last executing test programs: 4.219933189s ago: executing program 1 (id=394): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000300)={0x2, 0x4e21, @local}, 0x10) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x2, 0x0) recvfrom$inet(r0, &(0x7f0000004bc0)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) shutdown(r0, 0x1) 4.096736361s ago: executing program 1 (id=395): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x68, &(0x7f0000000200)=0xa40, 0x4) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0a000806000000000400aaaaaaaaaa2986dd6de7136600e98401addb0000000000000000000000000000ff0200000000000000000000000000014f19"], 0x65) 3.976154418s ago: executing program 1 (id=401): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000500)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000540)={0x1d, r1, 0x0, {0x0, 0xf0, 0x4}, 0x2}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000580)=0x1, 0x4) sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f1b5e5c208d9a8ebbb4a86ad8fac51f49812c844cc4d2fcaaaa6e54f421d0cb226fda7343f245faa55971d0ab2542e40eb0667d889dff84f1e4eff54e100"/71, 0x47}], 0x1}, 0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000700)=""/71, 0x47}, {0x0}], 0x2) 3.404274883s ago: executing program 1 (id=407): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='autofs\x00', 0x0, &(0x7f0000000100)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0, 0x3f46137792f68265) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0xc0049364, &(0x7f00000001c0)) 3.347119197s ago: executing program 1 (id=412): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000440)={{0xfffe, 0x1, 0x0, 0x25}, 'syz0\x00', 0x43}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x7) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 2.395882788s ago: executing program 1 (id=440): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) 2.38384392s ago: executing program 32 (id=440): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) 2.177013518s ago: executing program 0 (id=447): bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x4, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000004000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e70"], 0x0}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000740)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000040), &(0x7f00000003c0)=0x8) 2.146981546s ago: executing program 0 (id=448): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/split_huge_pages\x00', 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='test_file\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000000), 0x2000000) write(r0, &(0x7f0000000180)='/proc/self/cwd/test_file,0x0,0x10', 0x44) 1.988543607s ago: executing program 0 (id=449): r0 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f00000009c0), &(0x7f0000000a00)='./file0\x00', 0x4c, &(0x7f0000000a40)=ANY=[@ANYRES8=r0, @ANYRES16=r0, @ANYRESOCT], 0x1, 0x3a2, &(0x7f0000000a80)="$eJzs3U1rY+UXAPDTzPRl+v+36UIEFfFhdm5CW7/AFJkBsaDUiYyzEO/YdAy905QkVDKIzkJw6zdwP7h0J4hfoAvdu3PXjctZDBPJW5t0Yiv2JQ7+fhDuSZ5zkufmksvZhHNw59sH21uN0lbWjMKNFIWIKDyJWOpGPVP9Y6Ebz8SwR/Fm8c5vr3/w0d1319bXb26kdGvt9lurKaXFN376/Ivvr//c/N+HPyz+OBv7Sx8f/LH6+/7L+68cPLv9WbWRqo20U2umLN2r1ZrZvbySNquN7VJK7+eVrFFJ1Z1GpT6yvpXXdndbKdvZXJjfrVcajZTttNJ2pZWatdSst1J2P6vupFKplBbmg9OUH29sZGu9eO6EvBuXtSEuQL2+lnV+w7PPrZQfT2RDAMBEnan/Hyyc2v/fLQz1/3Pxl/3/dOj/z8X030sb7v//8ZvwL9fp/2f6v99R+n8AAAAAAAAAAAAAAHgRPGm3i+12uzg4tgd/Eu4/n/D2uGDPXf9jj0nvj4s19Me9uYj8m73yXrl37K2vbUU18qjEchTjaee2MNCLb72zfnM5dS3FwoOvuvXXf4koXxmtX4liLI2vX+nVp8P66BynY364fjU+iZfG16+OrZ+J5e+G6ktRjF8/jVrksdm9vR3Vf7mS0tvvrR+rn+3mAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDfUEoDr0Vv7v1eOeJa7PXn95eOEpZG5+P36g/n6y9HMZ6On8+/PHY+/9V49epkzx0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhqth9tZnlfqlxUMZv5neT4VM73gpKqpXvqjY0vXYjR59rT3OWNQODUnCkevXOuf5JjkZ+12uxvc//rctzp3uZfyLMF0RJyQ0+5/gWf/rP9HxPArV0ZzZiPiLB/RPuksOsFiJyic63d45VIu0yTuRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBZh0O/O0+mJr0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJqXRerid5XmlfoHBpM8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgRfJnAAAA///+Owi8") r1 = openat(0xffffffffffffff9c, 0x0, 0x129042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', 0x143041, 0x84) pwritev2(r2, &(0x7f0000000ec0)=[{&(0x7f0000000f00)="ff", 0xfdef}], 0x1, 0xe7b, 0x0, 0x0) 1.836749454s ago: executing program 0 (id=451): sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./debug\x00', &(0x7f0000000280)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/failslab/cache-filter\x00', 0x1, 0x0) writev(r0, &(0x7f0000000800)=[{&(0x7f0000000840)='F', 0x1}], 0x1) 1.582094416s ago: executing program 2 (id=459): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='8', 0x1) move_mount(0xffffffffffffff9c, 0x0, r0, 0x0, 0x642) io_uring_register$IORING_REGISTER_QUERY(0xffffffffffffffff, 0x23, &(0x7f0000000f40)=[{&(0x7f0000000680)={0x0, 0x0, 0x3}, 0x0, 0x1}], 0x0) 1.553448041s ago: executing program 0 (id=460): setns(0xc9, 0x0) r0 = socket$kcm(0xa, 0x3, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 1.504758058s ago: executing program 2 (id=462): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000000d80)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000001080)=""/4096, 0x54000}], 0x1}, 0x8}], 0x1, 0x40000142, 0x0) 1.479590627s ago: executing program 2 (id=465): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000b00), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000c40)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000c80)) 1.421078834s ago: executing program 2 (id=467): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f00000001c0)={[{@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x8}}, {@quota}]}, 0xff, 0x4ae, &(0x7f0000000440)="$eJzs3M9vFGUfAPDvTH/QvvxoX15eFAStoJH4o6UFlYMHNJp40MRED3isbUFkoYbWBEijxRg8GhLvxqOJf4E3L0Y9GBOvmng0JER7oXiqmZ2Zdmm3pQtt13Y/n2S7z7Mzu8/znXme3Wfm6UwALasv+5NE7IiIXyOiJ8/euUJf/jQ7MzVye2ZqJIm5uTf/TKrr3ZqZGilXLd+3vcgcSSPST5I4mSwtd+LylXPDlcrYxSI/MHn+/YGJy1eeOXt++MzYmbELQydOHD82+PxzQ8+uSZxZXLf2fzh+YN+rb19/feTU9Xd++Dqr1t6D+fLaOO7qdp2A6ujLttpfc1WLlz3eQN03g5016aS9iRWhIW0Rke2ujmr/74m2WNh5PfHKx02tHLCust+mbcsvnp4DtrAkml0DoDnKH/rs+Ld8bNDQ41/h5osRnUV6dmZqZHY+/vZI80RvxzqW3xcRp6b//iJ7RKPnIQAA7kF1bPN0vfFfGnurz/lcx65iDqU3Iv4bEbsj4n8RsSci/h9RXfeBiHgwf/NczyrL71uUXzr+SW/UrfMaycZ/L9SM/WZr4i+eetuK3M5q/B3J6bOVsaPFNjkSHduy/OAKZXz78i+fLbesdvyXPbLyy7FgUYEb7YtO0I0OTw6v1Ua4eTVif3u9+JP5mYCsBeyLiP2NffSuMnH2ya8OZM+ddVa6e/wrWIN5prkvI57I9/90LIq/lKw8PznQFZWxowNlq1jqx5+vvbFc+fcV/xq4eeihPLGw/xetUdPQKpWxixONl3Htt0+XPaZZ6P+Ntf/O5K3qnPVP7+avXRqenLw4GNGZvFbNl22t+vrQwnsvDU92Z/ly/az9Hzlcv//vLt6T7f9sK2WN+GBEPBwRjxR1fzQiDkXE4RXi//6lx95bIf4kkpjf/2ls8P6/GjFa9/tvvv33JrXz9feQaDv33TfLzZiv7vvveExXv2tz1e+/u1htBe9z8wEAAMCmkEbEjkjS/jzdtyPStL8//x/+PfGftDI+MfnU6fEPLozm1wj0RkdanunqqTkfOphMF5+Y54eKc8Xl8mPFeePP27qr+f6R8cpok2OHVrf9zv4fZf/P/NHW7NoB6871WtC6Fvf/tEn1ADbean7/HQvA1nRn/+/K/nQ3qy7AxnL8D62rXv//aFG+3vjfeQLY/Jb2/9/r3LIO2IqM/6F16f/QuvR/aEmNXM4fJ5db1BURjdwWoLxY4N7vKtC16iv8WyVR3vFiPcvqjivnOotXIm1SpG0NNrYtkch6zMYWWv9+PQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJvNPwEAAP//EsbZOQ==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r0, 0x0) 1.414297686s ago: executing program 0 (id=468): ioprio_set$pid(0x3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pipe2(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x60680, 0x0) sendfile(r0, r1, 0x0, 0x2) 1.310363615s ago: executing program 2 (id=470): lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, 0x0, 0x1) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2401, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0xc, 0x1000000, 0x7, 0xe, 0x5, 0x1, 0x8000009654, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0xffff, 0x200cc0, 0x1, 0x5, 0x0, 0xfffffffffffffffc, 0x0, 0x809, 0x0, 0x5, 0x6, 0x9}) 1.13845908s ago: executing program 5 (id=473): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000938000/0x8000)=nil, 0x8000, 0x2, 0x22052, r0, 0x41877000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000100)="dc", 0x1) setsockopt$inet_opts(r1, 0x0, 0xc, &(0x7f00000000c0)="e0", 0xfed7) getsockopt$inet_opts(r1, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f0000000080)=0x2b) 1.105509463s ago: executing program 5 (id=476): r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000300)={'wg1\x00', &(0x7f0000000440)=@ethtool_gstrings={0x1b, 0x6}}) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file2\x00', 0x8, &(0x7f0000000080)={[{@orlov}, {@sb={'sb', 0x3d, 0x1}}]}, 0x4, 0x523, &(0x7f00000018c0)="$eJzs3cFvG1kZAPBvnLhJs+mmC3sABGxZFgqq6iTubrTqhfYCQlUlRMWJQxsSN4pi11Hsiib0kB65V6ISJ+A/4MYBqScO3LjBjUs5IBWoQA0SB6MZT1I3sZNAnbiJfz9pMvPeTP29F/e953mR5wUwtC5ExGZEnImIOxExlecn+RbX2lt63csXDxe2XjxcSKLVuvX3JDuf5kXHv0m9k7/meER8/zsRP0r2xm2sb6zMV6uVtTw93aytTjfWNy4vF/Kc8tzs3MynVz4p962uH9R+/fzbyzd+8NvffOnZHza/+ZO0WJM/PZed66xHP7WrXozJjrzRiLhxFMEGZDT//8PJk7a2z0TEh1n7n4qR7N0EAE6zVmsqWlOdaQDgtEvv/ycjKZTyuYDJKBRKpfYc3vsxUajWG81LU/X79xYjm8M6H8XC3eVqZSafKzwfxSRNz2bHr9Ll19KPK1ci4r2IeDx2NjtfWqhXFwf5wQcAhtg7u8b/f421x/9OxUEVDgA4OuODLgAAcOyM/wAwfIz/ADB8/ofx37cDAeCUcP8PAMPH+A8Aw+fA8f/R8ZQDADgW37t5M91aW+3nX28/qfvyYqWxUqrdXygt1NdWS0v1+lK1UlpotQ56vWq9vjr78U6ysb5xu1a/f695e7k2v1S5XfEsAQAYvPc+ePqndNDfvHo226JjLQdjNZxuhUEXABiYkUEXABgY3+eB4XWIe3zTAHDKdVmity2fIEh6XfDE4q9wUl38vPl/GFZvMv9v7gBOtv9v/v9bfS8HcPyM4TC8Wq3Emv8AMGTM8QM9//6f6/mIkCf9LwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcFJPZlhRK2Vrgm+nPQqkUcS4izkcxubtcrcxExLsR8cex4lianh10oQGAN1T4a5Kv/3Vx6qPJ3WfPJP8ey/YR8eOf3/rZg/lmc202zf/HTn7zSZp/trlWPjOICgAAna7tzcrG73K+77iRf/ni4cL2dpxFfH69vbhoGncr39pnRmM0249HMSIm/pnk6bb088pIH+JvPoqIz23XfzwedESYzOZA2iuf7o6fxj7X9/idv//d8Quv1beQnUv3xex38dnYVTjgQE+vt/vJvO2lTTxvf4W4kO27t//xrId6c2n/lzbXrT39X2Gn/xvZEz/J2vyFnfT+JXn+8e++uyezNdU+9yjiC6Pd4ic78ZPu/W/xo0PW8c9f/PKHvc61fhFxsWv9t1ekrmXd7HSztjrdWN+4vFybX6osVe6Vy3OzczOfXvmkPJ3NUbd//r5bjL9dvfRur/hp/Sd6xB/fv/7xtUPW/5f/ufPDr+wT/xtf7f7+v79P/HRM/Poh489PXOu5fHcaf7FH/Q94/+PSIeM/+8vG4iEvBQCOQWN9Y2W+Wq2sHXCQftY86BoHhz9I7+3fgmJkB7EZ0a8XzCYlIqLrNekn6rejykd1kAws+q/6/YKD7pmAo/aq0Q+6JAAAAAAAAAAAAAAAQC+N9Y2Vse7f1urbwaDrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn13wAAAP//KHnENg==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x8000, 0x1) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020660b, &(0x7f0000000440)={0x44, 0x7d, 0x0, 0x8}) 1.022861981s ago: executing program 5 (id=478): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0x5, &(0x7f0000000b80)=ANY=[@ANYBLOB="18000000001900000000000006000000850000004f000000850000000700000095"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={r0, 0x0, 0xe40, 0xe40, &(0x7f0000000c80)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000cc0)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 967.887946ms ago: executing program 2 (id=479): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001680)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) bind$nfc_llcp(r0, &(0x7f00000001c0)={0x27, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0xff, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f5237c9c58a8f60d4f1700000000000200000000001900", 0x3c}, 0x60) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r2, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x5, 0x0, 0xfc, "d92984bd1ca44c226af5160e961811a07795c559b78411e88509de050000000000f2170e65e3f50327e4220000000000efffffff0002000000ec001900", 0x15}, 0x60) 922.414187ms ago: executing program 5 (id=481): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000200)=[{0x6, 0x22, 0x3, 0x50000}]}) io_setup(0x7, &(0x7f0000000000)=0x0) syz_clone3(&(0x7f0000000080)={0x21800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) io_destroy(r0) 617.708422ms ago: executing program 3 (id=485): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 480.74193ms ago: executing program 3 (id=487): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) write(r0, &(0x7f0000000180)='7', 0x1) sigaltstack(0x0, 0x0) lsetxattr$security_smack_transmute(0x0, &(0x7f0000000200), &(0x7f0000000240), 0x4, 0x2) 412.380717ms ago: executing program 3 (id=488): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sec/ima/policy\x00', 0x1, 0x6e) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./security\x00', 0x43) mount(0x0, &(0x7f00000004c0)='./security\x00', &(0x7f0000000500)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000540)='./security/ima/policy\x00', 0x1, 0x0) 363.547408ms ago: executing program 3 (id=489): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x9) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x3347, 0x5}, 0x30, 0x0) landlock_restrict_self(r2, 0x5) tkill(r1, 0x24) 302.186388ms ago: executing program 3 (id=490): r0 = memfd_create(&(0x7f0000000980)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7\xc6yE\xa8\xd6A\xe8*\xedEd\x14m|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6E&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x00'/717, 0x2) ftruncate(r0, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) writev(r0, &(0x7f0000000640)=[{&(0x7f00000005c0)="d06b02", 0x3}], 0x1) sendfile(r0, r0, 0x0, 0xffff) 173.459536ms ago: executing program 4 (id=493): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1234, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000040), &(0x7f0000000080)=@udp=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1e, 0x11, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000620afcff00000000bfa200000000000007020000fcffffff1851000000000000000000000000000085000000010000001500070000000000bf07000000000000bf61000000000000bf72000000000000b703000000000000850000007c000000bf710000000000008500000056000000b70000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r1], 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xd, 0x0, &(0x7f0000000800)="00000000000000000a00000011", 0x0}, 0x50) 164.458529ms ago: executing program 3 (id=494): mknodat$md(0xffffffffffffff9c, &(0x7f0000000200)='./md0\x00', 0x6180, 0x0) r0 = openat$md_node(0xffffffffffffff9c, &(0x7f0000000240)='./md0\x00', 0x2, 0x0) ioctl$SET_ARRAY_INFO(r0, 0x40480923, &(0x7f0000000280)={0x0, 0x5a, 0x0, 0x0, 0x1, 0x800, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6000}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000300)={0x0, {0x1, 0x0}, 0x0, 0x40408}) ioctl$ADD_NEW_DISK(r0, 0x40140921, &(0x7f0000000340)={0x1, {0x1, 0x1}, 0x1, 0x6}) ioctl$RUN_ARRAY(r0, 0x400c0930, 0x0) 143.593166ms ago: executing program 4 (id=495): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x24, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27"}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0xb, 0x6, 0xff}, 0x3c, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x1d98, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x8000004, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0x40000e, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10080007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x9, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x6, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x6, 0x1000a, 0x4, 0x5, 0xfffffffe, 0x103, 0x8d2, 0x9, 0x5, 0x7fff, 0xffffffff, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x10006, 0x8, 0xffffffff, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x2000000c, 0x2, 0x6d02, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xd, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2eb, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x2, 0x2, 0x5, 0x1, 0x3, 0x14c, 0x60a7, 0x6, 0x96, 0xfffffffb, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x2, 0x226, 0x5, 0x5, 0x1, 0x30b1d68f, 0xa1f, 0xcb, 0x800, 0x1, 0x6c1b, 0x0, 0x3, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xa77e]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f00000002c0)=0x3) 125.082675ms ago: executing program 4 (id=496): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = syz_io_uring_setup(0xf07, &(0x7f0000000300)={0x0, 0x22d85, 0x40000, 0x3, 0x800000c3}, &(0x7f0000000580)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000180)=0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) syz_io_uring_submit(r1, r2, r3, &(0x7f00000001c0)=@IORING_OP_FUTEX_WAKE={0x34, 0x0, 0x0, 0xe, 0x7, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x5}}) io_uring_enter(r0, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 103.272724ms ago: executing program 4 (id=497): r0 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r0, &(0x7f00000006c0)={&(0x7f0000000700)=@rxrpc=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0x9c000000, @ipv4={'\x00', '\xff\xff', @remote}, 0x1df}}, 0x80, 0x0, 0x0, &(0x7f0000000780)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0x40) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f00000007c0)={&(0x7f0000000800)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001000000000000000100100000b"], 0x28}, 0xfc40) r2 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r2, &(0x7f00000008c0)={&(0x7f0000000900)=@rxrpc=@in6={0x21, 0xfffc, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000000980)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0xfc00) 57.676465ms ago: executing program 4 (id=498): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/thread-self/fail-nth\x00', 0x2, 0xc9) write(r0, &(0x7f0000000200)='27', 0x2) r1 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl$DM_DEV_CREATE(r1, 0xc138fd03, &(0x7f00000018c0)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) 55.416381ms ago: executing program 5 (id=499): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) accept4$alg(r0, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0xf03, &(0x7f0000000080)={0x0, 0x8fb5, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 17.357295ms ago: executing program 5 (id=500): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@delchain={0x24, 0x66, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 0s ago: executing program 4 (id=501): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000940)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000980)=0x1, 0x4) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000a00)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="b3", 0x1}], 0x1, &(0x7f0000000b00)=ANY=[], 0xf0}}], 0x1, 0x24004c41) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.83' (ED25519) to the list of known hosts. [ 28.580127][ T4724] cgroup: Unknown subsys name 'net' [ 28.729985][ T4724] cgroup: Unknown subsys name 'cpuset' [ 28.731296][ T4724] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.892769][ T4724] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.907784][ T4749] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.907810][ T4750] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.909344][ T4751] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.909467][ T4751] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.909594][ T4751] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.909753][ T4752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.910056][ T4749] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.910553][ T4752] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.910817][ T4749] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.910969][ T4752] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.911268][ T4752] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.911669][ T4752] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.911834][ T4752] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.911999][ T4752] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.912523][ T4749] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.912691][ T4749] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.913015][ T4749] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.914352][ T4752] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.914802][ T4752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.914972][ T4752] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.916210][ T4745] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.923521][ T4752] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.924128][ T4752] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.924156][ T4745] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 29.924362][ T4745] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.124629][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.124901][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.127394][ T4742] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.128379][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.141697][ T4734] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.143746][ T4744] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.143867][ T4735] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 30.203733][ T4736] infiniband rxe0: set active [ 30.203991][ T4736] infiniband rxe0: added rxe_eth0 [ 30.219325][ T4736] RDS/IB: rxe0: added [ 30.219403][ T4736] smc: adding ib device rxe0 with port count 1 [ 30.219426][ T4736] smc: ib device rxe0 port 1 has no pnetid [ 30.224449][ T24] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.225685][ T1982] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.226830][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.289111][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.342618][ T1101] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.346514][ T1101] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.379821][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.461278][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.494047][ T4744] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.494464][ T4744] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.494580][ T4744] bridge_slave_0: entered allmulticast mode [ 30.495226][ T4744] bridge_slave_0: entered promiscuous mode [ 30.503621][ T4742] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.503663][ T4742] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.503760][ T4742] bridge_slave_0: entered allmulticast mode [ 30.504431][ T4742] bridge_slave_0: entered promiscuous mode [ 30.510613][ T4744] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.510670][ T4744] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.510771][ T4744] bridge_slave_1: entered allmulticast mode [ 30.511213][ T4744] bridge_slave_1: entered promiscuous mode [ 30.518933][ T4744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.523482][ T4744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.526270][ T4742] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.526302][ T4742] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.526367][ T4742] bridge_slave_1: entered allmulticast mode [ 30.526786][ T4742] bridge_slave_1: entered promiscuous mode [ 30.553800][ T4742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.555789][ T4742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.555814][ T4736] rxe_eth0 speed is unknown, defaulting to 1000 [ 30.563111][ T4744] team0: Port device team_slave_0 added [ 30.564493][ T4744] team0: Port device team_slave_1 added [ 30.567793][ T4734] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.567820][ T4734] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.567911][ T4734] bridge_slave_0: entered allmulticast mode [ 30.573033][ T4734] bridge_slave_0: entered promiscuous mode [ 30.575138][ T4734] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.575202][ T4734] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.575262][ T4734] bridge_slave_1: entered allmulticast mode [ 30.575820][ T4734] bridge_slave_1: entered promiscuous mode [ 30.586980][ T4742] team0: Port device team_slave_0 added [ 30.587064][ T4735] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.587091][ T4735] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.587143][ T4735] bridge_slave_0: entered allmulticast mode [ 30.588151][ T4735] bridge_slave_0: entered promiscuous mode [ 30.595479][ T4735] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.595502][ T4735] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.595591][ T4735] bridge_slave_1: entered allmulticast mode [ 30.596203][ T4735] bridge_slave_1: entered promiscuous mode [ 30.605621][ T4744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.605634][ T4744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.605647][ T4744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.614118][ T4734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.614996][ T4734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.622602][ T4742] team0: Port device team_slave_1 added [ 30.630172][ T4744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.630186][ T4744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.630200][ T4744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.631028][ T4734] team0: Port device team_slave_0 added [ 30.642043][ T4734] team0: Port device team_slave_1 added [ 30.649640][ T4734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.649651][ T4734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.649664][ T4734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.653439][ T4735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.654565][ T4735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.654805][ T4742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.654814][ T4742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.654831][ T4742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.655266][ T4734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.655274][ T4734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.655288][ T4734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.683158][ T4735] team0: Port device team_slave_0 added [ 30.683880][ T4735] team0: Port device team_slave_1 added [ 30.690105][ T4742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.690116][ T4742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.690130][ T4742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.702871][ T4742] hsr_slave_0: entered promiscuous mode [ 30.703214][ T4742] hsr_slave_1: entered promiscuous mode [ 30.711068][ T4735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.711079][ T4735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.711092][ T4735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.711767][ T4735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.711775][ T4735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.711787][ T4735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.725231][ T4744] hsr_slave_0: entered promiscuous mode [ 30.725546][ T4744] hsr_slave_1: entered promiscuous mode [ 30.725759][ T4744] debugfs: 'hsr0' already exists in 'hsr' [ 30.725799][ T4744] Cannot create hsr debugfs directory [ 30.737663][ T4735] hsr_slave_0: entered promiscuous mode [ 30.737932][ T4735] hsr_slave_1: entered promiscuous mode [ 30.738095][ T4735] debugfs: 'hsr0' already exists in 'hsr' [ 30.738104][ T4735] Cannot create hsr debugfs directory [ 30.743441][ T4734] hsr_slave_0: entered promiscuous mode [ 30.744291][ T4734] hsr_slave_1: entered promiscuous mode [ 30.744545][ T4734] debugfs: 'hsr0' already exists in 'hsr' [ 30.744556][ T4734] Cannot create hsr debugfs directory [ 30.892916][ T4736] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.892983][ T4736] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.893045][ T4736] bridge_slave_0: entered allmulticast mode [ 30.893515][ T4736] bridge_slave_0: entered promiscuous mode [ 30.899053][ T4736] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.899090][ T4736] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.899147][ T4736] bridge_slave_1: entered allmulticast mode [ 30.899575][ T4736] bridge_slave_1: entered promiscuous mode [ 30.911905][ T4742] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.913883][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.914303][ T4742] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.915684][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.921011][ T4736] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.921933][ T4736] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.928736][ T4736] team0: Port device team_slave_0 added [ 30.928920][ T4742] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.930804][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.934621][ T4736] team0: Port device team_slave_1 added [ 30.934668][ T4742] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.935897][ T4742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.949263][ T4736] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.949275][ T4736] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.949289][ T4736] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.953080][ T4736] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.953092][ T4736] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.953105][ T4736] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.966036][ T4736] hsr_slave_0: entered promiscuous mode [ 30.966325][ T4736] hsr_slave_1: entered promiscuous mode [ 30.966497][ T4736] debugfs: 'hsr0' already exists in 'hsr' [ 30.966507][ T4736] Cannot create hsr debugfs directory [ 30.972576][ T4734] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.975744][ T4734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.976105][ T4734] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.980320][ T4734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.999598][ T4734] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.001043][ T4734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.001386][ T4734] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.002829][ T4734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.028263][ T4734] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.028348][ T4734] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.028690][ T4734] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.028718][ T4734] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.031088][ T4742] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.031113][ T4742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.031198][ T4742] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.031235][ T4742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.041807][ T4735] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.043587][ T4735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.043999][ T4735] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.044951][ T4735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.051917][ T4744] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.054333][ T4744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.054658][ T4744] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.056625][ T4744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.065636][ T4735] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.066787][ T4735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.067110][ T4735] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.068208][ T4735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.076428][ T4744] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.077678][ T4744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.088665][ T4744] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.091501][ T4744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.105420][ T4735] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.105454][ T4735] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.105526][ T4735] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.105554][ T4735] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.121546][ T4736] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.123082][ T4736] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.125438][ T4736] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.126471][ T4736] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.139450][ T4742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.144225][ T4736] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.145275][ T4736] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.145565][ T4736] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.146774][ T4736] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.155963][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.156472][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.157365][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.157798][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.158260][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.163108][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.174548][ T4742] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.184618][ T156] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.184655][ T156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.195128][ T4735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.205615][ T4735] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.207342][ T156] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.207366][ T156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.211913][ T4734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.222960][ T156] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.222995][ T156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.223364][ T156] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.223381][ T156] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.225186][ T4734] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.243785][ T4735] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.243802][ T4735] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.254458][ T4744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.257730][ T4744] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.265312][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.265342][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.266374][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.266394][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.285764][ T4734] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.285781][ T4734] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.309673][ T476] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.309771][ T476] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.310118][ T476] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.310136][ T476] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.360363][ T4736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.381584][ T4736] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.383823][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.383856][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.403917][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.403945][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.506832][ T4735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.532550][ T4742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.563043][ T4734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.584475][ T4744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.590777][ T4742] veth0_vlan: entered promiscuous mode [ 31.594548][ T4742] veth1_vlan: entered promiscuous mode [ 31.617232][ T4734] veth0_vlan: entered promiscuous mode [ 31.625675][ T4744] veth0_vlan: entered promiscuous mode [ 31.627641][ T4744] veth1_vlan: entered promiscuous mode [ 31.641052][ T4744] veth0_macvtap: entered promiscuous mode [ 31.643759][ T4744] veth1_macvtap: entered promiscuous mode [ 31.652746][ T4734] veth1_vlan: entered promiscuous mode [ 31.654233][ T4742] veth0_macvtap: entered promiscuous mode [ 31.655399][ T4742] veth1_macvtap: entered promiscuous mode [ 31.663755][ T4744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.664938][ T4744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.665812][ T4736] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.684826][ T4742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.686424][ T4742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.688227][ T1841] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.729160][ T476] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.729232][ T476] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.733166][ T4735] veth0_vlan: entered promiscuous mode [ 31.744214][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.744238][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.744276][ T4735] veth1_vlan: entered promiscuous mode [ 31.748561][ T40] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.749261][ T40] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.749398][ T40] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.749623][ T40] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.749678][ T40] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.749889][ T4734] veth0_macvtap: entered promiscuous mode [ 31.751102][ T4734] veth1_macvtap: entered promiscuous mode [ 31.755667][ T4734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.757793][ T4734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.764689][ T40] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.764761][ T1841] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.795593][ T1841] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.795607][ T1841] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.808806][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.808818][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.809951][ T4735] veth0_macvtap: entered promiscuous mode [ 31.811098][ T4735] veth1_macvtap: entered promiscuous mode [ 31.814353][ T4735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.815337][ T4735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.819381][ T1841] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.825405][ T1841] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.825419][ T1841] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.830876][ T4736] veth0_vlan: entered promiscuous mode [ 31.833495][ T4736] veth1_vlan: entered promiscuous mode [ 31.850334][ T4736] veth0_macvtap: entered promiscuous mode [ 31.853002][ T4736] veth1_macvtap: entered promiscuous mode [ 31.859762][ T476] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.859840][ T476] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.873787][ T4744] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.874264][ T4736] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.895491][ T4736] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.912128][ T1841] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.912146][ T1841] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.919924][ T476] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.919957][ T476] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.919976][ T476] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.928995][ T4752] Bluetooth: hci2: command tx timeout [ 31.933645][ T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.933660][ T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.961110][ T1841] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.961124][ T1841] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.969714][ T54] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.970378][ T54] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.970400][ T54] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.970417][ T54] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.982154][ T4940] loop2: detected capacity change from 0 to 256 [ 31.984541][ T54] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.984555][ T54] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.009909][ T4752] Bluetooth: hci3: command tx timeout [ 32.010036][ T4752] Bluetooth: hci0: command tx timeout [ 32.010109][ T4752] Bluetooth: hci4: command tx timeout [ 32.010178][ T4752] Bluetooth: hci1: command tx timeout [ 32.032976][ T1841] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.032988][ T1841] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.053227][ T476] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.053243][ T476] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.106108][ T4951] Bluetooth: MGMT ver 1.23 [ 32.260634][ T4970] netlink: 204 bytes leftover after parsing attributes in process `syz.3.16'. [ 32.261326][ T4970] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16'. [ 32.284520][ T4976] loop2: detected capacity change from 0 to 128 [ 32.395598][ T4988] Illegal XDP return value 32768 on prog (id 2) dev syz_tun, expect packet loss! [ 32.405151][ T4990] netlink: 4 bytes leftover after parsing attributes in process `syz.4.26'. [ 32.487888][ T5001] loop0: detected capacity change from 0 to 4096 [ 32.498515][ T5001] EXT4-fs: Ignoring removed mblk_io_submit option [ 32.506051][ T5001] EXT4-fs (loop0): Test dummy encryption mode enabled [ 32.519431][ T5001] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 32.546120][ T5001] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-ce" [ 32.560928][ T5005] nbd2: detected capacity change from 0 to 63 [ 32.565084][ T5005] block nbd2: NBD_DISCONNECT [ 32.565977][ T5005] block nbd2: Disconnected due to user request. [ 32.565990][ T5005] block nbd2: shutting down sockets [ 32.566444][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 32.566484][ T11] Buffer I/O error on dev nbd2, logical block 0, async page read [ 32.570510][ T5001] fscrypt: AES-256-XTS using blk-crypto-fallback [ 32.586383][ T4411] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 32.586413][ T4411] Buffer I/O error on dev nbd2, logical block 1, async page read [ 32.586425][ T4411] Buffer I/O error on dev nbd2, logical block 2, async page read [ 32.586435][ T4411] Buffer I/O error on dev nbd2, logical block 3, async page read [ 32.586854][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.586875][ T11] Buffer I/O error on dev nbd2, logical block 0, async page read [ 32.586887][ T11] Buffer I/O error on dev nbd2, logical block 1, async page read [ 32.586897][ T11] Buffer I/O error on dev nbd2, logical block 2, async page read [ 32.586905][ T11] Buffer I/O error on dev nbd2, logical block 3, async page read [ 32.587028][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.587042][ T11] Buffer I/O error on dev nbd2, logical block 0, async page read [ 32.587052][ T11] Buffer I/O error on dev nbd2, logical block 1, async page read [ 32.587113][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.587178][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.587260][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.590191][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.591146][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.591186][ T4728] ldm_validate_partition_table(): Disk read failed. [ 32.591241][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 32.591436][ T4728] Dev nbd2: unable to read RDB block 0 [ 32.591738][ T4728] nbd2: unable to read partition table [ 32.634988][ T4728] ldm_validate_partition_table(): Disk read failed. [ 32.635202][ T4728] Dev nbd2: unable to read RDB block 0 [ 32.635546][ T4728] nbd2: unable to read partition table [ 32.660356][ T5012] FAULT_INJECTION: forcing a failure. [ 32.660356][ T5012] name failslab, interval 1, probability 0, space 0, times 1 [ 32.660379][ T5012] CPU: 1 UID: 0 PID: 5012 Comm: syz.2.35 Not tainted syzkaller #0 PREEMPT [ 32.660391][ T5012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 32.660398][ T5012] Call trace: [ 32.660401][ T5012] show_stack+0x2c/0x3c (C) [ 32.660418][ T5012] __dump_stack+0x30/0x40 [ 32.660429][ T5012] dump_stack_lvl+0xd8/0x12c [ 32.660438][ T5012] dump_stack+0x1c/0x28 [ 32.660447][ T5012] should_fail_ex+0x418/0x58c [ 32.660460][ T5012] should_failslab+0xc4/0x120 [ 32.660472][ T5012] kmem_cache_alloc_noprof+0x94/0x5d4 [ 32.660484][ T5012] alloc_empty_file+0x6c/0x1cc [ 32.660497][ T5012] alloc_file+0x58/0x98 [ 32.660509][ T5012] alloc_file_pseudo+0xe0/0x198 [ 32.660522][ T5012] sock_alloc_file+0xb4/0x1ac [ 32.660535][ T5012] do_accept+0x1e0/0x438 [ 32.660548][ T5012] __sys_accept4+0x11c/0x1f8 [ 32.660562][ T5012] __arm64_sys_accept+0x88/0xa0 [ 32.660575][ T5012] invoke_syscall+0x98/0x244 [ 32.660586][ T5012] el0_svc_common+0xec/0x23c [ 32.660595][ T5012] do_el0_svc+0x4c/0x5c [ 32.660604][ T5012] el0_svc+0x60/0x1d8 [ 32.660614][ T5012] el0t_64_sync_handler+0x44/0x104 [ 32.660623][ T5012] el0t_64_sync+0x198/0x19c [ 32.681450][ T4734] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 32.765843][ T5023] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 32.765883][ T5023] block device autoloading is deprecated and will be removed. [ 32.785709][ T5025] loop0: detected capacity change from 0 to 256 [ 32.792129][ T5025] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 32.798671][ T5025] FAT-fs (loop0): error, corrupted file size (i_pos 196, 2048) [ 32.798693][ T5025] FAT-fs (loop0): Filesystem has been set read-only [ 32.798973][ T5025] FAT-fs (loop0): error, invalid FAT chain (i_pos 196, last_block 8200) [ 32.965642][ T5034] ip_tables: iptables: counters copy to user failed while replacing table [ 32.984258][ T5037] FAULT_INJECTION: forcing a failure. [ 32.984258][ T5037] name failslab, interval 1, probability 0, space 0, times 0 [ 32.984282][ T5037] CPU: 1 UID: 0 PID: 5037 Comm: syz.1.45 Not tainted syzkaller #0 PREEMPT [ 32.984293][ T5037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 32.984299][ T5037] Call trace: [ 32.984301][ T5037] show_stack+0x2c/0x3c (C) [ 32.984318][ T5037] __dump_stack+0x30/0x40 [ 32.984327][ T5037] dump_stack_lvl+0xd8/0x12c [ 32.984335][ T5037] dump_stack+0x1c/0x28 [ 32.984343][ T5037] should_fail_ex+0x418/0x58c [ 32.984353][ T5037] should_failslab+0xc4/0x120 [ 32.984364][ T5037] kmem_cache_alloc_noprof+0x94/0x5d4 [ 32.984374][ T5037] cred_alloc_blank+0x24/0xb4 [ 32.984383][ T5037] keyctl_session_to_parent+0x50/0x98c [ 32.984396][ T5037] __arm64_sys_keyctl+0x2a8/0x3e8 [ 32.984409][ T5037] invoke_syscall+0x98/0x244 [ 32.984417][ T5037] el0_svc_common+0xec/0x23c [ 32.984426][ T5037] do_el0_svc+0x4c/0x5c [ 32.984433][ T5037] el0_svc+0x60/0x1d8 [ 32.984442][ T5037] el0t_64_sync_handler+0x44/0x104 [ 32.984450][ T5037] el0t_64_sync+0x198/0x19c [ 33.024203][ T5040] capability: warning: `syz.1.46' uses 32-bit capabilities (legacy support in use) [ 33.114611][ T5050] loop1: detected capacity change from 0 to 512 [ 33.123527][ T5050] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 33.123548][ T5050] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 33.123555][ T5050] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 33.128260][ T5050] EXT4-fs (loop1): 1 truncate cleaned up [ 33.131815][ T5050] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.184140][ T4742] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.402994][ T5086] capability: warning: `syz.4.65' uses deprecated v2 capabilities in a way that may be insecure [ 33.602207][ T5107] loop3: detected capacity change from 0 to 256 [ 33.842009][ T5116] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 33.842030][ T5116] device-mapper: ioctl: error adding target to table [ 33.843453][ T5121] netlink: 'syz.2.81': attribute type 14 has an invalid length. [ 33.843465][ T5121] netlink: 4 bytes leftover after parsing attributes in process `syz.2.81'. [ 33.853693][ T5121] netlink: 'syz.2.81': attribute type 14 has an invalid length. [ 33.853708][ T5121] netlink: 4 bytes leftover after parsing attributes in process `syz.2.81'. [ 33.853766][ T5121] Zero length message leads to an empty skb [ 33.878725][ T476] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 33.878761][ T476] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 33.878777][ T476] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 33.878792][ T476] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 33.902516][ T5123] FAULT_INJECTION: forcing a failure. [ 33.902516][ T5123] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 33.902540][ T5123] CPU: 0 UID: 0 PID: 5123 Comm: syz.4.82 Not tainted syzkaller #0 PREEMPT [ 33.902551][ T5123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 33.902557][ T5123] Call trace: [ 33.902560][ T5123] show_stack+0x2c/0x3c (C) [ 33.902576][ T5123] __dump_stack+0x30/0x40 [ 33.902585][ T5123] dump_stack_lvl+0xd8/0x12c [ 33.902593][ T5123] dump_stack+0x1c/0x28 [ 33.902601][ T5123] should_fail_ex+0x418/0x58c [ 33.902612][ T5123] should_fail+0x14/0x24 [ 33.902621][ T5123] should_fail_usercopy+0x20/0x30 [ 33.902631][ T5123] xt_obj_to_user+0x12c/0x33c [ 33.902643][ T5123] xt_target_to_user+0x88/0x1a8 [ 33.902654][ T5123] do_ip6t_get_ctl+0xcf4/0x10f8 [ 33.902663][ T5123] nf_getsockopt+0x94/0xd4 [ 33.902671][ T5123] ipv6_getsockopt+0x220/0x3b4 [ 33.902682][ T5123] udpv6_getsockopt+0x14c/0x388 [ 33.902694][ T5123] sock_common_getsockopt+0xa8/0xc4 [ 33.902706][ T5123] do_sock_getsockopt+0x338/0x720 [ 33.902719][ T5123] __sys_getsockopt+0xfc/0x168 [ 33.902730][ T5123] __arm64_sys_getsockopt+0xc8/0xe4 [ 33.902742][ T5123] invoke_syscall+0x98/0x244 [ 33.902750][ T5123] el0_svc_common+0xec/0x23c [ 33.902759][ T5123] do_el0_svc+0x4c/0x5c [ 33.902767][ T5123] el0_svc+0x60/0x1d8 [ 33.902775][ T5123] el0t_64_sync_handler+0x44/0x104 [ 33.902783][ T5123] el0t_64_sync+0x198/0x19c [ 34.009070][ T50] Bluetooth: hci2: command tx timeout [ 34.088545][ T50] Bluetooth: hci1: command tx timeout [ 34.088575][ T50] Bluetooth: hci4: command tx timeout [ 34.088592][ T50] Bluetooth: hci0: command tx timeout [ 34.088605][ T50] Bluetooth: hci3: command tx timeout [ 34.449791][ T5161] FAULT_INJECTION: forcing a failure. [ 34.449791][ T5161] name failslab, interval 1, probability 0, space 0, times 0 [ 34.449812][ T5161] CPU: 1 UID: 0 PID: 5161 Comm: syz.0.97 Not tainted syzkaller #0 PREEMPT [ 34.449823][ T5161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 34.449829][ T5161] Call trace: [ 34.449831][ T5161] show_stack+0x2c/0x3c (C) [ 34.449847][ T5161] __dump_stack+0x30/0x40 [ 34.449856][ T5161] dump_stack_lvl+0xd8/0x12c [ 34.449864][ T5161] dump_stack+0x1c/0x28 [ 34.449872][ T5161] should_fail_ex+0x418/0x58c [ 34.449883][ T5161] should_failslab+0xc4/0x120 [ 34.449893][ T5161] kmem_cache_alloc_noprof+0x94/0x5d4 [ 34.449903][ T5161] __kernfs_new_node+0xf0/0x7d8 [ 34.449912][ T5161] kernfs_new_node+0xe8/0x130 [ 34.449919][ T5161] __kernfs_create_file+0x60/0x2e0 [ 34.449928][ T5161] sysfs_add_file_mode_ns+0x1e8/0x2a4 [ 34.449938][ T5161] internal_create_group+0x550/0xb30 [ 34.449948][ T5161] internal_create_groups+0x64/0x138 [ 34.449958][ T5161] sysfs_create_groups+0x2c/0x3c [ 34.449968][ T5161] device_add_attrs+0x17c/0x4e4 [ 34.449977][ T5161] device_add+0x420/0x9e0 [ 34.449986][ T5161] netdev_register_kobject+0x184/0x328 [ 34.450000][ T5161] register_netdevice+0xd74/0x14c0 [ 34.450009][ T5161] ip6gre_newlink_common+0x1e0/0x2f0 [ 34.450018][ T5161] ip6gre_newlink+0x1f8/0x2fc [ 34.450031][ T5161] rtnl_newlink_create+0x294/0x6b8 [ 34.450042][ T5161] rtnl_newlink+0xfe4/0x138c [ 34.450051][ T5161] rtnetlink_rcv_msg+0x66c/0x9bc [ 34.450061][ T5161] netlink_rcv_skb+0x238/0x414 [ 34.450073][ T5161] rtnetlink_rcv+0x28/0x38 [ 34.450083][ T5161] netlink_unicast+0x600/0x7f8 [ 34.450093][ T5161] netlink_sendmsg+0x648/0x948 [ 34.450105][ T5161] __sock_sendmsg+0xc8/0x17c [ 34.450116][ T5161] ____sys_sendmsg+0x3d0/0x6c8 [ 34.450127][ T5161] ___sys_sendmsg+0x198/0x224 [ 34.450138][ T5161] __sys_sendmsg+0x158/0x204 [ 34.450150][ T5161] __arm64_sys_sendmsg+0x88/0x9c [ 34.450161][ T5161] invoke_syscall+0x98/0x244 [ 34.450170][ T5161] el0_svc_common+0xec/0x23c [ 34.450178][ T5161] do_el0_svc+0x4c/0x5c [ 34.450186][ T5161] el0_svc+0x60/0x1d8 [ 34.450195][ T5161] el0t_64_sync_handler+0x44/0x104 [ 34.450203][ T5161] el0t_64_sync+0x198/0x19c [ 34.774263][ T5208] FAULT_INJECTION: forcing a failure. [ 34.774263][ T5208] name failslab, interval 1, probability 0, space 0, times 0 [ 34.774289][ T5208] CPU: 0 UID: 0 PID: 5208 Comm: syz.1.109 Not tainted syzkaller #0 PREEMPT [ 34.774301][ T5208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 34.774307][ T5208] Call trace: [ 34.774310][ T5208] show_stack+0x2c/0x3c (C) [ 34.774326][ T5208] __dump_stack+0x30/0x40 [ 34.774335][ T5208] dump_stack_lvl+0xd8/0x12c [ 34.774344][ T5208] dump_stack+0x1c/0x28 [ 34.774352][ T5208] should_fail_ex+0x418/0x58c [ 34.774365][ T5208] should_failslab+0xc4/0x120 [ 34.774375][ T5208] __kmalloc_cache_node_noprof+0x98/0x618 [ 34.774389][ T5208] blkg_alloc+0xd8/0x6cc [ 34.774399][ T5208] blkg_conf_prep+0x530/0x934 [ 34.774408][ T5208] tg_set_conf+0x1e4/0x46c [ 34.774419][ T5208] tg_set_conf_uint+0x38/0x4c [ 34.774429][ T5208] cgroup_file_write+0x23c/0x6e4 [ 34.774440][ T5208] kernfs_fop_write_iter+0x260/0x3b8 [ 34.774450][ T5208] vfs_write+0x51c/0xa0c [ 34.774460][ T5208] ksys_write+0x12c/0x228 [ 34.774470][ T5208] __arm64_sys_write+0x84/0x98 [ 34.774479][ T5208] invoke_syscall+0x98/0x244 [ 34.774488][ T5208] el0_svc_common+0xec/0x23c [ 34.774496][ T5208] do_el0_svc+0x4c/0x5c [ 34.774505][ T5208] el0_svc+0x60/0x1d8 [ 34.774514][ T5208] el0t_64_sync_handler+0x44/0x104 [ 34.774522][ T5208] el0t_64_sync+0x198/0x19c [ 34.889972][ T5215] loop3: detected capacity change from 0 to 32768 [ 34.921828][ T5215] loop3: p1 p3 < > [ 34.949759][ T5229] FAULT_INJECTION: forcing a failure. [ 34.949759][ T5229] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 34.949785][ T5229] CPU: 1 UID: 0 PID: 5229 Comm: syz.1.113 Not tainted syzkaller #0 PREEMPT [ 34.949796][ T5229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 34.949802][ T5229] Call trace: [ 34.949805][ T5229] show_stack+0x2c/0x3c (C) [ 34.949821][ T5229] __dump_stack+0x30/0x40 [ 34.949831][ T5229] dump_stack_lvl+0xd8/0x12c [ 34.949840][ T5229] dump_stack+0x1c/0x28 [ 34.949848][ T5229] should_fail_ex+0x418/0x58c [ 34.949862][ T5229] should_fail_alloc_page+0xec/0x10c [ 34.949875][ T5229] prepare_alloc_pages+0x194/0x484 [ 34.949886][ T5229] __alloc_frozen_pages_noprof+0x180/0x578 [ 34.949897][ T5229] __alloc_pages_noprof+0x18/0x100 [ 34.949907][ T5229] alloc_pages_bulk_noprof+0x610/0x7d8 [ 34.949917][ T5229] __kasan_populate_vmalloc+0xc0/0x1d0 [ 34.949925][ T5229] alloc_vmap_area+0xcd8/0x12ec [ 34.949938][ T5229] __get_vm_area_node+0x210/0x32c [ 34.949949][ T5229] __vmalloc_node_range_noprof+0x2a0/0xe9c [ 34.949961][ T5229] xskq_create+0x178/0x278 [ 34.949973][ T5229] xsk_init_queue+0x9c/0xf8 [ 34.949983][ T5229] xsk_setsockopt+0x49c/0x6c4 [ 34.949993][ T5229] do_sock_setsockopt+0x1f0/0x330 [ 34.950006][ T5229] __sys_setsockopt+0x104/0x170 [ 34.950018][ T5229] __arm64_sys_setsockopt+0xc8/0xe4 [ 34.950029][ T5229] invoke_syscall+0x98/0x244 [ 34.950038][ T5229] el0_svc_common+0xec/0x23c [ 34.950047][ T5229] do_el0_svc+0x4c/0x5c [ 34.950055][ T5229] el0_svc+0x60/0x1d8 [ 34.950063][ T5229] el0t_64_sync_handler+0x44/0x104 [ 34.950071][ T5229] el0t_64_sync+0x198/0x19c [ 34.950132][ T5229] syz.1.113: vmalloc error: size 4096, align 0x1000, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 [ 34.950180][ T5229] CPU: 1 UID: 0 PID: 5229 Comm: syz.1.113 Not tainted syzkaller #0 PREEMPT [ 34.950188][ T5229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 34.950193][ T5229] Call trace: [ 34.950195][ T5229] show_stack+0x2c/0x3c (C) [ 34.950204][ T5229] __dump_stack+0x30/0x40 [ 34.950212][ T5229] dump_stack_lvl+0xd8/0x12c [ 34.950230][ T5229] dump_stack+0x1c/0x28 [ 34.950238][ T5229] warn_alloc+0x1c4/0x1d8 [ 34.950248][ T5229] __vmalloc_node_range_noprof+0x2c4/0xe9c [ 34.950261][ T5229] xskq_create+0x178/0x278 [ 34.950271][ T5229] xsk_init_queue+0x9c/0xf8 [ 34.950281][ T5229] xsk_setsockopt+0x49c/0x6c4 [ 34.950290][ T5229] do_sock_setsockopt+0x1f0/0x330 [ 34.950305][ T5229] __sys_setsockopt+0x104/0x170 [ 34.950317][ T5229] __arm64_sys_setsockopt+0xc8/0xe4 [ 34.950328][ T5229] invoke_syscall+0x98/0x244 [ 34.950337][ T5229] el0_svc_common+0xec/0x23c [ 34.950345][ T5229] do_el0_svc+0x4c/0x5c [ 34.950353][ T5229] el0_svc+0x60/0x1d8 [ 34.950361][ T5229] el0t_64_sync_handler+0x44/0x104 [ 34.950369][ T5229] el0t_64_sync+0x198/0x19c [ 34.950919][ T5229] Mem-Info: [ 34.950929][ T5229] active_anon:25 inactive_anon:20297 isolated_anon:0 [ 34.950929][ T5229] active_file:2272 inactive_file:14546 isolated_file:0 [ 34.950929][ T5229] unevictable:768 dirty:1730 writeback:0 [ 34.950929][ T5229] slab_reclaimable:9129 slab_unreclaimable:89652 [ 34.950929][ T5229] mapped:28976 shmem:16147 pagetables:981 [ 34.950929][ T5229] sec_pagetables:0 bounce:0 [ 34.950929][ T5229] kernel_misc_reclaimable:0 [ 34.950929][ T5229] free:1461231 free_pcp:10425 free_cma:7616 [ 34.950956][ T5229] Node 0 active_anon:100kB inactive_anon:81188kB active_file:9088kB inactive_file:58184kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:115904kB dirty:6920kB writeback:0kB shmem:64588kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8864kB pagetables:3924kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 34.950979][ T5229] Node 0 DMA free:3077888kB boost:0kB min:20404kB low:25504kB high:30604kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:3145728kB managed:3080192kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:30464kB [ 34.951004][ T5229] lowmem_reserve[]: 0 0 3636 3636 3636 [ 34.951023][ T5229] Node 0 Normal free:2767036kB boost:0kB min:24648kB low:30808kB high:36968kB reserved_highatomic:0kB free_highatomic:0kB active_anon:100kB inactive_anon:81188kB active_file:9088kB inactive_file:58184kB unevictable:3072kB writepending:6920kB zspages:0kB present:5242880kB managed:3724172kB mlocked:0kB bounce:0kB free_pcp:41636kB local_pcp:8728kB free_cma:0kB [ 34.951047][ T5229] lowmem_reserve[]: 0 0 0 0 0 [ 34.951065][ T5229] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB (C) 1*1024kB (C) 0*2048kB 751*4096kB (MC) = 3077888kB [ 34.951130][ T5229] Node 0 Normal: 1*4kB (M) 2*8kB (ME) 2*16kB (ME) 0*32kB 2*64kB (UM) 4*128kB (UME) 6*256kB (UME) 2*512kB (UE) 1*1024kB (U) 1*2048kB (E) 674*4096kB (M) = 2767028kB [ 34.951208][ T5229] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 34.951215][ T5229] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=32768kB [ 34.951230][ T5229] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 34.951236][ T5229] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=64kB [ 34.951243][ T5229] 32986 total pagecache pages [ 34.951247][ T5229] 0 pages in swap cache [ 34.951251][ T5229] Free swap = 124996kB [ 34.951255][ T5229] Total swap = 124996kB [ 34.951259][ T5229] 2097152 pages RAM [ 34.951262][ T5229] 0 pages HighMem/MovableOnly [ 34.951265][ T5229] 396061 pages reserved [ 34.951269][ T5229] 8192 pages cma reserved [ 34.951273][ T5229] 0 pages hwpoisoned [ 35.012611][ T5231] loop3: detected capacity change from 0 to 8192 [ 35.020259][ T5231] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 35.088172][ T30] audit: type=1326 audit(35.060:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5232 comm="syz.1.116" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff8b37a228 code=0x0 [ 35.115341][ T4761] udevd[4761]: inotify_add_watch(7, /dev/loop3p3, 10) failed: No such file or directory [ 35.115725][ T4728] udevd[4728]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 35.140222][ T5237] block2mtd: too many arguments [ 35.275276][ T5248] ======================================================= [ 35.275276][ T5248] WARNING: The mand mount option has been deprecated and [ 35.275276][ T5248] and is ignored by this kernel. Remove the mand [ 35.275276][ T5248] option from the mount to silence this warning. [ 35.275276][ T5248] ======================================================= [ 35.300522][ T5250] FAULT_INJECTION: forcing a failure. [ 35.300522][ T5250] name failslab, interval 1, probability 0, space 0, times 0 [ 35.300547][ T5250] CPU: 1 UID: 0 PID: 5250 Comm: syz.3.123 Not tainted syzkaller #0 PREEMPT [ 35.300559][ T5250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.300565][ T5250] Call trace: [ 35.300568][ T5250] show_stack+0x2c/0x3c (C) [ 35.300585][ T5250] __dump_stack+0x30/0x40 [ 35.300594][ T5250] dump_stack_lvl+0xd8/0x12c [ 35.300603][ T5250] dump_stack+0x1c/0x28 [ 35.300611][ T5250] should_fail_ex+0x418/0x58c [ 35.300623][ T5250] should_failslab+0xc4/0x120 [ 35.300633][ T5250] __kmalloc_noprof+0x108/0x6c8 [ 35.300644][ T5250] n_hdlc_alloc_buf+0x48/0xe4 [ 35.300654][ T5250] n_hdlc_tty_open+0x200/0x418 [ 35.300663][ T5250] tty_ldisc_open+0x9c/0x144 [ 35.300674][ T5250] tty_set_ldisc+0x250/0x3ec [ 35.300685][ T5250] tiocsetd+0xe4/0x120 [ 35.300693][ T5250] tty_ioctl+0xab8/0xcb8 [ 35.300701][ T5250] __arm64_sys_ioctl+0x154/0x1cc [ 35.300711][ T5250] invoke_syscall+0x98/0x244 [ 35.300720][ T5250] el0_svc_common+0xec/0x23c [ 35.300728][ T5250] do_el0_svc+0x4c/0x5c [ 35.300737][ T5250] el0_svc+0x60/0x1d8 [ 35.300746][ T5250] el0t_64_sync_handler+0x44/0x104 [ 35.300754][ T5250] el0t_64_sync+0x198/0x19c [ 35.325298][ T5252] FAULT_INJECTION: forcing a failure. [ 35.325298][ T5252] name failslab, interval 1, probability 0, space 0, times 0 [ 35.325316][ T5252] CPU: 0 UID: 0 PID: 5252 Comm: syz.4.124 Not tainted syzkaller #0 PREEMPT [ 35.325326][ T5252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.325332][ T5252] Call trace: [ 35.325334][ T5252] show_stack+0x2c/0x3c (C) [ 35.325350][ T5252] __dump_stack+0x30/0x40 [ 35.325359][ T5252] dump_stack_lvl+0xd8/0x12c [ 35.325367][ T5252] dump_stack+0x1c/0x28 [ 35.325374][ T5252] should_fail_ex+0x418/0x58c [ 35.325386][ T5252] should_failslab+0xc4/0x120 [ 35.325397][ T5252] kmem_cache_alloc_noprof+0x94/0x5d4 [ 35.325408][ T5252] prepare_creds+0x34/0x7d0 [ 35.325417][ T5252] cap_task_prctl+0x48c/0x8a8 [ 35.325428][ T5252] security_task_prctl+0xe8/0x17c [ 35.325437][ T5252] __arm64_sys_prctl+0x13c/0x13d0 [ 35.325446][ T5252] invoke_syscall+0x98/0x244 [ 35.325455][ T5252] el0_svc_common+0xec/0x23c [ 35.325463][ T5252] do_el0_svc+0x4c/0x5c [ 35.325471][ T5252] el0_svc+0x60/0x1d8 [ 35.325480][ T5252] el0t_64_sync_handler+0x44/0x104 [ 35.325488][ T5252] el0t_64_sync+0x198/0x19c [ 35.389005][ T5260] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 35.421394][ T5264] FAULT_INJECTION: forcing a failure. [ 35.421394][ T5264] name failslab, interval 1, probability 0, space 0, times 0 [ 35.421414][ T5264] CPU: 1 UID: 0 PID: 5264 Comm: syz.4.130 Not tainted syzkaller #0 PREEMPT [ 35.421425][ T5264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.421430][ T5264] Call trace: [ 35.421433][ T5264] show_stack+0x2c/0x3c (C) [ 35.421448][ T5264] __dump_stack+0x30/0x40 [ 35.421457][ T5264] dump_stack_lvl+0xd8/0x12c [ 35.421465][ T5264] dump_stack+0x1c/0x28 [ 35.421473][ T5264] should_fail_ex+0x418/0x58c [ 35.421484][ T5264] should_failslab+0xc4/0x120 [ 35.421494][ T5264] __kmalloc_flags_noprof+0x140/0x724 [ 35.421505][ T5264] alloc_slab_obj_exts+0x70/0x1bc [ 35.421514][ T5264] __memcg_slab_post_alloc_hook+0x408/0x824 [ 35.421524][ T5264] __kmalloc_cache_noprof+0x348/0x5fc [ 35.421534][ T5264] alloc_fs_context+0x7c/0xba4 [ 35.421546][ T5264] fs_context_for_mount+0x34/0x44 [ 35.421557][ T5264] __arm64_sys_fsopen+0xe8/0x1a4 [ 35.421568][ T5264] invoke_syscall+0x98/0x244 [ 35.421577][ T5264] el0_svc_common+0xec/0x23c [ 35.421585][ T5264] do_el0_svc+0x4c/0x5c [ 35.421593][ T5264] el0_svc+0x60/0x1d8 [ 35.421602][ T5264] el0t_64_sync_handler+0x44/0x104 [ 35.421610][ T5264] el0t_64_sync+0x198/0x19c [ 35.472692][ T5270] netlink: 4 bytes leftover after parsing attributes in process `syz.4.132'. [ 35.475991][ T5268] input: syz0 as /devices/virtual/input/input2 [ 35.665408][ T40] Bluetooth: hci5: Frame reassembly failed (-84) [ 35.841574][ T5293] FAULT_INJECTION: forcing a failure. [ 35.841574][ T5293] name failslab, interval 1, probability 0, space 0, times 0 [ 35.841598][ T5293] CPU: 0 UID: 0 PID: 5293 Comm: syz.3.143 Not tainted syzkaller #0 PREEMPT [ 35.841609][ T5293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.841615][ T5293] Call trace: [ 35.841618][ T5293] show_stack+0x2c/0x3c (C) [ 35.841634][ T5293] __dump_stack+0x30/0x40 [ 35.841643][ T5293] dump_stack_lvl+0xd8/0x12c [ 35.841651][ T5293] dump_stack+0x1c/0x28 [ 35.841659][ T5293] should_fail_ex+0x418/0x58c [ 35.841670][ T5293] should_failslab+0xc4/0x120 [ 35.841680][ T5293] kmem_cache_alloc_noprof+0x94/0x5d4 [ 35.841690][ T5293] mas_alloc_nodes+0x234/0x2d8 [ 35.841702][ T5293] mas_preallocate+0x43c/0x6e8 [ 35.841712][ T5293] __split_vma+0x298/0x83c [ 35.841720][ T5293] vms_gather_munmap_vmas+0x3d0/0x101c [ 35.841728][ T5293] do_vmi_align_munmap+0x218/0x364 [ 35.841736][ T5293] do_vmi_munmap+0x1d0/0x254 [ 35.841744][ T5293] move_vma+0xd10/0x1310 [ 35.841752][ T5293] mremap_to+0x338/0x3d8 [ 35.841759][ T5293] __arm64_sys_mremap+0x97c/0xde0 [ 35.841767][ T5293] invoke_syscall+0x98/0x244 [ 35.841776][ T5293] el0_svc_common+0xec/0x23c [ 35.841784][ T5293] do_el0_svc+0x4c/0x5c [ 35.841792][ T5293] el0_svc+0x60/0x1d8 [ 35.841799][ T5293] el0t_64_sync_handler+0x44/0x104 [ 35.841807][ T5293] el0t_64_sync+0x198/0x19c [ 35.866365][ T5296] FAULT_INJECTION: forcing a failure. [ 35.866365][ T5296] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 35.866383][ T5296] CPU: 0 UID: 0 PID: 5296 Comm: syz.4.145 Not tainted syzkaller #0 PREEMPT [ 35.866393][ T5296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.866398][ T5296] Call trace: [ 35.866401][ T5296] show_stack+0x2c/0x3c (C) [ 35.866416][ T5296] __dump_stack+0x30/0x40 [ 35.866425][ T5296] dump_stack_lvl+0xd8/0x12c [ 35.866433][ T5296] dump_stack+0x1c/0x28 [ 35.866441][ T5296] should_fail_ex+0x418/0x58c [ 35.866452][ T5296] should_fail+0x14/0x24 [ 35.866461][ T5296] should_fail_usercopy+0x20/0x30 [ 35.866471][ T5296] _inline_copy_from_user+0x3c/0x188 [ 35.866482][ T5296] core_sys_select+0x578/0x9e4 [ 35.866491][ T5296] __arm64_sys_pselect6+0x2f0/0x39c [ 35.866501][ T5296] invoke_syscall+0x98/0x244 [ 35.866511][ T5296] el0_svc_common+0xec/0x23c [ 35.866519][ T5296] do_el0_svc+0x4c/0x5c [ 35.866526][ T5296] el0_svc+0x60/0x1d8 [ 35.866535][ T5296] el0t_64_sync_handler+0x44/0x104 [ 35.866543][ T5296] el0t_64_sync+0x198/0x19c [ 35.971541][ T5307] FAULT_INJECTION: forcing a failure. [ 35.971541][ T5307] name failslab, interval 1, probability 0, space 0, times 0 [ 35.971561][ T5307] CPU: 1 UID: 0 PID: 5307 Comm: syz.4.150 Not tainted syzkaller #0 PREEMPT [ 35.971574][ T5307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 35.971580][ T5307] Call trace: [ 35.971583][ T5307] show_stack+0x2c/0x3c (C) [ 35.971601][ T5307] __dump_stack+0x30/0x40 [ 35.971613][ T5307] dump_stack_lvl+0xd8/0x12c [ 35.971622][ T5307] dump_stack+0x1c/0x28 [ 35.971630][ T5307] should_fail_ex+0x418/0x58c [ 35.971640][ T5307] should_failslab+0xc4/0x120 [ 35.971650][ T5307] __kmalloc_flags_noprof+0x140/0x724 [ 35.971661][ T5307] alloc_slab_obj_exts+0x70/0x1bc [ 35.971671][ T5307] __memcg_slab_post_alloc_hook+0x408/0x824 [ 35.971680][ T5307] __kvmalloc_node_noprof+0x4f8/0x7fc [ 35.971691][ T5307] alloc_netdev_mqs+0x6fc/0xf34 [ 35.971701][ T5307] ip6_tnl_locate+0x458/0x5b0 [ 35.971714][ T5307] ip6_tnl_siocdevprivate+0x4ac/0x68c [ 35.971726][ T5307] dev_ifsioc+0x654/0xc34 [ 35.971734][ T5307] dev_ioctl+0x560/0xc88 [ 35.971742][ T5307] sock_ioctl+0x734/0x7ec [ 35.971754][ T5307] __arm64_sys_ioctl+0x154/0x1cc [ 35.971764][ T5307] invoke_syscall+0x98/0x244 [ 35.971773][ T5307] el0_svc_common+0xec/0x23c [ 35.971781][ T5307] do_el0_svc+0x4c/0x5c [ 35.971789][ T5307] el0_svc+0x60/0x1d8 [ 35.971797][ T5307] el0t_64_sync_handler+0x44/0x104 [ 35.971805][ T5307] el0t_64_sync+0x198/0x19c [ 36.098853][ T4752] Bluetooth: hci2: command tx timeout [ 36.129874][ T5333] netlink: 'syz.4.161': attribute type 10 has an invalid length. [ 36.133300][ T5333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 36.134153][ T5333] team0: Port device netdevsim1 added [ 36.145846][ T5333] netlink: 'syz.4.161': attribute type 10 has an invalid length. [ 36.152553][ T5333] team0: Port device netdevsim1 removed [ 36.154505][ T5333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 36.155769][ T5333] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 36.168671][ T50] Bluetooth: hci3: command tx timeout [ 36.168698][ T50] Bluetooth: hci4: command tx timeout [ 36.168738][ T4746] Bluetooth: hci0: command tx timeout [ 36.168743][ T4752] Bluetooth: hci1: command tx timeout [ 36.270103][ T5354] netlink: 'syz.1.171': attribute type 6 has an invalid length. [ 36.290065][ T5357] overlayfs: failed to clone upperpath [ 36.313142][ T5361] overlayfs: failed to clone upperpath [ 36.334679][ T5364] netlink: 48 bytes leftover after parsing attributes in process `syz.1.178'. [ 36.356124][ T5368] loop1: detected capacity change from 0 to 512 [ 36.365531][ T5368] EXT4-fs: The data=journal mount option is deprecated and support will be removed in January 2028 [ 36.379328][ T5368] EXT4-fs (loop1): 1 orphan inode deleted [ 36.379798][ T5368] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 36.405270][ T4742] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.480704][ T5381] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.481356][ T5381] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.532614][ T5381] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 36.534544][ T5381] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 36.788957][ T54] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.789096][ T40] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.789119][ T40] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 36.789134][ T40] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 37.055701][ T5435] netlink: 12 bytes leftover after parsing attributes in process `syz.4.203'. [ 37.075397][ T5439] warning: `syz.4.205' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 37.133989][ T5447] loop1: detected capacity change from 0 to 512 [ 37.149289][ T5451] loop2: detected capacity change from 0 to 1024 [ 37.171412][ T5451] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 37.189268][ T5456] EXT4-fs error (device loop2): ext4_validate_block_bitmap:445: comm syz.2.211: bg 0: block 112: padding at end of block bitmap is not set [ 37.212598][ T4744] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 37.502132][ T54] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 37.506626][ T5489] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 37.689276][ T4752] Bluetooth: hci5: command 0x1003 tx timeout [ 37.689324][ T4748] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 37.745090][ T30] audit: type=1326 audit(37.720:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5499 comm="syz.3.232" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbad7a228 code=0x0 [ 37.759849][ T5502] ip_tables: iptables: counters copy to user failed while replacing table [ 37.800460][ T5506] ip_tables: iptables: counters copy to user failed while replacing table [ 37.937014][ T30] audit: type=1326 audit(37.910:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84d7a228 code=0x7ffc0000 [ 37.937121][ T30] audit: type=1326 audit(37.910:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84d7a228 code=0x7ffc0000 [ 37.937489][ T30] audit: type=1326 audit(37.910:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84d7a228 code=0x7ffc0000 [ 37.940222][ T30] audit: type=1326 audit(37.910:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84d7a228 code=0x7ffc0000 [ 37.940248][ T30] audit: type=1326 audit(37.910:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=279 compat=0 ip=0xffff84d7a228 code=0x7ffc0000 [ 37.940266][ T30] audit: type=1326 audit(37.910:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=222 compat=0 ip=0xffff84d79f20 code=0x7ffc0000 [ 37.940334][ T30] audit: type=1326 audit(37.910:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=64 compat=0 ip=0xffff84d5d0ec code=0x7ffc0000 [ 37.941156][ T30] audit: type=1326 audit(37.920:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5508 comm="syz.0.236" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffff84d79fcc code=0x7ffc0000 [ 37.941702][ T5509] loop0: detected capacity change from 0 to 512 [ 38.167095][ T5524] loop1: detected capacity change from 0 to 128 [ 38.169416][ T4748] Bluetooth: hci2: command tx timeout [ 38.175227][ T5524] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 38.189373][ T5524] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 38.249065][ T4752] Bluetooth: hci3: command tx timeout [ 38.249093][ T4752] Bluetooth: hci1: command tx timeout [ 38.249108][ T4752] Bluetooth: hci4: command tx timeout [ 38.249171][ T4748] Bluetooth: hci0: command tx timeout [ 38.250946][ T5533] loop2: detected capacity change from 0 to 128 [ 38.258249][ T5535] loop0: detected capacity change from 0 to 128 [ 38.278876][ T5533] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a84ec018, mo2=0002] [ 38.278922][ T5533] System zones: 1-3, 19-19, 35-36 [ 38.279523][ T5533] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 38.283014][ T5535] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 38.306114][ T5533] EXT4-fs warning (device loop2): verify_group_input:137: Cannot add at group 1986330625 (only 1 groups) [ 38.324362][ T4744] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 38.353227][ T4734] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 38.388800][ T5545] binder: 5544:5545 ioctl c0306201 20000200 returned -14 [ 38.450760][ T4742] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 38.456554][ T5553] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 38.502608][ T5559] netlink: 32 bytes leftover after parsing attributes in process `syz.1.254'. [ 38.605467][ T5575] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 38.605488][ T5575] overlayfs: failed to set xattr on upper [ 38.666583][ T5589] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 38.666601][ T5589] block device autoloading is deprecated and will be removed. [ 38.794103][ T5589] md/raid1:md4: active with 1 out of 2 mirrors [ 38.794774][ T5589] md4: detected capacity change from 0 to 4096 [ 38.825571][ T5607] md: recover of RAID array md4 [ 38.825959][ T5607] md: md4: recover done. [ 38.952000][ T5621] FAULT_INJECTION: forcing a failure. [ 38.952000][ T5621] name failslab, interval 1, probability 0, space 0, times 0 [ 38.952024][ T5621] CPU: 1 UID: 0 PID: 5621 Comm: syz.4.285 Tainted: G L syzkaller #0 PREEMPT [ 38.952037][ T5621] Tainted: [L]=SOFTLOCKUP [ 38.952041][ T5621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 38.952047][ T5621] Call trace: [ 38.952050][ T5621] show_stack+0x2c/0x3c (C) [ 38.952065][ T5621] __dump_stack+0x30/0x40 [ 38.952075][ T5621] dump_stack_lvl+0xd8/0x12c [ 38.952083][ T5621] dump_stack+0x1c/0x28 [ 38.952091][ T5621] should_fail_ex+0x418/0x58c [ 38.952103][ T5621] should_failslab+0xc4/0x120 [ 38.952113][ T5621] __kmalloc_cache_noprof+0x94/0x5fc [ 38.952124][ T5621] keyring_restrict+0x118/0x45c [ 38.952137][ T5621] keyctl_restrict_keyring+0x150/0x210 [ 38.952149][ T5621] __arm64_sys_keyctl+0x38c/0x3e8 [ 38.952162][ T5621] invoke_syscall+0x98/0x244 [ 38.952171][ T5621] el0_svc_common+0xec/0x23c [ 38.952179][ T5621] do_el0_svc+0x4c/0x5c [ 38.952187][ T5621] el0_svc+0x60/0x1d8 [ 38.952196][ T5621] el0t_64_sync_handler+0x44/0x104 [ 38.952204][ T5621] el0t_64_sync+0x198/0x19c [ 38.995545][ T5626] fuse: Bad value for 'fd' [ 39.220197][ T4752] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 39.221344][ T4752] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 39.221604][ T4752] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 39.221929][ T4752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 39.222136][ T4752] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 39.239674][ T5655] block nbd4: Cannot add socket to a running device [ 39.257999][ T1841] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.264372][ T5658] netlink: 20 bytes leftover after parsing attributes in process `syz.3.301'. [ 39.317465][ T1841] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.359252][ T5652] rxe_eth0 speed is unknown, defaulting to 1000 [ 39.385414][ T1841] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.477132][ T1841] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 39.508054][ T5679] syz.2.308 uses obsolete (PF_INET,SOCK_PACKET) [ 39.551601][ T5652] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.551652][ T5652] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.551704][ T5652] bridge_slave_0: entered allmulticast mode [ 39.552128][ T5652] bridge_slave_0: entered promiscuous mode [ 39.553509][ T5652] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.553561][ T5652] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.553611][ T5652] bridge_slave_1: entered allmulticast mode [ 39.554018][ T5652] bridge_slave_1: entered promiscuous mode [ 39.563170][ T5652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.564075][ T5652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.573641][ T5652] team0: Port device team_slave_0 added [ 39.574459][ T5652] team0: Port device team_slave_1 added [ 39.582476][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.582486][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.582501][ T5652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.583013][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.583019][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.583031][ T5652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.593924][ T5652] hsr_slave_0: entered promiscuous mode [ 39.594231][ T5652] hsr_slave_1: entered promiscuous mode [ 39.594428][ T5652] debugfs: 'hsr0' already exists in 'hsr' [ 39.594439][ T5652] Cannot create hsr debugfs directory [ 39.676572][ T1841] bridge_slave_1: left allmulticast mode [ 39.676597][ T1841] bridge_slave_1: left promiscuous mode [ 39.677560][ T1841] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.691702][ T1841] bridge_slave_0: left allmulticast mode [ 39.691721][ T1841] bridge_slave_0: left promiscuous mode [ 39.691832][ T1841] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.723831][ T5696] loop2: detected capacity change from 0 to 512 [ 39.771426][ T5696] FAT-fs (loop2): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 39.771447][ T5696] FAT-fs (loop2): Filesystem has been set read-only [ 39.776166][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.776387][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777251][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777450][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777617][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777698][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777852][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.777947][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.778099][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.778167][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.780749][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.780848][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.781531][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.781606][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.781692][ T5696] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 39.781778][ T5696] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 39.801284][ T1841] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 39.814052][ T1841] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 39.849902][ T1841] bond0 (unregistering): Released all slaves [ 40.015348][ T4748] block nbd4: Receive control failed (result -32) [ 40.019742][ T5647] block nbd4: shutting down sockets [ 40.097473][ T5714] loop4: detected capacity change from 0 to 4096 [ 40.113905][ T5714] EXT4-fs (loop4): Test dummy encryption mode enabled [ 40.122268][ T5714] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 40.124574][ T5720] netlink: 20 bytes leftover after parsing attributes in process `syz.2.319'. [ 40.161232][ T5716] bridge1: entered allmulticast mode [ 40.255405][ T4735] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.296819][ T5733] FAULT_INJECTION: forcing a failure. [ 40.296819][ T5733] name failslab, interval 1, probability 0, space 0, times 0 [ 40.296845][ T5733] CPU: 0 UID: 0 PID: 5733 Comm: syz.0.324 Tainted: G L syzkaller #0 PREEMPT [ 40.296858][ T5733] Tainted: [L]=SOFTLOCKUP [ 40.296861][ T5733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 40.296867][ T5733] Call trace: [ 40.296870][ T5733] show_stack+0x2c/0x3c (C) [ 40.296884][ T5733] __dump_stack+0x30/0x40 [ 40.296893][ T5733] dump_stack_lvl+0xd8/0x12c [ 40.296901][ T5733] dump_stack+0x1c/0x28 [ 40.296909][ T5733] should_fail_ex+0x418/0x58c [ 40.296920][ T5733] should_failslab+0xc4/0x120 [ 40.296930][ T5733] __kmalloc_noprof+0x108/0x6c8 [ 40.296940][ T5733] posix_acl_alloc+0x34/0x100 [ 40.296952][ T5733] posix_acl_from_xattr+0xbc/0x4d0 [ 40.296964][ T5733] do_set_acl+0x98/0x1a8 [ 40.296975][ T5733] do_setxattr+0x15c/0x19c [ 40.296990][ T5733] filename_setxattr+0x134/0x1f8 [ 40.297001][ T5733] path_setxattrat+0x200/0x2a8 [ 40.297012][ T5733] __arm64_sys_setxattr+0xd0/0xec [ 40.297023][ T5733] invoke_syscall+0x98/0x244 [ 40.297032][ T5733] el0_svc_common+0xec/0x23c [ 40.297040][ T5733] do_el0_svc+0x4c/0x5c [ 40.297048][ T5733] el0_svc+0x60/0x1d8 [ 40.297057][ T5733] el0t_64_sync_handler+0x44/0x104 [ 40.297065][ T5733] el0t_64_sync+0x198/0x19c [ 40.329270][ T4748] Bluetooth: hci4: command 0x0406 tx timeout [ 40.348881][ T5652] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 40.356592][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.356987][ T5652] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 40.370692][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.372884][ T5652] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 40.374563][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.374849][ T5652] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 40.388165][ T5652] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.447879][ T5752] input: syz0 as /devices/virtual/input/input3 [ 40.452931][ T1841] hsr_slave_0: left promiscuous mode [ 40.457582][ T1841] hsr_slave_1: left promiscuous mode [ 40.457984][ T1841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.458004][ T1841] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 40.462017][ T1841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.462033][ T1841] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 40.476476][ T1841] veth1_macvtap: left promiscuous mode [ 40.476547][ T1841] veth0_macvtap: left promiscuous mode [ 40.476667][ T1841] veth1_vlan: left promiscuous mode [ 40.476711][ T1841] veth0_vlan: left promiscuous mode [ 40.611657][ T5768] netlink: 36 bytes leftover after parsing attributes in process `syz.4.334'. [ 40.675240][ T1841] team0 (unregistering): Port device team_slave_1 removed [ 40.684682][ T1841] team0 (unregistering): Port device team_slave_0 removed [ 40.771999][ T5777] loop2: detected capacity change from 0 to 8192 [ 40.798164][ T5652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.808850][ T5652] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.813316][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.813346][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.813858][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.813877][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.862998][ T5784] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 41.089892][ T5652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.113874][ T5652] veth0_vlan: entered promiscuous mode [ 41.116149][ T5652] veth1_vlan: entered promiscuous mode [ 41.130826][ T5652] veth0_macvtap: entered promiscuous mode [ 41.132207][ T5652] veth1_macvtap: entered promiscuous mode [ 41.136483][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.137863][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.146090][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.146176][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.184912][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.186410][ T70] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.216310][ T476] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.216324][ T476] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.227108][ T5829] netlink: 'syz.2.351': attribute type 1 has an invalid length. [ 41.230668][ T5827] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 41.246714][ T5829] 8021q: adding VLAN 0 to HW filter on device bond1 [ 41.250572][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.250586][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.273454][ T4734] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 41.289622][ T4748] Bluetooth: hci3: command tx timeout [ 41.306908][ T5829] bond1: (slave geneve2): making interface the new active one [ 41.313334][ T5829] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 41.360530][ T5841] EXT4-fs (loop2): Test dummy encryption mode enabled [ 41.368430][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 41.374107][ T5841] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a806c018, mo2=0042] [ 41.374153][ T5841] System zones: 1-3, 19-19, 35-36 [ 41.374741][ T5841] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 41.407413][ T5841] FAULT_INJECTION: forcing a failure. [ 41.407413][ T5841] name failslab, interval 1, probability 0, space 0, times 0 [ 41.407437][ T5841] CPU: 0 UID: 0 PID: 5841 Comm: syz.2.354 Tainted: G L syzkaller #0 PREEMPT [ 41.407451][ T5841] Tainted: [L]=SOFTLOCKUP [ 41.407454][ T5841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 41.407460][ T5841] Call trace: [ 41.407463][ T5841] show_stack+0x2c/0x3c (C) [ 41.407478][ T5841] __dump_stack+0x30/0x40 [ 41.407487][ T5841] dump_stack_lvl+0xd8/0x12c [ 41.407495][ T5841] dump_stack+0x1c/0x28 [ 41.407503][ T5841] should_fail_ex+0x418/0x58c [ 41.407514][ T5841] should_failslab+0xc4/0x120 [ 41.407524][ T5841] __kmalloc_noprof+0x108/0x6c8 [ 41.407534][ T5841] security_inode_init_security+0xec/0x370 [ 41.407547][ T5841] ext4_init_security+0x44/0x58 [ 41.407556][ T5841] __ext4_new_inode+0x2988/0x3320 [ 41.407567][ T5841] ext4_mknod+0x1f4/0x414 [ 41.407580][ T5841] vfs_mknod+0x360/0x4e0 [ 41.407592][ T5841] filename_mknodat+0x3a0/0x5a0 [ 41.407604][ T5841] __arm64_sys_mknodat+0xc0/0xe8 [ 41.407616][ T5841] invoke_syscall+0x98/0x244 [ 41.407625][ T5841] el0_svc_common+0xec/0x23c [ 41.407633][ T5841] do_el0_svc+0x4c/0x5c [ 41.407641][ T5841] el0_svc+0x60/0x1d8 [ 41.407650][ T5841] el0t_64_sync_handler+0x44/0x104 [ 41.407658][ T5841] el0t_64_sync+0x198/0x19c [ 41.471466][ T4744] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 41.594682][ T5858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.362'. [ 41.605256][ T5860] FAULT_INJECTION: forcing a failure. [ 41.605256][ T5860] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 41.605279][ T5860] CPU: 1 UID: 0 PID: 5860 Comm: syz.2.364 Tainted: G L syzkaller #0 PREEMPT [ 41.605293][ T5860] Tainted: [L]=SOFTLOCKUP [ 41.605296][ T5860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 41.605302][ T5860] Call trace: [ 41.605305][ T5860] show_stack+0x2c/0x3c (C) [ 41.605321][ T5860] __dump_stack+0x30/0x40 [ 41.605330][ T5860] dump_stack_lvl+0xd8/0x12c [ 41.605339][ T5860] dump_stack+0x1c/0x28 [ 41.605346][ T5860] should_fail_ex+0x418/0x58c [ 41.605357][ T5860] should_fail_alloc_page+0xec/0x10c [ 41.605368][ T5860] prepare_alloc_pages+0x194/0x484 [ 41.605378][ T5860] __alloc_frozen_pages_noprof+0x180/0x578 [ 41.605388][ T5860] alloc_pages_mpol+0x1fc/0x3d0 [ 41.605400][ T5860] alloc_frozen_pages_noprof+0xc4/0x10c [ 41.605411][ T5860] alloc_pages_noprof+0x30/0x148 [ 41.605422][ T5860] __pte_alloc+0x40/0x1c4 [ 41.605434][ T5860] move_page_tables+0x21e0/0x26bc [ 41.605447][ T5860] move_vma+0x834/0x1310 [ 41.605454][ T5860] mremap_to+0x338/0x3d8 [ 41.605461][ T5860] __arm64_sys_mremap+0xb60/0xde0 [ 41.605469][ T5860] invoke_syscall+0x98/0x244 [ 41.605478][ T5860] el0_svc_common+0xec/0x23c [ 41.605486][ T5860] do_el0_svc+0x4c/0x5c [ 41.605494][ T5860] el0_svc+0x60/0x1d8 [ 41.605502][ T5860] el0t_64_sync_handler+0x44/0x104 [ 41.605510][ T5860] el0t_64_sync+0x198/0x19c [ 41.673477][ T5868] netlink: 8 bytes leftover after parsing attributes in process `syz.2.366'. [ 41.762544][ T5875] bond0: (slave bond_slave_1): Releasing backup interface [ 41.812013][ T5877] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 41.812031][ T5877] FAT-fs (loop2): Filesystem has been set read-only [ 41.812111][ T5877] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 41.812203][ T5877] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 42.386122][ T4834] rxe_eth0 speed is unknown, defaulting to 1000 [ 43.369030][ T4748] Bluetooth: hci3: command tx timeout [ 43.702273][ T5977] fuse: Bad value for 'fd' [ 43.807897][ T5994] set_capacity_and_notify: 3 callbacks suppressed [ 43.807911][ T5994] loop0: detected capacity change from 0 to 512 [ 43.824169][ T5994] EXT4-fs error (device loop0): ext4_orphan_get:1403: inode #15: comm syz.0.413: inode has both inline data and extents flags [ 43.824273][ T5994] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 43.826016][ T5994] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.413: couldn't read orphan inode 15 (err -117) [ 43.826086][ T5994] loop0: lost filesystem error report for type 5 error -117 [ 43.827660][ T5994] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 43.850936][ T5994] EXT4-fs (loop0): shut down requested (1) [ 43.881270][ T4734] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.903060][ T6001] rxe_eth0 speed is unknown, defaulting to 1000 [ 43.942011][ T6004] loop0: detected capacity change from 0 to 2048 [ 43.965023][ T6006] FAULT_INJECTION: forcing a failure. [ 43.965023][ T6006] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 43.965046][ T6006] CPU: 1 UID: 0 PID: 6006 Comm: syz.2.418 Tainted: G L syzkaller #0 PREEMPT [ 43.965059][ T6006] Tainted: [L]=SOFTLOCKUP [ 43.965062][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 43.965067][ T6006] Call trace: [ 43.965070][ T6006] show_stack+0x2c/0x3c (C) [ 43.965086][ T6006] __dump_stack+0x30/0x40 [ 43.965095][ T6006] dump_stack_lvl+0xd8/0x12c [ 43.965103][ T6006] dump_stack+0x1c/0x28 [ 43.965111][ T6006] should_fail_ex+0x418/0x58c [ 43.965122][ T6006] should_fail_alloc_page+0xec/0x10c [ 43.965133][ T6006] prepare_alloc_pages+0x194/0x484 [ 43.965143][ T6006] __alloc_frozen_pages_noprof+0x180/0x578 [ 43.965159][ T6006] alloc_pages_mpol+0x1fc/0x3d0 [ 43.965171][ T6006] alloc_frozen_pages_noprof+0xc4/0x10c [ 43.965182][ T6006] alloc_pages_noprof+0x30/0x148 [ 43.965194][ T6006] kimage_alloc_pages+0xa8/0x3d8 [ 43.965205][ T6006] kimage_alloc_control_pages+0x478/0x714 [ 43.965216][ T6006] do_kexec_load+0x358/0x678 [ 43.965235][ T6006] __arm64_sys_kexec_load+0x1b4/0x1d4 [ 43.965246][ T6006] invoke_syscall+0x98/0x244 [ 43.965255][ T6006] el0_svc_common+0xec/0x23c [ 43.965263][ T6006] do_el0_svc+0x4c/0x5c [ 43.965271][ T6006] el0_svc+0x60/0x1d8 [ 43.965280][ T6006] el0t_64_sync_handler+0x44/0x104 [ 43.965288][ T6006] el0t_64_sync+0x198/0x19c [ 43.965686][ T6006] kexec: Could not allocate control_code_buffer [ 43.971596][ T6004] loop0: p1 p2 p3 p4 [ 43.971596][ T6004] p1: [ 43.971694][ T6004] loop0: p1 size 67110656 extends beyond EOD, truncated [ 43.990528][ T6004] loop0: p3 size 134217728 extends beyond EOD, truncated [ 43.995872][ T6004] loop0: p4 size 4278190080 extends beyond EOD, truncated [ 43.998477][ T6004] loop0: p5 size 67110656 extends beyond EOD, truncated [ 43.999076][ T6004] loop0: p6 size 134217728 extends beyond EOD, truncated [ 44.167703][ T6019] FAULT_INJECTION: forcing a failure. [ 44.167703][ T6019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 44.167728][ T6019] CPU: 1 UID: 0 PID: 6019 Comm: syz.4.423 Tainted: G L syzkaller #0 PREEMPT [ 44.167741][ T6019] Tainted: [L]=SOFTLOCKUP [ 44.167744][ T6019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 44.167750][ T6019] Call trace: [ 44.167753][ T6019] show_stack+0x2c/0x3c (C) [ 44.167769][ T6019] __dump_stack+0x30/0x40 [ 44.167779][ T6019] dump_stack_lvl+0xd8/0x12c [ 44.167788][ T6019] dump_stack+0x1c/0x28 [ 44.167796][ T6019] should_fail_ex+0x418/0x58c [ 44.167807][ T6019] should_fail+0x14/0x24 [ 44.167817][ T6019] should_fail_usercopy+0x20/0x30 [ 44.167827][ T6019] bpf_verifier_vlog+0x3f4/0xbc0 [ 44.167837][ T6019] btf_verifier_log+0x120/0x1a0 [ 44.167848][ T6019] btf_datasec_log+0x78/0xbc [ 44.167860][ T6019] __btf_verifier_log_type+0x3bc/0x5e4 [ 44.167870][ T6019] btf_datasec_check_meta+0x348/0x71c [ 44.167882][ T6019] btf_check_all_metas+0x294/0x84c [ 44.167891][ T6019] btf_parse_type_sec+0x104/0x1004 [ 44.167903][ T6019] btf_new_fd+0x33c/0x7a8 [ 44.167911][ T6019] bpf_btf_load+0x144/0x190 [ 44.167924][ T6019] __sys_bpf+0x7f0/0x82c [ 44.167935][ T6019] __arm64_sys_bpf+0xd0/0xec [ 44.167946][ T6019] invoke_syscall+0x98/0x244 [ 44.167955][ T6019] el0_svc_common+0xec/0x23c [ 44.167963][ T6019] do_el0_svc+0x4c/0x5c [ 44.167972][ T6019] el0_svc+0x60/0x1d8 [ 44.167981][ T6019] el0t_64_sync_handler+0x44/0x104 [ 44.167989][ T6019] el0t_64_sync+0x198/0x19c [ 44.223398][ T6014] udevd[6014]: inotify_add_watch(7, /dev/loop0p2, 10) failed: No such file or directory [ 44.225141][ T4728] udevd[4728]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 44.225332][ T6013] udevd[6013]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 44.227464][ T4761] udevd[4761]: inotify_add_watch(7, /dev/loop0p5, 10) failed: No such file or directory [ 44.229328][ T4726] udevd[4726]: inotify_add_watch(7, /dev/loop0p6, 10) failed: No such file or directory [ 44.239525][ T6011] udevd[6011]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 44.337999][ T6035] loop4: detected capacity change from 0 to 8192 [ 44.447565][ T6044] FAULT_INJECTION: forcing a failure. [ 44.447565][ T6044] name failslab, interval 1, probability 0, space 0, times 0 [ 44.447590][ T6044] CPU: 1 UID: 0 PID: 6044 Comm: syz.2.433 Tainted: G L syzkaller #0 PREEMPT [ 44.447605][ T6044] Tainted: [L]=SOFTLOCKUP [ 44.447608][ T6044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 44.447614][ T6044] Call trace: [ 44.447617][ T6044] show_stack+0x2c/0x3c (C) [ 44.447634][ T6044] __dump_stack+0x30/0x40 [ 44.447644][ T6044] dump_stack_lvl+0xd8/0x12c [ 44.447652][ T6044] dump_stack+0x1c/0x28 [ 44.447660][ T6044] should_fail_ex+0x418/0x58c [ 44.447671][ T6044] should_failslab+0xc4/0x120 [ 44.447681][ T6044] __kvmalloc_node_noprof+0x160/0x7fc [ 44.447693][ T6044] alloc_netdev_mqs+0x86c/0xf34 [ 44.447702][ T6044] br_add_bridge+0x40/0xdc [ 44.447713][ T6044] br_ioctl_stub+0x418/0x938 [ 44.447723][ T6044] br_ioctl_call+0x78/0xac [ 44.447734][ T6044] sock_ioctl+0x460/0x7ec [ 44.447747][ T6044] __arm64_sys_ioctl+0x154/0x1cc [ 44.447757][ T6044] invoke_syscall+0x98/0x244 [ 44.447766][ T6044] el0_svc_common+0xec/0x23c [ 44.447774][ T6044] do_el0_svc+0x4c/0x5c [ 44.447782][ T6044] el0_svc+0x60/0x1d8 [ 44.447791][ T6044] el0t_64_sync_handler+0x44/0x104 [ 44.447799][ T6044] el0t_64_sync+0x198/0x19c [ 44.798964][ T4746] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 44.800928][ T4746] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 44.801455][ T4746] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 44.802069][ T4746] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 44.802360][ T4746] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 44.824650][ T6069] loop0: detected capacity change from 0 to 128 [ 44.851134][ T6069] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 44.862496][ T6069] syz.0.444 (pid 6069) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 44.879457][ T4734] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 44.982661][ T6065] rxe_eth0 speed is unknown, defaulting to 1000 [ 45.161047][ T6065] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.162675][ T6065] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.162734][ T6065] bridge_slave_0: entered allmulticast mode [ 45.163189][ T6065] bridge_slave_0: entered promiscuous mode [ 45.164165][ T6065] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.164850][ T6065] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.164912][ T6065] bridge_slave_1: entered allmulticast mode [ 45.165934][ T6065] bridge_slave_1: entered promiscuous mode [ 45.188956][ T6065] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 45.189949][ T6065] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 45.193047][ T6095] loop0: detected capacity change from 0 to 512 [ 45.215700][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.215818][ T6095] FAT-fs (loop0): Filesystem has been set read-only [ 45.215849][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.216381][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.216425][ T6065] team0: Port device team_slave_0 added [ 45.216466][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.216619][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.216687][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.216952][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217034][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217183][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217291][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217459][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217526][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217669][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.217735][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.218106][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.218108][ T6065] team0: Port device team_slave_1 added [ 45.218183][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.218275][ T6095] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 45.219354][ T6095] FAT-fs (loop0): error, fat_free: invalid cluster chain (i_pos 548) [ 45.253270][ T6065] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 45.253293][ T6065] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 45.253305][ T6065] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 45.259229][ T6065] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 45.259241][ T6065] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 45.259252][ T6065] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 45.284706][ T6065] hsr_slave_0: entered promiscuous mode [ 45.285057][ T6065] hsr_slave_1: entered promiscuous mode [ 45.357464][ T6065] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 45.366691][ T6065] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 45.367060][ T6065] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 45.381220][ T6065] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 45.382180][ T6065] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 45.392883][ T6065] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 45.393402][ T6065] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 45.402525][ T6065] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 45.420675][ T6065] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.420706][ T6065] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.420774][ T6065] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.420802][ T6065] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.465036][ T6065] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.482780][ T54] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.486143][ T54] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.496454][ T6119] FAULT_INJECTION: forcing a failure. [ 45.496454][ T6119] name failslab, interval 1, probability 0, space 0, times 0 [ 45.496482][ T6119] CPU: 1 UID: 0 PID: 6119 Comm: syz.2.457 Tainted: G L syzkaller #0 PREEMPT [ 45.496496][ T6119] Tainted: [L]=SOFTLOCKUP [ 45.496500][ T6119] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 45.496506][ T6119] Call trace: [ 45.496508][ T6119] show_stack+0x2c/0x3c (C) [ 45.496524][ T6119] __dump_stack+0x30/0x40 [ 45.496533][ T6119] dump_stack_lvl+0xd8/0x12c [ 45.496541][ T6119] dump_stack+0x1c/0x28 [ 45.496549][ T6119] should_fail_ex+0x418/0x58c [ 45.496560][ T6119] should_failslab+0xc4/0x120 [ 45.496570][ T6119] __kvmalloc_node_noprof+0x160/0x7fc [ 45.496581][ T6119] allocate_hook_entries_size+0x50/0xb8 [ 45.496591][ T6119] nf_hook_entries_grow+0x1b0/0x560 [ 45.496604][ T6119] __nf_register_net_hook+0x22c/0x624 [ 45.496613][ T6119] nf_register_net_hook+0xc0/0x19c [ 45.496621][ T6119] nf_register_net_hooks+0x54/0xf0 [ 45.496628][ T6119] nf_defrag_ipv4_enable+0x9c/0x12c [ 45.496641][ T6119] nf_ct_netns_do_get+0x268/0x4d0 [ 45.496650][ T6119] nf_ct_netns_get+0xa4/0xd8 [ 45.496658][ T6119] synproxy_tg4_check+0xe4/0x1fc [ 45.496666][ T6119] xt_check_target+0x554/0xb24 [ 45.496678][ T6119] translate_table+0x1194/0x17f8 [ 45.496686][ T6119] do_ipt_set_ctl+0x908/0xc38 [ 45.496694][ T6119] nf_setsockopt+0xa0/0xe4 [ 45.496702][ T6119] ip_setsockopt+0x118/0x128 [ 45.496710][ T6119] tcp_setsockopt+0xcc/0xe8 [ 45.496721][ T6119] sock_common_setsockopt+0xb0/0xcc [ 45.496732][ T6119] do_sock_setsockopt+0x1f0/0x330 [ 45.496744][ T6119] __sys_setsockopt+0x104/0x170 [ 45.496755][ T6119] __arm64_sys_setsockopt+0xc8/0xe4 [ 45.496766][ T6119] invoke_syscall+0x98/0x244 [ 45.496775][ T6119] el0_svc_common+0xec/0x23c [ 45.496784][ T6119] do_el0_svc+0x4c/0x5c [ 45.496792][ T6119] el0_svc+0x60/0x1d8 [ 45.496801][ T6119] el0t_64_sync_handler+0x44/0x104 [ 45.496809][ T6119] el0t_64_sync+0x198/0x19c [ 45.498231][ T6065] 8021q: adding VLAN 0 to HW filter on device team0 [ 45.520761][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.520790][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.527820][ T54] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.527848][ T54] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.550539][ T6065] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 45.550554][ T6065] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 45.592323][ T6124] FAULT_INJECTION: forcing a failure. [ 45.592323][ T6124] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 45.592348][ T6124] CPU: 1 UID: 0 PID: 6124 Comm: syz.2.459 Tainted: G L syzkaller #0 PREEMPT [ 45.592361][ T6124] Tainted: [L]=SOFTLOCKUP [ 45.592364][ T6124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 45.592370][ T6124] Call trace: [ 45.592373][ T6124] show_stack+0x2c/0x3c (C) [ 45.592389][ T6124] __dump_stack+0x30/0x40 [ 45.592398][ T6124] dump_stack_lvl+0xd8/0x12c [ 45.592407][ T6124] dump_stack+0x1c/0x28 [ 45.592415][ T6124] should_fail_ex+0x418/0x58c [ 45.592425][ T6124] should_fail+0x14/0x24 [ 45.592434][ T6124] should_fail_usercopy+0x20/0x30 [ 45.592444][ T6124] io_query+0x300/0x810 [ 45.592454][ T6124] __arm64_sys_io_uring_register+0x374/0x12e4 [ 45.592464][ T6124] invoke_syscall+0x98/0x244 [ 45.592473][ T6124] el0_svc_common+0xec/0x23c [ 45.592482][ T6124] do_el0_svc+0x4c/0x5c [ 45.592490][ T6124] el0_svc+0x60/0x1d8 [ 45.592499][ T6124] el0t_64_sync_handler+0x44/0x104 [ 45.592507][ T6124] el0t_64_sync+0x198/0x19c [ 45.601772][ T6127] netlink: 36 bytes leftover after parsing attributes in process `syz.4.461'. [ 45.613138][ T6127] netlink: 8 bytes leftover after parsing attributes in process `syz.4.461'. [ 45.722505][ T6148] loop2: detected capacity change from 0 to 512 [ 45.735611][ T6065] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 45.743605][ T6148] EXT4-fs error (device loop2): ext4_xattr_inode_iget:437: inode #12: comm syz.2.467: missing EA_INODE flag [ 45.743630][ T6148] loop2: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 45.747761][ T6148] EXT4-fs error (device loop2): ext4_xattr_inode_iget:442: comm syz.2.467: error while reading EA inode 12 err=-117 [ 45.747788][ T6148] loop2: lost filesystem error report for type 5 error -117 [ 45.747958][ T6148] EXT4-fs (loop2): 1 orphan inode deleted [ 45.756196][ T6148] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.814578][ T4744] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.836971][ T6065] veth0_vlan: entered promiscuous mode [ 45.842231][ T6065] veth1_vlan: entered promiscuous mode [ 45.854037][ T6065] veth0_macvtap: entered promiscuous mode [ 45.855571][ T6065] veth1_macvtap: entered promiscuous mode [ 45.864663][ T6065] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 45.867160][ T6065] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 45.901476][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.901493][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.915273][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 45.915288][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 45.941568][ T476] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.941980][ T476] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.942000][ T476] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.942018][ T476] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 45.998956][ T6172] faux_driver vgem: [drm] Unknown color mode 9; guessing buffer size. [ 46.035706][ T6176] loop5: detected capacity change from 0 to 512 [ 46.037134][ T6176] EXT4-fs: Ignoring removed orlov option [ 46.051768][ T6176] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.065762][ T6178] loop4: detected capacity change from 0 to 4096 [ 46.074557][ T6178] EXT4-fs (loop4): Test dummy encryption mode enabled [ 46.076663][ T6178] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.096100][ T6065] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.145090][ T4735] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.217853][ T6187] bond0: entered promiscuous mode [ 46.217880][ T6187] bond_slave_0: entered promiscuous mode [ 46.217992][ T6187] bond_slave_1: entered promiscuous mode [ 46.218195][ T6187] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 46.256243][ T4746] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 46.256798][ T4746] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 46.257207][ T4746] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 46.258435][ T4746] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 46.261564][ T4746] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 46.286849][ T6193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.482'. [ 46.286868][ T6193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.482'. [ 46.363569][ T6189] rxe_eth0 speed is unknown, defaulting to 1000 [ 46.641844][ T6189] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.641874][ T6189] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.641971][ T6189] bridge_slave_0: entered allmulticast mode [ 46.642564][ T6189] bridge_slave_0: entered promiscuous mode [ 46.652197][ T6189] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.653126][ T6189] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.653251][ T6189] bridge_slave_1: entered allmulticast mode [ 46.656074][ T6189] bridge_slave_1: entered promiscuous mode [ 46.685416][ T6189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 46.686387][ T6189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 46.710197][ T6189] team0: Port device team_slave_0 added [ 46.714245][ T6189] team0: Port device team_slave_1 added [ 46.735289][ T6189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 46.735302][ T6189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 46.735318][ T6189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 46.736321][ T6189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 46.736327][ T6189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 46.736338][ T6189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 46.775441][ T6189] hsr_slave_0: entered promiscuous mode [ 46.776393][ T6189] hsr_slave_1: entered promiscuous mode [ 46.776586][ T6189] debugfs: 'hsr0' already exists in 'hsr' [ 46.776596][ T6189] Cannot create hsr debugfs directory [ 46.818585][ T4748] Bluetooth: hci3: command tx timeout [ 46.933642][ T6189] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 46.933674][ T6189] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.019626][ T6236] md: array md3 already has disks! [ 47.022503][ T6189] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 47.022528][ T6189] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.068549][ T6236] md: could not open device unknown-block(1,6). [ 47.068582][ T6236] md: error, md_import_device() returned -16 [ 47.077089][ T6245] FAULT_INJECTION: forcing a failure. [ 47.077089][ T6245] name failslab, interval 1, probability 0, space 0, times 0 [ 47.077111][ T6245] CPU: 0 UID: 0 PID: 6245 Comm: syz.4.498 Tainted: G L syzkaller #0 PREEMPT [ 47.077124][ T6245] Tainted: [L]=SOFTLOCKUP [ 47.077127][ T6245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 47.077132][ T6245] Call trace: [ 47.077135][ T6245] show_stack+0x2c/0x3c (C) [ 47.077151][ T6245] __dump_stack+0x30/0x40 [ 47.077161][ T6245] dump_stack_lvl+0xd8/0x12c [ 47.077169][ T6245] dump_stack+0x1c/0x28 [ 47.077177][ T6245] should_fail_ex+0x418/0x58c [ 47.077190][ T6245] should_failslab+0xc4/0x120 [ 47.077202][ T6245] __kmalloc_cache_node_noprof+0x98/0x618 [ 47.077224][ T6245] bdi_alloc+0x5c/0x12c [ 47.077233][ T6245] __alloc_disk_node+0xb8/0x4e4 [ 47.077245][ T6245] __blk_alloc_disk+0xec/0x1a8 [ 47.077254][ T6245] dm_create+0x3ec/0xd94 [ 47.077266][ T6245] dev_create+0x108/0x258 [ 47.077277][ T6245] dm_ctl_ioctl+0x884/0xbbc [ 47.077287][ T6245] __arm64_sys_ioctl+0x154/0x1cc [ 47.077297][ T6245] invoke_syscall+0x98/0x244 [ 47.077306][ T6245] el0_svc_common+0xec/0x23c [ 47.077314][ T6245] do_el0_svc+0x4c/0x5c [ 47.077323][ T6245] el0_svc+0x60/0x1d8 [ 47.077332][ T6245] el0t_64_sync_handler+0x44/0x104 [ 47.077340][ T6245] el0t_64_sync+0x198/0x19c [ 47.124518][ T6236] ------------[ cut here ]------------ [ 47.124530][ T6236] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0xe4/0x578, CPU#0: syz.3.494/6236 [ 47.125051][ T6189] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 47.125073][ T6189] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 47.131366][ T6236] Modules linked in: [ 47.132073][ T6236] CPU: 0 UID: 0 PID: 6236 Comm: syz.3.494 Tainted: G L syzkaller #0 PREEMPT [ 47.134165][ T6236] Tainted: [L]=SOFTLOCKUP [ 47.135044][ T6236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 47.137332][ T6236] pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 47.139051][ T6236] pc : __alloc_frozen_pages_noprof+0xe4/0x578 [ 47.140228][ T6236] lr : __alloc_frozen_pages_noprof+0xa8/0x578 [ 47.141315][ T6236] sp : ffff80009b1872e0 [ 47.142079][ T6236] x29: ffff80009b1873a0 x28: ffff0000cb964018 x27: ffff80009b187300 [ 47.143879][ T6236] x26: 1ffff00011eac4ec x25: dfff800000000000 x24: ffff700013630e60 [ 47.145620][ T6236] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000040dc0 [ 47.147291][ T6236] x20: 0000000000000000 x19: 0000000000000034 x18: ffff8001237ae000 [ 47.148944][ T6236] x17: ffff0001acf6ce07 x16: ffff0000d1375894 x15: 00000000000000fc [ 47.150570][ T6236] x14: 0000000000000004 x13: 0000000000000005 x12: 0000000000000000 [ 47.152158][ T6236] x11: 0000000000000000 x10: ffff700013630e69 x9 : 0000000000000001 [ 47.153715][ T6236] x8 : ffff80008ae88000 x7 : 0000000000000000 x6 : 0000000000000000 [ 47.155254][ T6236] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000020 [ 47.156961][ T6236] x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff80009b187320 [ 47.158433][ T6236] Call trace: [ 47.159030][ T6236] __alloc_frozen_pages_noprof+0xe4/0x578 (P) [ 47.160239][ T6236] alloc_pages_mpol+0x1fc/0x3d0 [ 47.161188][ T6236] alloc_frozen_pages_noprof+0xc4/0x10c [ 47.162348][ T6236] ___kmalloc_large_node+0x74/0x158 [ 47.163388][ T6236] __kmalloc_large_node_noprof+0x2c/0x8c [ 47.164447][ T6236] __kmalloc_noprof+0x3f0/0x6c8 [ 47.165398][ T6236] setup_conf+0x9e4/0x1f38 [ 47.166249][ T6236] raid5_run+0x670/0x1b68 [ 47.167109][ T6236] md_run+0xb10/0x19e8 [ 47.168000][ T6236] do_md_run+0x4c/0x4e4 [ 47.168911][ T6236] md_ioctl+0x1bf8/0x23d4 [ 47.169858][ T6236] blkdev_ioctl+0x574/0x904 [ 47.170536][ T6256] loop4: detected capacity change from 0 to 256 [ 47.172311][ T6236] __arm64_sys_ioctl+0x154/0x1cc [ 47.173371][ T6236] invoke_syscall+0x98/0x244 [ 47.174299][ T6236] el0_svc_common+0xec/0x23c [ 47.175238][ T6236] do_el0_svc+0x4c/0x5c [ 47.176096][ T6236] el0_svc+0x60/0x1d8 [ 47.177026][ T6236] el0t_64_sync_handler+0x44/0x104 [ 47.178015][ T6236] el0t_64_sync+0x198/0x19c [ 47.178939][ T6236] irq event stamp: 1204 [ 47.179732][ T6236] hardirqs last enabled at (1203): [] seqcount_lockdep_reader_access+0x68/0xcc [ 47.181835][ T6236] hardirqs last disabled at (1204): [] el1_brk64+0x20/0x54 [ 47.183584][ T6236] softirqs last enabled at (1138): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 47.185689][ T6236] softirqs last disabled at (1136): [] fpsimd_restore_current_state+0x44/0x9c8 [ 47.187760][ T6236] ---[ end trace 0000000000000000 ]--- [ 47.191166][ T6236] Unable to handle kernel paging request at virtual address dfff800000000005 [ 47.191179][ T6236] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 47.191187][ T6236] Mem abort info: [ 47.191191][ T6236] ESR = 0x0000000096000005 [ 47.191196][ T6236] EC = 0x25: DABT (current EL), IL = 32 bits [ 47.191202][ T6236] SET = 0, FnV = 0 [ 47.191213][ T6236] EA = 0, S1PTW = 0 [ 47.191217][ T6236] FSC = 0x05: level 1 translation fault [ 47.191222][ T6236] Data abort info: [ 47.191225][ T6236] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 47.191230][ T6236] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 47.191236][ T6236] GCS = 0, Overlay = 0, DirtyBit = 0 [ 47.191242][ T6236] [dfff800000000005] address between user and kernel address ranges [ 47.191363][ T6236] Internal error: Oops: 0000000096000005 [#1] SMP [ 47.206710][ T6236] Modules linked in: [ 47.207477][ T6236] CPU: 0 UID: 0 PID: 6236 Comm: syz.3.494 Tainted: G W L syzkaller #0 PREEMPT [ 47.209390][ T6236] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 47.210332][ T6236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 47.212124][ T6236] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 47.213607][ T6236] pc : free_conf+0x88/0x540 [ 47.214411][ T6236] lr : free_conf+0x34/0x540 [ 47.215328][ T6236] sp : ffff80009b187550 [ 47.216117][ T6236] x29: ffff80009b187560 x28: ffff0000cb964018 x27: ffff700013630ecc [ 47.217585][ T6236] x26: ffff0000f814a000 x25: 1fffe0001f029444 x24: ffff0000f814a000 [ 47.219114][ T6236] x23: dfff800000000000 x22: 00000000fffffff4 x21: ffff0000f814a660 [ 47.220720][ T6236] x20: 0000000000000028 x19: ffff0000f814a000 x18: ffff8001237ae000 [ 47.222403][ T6236] x17: ffff0001acf6ce07 x16: ffff0000d1375894 x15: 00000000000000fc [ 47.223921][ T6236] x14: 0000000000000004 x13: 0000000000000005 x12: 0000000000000000 [ 47.225638][ T6236] x11: 0000000000000000 x10: 0000000000080000 x9 : 000000000001b886 [ 47.227211][ T6236] x8 : 0000000000000005 x7 : 0000000000000000 x6 : 0000000000000000 [ 47.228883][ T6236] x5 : 00000000ffffffff x4 : 0000000000000dc0 x3 : 0000000000000000 [ 47.230384][ T6236] x2 : ffffffffffffffff x1 : ffff0000d1375880 x0 : 0000000000000001 [ 47.232151][ T6236] Call trace: [ 47.232803][ T6236] free_conf+0x88/0x540 (P) [ 47.233665][ T6236] setup_conf+0xb0c/0x1f38 [ 47.234477][ T6236] raid5_run+0x670/0x1b68 [ 47.235325][ T6236] md_run+0xb10/0x19e8 [ 47.236182][ T6236] do_md_run+0x4c/0x4e4 [ 47.237094][ T6236] md_ioctl+0x1bf8/0x23d4 [ 47.237882][ T6236] blkdev_ioctl+0x574/0x904 [ 47.238771][ T6236] __arm64_sys_ioctl+0x154/0x1cc [ 47.239818][ T6236] invoke_syscall+0x98/0x244 [ 47.240753][ T6236] el0_svc_common+0xec/0x23c [ 47.241720][ T6236] do_el0_svc+0x4c/0x5c [ 47.242463][ T6236] el0_svc+0x60/0x1d8 [ 47.243285][ T6236] el0t_64_sync_handler+0x44/0x104 [ 47.244163][ T6236] el0t_64_sync+0x198/0x19c [ 47.245068][ T6236] Code: 9730d23e f9400288 9100a114 d343fe88 (38776908) [ 47.246395][ T6236] ---[ end trace 0000000000000000 ]--- [ 47.570510][ T6236] Kernel panic - not syncing: Oops: Fatal exception [ 47.571876][ T6236] SMP: stopping secondary CPUs [ 47.572881][ T6236] Kernel Offset: disabled [ 47.573911][ T6236] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 47.575505][ T6236] Memory Limit: none [ 47.905741][ T6236] Rebooting in 86400 seconds..