last executing test programs: 37.651716168s ago: executing program 2 (id=5873): openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ubifs/chk_lprops\x00', 0x210000, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/kvm/parameters/nx_huge_pages\x00', 0x80302, 0x0) sendfile$auto(r0, r0, 0x0, 0x400000000006) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848) madvise$auto(0x0, 0xffffffffffff0005, 0x17) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r1, 0x1, 0x7ff) ptrace$auto(0xc, r1, 0x6, 0x6) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r2, 0x5412, &(0x7f0000000040)="158f4a2b") r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r3, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) unshare$auto(0x40000080) r4 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, 0x0, 0x10004010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) bpf$auto(0x0, 0x0, 0x10) sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) 35.816695426s ago: executing program 2 (id=5877): mmap$auto(0x0, 0x276, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = eventfd$auto(0x7) writev$auto(0x4, &(0x7f0000000080)={&(0x7f0000000180), 0x8}, 0x7) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) openat$auto_wakeup_sources_stats_fops_wakeup(0xffffffffffffff9c, &(0x7f0000000000), 0x36281, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x200000000000404, 0x0) epoll_ctl$auto(r0, 0x5, r1, &(0x7f00000003c0)={0x7, 0x100000000}) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0xa, 0x1, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) r4 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80200, 0x0) recvmmsg$auto(r4, &(0x7f0000000340)={{&(0x7f0000000140)="c54d444bb27458c9ef21ffb70e2f6edaa60c7f1985a78399d660e120c46bf55c51eec96404dc59521a5bbee2b6c8a10005ee1598a3205bf64c0ae8f6d93fb599ad28ed0110f79e77c8b75e0f0988acce3688e4c332aa1e30899fbea5579a070c291dbbe2bc238b38e50df6", 0x8000000, &(0x7f0000000280)={&(0x7f0000000400)="6368fc2e4da8aafd4eadba875b74fb61cd3add3e6e7c94c8be4145b8cd8fa678e6ad1ee6ddb541ecd16af8484bd32621e48bc11e624f463f39a55f8f3437e43395f39ecaf27201a34744b428c459650fe71defbd6d76", 0x2}, 0x3, &(0x7f00000002c0)="d2ed7ef86bb513592a665e616e6be9712e7f011dbbc4786ade776fe2e1336fa9fc91c1a0eb36f34e4a74670d4088f83badb7a287f50875dbf8707dad280e93c1a48467da2750384aaaa116d8be75a54344e6f07f47df", 0xfff, 0x5}, 0x2}, 0x1, 0x40, &(0x7f0000000380)={0x4, 0x5}) sendmsg$auto_NBD_CMD_CONNECT(r2, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100020000000000000001000000100007800c00018008000180000000000c0002000600000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x8880) r5 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb0\x00', 0xc2000, 0x0) ioctl$auto(r5, 0x4611, r5) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r6 = socket(0x2, 0x1, 0x0) getsockopt$auto(r6, 0x6, 0x23, 0x0, &(0x7f0000000100)=0x14) close_range$auto(0x0, 0xffffeffe, 0x2) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty12\x00', 0x101c40, 0x0) r8 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) ioctl$auto(r7, 0x541c, r8) 35.09161087s ago: executing program 2 (id=5881): mmap$auto(0x0, 0x276, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = eventfd$auto(0x7) writev$auto(0x4, &(0x7f0000000080)={&(0x7f0000000180), 0x8}, 0x7) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) openat$auto_wakeup_sources_stats_fops_wakeup(0xffffffffffffff9c, &(0x7f0000000000), 0x36281, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x200000000000404, 0x0) epoll_ctl$auto(r0, 0x5, r1, &(0x7f00000003c0)={0x7, 0x100000000}) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0xa, 0x1, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) r4 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80200, 0x0) recvmmsg$auto(r4, &(0x7f0000000340)={{&(0x7f0000000140)="c54d444bb27458c9ef21ffb70e2f6edaa60c7f1985a78399d660e120c46bf55c51eec96404dc59521a5bbee2b6c8a10005ee1598a3205bf64c0ae8f6d93fb599ad28ed0110f79e77c8b75e0f0988acce3688e4c332aa1e30899fbea5579a070c291dbbe2bc238b38e50df6", 0x8000000, &(0x7f0000000280)={&(0x7f0000000400)="6368fc2e4da8aafd4eadba875b74fb61cd3add3e6e7c94c8be4145b8cd8fa678e6ad1ee6ddb541ecd16af8484bd32621e48bc11e624f463f39a55f8f3437e43395f39ecaf27201a34744b428c459650fe71defbd6d76caf66723a495969b034e4b44", 0x2}, 0x3, &(0x7f00000002c0)="d2ed7ef86bb513592a665e616e6be9712e7f011dbbc4786ade776fe2e1336fa9fc91c1a0eb36f34e4a7467", 0xfff, 0x5}, 0x2}, 0x1, 0x40, &(0x7f0000000380)={0x4, 0x5}) sendmsg$auto_NBD_CMD_CONNECT(r2, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100020000000000000001000000100007800c00018008000180000000000c0002000600000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x8880) r5 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb0\x00', 0xc2000, 0x0) ioctl$auto(r5, 0x4611, r5) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r6 = socket(0x2, 0x1, 0x0) getsockopt$auto(r6, 0x6, 0x23, 0x0, &(0x7f0000000100)=0x14) close_range$auto(0x0, 0xffffeffe, 0x2) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty12\x00', 0x101c40, 0x0) r8 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) ioctl$auto(r7, 0x541c, r8) 34.32436173s ago: executing program 2 (id=5883): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/pci0000:00/0000:00:03.0/virtio0/device\x00', 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(0x0, 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000280)={0x14, r2, 0xf3e97f51700e57cf, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = getpid() process_vm_readv$auto(r5, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 32.333857423s ago: executing program 2 (id=5887): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 31.585664897s ago: executing program 2 (id=5889): mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100) fcntl$auto(0x3, 0x400, 0x9ec0000000000000) mmap$auto(0x0, 0x8, 0xdf, 0xeb1, 0x0, 0x8000) close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$auto(0x3, 0x4188aec6, 0x38) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) rename$auto(0x0, 0x0) set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x121f01, 0x0) write$auto(r1, 0x0, 0xd) msync$auto(0x1ffff000, 0x1800000000000ff, 0x3) socket(0x10, 0x2, 0x6) open_tree$auto(0xffffffffffffff9c, &(0x7f0000001100)='./cgroup\x00', 0x2) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram3\x00', 0x44000, 0x0) r3 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/fail-nth\x00', 0x2, 0x0) write$auto(r3, &(0x7f0000000100)='7\x00\\\xa0\xe1J\x04|\x03\x7f\x81\xe4\x05\x1c\xc7k', 0x1) ioctl$auto_BLKBSZSET(r2, 0x40081271, &(0x7f00000000c0)=0x1000) socket(0x2b, 0x1, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) socket(0x2b, 0x1, 0x0) io_uring_setup$auto(0x6, 0x0) 31.170976505s ago: executing program 1 (id=5890): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000280)={0x14, r2, 0xf3e97f51700e57cf, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = getpid() process_vm_readv$auto(r5, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 29.351617027s ago: executing program 1 (id=5893): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/pci0000:00/0000:00:03.0/virtio0/device\x00', 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={0x0}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r2, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002bbd7000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r4 = getpid() process_vm_readv$auto(r4, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 27.547855126s ago: executing program 1 (id=5897): openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ubifs/chk_lprops\x00', 0x210000, 0x0) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/kvm/parameters/nx_huge_pages\x00', 0x80302, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_MON_PEER_GET(r0, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848) madvise$auto(0x0, 0xffffffffffff0005, 0x17) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r1, 0x1, 0x7ff) ptrace$auto(0xc, r1, 0x6, 0x6) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r2, 0x5412, &(0x7f0000000040)="158f4a2b") r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r3, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) unshare$auto(0x40000080) r4 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, 0x0, 0x10004010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) bpf$auto(0x0, 0x0, 0x10) sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) 25.555863562s ago: executing program 1 (id=5901): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/pci0000:00/0000:00:03.0/virtio0/device\x00', 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000280)={0x14, r2, 0xf3e97f51700e57cf, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(0x0, 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = getpid() process_vm_readv$auto(r5, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 23.837638207s ago: executing program 1 (id=5905): openat$auto_uhid_fops_uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_notify$auto(r0, &(0x7f0000000280)={@sival_int, @inferred=r0, 0x1, @_tid}) r1 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r1, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000040)={0x6, 0x0}) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0x8, 0xb0, @raw=0xfffff01c}}) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0) epoll_create$auto(0x3e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mtdblock0\x00', 0x14f602, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000200)='5', 0x1) unshare$auto(0xfffffffffffffffd) getsockopt$auto_SO_MEMINFO(0xffffffffffffffff, 0x1000000b, 0x37, 0x0, 0x0) r3 = socket(0xf, 0x3, 0xfffffffc) getsockopt$auto(r3, 0x11c, 0x4, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = socket(0x10, 0x2, 0xc) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$auto(0x4, 0x40009, 0xdf, 0x111, r4, 0x3) socket(0xa, 0x3, 0x87) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0x5dc}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/kvm/halt_poll_fail_hist\x00', 0x42, 0x0) write$auto(r5, &(0x7f0000000180)='0\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k>\xc8\x1f\xad\xf6\xf0\xef\xe4s\x95\xf2\x00\x97S\xb9O\xac\xbe\xd6\\J<\x02YK\xd6M\xe6\xe7\xa0\xb8\xc3[\x01\xc5\xe8|\xb0\xb0\x80\xbf\xa5?=i\x88UB\x1d\x8e\xd3\xc2\x949\xb6\xfb\x006\x02\x9c\xe5\x14\x13\x99\xc7\xb4)M\xed\tN $\xd4\xb2^?J\x92\x9a?\xf8b\x03\xd8\xdd\x84\xdf\x92\xf0\xcd\xd8\xba\xab\x15\x80\x9eo,\xc8\xf2\x82\xd2\x88\xbeL\xa0\x1a\xd3\xd5Of\x95\xee\x13e\xeb}o\x9b\x86_\xf0?\f<\xf3t7\xb6\x0f\x93\xc79@\xd8x\x9e\xef!\x006\b\xdbWB\x84\xdd\xac\xdau\x86g\x8f\x02@O7\x0f\xf8\x8d(\x9c\xf2NyD\x7f3\x14\x9eg\x86%)\xd6\b\xcd\x1f\x03\x00:\xa6\x83\'\xf4\xf2\x9dT\xf4z\x89\xc5D\xc4\x02\\\x81\xcf\x02Ep\xf6`\xdc*\x1dV', 0x5) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/audit\x00', 0x40, 0x0) 23.525453097s ago: executing program 1 (id=5907): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="1100"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 22.102286916s ago: executing program 0 (id=5910): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/pci0000:00/0000:00:03.0/virtio0/device\x00', 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/dev/cdrom/info\x00', 0x2000, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000280)={0x14, r2, 0xf3e97f51700e57cf, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r4 = getpid() process_vm_readv$auto(r4, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 21.152275168s ago: executing program 0 (id=5912): openat$auto_uhid_fops_uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_notify$auto(r0, &(0x7f0000000280)={@sival_int, @inferred=r0, 0x1, @_tid}) r1 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r1, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000040)={0x6, 0x0}) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0x8, 0xb0, @raw=0xfffff01c}}) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0) epoll_create$auto(0x3e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mtdblock0\x00', 0x14f602, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000200)='5', 0x1) unshare$auto(0xfffffffffffffffd) getsockopt$auto_SO_MEMINFO(0xffffffffffffffff, 0x1000000b, 0x37, 0x0, 0x0) r3 = socket(0xf, 0x3, 0xfffffffc) getsockopt$auto(r3, 0x11c, 0x4, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = socket(0x10, 0x2, 0xc) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$auto(0x4, 0x40009, 0xdf, 0x111, r4, 0x3) socket(0xa, 0x3, 0x87) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "00800000ffefffffff0200000001"}, 0x55) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0x5dc}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) 20.943257938s ago: executing program 0 (id=5913): mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100) fcntl$auto(0x3, 0x400, 0x9ec0000000000000) mmap$auto(0x0, 0x8, 0xdf, 0xeb1, 0x0, 0x8000) close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$auto(0x3, 0x4188aec6, 0x38) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) rename$auto(0x0, &(0x7f0000000080)='./file0\x00') set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x121f01, 0x0) write$auto(r1, 0x0, 0xd) msync$auto(0x1ffff000, 0x1800000000000ff, 0x3) socket(0x10, 0x2, 0x6) open_tree$auto(0xffffffffffffff9c, &(0x7f0000001100)='./cgroup\x00', 0x2) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram3\x00', 0x44000, 0x0) r3 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/fail-nth\x00', 0x2, 0x0) write$auto(r3, &(0x7f0000000100)='7\x00\\\xa0\xe1J\x04|\x03\x7f\x81\xe4\x05\x1c\xc7k', 0x1) ioctl$auto_BLKBSZSET(r2, 0x40081271, &(0x7f00000000c0)=0x1000) socket(0x2b, 0x1, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) socket(0x2b, 0x1, 0x0) io_uring_setup$auto(0x6, 0x0) 20.44438473s ago: executing program 0 (id=5915): openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ubifs/chk_lprops\x00', 0x210000, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/kvm/parameters/nx_huge_pages\x00', 0x80302, 0x0) sendfile$auto(r0, r0, 0x0, 0x400000000006) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848) madvise$auto(0x0, 0xffffffffffff0005, 0x17) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r2, 0x1, 0x7ff) ptrace$auto(0xc, r2, 0x6, 0x6) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r3, 0x5412, &(0x7f0000000040)="158f4a2b") r4 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r4, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) unshare$auto(0x40000080) r5 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, 0x0, 0x10004010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) bpf$auto(0x0, 0x0, 0x10) sendmsg$auto_NL80211_CMD_GET_REG(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) 19.690443391s ago: executing program 0 (id=5917): openat$auto_dfs_global_fops_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/ubifs/chk_lprops\x00', 0x210000, 0x0) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/kvm/parameters/nx_huge_pages\x00', 0x80302, 0x0) sendfile$auto(r0, r0, 0x0, 0x400000000006) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$auto_TIPC_NL_MON_PEER_GET(r1, &(0x7f0000006140)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4405}, 0x4c848) madvise$auto(0x0, 0xffffffffffff0005, 0x17) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) ptrace$auto(0x10, 0x0, 0x1, 0x7ff) ptrace$auto(0xc, 0x0, 0x6, 0x6) unshare$auto(0x40000080) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/cpu/cpu1/online\x00', 0x62, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) ioctl$auto_TIOCSTI2(r2, 0x5412, &(0x7f0000000040)="158f4a2b") r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/block/nbd7/queue/max_discard_segments\x00', 0x80000, 0x0) read$auto(r3, 0x0, 0x9) write$auto(0x3, 0x0, 0xfdef) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) unshare$auto(0x40000080) r4 = socket(0x10, 0x2, 0x0) sendmsg$auto_CTRL_CMD_GETPOLICY(0xffffffffffffffff, 0x0, 0x10004010) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB="1a0027"], 0x1ac}}, 0x40000) bpf$auto(0x0, 0x0, 0x10) sendmsg$auto_NL80211_CMD_GET_REG(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[], 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) 18.87894479s ago: executing program 0 (id=5919): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 17.404806358s ago: executing program 3 (id=5922): openat$auto_uhid_fops_uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_notify$auto(r0, &(0x7f0000000280)={@sival_int, @inferred=r0, 0x1, @_tid}) r1 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r1, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000040)={0x6, 0x0}) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0x8, 0xb0, @raw=0xfffff01c}}) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0) epoll_create$auto(0x3e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mtdblock0\x00', 0x14f602, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000200)='5', 0x1) unshare$auto(0xfffffffffffffffd) getsockopt$auto_SO_MEMINFO(0xffffffffffffffff, 0x1000000b, 0x37, 0x0, 0x0) r3 = socket(0xf, 0x3, 0xfffffffc) getsockopt$auto(r3, 0x11c, 0x4, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = socket(0x10, 0x2, 0xc) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$auto(0x4, 0x40009, 0xdf, 0x111, r4, 0x3) socket(0xa, 0x3, 0x87) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "00800000ffefffffff0200000001"}, 0x55) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0x5dc}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/kvm/halt_poll_fail_hist\x00', 0x42, 0x0) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/audit\x00', 0x40, 0x0) 17.213281115s ago: executing program 3 (id=5923): mmap$auto(0x0, 0x276, 0xdf, 0xeb1, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = eventfd$auto(0x7) writev$auto(0x4, &(0x7f0000000080)={&(0x7f0000000180), 0x8}, 0x7) madvise$auto(0x0, 0xffffffffffff0001, 0x15) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) openat$auto_wakeup_sources_stats_fops_wakeup(0xffffffffffffff9c, &(0x7f0000000000), 0x36281, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x200000000000404, 0x0) epoll_ctl$auto(r0, 0x5, r1, &(0x7f00000003c0)={0x7, 0x100000000}) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socket(0xa, 0x1, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) r4 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80200, 0x0) recvmmsg$auto(r4, &(0x7f0000000340)={{&(0x7f0000000140)="c54d444bb27458c9ef21ffb70e2f6edaa60c7f1985a78399d660e120c46bf55c51eec96404dc59521a5bbee2b6c8a10005ee1598a3205bf64c0ae8f6d93fb599ad28ed0110f79e77c8b75e0f0988acce3688e4c332aa1e30899fbea5579a070c291dbbe2bc238b38e50df6", 0x8000000, &(0x7f0000000280)={&(0x7f0000000400)="6368fc2e4da8aafd4eadba875b74fb61cd3add3e6e7c94c8be4145b8cd8fa678e6ad1ee6ddb541ecd16af8484bd32621e48bc11e624f463f39a55f8f3437e43395f39ecaf27201a34744b428c459650fe71defbd6d76caf66723a495969b034e4b44", 0x2}, 0x3, 0x0, 0xfff, 0x5}, 0x2}, 0x1, 0x40, &(0x7f0000000380)={0x4, 0x5}) sendmsg$auto_NBD_CMD_CONNECT(r2, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100020000000000000001000000100007800c00018008000180000000000c0002000600000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x8880) r5 = openat$auto_fb_fops_fb_chrdev(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb0\x00', 0xc2000, 0x0) ioctl$auto(r5, 0x4611, r5) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r6 = socket(0x2, 0x1, 0x0) getsockopt$auto(r6, 0x6, 0x23, 0x0, &(0x7f0000000100)=0x14) close_range$auto(0x0, 0xffffeffe, 0x2) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000800)='/dev/tty0\x00', 0x102, 0x0) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty12\x00', 0x101c40, 0x0) r8 = socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) ioctl$auto(r7, 0x541c, r8) 16.955571894s ago: executing program 3 (id=5924): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/pci0000:00/0000:00:03.0/virtio0/device\x00', 0x800, 0x0) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008012, r0, 0x8000) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mmap$auto(0x0, 0x5, 0x2, 0x40eb2, 0x401, 0x300000000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_GET_RADIO(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000000280)={0x14, r2, 0xf3e97f51700e57cf, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x884}, 0x8020) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$auto_HWSIM_CMD_NEW_RADIO(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcdbdf2504"], 0x20}, 0x1, 0x0, 0x0, 0x24040000}, 0x18800) read$auto(r1, 0x0, 0x3) mlock$auto(0x7c88, 0x7fff) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x800) sendmsg$auto_BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c894}, 0x4) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="72010000", @ANYBLOB=' \x00\''], 0x1ac}}, 0x0) setrlimit$auto(0x1000000007, 0x0) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r5 = getpid() process_vm_readv$auto(r5, &(0x7f00000001c0)={0x0, 0xfff}, 0x3, &(0x7f0000000280)={&(0x7f0000000100)="6c4bc022f1a924305022a30137693a982a453ee9ff2946c55588f6e6", 0xffffffff}, 0x6, 0x0) bpf$auto(0x5, 0x0, 0x7) 16.477384813s ago: executing program 3 (id=5925): openat$auto_uhid_fops_uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) mmap$auto(0x0, 0x400008, 0x5f, 0x9b72, 0x2, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_notify$auto(r0, &(0x7f0000000280)={@sival_int, @inferred=r0, 0x1, @_tid}) r1 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r1, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000040)={0x6, 0x0}) ioctl$auto_PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0x8, 0xb0, @raw=0xfffff01c}}) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x0, 0x0) epoll_create$auto(0x3e) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mtdblock0\x00', 0x14f602, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r2, &(0x7f0000000200)='5', 0x1) unshare$auto(0xfffffffffffffffd) getsockopt$auto_SO_MEMINFO(0xffffffffffffffff, 0x1000000b, 0x37, 0x0, 0x0) r3 = socket(0xf, 0x3, 0xfffffffc) getsockopt$auto(r3, 0x11c, 0x4, 0x0, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = socket(0x10, 0x2, 0xc) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$auto(0x4, 0x40009, 0xdf, 0x111, r4, 0x3) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa, "00800000ffefffffff0200000001"}, 0x55) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0x5dc}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/debug/kvm/halt_poll_fail_hist\x00', 0x42, 0x0) write$auto(r5, &(0x7f0000000180)='0\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k>\xc8\x1f\xad\xf6\xf0\xef\xe4s\x95\xf2\x00\x97S\xb9O\xac\xbe\xd6\\J<\x02YK\xd6M\xe6\xe7\xa0\xb8\xc3[\x01\xc5\xe8|\xb0\xb0\x80\xbf\xa5?=i\x88UB\x1d\x8e\xd3\xc2\x949\xb6\xfb\x006\x02\x9c\xe5\x14\x13\x99\xc7\xb4)M\xed\tN $\xd4\xb2^?J\x92\x9a?\xf8b\x03\xd8\xdd\x84\xdf\x92\xf0\xcd\xd8\xba\xab\x15\x80\x9eo,\xc8\xf2\x82\xd2\x88\xbeL\xa0\x1a\xd3\xd5Of\x95\xee\x13e\xeb}o\x9b\x86_\xf0?\f<\xf3t7\xb6\x0f\x93\xc79@\xd8x\x9e\xef!\x006\b\xdbWB\x84\xdd\xac\xdau\x86g\x8f\x02@O7\x0f\xf8\x8d(\x9c\xf2NyD\x7f3\x14\x9eg\x86%)\xd6\b\xcd\x1f\x03\x00:\xa6\x83\'\xf4\xf2\x9dT\xf4z\x89\xc5D\xc4\x02\\\x81\xcf\x02Ep\xf6`\xdc*\x1dV', 0x5) openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/audit\x00', 0x40, 0x0) 16.322225057s ago: executing program 3 (id=5926): mmap$auto(0x0, 0x20009, 0x4000000000df, 0x40000000000eb1, 0x401, 0x8000) mbind$auto(0x8000, 0xfa9d, 0x2, &(0x7f0000000280)=0x20000000000000f7, 0x3, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x161342, 0x100) fcntl$auto(0x3, 0x400, 0x9ec0000000000000) mmap$auto(0x0, 0x8, 0xdf, 0xeb1, 0x0, 0x8000) close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$auto(0x3, 0x4188aec6, 0x38) close_range$auto(0x2, 0x8, 0x0) unshare$auto(0x40000080) rename$auto(0x0, 0x0) set_mempolicy_home_node$auto(0x0, 0x2010001, 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x121f01, 0x0) write$auto(r1, 0x0, 0xd) msync$auto(0x1ffff000, 0x1800000000000ff, 0x3) socket(0x10, 0x2, 0x6) open_tree$auto(0xffffffffffffff9c, &(0x7f0000001100)='./cgroup\x00', 0x2) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram3\x00', 0x44000, 0x0) r3 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/fail-nth\x00', 0x2, 0x0) write$auto(r3, &(0x7f0000000100)='7\x00\\\xa0\xe1J\x04|\x03\x7f\x81\xe4\x05\x1c\xc7k', 0x1) ioctl$auto_BLKBSZSET(r2, 0x40081271, &(0x7f00000000c0)=0x1000) socket(0x2b, 0x1, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x59, &(0x7f0000000100)={0x0, 0x1d, 0x3000, 0x6, 0x7, 0x400a, 0xffffffffffffffff, [], {0x6, 0x6, 0x8c48, 0x29b, 0x3, 0x7f, 0x0, 0x6}, {0xe63c, 0x1, 0x52, 0x85, 0x2, 0x1a7b870a, 0x76c2, 0x8000c, 0x100000000}}) socket(0x2b, 0x1, 0x0) io_uring_setup$auto(0x6, 0x0) 15.783042763s ago: executing program 3 (id=5927): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 8.503017265s ago: executing program 32 (id=5907): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="1100"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 3.50009017s ago: executing program 33 (id=5919): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00', @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) 0s ago: executing program 34 (id=5927): close_range$auto(0x2, 0x8, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$auto(0x3, &(0x7f0000000000)=@generic={0x10, "a500acb75c9cedd1b5e9a0d76293"}, 0x68) r0 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x2, 0x0) write$auto_seq_oss_f_ops_seq_oss(r0, &(0x7f0000000040)="f6e6812018deadf7e88f819e30236ce79200e01532f2ed0d", 0x18) r1 = openat$auto_nsim_dev_health_break_fops_health(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/netdevsim/netdevsim2/health/break_health\x00', 0x48081, 0x0) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/virtual/net/bond0/bonding/arp_ip_target\x00', 0xa0002, 0x0) write$auto_ocfs2_control_fops_stack_user(r2, &(0x7f0000003900)='\t', 0x1) write$auto(r1, &(0x7f0000000080)=')@-!\x00', 0x1e1) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nbd(&(0x7f0000001d00), 0xffffffffffffffff) sendmsg$auto_NBD_CMD_CONNECT(r3, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000000200)={0x34, r4, 0x1, 0x703d25, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x1, 0x0, 0x1, [@generic='\x00\x00\x00\x00']}]}, @nested={0x4, 0x89}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x8880) openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/kernel/perf_event_max_contexts_per_stack\x00', 0x202, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x8, 0x3ff, 0x9, 0x5, 0x14, 0x944, 0x1ffe4, 0x3, 0x6, 0x4, 0x9, 0x400005, 0x4000fff, 0x8000007, 0x8001, 0xd, 0x5, 0x3, 0x4, 0x7, 0x20, 0x309, 0x8, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x78, 0x0, 0x0, [0x3, 0x0, 0x0, 0x200, 0x9, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 0x4000000000000, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82, 0x800000000002, 0x9, 0x0, 0xbec, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0xfffffffffffffffe, 0xffffffffffffd059, 0x0, 0x0, 0x0, 0x2961, 0x0, 0x2]}, 0x2001fb, 0x7f) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYBLOB="11002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[], 0x1ac}}, 0x40000) r5 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r5, &(0x7f0000000200)={{0x0, 0x1f00, &(0x7f0000000100)={0x0, 0xfdef}, 0x2, 0x0, 0x7, 0xa505}, 0x700}, 0x7, 0x4008) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x2, 0x8, 0x0) r6 = socket(0xf, 0x2, 0xffffffff) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) kernel console output (not intermixed with test programs): 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2493.582133][ T4334] RSP: 002b:00007fdd02db4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2493.582158][ T4334] RAX: ffffffffffffffda RBX: 00007fdd04e16180 RCX: 00007fdd04b9ce59 [ 2493.582174][ T4334] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2493.582189][ T4334] RBP: 00007fdd04c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2493.582204][ T4334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2493.582219][ T4334] R13: 00007fdd04e16218 R14: 00007fdd04e16180 R15: 00007fffef0baac8 [ 2493.582251][ T4334] [ 2494.142123][ T7694] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2494.161393][ T7694] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2494.173632][T28306] Bluetooth: hci3: command tx timeout [ 2494.188490][ T7694] bond0 (unregistering): Released all slaves [ 2494.226707][ T5295] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2494.351926][ T4346] bond0: invalid ARP target specified [ 2494.391578][ T4346] netlink: 'syz.3.5746': attribute type 1 has an invalid length. [ 2494.400138][ T4346] nbd: error processing sock list [ 2494.422078][ T4266] bridge0: port 1(bridge_slave_0) entered blocking state [ 2494.432030][ T4266] bridge0: port 1(bridge_slave_0) entered disabled state [ 2494.440007][ T4266] bridge_slave_0: entered allmulticast mode [ 2494.449092][ T4347] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5746'. [ 2494.453883][ T4266] bridge_slave_0: entered promiscuous mode [ 2494.477312][ T4266] bridge0: port 2(bridge_slave_1) entered blocking state [ 2494.484844][ T4266] bridge0: port 2(bridge_slave_1) entered disabled state [ 2494.495597][ T4266] bridge_slave_1: entered allmulticast mode [ 2494.504073][ T4266] bridge_slave_1: entered promiscuous mode [ 2494.629724][ T4266] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2494.698142][ T4266] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2494.796026][ T4354] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2494.937081][ T4358] bond0: invalid ARP target specified [ 2494.967326][ T4358] netlink: 'syz.0.5749': attribute type 1 has an invalid length. [ 2495.014098][ T4358] nbd: error processing sock list [ 2495.044303][ T4363] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5749'. [ 2495.044671][ T4355] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5747'. [ 2495.517645][ T4374] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5750'. [ 2495.572765][ T4369] bond0: invalid ARP target specified [ 2495.595689][ T4266] team0: Port device team_slave_0 added [ 2495.802349][ T4378] bond0: invalid ARP target specified [ 2495.842201][ T4266] team0: Port device team_slave_1 added [ 2495.855071][ T4378] netlink: 'syz.3.5751': attribute type 1 has an invalid length. [ 2495.879805][ T4378] nbd: error processing sock list [ 2495.958247][ T4378] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5751'. [ 2496.088092][ T4266] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2496.116219][ T4266] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2496.202686][ T4266] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2496.243098][T28306] Bluetooth: hci3: command tx timeout [ 2496.278033][ T4266] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2496.292550][ T4266] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2496.319357][ T4266] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2496.374378][ T5295] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2496.629023][ T4394] bond0: invalid ARP target specified [ 2496.638152][ T4395] netlink: 'syz.0.5754': attribute type 1 has an invalid length. [ 2496.651616][ T4395] nbd: error processing sock list [ 2496.725006][ T4394] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5754'. [ 2496.738712][ T4266] hsr_slave_0: entered promiscuous mode [ 2496.746958][ T4266] hsr_slave_1: entered promiscuous mode [ 2496.755097][ T4266] debugfs: 'hsr0' already exists in 'hsr' [ 2496.761557][ T4266] Cannot create hsr debugfs directory [ 2496.854939][ T4398] FAULT_INJECTION: forcing a failure. [ 2496.854939][ T4398] name failslab, interval 1, probability 0, space 0, times 0 [ 2496.905965][ T4398] CPU: 1 UID: 0 PID: 4398 Comm: syz.2.5755 Tainted: G L syzkaller #0 PREEMPT(full) [ 2496.906018][ T4398] Tainted: [L]=SOFTLOCKUP [ 2496.906030][ T4398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2496.906058][ T4398] Call Trace: [ 2496.906069][ T4398] [ 2496.906083][ T4398] dump_stack_lvl+0x100/0x190 [ 2496.906141][ T4398] should_fail_ex.cold+0x5/0xa [ 2496.906182][ T4398] should_failslab+0xc2/0x120 [ 2496.906219][ T4398] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2496.906267][ T4398] ? security_file_alloc+0x34/0x2c0 [ 2496.906306][ T4398] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2496.906348][ T4398] security_file_alloc+0x34/0x2c0 [ 2496.906387][ T4398] init_file+0x95/0x480 [ 2496.906432][ T4398] alloc_empty_file_noaccount+0x45/0xd0 [ 2496.906482][ T4398] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2496.906531][ T4398] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2496.906582][ T4398] ? iput+0x3a/0x40 [ 2496.906627][ T4398] bdev_file_open_by_dev+0x13a/0x210 [ 2496.906673][ T4398] blkdev_bszset+0x170/0x240 [ 2496.906718][ T4398] ? __pfx_blkdev_bszset+0x10/0x10 [ 2496.906766][ T4398] ? find_held_lock+0x2b/0x80 [ 2496.906805][ T4398] ? __fget_files+0x215/0x3d0 [ 2496.906879][ T4398] ? hook_file_ioctl_common+0x149/0x410 [ 2496.906925][ T4398] blkdev_ioctl+0x513/0x6f0 [ 2496.906971][ T4398] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2496.907023][ T4398] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2496.907082][ T4398] __x64_sys_ioctl+0x18e/0x210 [ 2496.907118][ T4398] do_syscall_64+0x115/0x840 [ 2496.907161][ T4398] ? clear_bhb_loop+0x40/0x90 [ 2496.907201][ T4398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2496.907234][ T4398] RIP: 0033:0x7f7ccf99ce59 [ 2496.907259][ T4398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2496.907290][ T4398] RSP: 002b:00007f7cd07a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2496.907321][ T4398] RAX: ffffffffffffffda RBX: 00007f7ccfc15fa0 RCX: 00007f7ccf99ce59 [ 2496.907344][ T4398] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2496.907362][ T4398] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2496.907380][ T4398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2496.907398][ T4398] R13: 00007f7ccfc16038 R14: 00007f7ccfc15fa0 R15: 00007ffc4184d4f8 [ 2496.907446][ T4398] [ 2497.552975][ T4412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5756'. [ 2498.160970][ T5295] 8021q: adding VLAN 0 to HW filter on device eth3 [ 2498.315916][T28306] Bluetooth: hci3: command tx timeout [ 2499.002299][ T4437] nbd: must specify a size in bytes for the device [ 2499.019386][ T4434] bond0: invalid ARP target specified [ 2499.119594][ T4434] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5759'. [ 2499.616748][ T4445] FAULT_INJECTION: forcing a failure. [ 2499.616748][ T4445] name failslab, interval 1, probability 0, space 0, times 0 [ 2499.629637][ T4445] CPU: 1 UID: 0 PID: 4445 Comm: syz.3.5761 Tainted: G L syzkaller #0 PREEMPT(full) [ 2499.629689][ T4445] Tainted: [L]=SOFTLOCKUP [ 2499.629700][ T4445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2499.629720][ T4445] Call Trace: [ 2499.629731][ T4445] [ 2499.629744][ T4445] dump_stack_lvl+0x100/0x190 [ 2499.629802][ T4445] should_fail_ex.cold+0x5/0xa [ 2499.629843][ T4445] should_failslab+0xc2/0x120 [ 2499.629890][ T4445] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2499.629938][ T4445] ? security_file_alloc+0x34/0x2c0 [ 2499.629977][ T4445] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2499.630021][ T4445] security_file_alloc+0x34/0x2c0 [ 2499.630066][ T4445] init_file+0x95/0x480 [ 2499.630111][ T4445] alloc_empty_file_noaccount+0x45/0xd0 [ 2499.630162][ T4445] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2499.630214][ T4445] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2499.630269][ T4445] ? iput+0x3a/0x40 [ 2499.630317][ T4445] bdev_file_open_by_dev+0x13a/0x210 [ 2499.630368][ T4445] blkdev_bszset+0x170/0x240 [ 2499.630413][ T4445] ? __pfx_blkdev_bszset+0x10/0x10 [ 2499.630461][ T4445] ? find_held_lock+0x2b/0x80 [ 2499.630500][ T4445] ? __fget_files+0x215/0x3d0 [ 2499.630533][ T4445] ? hook_file_ioctl_common+0x149/0x410 [ 2499.630579][ T4445] blkdev_ioctl+0x513/0x6f0 [ 2499.630627][ T4445] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2499.630677][ T4445] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2499.630725][ T4445] __x64_sys_ioctl+0x18e/0x210 [ 2499.630758][ T4445] do_syscall_64+0x115/0x840 [ 2499.630800][ T4445] ? clear_bhb_loop+0x40/0x90 [ 2499.630839][ T4445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2499.630879][ T4445] RIP: 0033:0x7f34c059ce59 [ 2499.630913][ T4445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2499.630945][ T4445] RSP: 002b:00007f34c14b9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2499.630976][ T4445] RAX: ffffffffffffffda RBX: 00007f34c0815fa0 RCX: 00007f34c059ce59 [ 2499.630998][ T4445] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2499.631018][ T4445] RBP: 00007f34c0632d6f R08: 0000000000000000 R09: 0000000000000000 [ 2499.631037][ T4445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2499.631055][ T4445] R13: 00007f34c0816038 R14: 00007f34c0815fa0 R15: 00007fffe1602328 [ 2499.631096][ T4445] [ 2500.648350][ T4266] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2500.696057][ T4266] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2500.731549][ T4266] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2500.758845][ T4266] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2500.802313][ T4266] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2500.862819][ T4266] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2500.888180][ T4266] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2500.922980][ T4266] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2501.019794][ T4470] bond0: invalid ARP target specified [ 2501.126393][ T4477] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5763'. [ 2501.594066][ T4484] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2501.951695][ T4266] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2502.161255][ T4485] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2502.335045][ T4502] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5766'. [ 2502.975387][ T4266] 8021q: adding VLAN 0 to HW filter on device team0 [ 2503.281643][ T4512] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5768'. [ 2503.317931][T10160] bridge0: port 1(bridge_slave_0) entered blocking state [ 2503.325342][T10160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2503.840161][ T4504] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5767'. [ 2503.941176][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 2503.948478][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2504.426170][ T4536] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5769'. [ 2504.898821][ T7694] hsr_slave_0: left promiscuous mode [ 2504.916653][ T7694] hsr_slave_1: left promiscuous mode [ 2504.938929][ T7694] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2504.965271][ T7694] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2504.979298][ T7694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2504.990940][ T7694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2505.027751][ T7694] veth1_macvtap: left promiscuous mode [ 2505.039450][ T7694] veth0_macvtap: left promiscuous mode [ 2505.055378][ T7694] veth1_vlan: left promiscuous mode [ 2505.060831][ T7694] veth0_vlan: left promiscuous mode [ 2505.670632][ T7694] team0 (unregistering): Port device team_slave_1 removed [ 2505.730500][ T7694] team0 (unregistering): Port device team_slave_0 removed [ 2505.961508][ T4571] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5771'. [ 2506.475686][ T4577] FAULT_INJECTION: forcing a failure. [ 2506.475686][ T4577] name failslab, interval 1, probability 0, space 0, times 0 [ 2506.499354][ T4577] CPU: 1 UID: 0 PID: 4577 Comm: syz.0.5772 Tainted: G L syzkaller #0 PREEMPT(full) [ 2506.499404][ T4577] Tainted: [L]=SOFTLOCKUP [ 2506.499415][ T4577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2506.499432][ T4577] Call Trace: [ 2506.499443][ T4577] [ 2506.499455][ T4577] dump_stack_lvl+0x100/0x190 [ 2506.499509][ T4577] should_fail_ex.cold+0x5/0xa [ 2506.499544][ T4577] should_failslab+0xc2/0x120 [ 2506.499582][ T4577] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2506.499630][ T4577] ? security_file_alloc+0x34/0x2c0 [ 2506.499667][ T4577] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2506.499709][ T4577] security_file_alloc+0x34/0x2c0 [ 2506.499749][ T4577] init_file+0x95/0x480 [ 2506.499794][ T4577] alloc_empty_file_noaccount+0x45/0xd0 [ 2506.499845][ T4577] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2506.499907][ T4577] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2506.499963][ T4577] ? iput+0x3a/0x40 [ 2506.500013][ T4577] bdev_file_open_by_dev+0x13a/0x210 [ 2506.500064][ T4577] blkdev_bszset+0x170/0x240 [ 2506.500113][ T4577] ? __pfx_blkdev_bszset+0x10/0x10 [ 2506.500161][ T4577] ? find_held_lock+0x2b/0x80 [ 2506.500199][ T4577] ? __fget_files+0x215/0x3d0 [ 2506.500233][ T4577] ? hook_file_ioctl_common+0x149/0x410 [ 2506.500278][ T4577] blkdev_ioctl+0x513/0x6f0 [ 2506.500325][ T4577] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2506.500378][ T4577] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2506.500433][ T4577] __x64_sys_ioctl+0x18e/0x210 [ 2506.500468][ T4577] do_syscall_64+0x115/0x840 [ 2506.500512][ T4577] ? clear_bhb_loop+0x40/0x90 [ 2506.500552][ T4577] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2506.500585][ T4577] RIP: 0033:0x7fdd04b9ce59 [ 2506.500613][ T4577] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2506.500642][ T4577] RSP: 002b:00007fdd02df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2506.500671][ T4577] RAX: ffffffffffffffda RBX: 00007fdd04e15fa0 RCX: 00007fdd04b9ce59 [ 2506.500692][ T4577] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2506.500711][ T4577] RBP: 00007fdd04c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2506.500730][ T4577] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2506.500747][ T4577] R13: 00007fdd04e16038 R14: 00007fdd04e15fa0 R15: 00007fffef0baac8 [ 2506.500785][ T4577] [ 2507.777902][ T4598] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5775'. [ 2508.593556][ T4266] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2509.050100][ T4613] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5776'. [ 2509.515380][ T4626] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2509.716665][ T4266] veth0_vlan: entered promiscuous mode [ 2509.977232][ T4266] veth1_vlan: entered promiscuous mode [ 2510.074587][ T4633] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5780'. [ 2510.327145][ T4266] veth0_macvtap: entered promiscuous mode [ 2510.542682][ T4266] veth1_macvtap: entered promiscuous mode [ 2510.760391][ T4266] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2510.865788][ T4641] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2511.053523][ T4266] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2511.133312][ T4638] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5781'. [ 2511.416333][ T7838] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2511.428158][ T7838] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2511.458892][ T7838] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2511.492992][ T7838] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2511.957379][ T7704] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2511.987270][ T7704] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2512.144950][ T7694] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2512.164789][ T7694] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2512.186037][ T4655] FAULT_INJECTION: forcing a failure. [ 2512.186037][ T4655] name failslab, interval 1, probability 0, space 0, times 0 [ 2512.221405][ T4655] CPU: 1 UID: 0 PID: 4655 Comm: syz.0.5784 Tainted: G L syzkaller #0 PREEMPT(full) [ 2512.221455][ T4655] Tainted: [L]=SOFTLOCKUP [ 2512.221467][ T4655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2512.221484][ T4655] Call Trace: [ 2512.221495][ T4655] [ 2512.221508][ T4655] dump_stack_lvl+0x100/0x190 [ 2512.221562][ T4655] should_fail_ex.cold+0x5/0xa [ 2512.221600][ T4655] should_failslab+0xc2/0x120 [ 2512.221635][ T4655] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2512.221685][ T4655] ? security_file_alloc+0x34/0x2c0 [ 2512.221726][ T4655] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2512.221771][ T4655] security_file_alloc+0x34/0x2c0 [ 2512.221810][ T4655] init_file+0x95/0x480 [ 2512.221853][ T4655] alloc_empty_file_noaccount+0x45/0xd0 [ 2512.221904][ T4655] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2512.221956][ T4655] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2512.222012][ T4655] ? iput+0x3a/0x40 [ 2512.222058][ T4655] bdev_file_open_by_dev+0x13a/0x210 [ 2512.222110][ T4655] blkdev_bszset+0x170/0x240 [ 2512.222159][ T4655] ? __pfx_blkdev_bszset+0x10/0x10 [ 2512.222208][ T4655] ? find_held_lock+0x2b/0x80 [ 2512.222246][ T4655] ? __fget_files+0x215/0x3d0 [ 2512.222284][ T4655] ? hook_file_ioctl_common+0x149/0x410 [ 2512.222344][ T4655] blkdev_ioctl+0x513/0x6f0 [ 2512.222391][ T4655] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2512.222443][ T4655] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2512.222487][ T4655] __x64_sys_ioctl+0x18e/0x210 [ 2512.222521][ T4655] do_syscall_64+0x115/0x840 [ 2512.222562][ T4655] ? clear_bhb_loop+0x40/0x90 [ 2512.222600][ T4655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2512.222628][ T4655] RIP: 0033:0x7fdd04b9ce59 [ 2512.222653][ T4655] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2512.222683][ T4655] RSP: 002b:00007fdd02df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2512.222712][ T4655] RAX: ffffffffffffffda RBX: 00007fdd04e15fa0 RCX: 00007fdd04b9ce59 [ 2512.222733][ T4655] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2512.222752][ T4655] RBP: 00007fdd04c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2512.222770][ T4655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2512.222789][ T4655] R13: 00007fdd04e16038 R14: 00007fdd04e15fa0 R15: 00007fffef0baac8 [ 2512.222828][ T4655] [ 2512.774047][ T4670] FAULT_INJECTION: forcing a failure. [ 2512.774047][ T4670] name failslab, interval 1, probability 0, space 0, times 0 [ 2512.827925][ T4670] CPU: 1 UID: 0 PID: 4670 Comm: syz.1.5735 Tainted: G L syzkaller #0 PREEMPT(full) [ 2512.827978][ T4670] Tainted: [L]=SOFTLOCKUP [ 2512.827990][ T4670] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2512.828009][ T4670] Call Trace: [ 2512.828020][ T4670] [ 2512.828033][ T4670] dump_stack_lvl+0x100/0x190 [ 2512.828094][ T4670] should_fail_ex.cold+0x5/0xa [ 2512.828133][ T4670] should_failslab+0xc2/0x120 [ 2512.828169][ T4670] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2512.828229][ T4670] ? security_file_alloc+0x34/0x2c0 [ 2512.828270][ T4670] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2512.828314][ T4670] security_file_alloc+0x34/0x2c0 [ 2512.828356][ T4670] init_file+0x95/0x480 [ 2512.828400][ T4670] alloc_empty_file_noaccount+0x45/0xd0 [ 2512.828450][ T4670] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2512.828501][ T4670] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2512.828553][ T4670] ? iput+0x3a/0x40 [ 2512.828595][ T4670] bdev_file_open_by_dev+0x13a/0x210 [ 2512.828642][ T4670] blkdev_bszset+0x170/0x240 [ 2512.828687][ T4670] ? __pfx_blkdev_bszset+0x10/0x10 [ 2512.828731][ T4670] ? find_held_lock+0x2b/0x80 [ 2512.828769][ T4670] ? __fget_files+0x215/0x3d0 [ 2512.828803][ T4670] ? hook_file_ioctl_common+0x149/0x410 [ 2512.828848][ T4670] blkdev_ioctl+0x513/0x6f0 [ 2512.828891][ T4670] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2512.828937][ T4670] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2512.828985][ T4670] __x64_sys_ioctl+0x18e/0x210 [ 2512.829015][ T4670] do_syscall_64+0x115/0x840 [ 2512.829054][ T4670] ? clear_bhb_loop+0x40/0x90 [ 2512.829091][ T4670] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2512.829124][ T4670] RIP: 0033:0x7f862bf9ce59 [ 2512.829149][ T4670] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2512.829188][ T4670] RSP: 002b:00007f862ce50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2512.829219][ T4670] RAX: ffffffffffffffda RBX: 00007f862c216090 RCX: 00007f862bf9ce59 [ 2512.829240][ T4670] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2512.829259][ T4670] RBP: 00007f862c032d6f R08: 0000000000000000 R09: 0000000000000000 [ 2512.829279][ T4670] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2512.829297][ T4670] R13: 00007f862c216128 R14: 00007f862c216090 R15: 00007ffe7e1e3a08 [ 2512.829339][ T4670] [ 2512.894854][ T4666] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5786'. [ 2514.035547][ T4682] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5788'. [ 2514.153009][ T4691] FAULT_INJECTION: forcing a failure. [ 2514.153009][ T4691] name failslab, interval 1, probability 0, space 0, times 0 [ 2514.182591][ T4685] FAULT_INJECTION: forcing a failure. [ 2514.182591][ T4685] name failslab, interval 1, probability 0, space 0, times 0 [ 2514.196155][ T4691] CPU: 1 UID: 0 PID: 4691 Comm: syz.3.5790 Tainted: G L syzkaller #0 PREEMPT(full) [ 2514.196215][ T4691] Tainted: [L]=SOFTLOCKUP [ 2514.196227][ T4691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2514.196247][ T4691] Call Trace: [ 2514.196259][ T4691] [ 2514.196272][ T4691] dump_stack_lvl+0x100/0x190 [ 2514.196331][ T4691] should_fail_ex.cold+0x5/0xa [ 2514.196370][ T4691] should_failslab+0xc2/0x120 [ 2514.196408][ T4691] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2514.196456][ T4691] ? security_file_alloc+0x34/0x2c0 [ 2514.196498][ T4691] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2514.196544][ T4691] security_file_alloc+0x34/0x2c0 [ 2514.196586][ T4691] init_file+0x95/0x480 [ 2514.196631][ T4691] alloc_empty_file_noaccount+0x45/0xd0 [ 2514.196679][ T4691] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2514.196730][ T4691] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2514.196784][ T4691] ? iput+0x3a/0x40 [ 2514.196833][ T4691] bdev_file_open_by_dev+0x13a/0x210 [ 2514.196884][ T4691] blkdev_bszset+0x170/0x240 [ 2514.196933][ T4691] ? __pfx_blkdev_bszset+0x10/0x10 [ 2514.196981][ T4691] ? find_held_lock+0x2b/0x80 [ 2514.197024][ T4691] ? __fget_files+0x215/0x3d0 [ 2514.197058][ T4691] ? hook_file_ioctl_common+0x149/0x410 [ 2514.197103][ T4691] blkdev_ioctl+0x513/0x6f0 [ 2514.197150][ T4691] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2514.197213][ T4691] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2514.197264][ T4691] __x64_sys_ioctl+0x18e/0x210 [ 2514.197300][ T4691] do_syscall_64+0x115/0x840 [ 2514.197343][ T4691] ? clear_bhb_loop+0x40/0x90 [ 2514.197382][ T4691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2514.197413][ T4691] RIP: 0033:0x7f34c059ce59 [ 2514.197438][ T4691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2514.197466][ T4691] RSP: 002b:00007f34c1477028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2514.197496][ T4691] RAX: ffffffffffffffda RBX: 00007f34c0816180 RCX: 00007f34c059ce59 [ 2514.197518][ T4691] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2514.197539][ T4691] RBP: 00007f34c0632d6f R08: 0000000000000000 R09: 0000000000000000 [ 2514.197558][ T4691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2514.197577][ T4691] R13: 00007f34c0816218 R14: 00007f34c0816180 R15: 00007fffe1602328 [ 2514.197619][ T4691] [ 2514.448366][ T4685] CPU: 1 UID: 0 PID: 4685 Comm: syz.2.5789 Tainted: G L syzkaller #0 PREEMPT(full) [ 2514.448420][ T4685] Tainted: [L]=SOFTLOCKUP [ 2514.448433][ T4685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2514.448453][ T4685] Call Trace: [ 2514.448465][ T4685] [ 2514.448479][ T4685] dump_stack_lvl+0x100/0x190 [ 2514.448541][ T4685] should_fail_ex.cold+0x5/0xa [ 2514.448582][ T4685] should_failslab+0xc2/0x120 [ 2514.448622][ T4685] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2514.448670][ T4685] ? security_file_alloc+0x34/0x2c0 [ 2514.448712][ T4685] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2514.448758][ T4685] security_file_alloc+0x34/0x2c0 [ 2514.448803][ T4685] init_file+0x95/0x480 [ 2514.448849][ T4685] alloc_empty_file_noaccount+0x45/0xd0 [ 2514.448901][ T4685] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2514.448956][ T4685] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2514.449012][ T4685] ? iput+0x3a/0x40 [ 2514.449061][ T4685] bdev_file_open_by_dev+0x13a/0x210 [ 2514.449114][ T4685] blkdev_bszset+0x170/0x240 [ 2514.449171][ T4685] ? __pfx_blkdev_bszset+0x10/0x10 [ 2514.449220][ T4685] ? find_held_lock+0x2b/0x80 [ 2514.449259][ T4685] ? __fget_files+0x215/0x3d0 [ 2514.449294][ T4685] ? hook_file_ioctl_common+0x149/0x410 [ 2514.449341][ T4685] blkdev_ioctl+0x513/0x6f0 [ 2514.449391][ T4685] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2514.449450][ T4685] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2514.449502][ T4685] __x64_sys_ioctl+0x18e/0x210 [ 2514.449539][ T4685] do_syscall_64+0x115/0x840 [ 2514.449583][ T4685] ? clear_bhb_loop+0x40/0x90 [ 2514.449623][ T4685] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2514.449658][ T4685] RIP: 0033:0x7f7ccf99ce59 [ 2514.449686][ T4685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2514.449718][ T4685] RSP: 002b:00007f7cd07a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2514.449750][ T4685] RAX: ffffffffffffffda RBX: 00007f7ccfc15fa0 RCX: 00007f7ccf99ce59 [ 2514.449772][ T4685] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2514.449792][ T4685] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2514.449812][ T4685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2514.449831][ T4685] R13: 00007f7ccfc16038 R14: 00007f7ccfc15fa0 R15: 00007ffc4184d4f8 [ 2514.449873][ T4685] [ 2515.620479][ T4697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5791'. [ 2516.675380][ T4727] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5796'. [ 2516.937073][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 2516.943545][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 2517.222736][ T4732] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2517.807076][ T4738] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5798'. [ 2518.450556][ T4742] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5799'. [ 2518.940872][ T4755] FAULT_INJECTION: forcing a failure. [ 2518.940872][ T4755] name failslab, interval 1, probability 0, space 0, times 0 [ 2518.963975][ T4755] CPU: 1 UID: 0 PID: 4755 Comm: syz.1.5801 Tainted: G L syzkaller #0 PREEMPT(full) [ 2518.964027][ T4755] Tainted: [L]=SOFTLOCKUP [ 2518.964047][ T4755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2518.964066][ T4755] Call Trace: [ 2518.964077][ T4755] [ 2518.964090][ T4755] dump_stack_lvl+0x100/0x190 [ 2518.964149][ T4755] should_fail_ex.cold+0x5/0xa [ 2518.964198][ T4755] should_failslab+0xc2/0x120 [ 2518.964236][ T4755] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2518.964279][ T4755] ? security_file_alloc+0x34/0x2c0 [ 2518.964319][ T4755] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2518.964359][ T4755] security_file_alloc+0x34/0x2c0 [ 2518.964397][ T4755] init_file+0x95/0x480 [ 2518.964440][ T4755] alloc_empty_file_noaccount+0x45/0xd0 [ 2518.964484][ T4755] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2518.964534][ T4755] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2518.964583][ T4755] ? iput+0x3a/0x40 [ 2518.964629][ T4755] bdev_file_open_by_dev+0x13a/0x210 [ 2518.964680][ T4755] blkdev_bszset+0x170/0x240 [ 2518.964739][ T4755] ? __pfx_blkdev_bszset+0x10/0x10 [ 2518.964789][ T4755] ? find_held_lock+0x2b/0x80 [ 2518.964829][ T4755] ? __fget_files+0x215/0x3d0 [ 2518.964864][ T4755] ? hook_file_ioctl_common+0x149/0x410 [ 2518.964909][ T4755] blkdev_ioctl+0x513/0x6f0 [ 2518.964959][ T4755] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2518.965013][ T4755] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2518.965065][ T4755] __x64_sys_ioctl+0x18e/0x210 [ 2518.965101][ T4755] do_syscall_64+0x115/0x840 [ 2518.965145][ T4755] ? clear_bhb_loop+0x40/0x90 [ 2518.965184][ T4755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2518.965217][ T4755] RIP: 0033:0x7f862bf9ce59 [ 2518.965243][ T4755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2518.965273][ T4755] RSP: 002b:00007f862ce50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2518.965305][ T4755] RAX: ffffffffffffffda RBX: 00007f862c216090 RCX: 00007f862bf9ce59 [ 2518.965325][ T4755] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2518.965346][ T4755] RBP: 00007f862c032d6f R08: 0000000000000000 R09: 0000000000000000 [ 2518.965364][ T4755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2518.965382][ T4755] R13: 00007f862c216128 R14: 00007f862c216090 R15: 00007ffe7e1e3a08 [ 2518.965425][ T4755] [ 2519.798984][ T4762] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5803'. [ 2520.552630][ T4772] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2520.805707][ T4765] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5804'. [ 2520.951421][ T4778] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2521.099611][ T4780] bond0: invalid ARP target specified [ 2521.161074][ T4786] FAULT_INJECTION: forcing a failure. [ 2521.161074][ T4786] name failslab, interval 1, probability 0, space 0, times 0 [ 2521.161127][ T4786] CPU: 1 UID: 0 PID: 4786 Comm: syz.3.5809 Tainted: G L syzkaller #0 PREEMPT(full) [ 2521.161170][ T4786] Tainted: [L]=SOFTLOCKUP [ 2521.161181][ T4786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2521.161200][ T4786] Call Trace: [ 2521.161211][ T4786] [ 2521.161223][ T4786] dump_stack_lvl+0x100/0x190 [ 2521.161293][ T4786] should_fail_ex.cold+0x5/0xa [ 2521.161333][ T4786] should_failslab+0xc2/0x120 [ 2521.161371][ T4786] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2521.161421][ T4786] ? security_file_alloc+0x34/0x2c0 [ 2521.161463][ T4786] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2521.161508][ T4786] security_file_alloc+0x34/0x2c0 [ 2521.161552][ T4786] init_file+0x95/0x480 [ 2521.161598][ T4786] alloc_empty_file_noaccount+0x45/0xd0 [ 2521.161647][ T4786] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2521.161698][ T4786] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2521.161751][ T4786] ? iput+0x3a/0x40 [ 2521.161800][ T4786] bdev_file_open_by_dev+0x13a/0x210 [ 2521.161853][ T4786] blkdev_bszset+0x170/0x240 [ 2521.161901][ T4786] ? __pfx_blkdev_bszset+0x10/0x10 [ 2521.161954][ T4786] ? find_held_lock+0x2b/0x80 [ 2521.161991][ T4786] ? __fget_files+0x215/0x3d0 [ 2521.162022][ T4786] ? hook_file_ioctl_common+0x149/0x410 [ 2521.162066][ T4786] blkdev_ioctl+0x513/0x6f0 [ 2521.162114][ T4786] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2521.162160][ T4786] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2521.162209][ T4786] __x64_sys_ioctl+0x18e/0x210 [ 2521.162254][ T4786] do_syscall_64+0x115/0x840 [ 2521.162299][ T4786] ? clear_bhb_loop+0x40/0x90 [ 2521.162338][ T4786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2521.162372][ T4786] RIP: 0033:0x7f34c059ce59 [ 2521.162398][ T4786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2521.162428][ T4786] RSP: 002b:00007f34c1498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2521.162459][ T4786] RAX: ffffffffffffffda RBX: 00007f34c0816090 RCX: 00007f34c059ce59 [ 2521.162480][ T4786] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2521.162499][ T4786] RBP: 00007f34c0632d6f R08: 0000000000000000 R09: 0000000000000000 [ 2521.162519][ T4786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2521.162538][ T4786] R13: 00007f34c0816128 R14: 00007f34c0816090 R15: 00007fffe1602328 [ 2521.162580][ T4786] [ 2521.224726][ T4780] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5808'. [ 2521.885894][ T4791] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2522.134907][ T4799] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2522.305957][ T4797] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5810'. [ 2522.597133][ T4803] FAULT_INJECTION: forcing a failure. [ 2522.597133][ T4803] name failslab, interval 1, probability 0, space 0, times 0 [ 2522.659287][ T4803] CPU: 0 UID: 0 PID: 4803 Comm: syz.2.5813 Tainted: G L syzkaller #0 PREEMPT(full) [ 2522.659342][ T4803] Tainted: [L]=SOFTLOCKUP [ 2522.659353][ T4803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2522.659373][ T4803] Call Trace: [ 2522.659385][ T4803] [ 2522.659397][ T4803] dump_stack_lvl+0x100/0x190 [ 2522.659463][ T4803] should_fail_ex.cold+0x5/0xa [ 2522.659504][ T4803] should_failslab+0xc2/0x120 [ 2522.659542][ T4803] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2522.659592][ T4803] ? security_file_alloc+0x34/0x2c0 [ 2522.659633][ T4803] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2522.659678][ T4803] security_file_alloc+0x34/0x2c0 [ 2522.659727][ T4803] init_file+0x95/0x480 [ 2522.659771][ T4803] alloc_empty_file_noaccount+0x45/0xd0 [ 2522.659822][ T4803] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2522.659875][ T4803] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2522.659931][ T4803] ? iput+0x3a/0x40 [ 2522.659979][ T4803] bdev_file_open_by_dev+0x13a/0x210 [ 2522.660031][ T4803] blkdev_bszset+0x170/0x240 [ 2522.660080][ T4803] ? __pfx_blkdev_bszset+0x10/0x10 [ 2522.660129][ T4803] ? find_held_lock+0x2b/0x80 [ 2522.660167][ T4803] ? __fget_files+0x215/0x3d0 [ 2522.660199][ T4803] ? hook_file_ioctl_common+0x149/0x410 [ 2522.660244][ T4803] blkdev_ioctl+0x513/0x6f0 [ 2522.660292][ T4803] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2522.660346][ T4803] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2522.660396][ T4803] __x64_sys_ioctl+0x18e/0x210 [ 2522.660431][ T4803] do_syscall_64+0x115/0x840 [ 2522.660474][ T4803] ? clear_bhb_loop+0x40/0x90 [ 2522.660513][ T4803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2522.660546][ T4803] RIP: 0033:0x7f7ccf99ce59 [ 2522.660574][ T4803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2522.660606][ T4803] RSP: 002b:00007f7cd07a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2522.660639][ T4803] RAX: ffffffffffffffda RBX: 00007f7ccfc15fa0 RCX: 00007f7ccf99ce59 [ 2522.660661][ T4803] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2522.660682][ T4803] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2522.660708][ T4803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2522.660726][ T4803] R13: 00007f7ccfc16038 R14: 00007f7ccfc15fa0 R15: 00007ffc4184d4f8 [ 2522.660768][ T4803] [ 2523.454304][T32098] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2523.474935][T32098] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2523.487555][T32098] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2523.509587][T32098] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2523.520666][T32098] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2523.677536][ T4815] FAULT_INJECTION: forcing a failure. [ 2523.677536][ T4815] name failslab, interval 1, probability 0, space 0, times 0 [ 2523.714440][ T4815] CPU: 0 UID: 0 PID: 4815 Comm: syz.0.5816 Tainted: G L syzkaller #0 PREEMPT(full) [ 2523.714492][ T4815] Tainted: [L]=SOFTLOCKUP [ 2523.714503][ T4815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2523.714522][ T4815] Call Trace: [ 2523.714532][ T4815] [ 2523.714545][ T4815] dump_stack_lvl+0x100/0x190 [ 2523.714599][ T4815] should_fail_ex.cold+0x5/0xa [ 2523.714641][ T4815] should_failslab+0xc2/0x120 [ 2523.714675][ T4815] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2523.714723][ T4815] ? security_file_alloc+0x34/0x2c0 [ 2523.714759][ T4815] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2523.714802][ T4815] security_file_alloc+0x34/0x2c0 [ 2523.714843][ T4815] init_file+0x95/0x480 [ 2523.714887][ T4815] alloc_empty_file_noaccount+0x45/0xd0 [ 2523.714935][ T4815] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2523.714978][ T4815] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2523.715019][ T4815] ? iput+0x3a/0x40 [ 2523.715056][ T4815] bdev_file_open_by_dev+0x13a/0x210 [ 2523.715096][ T4815] blkdev_bszset+0x170/0x240 [ 2523.715132][ T4815] ? __pfx_blkdev_bszset+0x10/0x10 [ 2523.715168][ T4815] ? find_held_lock+0x2b/0x80 [ 2523.715197][ T4815] ? __fget_files+0x215/0x3d0 [ 2523.715232][ T4815] ? hook_file_ioctl_common+0x149/0x410 [ 2523.715267][ T4815] blkdev_ioctl+0x513/0x6f0 [ 2523.715303][ T4815] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2523.715346][ T4815] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2523.715386][ T4815] __x64_sys_ioctl+0x18e/0x210 [ 2523.715413][ T4815] do_syscall_64+0x115/0x840 [ 2523.715447][ T4815] ? clear_bhb_loop+0x40/0x90 [ 2523.715476][ T4815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2523.715501][ T4815] RIP: 0033:0x7fdd04b9ce59 [ 2523.715522][ T4815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2523.715545][ T4815] RSP: 002b:00007fdd02df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2523.715570][ T4815] RAX: ffffffffffffffda RBX: 00007fdd04e15fa0 RCX: 00007fdd04b9ce59 [ 2523.715587][ T4815] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2523.715602][ T4815] RBP: 00007fdd04c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2523.715616][ T4815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2523.715631][ T4815] R13: 00007fdd04e16038 R14: 00007fdd04e15fa0 R15: 00007fffef0baac8 [ 2523.715667][ T4815] [ 2524.392606][ T4829] netlink: 'syz.1.5817': attribute type 1 has an invalid length. [ 2524.417694][ T4829] nbd: error processing sock list [ 2524.471845][ T4829] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5817'. [ 2524.611835][T10160] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2524.682447][ T4832] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2524.923978][T10160] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2525.229949][T10160] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2525.255775][ T4843] FAULT_INJECTION: forcing a failure. [ 2525.255775][ T4843] name failslab, interval 1, probability 0, space 0, times 0 [ 2525.280074][ T4843] CPU: 1 UID: 0 PID: 4843 Comm: syz.0.5822 Tainted: G L syzkaller #0 PREEMPT(full) [ 2525.280130][ T4843] Tainted: [L]=SOFTLOCKUP [ 2525.280147][ T4843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2525.280165][ T4843] Call Trace: [ 2525.280176][ T4843] [ 2525.280189][ T4843] dump_stack_lvl+0x100/0x190 [ 2525.280250][ T4843] should_fail_ex.cold+0x5/0xa [ 2525.280288][ T4843] should_failslab+0xc2/0x120 [ 2525.280328][ T4843] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2525.280380][ T4843] ? security_file_alloc+0x34/0x2c0 [ 2525.280424][ T4843] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2525.280469][ T4843] security_file_alloc+0x34/0x2c0 [ 2525.280513][ T4843] init_file+0x95/0x480 [ 2525.280559][ T4843] alloc_empty_file_noaccount+0x45/0xd0 [ 2525.280610][ T4843] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2525.280663][ T4843] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2525.280719][ T4843] ? iput+0x3a/0x40 [ 2525.280770][ T4843] bdev_file_open_by_dev+0x13a/0x210 [ 2525.280822][ T4843] blkdev_bszset+0x170/0x240 [ 2525.280872][ T4843] ? __pfx_blkdev_bszset+0x10/0x10 [ 2525.280921][ T4843] ? find_held_lock+0x2b/0x80 [ 2525.280961][ T4843] ? __fget_files+0x215/0x3d0 [ 2525.280997][ T4843] ? hook_file_ioctl_common+0x149/0x410 [ 2525.281043][ T4843] blkdev_ioctl+0x513/0x6f0 [ 2525.281102][ T4843] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2525.281151][ T4843] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2525.281198][ T4843] __x64_sys_ioctl+0x18e/0x210 [ 2525.281233][ T4843] do_syscall_64+0x115/0x840 [ 2525.281276][ T4843] ? clear_bhb_loop+0x40/0x90 [ 2525.281315][ T4843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2525.281348][ T4843] RIP: 0033:0x7fdd04b9ce59 [ 2525.281373][ T4843] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2525.281400][ T4843] RSP: 002b:00007fdd02df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2525.281430][ T4843] RAX: ffffffffffffffda RBX: 00007fdd04e15fa0 RCX: 00007fdd04b9ce59 [ 2525.281451][ T4843] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2525.281470][ T4843] RBP: 00007fdd04c32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2525.281487][ T4843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2525.281504][ T4843] R13: 00007fdd04e16038 R14: 00007fdd04e15fa0 R15: 00007fffef0baac8 [ 2525.281544][ T4843] [ 2525.603079][ T4848] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5821'. [ 2525.609882][T32098] Bluetooth: hci4: command tx timeout [ 2525.858901][T10160] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2526.647667][ T4858] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2526.746293][T10160] bridge_slave_1: left allmulticast mode [ 2526.761704][T10160] bridge_slave_1: left promiscuous mode [ 2526.762013][T10160] bridge0: port 2(bridge_slave_1) entered disabled state [ 2526.770698][T10160] bridge_slave_0: left allmulticast mode [ 2526.770734][T10160] bridge_slave_0: left promiscuous mode [ 2526.770985][T10160] bridge0: port 1(bridge_slave_0) entered disabled state [ 2526.820041][ T4865] nbd: socks must be embedded in a SOCK_ITEM attr [ 2526.822235][ T4865] block nbd3: shutting down sockets [ 2526.824568][ T4866] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5825'. [ 2527.289684][ T4868] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2527.354126][ T4873] FAULT_INJECTION: forcing a failure. [ 2527.354126][ T4873] name failslab, interval 1, probability 0, space 0, times 0 [ 2527.354161][ T4873] CPU: 1 UID: 0 PID: 4873 Comm: syz.2.5827 Tainted: G L syzkaller #0 PREEMPT(full) [ 2527.354187][ T4873] Tainted: [L]=SOFTLOCKUP [ 2527.354194][ T4873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2527.354204][ T4873] Call Trace: [ 2527.354211][ T4873] [ 2527.354239][ T4873] dump_stack_lvl+0x100/0x190 [ 2527.354273][ T4873] should_fail_ex.cold+0x5/0xa [ 2527.354297][ T4873] should_failslab+0xc2/0x120 [ 2527.354320][ T4873] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2527.354348][ T4873] ? security_file_alloc+0x34/0x2c0 [ 2527.354373][ T4873] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2527.354398][ T4873] security_file_alloc+0x34/0x2c0 [ 2527.354422][ T4873] init_file+0x95/0x480 [ 2527.354448][ T4873] alloc_empty_file_noaccount+0x45/0xd0 [ 2527.354476][ T4873] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2527.354506][ T4873] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2527.354541][ T4873] ? iput+0x3a/0x40 [ 2527.354580][ T4873] bdev_file_open_by_dev+0x13a/0x210 [ 2527.354625][ T4873] blkdev_bszset+0x170/0x240 [ 2527.354670][ T4873] ? __pfx_blkdev_bszset+0x10/0x10 [ 2527.354700][ T4873] ? find_held_lock+0x2b/0x80 [ 2527.354722][ T4873] ? __fget_files+0x215/0x3d0 [ 2527.354741][ T4873] ? hook_file_ioctl_common+0x149/0x410 [ 2527.354766][ T4873] blkdev_ioctl+0x513/0x6f0 [ 2527.354793][ T4873] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2527.354823][ T4873] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2527.354852][ T4873] __x64_sys_ioctl+0x18e/0x210 [ 2527.354871][ T4873] do_syscall_64+0x115/0x840 [ 2527.354896][ T4873] ? clear_bhb_loop+0x40/0x90 [ 2527.354918][ T4873] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2527.354937][ T4873] RIP: 0033:0x7f7ccf99ce59 [ 2527.354954][ T4873] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2527.354972][ T4873] RSP: 002b:00007f7ccdbf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2527.354992][ T4873] RAX: ffffffffffffffda RBX: 00007f7ccfc16180 RCX: 00007f7ccf99ce59 [ 2527.355004][ T4873] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2527.355016][ T4873] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2527.355027][ T4873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2527.355047][ T4873] R13: 00007f7ccfc16218 R14: 00007f7ccfc16180 R15: 00007ffc4184d4f8 [ 2527.355069][ T4873] [ 2527.407430][T10160] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2527.413374][T10160] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2527.428904][T10160] bond0 (unregistering): Released all slaves [ 2527.608706][ T4864] bond0: invalid ARP target specified [ 2527.697984][T32098] Bluetooth: hci4: command tx timeout [ 2528.440204][ T4878] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2528.458532][ T4814] bridge0: port 1(bridge_slave_0) entered blocking state [ 2528.484043][ T4814] bridge0: port 1(bridge_slave_0) entered disabled state [ 2528.502918][ T4814] bridge_slave_0: entered allmulticast mode [ 2528.521000][ T4814] bridge_slave_0: entered promiscuous mode [ 2528.526387][ T4814] bridge0: port 2(bridge_slave_1) entered blocking state [ 2528.526513][ T4814] bridge0: port 2(bridge_slave_1) entered disabled state [ 2528.526691][ T4814] bridge_slave_1: entered allmulticast mode [ 2528.528850][ T4814] bridge_slave_1: entered promiscuous mode [ 2528.679788][ T4814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2528.687088][ T4814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2528.947478][ T4814] team0: Port device team_slave_0 added [ 2528.995846][ T5295] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2529.011273][ T4903] bond0: invalid ARP target specified [ 2529.018998][ T4899] bond0: invalid ARP target specified [ 2529.034511][ T4814] team0: Port device team_slave_1 added [ 2529.064974][ T4901] nbd: socks must be embedded in a SOCK_ITEM attr [ 2529.081985][ T4901] block nbd3: shutting down sockets [ 2529.084751][ T4899] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5830'. [ 2529.219392][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2529.237199][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2529.286326][ T4814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2529.461732][ T4814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2529.480748][ T4814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2529.547137][ T4814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2529.748527][T32098] Bluetooth: hci4: command tx timeout [ 2530.136982][ T4910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5832'. [ 2530.588880][ T4814] hsr_slave_0: entered promiscuous mode [ 2530.605898][ T4814] hsr_slave_1: entered promiscuous mode [ 2530.632720][ T5295] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2531.394968][ T4941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5834'. [ 2531.818846][T32098] Bluetooth: hci4: command tx timeout [ 2533.044612][ T4973] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5838'. [ 2533.336464][ T4987] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5840'. [ 2534.274278][ T4814] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2534.290748][ T4814] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2534.346692][ T4814] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2534.358570][ T4814] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2534.433017][ T4814] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2534.452883][ T4814] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2534.468063][ T4814] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2534.481817][ T4814] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2535.333885][ T5026] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5841'. [ 2536.185587][ T4814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2536.494036][ T4814] 8021q: adding VLAN 0 to HW filter on device team0 [ 2536.634735][ T7843] bridge0: port 1(bridge_slave_0) entered blocking state [ 2536.642067][ T7843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2536.799707][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 2536.807176][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2537.165056][ T5079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5845'. [ 2537.579966][ T5082] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2538.069292][ T5091] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5848'. [ 2538.525908][ T5098] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5849'. [ 2539.221815][T10160] hsr_slave_0: left promiscuous mode [ 2539.232971][T10160] hsr_slave_1: left promiscuous mode [ 2539.241072][T10160] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2539.248595][T10160] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2539.261650][T10160] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2539.270798][T10160] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2539.299979][T10160] veth1_macvtap: left promiscuous mode [ 2539.307205][T10160] veth0_macvtap: left promiscuous mode [ 2539.319060][T10160] veth1_vlan: left promiscuous mode [ 2539.324482][T10160] veth0_vlan: left promiscuous mode [ 2539.362783][ T5111] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5850'. [ 2539.721351][T10160] team0 (unregistering): Port device team_slave_1 removed [ 2539.747017][T10160] team0 (unregistering): Port device team_slave_0 removed [ 2540.388048][ T4814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2540.465777][ T5123] bond0: invalid ARP target specified [ 2540.490689][ T5124] nbd: socks must be embedded in a SOCK_ITEM attr [ 2540.499878][ T5124] block nbd3: shutting down sockets [ 2540.532329][ T5119] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5851'. [ 2540.809549][ T5127] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5853'. [ 2541.858260][ T5140] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5855'. [ 2542.114954][ T4814] veth0_vlan: entered promiscuous mode [ 2542.357540][ T4814] veth1_vlan: entered promiscuous mode [ 2542.461714][ T4814] veth0_macvtap: entered promiscuous mode [ 2542.485946][ T4814] veth1_macvtap: entered promiscuous mode [ 2542.529995][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2542.570069][ T4814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2542.622786][ T3513] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2542.676026][ T3513] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2542.699751][ T3513] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2542.741271][ T3513] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2543.016428][ T5146] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2543.236191][ T3513] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2543.277921][ T3513] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2543.417691][ T5159] bond0: invalid ARP target specified [ 2543.487080][ T5159] nbd: socks must be embedded in a SOCK_ITEM attr [ 2543.499667][ T5159] block nbd3: shutting down sockets [ 2543.597689][ T3513] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2543.626537][ T3513] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2544.001130][ T5170] netlink: 'syz.3.5815': attribute type 1 has an invalid length. [ 2544.051216][ T5165] FAULT_INJECTION: forcing a failure. [ 2544.051216][ T5165] name failslab, interval 1, probability 0, space 0, times 0 [ 2544.060502][ T5170] nbd: error processing sock list [ 2544.111119][ T5165] CPU: 0 UID: 0 PID: 5165 Comm: syz.1.5860 Tainted: G L syzkaller #0 PREEMPT(full) [ 2544.111170][ T5165] Tainted: [L]=SOFTLOCKUP [ 2544.111181][ T5165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2544.111199][ T5165] Call Trace: [ 2544.111211][ T5165] [ 2544.111223][ T5165] dump_stack_lvl+0x100/0x190 [ 2544.111279][ T5165] should_fail_ex.cold+0x5/0xa [ 2544.111318][ T5165] should_failslab+0xc2/0x120 [ 2544.111356][ T5165] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2544.111402][ T5165] ? security_file_alloc+0x34/0x2c0 [ 2544.111441][ T5165] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2544.111492][ T5165] security_file_alloc+0x34/0x2c0 [ 2544.111532][ T5165] init_file+0x95/0x480 [ 2544.111574][ T5165] alloc_empty_file_noaccount+0x45/0xd0 [ 2544.111617][ T5165] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2544.111657][ T5165] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2544.111698][ T5165] ? iput+0x3a/0x40 [ 2544.111735][ T5165] bdev_file_open_by_dev+0x13a/0x210 [ 2544.111776][ T5165] blkdev_bszset+0x170/0x240 [ 2544.111813][ T5165] ? __pfx_blkdev_bszset+0x10/0x10 [ 2544.111851][ T5165] ? find_held_lock+0x2b/0x80 [ 2544.111885][ T5165] ? __fget_files+0x215/0x3d0 [ 2544.111918][ T5165] ? hook_file_ioctl_common+0x149/0x410 [ 2544.111962][ T5165] blkdev_ioctl+0x513/0x6f0 [ 2544.112005][ T5165] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2544.112057][ T5165] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2544.112105][ T5165] __x64_sys_ioctl+0x18e/0x210 [ 2544.112139][ T5165] do_syscall_64+0x115/0x840 [ 2544.112180][ T5165] ? clear_bhb_loop+0x40/0x90 [ 2544.112221][ T5165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2544.112253][ T5165] RIP: 0033:0x7f862bf9ce59 [ 2544.112278][ T5165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2544.112306][ T5165] RSP: 002b:00007f862ce71028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2544.112335][ T5165] RAX: ffffffffffffffda RBX: 00007f862c215fa0 RCX: 00007f862bf9ce59 [ 2544.112355][ T5165] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2544.112372][ T5165] RBP: 00007f862c032d6f R08: 0000000000000000 R09: 0000000000000000 [ 2544.112390][ T5165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2544.112407][ T5165] R13: 00007f862c216038 R14: 00007f862c215fa0 R15: 00007ffe7e1e3a08 [ 2544.112445][ T5165] [ 2544.116021][ T5174] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5815'. [ 2544.439130][ T5169] FAULT_INJECTION: forcing a failure. [ 2544.439130][ T5169] name failslab, interval 1, probability 0, space 0, times 0 [ 2544.466872][ T5169] CPU: 0 UID: 0 PID: 5169 Comm: syz.2.5861 Tainted: G L syzkaller #0 PREEMPT(full) [ 2544.466925][ T5169] Tainted: [L]=SOFTLOCKUP [ 2544.466937][ T5169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2544.466955][ T5169] Call Trace: [ 2544.466975][ T5169] [ 2544.466988][ T5169] dump_stack_lvl+0x100/0x190 [ 2544.467054][ T5169] should_fail_ex.cold+0x5/0xa [ 2544.467095][ T5169] should_failslab+0xc2/0x120 [ 2544.467133][ T5169] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2544.467179][ T5169] ? security_file_alloc+0x34/0x2c0 [ 2544.467220][ T5169] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2544.467266][ T5169] security_file_alloc+0x34/0x2c0 [ 2544.467308][ T5169] init_file+0x95/0x480 [ 2544.467353][ T5169] alloc_empty_file_noaccount+0x45/0xd0 [ 2544.467405][ T5169] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2544.467463][ T5169] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2544.467517][ T5169] ? iput+0x3a/0x40 [ 2544.467576][ T5169] bdev_file_open_by_dev+0x13a/0x210 [ 2544.467628][ T5169] blkdev_bszset+0x170/0x240 [ 2544.467680][ T5169] ? __pfx_blkdev_bszset+0x10/0x10 [ 2544.467725][ T5169] ? find_held_lock+0x2b/0x80 [ 2544.467760][ T5169] ? __fget_files+0x215/0x3d0 [ 2544.467791][ T5169] ? hook_file_ioctl_common+0x149/0x410 [ 2544.467836][ T5169] blkdev_ioctl+0x513/0x6f0 [ 2544.467884][ T5169] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2544.467939][ T5169] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2544.468000][ T5169] __x64_sys_ioctl+0x18e/0x210 [ 2544.468036][ T5169] do_syscall_64+0x115/0x840 [ 2544.468080][ T5169] ? clear_bhb_loop+0x40/0x90 [ 2544.468117][ T5169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2544.468148][ T5169] RIP: 0033:0x7f7ccf99ce59 [ 2544.468174][ T5169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2544.468202][ T5169] RSP: 002b:00007f7cd07a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2544.468231][ T5169] RAX: ffffffffffffffda RBX: 00007f7ccfc15fa0 RCX: 00007f7ccf99ce59 [ 2544.468251][ T5169] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2544.468269][ T5169] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2544.468289][ T5169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2544.468308][ T5169] R13: 00007f7ccfc16038 R14: 00007f7ccfc15fa0 R15: 00007ffc4184d4f8 [ 2544.468350][ T5169] [ 2544.890465][ T5168] bond0: invalid ARP target specified [ 2545.133178][T28306] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2545.168730][T28306] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2545.190161][T28306] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2545.207701][T28306] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2545.219179][T28306] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2546.080765][ T5196] bond0: invalid ARP target specified [ 2546.143208][ T5196] nbd: socks must be embedded in a SOCK_ITEM attr [ 2546.153241][ T5196] block nbd3: shutting down sockets [ 2546.175059][ T5183] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5863'. [ 2546.867960][ T5207] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2547.026517][ T5214] bond0: invalid ARP target specified [ 2547.048366][ T5215] nbd: socks must be embedded in a SOCK_ITEM attr [ 2547.050238][ T5215] block nbd3: shutting down sockets [ 2547.335601][ T5178] bridge0: port 1(bridge_slave_0) entered blocking state [ 2547.345415][T28306] Bluetooth: hci0: command tx timeout [ 2547.360815][ T5178] bridge0: port 1(bridge_slave_0) entered disabled state [ 2547.368252][ T5178] bridge_slave_0: entered allmulticast mode [ 2547.376463][ T5178] bridge_slave_0: entered promiscuous mode [ 2547.387078][ T5178] bridge0: port 2(bridge_slave_1) entered blocking state [ 2547.394316][ T5178] bridge0: port 2(bridge_slave_1) entered disabled state [ 2547.402022][ T5178] bridge_slave_1: entered allmulticast mode [ 2547.417321][ T5178] bridge_slave_1: entered promiscuous mode [ 2547.508705][ T5178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2547.524800][ T5178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2547.784540][ T5233] nbd: socks must be embedded in a SOCK_ITEM attr [ 2547.830615][ T5233] block nbd3: shutting down sockets [ 2547.959466][ T5178] team0: Port device team_slave_0 added [ 2547.967815][ T5226] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5869'. [ 2547.978601][ T5231] bond0: invalid ARP target specified [ 2548.087196][ T5178] team0: Port device team_slave_1 added [ 2548.435285][ T5178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2548.447677][ T5178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2548.475630][ T5178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2548.523387][ T5178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2548.537385][ T5178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2548.572050][ T5178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2548.761319][ T5178] hsr_slave_0: entered promiscuous mode [ 2548.772891][ T5178] hsr_slave_1: entered promiscuous mode [ 2548.779788][ T5178] debugfs: 'hsr0' already exists in 'hsr' [ 2548.785688][ T5178] Cannot create hsr debugfs directory [ 2549.406724][T28306] Bluetooth: hci0: command tx timeout [ 2549.430212][ T5178] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2549.659445][ T5248] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5874'. [ 2549.698338][ T5178] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2549.898168][ T5178] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2550.267673][ T5178] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2550.954201][ T5178] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2550.965940][ T5178] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2550.975193][ T5178] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2550.980736][ T5268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5878'. [ 2550.997521][ T5178] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2551.028733][ T5178] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2551.046863][ T5178] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2551.064553][ T5178] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2551.082824][ T5178] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2551.250304][ T5267] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2551.479044][T28306] Bluetooth: hci0: command tx timeout [ 2551.626301][ T5282] bond0: invalid ARP target specified [ 2551.631521][ T5283] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2551.674893][ T5178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2551.745365][ T5282] nbd: socks must be embedded in a SOCK_ITEM attr [ 2551.752408][ T5282] block nbd3: shutting down sockets [ 2551.792045][ T5178] 8021q: adding VLAN 0 to HW filter on device team0 [ 2551.822488][ T3513] bridge0: port 1(bridge_slave_0) entered blocking state [ 2551.822590][ T3513] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2551.844488][ T7843] bridge0: port 2(bridge_slave_1) entered blocking state [ 2551.844614][ T7843] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2552.021825][ T5285] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2552.121005][ T5178] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2552.406895][ T5298] FAULT_INJECTION: forcing a failure. [ 2552.406895][ T5298] name failslab, interval 1, probability 0, space 0, times 0 [ 2552.406946][ T5298] CPU: 1 UID: 0 PID: 5298 Comm: syz.3.5882 Tainted: G L syzkaller #0 PREEMPT(full) [ 2552.406990][ T5298] Tainted: [L]=SOFTLOCKUP [ 2552.407001][ T5298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2552.407022][ T5298] Call Trace: [ 2552.407032][ T5298] [ 2552.407045][ T5298] dump_stack_lvl+0x100/0x190 [ 2552.407100][ T5298] should_fail_ex.cold+0x5/0xa [ 2552.407140][ T5298] should_failslab+0xc2/0x120 [ 2552.407175][ T5298] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2552.407223][ T5298] ? security_file_alloc+0x34/0x2c0 [ 2552.407262][ T5298] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2552.407305][ T5298] security_file_alloc+0x34/0x2c0 [ 2552.407346][ T5298] init_file+0x95/0x480 [ 2552.407391][ T5298] alloc_empty_file_noaccount+0x45/0xd0 [ 2552.407437][ T5298] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2552.407488][ T5298] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2552.407538][ T5298] ? iput+0x3a/0x40 [ 2552.407583][ T5298] bdev_file_open_by_dev+0x13a/0x210 [ 2552.407636][ T5298] blkdev_bszset+0x170/0x240 [ 2552.407693][ T5298] ? __pfx_blkdev_bszset+0x10/0x10 [ 2552.407739][ T5298] ? find_held_lock+0x2b/0x80 [ 2552.407777][ T5298] ? __fget_files+0x215/0x3d0 [ 2552.407809][ T5298] ? hook_file_ioctl_common+0x149/0x410 [ 2552.407852][ T5298] blkdev_ioctl+0x513/0x6f0 [ 2552.407895][ T5298] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2552.407945][ T5298] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2552.407989][ T5298] __x64_sys_ioctl+0x18e/0x210 [ 2552.408021][ T5298] do_syscall_64+0x115/0x840 [ 2552.408062][ T5298] ? clear_bhb_loop+0x40/0x90 [ 2552.408099][ T5298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2552.408130][ T5298] RIP: 0033:0x7f4430d9ce59 [ 2552.408157][ T5298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2552.408186][ T5298] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2552.408218][ T5298] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2552.408239][ T5298] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2552.408258][ T5298] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2552.408275][ T5298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2552.408291][ T5298] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2552.408332][ T5298] [ 2552.979524][ T5313] úÿÅoè\¹ 'ÇÍd×"h_\ÿóÞ ‰ÊöÙÈw¦:Óá6;=lg¯Á!ÜšJè+Å>O‘i‚uÑú,YƒÑ-nÑ’ha_ÞåP+ø'"ËʼÚL¬))9­ô‰NGÍzõîu÷”Y¼;&íŽp'Ç©•U|eönÇòøŸlB†Â í§*Šy¾ap>%ø;}gƒ]ð?ãC߯Ÿ½ªdÏr¤š8ïôƒáûoS‘ãÏ5]‚¾R|§h>4u¬}‡ iŒã®m€gðnsêç—£¦ôáè [ 2553.388379][ T5306] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5883'. [ 2553.546153][T28306] Bluetooth: hci0: command tx timeout [ 2553.769307][ T5178] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2554.023244][ T5178] veth0_vlan: entered promiscuous mode [ 2554.080209][ T5178] veth1_vlan: entered promiscuous mode [ 2554.154925][ T5328] bond0: invalid ARP target specified [ 2554.209862][ T5178] veth0_macvtap: entered promiscuous mode [ 2554.216594][ T5328] nbd: socks must be embedded in a SOCK_ITEM attr [ 2554.224216][ T5328] block nbd3: shutting down sockets [ 2554.239020][ T5178] veth1_macvtap: entered promiscuous mode [ 2554.296960][ T5178] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2554.339943][ T5178] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2554.511429][ T7694] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2554.561414][ T7694] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2554.621616][ T7694] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2554.631786][ T5335] nbd: socks must be embedded in a SOCK_ITEM attr [ 2554.645770][ T5332] bond0: invalid ARP target specified [ 2554.666341][ T7696] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2554.670342][ T5335] block nbd3: shutting down sockets [ 2554.710221][ T5334] FAULT_INJECTION: forcing a failure. [ 2554.710221][ T5334] name failslab, interval 1, probability 0, space 0, times 0 [ 2554.737367][ T5324] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5885'. [ 2554.756803][ T5334] CPU: 0 UID: 0 PID: 5334 Comm: syz.3.5888 Tainted: G L syzkaller #0 PREEMPT(full) [ 2554.756861][ T5334] Tainted: [L]=SOFTLOCKUP [ 2554.756872][ T5334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2554.756894][ T5334] Call Trace: [ 2554.756905][ T5334] [ 2554.756918][ T5334] dump_stack_lvl+0x100/0x190 [ 2554.756975][ T5334] should_fail_ex.cold+0x5/0xa [ 2554.757015][ T5334] should_failslab+0xc2/0x120 [ 2554.757052][ T5334] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2554.757101][ T5334] ? security_file_alloc+0x34/0x2c0 [ 2554.757140][ T5334] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2554.757182][ T5334] security_file_alloc+0x34/0x2c0 [ 2554.757224][ T5334] init_file+0x95/0x480 [ 2554.757266][ T5334] alloc_empty_file_noaccount+0x45/0xd0 [ 2554.757313][ T5334] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2554.757358][ T5334] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2554.757409][ T5334] ? iput+0x3a/0x40 [ 2554.757460][ T5334] bdev_file_open_by_dev+0x13a/0x210 [ 2554.757511][ T5334] blkdev_bszset+0x170/0x240 [ 2554.757557][ T5334] ? __pfx_blkdev_bszset+0x10/0x10 [ 2554.757604][ T5334] ? find_held_lock+0x2b/0x80 [ 2554.757640][ T5334] ? __fget_files+0x215/0x3d0 [ 2554.757673][ T5334] ? hook_file_ioctl_common+0x149/0x410 [ 2554.757718][ T5334] blkdev_ioctl+0x513/0x6f0 [ 2554.757765][ T5334] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2554.757817][ T5334] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2554.757870][ T5334] __x64_sys_ioctl+0x18e/0x210 [ 2554.757903][ T5334] do_syscall_64+0x115/0x840 [ 2554.757945][ T5334] ? clear_bhb_loop+0x40/0x90 [ 2554.757982][ T5334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2554.758013][ T5334] RIP: 0033:0x7f4430d9ce59 [ 2554.758041][ T5334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2554.758069][ T5334] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2554.758098][ T5334] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2554.758117][ T5334] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2554.758136][ T5334] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2554.758155][ T5334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2554.758171][ T5334] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2554.758206][ T5334] [ 2555.377116][ T5340] FAULT_INJECTION: forcing a failure. [ 2555.377116][ T5340] name failslab, interval 1, probability 0, space 0, times 0 [ 2555.409512][ T5340] CPU: 1 UID: 0 PID: 5340 Comm: syz.2.5889 Tainted: G L syzkaller #0 PREEMPT(full) [ 2555.409565][ T5340] Tainted: [L]=SOFTLOCKUP [ 2555.409577][ T5340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2555.409597][ T5340] Call Trace: [ 2555.409612][ T5340] [ 2555.409625][ T5340] dump_stack_lvl+0x100/0x190 [ 2555.409693][ T5340] should_fail_ex.cold+0x5/0xa [ 2555.409735][ T5340] should_failslab+0xc2/0x120 [ 2555.409774][ T5340] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2555.409823][ T5340] ? security_file_alloc+0x34/0x2c0 [ 2555.409865][ T5340] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2555.409909][ T5340] security_file_alloc+0x34/0x2c0 [ 2555.409952][ T5340] init_file+0x95/0x480 [ 2555.409997][ T5340] alloc_empty_file_noaccount+0x45/0xd0 [ 2555.410047][ T5340] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2555.410100][ T5340] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2555.410155][ T5340] ? iput+0x3a/0x40 [ 2555.410201][ T5340] bdev_file_open_by_dev+0x13a/0x210 [ 2555.410254][ T5340] blkdev_bszset+0x170/0x240 [ 2555.410303][ T5340] ? __pfx_blkdev_bszset+0x10/0x10 [ 2555.410352][ T5340] ? find_held_lock+0x2b/0x80 [ 2555.410390][ T5340] ? __fget_files+0x215/0x3d0 [ 2555.410425][ T5340] ? hook_file_ioctl_common+0x149/0x410 [ 2555.410470][ T5340] blkdev_ioctl+0x513/0x6f0 [ 2555.410519][ T5340] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2555.410574][ T5340] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2555.410625][ T5340] __x64_sys_ioctl+0x18e/0x210 [ 2555.410661][ T5340] do_syscall_64+0x115/0x840 [ 2555.410715][ T5340] ? clear_bhb_loop+0x40/0x90 [ 2555.410755][ T5340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2555.410790][ T5340] RIP: 0033:0x7f7ccf99ce59 [ 2555.410817][ T5340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2555.410849][ T5340] RSP: 002b:00007f7cd07a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2555.410881][ T5340] RAX: ffffffffffffffda RBX: 00007f7ccfc15fa0 RCX: 00007f7ccf99ce59 [ 2555.410903][ T5340] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2555.410923][ T5340] RBP: 00007f7ccfa32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2555.410943][ T5340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2555.410962][ T5340] R13: 00007f7ccfc16038 R14: 00007f7ccfc15fa0 R15: 00007ffc4184d4f8 [ 2555.411004][ T5340] [ 2555.734566][ T7843] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2555.745948][ T7843] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2556.098457][ T7843] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2556.112601][ T7843] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2556.210235][ T5345] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5890'. [ 2556.530046][ T5350] FAULT_INJECTION: forcing a failure. [ 2556.530046][ T5350] name failslab, interval 1, probability 0, space 0, times 0 [ 2556.591602][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.3.5891 Tainted: G L syzkaller #0 PREEMPT(full) [ 2556.591652][ T5350] Tainted: [L]=SOFTLOCKUP [ 2556.591663][ T5350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2556.591682][ T5350] Call Trace: [ 2556.591693][ T5350] [ 2556.591705][ T5350] dump_stack_lvl+0x100/0x190 [ 2556.591761][ T5350] should_fail_ex.cold+0x5/0xa [ 2556.591798][ T5350] should_failslab+0xc2/0x120 [ 2556.591833][ T5350] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2556.591880][ T5350] ? security_file_alloc+0x34/0x2c0 [ 2556.591920][ T5350] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2556.591963][ T5350] security_file_alloc+0x34/0x2c0 [ 2556.592005][ T5350] init_file+0x95/0x480 [ 2556.592049][ T5350] alloc_empty_file_noaccount+0x45/0xd0 [ 2556.592101][ T5350] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2556.592152][ T5350] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2556.592205][ T5350] ? iput+0x3a/0x40 [ 2556.592251][ T5350] bdev_file_open_by_dev+0x13a/0x210 [ 2556.592307][ T5350] blkdev_bszset+0x170/0x240 [ 2556.592351][ T5350] ? __pfx_blkdev_bszset+0x10/0x10 [ 2556.592393][ T5350] ? find_held_lock+0x2b/0x80 [ 2556.592426][ T5350] ? __fget_files+0x215/0x3d0 [ 2556.592455][ T5350] ? hook_file_ioctl_common+0x149/0x410 [ 2556.592494][ T5350] blkdev_ioctl+0x513/0x6f0 [ 2556.592536][ T5350] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2556.592582][ T5350] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2556.592626][ T5350] __x64_sys_ioctl+0x18e/0x210 [ 2556.592657][ T5350] do_syscall_64+0x115/0x840 [ 2556.592696][ T5350] ? clear_bhb_loop+0x40/0x90 [ 2556.592729][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2556.592757][ T5350] RIP: 0033:0x7f4430d9ce59 [ 2556.592782][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2556.592809][ T5350] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2556.592838][ T5350] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2556.592857][ T5350] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2556.592875][ T5350] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2556.592893][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2556.592910][ T5350] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2556.592948][ T5350] [ 2557.069785][T32098] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2557.082485][T32098] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2557.093795][T32098] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2557.113107][T32098] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2557.135933][T32098] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2557.691033][ T5354] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5862'. [ 2558.267502][ T5365] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5893'. [ 2558.641485][ T5381] bond0: invalid ARP target specified [ 2558.684204][ T5378] FAULT_INJECTION: forcing a failure. [ 2558.684204][ T5378] name failslab, interval 1, probability 0, space 0, times 0 [ 2558.717304][ T5378] CPU: 1 UID: 0 PID: 5378 Comm: syz.0.5894 Tainted: G L syzkaller #0 PREEMPT(full) [ 2558.717355][ T5378] Tainted: [L]=SOFTLOCKUP [ 2558.717366][ T5378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2558.717383][ T5378] Call Trace: [ 2558.717393][ T5378] [ 2558.717406][ T5378] dump_stack_lvl+0x100/0x190 [ 2558.717468][ T5378] should_fail_ex.cold+0x5/0xa [ 2558.717508][ T5378] should_failslab+0xc2/0x120 [ 2558.717544][ T5378] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2558.717589][ T5378] ? security_file_alloc+0x34/0x2c0 [ 2558.717626][ T5378] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2558.717668][ T5378] security_file_alloc+0x34/0x2c0 [ 2558.717708][ T5378] init_file+0x95/0x480 [ 2558.717751][ T5378] alloc_empty_file_noaccount+0x45/0xd0 [ 2558.717799][ T5378] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2558.717851][ T5378] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2558.717904][ T5378] ? iput+0x3a/0x40 [ 2558.717952][ T5378] bdev_file_open_by_dev+0x13a/0x210 [ 2558.718000][ T5378] blkdev_bszset+0x170/0x240 [ 2558.718043][ T5378] ? __pfx_blkdev_bszset+0x10/0x10 [ 2558.718090][ T5378] ? find_held_lock+0x2b/0x80 [ 2558.718120][ T5378] ? __fget_files+0x215/0x3d0 [ 2558.718149][ T5378] ? hook_file_ioctl_common+0x149/0x410 [ 2558.718187][ T5378] blkdev_ioctl+0x513/0x6f0 [ 2558.718227][ T5378] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2558.718272][ T5378] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2558.718323][ T5378] __x64_sys_ioctl+0x18e/0x210 [ 2558.718353][ T5378] do_syscall_64+0x115/0x840 [ 2558.718392][ T5378] ? clear_bhb_loop+0x40/0x90 [ 2558.718428][ T5378] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2558.718458][ T5378] RIP: 0033:0x7f8deb19ce59 [ 2558.718483][ T5378] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2558.718511][ T5378] RSP: 002b:00007f8dec0d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2558.718539][ T5378] RAX: ffffffffffffffda RBX: 00007f8deb415fa0 RCX: 00007f8deb19ce59 [ 2558.718559][ T5378] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2558.718577][ T5378] RBP: 00007f8deb232d6f R08: 0000000000000000 R09: 0000000000000000 [ 2558.718594][ T5378] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2558.718610][ T5378] R13: 00007f8deb416038 R14: 00007f8deb415fa0 R15: 00007ffe700f1448 [ 2558.718647][ T5378] [ 2558.731484][ T5381] nbd: socks must be embedded in a SOCK_ITEM attr [ 2558.731805][ T5381] block nbd3: shutting down sockets [ 2559.197806][T32098] Bluetooth: hci2: command tx timeout [ 2559.218433][ T5386] FAULT_INJECTION: forcing a failure. [ 2559.218433][ T5386] name failslab, interval 1, probability 0, space 0, times 0 [ 2559.305350][ T5386] CPU: 0 UID: 0 PID: 5386 Comm: syz.3.5896 Tainted: G L syzkaller #0 PREEMPT(full) [ 2559.305404][ T5386] Tainted: [L]=SOFTLOCKUP [ 2559.305415][ T5386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2559.305434][ T5386] Call Trace: [ 2559.305445][ T5386] [ 2559.305459][ T5386] dump_stack_lvl+0x100/0x190 [ 2559.305516][ T5386] should_fail_ex.cold+0x5/0xa [ 2559.305554][ T5386] should_failslab+0xc2/0x120 [ 2559.305591][ T5386] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2559.305639][ T5386] ? security_file_alloc+0x34/0x2c0 [ 2559.305679][ T5386] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2559.305724][ T5386] security_file_alloc+0x34/0x2c0 [ 2559.305765][ T5386] init_file+0x95/0x480 [ 2559.305810][ T5386] alloc_empty_file_noaccount+0x45/0xd0 [ 2559.305859][ T5386] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2559.305910][ T5386] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2559.305966][ T5386] ? iput+0x3a/0x40 [ 2559.306015][ T5386] bdev_file_open_by_dev+0x13a/0x210 [ 2559.306065][ T5386] blkdev_bszset+0x170/0x240 [ 2559.306113][ T5386] ? __pfx_blkdev_bszset+0x10/0x10 [ 2559.306159][ T5386] ? find_held_lock+0x2b/0x80 [ 2559.306205][ T5386] ? __fget_files+0x215/0x3d0 [ 2559.306236][ T5386] ? hook_file_ioctl_common+0x149/0x410 [ 2559.306278][ T5386] blkdev_ioctl+0x513/0x6f0 [ 2559.306325][ T5386] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2559.306378][ T5386] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2559.306428][ T5386] __x64_sys_ioctl+0x18e/0x210 [ 2559.306464][ T5386] do_syscall_64+0x115/0x840 [ 2559.306505][ T5386] ? clear_bhb_loop+0x40/0x90 [ 2559.306544][ T5386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2559.306576][ T5386] RIP: 0033:0x7f4430d9ce59 [ 2559.306604][ T5386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2559.306635][ T5386] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2559.306666][ T5386] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2559.306688][ T5386] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2559.306708][ T5386] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2559.306727][ T5386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2559.306746][ T5386] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2559.306788][ T5386] [ 2560.029262][ T5405] FAULT_INJECTION: forcing a failure. [ 2560.029262][ T5405] name failslab, interval 1, probability 0, space 0, times 0 [ 2560.064460][ T5405] CPU: 1 UID: 0 PID: 5405 Comm: syz.3.5899 Tainted: G L syzkaller #0 PREEMPT(full) [ 2560.064512][ T5405] Tainted: [L]=SOFTLOCKUP [ 2560.064524][ T5405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2560.064543][ T5405] Call Trace: [ 2560.064554][ T5405] [ 2560.064568][ T5405] dump_stack_lvl+0x100/0x190 [ 2560.064633][ T5405] should_fail_ex.cold+0x5/0xa [ 2560.064673][ T5405] should_failslab+0xc2/0x120 [ 2560.064712][ T5405] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2560.064764][ T5405] ? security_file_alloc+0x34/0x2c0 [ 2560.064806][ T5405] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2560.064852][ T5405] security_file_alloc+0x34/0x2c0 [ 2560.064895][ T5405] init_file+0x95/0x480 [ 2560.064941][ T5405] alloc_empty_file_noaccount+0x45/0xd0 [ 2560.064993][ T5405] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2560.065044][ T5405] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2560.065099][ T5405] ? iput+0x3a/0x40 [ 2560.065147][ T5405] bdev_file_open_by_dev+0x13a/0x210 [ 2560.065200][ T5405] blkdev_bszset+0x170/0x240 [ 2560.065249][ T5405] ? __pfx_blkdev_bszset+0x10/0x10 [ 2560.065298][ T5405] ? find_held_lock+0x2b/0x80 [ 2560.065335][ T5405] ? __fget_files+0x215/0x3d0 [ 2560.065369][ T5405] ? hook_file_ioctl_common+0x149/0x410 [ 2560.065413][ T5405] blkdev_ioctl+0x513/0x6f0 [ 2560.065461][ T5405] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2560.065516][ T5405] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2560.065566][ T5405] __x64_sys_ioctl+0x18e/0x210 [ 2560.065610][ T5405] do_syscall_64+0x115/0x840 [ 2560.065654][ T5405] ? clear_bhb_loop+0x40/0x90 [ 2560.065694][ T5405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2560.065729][ T5405] RIP: 0033:0x7f4430d9ce59 [ 2560.065757][ T5405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2560.065788][ T5405] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2560.065820][ T5405] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2560.065842][ T5405] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2560.065860][ T5405] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2560.065880][ T5405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2560.065898][ T5405] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2560.065939][ T5405] [ 2560.762670][ T5358] bridge0: port 1(bridge_slave_0) entered blocking state [ 2560.770400][ T5358] bridge0: port 1(bridge_slave_0) entered disabled state [ 2560.777790][ T5358] bridge_slave_0: entered allmulticast mode [ 2560.785010][ T5358] bridge_slave_0: entered promiscuous mode [ 2560.809186][ T5358] bridge0: port 2(bridge_slave_1) entered blocking state [ 2560.816992][ T5358] bridge0: port 2(bridge_slave_1) entered disabled state [ 2560.824302][ T5358] bridge_slave_1: entered allmulticast mode [ 2560.832856][ T5358] bridge_slave_1: entered promiscuous mode [ 2560.883999][ T5358] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2560.901270][ T5358] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2560.940434][ T5358] team0: Port device team_slave_0 added [ 2560.972421][ T5358] team0: Port device team_slave_1 added [ 2561.156683][ T5413] bond0: invalid ARP target specified [ 2561.175631][ T5358] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2561.213659][ T5358] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2561.246035][ T5358] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2561.246543][ T5413] nbd: socks must be embedded in a SOCK_ITEM attr [ 2561.259136][ T5358] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2561.270390][T32098] Bluetooth: hci2: command tx timeout [ 2561.276431][ T5358] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2561.330003][ T5413] block nbd3: shutting down sockets [ 2561.340179][ T5358] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2561.666461][ T5358] hsr_slave_0: entered promiscuous mode [ 2561.683941][ T5358] hsr_slave_1: entered promiscuous mode [ 2561.695458][ T5358] debugfs: 'hsr0' already exists in 'hsr' [ 2561.710845][ T5358] Cannot create hsr debugfs directory [ 2562.087747][ T5423] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5902'. [ 2562.314308][ T5428] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5903'. [ 2563.108885][ T5358] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2563.171186][ T5451] bond0: invalid ARP target specified [ 2563.294044][ T5454] nbd: socks must be embedded in a SOCK_ITEM attr [ 2563.303499][ T5454] block nbd3: shutting down sockets [ 2563.337602][T32098] Bluetooth: hci2: command tx timeout [ 2563.652955][ T5358] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2563.876683][ T5358] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2563.985092][ T5358] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2564.322343][ T5458] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2564.499179][ T5460] FAULT_INJECTION: forcing a failure. [ 2564.499179][ T5460] name failslab, interval 1, probability 0, space 0, times 0 [ 2564.525891][ T5460] CPU: 1 UID: 0 PID: 5460 Comm: syz.3.5909 Tainted: G L syzkaller #0 PREEMPT(full) [ 2564.525944][ T5460] Tainted: [L]=SOFTLOCKUP [ 2564.525957][ T5460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2564.525975][ T5460] Call Trace: [ 2564.525987][ T5460] [ 2564.526000][ T5460] dump_stack_lvl+0x100/0x190 [ 2564.526057][ T5460] should_fail_ex.cold+0x5/0xa [ 2564.526098][ T5460] should_failslab+0xc2/0x120 [ 2564.526136][ T5460] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2564.526186][ T5460] ? security_file_alloc+0x34/0x2c0 [ 2564.526230][ T5460] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2564.526275][ T5460] security_file_alloc+0x34/0x2c0 [ 2564.526317][ T5460] init_file+0x95/0x480 [ 2564.526362][ T5460] alloc_empty_file_noaccount+0x45/0xd0 [ 2564.526415][ T5460] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2564.526469][ T5460] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2564.526521][ T5460] ? iput+0x3a/0x40 [ 2564.526564][ T5460] bdev_file_open_by_dev+0x13a/0x210 [ 2564.526609][ T5460] blkdev_bszset+0x170/0x240 [ 2564.526653][ T5460] ? __pfx_blkdev_bszset+0x10/0x10 [ 2564.526699][ T5460] ? find_held_lock+0x2b/0x80 [ 2564.526738][ T5460] ? __fget_files+0x215/0x3d0 [ 2564.526784][ T5460] ? hook_file_ioctl_common+0x149/0x410 [ 2564.526830][ T5460] blkdev_ioctl+0x513/0x6f0 [ 2564.526880][ T5460] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2564.526935][ T5460] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2564.526992][ T5460] __x64_sys_ioctl+0x18e/0x210 [ 2564.527029][ T5460] do_syscall_64+0x115/0x840 [ 2564.527069][ T5460] ? clear_bhb_loop+0x40/0x90 [ 2564.527105][ T5460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2564.527137][ T5460] RIP: 0033:0x7f4430d9ce59 [ 2564.527165][ T5460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2564.527196][ T5460] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2564.527228][ T5460] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2564.527249][ T5460] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2564.527266][ T5460] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2564.527283][ T5460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2564.527300][ T5460] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2564.527338][ T5460] [ 2565.403364][T32098] Bluetooth: hci2: command tx timeout [ 2567.290971][ T5497] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5916'. [ 2567.957872][ T5515] bond0: invalid ARP target specified [ 2569.020674][ T5523] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5921'. [ 2569.537101][ T5531] block nbd3: Unsupported socket: should be TCP or UNIX. [ 2569.980670][ T5534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5924'. [ 2570.481124][ T5540] FAULT_INJECTION: forcing a failure. [ 2570.481124][ T5540] name failslab, interval 1, probability 0, space 0, times 0 [ 2570.494263][ T5540] CPU: 1 UID: 0 PID: 5540 Comm: syz.3.5926 Tainted: G L syzkaller #0 PREEMPT(full) [ 2570.494309][ T5540] Tainted: [L]=SOFTLOCKUP [ 2570.494320][ T5540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2570.494337][ T5540] Call Trace: [ 2570.494348][ T5540] [ 2570.494359][ T5540] dump_stack_lvl+0x100/0x190 [ 2570.494417][ T5540] should_fail_ex.cold+0x5/0xa [ 2570.494455][ T5540] should_failslab+0xc2/0x120 [ 2570.494493][ T5540] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 2570.494546][ T5540] ? security_file_alloc+0x34/0x2c0 [ 2570.494582][ T5540] ? trace_kmem_cache_alloc+0xd5/0x100 [ 2570.494623][ T5540] security_file_alloc+0x34/0x2c0 [ 2570.494663][ T5540] init_file+0x95/0x480 [ 2570.494703][ T5540] alloc_empty_file_noaccount+0x45/0xd0 [ 2570.494751][ T5540] alloc_file_pseudo_noaccount+0x13a/0x230 [ 2570.494802][ T5540] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 2570.494852][ T5540] ? iput+0x3a/0x40 [ 2570.494901][ T5540] bdev_file_open_by_dev+0x13a/0x210 [ 2570.494952][ T5540] blkdev_bszset+0x170/0x240 [ 2570.495000][ T5540] ? __pfx_blkdev_bszset+0x10/0x10 [ 2570.495045][ T5540] ? find_held_lock+0x2b/0x80 [ 2570.495095][ T5540] ? __fget_files+0x215/0x3d0 [ 2570.495130][ T5540] ? hook_file_ioctl_common+0x149/0x410 [ 2570.495177][ T5540] blkdev_ioctl+0x513/0x6f0 [ 2570.495227][ T5540] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2570.495280][ T5540] ? __pfx_blkdev_ioctl+0x10/0x10 [ 2570.495325][ T5540] __x64_sys_ioctl+0x18e/0x210 [ 2570.495360][ T5540] do_syscall_64+0x115/0x840 [ 2570.495402][ T5540] ? clear_bhb_loop+0x40/0x90 [ 2570.495438][ T5540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2570.495472][ T5540] RIP: 0033:0x7f4430d9ce59 [ 2570.495500][ T5540] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2570.495531][ T5540] RSP: 002b:00007f442eff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2570.495564][ T5540] RAX: ffffffffffffffda RBX: 00007f4431015fa0 RCX: 00007f4430d9ce59 [ 2570.495583][ T5540] RDX: 00002000000000c0 RSI: 0000000040081271 RDI: 0000000000000002 [ 2570.495603][ T5540] RBP: 00007f4430e32d6f R08: 0000000000000000 R09: 0000000000000000 [ 2570.495621][ T5540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2570.495639][ T5540] R13: 00007f4431016038 R14: 00007f4431015fa0 R15: 00007fffcdcbac38 [ 2570.495695][ T5540] [ 2570.976851][ T5545] bond0: invalid ARP target specified [ 2571.007109][ T5545] nbd: socks must be embedded in a SOCK_ITEM attr [ 2571.014058][ T5545] block nbd3: shutting down sockets [ 2578.058956][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 2578.065330][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 2578.243746][T28306] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2578.258731][T28306] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2578.268105][T28306] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2578.282125][T28306] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2578.292529][T28306] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2578.784653][ T5547] bridge0: port 1(bridge_slave_0) entered blocking state [ 2578.791947][ T5547] bridge0: port 1(bridge_slave_0) entered disabled state [ 2578.799818][ T5547] bridge_slave_0: entered allmulticast mode [ 2578.807435][ T5547] bridge_slave_0: entered promiscuous mode [ 2578.815625][ T5547] bridge0: port 2(bridge_slave_1) entered blocking state [ 2578.826424][ T5547] bridge0: port 2(bridge_slave_1) entered disabled state [ 2578.834337][ T5547] bridge_slave_1: entered allmulticast mode [ 2578.841605][ T5547] bridge_slave_1: entered promiscuous mode [ 2578.871046][ T5547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2578.883434][ T5547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2578.913296][ T5547] team0: Port device team_slave_0 added [ 2578.922999][ T5547] team0: Port device team_slave_1 added [ 2578.949886][ T5547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2578.956976][ T5547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2578.983371][ T5547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2578.996190][ T5547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2579.003528][ T5547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2579.029975][ T5547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2579.073818][ T5547] hsr_slave_0: entered promiscuous mode [ 2579.080220][ T5547] hsr_slave_1: entered promiscuous mode [ 2579.086615][ T5547] debugfs: 'hsr0' already exists in 'hsr' [ 2579.092414][ T5547] Cannot create hsr debugfs directory [ 2580.365194][T32098] Bluetooth: hci1: command tx timeout [ 2582.434516][T32098] Bluetooth: hci1: command tx timeout [ 2583.255961][T28306] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 2583.269385][T28306] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 2583.278199][T28306] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 2583.289023][T28306] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 2583.298886][T28306] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 2583.794701][ T5566] bridge0: port 1(bridge_slave_0) entered blocking state [ 2583.801940][ T5566] bridge0: port 1(bridge_slave_0) entered disabled state [ 2583.809625][ T5566] bridge_slave_0: entered allmulticast mode [ 2583.816888][ T5566] bridge_slave_0: entered promiscuous mode [ 2583.825622][ T5566] bridge0: port 2(bridge_slave_1) entered blocking state [ 2583.832901][ T5566] bridge0: port 2(bridge_slave_1) entered disabled state [ 2583.840457][ T5566] bridge_slave_1: entered allmulticast mode [ 2583.847999][ T5566] bridge_slave_1: entered promiscuous mode [ 2583.880555][ T5566] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2583.892913][ T5566] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2583.925320][ T5566] team0: Port device team_slave_0 added [ 2583.933544][ T5566] team0: Port device team_slave_1 added [ 2583.959663][ T5566] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2583.966688][ T5566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2583.992994][ T5566] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2584.005901][ T5566] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2584.013006][ T5566] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2584.039102][ T5566] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2584.082922][ T5566] hsr_slave_0: entered promiscuous mode [ 2584.089768][ T5566] hsr_slave_1: entered promiscuous mode [ 2584.096288][ T5566] debugfs: 'hsr0' already exists in 'hsr' [ 2584.102052][ T5566] Cannot create hsr debugfs directory [ 2584.504237][T28306] Bluetooth: hci1: command tx timeout [ 2585.379258][T28306] Bluetooth: hci5: command tx timeout [ 2586.572908][T28306] Bluetooth: hci1: command tx timeout [ 2586.770338][T32098] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2586.787624][T32098] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2586.796593][T32098] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2586.804797][T32098] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2586.813532][T32098] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2587.324487][ T5585] bridge0: port 1(bridge_slave_0) entered blocking state [ 2587.331843][ T5585] bridge0: port 1(bridge_slave_0) entered disabled state [ 2587.339209][ T5585] bridge_slave_0: entered allmulticast mode [ 2587.346610][ T5585] bridge_slave_0: entered promiscuous mode [ 2587.355105][ T5585] bridge0: port 2(bridge_slave_1) entered blocking state [ 2587.362489][ T5585] bridge0: port 2(bridge_slave_1) entered disabled state [ 2587.370184][ T5585] bridge_slave_1: entered allmulticast mode [ 2587.379097][ T5585] bridge_slave_1: entered promiscuous mode [ 2587.410776][ T5585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2587.424559][ T5585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2587.449077][T32098] Bluetooth: hci5: command tx timeout [ 2587.458254][ T5585] team0: Port device team_slave_0 added [ 2587.466270][ T5585] team0: Port device team_slave_1 added [ 2587.495531][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2587.502565][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2587.530159][ T5585] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2587.544421][ T5585] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2587.551743][ T5585] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2587.577974][ T5585] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2587.625548][ T5585] hsr_slave_0: entered promiscuous mode [ 2587.632297][ T5585] hsr_slave_1: entered promiscuous mode [ 2587.638856][ T5585] debugfs: 'hsr0' already exists in 'hsr' [ 2587.644785][ T5585] Cannot create hsr debugfs directory [ 2588.881105][T32098] Bluetooth: hci6: command tx timeout [ 2589.518204][T32098] Bluetooth: hci5: command tx timeout [ 2590.950312][T32098] Bluetooth: hci6: command tx timeout [ 2591.587131][T32098] Bluetooth: hci5: command tx timeout [ 2593.019408][T32098] Bluetooth: hci6: command tx timeout [ 2595.088724][T32098] Bluetooth: hci6: command tx timeout [ 2615.787367][T32098] Bluetooth: hci3: command 0x0406 tx timeout [ 2616.768790][T32098] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 2616.779742][T32098] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 2616.791372][T32098] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 2616.799618][T32098] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 2616.810834][T32098] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 2617.310846][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 2617.318126][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 2617.325556][ T5610] bridge_slave_0: entered allmulticast mode [ 2617.333242][ T5610] bridge_slave_0: entered promiscuous mode [ 2617.341454][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 2617.348890][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 2617.356417][ T5610] bridge_slave_1: entered allmulticast mode [ 2617.364522][ T5610] bridge_slave_1: entered promiscuous mode [ 2617.394840][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2617.406942][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2617.439173][ T5610] team0: Port device team_slave_0 added [ 2617.447367][ T5610] team0: Port device team_slave_1 added [ 2617.473894][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2617.480910][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2617.507340][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2617.519553][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2617.526583][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2617.553003][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2617.597958][ T5610] hsr_slave_0: entered promiscuous mode [ 2617.604503][ T5610] hsr_slave_1: entered promiscuous mode [ 2617.610784][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 2617.616626][ T5610] Cannot create hsr debugfs directory [ 2618.884959][T32098] Bluetooth: hci7: command tx timeout [ 2620.954211][T32098] Bluetooth: hci7: command tx timeout [ 2623.023509][T32098] Bluetooth: hci7: command tx timeout [ 2625.092662][T32098] Bluetooth: hci7: command tx timeout [ 2638.315617][T28306] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 2638.329734][T28306] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 2638.338996][T28306] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 2638.348415][T28306] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 2638.356316][T28306] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 2638.873421][ T5631] bridge0: port 1(bridge_slave_0) entered blocking state [ 2638.880807][ T5631] bridge0: port 1(bridge_slave_0) entered disabled state [ 2638.888079][ T5631] bridge_slave_0: entered allmulticast mode [ 2638.895548][ T5631] bridge_slave_0: entered promiscuous mode [ 2638.903934][ T5631] bridge0: port 2(bridge_slave_1) entered blocking state [ 2638.911284][ T5631] bridge0: port 2(bridge_slave_1) entered disabled state [ 2638.918788][ T5631] bridge_slave_1: entered allmulticast mode [ 2638.927305][ T5631] bridge_slave_1: entered promiscuous mode [ 2638.958465][ T5631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2638.971191][ T5631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2639.001482][ T5631] team0: Port device team_slave_0 added [ 2639.009353][ T5631] team0: Port device team_slave_1 added [ 2639.044374][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2639.051431][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2639.077881][ T5631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2639.090624][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2639.097649][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2639.124161][ T5631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2639.171955][ T5631] hsr_slave_0: entered promiscuous mode [ 2639.178385][ T5631] hsr_slave_1: entered promiscuous mode [ 2639.186427][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 2639.187242][ T5631] debugfs: 'hsr0' already exists in 'hsr' [ 2639.193404][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 2639.198822][ T5631] Cannot create hsr debugfs directory [ 2640.453049][T32098] Bluetooth: hci8: command tx timeout [ 2642.522136][T32098] Bluetooth: hci8: command tx timeout [ 2643.297203][T28306] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 2643.316279][T28306] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 2643.326451][T28306] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 2643.337656][T28306] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 2643.346930][T28306] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 2643.848760][ T5650] bridge0: port 1(bridge_slave_0) entered blocking state [ 2643.856031][ T5650] bridge0: port 1(bridge_slave_0) entered disabled state [ 2643.863296][ T5650] bridge_slave_0: entered allmulticast mode [ 2643.871631][ T5650] bridge_slave_0: entered promiscuous mode [ 2643.883580][ T5650] bridge0: port 2(bridge_slave_1) entered blocking state [ 2643.891196][ T5650] bridge0: port 2(bridge_slave_1) entered disabled state [ 2643.898883][ T5650] bridge_slave_1: entered allmulticast mode [ 2643.906889][ T5650] bridge_slave_1: entered promiscuous mode [ 2643.945414][ T5650] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2643.958171][ T5650] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2643.989655][ T5650] team0: Port device team_slave_0 added [ 2643.997884][ T5650] team0: Port device team_slave_1 added [ 2644.027250][ T5650] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2644.034408][ T5650] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2644.060662][ T5650] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2644.072755][ T5650] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2644.079885][ T5650] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2644.105882][ T5650] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2644.154307][ T5650] hsr_slave_0: entered promiscuous mode [ 2644.160928][ T5650] hsr_slave_1: entered promiscuous mode [ 2644.167376][ T5650] debugfs: 'hsr0' already exists in 'hsr' [ 2644.173186][ T5650] Cannot create hsr debugfs directory [ 2644.591334][T28306] Bluetooth: hci8: command tx timeout [ 2645.387401][T28306] Bluetooth: hci9: command tx timeout [ 2646.342215][T28306] Bluetooth: hci4: command 0x0406 tx timeout [ 2646.660594][T32098] Bluetooth: hci8: command tx timeout [ 2647.300962][T28306] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 2647.321110][T28306] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 2647.331014][T28306] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 2647.340784][T28306] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 2647.348800][T28306] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 2647.456988][T28306] Bluetooth: hci9: command tx timeout [ 2647.859024][ T5669] bridge0: port 1(bridge_slave_0) entered blocking state [ 2647.866464][ T5669] bridge0: port 1(bridge_slave_0) entered disabled state [ 2647.873787][ T5669] bridge_slave_0: entered allmulticast mode [ 2647.881557][ T5669] bridge_slave_0: entered promiscuous mode [ 2647.891043][ T5669] bridge0: port 2(bridge_slave_1) entered blocking state [ 2647.898477][ T5669] bridge0: port 2(bridge_slave_1) entered disabled state [ 2647.906064][ T5669] bridge_slave_1: entered allmulticast mode [ 2647.914638][ T5669] bridge_slave_1: entered promiscuous mode [ 2647.946305][ T5669] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2647.958473][ T5669] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2647.990407][ T5669] team0: Port device team_slave_0 added [ 2647.998533][ T5669] team0: Port device team_slave_1 added [ 2648.026432][ T5669] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2648.033671][ T5669] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2648.060043][ T5669] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2648.072327][ T5669] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2648.079378][ T5669] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2648.105668][ T5669] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2648.150071][ T5669] hsr_slave_0: entered promiscuous mode [ 2648.156754][ T5669] hsr_slave_1: entered promiscuous mode [ 2648.163368][ T5669] debugfs: 'hsr0' already exists in 'hsr' [ 2648.169130][ T5669] Cannot create hsr debugfs directory [ 2649.446221][T28306] Bluetooth: hci10: command tx timeout [ 2649.526008][T28306] Bluetooth: hci9: command tx timeout [ 2651.515325][T28306] Bluetooth: hci10: command tx timeout [ 2651.595161][T28306] Bluetooth: hci9: command tx timeout [ 2653.584601][T28306] Bluetooth: hci10: command tx timeout [ 2655.653887][T28306] Bluetooth: hci10: command tx timeout [ 2671.818962][T28306] Bluetooth: hci0: command 0x0406 tx timeout [ 2676.849869][T32098] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 2676.864965][T32098] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 2676.874362][T32098] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 2676.884634][T32098] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 2676.892554][T32098] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 2677.412545][ T5693] bridge0: port 1(bridge_slave_0) entered blocking state [ 2677.419784][ T5693] bridge0: port 1(bridge_slave_0) entered disabled state [ 2677.427258][ T5693] bridge_slave_0: entered allmulticast mode [ 2677.434865][ T5693] bridge_slave_0: entered promiscuous mode [ 2677.444686][ T5693] bridge0: port 2(bridge_slave_1) entered blocking state [ 2677.452101][ T5693] bridge0: port 2(bridge_slave_1) entered disabled state [ 2677.459386][ T5693] bridge_slave_1: entered allmulticast mode [ 2677.466971][ T5693] bridge_slave_1: entered promiscuous mode [ 2677.497808][ T5693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2677.510035][ T5693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2677.546122][ T5693] team0: Port device team_slave_0 added [ 2677.554439][ T5693] team0: Port device team_slave_1 added [ 2677.580054][ T5693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2677.587031][ T5693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2677.613420][ T5693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2677.626572][ T5693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2677.633882][ T5693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2677.660258][ T5693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2677.704920][ T5693] hsr_slave_0: entered promiscuous mode [ 2677.711667][ T5693] hsr_slave_1: entered promiscuous mode [ 2677.717886][ T5693] debugfs: 'hsr0' already exists in 'hsr' [ 2677.723711][ T5693] Cannot create hsr debugfs directory [ 2678.972724][T32098] Bluetooth: hci11: command tx timeout [ 2681.041785][T32098] Bluetooth: hci11: command tx timeout [ 2682.000110][T32098] Bluetooth: hci2: command 0x0406 tx timeout [ 2683.110974][T32098] Bluetooth: hci11: command tx timeout [ 2685.180170][T32098] Bluetooth: hci11: command tx timeout [ 2698.378607][T28306] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 2698.395305][T28306] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 2698.407502][T28306] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 2698.420164][T28306] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 2698.428200][T28306] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 2698.947709][ T5713] bridge0: port 1(bridge_slave_0) entered blocking state [ 2698.955617][ T5713] bridge0: port 1(bridge_slave_0) entered disabled state [ 2698.963386][ T5713] bridge_slave_0: entered allmulticast mode [ 2698.970800][ T5713] bridge_slave_0: entered promiscuous mode [ 2698.979961][ T5713] bridge0: port 2(bridge_slave_1) entered blocking state [ 2698.987248][ T5713] bridge0: port 2(bridge_slave_1) entered disabled state [ 2698.995040][ T5713] bridge_slave_1: entered allmulticast mode [ 2699.002434][ T5713] bridge_slave_1: entered promiscuous mode [ 2699.037152][ T5713] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2699.049735][ T5713] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2699.082357][ T5713] team0: Port device team_slave_0 added [ 2699.094172][ T5713] team0: Port device team_slave_1 added [ 2699.125749][ T5713] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2699.132931][ T5713] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2699.160083][ T5713] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2699.173435][ T5713] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2699.180761][ T5713] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2699.207480][ T5713] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2699.254056][ T5713] hsr_slave_0: entered promiscuous mode [ 2699.260812][ T5713] hsr_slave_1: entered promiscuous mode [ 2699.267353][ T5713] debugfs: 'hsr0' already exists in 'hsr' [ 2699.273126][ T5713] Cannot create hsr debugfs directory [ 2700.304460][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 2700.310881][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 2700.460773][T28306] Bluetooth: hci12: command tx timeout [ 2702.377011][T28306] Bluetooth: hci1: command 0x0406 tx timeout [ 2702.530034][T32098] Bluetooth: hci12: command tx timeout [ 2703.375846][T28306] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 2703.392041][T28306] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 2703.400730][T28306] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 2703.414371][T28306] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 2703.422414][T28306] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 2703.923928][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 2703.931169][ T5734] bridge0: port 1(bridge_slave_0) entered disabled state [ 2703.938582][ T5734] bridge_slave_0: entered allmulticast mode [ 2703.946002][ T5734] bridge_slave_0: entered promiscuous mode [ 2703.955271][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 2703.962791][ T5734] bridge0: port 2(bridge_slave_1) entered disabled state [ 2703.970892][ T5734] bridge_slave_1: entered allmulticast mode [ 2703.978668][ T5734] bridge_slave_1: entered promiscuous mode [ 2704.009663][ T5734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2704.023084][ T5734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2704.057063][ T5734] team0: Port device team_slave_0 added [ 2704.065665][ T5734] team0: Port device team_slave_1 added [ 2704.091238][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2704.098386][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2704.128626][ T5734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2704.141512][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2704.148793][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2704.175386][ T5734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2704.220603][ T5734] hsr_slave_0: entered promiscuous mode [ 2704.227853][ T5734] hsr_slave_1: entered promiscuous mode [ 2704.234911][ T5734] debugfs: 'hsr0' already exists in 'hsr' [ 2704.240679][ T5734] Cannot create hsr debugfs directory [ 2704.599276][T28306] Bluetooth: hci12: command tx timeout [ 2705.474917][T28306] Bluetooth: hci13: command tx timeout [ 2706.668371][T28306] Bluetooth: hci12: command tx timeout [ 2707.472480][T28306] Bluetooth: hci5: command 0x0406 tx timeout [ 2707.544006][T32098] Bluetooth: hci13: command tx timeout [ 2707.876642][T28306] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 2707.897116][T28306] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 2707.905881][T28306] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 2707.915944][T28306] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 2707.924398][T28306] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 2708.485942][ T5754] bridge0: port 1(bridge_slave_0) entered blocking state [ 2708.493405][ T5754] bridge0: port 1(bridge_slave_0) entered disabled state [ 2708.501734][ T5754] bridge_slave_0: entered allmulticast mode [ 2708.509747][ T5754] bridge_slave_0: entered promiscuous mode [ 2708.517999][ T5754] bridge0: port 2(bridge_slave_1) entered blocking state [ 2708.525641][ T5754] bridge0: port 2(bridge_slave_1) entered disabled state [ 2708.533898][ T5754] bridge_slave_1: entered allmulticast mode [ 2708.541733][ T5754] bridge_slave_1: entered promiscuous mode [ 2708.572246][ T5754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2708.590055][ T5754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2708.625518][ T5754] team0: Port device team_slave_0 added [ 2708.634052][ T5754] team0: Port device team_slave_1 added [ 2708.661637][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2708.668746][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2708.695153][ T5754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2708.709253][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2708.716244][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2708.742582][ T5754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2708.785630][ T5754] hsr_slave_0: entered promiscuous mode [ 2708.792787][ T5754] hsr_slave_1: entered promiscuous mode [ 2708.799378][ T5754] debugfs: 'hsr0' already exists in 'hsr' [ 2708.805137][ T5754] Cannot create hsr debugfs directory [ 2709.613287][T28306] Bluetooth: hci13: command tx timeout [ 2709.852350][ T31] INFO: task syz-executor:5358 blocked for more than 143 seconds. [ 2709.860263][ T31] Tainted: G L syzkaller #0 [ 2709.867249][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2709.876358][ T31] task:syz-executor state:D stack:23496 pid:5358 tgid:5358 ppid:1 task_flags:0x480140 flags:0x00080003 [ 2709.888547][ T31] Call Trace: [ 2709.892002][ T31] [ 2709.894968][ T31] __schedule+0x1295/0x67a0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2709.899519][ T31] ? __pfx___schedule+0x10/0x10 [ 2709.904592][ T31] ? find_held_lock+0x2b/0x80 [ 2709.909394][ T31] ? schedule+0x2bf/0x390 [ 2709.913975][ T31] schedule+0xdd/0x390 [ 2709.918137][ T31] schedule_timeout+0x1b2/0x280 [ 2709.923142][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2709.928582][ T31] ? mark_held_locks+0x40/0x70 [ 2709.933906][ T31] __wait_for_common+0x2e7/0x4c0 [ 2709.939333][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2709.945093][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 2709.950667][ T31] remove_one+0x312/0x420 [ 2709.955724][ T31] ? find_next_child+0x18f/0x280 [ 2709.960758][ T31] __simple_recursive_removal+0x148/0x5c0 [ 2709.967080][ T31] ? __pfx_remove_one+0x10/0x10 [ 2709.983815][ T31] debugfs_remove+0x5d/0x80 [ 2710.010969][ T31] nsim_dev_health_exit+0x3b/0xe0 [ 2710.011117][T28306] Bluetooth: hci14: command tx timeout [ 2710.016427][ T31] nsim_dev_reload_destroy+0x144/0x4a0 [ 2710.016477][ T31] nsim_drv_remove+0x52/0x1e0 [ 2710.016505][ T31] ? __pfx_nsim_bus_remove+0x10/0x10 [ 2710.016538][ T31] device_remove+0xcb/0x180 [ 2710.016612][ T31] device_release_driver_internal+0x44e/0x620 [ 2710.016645][ T31] bus_remove_device+0x2bc/0x560 [ 2710.016682][ T31] ? __pfx_bus_remove_device+0x10/0x10 [ 2710.016715][ T31] ? __pfx_device_remove_attrs+0x10/0x10 [ 2710.016787][ T31] device_del+0x376/0x9b0 [ 2710.016828][ T31] ? __pfx_device_del+0x10/0x10 [ 2710.016867][ T31] ? __lock_acquire+0x4a5/0x2630 [ 2710.016910][ T31] device_unregister+0x1d/0xe0 [ 2710.016947][ T31] del_device_store+0x346/0x480 [ 2710.016984][ T31] ? __pfx_del_device_store+0x10/0x10 [ 2710.017018][ T31] ? find_held_lock+0x2b/0x80 [ 2710.017047][ T31] ? sysfs_file_kobj+0xe4/0x290 [ 2710.017085][ T31] ? sysfs_file_kobj+0xe4/0x290 [ 2710.017122][ T31] ? __pfx_del_device_store+0x10/0x10 [ 2710.017158][ T31] bus_attr_store+0x74/0xb0 [ 2710.017186][ T31] ? __pfx_bus_attr_store+0x10/0x10 [ 2710.017214][ T31] sysfs_kf_write+0xf2/0x150 [ 2710.017254][ T31] kernfs_fop_write_iter+0x3e0/0x5f0 [ 2710.017287][ T31] ? __pfx_sysfs_kf_write+0x10/0x10 [ 2710.017327][ T31] vfs_write+0x6ac/0x1070 [ 2710.017359][ T31] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 2710.017397][ T31] ? __pfx_vfs_write+0x10/0x10 [ 2710.017428][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 2710.017543][ T31] ksys_write+0x12a/0x250 [ 2710.017573][ T31] ? __pfx_ksys_write+0x10/0x10 [ 2710.017605][ T31] ? rcu_is_watching+0x12/0xc0 [ 2710.017656][ T31] do_syscall_64+0x115/0x840 [ 2710.017693][ T31] ? clear_bhb_loop+0x40/0x90 [ 2710.017738][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2710.017769][ T31] RIP: 0033:0x7f491595d68e [ 2710.195239][ T31] RSP: 002b:00007ffce8b0ab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2710.203806][ T31] RAX: ffffffffffffffda RBX: 0000555584163500 RCX: 00007f491595d68e [ 2710.211863][ T31] RDX: 0000000000000001 RSI: 00007ffce8b0abb0 RDI: 0000000000000005 [ 2710.220095][ T31] RBP: 00007f4915a335f2 R08: 0000000000000000 R09: 0000000000000000 [ 2710.228089][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2710.236204][ T31] R13: 00007ffce8b0abb0 R14: 00007f4916744620 R15: 0000000000000003 [ 2710.244342][ T31] [ 2710.247431][ T31] INFO: task syz.1.5907:5451 blocked for more than 143 seconds. [ 2710.255337][ T31] Tainted: G L syzkaller #0 [ 2710.261941][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2710.270805][ T31] task:syz.1.5907 state:D stack:26952 pid:5451 tgid:5450 ppid:4266 task_flags:0x400140 flags:0x00080002 [ 2710.282932][ T31] Call Trace: [ 2710.286239][ T31] [ 2710.289174][ T31] __schedule+0x1295/0x67a0 [ 2710.293873][ T31] ? __pfx___schedule+0x10/0x10 [ 2710.298901][ T31] ? find_held_lock+0x2b/0x80 [ 2710.303718][ T31] ? schedule+0x2bf/0x390 [ 2710.308117][ T31] schedule+0xdd/0x390 [ 2710.312303][ T31] schedule_preempt_disabled+0x13/0x30 [ 2710.317828][ T31] __mutex_lock+0xced/0x1b10 [ 2710.322502][ T31] ? devlink_health_report+0x66c/0xb20 [ 2710.328086][ T31] ? __pfx_devlink_nl_notify_filter+0x10/0x10 [ 2710.334423][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 2710.339609][ T31] ? devlink_recover_notify.constprop.0+0x443/0x550 [ 2710.346219][ T31] ? devlink_recover_notify.constprop.0+0x1e3/0x550 [ 2710.352956][ T31] ? devlink_health_report+0x66c/0xb20 [ 2710.358458][ T31] devlink_health_report+0x66c/0xb20 [ 2710.363836][ T31] ? __pfx_devlink_health_report+0x10/0x10 [ 2710.369751][ T31] ? _copy_from_user+0x59/0xd0 [ 2710.374621][ T31] nsim_dev_health_break_write+0x166/0x210 [ 2710.380520][ T31] ? __pfx_nsim_dev_health_break_write+0x10/0x10 [ 2710.386917][ T31] full_proxy_write+0x135/0x1a0 [ 2710.391886][ T31] vfs_write+0x2aa/0x1070 [ 2710.396267][ T31] ? __pfx_full_proxy_write+0x10/0x10 [ 2710.401785][ T31] ? __pfx_vfs_write+0x10/0x10 [ 2710.406639][ T31] ? __fget_files+0x215/0x3d0 [ 2710.411460][ T31] ? __fget_files+0x21f/0x3d0 [ 2710.416186][ T31] ksys_write+0x12a/0x250 [ 2710.420611][ T31] ? __pfx_ksys_write+0x10/0x10 [ 2710.425504][ T31] ? rcu_is_watching+0x12/0xc0 [ 2710.430375][ T31] do_syscall_64+0x115/0x840 [ 2710.435055][ T31] ? clear_bhb_loop+0x40/0x90 [ 2710.439892][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2710.445840][ T31] RIP: 0033:0x7f862bf9ce59 [ 2710.450334][ T31] RSP: 002b:00007f862ce71028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2710.458853][ T31] RAX: ffffffffffffffda RBX: 00007f862c215fa0 RCX: 00007f862bf9ce59 [ 2710.466877][ T31] RDX: 00000000000001e1 RSI: 0000200000000080 RDI: 0000000000000005 [ 2710.475337][ T31] RBP: 00007f862c032d6f R08: 0000000000000000 R09: 0000000000000000 [ 2710.483555][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2710.491906][ T31] R13: 00007f862c216038 R14: 00007f862c215fa0 R15: 00007ffe7e1e3a08 [ 2710.500348][ T31] [ 2710.503496][ T31] [ 2710.503496][ T31] Showing all locks held in the system: [ 2710.511936][ T31] 1 lock held by khungtaskd/31: [ 2710.516869][ T31] #0: ffffffff8e7e5360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 2710.527307][ T31] 5 locks held by kworker/u10:0/7694: [ 2710.533102][ T31] 6 locks held by kworker/u10:9/10160: [ 2710.538945][ T31] 2 locks held by getty/14942: [ 2710.543792][ T31] #0: ffff888036f520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 2710.553876][ T31] #1: ffffc9000390d2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 [ 2710.564303][ T31] 3 locks held by kworker/u11:0/32098: [ 2710.569968][ T31] #0: ffff88807be7b940 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 [ 2710.580389][ T31] #1: ffffc90003847d08 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 [ 2710.592670][ T31] #2: ffff888064698ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 [ 2710.602873][ T31] 7 locks held by syz-executor/5358: [ 2710.608215][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.617320][ T31] #1: ffff88805a4a2c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.627671][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.637910][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.649161][ T31] #4: ffff88807bbf5128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 [ 2710.659916][ T31] #5: ffff888025c91258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_drv_remove+0x4a/0x1e0 [ 2710.670059][ T31] #6: ffff88803cd5f160 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0xe0/0x5c0 [ 2710.681913][ T31] 3 locks held by syz.1.5907/5451: [ 2710.687089][ T31] #0: ffff88803120fb30 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 2710.696261][ T31] #1: ffff888020298410 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.705376][ T31] #2: ffff888025c91258 (&devlink->lock_key#7){+.+.}-{4:4}, at: devlink_health_report+0x66c/0xb20 [ 2710.716128][ T31] 2 locks held by syz.0.5919/5513: [ 2710.721290][ T31] #0: ffff888020298410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 [ 2710.730565][ T31] #1: ffff88803cd5f160 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 [ 2710.741154][ T31] 2 locks held by syz.3.5927/5544: [ 2710.746296][ T31] #0: ffff888020298410 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x9b1/0x31a0 [ 2710.755544][ T31] #1: ffff88803cd5f160 (&sb->s_type->i_mutex_key#17){++++}-{4:4}, at: path_openat+0xa16/0x31a0 [ 2710.766155][ T31] 4 locks held by syz-executor/5547: [ 2710.771552][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.780663][ T31] #1: ffff888059008880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.790554][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.800715][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.811446][ T31] 4 locks held by syz-executor/5566: [ 2710.816872][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.825966][ T31] #1: ffff88805bac1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.835914][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.846103][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.856598][ T31] 4 locks held by syz-executor/5585: [ 2710.861906][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.871102][ T31] #1: ffff888034b06080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.880994][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.891223][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.901672][ T31] 4 locks held by syz-executor/5610: [ 2710.907034][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.916179][ T31] #1: ffff88805b93a080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.926096][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.936269][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.946805][ T31] 4 locks held by syz-executor/5631: [ 2710.952133][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2710.961310][ T31] #1: ffff88805ba0dc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2710.971420][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2710.981584][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2710.992006][ T31] 4 locks held by syz-executor/5650: [ 2710.997358][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.006455][ T31] #1: ffff888032a11080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.016380][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.026532][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.036918][ T31] 4 locks held by syz-executor/5669: [ 2711.042242][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.051424][ T31] #1: ffff88802cef3c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.061536][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.071735][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.082147][ T31] 4 locks held by syz-executor/5693: [ 2711.087539][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.096669][ T31] #1: ffff8880321ca080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.106583][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.117009][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.128359][ T31] 4 locks held by syz-executor/5713: [ 2711.133733][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.142823][ T31] #1: ffff88803c003c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.152824][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.163562][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.174379][ T31] 4 locks held by syz-executor/5734: [ 2711.179930][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.189224][ T31] #1: ffff888080945480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.199127][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.209820][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.220338][ T31] 4 locks held by syz-executor/5754: [ 2711.225779][ T31] #0: ffff888036450410 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 2711.234893][ T31] #1: ffff88807c2c1880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 2711.244792][ T31] #2: ffff888029f9ee18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 2711.254969][ T31] #3: ffffffff8fb87a80 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 [ 2711.265476][ T31] [ 2711.267828][ T31] ============================================= [ 2711.267828][ T31] [ 2711.276346][ T31] NMI backtrace for cpu 1 [ 2711.276369][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2711.276407][ T31] Tainted: [L]=SOFTLOCKUP [ 2711.276418][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2711.276435][ T31] Call Trace: [ 2711.276446][ T31] [ 2711.276464][ T31] dump_stack_lvl+0x100/0x190 [ 2711.276516][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 2711.276551][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2711.276583][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 2711.276697][ T31] sys_info+0x141/0x190 [ 2711.276723][ T31] watchdog+0xcb1/0x1030 [ 2711.276775][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2711.276817][ T31] ? __pfx_watchdog+0x10/0x10 [ 2711.276860][ T31] ? __kthread_parkme+0x18c/0x230 [ 2711.276905][ T31] ? kthread+0x13a/0x450 [ 2711.276945][ T31] ? __pfx_watchdog+0x10/0x10 [ 2711.276983][ T31] kthread+0x370/0x450 [ 2711.277025][ T31] ? __pfx_kthread+0x10/0x10 [ 2711.277070][ T31] ret_from_fork+0x72b/0xd50 [ 2711.277106][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2711.277141][ T31] ? __switch_to+0x800/0x1100 [ 2711.277180][ T31] ? __switch_to_asm+0x39/0x70 [ 2711.277216][ T31] ? __pfx_kthread+0x10/0x10 [ 2711.277263][ T31] ret_from_fork_asm+0x1a/0x30 [ 2711.277319][ T31] [ 2711.277333][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2711.414819][ C0] NMI backtrace for cpu 0 [ 2711.414843][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2711.414885][ C0] Tainted: [L]=SOFTLOCKUP [ 2711.414894][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2711.414908][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2711.414945][ C0] Code: b6 95 02 e9 43 44 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 90 24 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 2711.414968][ C0] RSP: 0018:ffffffff8e407e00 EFLAGS: 00000242 [ 2711.414988][ C0] RAX: 000000000100008f RBX: ffffffff8e4955c0 RCX: ffffffff8b870225 [ 2711.415004][ C0] RDX: 0000000000000000 RSI: ffffffff8df1ae8f RDI: ffffffff8c1c4680 [ 2711.415019][ C0] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10170867b5 [ 2711.415033][ C0] R10: ffff8880b8433dab R11: 0000000000000000 R12: 0000000000000000 [ 2711.415054][ C0] R13: fffffbfff1c92ab8 R14: 0000000000000000 R15: ffffffff90d74850 [ 2711.415074][ C0] FS: 0000000000000000(0000) GS:ffff88812438e000(0000) knlGS:0000000000000000 [ 2711.415097][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2711.415113][ C0] CR2: 000055b167fb2a38 CR3: 000000000e596000 CR4: 00000000003526f0 [ 2711.415129][ C0] Call Trace: [ 2711.415137][ C0] [ 2711.415146][ C0] default_idle+0x9/0x10 [ 2711.415166][ C0] default_idle_call+0x6c/0xb0 [ 2711.415186][ C0] do_idle+0x464/0x590 [ 2711.415249][ C0] ? __pfx_do_idle+0x10/0x10 [ 2711.415279][ C0] cpu_startup_entry+0x4f/0x60 [ 2711.415307][ C0] rest_init+0x251/0x260 [ 2711.415329][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 2711.415449][ C0] start_kernel+0x484/0x490 [ 2711.415484][ C0] x86_64_start_reservations+0x24/0x30 [ 2711.415507][ C0] x86_64_start_kernel+0x12b/0x130 [ 2711.415531][ C0] common_startup_64+0x13e/0x148 [ 2711.415566][ C0] [ 2711.602708][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2711.609611][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2711.620399][ T31] Tainted: [L]=SOFTLOCKUP [ 2711.624986][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 2711.635068][ T31] Call Trace: [ 2711.638354][ T31] [ 2711.641379][ T31] dump_stack_lvl+0x100/0x190 [ 2711.646119][ T31] vpanic+0x552/0x970 [ 2711.650108][ T31] ? __pfx_vpanic+0x10/0x10 [ 2711.654613][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 2711.660791][ T31] ? nmi_trigger_cpumask_backtrace+0x182/0x230 [ 2711.666999][ T31] panic+0xd1/0xe0 [ 2711.670765][ T31] ? __pfx_panic+0x10/0x10 [ 2711.675224][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 2711.681417][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 2711.687600][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 2711.693861][ T31] ? watchdog.cold+0x1ec/0x234 [ 2711.698660][ T31] ? watchdog+0xcc1/0x1030 [ 2711.703124][ T31] watchdog.cold+0x1fd/0x234 [ 2711.707837][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 2711.713676][ T31] ? __pfx_watchdog+0x10/0x10 [ 2711.718389][ T31] ? __kthread_parkme+0x18c/0x230 [ 2711.723440][ T31] ? kthread+0x13a/0x450 [ 2711.727708][ T31] ? __pfx_watchdog+0x10/0x10 [ 2711.732500][ T31] kthread+0x370/0x450 [ 2711.736596][ T31] ? __pfx_kthread+0x10/0x10 [ 2711.741218][ T31] ret_from_fork+0x72b/0xd50 [ 2711.745829][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2711.750979][ T31] ? __switch_to+0x800/0x1100 [ 2711.755678][ T31] ? __switch_to_asm+0x39/0x70 [ 2711.760473][ T31] ? __pfx_kthread+0x10/0x10 [ 2711.765111][ T31] ret_from_fork_asm+0x1a/0x30 [ 2711.769918][ T31] [ 2711.773236][ T31] Kernel Offset: disabled [ 2711.777583][ T31] Rebooting in 86400 seconds..