last executing test programs: 16.911034285s ago: executing program 4 (id=871): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r2, {0x2, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x1}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x86, 0x1}, {0x5, 0x7}}}]}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) 16.864266112s ago: executing program 4 (id=873): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) write$vhost_msg(r0, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f00000007c0)={0x1, {&(0x7f0000000080)=""/158, 0x9e, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000001b00)={0x1, {&(0x7f0000000380)=""/185, 0xb9, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg(r0, &(0x7f0000000a00)={0x1, {&(0x7f0000000ac0)=""/23, 0x17, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000200)=""/66, 0x42, 0x0, 0x3, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) 16.793427499s ago: executing program 4 (id=876): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x2, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0x9, 0x4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008440)=@newtfilter={0x40, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r1, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0x9}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x40) 16.709320191s ago: executing program 4 (id=880): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) syz_usbip_server_init(0x3) syz_usbip_server_init(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1fe) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) umount2(&(0x7f0000000300)='./file0\x00', 0xc) 15.533599031s ago: executing program 4 (id=892): unshare(0x2a020400) socket(0xa, 0x3, 0x85) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff03", 0x2c}], 0x1) 15.375235664s ago: executing program 4 (id=900): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi1\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x4, 0x4, 0x7fffffff, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffc, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x1ff, 0x9ea, 0x3, 0xb, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0x2, 0x2000006, 0x77fd]}) syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) 15.331694264s ago: executing program 32 (id=900): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi1\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x4, 0x4, 0x7fffffff, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffc, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x1ff, 0x9ea, 0x3, 0xb, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0x2, 0x2000006, 0x77fd]}) syz_open_dev$media(&(0x7f0000000040), 0x2, 0x0) 4.573933387s ago: executing program 0 (id=1067): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000300)=ANY=[], 0x4) 4.384291556s ago: executing program 0 (id=1071): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$kcm(0x23, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) recvmsg$kcm(r1, &(0x7f0000002ac0)={0x0, 0x0, 0x0}, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) 3.391320661s ago: executing program 0 (id=1091): r0 = socket(0x10, 0x803, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x4000000) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001400)=@newlink={0x44, 0x10, 0x401, 0x2, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x4008010) 3.234642599s ago: executing program 0 (id=1094): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="1100030000000000180012800b00010069703667726500000800028004"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd7000000000000200000008000300", @ANYRES32, @ANYBLOB="08002700020001000800a0"], 0x34}}, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0xa00}, {0x0, 0x100000000000000}]}, 0xa50) 3.074928462s ago: executing program 0 (id=1098): r0 = syz_usb_connect(0x0, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x424, 0x12c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x2, 0x200}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x7c, &(0x7f0000000600)={0x40, 0x0, 0xf, "0f00000100"/15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 2.445115105s ago: executing program 2 (id=1112): ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x11) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={0x0}}, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, 0x0, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x3, &(0x7f0000001300)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 1.479905625s ago: executing program 5 (id=1120): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a697000000005000400000000000900020073797a3000000000240007800c00028008000140ac1414280c000180080001"], 0x6c}}, 0x0) 1.450189789s ago: executing program 5 (id=1121): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xc) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b000900", 0x2c}], 0x1) 1.416748103s ago: executing program 5 (id=1122): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa8442, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x2, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0x9, 0x4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x884}, 0x40) 1.345363215s ago: executing program 5 (id=1123): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000d80)={0x1c, &(0x7f0000000280)={0x40, 0x36, 0xa, "d0ed6d80fe0100f1ced1"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 953.074997ms ago: executing program 2 (id=1127): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18) sendmmsg(r0, &(0x7f0000005680)=[{{0x0, 0x0, &(0x7f0000004e80)=[{0x0}, {&(0x7f00000003c0)="4571aa", 0x3}], 0x2}}], 0x1, 0x0) 952.980402ms ago: executing program 3 (id=1128): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8008}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 952.879723ms ago: executing program 2 (id=1129): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="30000000110001000000000000000000000000000000000000000000000000000f00030073797a6b616c6c65723000", 0x2f}], 0x1}, 0x0) sendmsg$sock(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000a00)="54000000100001040000000000000000000000000000000000000000000000000f00030073797a6b616c6c6572300000240012000a00010076786c616e00000014000200080001007b000000080002007f000001", 0x54}], 0x1}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@bridge_newneigh={0x30, 0x1c, 0xc01, 0x0, 0x0, {0x7, 0x0, 0x0, r3, 0x80, 0x2}, [@NDA_DST_IPV4={0x8, 0x1, @loopback}, @NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}]}, 0x30}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 948.103266ms ago: executing program 2 (id=1130): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000ae8ff030900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114000000110001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180060001000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c0001800600010058"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40) 896.426903ms ago: executing program 0 (id=1131): sendmsg$inet(0xffffffffffffffff, 0x0, 0x40) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001000)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000001080)={0x73622a85, 0x110a, 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f0000000000)=""/4096, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000200)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) syz_usb_disconnect(0xffffffffffffffff) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="c80000001000010402400000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="88d10100000000009400128009000100766c616e00000000840002800c00020008000000000000004c0004800c00010084000000030000000c00010000000000ffffffff0c00010405000000060000000c00010085ffffff080000000c00010002000000ff0f00000c000100ff030000ff0f00000400038006000500810000001c0003806700010002100000060000000c0001000c0000000700000014000300766c616e30"], 0xc8}}, 0x0) 878.62199ms ago: executing program 3 (id=1132): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a697000000005000400000000000900020073797a3000000000240007800c00028008000140ac1414280c000180080001"], 0x6c}}, 0x0) 861.082597ms ago: executing program 3 (id=1133): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xc) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b000900", 0x2c}], 0x1) 843.012011ms ago: executing program 3 (id=1134): getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000380)={0x0, @in={{0x2, 0x4e22, @multicast1}}}, &(0x7f0000000040)=0x84) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 839.933685ms ago: executing program 5 (id=1135): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40000000000035d, 0x20000084) recvmmsg(r1, &(0x7f00000000c0), 0x191d1f8, 0x10042, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=@base={0x11, 0x4, 0x4, 0x1000ff, 0x4}, 0x48) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x67, &(0x7f0000000180)=0x27b, 0x4) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e25, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000019080), 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @broadcast}, {0x2, 0x22, @dev={0xac, 0x14, 0x14, 0xc}}, {0x2, 0x4e24, @local}, 0x7d, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x0, 0x0, 0x1009}) 785.324304ms ago: executing program 3 (id=1136): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000100)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) 775.111184ms ago: executing program 2 (id=1137): unshare(0x22020600) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl(r0, 0x3b8e, &(0x7f0000000000)) 369.755797ms ago: executing program 1 (id=1138): ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @remote}, {0x1}, 0xc, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x44}}}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x77}], 0x1, 0x4000ffe, 0x0) 269.837432ms ago: executing program 1 (id=1139): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a00001400028010000b800c001145"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 205.375608ms ago: executing program 1 (id=1140): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4040854}, 0x0) recvmmsg(r0, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000500)=""/150, 0x96}, {&(0x7f00000027c0)=""/4133, 0x1025}, {&(0x7f0000000040)=""/185, 0xb9}, {&(0x7f0000000a40)=""/4081, 0xff1}, {&(0x7f0000000200)=""/30, 0x1e}], 0x5}, 0xd}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}}], 0x4, 0x40000102, 0x0) 193.720143ms ago: executing program 1 (id=1141): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="30000000110001000000000000000000000000000000000000000000000000000f00030073797a6b616c6c65723000", 0x2f}], 0x1}, 0x0) sendmsg$sock(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000a00)="54000000100001040000000000000000000000000000000000000000000000000f00030073797a6b616c6c6572300000240012000a00010076786c616e00000014000200080001007b000000080002007f000001", 0x54}], 0x1}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@bridge_newneigh={0x30, 0x1c, 0xc01, 0x0, 0x0, {0x7, 0x0, 0x0, r3, 0x80, 0x2}, [@NDA_DST_IPV4={0x8, 0x1, @loopback}, @NDA_LLADDR={0xa, 0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}]}, 0x30}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 126.89874ms ago: executing program 1 (id=1142): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)={0x1c, 0x8, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080004) 61.575209ms ago: executing program 3 (id=1143): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8008}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x54}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 61.410023ms ago: executing program 5 (id=1144): socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 13.355627ms ago: executing program 2 (id=1145): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xc) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001400add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffff", 0x42}], 0x1) 0s ago: executing program 1 (id=1146): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)) readv(r0, &(0x7f0000000740)=[{&(0x7f0000000640)=""/36, 0x24}], 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.155' (ED25519) to the list of known hosts. [ 28.513573][ T4695] cgroup: Unknown subsys name 'net' [ 28.643538][ T4695] cgroup: Unknown subsys name 'cpuset' [ 28.645618][ T4695] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.784538][ T4695] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.587576][ T4721] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.587957][ T4722] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.588137][ T4722] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.588514][ T4722] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.589030][ T4722] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.589156][ T4722] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.589438][ T4722] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.589784][ T4722] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.589996][ T4722] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.591059][ T4722] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.591232][ T4722] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.591463][ T4722] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.591619][ T4722] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.592202][ T4722] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.592637][ T4723] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.593480][ T4722] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.593607][ T4722] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.595359][ T4722] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.596178][ T4722] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.597220][ T4722] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 29.597699][ T4722] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.599336][ T4722] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.599448][ T4722] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.608016][ T4722] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.622789][ T4722] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.025338][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.025555][ T4708] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.025622][ T4708] bridge_slave_0: entered allmulticast mode [ 30.026105][ T4708] bridge_slave_0: entered promiscuous mode [ 30.027623][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.027645][ T4708] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.027692][ T4708] bridge_slave_1: entered allmulticast mode [ 30.028141][ T4708] bridge_slave_1: entered promiscuous mode [ 30.038324][ T4715] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.038374][ T4715] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.038437][ T4715] bridge_slave_0: entered allmulticast mode [ 30.038838][ T4715] bridge_slave_0: entered promiscuous mode [ 30.039993][ T4715] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.040012][ T4715] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.040059][ T4715] bridge_slave_1: entered allmulticast mode [ 30.040532][ T4715] bridge_slave_1: entered promiscuous mode [ 30.057885][ T4708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.058907][ T4708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.078360][ T4708] team0: Port device team_slave_0 added [ 30.078704][ T4707] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.078774][ T4707] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.078866][ T4707] bridge_slave_0: entered allmulticast mode [ 30.079282][ T4707] bridge_slave_0: entered promiscuous mode [ 30.080410][ T4707] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.080430][ T4707] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.080475][ T4707] bridge_slave_1: entered allmulticast mode [ 30.080884][ T4707] bridge_slave_1: entered promiscuous mode [ 30.097082][ T4708] team0: Port device team_slave_1 added [ 30.103709][ T4715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.104997][ T4715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.113753][ T4706] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.113816][ T4706] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.113917][ T4706] bridge_slave_0: entered allmulticast mode [ 30.114326][ T4706] bridge_slave_0: entered promiscuous mode [ 30.115034][ T4706] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.115056][ T4706] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.115101][ T4706] bridge_slave_1: entered allmulticast mode [ 30.115488][ T4706] bridge_slave_1: entered promiscuous mode [ 30.121992][ T4706] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.122610][ T4716] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.122632][ T4716] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.122725][ T4716] bridge_slave_0: entered allmulticast mode [ 30.123131][ T4716] bridge_slave_0: entered promiscuous mode [ 30.123819][ T4716] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.123839][ T4716] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.123884][ T4716] bridge_slave_1: entered allmulticast mode [ 30.124276][ T4716] bridge_slave_1: entered promiscuous mode [ 30.131036][ T4716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.131923][ T4716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.141012][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.141033][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.141055][ T4708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.151173][ T4706] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.160429][ T4707] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.161385][ T4707] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.164799][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.166153][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.171042][ T4708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.175255][ T4715] team0: Port device team_slave_0 added [ 30.176070][ T4715] team0: Port device team_slave_1 added [ 30.179450][ T4716] team0: Port device team_slave_0 added [ 30.180563][ T4716] team0: Port device team_slave_1 added [ 30.184228][ T4706] team0: Port device team_slave_0 added [ 30.188674][ T4706] team0: Port device team_slave_1 added [ 30.199128][ T4706] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.200526][ T4706] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.205811][ T4706] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.210765][ T4706] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.212024][ T4706] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.217146][ T4706] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.220044][ T4707] team0: Port device team_slave_0 added [ 30.220858][ T4707] team0: Port device team_slave_1 added [ 30.224874][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.224894][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.224919][ T4715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.225482][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.225493][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.225504][ T4716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.226329][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.226337][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.226352][ T4716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.239865][ T4708] hsr_slave_0: entered promiscuous mode [ 30.240198][ T4708] hsr_slave_1: entered promiscuous mode [ 30.251610][ T4715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.252521][ T4715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.252544][ T4715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.268501][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.269873][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.272361][ T4707] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.284280][ T4715] hsr_slave_0: entered promiscuous mode [ 30.285805][ T4715] hsr_slave_1: entered promiscuous mode [ 30.286008][ T4715] debugfs: 'hsr0' already exists in 'hsr' [ 30.286047][ T4715] Cannot create hsr debugfs directory [ 30.287499][ T4706] hsr_slave_0: entered promiscuous mode [ 30.287821][ T4706] hsr_slave_1: entered promiscuous mode [ 30.288006][ T4706] debugfs: 'hsr0' already exists in 'hsr' [ 30.288021][ T4706] Cannot create hsr debugfs directory [ 30.288697][ T4707] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.288711][ T4707] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.288744][ T4707] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.298309][ T4716] hsr_slave_0: entered promiscuous mode [ 30.298605][ T4716] hsr_slave_1: entered promiscuous mode [ 30.298803][ T4716] debugfs: 'hsr0' already exists in 'hsr' [ 30.298812][ T4716] Cannot create hsr debugfs directory [ 30.333508][ T4707] hsr_slave_0: entered promiscuous mode [ 30.333808][ T4707] hsr_slave_1: entered promiscuous mode [ 30.333983][ T4707] debugfs: 'hsr0' already exists in 'hsr' [ 30.333991][ T4707] Cannot create hsr debugfs directory [ 30.434277][ T4708] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.438487][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.440187][ T4708] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.442446][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.445871][ T4708] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.448426][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.450314][ T4708] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.452745][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.468429][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.468481][ T4708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.468632][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.468673][ T4708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.473027][ T4706] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.475378][ T4706] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.476240][ T4706] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.477907][ T4706] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.481612][ T4706] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.484582][ T4706] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.484895][ T4706] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.486710][ T4706] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.506895][ T4706] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.506935][ T4706] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.507025][ T4706] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.507065][ T4706] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.511705][ T4716] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.514738][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.515050][ T4716] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.517091][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.519064][ T4716] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.521318][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.524295][ T4716] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.526418][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.541614][ T4708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.553939][ T4708] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.555775][ T4715] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.557993][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.558294][ T4715] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.560834][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.564758][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.566597][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.569500][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.573805][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.589594][ T4706] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.589778][ T4715] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.591703][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.591991][ T4715] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.593746][ T4715] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.601295][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.601340][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.602676][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.602698][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.626549][ T4707] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.628803][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.630544][ T4707] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.633053][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.637292][ T4707] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.639479][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.639945][ T4707] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.643661][ T4707] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.648109][ T4706] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.661939][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.661978][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.665895][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.665930][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.700624][ T4707] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.709862][ T4707] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.716909][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.716951][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.717303][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.717321][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.726803][ T4716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.736322][ T4716] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.744199][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.744253][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.754553][ T4707] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.756453][ T4707] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.764123][ T83] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.764164][ T83] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.780140][ T4715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.791957][ T4716] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.794556][ T4716] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.801638][ T4715] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.826296][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.826342][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.851123][ T4715] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.853542][ T4715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.857798][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.857832][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.902052][ T4708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.935868][ T4708] veth0_vlan: entered promiscuous mode [ 30.940343][ T4708] veth1_vlan: entered promiscuous mode [ 30.954726][ T4706] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.966008][ T4708] veth0_macvtap: entered promiscuous mode [ 30.968438][ T4708] veth1_macvtap: entered promiscuous mode [ 30.974147][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.984995][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.986880][ T3584] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.987123][ T3584] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.987293][ T3584] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.987368][ T3584] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.034933][ T3523] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.036605][ T3523] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.045262][ T4707] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.057224][ T3584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.066590][ T3584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.079644][ T4707] veth0_vlan: entered promiscuous mode [ 31.092620][ T4707] veth1_vlan: entered promiscuous mode [ 31.104765][ T4707] veth0_macvtap: entered promiscuous mode [ 31.110769][ T4716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.118376][ T4707] veth1_macvtap: entered promiscuous mode [ 31.119341][ T4708] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.135751][ T4716] veth0_vlan: entered promiscuous mode [ 31.139049][ T4716] veth1_vlan: entered promiscuous mode [ 31.144151][ T4715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.147196][ T4706] veth0_vlan: entered promiscuous mode [ 31.161612][ T4890] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 31.169376][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.172717][ T4707] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.191697][ T4715] veth0_vlan: entered promiscuous mode [ 31.199637][ T4716] veth0_macvtap: entered promiscuous mode [ 31.201881][ T4706] veth1_vlan: entered promiscuous mode [ 31.203696][ T3523] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.205598][ T3523] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.205687][ T3523] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.205762][ T3523] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.212179][ T4715] veth1_vlan: entered promiscuous mode [ 31.212191][ T4892] netlink: 564 bytes leftover after parsing attributes in process `syz.3.6'. [ 31.217662][ T4715] veth0_macvtap: entered promiscuous mode [ 31.228220][ T4716] veth1_macvtap: entered promiscuous mode [ 31.231862][ T4715] veth1_macvtap: entered promiscuous mode [ 31.236209][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.237245][ T4715] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.241860][ T4892] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input2 [ 31.255971][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.257284][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.259081][ T4706] veth0_macvtap: entered promiscuous mode [ 31.260104][ T4706] veth1_macvtap: entered promiscuous mode [ 31.268617][ T3193] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.270230][ T3193] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.292544][ T3523] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.315530][ T4706] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.316628][ T4706] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.318413][ T3584] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.318460][ T3584] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.318509][ T3584] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.324248][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.324696][ T3584] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.324791][ T3584] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.324869][ T3584] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.334659][ T3193] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.334690][ T3193] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.340758][ T4895] netlink: 'syz.3.7': attribute type 1 has an invalid length. [ 31.344815][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.344837][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.367080][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.367109][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.388348][ T3193] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.388378][ T3193] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.393377][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.393428][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.393453][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.407313][ T3193] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.407341][ T3193] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.434376][ T3523] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.441939][ T3193] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.441975][ T3193] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.451835][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.451867][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.520588][ T4908] Zero length message leads to an empty skb [ 31.605219][ T4919] veth1_macvtap: left promiscuous mode [ 31.605280][ T4919] macsec0: entered allmulticast mode [ 31.610792][ T4919] veth1_macvtap: entered promiscuous mode [ 31.610822][ T4919] veth1_macvtap: entered allmulticast mode [ 31.610871][ T4919] macsec0: left allmulticast mode [ 31.610879][ T4919] veth1_macvtap: left allmulticast mode [ 31.672565][ T4720] Bluetooth: hci2: command tx timeout [ 31.682606][ T51] Bluetooth: hci4: command tx timeout [ 31.683820][ T51] Bluetooth: hci1: command tx timeout [ 31.684951][ T51] Bluetooth: hci3: command tx timeout [ 31.686106][ T4720] Bluetooth: hci0: command tx timeout [ 31.695203][ T4796] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.732095][ T4934] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19'. [ 31.754855][ T4936] netlink: 56 bytes leftover after parsing attributes in process `syz.3.21'. [ 31.884965][ T4796] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 31.890618][ T4796] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.972112][ T4796] usb 1-1: config 0 descriptor?? [ 32.812014][ T4953] netlink: 8 bytes leftover after parsing attributes in process `syz.4.29'. [ 32.826984][ T4945] syzkaller0: entered promiscuous mode [ 32.828239][ T4945] syzkaller0: entered allmulticast mode [ 32.850031][ T4945] netlink: 4 bytes leftover after parsing attributes in process `syz.1.25'. [ 32.865843][ T4954] netlink: 2 bytes leftover after parsing attributes in process `syz.3.28'. [ 32.870317][ T4956] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 32.870792][ T4950] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 33.053622][ T4796] usb 1-1: Cannot set MAC address [ 33.053801][ T4796] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 33.057902][ T4796] usb 1-1: USB disconnect, device number 2 [ 33.101527][ T4954] bond1: entered promiscuous mode [ 33.101576][ T4954] bond1: entered allmulticast mode [ 33.101748][ T4954] 8021q: adding VLAN 0 to HW filter on device bond1 [ 33.401469][ T4973] Bluetooth: MGMT ver 1.23 [ 33.443112][ T4973] netlink: 20 bytes leftover after parsing attributes in process `syz.3.34'. [ 33.602331][ T4976] netlink: 56 bytes leftover after parsing attributes in process `syz.2.38'. [ 33.780911][ T4720] Bluetooth: hci0: command tx timeout [ 33.781031][ T4720] Bluetooth: hci3: command tx timeout [ 33.781166][ T4720] Bluetooth: hci2: command tx timeout [ 33.781324][ T4720] Bluetooth: hci1: command tx timeout [ 33.781566][ T4720] Bluetooth: hci4: command tx timeout [ 34.488066][ T1090] cfg80211: failed to load regulatory.db [ 34.556279][ T4981] loop0: detected capacity change from 0 to 512 [ 34.594891][ T4981] EXT4-fs error (device loop0): ext4_orphan_get:1403: inode #15: comm syz.0.39: iget: bad i_size value: 38620345925642 [ 34.594953][ T4981] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 34.595963][ T4981] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.39: couldn't read orphan inode 15 (err -117) [ 34.596024][ T4981] loop0: lost filesystem error report for type 5 error -117 [ 34.596658][ T4981] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.657461][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 34.778982][ T5003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.779204][ T5003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.850116][ T5013] loop0: detected capacity change from 0 to 512 [ 34.872658][ T5013] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 34.878757][ T5013] EXT4-fs (loop0): invalid journal inode [ 34.878830][ T5013] EXT4-fs (loop0): can't get journal size [ 34.883007][ T5013] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e056c118, mo2=0002] [ 34.883121][ T5013] System zones: 1-12, 13-13 [ 34.884166][ T5013] EXT4-fs (loop0): 1 truncate cleaned up [ 34.884724][ T5013] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 34.898172][ T5016] netlink: zone id is out of range [ 34.898195][ T5016] netlink: zone id is out of range [ 34.944749][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.154135][ T5029] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 35.469424][ T5043] loop3: detected capacity change from 0 to 512 [ 35.474084][ T5043] EXT4-fs error (device loop3): ext4_orphan_get:1403: inode #15: comm syz.3.66: iget: bad i_size value: 38620345925642 [ 35.474114][ T5043] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 35.476939][ T5043] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.66: couldn't read orphan inode 15 (err -117) [ 35.476962][ T5043] loop3: lost filesystem error report for type 5 error -117 [ 35.478376][ T5043] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.494054][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 35.810906][ T5072] loop2: detected capacity change from 0 to 512 [ 35.817239][ T5072] EXT4-fs error (device loop2): ext4_orphan_get:1403: inode #15: comm syz.2.78: iget: bad i_size value: 38620345925642 [ 35.817274][ T5072] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 35.820176][ T5072] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.78: couldn't read orphan inode 15 (err -117) [ 35.820217][ T5072] loop2: lost filesystem error report for type 5 error -117 [ 35.822256][ C1] EXT4-fs (loop2): error count since last fsck: 2 [ 35.822272][ C1] EXT4-fs (loop2): initial error at time 35: ext4_orphan_get:1403: inode 15 [ 35.822288][ C1] EXT4-fs (loop2): last error at time 35: ext4_orphan_get:1408 [ 35.825285][ T5072] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.833257][ T4709] Bluetooth: hci2: command tx timeout [ 35.833278][ T4709] Bluetooth: hci3: command tx timeout [ 35.833295][ T4709] Bluetooth: hci0: command tx timeout [ 35.833386][ T4720] Bluetooth: hci1: command tx timeout [ 35.833419][ T51] Bluetooth: hci4: command tx timeout [ 35.840597][ T4716] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.229476][ T5112] syzkaller0: entered promiscuous mode [ 36.229509][ T5112] syzkaller0: entered allmulticast mode [ 36.318675][ T5127] netlink: 20 bytes leftover after parsing attributes in process `syz.4.101'. [ 36.320756][ T5127] netlink: 8 bytes leftover after parsing attributes in process `syz.4.101'. [ 36.331452][ T5128] ±ÿª¨úrBº“€: renamed from lo (while UP) [ 36.360251][ T5131] lo speed is unknown, defaulting to 1000 [ 36.364638][ T5131] lo speed is unknown, defaulting to 1000 [ 36.365235][ T5131] lo speed is unknown, defaulting to 1000 [ 36.371498][ T5131] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 36.387533][ T5131] lo speed is unknown, defaulting to 1000 [ 36.387967][ T5131] lo speed is unknown, defaulting to 1000 [ 36.388343][ T5131] lo speed is unknown, defaulting to 1000 [ 36.388656][ T5131] lo speed is unknown, defaulting to 1000 [ 36.388989][ T5131] lo speed is unknown, defaulting to 1000 [ 36.410623][ T5135] sctp: [Deprecated]: syz.4.104 (pid 5135) Use of struct sctp_assoc_value in delayed_ack socket option. [ 36.410623][ T5135] Use struct sctp_sack_info instead [ 36.451697][ T5141] netlink: 56 bytes leftover after parsing attributes in process `syz.0.106'. [ 37.320221][ T5155] lo speed is unknown, defaulting to 1000 [ 37.327618][ T5154] TCP: tcp_parse_options: Illegal window scaling value 215 > 14 received [ 37.521612][ T5172] netlink: 'syz.1.121': attribute type 33 has an invalid length. [ 37.910926][ T5190] netlink: 'syz.2.125': attribute type 9 has an invalid length. [ 37.913542][ T51] Bluetooth: hci4: command tx timeout [ 37.913563][ T51] Bluetooth: hci1: command tx timeout [ 37.913579][ T51] Bluetooth: hci0: command tx timeout [ 37.913592][ T51] Bluetooth: hci3: command tx timeout [ 37.913606][ T51] Bluetooth: hci2: command tx timeout [ 38.003319][ T5190] netlink: 'syz.2.125': attribute type 1 has an invalid length. [ 38.108442][ T5201] block nbd3: not configured, cannot reconfigure [ 38.117838][ T5202] netlink: 8 bytes leftover after parsing attributes in process `syz.4.130'. [ 38.117870][ T5202] netlink: 40 bytes leftover after parsing attributes in process `syz.4.130'. [ 38.176407][ T30] audit: type=1107 audit(38.170:2): pid=5209 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='' [ 38.227591][ T5214] xt_hashlimit: size too large, truncated to 1048576 [ 38.397957][ T5227] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 38.451418][ T5230] netlink: zone id is out of range [ 38.451466][ T5230] netlink: set zone limit has 4 unknown bytes [ 38.518109][ T5235] bond1 (unregistering): Released all slaves [ 38.541902][ T5238] veth1_macvtap: left promiscuous mode [ 38.545548][ T5238] macsec0: entered allmulticast mode [ 38.647106][ T5250] lo: entered allmulticast mode [ 38.648570][ T5248] lo: left allmulticast mode [ 38.685936][ T5256] tipc: Started in network mode [ 38.685972][ T5256] tipc: Node identity 4246, cluster identity 4711 [ 38.685982][ T5256] tipc: Node number set to 16966 [ 38.686201][ T5256] tipc: Cannot configure node identity twice [ 38.734746][ T5264] netlink: 8 bytes leftover after parsing attributes in process `syz.3.160'. [ 38.734778][ T5264] bridge: RTM_NEWNEIGH with invalid ether address [ 38.776571][ T5267] veth1_macvtap: left promiscuous mode [ 38.777966][ T5267] macsec0: entered allmulticast mode [ 38.846583][ T5268] loop1: detected capacity change from 0 to 256 [ 38.946021][ T5278] netlink: 20 bytes leftover after parsing attributes in process `syz.3.164'. [ 38.976822][ T5284] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 39.329998][ T5305] netlink: 24 bytes leftover after parsing attributes in process `syz.3.176'. [ 39.335337][ T5305] netlink: 12 bytes leftover after parsing attributes in process `syz.3.176'. [ 39.671255][ T5331] veth1_macvtap: entered promiscuous mode [ 39.671292][ T5331] veth1_macvtap: entered allmulticast mode [ 39.671365][ T5331] macsec0: left allmulticast mode [ 39.671378][ T5331] veth1_macvtap: left allmulticast mode [ 39.809758][ T5350] netlink: zone id is out of range [ 39.809787][ T5350] netlink: zone id is out of range [ 39.895401][ T5365] tipc: Can't bind to reserved service type 1 [ 39.947120][ T5372] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input3 [ 40.039788][ T5385] syz_tun: entered allmulticast mode [ 40.225118][ T5405] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.225459][ T5405] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.268262][ T5405] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 40.270339][ T5405] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 40.463967][ T40] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.464653][ T40] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.464677][ T40] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.464693][ T40] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 40.595774][ T5434] netlink: 'syz.2.230': attribute type 9 has an invalid length. [ 40.629049][ T5435] caif0: tun_chr_ioctl cmd 2147767507 [ 40.911580][ T5479] syzkaller0: entered promiscuous mode [ 40.911619][ T5479] syzkaller0: entered allmulticast mode [ 40.918129][ T5479] netlink: 8 bytes leftover after parsing attributes in process `syz.4.241'. [ 40.955289][ T4720] Bluetooth: hci0: command tx timeout [ 41.088547][ T5509] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 41.102025][ T5511] veth1_macvtap: left promiscuous mode [ 41.102060][ T5511] macsec0: entered allmulticast mode [ 41.277986][ T5541] loop0: detected capacity change from 0 to 512 [ 41.282909][ T5541] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 41.284573][ T5541] System zones: 1-12 [ 41.287028][ T5541] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.264: missing EA_INODE flag [ 41.288690][ T5541] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 41.289222][ T5541] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.264: error while reading EA inode 12 err=-117 [ 41.289238][ T5541] loop0: lost filesystem error report for type 5 error -117 [ 41.289554][ T5541] EXT4-fs (loop0): 1 orphan inode deleted [ 41.290037][ T5541] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 41.302857][ T5543] veth1_macvtap: left promiscuous mode [ 41.302888][ T5543] macsec0: entered allmulticast mode [ 41.522995][ T5557] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 41.525420][ T5557] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 42.329726][ T5577] __nla_validate_parse: 2 callbacks suppressed [ 42.329769][ T5577] netlink: 24 bytes leftover after parsing attributes in process `syz.2.278'. [ 42.339523][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.440944][ T5592] sctp: [Deprecated]: syz.1.284 (pid 5592) Use of struct sctp_assoc_value in delayed_ack socket option. [ 42.440944][ T5592] Use struct sctp_sack_info instead [ 42.442856][ T3584] IPVS: starting estimator thread 0... [ 42.443908][ T5590] IPVS: fo: TCP 127.0.0.1:21 - no destination available [ 42.451569][ T5589] team0 (unregistering): Port device team_slave_0 removed [ 42.455066][ T5589] team0 (unregistering): Port device team_slave_1 removed [ 42.533609][ T5593] IPVS: using max 50 ests per chain, 120000 per kthread [ 42.560551][ T5605] loop2: detected capacity change from 0 to 512 [ 42.567476][ T5605] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 42.569308][ T5605] System zones: 1-12 [ 42.571012][ T5605] EXT4-fs error (device loop2): ext4_xattr_inode_iget:437: inode #12: comm syz.2.290: missing EA_INODE flag [ 42.572586][ T5605] loop2: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 42.573521][ T5605] EXT4-fs error (device loop2): ext4_xattr_inode_iget:442: comm syz.2.290: error while reading EA inode 12 err=-117 [ 42.573546][ T5605] loop2: lost filesystem error report for type 5 error -117 [ 42.574410][ T5605] EXT4-fs (loop2): 1 orphan inode deleted [ 42.574863][ T5605] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 42.661094][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.809925][ T5617] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 42.811622][ T5617] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 43.497843][ T5623] sctp: [Deprecated]: syz.0.297 (pid 5623) Use of struct sctp_assoc_value in delayed_ack socket option. [ 43.497843][ T5623] Use struct sctp_sack_info instead [ 43.617935][ T4716] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 43.762806][ T5658] netlink: 20 bytes leftover after parsing attributes in process `syz.0.311'. [ 43.764060][ T5658] netlink: 20 bytes leftover after parsing attributes in process `syz.0.311'. [ 43.815385][ T5668] loop0: detected capacity change from 0 to 512 [ 43.821877][ T5668] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 43.821940][ T5668] System zones: 1-12 [ 43.827655][ T5668] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.313: missing EA_INODE flag [ 43.830952][ T5668] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 43.831214][ T5668] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.313: error while reading EA inode 12 err=-117 [ 43.831244][ T5668] loop0: lost filesystem error report for type 5 error -117 [ 43.833387][ C0] EXT4-fs (loop0): error count since last fsck: 2 [ 43.833402][ C0] EXT4-fs (loop0): initial error at time 43: ext4_xattr_inode_iget:437: inode 12 [ 43.833419][ C0] EXT4-fs (loop0): last error at time 43: ext4_xattr_inode_iget:442 [ 43.838893][ T5668] EXT4-fs (loop0): 1 orphan inode deleted [ 43.839346][ T5668] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.953496][ T5672] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 43.953717][ T5672] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 44.258233][ T5676] sctp: [Deprecated]: syz.4.315 (pid 5676) Use of struct sctp_assoc_value in delayed_ack socket option. [ 44.258233][ T5676] Use struct sctp_sack_info instead [ 44.332535][ T5682] warning: `syz.4.318' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 44.470054][ T5699] netlink: 24 bytes leftover after parsing attributes in process `syz.1.326'. [ 44.470725][ T5699] netlink: 16 bytes leftover after parsing attributes in process `syz.1.326'. [ 44.581685][ T5712] bond1: invalid ARP target 0.0.0.0 specified for addition [ 44.581719][ T5712] bond1: option arp_ip_target: invalid value (0) [ 44.585495][ T5712] bond1 (unregistering): Released all slaves [ 44.688877][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.713738][ T5718] bond1 (unregistering): Released all slaves [ 44.805469][ T5728] bridge0: port 2(bridge_slave_1) entered disabled state [ 44.805645][ T5728] bridge0: port 1(bridge_slave_0) entered disabled state [ 44.848821][ T5728] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 44.850774][ T5728] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 45.012846][ T3584] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.013531][ T3584] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.013559][ T3584] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.013579][ T3584] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.684684][ T5740] ip_tables: iptables: counters copy to user failed while replacing table [ 45.711782][ T5742] loop4: detected capacity change from 0 to 512 [ 45.717048][ T5742] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 45.717097][ T5742] System zones: 1-12 [ 45.717627][ T5742] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.345: missing EA_INODE flag [ 45.717640][ T5742] loop4: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 45.717992][ T5742] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.345: error while reading EA inode 12 err=-117 [ 45.718009][ T5742] loop4: lost filesystem error report for type 5 error -117 [ 45.718128][ T5742] EXT4-fs (loop4): 1 orphan inode deleted [ 45.718565][ T5742] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.836925][ T5744] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 45.837100][ T5744] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 46.580151][ T4706] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.735746][ T5652] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 46.802388][ T5765] sctp: [Deprecated]: syz.0.353 (pid 5765) Use of struct sctp_assoc_value in delayed_ack socket option. [ 46.802388][ T5765] Use struct sctp_sack_info instead [ 46.825811][ T5767] loop3: detected capacity change from 0 to 512 [ 46.826796][ T5769] loop1: detected capacity change from 0 to 512 [ 46.839478][ T5769] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 46.839554][ T5769] System zones: 1-12 [ 46.842201][ T5769] EXT4-fs error (device loop1): ext4_xattr_inode_iget:437: inode #12: comm syz.1.357: missing EA_INODE flag [ 46.842818][ T5769] loop1: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 46.845006][ T5767] EXT4-fs error (device loop3): ext4_orphan_get:1403: inode #15: comm syz.3.356: iget: bad i_size value: 38620345925642 [ 46.845041][ T5767] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 46.845086][ T5769] EXT4-fs error (device loop1): ext4_xattr_inode_iget:442: comm syz.1.357: error while reading EA inode 12 err=-117 [ 46.845118][ T5769] loop1: lost filesystem error report for type 5 error -117 [ 46.845577][ T5769] EXT4-fs (loop1): 1 orphan inode deleted [ 46.846148][ T5769] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.852783][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 46.852798][ C0] EXT4-fs (loop3): initial error at time 46: ext4_orphan_get:1403: inode 15 [ 46.852813][ C0] EXT4-fs (loop3): last error at time 46: ext4_orphan_get:1403: inode 15 [ 46.862205][ T5767] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.356: couldn't read orphan inode 15 (err -117) [ 46.862763][ T5767] loop3: lost filesystem error report for type 5 error -117 [ 46.865910][ T5767] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.971219][ T5774] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 46.971406][ T5774] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 46.988988][ T5767] EXT4-fs error (device loop3): ext4_validate_block_bitmap:436: comm syz.3.356: bg 0: block 5: invalid block bitmap [ 46.990022][ T5767] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 46.990038][ T5767] EXT4-fs (loop3): This should not happen!! Data will be lost [ 46.990038][ T5767] [ 46.990047][ T5767] EXT4-fs (loop3): Total free blocks count 0 [ 46.990054][ T5767] EXT4-fs (loop3): Free/Dirty block details [ 46.990064][ T5767] EXT4-fs (loop3): free_blocks=0 [ 46.990075][ T5767] EXT4-fs (loop3): dirty_blocks=2236 [ 46.990082][ T5767] EXT4-fs (loop3): Block reservation details [ 46.990088][ T5767] EXT4-fs (loop3): i_reserved_data_blocks=2236 [ 47.010172][ T3584] EXT4-fs (loop3): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 180 with error 28 [ 47.082899][ T5792] netlink: 'syz.0.365': attribute type 4 has an invalid length. [ 47.153022][ T3523] IPVS: starting estimator thread 0... [ 47.194765][ T5801] sctp: [Deprecated]: syz.0.369 (pid 5801) Use of struct sctp_assoc_value in delayed_ack socket option. [ 47.194765][ T5801] Use struct sctp_sack_info instead [ 47.252637][ T5797] IPVS: using max 58 ests per chain, 139200 per kthread [ 47.411462][ T5818] loop0: detected capacity change from 0 to 512 [ 47.425666][ T5818] EXT4-fs error (device loop0): ext4_orphan_get:1403: inode #15: comm syz.0.377: iget: bad i_size value: 38620345925642 [ 47.425702][ T5818] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 47.428676][ T5818] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.377: couldn't read orphan inode 15 (err -117) [ 47.432851][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 47.432864][ C0] EXT4-fs (loop0): initial error at time 47: ext4_orphan_get:1403: inode 15 [ 47.432883][ C0] EXT4-fs (loop0): last error at time 47: ext4_orphan_get:1403: inode 15 [ 47.432967][ T5818] loop0: lost filesystem error report for type 5 error -117 [ 47.436437][ T5818] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 47.498026][ T5818] EXT4-fs error (device loop0): ext4_validate_block_bitmap:436: comm syz.0.377: bg 0: block 5: invalid block bitmap [ 47.500736][ T5818] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 47.501250][ T5818] EXT4-fs (loop0): This should not happen!! Data will be lost [ 47.501250][ T5818] [ 47.501261][ T5818] EXT4-fs (loop0): Total free blocks count 0 [ 47.501270][ T5818] EXT4-fs (loop0): Free/Dirty block details [ 47.501279][ T5818] EXT4-fs (loop0): free_blocks=0 [ 47.501289][ T5818] EXT4-fs (loop0): dirty_blocks=3284 [ 47.501297][ T5818] EXT4-fs (loop0): Block reservation details [ 47.501304][ T5818] EXT4-fs (loop0): i_reserved_data_blocks=3284 [ 47.522995][ T3584] EXT4-fs (loop0): Delayed block allocation failed for inode 18 at logical offset 2052 with max blocks 1232 with error 28 [ 47.694996][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 48.473674][ T5848] sctp: [Deprecated]: syz.4.388 (pid 5848) Use of struct sctp_assoc_value in delayed_ack socket option. [ 48.473674][ T5848] Use struct sctp_sack_info instead [ 48.957672][ T5873] syzkaller0: entered promiscuous mode [ 48.957699][ T5873] syzkaller0: entered allmulticast mode [ 49.095782][ T5879] dlm: no local IP address has been set [ 49.096361][ T5879] dlm: cannot start dlm midcomms -107 [ 49.264927][ T5884] loop4: detected capacity change from 0 to 256 [ 50.029885][ T5787] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 50.079436][ T5888] loop0: detected capacity change from 0 to 512 [ 50.093108][ T5888] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 50.093216][ T5888] System zones: 1-12 [ 50.096336][ T5888] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.406: missing EA_INODE flag [ 50.096369][ T5888] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 50.098709][ T5888] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.406: error while reading EA inode 12 err=-117 [ 50.102833][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 50.102842][ C0] EXT4-fs (loop0): initial error at time 50: ext4_xattr_inode_iget:437: inode 12 [ 50.102858][ C0] EXT4-fs (loop0): last error at time 50: ext4_xattr_inode_iget:437: inode 12 [ 50.111878][ T5888] loop0: lost filesystem error report for type 5 error -117 [ 50.112054][ T5888] EXT4-fs (loop0): 1 orphan inode deleted [ 50.115345][ T5888] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 50.125688][ T5895] kernel profiling enabled (shift: 63) [ 50.125724][ T5895] profiling shift: 63 too large [ 50.128489][ T5897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.130792][ T5897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.205533][ T5902] syzkaller0: entered promiscuous mode [ 50.206633][ T5902] syzkaller0: entered allmulticast mode [ 50.245971][ T5903] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 50.246156][ T5903] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 50.279560][ T5912] Config c/1 of g1 needs at least one function. [ 50.281798][ T5912] udc dummy_udc.0: failed to start g1: -22 [ 50.283139][ T5912] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 50.287016][ T5912] UDC core: g1: couldn't find an available UDC or it's busy [ 50.357865][ T5897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.358061][ T5897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.425823][ T5922] loop3: detected capacity change from 0 to 256 [ 50.760407][ T5897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.760598][ T5897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.924149][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.725257][ T5951] syzkaller0: entered promiscuous mode [ 51.725969][ T5951] syzkaller0: entered allmulticast mode [ 51.803040][ T5953] syzkaller0: entered promiscuous mode [ 51.803064][ T5953] syzkaller0: entered allmulticast mode [ 52.090919][ T5956] netlink: 24 bytes leftover after parsing attributes in process `syz.2.430'. [ 52.091855][ T5956] vlan0: entered promiscuous mode [ 53.194454][ T5958] syzkaller0: entered promiscuous mode [ 53.194482][ T5958] syzkaller0: entered allmulticast mode [ 53.359204][ T5920] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 53.477155][ T5976] netlink: 8 bytes leftover after parsing attributes in process `syz.2.440'. [ 53.478941][ T5976] netlink: 8 bytes leftover after parsing attributes in process `syz.2.440'. [ 53.480692][ T5976] FAULT_INJECTION: forcing a failure. [ 53.480692][ T5976] name failslab, interval 1, probability 0, space 0, times 1 [ 53.484357][ T5976] CPU: 0 UID: 0 PID: 5976 Comm: syz.2.440 Not tainted syzkaller #0 PREEMPT [ 53.484378][ T5976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 53.484384][ T5976] Call trace: [ 53.484388][ T5976] show_stack+0x2c/0x3c (C) [ 53.484413][ T5976] __dump_stack+0x30/0x40 [ 53.484427][ T5976] dump_stack_lvl+0xd8/0x12c [ 53.484440][ T5976] dump_stack+0x1c/0x28 [ 53.484451][ T5976] should_fail_ex+0x41c/0x590 [ 53.484464][ T5976] should_failslab+0xc4/0x120 [ 53.484477][ T5976] __kmalloc_noprof+0x108/0x6c8 [ 53.484486][ T5976] nft_set_elem_init+0xac/0x528 [ 53.484498][ T5976] nf_tables_newsetelem+0x1ad4/0x31fc [ 53.484506][ T5976] nfnetlink_rcv+0xc8c/0x16ec [ 53.484519][ T5976] netlink_unicast+0x600/0x7f8 [ 53.484528][ T5976] netlink_sendmsg+0x648/0x948 [ 53.484538][ T5976] __sock_sendmsg+0xc8/0x17c [ 53.484547][ T5976] ____sys_sendmsg+0x3d0/0x6c8 [ 53.484557][ T5976] ___sys_sendmsg+0x198/0x224 [ 53.484566][ T5976] __sys_sendmsg+0x158/0x204 [ 53.484575][ T5976] __arm64_sys_sendmsg+0x88/0x9c [ 53.484585][ T5976] invoke_syscall+0x98/0x244 [ 53.484597][ T5976] el0_svc_common+0xec/0x23c [ 53.484609][ T5976] do_el0_svc+0x4c/0x5c [ 53.484620][ T5976] el0_svc+0x64/0x260 [ 53.484631][ T5976] el0t_64_sync_handler+0x44/0x104 [ 53.484641][ T5976] el0t_64_sync+0x198/0x19c [ 53.495413][ T5978] FAULT_INJECTION: forcing a failure. [ 53.495413][ T5978] name failslab, interval 1, probability 0, space 0, times 1 [ 53.495427][ T5978] CPU: 1 UID: 0 PID: 5978 Comm: syz.4.439 Not tainted syzkaller #0 PREEMPT [ 53.495438][ T5978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 53.495443][ T5978] Call trace: [ 53.495446][ T5978] show_stack+0x2c/0x3c (C) [ 53.495462][ T5978] __dump_stack+0x30/0x40 [ 53.495474][ T5978] dump_stack_lvl+0xd8/0x12c [ 53.495485][ T5978] dump_stack+0x1c/0x28 [ 53.495497][ T5978] should_fail_ex+0x41c/0x590 [ 53.495509][ T5978] should_failslab+0xc4/0x120 [ 53.495521][ T5978] __kmalloc_cache_noprof+0x94/0x5fc [ 53.495529][ T5978] fuse_get_tree+0xc4/0x31c [ 53.495540][ T5978] vfs_get_tree+0x90/0x28c [ 53.495551][ T5978] fc_mount+0x24/0xac [ 53.495560][ T5978] do_new_mount+0x2a4/0x538 [ 53.495571][ T5978] path_mount+0x5f0/0xa88 [ 53.495581][ T5978] do_mount+0xe8/0x148 [ 53.495591][ T5978] __arm64_sys_mount+0x33c/0x388 [ 53.495602][ T5978] invoke_syscall+0x98/0x244 [ 53.495614][ T5978] el0_svc_common+0xec/0x23c [ 53.495626][ T5978] do_el0_svc+0x4c/0x5c [ 53.495637][ T5978] el0_svc+0x64/0x260 [ 53.495647][ T5978] el0t_64_sync_handler+0x44/0x104 [ 53.495657][ T5978] el0t_64_sync+0x198/0x19c [ 53.531045][ T5977] loop1: detected capacity change from 0 to 256 [ 53.565353][ T5982] team0 (unregistering): Port device team_slave_0 removed [ 53.568481][ T5982] team0 (unregistering): Port device team_slave_1 removed [ 53.662275][ T4804] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 53.816592][ T4804] usb 1-1: Using ep0 maxpacket: 8 [ 53.817973][ T4804] usb 1-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 53.821601][ T4804] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 53.821632][ T4804] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 53.821649][ T4804] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 53.829423][ T4804] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 53.829446][ T4804] usb 1-1: Product: syz [ 53.829465][ T4804] usb 1-1: Manufacturer: syz [ 53.829478][ T4804] usb 1-1: SerialNumber: syz [ 53.836364][ T4804] usb 1-1: config 0 descriptor?? [ 53.842686][ T4804] Registered IR keymap rc-imon-rsc [ 53.892274][ T4804] rc_core: Loaded IR protocol module ir-nec-decoder, but protocol nec still not available [ 53.894970][ T4804] rc rc0: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 53.901761][ T4804] input: iMON Station as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input4 [ 54.071343][ T6008] syzkaller0: entered promiscuous mode [ 54.071379][ T6008] syzkaller0: entered allmulticast mode [ 54.086283][ T10] usb 1-1: USB disconnect, device number 3 [ 54.285489][ T6026] loop2: detected capacity change from 0 to 256 [ 54.347345][ T6035] netlink: 8 bytes leftover after parsing attributes in process `syz.1.462'. [ 54.416415][ T6040] syzkaller0: entered promiscuous mode [ 54.416445][ T6040] syzkaller0: entered allmulticast mode [ 54.432473][ T6046] netlink: 8 bytes leftover after parsing attributes in process `syz.1.466'. [ 54.432502][ T6046] netlink: 8 bytes leftover after parsing attributes in process `syz.1.466'. [ 54.636768][ T6077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.481'. [ 54.636804][ T6077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.481'. [ 54.686441][ T6088] syzkaller0: entered promiscuous mode [ 54.686471][ T6088] syzkaller0: entered allmulticast mode [ 54.763623][ T6100] netlink: 'syz.3.489': attribute type 9 has an invalid length. [ 54.774623][ T6100] bridge2: entered promiscuous mode [ 54.869523][ T6119] xt_l2tp: missing protocol rule (udp|l2tpip) [ 54.936521][ T6125] syzkaller0: entered promiscuous mode [ 54.936556][ T6125] syzkaller0: entered allmulticast mode [ 54.979848][ T6134] netlink: 'syz.3.503': attribute type 9 has an invalid length. [ 54.982189][ T6134] bridge3: entered promiscuous mode [ 55.097684][ T6141] loop1: detected capacity change from 0 to 256 [ 55.164852][ T6154] netlink: 15 bytes leftover after parsing attributes in process `syz.1.511'. [ 55.273703][ T6167] netlink: 'syz.1.516': attribute type 9 has an invalid length. [ 55.276758][ T6167] bridge1: entered promiscuous mode [ 55.316660][ T6171] syzkaller0: entered promiscuous mode [ 55.316697][ T6171] syzkaller0: entered allmulticast mode [ 55.320865][ T6148] netlink: 24 bytes leftover after parsing attributes in process `syz.0.506'. [ 55.320911][ T6148] vlan0: entered promiscuous mode [ 55.502785][ T6185] Bluetooth: ISO socket layer initialized [ 55.537417][ T6187] veth1_macvtap: entered promiscuous mode [ 55.538510][ T6187] veth1_macvtap: entered allmulticast mode [ 55.538666][ T6187] macsec0: left allmulticast mode [ 55.538676][ T6187] veth1_macvtap: left allmulticast mode [ 55.541790][ T6187] 8021q: adding VLAN 0 to HW filter on device bond1 [ 55.543794][ T6187] 8021q: adding VLAN 0 to HW filter on device bond2 [ 55.544432][ T6187] bridge1: left promiscuous mode [ 55.545658][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.545683][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.814790][ T6205] syzkaller0: entered promiscuous mode [ 55.814826][ T6205] syzkaller0: entered allmulticast mode [ 56.375274][ T6262] syzkaller0: entered promiscuous mode [ 56.376457][ T6262] syzkaller0: entered allmulticast mode [ 56.378745][ T6262] tipc: Started in network mode [ 56.379770][ T6262] tipc: Node identity 021b729888e6, cluster identity 4711 [ 56.381339][ T6262] tipc: Enabled bearer , priority 0 [ 56.394590][ T6261] tipc: Resetting bearer [ 56.410584][ T6261] tipc: Disabling bearer [ 56.440834][ T6272] loop4: detected capacity change from 0 to 512 [ 56.469835][ T6272] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 56.469912][ T6272] System zones: 1-12 [ 56.476007][ T6272] EXT4-fs error (device loop4): ext4_xattr_inode_iget:437: inode #12: comm syz.4.556: missing EA_INODE flag [ 56.476042][ T6272] loop4: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 56.478461][ T6272] EXT4-fs error (device loop4): ext4_xattr_inode_iget:442: comm syz.4.556: error while reading EA inode 12 err=-117 [ 56.478491][ T6272] loop4: lost filesystem error report for type 5 error -117 [ 56.482486][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 56.482502][ C0] EXT4-fs (loop4): initial error at time 56: ext4_xattr_inode_iget:437: inode 12 [ 56.482518][ C0] EXT4-fs (loop4): last error at time 56: ext4_xattr_inode_iget:442 [ 56.486425][ T6272] EXT4-fs (loop4): 1 orphan inode deleted [ 56.486881][ T6272] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 56.569518][ T6272] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 56.569709][ T6272] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 56.647573][ T4706] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 56.694145][ T6299] loop0: detected capacity change from 0 to 256 [ 57.019791][ T6300] vlan0: entered promiscuous mode [ 57.243188][ T6327] IPVS: fo: TCP 127.0.0.1:21 - no destination available [ 57.321611][ T6330] loop2: detected capacity change from 0 to 256 [ 57.559316][ T6344] loop0: detected capacity change from 0 to 512 [ 57.561331][ T6343] syzkaller0: entered promiscuous mode [ 57.561881][ T6343] syzkaller0: entered allmulticast mode [ 57.565820][ T6344] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 57.566558][ T6344] System zones: 1-12 [ 57.568455][ T6344] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.583: missing EA_INODE flag [ 57.569386][ T6344] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 57.569554][ T6344] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.583: error while reading EA inode 12 err=-117 [ 57.569570][ T6344] loop0: lost filesystem error report for type 5 error -117 [ 57.569687][ T6344] EXT4-fs (loop0): 1 orphan inode deleted [ 57.570123][ T6344] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.587969][ T6344] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 57.588169][ T6344] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 57.605804][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 57.840241][ T6373] loop0: detected capacity change from 0 to 512 [ 57.844073][ T6373] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 57.844127][ T6373] System zones: 1-12 [ 57.846652][ T6373] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: inode #12: comm syz.0.595: missing EA_INODE flag [ 57.846672][ T6373] loop0: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 57.849035][ T6373] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.595: error while reading EA inode 12 err=-117 [ 57.852839][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 57.852852][ C1] EXT4-fs (loop0): initial error at time 57: ext4_xattr_inode_iget:437: inode 12 [ 57.852869][ C1] EXT4-fs (loop0): last error at time 57: ext4_xattr_inode_iget:437: inode 12 [ 57.857761][ T6373] loop0: lost filesystem error report for type 5 error -117 [ 57.858027][ T6373] EXT4-fs (loop0): 1 orphan inode deleted [ 57.860524][ T6373] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 57.875357][ T6373] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 57.875539][ T6373] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 57.901241][ T4707] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.069720][ T6403] loop3: detected capacity change from 0 to 512 [ 58.099925][ T6403] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 58.099978][ T6403] System zones: 1-12 [ 58.102809][ T6403] EXT4-fs error (device loop3): ext4_xattr_inode_iget:437: inode #12: comm syz.3.608: missing EA_INODE flag [ 58.102838][ T6403] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 58.105352][ T6403] EXT4-fs error (device loop3): ext4_xattr_inode_iget:442: comm syz.3.608: error while reading EA inode 12 err=-117 [ 58.110125][ T6403] loop3: lost filesystem error report for type 5 error -117 [ 58.111789][ T6403] EXT4-fs (loop3): 1 orphan inode deleted [ 58.114417][ T6403] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 58.129197][ T6403] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 58.129379][ T6403] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 58.175922][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.243303][ T6418] loop2: detected capacity change from 0 to 256 [ 58.602842][ T6428] __nla_validate_parse: 2 callbacks suppressed [ 58.602890][ T6428] netlink: 24 bytes leftover after parsing attributes in process `syz.0.613'. [ 58.678783][ T6448] syzkaller0: entered promiscuous mode [ 58.680162][ T6448] syzkaller0: entered allmulticast mode [ 59.393146][ T6489] ip_tables: iptables: counters copy to user failed while replacing table [ 59.432487][ T6493] capability: warning: `syz.1.648' uses deprecated v2 capabilities in a way that may be insecure [ 59.436102][ T6493] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 59.436645][ T6493] overlayfs: failed to get uuid (117/file2, err=-13); falling back to uuid=null. [ 59.530000][ T6500] FAULT_INJECTION: forcing a failure. [ 59.530000][ T6500] name failslab, interval 1, probability 0, space 0, times 0 [ 59.530035][ T6500] CPU: 0 UID: 0 PID: 6500 Comm: syz.3.652 Not tainted syzkaller #0 PREEMPT [ 59.530047][ T6500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 59.530053][ T6500] Call trace: [ 59.530056][ T6500] show_stack+0x2c/0x3c (C) [ 59.530075][ T6500] __dump_stack+0x30/0x40 [ 59.530088][ T6500] dump_stack_lvl+0xd8/0x12c [ 59.530099][ T6500] dump_stack+0x1c/0x28 [ 59.530110][ T6500] should_fail_ex+0x41c/0x590 [ 59.530123][ T6500] should_failslab+0xc4/0x120 [ 59.530136][ T6500] __kmalloc_node_track_caller_noprof+0x108/0x6e0 [ 59.530145][ T6500] kstrdup+0x50/0x104 [ 59.530153][ T6500] v9fs_init_fs_context+0xfc/0x4d4 [ 59.530164][ T6500] alloc_fs_context+0x7d8/0xba4 [ 59.530173][ T6500] fs_context_for_mount+0x34/0x44 [ 59.530182][ T6500] do_new_mount+0x158/0x538 [ 59.530193][ T6500] path_mount+0x5f0/0xa88 [ 59.530203][ T6500] do_mount+0xe8/0x148 [ 59.530213][ T6500] __arm64_sys_mount+0x33c/0x388 [ 59.530224][ T6500] invoke_syscall+0x98/0x244 [ 59.530236][ T6500] el0_svc_common+0xec/0x23c [ 59.530248][ T6500] do_el0_svc+0x4c/0x5c [ 59.530259][ T6500] el0_svc+0x64/0x260 [ 59.530270][ T6500] el0t_64_sync_handler+0x44/0x104 [ 59.530279][ T6500] el0t_64_sync+0x198/0x19c [ 59.535244][ T6497] syzkaller0: entered promiscuous mode [ 59.535256][ T6497] syzkaller0: entered allmulticast mode [ 59.619424][ T6504] rnbd_client L610: Mapping device /dev/ram0 on session s1, (access_mode: rw, nr_poll_queues: 0) [ 59.624843][ T6504] rtrs_client L2095: : Failed to resolve address, err: -ENODEV [ 59.626646][ T6504] rtrs_client L2638: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 59.950998][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.666'. [ 59.953754][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.666'. [ 60.042386][ T6538] netlink: 12 bytes leftover after parsing attributes in process `syz.0.670'. [ 60.272138][ T6560] loop3: detected capacity change from 0 to 512 [ 60.291125][ T6560] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 60.291183][ T6560] System zones: 1-12 [ 60.291435][ T6560] EXT4-fs error (device loop3): ext4_xattr_inode_iget:437: inode #12: comm syz.3.679: missing EA_INODE flag [ 60.291448][ T6560] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 60.291541][ T6560] EXT4-fs error (device loop3): ext4_xattr_inode_iget:442: comm syz.3.679: error while reading EA inode 12 err=-117 [ 60.291553][ T6560] loop3: lost filesystem error report for type 5 error -117 [ 60.291658][ T6560] EXT4-fs (loop3): 1 orphan inode deleted [ 60.292130][ T6560] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 60.509473][ T6573] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 60.513251][ T6573] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 60.677444][ T6586] syzkaller0: entered promiscuous mode [ 60.677476][ T6586] syzkaller0: entered allmulticast mode [ 60.958235][ T6603] netlink: 12 bytes leftover after parsing attributes in process `syz.0.698'. [ 61.225490][ T6622] netlink: 'syz.1.708': attribute type 1 has an invalid length. [ 61.225521][ T6622] netlink: 244 bytes leftover after parsing attributes in process `syz.1.708'. [ 61.284701][ T6625] 9pnet_virtio: no channels available for device syz [ 61.702333][ T4818] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 61.755106][ T6652] netlink: 24 bytes leftover after parsing attributes in process `syz.4.722'. [ 61.755145][ T6652] vlan0: entered promiscuous mode [ 61.769146][ T6670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.772119][ T6670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.852779][ T4818] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 61.855390][ T4818] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 61.855432][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.855456][ T4818] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.855477][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.855493][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.866615][ T4818] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 61.866641][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.866668][ T4818] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.866686][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.866701][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.878371][ T4818] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 61.878399][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 61.878429][ T4818] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 61.878444][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 61.878459][ T4818] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 61.891715][ T4818] usb 1-1: string descriptor 0 read error: -22 [ 61.891770][ T4818] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.903023][ T4818] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 62.080303][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.160661][ T4818] usb 1-1: USB disconnect, device number 4 [ 62.295609][ T6683] netlink: 4 bytes leftover after parsing attributes in process `syz.4.734'. [ 62.359633][ T6692] netlink: 8 bytes leftover after parsing attributes in process `syz.4.737'. [ 62.359665][ T6692] netlink: 8 bytes leftover after parsing attributes in process `syz.4.737'. [ 62.745620][ T6742] 9pnet_virtio: no channels available for device syz [ 63.026774][ T6783] syzkaller0: entered promiscuous mode [ 63.026807][ T6783] syzkaller0: entered allmulticast mode [ 63.043337][ T6785] binder: 6784:6785 unknown command 0 [ 63.044567][ T6785] binder: 6784:6785 ioctl c0306201 200001c0 returned -22 [ 63.206595][ T6801] syzkaller0: entered promiscuous mode [ 63.207881][ T6801] syzkaller0: entered allmulticast mode [ 63.286649][ T6811] FAULT_INJECTION: forcing a failure. [ 63.286649][ T6811] name failslab, interval 1, probability 0, space 0, times 0 [ 63.288234][ T6811] CPU: 0 UID: 0 PID: 6811 Comm: syz.3.786 Not tainted syzkaller #0 PREEMPT [ 63.288256][ T6811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 63.288263][ T6811] Call trace: [ 63.288267][ T6811] show_stack+0x2c/0x3c (C) [ 63.288288][ T6811] __dump_stack+0x30/0x40 [ 63.288302][ T6811] dump_stack_lvl+0xd8/0x12c [ 63.288313][ T6811] dump_stack+0x1c/0x28 [ 63.288325][ T6811] should_fail_ex+0x41c/0x590 [ 63.288337][ T6811] should_failslab+0xc4/0x120 [ 63.288350][ T6811] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 63.288363][ T6811] sock_alloc_inode+0x30/0x180 [ 63.288375][ T6811] alloc_inode+0x68/0x198 [ 63.288386][ T6811] sock_alloc+0x4c/0x204 [ 63.288394][ T6811] __sock_create+0x108/0x670 [ 63.288402][ T6811] __sys_socket_create+0xc0/0x11c [ 63.288411][ T6811] __sys_socket+0x44/0xec [ 63.288419][ T6811] __arm64_sys_socket+0x84/0x9c [ 63.288430][ T6811] invoke_syscall+0x98/0x244 [ 63.288442][ T6811] el0_svc_common+0xec/0x23c [ 63.288454][ T6811] do_el0_svc+0x4c/0x5c [ 63.288465][ T6811] el0_svc+0x64/0x260 [ 63.288476][ T6811] el0t_64_sync_handler+0x44/0x104 [ 63.288486][ T6811] el0t_64_sync+0x198/0x19c [ 63.288556][ T6811] socket: no more sockets [ 63.729140][ T6856] __nla_validate_parse: 3 callbacks suppressed [ 63.730733][ T6856] netlink: 52 bytes leftover after parsing attributes in process `syz.1.806'. [ 63.827275][ T6861] netlink: 56 bytes leftover after parsing attributes in process `syz.0.808'. [ 64.290509][ T6895] netlink: 28 bytes leftover after parsing attributes in process `syz.3.823'. [ 64.474279][ T1592] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.474344][ T1592] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.550787][ T6920] loop3: detected capacity change from 0 to 256 [ 64.584795][ T6923] overlayfs: failed to decode file handle (len=32, type=1, flags=0, err=-22) [ 65.053310][ T6956] FAULT_INJECTION: forcing a failure. [ 65.053310][ T6956] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 65.055805][ T6956] CPU: 1 UID: 0 PID: 6956 Comm: syz.1.840 Not tainted syzkaller #0 PREEMPT [ 65.055823][ T6956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 65.055829][ T6956] Call trace: [ 65.055833][ T6956] show_stack+0x2c/0x3c (C) [ 65.055854][ T6956] __dump_stack+0x30/0x40 [ 65.055867][ T6956] dump_stack_lvl+0xd8/0x12c [ 65.055878][ T6956] dump_stack+0x1c/0x28 [ 65.055890][ T6956] should_fail_ex+0x41c/0x590 [ 65.055902][ T6956] should_fail+0x14/0x24 [ 65.055914][ T6956] should_fail_usercopy+0x20/0x30 [ 65.055926][ T6956] _inline_copy_from_user+0x3c/0x174 [ 65.055940][ T6956] bpf_test_init+0xd8/0x154 [ 65.055951][ T6956] bpf_prog_test_run_skb+0x2a0/0x1ed0 [ 65.055963][ T6956] bpf_prog_test_run+0x1e0/0x250 [ 65.055974][ T6956] __sys_bpf+0x6bc/0x82c [ 65.055983][ T6956] __arm64_sys_bpf+0xd0/0xec [ 65.055992][ T6956] invoke_syscall+0x98/0x244 [ 65.056003][ T6956] el0_svc_common+0xec/0x23c [ 65.056015][ T6956] do_el0_svc+0x4c/0x5c [ 65.056026][ T6956] el0_svc+0x64/0x260 [ 65.056036][ T6956] el0t_64_sync_handler+0x44/0x104 [ 65.056046][ T6956] el0t_64_sync+0x198/0x19c [ 65.101277][ T6960] netlink: 56 bytes leftover after parsing attributes in process `syz.2.842'. [ 65.142306][ T4804] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 65.298569][ T4804] usb 1-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 65.300965][ T4804] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 65.301003][ T4804] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 65.301871][ T4804] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 65.301884][ T4804] usb 1-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 65.303461][ T4804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.303475][ T4804] usb 1-1: Product: syz [ 65.303482][ T4804] usb 1-1: Manufacturer: syz [ 65.303490][ T4804] usb 1-1: SerialNumber: syz [ 65.318832][ T4804] ti_usb_3410_5052 1-1:2.0: TI USB 5052 2 port adapter converter detected [ 65.326188][ T4804] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 65.329588][ T4804] usb 1-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 65.362805][ T4720] Bluetooth: hci3: Opcode 0x206a failed: -110 [ 65.362847][ T4720] Bluetooth: hci3: command 0x206a tx timeout [ 65.473982][ T6992] syzkaller0: entered promiscuous mode [ 65.474011][ T6992] syzkaller0: entered allmulticast mode [ 65.519501][ T6948] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 65.521230][ T9] usb 1-1: USB disconnect, device number 5 [ 65.529109][ T9] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 65.534177][ T9] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 65.534487][ T9] ti_usb_3410_5052 1-1:2.0: device disconnected [ 65.635396][ T7006] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 65.791243][ T7023] syzkaller0: entered promiscuous mode [ 65.791272][ T7023] syzkaller0: entered allmulticast mode [ 65.971519][ T7040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 65.974475][ T7040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.172099][ T51] Bluetooth: hci3: Malformed LE Event: 0x02 [ 66.180532][ T7040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.180742][ T7040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.200663][ T7060] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 66.200682][ T7060] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 66.201772][ T7060] vhci_hcd vhci_hcd.0: Device attached [ 66.205537][ T7060] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(5) [ 66.205555][ T7060] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 66.205741][ T7060] vhci_hcd vhci_hcd.0: Device attached [ 66.206429][ T7063] vhci_hcd: connection closed [ 66.207135][ T7066] vhci_hcd: connection closed [ 66.207734][ T3584] vhci_hcd vhci_hcd.4: stop threads [ 66.207873][ T3584] vhci_hcd vhci_hcd.4: release socket [ 66.207894][ T3584] vhci_hcd vhci_hcd.4: disconnect device [ 66.210910][ T7068] loop1: detected capacity change from 0 to 512 [ 66.218858][ T3584] vhci_hcd vhci_hcd.4: stop threads [ 66.218885][ T3584] vhci_hcd vhci_hcd.4: release socket [ 66.218910][ T3584] vhci_hcd vhci_hcd.4: disconnect device [ 66.221338][ T7068] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 66.221371][ T7068] System zones: 1-12 [ 66.228118][ T7068] EXT4-fs error (device loop1): ext4_xattr_inode_iget:437: inode #12: comm syz.1.882: missing EA_INODE flag [ 66.229517][ T7068] loop1: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 66.229667][ T7068] EXT4-fs error (device loop1): ext4_xattr_inode_iget:442: comm syz.1.882: error while reading EA inode 12 err=-117 [ 66.229682][ T7068] loop1: lost filesystem error report for type 5 error -117 [ 66.229815][ T7068] EXT4-fs (loop1): 1 orphan inode deleted [ 66.230702][ T7068] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 66.448790][ T7073] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 66.450532][ T7073] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 67.258666][ T4715] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 67.494634][ T7109] FAULT_INJECTION: forcing a failure. [ 67.494634][ T7109] name failslab, interval 1, probability 0, space 0, times 0 [ 67.497123][ T7109] CPU: 1 UID: 0 PID: 7109 Comm: syz.1.898 Not tainted syzkaller #0 PREEMPT [ 67.497137][ T7109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 67.497143][ T7109] Call trace: [ 67.497146][ T7109] show_stack+0x2c/0x3c (C) [ 67.497164][ T7109] __dump_stack+0x30/0x40 [ 67.497177][ T7109] dump_stack_lvl+0xd8/0x12c [ 67.497188][ T7109] dump_stack+0x1c/0x28 [ 67.497199][ T7109] should_fail_ex+0x41c/0x590 [ 67.497212][ T7109] should_failslab+0xc4/0x120 [ 67.497224][ T7109] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 67.497237][ T7109] sock_alloc_inode+0x30/0x180 [ 67.497249][ T7109] alloc_inode+0x68/0x198 [ 67.497259][ T7109] sock_alloc+0x4c/0x204 [ 67.497267][ T7109] __sock_create+0x108/0x670 [ 67.497275][ T7109] __sys_socket_create+0xc0/0x11c [ 67.497284][ T7109] __sys_socket+0x44/0xec [ 67.497292][ T7109] __arm64_sys_socket+0x84/0x9c [ 67.497301][ T7109] invoke_syscall+0x98/0x244 [ 67.497313][ T7109] el0_svc_common+0xec/0x23c [ 67.497324][ T7109] do_el0_svc+0x4c/0x5c [ 67.497335][ T7109] el0_svc+0x64/0x260 [ 67.497346][ T7109] el0t_64_sync_handler+0x44/0x104 [ 67.497356][ T7109] el0t_64_sync+0x198/0x19c [ 67.514454][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 67.515693][ T7109] socket: no more sockets [ 67.623329][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.625870][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.627768][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.629439][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.633903][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.768892][ T7114] lo speed is unknown, defaulting to 1000 [ 67.896423][ T7114] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.897983][ T7114] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.899732][ T7114] bridge_slave_0: entered allmulticast mode [ 67.901729][ T7114] bridge_slave_0: entered promiscuous mode [ 67.904374][ T7114] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.905972][ T7114] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.907678][ T7114] bridge_slave_1: entered allmulticast mode [ 67.909559][ T7114] bridge_slave_1: entered promiscuous mode [ 67.927385][ T7114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.939481][ T7114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.958521][ T13] bridge_slave_1: left allmulticast mode [ 67.959922][ T13] bridge_slave_1: left promiscuous mode [ 67.961453][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.964300][ T13] bridge_slave_0: left allmulticast mode [ 67.964330][ T13] bridge_slave_0: left promiscuous mode [ 67.964412][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.106912][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 68.143398][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 68.154878][ T13] bond0 (unregistering): Released all slaves [ 68.157383][ T13] bond1 (unregistering): Released all slaves [ 68.171291][ T13] bond2 (unregistering): Released all slaves [ 68.186110][ T7114] team0: Port device team_slave_0 added [ 68.188270][ T7114] team0: Port device team_slave_1 added [ 68.213645][ T7114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.213675][ T7114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.214116][ T7114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.230556][ T7114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.230673][ T7114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.231091][ T7114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.250205][ T7114] hsr_slave_0: entered promiscuous mode [ 68.257989][ T7114] hsr_slave_1: entered promiscuous mode [ 68.258234][ T7114] debugfs: 'hsr0' already exists in 'hsr' [ 68.258245][ T7114] Cannot create hsr debugfs directory [ 68.440292][ T13] hsr_slave_0: left promiscuous mode [ 68.441438][ T13] hsr_slave_1: left promiscuous mode [ 68.442025][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 68.443335][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 68.861704][ T7028] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 68.868133][ T7114] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 68.876393][ T7114] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.878622][ T7114] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 68.887556][ T7114] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.889606][ T7114] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 68.898690][ T7114] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.900542][ T7114] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 68.905568][ T7114] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.958178][ T7114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.975786][ T7114] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.979098][ T3193] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.979145][ T3193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.988395][ T3584] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.988438][ T3584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.108979][ T4398] 8021q: adding VLAN 0 to HW filter on device eth0 [ 69.199200][ T7114] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.274453][ T7235] team0 (unregistering): Port device team_slave_0 removed [ 69.276492][ T7235] team0 (unregistering): Port device team_slave_1 removed [ 69.358666][ T7114] veth0_vlan: entered promiscuous mode [ 69.360706][ T7114] veth1_vlan: entered promiscuous mode [ 69.387991][ T7114] veth0_macvtap: entered promiscuous mode [ 69.409209][ T7114] veth1_macvtap: entered promiscuous mode [ 69.413955][ T7114] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.416955][ T7114] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.426898][ T4398] 8021q: adding VLAN 0 to HW filter on device eth1 [ 69.452529][ T3193] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.452571][ T3193] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.452602][ T3193] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.452624][ T3193] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.468706][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.468740][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.488658][ T7262] syzkaller0: entered promiscuous mode [ 69.489755][ T7262] syzkaller0: entered allmulticast mode [ 69.501646][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 69.501670][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 69.503886][ T49] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.515103][ T61] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.515142][ T61] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.515176][ T61] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.673378][ T4720] Bluetooth: hci0: command tx timeout [ 69.696498][ T7290] team0 (unregistering): Port device team_slave_0 removed [ 69.699152][ T7290] team0 (unregistering): Port device team_slave_1 removed [ 69.790120][ T4398] 8021q: adding VLAN 0 to HW filter on device eth2 [ 69.806859][ T7311] syzkaller0: entered promiscuous mode [ 69.806987][ T7311] syzkaller0: entered allmulticast mode [ 69.832891][ T61] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.833235][ T61] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.833430][ T61] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.833536][ T61] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 69.868077][ T7319] FAULT_INJECTION: forcing a failure. [ 69.868077][ T7319] name fail_futex, interval 1, probability 0, space 0, times 1 [ 69.868112][ T7319] CPU: 1 UID: 0 PID: 7319 Comm: syz.1.954 Not tainted syzkaller #0 PREEMPT [ 69.868127][ T7319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 69.868134][ T7319] Call trace: [ 69.868138][ T7319] show_stack+0x2c/0x3c (C) [ 69.868158][ T7319] __dump_stack+0x30/0x40 [ 69.868171][ T7319] dump_stack_lvl+0xd8/0x12c [ 69.868183][ T7319] dump_stack+0x1c/0x28 [ 69.868194][ T7319] should_fail_ex+0x41c/0x590 [ 69.868207][ T7319] should_fail+0x14/0x24 [ 69.868217][ T7319] get_futex_key+0x1ec/0x12b0 [ 69.868228][ T7319] futex_wait_setup+0x58/0x674 [ 69.868240][ T7319] __futex_wait+0x108/0x25c [ 69.868251][ T7319] futex_wait+0x108/0x2c0 [ 69.868262][ T7319] do_futex+0x320/0x378 [ 69.868272][ T7319] __arm64_sys_futex+0x2e4/0x418 [ 69.868282][ T7319] invoke_syscall+0x98/0x244 [ 69.868294][ T7319] el0_svc_common+0xec/0x23c [ 69.868305][ T7319] do_el0_svc+0x4c/0x5c [ 69.868317][ T7319] el0_svc+0x64/0x260 [ 69.868327][ T7319] el0t_64_sync_handler+0x44/0x104 [ 69.868337][ T7319] el0t_64_sync+0x198/0x19c [ 69.890731][ T7322] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 69.940856][ T7322] lo speed is unknown, defaulting to 1000 [ 70.077710][ T4398] 8021q: adding VLAN 0 to HW filter on device eth3 [ 70.520274][ T7362] loop3: detected capacity change from 0 to 512 [ 70.526064][ T7362] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 70.526132][ T7362] System zones: 1-12 [ 70.528475][ T7362] EXT4-fs error (device loop3): ext4_xattr_inode_iget:437: inode #12: comm syz.3.965: missing EA_INODE flag [ 70.528491][ T7362] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 70.528601][ T7362] EXT4-fs error (device loop3): ext4_xattr_inode_iget:442: comm syz.3.965: error while reading EA inode 12 err=-117 [ 70.528614][ T7362] loop3: lost filesystem error report for type 5 error -117 [ 70.528726][ T7362] EXT4-fs (loop3): 1 orphan inode deleted [ 70.529190][ T7362] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 70.720377][ T7366] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 70.720579][ T7366] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 70.899298][ T7368] netlink: 8 bytes leftover after parsing attributes in process `syz.0.966'. [ 70.899327][ T7368] netlink: 8 bytes leftover after parsing attributes in process `syz.0.966'. [ 71.273358][ T51] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 71.283396][ T4811] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 71.434172][ T4811] usb 1-1: Using ep0 maxpacket: 8 [ 71.435664][ T4811] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 71.438577][ T4811] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 71.438602][ T4811] usb 1-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 71.438624][ T4811] usb 1-1: config 0 interface 0 has no altsetting 0 [ 71.438643][ T4811] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.450674][ T4811] usb 1-1: config 0 descriptor?? [ 71.491137][ T7410] netlink: 8 bytes leftover after parsing attributes in process `syz.5.977'. [ 71.491169][ T7410] netlink: 8 bytes leftover after parsing attributes in process `syz.5.977'. [ 71.678345][ T7420] netlink: 12 bytes leftover after parsing attributes in process `syz.5.981'. [ 71.706163][ T7422] 9pnet_virtio: no channels available for device syz [ 71.869177][ T4811] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 71.871078][ T4811] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 71.872495][ T4811] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 71.873897][ T4811] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 71.875273][ T4811] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 71.877080][ T4811] mcp2221 0003:04D8:00DD.0001: USB HID vff.ff Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 71.990874][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.075642][ T4929] usb 1-1: USB disconnect, device number 6 [ 72.219374][ T7447] netlink: 56 bytes leftover after parsing attributes in process `syz.3.991'. [ 72.391019][ T7458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.393328][ T7458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.945234][ T7493] 9pnet_virtio: no channels available for device syz [ 73.192477][ T51] Bluetooth: hci0: command tx timeout [ 73.637589][ T7508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.639169][ T7508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.702289][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 73.853039][ T9] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 73.853740][ T9] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 73.853752][ T9] usb 1-1: config 1 has no interface number 0 [ 73.853769][ T9] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0xE has invalid maxpacket 8 [ 73.855054][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.855066][ T9] usb 1-1: Product: syz [ 73.855074][ T9] usb 1-1: Manufacturer: syz [ 73.855080][ T9] usb 1-1: SerialNumber: syz [ 73.857146][ T7500] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 73.859843][ T9] usb 1-1: Error in usbnet_get_endpoints (-22) [ 74.108947][ T7373] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 74.228856][ T7526] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1026'. [ 74.280914][ T7532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1029'. [ 74.280947][ T7532] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1029'. [ 74.385300][ T7541] FAULT_INJECTION: forcing a failure. [ 74.385300][ T7541] name failslab, interval 1, probability 0, space 0, times 0 [ 74.387754][ T7541] CPU: 1 UID: 0 PID: 7541 Comm: syz.2.1033 Not tainted syzkaller #0 PREEMPT [ 74.387773][ T7541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 74.387779][ T7541] Call trace: [ 74.387783][ T7541] show_stack+0x2c/0x3c (C) [ 74.387805][ T7541] __dump_stack+0x30/0x40 [ 74.387820][ T7541] dump_stack_lvl+0xd8/0x12c [ 74.387832][ T7541] dump_stack+0x1c/0x28 [ 74.387844][ T7541] should_fail_ex+0x41c/0x590 [ 74.387857][ T7541] should_failslab+0xc4/0x120 [ 74.387871][ T7541] kmem_cache_alloc_noprof+0x94/0x5d4 [ 74.387884][ T7541] do_getname+0x48/0x234 [ 74.387892][ T7541] __arm64_sys_mkdirat+0x88/0xc0 [ 74.387903][ T7541] invoke_syscall+0x98/0x244 [ 74.387915][ T7541] el0_svc_common+0xec/0x23c [ 74.387926][ T7541] do_el0_svc+0x4c/0x5c [ 74.387938][ T7541] el0_svc+0x64/0x260 [ 74.387949][ T7541] el0t_64_sync_handler+0x44/0x104 [ 74.387959][ T7541] el0t_64_sync+0x198/0x19c [ 74.687558][ T7562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1041'. [ 74.923689][ T7570] loop5: detected capacity change from 0 to 256 [ 75.056571][ T7572] syzkaller0: entered promiscuous mode [ 75.056603][ T7572] syzkaller0: entered allmulticast mode [ 75.059561][ T49] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 75.061896][ T49] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 75.064346][ T49] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 75.066664][ T49] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 75.088757][ T7574] FAULT_INJECTION: forcing a failure. [ 75.088757][ T7574] name failslab, interval 1, probability 0, space 0, times 0 [ 75.088792][ T7574] CPU: 1 UID: 0 PID: 7574 Comm: syz.3.1045 Not tainted syzkaller #0 PREEMPT [ 75.088808][ T7574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 75.088816][ T7574] Call trace: [ 75.088820][ T7574] show_stack+0x2c/0x3c (C) [ 75.088841][ T7574] __dump_stack+0x30/0x40 [ 75.088856][ T7574] dump_stack_lvl+0xd8/0x12c [ 75.088868][ T7574] dump_stack+0x1c/0x28 [ 75.088879][ T7574] should_fail_ex+0x41c/0x590 [ 75.088891][ T7574] should_failslab+0xc4/0x120 [ 75.088904][ T7574] kmem_cache_alloc_noprof+0x94/0x5d4 [ 75.088918][ T7574] do_getname+0x48/0x234 [ 75.088927][ T7574] __arm64_sys_mkdirat+0x88/0xc0 [ 75.088937][ T7574] invoke_syscall+0x98/0x244 [ 75.088949][ T7574] el0_svc_common+0xec/0x23c [ 75.088961][ T7574] do_el0_svc+0x4c/0x5c [ 75.088972][ T7574] el0_svc+0x64/0x260 [ 75.088983][ T7574] el0t_64_sync_handler+0x44/0x104 [ 75.088993][ T7574] el0t_64_sync+0x198/0x19c [ 75.154752][ T7578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.154937][ T7578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.272287][ T4720] Bluetooth: hci0: command tx timeout [ 75.683099][ T7584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.685126][ T7584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.203473][ T7588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.205272][ T7588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.472885][ T4811] usb 1-1: USB disconnect, device number 7 [ 76.888177][ T7598] loop3: detected capacity change from 0 to 256 [ 77.352365][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 77.425885][ T7605] __nla_validate_parse: 1 callbacks suppressed [ 77.425917][ T7605] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1056'. [ 77.425927][ T7605] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1056'. [ 77.428425][ T7544] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 77.617887][ T7626] loop3: detected capacity change from 0 to 512 [ 77.624633][ T7626] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 77.624698][ T7626] System zones: 1-12 [ 77.628348][ T7626] EXT4-fs error (device loop3): ext4_xattr_inode_iget:437: inode #12: comm syz.3.1066: missing EA_INODE flag [ 77.628377][ T7626] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 77.628761][ T7626] EXT4-fs error (device loop3): ext4_xattr_inode_iget:442: comm syz.3.1066: error while reading EA inode 12 err=-117 [ 77.628782][ T7626] loop3: lost filesystem error report for type 5 error -117 [ 77.628893][ T7626] EXT4-fs (loop3): 1 orphan inode deleted [ 77.629339][ T7626] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 77.827169][ T7631] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 77.827360][ T7631] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 78.625723][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.636102][ T7653] overlayfs: failed to resolve 'lower': -2 [ 78.695341][ T7662] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1078'. [ 78.695380][ T7662] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1078'. [ 78.757934][ T7670] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1081'. [ 78.804327][ T7676] loop3: detected capacity change from 0 to 512 [ 78.839591][ T7676] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e040e01c, mo2=0002] [ 78.839640][ T7676] System zones: 1-12 [ 78.840403][ T7676] EXT4-fs error (device loop3): ext4_xattr_inode_iget:437: inode #12: comm syz.3.1084: missing EA_INODE flag [ 78.840433][ T7676] loop3: lost file I/O error report for ino 12 type 5 pos 0x0 len 0x0 error -117 [ 78.840799][ T7676] EXT4-fs error (device loop3): ext4_xattr_inode_iget:442: comm syz.3.1084: error while reading EA inode 12 err=-117 [ 78.840820][ T7676] loop3: lost filesystem error report for type 5 error -117 [ 78.841889][ T7676] EXT4-fs (loop3): 1 orphan inode deleted [ 78.844644][ T7676] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.968690][ T7684] overlayfs: failed to resolve 'lower': -2 [ 79.055627][ T7687] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 79.055823][ T7687] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 79.670837][ T7698] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.674015][ T7698] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.793093][ T7702] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.795197][ T7702] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.795293][ T7702] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.826004][ T4708] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.873516][ T7708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.873697][ T7708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.926936][ T7716] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1101'. [ 79.928770][ T7716] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1101'. [ 80.102273][ T4929] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 80.252347][ T4929] usb 1-1: Using ep0 maxpacket: 8 [ 80.254327][ T4929] usb 1-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 80.255145][ T4929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.256638][ T4929] usb 1-1: config 0 descriptor?? [ 80.259673][ T4929] usb 1-1: probing VID:PID(0424:012C) [ 80.261505][ T4929] usb 1-1: vub300 testing BULK IN EndPoint(0) 81 [ 80.265793][ T4929] usb 1-1: vub300 testing BULK OUT EndPoint(1) 02 [ 80.265823][ T4929] usb 1-1: vub300 testing BULK IN EndPoint(2) 83 [ 80.265837][ T4929] usb 1-1: vub300 testing BULK OUT EndPoint(3) 04 [ 80.265846][ T4929] usb 1-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 80.687491][ T4929] usb 1-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 80.888637][ T4929] usb 1-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 81.459877][ T7776] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1120'. [ 81.554835][ T7782] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.557933][ T7782] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.859351][ T4929] usb 1-1: SET_CLOCK_SPEED 200kHz failed with retval=-71 [ 81.880780][ T4929] usb 1-1: USB disconnect, device number 8 [ 81.959048][ T4929] USB vub300 remote SDIO host controller[0] now disconnected [ 82.049070][ T7815] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1132'. [ 82.346075][ T7829] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1131'. [ 82.651016][ T7836] netlink: set zone limit has 8 unknown bytes [ 82.952472][ C1] [ 82.952957][ C1] ============================= [ 82.953772][ C1] WARNING: suspicious RCU usage [ 82.954625][ C1] syzkaller #0 Not tainted [ 82.955395][ C1] ----------------------------- [ 82.956241][ C1] kernel/sched/core.c:9196 Illegal context switch in RCU-sched read-side critical section! [ 82.958074][ C1] [ 82.958074][ C1] other info that might help us debug this: [ 82.958074][ C1] [ 82.959845][ C1] [ 82.959845][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 82.961183][ C1] locks held by sed/7853: 3, last CPU#1: [ 82.962085][ C1] #0: ffff0000f6400e78 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1a8/0x46c [ 82.963787][ C1] #1: ffff800088de2120 (rcu_read_lock_sched){....}-{1:2}, at: slab_address+0xbc/0x258 [ 82.965377][ C1] #2: ffff80008ec47c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c [ 82.967102][ C1] [ 82.967102][ C1] stack backtrace: [ 82.968061][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Not tainted syzkaller #0 PREEMPT [ 82.969386][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 82.971056][ C1] Call trace: [ 82.971576][ C1] show_stack+0x2c/0x3c (C) [ 82.972308][ C1] __dump_stack+0x30/0x40 [ 82.973070][ C1] dump_stack_lvl+0xd8/0x12c [ 82.973915][ C1] dump_stack+0x1c/0x28 [ 82.974673][ C1] lockdep_rcu_suspicious+0x168/0x26c [ 82.975680][ C1] __might_resched+0xd0/0x4c0 [ 82.976532][ C1] __might_sleep+0x84/0xdc [ 82.977310][ C1] __cancel_work_sync+0x78/0x144 [ 82.978182][ C1] cancel_delayed_work_sync+0x24/0x38 [ 82.979126][ C1] mmc_free_host+0x20/0x40 [ 82.979924][ C1] vub300_delete+0xd4/0xec [ 82.980708][ C1] vub300_inactivity_timer_expired+0xd4/0x2ac [ 82.981776][ C1] call_timer_fn+0x194/0xa4c [ 82.982568][ C1] __run_timer_base+0x530/0x744 [ 82.983435][ C1] run_timer_base+0x84/0x1b8 [ 82.984261][ C1] run_timer_softirq+0x20/0x48 [ 82.985111][ C1] handle_softirqs+0x2ec/0xd98 [ 82.985917][ C1] __do_softirq+0x14/0x20 [ 82.986650][ C1] ____do_softirq+0x14/0x20 [ 82.987435][ C1] call_on_irq_stack+0x30/0x48 [ 82.988287][ C1] do_softirq_own_stack+0x20/0x2c [ 82.989164][ C1] __irq_exit_rcu+0x1c0/0x458 [ 82.989996][ C1] irq_exit_rcu+0x14/0x84 [ 82.990734][ C1] el1_interrupt+0x40/0x60 [ 82.991485][ C1] el1h_64_irq_handler+0x18/0x24 [ 82.992311][ C1] el1h_64_irq+0x6c/0x70 [ 82.993043][ C1] lock_acquire+0x17c/0x370 (P) [ 82.993876][ C1] slab_address+0xc4/0x258 [ 82.994648][ C1] kasan_record_aux_stack+0x44/0xc8 [ 82.995578][ C1] call_rcu+0x104/0x75c [ 82.996327][ C1] kmem_cache_free+0x484/0x6c0 [ 82.997158][ C1] vm_area_free+0x10c/0x17c [ 82.997949][ C1] remove_vma+0x120/0x138 [ 82.998690][ C1] vms_complete_munmap_vmas+0x650/0x930 [ 82.999671][ C1] __mmap_complete+0xb0/0x3bc [ 83.000459][ C1] mmap_region+0xd4c/0x1c30 [ 83.001217][ C1] do_mmap+0xb88/0x1104 [ 83.001917][ C1] vm_mmap_pgoff+0x298/0x46c [ 83.002682][ C1] ksys_mmap_pgoff+0xd0/0x5b4 [ 83.003472][ C1] __arm64_sys_mmap+0x110/0x12c [ 83.004286][ C1] invoke_syscall+0x98/0x244 [ 83.005061][ C1] el0_svc_common+0xec/0x23c [ 83.005826][ C1] do_el0_svc+0x4c/0x5c [ 83.006551][ C1] el0_svc+0x64/0x260 [ 83.007233][ C1] el0t_64_sync_handler+0x44/0x104 [ 83.008117][ C1] el0t_64_sync+0x198/0x19c [ 83.008985][ C1] BUG: slee ** replaying previous printk message ** [ 83.008985][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:4552 [ 83.008998][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 7853, name: sed [ 83.009013][ C1] preempt_count: 101, expected: 0 [ 83.009023][ C1] RCU nest depth: 0, expected: 0 [ 83.009033][ C1] locks held by sed/7853: 3, last CPU#1: [ 83.009044][ C1] #0: ffff0000f6400e78 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1a8/0x46c [ 83.009091][ C1] #1: ffff800088de2120 (rcu_read_lock_sched){....}-{1:2}, at: slab_address+0xbc/0x258 [ 83.009137][ C1] #2: ffff80008ec47c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c [ 83.009160][ C1] Preemption disabled at: [ 83.009163][ C1] [] slab_address+0xa0/0x258 [ 83.009174][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Not tainted syzkaller #0 PREEMPT [ 83.009182][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.009186][ C1] Call trace: [ 83.009189][ C1] show_stack+0x2c/0x3c (C) [ 83.009199][ C1] __dump_stack+0x30/0x40 [ 83.009210][ C1] dump_stack_lvl+0xd8/0x12c [ 83.009220][ C1] dump_stack+0x1c/0x28 [ 83.009230][ C1] __might_resched+0x354/0x4c0 [ 83.009239][ C1] __might_sleep+0x84/0xdc [ 83.009248][ C1] __cancel_work_sync+0x78/0x144 [ 83.009255][ C1] cancel_delayed_work_sync+0x24/0x38 [ 83.009263][ C1] mmc_free_host+0x20/0x40 [ 83.009274][ C1] vub300_delete+0xd4/0xec [ 83.009281][ C1] vub300_inactivity_timer_expired+0xd4/0x2ac [ 83.009289][ C1] call_timer_fn+0x194/0xa4c [ 83.009297][ C1] __run_timer_base+0x530/0x744 [ 83.009307][ C1] run_timer_base+0x84/0x1b8 [ 83.009314][ C1] run_timer_softirq+0x20/0x48 [ 83.009325][ C1] handle_softirqs+0x2ec/0xd98 [ 83.009333][ C1] __do_softirq+0x14/0x20 [ 83.009340][ C1] ____do_softirq+0x14/0x20 [ 83.009347][ C1] call_on_irq_stack+0x30/0x48 [ 83.009355][ C1] do_softirq_own_stack+0x20/0x2c [ 83.009362][ C1] __irq_exit_rcu+0x1c0/0x458 [ 83.009370][ C1] irq_exit_rcu+0x14/0x84 [ 83.009378][ C1] el1_interrupt+0x40/0x60 [ 83.009387][ C1] el1h_64_irq_handler+0x18/0x24 [ 83.009395][ C1] el1h_64_irq+0x6c/0x70 [ 83.009403][ C1] lock_acquire+0x17c/0x370 (P) [ 83.009411][ C1] slab_address+0xc4/0x258 [ 83.009420][ C1] kasan_record_aux_stack+0x44/0xc8 [ 83.009429][ C1] call_rcu+0x104/0x75c [ 83.009437][ C1] kmem_cache_free+0x484/0x6c0 [ 83.009444][ C1] vm_area_free+0x10c/0x17c [ 83.009453][ C1] remove_vma+0x120/0x138 [ 83.009462][ C1] vms_complete_munmap_vmas+0x650/0x930 [ 83.009472][ C1] __mmap_complete+0xb0/0x3bc [ 83.009482][ C1] mmap_region+0xd4c/0x1c30 [ 83.009492][ C1] do_mmap+0xb88/0x1104 [ 83.009500][ C1] vm_mmap_pgoff+0x298/0x46c [ 83.009507][ C1] ksys_mmap_pgoff+0xd0/0x5b4 [ 83.009515][ C1] __arm64_sys_mmap+0x110/0x12c [ 83.009526][ C1] invoke_syscall+0x98/0x244 [ 83.009536][ C1] el0_svc_common+0xec/0x23c [ 83.009546][ C1] do_el0_svc+0x4c/0x5c [ 83.009556][ C1] el0_svc+0x64/0x260 [ 83.009565][ C1] el0t_64_sync_handler+0x44/0x104 [ 83.009574][ C1] el0t_64_sync+0x198/0x19c [ 83.009633][ C1] [ 83.058353][ C1] ============================= [ 83.059119][ C1] WARNING: suspicious RCU usage [ 83.059884][ C1] syzkaller #0 Tainted: G W [ 83.060823][ C1] ----------------------------- [ 83.061586][ C1] kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 83.063596][ C1] [ 83.063596][ C1] other info that might help us debug this: [ 83.063596][ C1] [ 83.065217][ C1] [ 83.065217][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 83.066547][ C1] locks held by sed/7853: 3, last CPU#1: [ 83.067479][ C1] #0: ffff0000f6400e78 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1a8/0x46c [ 83.069143][ C1] #1: ffff800088de2120 (rcu_read_lock_sched){....}-{1:2}, at: slab_address+0xbc/0x258 [ 83.070892][ C1] #2: ffff80008ec47c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c [ 83.072710][ C1] [ 83.072710][ C1] stack backtrace: [ 83.073679][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Tainted: G W syzkaller #0 PREEMPT [ 83.075324][ C1] Tainted: [W]=WARN [ 83.075904][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.077531][ C1] Call trace: [ 83.078051][ C1] show_stack+0x2c/0x3c (C) [ 83.078805][ C1] __dump_stack+0x30/0x40 [ 83.079524][ C1] dump_stack_lvl+0xd8/0x12c [ 83.080292][ C1] dump_stack+0x1c/0x28 [ 83.080971][ C1] lockdep_rcu_suspicious+0x168/0x26c [ 83.081824][ C1] __synchronize_srcu+0x150/0x268 [ 83.082670][ C1] synchronize_srcu+0x41c/0x5d4 [ 83.083526][ C1] wakeup_source_unregister+0x110/0x32c [ 83.084499][ C1] mmc_host_classdev_release+0x48/0x100 [ 83.085487][ C1] device_release+0xb4/0x1d4 [ 83.086269][ C1] kobject_put+0x1dc/0x4b8 [ 83.087017][ C1] put_device+0x28/0x40 [ 83.087734][ C1] mmc_free_host+0x30/0x40 [ 83.088481][ C1] vub300_delete+0xd4/0xec [ 83.089231][ C1] vub300_inactivity_timer_expired+0xd4/0x2ac [ 83.090284][ C1] call_timer_fn+0x194/0xa4c [ 83.091048][ C1] __run_timer_base+0x530/0x744 [ 83.091878][ C1] run_timer_base+0x84/0x1b8 [ 83.092684][ C1] run_timer_softirq+0x20/0x48 [ 83.093513][ C1] handle_softirqs+0x2ec/0xd98 [ 83.094315][ C1] __do_softirq+0x14/0x20 [ 83.095055][ C1] ____do_softirq+0x14/0x20 [ 83.095833][ C1] call_on_irq_stack+0x30/0x48 [ 83.096639][ C1] do_softirq_own_stack+0x20/0x2c [ 83.097512][ C1] __irq_exit_rcu+0x1c0/0x458 [ 83.098327][ C1] irq_exit_rcu+0x14/0x84 [ 83.099044][ C1] el1_interrupt+0x40/0x60 [ 83.099767][ C1] el1h_64_irq_handler+0x18/0x24 [ 83.100576][ C1] el1h_64_irq+0x6c/0x70 [ 83.101271][ C1] lock_acquire+0x17c/0x370 (P) [ 83.102182][ C1] slab_address+0xc4/0x258 [ 83.102933][ C1] kasan_record_aux_stack+0x44/0xc8 [ 83.103830][ C1] call_rcu+0x104/0x75c [ 83.104535][ C1] kmem_cache_free+0x484/0x6c0 [ 83.105344][ C1] vm_area_free+0x10c/0x17c [ 83.106130][ C1] remove_vma+0x120/0x138 [ 83.106879][ C1] vms_complete_munmap_vmas+0x650/0x930 [ 83.107864][ C1] __mmap_complete+0xb0/0x3bc [ 83.108715][ C1] mmap_region+0xd4c/0x1c30 [ 83.109499][ C1] do_mmap+0xb88/0x1104 [ 83.110276][ C1] vm_mmap_pgoff+0x298/0x46c [ 83.111095][ C1] ksys_mmap_pgoff+0xd0/0x5b4 [ 83.111860][ C1] __arm64_sys_mmap+0x110/0x12c [ 83.112680][ C1] invoke_syscall+0x98/0x244 [ 83.113484][ C1] el0_svc_common+0xec/0x23c [ 83.114295][ C1] do_el0_svc+0x4c/0x5c [ 83.114993][ C1] el0_svc+0x64/0x260 [ 83.115675][ C1] el0t_64_sync_handler+0x44/0x104 [ 83.116537][ C1] el0t_64_sync+0x198/0x19c [ 83.117366][ C1] ODEBUG: object 00000000619d9433 is NOT on stack 000000005fddfc4c, but annotated. [ 83.117491][ C1] ------------[ cut here ]------------ [ 83.117495][ C1] WARNING: lib/debugobjects.c:672 at debug_object_is_on_stack+0xb0/0xb8, CPU#1: sed/7853 [ 83.121409][ C1] Modules linked in: [ 83.122051][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Tainted: G W syzkaller #0 PREEMPT [ 83.123794][ C1] Tainted: [W]=WARN [ 83.124471][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.126262][ C1] pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 83.127663][ C1] pc : debug_object_is_on_stack+0xb0/0xb8 [ 83.128689][ C1] lr : debug_object_is_on_stack+0xb0/0xb8 [ 83.129665][ C1] sp : ffff80008ec47780 [ 83.130372][ C1] x29: ffff80008ec47780 x28: dfff800000000000 x27: 1fffe00019c74808 [ 83.131830][ C1] x26: 0000000000000000 x25: dfff800000000000 x24: 0000000000000000 [ 83.133240][ C1] x23: 0000000000000000 x22: ffff80008eb4d000 x21: ffff0000f16c1da0 [ 83.134648][ C1] x20: 0000000000000001 x19: ffff80008ec478e0 x18: 00000000ffffffff [ 83.136010][ C1] x17: 6334636664646635 x16: 3030303030303030 x15: 206b63617473206e [ 83.137453][ C1] x14: 6f20544f4e207369 x13: 0000000000000001 x12: 0000000000000003 [ 83.138902][ C1] x11: 0000000000000000 x10: 0000000000000103 x9 : b8535175ccafb800 [ 83.140351][ C1] x8 : b8535175ccafb800 x7 : ffff80008048e314 x6 : 0000000000000000 [ 83.141734][ C1] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800080498f8c [ 83.143122][ C1] x2 : 0000000000000102 x1 : ffff0000f16c1d80 x0 : 0000000000000050 [ 83.144500][ C1] Call trace: [ 83.145052][ C1] debug_object_is_on_stack+0xb0/0xb8 (P) [ 83.146037][ C1] lookup_object_or_alloc+0xfc/0x188 [ 83.146942][ C1] __debug_object_init+0x8c/0x1e0 [ 83.147804][ C1] debug_object_init_on_stack+0x20/0x2c [ 83.148783][ C1] init_rcu_head_on_stack+0x18/0x24 [ 83.149707][ C1] __synchronize_srcu+0x1ac/0x268 [ 83.150616][ C1] synchronize_srcu+0x41c/0x5d4 [ 83.151478][ C1] wakeup_source_unregister+0x110/0x32c [ 83.152484][ C1] mmc_host_classdev_release+0x48/0x100 [ 83.153483][ C1] device_release+0xb4/0x1d4 [ 83.154313][ C1] kobject_put+0x1dc/0x4b8 [ 83.155113][ C1] put_device+0x28/0x40 [ 83.155881][ C1] mmc_free_host+0x30/0x40 [ 83.156641][ C1] vub300_delete+0xd4/0xec [ 83.157425][ C1] vub300_inactivity_timer_expired+0xd4/0x2ac [ 83.158462][ C1] call_timer_fn+0x194/0xa4c [ 83.159260][ C1] __run_timer_base+0x530/0x744 [ 83.160094][ C1] run_timer_base+0x84/0x1b8 [ 83.160867][ C1] run_timer_softirq+0x20/0x48 [ 83.161661][ C1] handle_softirqs+0x2ec/0xd98 [ 83.162454][ C1] __do_softirq+0x14/0x20 [ 83.163183][ C1] ____do_softirq+0x14/0x20 [ 83.163943][ C1] call_on_irq_stack+0x30/0x48 [ 83.164776][ C1] do_softirq_own_stack+0x20/0x2c [ 83.165649][ C1] __irq_exit_rcu+0x1c0/0x458 [ 83.166455][ C1] irq_exit_rcu+0x14/0x84 [ 83.167187][ C1] el1_interrupt+0x40/0x60 [ 83.167953][ C1] el1h_64_irq_handler+0x18/0x24 [ 83.168806][ C1] el1h_64_irq+0x6c/0x70 [ 83.169530][ C1] lock_acquire+0x17c/0x370 (P) [ 83.170360][ C1] slab_address+0xc4/0x258 [ 83.171122][ C1] kasan_record_aux_stack+0x44/0xc8 [ 83.171990][ C1] call_rcu+0x104/0x75c [ 83.172681][ C1] kmem_cache_free+0x484/0x6c0 [ 83.173510][ C1] vm_area_free+0x10c/0x17c [ 83.174282][ C1] remove_vma+0x120/0x138 [ 83.175051][ C1] vms_complete_munmap_vmas+0x650/0x930 [ 83.176011][ C1] __mmap_complete+0xb0/0x3bc [ 83.176816][ C1] mmap_region+0xd4c/0x1c30 [ 83.177565][ C1] do_mmap+0xb88/0x1104 [ 83.178281][ C1] vm_mmap_pgoff+0x298/0x46c [ 83.179061][ C1] ksys_mmap_pgoff+0xd0/0x5b4 [ 83.179870][ C1] __arm64_sys_mmap+0x110/0x12c [ 83.180716][ C1] invoke_syscall+0x98/0x244 [ 83.181516][ C1] el0_svc_common+0xec/0x23c [ 83.182326][ C1] do_el0_svc+0x4c/0x5c [ 83.183045][ C1] el0_svc+0x64/0x260 [ 83.183746][ C1] el0t_64_sync_handler+0x44/0x104 [ 83.184620][ C1] el0t_64_sync+0x198/0x19c [ 83.185380][ C1] irq event stamp: 3721 [ 83.186072][ C1] hardirqs last enabled at (3720): [] __arm64_exit_to_kernel_mode+0x64/0x78 [ 83.187824][ C1] hardirqs last disabled at (3721): [] _raw_spin_lock_irqsave+0x2c/0x7c [ 83.189469][ C1] softirqs last enabled at (1474): [] fpsimd_restore_current_state+0x39c/0x9c8 [ 83.191228][ C1] softirqs last disabled at (3103): [] __do_softirq+0x14/0x20 [ 83.192771][ C1] ---[ end trace 0000000000000000 ]--- [ 83.193759][ C1] BUG: scheduling while atomic: sed/7853/0x00000102 [ 83.193772][ C1] locks held by sed/7853: 3, on CPU#1: [ 83.193783][ C1] #0: ffff0000f6400e78 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1a8/0x46c [ 83.193831][ C1] #1: ffff800088de2120 (rcu_read_lock_sched){....}-{1:2}, at: slab_address+0xbc/0x258 [ 83.193877][ C1] #2: ffff80008ec47c60 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xec/0xa4c [ 83.193920][ C1] Modules linked in: [ 83.193933][ C1] Preemption disabled at: [ 83.193939][ C1] [] slab_address+0xa0/0x258 [ 83.193957][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Tainted: G W syzkaller #0 PREEMPT [ 83.193968][ C1] Tainted: [W]=WARN [ 83.193971][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.193975][ C1] Call trace: [ 83.193977][ C1] show_stack+0x2c/0x3c (C) [ 83.193988][ C1] __dump_stack+0x30/0x40 [ 83.193999][ C1] dump_stack_lvl+0xd8/0x12c [ 83.194009][ C1] dump_stack+0x1c/0x28 [ 83.194019][ C1] __schedule_bug+0x10c/0x190 [ 83.194029][ C1] __schedule+0x1478/0x2d80 [ 83.194037][ C1] schedule+0x13c/0x20c [ 83.194044][ C1] schedule_timeout+0xc0/0x28c [ 83.194053][ C1] wait_for_common+0x220/0x394 [ 83.194060][ C1] wait_for_completion+0x18/0x24 [ 83.194068][ C1] __synchronize_srcu+0x1cc/0x268 [ 83.194079][ C1] synchronize_srcu+0x41c/0x5d4 [ 83.194090][ C1] wakeup_source_unregister+0x110/0x32c [ 83.194100][ C1] mmc_host_classdev_release+0x48/0x100 [ 83.194111][ C1] device_release+0xb4/0x1d4 [ 83.194120][ C1] kobject_put+0x1dc/0x4b8 [ 83.194130][ C1] put_device+0x28/0x40 [ 83.194141][ C1] mmc_free_host+0x30/0x40 [ 83.194152][ C1] vub300_delete+0xd4/0xec [ 83.194159][ C1] vub300_inactivity_timer_expired+0xd4/0x2ac [ 83.194167][ C1] call_timer_fn+0x194/0xa4c [ 83.194174][ C1] __run_timer_base+0x530/0x744 [ 83.194185][ C1] run_timer_base+0x84/0x1b8 [ 83.194192][ C1] run_timer_softirq+0x20/0x48 [ 83.194203][ C1] handle_softirqs+0x2ec/0xd98 [ 83.194211][ C1] __do_softirq+0x14/0x20 [ 83.194218][ C1] ____do_softirq+0x14/0x20 [ 83.194225][ C1] call_on_irq_stack+0x30/0x48 [ 83.194233][ C1] do_softirq_own_stack+0x20/0x2c [ 83.194240][ C1] __irq_exit_rcu+0x1c0/0x458 [ 83.194248][ C1] irq_exit_rcu+0x14/0x84 [ 83.194256][ C1] el1_interrupt+0x40/0x60 [ 83.194264][ C1] el1h_64_irq_handler+0x18/0x24 [ 83.194273][ C1] el1h_64_irq+0x6c/0x70 [ 83.194281][ C1] lock_acquire+0x17c/0x370 (P) [ 83.194289][ C1] slab_address+0xc4/0x258 [ 83.194298][ C1] kasan_record_aux_stack+0x44/0xc8 [ 83.194307][ C1] call_rcu+0x104/0x75c [ 83.194315][ C1] kmem_cache_free+0x484/0x6c0 [ 83.194323][ C1] vm_area_free+0x10c/0x17c [ 83.194332][ C1] remove_vma+0x120/0x138 [ 83.194341][ C1] vms_complete_munmap_vmas+0x650/0x930 [ 83.194351][ C1] __mmap_complete+0xb0/0x3bc [ 83.194361][ C1] mmap_region+0xd4c/0x1c30 [ 83.194371][ C1] do_mmap+0xb88/0x1104 [ 83.194378][ C1] vm_mmap_pgoff+0x298/0x46c [ 83.194386][ C1] ksys_mmap_pgoff+0xd0/0x5b4 [ 83.194394][ C1] __arm64_sys_mmap+0x110/0x12c [ 83.194404][ C1] invoke_syscall+0x98/0x244 [ 83.194415][ C1] el0_svc_common+0xec/0x23c [ 83.194425][ C1] do_el0_svc+0x4c/0x5c [ 83.194435][ C1] el0_svc+0x64/0x260 [ 83.194444][ C1] el0t_64_sync_handler+0x44/0x104 [ 83.194453][ C1] el0t_64_sync+0x198/0x19c [ 83.194464][ T7853] [ 83.200150][ C1] ================================================================== [ 83.250948][ C1] BUG: KASAN: stack-out-of-bounds in stack_trace_consume_entry+0xe8/0x1d0 [ 83.252343][ C1] Write of size 8 at addr ffff80008ec475b0 by task sed/7853 [ 83.253569][ C1] [ 83.253961][ C1] CPU: 1 UID: 0 PID: 7853 Comm: sed Tainted: G W syzkaller #0 PREEMPT [ 83.255868][ C1] Tainted: [W]=WARN [ 83.256569][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.258456][ C1] Call trace: [ 83.259035][ C1] show_stack+0x2c/0x3c (C) [ 83.259849][ C1] __dump_stack+0x30/0x40 [ 83.260612][ C1] dump_stack_lvl+0xd8/0x12c [ 83.261414][ C1] print_address_description+0xb0/0x238 [ 83.262381][ C1] print_report+0x68/0x84 [ 83.263140][ C1] kasan_report+0x8c/0xc4 [ 83.263884][ C1] __asan_report_store8_noabort+0x20/0x2c [ 83.264897][ C1] stack_trace_consume_entry+0xe8/0x1d0 [ 83.265859][ C1] arch_stack_walk+0x218/0x328 [ 83.266631][ C1] stack_trace_save+0x9c/0xf0 [ 83.267419][ C1] kasan_save_track+0x40/0x78 [ 83.268226][ C1] kasan_save_alloc_info+0x40/0x50 [ 83.269086][ C1] __kasan_mempool_unpoison_object+0xa8/0x13c [ 83.270142][ C1] napi_skb_cache_get+0x474/0x8f8 [ 83.271102][ C1] __alloc_skb+0x180/0x610 [ 83.271923][ C1] napi_alloc_skb+0xa4/0x884 [ 83.272773][ C1] gve_rx_copy_data+0x40/0x1a0 [ 83.273660][ C1] gve_rx_copy+0x90/0xf0 [ 83.274451][ C1] gve_rx_poll_dqo+0x1e84/0x3650 [ 83.275368][ C1] gve_napi_poll_dqo+0x11c/0x3b4 [ 83.276278][ C1] __napi_poll+0xb4/0x328 [ 83.277056][ C1] net_rx_action+0x5b0/0xc14 [ 83.277882][ C1] handle_softirqs+0x2ec/0xd98 [ 83.278706][ C1] __do_softirq+0x14/0x20 [ 83.279491][ C1] ____do_softirq+0x14/0x20 [ 83.280281][ C1] call_on_irq_stack+0x30/0x48 [ 83.281141][ C1] [ 83.281553][ C1] The buggy address belongs to a 8-page vmalloc region starting at 0xffff80008ec40000 allocated at init_IRQ+0x10/0x34 [ 83.283637][ C1] The buggy address belongs to the physical page: [ 83.284713][ C1] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1011e7 [ 83.286208][ C1] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 83.287458][ C1] raw: 05ffc00000000000 fffffdffc30479c8 fffffdffc30479c8 0000000000000000 [ 83.288925][ C1] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 83.290400][ C1] page dumped because: kasan: bad access detected [ 83.291500][ C1] [ 83.291886][ C1] Memory state around the buggy address: [ 83.292836][ C1] ffff80008ec47480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 83.294187][ C1] ffff80008ec47500: f1 f1 f1 f1 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 [ 83.295599][ C1] >ffff80008ec47580: f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 [ 83.297012][ C1] ^ [ 83.297998][ C1] ffff80008ec47600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 83.299389][ C1] ffff80008ec47680: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 f3 [ 83.300773][ C1] ================================================================== [ 83.302232][ C1] Disabling lock debugging due to kernel taint [ 83.303819][ T7853] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 83.305536][ T7853] Mem abort info: [ 83.306195][ T7853] ESR = 0x0000000086000004 [ 83.307033][ T7853] EC = 0x21: IABT (current EL), IL = 32 bits [ 83.308139][ T7853] SET = 0, FnV = 0 [ 83.308804][ T7853] EA = 0, S1PTW = 0 [ 83.309492][ T7853] FSC = 0x04: level 0 translation fault [ 83.310498][ T7853] user pgtable: 4k pages, 48-bit VAs, pgdp=000000010d594000 [ 83.311789][ T7853] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 83.313170][ T7853] Internal error: Oops: 0000000086000004 [#1] SMP [ 83.314300][ T7853] Modules linked in: [ 83.314979][ T7853] CPU: 1 UID: 0 PID: 7853 Comm: sed Tainted: G B W syzkaller #0 PREEMPT [ 83.316698][ T7853] Tainted: [B]=BAD_PAGE, [W]=WARN [ 83.317589][ T7853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 83.319284][ T7853] pstate: 434000c5 (nZcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 83.320572][ T7853] pc : 0x0 [ 83.321074][ T7853] lr : 0x0 [ 83.321583][ T7853] sp : ffff80008ec46d60 [ 83.322260][ T7853] x29: ffff0001add19150 x28: ffff0000f16c1d80 x27: 00000000000000c0 [ 83.323674][ T7853] x26: 1ffff0001126aa15 x25: ffff80008ec46f40 x24: dfff800000000000 [ 83.325111][ T7853] x23: 0000000083400005 x22: 1fffe0001e2d83b1 x21: dfff800000000000 [ 83.326471][ T7853] x20: ffff0000f16c1d80 x19: ffff0000f16c1d88 x18: 00000000ffffffff [ 83.327938][ T7853] x17: 00000000ffff0000 x16: ffff000000000000 x15: 0000000000000000 [ 83.329400][ T7853] x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000003 [ 83.330867][ T7853] x11: 0000000000000000 x10: 0000000000000003 x9 : 00000000000000c0 [ 83.332333][ T7853] x8 : 0000000000400000 x7 : 0000000000000000 x6 : ffff80008044488c [ 83.333732][ T7853] x5 : 0000000000000001 x4 : 00000013654b58b6 x3 : ffff80008058b884 [ 83.335136][ T7853] x2 : 0000000000000003 x1 : ffff0000f16c1d80 x0 : ffff800080311114 [ 83.336569][ T7853] Call trace: [ 83.337173][ T7853] 0x0 (P) [ 83.337702][ T7853] ---[ end trace 0000000000000000 ]--- [ 83.352937][ T7860] Bluetooth: MGMT ver 1.23 [ 83.638871][ T7853] Kernel panic - not syncing: Oops: Fatal exception [ 83.640791][ T7853] SMP: stopping secondary CPUs [ 83.641640][ T7853] Kernel Offset: disabled [ 83.642376][ T7853] CPU features: 0x0,a0000000,00f00020,9c080a02,a84ff6a7 [ 83.643590][ T7853] Memory Limit: none [ 83.952267][ T7853] Rebooting in 86400 seconds..