last executing test programs: 7.20165385s ago: executing program 3 (id=4): r0 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r1, &(0x7f0000000020)=@name={0x1e, 0x2, 0x1, {{0x1}}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r2, &(0x7f0000000040)=@id={0x1e, 0x3, 0x1}, 0x10) nanosleep(&(0x7f0000000100)={0x0, 0xbebc200}, 0x0) 6.864346363s ago: executing program 3 (id=6): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000200)={&(0x7f0000000100)=@in={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000400)='hello', 0x5}], 0x1, &(0x7f0000000500)=[@sndrcv={0x0, 0x84, 0x1, {0x64, 0x0, 0x1}}], 0x20}, 0x0) 6.667924004s ago: executing program 3 (id=7): r0 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000200)="01154e00010000112233445588fb00010001160c00"/34, 0x22, 0x0, &(0x7f0000000040)={0x11, 0x88fb, r1, 0x0, 0x0, 0x0}, 0x14) 6.53980714s ago: executing program 1 (id=2): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x334) r1 = socket(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000014000500000000000000000023000000020000000800010004000000"], 0x20}}, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r3, &(0x7f0000000300)={0x23, 0x1, 0x4}, 0x10) listen(r3, 0x5) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r4, &(0x7f0000000400)={0x23, 0x1, 0x4}, 0x10) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) r5 = accept4$phonet_pipe(r3, 0x0, 0x0, 0x800) nanosleep(&(0x7f0000000600)={0x0, 0x2faf080}, 0x0) sendto$phonet(r4, &(0x7f0000000500)='hello', 0x5, 0x80, 0x0, 0x0) sendto$phonet(r5, &(0x7f0000000500)='hello', 0x5, 0x80, 0x0, 0x0) 6.50683539s ago: executing program 3 (id=8): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='127.0.0.1:6789:/\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='ceph\x00', 0x0, &(0x7f0000000400)='ms_mode=legacy\x00') (async) r1 = accept$inet(r0, 0x0, 0x0) write(r1, &(0x7f0000000500)='ceph v027\x00'/153, 0x99) write(r1, &(0x7f0000000080)="01ffffffffffffffff0000000000000000000000000000000001000000", 0x1d) write(r1, &(0x7f00000000c0)="0100000000000000000000000000000000290000000400000000000000100000000000010000000000000000000000572b1fb2", 0x33) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) 6.343310847s ago: executing program 0 (id=1): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000000), r0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x10, 0x1, 0x2, 0x0, {0x2}, [@generic="0101000000"]}, 0x14}}, 0x0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x14, r1, 0x1, 0x3}, 0x14}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f0000000040), 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000600)={'netdevsim0\x00', 0x1}) nanosleep(&(0x7f0000000700)={0x0, 0x1dcd6500}, 0x0) 6.116777675s ago: executing program 4 (id=5): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000d0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000e0)) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x3, 0x1}, 0x10) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r8, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 5.974547202s ago: executing program 4 (id=9): r0 = socket$phonet(0x23, 0x2, 0x1) bind$phonet(r0, &(0x7f0000000040), 0x10) ioctl$SIOCPNADDRESOURCE(r0, 0x89e0, &(0x7f0000000000)=0x1) 5.942770575s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, &(0x7f0000000400)='\x00') r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/times\x00', 0x1, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='N\x00', 0x1) write(r4, &(0x7f0000000100)='10\x00', 0x2) write(r5, &(0x7f0000000100)='100\x00', 0x3) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x605, 0x1, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3e8}}}}]}, 0x134}}, 0x0) 5.833864884s ago: executing program 4 (id=10): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x11, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x12, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x15, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x16, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x21, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x22, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x26, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x27, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x28, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x29, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2a, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2b, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2c, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2d, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2e, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x2f, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x2c, 0x30, 0x1, 0x0, 0x0, {0x1, 0x1}, [@generic="00000000140001800c0024800400010000000000"]}, 0x2c}}, 0x0) 5.460485323s ago: executing program 0 (id=11): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x334) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x23, 0x0, 0x0, 0x0, 0x1}, [@IFA_LOCAL={0x5, 0x2, @empty}]}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=@newlink={0x20, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, 0x1}}, 0x20}}, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_INITSTATE(r2, 0x113, 0x4, &(0x7f0000000600), 0x4) connect$phonet_pipe(r2, &(0x7f0000000700), 0x10) sendto$phonet(r2, &(0x7f0000000800)='\x00', 0x1, 0x80, 0x0, 0x0) 5.449228003s ago: executing program 2 (id=12): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x40, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'lo\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x40}}, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) bind(r3, &(0x7f0000000400)=@in={0x2, 0x1f90, @loopback}, 0x10) listen(r3, 0x5) connect(r2, &(0x7f0000000500)=@in={0x2, 0x1f90, @loopback}, 0x10) 3.985852216s ago: executing program 3 (id=13): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000050)=0x2, 0x4) r1 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendto(r1, &(0x7f0000000100)='abcdefghijklmnopqrstuvwxyz0123456789', 0x24, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000200)={0x1}, &(0x7f0000000240)=0x8) 3.790813239s ago: executing program 3 (id=14): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000120), 0x4) bind$rds(r1, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000140)={{0xfffffffffffffffc, 0x1000}, &(0x7f0000000180)}, 0x20) 396.386099ms ago: executing program 2 (id=15): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @empty, 0xc0000001}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="ffffffffffff00aabbccddee08004500001c123420004073483c00000000ffffffff00000000c0020014"], 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffff00aabbccddee08004500001c123420014073483700000000ffffffffc000000100000000"], 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffff00aabbccddee08004500001c123400024073683600000000ffffffff1122334455667788"], 0x0) 318.729426ms ago: executing program 1 (id=16): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x38, 0x3f, 0x107, 0x70bd2b, 0x0, {0x1}, [@nested={0x4, 0x2fc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x9, 0x23, 0x0, 0x0, @str='ovs0\x00'}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r0}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000031c0)={0x40, 0x42, 0x107, 0x0, 0x0, {0x3}, [@nested={0x22, 0x1, 0x0, 0x1, [@typed={0x1e, 0x0, 0x0, 0x0, @binary="00112233445566778899aabb08004500001c00000000010100000101010102020202"}]}, @nested={0x4, 0x8002}, @nested={0xc, 0x8003, 0x0, 0x1, [@nested={0x8, 0x8017, 0x0, 0x1, [@nested={0x4, 0x8001}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0x400c004) 278.412465ms ago: executing program 0 (id=17): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @empty}, 0x10) listen(r0, 0xa) r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='mon_addr\x00', &(0x7f0000000300)='127.0.0.1:6789\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000400)='source\x00', &(0x7f0000000500)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000600)='mount_timeout\x00', &(0x7f0000000700)='1\x00', 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000800)="6365706820763032370a000000000000000000021a857f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000021a857f0000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001ffffffffffffffff010000000100"/418, 0x134) 245.855576ms ago: executing program 2 (id=18): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'lo\x00'}]}]}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x601, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x138}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='1\n', 0x2) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @private=0xa010101}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x5, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)='lo\x00'}) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x0, @private=0xa010102}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x5, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='lo\x00'}) syz_emit_ethernet(0x2f, &(0x7f0000000300)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) syz_emit_ethernet(0x2f, &(0x7f0000000500)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @private=0xa010101}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) syz_emit_ethernet(0x2f, &(0x7f0000000700)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x21, 0x64, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @private=0xa010102}, {0x3030, 0x3030, 0xd, 0x0, @opaque="1234567890"}}}}}, 0x0) 0s ago: executing program 4 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1 1\n', 0x4) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'netdevsim0\x00'}) r2 = io_uring_setup(0x1, &(0x7f0000000180)={0x0, 0x0, 0x3000, 0x0, 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r2, 0x20, &(0x7f0000000240)={0x1, 0x0, 0x10, 0x0, &(0x7f00000002c0)={&(0x7f0000001000), 0x1000}, &(0x7f0000000300)={&(0x7f0000002000), 0x1000, 0x1}}, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.170' (ED25519) to the list of known hosts. [ 72.589792][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 72.589810][ T30] audit: type=1400 audit(1785768657.610:129): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 72.619860][ T30] audit: type=1400 audit(1785768657.640:130): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.623941][ T5594] cgroup: Unknown subsys name 'net' [ 72.650641][ T30] audit: type=1400 audit(1785768657.670:131): avc: denied { unmount } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 72.781724][ T5594] cgroup: Unknown subsys name 'cpuset' [ 72.789797][ T5594] cgroup: Unknown subsys name 'rlimit' [ 72.950414][ T30] audit: type=1400 audit(1785768657.970:132): avc: denied { setattr } for pid=5594 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=821 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 72.984556][ T30] audit: type=1400 audit(1785768657.970:133): avc: denied { create } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.029614][ T30] audit: type=1400 audit(1785768657.970:134): avc: denied { write } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.050204][ T30] audit: type=1400 audit(1785768657.970:135): avc: denied { read } for pid=5594 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 73.070590][ T30] audit: type=1400 audit(1785768657.980:136): avc: denied { mounton } for pid=5594 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 73.095554][ T30] audit: type=1400 audit(1785768657.990:137): avc: denied { mount } for pid=5594 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 73.097750][ T5596] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 73.129053][ T30] audit: type=1400 audit(1785768658.150:138): avc: denied { relabelto } for pid=5596 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 74.095545][ T5594] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.331960][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.337541][ T5621] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.341342][ T5618] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.348272][ T5621] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.354875][ T5618] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.363547][ T5621] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.378060][ T5621] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.379425][ T5618] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.387144][ T5621] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.393431][ T5618] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.400263][ T5621] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.407589][ T5618] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.414352][ T5621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.420877][ T5618] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.436368][ T5622] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.444926][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.444931][ T5622] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.446721][ T5622] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.454223][ T5619] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.470589][ T5618] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 76.475909][ T5619] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.483122][ T5618] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 76.519368][ T5611] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 76.530106][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 76.544753][ T5611] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 77.925841][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.934900][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.942558][ T5608] bridge_slave_0: entered allmulticast mode [ 77.950678][ T5608] bridge_slave_0: entered promiscuous mode [ 77.979172][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.986278][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.994845][ T5608] bridge_slave_1: entered allmulticast mode [ 78.001939][ T5608] bridge_slave_1: entered promiscuous mode [ 78.068399][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.075574][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.082916][ T5607] bridge_slave_0: entered allmulticast mode [ 78.089735][ T5607] bridge_slave_0: entered promiscuous mode [ 78.123482][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.130769][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.138203][ T5607] bridge_slave_1: entered allmulticast mode [ 78.145013][ T5607] bridge_slave_1: entered promiscuous mode [ 78.161017][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.203805][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.265427][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.304275][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.320406][ T5608] team0: Port device team_slave_0 added [ 78.326166][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.333426][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.340752][ T5606] bridge_slave_0: entered allmulticast mode [ 78.347963][ T5606] bridge_slave_0: entered promiscuous mode [ 78.355106][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.362409][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.370537][ T5609] bridge_slave_0: entered allmulticast mode [ 78.377626][ T5609] bridge_slave_0: entered promiscuous mode [ 78.401864][ T5608] team0: Port device team_slave_1 added [ 78.408045][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.415179][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.422396][ T5606] bridge_slave_1: entered allmulticast mode [ 78.429448][ T5606] bridge_slave_1: entered promiscuous mode [ 78.436270][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.443428][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.450815][ T5609] bridge_slave_1: entered allmulticast mode [ 78.457796][ T5609] bridge_slave_1: entered promiscuous mode [ 78.512637][ T5607] team0: Port device team_slave_0 added [ 78.518629][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.525774][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.533146][ T5624] bridge_slave_0: entered allmulticast mode [ 78.540117][ T5624] bridge_slave_0: entered promiscuous mode [ 78.547831][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.555536][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.563202][ T5611] Bluetooth: hci0: command tx timeout [ 78.563557][ T5621] Bluetooth: hci2: command tx timeout [ 78.569679][ T5611] Bluetooth: hci3: command tx timeout [ 78.575914][ T5622] Bluetooth: hci1: command tx timeout [ 78.582568][ T5624] bridge_slave_1: entered allmulticast mode [ 78.593820][ T5624] bridge_slave_1: entered promiscuous mode [ 78.601592][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.608585][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.634618][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.645650][ T5622] Bluetooth: hci4: command tx timeout [ 78.666088][ T5607] team0: Port device team_slave_1 added [ 78.683395][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.690468][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.716628][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.735591][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.748272][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.759296][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.802902][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.822426][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.834138][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.859900][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.866991][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.896954][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.909265][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.916259][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.942204][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.963613][ T5606] team0: Port device team_slave_0 added [ 79.002047][ T5606] team0: Port device team_slave_1 added [ 79.009694][ T5609] team0: Port device team_slave_0 added [ 79.025220][ T5624] team0: Port device team_slave_0 added [ 79.039436][ T5609] team0: Port device team_slave_1 added [ 79.058815][ T5608] hsr_slave_0: entered promiscuous mode [ 79.065202][ T5608] hsr_slave_1: entered promiscuous mode [ 79.073287][ T5624] team0: Port device team_slave_1 added [ 79.110198][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.117447][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.143778][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.164991][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.172371][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.198336][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.210912][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.218461][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.244527][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.263454][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.270492][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.296475][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.314761][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.321825][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.347821][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.365714][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.372737][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.398738][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.422771][ T5607] hsr_slave_0: entered promiscuous mode [ 79.429072][ T5607] hsr_slave_1: entered promiscuous mode [ 79.435060][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 79.441046][ T5607] Cannot create hsr debugfs directory [ 79.513158][ T5609] hsr_slave_0: entered promiscuous mode [ 79.519504][ T5609] hsr_slave_1: entered promiscuous mode [ 79.525522][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 79.531521][ T5609] Cannot create hsr debugfs directory [ 79.583125][ T5606] hsr_slave_0: entered promiscuous mode [ 79.589384][ T5606] hsr_slave_1: entered promiscuous mode [ 79.595409][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 79.601559][ T5606] Cannot create hsr debugfs directory [ 79.648890][ T5624] hsr_slave_0: entered promiscuous mode [ 79.655248][ T5624] hsr_slave_1: entered promiscuous mode [ 79.661504][ T5624] debugfs: 'hsr0' already exists in 'hsr' [ 79.667459][ T5624] Cannot create hsr debugfs directory [ 80.062016][ T5608] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 80.073914][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.081999][ T5608] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 80.091552][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.102581][ T5608] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 80.114642][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.122500][ T5608] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 80.132714][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.201024][ T5607] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 80.210508][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.225888][ T5607] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 80.236359][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.244559][ T5607] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 80.253403][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.261363][ T5607] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 80.270128][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.354428][ T5606] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.364950][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.373389][ T5606] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.384000][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.392143][ T5606] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.401507][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.409446][ T5606] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.418927][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.494879][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.545419][ T5609] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.555711][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.573348][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.581141][ T5609] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.590166][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.607916][ T5609] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.622230][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.637525][ T5622] Bluetooth: hci3: command tx timeout [ 80.637545][ T5621] Bluetooth: hci1: command tx timeout [ 80.637569][ T5621] Bluetooth: hci0: command tx timeout [ 80.642974][ T5611] Bluetooth: hci2: command tx timeout [ 80.673848][ T5609] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.683148][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.712503][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.720123][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.728969][ T5611] Bluetooth: hci4: command tx timeout [ 80.764791][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.771929][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.801466][ T5624] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.811149][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.819286][ T5624] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.829042][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.844086][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.851254][ T5624] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.860245][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.868713][ T5624] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.879366][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.926512][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.968400][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.985823][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.992957][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.013094][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.020231][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.064882][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.084338][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.091514][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.110132][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.117273][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.214469][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.283258][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.314898][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.351693][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.358877][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.376390][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.402342][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.409530][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.446261][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.453454][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.493156][ T1123] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.500363][ T1123] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.119761][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.334681][ T5608] veth0_vlan: entered promiscuous mode [ 82.383407][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.404943][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.431830][ T5608] veth1_vlan: entered promiscuous mode [ 82.582503][ T5608] veth0_macvtap: entered promiscuous mode [ 82.602275][ T5606] veth0_vlan: entered promiscuous mode [ 82.632770][ T5608] veth1_macvtap: entered promiscuous mode [ 82.682526][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.701477][ T5606] veth1_vlan: entered promiscuous mode [ 82.717701][ T5611] Bluetooth: hci2: command tx timeout [ 82.723159][ T5622] Bluetooth: hci3: command tx timeout [ 82.723213][ T5619] Bluetooth: hci1: command tx timeout [ 82.731902][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.734111][ T5621] Bluetooth: hci0: command tx timeout [ 82.773134][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.797728][ T5621] Bluetooth: hci4: command tx timeout [ 82.803433][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.890169][ T5606] veth0_macvtap: entered promiscuous mode [ 82.938528][ T5606] veth1_macvtap: entered promiscuous mode [ 82.960039][ T5624] veth0_vlan: entered promiscuous mode [ 82.992164][ T152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.000783][ T152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.020844][ T5624] veth1_vlan: entered promiscuous mode [ 83.057655][ T5607] veth0_vlan: entered promiscuous mode [ 83.074877][ T5609] veth0_vlan: entered promiscuous mode [ 83.084071][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.100118][ T152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.108911][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.113086][ T152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.128989][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.145089][ T5607] veth1_vlan: entered promiscuous mode [ 83.148636][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 83.148652][ T30] audit: type=1400 audit(1785768668.160:153): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.MTNXAb/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 83.155808][ T5609] veth1_vlan: entered promiscuous mode [ 83.167116][ T30] audit: type=1400 audit(1785768668.180:154): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.212450][ T30] audit: type=1400 audit(1785768668.180:155): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.MTNXAb/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 83.237186][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.238827][ T30] audit: type=1400 audit(1785768668.180:156): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 83.280050][ T5608] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 83.298910][ T30] audit: type=1400 audit(1785768668.210:157): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.MTNXAb/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 83.328503][ T5624] veth0_macvtap: entered promiscuous mode [ 83.331727][ T30] audit: type=1400 audit(1785768668.210:158): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/root/syzkaller.MTNXAb/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=7355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 83.340620][ T5624] veth1_macvtap: entered promiscuous mode [ 83.364362][ T30] audit: type=1400 audit(1785768668.220:159): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 83.390462][ T30] audit: type=1400 audit(1785768668.230:160): avc: denied { mounton } for pid=5608 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 83.407537][ T141] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.415728][ T30] audit: type=1400 audit(1785768668.230:161): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="gadgetfs" ino=7392 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 83.435335][ T5607] veth0_macvtap: entered promiscuous mode [ 83.447299][ T30] audit: type=1400 audit(1785768668.240:162): avc: denied { mount } for pid=5608 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 83.498323][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.528423][ T5609] veth0_macvtap: entered promiscuous mode [ 83.549747][ T5607] veth1_macvtap: entered promiscuous mode [ 83.563443][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.578103][ T48] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.587345][ T5609] veth1_macvtap: entered promiscuous mode [ 83.600364][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.639098][ T1123] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.648561][ T1123] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.687539][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.711644][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.734912][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.752916][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.758332][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.765921][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.776173][ T36] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.894781][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.912345][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.978308][ T48] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.065650][ T141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.076200][ T1123] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.087685][ T141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.140455][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.171711][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.226136][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.242915][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.333665][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.358087][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.386295][ T1123] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.426223][ T1123] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.435260][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.448763][ T1123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.456191][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.495519][ T5819] Zero length message leads to an empty skb [ 84.510520][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.521851][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.542207][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.559279][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.570278][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.767220][ T1123] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.800242][ T5619] Bluetooth: hci1: command tx timeout [ 84.800401][ T5622] Bluetooth: hci3: command tx timeout [ 84.805876][ T5621] Bluetooth: hci0: command tx timeout [ 84.811608][ T5611] Bluetooth: hci2: command tx timeout [ 84.838391][ T48] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.877576][ T5622] Bluetooth: hci4: command tx timeout [ 84.878214][ T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.888378][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 84.914340][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 84.925840][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 84.936341][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 84.937057][ T141] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.948142][ T5830] FAULT_INJECTION: forcing a failure. [ 84.948142][ T5830] name failslab, interval 1, probability 100, space 0, times 10 [ 84.954842][ T29] FAULT_INJECTION: forcing a failure. [ 84.954842][ T29] name failslab, interval 1, probability 100, space 0, times 10 [ 84.966889][ C0] FAULT_INJECTION: forcing a failure. [ 84.966889][ C0] name failslab, interval 1, probability 100, space 0, times 9 [ 84.979925][ C1] FAULT_INJECTION: forcing a failure. [ 84.979925][ C1] name failslab, interval 1, probability 100, space 0, times 9 [ 84.992690][ C0] CPU: 0 UID: 0 PID: 5830 Comm: syz.2.3 Not tainted syzkaller #0 PREEMPT(full) [ 84.992713][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 84.992728][ C0] Call Trace: [ 84.992733][ C0] [ 84.992740][ C0] dump_stack_lvl+0x100/0x190 [ 84.992769][ C0] should_fail_ex.cold+0x5/0xa [ 84.992789][ C0] should_failslab+0xc2/0x120 [ 84.992810][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 84.992831][ C0] ? __alloc_skb+0x140/0x710 [ 84.992855][ C0] __alloc_skb+0x140/0x710 [ 84.992873][ C0] ? __alloc_skb+0x5b7/0x710 [ 84.992890][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 84.992909][ C0] ? __pfx_ipv6_get_ifaddr+0x10/0x10 [ 84.992933][ C0] ndisc_alloc_skb+0xd8/0x530 [ 84.992956][ C0] ndisc_send_rs+0x370/0x680 [ 84.992981][ C0] addrconf_rs_timer+0x424/0x880 [ 84.993003][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 84.993029][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 84.993049][ C0] call_timer_fn+0x19a/0x610 [ 84.993071][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 84.993093][ C0] ? __run_timers+0x747/0xb00 [ 84.993115][ C0] ? rcu_is_watching+0x12/0xc0 [ 84.993147][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 84.993165][ C0] __run_timers+0x757/0xb00 [ 84.993188][ C0] ? __pfx___run_timers+0x10/0x10 [ 84.993216][ C0] ? ktime_get+0x9f/0x320 [ 84.993238][ C0] ? _raw_spin_lock_irq+0x45/0x50 [ 84.993265][ C0] run_timer_base+0x114/0x190 [ 84.993288][ C0] ? __pfx_run_timer_base+0x10/0x10 [ 84.993314][ C0] run_timer_softirq+0x1a/0x50 [ 84.993335][ C0] handle_softirqs+0x1ea/0x9b0 [ 84.993377][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 84.993406][ C0] ? _raw_spin_unlock+0x28/0x50 [ 84.993426][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 84.993450][ C0] __irq_exit_rcu+0x162/0x210 [ 84.993479][ C0] irq_exit_rcu+0x9/0x30 [ 84.993507][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 84.993534][ C0] [ 84.993541][ C0] [ 84.993549][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 84.993575][ C0] RIP: 0010:console_flush_one_record+0xac3/0xe50 [ 84.993611][ C0] Code: 00 e8 d1 25 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 bf d1 21 00 48 85 ed 0f 85 d7 01 00 00 e8 11 d7 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b [ 84.993638][ C0] RSP: 0018:ffffc900052074f0 EFLAGS: 00000287 [ 84.993660][ C0] RAX: ffffffff8f9aced8 RBX: ffffffff8f9ace80 RCX: ffffc90005de9000 [ 84.993675][ C0] RDX: 0000000000080000 RSI: ffffffff81e88b0f RDI: ffff88803213a540 [ 84.993689][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 84.993701][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000a1d [ 84.993714][ C0] R13: ffffffff8f9aced8 R14: ffffc90005207570 R15: dffffc0000000000 [ 84.993737][ C0] ? console_flush_one_record+0xabf/0xe50 [ 84.993780][ C0] ? __pfx_console_flush_one_record+0x10/0x10 [ 84.993813][ C0] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 84.993842][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 84.993868][ C0] console_unlock+0x103/0x260 [ 84.993901][ C0] ? __pfx_console_unlock+0x10/0x10 [ 84.993934][ C0] ? lock_acquire+0x101/0x370 [ 84.993970][ C0] vprintk_emit+0x407/0x6b0 [ 84.994005][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 84.994045][ C0] _printk+0xcf/0x110 [ 84.994071][ C0] ? __pfx__printk+0x10/0x10 [ 84.994098][ C0] ? __pfx____ratelimit+0x10/0x10 [ 84.994128][ C0] should_fail_ex+0x4e4/0x640 [ 84.994163][ C0] should_failslab+0xc2/0x120 [ 84.994192][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 84.994220][ C0] ? __alloc_skb+0x5b7/0x710 [ 84.994246][ C0] ? __alloc_skb+0x140/0x710 [ 84.994276][ C0] __alloc_skb+0x140/0x710 [ 84.994299][ C0] ? __alloc_skb+0x5b7/0x710 [ 84.994324][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 84.994364][ C0] netlink_alloc_large_skb+0x69/0x150 [ 84.994389][ C0] netlink_sendmsg+0x680/0xda0 [ 84.994418][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 84.994444][ C0] ? selinux_socket_sendmsg+0x198/0x2f0 [ 84.994482][ C0] ____sys_sendmsg+0xa4d/0xbe0 [ 84.994516][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 84.994541][ C0] ? __pfx_____sys_sendmsg+0x10/0x10 [ 84.994573][ C0] ? futex_hash+0x311/0x400 [ 84.994609][ C0] ? plist_del+0x308/0x510 [ 84.994632][ C0] ___sys_sendmsg+0x190/0x1e0 [ 84.994655][ C0] ? __pfx____sys_sendmsg+0x10/0x10 [ 84.994675][ C0] ? __lock_acquire+0x49f/0x1a40 [ 84.994702][ C0] ? futex_wake+0x220/0x5e0 [ 84.994752][ C0] __sys_sendmsg+0x160/0x210 [ 84.994782][ C0] ? __pfx___sys_sendmsg+0x10/0x10 [ 84.994824][ C0] do_syscall_64+0x115/0x870 [ 84.994849][ C0] ? clear_bhb_loop+0x40/0x90 [ 84.994875][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.994897][ C0] RIP: 0033:0x7ff37159e019 [ 84.994916][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.994935][ C0] RSP: 002b:00007ff372470028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 84.994954][ C0] RAX: ffffffffffffffda RBX: 00007ff371825fa0 RCX: 00007ff37159e019 [ 84.994969][ C0] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 84.994982][ C0] RBP: 00007ff37163500c R08: 0000000000000000 R09: 0000000000000000 [ 84.994995][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.995008][ C0] R13: 00007ff371826038 R14: 00007ff371825fa0 R15: 00007ffcafadf058 [ 84.995037][ C0] [ 84.995301][ T10] FAULT_INJECTION: forcing a failure. [ 84.995301][ T10] name failslab, interval 1, probability 100, space 0, times 8 [ 85.006119][ C1] CPU: 1 UID: 0 PID: 29 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 85.006145][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.006170][ C1] Workqueue: mld mld_dad_work [ 85.006202][ C1] Call Trace: [ 85.006209][ C1] [ 85.006217][ C1] dump_stack_lvl+0x100/0x190 [ 85.006242][ C1] should_fail_ex.cold+0x5/0xa [ 85.006270][ C1] should_failslab+0xc2/0x120 [ 85.006299][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.006327][ C1] ? __alloc_skb+0x140/0x710 [ 85.006356][ C1] __alloc_skb+0x140/0x710 [ 85.006381][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.006407][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.006434][ C1] ? lock_acquire+0x1b9/0x370 [ 85.006463][ C1] ? __pfx_wg_expired_send_persistent_keepalive+0x10/0x10 [ 85.006500][ C1] wg_packet_send_keepalive+0x7a/0x300 [ 85.006537][ C1] wg_expired_send_persistent_keepalive+0x5e/0x80 [ 85.006572][ C1] call_timer_fn+0x19a/0x610 [ 85.006598][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 85.006626][ C1] ? __pfx_wg_expired_send_persistent_keepalive+0x10/0x10 [ 85.006661][ C1] ? mark_held_locks+0x40/0x70 [ 85.006690][ C1] ? __pfx_wg_expired_send_persistent_keepalive+0x10/0x10 [ 85.006722][ C1] __run_timers+0x757/0xb00 [ 85.006757][ C1] ? __pfx___run_timers+0x10/0x10 [ 85.006792][ C1] ? ktime_get+0x9f/0x320 [ 85.006817][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 85.006851][ C1] run_timer_base+0x114/0x190 [ 85.006876][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 85.006905][ C1] run_timer_softirq+0x1a/0x50 [ 85.006929][ C1] handle_softirqs+0x1ea/0x9b0 [ 85.006962][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.006990][ C1] ? _raw_spin_unlock+0x28/0x50 [ 85.007011][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.007036][ C1] __irq_exit_rcu+0x162/0x210 [ 85.007063][ C1] irq_exit_rcu+0x9/0x30 [ 85.007090][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.007116][ C1] [ 85.007122][ C1] [ 85.007130][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.007155][ C1] RIP: 0010:console_flush_one_record+0xac3/0xe50 [ 85.007190][ C1] Code: 00 e8 d1 25 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 bf d1 21 00 48 85 ed 0f 85 d7 01 00 00 e8 11 d7 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b [ 85.007210][ C1] RSP: 0018:ffffc90000a474c0 EFLAGS: 00000293 [ 85.007225][ C1] RAX: ffffffff8f9aced8 RBX: ffffffff8f9ace80 RCX: ffffffff81e88b01 [ 85.007240][ C1] RDX: ffff88801f298000 RSI: ffffffff81e88b0f RDI: ffff88801f298000 [ 85.007254][ C1] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.007267][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000a1e [ 85.007280][ C1] R13: ffffffff8f9aced8 R14: ffffc90000a47540 R15: dffffc0000000000 [ 85.007301][ C1] ? console_flush_one_record+0xab1/0xe50 [ 85.007335][ C1] ? console_flush_one_record+0xabf/0xe50 [ 85.007377][ C1] ? __pfx_console_flush_one_record+0x10/0x10 [ 85.007409][ C1] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 85.007438][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 85.007465][ C1] console_unlock+0x103/0x260 [ 85.007497][ C1] ? __pfx_console_unlock+0x10/0x10 [ 85.007530][ C1] ? lock_acquire+0x101/0x370 [ 85.007559][ C1] ? vprintk_emit+0x66a/0x6b0 [ 85.007596][ C1] vprintk_emit+0x407/0x6b0 [ 85.007630][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 85.007670][ C1] _printk+0xcf/0x110 [ 85.007692][ C1] ? __pfx__printk+0x10/0x10 [ 85.007717][ C1] ? __pfx____ratelimit+0x10/0x10 [ 85.007748][ C1] should_fail_ex+0x4e4/0x640 [ 85.007782][ C1] should_failslab+0xc2/0x120 [ 85.007810][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.007842][ C1] ? __alloc_skb+0x140/0x710 [ 85.007872][ C1] __alloc_skb+0x140/0x710 [ 85.007896][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.007920][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.007948][ C1] ? __lock_acquire+0x49f/0x1a40 [ 85.007978][ C1] mld_newpack.isra.0+0x18e/0xa20 [ 85.008012][ C1] ? __pfx_mld_newpack.isra.0+0x10/0x10 [ 85.008047][ C1] ? rcu_is_watching+0x12/0xc0 [ 85.008083][ C1] ? add_grhead+0x299/0x340 [ 85.008110][ C1] add_grhead+0x299/0x340 [ 85.008140][ C1] add_grec+0x1389/0x1930 [ 85.008169][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 85.008203][ C1] ? __pfx_add_grec+0x10/0x10 [ 85.008239][ C1] mld_send_initial_cr+0x156/0x320 [ 85.008271][ C1] mld_dad_work+0x32/0x1f0 [ 85.008302][ C1] process_one_work+0xa23/0x1940 [ 85.008337][ C1] ? __pfx_process_one_work+0x10/0x10 [ 85.008369][ C1] ? __pfx_mld_dad_work+0x10/0x10 [ 85.008402][ C1] worker_thread+0x5ef/0xe50 [ 85.008436][ C1] ? kthread+0x13a/0x450 [ 85.008456][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.008479][ C1] kthread+0x370/0x450 [ 85.008498][ C1] ? __pfx_kthread+0x10/0x10 [ 85.008520][ C1] ret_from_fork+0x72b/0xd50 [ 85.008553][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 85.008584][ C1] ? __switch_to+0x800/0x10f0 [ 85.008606][ C1] ? __pfx_kthread+0x10/0x10 [ 85.008629][ C1] ret_from_fork_asm+0x1a/0x30 [ 85.008674][ C1] [ 85.008762][ C1] FAULT_INJECTION: forcing a failure. [ 85.008762][ C1] name failslab, interval 1, probability 100, space 0, times 7 [ 85.015356][ T5761] FAULT_INJECTION: forcing a failure. [ 85.015356][ T5761] name failslab, interval 1, probability 100, space 0, times 7 [ 85.025326][ C1] CPU: 1 UID: 0 PID: 29 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 85.025345][ C0] FAULT_INJECTION: forcing a failure. [ 85.025345][ C0] name failslab, interval 1, probability 100, space 0, times 7 [ 85.025350][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.025365][ C1] Workqueue: mld mld_dad_work [ 85.025398][ C1] Call Trace: [ 85.025405][ C1] [ 85.025413][ C1] dump_stack_lvl+0x100/0x190 [ 85.025441][ C1] should_fail_ex.cold+0x5/0xa [ 85.025470][ C1] should_failslab+0xc2/0x120 [ 85.025498][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.025528][ C1] ? __alloc_skb+0x140/0x710 [ 85.025560][ C1] __alloc_skb+0x140/0x710 [ 85.025585][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.025611][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.025639][ C1] ? __pfx_ipv6_get_ifaddr+0x10/0x10 [ 85.025672][ C1] ndisc_alloc_skb+0xd8/0x530 [ 85.025703][ C1] ndisc_send_rs+0x370/0x680 [ 85.025737][ C1] addrconf_rs_timer+0x424/0x880 [ 85.025768][ C1] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 85.025801][ C1] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 85.025828][ C1] call_timer_fn+0x19a/0x610 [ 85.025860][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 85.025889][ C1] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 85.025915][ C1] ? mark_held_locks+0x40/0x70 [ 85.025946][ C1] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 85.025971][ C1] __run_timers+0x757/0xb00 [ 85.026005][ C1] ? __pfx___run_timers+0x10/0x10 [ 85.026040][ C1] ? ktime_get+0x9f/0x320 [ 85.026066][ C1] ? _raw_spin_lock_irq+0x45/0x50 [ 85.026094][ C1] run_timer_base+0x114/0x190 [ 85.026120][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 85.026149][ C1] run_timer_softirq+0x1a/0x50 [ 85.026174][ C1] handle_softirqs+0x1ea/0x9b0 [ 85.026207][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.026235][ C1] ? _raw_spin_unlock+0x28/0x50 [ 85.026256][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.026281][ C1] __irq_exit_rcu+0x162/0x210 [ 85.026310][ C1] irq_exit_rcu+0x9/0x30 [ 85.026336][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.026363][ C1] [ 85.026370][ C1] [ 85.026378][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.026403][ C1] RIP: 0010:console_flush_one_record+0xac3/0xe50 [ 85.026439][ C1] Code: 00 e8 d1 25 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 bf d1 21 00 48 85 ed 0f 85 d7 01 00 00 e8 11 d7 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b [ 85.026460][ C1] RSP: 0018:ffffc90000a474c0 EFLAGS: 00000293 [ 85.026477][ C1] RAX: ffffffff8f9aced8 RBX: ffffffff8f9ace80 RCX: ffffffff81e88b01 [ 85.026491][ C1] RDX: ffff88801f298000 RSI: ffffffff81e88b0f RDI: ffff88801f298000 [ 85.026506][ C1] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.026519][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000a1e [ 85.026531][ C1] R13: ffffffff8f9aced8 R14: ffffc90000a47540 R15: dffffc0000000000 [ 85.026554][ C1] ? console_flush_one_record+0xab1/0xe50 [ 85.026587][ C1] ? console_flush_one_record+0xabf/0xe50 [ 85.026630][ C1] ? __pfx_console_flush_one_record+0x10/0x10 [ 85.026663][ C1] ? __hrtimer_rearm_deferred+0x23c/0x720 [ 85.026693][ C1] ? is_printk_cpu_sync_owner+0x32/0x40 [ 85.026720][ C1] console_unlock+0x103/0x260 [ 85.026756][ C1] ? __pfx_console_unlock+0x10/0x10 [ 85.026788][ C1] ? lock_acquire+0x101/0x370 [ 85.026820][ C1] ? vprintk_emit+0x66a/0x6b0 [ 85.026862][ C1] vprintk_emit+0x407/0x6b0 [ 85.026896][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 85.026937][ C1] _printk+0xcf/0x110 [ 85.026958][ C1] ? __pfx__printk+0x10/0x10 [ 85.026985][ C1] ? __pfx____ratelimit+0x10/0x10 [ 85.027016][ C1] should_fail_ex+0x4e4/0x640 [ 85.027050][ C1] should_failslab+0xc2/0x120 [ 85.027079][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.027107][ C1] ? __alloc_skb+0x140/0x710 [ 85.027137][ C1] __alloc_skb+0x140/0x710 [ 85.027162][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.027187][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.027214][ C1] ? __lock_acquire+0x49f/0x1a40 [ 85.027246][ C1] mld_newpack.isra.0+0x18e/0xa20 [ 85.027280][ C1] ? __pfx_mld_newpack.isra.0+0x10/0x10 [ 85.027315][ C1] ? rcu_is_watching+0x12/0xc0 [ 85.027350][ C1] ? add_grhead+0x299/0x340 [ 85.027377][ C1] add_grhead+0x299/0x340 [ 85.027408][ C1] add_grec+0x1389/0x1930 [ 85.027438][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 85.027471][ C1] ? __pfx_add_grec+0x10/0x10 [ 85.027508][ C1] mld_send_initial_cr+0x156/0x320 [ 85.027542][ C1] mld_dad_work+0x32/0x1f0 [ 85.027573][ C1] process_one_work+0xa23/0x1940 [ 85.027610][ C1] ? __pfx_process_one_work+0x10/0x10 [ 85.027642][ C1] ? __pfx_mld_dad_work+0x10/0x10 [ 85.027676][ C1] worker_thread+0x5ef/0xe50 [ 85.027710][ C1] ? kthread+0x13a/0x450 [ 85.027730][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.027753][ C1] kthread+0x370/0x450 [ 85.027773][ C1] ? __pfx_kthread+0x10/0x10 [ 85.027795][ C1] ret_from_fork+0x72b/0xd50 [ 85.027827][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 85.027865][ C1] ? __switch_to+0x800/0x10f0 [ 85.027888][ C1] ? __pfx_kthread+0x10/0x10 [ 85.027911][ C1] ret_from_fork_asm+0x1a/0x30 [ 85.027956][ C1] [ 85.027967][ C0] CPU: 0 UID: 0 PID: 5761 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) [ 85.027990][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.028002][ C0] Workqueue: events nsim_fib_event_work [ 85.028037][ C0] Call Trace: [ 85.028043][ C0] [ 85.028050][ C0] dump_stack_lvl+0x100/0x190 [ 85.028079][ C0] should_fail_ex.cold+0x5/0xa [ 85.028105][ C0] should_failslab+0xc2/0x120 [ 85.028135][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.028161][ C0] ? __alloc_skb+0x140/0x710 [ 85.028190][ C0] __alloc_skb+0x140/0x710 [ 85.028210][ C0] ? __alloc_skb+0x5b7/0x710 [ 85.028232][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 85.028256][ C0] ? lock_acquire+0x1b9/0x370 [ 85.028282][ C0] __netdev_alloc_skb+0x7a/0x960 [ 85.028305][ C1] FAULT_INJECTION: forcing a failure. [ 85.028305][ C1] name failslab, interval 1, probability 100, space 0, times 6 [ 85.028309][ C0] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.028350][ C0] ? __lock_acquire+0x49f/0x1a40 [ 85.028380][ C0] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.028413][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.028452][ C0] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.028491][ C0] __iterate_interfaces+0x2e6/0x650 [ 85.028520][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.028552][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.028582][ C0] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.028616][ C0] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.028640][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.028662][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 85.028708][ C0] hrtimer_run_softirq+0x17d/0x2c0 [ 85.028744][ C0] handle_softirqs+0x1ea/0x9b0 [ 85.028776][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 85.028805][ C0] ? _raw_spin_unlock+0x28/0x50 [ 85.028827][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.028852][ C0] __irq_exit_rcu+0x162/0x210 [ 85.028880][ C0] irq_exit_rcu+0x9/0x30 [ 85.028907][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.028934][ C0] [ 85.028941][ C0] [ 85.028949][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.028974][ C0] RIP: 0010:vprintk_emit+0x553/0x6b0 [ 85.029008][ C0] Code: 00 4d 85 ed 0f 85 1b 01 00 00 e8 18 b0 21 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 a6 aa 21 00 48 85 ed 0f 85 27 01 00 00 f8 af 21 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00 [ 85.029029][ C0] RSP: 0018:ffffc90004fdf868 EFLAGS: 00000293 [ 85.029046][ C0] RAX: 0000000000000000 RBX: 0000000000000060 RCX: ffffffff81e8b33a [ 85.029059][ C0] RDX: ffff888028ca8000 RSI: ffffffff81e8b344 RDI: ffff888028ca8000 [ 85.029075][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.029087][ C0] R10: 0000000000000000 R11: 000000000000758b R12: 1ffff920009fbf0f [ 85.029101][ C0] R13: 0000000000000200 R14: ffff88801f298000 R15: ffffc90004fdf930 [ 85.029123][ C0] ? vprintk_emit+0x66a/0x6b0 [ 85.029155][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.029191][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.029225][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 85.029268][ C0] _printk+0xcf/0x110 [ 85.029289][ C0] ? __pfx__printk+0x10/0x10 [ 85.029315][ C0] ? __pfx____ratelimit+0x10/0x10 [ 85.029351][ C0] should_fail_ex+0x4e4/0x640 [ 85.029386][ C0] should_failslab+0xc2/0x120 [ 85.029416][ C0] __kmalloc_cache_noprof+0x91/0x6c0 [ 85.029453][ C0] ? nsim_fib_event_work+0x156d/0x6310 [ 85.029492][ C0] nsim_fib_event_work+0x156d/0x6310 [ 85.029536][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 85.029568][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.029621][ C0] ? rcu_is_watching+0x12/0xc0 [ 85.029659][ C0] process_one_work+0xa23/0x1940 [ 85.029695][ C0] ? __pfx_process_one_work+0x10/0x10 [ 85.029727][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.029766][ C0] worker_thread+0x5ef/0xe50 [ 85.029798][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.029822][ C0] ? kthread+0x13a/0x450 [ 85.029841][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.029864][ C0] kthread+0x370/0x450 [ 85.029885][ C0] ? __pfx_kthread+0x10/0x10 [ 85.029908][ C0] ret_from_fork+0x72b/0xd50 [ 85.029939][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 85.029972][ C0] ? __switch_to+0x800/0x10f0 [ 85.029995][ C0] ? __pfx_kthread+0x10/0x10 [ 85.030018][ C0] ret_from_fork_asm+0x1a/0x30 [ 85.030064][ C0] [ 85.030075][ C1] CPU: 1 UID: 0 PID: 48 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 85.030086][ C0] FAULT_INJECTION: forcing a failure. [ 85.030086][ C0] name failslab, interval 1, probability 100, space 0, times 5 [ 85.030100][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.030114][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 85.030143][ C1] Call Trace: [ 85.030149][ C1] [ 85.030156][ C1] dump_stack_lvl+0x100/0x190 [ 85.030183][ C1] should_fail_ex.cold+0x5/0xa [ 85.030210][ C1] should_failslab+0xc2/0x120 [ 85.030238][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.030266][ C1] ? __alloc_skb+0x140/0x710 [ 85.030296][ C1] __alloc_skb+0x140/0x710 [ 85.030320][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.030346][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.030374][ C1] ? lock_acquire+0x1b9/0x370 [ 85.030404][ C1] __netdev_alloc_skb+0x7a/0x960 [ 85.030435][ C1] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.030467][ C1] ? __lock_acquire+0x49f/0x1a40 [ 85.030498][ C1] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.030530][ C1] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.030569][ C1] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.030607][ C1] __iterate_interfaces+0x2e6/0x650 [ 85.030634][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.030666][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.030695][ C1] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.030728][ C1] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.030751][ C1] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.030773][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 85.030817][ C1] hrtimer_run_softirq+0x17d/0x2c0 [ 85.030857][ C1] handle_softirqs+0x1ea/0x9b0 [ 85.030888][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.030917][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.030943][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.030968][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.030994][ C1] do_softirq+0xac/0xe0 [ 85.031022][ C1] [ 85.031029][ C1] [ 85.031036][ C1] __local_bh_enable_ip+0xf8/0x120 [ 85.031066][ C1] __alloc_skb+0x5db/0x710 [ 85.031089][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.031115][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.031139][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 85.031171][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 85.031209][ C1] nsim_dev_trap_report_work+0x2af/0xd20 [ 85.031250][ C1] process_one_work+0xa23/0x1940 [ 85.031286][ C1] ? __pfx_process_one_work+0x10/0x10 [ 85.031318][ C1] ? __pfx_nsim_dev_trap_report_work+0x10/0x10 [ 85.031349][ C1] worker_thread+0x5ef/0xe50 [ 85.031380][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.031406][ C1] ? kthread+0x13a/0x450 [ 85.031426][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.031448][ C1] kthread+0x370/0x450 [ 85.031468][ C1] ? __pfx_kthread+0x10/0x10 [ 85.031491][ C1] ret_from_fork+0x72b/0xd50 [ 85.031523][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 85.031556][ C1] ? __switch_to+0x800/0x10f0 [ 85.031578][ C1] ? __pfx_kthread+0x10/0x10 [ 85.031601][ C1] ret_from_fork_asm+0x1a/0x30 [ 85.031646][ C1] [ 85.031656][ C0] CPU: 0 UID: 0 PID: 5761 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) [ 85.031665][ C1] FAULT_INJECTION: forcing a failure. [ 85.031665][ C1] name failslab, interval 1, probability 100, space 0, times 4 [ 85.031681][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.031696][ C0] Workqueue: events nsim_fib_event_work [ 85.031729][ C0] Call Trace: [ 85.031736][ C0] [ 85.031743][ C0] dump_stack_lvl+0x100/0x190 [ 85.031770][ C0] should_fail_ex.cold+0x5/0xa [ 85.031797][ C0] should_failslab+0xc2/0x120 [ 85.031826][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.031853][ C0] ? __alloc_skb+0x140/0x710 [ 85.031884][ C0] __alloc_skb+0x140/0x710 [ 85.031909][ C0] ? __alloc_skb+0x5b7/0x710 [ 85.031934][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 85.031962][ C0] ? lock_acquire+0x1b9/0x370 [ 85.031995][ C0] __netdev_alloc_skb+0x7a/0x960 [ 85.032027][ C0] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.032059][ C0] ? __lock_acquire+0x49f/0x1a40 [ 85.032089][ C0] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.032121][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.032160][ C0] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.032198][ C0] __iterate_interfaces+0x2e6/0x650 [ 85.032226][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.032258][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.032287][ C0] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.032319][ C0] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.032347][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.032370][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 85.032412][ C0] hrtimer_run_softirq+0x17d/0x2c0 [ 85.032451][ C0] handle_softirqs+0x1ea/0x9b0 [ 85.032484][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 85.032513][ C0] ? _raw_spin_unlock+0x28/0x50 [ 85.032534][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.032560][ C0] __irq_exit_rcu+0x162/0x210 [ 85.032588][ C0] irq_exit_rcu+0x9/0x30 [ 85.032615][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.032641][ C0] [ 85.032648][ C0] [ 85.032656][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.032681][ C0] RIP: 0010:vprintk_emit+0x553/0x6b0 [ 85.032713][ C0] Code: 00 4d 85 ed 0f 85 1b 01 00 00 e8 18 b0 21 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 a6 aa 21 00 48 85 ed 0f 85 27 01 00 00 f8 af 21 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00 [ 85.032734][ C0] RSP: 0018:ffffc90004fdf868 EFLAGS: 00000293 [ 85.032751][ C0] RAX: 0000000000000000 RBX: 0000000000000060 RCX: ffffffff81e8b33a [ 85.032765][ C0] RDX: ffff888028ca8000 RSI: ffffffff81e8b344 RDI: ffff888028ca8000 [ 85.032779][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.032792][ C0] R10: 0000000000000000 R11: 000000000000758b R12: 1ffff920009fbf0f [ 85.032805][ C0] R13: 0000000000000200 R14: ffff88801f298000 R15: ffffc90004fdf930 [ 85.032826][ C0] ? vprintk_emit+0x66a/0x6b0 [ 85.032859][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.032895][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.032930][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 85.032971][ C0] _printk+0xcf/0x110 [ 85.032991][ C0] ? __pfx__printk+0x10/0x10 [ 85.033018][ C0] ? __pfx____ratelimit+0x10/0x10 [ 85.033048][ C0] should_fail_ex+0x4e4/0x640 [ 85.033082][ C0] should_failslab+0xc2/0x120 [ 85.033110][ C0] __kmalloc_cache_noprof+0x91/0x6c0 [ 85.033147][ C0] ? nsim_fib_event_work+0x156d/0x6310 [ 85.033185][ C0] nsim_fib_event_work+0x156d/0x6310 [ 85.033230][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 85.033262][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.033304][ C0] ? rcu_is_watching+0x12/0xc0 [ 85.033345][ C0] process_one_work+0xa23/0x1940 [ 85.033381][ C0] ? __pfx_process_one_work+0x10/0x10 [ 85.033413][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.033449][ C0] worker_thread+0x5ef/0xe50 [ 85.033481][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.033506][ C0] ? kthread+0x13a/0x450 [ 85.033526][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.033549][ C0] kthread+0x370/0x450 [ 85.033569][ C0] ? __pfx_kthread+0x10/0x10 [ 85.033592][ C0] ret_from_fork+0x72b/0xd50 [ 85.033624][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 85.033655][ C0] ? __switch_to+0x800/0x10f0 [ 85.033678][ C0] ? __pfx_kthread+0x10/0x10 [ 85.033701][ C0] ret_from_fork_asm+0x1a/0x30 [ 85.033746][ C0] [ 85.033756][ C1] CPU: 1 UID: 0 PID: 48 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 85.033765][ C0] FAULT_INJECTION: forcing a failure. [ 85.033765][ C0] name failslab, interval 1, probability 100, space 0, times 3 [ 85.033781][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.033795][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 85.033821][ C1] Call Trace: [ 85.033827][ C1] [ 85.033839][ C1] dump_stack_lvl+0x100/0x190 [ 85.033866][ C1] should_fail_ex.cold+0x5/0xa [ 85.033893][ C1] should_failslab+0xc2/0x120 [ 85.033922][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.033950][ C1] ? __alloc_skb+0x140/0x710 [ 85.033981][ C1] __alloc_skb+0x140/0x710 [ 85.034006][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.034031][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.034059][ C1] ? lock_acquire+0x1b9/0x370 [ 85.034090][ C1] __netdev_alloc_skb+0x7a/0x960 [ 85.034121][ C1] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.034153][ C1] ? __lock_acquire+0x49f/0x1a40 [ 85.034183][ C1] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.034214][ C1] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.034254][ C1] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.034292][ C1] __iterate_interfaces+0x2e6/0x650 [ 85.034318][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.034350][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.034380][ C1] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.034413][ C1] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.034436][ C1] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.034458][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 85.034501][ C1] hrtimer_run_softirq+0x17d/0x2c0 [ 85.034537][ C1] handle_softirqs+0x1ea/0x9b0 [ 85.034567][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.034597][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.034624][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.034648][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.034675][ C1] do_softirq+0xac/0xe0 [ 85.034702][ C1] [ 85.034708][ C1] [ 85.034715][ C1] __local_bh_enable_ip+0xf8/0x120 [ 85.034745][ C1] __alloc_skb+0x5db/0x710 [ 85.034770][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.034795][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.034820][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 85.034859][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 85.034896][ C1] nsim_dev_trap_report_work+0x2af/0xd20 [ 85.034938][ C1] process_one_work+0xa23/0x1940 [ 85.034973][ C1] ? __pfx_process_one_work+0x10/0x10 [ 85.035006][ C1] ? __pfx_nsim_dev_trap_report_work+0x10/0x10 [ 85.035037][ C1] worker_thread+0x5ef/0xe50 [ 85.035069][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.035094][ C1] ? kthread+0x13a/0x450 [ 85.035113][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.035136][ C1] kthread+0x370/0x450 [ 85.035157][ C1] ? __pfx_kthread+0x10/0x10 [ 85.035181][ C1] ret_from_fork+0x72b/0xd50 [ 85.035213][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 85.035244][ C1] ? __switch_to+0x800/0x10f0 [ 85.035267][ C1] ? __pfx_kthread+0x10/0x10 [ 85.035290][ C1] ret_from_fork_asm+0x1a/0x30 [ 85.035335][ C1] [ 85.035344][ C0] CPU: 0 UID: 0 PID: 5761 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) [ 85.035352][ C1] FAULT_INJECTION: forcing a failure. [ 85.035352][ C1] name failslab, interval 1, probability 100, space 0, times 2 [ 85.035370][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.035384][ C0] Workqueue: events nsim_fib_event_work [ 85.035415][ C0] Call Trace: [ 85.035421][ C0] [ 85.035428][ C0] dump_stack_lvl+0x100/0x190 [ 85.035455][ C0] should_fail_ex.cold+0x5/0xa [ 85.035482][ C0] should_failslab+0xc2/0x120 [ 85.035510][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.035538][ C0] ? __alloc_skb+0x140/0x710 [ 85.035569][ C0] __alloc_skb+0x140/0x710 [ 85.035593][ C0] ? __alloc_skb+0x5b7/0x710 [ 85.035619][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 85.035646][ C0] ? lock_acquire+0x1b9/0x370 [ 85.035677][ C0] __netdev_alloc_skb+0x7a/0x960 [ 85.035709][ C0] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.035741][ C0] ? __lock_acquire+0x49f/0x1a40 [ 85.035771][ C0] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.035803][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.035841][ C0] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.035879][ C0] __iterate_interfaces+0x2e6/0x650 [ 85.035907][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.035939][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.035968][ C0] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.036001][ C0] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.036024][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.036047][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 85.036090][ C0] hrtimer_run_softirq+0x17d/0x2c0 [ 85.036125][ C0] handle_softirqs+0x1ea/0x9b0 [ 85.036158][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 85.036187][ C0] ? _raw_spin_unlock+0x28/0x50 [ 85.036209][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.036234][ C0] __irq_exit_rcu+0x162/0x210 [ 85.036263][ C0] irq_exit_rcu+0x9/0x30 [ 85.036289][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.036314][ C0] [ 85.036321][ C0] [ 85.036329][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.036359][ C0] RIP: 0010:vprintk_emit+0x553/0x6b0 [ 85.036393][ C0] Code: 00 4d 85 ed 0f 85 1b 01 00 00 e8 18 b0 21 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 a6 aa 21 00 48 85 ed 0f 85 27 01 00 00 f8 af 21 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00 [ 85.036414][ C0] RSP: 0018:ffffc90004fdf868 EFLAGS: 00000293 [ 85.036430][ C0] RAX: 0000000000000000 RBX: 0000000000000060 RCX: ffffffff81e8b33a [ 85.036443][ C0] RDX: ffff888028ca8000 RSI: ffffffff81e8b344 RDI: ffff888028ca8000 [ 85.036458][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.036471][ C0] R10: 0000000000000000 R11: 000000000000758b R12: 1ffff920009fbf0f [ 85.036484][ C0] R13: 0000000000000200 R14: ffff88801f298000 R15: ffffc90004fdf930 [ 85.036506][ C0] ? vprintk_emit+0x66a/0x6b0 [ 85.036540][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.036578][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.036612][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 85.036653][ C0] _printk+0xcf/0x110 [ 85.036674][ C0] ? __pfx__printk+0x10/0x10 [ 85.036701][ C0] ? __pfx____ratelimit+0x10/0x10 [ 85.036732][ C0] should_fail_ex+0x4e4/0x640 [ 85.036766][ C0] should_failslab+0xc2/0x120 [ 85.036794][ C0] __kmalloc_cache_noprof+0x91/0x6c0 [ 85.036830][ C0] ? nsim_fib_event_work+0x156d/0x6310 [ 85.036868][ C0] nsim_fib_event_work+0x156d/0x6310 [ 85.036911][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 85.036944][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.036984][ C0] ? rcu_is_watching+0x12/0xc0 [ 85.037022][ C0] process_one_work+0xa23/0x1940 [ 85.037058][ C0] ? __pfx_process_one_work+0x10/0x10 [ 85.037090][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.037126][ C0] worker_thread+0x5ef/0xe50 [ 85.037158][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.037183][ C0] ? kthread+0x13a/0x450 [ 85.037203][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.037225][ C0] kthread+0x370/0x450 [ 85.037246][ C0] ? __pfx_kthread+0x10/0x10 [ 85.037269][ C0] ret_from_fork+0x72b/0xd50 [ 85.037299][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 85.037332][ C0] ? __switch_to+0x800/0x10f0 [ 85.037359][ C0] ? __pfx_kthread+0x10/0x10 [ 85.037382][ C0] ret_from_fork_asm+0x1a/0x30 [ 85.037427][ C0] [ 85.037437][ C1] CPU: 1 UID: 0 PID: 48 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 85.037459][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.037471][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 85.037477][ C0] FAULT_INJECTION: forcing a failure. [ 85.037477][ C0] name failslab, interval 1, probability 100, space 0, times 1 [ 85.037495][ C1] [ 85.037500][ C1] Call Trace: [ 85.037507][ C1] [ 85.037514][ C1] dump_stack_lvl+0x100/0x190 [ 85.037541][ C1] should_fail_ex.cold+0x5/0xa [ 85.037568][ C1] should_failslab+0xc2/0x120 [ 85.037597][ C1] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.037624][ C1] ? __alloc_skb+0x140/0x710 [ 85.037655][ C1] __alloc_skb+0x140/0x710 [ 85.037679][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.037704][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.037731][ C1] ? lock_acquire+0x1b9/0x370 [ 85.037763][ C1] __netdev_alloc_skb+0x7a/0x960 [ 85.037795][ C1] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.037827][ C1] ? __lock_acquire+0x49f/0x1a40 [ 85.037863][ C1] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.037894][ C1] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.037932][ C1] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.037970][ C1] __iterate_interfaces+0x2e6/0x650 [ 85.037997][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.038029][ C1] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.038058][ C1] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.038092][ C1] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.038116][ C1] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.038138][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 85.038181][ C1] hrtimer_run_softirq+0x17d/0x2c0 [ 85.038219][ C1] handle_softirqs+0x1ea/0x9b0 [ 85.038248][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.038278][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 85.038305][ C1] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.038329][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.038354][ C1] do_softirq+0xac/0xe0 [ 85.038381][ C1] [ 85.038388][ C1] [ 85.038395][ C1] __local_bh_enable_ip+0xf8/0x120 [ 85.038423][ C1] __alloc_skb+0x5db/0x710 [ 85.038448][ C1] ? __alloc_skb+0x5b7/0x710 [ 85.038473][ C1] ? __pfx___alloc_skb+0x10/0x10 [ 85.038499][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 85.038529][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 85.038566][ C1] nsim_dev_trap_report_work+0x2af/0xd20 [ 85.038608][ C1] process_one_work+0xa23/0x1940 [ 85.038644][ C1] ? __pfx_process_one_work+0x10/0x10 [ 85.038677][ C1] ? __pfx_nsim_dev_trap_report_work+0x10/0x10 [ 85.038709][ C1] worker_thread+0x5ef/0xe50 [ 85.038741][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.038766][ C1] ? kthread+0x13a/0x450 [ 85.038786][ C1] ? __pfx_worker_thread+0x10/0x10 [ 85.038808][ C1] kthread+0x370/0x450 [ 85.038829][ C1] ? __pfx_kthread+0x10/0x10 [ 85.038856][ C1] ret_from_fork+0x72b/0xd50 [ 85.038887][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 85.038918][ C1] ? __switch_to+0x800/0x10f0 [ 85.038940][ C1] ? __pfx_kthread+0x10/0x10 [ 85.038964][ C1] ret_from_fork_asm+0x1a/0x30 [ 85.039009][ C1] [ 85.039018][ C0] CPU: 0 UID: 0 PID: 5761 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) [ 85.039042][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.039055][ C0] Workqueue: events nsim_fib_event_work [ 85.039085][ C0] Call Trace: [ 85.039091][ C0] [ 85.039099][ C0] dump_stack_lvl+0x100/0x190 [ 85.039124][ C0] should_fail_ex.cold+0x5/0xa [ 85.039150][ C0] should_failslab+0xc2/0x120 [ 85.039179][ C0] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.039204][ C0] ? __alloc_skb+0x140/0x710 [ 85.039233][ C0] __alloc_skb+0x140/0x710 [ 85.039259][ C0] ? __alloc_skb+0x5b7/0x710 [ 85.039286][ C0] ? __pfx___alloc_skb+0x10/0x10 [ 85.039314][ C0] ? lock_acquire+0x1b9/0x370 [ 85.039347][ C0] __netdev_alloc_skb+0x7a/0x960 [ 85.039377][ C0] __ieee80211_beacon_get+0xba1/0x1ee0 [ 85.039409][ C0] ? __lock_acquire+0x49f/0x1a40 [ 85.039434][ C0] ieee80211_beacon_get_tim+0xa6/0x280 [ 85.039464][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 85.039504][ C0] mac80211_hwsim_beacon_tx+0x4c7/0xa00 [ 85.039543][ C0] __iterate_interfaces+0x2e6/0x650 [ 85.039571][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.039605][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 85.039634][ C0] ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 [ 85.039670][ C0] mac80211_hwsim_beacon+0xe5/0x2a0 [ 85.039692][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 85.039716][ C0] __hrtimer_run_queues+0x462/0x9c0 [ 85.039762][ C0] hrtimer_run_softirq+0x17d/0x2c0 [ 85.039800][ C0] handle_softirqs+0x1ea/0x9b0 [ 85.039834][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 85.039862][ C0] ? _raw_spin_unlock+0x28/0x50 [ 85.039885][ C0] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 85.039915][ C0] __irq_exit_rcu+0x162/0x210 [ 85.039944][ C0] irq_exit_rcu+0x9/0x30 [ 85.039973][ C0] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 85.040001][ C0] [ 85.040007][ C0] [ 85.040015][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 85.040042][ C0] RIP: 0010:vprintk_emit+0x553/0x6b0 [ 85.040077][ C0] Code: 00 4d 85 ed 0f 85 1b 01 00 00 e8 18 b0 21 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 a6 aa 21 00 48 85 ed 0f 85 27 01 00 00 f8 af 21 00 45 31 c9 41 b8 01 00 00 00 31 c9 48 8d 05 00 00 00 [ 85.040098][ C0] RSP: 0018:ffffc90004fdf868 EFLAGS: 00000293 [ 85.040115][ C0] RAX: 0000000000000000 RBX: 0000000000000060 RCX: ffffffff81e8b33a [ 85.040129][ C0] RDX: ffff888028ca8000 RSI: ffffffff81e8b344 RDI: ffff888028ca8000 [ 85.040144][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 85.040158][ C0] R10: 0000000000000000 R11: 000000000000758b R12: 1ffff920009fbf0f [ 85.040172][ C0] R13: 0000000000000200 R14: ffff88801f298000 R15: ffffc90004fdf930 [ 85.040194][ C0] ? vprintk_emit+0x66a/0x6b0 [ 85.040226][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.040258][ C0] ? vprintk_emit+0x674/0x6b0 [ 85.040291][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 85.040333][ C0] _printk+0xcf/0x110 [ 85.040358][ C0] ? __pfx__printk+0x10/0x10 [ 85.040381][ C0] ? __pfx____ratelimit+0x10/0x10 [ 85.040408][ C0] should_fail_ex+0x4e4/0x640 [ 85.040438][ C0] should_failslab+0xc2/0x120 [ 85.040465][ C0] __kmalloc_cache_noprof+0x91/0x6c0 [ 85.040498][ C0] ? nsim_fib_event_work+0x156d/0x6310 [ 85.040532][ C0] nsim_fib_event_work+0x156d/0x6310 [ 85.040572][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 85.040599][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.040635][ C0] ? rcu_is_watching+0x12/0xc0 [ 85.040668][ C0] process_one_work+0xa23/0x1940 [ 85.040699][ C0] ? __pfx_process_one_work+0x10/0x10 [ 85.040728][ C0] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.040760][ C0] worker_thread+0x5ef/0xe50 [ 85.040787][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.040809][ C0] ? kthread+0x13a/0x450 [ 85.040826][ C0] ? __pfx_worker_thread+0x10/0x10 [ 85.040846][ C0] kthread+0x370/0x450 [ 85.040863][ C0] ? __pfx_kthread+0x10/0x10 [ 85.040883][ C0] ret_from_fork+0x72b/0xd50 [ 85.040911][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 85.040939][ C0] ? __switch_to+0x800/0x10f0 [ 85.040959][ C0] ? __pfx_kthread+0x10/0x10 [ 85.040979][ C0] ret_from_fork_asm+0x1a/0x30 [ 85.041020][ C0] [ 85.062156][ T29] CPU: 1 UID: 0 PID: 29 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 85.062183][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.062196][ T29] Workqueue: mld mld_dad_work [ 85.062230][ T29] Call Trace: [ 85.062236][ T29] [ 85.062243][ T29] dump_stack_lvl+0x100/0x190 [ 85.062270][ T29] should_fail_ex.cold+0x5/0xa [ 85.062295][ T29] should_failslab+0xc2/0x120 [ 85.062320][ T29] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.062344][ T29] ? __alloc_skb+0x140/0x710 [ 85.062372][ T29] __alloc_skb+0x140/0x710 [ 85.062393][ T29] ? __alloc_skb+0x5b7/0x710 [ 85.062416][ T29] ? __pfx___alloc_skb+0x10/0x10 [ 85.062439][ T29] ? __lock_acquire+0x49f/0x1a40 [ 85.062467][ T29] mld_newpack.isra.0+0x18e/0xa20 [ 85.062498][ T29] ? __pfx_mld_newpack.isra.0+0x10/0x10 [ 85.062530][ T29] ? rcu_is_watching+0x12/0xc0 [ 85.062562][ T29] ? add_grhead+0x299/0x340 [ 85.062585][ T29] add_grhead+0x299/0x340 [ 85.062613][ T29] add_grec+0x1389/0x1930 [ 85.062638][ T29] ? __pfx___mutex_lock+0x10/0x10 [ 85.062687][ T29] ? __pfx_add_grec+0x10/0x10 [ 85.062720][ T29] mld_send_initial_cr+0x156/0x320 [ 85.062748][ T29] mld_dad_work+0x32/0x1f0 [ 85.062775][ T29] process_one_work+0xa23/0x1940 [ 85.062808][ T29] ? __pfx_process_one_work+0x10/0x10 [ 85.062843][ T29] ? __pfx_mld_dad_work+0x10/0x10 [ 85.062872][ T29] worker_thread+0x5ef/0xe50 [ 85.062904][ T29] ? kthread+0x13a/0x450 [ 85.062921][ T29] ? __pfx_worker_thread+0x10/0x10 [ 85.062941][ T29] kthread+0x370/0x450 [ 85.062960][ T29] ? __pfx_kthread+0x10/0x10 [ 85.062980][ T29] ret_from_fork+0x72b/0xd50 [ 85.063008][ T29] ? __pfx_ret_from_fork+0x10/0x10 [ 85.063036][ T29] ? __switch_to+0x800/0x10f0 [ 85.063057][ T29] ? __pfx_kthread+0x10/0x10 [ 85.063078][ T29] ret_from_fork_asm+0x1a/0x30 [ 85.063119][ T29] [ 85.097213][ T5830] CPU: 1 UID: 0 PID: 5830 Comm: syz.2.3 Not tainted syzkaller #0 PREEMPT(full) [ 85.097243][ T5830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.097256][ T5830] Call Trace: [ 85.097263][ T5830] [ 85.097271][ T5830] dump_stack_lvl+0x100/0x190 [ 85.097305][ T5830] should_fail_ex.cold+0x5/0xa [ 85.097332][ T5830] should_failslab+0xc2/0x120 [ 85.097360][ T5830] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.097387][ T5830] ? __alloc_skb+0x5b7/0x710 [ 85.097412][ T5830] ? __alloc_skb+0x140/0x710 [ 85.097441][ T5830] __alloc_skb+0x140/0x710 [ 85.097465][ T5830] ? __alloc_skb+0x5b7/0x710 [ 85.097489][ T5830] ? __pfx___alloc_skb+0x10/0x10 [ 85.097521][ T5830] netlink_alloc_large_skb+0x69/0x150 [ 85.097548][ T5830] netlink_sendmsg+0x680/0xda0 [ 85.097575][ T5830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.097600][ T5830] ? selinux_socket_sendmsg+0x198/0x2f0 [ 85.097636][ T5830] ____sys_sendmsg+0xa4d/0xbe0 [ 85.097668][ T5830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.097693][ T5830] ? __pfx_____sys_sendmsg+0x10/0x10 [ 85.097724][ T5830] ? futex_hash+0x311/0x400 [ 85.097758][ T5830] ? plist_del+0x308/0x510 [ 85.097781][ T5830] ___sys_sendmsg+0x190/0x1e0 [ 85.097805][ T5830] ? __pfx____sys_sendmsg+0x10/0x10 [ 85.097825][ T5830] ? __lock_acquire+0x49f/0x1a40 [ 85.097866][ T5830] ? futex_wake+0x220/0x5e0 [ 85.097918][ T5830] __sys_sendmsg+0x160/0x210 [ 85.097947][ T5830] ? __pfx___sys_sendmsg+0x10/0x10 [ 85.097990][ T5830] do_syscall_64+0x115/0x870 [ 85.098015][ T5830] ? clear_bhb_loop+0x40/0x90 [ 85.098040][ T5830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.098063][ T5830] RIP: 0033:0x7ff37159e019 [ 85.098081][ T5830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.098102][ T5830] RSP: 002b:00007ff372470028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 85.098122][ T5830] RAX: ffffffffffffffda RBX: 00007ff371825fa0 RCX: 00007ff37159e019 [ 85.098136][ T5830] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 85.098149][ T5830] RBP: 00007ff37163500c R08: 0000000000000000 R09: 0000000000000000 [ 85.098164][ T5830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.098177][ T5830] R13: 00007ff371826038 R14: 00007ff371825fa0 R15: 00007ffcafadf058 [ 85.098205][ T5830] [ 85.127438][ T29] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 85.132995][ T5831] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 85.155354][ T5814] ceph: No mds server is up or the cluster is laggy [ 85.161939][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) [ 85.161968][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.161981][ T10] Workqueue: mld mld_ifc_work [ 85.162012][ T10] Call Trace: [ 85.162019][ T10] [ 85.162025][ T10] dump_stack_lvl+0x100/0x190 [ 85.162052][ T10] should_fail_ex.cold+0x5/0xa [ 85.162082][ T10] should_failslab+0xc2/0x120 [ 85.162107][ T10] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 85.162132][ T10] ? __alloc_skb+0x140/0x710 [ 85.162161][ T10] __alloc_skb+0x140/0x710 [ 85.162181][ T10] ? __alloc_skb+0x5b7/0x710 [ 85.162204][ T10] ? __pfx___alloc_skb+0x10/0x10 [ 85.162228][ T10] ? __pfx_ip6_finish_output+0x10/0x10 [ 85.162254][ T10] ? NF_HOOK.constprop.0+0x277/0x5a0 [ 85.162283][ T10] mld_newpack.isra.0+0x18e/0xa20 [ 85.162309][ T10] ? lock_acquire+0x1b9/0x370 [ 85.162342][ T10] ? __pfx_mld_newpack.isra.0+0x10/0x10 [ 85.162369][ T10] ? rcu_is_watching+0x12/0xc0 [ 85.162398][ T10] ? trace_contention_end+0x126/0x160 [ 85.162429][ T10] ? add_grhead+0x299/0x340 [ 85.162452][ T10] add_grhead+0x299/0x340 [ 85.162479][ T10] add_grec+0x1389/0x1930 [ 85.162514][ T10] ? __pfx_add_grec+0x10/0x10 [ 85.162546][ T10] mld_ifc_work+0x3c5/0xc10 [ 85.162572][ T10] ? rcu_is_watching+0x12/0xc0 [ 85.162604][ T10] process_one_work+0xa23/0x1940 [ 85.162637][ T10] ? __pfx_process_one_work+0x10/0x10 [ 85.162686][ T10] ? __pfx_mld_ifc_work+0x10/0x10 [ 85.162715][ T10] worker_thread+0x5ef/0xe50 [ 85.162746][ T10] ? kthread+0x13a/0x450 [ 85.162764][ T10] ? __pfx_worker_thread+0x10/0x10 [ 85.162784][ T10] kthread+0x370/0x450 [ 85.162802][ T10] ? __pfx_kthread+0x10/0x10 [ 85.162822][ T10] ret_from_fork+0x72b/0xd50 [ 85.162850][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 85.162878][ T10] ? __switch_to+0x800/0x10f0 [ 85.162898][ T10] ? __pfx_kthread+0x10/0x10 [ 85.162919][ T10] ret_from_fork_asm+0x1a/0x30 [ 85.162961][ T10] [ 85.169891][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 85.169960][ T5829] ksmbd: Unknown IPC event: 1, ignore. [ 85.170279][ T5829] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 85.419949][ T24] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 85.428073][ T5761] CPU: 0 UID: 0 PID: 5761 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT(full) [ 85.428102][ T5761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 85.428115][ T5761] Workqueue: events nsim_fib_event_work [ 85.428150][ T5761] Call Trace: [ 85.428157][ T5761] [ 85.428165][ T5761] dump_stack_lvl+0x100/0x190 [ 85.428192][ T5761] should_fail_ex.cold+0x5/0xa [ 85.428218][ T5761] should_failslab+0xc2/0x120 [ 85.428246][ T5761] __kmalloc_cache_noprof+0x91/0x6c0 [ 85.428278][ T5761] ? nsim_fib_event_work+0x156d/0x6310 [ 85.428321][ T5761] nsim_fib_event_work+0x156d/0x6310 [ 85.428364][ T5761] ? debug_object_deactivate+0x2e4/0x3b0 [ 85.428393][ T5761] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.428429][ T5761] ? rcu_is_watching+0x12/0xc0 [ 85.428463][ T5761] process_one_work+0xa23/0x1940 [ 85.428498][ T5761] ? __pfx_process_one_work+0x10/0x10 [ 85.428527][ T5761] ? __pfx_nsim_fib_event_work+0x10/0x10 [ 85.428560][ T5761] worker_thread+0x5ef/0xe50 [ 85.428589][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 85.428612][ T5761] ? kthread+0x13a/0x450 [ 85.428630][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 85.428651][ T5761] kthread+0x370/0x450 [ 85.428670][ T5761] ? __pfx_kthread+0x10/0x10 [ 85.428691][ T5761] ret_from_fork+0x72b/0xd50 [ 85.428720][ T5761] ? __pfx_ret_from_fork+0x10/0x10 [ 85.428749][ T5761] ? __switch_to+0x800/0x10f0 [ 85.428771][ T5761] ? __pfx_kthread+0x10/0x10 [ 85.428791][ T5761] ret_from_fork_asm+0x1a/0x30 [ 85.428833][ T5761] [ 85.435013][ T5829] nbd: must specify at least one socket [ 85.952617][ T24] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 86.644712][ T932] cfg80211: failed to load regulatory.db [ 90.254267][ T5843] smc: net device lo applied user defined pnetid SYZ0 [ 90.261390][ T5831] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 90.270788][ T5836] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 90.328323][ T5834] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 90.343318][ T30] kauditd_printk_skb: 41 callbacks suppressed [ 90.343338][ T30] audit: type=1400 audit(1785768675.360:204): avc: denied { create } for pid=5853 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 90.392993][ T5838] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 90.425756][ T30] audit: type=1400 audit(1785768675.360:205): avc: denied { bind } for pid=5853 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 90.462222][ T5840] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10'. [ 90.503094][ T5840] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 90.532495][ T30] audit: type=1400 audit(1785768675.360:206): avc: denied { node_bind } for pid=5853 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 90.571092][ T5859] netlink: 'syz.1.16': attribute type 2 has an invalid length. [ 90.591923][ T5859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16'. [ 90.620891][ T5863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16'. [ 90.638234][ T30] audit: type=1400 audit(1785768675.550:207): avc: denied { node_bind } for pid=5855 comm="syz.0.17" src=6789 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 90.739972][ T30] audit: type=1400 audit(1785768675.620:208): avc: denied { create } for pid=5860 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 90.757460][ T5859] : entered promiscuous mode [ 90.775285][ C0] ------------[ cut here ]------------ [ 90.781180][ C0] (skb->_skb_refdst & ~(1UL)) && !(skb->_skb_refdst & 1UL) [ 90.781207][ C0] WARNING: ./include/linux/skbuff.h:1170 at nf_flow_offload_ip_hook+0xf6c/0x2b60, CPU#0: syz.2.18/5861 [ 90.799551][ C0] Modules linked in: [ 90.804334][ C0] CPU: 0 UID: 0 PID: 5861 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPT(full) [ 90.811026][ T30] audit: type=1400 audit(1785768675.640:209): avc: denied { write } for pid=5860 comm="syz.2.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 90.813530][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 90.843824][ C0] RIP: 0010:nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 90.850258][ C0] Code: 89 ee e8 87 4b 14 f8 48 83 fd 01 76 20 e8 dc 50 14 f8 83 e5 01 31 ff 48 89 ee e8 6f 4b 14 f8 48 85 ed 75 09 e8 c5 50 14 f8 90 <0f> 0b 90 e8 bc 50 14 f8 e8 e7 73 f7 f7 31 ff 89 c5 89 c6 e8 1c 4b [ 90.869920][ C0] RSP: 0018:ffffc90000007798 EFLAGS: 00010246 [ 90.876000][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89f61151 [ 90.884031][ C0] RDX: ffff8880343a8000 RSI: ffffffff89f6115b RDI: ffff8880343a8000 [ 90.892069][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 90.900101][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805a999418 [ 90.908114][ C0] R13: ffff88805aa74900 R14: ffff888056d6c1c0 R15: ffff88805aa74900 [ 90.916103][ C0] FS: 00007ff3724706c0(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000 [ 90.925108][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.931750][ C0] CR2: 0000001b3350aff8 CR3: 0000000073af3000 CR4: 00000000003526f0 [ 90.934833][ T5849] infiniband syz0: set active [ 90.939794][ C0] Call Trace: [ 90.939805][ C0] [ 90.939820][ C0] ? __pfx_ipv4_dst_check+0x10/0x10 [ 90.939859][ C0] ? __pfx_nf_flow_offload_ip_hook+0x10/0x10 [ 90.939894][ C0] ? __lock_acquire+0x49f/0x1a40 [ 90.939923][ C0] ? __pfx_ip_dst_mtu_maybe_forward+0x10/0x10 [ 90.946423][ T5849] infiniband syz0: added veth0 [ 90.948052][ C0] ? lock_acquire+0x1b9/0x370 [ 90.948094][ C0] nf_hook_slow+0xbf/0x220 [ 90.974348][ T30] audit: type=1400 audit(1785768675.990:210): avc: denied { mount } for pid=5864 comm="syz.4.19" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 90.977967][ C0] __netif_receive_skb_core.constprop.0+0x1689/0x3530 [ 90.978008][ C0] ? find_held_lock+0x2b/0x80 [ 90.978029][ C0] ? __pfx_ip_output+0x10/0x10 [ 90.978057][ C0] ? ip_forward_finish+0x1b4/0x320 [ 90.991144][ T30] audit: type=1400 audit(1785768676.010:211): avc: denied { allowed } for pid=5864 comm="syz.4.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 91.008803][ C0] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 91.008842][ C0] ? ip_forward+0xfa2/0x2690 [ 91.008888][ C0] ? __lock_acquire+0x49f/0x1a40 [ 91.046835][ T30] audit: type=1400 audit(1785768676.060:212): avc: denied { create } for pid=5864 comm="syz.4.19" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 91.049291][ C0] ? process_backlog+0x32a/0x1580 [ 91.086493][ T30] audit: type=1400 audit(1785768676.090:213): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 91.086868][ C0] __netif_receive_skb_one_core+0xb0/0x1e0 [ 91.107625][ T5849] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 91.111681][ C0] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 91.127809][ T5856] ceph: No mds server is up or the cluster is laggy [ 91.132411][ C0] ? lock_acquire+0x1b9/0x370 [ 91.132453][ C0] ? process_backlog+0x32a/0x1580 [ 91.148871][ C0] ? process_backlog+0x32a/0x1580 [ 91.153922][ C0] __netif_receive_skb+0x1f/0x120 [ 91.157266][ T5849] infiniband syz0: Couldn't open port 1 [ 91.159007][ C0] process_backlog+0x37a/0x1580 [ 91.169488][ C0] __napi_poll.constprop.0+0xaf/0x450 [ 91.174899][ C0] net_rx_action+0xa40/0xf20 [ 91.179598][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 91.179808][ T5849] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 91.184747][ C0] ? hrtimer_bases_first+0x1a0/0x210 [ 91.184785][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 91.184812][ C0] ? sched_clock+0x38/0x60 [ 91.207406][ T5849] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 91.210486][ C0] ? sched_clock_cpu+0x6c/0x570 [ 91.215097][ T5849] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 91.232036][ C0] ? rcu_is_watching+0x12/0xc0 [ 91.232077][ C0] handle_softirqs+0x1ea/0x9b0 [ 91.256195][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 91.261557][ C0] ? irqtime_account_delta+0x9a/0x110 [ 91.266994][ C0] ? tun_rx_batched.isra.0+0x402/0x750 [ 91.272492][ C0] do_softirq+0xac/0xe0 [ 91.276681][ C0] [ 91.279670][ C0] [ 91.282611][ C0] __local_bh_enable_ip+0xf8/0x120 [ 91.287783][ C0] tun_rx_batched.isra.0+0x407/0x750 [ 91.293111][ C0] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 91.299007][ C0] ? tun_get_user+0x1cc8/0x3c20 [ 91.303888][ C0] tun_get_user+0x1e31/0x3c20 [ 91.308642][ C0] ? __pfx_tun_get_user+0x10/0x10 [ 91.313705][ C0] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 91.319258][ C0] ? find_held_lock+0x2b/0x80 [ 91.323958][ C0] ? tun_get+0x191/0x370 [ 91.328264][ C0] ? tun_get+0x191/0x370 [ 91.332534][ C0] tun_chr_write_iter+0xdc/0x200 [ 91.337542][ C0] vfs_write+0x6ac/0x1050 [ 91.341911][ C0] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 91.347561][ C0] ? __pfx_vfs_write+0x10/0x10 [ 91.352363][ C0] ? find_held_lock+0x2b/0x80 [ 91.357117][ C0] ksys_write+0x12a/0x250 [ 91.361480][ C0] ? __pfx_ksys_write+0x10/0x10 [ 91.366375][ C0] do_syscall_64+0x115/0x870 [ 91.371045][ C0] ? clear_bhb_loop+0x40/0x90 [ 91.375777][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.381749][ C0] RIP: 0033:0x7ff37155e84e [ 91.386185][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 91.386738][ T24] libceph: mon0 (1)127.0.0.1:6789 socket closed (con state V1_BANNER) [ 91.405847][ C0] RSP: 002b:00007ff37246ffb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 91.405872][ C0] RAX: ffffffffffffffda RBX: 00007ff3724706c0 RCX: 00007ff37155e84e [ 91.405889][ C0] RDX: 000000000000002f RSI: 0000200000000300 RDI: 00000000000000c8 [ 91.438506][ C0] RBP: 00007ff37163500c R08: 0000000000000000 R09: 0000000000000000 [ 91.446490][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.454525][ C0] R13: 00007ff371826038 R14: 00007ff371825fa0 R15: 00007ffcafadf058 [ 91.462592][ C0] [ 91.465632][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 91.472921][ C0] CPU: 0 UID: 0 PID: 5861 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPT(full) [ 91.482046][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 91.492108][ C0] Call Trace: [ 91.495396][ C0] [ 91.498248][ C0] dump_stack_lvl+0x100/0x190 [ 91.502949][ C0] vpanic+0x552/0x970 [ 91.506935][ C0] ? __pfx_vpanic+0x10/0x10 [ 91.511441][ C0] panic+0xd1/0xe0 [ 91.515153][ C0] ? __pfx_panic+0x10/0x10 [ 91.519569][ C0] ? check_panic_on_warn+0x1f/0x90 [ 91.524677][ C0] check_panic_on_warn.cold+0x19/0x34 [ 91.530040][ C0] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 91.535763][ C0] __warn.cold+0x191/0x318 [ 91.540172][ C0] __report_bug+0x30f/0x440 [ 91.544668][ C0] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 91.550388][ C0] ? __pfx___report_bug+0x10/0x10 [ 91.555403][ C0] ? __pfx_flow_offload_lookup+0x10/0x10 [ 91.561029][ C0] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 91.566918][ C0] ? nf_flow_tuple_encap+0x33e/0xaf0 [ 91.572205][ C0] ? __lock_acquire+0x49f/0x1a40 [ 91.577143][ C0] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 91.582869][ C0] report_bug+0xb2/0x220 [ 91.587112][ C0] ? nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 91.592832][ C0] handle_bug+0x16a/0x2a0 [ 91.597162][ C0] exc_invalid_op+0x17/0x50 [ 91.601663][ C0] asm_exc_invalid_op+0x1a/0x20 [ 91.606504][ C0] RIP: 0010:nf_flow_offload_ip_hook+0xf6c/0x2b60 [ 91.612835][ C0] Code: 89 ee e8 87 4b 14 f8 48 83 fd 01 76 20 e8 dc 50 14 f8 83 e5 01 31 ff 48 89 ee e8 6f 4b 14 f8 48 85 ed 75 09 e8 c5 50 14 f8 90 <0f> 0b 90 e8 bc 50 14 f8 e8 e7 73 f7 f7 31 ff 89 c5 89 c6 e8 1c 4b [ 91.632432][ C0] RSP: 0018:ffffc90000007798 EFLAGS: 00010246 [ 91.638489][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff89f61151 [ 91.646445][ C0] RDX: ffff8880343a8000 RSI: ffffffff89f6115b RDI: ffff8880343a8000 [ 91.654402][ C0] RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000 [ 91.662356][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805a999418 [ 91.670318][ C0] R13: ffff88805aa74900 R14: ffff888056d6c1c0 R15: ffff88805aa74900 [ 91.678289][ C0] ? nf_flow_offload_ip_hook+0xf61/0x2b60 [ 91.684017][ C0] ? nf_flow_offload_ip_hook+0xf6b/0x2b60 [ 91.689739][ C0] ? nf_flow_offload_ip_hook+0xf6b/0x2b60 [ 91.695462][ C0] ? __pfx_ipv4_dst_check+0x10/0x10 [ 91.700660][ C0] ? __pfx_nf_flow_offload_ip_hook+0x10/0x10 [ 91.706639][ C0] ? __lock_acquire+0x49f/0x1a40 [ 91.711573][ C0] ? __pfx_ip_dst_mtu_maybe_forward+0x10/0x10 [ 91.717637][ C0] ? lock_acquire+0x1b9/0x370 [ 91.722311][ C0] nf_hook_slow+0xbf/0x220 [ 91.726718][ C0] __netif_receive_skb_core.constprop.0+0x1689/0x3530 [ 91.733481][ C0] ? find_held_lock+0x2b/0x80 [ 91.738148][ C0] ? __pfx_ip_output+0x10/0x10 [ 91.742906][ C0] ? ip_forward_finish+0x1b4/0x320 [ 91.748010][ C0] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 91.755109][ C0] ? ip_forward+0xfa2/0x2690 [ 91.759705][ C0] ? __lock_acquire+0x49f/0x1a40 [ 91.764640][ C0] ? process_backlog+0x32a/0x1580 [ 91.769662][ C0] __netif_receive_skb_one_core+0xb0/0x1e0 [ 91.775481][ C0] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 91.781895][ C0] ? lock_acquire+0x1b9/0x370 [ 91.786590][ C0] ? process_backlog+0x32a/0x1580 [ 91.791608][ C0] ? process_backlog+0x32a/0x1580 [ 91.796622][ C0] __netif_receive_skb+0x1f/0x120 [ 91.801639][ C0] process_backlog+0x37a/0x1580 [ 91.806486][ C0] __napi_poll.constprop.0+0xaf/0x450 [ 91.811856][ C0] net_rx_action+0xa40/0xf20 [ 91.816444][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 91.821547][ C0] ? hrtimer_bases_first+0x1a0/0x210 [ 91.826833][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 91.832022][ C0] ? sched_clock+0x38/0x60 [ 91.836430][ C0] ? sched_clock_cpu+0x6c/0x570 [ 91.841284][ C0] ? rcu_is_watching+0x12/0xc0 [ 91.846053][ C0] handle_softirqs+0x1ea/0x9b0 [ 91.850819][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 91.856097][ C0] ? irqtime_account_delta+0x9a/0x110 [ 91.861459][ C0] ? tun_rx_batched.isra.0+0x402/0x750 [ 91.866927][ C0] do_softirq+0xac/0xe0 [ 91.871079][ C0] [ 91.873997][ C0] [ 91.876914][ C0] __local_bh_enable_ip+0xf8/0x120 [ 91.882023][ C0] tun_rx_batched.isra.0+0x407/0x750 [ 91.887315][ C0] ? __pfx_tun_rx_batched.isra.0+0x10/0x10 [ 91.893141][ C0] ? tun_get_user+0x1cc8/0x3c20 [ 91.897986][ C0] tun_get_user+0x1e31/0x3c20 [ 91.902681][ C0] ? __pfx_tun_get_user+0x10/0x10 [ 91.907722][ C0] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 91.913225][ C0] ? find_held_lock+0x2b/0x80 [ 91.917897][ C0] ? tun_get+0x191/0x370 [ 91.922133][ C0] ? tun_get+0x191/0x370 [ 91.926369][ C0] tun_chr_write_iter+0xdc/0x200 [ 91.931299][ C0] vfs_write+0x6ac/0x1050 [ 91.935632][ C0] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 91.941172][ C0] ? __pfx_vfs_write+0x10/0x10 [ 91.945931][ C0] ? find_held_lock+0x2b/0x80 [ 91.950609][ C0] ksys_write+0x12a/0x250 [ 91.954937][ C0] ? __pfx_ksys_write+0x10/0x10 [ 91.959793][ C0] do_syscall_64+0x115/0x870 [ 91.964377][ C0] ? clear_bhb_loop+0x40/0x90 [ 91.969060][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.974959][ C0] RIP: 0033:0x7ff37155e84e [ 91.979362][ C0] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 91.998962][ C0] RSP: 002b:00007ff37246ffb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.007370][ C0] RAX: ffffffffffffffda RBX: 00007ff3724706c0 RCX: 00007ff37155e84e [ 92.015328][ C0] RDX: 000000000000002f RSI: 0000200000000300 RDI: 00000000000000c8 [ 92.023283][ C0] RBP: 00007ff37163500c R08: 0000000000000000 R09: 0000000000000000 [ 92.031238][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.039194][ C0] R13: 00007ff371826038 R14: 00007ff371825fa0 R15: 00007ffcafadf058 [ 92.047175][ C0] [ 92.050430][ C0] Kernel Offset: disabled [ 92.054736][ C0] Rebooting in 86400 seconds..