last executing test programs: 28.81343715s ago: executing program 0 (id=602): r0 = prctl$auto(0x3e, 0xffe, 0x0, 0x4, 0xfffffffffffffffe) sendmsg$auto_TCP_METRICS_CMD_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0100f9020000fbdbdf250100000008000b00ac141420080001"], 0x24}, 0x1, 0x0, 0x0, 0x14}, 0x0) close_range$auto(0x0, 0xfffffffffffff000, 0x2) r1 = socket(0x11, 0xa, 0x80) r2 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x787806, 0x0) r3 = socket(0x10, 0x2, 0x4) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES8=r1, @ANYRES8=r2], 0x18}, 0x1, 0x0, 0x0, 0x60008004}, 0x2000c082) write$auto(r3, &(0x7f0000000000)='-\x00', 0xfdef) ioctl$auto_RNDADDENTROPY2(0xffffffffffffffff, 0x40085203, &(0x7f0000000440)=[0xfff, 0xedc0]) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) r4 = openat$auto_ftrace_event_format_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/tracing/events/vmalloc/free_vmap_area_noflush/format\x00', 0x40, 0x0) pread64$auto(r4, 0x0, 0x3, 0xfdd) mmap$auto(0x9, 0x5, 0x6, 0xeb1, r0, 0x8000) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) r5 = socket(0x2b, 0x1, 0x1) setsockopt$auto(r5, 0x0, 0x27, 0x0, 0xc) io_uring_setup$auto(0x6, 0x0) socket(0x2a, 0x2, 0x1) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/workqueue/parameters/default_affinity_scope\x00', 0x1a9242, 0x0) sendfile$auto(r5, r4, 0x0, 0x5) io_setup$auto(0xffff, &(0x7f0000000580)) io_setup$auto(0xa, 0x0) r6 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/virtual/misc/hw_random/rng_quality\x00', 0x8a801, 0x0) write$auto(r6, &(0x7f0000000000)='1\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000) r7 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/maps\x00', 0x40302, 0x0) ioctl$auto_PROCMAP_QUERY(r7, 0xc0686611, 0x0) 27.781515985s ago: executing program 0 (id=608): r0 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x2, 0x0) write$auto_sg_fops_sg(r0, &(0x7f00000000c0)="4a0200000000040000000000000000000700924d1b3c5d2e00000000fdd2adc245a4fe3a61af156016d2e122228118b035ab6f7e46cbe922896e7e796fec3370fd6cf2d037cbf213d48b743bd7800890341900000000000000091261d01d3d1b573ab7aefb0d9f016860e3912060ee2dab170edcad212b7a4106b158ca8cdf4d76900d9772636f0cb3bd2913e2a6812a2f6921473340f867940a38087139a608d706fdb5279c716cff318b648b9680ddbe99631a96a20967d03d18c13e4efe1552d1cbd0f5503b4f552dc33a162651f3b15ad44907b2b2a2662b4e6640dc380afd675a95f58de3f019280d5a99b66cb919131e5752c53688908ff57e6e7753192537707b8d3d9508cd2ffab40b20f9367f40cd6c9211423264499f39b48d6e8843a7b000a421f5b3efdfccb5b7da69400dee", 0x132) r1 = fcntl$auto(0xffffffffffffffff, 0x400, 0x0) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x682, 0x0) ioctl$auto_SOUND_MIXER_READ_STEREODEVS2(r3, 0x80044dfb, &(0x7f0000000040)) read$auto_proc_sessionid_operations_base(r1, &(0x7f0000000480)=""/234, 0xffffffffffffff1e) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r6 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r6, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x82600, 0x0) write$auto(0xca, 0x0, 0x0) syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(r7, 0x0, 0x800) getdents$auto(0xffffffffffffffff, 0x0, 0x400018) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) r8 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000240), r4) sendmsg$auto_ETHTOOL_MSG_FEC_SET(r4, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x30, r8, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x1}, @ETHTOOL_A_FEC_HEADER={0x4}, @ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x9}, @ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$auto_nl80211(0x0, r9) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0x20, r10, 0xd0d58b333228212f, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r11}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x20}}, 0x4000000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x3, 0x66) madvise$auto(0x0, 0x20000a, 0x8) sendmsg$auto_NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fddbdf250800030008000300", @ANYRES32=r5], 0x24}, 0x1, 0x0, 0x0, 0x5c5fd097d751f33e}, 0x80) ioctl$auto_SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000040)="a6396751b883cec86d85a0bc80cb004243ce5beb1e814e96e8ae10f9ebc730f65c4214656b5ab27151da2878d6602801779bab84ba7876fac259baa438ca0985fd5f0989c48a713888f61eda2a99c65bf6145cb18ad567ac27bb3a9ed99354c9c2602113b0da385ba15903788e0ec1a3") 27.015452089s ago: executing program 0 (id=609): sendfile$auto(0x1, 0xffffffffffffffff, 0x0, 0x1f) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async, rerun: 32) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/virtual/block/ram6/queue/max_hw_sectors_kb\x00', 0x80000, 0x0) (rerun: 32) read$auto(r0, 0x0, 0x20) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) writev$auto(r1, &(0x7f0000000200)={0x0, 0x7}, 0x3) r2 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snd/controlC2\x00', 0x80, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket(0x10, 0x2, 0x0) (async) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/pagemap\x00', 0x201, 0x0) (async, rerun: 64) clone$auto(0x4, 0x72d2, 0x0, 0x0, 0x4) (async, rerun: 64) mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, 0x200000401, 0x8000) (async) socket(0x10, 0x2, 0x0) (async) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) (async) sendmsg$auto_NETDEV_CMD_QUEUE_GET(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, &(0x7f0000003000)={&(0x7f0000000000)=ANY=[@ANYBLOB="fd0000690a66caae782dec41bb20a7a3e7b147ad802d721100", @ANYRES16=0x0, @ANYBLOB="01002cbd7000fbdbdf250a0000000800010080000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20004080) (async) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB='X'], 0x1ac}}, 0x40000) (async) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) 25.119522557s ago: executing program 0 (id=617): r0 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x2, 0x0) write$auto_sg_fops_sg(r0, &(0x7f00000000c0)="4a0200000000040000000000000000000700924d1b3c5d2e00000000fdd2adc245a4fe3a61af156016d2e122228118b035ab6f7e46cbe922896e7e796fec3370fd6cf2d037cbf213d48b743bd7800890341900000000000000091261d01d3d1b573ab7aefb0d9f016860e3912060ee2dab170edcad212b7a4106b158ca8cdf4d76900d9772636f0cb3bd2913e2a6812a2f6921473340f867940a38087139a608d706fdb5279c716cff318b648b9680ddbe99631a96a20967d03d18c13e4efe1552d1cbd0f5503b4f552dc33a162651f3b15ad44907b2b2a2662b4e6640dc380afd675a95f58de3f019280d5a99b66cb919131e5752c53688908ff57e6e7753192537707b8d3d9508cd2ffab40b20f9367f40cd6c9211423264499f39b48d6e8843a7b000a421f5b3efdfccb5b7da69400dee", 0x132) r1 = fcntl$auto(0xffffffffffffffff, 0x400, 0x0) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) r3 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x682, 0x0) ioctl$auto_SOUND_MIXER_READ_STEREODEVS2(r3, 0x80044dfb, &(0x7f0000000040)) read$auto_proc_sessionid_operations_base(r1, &(0x7f0000000480)=""/234, 0xffffffffffffff1e) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r6 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r6, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x82600, 0x0) write$auto(0xca, 0x0, 0x0) syz_genetlink_get_family_id$auto_ovs_flow(&(0x7f0000000180), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_OVS_FLOW_CMD_GET(r7, 0x0, 0x800) getdents$auto(0xffffffffffffffff, 0x0, 0x400018) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, 0x0, 0x0) r8 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000240), r4) sendmsg$auto_ETHTOOL_MSG_FEC_SET(r4, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x30, r8, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x1}, @ETHTOOL_A_FEC_HEADER={0x4}, @ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x9}, @ETHTOOL_A_FEC_AUTO={0x5, 0x3, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$auto_nl80211(0x0, r9) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0x20, r10, 0xd0d58b333228212f, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r11}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x20}}, 0x4000000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) madvise$auto(0x0, 0x3, 0x66) madvise$auto(0x0, 0x20000a, 0x8) sendmsg$auto_NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fddbdf250800030008000300", @ANYRES32=r5], 0x24}, 0x1, 0x0, 0x0, 0x5c5fd097d751f33e}, 0x80) ioctl$auto_SG_EMULATED_HOST(r1, 0x2203, &(0x7f0000000040)="a6396751b883cec86d85a0bc80cb004243ce5beb1e814e96e8ae10f9ebc730f65c4214656b5ab27151da2878d6602801779bab84ba7876fac259baa438ca0985fd5f0989c48a713888f61eda2a99c65bf6145cb18ad567ac27bb3a9ed99354c9c2602113b0da385ba15903788e0ec1a3") 18.094832789s ago: executing program 0 (id=633): io_uring_setup$auto(0x386, &(0x7f0000000000)={0x5, 0x1, 0x4c, 0x0, 0x5, 0x8, 0xffffffffffffffff, [0xfffffffa, 0x8, 0xa], {0x8, 0x8, 0x3fc000, 0x4, 0x751, 0x3, 0x3b, 0x40000ec5, 0xffff}, {0xd5, 0x80000000, 0x1bee, 0x5d, 0x400, 0xd, 0x7, 0x8400, 0x7f}}) r1 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sysfs$auto(0x2, 0x0, 0x0) r2 = fsopen$auto(0x0, 0x1) fsconfig$auto(r2, 0x8, 0x0, 0x0, 0x0) r3 = fsopen$auto(0x0, 0x1) fsconfig$auto(r3, 0x6, 0x0, 0x0, 0x0) write$auto_console_fops_tty_io(r1, &(0x7f0000000000)="c80d1b5d399b39", 0xfdef) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1f, 0x5, 0x3) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) socket(0x11, 0xa, 0x402fd) sendmmsg$auto(0x4, 0x0, 0x9a6, 0xa) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/memory.force_empty\x00', 0xa001, 0x0) write$auto(r4, &(0x7f0000000080)='3\xc7\xff\xff\xff\xdd\x00\b(Ks\x0f\x87|P\x11\xd1li0\x89\x85\x90QM\xd6wfF\xf1x\xb3;c\tP\x03\x84\x97\x99\x83\x97\x81:\xf3\xa3o5\xc5\x86\xed\xa4\x18]\xa3\xc9\x0f\xff\xdak\xb0m\xe1U\xb3\xa2\xee\xdcTJQO\x98\xc8w\x8c\xe7\x00\x00\x00\x1dj\x1e\xebQT\xdd\x9b\x00'/101, 0x2000000000000008) sendmmsg$auto(0x3, 0x0, 0x9a6, 0xa00) read$auto_proc_iter_file_ops_compat_inode(0xffffffffffffffff, &(0x7f00000002c0)=""/266, 0x10a) mmap$auto(0x5, 0x2020009, 0xb, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) sendto$auto(0x3, 0x0, 0x2000f, 0x101, 0x0, 0x1c) ioctl$auto_SNDRV_PCM_IOCTL_INFO(r0, 0x81204101, &(0x7f0000000400)={0x4, 0x0, 0x200, 0x9, "ad46b93c167c163eebeaf9fac5369ae40ca94402f99fd0e0fc2ce57a0c1ca23cc13e4d0f61ad350f6bb20f8555231a5dd0a337167bfbd55c1708fd77fd72d4d4", "d0edb25bef2a01a938202e2c17a595947be2d688eda7bb7f1ba54ee1397161755e14fe9239d6ba9fe1da948de48a2355e619bfefa47d1e3e57032a449df640ac4ae92e46e466c1e29fd5d293555884b0", "b7317e0a01099c2cb876433925490aaf2d27aec9975894fbc9f8509d6b878342", 0x9, 0x0, 0x9, 0x0, '\x00', "67616cc99b4bb419ab5ff06577684da8a6c6ab7e940836c0dbca8535ca27f915b6fb5b4d5ce82edac825396ba66142cd4226ed64d9ec1490e5379c75e8e7fb8d"}) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setregid$auto(0x0, 0xffffffffffffffff) 9.630819599s ago: executing program 1 (id=663): mmap$auto(0x0, 0x20009, 0xe2, 0xeb1, 0x405, 0x8000) (async) ioctl$auto_XFS_IOC_OPEN_BY_HANDLE(0xffffffffffffffff, 0xc038586b, &(0x7f00000014c0)={0xffffffffffffffff, 0x0, 0x419, 0x0, 0x2, &(0x7f0000001500)="836e36831fd219840e8f4055fdb47eb4364f8739f7f9fc5592d03b382f897ba3fa507b9795149d7d43c076dc92883a3f36807fd3ab0da36dc7adaaabbfd05cf52862a44d9f7fe38c1373beec3dbf416dc15e6aac6300cb0ad70455b8dde2fe6cac0ebac4ebb7a76939b24046fcd97cba51e4c1847cdd7d1cb3ce65e27694271b94ecbbb3d6eee9f18ad2512d9ac294e8cd235aa30dd3486ef425be4e4d280c8437313664c61e5253b25b598d35092bc17a6d14a1a1f43693ff62747dd614b15de3a1d0c97c6cf0a4165959fa8634da4c51c18835a96659bd52709a2364e6b7982464d5c04aa5d17d3df6f7fe7c9bddcefb8b60c390a4e9e347878de807bb89a6aac0a542e7ae68a61e1ac8c4504694b19446c2c61d92db17d24a6c3d478e807bdf3772ee2f59d2bc6bf139c9283fc15963b0d61ea6c66c570d074b4b3792406ca97105a0c8ea5f701f4ba682704a003226ce47359302bea327980d6314d0d3b85d89f802db8cc33773bd57f8a2c08e7c12f9e818bc231967dff0e10d7eed8369c78efe00398e30c906cc6432c26f5036fd988cd281567f4a59193c78d932ed697219876c2e14b90c7c3e501c5e9230b7e223e9d3d72d53695ce64d188d5f5e2112381b1f2f18553f19b63e9921fcc9ce3da7ec402afed9be08b2cff739c5b3021300a5f3627d9e2e730e444d3e48fa6ccb419e38ed83d551f81de2ef054c84edcb96fe50fac2583a4a81a5dcf283163fc304e5fadaf3c8fe878b8427e36dd6614ef9558fcfbbd139b342c8b428c40d1c3b59209fb4d3252537467ccb5a31cc7e0c643a1c451b318f99c22bdee12767177aeaccd6e0c11a19f079ed0b8f3f5483a05c526707ad87cd3267ee0b1792850908e4c2f0fbd7e15508aff686821e6488cd8e907e2d59a05c2755cc7496b92cb9ea4662aa0ddcfcf876b07824021e647998a1e52c5165e292be17067a371ba0aec7dcc5eb6cf91e9111d1f72efe5cffddc59de7d58b7e968c1c9d2d4af20919b006d4bd98fdac34080d7e98b42e49175dbbf95ac32e13f063905ae069b9cdae80266ea3b2c7abec9254315d91764acd329e01a6655640d687ad52ab18f9300eff5ae0379f443156589cbffe7bf0a4e1fae094ce6167ca98df58e0860a5cbdb92823d72ffef6287923a94e662d9bdf5c328110196a448650621b2f45f9673800c70a6c27cbc02fff791726aa32996bcd11d71f2db48548683834b93d3e5123f1e8c9632370f9e2c559189fa4369a970e64407ad3f249ce944d4741781ec64377c739a3ac364499b0ae6373a10407d626d62befe72a956d4d1b441d32e86f02508a48e0d6792f1008092bcc7a1a4a0bd3fd37c0dea1782f31914e68ca9aef8dd911d6aeb6a4f8a4e6767cfeaaac387573e13f05d4f6262e763bd572b05b247f7f14f547cbdc19ae5d497dcdd2ba9ba637209aaedad1c680b768d1a54dbc24a601b05587d57d92aaaa336efb6b387758522037760067b89a706f0edb592078b9731ea2ccd4f8604089a19227d7bfcf0fc0cd28c8ca927c9456ec32ed9ca475954c2773204906ed1ad84980fe1f4a45ec26cb5e08bd228d196949fabc029db6b0aa9116bd1907a84e47efc4b8e020ab288540e21ff2f22cca1c799be053ccfaa8b449be601a88c56ff3cc94c30cd35092c2832b74bff15276294a708e52822b6eeea0c1f7c6c7ecaf873d943128c227c486f1e79b47de26b6dd3b7119d792accf14dce2fab1da795985394044ef4db85316a69f672ce3fd99000ecb49724165652f5d27a2afe2d32226edeb4d97b37a89f918b6db741d41fb411b6083470ad53c55fefc609a47cbe512c83ac8d34c192384c74d3d5d60fc2836c6d09c465d42910859f4f40efd13eda37eeea78f87698f172e18fd8f030b50a31afb7291908d7e90e63ccb7a913e6927aa1d8f7f12ef43c7ea291985a047c4a1869b2c16187b54eb81ac95a80253e3710609f938f24197ab8a25e41f80d2402d9fcf4ac33cde6550a817121ee81ba5edc5c7010deeac57da355ad7cb5f0e15d10ffbd9bc730b505acdef533f802151ef40711bc1ecedf980c6bfeeab4b0f54e7bcf6d2707ae518ad50540b0b40c1eb0ff5da154f7129bb345456b5ecfba90da7cc7ab963b5912f1b50494c9e717dae4764826c4e7a188c3b5a4d0fcc444f203e6a0a1d3506b6cb1341f88d54a32d4a056ce7db9d9215a9398dbfdb011276fc7760310563c2daf2355b7503e15605e29eb3c47b487ed2b572485ec9eb352b8a2878f19f02b407e9a40d76e3d9a9b1689a20e7ce2c2d37c49e2a95179c4112f5d1f94f6b4ca3b9f1f41c72fe97174af1f7108106648d70ce7522f7acfc609cc3537fe1621ab0acb4b64d57f9dc7fc15ce1bfc7a60a924c9e337970e1a59b7d71911fb364a58384f87e4e55a4deb879e75f520d1b24025f311cb8d5ac75cd9a8a9be9fd74b8779c978a9683d9f653995644ab75d7f31ca26a588f6f47fe370bdd65aad62ee24a1add05f3b5713db16a9dd93b8f878cb34854b346c5093ef0e7a6f9b7f3d4ee79e8062cfc5214d6b9f3d75ed39c33df5dca3cbcfbdd3f6b7b590a857686bf6d4a6229851c8770b67b6cfb35b8a420531b16f098d5c3a2e7dfef05f16afd37bcaee302139aea0eabbe57517713c688527d3d00015ae9ea001ba4f284faa32fd802698cc39b8b2f5e682724be0cc223b865c73db8415acf5f934081b7c8acc763a71f79276a1706a9104d3f42422671ea843fc4e2ce4ae6fce7d06476dd3259379811dc856f44eb73e304a51bafaf337695c64ce2a868db44257d1a6dfa7e24339f574bb3c84e7eaec9b10b90a4e33566f90e4821af7aa35ac894c7f614f63814d281f3136fa28e3019ddf9a32cace41d8fa1f4135fca80d04cc73cacd5154cfb9804a221a29a048a5f42d6e76ad2b4c0dc7269ccecebfe60e60edb9355a50caec575778c1107e8802d676800608cd6319705977edcd1746b5f8814c8b07208d6e44b3141e2216114658d366a73d74bb1d43a1f5d61a9b752fbdf95bc8231fb8e08485141fae83d8d2e65aa5e6cd641c2edaca31a82768d41d4649e85f01125e69258fc992e453b256476df347b43f546365d91c18634033bd59b75b833e12925f16de4d159b12490ae506a855eab5f866f5caf071a87e12d86d9d59f6b1afcd72f86ba6855a7fff28e16742bef01e3b1a46dcd6daa754adf4b8c048b7107fee613aec59679a956221b247687bebb00cb6070b56c83514729ad8b6e1956905267a28820436903a8394933268ebaf0394e5aca205bf74f10d224e9dec0e5de8b2b5d73fdff50c6e252fa3d5286082c99285130ce07fc5806208b0acc13d68f6f204b750a8a344d0f25d5fc614f5737ffbb1e39fe7806ec5f52fb0c86ee5d48c6c599db671caf75807046d23e6958b610595845054c1f3a53b9e739eb21e52b448b241731bfa2f32d08aed09a572a116440fc82f1d15cd12d1a146a674932b200a42938702cab94dfc2922712897ebb33a662f16f3fba43b24034a0d565288e8361f0fc204b9249e54954aa98e1618ed2619e6d3ffcc3240693330fce3cd7b7658ad11e953785b01f5b2d8bcf46b2e2f18225d89193e160a63ef3809b53b917f298dc3cf525b16fc52b2d53a71ec88a07e72eee6ac8ab4547ceb664a1210cde23d9a6a57de9a975fed983307983a41a45843aa695ac7af320aae6c134667c40406baa44433ea98a881ffd85aef9bfbaacfec240896a55b51d5bed11a83765a43297bfc15aa1130b76be94d2f4f1c11108a23802a85407add5667e2166930e6564d6cfd0d1175407ba812050394cadbb5cdb91bc950e91165f8c90c2984ac932e7498c2ec4d3f3bde592a84bd4da217e63d4df4895d2d662e7dba128e395ba7a493cefb3336a27f8d1e0a6dfff413c6a50700d9316a3c21f8bbaaef33088f3867565b99b066e42fe496b0912444a80cdfd9ce763df1b6c88ebf4f6a3440228db08e2f00aaaea4406f0548e5d05fafe199d61f58b430fac929c4b0403f21239c561366de957bf6fab37d6e42b8f9023ef90c8477313285ef4554a6688bbeb8aa2015833ff3d0e56d1163ccf5c49f2217d0ba0dc60b1c790f1b436aa6c9e058a11224f86e283f36efeee668f14a063279ef38d62e01d51f123dd9aa87393d9cf4c3d66163502f81ae900cfa4d1a86fc0a88eb6069dd7ce705a28468cec6310db1ddca8519c46ca5ca03c3588f212f082c8ed06828aa7cac0520fe19f2f3a3122e743fdaf4664454856d32daddf913c4ccbd4a282f50052a47bb1b9199200e46d80f575883f53b896ef28398a484a5a9957c771e8aa6d623f70195ed5705c76fd807127d4588f8bb04b4b7e1b092cc3bd5c826bd45f49652ef74725f463c32e88817a8d5d15d7d55991dcf0f69de553a10c26ffa4ade61ae4763f6ae5b3686647887a61e6dcab99d87d5082d535cf6dce7b242731c4921e6efc0f0abc6baf02091415e8ddd1856236551de18a518a678f91f8513df1ab2f38b6cca5ca3036ac414b789933e0c9c6c7effc60ca22f638f414d1780cabe17cec3b94e691d83825b0001439fa4adb8158f87a25cc3ae623cb881b9fe8da069c7f79fc2a46312a7795b460adc8dd2bbad63611a4b39320fb432b8a7b00579a6cf31ebd524f1473a0a2b1a2a373540c545a5ffcd20953deaea0ca5c87311d4ee4cff57bb8fc2393148c81a053a0ac7e601f2402c1aaaa4b7df5615550706a2b65ee9726eca6fe9fe73d0798711e07c9705dffd8ed04f4a5ff98d8f2882174b899f5e44b8ae42725d8da1671e09baa1b29182ee1487d29fde833452462c4c6f81722c47147251937f749d75e1431dbafd7255f509e", 0x0}) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x6e642, 0x0) write$auto(r0, &(0x7f0000000400)='odev/audio1\x00', 0x100000a3d9) (async) openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, 0x0, 0x222000, 0x0) openat$auto_zero_fops_mem(0xffffffffffffff9c, 0x0, 0x109200, 0x0) (async) syz_genetlink_get_family_id$auto_nl802154(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 64) r1 = openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/set_event_notrace_pid\x00', 0x582, 0x0) (rerun: 64) write$auto_console_fops_tty_io(r1, &(0x7f0000001240)='4', 0x1) (async) openat$auto_uprobe_events_ops_trace_uprobe(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$auto_cachefiles_daemon_fops_internal(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) openat$auto_debugfs_full_proxy_file_operations_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/ieee80211/phy3/netdev:wlan0/stations/08:02:11:00:00:01/he_capa\x00', 0xa0080, 0x0) (rerun: 64) unshare$auto(0x40000080) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) close_range$auto(0x2, 0x8, 0x0) (rerun: 64) socket(0x2, 0x3, 0x100) (async) socket(0x10, 0x2, 0x0) (async) r3 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000002980), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x38, r3, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_BACKEND_IDENTIFIER={0xc, 0xa, 'nl80211\x00'}]}, 0x38}}, 0x20000000) (async, rerun: 64) openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/tracing/set_event\x00', 0x101901, 0x0) (rerun: 64) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x103a42, 0x0) (async) write$auto(0xffffffffffffffff, &(0x7f0000000400)='/dev/\x98@dio1\x00', 0x100000a3d9) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) close_range$auto(0x2, 0x8, 0x0) (async, rerun: 64) socket(0x2, 0x80802, 0x0) (rerun: 64) r4 = socket(0x2b, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x11}}, 0x6a) (async) sendmmsg$auto(r4, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x3, 0x20000000) sendfile$auto(0x1, 0x3, 0x0, 0x7ff) sendto$auto(0x3, 0x0, 0x2000f, 0x101, 0x0, 0x1c) 8.783233136s ago: executing program 2 (id=665): mmap$auto(0x0, 0x40009, 0x36, 0x9b72, 0x7, 0x28000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/platform/vivid.0/video4linux/video62/name\x00', 0x100, 0x0) ustat$auto(0x12, &(0x7f0000000340)={0x2, 0x80, "2f50fc00", "df5f19b5a360"}) r0 = openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/kvm/halt_successful_poll\x00', 0x42, 0x0) write$auto(r0, &(0x7f0000000180)='0\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k>\xc8\x1f\xad\xf6\xf0\xef\xe4s\x95\xf2\x00\x97S\xb9O\xac\xbe\xd6\\J<\x02YK\xd6M\xe6\xe7\xa0\xb8\xc3[\x01\xc5\xe8|\xb0\xb0\x80\xbf\xa5?=i\x88UB\x1d\x8e\xd3\xc2\x949\xb6\xfb\x006\x02\x9c\xe5\x14\x13\x99\xc7\xb4)M\xed\tN $\xd4\xb2^?J\x92\x9a?\xf8b\x03\xd8\xdd\x84\xdf\x92\xf0\xcd\xd8\xba\xab\x15\x80\x9eo,\xc8\xf2\x82\xd2\x88\xbeL\xa0\x1a\xd3\xd5Of\x95\xee\x13e\xeb}o\x9b\x86_\xf0?\f<\xf3t7\xb6\x0f\x93\xc79@\xd8x\x9e\xef!\x006\b\xdbWB\x84\xdd\xac\xdau\x86g\x8f\x02@O7\x0f\xf8\x8d(\x9c\xf2NyD\x7f3\x14\x9eg\x86%)\xd6\b\xcd\x1f\x03\x00:\xa6\x83\'\xf4\xf2\x9dT\xf4z\x89\xc5D\xc4\x02\\\x81\xcf\x02Ep\xf6`\xdc*\x1dV', 0x5) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x200500, 0x0) r1 = ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty12\x00', 0x101c40, 0x0) close_range$auto(0x0, 0x5, 0x0) pipe$auto(0x0) write$auto(0x1, 0x0, 0x80000000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$auto_NL80211_CMD_SET_WIPHY(r1, 0x0, 0x0) socket(0x8, 0x1, 0x33) r3 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYBLOB='&\x00', @ANYBLOB="5de1"], 0x1ac}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) read$auto(r3, &(0x7f0000000080)='MJC802154_HWSIM\x00\xcb\x0fX\xc7\xfdx!\xf7\xb5T\x04\xad\x96\xf4\xbc\xca\xa52UWT1\a\x00\x00\x00\x00\x00\x007\xc9\xa6\x8a', 0x1060) r4 = openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x101001, 0x0) ioctl$auto_UI_DEV_SETUP(r4, 0x405c5503, &(0x7f00000000c0)={{0x1009, 0xf2cf, 0x8, 0x80}, "6a034a07c7b82d90b69a39e32576f893fba86c9dd051a0094a3836d61c9100fefbbabea6ef9368c7996e841f3f1561d4992f726b0a6c36b0b2fd1678e816201cf562367fe6596824588a2e3d84ba165f", 0xa}) ioctl$auto_UI_DEV_CREATE(r4, 0x5501, 0x0) writev$auto(r4, &(0x7f0000000340)={0x0, 0x18}, 0x8) ioctl$auto_UI_SET_FFBIT(r4, 0x4004556b, 0x0) socketpair$auto(0x1a, 0x1, 0x0, 0x0) fanotify_mark$auto(0x0, 0x1, 0x9, 0x4, 0x0) readv$auto(0x3, 0x0, 0x1) 7.79848488s ago: executing program 1 (id=666): mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) close_range$auto(0x2, 0x8, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x2, 0x1, 0x106) r1 = openat$auto_sw_sync_debugfs_fops_sync_debug(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) ioctl$auto_SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, 0x0) mmap$auto(0x0, 0x10000, 0x3, 0x15, 0xfffffffffffffffa, 0x8000) r2 = io_uring_setup$auto(0x6, 0x0) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = ioctl$auto_SIOCSIFHWADDR2(r2, 0x8924, &(0x7f0000000440)="bac96365913c251c059430684da60f911330b534be8bef624403e1437a781d95cb88cf958c6232373fd384f7bb0ec93f4c98b02241773eb6598dbe39a1b32f2cdb4495ac4cd7ead5ee62104071aab038bb83f66c9c8d8929da8bf82db5224168ba911993866691de4fe992d8c8f175e1ebd05456bb089b5d7853d239a3e6fb872f35cd515f997b04aae0d936ebd328619cd430fdeb5fbcb60bc363c78a4e69a8dc3abc82f0bfdfe0f55a18fda2218af6132cc61df05077810f17c5e416971a2c148123435429907db89f198c904973317cc9d3f0bef20adc323def908eae719fc5a6212a47901bd36d63917d3c7d466d0724348a6ae6932d11c274b18117a9fc3092fc6d9fc268481e22556b9df3407361ea456dffebd793a5ce7fd7b8d6e782734380577fc8741d53b7a39064b653ed3451ef7b64d393aab36e95dde590a6e92e11f88aa70f4bd9cd01a6867567417672c0f92a4452088f314a57ec4f3dedf878927d818a55b7df692e64d40ab3efa72d037a72d4a638cb4f806abb41b6290c45fde1e5657823d41aa5365357da03639500dc92eeb3da00e5ecd47276ccae73eec608264974cf81ddcbdfe45e98e8147d9c4eca75d947b1549287e3db177119f813927f971f1280bcf6d6497bb1a93d63250263777ceb55c2a78e79ea2f62d634e242f93c61a0b0969f49e70fe9c30e474f8e3caa2c58625858fa529aa83f5ce50e63e6808c19f38923b3ac7180b7255456ed4a03ce94f6903e6d4987b778191db14abc22d2a3151f7a91424f5dcce73bb1a1fd89e3d108b0886e93410926c2810a937d556da58b7e81bf830bfa08da712eccdea645fb496dd7cd87ced15bfc3fd6268b67696f0e2361b3a5935fcf01282dc73c0c79b7fbe24a71df4d2848ba2ffd9907d407de779fd47725c90af676a5f61f235ca32e7c62d8ded8078607dfa72aac286ad989c863f62d451c27056af6e433a4b4d29daa0dd5f99407a000a2a5962fd43006b8969be66a50d551f85cea4c694e87327d8ad38e2f79307639d972317662fcf38196369bdd794c1391ffab65df2e58f818ab74fa66d3367992a04803d17ffb8a0c4ebd70569c73249e5289ab2c5436f70d290a4e07ca448cadcba6789a4174944b4d95aacafd93fbe8f5e2f0a209af2cafd5520e0b1ff0c1fc918d5cdbe98da4b73f6c4205aa1188762ee7b694fe63e99bb74df233419ab4f6386d6e9c6ca10f8e196cc2436b7b0e44bce6854326763ffd14dca2396b7b7ae24244a985460580970bb386dbd695a1157d0c1f79fdda68b191e534b15db670f424889d81c732a77dfc7d085f543f48fc799fa155f07b7268ba13bbe37c830a1f7dfd7465bdf96cb106d871aa0348f6482ea62009037b68d2081605a1ac06fe5d3e59cc31cec6ab07972f0ae2865433daced94fc46515d7f466830a0d5346fb867fc5b48c29a2277af57653dec56b1e8e0f3c97ce4759433b60e0455432b4e43e96651b2bc3734978c91fe198827beec911f1a9db12be5fea0ef42323b42df5d11dd725e9df6b4fdd45759bf61b09b4cf43e11c998616e607109866949f5250e55c3d4a9c148b7ddc24da019fa4c152da4a8e5ab8a03a36051f57d90cca22f428626d314166f81a541c8f6de589c948611df3e6a70e2ad789479321191ddfbc639787a09cce6a7ff33013a4b7bd57be4b6653557c270d2df0ebd44b902d259a443c4fc62cbc5aea808b1cc66076db520b48abc4b17137b16893514a50f72c90b1772b3f27dd0b5ae071dd8e2b6bb7fc75023479ef8d72f42769700ee2e90d5b1282f885782e3e9fa0585db0502a7a4c657d64f95840fb40d187ca6fe8e5656cc133a66b6cff4d11d9d6474b952983ad4129e3cf69b2f6f0d34b584f5ac8f9b4c73c42680bd8053ff620a9d29d70c7bff47d82b65342d783fa523fdb6f2c959c541847b39b95102234c581ee0308c4f1a26e07699ed30c98a6e772e1cbe3306e1e80c3289c2c3586849aca22d79fc50ae90b53103af192a7efa62a9a8dd64ac5daef7acfd035b2e216f58999cb2aa655ea4a4e1c9fffb80537412246e552714df6b9d4f0c11e369b475dae18b60b3c6a572bc293eca3fb57ff5d2e5532dcf0be9550f2300bb6f2cfbc1b1a2c20e698410dbd96a53d0146bdecc5a58eece1dcab21fda0b5412134eff1a572cf6221320ad5b2234e76f3a1a65ab313402cd3359ac962f1c9b752acad47aaf9747330dcae9a6753b06fe768201af0dce9f89c28e0eb9bf6149e2f5dfd8803553ad6affcd483a08b06cd21affaa6792bb725e46b4d3fba320edff669527871a51da0db4a23ac91b016faf4d84b83150ad520b7ec03880889322d121c8462c6c80b6447d1fa7f0f2a9e3b5b8c1f9479beedd605949728c0303defa64070ed644220b5978b1909bb0b1355e61bb9f2ae5c1e391e7a8bb12795ea312a7c94291142c2eaa7a44b9885138d91fc543cbb9f36bae3d9ff64ccc55c04fae5bd50738eca13defb2452db8936993e358d7b16503c334900a2fcd9955e3374a7813aedff6a5d4b43a0281275521cdd4e4f25dac5f002fc88bc764725794f0ad1de2132767974b6082640e27427a33bef04144198f54a6c9fc18d25c6a77b8d7b424892f77f0854af999ee32015e5a110248567f8113724e40a0f567c2604350cc0505204297be2a030d0caa4b38b4fdb363bda43e08e0306470b5752fd1c154706b222cb61a0ffa3642e2d6bd8f2e52302f0d0bb1523d45dfb9936c2773577409a82403e4b5b5d9dc58915aa77837fc72a3bc22c40b24d4a33df31516ea6a96609507f739d5f26fd0f1df9b99134be3ec3227c9cf30ea51b16c3cc5baeb0bac682d9d785c10e5aa9e4e97020d597f58c8dacf69e2958ea28c1fe42565806cff117a370a0e9085def558d4627b1fd322cadb87b104550afbd9196e1e765143a14ea968289dea70e39f213a20ab965f20628dd7e60ccab50a7c7bc91d5a532592ebec0305bc4163005e1cf4bbc6be47cd4382e0e38856bea315bba9c83d55607d600152ad9c8745956eedfc27aca9cf7d6b31a036644564f183afa33bc6e6bddfc887de5d3b854bfe0b4e273ab026d047d6820a2ffb4593c28844fc92380762243208bf325f6ecd2d1317e39c2c84556273b41fc6bf67140c9eb054347b95779e919a3ac684ae18e986edf71e167689b81b28c668949bd161301972683ecbe46dac226e944a85755771596d2f6fae90b47e6175395739714ef410ca9a05ec43e35fc7a1139bfdeef7542caba4d6aaeedebab0a52cdbe2226d87b07b5db12e227afc1d7cabed230f754092a1cf574f6108f50a535b943c1810e9ebfd8fe0eb34aaf569c6c4974aba775faa245c76fe368e7a9d4106d8e0e16d301bb64a9efe08cfe0f252d7895d1af8a596d2fefa0b3a456fcdbdb1bdbc5fc15cd36043bc9d56dd6f7e5917cdafb5e76591d6f5b5fa95ae210c915db1e25f4806edaa91a2690e846c5fa1722070908d5c76870de09218746c98884045d1ad0dce088fa5fc6fd5117778d4525e7d9117099b5a9f6d20832b024f4e68df64ee8d5a4c5326efe7cb0a133d458c72948617b412f03ff75d2e149ca93e1ff677cb450104c584a2c712aa6ca26559ef1d135d97856b72024dd8b6870bea651ec0c292255741c28f41314f63c2a7def2ce42036f674c14610d020ead23d73bdcc784c0e17d586caa62fbc9269282bf6c89e6a65f70ee0ad96033fd75c4d3b95a25ed468743cf99dce3ed5808b1a74fa75ecfe6c6047e216a6220c39b68a3573c8458f40213b549403dbc78eec7e64bac3eafeef286f40bea0bcdb96b476455e282ba32632eaf3148db9d718a24124daf14e2ad550b99714ffa2652174d3329c8ef13a638f63ec463411f8885cf3614c79b671bfbca302c5fcbed304327af48a7b37f14c6acd721762b004ba2d0ac89fe1b52e9db8177035db02fa18c1d6d30c206571e6cb0b528375971601d4bdb8d7eb3a4ee6cf4a0f2090829965e8c6924b10319a20debc9e70779ec7a50b1d26f1337aa49702c65683908f94c783a2b3c6ad43f721ce1df7ad0456abe310bb821b1421f061a4eacc80b3b176a2aabcbd9f8ddc8eab72a1ae3e72d4393c526e87fa7491d416332e8a634cbb2a808adde7331c9cc579741623f5f9cdd1cd10804908a3c099986a3d30c98b136b18342238a87b44f89caf016e4e71eb6c323321c0ba09cfa09dc977b162f8f6a081edb3aeb3e908222b90b46387f58ba07446a24cc86e3d7c94d0bf528df9d967f463380f3d1176cb3ef5c1decc9a6a95cbeac3f7ce85daad4a6ad928d1c1bc92158443e5e6c4d5369d78613296c5c449bf12d8f9db15283a384e3be95ca5fddedf8958c216f2bb162e6fcaa9d61ee19a10f32deb792421a234d688b37178aa4eeb99f2aa1d3f1b50485c343554004131c89bdb6add0f0ebf3950d11c6d80e59f7676f1bae998c97200aefc35f8f2dd5841c9ff5baf70c2b6060229c1d31cfd3daafbf8c073069eb4298a4f567f7661b166aa07cd14173cd2bcee355c33c519b8a40b843d1580efceb16ef007d6f948a6d44060180147e5aaefaa8faf0552b0c3c97f6eb66219dd3715dac21580a1cd762b9b62ad249fe774827273ca0aaa01c457ff7c15150dfd7e9dcf25545668c0685473c8f2d2271065f4ae357f7f8976004942302120fa2800df345dedb68a99d53556a91ed735eeab8657107631392be5be93457587cc508cca9b3a811e6d9d853ad3eba53bcc637ad3d17190a695f2e6cc8ae7b767b0166e0c01489f15217d657cf661918cd36eb80960cc691157fa59f39f6fe78a4280f58a44a354920596e774342fc9a623e6af424bbd1dc57b8b4240075b4b6be10ae395c3a0993971e3a248c722eaf3eeab35b6f0e0d3e70f0b2834085ece7b580f5ea1d9e6e3608a70fdc85f8da052367051739c3a71ba8870eb5091feffa6ded5911c9059cd21d98ced153707682bf4edf46b436525623bcb4d00088395cac06561e9999668c4d87ccfd5d84885b9d6a795e8da00efdf6ad4d99d76ab716d161fac14f61c84f06af5a8336a03ea2bef9ac6c957e6bfe5ac2a1ac2e9045c07df57193c3bba976bbddaa02c60e00de4c449e45d89eec77af8d492e972e228b7b198a17095b03e2a102abed18f82b63d415e60d8e52a1961d1b492e9c0db4856620a0b306a92632fd5a0ba6ccb984bfdb37db943c62efffa8fe37671cdf645bb623a151f0cf4943ba7169c366ef3d5708c833fb91d761112e4c0ce3c3a723f2a0e3ef392ea2635d42840d4c40f723bdd8a1748af72f554634629e674ba1a77381ba971006fd1336498e1b1b450ecae706994dc9345522ce91e1636e80df77b6fc9a8177fba9ae49cc3ed31f707d698ad0693214f1ef5c92edd9020da59155e05a9a45803d9e2d6e82811a819fe8fadb853c00e57a4a521d7a12dbe28a12165040927b0a18b6d6660b22256b6259728fcef54da8cb006c4426d81319fa976f51ae143e6b483de45303b612905b264b550c7178d50a61530c7a010740001b1a2b065423e9435d3e1a4faa6eae892deb27d440d906240e0c49c5abb5e4eb1411f184d4048557e474d6d97141e495d7332121edc0ee7919d9b292d8de2261d255a8686fb8f4001bd8b338f493dc49dccfe1398c747535f54378cce82337333f7fd7e5e7fa28c52c78759f92e9e1aa484c09b1fcbebbcbd8c96aff0db21b8109b578f7a4c2a9f33df8c9dccc15ffe0af8ea691aff5f085f8e82f3a7eb223a55d551f0bc6534fa36015654") r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000080), r0) sendmsg$auto_NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r5, @ANYBLOB="000426bd7000fcdbdf257e0000007700bb002219ca9cbe3c570ae82e2fcbc1772cc1a472bdaf0415fea0b123d1cc70732c836c2b059abd4944de04ecdd924b2c0c957bf5b98dcf1469d3edefe691d45e4acc1dd84c8177fbe7bf2ebf26e461319dd24346c2454229fe4b4e902c862ae4aac04da398cfc7ab53eb5e72a9d4629ce4e7d3756b1b1e00"], 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x4000) read$auto_transactions_fops_(r4, &(0x7f0000001440)=""/128, 0x80) write$auto(r3, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) openat$auto_uinput_fops_uinput(0xffffffffffffff9c, &(0x7f0000000380), 0x20000, 0x0) mmap$auto(0x0, 0x2020007, 0xffffffffffffffff, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) r7 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r7) ioctl$auto_KVM_GET_MSRS(r6, 0xc008ae88, &(0x7f0000000080)={0x2, 0x0, [{0x6a4, 0x400, 0x9}]}) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) getpriority$auto_PRIO_USER(0x2, 0x0) socket(0x28, 0x5, 0x0) openat$auto_generic(0xffffffffffffff9c, &(0x7f00000032c0)='/proc/kmsg\x00', 0x80002, 0x0) 7.694101263s ago: executing program 2 (id=667): mmap$auto(0x0, 0x400005, 0xe2, 0x9b72, 0x2, 0x8000) r0 = io_uring_setup$auto(0x999, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) socket(0xa, 0x1, 0x84) r1 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="0100", @ANYBLOB=']'], 0x1ac}}, 0x40000) recvmmsg$auto(r1, &(0x7f0000000140)={{0x0, 0x1, &(0x7f0000000080)={0x0, 0x400}, 0x5, 0x0, 0x3, 0x8}, 0x803}, 0xfffffff9, 0x10, 0x0) setsockopt$auto(0x3, 0x10000000084, 0x1f, 0x0, 0x3ff) ustat$auto(0x801, 0x0) close_range$auto(0x2, 0x8, 0x0) open(0x0, 0x22240, 0x155) socket(0x2, 0x2, 0x0) r2 = socket(0x2, 0x1, 0x0) close_range$auto(0x2, 0x8, 0x0) open(0x0, 0x22240, 0x1a2) socket(0x2, 0x1, 0x106) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a) socket(0x2, 0x1, 0x106) listen$auto(0x3, 0x81) sendmmsg$auto(r2, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000) accept$auto(r0, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) 6.919712233s ago: executing program 2 (id=669): landlock_create_ruleset$auto(&(0x7f0000000000)={0xfffffffffffffffe, 0x403, 0x40000000000007}, 0x9, 0xd) syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000000c0), 0xffffffffffffffff) close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty28\x00', 0x4200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) mmap$auto(0x0, 0x20004, 0x1ff, 0xeb1, 0x8000000000000024, 0x8000) r0 = io_uring_setup$auto(0x406, 0x0) r1 = openat$auto_posix_clock_file_operations_posix_clock(0xffffffffffffff9c, &(0x7f0000000080), 0xc0402, 0x0) pread64$auto(r1, 0x0, 0x1ffffffffffe, 0x2f4a3a23) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x0) getxattrat$auto(r0, &(0x7f0000000180)='./file0\x00', 0x0, &(0x7f00000001c0)='!*$\x00', &(0x7f0000000200)={0x4, 0x5, 0x3}, 0xffffffff) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000100), 0x460880, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$auto_SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, &(0x7f0000000040)={0x0, 0x318f, 0x4, 0x0, 0xff, "50cfeeca8e00"}) close_range$auto(0x2, 0x8, 0x0) r3 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) openat$auto_vmwgfx_driver_fops_vmwgfx_drv(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/card1\x00', 0x90883, 0x0) socket(0x2, 0x5, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x80001, 0x0) socket(0x2, 0x5, 0x0) setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9) setsockopt$auto(0x3, 0x10000000084, 0x80, 0x0, 0x8) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/net/ipv6_route\x00', 0x101000, 0x0) mq_open$auto(0x0, 0x5, 0x0, 0x0) write$auto(r3, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) close_range$auto(0x2, 0x8, 0x0) ioctl$auto(0x3, 0xae41, r2) 5.553959958s ago: executing program 1 (id=670): unshare$auto(0x40000083) unshare$auto(0x40000080) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bus/usb/008/001\x00', 0x402, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x8a241, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) mmap$auto(0x0, 0x2020009, 0x2, 0xf8, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x6, 0x0) ustat$auto(0x801, 0x0) close_range$auto(0x2, 0x8, 0x0) open(0x0, 0xe2c1, 0x157) r1 = socket(0x2, 0x2, 0x0) r2 = socket(0x2, 0x1, 0x0) close_range$auto(0x2, 0x8, 0x0) open(0x0, 0x26241, 0x20) socket(0x2, 0x1, 0x106) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0xffff, @remote}, 0x6a) socket(0x2, 0x1, 0x106) listen$auto(0x3, 0x81) sendmmsg$auto(r2, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x5, 0x20000000) sendmsg$auto_NL80211_CMD_SET_MULTICAST_TO_UNICAST(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20000010) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r3, 0x8000) move_pages$auto(0x0, 0x1002, 0x0, &(0x7f0000001140), 0x0, 0x2) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x4044001) r4 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/dynamic_debug/control\x00', 0x0, 0x0) pread64$auto(r4, &(0x7f0000000040)='uete1\x00', 0x200000000006, 0x7) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, 0x0, 0xc0) 5.051651549s ago: executing program 3 (id=672): r0 = socket(0x26, 0x1, 0x4b73) r1 = socket(0x2, 0x1, 0x84) r2 = syz_genetlink_get_family_id$auto_nfc(&(0x7f0000000040), r0) sendmsg$auto_NFC_CMD_DISABLE_SE(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYBLOB="080027bd7000fbdb9f2512000defc7ee02006e66630004001400050010000300fe2fe7098edea39925b5f6a714ca78470ee594c4c632fb25fcd00b07fb0449314a216ccdf981f63450ffe145275b4a8e54b5023c0838f85785e6973bc74cf7a862d99206273cc126cac6a8ef788020dfa455c0e4e3f4c5088325e33ab6c1d9f57b6225962a22ec304aee4b493c2d6b0903ffade8bdf6b6d4791fbe89d8fcf7db057bcd6c00664bad5f5015186982e1450483f7f18b2ce4366ec61fd98b196fe4659b65949470d2df15239555a504f4a06976780d8fd0", @ANYRES16=r2, @ANYRES64=r0, @ANYRES8=0x0, @ANYRES16=0x0], 0x28}, 0x1, 0x0, 0x0, 0x20004840}, 0x0) setsockopt$auto(r1, 0x84, 0x6, 0x0, 0xd3) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) bind$auto(r1, &(0x7f0000000100)=@phonet={0x23, 0x7, 0xbd, 0x2}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x42}}, 0x51) openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vbi22\x00', 0x100, 0x0) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x28440, 0x1d4) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x28382, 0x0) mmap$auto(0x0, 0x10001, 0xdf, 0x9b71, 0xffffffffffffffff, 0x0) socket(0x18, 0x6, 0x100) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x80502, 0x0) ioctl$auto_TIOCGPTPEER2(r5, 0x5441, 0xebffffff) write$auto(r4, &(0x7f0000000180)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8\xa6\xb6\xaa\x96/OX\xba\x02\xc5\xc6B\x1d}Y\xbc@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf\xd6f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8', 0x100000a3d6) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x10200000000001ff, 0x9, 0xd3e, 0x20, 0x9687, 0x100000000000003, 0x3c2a19d8, 0x6, 0x3, 0x62, 0x8, 0x7, 0x6d3f, 0x6, 0xa, 0xfffffffffffffffe]}, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f0000000380)={[0x1ff, 0x7, 0xfffffffffffffffb, 0x1000001, 0x4, 0x3, 0x3, 0x3, 0xffffffffffffffff, 0x3, 0x80000000003fffff, 0x3, 0x6d3c, 0x3, 0x2, 0x8000000000000006]}, 0x0) ioctl$auto(0x4000000000000c8, 0x400454cc, 0x6f) close_range$auto(0x2, 0xa, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x2000, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) setsockopt$auto(r3, 0xffffffff, 0x10000, 0x0, 0x2c) write$auto_fops_init_pkru_pkeys(r3, 0x0, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) 4.947243088s ago: executing program 2 (id=673): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r0 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f0000000000)='/dev/v4l-subdev6\x00', 0x169000, 0x0) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810007, 0xf4, 0x800000000a011, r1, 0x8000) unshare$auto(0x40000080) socket(0x15, 0x5, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xfffffffffffffffa, 0x8000) r2 = prctl$auto(0x3, 0x1002, 0x0, 0x0, 0xfffffffffffffff7) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_ovs_vport(&(0x7f0000000200), r3) sendmsg$auto_OVS_VPORT_CMD_SET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x18, r4, 0x1, 0x70bd25, 0x25dfdbff, {}, [@OVS_VPORT_ATTR_UPCALL_STATS={0x4}]}, 0x18}}, 0x10) syz_clone3(&(0x7f00000006c0)={0x208200700, 0x0, 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r2}}, 0x58) ioctl$auto(r0, 0xc040564a, r0) 4.173227789s ago: executing program 1 (id=674): sendmsg$auto_OVS_CT_LIMIT_CMD_SET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x0, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) close_range$auto(0x2, 0x8, 0x20000000) socket(0x1e, 0x1, 0x6) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x103e81, 0x0) ioctl$auto_TCSBRKP2(r1, 0x5425, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x103e81, 0x0) ioctl$auto_TCSBRKP2(r2, 0x5425, 0x0) write$auto(r0, &(0x7f0000000080)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) mknod$auto(&(0x7f0000000040)='./file0\x00', 0x1001, 0x44) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) clone$auto(0x1, 0x0, 0x0, 0x0, 0x42) syz_clone3(&(0x7f0000000180)={0xa7102000, 0x0, 0x0, 0x0, {0x2a}, 0x0, 0x0, 0x0, 0x0}, 0x58) r3 = open(&(0x7f0000000000)='./file0\x00', 0x563342, 0x100) socket(0x2, 0x2, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000e40)='/sys/devices/pci0000:00/0000:00:01.3/config\x00', 0x68102, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(0xffffffffffffffff, 0x400000000000, 0x0) mmap$auto(0x200, 0x4, 0x4000000000df, 0x14, 0x401, 0x300000000000) sysfs$auto(0x2, 0x24, 0x0) ioctl$auto_AUTOFS_IOC_ASKUMOUNT(r3, 0x80049370, &(0x7f00000000c0)=0x3) r4 = openat$auto_ftrace_set_event_fops_trace_events(0xffffffffffffff9c, 0x0, 0x20201, 0x0) write$auto(r4, 0x0, 0x3) select$auto(0xe, 0x0, 0x0, 0x0, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, 0x0) ioctl$auto_SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, 0x0) r5 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/net/vlan/config\x00', 0x0, 0x0) pread64$auto(r5, &(0x7f0000000440)='/proc-se\xa5\xc7\x19\xdb\xc0nf\xa0\xe8\x00\xbb\xc1\xfa\xbalf/net/tcp6\x00\xd2)\x8e\x892\x82\x19\xfd\x03\xc3\x8d\xd7D\bz\xde5u4\xddS\xe6\x1a\x8a`\xad0\x98|\xbc\x00\x98\b\x0ey\xcb`\x9b\x91r\xd5\x13\x9e\xdd4\xe7\xb7\x94P\x8fBlm\x04eAW\xbc0\x9b\xbd\x8f\xf5];\x94\x18\xf0\v\xd7\xf4P\xd3\x9e,Q\xd8\x16\x989l\x03\a\xcc\x1e\xb9\xe9{\xeeS\xa9\xc60\x00\xb5&\x9e\xdbk{F\x18\xa8\xa3\xedfx\xec\xab\xa4\xdf}o\xde\x0e5\xd2\xb2*G\xd3\x80\xb1G.\xec1\x96uP\x97\x8co\xf1\xa6\xd5\xea\xc8L3|a\xb3\xaa\x90~Y\xb19\xad\xdc\x05o\x98g\xd4\x10]5\x95\xd0\xabJC\x06\xd0c\xd1Ra\xf7\xc4n\xdf\xe4\xc7\x03\x19x\xbb\v\x00\t\xde\xf5\x93\xfb\xfb#\xbd\xc0S\f57\x83\xdd\xaa\xf0\x9c\xd3G\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x00oL\xcct\x89\xbch\'\xef\x93*\xc7\xb67\x997.\xc61\xb5\xb0\xaa\x10\x02\xb2>l8\x14\xad\x8c\x8fE8\xaf\xf3#g\xb7T\xe2\xd3\xd0.\xf7q\xc6/i\xb7\x9d\xe7\xbfd(Q0\x0ep\x1c?J\xe5\xa6\xfaoj\x14\x11\xa5#A\x19\xf9\x05\xe7\xcaq\xaaia\f\xaf\xe5\x1a\x8fCk*d\xf5\x84\x81/\xcd\x87+Z\xac\x01wR\x10e*\xe4g#\xa8\xf3\xcc(V\x92\xf9\x8f\xb1\xac_k\xc1K\xe4', 0x3f3, 0x100000000000009) 4.058697461s ago: executing program 2 (id=675): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000380)='/sys/kernel/debug/netdevsim/netdevsim4/health/break_health\x00', 0x80000, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card1/cable#1\x00', 0xc0f02, 0x0) r0 = mq_open$auto(&(0x7f0000000000)='\x95\bzSasezi\r\x04\xdb\x9fB]>(\xfe\xe3\xa4\xbc\xce9\xfa\xf4\x17\'\x061cd\xfcP\n\x18\x194\xd3\x92\xee\x7f\xabg^\x98DRz\xde\xfd\x11\xf4Y\xc5\xa5\xca\xdc\xfc\xf3\xa5\x93Q\xc3\xad\x89\x97*\xcb\x9e\xc5}\x95g`\x0f\xaf\xa0\xb9\x0e\x99jB\x8f{\x9d\xc9\xb0\x8f\xf0\xf0h_S\x85\xf9\x8aM\'\x11\xf0y\xdco:p\xef[&\xf97\xf2\r)\xf5\xb0\xd4K b\xd2c\x91\x14g\xa06[L\v J_:\xf4\xf7\xfa7\xa9l\x1a\xe7\xcb\xf7\x94\x8e\r|\xeag\x91H\x10\xdf\f\xaf&\x8c\x1d4\xd7o\xd7p\nlCB\xc6$\xa1\xe3\xab\xca\x1b\xdaq\xcbt(8\xe6T\xac\xdcxU#\xee\xbb\xe168\xccQi\xcc\xa58~\xf6\xfd\xfc3]\xa2)P;\xec\xb0\xbe-Z8\xd1\xfcTI\x89@\xa3\xaf\xb8\xdc\xcb\xb8\x02i\x8f\x03\x86\xcb\xc0\xbc\x06\x8b\xd30x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)={0x20, r5, 0xd0d58b333228212f, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x20}}, 0x4000000) preadv$auto(r3, &(0x7f0000000100)={&(0x7f00000000c0)="9ebb530bed4eff96e514bf", 0x2}, 0x8, 0x1, 0x5) ioctl$auto_SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000080)) close_range$auto(0x2, 0xffffffffffffffff, 0x0) openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) 2.326882005s ago: executing program 3 (id=678): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ram12\x00', 0x222a02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000280)={0x0, 0x80000000}, 0x6, 0x3, 0x4, 0x2a) ioctl$auto_BLKFLSBUF(r0, 0x1261, 0x0) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x0, 0xffb, 0x8000000008012, r1, 0x8000) mprotect$auto(0x1000, 0x401000, 0x4) mmap$auto(0x848, 0x7, 0x5, 0xfffffffffffffffb, r0, 0x2) mmap$auto(0x4, 0xa00006, 0x2, 0x100000000040eb1, 0x602, 0x300000000000) ioctl$auto_USBDEVFS_DISCSIGNAL(0xffffffffffffffff, 0x8010550e, 0x0) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) unshare$auto(0x40000080) mmap$auto(0x2, 0x202000b, 0x3, 0x1c, 0xfffffffffffffffa, 0x8) r2 = socket(0x15, 0x5, 0x0) rt_sigsuspend$auto(0x0, 0x8) sendmsg$auto_NL802154_CMD_SET_CCA_MODE(0xffffffffffffffff, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYRESDEC=r1, @ANYRESDEC=r2, @ANYBLOB="3a5a44649802c2deae62c701012bbd7000fddbdf250d0000001c0006000100000000000900e8ef6976c7009d14256c4baecaeea32d5ccc168a692debb91d939f259ae4fb80d3ee6dc1dd731b0831dd10897e358ed06757d19caec4f012cf98f492a2ae4252059199ac00ec867cded70bdd57707c0000bcccc7ae59e62ecbb754396aa8a4f6f0c6f8f3cdcff2454211fb2d554284c8e0f5c905f59ba337a4f11b0eb76379ae31001f8b1ef8e523a5865bc038d4102b4bcf0da014d3b75b65cdc43b779aaf3e585e1d38a5ea29dfa9b469bc7a7648e573cf9cbfbbacd974fa9134ae91c0b2eee0254053bf8010c7150abebfc72df22690cd0e46cebacae8c485d6178e"], 0x20}, 0x1, 0x0, 0x0, 0x60040440}, 0x4000810) close_range$auto(0x2, 0x8, 0x0) r3 = socket(0x10, 0x2, 0x4) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(r3, 0x0, 0x80) write$auto(r3, &(0x7f0000000000)='-\x00', 0xfdef) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000000400)=ANY=[@ANYBLOB="580000cfbf0d2f5d504ecb", @ANYRES8, @ANYBLOB="000428bd7080000000250200000008000900800000000e004500eecd71556377220471e700002a0005005416cf27fe10940ee223ed9f86da74b8a5540f6cc777764fb84eb8b74fd5350174f8c059d5da078abdc2762eabdefeb6945484691ea197525ef0cd6721280000bdacd9ff9339c9bac80a4d4857abd8f286758d7b62d8edd81d0ca41d13eed3f694711ff59c71de506e49f2"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x400c994) mmap$auto(0x6, 0x40009, 0x40, 0x9b72, 0x7, 0x27ffd) sendmsg$auto_TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[], 0x100}, 0x1, 0x0, 0x0, 0x20008800}, 0x42) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x15) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1000"], 0x1ac}, 0x1, 0x0, 0x0, 0x22004840}, 0x4001) 2.134820121s ago: executing program 1 (id=679): mmap$auto(0x9, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) shmctl$auto_IPC_INFO(0x5, 0x3, 0x0) sendfile$auto(0x1, 0x3, 0x0, 0x7ffff000) ioctl$auto(0x3, 0x80108907, 0x38) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x40000000000a5, 0x8000) r0 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x1000, 0x0) r1 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000000c0), 0x302, 0x0) ioctl$auto_VHOST_SET_OWNER(r1, 0xaf01, 0x5) ioctl$auto(r1, 0x4008af15, r0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) sendmsg$auto_NL802154_CMD_SET_WPAN_PHY_NETNS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram7\x00', 0x14f602, 0x0) getrandom$auto(0x0, 0x6000000, 0x3) mmap$auto(0x0, 0x810004, 0x2000000efb, 0x8000000008011, r2, 0x8000) openat$auto_snapshot_fops_user(0xffffffffffffff9c, &(0x7f0000000000), 0x488801, 0x0) prctl$auto_PR_GET_SHADOW_STACK_STATUS(0x4a, 0x101, 0x2, 0x0, 0x0) ioctl$auto_BLKRRPART(r2, 0x125f, 0x0) r3 = syz_clone(0x1080011, 0x0, 0x24, 0x0, 0x0, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000db, 0x12, 0x400, 0x18002) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x10000, r3, 0x5, 0x40000000007) madvise$auto(0x0, 0xffffffffffff0005, 0x19) getpriority$auto_PRIO_USER(0x2, 0x0) pipe2$auto(0x0, 0x80) r4 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x40, 0x4, r3, 0xffffffffffffffff, 0x3) write$auto(r4, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) socket(0x10, 0x2, 0x0) 1.871362508s ago: executing program 3 (id=680): sendmsg$auto_OVS_PACKET_CMD_EXECUTE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000306b87000fedbdf250300000004000800040003800c0016"], 0x28}}, 0x4c810) sendmsg$auto_NFSD_CMD_THREADS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0d566b3dd008e4edd96502"], 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000c4) (async) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' '], 0x1ac}}, 0x40000) (async) r0 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x44814}, 0x2004c0c4) (async) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f00000001c0), 0x7, 0xa505}, 0x800}, 0x7, 0x8) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r1) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$auto_NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="2f212cbd7000fcdbdf252100000008000300", @ANYRES32=r3, @ANYBLOB="10002c8008004b00", @ANYRES32, @ANYBLOB="1f5d7c3046e23361"], 0x2c}}, 0x4000000) 1.450973911s ago: executing program 3 (id=681): madvise$auto(0x1, 0x6, 0xbf) r0 = timerfd_create$auto(0xfffffff8, 0x9) ioctl$auto_SNDCTL_SEQ_THRESHOLD(r0, 0x4004510d, &(0x7f0000000000)="f798ac77e105d1b727c3c588147b26854e9f570f4acb94ace428fb03609d163558fcb3d563c35d141ec9f60e9a5c200616306604135fcb0a2ce7a78da19c3569fa32c59ba98d504405f710894af9dd8153143a08fff86f6468c9550ce2b10639201c4f34968dc58fde3642917ffc92d0a7cba5ce9af3a9ce3c1c86e4ab82ad8ef99196e06eebccff3ff9488701051e00ad531fc41a61fb90d9a2c5973d1a943bba624350ffbbd4e07745") inotify_add_watch$auto(r0, &(0x7f00000000c0)='./file0\x00', 0x2) madvise$auto(0x8, 0xffffffffffff8001, 0x5) getsockopt$auto_SO_RCVMARK(r0, 0x0, 0x4b, &(0x7f0000000100)='%\x00', &(0x7f0000000140)=0x7fff) ioctl$auto_MON_IOCX_GET(r0, 0x40189206, &(0x7f0000000280)={&(0x7f0000000180)={0x7fffffff, 0x1, 0x4, 0x5, 0x3, 0x3, 0x0, 0x31, 0xe, 0x9, 0x0, 0x6, 0x5, @iso={0x0, 0xc6}, 0x81, 0x2, 0x4, 0x3000000}, &(0x7f00000001c0)="f4279337d3cf4c149f759854c61454a869aca9dece45f8d4ed543791ee6c05720e789a617f3123065c55343fe7f156d101328898ad5f875be4a75e04ad4843a2fb21399f3438f0f62a19addd50349878c95833c23f800442fe3e287f40d33867e37aef212752454ffb9ec9a619f737a471842ca42ca24bb52c9c9858d146091746713d37cc7498fc5e01b38b163f1ad8bcf804ccac26501629", 0x8d7d}) r1 = socket$nl_generic(0x10, 0x3, 0x10) readv$auto(r1, &(0x7f0000000300)={&(0x7f00000002c0), 0x101}, 0x5) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000340), r0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000380)='/dev/bus/usb/039/001\x00', 0x0, 0x0) ioctl$auto_BLKTRACETEARDOWN2(r0, 0x1276, 0x0) ioctl$auto_XFS_IOC_ALLOCSP(r0, 0x4030580a, &(0x7f00000003c0)={0xdc1, 0xccb4, 0x94, 0x7a0, 0x662380bd, 0xffffffffffffffff}) r3 = fcntl$auto(r1, 0xff, r2) madvise$auto(0x6, 0x8, 0x3d) r4 = ioctl$auto_TIOCGPTPEER2(r0, 0x5441, 0x0) process_madvise$auto_MADV_KEEPONFORK(r4, &(0x7f0000000480)={&(0x7f0000000400)="09de00f02d21399fc814639bbab0b28aeb55d6e53e308b34d2fad39a837b5eb2d560bee272a6d987d67a89043a6ea2904896df1a19e9b40f3e7786dbdcc02ea7dc5b88b6a10455d46fd171e6a8d66ad47457", 0x9}, 0x0, 0x13, 0x4) close_range$auto(r4, r3, 0x400) getsockopt$auto_SO_PEERNAME(r4, 0xffff, 0x1c, &(0x7f00000004c0)='\':\x00', &(0x7f0000000500)=0x130) keyctl$auto_KEYCTL_PKEY_QUERY(0x18, 0x3, 0x7fff, 0x0, 0xa615) r5 = openat$auto_binder_fops_binder_internal(0xffffffffffffff9c, &(0x7f0000000540)='/dev/binderfs/binder0\x00', 0x0, 0x0) r6 = openat$auto_ctl_device_fops_user(0xffffffffffffff9c, &(0x7f0000000580), 0x5f6d04d5295b4b8f, 0x0) r7 = bpf$auto_BPF_OBJ_GET(0x7, &(0x7f00000005c0)=@bpf_attr_4={0x6, r1, 0x6c, r6}, 0x2) r8 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f00000006c0), r4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000700)={'hsr0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_TSCONFIG_GET(r4, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x3c, r8, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_TSCONFIG_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3ff}]}, @ETHTOOL_A_TSCONFIG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0xfffffff9}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x20008084) bpf$auto_BPF_BTF_LOAD(0x12, &(0x7f0000000800)=@info={r5, 0x1f0e, 0xff}, 0x5) r10 = openat$auto_proc_loginuid_operations_base(0xffffffffffffff9c, &(0x7f00000008c0)='/proc/thread-self/loginuid\x00', 0xf8002, 0x0) close_range$auto(r0, r10, 0x9) socketpair$auto(0xfffffff7, 0x7fffffff, 0x7, &(0x7f0000000900)=0xffffffff) 487.945186ms ago: executing program 3 (id=682): socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) mmap$auto(0x0, 0x2020009, 0x7, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0x2b, 0x1, 0x1) getsockopt$auto(r0, 0x0, 0x80, 0x0, 0x0) getsockopt$auto_SO_BUSY_POLL(r0, 0x29, 0x3a, 0x0, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400004, 0x6, 0x9b72, 0xffffffffffffffff, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x2020009, 0x7, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r2, 0x0, 0x8880) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) mmap$auto(0x2000, 0x400008, 0xdf, 0x40000000009b70, 0x2, 0x800000008000) ioctl$auto_PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f000000c380)={0x60, 0x0, 0x100000, 0x7fffffffefff, 0xfffffffffffffffe, 0x1, 0x8, 0xbff, 0x2c, 0x2c, 0x3, 0x2}) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/amidi2\x00', 0x8001, 0x0) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) mlockall$auto(0x800000000000005) msync$auto(0x1ffff000, 0x1800000ff000000, 0x400000004) r3 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r3, &(0x7f00000002c0)=""/190, 0xfffffe39) fanotify_init$auto(0x4000, 0x100002) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000002080)='/dev/sequencer2\x00', 0x1, 0x0) 449.457722ms ago: executing program 2 (id=683): r0 = socket(0xa, 0x1, 0x84) r1 = pidfd_getfd$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$auto(0x0, 0x101, 0x4000000000df, 0xeb1, r1, 0x5) write$auto_ocfs2_control_fops_stack_user(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x10, 0x2, 0xf) syz_genetlink_get_family_id$auto_nl80211(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$auto_netdev(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$auto_NETDEV_CMD_NAPI_GET(r2, 0x0, 0x4000090) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x2, 0x0) pidfd_send_signal$auto_PIDFD_SIGNAL_PROCESS_GROUP(r2, 0x9, &(0x7f0000000080)={@_si_pad}, 0x4) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r5, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) write$auto(r4, 0x0, 0xb) write$auto(r3, &(0x7f0000000380)='0\x81=\"\xad/\x8d\b\xf5\x18\xa4\xb0\xb4\xd9\x82=~\x17\xfb&L\xeb=j\a\xf1y\xb3\"\xeb\a\xdd\xf4\xf4Ry\xee\xd7\x1e\x1c\x86\x0f\xcf\x7f\xbf\xab\x12{\xc2\xc2*\xc1M+6/v8\xea\xe9\x85s4\xfe\xe5\t\x7fc\xfb7^\xb86J_\x1d1s!\x01\xff\xff\xff\xff\xff\xff\xff\x1dF\xe6\xf6\x17\x10+\xc0\xb0\xafc\x99\xd4\x150Y~\x1e\xe2\xd6x4fW\x13\xc4U`\x9e-X\xd7\xe2H^\fLS`\xfc\xbb\r\f\x00\xeaN\t\x00\x82;\x7f\xa0.\x9a\xfb\x8d\xf3l\xf2\xd3\x95\xc1M5\xcb\xa6I\x067\xe36\xea\xe9\xe3\xf44oT_`8\xb3\xef\x04 \x05K\xf9\x87pl\xac\x86\nE\xc7e\xc5Q\x89\xcd@\x1c\x92\x00\x87\x976\x9f>\xa2\xcfm\xec\r\x11\x7f\x00\x00\x00\xb1\xde@\x02\xce\x03\xb7\xb1\xfb\x9fr\v\xb2\xe3\xc7\b\x85\x00 /zm\x7f\x8fg,p\a\xc8\x7f\xa5\x87\x02\x87\xbbR=A\x00\x1f\x8a\xa7/Q\"J\xbb\xb0m\xf2SP\x84\x84S\xf0\xba\x9a\xf6\xb6`WI\xba\xba*8\x9f\xea\xe8K/\x98\xbc7~>\x12\x9buB\xcb\xe4\x8aKf\xba\x8c\x19m\xe6I\x02\xde\x80\x9d\x87}\xf4\xbd9\xaa\xd6\xdb1]\xde\xa0r\x14\xca56^\x94\xd2\xd8\xe6}9\x91\xb6\xf7\xa1=\x96\x11\xf1\\\xa91\x0e\xd1\xe4z\xc1;Pw!\x8b\xf5{\xc7Xd\xf1\xf2}\x96EVf\xc9\xa8\xcd\xe4\xc9\x8d\x1d7\xd5\x94\\\xb5\r\xd2\xaa\xe6H\xfe)\xb3a\x04\x1eRMl\xa3F\xa8W0\x90\xc9Ky#\x03\xf5~\xd2Z\xe9(\x99\b\x00\r\xde\x01]\r\xd09k\xc2\x84\xc1\xabN\x96\x8a6\x98@\xd3\xab\xa8m\xdf\x8d\x1d\b\x82\xfcP\x87\x93\x80\x97Q\x86\x8a\x9c\xf8L\x0f\xa8@VE2\x9d\x1e`#\xd8\xd7M\xd4k1\xe6\x13Y\\\x83E\xd0e\x0eM\xa9Q\xac\x0e\x1d]\a\x19H\x81\xd2\xccF\xc6\xd4\xe2R$\xfa\xd6}\xbdsN\x18\xdf\xf5\xffP\xf5\f\xccL\xef\x83\xb3$\xd4\xf4\xb5\xe6\xd0 \xb9\xa7\x8e6\t\x83q\xef\b\xd2\xdb', 0x1) r6 = socket(0x1d, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) bind$auto(0x3, &(0x7f0000000040)=@can, 0x6a) sendto$auto(r6, 0x0, 0xc, 0xfffffff8, &(0x7f0000000440)=@tipc=@nameseq={0x1d, 0x1, 0x2, {0x2, 0x0, 0x4}}, 0x36) write$auto(0x3, 0x0, 0xffd8) mmap$auto(0x0, 0x20009, 0x20004000000000df, 0xeb1, 0xffffffffffffffff, 0x8000) ioctl$auto_VHOST_SET_VRING_CALL(0xffffffffffffffff, 0x4008af21, &(0x7f0000000000)={0x8, r0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'wg2\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'pim6reg0\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'pimreg0\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'veth1_vlan\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000002ec0), 0xffffffffffffffff) 0s ago: executing program 0 (id=633): io_uring_setup$auto(0x386, &(0x7f0000000000)={0x5, 0x1, 0x4c, 0x0, 0x5, 0x8, 0xffffffffffffffff, [0xfffffffa, 0x8, 0xa], {0x8, 0x8, 0x3fc000, 0x4, 0x751, 0x3, 0x3b, 0x40000ec5, 0xffff}, {0xd5, 0x80000000, 0x1bee, 0x5d, 0x400, 0xd, 0x7, 0x8400, 0x7f}}) r1 = openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) sysfs$auto(0x2, 0x0, 0x0) r2 = fsopen$auto(0x0, 0x1) fsconfig$auto(r2, 0x8, 0x0, 0x0, 0x0) r3 = fsopen$auto(0x0, 0x1) fsconfig$auto(r3, 0x6, 0x0, 0x0, 0x0) write$auto_console_fops_tty_io(r1, &(0x7f0000000000)="c80d1b5d399b39", 0xfdef) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1f, 0x5, 0x3) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) socketpair$auto(0x1e, 0x1, 0x8000000000000000, 0x0) socket(0x11, 0xa, 0x402fd) sendmmsg$auto(0x4, 0x0, 0x9a6, 0xa) setsockopt$auto(0x3, 0x1, 0x21, 0x0, 0x9) r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/memory.force_empty\x00', 0xa001, 0x0) write$auto(r4, &(0x7f0000000080)='3\xc7\xff\xff\xff\xdd\x00\b(Ks\x0f\x87|P\x11\xd1li0\x89\x85\x90QM\xd6wfF\xf1x\xb3;c\tP\x03\x84\x97\x99\x83\x97\x81:\xf3\xa3o5\xc5\x86\xed\xa4\x18]\xa3\xc9\x0f\xff\xdak\xb0m\xe1U\xb3\xa2\xee\xdcTJQO\x98\xc8w\x8c\xe7\x00\x00\x00\x1dj\x1e\xebQT\xdd\x9b\x00'/101, 0x2000000000000008) sendmmsg$auto(0x3, 0x0, 0x9a6, 0xa00) read$auto_proc_iter_file_ops_compat_inode(0xffffffffffffffff, &(0x7f00000002c0)=""/266, 0x10a) mmap$auto(0x5, 0x2020009, 0xb, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) sendto$auto(0x3, 0x0, 0x2000f, 0x101, 0x0, 0x1c) ioctl$auto_SNDRV_PCM_IOCTL_INFO(r0, 0x81204101, &(0x7f0000000400)={0x4, 0x0, 0x200, 0x9, "ad46b93c167c163eebeaf9fac5369ae40ca94402f99fd0e0fc2ce57a0c1ca23cc13e4d0f61ad350f6bb20f8555231a5dd0a337167bfbd55c1708fd77fd72d4d4", "d0edb25bef2a01a938202e2c17a595947be2d688eda7bb7f1ba54ee1397161755e14fe9239d6ba9fe1da948de48a2355e619bfefa47d1e3e57032a449df640ac4ae92e46e466c1e29fd5d293555884b0", "b7317e0a01099c2cb876433925490aaf2d27aec9975894fbc9f8509d6b878342", 0x9, 0x0, 0x9, 0x0, '\x00', "67616cc99b4bb419ab5ff06577684da8a6c6ab7e940836c0dbca8535ca27f915b6fb5b4d5ce82edac825396ba66142cd4226ed64d9ec1490e5379c75e8e7fb8d"}) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setregid$auto(0x0, 0xffffffffffffffff) kernel console output (not intermixed with test programs): 7][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.286751][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.557158][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.579874][ T5781] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.601058][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.664060][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.689146][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.724364][ T1341] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.753307][ T1341] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.819965][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.897132][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.003049][ T5792] smpboot: CPU 1 is now offline [ 89.538495][ T5806] FAULT_INJECTION: forcing a failure. [ 89.538495][ T5806] name failslab, interval 1, probability 0, space 0, times 1 [ 89.610778][ T5809] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 89.624353][ T5806] CPU: 0 UID: 0 PID: 5806 Comm: syz.1.2 Not tainted syzkaller #0 PREEMPT(full) [ 89.624379][ T5806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 89.624394][ T5806] Call Trace: [ 89.624400][ T5806] [ 89.624405][ T5806] dump_stack_lvl+0x100/0x190 [ 89.624431][ T5806] should_fail_ex.cold+0x5/0xa [ 89.624457][ T5806] should_failslab+0xc2/0x120 [ 89.624476][ T5806] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 89.624499][ T5806] ? prepare_creds+0x2c/0x950 [ 89.624518][ T5806] prepare_creds+0x2c/0x950 [ 89.624535][ T5806] prepare_exec_creds+0x10/0x240 [ 89.624555][ T5806] bprm_execve+0xcc/0x1650 [ 89.624572][ T5806] ? alloc_bprm+0x3da/0x710 [ 89.624585][ T5806] ? alloc_bprm+0x3da/0x710 [ 89.624600][ T5806] ? __pfx_bprm_execve+0x10/0x10 [ 89.624618][ T5806] ? copy_string_kernel+0x339/0x3f0 [ 89.624641][ T5806] do_execveat_common.isra.0+0x4a5/0x580 [ 89.624664][ T5806] __x64_sys_execveat+0xdf/0x130 [ 89.624683][ T5806] do_syscall_64+0x10b/0xf80 [ 89.624703][ T5806] ? clear_bhb_loop+0x40/0x90 [ 89.624721][ T5806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.624736][ T5806] RIP: 0033:0x7f4cbd99cdd9 [ 89.624753][ T5806] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.624766][ T5806] RSP: 002b:00007f4cbe835028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 89.624781][ T5806] RAX: ffffffffffffffda RBX: 00007f4cbdc15fa0 RCX: 00007f4cbd99cdd9 [ 89.624791][ T5806] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 89.624799][ T5806] RBP: 00007f4cbda32d69 R08: 0000000000001000 R09: 0000000000000000 [ 89.624808][ T5806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.624817][ T5806] R13: 00007f4cbdc16038 R14: 00007f4cbdc15fa0 R15: 00007ffca44f0658 [ 89.624837][ T5806] [ 89.823050][ T5811] syz.0.7 uses obsolete (PF_INET,SOCK_PACKET) [ 89.922313][ T50] Bluetooth: hci1: command tx timeout [ 89.922341][ T50] Bluetooth: hci0: command tx timeout [ 89.922358][ T50] Bluetooth: hci2: command tx timeout [ 89.922374][ T50] Bluetooth: hci3: command tx timeout [ 90.533268][ T5816] FAULT_INJECTION: forcing a failure. [ 90.533268][ T5816] name fail_futex, interval 1, probability 0, space 0, times 1 [ 90.587198][ T5816] CPU: 0 UID: 0 PID: 5816 Comm: syz.3.8 Not tainted syzkaller #0 PREEMPT(full) [ 90.587219][ T5816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 90.587227][ T5816] Call Trace: [ 90.587232][ T5816] [ 90.587238][ T5816] dump_stack_lvl+0x100/0x190 [ 90.587257][ T5816] should_fail_ex.cold+0x5/0xa [ 90.587275][ T5816] get_futex_key+0x1d2/0x1510 [ 90.587292][ T5816] ? __pfx_get_futex_key+0x10/0x10 [ 90.587305][ T5816] ? lock_acquire+0x1b1/0x370 [ 90.587323][ T5816] futex_wake+0xea/0x530 [ 90.587343][ T5816] ? __pfx_futex_wake+0x10/0x10 [ 90.587360][ T5816] ? exit_mm_release+0x19/0x30 [ 90.587386][ T5816] do_futex+0x32b/0x350 [ 90.587401][ T5816] ? __pfx_do_futex+0x10/0x10 [ 90.587415][ T5816] ? __might_fault+0xc5/0x140 [ 90.587441][ T5816] mm_release+0x24a/0x2f0 [ 90.587458][ T5816] do_exit+0x707/0x2a60 [ 90.587482][ T5816] ? __pfx_do_exit+0x10/0x10 [ 90.587503][ T5816] ? do_raw_spin_lock+0x128/0x260 [ 90.587518][ T5816] ? find_held_lock+0x2b/0x80 [ 90.587536][ T5816] ? get_signal+0x7e0/0x21e0 [ 90.587555][ T5816] do_group_exit+0xd5/0x2a0 [ 90.587578][ T5816] get_signal+0x1ec7/0x21e0 [ 90.587599][ T5816] ? __might_fault+0xc5/0x140 [ 90.587621][ T5816] ? __pfx_get_signal+0x10/0x10 [ 90.587639][ T5816] ? do_futex+0x192/0x350 [ 90.587656][ T5816] arch_do_signal_or_restart+0x91/0x770 [ 90.587678][ T5816] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 90.587704][ T5816] ? __pfx___x64_sys_futex+0x10/0x10 [ 90.587726][ T5816] ? rcu_is_watching+0x12/0xc0 [ 90.587745][ T5816] exit_to_user_mode_loop+0x86/0x4a0 [ 90.587759][ T5816] ? do_syscall_64+0x519/0xf80 [ 90.587779][ T5816] do_syscall_64+0x6f2/0xf80 [ 90.587796][ T5816] ? clear_bhb_loop+0x40/0x90 [ 90.587816][ T5816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.587830][ T5816] RIP: 0033:0x7f93ed59cdd9 [ 90.587845][ T5816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.587858][ T5816] RSP: 002b:00007f93ee4790e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 90.587872][ T5816] RAX: fffffffffffffe00 RBX: 00007f93ed815fa8 RCX: 00007f93ed59cdd9 [ 90.587881][ T5816] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f93ed815fa8 [ 90.587889][ T5816] RBP: 00007f93ed815fa0 R08: 0000000000000000 R09: 0000000000000000 [ 90.587897][ T5816] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.587905][ T5816] R13: 00007f93ed816038 R14: 00007ffc4ee08370 R15: 00007ffc4ee08458 [ 90.587922][ T5816] [ 90.943467][ T5822] FAULT_INJECTION: forcing a failure. [ 90.943467][ T5822] name failslab, interval 1, probability 0, space 0, times 0 [ 90.956424][ T5822] CPU: 0 UID: 0 PID: 5822 Comm: syz.0.10 Not tainted syzkaller #0 PREEMPT(full) [ 90.956446][ T5822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 90.956454][ T5822] Call Trace: [ 90.956460][ T5822] [ 90.956465][ T5822] dump_stack_lvl+0x100/0x190 [ 90.956488][ T5822] should_fail_ex.cold+0x5/0xa [ 90.956509][ T5822] ? __alloc_empty_sheaf+0x35/0x50 [ 90.956537][ T5822] should_failslab+0xc2/0x120 [ 90.956557][ T5822] __kmalloc_noprof+0xe0/0x850 [ 90.956580][ T5822] ? __pcs_replace_empty_main+0x13a/0x650 [ 90.956604][ T5822] ? __pcs_replace_empty_main+0x13a/0x650 [ 90.956629][ T5822] __alloc_empty_sheaf+0x35/0x50 [ 90.956649][ T5822] __pcs_replace_empty_main+0x3e8/0x650 [ 90.956682][ T5822] kmem_cache_alloc_noprof+0x480/0x6e0 [ 90.956704][ T5822] ? sp_alloc+0x27/0x160 [ 90.956725][ T5822] sp_alloc+0x27/0x160 [ 90.956744][ T5822] mpol_set_shared_policy+0xa5/0x890 [ 90.956772][ T5822] ? __pfx_shmem_set_policy+0x10/0x10 [ 90.956790][ T5822] mbind_range+0x339/0x550 [ 90.956811][ T5822] do_mbind+0x7dc/0xfd0 [ 90.956833][ T5822] ? __might_fault+0xc5/0x140 [ 90.956855][ T5822] ? __pfx_do_mbind+0x10/0x10 [ 90.956877][ T5822] ? _copy_from_user+0x59/0xd0 [ 90.956908][ T5822] ? __pfx_get_nodes+0x10/0x10 [ 90.956928][ T5822] kernel_mbind+0x1b7/0x200 [ 90.956948][ T5822] ? __pfx_kernel_mbind+0x10/0x10 [ 90.956969][ T5822] ? rcu_is_watching+0x12/0xc0 [ 90.956992][ T5822] do_syscall_64+0x10b/0xf80 [ 90.957012][ T5822] ? clear_bhb_loop+0x40/0x90 [ 90.957033][ T5822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.957048][ T5822] RIP: 0033:0x7fe6d779cdd9 [ 90.957062][ T5822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.957078][ T5822] RSP: 002b:00007fe6d85f2028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 90.957094][ T5822] RAX: ffffffffffffffda RBX: 00007fe6d7a15fa0 RCX: 00007fe6d779cdd9 [ 90.957106][ T5822] RDX: 0000000000008003 RSI: 0000000000800605 RDI: 0000000000000000 [ 90.957114][ T5822] RBP: 00007fe6d7832d69 R08: 0000000000000003 R09: 0000000000000003 [ 90.957123][ T5822] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 90.957131][ T5822] R13: 00007fe6d7a16038 R14: 00007fe6d7a15fa0 R15: 00007ffea1313e48 [ 90.957150][ T5822] [ 91.432949][ T5836] FAULT_INJECTION: forcing a failure. [ 91.432949][ T5836] name failslab, interval 1, probability 0, space 0, times 0 [ 91.479794][ T5836] CPU: 0 UID: 0 PID: 5836 Comm: syz.0.13 Not tainted syzkaller #0 PREEMPT(full) [ 91.479818][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 91.479827][ T5836] Call Trace: [ 91.479833][ T5836] [ 91.479839][ T5836] dump_stack_lvl+0x100/0x190 [ 91.479860][ T5836] should_fail_ex.cold+0x5/0xa [ 91.479880][ T5836] should_failslab+0xc2/0x120 [ 91.479897][ T5836] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 91.479919][ T5836] ? security_inode_alloc+0x3b/0x2c0 [ 91.479942][ T5836] ? lockdep_init_map_type+0x5c/0x250 [ 91.479960][ T5836] security_inode_alloc+0x3b/0x2c0 [ 91.479984][ T5836] inode_init_always_gfp+0xcc0/0x1000 [ 91.480005][ T5836] alloc_inode+0x8e/0x250 [ 91.480027][ T5836] new_inode+0x22/0x1c0 [ 91.480050][ T5836] shmem_get_inode+0x1e3/0xfb0 [ 91.480071][ T5836] ? __pfx_shmem_get_inode+0x10/0x10 [ 91.480091][ T5836] ? do_raw_spin_unlock+0x145/0x1e0 [ 91.480110][ T5836] shmem_mknod+0x217/0x480 [ 91.480131][ T5836] ? __pfx_shmem_mknod+0x10/0x10 [ 91.480149][ T5836] ? bpf_lsm_inode_create+0x9/0x10 [ 91.480173][ T5836] ? __pfx_shmem_create+0x10/0x10 [ 91.480193][ T5836] lookup_open.isra.0+0xc47/0x11b0 [ 91.480212][ T5836] ? __pfx_lookup_open.isra.0+0x10/0x10 [ 91.480231][ T5836] ? __pfx___might_resched+0x10/0x10 [ 91.480247][ T5836] ? mnt_get_write_access+0x52/0x2f0 [ 91.480273][ T5836] ? __pfx_down_write+0x10/0x10 [ 91.480293][ T5836] ? mnt_get_write_access+0x1e9/0x2f0 [ 91.480318][ T5836] path_openat+0x2291/0x31a0 [ 91.480348][ T5836] ? entry_SYSCALL_64_after_hwframe+0x48/0x7f [ 91.480366][ T5836] ? __pfx_path_openat+0x10/0x10 [ 91.480391][ T5836] do_file_open+0x20e/0x430 [ 91.480411][ T5836] ? __pfx_do_file_open+0x10/0x10 [ 91.480442][ T5836] ? _raw_spin_unlock+0x28/0x50 [ 91.480457][ T5836] ? alloc_fd+0x476/0x790 [ 91.480479][ T5836] do_sys_openat2+0x10d/0x1e0 [ 91.480502][ T5836] ? __pfx_do_sys_openat2+0x10/0x10 [ 91.480530][ T5836] __x64_sys_open+0xfe/0x1d0 [ 91.480551][ T5836] ? __pfx___x64_sys_open+0x10/0x10 [ 91.480572][ T5836] ? ksys_read+0x1ac/0x250 [ 91.480590][ T5836] ? rcu_is_watching+0x12/0xc0 [ 91.480610][ T5836] do_syscall_64+0x10b/0xf80 [ 91.480627][ T5836] ? clear_bhb_loop+0x40/0x90 [ 91.480644][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.480659][ T5836] RIP: 0033:0x7fe6d779cdd9 [ 91.480672][ T5836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.480686][ T5836] RSP: 002b:00007fe6d85f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 91.480700][ T5836] RAX: ffffffffffffffda RBX: 00007fe6d7a15fa0 RCX: 00007fe6d779cdd9 [ 91.480710][ T5836] RDX: 0000000000000154 RSI: 0000000000022240 RDI: 0000200000000800 [ 91.480718][ T5836] RBP: 00007fe6d7832d69 R08: 0000000000000000 R09: 0000000000000000 [ 91.480727][ T5836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.480736][ T5836] R13: 00007fe6d7a16038 R14: 00007fe6d7a15fa0 R15: 00007ffea1313e48 [ 91.480758][ T5836] [ 91.999306][ T5843] FAULT_INJECTION: forcing a failure. [ 91.999306][ T5843] name failslab, interval 1, probability 0, space 0, times 0 [ 92.013436][ T5843] CPU: 0 UID: 0 PID: 5843 Comm: syz.3.17 Not tainted syzkaller #0 PREEMPT(full) [ 92.013456][ T5843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 92.013465][ T5843] Call Trace: [ 92.013470][ T5843] [ 92.013476][ T5843] dump_stack_lvl+0x100/0x190 [ 92.013497][ T5843] should_fail_ex.cold+0x5/0xa [ 92.013516][ T5843] should_failslab+0xc2/0x120 [ 92.013533][ T5843] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 92.013556][ T5843] ? sock_alloc_inode+0x26/0x290 [ 92.013577][ T5843] ? __pfx_sock_alloc_inode+0x10/0x10 [ 92.013595][ T5843] sock_alloc_inode+0x26/0x290 [ 92.013612][ T5843] ? __pfx_sock_alloc_inode+0x10/0x10 [ 92.013629][ T5843] alloc_inode+0x68/0x250 [ 92.013651][ T5843] sock_alloc+0x44/0x280 [ 92.013666][ T5843] ? security_socket_create+0x7f/0x250 [ 92.013688][ T5843] sock_create_lite+0x82/0x120 [ 92.013706][ T5843] __netlink_kernel_create+0xbd/0x750 [ 92.013727][ T5843] ? __pfx___netlink_kernel_create+0x10/0x10 [ 92.013752][ T5843] fib_net_init+0x26d/0x3f0 [ 92.013769][ T5843] ? is_module_address+0x69/0xf0 [ 92.013784][ T5843] ? __pfx_fib_net_init+0x10/0x10 [ 92.013801][ T5843] ? timer_init_key+0x155/0x330 [ 92.013821][ T5843] ? __pfx_nl_fib_input+0x10/0x10 [ 92.013840][ T5843] ? devinet_init_net+0x56c/0x8d0 [ 92.013861][ T5843] ? __pfx_fib_net_init+0x10/0x10 [ 92.013877][ T5843] ops_init+0x1e2/0x5f0 [ 92.013895][ T5843] setup_net+0x118/0x3a0 [ 92.013911][ T5843] ? __pfx_setup_net+0x10/0x10 [ 92.013927][ T5843] ? mutex_init_lockdep+0xf1/0x120 [ 92.013946][ T5843] copy_net_ns+0x46f/0x7c0 [ 92.013965][ T5843] create_new_namespaces+0x3ea/0xac0 [ 92.013988][ T5843] unshare_nsproxy_namespaces+0xf2/0x220 [ 92.014008][ T5843] ksys_unshare+0x438/0xab0 [ 92.014031][ T5843] ? __pfx_ksys_unshare+0x10/0x10 [ 92.014050][ T5843] ? xfd_validate_state+0x129/0x190 [ 92.014071][ T5843] __x64_sys_unshare+0x31/0x40 [ 92.014092][ T5843] do_syscall_64+0x10b/0xf80 [ 92.014110][ T5843] ? clear_bhb_loop+0x40/0x90 [ 92.014127][ T5843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.014142][ T5843] RIP: 0033:0x7f93ed59cdd9 [ 92.014156][ T5843] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.014169][ T5843] RSP: 002b:00007f93ee479028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 92.014183][ T5843] RAX: ffffffffffffffda RBX: 00007f93ed815fa0 RCX: 00007f93ed59cdd9 [ 92.014193][ T5843] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 92.014202][ T5843] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 92.014211][ T5843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.014219][ T5843] R13: 00007f93ed816038 R14: 00007f93ed815fa0 R15: 00007ffc4ee08458 [ 92.014246][ T5843] [ 94.190499][ T5883] random: crng reseeded on system resumption [ 94.598339][ T5883] hub 1-0:1.0: USB hub found [ 94.728519][ T5883] hub 1-0:1.0: 1 port detected [ 96.585958][ T5917] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 96.631423][ T5917] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 96.719526][ T5917] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 96.788400][ T5917] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 96.834327][ T5917] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 96.888083][ T5917] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 96.934569][ T5917] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 96.967703][ T5917] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 97.023642][ T5917] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 97.078928][ T5917] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 97.118987][ T5917] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 97.181347][ T5917] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 97.606791][ T5960] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 97.694853][ T5960] vivid-008: ================= START STATUS ================= [ 97.760949][ T5960] vivid-008: ================== END STATUS ================== [ 98.044959][ T5636] Bluetooth: hci0: command 0x0c1a tx timeout [ 98.845296][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 99.005146][ T5636] Bluetooth: hci2: command 0x0c1a tx timeout [ 99.030408][ T5961] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 99.085227][ T5636] Bluetooth: hci3: command 0x0c1a tx timeout [ 99.527099][ T5995] Zero length message leads to an empty skb [ 99.586821][ T5995] mmap: syz.0.37 (5995) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 99.981314][ T6008] sg_write: data in/out 262108/256 bytes for SCSI command 0x61-- guessing data in; [ 99.981314][ T6008] program syz.1.40 not setting count and/or reply_len properly [ 100.125658][ T5636] Bluetooth: hci0: command 0x0c1a tx timeout [ 100.388768][ T6011] netlink: 8 bytes leftover after parsing attributes in process `syz.1.40'. [ 100.425302][ T5636] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 100.925588][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 101.084864][ T5636] Bluetooth: hci2: command 0x0c1a tx timeout [ 101.165084][ T5636] Bluetooth: hci3: command 0x0c1a tx timeout [ 101.281534][ T6035] FAULT_INJECTION: forcing a failure. [ 101.281534][ T6035] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 101.350979][ T6035] CPU: 0 UID: 0 PID: 6035 Comm: syz.2.45 Not tainted syzkaller #0 PREEMPT(full) [ 101.351003][ T6035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 101.351012][ T6035] Call Trace: [ 101.351017][ T6035] [ 101.351023][ T6035] dump_stack_lvl+0x100/0x190 [ 101.351045][ T6035] should_fail_ex.cold+0x5/0xa [ 101.351061][ T6035] ? prepare_alloc_pages+0x16d/0x5f0 [ 101.351082][ T6035] should_fail_alloc_page+0xeb/0x140 [ 101.351101][ T6035] prepare_alloc_pages+0x1f0/0x5f0 [ 101.351119][ T6035] ? __kernel_text_address+0xd/0x30 [ 101.351137][ T6035] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 101.351164][ T6035] ? __lock_acquire+0x4a5/0x2630 [ 101.351178][ T6035] ? stack_trace_save+0x8e/0xc0 [ 101.351199][ T6035] ? __pfx_stack_trace_save+0x10/0x10 [ 101.351218][ T6035] ? __pfx_number+0x10/0x10 [ 101.351239][ T6035] ? stack_depot_save_flags+0x27/0x9d0 [ 101.351257][ T6035] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 101.351299][ T6035] ? __pfx_css_rstat_updated+0x10/0x10 [ 101.351322][ T6035] ? try_charge_memcg+0x365/0xdf0 [ 101.351343][ T6035] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 101.351367][ T6035] ? policy_nodemask+0xed/0x4f0 [ 101.351386][ T6035] alloc_pages_mpol+0x1fb/0x540 [ 101.351404][ T6035] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 101.351420][ T6035] ? __memcg_slab_post_alloc_hook+0x734/0xff0 [ 101.351442][ T6035] alloc_pages_noprof+0x1a/0x160 [ 101.351461][ T6035] pgd_alloc+0x4d/0x630 [ 101.351480][ T6035] ? mutex_init_lockdep+0xf1/0x120 [ 101.351497][ T6035] mm_init+0x6da/0x10d0 [ 101.351517][ T6035] mm_alloc+0x97/0xd0 [ 101.351537][ T6035] alloc_bprm+0x2af/0x710 [ 101.351554][ T6035] do_execveat_common.isra.0+0x19c/0x580 [ 101.351571][ T6035] ? do_getname+0x191/0x390 [ 101.351592][ T6035] __x64_sys_execveat+0xdf/0x130 [ 101.351610][ T6035] do_syscall_64+0x10b/0xf80 [ 101.351628][ T6035] ? clear_bhb_loop+0x40/0x90 [ 101.351645][ T6035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.351660][ T6035] RIP: 0033:0x7f34cf99cdd9 [ 101.351673][ T6035] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.351686][ T6035] RSP: 002b:00007f34d0888028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 101.351702][ T6035] RAX: ffffffffffffffda RBX: 00007f34cfc15fa0 RCX: 00007f34cf99cdd9 [ 101.351711][ T6035] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 101.351720][ T6035] RBP: 00007f34cfa32d69 R08: 0000000000001000 R09: 0000000000000000 [ 101.351728][ T6035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.351736][ T6035] R13: 00007f34cfc16038 R14: 00007f34cfc15fa0 R15: 00007ffc09f9c8d8 [ 101.351755][ T6035] [ 101.812278][ T6043] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 102.206181][ T5636] Bluetooth: hci0: command 0x0c1a tx timeout [ 102.232018][ T6027] random: crng reseeded on system resumption [ 103.005467][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.164916][ T5636] Bluetooth: hci2: command 0x0c1a tx timeout [ 103.245241][ T5636] Bluetooth: hci3: command 0x0c1a tx timeout [ 103.718146][ T6073] sg_write: data in/out 262108/249 bytes for SCSI command 0x61-- guessing data in; [ 103.718146][ T6073] program syz.0.50 not setting count and/or reply_len properly [ 104.286575][ T5636] Bluetooth: hci0: command 0x0c1a tx timeout [ 104.308954][ T6073] netlink: 8 bytes leftover after parsing attributes in process `syz.0.50'. [ 105.140256][ T6089] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 105.353003][ T6089] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 105.494126][ T6089] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 105.743892][ T6089] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 106.607523][ T6094] sg_write: data in/out 262108/249 bytes for SCSI command 0x61-- guessing data in; [ 106.607523][ T6094] program syz.1.55 not setting count and/or reply_len properly [ 107.165089][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 107.331867][ T6094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.55'. [ 107.405634][ T50] Bluetooth: hci1: command 0x0c1a tx timeout [ 107.565020][ T50] Bluetooth: hci2: command 0x0c1a tx timeout [ 107.804881][ T50] Bluetooth: hci3: command 0x0c1a tx timeout [ 107.885728][ T6127] sg_write: data in/out 262108/239 bytes for SCSI command 0x61-- guessing data in; [ 107.885728][ T6127] program syz.2.61 not setting count and/or reply_len properly [ 108.242672][ T6129] netlink: 8 bytes leftover after parsing attributes in process `syz.2.61'. [ 109.353029][ T6116] random: crng reseeded on system resumption [ 110.353696][ T6166] netlink: 4 bytes leftover after parsing attributes in process `syz.2.67'. [ 110.836344][ T6153] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 110.886886][ T6153] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 110.913280][ T6153] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 110.939645][ T6153] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 111.502083][ T6174] ======================================================= [ 111.502083][ T6174] WARNING: The mand mount option has been deprecated and [ 111.502083][ T6174] and is ignored by this kernel. Remove the mand [ 111.502083][ T6174] option from the mount to silence this warning. [ 111.502083][ T6174] ======================================================= [ 111.502122][ T6174] nfsd: Unknown parameter '%e VFsod͍47DZ|>rW>[44s]O' [ 112.125618][ T50] Bluetooth: hci0: command 0x0c1a tx timeout [ 112.419041][ T6202] random: crng reseeded on system resumption [ 112.925702][ T50] Bluetooth: hci2: command 0x0c1a tx timeout [ 112.931742][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 113.011789][ T50] Bluetooth: hci3: command 0x0c1a tx timeout [ 114.444166][ T6250] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 114.883203][ T6262] random: crng reseeded on system resumption [ 114.980049][ T6262] hub 1-0:1.0: USB hub found [ 115.013250][ T6262] hub 1-0:1.0: 1 port detected [ 115.531561][ T6266] FAULT_INJECTION: forcing a failure. [ 115.531561][ T6266] name failslab, interval 1, probability 0, space 0, times 0 [ 115.740626][ T6266] CPU: 0 UID: 0 PID: 6266 Comm: syz.3.86 Not tainted syzkaller #0 PREEMPT(full) [ 115.740648][ T6266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 115.740657][ T6266] Call Trace: [ 115.740662][ T6266] [ 115.740668][ T6266] dump_stack_lvl+0x100/0x190 [ 115.740688][ T6266] should_fail_ex.cold+0x5/0xa [ 115.740709][ T6266] should_failslab+0xc2/0x120 [ 115.740726][ T6266] __kmalloc_cache_noprof+0x7a/0x6f0 [ 115.740747][ T6266] ? resv_map_alloc+0x7e/0x400 [ 115.740766][ T6266] resv_map_alloc+0x7e/0x400 [ 115.740782][ T6266] hugetlbfs_get_inode+0x385/0x700 [ 115.740801][ T6266] ? security_capable+0x80/0x260 [ 115.740825][ T6266] hugetlb_file_setup+0x3cc/0x5b0 [ 115.740849][ T6266] newseg+0xaf0/0xed0 [ 115.740870][ T6266] ? __pfx_newseg+0x10/0x10 [ 115.740886][ T6266] ? down_write+0x146/0x1f0 [ 115.740912][ T6266] ipcget+0xee/0xf50 [ 115.740937][ T6266] ? do_futex+0x192/0x350 [ 115.740954][ T6266] ? __pfx_do_futex+0x10/0x10 [ 115.740973][ T6266] ? __pfx_ipcget+0x10/0x10 [ 115.740991][ T6266] ? __x64_sys_futex+0x34f/0x4d0 [ 115.741006][ T6266] ? __x64_sys_futex+0x358/0x4d0 [ 115.741025][ T6266] __x64_sys_shmget+0x13b/0x1b0 [ 115.741044][ T6266] ? __pfx___x64_sys_shmget+0x10/0x10 [ 115.741063][ T6266] ? rcu_is_watching+0x12/0xc0 [ 115.741083][ T6266] do_syscall_64+0x10b/0xf80 [ 115.741101][ T6266] ? clear_bhb_loop+0x40/0x90 [ 115.741119][ T6266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.741133][ T6266] RIP: 0033:0x7f93ed59cdd9 [ 115.741146][ T6266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.741160][ T6266] RSP: 002b:00007f93ee437028 EFLAGS: 00000246 ORIG_RAX: 000000000000001d [ 115.741174][ T6266] RAX: ffffffffffffffda RBX: 00007f93ed816180 RCX: 00007f93ed59cdd9 [ 115.741184][ T6266] RDX: 0000000079e56dc9 RSI: 0000000000000003 RDI: 0000000100000000 [ 115.741192][ T6266] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 115.741201][ T6266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.741209][ T6266] R13: 00007f93ed816218 R14: 00007f93ed816180 R15: 00007ffc4ee08458 [ 115.741229][ T6266] [ 116.993413][ T6303] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 117.253549][ T6306] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 117.253549][ T6306] program syz.1.95 not setting count and/or reply_len properly [ 117.658679][ T6315] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 118.353938][ T6326] netlink: 20 bytes leftover after parsing attributes in process `syz.0.98'. [ 118.648669][ T6330] netlink: 28 bytes leftover after parsing attributes in process `syz.2.99'. [ 118.972755][ T6292] kexec: Could not allocate control_code_buffer [ 119.380891][ T6350] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 119.380891][ T6350] program syz.1.105 not setting count and/or reply_len properly [ 119.707940][ T6365] FAULT_INJECTION: forcing a failure. [ 119.707940][ T6365] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 119.825005][ T6365] CPU: 0 UID: 0 PID: 6365 Comm: syz.2.106 Not tainted syzkaller #0 PREEMPT(full) [ 119.825028][ T6365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 119.825037][ T6365] Call Trace: [ 119.825042][ T6365] [ 119.825048][ T6365] dump_stack_lvl+0x100/0x190 [ 119.825069][ T6365] should_fail_ex.cold+0x5/0xa [ 119.825086][ T6365] ? prepare_alloc_pages+0x16d/0x5f0 [ 119.825110][ T6365] should_fail_alloc_page+0xeb/0x140 [ 119.825129][ T6365] prepare_alloc_pages+0x1f0/0x5f0 [ 119.825147][ T6365] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 119.825170][ T6365] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 119.825195][ T6365] ? unwind_get_return_address+0x59/0xa0 [ 119.825215][ T6365] ? arch_stack_walk+0xa6/0xf0 [ 119.825240][ T6365] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 119.825263][ T6365] ? __pfx_stack_trace_save+0x10/0x10 [ 119.825282][ T6365] ? __alloc_frozen_pages_noprof+0x2b1/0x2bc0 [ 119.825305][ T6365] ? arch_stack_walk+0xa6/0xf0 [ 119.825327][ T6365] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 119.825349][ T6365] ? __pmd_alloc+0xbf/0x950 [ 119.825366][ T6365] ? __handle_mm_fault+0xa9c/0x2a00 [ 119.825385][ T6365] ? handle_mm_fault+0x36d/0xa20 [ 119.825404][ T6365] ? __get_user_pages+0x1178/0x32a0 [ 119.825420][ T6365] ? get_user_pages_remote+0x3d2/0xb10 [ 119.825437][ T6365] ? get_arg_page+0xf4/0x310 [ 119.825461][ T6365] ? copy_string_kernel+0x17d/0x3f0 [ 119.825475][ T6365] ? do_execveat_common.isra.0+0x2e6/0x580 [ 119.825491][ T6365] ? __x64_sys_execveat+0xdf/0x130 [ 119.825506][ T6365] ? do_syscall_64+0x10b/0xf80 [ 119.825525][ T6365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.825540][ T6365] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 119.825562][ T6365] ? policy_nodemask+0xed/0x4f0 [ 119.825580][ T6365] alloc_pages_mpol+0x1fb/0x540 [ 119.825597][ T6365] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 119.825616][ T6365] ? __lock_acquire+0x4a5/0x2630 [ 119.825632][ T6365] alloc_pages_noprof+0x1a/0x160 [ 119.825651][ T6365] pte_alloc_one+0x1c/0x3d0 [ 119.825671][ T6365] __pte_alloc+0x6d/0x3e0 [ 119.825687][ T6365] ? __pfx___pte_alloc+0x10/0x10 [ 119.825703][ T6365] ? do_raw_spin_lock+0x128/0x260 [ 119.825719][ T6365] ? find_held_lock+0x2b/0x80 [ 119.825739][ T6365] do_anonymous_page+0x13c6/0x2050 [ 119.825762][ T6365] ? __pmd_alloc+0x3fb/0x950 [ 119.825782][ T6365] __handle_mm_fault+0x1d2c/0x2a00 [ 119.825806][ T6365] ? mt_find+0x45e/0x8e0 [ 119.825826][ T6365] ? __pfx___handle_mm_fault+0x10/0x10 [ 119.825846][ T6365] ? __pfx_mt_find+0x10/0x10 [ 119.825880][ T6365] handle_mm_fault+0x36d/0xa20 [ 119.825905][ T6365] __get_user_pages+0x1178/0x32a0 [ 119.825930][ T6365] ? __pfx___get_user_pages+0x10/0x10 [ 119.825953][ T6365] get_user_pages_remote+0x3d2/0xb10 [ 119.825974][ T6365] ? __pfx_get_user_pages_remote+0x10/0x10 [ 119.825993][ T6365] ? __pfx_create_init_stack_vma+0x10/0x10 [ 119.826013][ T6365] get_arg_page+0xf4/0x310 [ 119.826028][ T6365] ? __pfx_get_arg_page+0x10/0x10 [ 119.826043][ T6365] ? alloc_bprm+0x3da/0x710 [ 119.826057][ T6365] ? alloc_bprm+0x3da/0x710 [ 119.826073][ T6365] copy_string_kernel+0x17d/0x3f0 [ 119.826089][ T6365] ? alloc_bprm+0x420/0x710 [ 119.826105][ T6365] do_execveat_common.isra.0+0x2e6/0x580 [ 119.826125][ T6365] __x64_sys_execveat+0xdf/0x130 [ 119.826142][ T6365] do_syscall_64+0x10b/0xf80 [ 119.826159][ T6365] ? clear_bhb_loop+0x40/0x90 [ 119.826177][ T6365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.826192][ T6365] RIP: 0033:0x7f34cf99cdd9 [ 119.826205][ T6365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.826226][ T6365] RSP: 002b:00007f34d0888028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 119.826241][ T6365] RAX: ffffffffffffffda RBX: 00007f34cfc15fa0 RCX: 00007f34cf99cdd9 [ 119.826250][ T6365] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 119.826259][ T6365] RBP: 00007f34cfa32d69 R08: 0000000000001000 R09: 0000000000000000 [ 119.826268][ T6365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.826276][ T6365] R13: 00007f34cfc16038 R14: 00007f34cfc15fa0 R15: 00007ffc09f9c8d8 [ 119.826295][ T6365] [ 119.826462][ T6350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.105'. [ 120.577075][ T6377] netlink: 25 bytes leftover after parsing attributes in process `syz.3.109'. [ 121.035661][ T12] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.729715][ T6410] FAULT_INJECTION: forcing a failure. [ 121.729715][ T6410] name failslab, interval 1, probability 0, space 0, times 0 [ 121.819773][ T6410] CPU: 0 UID: 0 PID: 6410 Comm: syz.0.117 Not tainted syzkaller #0 PREEMPT(full) [ 121.819797][ T6410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 121.819807][ T6410] Call Trace: [ 121.819812][ T6410] [ 121.819818][ T6410] dump_stack_lvl+0x100/0x190 [ 121.819838][ T6410] should_fail_ex.cold+0x5/0xa [ 121.819859][ T6410] should_failslab+0xc2/0x120 [ 121.819876][ T6410] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 121.819899][ T6410] ? ptlock_alloc+0x1f/0x70 [ 121.819924][ T6410] ? __lock_acquire+0x4a5/0x2630 [ 121.819945][ T6410] ptlock_alloc+0x1f/0x70 [ 121.819966][ T6410] pte_alloc_one+0x82/0x3d0 [ 121.819991][ T6410] __pte_alloc+0x6d/0x3e0 [ 121.820008][ T6410] ? __pfx___pte_alloc+0x10/0x10 [ 121.820025][ T6410] ? do_raw_spin_lock+0x128/0x260 [ 121.820041][ T6410] ? find_held_lock+0x2b/0x80 [ 121.820060][ T6410] do_anonymous_page+0x13c6/0x2050 [ 121.820084][ T6410] ? __pmd_alloc+0x3fb/0x950 [ 121.820104][ T6410] __handle_mm_fault+0x1d2c/0x2a00 [ 121.820129][ T6410] ? mt_find+0x45e/0x8e0 [ 121.820149][ T6410] ? __pfx___handle_mm_fault+0x10/0x10 [ 121.820169][ T6410] ? __pfx_mt_find+0x10/0x10 [ 121.820203][ T6410] handle_mm_fault+0x36d/0xa20 [ 121.820235][ T6410] __get_user_pages+0x1178/0x32a0 [ 121.820262][ T6410] ? __pfx___get_user_pages+0x10/0x10 [ 121.820286][ T6410] get_user_pages_remote+0x3d2/0xb10 [ 121.820308][ T6410] ? __pfx_get_user_pages_remote+0x10/0x10 [ 121.820327][ T6410] ? __pfx_create_init_stack_vma+0x10/0x10 [ 121.820348][ T6410] get_arg_page+0xf4/0x310 [ 121.820364][ T6410] ? __pfx_get_arg_page+0x10/0x10 [ 121.820380][ T6410] ? alloc_bprm+0x3da/0x710 [ 121.820393][ T6410] ? alloc_bprm+0x3da/0x710 [ 121.820409][ T6410] copy_string_kernel+0x17d/0x3f0 [ 121.820425][ T6410] ? alloc_bprm+0x420/0x710 [ 121.820441][ T6410] do_execveat_common.isra.0+0x2e6/0x580 [ 121.820461][ T6410] __x64_sys_execveat+0xdf/0x130 [ 121.820479][ T6410] do_syscall_64+0x10b/0xf80 [ 121.820497][ T6410] ? clear_bhb_loop+0x40/0x90 [ 121.820514][ T6410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.820529][ T6410] RIP: 0033:0x7fe6d779cdd9 [ 121.820542][ T6410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.820556][ T6410] RSP: 002b:00007fe6d85f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 121.820571][ T6410] RAX: ffffffffffffffda RBX: 00007fe6d7a15fa0 RCX: 00007fe6d779cdd9 [ 121.820580][ T6410] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 121.820589][ T6410] RBP: 00007fe6d7832d69 R08: 0000000000001000 R09: 0000000000000000 [ 121.820597][ T6410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 121.820605][ T6410] R13: 00007fe6d7a16038 R14: 00007fe6d7a15fa0 R15: 00007ffea1313e48 [ 121.820625][ T6410] [ 122.376317][ T6430] i2c i2c-0: delete_device: Can't find device in list [ 122.564969][ T50] Bluetooth: hci2: unexpected event 0x33 length: 124 > 10 [ 122.594538][ T6440] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 122.594538][ T6440] program syz.0.123 not setting count and/or reply_len properly [ 123.022883][ T6440] netlink: 8 bytes leftover after parsing attributes in process `syz.0.123'. [ 124.037914][ T6476] FAULT_INJECTION: forcing a failure. [ 124.037914][ T6476] name failslab, interval 1, probability 0, space 0, times 0 [ 124.098206][ T6476] CPU: 0 UID: 0 PID: 6476 Comm: syz.1.128 Not tainted syzkaller #0 PREEMPT(full) [ 124.098229][ T6476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 124.098237][ T6476] Call Trace: [ 124.098243][ T6476] [ 124.098249][ T6476] dump_stack_lvl+0x100/0x190 [ 124.098271][ T6476] should_fail_ex.cold+0x5/0xa [ 124.098291][ T6476] should_failslab+0xc2/0x120 [ 124.098308][ T6476] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 124.098330][ T6476] ? ptlock_alloc+0x1f/0x70 [ 124.098350][ T6476] ? __lock_acquire+0x4a5/0x2630 [ 124.098367][ T6476] ptlock_alloc+0x1f/0x70 [ 124.098387][ T6476] pte_alloc_one+0x82/0x3d0 [ 124.098407][ T6476] __pte_alloc+0x6d/0x3e0 [ 124.098423][ T6476] ? __pfx___pte_alloc+0x10/0x10 [ 124.098439][ T6476] ? do_raw_spin_lock+0x128/0x260 [ 124.098455][ T6476] ? find_held_lock+0x2b/0x80 [ 124.098475][ T6476] do_anonymous_page+0x13c6/0x2050 [ 124.098499][ T6476] ? __pmd_alloc+0x3fb/0x950 [ 124.098518][ T6476] __handle_mm_fault+0x1d2c/0x2a00 [ 124.098542][ T6476] ? mt_find+0x45e/0x8e0 [ 124.098563][ T6476] ? __pfx___handle_mm_fault+0x10/0x10 [ 124.098582][ T6476] ? __pfx_mt_find+0x10/0x10 [ 124.098616][ T6476] handle_mm_fault+0x36d/0xa20 [ 124.098641][ T6476] __get_user_pages+0x1178/0x32a0 [ 124.098666][ T6476] ? __pfx___get_user_pages+0x10/0x10 [ 124.098689][ T6476] get_user_pages_remote+0x3d2/0xb10 [ 124.098710][ T6476] ? __pfx_get_user_pages_remote+0x10/0x10 [ 124.098729][ T6476] ? __pfx_create_init_stack_vma+0x10/0x10 [ 124.098750][ T6476] get_arg_page+0xf4/0x310 [ 124.098765][ T6476] ? __pfx_get_arg_page+0x10/0x10 [ 124.098780][ T6476] ? alloc_bprm+0x3da/0x710 [ 124.098794][ T6476] ? alloc_bprm+0x3da/0x710 [ 124.098810][ T6476] copy_string_kernel+0x17d/0x3f0 [ 124.098826][ T6476] ? alloc_bprm+0x420/0x710 [ 124.098842][ T6476] do_execveat_common.isra.0+0x2e6/0x580 [ 124.098870][ T6476] __x64_sys_execveat+0xdf/0x130 [ 124.098888][ T6476] do_syscall_64+0x10b/0xf80 [ 124.098907][ T6476] ? clear_bhb_loop+0x40/0x90 [ 124.098926][ T6476] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.098941][ T6476] RIP: 0033:0x7f4cbd99cdd9 [ 124.098953][ T6476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.098967][ T6476] RSP: 002b:00007f4cbe835028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 124.098981][ T6476] RAX: ffffffffffffffda RBX: 00007f4cbdc15fa0 RCX: 00007f4cbd99cdd9 [ 124.098991][ T6476] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 124.099000][ T6476] RBP: 00007f4cbda32d69 R08: 0000000000001000 R09: 0000000000000000 [ 124.099008][ T6476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 124.099017][ T6476] R13: 00007f4cbdc16038 R14: 00007f4cbdc15fa0 R15: 00007ffca44f0658 [ 124.099040][ T6476] [ 125.320654][ T6510] FAULT_INJECTION: forcing a failure. [ 125.320654][ T6510] name failslab, interval 1, probability 0, space 0, times 0 [ 125.320705][ T6510] CPU: 0 UID: 0 PID: 6510 Comm: syz.1.135 Not tainted syzkaller #0 PREEMPT(full) [ 125.320722][ T6510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 125.320730][ T6510] Call Trace: [ 125.320734][ T6510] [ 125.320740][ T6510] dump_stack_lvl+0x100/0x190 [ 125.320759][ T6510] should_fail_ex.cold+0x5/0xa [ 125.320777][ T6510] ? kernfs_fop_write_iter+0x26a/0x5f0 [ 125.320800][ T6510] should_failslab+0xc2/0x120 [ 125.320823][ T6510] __kmalloc_noprof+0xe0/0x850 [ 125.320849][ T6510] kernfs_fop_write_iter+0x26a/0x5f0 [ 125.320877][ T6510] vfs_write+0x6ac/0x1070 [ 125.320894][ T6510] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 125.320924][ T6510] ? __pfx_vfs_write+0x10/0x10 [ 125.320954][ T6510] ksys_write+0x12a/0x250 [ 125.320970][ T6510] ? __pfx_ksys_write+0x10/0x10 [ 125.320987][ T6510] ? rcu_is_watching+0x12/0xc0 [ 125.321007][ T6510] do_syscall_64+0x10b/0xf80 [ 125.321025][ T6510] ? clear_bhb_loop+0x40/0x90 [ 125.321042][ T6510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.321056][ T6510] RIP: 0033:0x7f4cbd99cdd9 [ 125.321068][ T6510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.321081][ T6510] RSP: 002b:00007f4cbe814028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 125.321094][ T6510] RAX: ffffffffffffffda RBX: 00007f4cbdc16090 RCX: 00007f4cbd99cdd9 [ 125.321103][ T6510] RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003 [ 125.321111][ T6510] RBP: 00007f4cbe814090 R08: 0000000000000000 R09: 0000000000000000 [ 125.321119][ T6510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.321126][ T6510] R13: 00007f4cbdc16128 R14: 00007f4cbdc16090 R15: 00007ffca44f0658 [ 125.321147][ T6510] [ 125.728748][ T6515] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 125.728748][ T6515] program syz.0.136 not setting count and/or reply_len properly [ 125.944530][ T6515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.136'. [ 127.764133][ T6567] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 127.764133][ T6567] program syz.1.145 not setting count and/or reply_len properly [ 127.976043][ T6571] FAULT_INJECTION: forcing a failure. [ 127.976043][ T6571] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 128.080613][ T6574] netlink: 8 bytes leftover after parsing attributes in process `syz.1.145'. [ 128.128937][ T6571] CPU: 0 UID: 0 PID: 6571 Comm: syz.2.146 Not tainted syzkaller #0 PREEMPT(full) [ 128.128958][ T6571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 128.128966][ T6571] Call Trace: [ 128.128972][ T6571] [ 128.128977][ T6571] dump_stack_lvl+0x100/0x190 [ 128.128998][ T6571] should_fail_ex.cold+0x5/0xa [ 128.129017][ T6571] _copy_from_iter+0x1f4/0x1690 [ 128.129035][ T6571] ? __pfx__copy_from_iter+0x10/0x10 [ 128.129048][ T6571] ? rcu_is_watching+0x12/0xc0 [ 128.129066][ T6571] ? trace_kmalloc+0xe3/0x110 [ 128.129082][ T6571] ? __kasan_kmalloc+0xaa/0xb0 [ 128.129096][ T6571] ? __kmalloc_noprof+0x320/0x850 [ 128.129122][ T6571] kernfs_fop_write_iter+0x186/0x5f0 [ 128.129145][ T6571] vfs_write+0x6ac/0x1070 [ 128.129162][ T6571] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 128.129183][ T6571] ? __pfx_vfs_write+0x10/0x10 [ 128.129211][ T6571] ksys_write+0x12a/0x250 [ 128.129226][ T6571] ? __pfx_ksys_write+0x10/0x10 [ 128.129244][ T6571] ? rcu_is_watching+0x12/0xc0 [ 128.129262][ T6571] do_syscall_64+0x10b/0xf80 [ 128.129280][ T6571] ? clear_bhb_loop+0x40/0x90 [ 128.129298][ T6571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.129312][ T6571] RIP: 0033:0x7f34cf99cdd9 [ 128.129324][ T6571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 128.129337][ T6571] RSP: 002b:00007f34d0867028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 128.129350][ T6571] RAX: ffffffffffffffda RBX: 00007f34cfc16090 RCX: 00007f34cf99cdd9 [ 128.129359][ T6571] RDX: 000000000000000b RSI: 00002000000002c0 RDI: 0000000000000003 [ 128.129368][ T6571] RBP: 00007f34d0867090 R08: 0000000000000000 R09: 0000000000000000 [ 128.129376][ T6571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 128.129383][ T6571] R13: 00007f34cfc16128 R14: 00007f34cfc16090 R15: 00007ffc09f9c8d8 [ 128.129403][ T6571] [ 128.962375][ T6578] FAULT_INJECTION: forcing a failure. [ 128.962375][ T6578] name failslab, interval 1, probability 0, space 0, times 0 [ 129.021131][ T6578] CPU: 0 UID: 0 PID: 6578 Comm: syz.0.147 Not tainted syzkaller #0 PREEMPT(full) [ 129.021154][ T6578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 129.021163][ T6578] Call Trace: [ 129.021168][ T6578] [ 129.021174][ T6578] dump_stack_lvl+0x100/0x190 [ 129.021194][ T6578] should_fail_ex.cold+0x5/0xa [ 129.021214][ T6578] should_failslab+0xc2/0x120 [ 129.021231][ T6578] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 129.021258][ T6578] ? sock_alloc_inode+0x26/0x290 [ 129.021279][ T6578] ? __pfx_sock_alloc_inode+0x10/0x10 [ 129.021298][ T6578] sock_alloc_inode+0x26/0x290 [ 129.021315][ T6578] ? __pfx_sock_alloc_inode+0x10/0x10 [ 129.021332][ T6578] alloc_inode+0x68/0x250 [ 129.021355][ T6578] sock_alloc+0x44/0x280 [ 129.021370][ T6578] ? security_socket_create+0x7f/0x250 [ 129.021393][ T6578] __sock_create+0xc2/0x860 [ 129.021415][ T6578] __sys_socket+0x14d/0x260 [ 129.021436][ T6578] ? __pfx___sys_socket+0x10/0x10 [ 129.021462][ T6578] __x64_sys_socket+0x72/0xb0 [ 129.021481][ T6578] ? lockdep_hardirqs_on+0x78/0x100 [ 129.021500][ T6578] do_syscall_64+0x10b/0xf80 [ 129.021517][ T6578] ? clear_bhb_loop+0x40/0x90 [ 129.021535][ T6578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.021550][ T6578] RIP: 0033:0x7fe6d779cdd9 [ 129.021563][ T6578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.021584][ T6578] RSP: 002b:00007fe6d85d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 129.021599][ T6578] RAX: ffffffffffffffda RBX: 00007fe6d7a16090 RCX: 00007fe6d779cdd9 [ 129.021609][ T6578] RDX: 0010000000000002 RSI: 0000000000000002 RDI: 2000000000000021 [ 129.021618][ T6578] RBP: 00007fe6d7832d69 R08: 0000000000000000 R09: 0000000000000000 [ 129.021627][ T6578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 129.021636][ T6578] R13: 00007fe6d7a16128 R14: 00007fe6d7a16090 R15: 00007ffea1313e48 [ 129.021655][ T6578] [ 129.254577][ T6578] socket: no more sockets [ 131.320135][ T6643] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 131.320135][ T6643] program syz.0.159 not setting count and/or reply_len properly [ 131.767165][ T6651] FAULT_INJECTION: forcing a failure. [ 131.767165][ T6651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 131.856180][ T6643] netlink: 8 bytes leftover after parsing attributes in process `syz.0.159'. [ 131.960032][ T6651] CPU: 0 UID: 0 PID: 6651 Comm: syz.1.161 Not tainted syzkaller #0 PREEMPT(full) [ 131.960054][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 131.960062][ T6651] Call Trace: [ 131.960068][ T6651] [ 131.960074][ T6651] dump_stack_lvl+0x100/0x190 [ 131.960094][ T6651] should_fail_ex.cold+0x5/0xa [ 131.960113][ T6651] _copy_to_user+0x32/0xd0 [ 131.960128][ T6651] simple_read_from_buffer+0xcb/0x170 [ 131.960146][ T6651] proc_fail_nth_read+0x1af/0x230 [ 131.960170][ T6651] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 131.960193][ T6651] ? rw_verify_area+0xce/0x6d0 [ 131.960206][ T6651] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 131.960228][ T6651] vfs_read+0x1e4/0xb30 [ 131.960253][ T6651] ? __pfx_vfs_read+0x10/0x10 [ 131.960268][ T6651] ? __fget_files+0x215/0x3d0 [ 131.960289][ T6651] ? __fget_files+0x21f/0x3d0 [ 131.960310][ T6651] ksys_read+0x12a/0x250 [ 131.960325][ T6651] ? __pfx_ksys_read+0x10/0x10 [ 131.960342][ T6651] ? rcu_is_watching+0x12/0xc0 [ 131.960362][ T6651] do_syscall_64+0x10b/0xf80 [ 131.960380][ T6651] ? clear_bhb_loop+0x40/0x90 [ 131.960398][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.960412][ T6651] RIP: 0033:0x7f4cbd95d60e [ 131.960424][ T6651] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 131.960437][ T6651] RSP: 002b:00007f4cbe834fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 131.960451][ T6651] RAX: ffffffffffffffda RBX: 00007f4cbe8356c0 RCX: 00007f4cbd95d60e [ 131.960460][ T6651] RDX: 000000000000000f RSI: 00007f4cbe8350a0 RDI: 0000000000000005 [ 131.960468][ T6651] RBP: 00007f4cbe835090 R08: 0000000000000000 R09: 0000000000000000 [ 131.960475][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.960486][ T6651] R13: 00007f4cbdc16038 R14: 00007f4cbdc15fa0 R15: 00007ffca44f0658 [ 131.960504][ T6651] [ 132.852483][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.863663][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.102119][ T6728] ubi0: attaching mtd0 [ 134.156258][ T6728] ubi0: scanning is finished [ 134.176699][ T6728] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 134.794659][ T6728] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 134.891185][ T6745] capability: warning: `syz.0.178' uses 32-bit capabilities (legacy support in use) [ 136.273444][ T6781] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 136.273444][ T6781] program syz.1.187 not setting count and/or reply_len properly [ 136.748368][ T6781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.187'. [ 137.434228][ T6811] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 137.434228][ T6811] The task syz.3.191 (6811) triggered the difference, watch for misbehavior. [ 137.543260][ T5636] Bluetooth: hci2: unexpected event 0x01 length: 124 > 1 [ 137.962892][ T6833] netlink: 346 bytes leftover after parsing attributes in process `syz.3.195'. [ 138.168806][ T6835] FAULT_INJECTION: forcing a failure. [ 138.168806][ T6835] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 138.210392][ T6835] CPU: 0 UID: 0 PID: 6835 Comm: syz.3.196 Not tainted syzkaller #0 PREEMPT(full) [ 138.210415][ T6835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 138.210424][ T6835] Call Trace: [ 138.210430][ T6835] [ 138.210436][ T6835] dump_stack_lvl+0x100/0x190 [ 138.210457][ T6835] should_fail_ex.cold+0x5/0xa [ 138.210474][ T6835] ? prepare_alloc_pages+0x16d/0x5f0 [ 138.210496][ T6835] should_fail_alloc_page+0xeb/0x140 [ 138.210514][ T6835] prepare_alloc_pages+0x1f0/0x5f0 [ 138.210535][ T6835] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 138.210561][ T6835] ? __lock_acquire+0x4a5/0x2630 [ 138.210576][ T6835] ? kasan_save_stack+0x3f/0x50 [ 138.210590][ T6835] ? kasan_save_stack+0x30/0x50 [ 138.210602][ T6835] ? kasan_save_track+0x14/0x30 [ 138.210615][ T6835] ? __kasan_slab_alloc+0x89/0x90 [ 138.210629][ T6835] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 138.210658][ T6835] ? ptlock_alloc+0x1f/0x70 [ 138.210678][ T6835] ? pte_alloc_one+0x82/0x3d0 [ 138.210697][ T6835] ? __pte_alloc+0x6d/0x3e0 [ 138.210712][ T6835] ? copy_page_range+0x3dbb/0x5b00 [ 138.210735][ T6835] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 138.210762][ T6835] ? __lock_acquire+0x4a5/0x2630 [ 138.210779][ T6835] ? __lock_acquire+0x4a5/0x2630 [ 138.210794][ T6835] ? __lock_acquire+0x4a5/0x2630 [ 138.210807][ T6835] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 138.210829][ T6835] ? policy_nodemask+0xed/0x4f0 [ 138.210848][ T6835] alloc_pages_mpol+0x1fb/0x540 [ 138.210865][ T6835] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 138.210887][ T6835] alloc_pages_noprof+0x1a/0x160 [ 138.210907][ T6835] pte_alloc_one+0x1c/0x3d0 [ 138.210929][ T6835] __pte_alloc+0x6d/0x3e0 [ 138.210945][ T6835] ? __pfx___pte_alloc+0x10/0x10 [ 138.210960][ T6835] ? __pfx___might_resched+0x10/0x10 [ 138.210976][ T6835] ? copy_page_range+0x1c2d/0x5b00 [ 138.210999][ T6835] copy_page_range+0x3dbb/0x5b00 [ 138.211040][ T6835] ? mas_wr_store_entry+0xa1/0x1e80 [ 138.211063][ T6835] ? __pfx_copy_page_range+0x10/0x10 [ 138.211091][ T6835] ? __pfx___might_resched+0x10/0x10 [ 138.211113][ T6835] ? up_write+0x28c/0x4f0 [ 138.211131][ T6835] dup_mmap+0xd25/0x2180 [ 138.211158][ T6835] ? __pfx_dup_mmap+0x10/0x10 [ 138.211174][ T6835] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 138.211196][ T6835] ? __lock_acquire+0x4a5/0x2630 [ 138.211210][ T6835] ? find_held_lock+0x2b/0x80 [ 138.211228][ T6835] ? __percpu_counter_init_many+0x2bc/0x3b0 [ 138.211259][ T6835] copy_process+0x6c63/0x7e00 [ 138.211290][ T6835] ? __pfx_copy_process+0x10/0x10 [ 138.211310][ T6835] ? find_held_lock+0x2b/0x80 [ 138.211331][ T6835] ? futex_private_hash_put+0x107/0x1c0 [ 138.211350][ T6835] kernel_clone+0x12e/0x9c0 [ 138.211371][ T6835] ? __pfx_kernel_clone+0x10/0x10 [ 138.211402][ T6835] __do_sys_clone+0xd9/0x120 [ 138.211422][ T6835] ? __pfx___do_sys_clone+0x10/0x10 [ 138.211454][ T6835] ? rcu_is_watching+0x12/0xc0 [ 138.211473][ T6835] do_syscall_64+0x10b/0xf80 [ 138.211491][ T6835] ? clear_bhb_loop+0x40/0x90 [ 138.211509][ T6835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.211524][ T6835] RIP: 0033:0x7f93ed59cdd9 [ 138.211537][ T6835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.211551][ T6835] RSP: 002b:00007f93ee479028 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 138.211567][ T6835] RAX: ffffffffffffffda RBX: 00007f93ed815fa0 RCX: 00007f93ed59cdd9 [ 138.211577][ T6835] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 138.211585][ T6835] RBP: 00007f93ed632d69 R08: 0000000000000003 R09: 0000000000000000 [ 138.211594][ T6835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.211602][ T6835] R13: 00007f93ed816038 R14: 00007f93ed815fa0 R15: 00007ffc4ee08458 [ 138.211622][ T6835] [ 139.392872][ T6845] FAULT_INJECTION: forcing a failure. [ 139.392872][ T6845] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 139.471729][ T6845] CPU: 0 UID: 0 PID: 6845 Comm: syz.0.198 Not tainted syzkaller #0 PREEMPT(full) [ 139.471752][ T6845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 139.471761][ T6845] Call Trace: [ 139.471765][ T6845] [ 139.471771][ T6845] dump_stack_lvl+0x100/0x190 [ 139.471791][ T6845] should_fail_ex.cold+0x5/0xa [ 139.471809][ T6845] _copy_from_iter+0x1f4/0x1690 [ 139.471826][ T6845] ? __asan_memset+0x23/0x50 [ 139.471848][ T6845] ? __pfx__copy_from_iter+0x10/0x10 [ 139.471861][ T6845] ? __pfx___alloc_skb+0x10/0x10 [ 139.471875][ T6845] ? apparmor_capable+0x1d7/0x4d0 [ 139.471902][ T6845] netlink_sendmsg+0x808/0xda0 [ 139.471925][ T6845] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.471942][ T6845] ? __import_iovec+0x1d2/0x640 [ 139.471957][ T6845] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 139.471980][ T6845] ____sys_sendmsg+0x9e1/0xb70 [ 139.471998][ T6845] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.472018][ T6845] ? __pfx_____sys_sendmsg+0x10/0x10 [ 139.472040][ T6845] ? __pfx_futex_wake_mark+0x10/0x10 [ 139.472062][ T6845] ___sys_sendmsg+0x190/0x1e0 [ 139.472083][ T6845] ? __pfx____sys_sendmsg+0x10/0x10 [ 139.472123][ T6845] __sys_sendmsg+0x170/0x220 [ 139.472138][ T6845] ? __pfx___sys_sendmsg+0x10/0x10 [ 139.472152][ T6845] ? __x64_sys_futex+0x34f/0x4d0 [ 139.472174][ T6845] ? rcu_is_watching+0x12/0xc0 [ 139.472194][ T6845] do_syscall_64+0x10b/0xf80 [ 139.472212][ T6845] ? clear_bhb_loop+0x40/0x90 [ 139.472229][ T6845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.472244][ T6845] RIP: 0033:0x7fe6d779cdd9 [ 139.472257][ T6845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.472269][ T6845] RSP: 002b:00007fe6d85b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 139.472283][ T6845] RAX: ffffffffffffffda RBX: 00007fe6d7a16180 RCX: 00007fe6d779cdd9 [ 139.472292][ T6845] RDX: 0000000020040824 RSI: 0000200000000440 RDI: 0000000000000006 [ 139.472300][ T6845] RBP: 00007fe6d7832d69 R08: 0000000000000000 R09: 0000000000000000 [ 139.472308][ T6845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.472316][ T6845] R13: 00007fe6d7a16218 R14: 00007fe6d7a16180 R15: 00007ffea1313e48 [ 139.472333][ T6845] [ 142.350276][ T6889] NFSD: Failed to start, no listeners configured. [ 142.648191][ T6891] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 142.648191][ T6891] program syz.0.209 not setting count and/or reply_len properly [ 143.154930][ T6891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.209'. [ 144.100922][ T6936] netlink: zone id is out of range [ 144.388834][ T6939] zswap: compressor not available [ 144.660011][ T6958] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 144.660011][ T6958] program syz.3.222 not setting count and/or reply_len properly [ 144.979243][ T6962] netlink: 8 bytes leftover after parsing attributes in process `syz.3.222'. [ 146.878071][ T7022] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 146.878071][ T7022] program syz.3.235 not setting count and/or reply_len properly [ 147.290045][ T7022] netlink: 8 bytes leftover after parsing attributes in process `syz.3.235'. [ 148.168579][ T7054] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 149.098215][ T7088] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 149.098215][ T7088] program syz.3.247 not setting count and/or reply_len properly [ 149.623041][ T7088] netlink: 8 bytes leftover after parsing attributes in process `syz.3.247'. [ 152.694578][ T7172] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 152.694578][ T7172] program syz.0.261 not setting count and/or reply_len properly [ 153.078177][ T7172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.261'. [ 154.879155][ T30] audit: type=1800 audit(1778131592.072:2): pid=7224 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.268" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 154.906494][ T7224] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 154.948680][ T7224] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 154.994422][ T7224] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 155.164433][ T7224] syz.3.268 (7224) used greatest stack depth: 19928 bytes left [ 157.154400][ T5636] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 157.177688][ T7277] vivid-008: ================= START STATUS ================= [ 157.290636][ T7277] vivid-008: ================== END STATUS ================== [ 157.488456][ T7282] FAULT_INJECTION: forcing a failure. [ 157.488456][ T7282] name failslab, interval 1, probability 0, space 0, times 0 [ 157.502055][ T7282] CPU: 0 UID: 0 PID: 7282 Comm: syz.0.282 Not tainted syzkaller #0 PREEMPT(full) [ 157.502077][ T7282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 157.502086][ T7282] Call Trace: [ 157.502093][ T7282] [ 157.502099][ T7282] dump_stack_lvl+0x100/0x190 [ 157.502121][ T7282] should_fail_ex.cold+0x5/0xa [ 157.502141][ T7282] should_failslab+0xc2/0x120 [ 157.502159][ T7282] __kmalloc_cache_noprof+0x7a/0x6f0 [ 157.502179][ T7282] ? tipc_service_create+0xb1/0x340 [ 157.502204][ T7282] tipc_service_create+0xb1/0x340 [ 157.502223][ T7282] ? tipc_service_find+0x161/0x1c0 [ 157.502245][ T7282] tipc_nametbl_subscribe+0x892/0xa80 [ 157.502271][ T7282] ? __pfx_tipc_nametbl_subscribe+0x10/0x10 [ 157.502295][ T7282] ? lockdep_init_map_type+0x5c/0x250 [ 157.502313][ T7282] tipc_sub_subscribe+0x4ba/0x730 [ 157.502335][ T7282] tipc_conn_rcv_sub+0x21e/0x3d0 [ 157.502354][ T7282] tipc_topsrv_kern_subscr+0x20b/0x3c0 [ 157.502373][ T7282] ? __pfx_tipc_topsrv_kern_subscr+0x10/0x10 [ 157.502393][ T7282] ? net_generic+0xea/0x2a0 [ 157.502414][ T7282] tipc_group_create+0x4ab/0x660 [ 157.502435][ T7282] tipc_setsockopt+0x611/0xe30 [ 157.502459][ T7282] ? __pfx_tipc_setsockopt+0x10/0x10 [ 157.502488][ T7282] ? __pfx_tipc_setsockopt+0x10/0x10 [ 157.502511][ T7282] do_sock_setsockopt+0xf3/0x1d0 [ 157.502532][ T7282] __sys_setsockopt+0x119/0x190 [ 157.502550][ T7282] __x64_sys_setsockopt+0xbd/0x160 [ 157.502564][ T7282] ? do_syscall_64+0x90/0xf80 [ 157.502581][ T7282] ? lockdep_hardirqs_on+0x78/0x100 [ 157.502599][ T7282] do_syscall_64+0x10b/0xf80 [ 157.502617][ T7282] ? clear_bhb_loop+0x40/0x90 [ 157.502634][ T7282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.502649][ T7282] RIP: 0033:0x7fe6d779cdd9 [ 157.502663][ T7282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.502677][ T7282] RSP: 002b:00007fe6d85f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 157.502691][ T7282] RAX: ffffffffffffffda RBX: 00007fe6d7a15fa0 RCX: 00007fe6d779cdd9 [ 157.502712][ T7282] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000003 [ 157.502721][ T7282] RBP: 00007fe6d7832d69 R08: 0000000000000014 R09: 0000000000000000 [ 157.502729][ T7282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 157.502738][ T7282] R13: 00007fe6d7a16038 R14: 00007fe6d7a15fa0 R15: 00007ffea1313e48 [ 157.502758][ T7282] [ 157.503207][ T7282] tipc: Service creation failed, no memory [ 157.747380][ T7282] tipc: Failed to subscribe for {3630115232,0,4294967295} [ 158.216703][ T7276] random: crng reseeded on system resumption [ 158.748980][ T7293] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 159.135209][ T7309] ubi0: attaching mtd0 [ 159.246157][ T50] Bluetooth: hci1: command 0x0c1a tx timeout [ 159.260974][ T7309] ubi0: scanning is finished [ 159.337155][ T7309] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 159.678927][ T7323] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 159.678927][ T7323] program syz.2.290 not setting count and/or reply_len properly [ 159.746025][ T7309] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 160.523805][ T7323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.290'. [ 161.218691][ T30] audit: type=1800 audit(1778131598.422:3): pid=7358 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.297" name="dbroot" dev="configfs" ino=16574 res=0 errno=0 [ 161.278326][ T7358] netlink: 342 bytes leftover after parsing attributes in process `syz.1.297'. [ 161.325866][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 161.863250][ T7378] ptrace attach of "ci-qemu-gce-upstream-auto/syz-executor exec"[7385] was attempted by "ci-qemu-gce-upstream-auto/syz-executor exec"[7378] [ 161.900548][ T7368] FAULT_INJECTION: forcing a failure. [ 161.900548][ T7368] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 162.004359][ T7368] CPU: 0 UID: 0 PID: 7368 Comm: syz.2.298 Not tainted syzkaller #0 PREEMPT(full) [ 162.004381][ T7368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 162.004391][ T7368] Call Trace: [ 162.004396][ T7368] [ 162.004402][ T7368] dump_stack_lvl+0x100/0x190 [ 162.004424][ T7368] should_fail_ex.cold+0x5/0xa [ 162.004440][ T7368] ? prepare_alloc_pages+0x16d/0x5f0 [ 162.004461][ T7368] should_fail_alloc_page+0xeb/0x140 [ 162.004479][ T7368] prepare_alloc_pages+0x1f0/0x5f0 [ 162.004501][ T7368] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 162.004525][ T7368] ? rcu_is_watching+0x12/0xc0 [ 162.004545][ T7368] ? __lock_acquire+0x4a5/0x2630 [ 162.004562][ T7368] ? __lock_acquire+0x4a5/0x2630 [ 162.004574][ T7368] ? css_rstat_updated+0x1ce/0x5a0 [ 162.004597][ T7368] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 162.004623][ T7368] ? do_raw_spin_lock+0x128/0x260 [ 162.004639][ T7368] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 162.004656][ T7368] ? find_held_lock+0x2b/0x80 [ 162.004680][ T7368] ? __lock_acquire+0x4a5/0x2630 [ 162.004694][ T7368] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 162.004715][ T7368] ? policy_nodemask+0xed/0x4f0 [ 162.004737][ T7368] alloc_pages_mpol+0x1fb/0x540 [ 162.004754][ T7368] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 162.004771][ T7368] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 162.004786][ T7368] ? __folio_batch_add_and_move+0x5e5/0xc60 [ 162.004804][ T7368] folio_alloc_mpol_noprof+0x36/0x260 [ 162.004824][ T7368] shmem_alloc_folio+0x135/0x160 [ 162.004845][ T7368] shmem_alloc_and_add_folio+0x371/0xd40 [ 162.004873][ T7368] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 162.004897][ T7368] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 162.004916][ T7368] shmem_get_folio_gfp+0x6ab/0x1900 [ 162.004941][ T7368] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 162.004962][ T7368] shmem_write_begin+0x1a4/0x420 [ 162.004979][ T7368] ? __pfx_shmem_write_begin+0x10/0x10 [ 162.004995][ T7368] ? balance_dirty_pages_ratelimited_flags+0x91/0x1170 [ 162.005019][ T7368] generic_perform_write+0x292/0xa40 [ 162.005047][ T7368] ? __pfx_generic_perform_write+0x10/0x10 [ 162.005066][ T7368] ? __mark_inode_dirty+0x55c/0x1720 [ 162.005083][ T7368] ? mnt_put_write_access_file+0x4e/0x100 [ 162.005101][ T7368] ? file_update_time_flags+0x373/0x500 [ 162.005124][ T7368] shmem_file_write_iter+0x10e/0x140 [ 162.005143][ T7368] vfs_write+0x6ac/0x1070 [ 162.005160][ T7368] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 162.005179][ T7368] ? __pfx_vfs_write+0x10/0x10 [ 162.005208][ T7368] ksys_write+0x12a/0x250 [ 162.005224][ T7368] ? __pfx_ksys_write+0x10/0x10 [ 162.005248][ T7368] ? rcu_is_watching+0x12/0xc0 [ 162.005269][ T7368] do_syscall_64+0x10b/0xf80 [ 162.005288][ T7368] ? clear_bhb_loop+0x40/0x90 [ 162.005307][ T7368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 162.005322][ T7368] RIP: 0033:0x7f34cf99cdd9 [ 162.005335][ T7368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 162.005348][ T7368] RSP: 002b:00007f34d0888028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 162.005363][ T7368] RAX: ffffffffffffffda RBX: 00007f34cfc15fa0 RCX: 00007f34cf99cdd9 [ 162.005373][ T7368] RDX: 0000000000100082 RSI: 0000000000000000 RDI: 0000000000000003 [ 162.005382][ T7368] RBP: 00007f34cfa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 162.005391][ T7368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 162.005399][ T7368] R13: 00007f34cfc16038 R14: 00007f34cfc15fa0 R15: 00007ffc09f9c8d8 [ 162.005419][ T7368] [ 164.048419][ T7418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.306'. [ 164.668022][ T7430] i2c i2c-0: delete_device: Can't find device in list [ 165.791602][ T7459] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 165.791602][ T7459] program syz.0.314 not setting count and/or reply_len properly [ 166.244191][ T7459] netlink: 8 bytes leftover after parsing attributes in process `syz.0.314'. [ 168.024014][ T7498] vivid-008: ================= START STATUS ================= [ 168.055607][ T7498] vivid-008: ================== END STATUS ================== [ 169.120327][ T7529] bridge0: port 3(netdevsim3) entered blocking state [ 169.188530][ T7529] bridge0: port 3(netdevsim3) entered disabled state [ 169.270790][ T7529] netdevsim netdevsim2 netdevsim3: entered allmulticast mode [ 169.389479][ T7529] netdevsim netdevsim2 netdevsim3: entered promiscuous mode [ 169.476245][ T7529] bridge0: port 3(netdevsim3) entered blocking state [ 169.483976][ T7529] bridge0: port 3(netdevsim3) entered forwarding state [ 170.113909][ T7550] sg_write: data in/out 704643034/2147479500 bytes for SCSI command 0x9d-- guessing data in; [ 170.113909][ T7550] program syz.2.330 not setting count and/or reply_len properly [ 170.967474][ T7585] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 170.967474][ T7585] program syz.1.337 not setting count and/or reply_len properly [ 171.350825][ T7585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.337'. [ 172.657520][ T7630] netlink: 20 bytes leftover after parsing attributes in process `syz.0.345'. [ 173.180238][ T7646] unchecked MSR access error: WRMSR to 0x418 (tried to write 0x0000000000000322) at rIP: 0xffffffff81b0da7a (__mcheck_cpu_init_prepare_banks+0x18a/0x380) [ 173.195855][ T7646] Call Trace: [ 173.199131][ T7646] [ 173.202053][ T7646] ? __pfx___mcheck_cpu_init_prepare_banks+0x10/0x10 [ 173.208731][ T7646] mce_cpu_restart+0xd5/0x1f0 [ 173.213394][ T7646] ? __pfx_mce_cpu_restart+0x10/0x10 [ 173.218667][ T7646] smp_call_function_many_cond+0x13d4/0x1700 [ 173.224669][ T7646] ? __pfx_mce_cpu_restart+0x10/0x10 [ 173.229941][ T7646] ? mark_held_locks+0x40/0x70 [ 173.234699][ T7646] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 173.240493][ T7646] ? lockdep_hardirqs_on+0x78/0x100 [ 173.245680][ T7646] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 173.251474][ T7646] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 173.257806][ T7646] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 173.263789][ T7646] ? __timer_delete_sync+0x151/0x1c0 [ 173.269065][ T7646] ? __pfx_mce_cpu_restart+0x10/0x10 [ 173.274336][ T7646] on_each_cpu_cond_mask+0x40/0x90 [ 173.279440][ T7646] set_bank+0x240/0x3a0 [ 173.283580][ T7646] ? __pfx_set_bank+0x10/0x10 [ 173.288240][ T7646] ? find_held_lock+0x2b/0x80 [ 173.292930][ T7646] ? sysfs_file_kobj+0xe4/0x290 [ 173.297774][ T7646] ? sysfs_file_kobj+0xe4/0x290 [ 173.302616][ T7646] ? __pfx_set_bank+0x10/0x10 [ 173.307275][ T7646] dev_attr_store+0x58/0x80 [ 173.311767][ T7646] ? __pfx_dev_attr_store+0x10/0x10 [ 173.316951][ T7646] sysfs_kf_write+0xf2/0x150 [ 173.321534][ T7646] kernfs_fop_write_iter+0x3e0/0x5f0 [ 173.326808][ T7646] ? __pfx_sysfs_kf_write+0x10/0x10 [ 173.331999][ T7646] vfs_write+0x6ac/0x1070 [ 173.336317][ T7646] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 173.342151][ T7646] ? __pfx_vfs_write+0x10/0x10 [ 173.346912][ T7646] ksys_write+0x12a/0x250 [ 173.351231][ T7646] ? __pfx_ksys_write+0x10/0x10 [ 173.356076][ T7646] ? rcu_is_watching+0x12/0xc0 [ 173.360833][ T7646] do_syscall_64+0x10b/0xf80 [ 173.365422][ T7646] ? clear_bhb_loop+0x40/0x90 [ 173.370086][ T7646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 173.375963][ T7646] RIP: 0033:0x7f34cf99cdd9 [ 173.380361][ T7646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.400560][ T7646] RSP: 002b:00007f34d0888028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 173.408959][ T7646] RAX: ffffffffffffffda RBX: 00007f34cfc15fa0 RCX: 00007f34cf99cdd9 [ 173.416912][ T7646] RDX: 0000000000000003 RSI: 0000200000000240 RDI: 0000000000000004 [ 173.424868][ T7646] RBP: 00007f34cfa32d69 R08: 0000000000000000 R09: 0000000000000000 [ 173.432820][ T7646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 173.440771][ T7646] R13: 00007f34cfc16038 R14: 00007f34cfc15fa0 R15: 00007ffc09f9c8d8 [ 173.448735][ T7646] [ 173.460920][ T7639] netlink: 338 bytes leftover after parsing attributes in process `syz.0.347'. [ 175.101198][ T7694] netlink: 82 bytes leftover after parsing attributes in process `syz.0.359'. [ 175.249720][ T7694] netlink: 338 bytes leftover after parsing attributes in process `syz.0.359'. [ 175.643926][ T7700] FAULT_INJECTION: forcing a failure. [ 175.643926][ T7700] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 175.754222][ T7700] CPU: 0 UID: 0 PID: 7700 Comm: syz.3.361 Not tainted syzkaller #0 PREEMPT(full) [ 175.754245][ T7700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 175.754253][ T7700] Call Trace: [ 175.754258][ T7700] [ 175.754264][ T7700] dump_stack_lvl+0x100/0x190 [ 175.754285][ T7700] should_fail_ex.cold+0x5/0xa [ 175.754302][ T7700] ? prepare_alloc_pages+0x16d/0x5f0 [ 175.754323][ T7700] should_fail_alloc_page+0xeb/0x140 [ 175.754341][ T7700] prepare_alloc_pages+0x1f0/0x5f0 [ 175.754359][ T7700] ? __lock_acquire+0x4a5/0x2630 [ 175.754375][ T7700] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 175.754405][ T7700] ? find_held_lock+0x2b/0x80 [ 175.754427][ T7700] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 175.754454][ T7700] ? is_bpf_text_address+0x94/0x1a0 [ 175.754474][ T7700] ? kernel_text_address+0x8d/0x100 [ 175.754491][ T7700] ? __kernel_text_address+0xd/0x30 [ 175.754512][ T7700] ? find_held_lock+0x2b/0x80 [ 175.754531][ T7700] ? mark_held_locks+0x40/0x70 [ 175.754544][ T7700] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 175.754566][ T7700] ? policy_nodemask+0xed/0x4f0 [ 175.754584][ T7700] alloc_pages_mpol+0x1fb/0x540 [ 175.754601][ T7700] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 175.754617][ T7700] ? kasan_save_stack+0x30/0x50 [ 175.754630][ T7700] ? __kasan_kmalloc+0xaa/0xb0 [ 175.754643][ T7700] ? __get_vm_area_node+0x101/0x330 [ 175.754659][ T7700] ? __vmalloc_node_range_noprof+0x228/0x1630 [ 175.754682][ T7700] alloc_pages_noprof+0x1a/0x160 [ 175.754702][ T7700] get_free_pages_noprof+0x10/0xb0 [ 175.754733][ T7700] __kasan_populate_vmalloc+0xa0/0x210 [ 175.754765][ T7700] alloc_vmap_area+0x95d/0x2b70 [ 175.754790][ T7700] ? __pfx_alloc_vmap_area+0x10/0x10 [ 175.754813][ T7700] __get_vm_area_node+0x1ca/0x330 [ 175.754835][ T7700] __vmalloc_node_range_noprof+0x228/0x1630 [ 175.754855][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 175.754877][ T7700] ? putname+0xb6/0x110 [ 175.754897][ T7700] ? do_file_open_root+0x42d/0x5a0 [ 175.754918][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 175.754937][ T7700] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 175.754961][ T7700] ? ima_read_file+0x149/0x1b0 [ 175.754982][ T7700] ? __pfx_ima_read_file+0x10/0x10 [ 175.755009][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 175.755021][ T7700] __vmalloc_node_noprof+0xad/0xf0 [ 175.755040][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 175.755056][ T7700] kernel_read_file+0x77e/0x9a0 [ 175.755072][ T7700] ? __pfx_kernel_read_file+0x10/0x10 [ 175.755093][ T7700] kernel_read_file_from_path_initns+0x1cf/0x260 [ 175.755111][ T7700] ? __pfx_kernel_read_file_from_path_initns+0x10/0x10 [ 175.755134][ T7700] _request_firmware+0x733/0x13c0 [ 175.755166][ T7700] ? __pfx__request_firmware+0x10/0x10 [ 175.755190][ T7700] ? _request_firmware+0x274/0x13c0 [ 175.755215][ T7700] request_firmware+0x35/0x50 [ 175.755237][ T7700] valid_regdb+0x184/0x590 [ 175.755254][ T7700] ? __pfx_valid_regdb+0x10/0x10 [ 175.755273][ T7700] reg_reload_regdb+0x11a/0x460 [ 175.755290][ T7700] ? __pfx_reg_reload_regdb+0x10/0x10 [ 175.755308][ T7700] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 175.755329][ T7700] ? nl80211_pre_doit+0x19a/0xae0 [ 175.755353][ T7700] genl_family_rcv_msg_doit+0x214/0x300 [ 175.755378][ T7700] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 175.755399][ T7700] ? genl_get_cmd+0x3e7/0x760 [ 175.755424][ T7700] ? bpf_lsm_capable+0x9/0x10 [ 175.755440][ T7700] ? security_capable+0x80/0x260 [ 175.755464][ T7700] genl_rcv_msg+0x560/0x800 [ 175.755488][ T7700] ? __pfx_genl_rcv_msg+0x10/0x10 [ 175.755509][ T7700] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 175.755529][ T7700] ? __pfx_nl80211_reload_regdb+0x10/0x10 [ 175.755544][ T7700] ? __pfx_nl80211_post_doit+0x10/0x10 [ 175.755571][ T7700] netlink_rcv_skb+0x159/0x420 [ 175.755590][ T7700] ? __pfx_genl_rcv_msg+0x10/0x10 [ 175.755612][ T7700] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 175.755639][ T7700] ? netlink_deliver_tap+0x1ae/0xcc0 [ 175.755659][ T7700] genl_rcv+0x28/0x40 [ 175.755681][ T7700] netlink_unicast+0x585/0x850 [ 175.755703][ T7700] ? __pfx_netlink_unicast+0x10/0x10 [ 175.755727][ T7700] netlink_sendmsg+0x8b0/0xda0 [ 175.755750][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.755767][ T7700] ? __import_iovec+0x1d2/0x640 [ 175.755784][ T7700] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 175.755808][ T7700] ____sys_sendmsg+0x9e1/0xb70 [ 175.755826][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 175.755847][ T7700] ? __pfx_____sys_sendmsg+0x10/0x10 [ 175.755865][ T7700] ? preempt_schedule_thunk+0x16/0x30 [ 175.755897][ T7700] ? try_to_wake_up+0x5f6/0x1900 [ 175.755920][ T7700] ___sys_sendmsg+0x190/0x1e0 [ 175.755943][ T7700] ? __pfx____sys_sendmsg+0x10/0x10 [ 175.755964][ T7700] ? futex_private_hash_put+0x107/0x1c0 [ 175.755999][ T7700] __sys_sendmsg+0x170/0x220 [ 175.756016][ T7700] ? __pfx___sys_sendmsg+0x10/0x10 [ 175.756030][ T7700] ? __x64_sys_futex+0x34f/0x4d0 [ 175.756053][ T7700] ? rcu_is_watching+0x12/0xc0 [ 175.756073][ T7700] do_syscall_64+0x10b/0xf80 [ 175.756091][ T7700] ? clear_bhb_loop+0x40/0x90 [ 175.756108][ T7700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.756123][ T7700] RIP: 0033:0x7f93ed59cdd9 [ 175.756136][ T7700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 175.756150][ T7700] RSP: 002b:00007f93ee479028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 175.756165][ T7700] RAX: ffffffffffffffda RBX: 00007f93ed815fa0 RCX: 00007f93ed59cdd9 [ 175.756175][ T7700] RDX: 0000000000008000 RSI: 0000200000000200 RDI: 0000000000000008 [ 175.756184][ T7700] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 175.756192][ T7700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.756201][ T7700] R13: 00007f93ed816038 R14: 00007f93ed815fa0 R15: 00007ffc4ee08458 [ 175.756221][ T7700] [ 178.360253][ T7751] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 178.360253][ T7751] program syz.0.369 not setting count and/or reply_len properly [ 178.407983][ T7700] syz.3.361: vmalloc error: size 1085, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 178.490759][ T7700] CPU: 0 UID: 0 PID: 7700 Comm: syz.3.361 Not tainted syzkaller #0 PREEMPT(full) [ 178.490782][ T7700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 178.490791][ T7700] Call Trace: [ 178.490797][ T7700] [ 178.490803][ T7700] dump_stack_lvl+0x100/0x190 [ 178.490826][ T7700] warn_alloc.cold+0x95/0x1c1 [ 178.490843][ T7700] ? __pfx_warn_alloc+0x10/0x10 [ 178.490865][ T7700] ? lockdep_hardirqs_on+0x78/0x100 [ 178.490886][ T7700] ? __get_vm_area_node+0x2c5/0x330 [ 178.490909][ T7700] ? __get_vm_area_node+0x208/0x330 [ 178.490930][ T7700] __vmalloc_node_range_noprof+0xccd/0x1630 [ 178.490951][ T7700] ? putname+0xb6/0x110 [ 178.490970][ T7700] ? do_file_open_root+0x42d/0x5a0 [ 178.490991][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 178.491010][ T7700] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 178.491034][ T7700] ? ima_read_file+0x149/0x1b0 [ 178.491054][ T7700] ? __pfx_ima_read_file+0x10/0x10 [ 178.491076][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 178.491089][ T7700] __vmalloc_node_noprof+0xad/0xf0 [ 178.491108][ T7700] ? kernel_read_file+0x77e/0x9a0 [ 178.491123][ T7700] kernel_read_file+0x77e/0x9a0 [ 178.491139][ T7700] ? __pfx_kernel_read_file+0x10/0x10 [ 178.491158][ T7700] kernel_read_file_from_path_initns+0x1cf/0x260 [ 178.491176][ T7700] ? __pfx_kernel_read_file_from_path_initns+0x10/0x10 [ 178.491197][ T7700] _request_firmware+0x733/0x13c0 [ 178.491226][ T7700] ? __pfx__request_firmware+0x10/0x10 [ 178.491250][ T7700] ? _request_firmware+0x274/0x13c0 [ 178.491275][ T7700] request_firmware+0x35/0x50 [ 178.491297][ T7700] valid_regdb+0x184/0x590 [ 178.491314][ T7700] ? __pfx_valid_regdb+0x10/0x10 [ 178.491332][ T7700] reg_reload_regdb+0x11a/0x460 [ 178.491350][ T7700] ? __pfx_reg_reload_regdb+0x10/0x10 [ 178.491368][ T7700] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 178.491388][ T7700] ? nl80211_pre_doit+0x19a/0xae0 [ 178.491411][ T7700] genl_family_rcv_msg_doit+0x214/0x300 [ 178.491435][ T7700] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 178.491461][ T7700] ? genl_get_cmd+0x3e7/0x760 [ 178.491487][ T7700] ? bpf_lsm_capable+0x9/0x10 [ 178.491503][ T7700] ? security_capable+0x80/0x260 [ 178.491528][ T7700] genl_rcv_msg+0x560/0x800 [ 178.491551][ T7700] ? __pfx_genl_rcv_msg+0x10/0x10 [ 178.491572][ T7700] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 178.491599][ T7700] ? __pfx_nl80211_reload_regdb+0x10/0x10 [ 178.491616][ T7700] ? __pfx_nl80211_post_doit+0x10/0x10 [ 178.491644][ T7700] netlink_rcv_skb+0x159/0x420 [ 178.491664][ T7700] ? __pfx_genl_rcv_msg+0x10/0x10 [ 178.491686][ T7700] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 178.491713][ T7700] ? netlink_deliver_tap+0x1ae/0xcc0 [ 178.491735][ T7700] genl_rcv+0x28/0x40 [ 178.491754][ T7700] netlink_unicast+0x585/0x850 [ 178.491776][ T7700] ? __pfx_netlink_unicast+0x10/0x10 [ 178.491800][ T7700] netlink_sendmsg+0x8b0/0xda0 [ 178.491823][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.491841][ T7700] ? __import_iovec+0x1d2/0x640 [ 178.491857][ T7700] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 178.491881][ T7700] ____sys_sendmsg+0x9e1/0xb70 [ 178.491900][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.491922][ T7700] ? __pfx_____sys_sendmsg+0x10/0x10 [ 178.491940][ T7700] ? preempt_schedule_thunk+0x16/0x30 [ 178.491965][ T7700] ? try_to_wake_up+0x5f6/0x1900 [ 178.491987][ T7700] ___sys_sendmsg+0x190/0x1e0 [ 178.492009][ T7700] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.492029][ T7700] ? futex_private_hash_put+0x107/0x1c0 [ 178.492065][ T7700] __sys_sendmsg+0x170/0x220 [ 178.492082][ T7700] ? __pfx___sys_sendmsg+0x10/0x10 [ 178.492098][ T7700] ? __x64_sys_futex+0x34f/0x4d0 [ 178.492120][ T7700] ? rcu_is_watching+0x12/0xc0 [ 178.492140][ T7700] do_syscall_64+0x10b/0xf80 [ 178.492158][ T7700] ? clear_bhb_loop+0x40/0x90 [ 178.492175][ T7700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.492190][ T7700] RIP: 0033:0x7f93ed59cdd9 [ 178.492203][ T7700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 178.492217][ T7700] RSP: 002b:00007f93ee479028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 178.492232][ T7700] RAX: ffffffffffffffda RBX: 00007f93ed815fa0 RCX: 00007f93ed59cdd9 [ 178.492242][ T7700] RDX: 0000000000008000 RSI: 0000200000000200 RDI: 0000000000000008 [ 178.492252][ T7700] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 178.492261][ T7700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.492269][ T7700] R13: 00007f93ed816038 R14: 00007f93ed815fa0 R15: 00007ffc4ee08458 [ 178.492288][ T7700] [ 178.980129][ T7700] Mem-Info: [ 178.983329][ T7700] active_anon:5532 inactive_anon:27 isolated_anon:0 [ 178.983329][ T7700] active_file:2804 inactive_file:48376 isolated_file:0 [ 178.983329][ T7700] unevictable:9587 dirty:529 writeback:0 [ 178.983329][ T7700] slab_reclaimable:10841 slab_unreclaimable:89473 [ 178.983329][ T7700] mapped:30775 shmem:1350 pagetables:1191 [ 178.983329][ T7700] sec_pagetables:0 bounce:0 [ 178.983329][ T7700] kernel_misc_reclaimable:0 [ 178.983329][ T7700] free:1327084 free_pcp:13395 free_cma:0 [ 179.028825][ T7700] Node 0 active_anon:22128kB inactive_anon:108kB active_file:11216kB inactive_file:193296kB unevictable:36812kB isolated(anon):0kB isolated(file):0kB mapped:123100kB dirty:2116kB writeback:0kB shmem:3864kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11520kB pagetables:4624kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 179.064078][ T7700] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 179.097214][ T7700] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 179.127253][ T7700] lowmem_reserve[]: 0 2477 2478 2478 2478 [ 179.133046][ T7700] Node 0 DMA32 free:1360108kB boost:0kB min:34056kB low:42568kB high:51080kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22128kB inactive_anon:108kB active_file:11216kB inactive_file:193296kB unevictable:36812kB writepending:2116kB zspages:4kB present:3129332kB managed:2537388kB mlocked:35312kB bounce:0kB free_pcp:49108kB local_pcp:49108kB free_cma:0kB [ 179.167446][ T7700] lowmem_reserve[]: 0 0 1 1 1 [ 179.172199][ T7700] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1100kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 179.202020][ T7700] lowmem_reserve[]: 0 0 0 0 0 [ 179.206782][ T7700] Node 1 Normal free:3932864kB boost:0kB min:55828kB low:69784kB high:83740kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:4460kB local_pcp:4460kB free_cma:0kB [ 179.238926][ T7700] lowmem_reserve[]: 0 0 0 0 0 [ 179.243672][ T7700] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 179.256714][ T7700] Node 0 DMA32: 3902*4kB (UME) 2007*8kB (UME) 1209*16kB (UME) 855*32kB (UM) 517*64kB (UM) 317*128kB (UM) 143*256kB (UM) 38*512kB (UME) 15*1024kB (UM) 1*2048kB (M) 277*4096kB (UM) = 1360096kB [ 179.275620][ T7700] Node 0 Normal: 1*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 179.287488][ T7700] Node 1 Normal: 2*4kB (UM) 5*8kB (U) 9*16kB (U) 4*32kB (UM) 0*64kB 1*128kB (U) 1*256kB (U) 2*512kB (U) 1*1024kB (M) 1*2048kB (M) 959*4096kB (UM) = 3932864kB [ 179.303479][ T7700] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 179.313079][ T7700] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 179.322400][ T7700] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 179.332004][ T7700] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 179.341326][ T7700] 57494 total pagecache pages [ 179.346028][ T7700] 25 pages in swap cache [ 179.350280][ T7700] Free swap = 124892kB [ 179.354814][ T7700] Total swap = 124996kB [ 179.359010][ T7700] 2097051 pages RAM [ 179.362841][ T7700] 0 pages HighMem/MovableOnly [ 179.367560][ T7700] 430814 pages reserved [ 179.371730][ T7700] 0 pages cma reserved [ 179.375880][ T7700] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -12 [ 179.392682][ T7700] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -12 [ 179.412867][ T7700] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 179.464045][ T7700] syz.3.361 (7700) used greatest stack depth: 19720 bytes left [ 179.679985][ T7766] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 179.679985][ T7766] program syz.1.372 not setting count and/or reply_len properly [ 179.741979][ T7763] netlink: 8 bytes leftover after parsing attributes in process `syz.0.369'. [ 179.990449][ T7761] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(12) [ 180.326262][ T7766] netlink: 8 bytes leftover after parsing attributes in process `syz.1.372'. [ 180.562903][ T7789] netlink: Unknown nat attribute (0) [ 181.491067][ T7795] FAULT_INJECTION: forcing a failure. [ 181.491067][ T7795] name failslab, interval 1, probability 0, space 0, times 0 [ 181.699476][ T7795] CPU: 0 UID: 0 PID: 7795 Comm: syz.3.375 Not tainted syzkaller #0 PREEMPT(full) [ 181.699500][ T7795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 181.699509][ T7795] Call Trace: [ 181.699515][ T7795] [ 181.699521][ T7795] dump_stack_lvl+0x100/0x190 [ 181.699552][ T7795] should_fail_ex.cold+0x5/0xa [ 181.699572][ T7795] ? ops_init+0x77/0x5f0 [ 181.699591][ T7795] should_failslab+0xc2/0x120 [ 181.699609][ T7795] __kmalloc_noprof+0xe0/0x850 [ 181.699632][ T7795] ? net_generic+0xf4/0x2a0 [ 181.699657][ T7795] ops_init+0x77/0x5f0 [ 181.699675][ T7795] setup_net+0x118/0x3a0 [ 181.699698][ T7795] ? __pfx_setup_net+0x10/0x10 [ 181.699715][ T7795] ? mutex_init_lockdep+0xf1/0x120 [ 181.699735][ T7795] copy_net_ns+0x46f/0x7c0 [ 181.699755][ T7795] create_new_namespaces+0x3ea/0xac0 [ 181.699791][ T7795] unshare_nsproxy_namespaces+0xf2/0x220 [ 181.699812][ T7795] ksys_unshare+0x438/0xab0 [ 181.699835][ T7795] ? __pfx_ksys_unshare+0x10/0x10 [ 181.699855][ T7795] ? xfd_validate_state+0x129/0x190 [ 181.699876][ T7795] __x64_sys_unshare+0x31/0x40 [ 181.699896][ T7795] do_syscall_64+0x10b/0xf80 [ 181.699914][ T7795] ? clear_bhb_loop+0x40/0x90 [ 181.699932][ T7795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.699947][ T7795] RIP: 0033:0x7f93ed59cdd9 [ 181.699965][ T7795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.699978][ T7795] RSP: 002b:00007f93ee458028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 181.699992][ T7795] RAX: ffffffffffffffda RBX: 00007f93ed816090 RCX: 00007f93ed59cdd9 [ 181.700003][ T7795] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 181.700012][ T7795] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 181.700020][ T7795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 181.700029][ T7795] R13: 00007f93ed816128 R14: 00007f93ed816090 R15: 00007ffc4ee08458 [ 181.700049][ T7795] [ 181.966277][ T7815] program syz.2.378 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 182.167215][ T30] audit: type=1807 audit(32773.007:4): UNKNOWN=0"]$|1j0B|dӉO+/xWӦ^gq%ḦrO res=0 [ 182.199976][ T30] audit: type=1802 audit(32773.007:5): pid=7815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.2.378" res=0 errno=0 [ 182.660521][ T7814] ima: policy update failed [ 182.667661][ T30] audit: type=1802 audit(32773.697:6): pid=7814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.2.378" res=0 errno=0 [ 182.954660][ T7836] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 182.954660][ T7836] program syz.0.381 not setting count and/or reply_len properly [ 183.613713][ T7836] netlink: 8 bytes leftover after parsing attributes in process `syz.0.381'. [ 183.821699][ T7863] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(12) [ 186.054292][ T7917] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 186.054292][ T7917] program syz.1.394 not setting count and/or reply_len properly [ 186.550999][ T7917] netlink: 8 bytes leftover after parsing attributes in process `syz.1.394'. [ 186.978781][ T7944] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 187.659568][ T7948] netlink: 28 bytes leftover after parsing attributes in process `syz.0.399'. [ 188.996525][ T50] Bluetooth: hci3: unexpected event 0x3e length: 508 > 260 [ 188.996549][ T50] Bluetooth: hci3: unexpected subevent 0x02 length: 507 > 260 [ 189.012185][ T50] Bluetooth: hci3: Dropping invalid advertising data [ 189.019741][ T50] Bluetooth: hci3: unknown advertising packet type: 0xe9 [ 189.092410][ T7984] netlink: 'syz.3.406': attribute type 33 has an invalid length. [ 189.171968][ T7984] netlink: 322 bytes leftover after parsing attributes in process `syz.3.406'. [ 189.194385][ T7989] netlink: 334 bytes leftover after parsing attributes in process `syz.1.407'. [ 192.410014][ T8087] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 192.410014][ T8087] program syz.2.421 not setting count and/or reply_len properly [ 193.313487][ T8087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.421'. [ 194.287616][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.299666][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.842958][ T8135] wlan1: mtu less than device minimum [ 195.201926][ T8148] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 195.201926][ T8148] program syz.1.433 not setting count and/or reply_len properly [ 195.903874][ T8148] netlink: 8 bytes leftover after parsing attributes in process `syz.1.433'. [ 197.124314][ T8190] i2c i2c-0: delete_device: Can't find device in list [ 200.943171][ T8274] mmap: syz.0.459 (8274): VmData 37597184 exceed data ulimit 3. Update limits or use boot option ignore_rlimit_data. [ 200.985995][ T8276] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 200.985995][ T8276] program syz.3.460 not setting count and/or reply_len properly [ 201.209347][ T8279] Format for unlinking a device is "netnsfd:ifidx" (int uint). [ 201.330340][ T8278] Format for unlinking a device is "netnsfd:ifidx" (int uint). [ 201.373245][ T8276] netlink: 8 bytes leftover after parsing attributes in process `syz.3.460'. [ 202.590780][ T8323] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(12) [ 202.952512][ T8333] netlink: 146 bytes leftover after parsing attributes in process `syz.0.471'. [ 203.293439][ T8339] random: crng reseeded on system resumption [ 203.311845][ T8340] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 203.311845][ T8340] program syz.3.473 not setting count and/or reply_len properly [ 203.829942][ T8340] netlink: 8 bytes leftover after parsing attributes in process `syz.3.473'. [ 205.546884][ T8401] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 205.546884][ T8401] program syz.2.486 not setting count and/or reply_len properly [ 205.580525][ T8389] FAULT_INJECTION: forcing a failure. [ 205.580525][ T8389] name failslab, interval 1, probability 0, space 0, times 0 [ 205.612113][ T8389] CPU: 0 UID: 0 PID: 8389 Comm: syz.3.484 Not tainted syzkaller #0 PREEMPT(full) [ 205.612135][ T8389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 205.612143][ T8389] Call Trace: [ 205.612148][ T8389] [ 205.612154][ T8389] dump_stack_lvl+0x100/0x190 [ 205.612174][ T8389] should_fail_ex.cold+0x5/0xa [ 205.612193][ T8389] should_failslab+0xc2/0x120 [ 205.612210][ T8389] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 205.612231][ T8389] ? mas_preallocate+0x1105/0x14a0 [ 205.612257][ T8389] mas_preallocate+0x1105/0x14a0 [ 205.612281][ T8389] ? __pfx_mas_preallocate+0x10/0x10 [ 205.612307][ T8389] ? anon_vma_name+0x5a/0x250 [ 205.612329][ T8389] __split_vma+0x33d/0xd90 [ 205.612353][ T8389] ? __pfx___split_vma+0x10/0x10 [ 205.612372][ T8389] ? clockevents_program_event+0x23e/0x820 [ 205.612388][ T8389] ? clockevents_program_event+0x23e/0x820 [ 205.612407][ T8389] ? ktime_get+0x9f/0x320 [ 205.612432][ T8389] vma_modify+0x1cf4/0x25c0 [ 205.612459][ T8389] ? clockevents_shutdown+0x1f0/0x1f0 [ 205.612480][ T8389] ? __pfx_vma_modify+0x10/0x10 [ 205.612512][ T8389] vma_modify_flags+0x257/0x3d0 [ 205.612534][ T8389] ? __pfx_vma_modify_flags+0x10/0x10 [ 205.612566][ T8389] ? rcu_is_watching+0x12/0xc0 [ 205.612582][ T8389] ? percpu_counter_add_batch+0xb9/0x230 [ 205.612603][ T8389] mprotect_fixup+0x27a/0xe30 [ 205.612628][ T8389] ? __pfx_mprotect_fixup+0x10/0x10 [ 205.612660][ T8389] ? __pfx_mas_prev+0x10/0x10 [ 205.612683][ T8389] do_mprotect_pkey+0xa4b/0xef0 [ 205.612710][ T8389] ? __pfx_do_mprotect_pkey+0x10/0x10 [ 205.612730][ T8389] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 205.612753][ T8389] ? ktime_get+0x22c/0x320 [ 205.612787][ T8389] __x64_sys_mprotect+0x78/0xc0 [ 205.612807][ T8389] ? lockdep_hardirqs_on+0x78/0x100 [ 205.612825][ T8389] do_syscall_64+0x10b/0xf80 [ 205.612843][ T8389] ? clear_bhb_loop+0x40/0x90 [ 205.612860][ T8389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 205.612874][ T8389] RIP: 0033:0x7f93ed59cbd7 [ 205.612886][ T8389] Code: 89 38 eb 84 0f 1f 80 00 00 00 00 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 7a ff ff ff b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 205.612899][ T8389] RSP: 002b:00007ffc4ee083f8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a [ 205.612913][ T8389] RAX: ffffffffffffffda RBX: 00007f93ee4376c0 RCX: 00007f93ed59cbd7 [ 205.612922][ T8389] RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f93ee418000 [ 205.612930][ T8389] RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000 [ 205.612937][ T8389] R10: 0000000000021000 R11: 0000000000000206 R12: 00007ffc4ee08550 [ 205.612945][ T8389] R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 [ 205.612963][ T8389] [ 206.249560][ T8403] netlink: 8 bytes leftover after parsing attributes in process `syz.2.486'. [ 206.654216][ T50] Bluetooth: hci1: unexpected event 0x3e length: 508 > 260 [ 206.654239][ T50] Bluetooth: hci1: unexpected subevent 0x02 length: 507 > 260 [ 206.674017][ T50] Bluetooth: hci1: Dropping invalid advertising data [ 206.683541][ T50] Bluetooth: hci1: unknown advertising packet type: 0xe9 [ 206.683575][ T50] Bluetooth: hci1: unknown advertising packet type: 0x20 [ 206.691331][ T50] Bluetooth: hci1: Malformed LE Event: 0x02 [ 207.154677][ T8431] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 207.249499][ T8430] FAULT_INJECTION: forcing a failure. [ 207.249499][ T8430] name failslab, interval 1, probability 0, space 0, times 0 [ 207.352404][ T8430] CPU: 0 UID: 0 PID: 8430 Comm: syz.2.493 Not tainted syzkaller #0 PREEMPT(full) [ 207.352425][ T8430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 207.352433][ T8430] Call Trace: [ 207.352438][ T8430] [ 207.352443][ T8430] dump_stack_lvl+0x100/0x190 [ 207.352464][ T8430] should_fail_ex.cold+0x5/0xa [ 207.352482][ T8430] should_failslab+0xc2/0x120 [ 207.352499][ T8430] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 207.352521][ T8430] ? do_getname+0x35/0x390 [ 207.352545][ T8430] do_getname+0x35/0x390 [ 207.352567][ T8430] __x64_sys_linkat+0xd1/0x150 [ 207.352587][ T8430] do_syscall_64+0x10b/0xf80 [ 207.352605][ T8430] ? clear_bhb_loop+0x40/0x90 [ 207.352622][ T8430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 207.352636][ T8430] RIP: 0033:0x7f34cf99cdd9 [ 207.352648][ T8430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 207.352660][ T8430] RSP: 002b:00007f34d0888028 EFLAGS: 00000246 ORIG_RAX: 0000000000000109 [ 207.352674][ T8430] RAX: ffffffffffffffda RBX: 00007f34cfc15fa0 RCX: 00007f34cf99cdd9 [ 207.352683][ T8430] RDX: 0000000000000005 RSI: 0000000000000000 RDI: ffffffffffffffff [ 207.352691][ T8430] RBP: 00007f34cfa32d69 R08: 0000000000000009 R09: 0000000000000000 [ 207.352699][ T8430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 207.352706][ T8430] R13: 00007f34cfc16038 R14: 00007f34cfc15fa0 R15: 00007ffc09f9c8d8 [ 207.352724][ T8430] [ 207.644352][ T8446] ovs_: entered promiscuous mode [ 210.125852][ T5636] Bluetooth: hci4: command 0x1003 tx timeout [ 210.134295][ T50] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 210.495695][ T8492] vhci_hcd vhci_hcd.2: invalid port number 194 [ 210.562746][ T8492] vhci_hcd vhci_hcd.2: invalid port number 194 [ 211.924093][ T8525] FAULT_INJECTION: forcing a failure. [ 211.924093][ T8525] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.052250][ T8525] CPU: 0 UID: 0 PID: 8525 Comm: syz.0.513 Not tainted syzkaller #0 PREEMPT(full) [ 212.052281][ T8525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 212.052289][ T8525] Call Trace: [ 212.052294][ T8525] [ 212.052299][ T8525] dump_stack_lvl+0x100/0x190 [ 212.052320][ T8525] should_fail_ex.cold+0x5/0xa [ 212.052338][ T8525] _copy_from_user+0x2e/0xd0 [ 212.052362][ T8525] copy_msghdr_from_user+0x9f/0x4f0 [ 212.052389][ T8525] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 212.052418][ T8525] ___sys_sendmsg+0x106/0x1e0 [ 212.052439][ T8525] ? __pfx____sys_sendmsg+0x10/0x10 [ 212.052479][ T8525] __sys_sendmsg+0x170/0x220 [ 212.052495][ T8525] ? __pfx___sys_sendmsg+0x10/0x10 [ 212.052515][ T8525] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 212.052537][ T8525] ? syscall_user_dispatch+0x76/0x130 [ 212.052555][ T8525] do_syscall_64+0x10b/0xf80 [ 212.052573][ T8525] ? clear_bhb_loop+0x40/0x90 [ 212.052590][ T8525] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.052604][ T8525] RIP: 0033:0x7fe6d779cdd9 [ 212.052616][ T8525] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.052629][ T8525] RSP: 002b:00007fe6d85d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 212.052642][ T8525] RAX: ffffffffffffffda RBX: 00007fe6d7a16090 RCX: 00007fe6d779cdd9 [ 212.052651][ T8525] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 212.052659][ T8525] RBP: 00007fe6d85d1090 R08: 0000000000000000 R09: 0000000000000000 [ 212.052667][ T8525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.052675][ T8525] R13: 00007fe6d7a16128 R14: 00007fe6d7a16090 R15: 00007ffea1313e48 [ 212.052692][ T8525] [ 214.292107][ T8574] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(5.0.65535), cmd(12) [ 216.208588][ T8619] FAULT_INJECTION: forcing a failure. [ 216.208588][ T8619] name failslab, interval 1, probability 0, space 0, times 0 [ 216.325124][ T8619] CPU: 0 UID: 0 PID: 8619 Comm: syz.1.533 Not tainted syzkaller #0 PREEMPT(full) [ 216.325145][ T8619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 216.325154][ T8619] Call Trace: [ 216.325159][ T8619] [ 216.325165][ T8619] dump_stack_lvl+0x100/0x190 [ 216.325193][ T8619] should_fail_ex.cold+0x5/0xa [ 216.325212][ T8619] ? tomoyo_realpath_from_path+0xb6/0x690 [ 216.325231][ T8619] should_failslab+0xc2/0x120 [ 216.325248][ T8619] __kmalloc_noprof+0xe0/0x850 [ 216.325270][ T8619] ? kfree+0x1dd/0x6c0 [ 216.325292][ T8619] tomoyo_realpath_from_path+0xb6/0x690 [ 216.325315][ T8619] tomoyo_check_open_permission+0x2af/0x3c0 [ 216.325331][ T8619] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 216.325353][ T8619] ? hook_file_open+0x24e/0x7a0 [ 216.325381][ T8619] ? path_get+0x61/0x80 [ 216.325403][ T8619] tomoyo_file_open+0x6b/0x90 [ 216.325423][ T8619] security_file_open+0xb5/0x1e0 [ 216.325440][ T8619] do_dentry_open+0x5aa/0x1660 [ 216.325459][ T8619] ? security_inode_permission+0xbf/0x250 [ 216.325477][ T8619] vfs_open+0x82/0x3f0 [ 216.325500][ T8619] path_openat+0x208c/0x31a0 [ 216.325524][ T8619] ? __pfx_path_openat+0x10/0x10 [ 216.325548][ T8619] do_file_open+0x20e/0x430 [ 216.325568][ T8619] ? __pfx_do_file_open+0x10/0x10 [ 216.325598][ T8619] ? alloc_fd+0x476/0x790 [ 216.325617][ T8619] ? do_getname+0x191/0x390 [ 216.325639][ T8619] do_sys_openat2+0x10d/0x1e0 [ 216.325661][ T8619] ? __pfx_do_sys_openat2+0x10/0x10 [ 216.325683][ T8619] ? blkcg_maybe_throttle_current+0x5e7/0xeb0 [ 216.325705][ T8619] __x64_sys_openat+0x12d/0x210 [ 216.325728][ T8619] ? __pfx___x64_sys_openat+0x10/0x10 [ 216.325753][ T8619] ? rcu_is_watching+0x12/0xc0 [ 216.325773][ T8619] do_syscall_64+0x10b/0xf80 [ 216.325791][ T8619] ? clear_bhb_loop+0x40/0x90 [ 216.325809][ T8619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.325824][ T8619] RIP: 0033:0x7f4cbd99cdd9 [ 216.325837][ T8619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 216.325851][ T8619] RSP: 002b:00007f4cbe835028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 216.325865][ T8619] RAX: ffffffffffffffda RBX: 00007f4cbdc15fa0 RCX: 00007f4cbd99cdd9 [ 216.325875][ T8619] RDX: 0000000000121000 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 216.325885][ T8619] RBP: 00007f4cbda32d69 R08: 0000000000000000 R09: 0000000000000000 [ 216.325894][ T8619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 216.325902][ T8619] R13: 00007f4cbdc16038 R14: 00007f4cbdc15fa0 R15: 00007ffca44f0658 [ 216.325921][ T8619] [ 216.325928][ T8619] ERROR: Out of memory at tomoyo_realpath_from_path. [ 221.960181][ T8716] FAULT_INJECTION: forcing a failure. [ 221.960181][ T8716] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.060932][ T8716] CPU: 0 UID: 0 PID: 8716 Comm: syz.3.557 Not tainted syzkaller #0 PREEMPT(full) [ 222.060954][ T8716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 222.060962][ T8716] Call Trace: [ 222.060967][ T8716] [ 222.060973][ T8716] dump_stack_lvl+0x100/0x190 [ 222.060993][ T8716] should_fail_ex.cold+0x5/0xa [ 222.061011][ T8716] _copy_from_iter+0x1f4/0x1690 [ 222.061027][ T8716] ? __asan_memset+0x23/0x50 [ 222.061049][ T8716] ? __pfx__copy_from_iter+0x10/0x10 [ 222.061062][ T8716] ? __pfx___alloc_skb+0x10/0x10 [ 222.061083][ T8716] netlink_sendmsg+0x808/0xda0 [ 222.061105][ T8716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 222.061123][ T8716] ? __import_iovec+0x1d2/0x640 [ 222.061138][ T8716] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 222.061162][ T8716] ____sys_sendmsg+0x9e1/0xb70 [ 222.061179][ T8716] ? __pfx_netlink_sendmsg+0x10/0x10 [ 222.061199][ T8716] ? __pfx_____sys_sendmsg+0x10/0x10 [ 222.061226][ T8716] ___sys_sendmsg+0x190/0x1e0 [ 222.061246][ T8716] ? __pfx____sys_sendmsg+0x10/0x10 [ 222.061293][ T8716] __sys_sendmsg+0x170/0x220 [ 222.061309][ T8716] ? __pfx___sys_sendmsg+0x10/0x10 [ 222.061329][ T8716] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 222.061351][ T8716] ? syscall_user_dispatch+0x76/0x130 [ 222.061369][ T8716] do_syscall_64+0x10b/0xf80 [ 222.061387][ T8716] ? clear_bhb_loop+0x40/0x90 [ 222.061404][ T8716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.061418][ T8716] RIP: 0033:0x7f93ed59cdd9 [ 222.061431][ T8716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.061443][ T8716] RSP: 002b:00007f93ee458028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 222.061457][ T8716] RAX: ffffffffffffffda RBX: 00007f93ed816090 RCX: 00007f93ed59cdd9 [ 222.061466][ T8716] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000007 [ 222.061474][ T8716] RBP: 00007f93ee458090 R08: 0000000000000000 R09: 0000000000000000 [ 222.061482][ T8716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.061489][ T8716] R13: 00007f93ed816128 R14: 00007f93ed816090 R15: 00007ffc4ee08458 [ 222.061507][ T8716] [ 224.321699][ T8760] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 224.321699][ T8760] program syz.1.564 not setting count and/or reply_len properly [ 224.777332][ T8760] netlink: 8 bytes leftover after parsing attributes in process `syz.1.564'. [ 226.254800][ T8830] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 226.254800][ T8830] program syz.1.579 not setting count and/or reply_len properly [ 226.375391][ T30] audit: type=1804 audit(32817.397:7): pid=8823 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.578" name="/newroot/130/file0" dev="tmpfs" ino=710 res=1 errno=0 [ 226.510015][ T30] audit: type=1804 audit(32817.427:8): pid=8824 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.578" name="/newroot/130/file0" dev="tmpfs" ino=710 res=1 errno=0 [ 226.689329][ T30] audit: type=1800 audit(32817.437:9): pid=8824 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.578" name="file0" dev="tmpfs" ino=710 res=0 errno=0 [ 226.786025][ T8833] netlink: 8 bytes leftover after parsing attributes in process `syz.1.579'. [ 227.289633][ T8851] FAULT_INJECTION: forcing a failure. [ 227.289633][ T8851] name failslab, interval 1, probability 0, space 0, times 0 [ 227.369869][ T8851] CPU: 0 UID: 0 PID: 8851 Comm: syz.1.582 Not tainted syzkaller #0 PREEMPT(full) [ 227.369895][ T8851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 227.369904][ T8851] Call Trace: [ 227.369909][ T8851] [ 227.369915][ T8851] dump_stack_lvl+0x100/0x190 [ 227.369936][ T8851] should_fail_ex.cold+0x5/0xa [ 227.369957][ T8851] should_failslab+0xc2/0x120 [ 227.369975][ T8851] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 227.369997][ T8851] ? vm_area_dup+0x27/0x8e0 [ 227.370017][ T8851] ? __vma_start_write+0x17f/0x280 [ 227.370040][ T8851] vm_area_dup+0x27/0x8e0 [ 227.370062][ T8851] dup_mmap+0x6f6/0x2180 [ 227.370089][ T8851] ? __pfx_dup_mmap+0x10/0x10 [ 227.370107][ T8851] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 227.370128][ T8851] ? __lock_acquire+0x4a5/0x2630 [ 227.370144][ T8851] ? find_held_lock+0x2b/0x80 [ 227.370161][ T8851] ? __percpu_counter_init_many+0x2bc/0x3b0 [ 227.370192][ T8851] copy_process+0x6c63/0x7e00 [ 227.370211][ T8851] ? futex_unqueue+0x133/0x2c0 [ 227.370237][ T8851] ? __pfx_copy_process+0x10/0x10 [ 227.370263][ T8851] ? _copy_from_user+0x59/0xd0 [ 227.370289][ T8851] kernel_clone+0x12e/0x9c0 [ 227.370308][ T8851] ? futex_hash+0x141/0x370 [ 227.370321][ T8851] ? __pfx_kernel_clone+0x10/0x10 [ 227.370345][ T8851] ? __pfx_futex_wait+0x10/0x10 [ 227.370369][ T8851] __do_sys_clone3+0x214/0x290 [ 227.370388][ T8851] ? __pfx___do_sys_clone3+0x10/0x10 [ 227.370429][ T8851] ? rcu_is_watching+0x12/0xc0 [ 227.370449][ T8851] do_syscall_64+0x10b/0xf80 [ 227.370467][ T8851] ? clear_bhb_loop+0x40/0x90 [ 227.370485][ T8851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.370500][ T8851] RIP: 0033:0x7f4cbd99cdd9 [ 227.370513][ T8851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 227.370528][ T8851] RSP: 002b:00007f4cbe7f2ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 227.370542][ T8851] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f4cbd99cdd9 [ 227.370552][ T8851] RDX: 00007f4cbe7f2f10 RSI: 0000000000000058 RDI: 00007f4cbe7f2f10 [ 227.370561][ T8851] RBP: 00007f4cbda32d69 R08: 0000000000000000 R09: 0000000000000058 [ 227.370570][ T8851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 227.370578][ T8851] R13: 00007f4cbdc16218 R14: 00007f4cbdc16180 R15: 00007ffca44f0658 [ 227.370598][ T8851] [ 229.930363][ T8895] netlink: 330 bytes leftover after parsing attributes in process `syz.0.589'. [ 230.684186][ T8904] netlink: 342 bytes leftover after parsing attributes in process `syz.3.592'. [ 232.180670][ T8940] netlink: 9 bytes leftover after parsing attributes in process `syz.0.602'. [ 232.240680][ T8940] netlink: 4 bytes leftover after parsing attributes in process `syz.0.602'. [ 233.162951][ T8967] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 233.162951][ T8967] program syz.0.608 not setting count and/or reply_len properly [ 233.593738][ T8969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.608'. [ 234.823326][ T50] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 234.841280][ T9018] vivid-008: ================= START STATUS ================= [ 234.877370][ T9018] vivid-008: ================== END STATUS ================== [ 235.469866][ T8998] cgroup: fork rejected by pids controller in /syz0 [ 236.236916][ T9022] Process accounting resumed [ 236.478998][ T9047] netlink: 54 bytes leftover after parsing attributes in process `syz.2.615'. [ 236.844879][ T5636] Bluetooth: hci1: command 0x0c1a tx timeout [ 238.637358][ T9108] zswap: compressor not available [ 238.685763][ T9112] block2mtd: illegal erase size [ 238.925763][ T50] Bluetooth: hci1: command 0x0c1a tx timeout [ 240.953089][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.626'. [ 243.042306][ T1341] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.241415][ T1341] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.261506][ T9213] sg_write: data in/out 262108/258 bytes for SCSI command 0x61-- guessing data in; [ 243.261506][ T9213] program syz.2.635 not setting count and/or reply_len properly [ 243.383619][ T1341] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.521254][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 243.533188][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 243.541691][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 243.549663][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 243.562388][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 243.625450][ T1341] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.642047][ T9222] netlink: 8 bytes leftover after parsing attributes in process `syz.2.635'. [ 244.489700][ T1341] bridge_slave_1: left allmulticast mode [ 244.489778][ T1341] bridge_slave_1: left promiscuous mode [ 244.491744][ T1341] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.514510][ T1341] bridge_slave_0: left allmulticast mode [ 244.514532][ T1341] bridge_slave_0: left promiscuous mode [ 244.514660][ T1341] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.160775][ T1341] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 245.213840][ T1341] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.251525][ T1341] bond0 (unregistering): Released all slaves [ 245.644786][ T50] Bluetooth: hci2: command tx timeout [ 246.019183][ T5288] 8021q: adding VLAN 0 to HW filter on device eth1 [ 246.443578][ T1341] hsr_slave_0: left promiscuous mode [ 246.476898][ T1341] hsr_slave_1: left promiscuous mode [ 246.507798][ T1341] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 246.539603][ T1341] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 246.578515][ T1341] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 246.619258][ T1341] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 246.727860][ T1341] veth1_macvtap: left promiscuous mode [ 246.758367][ T1341] veth0_macvtap: left promiscuous mode [ 247.391954][ T1341] team0 (unregistering): Port device team_slave_1 removed [ 247.445859][ T1341] team0 (unregistering): Port device team_slave_0 removed [ 247.724867][ T50] Bluetooth: hci2: command tx timeout [ 247.800893][ T5288] 8021q: adding VLAN 0 to HW filter on device eth2 [ 248.632396][ T9340] netlink: 28 bytes leftover after parsing attributes in process `syz.1.654'. [ 249.064664][ T9340] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 249.136821][ T9340] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 249.193525][ T9340] bond0 (unregistering): Released all slaves [ 249.588064][ T9218] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.638205][ T9218] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.690889][ T9218] bridge_slave_0: entered allmulticast mode [ 249.744626][ T9218] bridge_slave_0: entered promiscuous mode [ 249.789438][ T9218] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.808511][ T50] Bluetooth: hci2: command tx timeout [ 249.832300][ T9218] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.881113][ T9218] bridge_slave_1: entered allmulticast mode [ 249.923884][ T9218] bridge_slave_1: entered promiscuous mode [ 250.048768][ T5288] 8021q: adding VLAN 0 to HW filter on device eth3 [ 250.095011][ T9218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 250.161284][ T9218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 250.292683][ T9218] team0: Port device team_slave_0 added [ 250.329079][ T9218] team0: Port device team_slave_1 added [ 250.522722][ T9218] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 250.563079][ T9218] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 250.705528][ T9218] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 250.779740][ T9218] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 250.815587][ T9218] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 250.959386][ T9218] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 251.221356][ T9218] hsr_slave_0: entered promiscuous mode [ 251.248918][ T9218] hsr_slave_1: entered promiscuous mode [ 251.290473][ T9218] debugfs: 'hsr0' already exists in 'hsr' [ 251.331425][ T9218] Cannot create hsr debugfs directory [ 251.886191][ T50] Bluetooth: hci2: command tx timeout [ 252.041449][ T5288] 8021q: adding VLAN 0 to HW filter on device eth4 [ 252.441396][ T9421] input: jJǸ-9%vlQ J86 as /devices/virtual/input/input6 [ 253.751802][ T9442] random: crng reseeded on system resumption [ 253.961819][ T9442] FAULT_INJECTION: forcing a failure. [ 253.961819][ T9442] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 254.164014][ T9218] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 254.227111][ T9442] CPU: 0 UID: 0 PID: 9442 Comm: syz.3.668 Tainted: G L syzkaller #0 PREEMPT(full) [ 254.227136][ T9442] Tainted: [L]=SOFTLOCKUP [ 254.227142][ T9442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 254.227153][ T9442] Call Trace: [ 254.227159][ T9442] [ 254.227164][ T9442] dump_stack_lvl+0x100/0x190 [ 254.227186][ T9442] should_fail_ex.cold+0x5/0xa [ 254.227203][ T9442] ? prepare_alloc_pages+0x16d/0x5f0 [ 254.227224][ T9442] should_fail_alloc_page+0xeb/0x140 [ 254.227242][ T9442] prepare_alloc_pages+0x1f0/0x5f0 [ 254.227266][ T9442] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 254.227292][ T9442] ? __alloc_frozen_pages_noprof+0x2b1/0x2bc0 [ 254.227321][ T9442] ? stack_trace_save+0x8e/0xc0 [ 254.227341][ T9442] ? __pfx_stack_trace_save+0x10/0x10 [ 254.227359][ T9442] ? arch_stack_walk+0xa6/0xf0 [ 254.227377][ T9442] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 254.227402][ T9442] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 254.227427][ T9442] ? kasan_save_stack+0x30/0x50 [ 254.227440][ T9442] ? kasan_save_track+0x14/0x30 [ 254.227453][ T9442] ? __kasan_kmalloc+0xaa/0xb0 [ 254.227466][ T9442] ? memory_bm_create+0x14d/0xba0 [ 254.227488][ T9442] ? do_syscall_64+0x10b/0xf80 [ 254.227506][ T9442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.227523][ T9442] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 254.227546][ T9442] ? policy_nodemask+0xed/0x4f0 [ 254.227565][ T9442] alloc_pages_mpol+0x1fb/0x540 [ 254.227584][ T9442] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 254.227601][ T9442] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 254.227621][ T9442] alloc_pages_noprof+0x1a/0x160 [ 254.227640][ T9442] get_zeroed_page_noprof+0x18/0xb0 [ 254.227658][ T9442] get_image_page+0x18/0x1a0 [ 254.227677][ T9442] alloc_rtree_node+0x3c/0xb0 [ 254.227695][ T9442] memory_bm_create+0x65e/0xba0 [ 254.227722][ T9442] create_basic_memory_bitmaps+0xbd/0x350 [ 254.227745][ T9442] snapshot_open+0x230/0x2a0 [ 254.227766][ T9442] ? __pfx_snapshot_open+0x10/0x10 [ 254.227787][ T9442] misc_open+0x26d/0x450 [ 254.227805][ T9442] ? __pfx_misc_open+0x10/0x10 [ 254.227822][ T9442] chrdev_open+0x234/0x6a0 [ 254.227845][ T9442] ? __pfx_apparmor_file_open+0x10/0x10 [ 254.227869][ T9442] ? __pfx_chrdev_open+0x10/0x10 [ 254.227889][ T9442] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 254.227913][ T9442] do_dentry_open+0x6d8/0x1660 [ 254.227931][ T9442] ? __pfx_chrdev_open+0x10/0x10 [ 254.227954][ T9442] vfs_open+0x82/0x3f0 [ 254.227977][ T9442] path_openat+0x208c/0x31a0 [ 254.228002][ T9442] ? __pfx_path_openat+0x10/0x10 [ 254.228027][ T9442] do_file_open+0x20e/0x430 [ 254.228046][ T9442] ? __pfx_do_file_open+0x10/0x10 [ 254.228086][ T9442] ? alloc_fd+0x476/0x790 [ 254.228107][ T9442] ? do_getname+0x191/0x390 [ 254.228131][ T9442] do_sys_openat2+0x10d/0x1e0 [ 254.228153][ T9442] ? __pfx_do_sys_openat2+0x10/0x10 [ 254.228177][ T9442] ? __fget_files+0x21f/0x3d0 [ 254.228198][ T9442] __x64_sys_openat+0x12d/0x210 [ 254.228221][ T9442] ? __pfx___x64_sys_openat+0x10/0x10 [ 254.228246][ T9442] ? rcu_is_watching+0x12/0xc0 [ 254.228266][ T9442] do_syscall_64+0x10b/0xf80 [ 254.228283][ T9442] ? clear_bhb_loop+0x40/0x90 [ 254.228301][ T9442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.228316][ T9442] RIP: 0033:0x7f93ed59cdd9 [ 254.228330][ T9442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.228345][ T9442] RSP: 002b:00007f93ee458028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 254.228364][ T9442] RAX: ffffffffffffffda RBX: 00007f93ed816090 RCX: 00007f93ed59cdd9 [ 254.228374][ T9442] RDX: 0000000000008001 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 254.228384][ T9442] RBP: 00007f93ed632d69 R08: 0000000000000000 R09: 0000000000000000 [ 254.228392][ T9442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 254.228401][ T9442] R13: 00007f93ed816128 R14: 00007f93ed816090 R15: 00007ffc4ee08458 [ 254.228422][ T9442] [ 254.233785][ T9218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 254.655206][ T9453] FAULT_INJECTION: forcing a failure. [ 254.655206][ T9453] name failslab, interval 1, probability 0, space 0, times 0 [ 254.714022][ T9453] CPU: 0 UID: 0 PID: 9453 Comm: syz.2.669 Tainted: G L syzkaller #0 PREEMPT(full) [ 254.714047][ T9453] Tainted: [L]=SOFTLOCKUP [ 254.714052][ T9453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 254.714060][ T9453] Call Trace: [ 254.714065][ T9453] [ 254.714070][ T9453] dump_stack_lvl+0x100/0x190 [ 254.714091][ T9453] should_fail_ex.cold+0x5/0xa [ 254.714110][ T9453] should_failslab+0xc2/0x120 [ 254.714127][ T9453] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 254.714149][ T9453] ? taskstats_exit+0x67b/0xc10 [ 254.714168][ T9453] ? rcu_is_watching+0x12/0xc0 [ 254.714188][ T9453] taskstats_exit+0x67b/0xc10 [ 254.714207][ T9453] ? __pfx_acct_update_integrals+0x10/0x10 [ 254.714228][ T9453] ? __pfx_taskstats_exit+0x10/0x10 [ 254.714249][ T9453] ? rcu_read_lock_any_held+0x6a/0xa0 [ 254.714267][ T9453] ? exit_signals+0x395/0xaf0 [ 254.714287][ T9453] do_exit+0x65c/0x2a60 [ 254.714311][ T9453] ? __pfx_do_exit+0x10/0x10 [ 254.714332][ T9453] ? do_raw_spin_lock+0x128/0x260 [ 254.714348][ T9453] ? find_held_lock+0x2b/0x80 [ 254.714366][ T9453] ? get_signal+0x7e0/0x21e0 [ 254.714385][ T9453] do_group_exit+0xd5/0x2a0 [ 254.714408][ T9453] get_signal+0x1ec7/0x21e0 [ 254.714432][ T9453] ? __pfx_get_signal+0x10/0x10 [ 254.714450][ T9453] ? do_futex+0x192/0x350 [ 254.714468][ T9453] arch_do_signal_or_restart+0x91/0x770 [ 254.714492][ T9453] ? find_held_lock+0x2b/0x80 [ 254.714510][ T9453] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 254.714536][ T9453] ? __pfx___x64_sys_futex+0x10/0x10 [ 254.714552][ T9453] ? rcu_is_watching+0x12/0xc0 [ 254.714570][ T9453] exit_to_user_mode_loop+0x86/0x4a0 [ 254.714584][ T9453] ? do_syscall_64+0x519/0xf80 [ 254.714604][ T9453] do_syscall_64+0x6f2/0xf80 [ 254.714621][ T9453] ? clear_bhb_loop+0x40/0x90 [ 254.714639][ T9453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.714652][ T9453] RIP: 0033:0x7f34cf99cdd9 [ 254.714664][ T9453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.714678][ T9453] RSP: 002b:00007f34d08460e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 254.714692][ T9453] RAX: fffffffffffffe00 RBX: 00007f34cfc16188 RCX: 00007f34cf99cdd9 [ 254.714701][ T9453] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f34cfc16188 [ 254.714709][ T9453] RBP: 00007f34cfc16180 R08: 0000000000000000 R09: 0000000000000000 [ 254.714717][ T9453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 254.714725][ T9453] R13: 00007f34cfc16218 R14: 00007ffc09f9c7f0 R15: 00007ffc09f9c8d8 [ 254.714743][ T9453] [ 255.828558][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.834969][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.165887][ T9218] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 256.239609][ T9218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 256.290367][ T9218] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 256.320876][ T9218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 256.388496][ T9218] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 256.429620][ T9218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 257.059608][ T9218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 257.152230][ T9218] 8021q: adding VLAN 0 to HW filter on device team0 [ 257.198131][ T136] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.205293][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 257.300026][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.307195][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.081970][ T9560] netlink: 'syz.3.680': attribute type 22 has an invalid length. [ 259.161748][ T9560] netlink: 330 bytes leftover after parsing attributes in process `syz.3.680'. [ 259.405849][ T9218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 259.631021][ T9218] veth0_vlan: entered promiscuous mode [ 259.689572][ T9218] veth1_vlan: entered promiscuous mode [ 259.808023][ T9218] veth0_macvtap: entered promiscuous mode [ 259.848232][ T9218] veth1_macvtap: entered promiscuous mode [ 259.923926][ T9218] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 259.973230][ T9218] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 260.043812][ T1341] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.080681][ T1341] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.129063][ T1341] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.177990][ T1341] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 260.424092][ T1341] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 260.482320][ T1341] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 260.598708][ T136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 260.657814][ T136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 260.981145][ T9593] ================================================================== [ 260.981167][ T9593] BUG: KASAN: vmalloc-out-of-bounds in sys_fillrect+0x174a/0x1910 [ 260.981196][ T9593] Write of size 8 at addr ffffc90004ba9000 by task syz.0.633/9593 [ 260.981210][ T9593] [ 260.981219][ T9593] CPU: 0 UID: 0 PID: 9593 Comm: syz.0.633 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.981240][ T9593] Tainted: [L]=SOFTLOCKUP [ 260.981245][ T9593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 260.981254][ T9593] Call Trace: [ 260.981259][ T9593] [ 260.981265][ T9593] dump_stack_lvl+0x100/0x190 [ 260.981281][ T9593] print_report+0x13d/0x4b0 [ 260.981301][ T9593] ? _raw_spin_lock_irqsave+0x52/0x60 [ 260.981319][ T9593] ? sys_fillrect+0x174a/0x1910 [ 260.981339][ T9593] kasan_report+0xdf/0x1d0 [ 260.981356][ T9593] ? sys_fillrect+0x174a/0x1910 [ 260.981378][ T9593] sys_fillrect+0x174a/0x1910 [ 260.981400][ T9593] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 260.981426][ T9593] bit_clear+0x17d/0x220 [ 260.981443][ T9593] ? __pfx_bit_clear+0x10/0x10 [ 260.981460][ T9593] ? fb_get_color_depth+0x120/0x250 [ 260.981476][ T9593] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 260.981498][ T9593] __fbcon_clear+0x633/0x760 [ 260.981513][ T9593] ? __pfx_bit_clear+0x10/0x10 [ 260.981531][ T9593] fbcon_scroll+0x314/0x650 [ 260.981546][ T9593] con_scroll+0x464/0x690 [ 260.981567][ T9593] csi_ECMA.constprop.0+0xc57/0x3b60 [ 260.981589][ T9593] ? find_held_lock+0x2b/0x80 [ 260.981611][ T9593] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 260.981635][ T9593] do_con_write+0x3946/0x4a10 [ 260.981655][ T9593] ? trace_contention_end+0x122/0x170 [ 260.981674][ T9593] ? __pfx_do_con_write+0x10/0x10 [ 260.981699][ T9593] con_write+0x23/0xb0 [ 260.981720][ T9593] n_tty_write+0x431/0x11c0 [ 260.981738][ T9593] ? __pfx_n_tty_write+0x10/0x10 [ 260.981752][ T9593] ? trace_kmalloc+0xe3/0x110 [ 260.981769][ T9593] ? __pfx_woken_wake_function+0x10/0x10 [ 260.981786][ T9593] ? rcu_is_watching+0x12/0xc0 [ 260.981803][ T9593] ? file_tty_write.isra.0+0x694/0x890 [ 260.981823][ T9593] ? kfree+0x1dd/0x6c0 [ 260.981842][ T9593] ? __pfx_n_tty_write+0x10/0x10 [ 260.981857][ T9593] file_tty_write.isra.0+0x4d2/0x890 [ 260.981879][ T9593] redirected_tty_write+0xd4/0x120 [ 260.981900][ T9593] vfs_write+0x6ac/0x1070 [ 260.981916][ T9593] ? __pfx_redirected_tty_write+0x10/0x10 [ 260.981938][ T9593] ? __pfx_vfs_write+0x10/0x10 [ 260.981952][ T9593] ? find_held_lock+0x2b/0x80 [ 260.981975][ T9593] ksys_write+0x12a/0x250 [ 260.981991][ T9593] ? __pfx_ksys_write+0x10/0x10 [ 260.982008][ T9593] ? rcu_is_watching+0x12/0xc0 [ 260.982025][ T9593] do_syscall_64+0x10b/0xf80 [ 260.982043][ T9593] ? clear_bhb_loop+0x40/0x90 [ 260.982059][ T9593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.982074][ T9593] RIP: 0033:0x7ff2c3b9cdd9 [ 260.982086][ T9593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.982101][ T9593] RSP: 002b:00007ff2c49c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 260.982117][ T9593] RAX: ffffffffffffffda RBX: 00007ff2c3e15fa0 RCX: 00007ff2c3b9cdd9 [ 260.982127][ T9593] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000003 [ 260.982137][ T9593] RBP: 00007ff2c3c32d69 R08: 0000000000000000 R09: 0000000000000000 [ 260.982146][ T9593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 260.982155][ T9593] R13: 00007ff2c3e16038 R14: 00007ff2c3e15fa0 R15: 00007ffd1d0a17b8 [ 260.982169][ T9593] [ 260.982174][ T9593] [ 260.982184][ T9593] The buggy address belongs to a 0-page vmalloc region starting at 0xffffc900048a9000 allocated at drm_gem_shmem_vmap_locked+0x553/0x860 [ 260.982212][ T9593] Memory state around the buggy address: [ 260.982221][ T9593] ffffc90004ba8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 260.982240][ T9593] ffffc90004ba8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 260.982251][ T9593] >ffffc90004ba9000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 260.982259][ T9593] ^ [ 260.982267][ T9593] ffffc90004ba9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 260.982277][ T9593] ffffc90004ba9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 260.982286][ T9593] ================================================================== [ 260.982308][ T9593] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 260.982323][ T9593] CPU: 0 UID: 0 PID: 9593 Comm: syz.0.633 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.982345][ T9593] Tainted: [L]=SOFTLOCKUP [ 260.982351][ T9593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 260.982360][ T9593] Call Trace: [ 260.982366][ T9593] [ 260.982372][ T9593] dump_stack_lvl+0x100/0x190 [ 260.982387][ T9593] vpanic+0x552/0x970 [ 260.982401][ T9593] ? __pfx_vpanic+0x10/0x10 [ 260.982421][ T9593] ? mark_held_locks+0x40/0x70 [ 260.982436][ T9593] ? sys_fillrect+0x174a/0x1910 [ 260.982457][ T9593] panic+0xd1/0xe0 [ 260.982470][ T9593] ? __pfx_panic+0x10/0x10 [ 260.982487][ T9593] check_panic_on_warn.cold+0x19/0x34 [ 260.982503][ T9593] end_report.part.0+0x3a/0x90 [ 260.982523][ T9593] kasan_report.cold+0xe/0x18 [ 260.982544][ T9593] ? sys_fillrect+0x174a/0x1910 [ 260.982567][ T9593] sys_fillrect+0x174a/0x1910 [ 260.982590][ T9593] drm_fbdev_shmem_defio_fillrect+0x22/0x140 [ 260.982607][ T9593] bit_clear+0x17d/0x220 [ 260.982623][ T9593] ? __pfx_bit_clear+0x10/0x10 [ 260.982640][ T9593] ? fb_get_color_depth+0x120/0x250 [ 260.982655][ T9593] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 260.982677][ T9593] __fbcon_clear+0x633/0x760 [ 260.982693][ T9593] ? __pfx_bit_clear+0x10/0x10 [ 260.982710][ T9593] fbcon_scroll+0x314/0x650 [ 260.982726][ T9593] con_scroll+0x464/0x690 [ 260.982747][ T9593] csi_ECMA.constprop.0+0xc57/0x3b60 [ 260.982768][ T9593] ? find_held_lock+0x2b/0x80 [ 260.982786][ T9593] ? __pfx_csi_ECMA.constprop.0+0x10/0x10 [ 260.982810][ T9593] do_con_write+0x3946/0x4a10 [ 260.982831][ T9593] ? trace_contention_end+0x122/0x170 [ 260.982850][ T9593] ? __pfx_do_con_write+0x10/0x10 [ 260.982875][ T9593] con_write+0x23/0xb0 [ 260.982895][ T9593] n_tty_write+0x431/0x11c0 [ 260.982913][ T9593] ? __pfx_n_tty_write+0x10/0x10 [ 260.982927][ T9593] ? trace_kmalloc+0xe3/0x110 [ 260.982944][ T9593] ? __pfx_woken_wake_function+0x10/0x10 [ 260.982961][ T9593] ? rcu_is_watching+0x12/0xc0 [ 260.982978][ T9593] ? file_tty_write.isra.0+0x694/0x890 [ 260.982998][ T9593] ? kfree+0x1dd/0x6c0 [ 260.983016][ T9593] ? __pfx_n_tty_write+0x10/0x10 [ 260.983032][ T9593] file_tty_write.isra.0+0x4d2/0x890 [ 260.983054][ T9593] redirected_tty_write+0xd4/0x120 [ 260.983075][ T9593] vfs_write+0x6ac/0x1070 [ 260.983091][ T9593] ? __pfx_redirected_tty_write+0x10/0x10 [ 260.983113][ T9593] ? __pfx_vfs_write+0x10/0x10 [ 260.983128][ T9593] ? find_held_lock+0x2b/0x80 [ 260.983151][ T9593] ksys_write+0x12a/0x250 [ 260.983166][ T9593] ? __pfx_ksys_write+0x10/0x10 [ 260.983183][ T9593] ? rcu_is_watching+0x12/0xc0 [ 260.983200][ T9593] do_syscall_64+0x10b/0xf80 [ 260.983218][ T9593] ? clear_bhb_loop+0x40/0x90 [ 260.983234][ T9593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.983249][ T9593] RIP: 0033:0x7ff2c3b9cdd9 [ 260.983260][ T9593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.983275][ T9593] RSP: 002b:00007ff2c49c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 260.983289][ T9593] RAX: ffffffffffffffda RBX: 00007ff2c3e15fa0 RCX: 00007ff2c3b9cdd9 [ 260.983299][ T9593] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000003 [ 260.983308][ T9593] RBP: 00007ff2c3c32d69 R08: 0000000000000000 R09: 0000000000000000 [ 260.983317][ T9593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 260.983327][ T9593] R13: 00007ff2c3e16038 R14: 00007ff2c3e15fa0 R15: 00007ffd1d0a17b8 [ 260.983345][ T9593] [ 260.983415][ T9593] Kernel Offset: disabled