774][T29646] name failslab, interval 1, probability 0, space 0, times 0 [ 886.889330][T29646] CPU: 0 UID: 0 PID: 29646 Comm: syz.1.11171 Tainted: G U L syzkaller #0 PREEMPT(full) [ 886.889372][T29646] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 886.889381][T29646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 886.889396][T29646] Call Trace: [ 886.889403][T29646] [ 886.889413][T29646] dump_stack_lvl+0x100/0x190 [ 886.889444][T29646] should_fail_ex.cold+0x5/0xa [ 886.889472][T29646] should_failslab+0xc2/0x120 [ 886.889507][T29646] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 886.889538][T29646] ? lockdep_hardirqs_on+0x78/0x100 [ 886.889571][T29646] ? sock_alloc_inode+0x26/0x2c0 [ 886.889602][T29646] ? __pfx_sock_alloc_inode+0x10/0x10 [ 886.889627][T29646] sock_alloc_inode+0x26/0x2c0 [ 886.889649][T29646] ? __pfx_sock_alloc_inode+0x10/0x10 [ 886.889671][T29646] alloc_inode+0x68/0x250 [ 886.889704][T29646] sock_alloc+0x44/0x280 [ 886.889739][T29646] ? security_socket_create+0x7f/0x250 [ 886.889770][T29646] __sock_create+0xc2/0x860 [ 886.889800][T29646] smc_create_clcsk+0x37/0xd0 [ 886.889832][T29646] ? __pfx_smc_inet_init_sock+0x10/0x10 [ 886.889955][T29646] inet6_create+0xb1a/0x12b0 [ 886.889992][T29646] ? inet6_create+0x7f/0x12b0 [ 886.890022][T29646] __sock_create+0x339/0x860 [ 886.890059][T29646] __sys_socket+0x14d/0x260 [ 886.890088][T29646] ? __pfx___sys_socket+0x10/0x10 [ 886.890124][T29646] __x64_sys_socket+0x72/0xb0 [ 886.890151][T29646] ? lockdep_hardirqs_on+0x78/0x100 [ 886.890183][T29646] do_syscall_64+0x115/0x840 [ 886.890214][T29646] ? clear_bhb_loop+0x40/0x90 [ 886.890244][T29646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 886.890268][T29646] RIP: 0033:0x7fe19dd9e019 [ 886.890288][T29646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 886.890312][T29646] RSP: 002b:00007fe19ece7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 886.890335][T29646] RAX: ffffffffffffffda RBX: 00007fe19e025fa0 RCX: 00007fe19dd9e019 [ 886.890354][T29646] RDX: 0000000000000100 RSI: 0000000000000001 RDI: 000000000000000a [ 886.890369][T29646] RBP: 00007fe19de3500c R08: 0000000000000000 R09: 0000000000000000 [ 886.890384][T29646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 886.890398][T29646] R13: 00007fe19e026038 R14: 00007fe19e025fa0 R15: 00007fffbfcbcc78 [ 886.890428][T29646] [ 886.890452][T29646] socket: no more sockets [ 887.226340][T29606] Bluetooth: hci1: command 0x0406 tx timeout [ 887.233244][T29606] Bluetooth: hci2: command 0x0406 tx timeout [ 887.355638][T29652] vmstat_refresh: nr_hugetlb -6144 [ 894.140361][T29796] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 895.445849][T29828] FAULT_INJECTION: forcing a failure. [ 895.445849][T29828] name failslab, interval 1, probability 0, space 0, times 0 [ 895.509180][T29828] CPU: 0 UID: 0 PID: 29828 Comm: syz.2.11246 Tainted: G U L syzkaller #0 PREEMPT(full) [ 895.509224][T29828] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 895.509233][T29828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 895.509248][T29828] Call Trace: [ 895.509256][T29828] [ 895.509265][T29828] dump_stack_lvl+0x100/0x190 [ 895.509298][T29828] should_fail_ex.cold+0x5/0xa [ 895.509325][T29828] should_failslab+0xc2/0x120 [ 895.509360][T29828] __kmalloc_cache_noprof+0x91/0x6c0 [ 895.509385][T29828] ? find_held_lock+0x2b/0x80 [ 895.509416][T29828] ? rcu_read_unlock+0x17/0x60 [ 895.509454][T29828] ? alloc_mnt_ns+0xce/0x520 [ 895.509563][T29828] alloc_mnt_ns+0xce/0x520 [ 895.509601][T29828] copy_mnt_ns+0x308/0x1180 [ 895.509640][T29828] ? rcu_is_watching+0x12/0xc0 [ 895.509671][T29828] ? __pfx_copy_mnt_ns+0x10/0x10 [ 895.509702][T29828] ? kmem_cache_alloc_noprof+0x2d7/0x6a0 [ 895.509733][T29828] ? create_new_namespaces+0x30/0xac0 [ 895.509765][T29828] create_new_namespaces+0xd3/0xac0 [ 895.509791][T29828] ? bpf_lsm_capable+0x9/0x10 [ 895.509818][T29828] ? security_capable+0x80/0x260 [ 895.509848][T29828] unshare_nsproxy_namespaces+0xf2/0x220 [ 895.509880][T29828] ksys_unshare+0x438/0xab0 [ 895.509914][T29828] ? __pfx_ksys_unshare+0x10/0x10 [ 895.509956][T29828] __x64_sys_unshare+0x31/0x40 [ 895.509988][T29828] do_syscall_64+0x115/0x840 [ 895.510020][T29828] ? clear_bhb_loop+0x40/0x90 [ 895.510050][T29828] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.510075][T29828] RIP: 0033:0x7f14f219e019 [ 895.510095][T29828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 895.510119][T29828] RSP: 002b:00007f14f3023028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 895.510142][T29828] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219e019 [ 895.510159][T29828] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008100000 [ 895.510174][T29828] RBP: 00007f14f223500c R08: 0000000000000000 R09: 0000000000000000 [ 895.510188][T29828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 895.510203][T29828] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 895.510233][T29828] [ 896.804134][T29856] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11257'. [ 897.621792][T29871] FAULT_INJECTION: forcing a failure. [ 897.621792][T29871] name failslab, interval 1, probability 0, space 0, times 0 [ 897.671117][ T29] audit: type=1804 audit(4295033032.656:49): pid=29873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.11261" name="/newroot/2612/file0" dev="tmpfs" ino=13145 res=1 errno=0 [ 897.706876][T29871] CPU: 0 UID: 0 PID: 29871 Comm: syz.2.11262 Tainted: G U L syzkaller #0 PREEMPT(full) [ 897.706917][T29871] Tainted: [U]=USER, [L]=SOFTLOCKUP [ 897.706927][T29871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 897.706942][T29871] Call Trace: [ 897.706949][T29871] [ 897.706958][T29871] dump_stack_lvl+0x100/0x190 [ 897.706990][T29871] should_fail_ex.cold+0x5/0xa [ 897.707018][T29871] should_failslab+0xc2/0x120 [ 897.707053][T29871] kmem_cache_alloc_lru_noprof+0x8d/0x6a0 [ 897.707086][T29871] ? __d_alloc+0x35/0xa50 [ 897.707118][T29871] __d_alloc+0x35/0xa50 [ 897.707155][T29871] d_alloc_pseudo+0x1c/0xc0 [ 897.707189][T29871] alloc_file_pseudo+0x118/0x290 [ 897.707223][T29871] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 897.707256][T29871] ? alloc_fd+0x471/0x7a0 [ 897.707284][T29871] sock_alloc_file+0x50/0x210 [ 897.707322][T29871] __sys_socket+0x1c0/0x260 [ 897.707348][T29871] ? exc_page_fault+0x6f/0xd0 [ 897.707379][T29871] ? __pfx___sys_socket+0x10/0x10 [ 897.707421][T29871] __x64_sys_socket+0x72/0xb0 [ 897.707447][T29871] ? lockdep_hardirqs_on+0x78/0x100 [ 897.707478][T29871] do_syscall_64+0x115/0x840 [ 897.707513][T29871] ? clear_bhb_loop+0x40/0x90 [ 897.707542][T29871] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.707567][T29871] RIP: 0033:0x7f14f219f887 [ 897.707586][T29871] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 897.707610][T29871] RSP: 002b:00007f14f3021f98 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 897.707634][T29871] RAX: ffffffffffffffda RBX: 00007f14f2425fa0 RCX: 00007f14f219f887 [ 897.707650][T29871] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 897.707664][T29871] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 897.707678][T29871] R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000 [ 897.707693][T29871] R13: 00007f14f2426038 R14: 00007f14f2425fa0 R15: 00007ffcba133f68 [ 897.707723][T29871] [ 898.300306][T29878] netlink: 82 bytes leftover after parsing attributes in process `syz.1.11264'. [ 904.750130][T30044] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11337'. [ 904.796868][T30044] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11337'. [ 904.972170][T30048] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11339'. [ 905.743940][T30074] overlayfs: missing 'lowerdir' [ 906.087796][T30084] bridge0: port 5(batadv0) entered blocking state [ 906.121271][T30084] bridge0: port 5(batadv0) entered disabled state [ 906.153590][T30084] batadv0: entered allmulticast mode [ 906.189629][T30084] batadv0: entered promiscuous mode [ 906.219383][T30084] bridge0: port 5(batadv0) entered blocking state [ 906.226008][T30084] bridge0: port 5(batadv0) entered forwarding state [ 906.308737][ T9803] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 906.318438][ T9803] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 907.111053][T30111] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11369'. [ 907.211343][ T29] audit: type=1804 audit(4295033042.256:50): pid=30110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.11367" name="/newroot/907/file0" dev="tmpfs" ino=4600 res=1 errno=0 [ 908.821627][T30152] bridge0: port 6(veth0_to_bridge) entered blocking state [ 908.847519][T30152] bridge0: port 6(veth0_to_bridge) entered disabled state [ 908.889272][T30152] veth0_to_bridge: entered allmulticast mode [ 908.936137][T30152] veth0_to_bridge: entered promiscuous mode [ 908.956497][T30152] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 909.002512][T30152] bridge0: port 6(veth0_to_bridge) entered blocking state [ 909.009889][T30152] bridge0: port 6(veth0_to_bridge) entered forwarding state [ 909.980858][ T29] audit: type=1804 audit(4295033045.040:51): pid=30185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.11402" name="file0" dev="tmpfs" ino=14856 res=1 errno=0 [ 927.957295][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1001.048894][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 1014.359357][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.372219][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.385711][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.398449][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.412222][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.425027][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.438549][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.451247][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.464626][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1014.477400][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1016.434814][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1016.441837][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5637/1:b..l [ 1016.450580][ C0] rcu: (detected by 0, t=10502 jiffies, g=303045, q=416 ncpus=1) [ 1016.458404][ C0] task:syz-executor state:R running task stack:23048 pid:5637 tgid:5637 ppid:5625 task_flags:0x400140 flags:0x00080000 [ 1016.473522][ C0] Call Trace: [ 1016.476824][ C0] [ 1016.479770][ C0] __schedule+0x125c/0x6730 [ 1016.484334][ C0] ? __pfx___schedule+0x10/0x10 [ 1016.489242][ C0] ? mark_held_locks+0x40/0x70 [ 1016.494075][ C0] preempt_schedule_irq+0x50/0x90 [ 1016.499138][ C0] irqentry_exit+0x205/0xa00 [ 1016.503790][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1016.509799][ C0] RIP: 0010:lock_acquire+0x5e/0x370 [ 1016.515022][ C0] Code: 05 7b b4 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 06 55 3d 0f 0f 82 ac 02 00 00 8b 35 ae 88 3d 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 1d b4 7e 12 0f 85 ec 02 00 00 48 83 c4 [ 1016.534647][ C0] RSP: 0018:ffffc900042df358 EFLAGS: 00000206 [ 1016.540737][ C0] RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000 [ 1016.548717][ C0] RDX: 0000000000000000 RSI: ffffffff8e183ae4 RDI: ffffffff8c400a80 [ 1016.556722][ C0] RBP: ffffffff8ebe8000 R08: 000000002303ceeb R09: 0000000000000007 [ 1016.564706][ C0] R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002 [ 1016.572688][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1016.580687][ C0] ? unwind_next_frame+0x3be/0x2090 [ 1016.585915][ C0] ? unwind_next_frame+0x3be/0x2090 [ 1016.591139][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1016.597348][ C0] unwind_next_frame+0xd1/0x2090 [ 1016.602309][ C0] ? unwind_next_frame+0xbd/0x2090 [ 1016.607443][ C0] ? __kasan_slab_alloc+0x69/0x90 [ 1016.612489][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1016.618664][ C0] arch_stack_walk+0x94/0xf0 [ 1016.623283][ C0] ? __kasan_slab_alloc+0x69/0x90 [ 1016.628330][ C0] stack_trace_save+0x8e/0xc0 [ 1016.633048][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1016.638463][ C0] ? __lock_acquire+0x49f/0x1a40 [ 1016.643448][ C0] ? __lock_acquire+0x49f/0x1a40 [ 1016.648412][ C0] save_stack+0x162/0x1e0 [ 1016.652851][ C0] ? __pfx_save_stack+0x10/0x10 [ 1016.657719][ C0] ? __free_frozen_pages+0x79f/0x1090 [ 1016.663116][ C0] ? qlist_free_all+0x47/0xf0 [ 1016.667819][ C0] ? kasan_quarantine_reduce+0x1a0/0x1f0 [ 1016.673480][ C0] ? __kasan_slab_alloc+0x69/0x90 [ 1016.678544][ C0] ? page_ext_put+0x3e/0xd0 [ 1016.683145][ C0] __reset_page_owner+0x84/0x190 [ 1016.688118][ C0] __free_frozen_pages+0x79f/0x1090 [ 1016.693350][ C0] qlist_free_all+0x47/0xf0 [ 1016.697873][ C0] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1016.703358][ C0] __kasan_slab_alloc+0x69/0x90 [ 1016.708293][ C0] kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1016.713809][ C0] ? vm_area_dup+0x27/0x8e0 [ 1016.718338][ C0] vm_area_dup+0x27/0x8e0 [ 1016.722686][ C0] dup_mmap+0x6f6/0x21b0 [ 1016.726962][ C0] ? __pfx_dup_mmap+0x10/0x10 [ 1016.731680][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1016.737599][ C0] ? __lock_acquire+0x49f/0x1a40 [ 1016.742566][ C0] ? find_held_lock+0x2b/0x80 [ 1016.747276][ C0] ? __percpu_counter_init_many+0x2bc/0x3b0 [ 1016.753305][ C0] copy_process+0x4588/0x8030 [ 1016.758014][ C0] ? __pfx_copy_process+0x10/0x10 [ 1016.763051][ C0] ? do_raw_spin_lock+0x128/0x260 [ 1016.768104][ C0] kernel_clone+0x176/0x9d0 [ 1016.772644][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 1016.777727][ C0] ? find_held_lock+0x2b/0x80 [ 1016.782445][ C0] ? __might_fault+0xc5/0x140 [ 1016.787154][ C0] __do_sys_clone+0xd9/0x120 [ 1016.791805][ C0] ? __pfx___do_sys_clone+0x10/0x10 [ 1016.797069][ C0] do_syscall_64+0x115/0x840 [ 1016.801691][ C0] ? clear_bhb_loop+0x40/0x90 [ 1016.806443][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1016.812365][ C0] RIP: 0033:0x7f67e89c6a92 [ 1016.816788][ C0] RSP: 002b:00007fff589a8f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 1016.825258][ C0] RAX: ffffffffffffffda RBX: 00007fff589a8f50 RCX: 00007f67e89c6a92 [ 1016.833255][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 1016.841233][ C0] RBP: 00007fff589a90dc R08: 0000000000000000 R09: 0000000000000001 [ 1016.849213][ C0] R10: 000055555af5b7d0 R11: 0000000000000246 R12: 0000000000000001 [ 1016.857206][ C0] R13: 00000000000927c0 R14: 00000000000df630 R15: 00007fff589a9130 [ 1016.865218][ C0] [ 1019.340578][ C0] net_ratelimit: 4068 callbacks suppressed [ 1019.340600][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.359327][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.373147][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.386006][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.399728][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.412570][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.426286][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.439160][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.452847][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1019.465650][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.156125][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 1024.323880][ C0] net_ratelimit: 4167 callbacks suppressed [ 1024.323902][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.343394][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.356283][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.369963][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.382838][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.396493][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.409294][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.424192][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.437026][ C0] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1024.450613][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 1025.429032][ T1318] ieee802154 phy1 wpan1: encryption failed: -22