last executing test programs: 17.030338065s ago: executing program 0 (id=8711): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x320b401, 0x0, 0x22, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') unshare(0x26020480) r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) fstat(r0, &(0x7f0000000700)) 16.835993315s ago: executing program 0 (id=8713): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0xffffffffffffffb1, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xc6da5938055b87b0, 0x48a21}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x3}]}}}, @IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x4c}, 0x1, 0x200000000000000, 0x0, 0xd1}, 0x2400c000) 16.73991763s ago: executing program 0 (id=8715): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x40a82) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a4, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 16.551788169s ago: executing program 0 (id=8718): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x104000, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x3005840, 0x0, 0x5, 0x0, 0x0) mount$bind(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0xb1c08, 0x0) mount$fuse(0x0, &(0x7f00000005c0)='./file0/file0\x00', 0x0, 0x88000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2125099, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='pstore\x00', 0x0, 0x0) 16.395438287s ago: executing program 0 (id=8720): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[], 0x6ec}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 15.94820503s ago: executing program 0 (id=8725): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x16, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af8ff0000000018110000", @ANYRES32=r0, @ANYBLOB="000000000000000015010200e9ffffff18110000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x7, 0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 15.36215146s ago: executing program 32 (id=8725): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x16, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af8ff0000000018110000", @ANYRES32=r0, @ANYBLOB="000000000000000015010200e9ffffff18110000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x7, 0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.772162618s ago: executing program 2 (id=8787): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/4, 0x4}], 0x3bc, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba0000004a439133f4d94af300", @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d"], 0x38}}, 0x0) 3.003179107s ago: executing program 2 (id=8793): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0x5, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.807241207s ago: executing program 2 (id=8794): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000600)={0x0, 0x28}}, 0x4000010) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x5, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.613557877s ago: executing program 2 (id=8795): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0x2, 0x0, 0x5, 0x4, 0xdd9, 0x2, 0x8, 0x8000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x0, 0x5, 0x80000001, 0x7}, 0x3d}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000412) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0406e52534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 2.583454949s ago: executing program 1 (id=8796): syz_mount_image$iso9660(&(0x7f00000001c0), &(0x7f0000000000)='./file0\x00', 0x1a08050, &(0x7f0000000380)=ANY=[], 0x2, 0x5be, &(0x7f0000002340)="$eJzs3V1vG1kZwPFnEqcxAVUIUFVFbfdsClIqZd3xZOMq2qthfOzMrj1jzYxXyVUVEaeK6hTUFInkhvSmagV8BaR+CG75MlxXXIMERvMWnPgtrdOYlv8v2p0T+/E5z3GteXqmMx4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABiOFXTLBvScL32thrNqQZ+c8zzeX8Pzm3GjCtixP9JsSi304du/+y/T9+K/7cid9Lf7kgx3hTl5Ie3fvzNTwtz+evHJHQtjo5Pnu52u53nl4wvzDzjq1XXnhv6btOua+WGvtqsVMyHW7VQ1dyGDnfCSDeVE2g78gO16jxQ5c3NdaVLO37bq1fths4ffPSVZZoV9W2ppe0g9L2H35ZCZ8ttNFyvnsTET8cxj+IP4ndupCJtN5XaP+h21iclGQeVs/bFP4DT/iBrUk+WaVnlgohUNm5kH1TLKpctq1zZ2Nx4ZJoF8wJZvBjR96Gt/yPt4z3fdHzarmrXDUxtLqv/0hBXPGnLtqihP45UJRBfmiOez+T1/xcP9dhx++t/XuVv+z/In16WpP7fS3+7N6r+i5LFEflcz8+RHMuJPJVd6UpXOvJ8uv7m8vnPck4qfnNPLxdZFy2euBKKL640xU4eUeJKUXxRsikVqYgpj2VLahKKkpq40hAtoexIKJHo5BPlSCBabInEl0CUrIojD0RJUm1lXZRoKcmO+NIWT+pSFTvpZV8Okvd9fUyOZ0HlywRZY4KS+t9fzAceGKj/AxGz/0srZutqd+DAFHp5/QcAAAAAAJ8tIzn6Hq//F+Ru0qq5DW3OOi0AAAAAAHCFXteS8+uNeP0vInfFGLn+P80OFAAAAAAAgE+MkVxjFy/rl+SLtJVfCXV2EGButikCAAAAAIApJf+gfy/eLMWtL8QYXP8PSr79rHhtSQIAAAAAgKlEr7PGyO/YD1uLxl//LkGwYLxsbf/cOLTjOPtwPn3d/ECPtWXpLabtpK9KIevS0XeM7Nsvz74E8126KUivNz4PY2wChfMJGDezV59PQP4oX8YRf5Mv99LYvfyZdJSlmtvQJcdvfFMW2745F+nt6LfPDn4nyfTfeM04yYNup/SrX3f3klxexr28PMyuixi4PGJMLi/y4yd3h894IbkQIxt3yZD9g27H7J9/dlrGwNkZY8Z8JStpzMpSul06P/9iPGa5NGr2aRYLMuXMX8n9NOb+6v10MyQLa0IWHas/iw96Ly6RxfqkLNanzAIAZmU/+dafoVUo36VfrLsfsJfbn3Qnn/HV/ZKjvJLVNGZ1OdmxFpaH7NHNSXt0s7WdV+a0ut0YW93kVGT4Hv3sHkijamw87p/Oxi0ns3/7exF5m1fVgemHDcuI38L5F4e/kVtHxydfHRzuPuk86TyzrPWK+bVpbliykEwj21B7AABDTL7HzsQI4+t0VS3JqvpfvVRfxftJdkpBflSgK3uyllxtkJxxUJTFc73+4c/xSrzvNIS1i6vWgvRX1F5eLP/Z6/XWJqzq0n5zl4lNby8DAMDnZKW/Do+t/1nckPq/lh8KGLHuPl/LL94heFRseUTGb7gcEQCAKeng3b+zFXvrcXlzs2xHW1oFvvOdCtxqXSvXi3TgbNleXatW4Ee+48/Hje/dqg5V2G61/CBSNT9QLT90t5M7v6vs1u+hbtpe5Dphq6HtUCvH9yLbiVTVDR3Vav+y4YZbOkheHLa049Zcx45c31Oh3w4cXVIq1Lov0K1qL3Jrbtz0VCtwm3awo773G+2mVlUdOoHbivy0w3ws16v5QTPu9sas32sAAP5XHB2fPN3tdjvPP2Jj1nMEAADnvU+V5owxAAAAAAAAAAAAAAAAAAAAAABmY/R1e/NyDZcGZo2//EjkusYa3VgQkdmNTuP/snHzijssyhV1OGnPcXo9OygAH81/AgAA///lXV5a") munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r0 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 2.178722019s ago: executing program 1 (id=8800): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000340)={0x3, 0x0, [{0x37d, 0x0, 0x3}, {0x3f6, 0x0, 0x6}, {0x4b564d01, 0x0, 0x200}]}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0xf3b8, 0x0, 0x8000001000, 0x400, 0x4002004c4, 0x1000, 0x0, 0x97, 0x10, 0x0, 0x3, 0x4, 0x0, 0x100000000], 0xeeee8000, 0x150642}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.931989192s ago: executing program 2 (id=8801): syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) request_key(&(0x7f0000000280)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f0000000200)=')\x00', 0x0) 1.901843193s ago: executing program 3 (id=8802): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0x5, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.817119118s ago: executing program 1 (id=8803): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000600)={0x0, 0x28}}, 0x4000010) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x5, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.5800108s ago: executing program 3 (id=8804): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000000)='O', 0x1) setsockopt$inet6_int(r0, 0x29, 0x4d, 0x0, 0x0) 1.542594631s ago: executing program 2 (id=8805): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 1.336480132s ago: executing program 1 (id=8806): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[], 0x18}, 0xc020) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text16={0x10, 0x0}], 0x1, 0x6d, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x7, 0xc, 0x6, 0x20ac1f87, 0x8, 0x6, 0x4, 0x4, 0x8, 0x4, 0x6, 0x1, 0x1932be21, 0x1000, 0x4, 0x4], 0xeeee0000, 0x40600}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x2, 0x7, 0x3, 0x0, 0x8, 0x2, 0xff, 0x63, 0x3, 0x2, 0xd, 0x7, 0x0, 0x1, 0xfffffffb, 0xfa, 0x9, 0x2, 0x0, '\x00', 0x25, 0x1}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000100)=0x9000) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.261085686s ago: executing program 3 (id=8807): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="ec060000210a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000c006"], 0x6ec}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1.025842828s ago: executing program 1 (id=8808): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0x2, 0x0, 0x5, 0x4, 0xdd9, 0x2, 0x8, 0x8000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x0, 0x5, 0x80000001, 0x7}, 0x3d}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000412) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, 0x0, 0x4005) 972.26042ms ago: executing program 3 (id=8809): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd0a, &(0x7f00000004c0)="0400000000000000000000009001000038010000030000000000000000000000000000000000000000000000000000006d706174683000"/78) 179.830411ms ago: executing program 1 (id=8810): sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x9) io_uring_setup(0x162e, &(0x7f00000002c0)={0x0, 0xd38b, 0x1000, 0x1, 0x348}) r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2) write$binfmt_elf64(r1, &(0x7f0000000200)=ANY=[], 0x1cb) close(r1) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) 179.554951ms ago: executing program 3 (id=8811): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0x5, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 3 (id=8812): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RELDISP(r0, 0x5605) writev(r0, &(0x7f0000001780)=[{&(0x7f0000000580)="7be628c8ea0ce2c4dd943ed5e2c1dfba2f76ad9f8b0dd783d36e440ca159c1c4514e96fb2adb61256e26ec7ebd27afe1eb5f633c82c2eceeb77261c973502c3c046b4b0f1dc82037f41a1e22390afb38705c1fa7eefbb56ee40ac1be9dda6fdb99a57f401ffa5c80c03ccc313acceb68c8bbec7d6314dec2a67cfa5dfbe12215061df69d8cdfc2c3ea62a53f05aa761b122c7531e83ffc16ea6873411eb0043f8f86da9e66109d39118f5bc5eb863ce4d140d2e89a59edb7997f8d4eac718ced71bbece9", 0xc4}, {&(0x7f0000000680)="5965c2656171eb33900659d0dadc7e49ff1fb8227e27cb606f527d5adb40188a4aeb32d2785f3f830b11b2861038c72709f448038070f8315313fe0298bf6bc428ffac6222098898c79cf70e1437dab7bec77b81c3f8a07e512366d49a4b73b654a91515754a79a957ddb92d7da3fb3d27dc756952a9b7630dd8c3541e6d5cf85ea7eda2987a1350aacf15baeb9f5da2fff1faeb049818435cd5b9c3ae1ca787753b119a6d97402fd3f9ff862753218b955dc6a2894f22c6c755366d9b9bd6952007eab46b09ff43513ad24704d53b8ab07876ed4a6e98eea8c186e87a4c5ffb73efc7bcf30e1fb70e18b58130b22ffd9ca86fe22776e79d0b1715bec7152d32dccd991d00270eeead0063beb1d07fefb6cd9f0999b55aaab6b54d32b78f65527cf5aa4f0c6d4522a760d212b736bb52cf46da71098512a7c3318478bb994cabbe1d2108ab79714a01e7a66cb32e05e30dc0ede41172dd7634a1d33ff5b219db10eb2ef4d7e59df31550bd4586ca03f20bc271eb73b108c0ad83a30e16ae0f080568bf66821d535c5de949aa91ff65ebdda04dc6ec8a68d8cb91f8dea5f881217f932fcfcec578d372d283594ebcf32b5ae47f1d3bc7580580218ffab103b546fabc49445fb0fe04b227b972f05e88c44d9369b427bc363b47bd85e265ccf5737ecb979827556ad05f05e12dd77502cde07db1865ace7dfa51b398f6a12b0fb0bed875a01cf4615065c6039322dcf4f0d859c8f619e14924f4cbf7004a909243d91873de0e432b75bce22b7e1af78c7c3ce568eb6dbc7185b12e3b7178c8d3f5645fa1a05d90c1f77804046d12158604453daa6fb51c055ebbbcd38f2adbb85e49d0264f56fca56d7d8d72ad1c74fc18fac90dad1ba2460d4693ab98869f554dde3e95ea4bb33514d15f09b447ded518fd4d6c40d67a4fa76f5bebe269fdc38eea8a036fd074232f74c39f0d1580af40e9fa15f2c86e44c9f6d9a71da4c27348d56ff9f568b470b0e33a4e0d9dad41dd236f269ced17140cdc757bd7e04c56e66c3b35022f3b0ce10b5d777181c36ff56478b79b314099c6a619c88f497ffd7709f1181e1d9afd50f4513abf4ac2b6a50d847afeef3fbb29a59c349f2ff87215f8c30d330019259b5ec613fbd6861a43bc4f05bd4da632d43642cba6ca7af3006b04a25cfa8c74809d67af6b24a7c6709dd341c917452dcd0e8ec3cc83404762d2df5baa97c30bb35f1e7b8560aacb6e2ce8d9bf04b0a65b23cac02a3d82c6790da518191b61c5ee6e18a563cf41f12494b9af9f6f5e5af94656d8c54d948993351f5617ba48c5508e15c89f116ee0d14fd86f14e1adeb57d0480395c02f5bc02b17eeecd86662591ab41f2de8a8b57e0b465b6da671751d33864865bbacb54645e3d5a8b9417371f526200dd645373387b902218d9713d872043b1d6903e4ef8893488561a9130c992972174c3daa585b890f53e5769f7e71844bebc2ff09b16157c8daafee436d515e0e24fdb7bdbfa8627835f037556c58e4a979c8ccf9990e53e82d13b87791da1870a21ccc47d37d1d8bfc2a7787c633365d50963357844912745dbd799593941222e5a9773020bc9ad6748ce0e8ff7f561fc616f3eda5869fc7e8033026623e4f49da21cafe035e769086d68de6771ca98a1d2ba3365583355a0d2f3155d3fd4bc4eadad498ced1e08f0c34bfa7810c62a5f27bc9cd29a27527c610871b68e542f61f09bc48568938c50a8f1e73a9ecc54da5cd3ef594bca130a620dc85467c3d3b904391c5b394b223ac2309e8e3cde008890a9ad322be8a29d296b0c7889b1111519e1843ceea9e8610f4a6730ae5404717dabf867fc8557e7708552683b8c091e99803dc2d2088f3b5f2c4fa20e3cd36ee71539d29fbde64a870fc1860c9d0552a3c38c15e11c6ef196dac7f1eaaa2a7ba21194351c5963ca99728c77c176df5a7134dd86508c311649c78a23b2fc8b251dd1b8d29e4c9ced68db17b46c69352f54c3036a9f58c5c158f35055ca509f6135414ca6a0800d28a134b0d84decc15aec5f113d329c5ff71525dfe6461c018472b22376aad2c8a26cf3f73069f88e7059d4637f9127c342b76b7e23f33a56d34a1d03555fba252e06b540de2c192281ce6be63894d6c40a0057ad5cc9d54028924cd25fad2eac9ddf4e95976f9958019f8eb6b22fa2d9f0a80810898d09ea6d180f9d96ee6d98a5e7656ff8dbe056e30bf8f3d92c623c225e87d725a0900254d964d4a2210f631adf76535f04603da0d34a88724e3fd00f14083d58a6405edbf2e21274af1594b50c380b818481dbaf3f8cc719fdad4e9211f37a639006258b8a71dfe3abcd09ec053dfe6f39a3eedaf089adb368b5dfebe0ee21ed32b6f0c1bc246ca45fdddb970cd07c6df7416ac12e09ce8488793fdfd029a1140ba3c1cabe21d755ce69e22bcebe8f0927784a5c1bf5c42f30483a11706b83ff35dbf4efdf88aecbe98d964385c9d1a208f7c7f8efea0d394cb8c28296e52cb2a8b4cb053bf1c14e7bfa8796fd15b4dd217613fdd5dbd9cf6db61f7fe9d9b6a66d99e88fbe3c5150d9821f3b0929ceaeddbc7beb08ec85062a7abe31a7dea00ec530baa3b6eb523fa33f7cae3016ec4ef97449169de5b01ded533a255b6df4903d14f8de5a708cb45af0ccf96a2070c709c76568cd872ef12e8786a3ff6368b9e598f3494b37e4b39f4594cf27746ba5ef9924cf0bc844a1fc2af8690844effc9c0d12d5e03a6c4d614ef056fbb2743e8a3819a495383a5db0becf7271c4c2571821cd0ce2b24eeaddec33c9525ca1728aeb0e42ff9ba827e20f803bf358d23205b29d582dd4c8527bcd25a2fc982ff0586afb59b2e2f34e14af5eff46d61fabf2a8590d4a3c80adb959e173b747bd7aaf6a0fa7545d3f03eacbf1acbcccfbfaf932fa96bff942749236587c63d11a10aeec0a425421abe2789cd4d6a6874db1d9248fb6080c41e4b04fa8c4f6f8accc17f7b2891fad13f71667397cf5dd73a62449aceb5360356d3c99e11963e10564298516985d0132bc6734f174f18aaa0dd0f4347d785b1e0d5eb73d6e096f6c449a3c8c0f424f010115db77e346feaa0c45f1edfe23e06a75a15f45d7df6ba3e46cd9bde61078bcaa7d315e145f390b2a8ed9140c96a7bce9635563dbaa8d5656d8e3c10c99a9dc3c882c7e55ccdcc03178b07698b4cf8f53f4ebfb9569e1b81be5e49d9de1db8821084bb916912e7562a7593cb77e1f87431bf0465bcfb34406ed6d69771718c10916f939b19d685bc92e6134cdd92bb2fd7dcce7b05b3bd62373338f168c742882ccdc57d8e7f7d04ffc93dbe9db02ed85701ee05a90782956b9a12d7f9005458ead82c24faa23bb4580e2fcfe8ae0fb9ff19dfe3682aabaa51c384772b72d2fa3135c09daf32a8772fe0214d4c4be620c3e86700a9eb02977ba4cdf3d59fd6148881ce8d53cb96e317554e042ea947ea4408279a80a334d93709f187bd3e40e47c8db749135d3fbd10965a81866ad3d17ab4a3ab844dff004e1e441d193b5a8db60e9f9634f13374befdc3d1c347e6d7b821ceb95ca2872bfca9d7f825109717b8eed5503da59ee4428f8ba8dd84e18f9700892a4c9055cff9ac10dc1ffb86d4801eb62c820821a5c28ba6a4c395603aee55ab29c1e4edae6b43cb434598153950cfe08db193d7ddbd6109bbceb44c6945ff28f446107e828aaf7fd8edcce50f234cf0e2720a0141bff02ae77ac20a30ee88ef6898767ae5abf809a415bb9e4d65be34abaf38ea5b3d816cef76c09a1c1e97bc87dac0d3b366f0854790660a0eaa9036d1681ec7202ac3a02d7499be2218820d1efdde985862927edffe00e8b951b7a0f7f757dd961ed1d7a6bdc19414ae1b9f4e8724b3825662ffe05199959945c9cbf3c42eeddc1092651ba3ca1c307929e5802c2ab57d1886bdb7f5b458f8346fa0032946424c8b1b89b9372bb8f12cac4c5347f8e4e5b2de6eedb0684f8862ace2ce1ddd43febd8bedda479bc91d09d65b71d4576e8f34ff9c6f3f615928bcb63a07f68de7043972ac57903d8d54871088362ccc15953b073ae7d887375ded009091062e67a8f81d7af6b9e54117ce28b1addea64b701795889b5806d29c9f8124093e1e330dccbe44e637d0eb762a343a3a5f6c9a228f7673d5b6b849c6eae3154b0658c4d37da3af22f7be3f610f9895dfd9eab332ba3c9a992ec8f2a8fa45a608c13893f0669162668d0eb9e8d3309a0822a3012f59a249031990bcc6496eb84e80309ce36278af4c2c38ba5982acc975dec6c66881dd853bbb79dfa4b148b7394bc30eccd3668aec613d9f9c005c0920a65d207a557ca346f87710347fe4f560b087b6f47b0c5ff457833ac93d0558661c1cde911c01a90615a1297f2ca86c8f6207cc2c8cf7d160b72538114a8a7097a97eb8e4ae106ad167275445435d60c6dccbb15724c6af186bba17cf5d772bdd225cfe615509fa9af240b9c135855433b6ff4c0dfcbe3a4b31b840c1f24baae5ed2bcc9e5097018a7e4c093c450ac2ebcd364958839831418902228ec612d75c5c84db4e82fc7b9cefdcce63ad007a08eadb2c7223e423155b38f8e031e9ae3f7e3b1e3ee8703677212c5c1fa607dc4a400dfe3eb1c691bfc4b4acda5e06f5930e54e402d4e7bf3fb3364664e9b87d3193a6e7f02c210bf9d5799bf827be66b417e31b715f514589ec4af6f054a153017784f33e4c2d2361088c8bbe501e337d8463090d567bedb18eec1d7f9308f81c9509f9ee23821d4dd131d1a2a9122899ba1885e4b34aaec615101d6c81ea8e9addecca440037caa1fd1f1881f18fb0a7bfc0b0633693b45f81ba43797b3f4549ba655abbec42e34135bb5ec39890f7298b248f800d992e7aad8be1fd782d53a173d5300610fcee91c80ba0914cce41efb7e2cc855fbd7f0ac9c15f0f8f56a4de8ac32dd36cfdf3358230f39d8c5fad59ae354b4308ab807c1c2ed5986256f3ec5eb248eafc2d566d470ca28753e0413bb7db2f8eb4249b48780d7b96bd7351fbebd22761a5830ab7fef29755fc", 0xe00}, {0x0}], 0x3) kernel console output (not intermixed with test programs): aller0> [ 1176.447431][T24872] tipc: Disabling bearer [ 1176.507893][T24877] syzkaller0: entered promiscuous mode [ 1176.524166][T24877] syzkaller0: entered allmulticast mode [ 1176.789902][T24886] netlink: 'syz.1.6663': attribute type 1 has an invalid length. [ 1176.999738][T24893] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1177.009370][T24893] syzkaller1: linktype set to 823 [ 1177.246748][T24899] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1177.484491][T24905] syzkaller0: entered promiscuous mode [ 1177.493977][T24905] syzkaller0: entered allmulticast mode [ 1177.507518][T24909] netlink: 'syz.1.6674': attribute type 1 has an invalid length. [ 1177.617131][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.940673][T24922] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6679'. [ 1178.260517][T24938] netlink: 'syz.0.6686': attribute type 1 has an invalid length. [ 1178.385218][T24942] syzkaller0: entered promiscuous mode [ 1178.390792][T24942] syzkaller0: entered allmulticast mode [ 1178.450994][T24948] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6691'. [ 1179.063628][T24947] bridge0: port 2(bridge_slave_1) entered disabled state [ 1179.072411][T24947] bridge0: port 1(bridge_slave_0) entered disabled state [ 1179.719099][T24947] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1179.785866][T24947] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1180.336533][T24947] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.346463][T24947] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.356023][T24947] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.365357][T24947] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1181.061507][T24972] netlink: 'syz.2.6699': attribute type 1 has an invalid length. [ 1181.072758][T24972] workqueue: Failed to create a rescuer kthread for wq "bond19": -EINTR [ 1181.086021][T24989] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6700'. [ 1181.353182][T25001] syzkaller0: entered promiscuous mode [ 1181.363454][T25001] syzkaller0: entered allmulticast mode [ 1181.575646][T25011] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6709'. [ 1181.635915][T25013] netlink: 'syz.3.6710': attribute type 1 has an invalid length. [ 1181.777697][T25018] syzkaller0: entered promiscuous mode [ 1181.791562][T25018] syzkaller0: entered allmulticast mode [ 1181.887843][T25022] syzkaller0: entered promiscuous mode [ 1181.893461][T25022] syzkaller0: entered allmulticast mode [ 1182.237392][T25028] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6717'. [ 1182.249458][T25028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6717'. [ 1182.345946][T25032] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6719'. [ 1182.397779][T25034] netlink: 'syz.2.6720': attribute type 1 has an invalid length. [ 1182.565427][T25040] syzkaller0: entered promiscuous mode [ 1182.570971][T25040] syzkaller0: entered allmulticast mode [ 1182.998686][T25060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6731'. [ 1183.077495][T25062] netlink: 'syz.3.6732': attribute type 1 has an invalid length. [ 1183.337069][T25074] syzkaller0: entered promiscuous mode [ 1183.342652][T25074] syzkaller0: entered allmulticast mode [ 1183.555495][T25079] syzkaller0: entered promiscuous mode [ 1183.561180][T25079] syzkaller0: entered allmulticast mode [ 1183.652247][T25084] netlink: 'syz.1.6742': attribute type 1 has an invalid length. [ 1183.786750][T25087] dvmrp6: entered allmulticast mode [ 1183.924770][T25091] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1184.194856][T25103] syzkaller0: entered promiscuous mode [ 1184.205627][T25103] syzkaller0: entered allmulticast mode [ 1184.385970][T25110] netlink: 'syz.1.6752': attribute type 1 has an invalid length. [ 1184.511356][T25113] syzkaller0: entered promiscuous mode [ 1184.524066][T25113] syzkaller0: entered allmulticast mode [ 1185.083194][T25135] netlink: 'syz.1.6763': attribute type 1 has an invalid length. [ 1185.280518][T25142] syzkaller0: entered promiscuous mode [ 1185.295198][T25142] syzkaller0: entered allmulticast mode [ 1185.302430][T25145] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1185.603622][T25153] netlink: 'syz.0.6772': attribute type 1 has an invalid length. [ 1185.611854][T25153] netlink: 'syz.0.6772': attribute type 2 has an invalid length. [ 1185.703753][T25156] syz_tun: entered allmulticast mode [ 1185.727506][T25156] dvmrp6: entered allmulticast mode [ 1185.737998][T25159] netlink: 'syz.0.6773': attribute type 1 has an invalid length. [ 1185.840923][T25154] syz_tun: left allmulticast mode [ 1186.205737][T25174] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6780'. [ 1186.531605][T25187] syz_tun: entered allmulticast mode [ 1186.541072][T25188] netlink: 'syz.3.6785': attribute type 1 has an invalid length. [ 1186.578872][T25186] syz_tun: left allmulticast mode [ 1186.599905][T25188] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6785'. [ 1186.612213][T25188] bond21: entered promiscuous mode [ 1186.617588][T25188] bond21: entered allmulticast mode [ 1186.623437][T25188] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1186.901692][T25197] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6791'. [ 1187.164632][T25212] netlink: 'syz.0.6797': attribute type 1 has an invalid length. [ 1187.298665][T25217] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6797'. [ 1187.310606][T25217] bond17: entered promiscuous mode [ 1187.328820][T25217] bond17: entered allmulticast mode [ 1187.350920][T25217] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1187.449693][T25225] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6803'. [ 1188.091922][T25253] netlink: 'syz.2.6813': attribute type 1 has an invalid length. [ 1188.158433][T25253] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6813'. [ 1188.171067][T25253] bond20: entered promiscuous mode [ 1188.176445][T25253] bond20: entered allmulticast mode [ 1188.182335][T25253] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1188.225332][T25257] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6814'. [ 1188.302961][T25259] syzkaller0: entered promiscuous mode [ 1188.320121][T25259] syzkaller0: entered allmulticast mode [ 1188.451650][T25263] dvmrp6: entered allmulticast mode [ 1188.769292][T25278] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6824'. [ 1189.009804][T25286] syzkaller0: entered promiscuous mode [ 1189.021430][T25286] syzkaller0: entered allmulticast mode [ 1189.127613][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 60 seconds [ 1189.330111][T25300] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6835'. [ 1189.511650][T25309] netlink: 'syz.2.6840': attribute type 1 has an invalid length. [ 1189.592700][T25309] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6840'. [ 1189.619826][T25309] bond21: entered promiscuous mode [ 1189.635877][T25309] bond21: entered allmulticast mode [ 1189.642266][T25309] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1190.161264][T25324] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6846'. [ 1190.328245][T25329] syzkaller0: entered promiscuous mode [ 1190.342835][T25329] syzkaller0: entered allmulticast mode [ 1190.480529][T25336] syzkaller0: entered promiscuous mode [ 1190.487801][T25336] syzkaller0: entered allmulticast mode [ 1190.638709][T25341] lo: entered allmulticast mode [ 1190.665785][T25339] lo: left allmulticast mode [ 1190.780646][T25346] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6856'. [ 1191.183019][T25367] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1191.408535][T25376] netlink: 'syz.0.6866': attribute type 1 has an invalid length. [ 1191.605519][T25376] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6866'. [ 1192.223567][T24981] IPVS: starting estimator thread 0... [ 1192.327436][T25415] IPVS: using max 20 ests per chain, 48000 per kthread [ 1192.355478][T25418] netlink: 'syz.3.6880': attribute type 1 has an invalid length. [ 1192.419974][T25419] syzkaller0: entered promiscuous mode [ 1192.434354][T25419] syzkaller0: entered allmulticast mode [ 1192.549983][T25418] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6880'. [ 1192.725018][T25432] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1192.836707][T25442] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6886'. [ 1193.835825][T11957] Bluetooth: hci3: link tx timeout [ 1193.841152][T11957] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 1193.850743][T25468] netlink: 'syz.0.6893': attribute type 1 has an invalid length. [ 1193.944732][T25472] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6893'. [ 1194.045312][T25479] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6898'. [ 1194.253405][T21415] Bluetooth: hci3: link tx timeout [ 1194.259245][T21415] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 1194.501810][T21415] Bluetooth: hci3: link tx timeout [ 1194.507358][T21415] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 1194.640919][T25502] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6906'. [ 1194.658959][T25502] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1194.667953][T25502] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1194.676787][T25502] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1194.685653][T25502] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1194.729443][T21415] Bluetooth: hci3: link tx timeout [ 1194.734904][T21415] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 1194.802037][T25507] netlink: 'syz.2.6908': attribute type 1 has an invalid length. [ 1194.996388][T25514] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6911'. [ 1195.013723][T25512] syzkaller0: entered promiscuous mode [ 1195.022413][T25512] syzkaller0: entered allmulticast mode [ 1195.156342][ T5139] udevd[5139]: worker [23194] /devices/virtual/block/nbd0 is taking a long time [ 1195.412268][T25531] netlink: 'syz.3.6918': attribute type 1 has an invalid length. [ 1195.838046][T25554] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6924'. [ 1195.929441][T21415] Bluetooth: hci3: command 0x0406 tx timeout [ 1196.188798][T25566] netlink: 'syz.0.6930': attribute type 1 has an invalid length. [ 1196.256982][T25562] lo: entered allmulticast mode [ 1196.267578][T25573] syz.3.6929 (25573) used obsolete PPPIOCDETACH ioctl [ 1196.314667][T25561] lo: left allmulticast mode [ 1196.810472][T25595] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6937'. [ 1196.955080][T25603] netlink: 'syz.1.6939': attribute type 1 has an invalid length. [ 1197.019732][T25604] syzkaller0: entered promiscuous mode [ 1197.028417][T25604] syzkaller0: entered allmulticast mode [ 1197.258111][T25608] lo: entered allmulticast mode [ 1197.275393][T25607] lo: left allmulticast mode [ 1197.522046][T25623] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1197.727879][T25632] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6949'. [ 1197.962812][T25640] syzkaller0: entered promiscuous mode [ 1197.977801][T25640] syzkaller0: entered allmulticast mode [ 1197.996291][T25642] netlink: 'syz.2.6951': attribute type 1 has an invalid length. [ 1198.022281][T25646] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6953'. [ 1198.445072][T25661] lo: entered allmulticast mode [ 1198.462112][T25659] lo: left allmulticast mode [ 1198.756669][T25677] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6962'. [ 1198.879851][T25684] netlink: 'syz.2.6963': attribute type 1 has an invalid length. [ 1199.110071][T25693] syzkaller0: entered promiscuous mode [ 1199.115923][T25693] syzkaller0: entered allmulticast mode [ 1199.568258][T25704] syzkaller0: entered promiscuous mode [ 1199.589715][T25704] syzkaller0: entered allmulticast mode [ 1199.633658][T25714] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6973'. [ 1201.949826][T25721] netlink: 'syz.2.6974': attribute type 1 has an invalid length. [ 1202.008780][T25726] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6974'. [ 1202.278234][T25737] syzkaller0: entered promiscuous mode [ 1202.289067][T25737] syzkaller0: entered allmulticast mode [ 1202.706443][T25760] netlink: 'syz.0.6985': attribute type 1 has an invalid length. [ 1202.824504][T25763] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6986'. [ 1202.925065][T25760] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6985'. [ 1203.185977][T25771] syzkaller0: entered promiscuous mode [ 1203.197475][T25771] syzkaller0: entered allmulticast mode [ 1204.294923][T21415] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1204.332432][T21415] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1204.361952][T21415] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1204.383102][T21415] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1204.412084][T21415] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1204.419838][T21415] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1206.196840][T25787] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6993'. [ 1206.243695][T18795] syz_tun (unregistering): left allmulticast mode [ 1206.297771][ T12] tipc: Left network mode [ 1206.484348][T11957] Bluetooth: hci2: command tx timeout [ 1206.958894][T25830] netlink: 'syz.1.6999': attribute type 1 has an invalid length. [ 1207.079431][T25835] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6999'. [ 1207.371862][T25842] tipc: Enabled bearer , priority 0 [ 1207.407178][T25842] syzkaller0: entered promiscuous mode [ 1207.412731][T25842] syzkaller0: entered allmulticast mode [ 1207.640385][T25842] tipc: Resetting bearer [ 1207.677257][T25841] tipc: Resetting bearer [ 1207.767996][T25841] tipc: Disabling bearer [ 1207.934681][ T12] bond1: (slave gretap1): Releasing active interface [ 1207.991405][T25803] chnl_net:caif_netlink_parms(): no params data found [ 1208.096160][T25873] netlink: 'syz.2.7010': attribute type 1 has an invalid length. [ 1208.300683][T25880] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7010'. [ 1208.571672][T11957] Bluetooth: hci2: command tx timeout [ 1208.666903][T25803] bridge0: port 1(bridge_slave_0) entered blocking state [ 1208.685559][T25803] bridge0: port 1(bridge_slave_0) entered disabled state [ 1208.692939][T25803] bridge_slave_0: entered allmulticast mode [ 1208.723256][T25803] bridge_slave_0: entered promiscuous mode [ 1208.772163][T25803] bridge0: port 2(bridge_slave_1) entered blocking state [ 1208.787935][T25803] bridge0: port 2(bridge_slave_1) entered disabled state [ 1208.824334][T25803] bridge_slave_1: entered allmulticast mode [ 1208.858404][T25803] bridge_slave_1: entered promiscuous mode [ 1208.930322][ T12] hsr_slave_0: left promiscuous mode [ 1208.945519][ T12] hsr_slave_1: left promiscuous mode [ 1208.962753][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1208.978891][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1209.005016][ T12] dummy0: left allmulticast mode [ 1209.025119][ T12] dummy0: left promiscuous mode [ 1209.030338][ T12] bridge0: port 3(dummy0) entered disabled state [ 1209.070400][ T12] bridge_slave_1: left allmulticast mode [ 1209.095126][ T12] bridge_slave_1: left promiscuous mode [ 1209.100983][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1209.143420][ T12] bridge_slave_0: left allmulticast mode [ 1209.150413][ T12] bridge_slave_0: left promiscuous mode [ 1209.160184][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1209.295928][ T12] veth1_macvtap: left promiscuous mode [ 1209.301633][ T12] veth0_macvtap: left promiscuous mode [ 1209.311883][ T12] veth1_vlan: left promiscuous mode [ 1209.324831][ T12] veth0_vlan: left promiscuous mode [ 1209.733315][ T12] bond16 (unregistering): Released all slaves [ 1209.765772][ T12] bond15 (unregistering): Released all slaves [ 1209.798599][ T12] bond14 (unregistering): Released all slaves [ 1209.823597][ T12] bond13 (unregistering): Released all slaves [ 1210.124635][ T12] bond12 (unregistering): Released all slaves [ 1210.325257][ T12] bond11 (unregistering): Released all slaves [ 1210.355002][ T12] bond10 (unregistering): Released all slaves [ 1210.391973][ T12] bond9 (unregistering): Released all slaves [ 1210.420865][ T12] bond8 (unregistering): (slave wireguard0): Releasing backup interface [ 1210.439129][ T12] wireguard0 (unregistering): left promiscuous mode [ 1210.446018][ T12] wireguard0 (unregistering): left allmulticast mode [ 1210.591788][ T12] bond8 (unregistering): left allmulticast mode [ 1210.600366][ T12] bond8 (unregistering): Released all slaves [ 1210.648573][T11957] Bluetooth: hci2: command tx timeout [ 1210.760456][ T12] bond7 (unregistering): Released all slaves [ 1210.912621][ T12] bond6 (unregistering): Released all slaves [ 1210.944387][ T12] bond5 (unregistering): (slave geneve2): Releasing active interface [ 1210.952548][ T12] geneve2 (unregistering): left promiscuous mode [ 1211.131270][ T12] bond5 (unregistering): Released all slaves [ 1211.161783][ T12] bond4 (unregistering): Released all slaves [ 1211.179260][ T12] bond3 (unregistering): Released all slaves [ 1211.198998][ T12] bond2 (unregistering): Released all slaves [ 1211.220338][ T12] bond1 (unregistering): Released all slaves [ 1211.357379][ T12] pimreg (unregistering): left allmulticast mode [ 1211.937529][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1211.989802][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1212.046694][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1212.099511][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1212.536239][ T12] bond0 (unregistering): Released all slaves [ 1212.646259][T25924] netlink: 'syz.1.7020': attribute type 1 has an invalid length. [ 1212.676517][T25924] workqueue: Failed to create a rescuer kthread for wq "bond29": -EINTR [ 1212.692217][T25929] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7020'. [ 1212.727130][T11957] Bluetooth: hci2: command tx timeout [ 1212.737191][T25944] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7023'. [ 1212.966475][T25803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1213.003157][T25803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1213.133380][T25803] team0: Port device team_slave_0 added [ 1213.169318][T25803] team0: Port device team_slave_1 added [ 1213.310030][T25803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1213.335401][T25803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1213.414354][T25803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1213.429657][T25803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1213.437688][T25803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1213.489197][T25803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1213.668122][T25803] hsr_slave_0: entered promiscuous mode [ 1213.682444][T25803] hsr_slave_1: entered promiscuous mode [ 1213.708917][T25803] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1213.719361][T25803] Cannot create hsr debugfs directory [ 1213.818943][ T12] IPVS: stop unused estimator thread 0... [ 1214.229066][T25981] dvmrp6: entered allmulticast mode [ 1215.219690][ T12] tipc: Left network mode [ 1215.290366][T25803] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1215.320959][T25803] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1215.433371][T25803] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1215.450353][T25803] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1215.779515][T25803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1215.923467][T25803] 8021q: adding VLAN 0 to HW filter on device team0 [ 1216.039547][ T7995] bridge0: port 1(bridge_slave_0) entered blocking state [ 1216.046797][ T7995] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1216.099745][ T7995] bridge0: port 2(bridge_slave_1) entered blocking state [ 1216.107005][ T7995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1216.491730][ T12] dvmrp6 (unregistering): left allmulticast mode [ 1216.533371][T26058] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7054'. [ 1216.636336][T25803] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1216.869990][ T12] hsr_slave_0: left promiscuous mode [ 1216.882287][ T12] hsr_slave_1: left promiscuous mode [ 1216.890585][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1216.899078][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1216.907849][ T12] bridge_slave_1: left allmulticast mode [ 1216.913569][ T12] bridge_slave_1: left promiscuous mode [ 1216.919922][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1216.933396][ T12] bridge_slave_0: left promiscuous mode [ 1216.942301][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1216.965698][ T12] bond23 (unregistering): Released all slaves [ 1216.988161][ T12] bond22 (unregistering): Released all slaves [ 1217.109468][T26069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1217.210878][ T12] bond21 (unregistering): Released all slaves [ 1217.237052][ T12] bond20 (unregistering): Released all slaves [ 1217.260698][ T12] bond19 (unregistering): Released all slaves [ 1217.647157][ T12] bond18 (unregistering): Released all slaves [ 1217.915446][ T12] bond17 (unregistering): Released all slaves [ 1218.133965][ T12] bond16 (unregistering): Released all slaves [ 1218.312885][ T12] bond15 (unregistering): Released all slaves [ 1218.499813][ T12] bond14 (unregistering): Released all slaves [ 1218.691561][ T12] bond13 (unregistering): Released all slaves [ 1218.966568][ T12] bond12 (unregistering): Released all slaves [ 1219.112261][ T12] bond11 (unregistering): Released all slaves [ 1219.208392][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 90 seconds [ 1219.274637][ T12] bond10 (unregistering): Released all slaves [ 1219.422761][ T12] bond9 (unregistering): Released all slaves [ 1219.571537][ T12] bond8 (unregistering): Released all slaves [ 1219.725417][ T12] bond7 (unregistering): Released all slaves [ 1219.877852][ T12] bond6 (unregistering): Released all slaves [ 1220.030738][ T12] bond5 (unregistering): Released all slaves [ 1220.169415][ T12] bond4 (unregistering): Released all slaves [ 1220.315825][ T12] bond3 (unregistering): Released all slaves [ 1220.458287][ T12] bond2 (unregistering): Released all slaves [ 1220.604756][ T12] bond1 (unregistering): Released all slaves [ 1221.168004][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1221.223765][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1221.279970][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1221.340741][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1221.751457][ T12] bond0 (unregistering): Released all slaves [ 1221.872698][T26081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7063'. [ 1222.190907][T25803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1222.312566][T25803] veth0_vlan: entered promiscuous mode [ 1222.358893][T25803] veth1_vlan: entered promiscuous mode [ 1222.478689][T25803] veth0_macvtap: entered promiscuous mode [ 1222.490915][T25803] veth1_macvtap: entered promiscuous mode [ 1222.580194][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.600139][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.622326][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.636560][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.653525][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.670123][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.683271][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.695049][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.705512][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.716858][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.729055][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1222.741490][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.762787][T25803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1222.776462][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.800478][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.811997][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.823374][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.833749][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.851900][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.863406][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.874633][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.885723][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.905866][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.920005][T25803] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1222.931845][T25803] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1222.944398][T25803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1222.969288][T25803] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.979561][T25803] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.989198][T25803] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.998393][T25803] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1223.218959][T15344] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1223.245002][T15344] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1223.298170][T15332] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1223.309775][T15332] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1223.443022][T26123] syzkaller0: entered promiscuous mode [ 1223.448797][T26123] syzkaller0: entered allmulticast mode [ 1223.850010][T26133] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7082'. [ 1224.804898][T26147] dvmrp6: entered allmulticast mode [ 1225.239653][T26164] syzkaller0: entered promiscuous mode [ 1225.254222][T26164] syzkaller0: entered allmulticast mode [ 1225.905231][T26192] syzkaller0: entered promiscuous mode [ 1225.910755][T26192] syzkaller0: entered allmulticast mode [ 1226.575115][T26212] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7117'. [ 1226.625370][T26214] syzkaller0: entered promiscuous mode [ 1226.631192][T26214] syzkaller0: entered allmulticast mode [ 1226.826829][T26222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7123'. [ 1227.233765][T26238] netlink: 56 bytes leftover after parsing attributes in process `syz.2.7129'. [ 1227.255483][T26238] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7129'. [ 1227.451612][T26247] syzkaller0: entered promiscuous mode [ 1227.457500][T26247] syzkaller0: entered allmulticast mode [ 1227.895339][T26263] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7140'. [ 1227.943352][T26267] netlink: 56 bytes leftover after parsing attributes in process `syz.0.7141'. [ 1227.953614][T26267] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7141'. [ 1228.168452][T26274] syzkaller0: entered promiscuous mode [ 1228.179993][T26274] syzkaller0: entered allmulticast mode [ 1229.835368][T21415] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1229.849231][T21415] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1229.857334][T21415] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1229.869099][T21415] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1229.877878][T21415] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1229.885564][T21415] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1229.946900][T19179] syz_tun (unregistering): left allmulticast mode [ 1230.188937][T26321] lo speed is unknown, defaulting to 1000 [ 1230.198607][T26321] lo speed is unknown, defaulting to 1000 [ 1230.213865][T26321] lo speed is unknown, defaulting to 1000 [ 1230.251033][T26321] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 1230.365443][T26312] chnl_net:caif_netlink_parms(): no params data found [ 1230.390337][T26321] lo speed is unknown, defaulting to 1000 [ 1230.444432][T26321] lo speed is unknown, defaulting to 1000 [ 1230.479117][T26321] lo speed is unknown, defaulting to 1000 [ 1230.525073][T26321] lo speed is unknown, defaulting to 1000 [ 1230.589299][T26321] lo speed is unknown, defaulting to 1000 [ 1230.605075][T26312] bridge0: port 1(bridge_slave_0) entered blocking state [ 1230.612358][T26312] bridge0: port 1(bridge_slave_0) entered disabled state [ 1230.633431][T26312] bridge_slave_0: entered allmulticast mode [ 1230.642719][T26312] bridge_slave_0: entered promiscuous mode [ 1230.652658][T26312] bridge0: port 2(bridge_slave_1) entered blocking state [ 1230.659977][T26312] bridge0: port 2(bridge_slave_1) entered disabled state [ 1230.667785][T26312] bridge_slave_1: entered allmulticast mode [ 1230.675457][T26312] bridge_slave_1: entered promiscuous mode [ 1230.685085][T26321] lo speed is unknown, defaulting to 1000 [ 1230.717974][T26321] lo speed is unknown, defaulting to 1000 [ 1230.728124][T26312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1230.737902][T26321] lo speed is unknown, defaulting to 1000 [ 1230.745198][T26312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1230.814931][T26312] team0: Port device team_slave_0 added [ 1230.832408][T26312] team0: Port device team_slave_1 added [ 1230.888698][T26312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1230.902076][T26312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1230.934343][T26312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1230.967026][T26312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1230.982337][T26312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1231.008786][T26312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1231.073743][T26312] hsr_slave_0: entered promiscuous mode [ 1231.085852][T26312] hsr_slave_1: entered promiscuous mode [ 1231.093081][T26312] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1231.100930][T26312] Cannot create hsr debugfs directory [ 1231.308627][T26312] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.320464][T26312] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.416928][T26312] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.429158][T26312] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.599476][T26312] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.612495][T26312] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.748997][T26312] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1231.771673][T26312] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1231.934532][T11957] Bluetooth: hci0: command tx timeout [ 1231.985922][T26312] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1231.997326][T26312] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1232.018960][T26312] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1232.042751][T26312] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1232.256892][T26312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1232.289577][T26312] 8021q: adding VLAN 0 to HW filter on device team0 [ 1232.308734][ T3466] bridge0: port 1(bridge_slave_0) entered blocking state [ 1232.315987][ T3466] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1232.339343][ T3466] bridge0: port 2(bridge_slave_1) entered blocking state [ 1232.346622][ T3466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1232.459101][T26369] syzkaller0: entered promiscuous mode [ 1232.471721][T26369] syzkaller0: entered allmulticast mode [ 1232.789092][T26312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1232.873494][T26312] veth0_vlan: entered promiscuous mode [ 1232.911053][T26312] veth1_vlan: entered promiscuous mode [ 1232.978818][T26312] veth0_macvtap: entered promiscuous mode [ 1232.999129][T26312] veth1_macvtap: entered promiscuous mode [ 1233.037185][T26385] lo: entered allmulticast mode [ 1233.046255][T26384] lo: left allmulticast mode [ 1233.057094][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.078515][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.097155][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.108461][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.119699][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.131401][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.149849][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.169984][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.183257][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.208240][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.230202][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.247987][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.258446][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1233.272739][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.290904][T26312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1233.311559][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.322640][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.333402][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.344366][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.356892][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.368362][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.380591][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.391960][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.403172][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.421923][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.431871][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.442871][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.453724][T26312] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1233.467434][T26312] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1233.479717][T26312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1233.500553][T26312] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1233.510344][T26312] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1233.520176][T26312] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1233.529987][T26312] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1233.712465][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1233.730540][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1233.798638][T15336] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1233.807774][T15336] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1233.952650][T26395] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7193'. [ 1233.971967][T26398] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7157'. [ 1233.985206][T26396] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7194'. [ 1234.003908][T11957] Bluetooth: hci0: command tx timeout [ 1234.352945][T26411] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7200'. [ 1234.456084][T26417] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7203'. [ 1234.643437][T26422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7206'. [ 1234.978416][T26436] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7212'. [ 1235.156765][T26439] nbd: must specify an index to disconnect [ 1235.169821][T26442] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7215'. [ 1235.428757][T26453] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7220'. [ 1235.592779][T26459] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7223'. [ 1236.084444][T11957] Bluetooth: hci0: command tx timeout [ 1236.147578][T26484] syz_tun: entered allmulticast mode [ 1236.156997][T26483] syz_tun: left allmulticast mode [ 1236.654812][T26508] lo: entered allmulticast mode [ 1236.666294][T26506] lo: left allmulticast mode [ 1237.065483][T26524] netlink: 'syz.3.7249': attribute type 19 has an invalid length. [ 1237.258199][T26534] syz_tun: entered allmulticast mode [ 1237.280383][T26533] syz_tun: left allmulticast mode [ 1237.446364][T26542] netlink: 'syz.3.7259': attribute type 1 has an invalid length. [ 1237.458821][T26542] netlink: 'syz.3.7259': attribute type 2 has an invalid length. [ 1237.554438][T26548] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 1238.165363][T11957] Bluetooth: hci0: command tx timeout [ 1238.852743][T26598] lo: entered allmulticast mode [ 1239.057468][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.073633][T26608] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 1239.142301][T26611] __nla_validate_parse: 3 callbacks suppressed [ 1239.142321][T26611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7284'. [ 1239.713763][T26635] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7296'. [ 1239.743985][T26635] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1239.751922][T26635] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1239.758491][T26635] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1239.765030][T26635] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1239.771556][T26635] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1239.778110][T26635] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1239.784722][T26635] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1239.791187][T26635] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1239.797812][T26635] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1239.804444][T26635] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1240.404059][T26659] syz_tun: entered allmulticast mode [ 1240.577595][T26667] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 1241.222666][T26699] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7326'. [ 1241.915044][T26720] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7336'. [ 1242.258315][ T3466] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.286342][T26724] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7337'. [ 1242.342920][T21415] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1242.362768][T21415] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1242.372403][T21415] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1242.383180][T21415] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1242.399675][T21415] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1242.408427][T21415] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1242.513664][ T3466] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.537903][T26736] netlink: 'syz.1.7341': attribute type 13 has an invalid length. [ 1242.556487][T26736] netlink: 24643 bytes leftover after parsing attributes in process `syz.1.7341'. [ 1242.637608][ T3466] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.807949][ T3466] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1242.841314][T26731] lo speed is unknown, defaulting to 1000 [ 1242.858734][T26744] dvmrp6: entered allmulticast mode [ 1243.832756][T26763] netlink: 100 bytes leftover after parsing attributes in process `syz.3.7353'. [ 1244.497154][T21415] Bluetooth: hci3: command tx timeout [ 1244.608251][ T3466] tipc: Left network mode [ 1244.706047][T26731] chnl_net:caif_netlink_parms(): no params data found [ 1245.300500][T26731] bridge0: port 1(bridge_slave_0) entered blocking state [ 1245.319778][T26731] bridge0: port 1(bridge_slave_0) entered disabled state [ 1245.354123][T26731] bridge_slave_0: entered allmulticast mode [ 1245.361842][T26731] bridge_slave_0: entered promiscuous mode [ 1245.432114][T26731] bridge0: port 2(bridge_slave_1) entered blocking state [ 1245.447989][T26731] bridge0: port 2(bridge_slave_1) entered disabled state [ 1245.464822][T26731] bridge_slave_1: entered allmulticast mode [ 1245.481897][T26731] bridge_slave_1: entered promiscuous mode [ 1245.681337][T26811] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7365'. [ 1245.728328][T26731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1245.757678][T26731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1245.862871][ T3466] dvmrp6 (unregistering): left allmulticast mode [ 1245.991678][T26731] team0: Port device team_slave_0 added [ 1246.019197][T26731] team0: Port device team_slave_1 added [ 1246.305628][T26731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1246.322836][T26731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1246.351516][T26731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1246.365361][T26731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1246.372350][T26731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1246.401788][T26731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1246.488343][ T3466] hsr_slave_0: left promiscuous mode [ 1246.517214][ T3466] hsr_slave_1: left promiscuous mode [ 1246.523555][ T3466] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1246.531599][ T3466] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1246.543075][ T3466] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1246.552901][ T3466] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1246.563219][ T3466] bridge_slave_1: left allmulticast mode [ 1246.572408][ T3466] bridge_slave_1: left promiscuous mode [ 1246.578727][T21415] Bluetooth: hci3: command tx timeout [ 1246.591001][ T3466] bridge0: port 2(bridge_slave_1) entered disabled state [ 1246.601924][ T3466] bridge_slave_0: left allmulticast mode [ 1246.607940][ T3466] bridge_slave_0: left promiscuous mode [ 1246.614508][ T3466] bridge0: port 1(bridge_slave_0) entered disabled state [ 1246.725487][ T3466] veth1_macvtap: left promiscuous mode [ 1246.731714][ T3466] veth0_macvtap: left promiscuous mode [ 1246.740064][ T3466] veth1_vlan: left promiscuous mode [ 1246.745739][ T3466] veth0_vlan: left promiscuous mode [ 1246.962176][ T9] infiniband syz_device_name_32_chars_1234567: ib_query_port failed (-19) [ 1247.030614][ T3466] bond26 (unregistering): Released all slaves [ 1247.047233][ T3466] bond25 (unregistering): Released all slaves [ 1247.065608][ T3466] bond24 (unregistering): Released all slaves [ 1247.091059][ T3466] bond23 (unregistering): Released all slaves [ 1247.121063][ T3466] bond22 (unregistering): Released all slaves [ 1247.286662][ T3466] bond21 (unregistering): Released all slaves [ 1247.485098][ T3466] bond20 (unregistering): Released all slaves [ 1247.503098][ T3466] bond19 (unregistering): Released all slaves [ 1247.837412][ T3466] bond18 (unregistering): Released all slaves [ 1247.929240][ T3466] bond17 (unregistering): Released all slaves [ 1247.947941][ T3466] bond16 (unregistering): Released all slaves [ 1248.256440][ T3466] bond15 (unregistering): Released all slaves [ 1248.409484][ T3466] bond14 (unregistering): Released all slaves [ 1248.620389][ T3466] bond13 (unregistering): Released all slaves [ 1248.651940][T21415] Bluetooth: hci3: command tx timeout [ 1248.820599][ T3466] bond12 (unregistering): Released all slaves [ 1248.980092][ T3466] bond11 (unregistering): Released all slaves [ 1249.136900][ T3466] bond10 (unregistering): Released all slaves [ 1249.306629][ T3466] bond9 (unregistering): Released all slaves [ 1249.315481][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 120 seconds [ 1249.501178][ T3466] bond8 (unregistering): Released all slaves [ 1249.661699][ T3466] bond7 (unregistering): Released all slaves [ 1249.827577][ T3466] bond6 (unregistering): Released all slaves [ 1249.986598][ T3466] bond5 (unregistering): Released all slaves [ 1250.137268][ T3466] bond4 (unregistering): Released all slaves [ 1250.300083][ T3466] bond3 (unregistering): Released all slaves [ 1250.451517][ T3466] bond2 (unregistering): Released all slaves [ 1250.613740][ T3466] bond1 (unregistering): Released all slaves [ 1250.731043][T21415] Bluetooth: hci3: command tx timeout [ 1251.210151][ T3466] team0 (unregistering): Port device team_slave_1 removed [ 1251.265884][ T3466] team0 (unregistering): Port device team_slave_0 removed [ 1251.318883][ T3466] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1251.373333][ T3466] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1251.789822][ T3466] bond0 (unregistering): Released all slaves [ 1251.878235][ T3466] lo (unregistering): left allmulticast mode [ 1252.320422][T26731] hsr_slave_0: entered promiscuous mode [ 1252.378632][T26731] hsr_slave_1: entered promiscuous mode [ 1252.394675][T26731] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1252.402312][T26731] Cannot create hsr debugfs directory [ 1252.851231][T26885] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1252.960620][ T3466] IPVS: stop unused estimator thread 0... [ 1253.164056][T26888] syzkaller0: entered promiscuous mode [ 1253.179547][T26888] syzkaller0: entered allmulticast mode [ 1253.738836][T26901] netlink: 56 bytes leftover after parsing attributes in process `syz.0.7391'. [ 1253.748254][T26901] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7391'. [ 1253.851052][T26904] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7392'. [ 1256.191692][T26902] syz_tun: entered allmulticast mode [ 1256.201129][T26902] syz_tun: left allmulticast mode [ 1256.615962][T26731] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1256.759978][T26731] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1256.790207][T26731] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1256.818237][T26731] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1257.064527][T26731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1257.098416][T26731] 8021q: adding VLAN 0 to HW filter on device team0 [ 1257.113592][T15336] bridge0: port 1(bridge_slave_0) entered blocking state [ 1257.120839][T15336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1257.174190][T15344] bridge0: port 2(bridge_slave_1) entered blocking state [ 1257.181424][T15344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1257.259597][T26944] netlink: 120 bytes leftover after parsing attributes in process `syz.3.7402'. [ 1257.632702][T26950] syzkaller0: entered promiscuous mode [ 1257.646882][T26950] syzkaller0: entered allmulticast mode [ 1257.677191][T26955] syz_tun: entered allmulticast mode [ 1257.693619][T26954] syz_tun: left allmulticast mode [ 1260.418650][T26975] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1260.526049][T26731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1260.667163][T26731] veth0_vlan: entered promiscuous mode [ 1260.696841][T26731] veth1_vlan: entered promiscuous mode [ 1260.789511][T26731] veth0_macvtap: entered promiscuous mode [ 1260.812058][T26731] veth1_macvtap: entered promiscuous mode [ 1260.871971][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1260.899793][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.913409][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1260.924392][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.935778][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1260.964166][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.983949][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1261.003926][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.018826][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1261.040106][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.060296][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1261.096974][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.107334][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1261.126404][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.149634][T26731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1261.199960][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.240388][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.263943][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.277048][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.300516][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.320511][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.332040][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.353518][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.365797][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.376760][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.387109][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.398537][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.411983][T26731] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1261.424005][T26731] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1261.437159][T26731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1261.481774][T26731] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.534267][T26731] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.543056][T26731] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.594175][T26731] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.839400][T15332] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1261.882208][T15332] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1261.892050][T27012] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7418'. [ 1261.963901][T27013] syzkaller0: entered promiscuous mode [ 1261.969450][T27013] syzkaller0: entered allmulticast mode [ 1263.747011][T27045] netlink: 120 bytes leftover after parsing attributes in process `syz.3.7426'. [ 1265.652081][T27048] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7428'. [ 1265.654302][T21201] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1265.669669][T21201] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1266.307537][T27073] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7438'. [ 1266.670786][T11957] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1266.681661][T11957] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1266.691498][T11957] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1266.711995][T11957] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1266.724332][T11957] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1266.741497][T11957] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1266.940954][T19517] syz_tun (unregistering): left allmulticast mode [ 1267.259071][ T3466] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.431567][T27094] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7446'. [ 1267.979279][ T3466] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.137693][ T3466] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.252031][ T3466] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.397617][T27076] chnl_net:caif_netlink_parms(): no params data found [ 1268.692320][T27076] bridge0: port 1(bridge_slave_0) entered blocking state [ 1268.709767][T27076] bridge0: port 1(bridge_slave_0) entered disabled state [ 1268.723602][T27076] bridge_slave_0: entered allmulticast mode [ 1268.744651][T27076] bridge_slave_0: entered promiscuous mode [ 1268.754275][T27076] bridge0: port 2(bridge_slave_1) entered blocking state [ 1268.761451][T27076] bridge0: port 2(bridge_slave_1) entered disabled state [ 1268.768973][T27076] bridge_slave_1: entered allmulticast mode [ 1268.776793][T27076] bridge_slave_1: entered promiscuous mode [ 1268.804509][T11957] Bluetooth: hci4: command tx timeout [ 1269.109391][T27140] netlink: 120 bytes leftover after parsing attributes in process `syz.1.7465'. [ 1269.371072][T27076] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1269.412403][T27076] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1269.468001][ T3466] tipc: Left network mode [ 1269.532712][T27076] team0: Port device team_slave_0 added [ 1269.559365][T27076] team0: Port device team_slave_1 added [ 1269.776336][T27076] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1269.783544][T27076] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1269.829025][T27076] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1269.868105][T27076] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1269.885310][T27076] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1269.928157][T27076] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1270.381644][T27076] hsr_slave_0: entered promiscuous mode [ 1270.428869][T27076] hsr_slave_1: entered promiscuous mode [ 1270.464461][T27076] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1270.484832][T27076] Cannot create hsr debugfs directory [ 1270.884815][T11957] Bluetooth: hci4: command tx timeout [ 1271.417088][ T3466] dvmrp6 (unregistering): left allmulticast mode [ 1271.609163][T27211] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7488'. [ 1271.666995][T27213] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7489'. [ 1272.099919][ T3466] hsr_slave_0: left promiscuous mode [ 1272.111789][ T3466] hsr_slave_1: left promiscuous mode [ 1272.134577][ T3466] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1272.146243][ T3466] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1272.180320][ T3466] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1272.195056][ T3466] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1272.215623][ T3466] bridge_slave_1: left allmulticast mode [ 1272.222524][ T3466] bridge_slave_1: left promiscuous mode [ 1272.235331][ T3466] bridge0: port 2(bridge_slave_1) entered disabled state [ 1272.259849][ T3466] bridge_slave_0: left allmulticast mode [ 1272.273910][ T3466] bridge_slave_0: left promiscuous mode [ 1272.288933][ T3466] bridge0: port 1(bridge_slave_0) entered disabled state [ 1272.458267][ T3466] veth1_macvtap: left promiscuous mode [ 1272.464814][ T3466] veth0_macvtap: left promiscuous mode [ 1272.470516][ T3466] veth1_vlan: left promiscuous mode [ 1272.476732][ T3466] veth0_vlan: left promiscuous mode [ 1272.907586][T27252] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7502'. [ 1272.931214][ T3466] bond21 (unregistering): Released all slaves [ 1272.952074][ T3466] bond20 (unregistering): Released all slaves [ 1272.967156][T11957] Bluetooth: hci4: command tx timeout [ 1272.994805][ T3466] bond19 (unregistering): Released all slaves [ 1273.035579][ T3466] bond18 (unregistering): Released all slaves [ 1273.305303][ T3466] bond17 (unregistering): Released all slaves [ 1273.326409][ T3466] bond16 (unregistering): Released all slaves [ 1273.348297][ T3466] bond15 (unregistering): Released all slaves [ 1273.903386][ T3466] bond14 (unregistering): Released all slaves [ 1274.152265][ T3466] bond13 (unregistering): Released all slaves [ 1274.329198][ T3466] bond12 (unregistering): Released all slaves [ 1274.611337][ T3466] bond11 (unregistering): Released all slaves [ 1274.850164][ T3466] bond10 (unregistering): Released all slaves [ 1275.053982][T11957] Bluetooth: hci4: command tx timeout [ 1275.122739][ T3466] bond9 (unregistering): Released all slaves [ 1275.244988][T27294] netlink: 120 bytes leftover after parsing attributes in process `syz.3.7523'. [ 1275.427714][ T3466] bond8 (unregistering): Released all slaves [ 1275.593597][ T3466] bond7 (unregistering): Released all slaves [ 1275.780911][ T3466] bond6 (unregistering): Released all slaves [ 1275.967379][ T3466] bond5 (unregistering): Released all slaves [ 1276.133219][ T3466] bond4 (unregistering): Released all slaves [ 1276.323292][ T3466] bond3 (unregistering): Released all slaves [ 1276.638451][ T3466] bond2 (unregistering): Released all slaves [ 1276.764439][T27310] netlink: 120 bytes leftover after parsing attributes in process `syz.3.7531'. [ 1276.923544][ T3466] bond1 (unregistering): Released all slaves [ 1277.070601][T27318] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7535'. [ 1277.082511][T27318] unsupported nla_type 34 [ 1277.881632][ T3466] team0 (unregistering): Port device team_slave_1 removed [ 1277.957808][ T3466] team0 (unregistering): Port device team_slave_0 removed [ 1278.023014][ T3466] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1278.114319][ T3466] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1278.205247][T27342] netlink: 'syz.3.7547': attribute type 9 has an invalid length. [ 1278.826882][ T3466] bond0 (unregistering): Released all slaves [ 1279.180349][T27242] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7498'. [ 1279.314854][T27282] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7517'. [ 1279.380777][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 150 seconds [ 1279.771267][T27076] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1279.835724][T27076] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1279.908732][T27076] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1279.957939][T27076] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1280.100878][T27389] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7567'. [ 1280.325635][T27400] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7571'. [ 1280.365672][ T3466] IPVS: stop unused estimator thread 0... [ 1280.465434][T27076] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1280.548875][T27076] 8021q: adding VLAN 0 to HW filter on device team0 [ 1280.616155][T21201] bridge0: port 1(bridge_slave_0) entered blocking state [ 1280.623396][T21201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1280.702820][T15332] bridge0: port 2(bridge_slave_1) entered blocking state [ 1280.710120][T15332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1280.854185][T27415] netlink: 'syz.2.7576': attribute type 19 has an invalid length. [ 1281.074425][T27425] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7579'. [ 1281.431184][T27076] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1281.555359][T27076] veth0_vlan: entered promiscuous mode [ 1281.587132][T27076] veth1_vlan: entered promiscuous mode [ 1281.678160][T27076] veth0_macvtap: entered promiscuous mode [ 1281.701896][T27076] veth1_macvtap: entered promiscuous mode [ 1281.766184][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1281.786162][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1281.817084][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1281.843855][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1281.864244][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1281.890944][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1281.912857][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1281.941095][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1281.961951][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1281.982707][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.003484][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1282.034191][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.054351][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1282.073851][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.097684][T27076] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1282.154475][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.193938][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.213814][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.264022][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.301301][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.328644][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.361365][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.380475][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.391911][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.414486][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.433717][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.456734][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.477958][T27076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1282.501184][T27076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1282.517064][T27076] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1282.550459][T27465] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7590'. [ 1282.757759][T27076] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1282.787803][T27076] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1282.813893][T27076] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1282.839172][T27076] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1282.877286][T27476] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1283.142834][T15336] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1283.158153][T15336] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1283.255994][T21201] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1283.295572][T21201] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1283.649382][T27503] syzkaller0: entered promiscuous mode [ 1283.655415][T27503] syzkaller0: entered allmulticast mode [ 1283.663087][T27507] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7602'. [ 1286.504896][T27521] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1286.527104][T27539] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7613'. [ 1286.977319][T27555] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7620'. [ 1287.042908][T27561] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7623'. [ 1287.075863][T27561] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7623'. [ 1287.172859][T27565] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7625'. [ 1287.405295][T27567] syzkaller0: entered promiscuous mode [ 1287.428492][T27567] syzkaller0: entered allmulticast mode [ 1287.721289][T27589] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7635'. [ 1287.799945][T27586] can: request_module (can-proto-5) failed. [ 1288.747174][T27612] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7644'. [ 1290.879422][T27599] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7640'. [ 1291.042640][T27639] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7654'. [ 1291.485151][T27651] syzkaller0: entered promiscuous mode [ 1291.503942][T27651] syzkaller0: entered allmulticast mode [ 1291.554152][T27654] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1291.749162][T27667] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7667'. [ 1292.584651][T27681] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7673'. [ 1293.652440][T27708] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7685'. [ 1294.885162][T27697] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1294.893109][T27718] netlink: 'syz.0.7690': attribute type 21 has an invalid length. [ 1294.925413][T27718] IPv6: NLM_F_CREATE should be specified when creating new route [ 1294.965084][T27718] netlink: 'syz.0.7690': attribute type 1 has an invalid length. [ 1295.066046][T27722] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7694'. [ 1295.419910][T27740] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1295.532169][T27745] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7704'. [ 1295.605091][T27741] syzkaller0: entered promiscuous mode [ 1295.610832][T27741] syzkaller0: entered allmulticast mode [ 1296.196631][T27765] netlink: 120 bytes leftover after parsing attributes in process `syz.2.7713'. [ 1298.620427][T27762] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1298.807235][T27792] netlink: 120 bytes leftover after parsing attributes in process `syz.1.7722'. [ 1299.024028][T27805] netlink: 108 bytes leftover after parsing attributes in process `syz.2.7730'. [ 1299.260171][T27813] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1299.446558][T27823] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7738'. [ 1299.557198][T27827] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7740'. [ 1300.032847][T27850] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1300.067012][T27852] netlink: 'syz.0.7751': attribute type 1 has an invalid length. [ 1300.498396][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.849315][T27887] netlink: 120 bytes leftover after parsing attributes in process `syz.0.7767'. [ 1300.978384][T27891] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7771'. [ 1301.332636][T27906] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 1301.385309][T27912] netlink: 4292 bytes leftover after parsing attributes in process `syz.3.7779'. [ 1301.660567][T27923] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7785'. [ 1302.328560][T27952] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7799'. [ 1302.902927][T27979] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7812'. [ 1303.877716][T28024] __nla_validate_parse: 3 callbacks suppressed [ 1303.877737][T28024] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7834'. [ 1304.417764][T28052] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7847'. [ 1304.880943][T28070] netlink: 6692 bytes leftover after parsing attributes in process `syz.3.7857'. [ 1304.985333][T28074] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7858'. [ 1305.275545][T28080] syzkaller0: entered promiscuous mode [ 1305.301296][T28080] syzkaller0: entered allmulticast mode [ 1305.368864][T28092] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7866'. [ 1305.528165][T28097] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7869'. [ 1306.821960][T28119] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7877'. [ 1306.882590][T28121] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7878'. [ 1306.946879][T28123] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 1308.469845][T28143] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7887'. [ 1308.920134][T28160] syzkaller0: entered promiscuous mode [ 1308.927071][T28160] syzkaller0: entered allmulticast mode [ 1309.092066][T28169] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7897'. [ 1309.184164][T28172] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7899'. [ 1309.450315][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 180 seconds [ 1309.732012][T28189] loop2: detected capacity change from 0 to 764 [ 1311.451561][T28221] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7919'. [ 1311.477041][T28223] loop0: detected capacity change from 0 to 512 [ 1311.490242][T28223] FAT-fs (loop0): Directory bread(block 199916) failed [ 1311.508242][T28223] FAT-fs (loop0): Directory bread(block 199917) failed [ 1311.515701][T28223] FAT-fs (loop0): Directory bread(block 199918) failed [ 1311.572052][T28223] FAT-fs (loop0): Directory bread(block 199919) failed [ 1311.580115][T28223] FAT-fs (loop0): Directory bread(block 199920) failed [ 1311.587516][T28223] FAT-fs (loop0): Directory bread(block 199921) failed [ 1311.607754][T28223] FAT-fs (loop0): Directory bread(block 199922) failed [ 1311.615700][T28223] FAT-fs (loop0): Directory bread(block 199923) failed [ 1311.701559][T28223] FAT-fs (loop0): FAT read failed (blocknr 128) [ 1312.702474][T28245] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7928'. [ 1313.299855][T28258] netlink: 'syz.0.7935': attribute type 9 has an invalid length. [ 1313.548513][T28265] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7938'. [ 1314.761865][T28293] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7949'. [ 1315.069684][T28297] syzkaller0: entered promiscuous mode [ 1315.082875][T28297] syzkaller0: entered allmulticast mode [ 1317.690247][T28333] overlayfs: lower data-only dirs require metacopy support. [ 1318.595881][T28348] loop1: detected capacity change from 0 to 512 [ 1318.642849][T28348] FAT-fs (loop1): Directory bread(block 199916) failed [ 1318.680760][T28348] FAT-fs (loop1): Directory bread(block 199917) failed [ 1318.713986][T28348] FAT-fs (loop1): Directory bread(block 199918) failed [ 1318.724377][T28348] FAT-fs (loop1): Directory bread(block 199919) failed [ 1318.745263][T28348] FAT-fs (loop1): Directory bread(block 199920) failed [ 1318.762597][T28348] FAT-fs (loop1): Directory bread(block 199921) failed [ 1318.785266][T28348] FAT-fs (loop1): Directory bread(block 199922) failed [ 1318.804951][T28348] FAT-fs (loop1): Directory bread(block 199923) failed [ 1318.936516][T28348] FAT-fs (loop1): FAT read failed (blocknr 128) [ 1319.083201][T28358] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7977'. [ 1319.384106][T28364] syzkaller0: entered promiscuous mode [ 1319.404757][T28364] syzkaller0: entered allmulticast mode [ 1320.649649][T28400] overlayfs: lower data-only dirs require metacopy support. [ 1323.054818][T28427] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1323.494129][T28442] syzkaller0: entered promiscuous mode [ 1323.504748][T28442] syzkaller0: entered allmulticast mode [ 1324.501051][T28462] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1326.463089][T28448] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8012'. [ 1326.900516][T28479] FAULT_INJECTION: forcing a failure. [ 1326.900516][T28479] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1326.933443][T28479] CPU: 1 PID: 28479 Comm: syz.0.8025 Not tainted syzkaller #0 [ 1326.941082][T28479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1326.951193][T28479] Call Trace: [ 1326.954515][T28479] [ 1326.957486][T28479] dump_stack_lvl+0x18c/0x250 [ 1326.962231][T28479] ? show_regs_print_info+0x20/0x20 [ 1326.967533][T28479] ? load_image+0x420/0x420 [ 1326.972106][T28479] ? __lock_acquire+0x7d80/0x7d80 [ 1326.977203][T28479] should_fail_ex+0x394/0x4c0 [ 1326.982020][T28479] prepare_alloc_pages+0x1e1/0x5b0 [ 1326.987202][T28479] __alloc_pages+0x134/0x460 [ 1326.992296][T28479] ? zone_statistics+0x170/0x170 [ 1326.997292][T28479] ? lockdep_init_map_type+0x9c/0x8e0 [ 1327.002728][T28479] ? lockdep_softirqs_off+0x440/0x440 [ 1327.008189][T28479] ? free_zapped_rcu+0x250/0x250 [ 1327.013200][T28479] __kmalloc_large_node+0x8c/0x1f0 [ 1327.018379][T28479] ? io_alloc_hash_table+0x2d/0xb0 [ 1327.023576][T28479] __kmalloc+0x114/0x240 [ 1327.027888][T28479] ? init_hash_table+0xc7/0xe0 [ 1327.032984][T28479] io_alloc_hash_table+0x2d/0xb0 [ 1327.038048][T28479] io_ring_ctx_alloc+0x160/0xc10 [ 1327.043053][T28479] io_uring_create+0x2df/0x1330 [ 1327.047963][T28479] ? __might_fault+0xc6/0x120 [ 1327.052702][T28479] ? __might_fault+0xaa/0x120 [ 1327.057423][T28479] __se_sys_io_uring_setup+0x29f/0x2b0 [ 1327.062927][T28479] ? __x64_sys_io_uring_setup+0x60/0x60 [ 1327.068524][T28479] ? lockdep_hardirqs_on+0x98/0x150 [ 1327.073757][T28479] do_syscall_64+0x55/0xb0 [ 1327.078218][T28479] ? clear_bhb_loop+0x40/0x90 [ 1327.082933][T28479] ? clear_bhb_loop+0x40/0x90 [ 1327.087670][T28479] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1327.093606][T28479] RIP: 0033:0x7ffa80f9e159 [ 1327.098053][T28479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1327.117781][T28479] RSP: 002b:00007ffa7f1f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1327.126242][T28479] RAX: ffffffffffffffda RBX: 00007ffa81225fa0 RCX: 00007ffa80f9e159 [ 1327.134248][T28479] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000162e [ 1327.142598][T28479] RBP: 00007ffa8103506b R08: 0000000000000000 R09: 0000000000000000 [ 1327.150598][T28479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1327.158634][T28479] R13: 00007ffa81226038 R14: 00007ffa81225fa0 R15: 00007ffd8e7d5198 [ 1327.166651][T28479] [ 1327.361143][T28485] sd 0:0:1:0: PR command failed: 1026 [ 1327.375176][T28485] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 1327.386026][T28485] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 1327.893283][T28502] netlink: 144 bytes leftover after parsing attributes in process `syz.2.8035'. [ 1328.146480][T28511] sd 0:0:1:0: PR command failed: 1026 [ 1328.152095][T28511] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 1328.164010][T21415] Bluetooth: hci2: command 0x0406 tx timeout [ 1328.239302][T28511] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 1328.653160][T28529] loop2: detected capacity change from 0 to 512 [ 1328.754136][T28529] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1328.887112][T28535] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8051'. [ 1329.916925][T28558] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8062'. [ 1330.650577][T28587] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8075'. [ 1330.699625][T28589] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8076'. [ 1330.888311][T28595] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8079'. [ 1330.906106][T28595] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8079'. [ 1331.207608][T28606] FAULT_INJECTION: forcing a failure. [ 1331.207608][T28606] name failslab, interval 1, probability 0, space 0, times 0 [ 1331.243890][T28606] CPU: 0 PID: 28606 Comm: syz.1.8085 Not tainted syzkaller #0 [ 1331.251536][T28606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1331.261645][T28606] Call Trace: [ 1331.264967][T28606] [ 1331.267932][T28606] dump_stack_lvl+0x18c/0x250 [ 1331.272654][T28606] ? show_regs_print_info+0x20/0x20 [ 1331.277898][T28606] ? load_image+0x420/0x420 [ 1331.282497][T28606] ? __lock_acquire+0x7d80/0x7d80 [ 1331.287578][T28606] should_fail_ex+0x394/0x4c0 [ 1331.292308][T28606] should_failslab+0x9/0x20 [ 1331.296853][T28606] slab_pre_alloc_hook+0x59/0x300 [ 1331.301921][T28606] ? io_ring_ctx_alloc+0x54/0xc10 [ 1331.307022][T28606] __kmem_cache_alloc_node+0x53/0x250 [ 1331.312440][T28606] ? io_ring_ctx_alloc+0x54/0xc10 [ 1331.317505][T28606] kmalloc_trace+0x2a/0xe0 [ 1331.321963][T28606] io_ring_ctx_alloc+0x54/0xc10 [ 1331.326870][T28606] io_uring_create+0x2df/0x1330 [ 1331.331754][T28606] ? __might_fault+0xc6/0x120 [ 1331.336477][T28606] ? __might_fault+0xaa/0x120 [ 1331.341302][T28606] __se_sys_io_uring_setup+0x29f/0x2b0 [ 1331.346813][T28606] ? __x64_sys_io_uring_setup+0x60/0x60 [ 1331.352409][T28606] ? lockdep_hardirqs_on+0x98/0x150 [ 1331.357647][T28606] do_syscall_64+0x55/0xb0 [ 1331.362107][T28606] ? clear_bhb_loop+0x40/0x90 [ 1331.366825][T28606] ? clear_bhb_loop+0x40/0x90 [ 1331.371546][T28606] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1331.377479][T28606] RIP: 0033:0x7f6bb139e159 [ 1331.381925][T28606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1331.401595][T28606] RSP: 002b:00007f6bb2354028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1331.410225][T28606] RAX: ffffffffffffffda RBX: 00007f6bb1625fa0 RCX: 00007f6bb139e159 [ 1331.418321][T28606] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000162e [ 1331.426327][T28606] RBP: 00007f6bb143506b R08: 0000000000000000 R09: 0000000000000000 [ 1331.434354][T28606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1331.442352][T28606] R13: 00007f6bb1626038 R14: 00007f6bb1625fa0 R15: 00007fff4294c898 [ 1331.450369][T28606] [ 1331.533073][T28611] netlink: 108 bytes leftover after parsing attributes in process `syz.0.8087'. [ 1331.781296][T28618] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8090'. [ 1331.797841][T28618] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8090'. [ 1332.685463][T28646] FAULT_INJECTION: forcing a failure. [ 1332.685463][T28646] name failslab, interval 1, probability 0, space 0, times 0 [ 1332.700834][T28646] CPU: 0 PID: 28646 Comm: syz.2.8101 Not tainted syzkaller #0 [ 1332.701257][T28645] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8102'. [ 1332.708365][T28646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1332.708383][T28646] Call Trace: [ 1332.708393][T28646] [ 1332.708404][T28646] dump_stack_lvl+0x18c/0x250 [ 1332.708448][T28646] ? show_regs_print_info+0x20/0x20 [ 1332.708482][T28646] ? load_image+0x420/0x420 [ 1332.708523][T28646] ? __lock_acquire+0x7d80/0x7d80 [ 1332.708561][T28646] should_fail_ex+0x394/0x4c0 [ 1332.708604][T28646] should_failslab+0x9/0x20 [ 1332.708641][T28646] slab_pre_alloc_hook+0x59/0x300 [ 1332.708682][T28646] ? io_ring_ctx_alloc+0x54/0xc10 [ 1332.708711][T28646] __kmem_cache_alloc_node+0x53/0x250 [ 1332.708753][T28646] ? io_ring_ctx_alloc+0x54/0xc10 [ 1332.708781][T28646] kmalloc_trace+0x2a/0xe0 [ 1332.736272][T28645] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8102'. [ 1332.738874][T28646] io_ring_ctx_alloc+0x54/0xc10 [ 1332.801814][T28646] io_uring_create+0x2df/0x1330 [ 1332.806856][T28646] ? __might_fault+0xc6/0x120 [ 1332.811604][T28646] ? __might_fault+0xaa/0x120 [ 1332.816364][T28646] __se_sys_io_uring_setup+0x29f/0x2b0 [ 1332.821912][T28646] ? __x64_sys_io_uring_setup+0x60/0x60 [ 1332.827562][T28646] ? lockdep_hardirqs_on+0x98/0x150 [ 1332.832843][T28646] do_syscall_64+0x55/0xb0 [ 1332.837341][T28646] ? clear_bhb_loop+0x40/0x90 [ 1332.842102][T28646] ? clear_bhb_loop+0x40/0x90 [ 1332.846864][T28646] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1332.852832][T28646] RIP: 0033:0x7fe94579e159 [ 1332.857317][T28646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1332.876999][T28646] RSP: 002b:00007fe9465d8028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1332.885585][T28646] RAX: ffffffffffffffda RBX: 00007fe945a25fa0 RCX: 00007fe94579e159 [ 1332.893634][T28646] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000162e [ 1332.901685][T28646] RBP: 00007fe94583506b R08: 0000000000000000 R09: 0000000000000000 [ 1332.909733][T28646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1332.917772][T28646] R13: 00007fe945a26038 R14: 00007fe945a25fa0 R15: 00007ffead5a92e8 [ 1332.925834][T28646] [ 1333.727450][T28670] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8113'. [ 1334.324775][T28692] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8123'. [ 1335.235446][T28712] netlink: 144 bytes leftover after parsing attributes in process `syz.1.8131'. [ 1335.390036][T28714] syzkaller0: entered promiscuous mode [ 1335.398584][T28714] syzkaller0: entered allmulticast mode [ 1335.537727][T28716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8134'. [ 1336.089426][T28737] netlink: 144 bytes leftover after parsing attributes in process `syz.0.8142'. [ 1336.270763][T28742] FAULT_INJECTION: forcing a failure. [ 1336.270763][T28742] name failslab, interval 1, probability 0, space 0, times 0 [ 1336.290688][T28742] CPU: 0 PID: 28742 Comm: syz.2.8146 Not tainted syzkaller #0 [ 1336.298367][T28742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1336.308480][T28742] Call Trace: [ 1336.311812][T28742] [ 1336.314793][T28742] dump_stack_lvl+0x18c/0x250 [ 1336.319584][T28742] ? show_regs_print_info+0x20/0x20 [ 1336.324856][T28742] ? load_image+0x420/0x420 [ 1336.329427][T28742] ? __might_sleep+0xe0/0xe0 [ 1336.334093][T28742] ? __lock_acquire+0x7d80/0x7d80 [ 1336.336001][T28744] syzkaller0: entered promiscuous mode [ 1336.339206][T28742] ? trace_raw_output_percpu_destroy_chunk+0xc0/0xc0 [ 1336.346892][T28744] syzkaller0: entered allmulticast mode [ 1336.351404][T28742] should_fail_ex+0x394/0x4c0 [ 1336.361773][T28742] should_failslab+0x9/0x20 [ 1336.366348][T28742] slab_pre_alloc_hook+0x59/0x300 [ 1336.371442][T28742] ? pcpu_alloc+0x11e7/0x1880 [ 1336.376189][T28742] ? percpu_ref_init+0xc3/0x340 [ 1336.381100][T28742] __kmem_cache_alloc_node+0x53/0x250 [ 1336.386556][T28742] ? percpu_ref_init+0xc3/0x340 [ 1336.391479][T28742] ? io_allocate_scq_urings+0x620/0x620 [ 1336.397084][T28742] kmalloc_trace+0x2a/0xe0 [ 1336.401576][T28742] percpu_ref_init+0xc3/0x340 [ 1336.406328][T28742] io_ring_ctx_alloc+0x205/0xc10 [ 1336.411326][T28742] io_uring_create+0x2df/0x1330 [ 1336.416206][T28742] ? __might_fault+0xc6/0x120 [ 1336.420905][T28742] ? __might_fault+0xaa/0x120 [ 1336.425612][T28742] __se_sys_io_uring_setup+0x29f/0x2b0 [ 1336.431107][T28742] ? __x64_sys_io_uring_setup+0x60/0x60 [ 1336.436718][T28742] ? lockdep_hardirqs_on+0x98/0x150 [ 1336.441958][T28742] do_syscall_64+0x55/0xb0 [ 1336.446395][T28742] ? clear_bhb_loop+0x40/0x90 [ 1336.451101][T28742] ? clear_bhb_loop+0x40/0x90 [ 1336.455801][T28742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1336.461738][T28742] RIP: 0033:0x7fe94579e159 [ 1336.466178][T28742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1336.485818][T28742] RSP: 002b:00007fe9465d8028 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1336.494295][T28742] RAX: ffffffffffffffda RBX: 00007fe945a25fa0 RCX: 00007fe94579e159 [ 1336.502314][T28742] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000162e [ 1336.510310][T28742] RBP: 00007fe94583506b R08: 0000000000000000 R09: 0000000000000000 [ 1336.518321][T28742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1336.526349][T28742] R13: 00007fe945a26038 R14: 00007fe945a25fa0 R15: 00007ffead5a92e8 [ 1336.534356][T28742] [ 1337.032156][T28748] loop3: detected capacity change from 0 to 8192 [ 1337.057145][T28748] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 1337.132968][ T28] kauditd_printk_skb: 77 callbacks suppressed [ 1337.133024][ T28] audit: type=1800 audit(1789870404.921:177): pid=28748 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8149" name="file1" dev="loop3" ino=1048637 res=0 errno=0 [ 1337.265309][T28762] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1337.287675][T28748] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 1044) [ 1337.303416][T28748] FAT-fs (loop3): Filesystem has been set read-only [ 1337.312149][T28748] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 1044) [ 1337.335354][T28748] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 1044) [ 1337.455462][T25803] FAT-fs (loop3): error, fat_get_cluster: invalid cluster chain (i_pos 1044) [ 1337.746561][T28777] netlink: 108 bytes leftover after parsing attributes in process `syz.2.8162'. [ 1338.018382][T28786] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1338.625646][T28803] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8174'. [ 1339.202998][T28820] loop1: detected capacity change from 0 to 764 [ 1339.486158][T28827] syzkaller0: entered promiscuous mode [ 1339.493209][T28829] netlink: 108 bytes leftover after parsing attributes in process `syz.1.8185'. [ 1339.511734][T28827] syzkaller0: entered allmulticast mode [ 1339.527885][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 210 seconds [ 1339.915641][T28843] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1340.228627][T28853] netlink: 108 bytes leftover after parsing attributes in process `syz.1.8196'. [ 1340.466874][T28860] syzkaller0: entered promiscuous mode [ 1340.472439][T28860] syzkaller0: entered allmulticast mode [ 1340.732640][T28871] loop2: detected capacity change from 0 to 128 [ 1340.776227][T28873] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1341.097244][T28880] netlink: 144 bytes leftover after parsing attributes in process `syz.2.8209'. [ 1341.130288][T28881] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 1341.381023][T28890] syzkaller0: entered promiscuous mode [ 1341.392659][T28890] syzkaller0: entered allmulticast mode [ 1341.523107][T28896] overlayfs: unescaped trailing colons in lowerdir mount option. [ 1341.945587][T28910] netlink: 108 bytes leftover after parsing attributes in process `syz.2.8223'. [ 1342.720641][T28939] netlink: 108 bytes leftover after parsing attributes in process `syz.0.8235'. [ 1343.385866][T28959] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8245'. [ 1343.497121][T28968] netlink: 108 bytes leftover after parsing attributes in process `syz.2.8248'. [ 1344.297044][T28990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8258'. [ 1344.786370][T29006] loop2: detected capacity change from 0 to 2048 [ 1344.922950][T29006] Alternate GPT is invalid, using primary GPT. [ 1344.938141][T29006] loop2: p1 p2 p3 [ 1344.944298][T29006] loop2: partition table partially beyond EOD, truncated [ 1345.185704][T29019] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8271'. [ 1345.339530][T29026] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8274'. [ 1345.417490][T23429] udevd[23429]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 1345.428451][T23471] udevd[23471]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 1345.483730][T23475] udevd[23475]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 1346.067875][T29047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8284'. [ 1346.214634][T29053] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8287'. [ 1346.801167][T29074] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8297'. [ 1346.920317][T29080] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8300'. [ 1347.440529][T29099] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8309'. [ 1348.175265][T29121] overlayfs: missing 'lowerdir' [ 1348.459612][T29133] __nla_validate_parse: 2 callbacks suppressed [ 1348.459641][T29133] netlink: 88 bytes leftover after parsing attributes in process `syz.1.8323'. [ 1349.063055][T29151] overlayfs: missing 'lowerdir' [ 1349.263952][T29156] netlink: 88 bytes leftover after parsing attributes in process `syz.1.8335'. [ 1349.279487][T29158] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8334'. [ 1350.064496][T29180] overlayfs: missing 'lowerdir' [ 1350.077790][T29183] netlink: 108 bytes leftover after parsing attributes in process `syz.2.8348'. [ 1350.667581][T29203] loop0: detected capacity change from 0 to 512 [ 1350.675183][T29204] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8359'. [ 1350.824693][T29208] overlay: Unknown parameter ':olatile' [ 1351.455679][T29230] netlink: 108 bytes leftover after parsing attributes in process `syz.1.8369'. [ 1351.644788][T29236] overlay: Unknown parameter ':olatile' [ 1352.638350][T29270] raw_sendmsg: syz.0.8384 forgot to set AF_INET. Fix it! [ 1353.344608][T29293] loop2: detected capacity change from 0 to 512 [ 1353.368318][T29295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8397'. [ 1353.379075][ T28] audit: type=1326 audit(1789870421.171:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29291 comm="syz.3.8395" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad5999e159 code=0x7fc00000 [ 1353.486862][T29293] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 1353.764479][T21415] Bluetooth: hci0: command 0x0406 tx timeout [ 1354.094341][ T28] audit: type=1326 audit(1789870421.881:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29291 comm="syz.3.8395" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fad5999e159 code=0x7fc00000 [ 1354.510817][T29319] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8406'. [ 1355.775194][T29359] overlayfs: failed to resolve './file2': -2 [ 1356.433699][T29381] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8432'. [ 1356.547962][T29388] overlayfs: failed to resolve './file2': -2 [ 1357.269486][T29410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8445'. [ 1357.727896][T29427] netlink: 'syz.3.8453': attribute type 14 has an invalid length. [ 1357.764959][T29430] loop2: detected capacity change from 0 to 164 [ 1357.929344][T29433] FAULT_INJECTION: forcing a failure. [ 1357.929344][T29433] name failslab, interval 1, probability 0, space 0, times 0 [ 1357.974825][T29435] xt_connbytes: Forcing CT accounting to be enabled [ 1357.985323][T29433] CPU: 1 PID: 29433 Comm: syz.0.8454 Not tainted syzkaller #0 [ 1357.992955][T29433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1358.003066][T29433] Call Trace: [ 1358.006395][T29433] [ 1358.009375][T29433] dump_stack_lvl+0x18c/0x250 [ 1358.014120][T29433] ? show_regs_print_info+0x20/0x20 [ 1358.019387][T29433] ? load_image+0x420/0x420 [ 1358.023950][T29433] ? __might_sleep+0xe0/0xe0 [ 1358.028610][T29433] ? __lock_acquire+0x7d80/0x7d80 [ 1358.033692][T29433] ? mark_lock+0x94/0x320 [ 1358.038083][T29433] should_fail_ex+0x394/0x4c0 [ 1358.042833][T29433] should_failslab+0x9/0x20 [ 1358.047396][T29433] slab_pre_alloc_hook+0x59/0x300 [ 1358.052487][T29433] kmem_cache_alloc+0x5a/0x2c0 [ 1358.057305][T29433] ? mas_alloc_nodes+0x2f8/0x8c0 [ 1358.062415][T29433] mas_alloc_nodes+0x2f8/0x8c0 [ 1358.067244][T29433] mas_preallocate+0xa1f/0x1170 [ 1358.072141][T29433] ? lockdep_softirqs_off+0x440/0x440 [ 1358.077555][T29433] ? mas_destroy+0x20a0/0x20a0 [ 1358.082368][T29433] ? vma_iter_config+0xe6/0x270 [ 1358.087261][T29433] __split_vma+0x2dd/0xc20 [ 1358.091719][T29433] ? mmap_write_unlock+0x160/0x160 [ 1358.096883][T29433] ? move_page_tables+0x1477/0x1970 [ 1358.102128][T29433] do_vmi_align_munmap+0x310/0x16a0 [ 1358.107373][T29433] ? move_page_tables+0x186a/0x1970 [ 1358.112601][T29433] ? do_vmi_munmap+0x2d0/0x2d0 [ 1358.117411][T29433] ? mtree_range_walk+0x68c/0x7b0 [ 1358.122485][T29433] ? mas_find_setup+0x47f/0x590 [ 1358.127405][T29433] do_vmi_munmap+0x252/0x2d0 [ 1358.132039][T29433] move_vma+0xcb3/0x16a0 [ 1358.136315][T29433] ? vma_expandable+0xf0/0xf0 [ 1358.141017][T29433] ? arch_get_unmapped_area+0x7c0/0x7c0 [ 1358.146661][T29433] ? bpf_lsm_mmap_addr+0x9/0x10 [ 1358.151557][T29433] ? security_mmap_addr+0x72/0x90 [ 1358.156656][T29433] ? get_unmapped_area+0x2f9/0x360 [ 1358.161803][T29433] mremap_to+0x51f/0x5d0 [ 1358.166113][T29433] __se_sys_mremap+0x6a8/0x11a0 [ 1358.171006][T29433] ? __x64_sys_mremap+0xc0/0xc0 [ 1358.175885][T29433] ? __lock_acquire+0x7d80/0x7d80 [ 1358.180962][T29433] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1358.186985][T29433] ? lock_chain_count+0x20/0x20 [ 1358.191877][T29433] ? lockdep_hardirqs_on+0x98/0x150 [ 1358.197134][T29433] ? __x64_sys_mremap+0x20/0xc0 [ 1358.202021][T29433] do_syscall_64+0x55/0xb0 [ 1358.206492][T29433] ? clear_bhb_loop+0x40/0x90 [ 1358.211206][T29433] ? clear_bhb_loop+0x40/0x90 [ 1358.215923][T29433] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1358.221855][T29433] RIP: 0033:0x7ffa80f9e159 [ 1358.226304][T29433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1358.245956][T29433] RSP: 002b:00007ffa7f1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1358.254430][T29433] RAX: ffffffffffffffda RBX: 00007ffa81225fa0 RCX: 00007ffa80f9e159 [ 1358.262432][T29433] RDX: 0000000000003021 RSI: 0000000000004000 RDI: 0000200000001000 [ 1358.270431][T29433] RBP: 00007ffa8103506b R08: 0000200000ffd000 R09: 0000000000000000 [ 1358.278539][T29433] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 1358.286543][T29433] R13: 00007ffa81226038 R14: 00007ffa81225fa0 R15: 00007ffd8e7d5198 [ 1358.294558][T29433] [ 1358.472198][T29440] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8457'. [ 1359.049989][T29464] loop1: detected capacity change from 0 to 164 [ 1359.324989][T29472] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8469'. [ 1359.998799][T29500] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8481'. [ 1361.878679][T29580] loop0: detected capacity change from 0 to 164 [ 1361.928540][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.159441][T29589] overlayfs: failed to clone upperpath [ 1362.450827][T29600] net_ratelimit: 14 callbacks suppressed [ 1362.450919][T29600] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1362.539741][T29604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8523'. [ 1362.881124][T29619] overlayfs: failed to clone upperpath [ 1363.077173][T29624] netlink: 144 bytes leftover after parsing attributes in process `syz.0.8531'. [ 1363.835429][T29658] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 1363.897212][T29661] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1364.539438][T29684] loop3: detected capacity change from 0 to 164 [ 1364.894888][T29693] team0: Port device vlan2 added [ 1365.607243][T29715] loop3: detected capacity change from 0 to 164 [ 1367.061006][T29742] loop0: detected capacity change from 0 to 164 [ 1367.334583][T29748] FAULT_INJECTION: forcing a failure. [ 1367.334583][T29748] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1367.376033][T29748] CPU: 1 PID: 29748 Comm: syz.0.8582 Not tainted syzkaller #0 [ 1367.383584][T29748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1367.393679][T29748] Call Trace: [ 1367.396985][T29748] [ 1367.399939][T29748] dump_stack_lvl+0x18c/0x250 [ 1367.404660][T29748] ? show_regs_print_info+0x20/0x20 [ 1367.409892][T29748] ? load_image+0x420/0x420 [ 1367.414430][T29748] ? bsearch+0x8a/0xb0 [ 1367.418539][T29748] ? search_extable+0x90/0xd0 [ 1367.423277][T29748] ? trim_init_extable+0x6f0/0x6f0 [ 1367.428453][T29748] ? rep_movs_alternative+0x4a/0x90 [ 1367.433734][T29748] should_fail_ex+0x394/0x4c0 [ 1367.438486][T29748] get_futex_key+0x136/0x1030 [ 1367.443290][T29748] ? futex_setup_timer+0xc0/0xc0 [ 1367.448266][T29748] futex_wake+0x127/0x4f0 [ 1367.452626][T29748] ? lock_chain_count+0x20/0x20 [ 1367.457516][T29748] ? futex_wake_mark+0x150/0x150 [ 1367.462490][T29748] ? lockdep_hardirqs_on+0x98/0x150 [ 1367.467723][T29748] ? asm_exc_page_fault+0x26/0x30 [ 1367.472800][T29748] do_futex+0x35d/0x3e0 [ 1367.476998][T29748] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1367.482946][T29748] ? _copy_from_user+0xc8/0xe0 [ 1367.487751][T29748] __se_sys_futex+0x3a9/0x440 [ 1367.492473][T29748] ? __x64_sys_futex+0xf0/0xf0 [ 1367.497273][T29748] ? __x64_sys_futex+0x21/0xf0 [ 1367.502239][T29748] do_syscall_64+0x55/0xb0 [ 1367.506691][T29748] ? clear_bhb_loop+0x40/0x90 [ 1367.511401][T29748] ? clear_bhb_loop+0x40/0x90 [ 1367.516118][T29748] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1367.522043][T29748] RIP: 0033:0x7ffa80f9e159 [ 1367.526499][T29748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1367.546145][T29748] RSP: 002b:00007ffa7f1f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1367.554615][T29748] RAX: ffffffffffffffda RBX: 00007ffa81225fa8 RCX: 00007ffa80f9e159 [ 1367.562641][T29748] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ffa81225fac [ 1367.570663][T29748] RBP: 00007ffa81225fa0 R08: 0000000000745d1e R09: 0000000000000000 [ 1367.578678][T29748] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 1367.586689][T29748] R13: 00007ffa81226038 R14: 00007ffd8e7d50b0 R15: 00007ffd8e7d5198 [ 1367.594718][T29748] [ 1368.852091][T29777] overlayfs: failed to resolve './file2': -2 [ 1369.026495][T29784] loop3: detected capacity change from 0 to 256 [ 1369.128017][T21415] Bluetooth: hci3: command 0x0406 tx timeout [ 1369.604578][ T24] block nbd0: Possible stuck request ffff888021cc8000: control (read@0,1024B). Runtime 240 seconds [ 1369.820600][T29812] overlayfs: failed to resolve './file2': -2 [ 1370.163548][T29821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8613'. [ 1370.194598][T29821] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1370.429926][T29821] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1370.510303][T29827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8616'. [ 1370.774519][T29841] set match dimension is over the limit! [ 1371.102248][T29854] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8626'. [ 1371.306866][T29856] kvm: vcpu 0: requested 3328 ns lapic timer period limited to 200000 ns [ 1371.386572][T29856] kvm: pic: non byte write [ 1372.936937][T29901] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1374.027996][T29941] loop0: detected capacity change from 0 to 164 [ 1374.738529][T29961] netlink: 144 bytes leftover after parsing attributes in process `syz.0.8671'. [ 1375.422670][T29976] loop0: detected capacity change from 0 to 164 [ 1377.333642][T30000] loop3: detected capacity change from 0 to 164 [ 1377.841756][T30018] loop3: detected capacity change from 0 to 128 [ 1378.310381][T30033] loop3: detected capacity change from 0 to 256 [ 1378.997270][T30055] loop3: detected capacity change from 0 to 16 [ 1379.062835][T30055] erofs: (device loop3): mounted with root inode @ nid 36. [ 1379.327068][T30064] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8714'. [ 1380.286495][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1380.537842][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1380.649373][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1381.011065][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1381.731344][T21415] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1381.751136][T21415] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1381.761617][T21415] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1381.815508][T21415] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1381.840085][T21415] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1381.864081][T21415] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1381.885130][T30114] overlayfs: failed to clone upperpath [ 1382.153213][ T28] audit: type=1326 audit(1789870449.941:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.233668][ T28] audit: type=1326 audit(1789870449.941:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.294032][ T28] audit: type=1326 audit(1789870449.941:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.391292][ T28] audit: type=1326 audit(1789870449.981:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.463116][ T28] audit: type=1326 audit(1789870449.981:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.570163][ T28] audit: type=1326 audit(1789870449.981:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.650766][ T28] audit: type=1326 audit(1789870449.981:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.715644][ T28] audit: type=1326 audit(1789870449.981:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.772681][ T28] audit: type=1326 audit(1789870449.981:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1382.830691][ T28] audit: type=1326 audit(1789870449.981:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30122 comm="syz.2.8736" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe94579e159 code=0x7ffc0000 [ 1383.175188][T30154] syzkaller0: entered promiscuous mode [ 1383.180755][T30154] syzkaller0: entered allmulticast mode [ 1383.571301][T30168] overlay: Unknown parameter '/file0' [ 1383.838494][T30173] syz.3.8752: attempt to access beyond end of device [ 1383.838494][T30173] loop0: rw=0, sector=0, nr_sectors = 8 limit=0 [ 1383.924414][T21415] Bluetooth: hci1: command tx timeout [ 1384.161777][T30182] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8753'. [ 1384.552048][T30111] chnl_net:caif_netlink_parms(): no params data found [ 1384.902401][ T12] hsr_slave_0: left promiscuous mode [ 1384.921007][T30173] device-mapper: table: 248:0: thin-pool: Error creating metadata object (-EIO) [ 1385.012698][T30173] device-mapper: ioctl: error adding target to table [ 1385.647104][ T12] hsr_slave_1: left promiscuous mode [ 1385.764387][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1385.771916][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1385.822678][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1385.843314][T30215] netlink: 1740 bytes leftover after parsing attributes in process `syz.2.8761'. [ 1385.852807][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1385.871396][ T12] bridge_slave_1: left allmulticast mode [ 1385.878040][T30216] overlay: Unknown parameter '/file0' [ 1385.887896][ T12] bridge_slave_1: left promiscuous mode [ 1385.907847][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1385.971261][ T12] bridge_slave_0: left allmulticast mode [ 1385.988914][ T12] bridge_slave_0: left promiscuous mode [ 1386.014023][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1386.098020][T21415] Bluetooth: hci1: command tx timeout [ 1386.166788][ T12] veth1_macvtap: left promiscuous mode [ 1386.173083][ T12] veth0_macvtap: left promiscuous mode [ 1386.194040][ T12] veth1_vlan: left promiscuous mode [ 1386.206567][ T12] veth0_vlan: left promiscuous mode [ 1386.632292][ T12] team0 (unregistering): Port device vlan2 removed [ 1386.697929][T30242] netlink: 1740 bytes leftover after parsing attributes in process `syz.1.8770'. [ 1387.499560][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1387.567809][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1387.628248][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1387.687410][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1388.164166][T21415] Bluetooth: hci1: command tx timeout [ 1388.286066][T30261] netlink: 1740 bytes leftover after parsing attributes in process `syz.1.8778'. [ 1388.336875][ T12] bond0 (unregistering): Released all slaves [ 1388.908703][T30225] bridge0: port 2(bridge_slave_1) entered disabled state [ 1388.916566][T30225] bridge0: port 1(bridge_slave_0) entered disabled state [ 1389.134525][ T5139] udevd[5139]: worker [23194] /devices/virtual/block/nbd0 timeout; kill it [ 1389.148865][ T5139] udevd[5139]: seq 27988 '/devices/virtual/block/nbd0' killed [ 1389.458273][T30225] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1389.524956][T30225] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1390.067376][T30225] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1390.078306][T30225] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1390.087925][T30225] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1390.097373][T30225] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1390.243921][T21415] Bluetooth: hci1: command tx timeout [ 1390.495994][T30270] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8780'. [ 1390.550657][T30111] bridge0: port 1(bridge_slave_0) entered blocking state [ 1390.558415][T30111] bridge0: port 1(bridge_slave_0) entered disabled state [ 1390.567160][T30111] bridge_slave_0: entered allmulticast mode [ 1390.575876][T30111] bridge_slave_0: entered promiscuous mode [ 1390.586185][T30111] bridge0: port 2(bridge_slave_1) entered blocking state [ 1390.593362][T30111] bridge0: port 2(bridge_slave_1) entered disabled state [ 1390.601131][T30111] bridge_slave_1: entered allmulticast mode [ 1390.614891][T30111] bridge_slave_1: entered promiscuous mode [ 1390.792778][T30111] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1390.840517][T30111] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1391.034129][T30111] team0: Port device team_slave_0 added [ 1391.051635][T30111] team0: Port device team_slave_1 added [ 1391.212723][T30111] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1391.252664][T30111] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1391.339461][T30111] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1391.355436][T30298] FAULT_INJECTION: forcing a failure. [ 1391.355436][T30298] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1391.384388][T30111] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1391.403890][T30298] CPU: 0 PID: 30298 Comm: syz.3.8789 Not tainted syzkaller #0 [ 1391.411450][T30298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1391.421561][T30298] Call Trace: [ 1391.424916][T30298] [ 1391.427895][T30298] dump_stack_lvl+0x18c/0x250 [ 1391.432633][T30298] ? show_regs_print_info+0x20/0x20 [ 1391.437900][T30298] ? load_image+0x420/0x420 [ 1391.442467][T30298] ? __lock_acquire+0x7d80/0x7d80 [ 1391.447560][T30298] should_fail_ex+0x394/0x4c0 [ 1391.452300][T30298] prepare_alloc_pages+0x1e1/0x5b0 [ 1391.457475][T30298] __alloc_pages+0x134/0x460 [ 1391.462121][T30298] ? zone_statistics+0x170/0x170 [ 1391.467123][T30298] ? alloc_pages+0x4e1/0x740 [ 1391.471774][T30298] __get_free_pages+0xc/0x30 [ 1391.476418][T30298] kasan_populate_vmalloc_pte+0x35/0x100 [ 1391.482143][T30298] __apply_to_page_range+0x860/0xdd0 [ 1391.487591][T30298] ? kasan_populate_vmalloc+0x70/0x70 [ 1391.493038][T30298] ? apply_to_page_range+0x50/0x50 [ 1391.498213][T30298] ? do_raw_spin_unlock+0x121/0x230 [ 1391.503479][T30298] alloc_vmap_area+0x1d26/0x1e50 [ 1391.508506][T30298] ? vm_map_ram+0xcf0/0xcf0 [ 1391.513098][T30298] ? rcu_is_watching+0x15/0xb0 [ 1391.517912][T30298] __get_vm_area_node+0x162/0x370 [ 1391.522992][T30298] ? __kasan_kmalloc+0x8f/0xa0 [ 1391.527796][T30298] __vmalloc_node_range+0x36f/0x1320 [ 1391.533128][T30298] ? write_ldt+0x4d4/0x750 [ 1391.537611][T30298] ? free_vm_area+0x50/0x50 [ 1391.542153][T30298] ? write_ldt+0x4d4/0x750 [ 1391.546609][T30298] __vmalloc+0x7a/0x90 [ 1391.550735][T30298] ? write_ldt+0x4d4/0x750 [ 1391.555245][T30298] write_ldt+0x4d4/0x750 [ 1391.559629][T30298] ? native_write_gdt_entry+0x30/0x30 [ 1391.565046][T30298] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1391.571085][T30298] ? lock_chain_count+0x20/0x20 [ 1391.575978][T30298] __se_sys_modify_ldt+0x6c/0x2f0 [ 1391.581048][T30298] do_syscall_64+0x55/0xb0 [ 1391.585501][T30298] ? clear_bhb_loop+0x40/0x90 [ 1391.590211][T30298] ? clear_bhb_loop+0x40/0x90 [ 1391.594933][T30298] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1391.600875][T30298] RIP: 0033:0x7fad5999e159 [ 1391.605327][T30298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1391.624987][T30298] RSP: 002b:00007fad5a8b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 1391.633435][T30298] RAX: ffffffffffffffda RBX: 00007fad59c25fa0 RCX: 00007fad5999e159 [ 1391.641436][T30298] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000001 [ 1391.649432][T30298] RBP: 00007fad59a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1391.657448][T30298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1391.665443][T30298] R13: 00007fad59c26038 R14: 00007fad59c25fa0 R15: 00007ffdb7665be8 [ 1391.673621][T30298] [ 1391.678717][T30111] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1391.705688][T30111] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1391.734542][T30298] warn_alloc: 1 callbacks suppressed [ 1391.734560][T30298] syz.3.8789: vmalloc error: size 65536, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1391.765879][T30299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8787'. [ 1391.804534][T30298] CPU: 0 PID: 30298 Comm: syz.3.8789 Not tainted syzkaller #0 [ 1391.812099][T30298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1391.822216][T30298] Call Trace: [ 1391.825544][T30298] [ 1391.828516][T30298] dump_stack_lvl+0x18c/0x250 [ 1391.833313][T30298] ? show_regs_print_info+0x20/0x20 [ 1391.838609][T30298] ? load_image+0x420/0x420 [ 1391.843184][T30298] ? __rcu_read_unlock+0x7c/0xd0 [ 1391.848162][T30298] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1391.854664][T30298] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1391.861243][T30298] warn_alloc+0x246/0x340 [ 1391.865679][T30298] ? slab_free_freelist_hook+0x130/0x1a0 [ 1391.871383][T30298] ? zone_watermark_ok_safe+0x230/0x230 [ 1391.876979][T30298] ? __get_vm_area_node+0x17b/0x370 [ 1391.882251][T30298] ? __get_vm_area_node+0x17b/0x370 [ 1391.887601][T30298] ? __kasan_kmalloc+0x8f/0xa0 [ 1391.892429][T30298] __vmalloc_node_range+0x394/0x1320 [ 1391.897815][T30298] ? free_vm_area+0x50/0x50 [ 1391.902400][T30298] ? write_ldt+0x4d4/0x750 [ 1391.906879][T30298] __vmalloc+0x7a/0x90 [ 1391.911011][T30298] ? write_ldt+0x4d4/0x750 [ 1391.915490][T30298] write_ldt+0x4d4/0x750 [ 1391.919801][T30298] ? native_write_gdt_entry+0x30/0x30 [ 1391.925242][T30298] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1391.931328][T30298] ? lock_chain_count+0x20/0x20 [ 1391.936254][T30298] __se_sys_modify_ldt+0x6c/0x2f0 [ 1391.941346][T30298] do_syscall_64+0x55/0xb0 [ 1391.945819][T30298] ? clear_bhb_loop+0x40/0x90 [ 1391.950567][T30298] ? clear_bhb_loop+0x40/0x90 [ 1391.955360][T30298] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1391.961312][T30298] RIP: 0033:0x7fad5999e159 [ 1391.965784][T30298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1391.985446][T30298] RSP: 002b:00007fad5a8b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000009a [ 1391.993924][T30298] RAX: ffffffffffffffda RBX: 00007fad59c25fa0 RCX: 00007fad5999e159 [ 1392.001991][T30298] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000001 [ 1392.010024][T30298] RBP: 00007fad59a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1392.018063][T30298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1392.026185][T30298] R13: 00007fad59c26038 R14: 00007fad59c25fa0 R15: 00007ffdb7665be8 [ 1392.034229][T30298] [ 1392.042243][T30298] Mem-Info: [ 1392.045959][T30298] active_anon:5792 inactive_anon:2 isolated_anon:0 [ 1392.045959][T30298] active_file:10858 inactive_file:42748 isolated_file:0 [ 1392.045959][T30298] unevictable:768 dirty:115 writeback:0 [ 1392.045959][T30298] slab_reclaimable:11105 slab_unreclaimable:112438 [ 1392.045959][T30298] mapped:24551 shmem:1369 pagetables:616 [ 1392.045959][T30298] sec_pagetables:0 bounce:0 [ 1392.045959][T30298] kernel_misc_reclaimable:0 [ 1392.045959][T30298] free:1324406 free_pcp:10898 free_cma:0 [ 1392.094218][T30298] Node 0 active_anon:23168kB inactive_anon:8kB active_file:43432kB inactive_file:170792kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:98204kB dirty:460kB writeback:0kB shmem:3940kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12708kB pagetables:2464kB sec_pagetables:0kB all_unreclaimable? no [ 1392.129036][T30298] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1392.230654][T30298] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1392.289111][T30298] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1392.309430][T30298] Node 0 DMA32 free:1392236kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:23084kB inactive_anon:8kB active_file:43432kB inactive_file:169968kB unevictable:1536kB writepending:464kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:25116kB local_pcp:7520kB free_cma:0kB [ 1392.350609][T30298] lowmem_reserve[]: 0 0 0 0 0 [ 1392.357049][T30298] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:4kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 1392.396430][T30298] lowmem_reserve[]: 0 0 0 0 0 [ 1392.401278][T30298] Node 1 Normal free:3889524kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:19296kB local_pcp:11136kB free_cma:0kB [ 1392.467456][T30298] lowmem_reserve[]: 0 0 0 0 0 [ 1392.472351][T30298] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1392.514974][T30298] Node 0 DMA32: 465*4kB (UME) 829*8kB (UME) 487*16kB (UME) 1223*32kB (UME) 580*64kB (UME) 162*128kB (UME) 28*256kB (UME) 14*512kB (UME) 6*1024kB (UM) 2*2048kB (ME) 306*4096kB (UM) = 1391228kB [ 1392.548680][T30298] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1392.578265][T30298] Node 1 Normal: 211*4kB (UME) 47*8kB (UME) 43*16kB (UME) 88*32kB (UME) 28*64kB (UE) 4*128kB (UME) 0*256kB 3*512kB (UME) 0*1024kB 1*2048kB (E) 947*4096kB (M) = 3889524kB [ 1392.622701][T30298] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1392.675328][T30298] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1392.691559][T30111] hsr_slave_0: entered promiscuous mode [ 1392.699412][T30298] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1392.724504][T30111] hsr_slave_1: entered promiscuous mode [ 1392.731047][T30298] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1392.740672][T30111] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1392.759240][T30111] Cannot create hsr debugfs directory [ 1392.764949][T30298] 55602 total pagecache pages [ 1392.769709][T30298] 2 pages in swap cache [ 1392.800918][T30298] Free swap = 124456kB [ 1392.821715][T30298] Total swap = 124996kB [ 1392.847687][T30298] 2097051 pages RAM [ 1392.851578][T30298] 0 pages HighMem/MovableOnly [ 1392.878012][T30298] 416965 pages reserved [ 1392.882254][T30298] 0 pages cma reserved [ 1393.530044][T30111] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1393.619159][T30111] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1393.676089][T30111] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1393.771349][T30111] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1393.914922][T30344] process 'syz.3.8798' launched './file1' with NULL argv: empty string added [ 1394.129036][T30111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1394.191013][T30111] 8021q: adding VLAN 0 to HW filter on device team0 [ 1394.275612][T15344] bridge0: port 1(bridge_slave_0) entered blocking state [ 1394.282841][T15344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1394.328044][T15344] bridge0: port 2(bridge_slave_1) entered blocking state [ 1394.335317][T15344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1395.180080][T30111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1396.197269][T30111] veth0_vlan: entered promiscuous mode [ 1396.244471][T30111] veth1_vlan: entered promiscuous mode [ 1396.294814][T30410] ================================================================== [ 1396.294892][T30410] BUG: KASAN: vmalloc-out-of-bounds in sys_imageblit+0x1bac/0x25d0 [ 1396.294992][T30410] Write of size 4 at addr ffffc90003ce9000 by task syz.3.8812/30410 [ 1396.295011][T30410] [ 1396.295046][T30410] CPU: 0 PID: 30410 Comm: syz.3.8812 Not tainted syzkaller #0 [ 1396.295068][T30410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1396.295082][T30410] Call Trace: [ 1396.295092][T30410] [ 1396.295101][T30410] dump_stack_lvl+0x18c/0x250 [ 1396.295132][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.295156][T30410] ? show_regs_print_info+0x20/0x20 [ 1396.295185][T30410] ? load_image+0x420/0x420 [ 1396.295211][T30410] ? mark_lock+0x94/0x320 [ 1396.295241][T30410] print_report+0xa8/0x210 [ 1396.295267][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.295289][T30410] kasan_report+0x117/0x150 [ 1396.295318][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.295345][T30410] sys_imageblit+0x1bac/0x25d0 [ 1396.295375][T30410] ? sys_copyarea+0x2530/0x2530 [ 1396.295426][T30410] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 1396.295484][T30410] soft_cursor+0xa01/0xc30 [ 1396.295522][T30410] bit_cursor+0x16dd/0x1f60 [ 1396.295566][T30410] ? bit_clear_margins+0x550/0x550 [ 1396.295604][T30410] ? get_color+0x2e8/0x4d0 [ 1396.295632][T30410] ? bit_clear_margins+0x550/0x550 [ 1396.295665][T30410] ? fbcon_cursor+0x430/0x640 [ 1396.295694][T30410] ? add_softcursor+0x8c/0x440 [ 1396.295731][T30410] con_flush_chars+0x1fa/0x280 [ 1396.295762][T30410] con_write+0x2e/0x40 [ 1396.295792][T30410] do_output_char+0x64a/0x960 [ 1396.295827][T30410] n_tty_write+0xdee/0x11e0 [ 1396.295869][T30410] ? n_tty_read+0x1370/0x1370 [ 1396.295901][T30410] ? wait_woken+0x180/0x180 [ 1396.295927][T30410] ? __virt_addr_valid+0x10c/0x380 [ 1396.295958][T30410] ? __check_object_size+0x4fc/0xa40 [ 1396.295980][T30410] ? n_tty_read+0x1370/0x1370 [ 1396.296012][T30410] file_tty_write+0x529/0x960 [ 1396.296045][T30410] do_iter_write+0x747/0xc50 [ 1396.296081][T30410] ? __asan_memset+0x22/0x40 [ 1396.296111][T30410] ? vfs_iter_write+0xa0/0xa0 [ 1396.296140][T30410] ? __import_iovec+0x3fa/0x850 [ 1396.296176][T30410] ? import_iovec+0x73/0xa0 [ 1396.296208][T30410] do_writev+0x27f/0x480 [ 1396.296232][T30410] ? do_readv+0x460/0x460 [ 1396.296260][T30410] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1396.296288][T30410] ? lock_chain_count+0x20/0x20 [ 1396.296317][T30410] ? lockdep_hardirqs_on+0x98/0x150 [ 1396.296341][T30410] do_syscall_64+0x55/0xb0 [ 1396.296369][T30410] ? clear_bhb_loop+0x40/0x90 [ 1396.296399][T30410] ? clear_bhb_loop+0x40/0x90 [ 1396.296429][T30410] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1396.296467][T30410] RIP: 0033:0x7fad5999e159 [ 1396.296487][T30410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1396.296507][T30410] RSP: 002b:00007fad5a8b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1396.296533][T30410] RAX: ffffffffffffffda RBX: 00007fad59c25fa0 RCX: 00007fad5999e159 [ 1396.296551][T30410] RDX: 0000000000000003 RSI: 0000200000001780 RDI: 0000000000000003 [ 1396.296566][T30410] RBP: 00007fad59a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1396.296580][T30410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1396.296594][T30410] R13: 00007fad59c26038 R14: 00007fad59c25fa0 R15: 00007ffdb7665be8 [ 1396.296620][T30410] [ 1396.296628][T30410] [ 1396.296633][T30410] The buggy address belongs to a 768-page vmalloc region starting at 0xffffc900039e9000 allocated at drm_fbdev_generic_helper_fb_probe+0x247/0x520 [ 1396.296682][T30410] Memory state around the buggy address: [ 1396.296694][T30410] ffffc90003ce8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1396.296709][T30410] ffffc90003ce8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1396.296724][T30410] >ffffc90003ce9000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1396.296735][T30410] ^ [ 1396.296746][T30410] ffffc90003ce9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1396.296761][T30410] ffffc90003ce9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1396.296772][T30410] ================================================================== [ 1396.311411][T30410] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1396.311428][T30410] CPU: 0 PID: 30410 Comm: syz.3.8812 Not tainted syzkaller #0 [ 1396.311458][T30410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1396.311472][T30410] Call Trace: [ 1396.311480][T30410] [ 1396.311489][T30410] dump_stack_lvl+0x18c/0x250 [ 1396.311527][T30410] ? show_regs_print_info+0x20/0x20 [ 1396.311558][T30410] ? load_image+0x420/0x420 [ 1396.311588][T30410] panic+0x2ca/0x720 [ 1396.311612][T30410] ? bpf_jit_dump+0xd0/0xd0 [ 1396.311635][T30410] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 1396.311661][T30410] ? _raw_spin_unlock+0x40/0x40 [ 1396.311683][T30410] ? print_memory_metadata+0x314/0x400 [ 1396.311714][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.311736][T30410] check_panic_on_warn+0x84/0xa0 [ 1396.311765][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.311786][T30410] end_report+0x6f/0x130 [ 1396.311814][T30410] kasan_report+0x128/0x150 [ 1396.311842][T30410] ? sys_imageblit+0x1bac/0x25d0 [ 1396.311867][T30410] sys_imageblit+0x1bac/0x25d0 [ 1396.311898][T30410] ? sys_copyarea+0x2530/0x2530 [ 1396.311929][T30410] drm_fbdev_generic_defio_imageblit+0x2c/0x110 [ 1396.311962][T30410] soft_cursor+0xa01/0xc30 [ 1396.312000][T30410] bit_cursor+0x16dd/0x1f60 [ 1396.312043][T30410] ? bit_clear_margins+0x550/0x550 [ 1396.312080][T30410] ? get_color+0x2e8/0x4d0 [ 1396.312109][T30410] ? bit_clear_margins+0x550/0x550 [ 1396.312142][T30410] ? fbcon_cursor+0x430/0x640 [ 1396.312170][T30410] ? add_softcursor+0x8c/0x440 [ 1396.312200][T30410] con_flush_chars+0x1fa/0x280 [ 1396.312231][T30410] con_write+0x2e/0x40 [ 1396.312261][T30410] do_output_char+0x64a/0x960 [ 1396.312294][T30410] n_tty_write+0xdee/0x11e0 [ 1396.312337][T30410] ? n_tty_read+0x1370/0x1370 [ 1396.312368][T30410] ? wait_woken+0x180/0x180 [ 1396.312394][T30410] ? __virt_addr_valid+0x10c/0x380 [ 1396.312428][T30410] ? __check_object_size+0x4fc/0xa40 [ 1396.312458][T30410] ? n_tty_read+0x1370/0x1370 [ 1396.312489][T30410] file_tty_write+0x529/0x960 [ 1396.312524][T30410] do_iter_write+0x747/0xc50 [ 1396.312561][T30410] ? __asan_memset+0x22/0x40 [ 1396.312591][T30410] ? vfs_iter_write+0xa0/0xa0 [ 1396.312619][T30410] ? __import_iovec+0x3fa/0x850 [ 1396.312656][T30410] ? import_iovec+0x73/0xa0 [ 1396.312688][T30410] do_writev+0x27f/0x480 [ 1396.312711][T30410] ? do_readv+0x460/0x460 [ 1396.312739][T30410] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1396.312767][T30410] ? lock_chain_count+0x20/0x20 [ 1396.312796][T30410] ? lockdep_hardirqs_on+0x98/0x150 [ 1396.312820][T30410] do_syscall_64+0x55/0xb0 [ 1396.312848][T30410] ? clear_bhb_loop+0x40/0x90 [ 1396.312877][T30410] ? clear_bhb_loop+0x40/0x90 [ 1396.312907][T30410] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1396.312937][T30410] RIP: 0033:0x7fad5999e159 [ 1396.312958][T30410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1396.312977][T30410] RSP: 002b:00007fad5a8b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1396.313000][T30410] RAX: ffffffffffffffda RBX: 00007fad59c25fa0 RCX: 00007fad5999e159 [ 1396.313017][T30410] RDX: 0000000000000003 RSI: 0000200000001780 RDI: 0000000000000003 [ 1396.313032][T30410] RBP: 00007fad59a3506b R08: 0000000000000000 R09: 0000000000000000 [ 1396.313046][T30410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1396.313060][T30410] R13: 00007fad59c26038 R14: 00007fad59c25fa0 R15: 00007ffdb7665be8 [ 1396.313084][T30410] [ 1396.313683][T30410] Kernel Offset: disabled