last executing test programs: 17.039560573s ago: executing program 2 (id=384): syz_usb_connect(0x3, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = syz_open_dev$midi(&(0x7f0000000080), 0x3, 0x8ac02) readv(r0, &(0x7f0000000480)=[{&(0x7f0000000000)=""/128, 0x80}], 0x1) 15.05840317s ago: executing program 3 (id=390): syz_open_dev$usbfs(0x0, 0xb, 0x101301) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) bpf$MAP_CREATE(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002a00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000015c0)=ANY=[@ANYRES32=r6, @ANYRES32=r7, @ANYBLOB], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r6}, &(0x7f00000006c0), &(0x7f0000000700)=r5}, 0x20) sendmsg$inet(r4, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 12.931084283s ago: executing program 3 (id=392): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 12.744989533s ago: executing program 2 (id=393): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x4c, 0x32, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffff7d}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x44}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40850}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ptrace$pokeuser(0x6, 0x0, 0x388, 0xd) mlockall(0x5) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xc040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl(r2, 0x4048aec9, &(0x7f00000000c0)="03000000000000000100000005") r3 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r3, 0x0, 0x4000000) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001c40)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000140), 0x8083, 0x0) io_uring_enter(0xffffffffffffffff, 0x8ae, 0xfbb9, 0x35, 0x0, 0x0) r5 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x802154}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0x20}}}, &(0x7f0000000480)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r5) syz_ublk_setup_queues(r11, r10, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x11, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r5}, 0xffffffffffffffff, 0x0, 0x0}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3900, 0x0, 0x10001, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x400, 0x3, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf150, 0x400, 0x6, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r11, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) syz_ublk_add_dev(r12, r6, r13, r8, &(0x7f0000000740)={0x2e, 0x5a, 0x0, r9, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x12ef, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000700)=@any_dev={0x1, 0xa98, 0x0, 0x0, 0x1000, 0x2, 0xffffffffffffffff, 0x0, 0xc0}}}, &(0x7f00000007c0)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000180)=0x1) preadv2(r0, &(0x7f0000003500)=[{&(0x7f0000000580)=""/72, 0x48}], 0x1, 0x0, 0x7e, 0x10) socket$unix(0x1, 0x2, 0x0) 11.219549043s ago: executing program 2 (id=396): fsopen(0x0, 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x1, 0x28001, 0x0, 0xb46, 0x200000000002, 0x7, 0x8, 0x1}, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)='X\x00\x00', 0x3}], 0x1) 8.924191041s ago: executing program 3 (id=402): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x6, 0x2}, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x3, 'wrr\x00', 0xd, 0x81, 0x2e}, {@rand_addr=0xac1414aa, 0x4e23, 0x3, 0x1cb, 0x12d5c, 0x12d59}}, 0x44) 6.241580381s ago: executing program 0 (id=409): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@empty}}, 0x0) ioctl$XFS_IOC_COMMIT_RANGE(r1, 0x40585883, &(0x7f00000001c0)={r0, 0x0, 0x8001, 0x2b, 0x0, 0x4, [0x4800000000000, 0x2, 0x5, 0x3, 0x8000000000000000]}) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@allocspi={0x104, 0x16, 0x4, 0x70bd2c, 0x25dfdbfc, {{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2, 0x4e20, 0x1, 0x4e23, 0x0, 0xa, 0x30, 0x40, 0x0, 0x0, r2}, {@in6=@mcast1, 0x4d4, 0x6c}, @in6=@remote, {0x7, 0x6e, 0x2, 0xc, 0x7fffffff, 0x7, 0x7d3, 0x80000001}, {0x6d, 0x10, 0x0, 0x80000000}, {0x10001, 0x5, 0x7}, 0x2, 0x3502, 0x2, 0x3, 0x5, 0x60}, 0x10000, 0x100}, [@iptfs_dont_frag={0x4}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xffffffff}]}, 0x104}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) unshare(0x2c020400) msgsnd(0x0, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x2000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x61, 0x0, 0x2}, {0x4}, {0x3, 0xfd}, {0x0, 0x0, 0x0, 0x10000000}, {}, {0x0, 0x0, 0xf8}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0xfffffffc}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) fsopen(0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) 4.301494535s ago: executing program 3 (id=412): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 4.047275131s ago: executing program 4 (id=413): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) 4.008017322s ago: executing program 3 (id=414): syz_clone3(&(0x7f0000000080)={0x180801400, 0x0, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x6, &(0x7f00005fe000/0x1000)=nil, &(0x7f0000ca5000/0x4000)=nil, 0xb1f2, 0x0, 0x0, 0x7dc, 0x58, 0x0, 0x0, 0x40}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}], 0x1, 0x40800) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = fsopen(&(0x7f0000000000)='gfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000080)='source', &(0x7f0000000640)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14/8\\\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x6, 0x2}, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x3, 'wrr\x00', 0xd, 0x81, 0x2e}, {@rand_addr=0xac1414aa, 0x4e23, 0x3, 0x1cb, 0x12d5c, 0x12d59}}, 0x44) 2.882521676s ago: executing program 1 (id=423): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) unshare(0x22020600) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='stack\x00') lseek(r0, 0x3, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x0, 0x0, 0x1f0, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 2.75393894s ago: executing program 0 (id=424): openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x103000, 0x0) syz_ublk_setup_io_uring(0x1e, &(0x7f0000000580)={0x0, 0x9f03, 0x80, 0x6, 0x10001d8}, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x2002, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="180300003f0007012bbd700000000000017c0000e402fc80b00215806a4b4767ef29e5317dbe81cb7de0203ee72ec55ce049121c273120d45f7f360500109f58472b6d5371afc5ca2de5a1c14cbfedfa5363edd2ccc02813c08d1df81c7c15f732285519470ddf35cf5cf5fc8c71b4aa5351828f2f57af12e5d98e2eb4a849e4328e2cb8e61c024296f5ad2d351a5c7960dca8d98cc8fe8e8a48809ea287b746136d79be7cf397275f5d5cddc331f54ff9f7bc97dbc71329085b28dadfd8d25dc1b1f0036e96cef4a01d64e238c23e29774334769f32fe03806535641f5d37003d1d74881c9e9b73792b7c5f5871b49f3dac0ef126e466cb349bf67e5459bb69c6014780", @ANYRES32, @ANYBLOB="3d3668c91db02d5da40b867662c8238467dec63baa8faa428f086cdffaf2d95157392235c8aaff9de9dcb900a000a166ba80322accf55c0c767755bc1ab7084522b51d536b8940b4090df7caaef7907d665fcc01d1c05cd79956f7779696daafee87331484887e2bae20241cc6af0bef4b7c66968a77b38b22493aabf251316820cac664c5a63d9053fe1fc081f99f965d07a220117c951b534abc8fc79bea699d15e670a9d71eb71da6d56e976f907406551dfe19e03bfb092757792fa8228c28bab6f430cca7e930a1ea4a5dc03e5794e664ad34938ae1dc14440f12392832fff021000000c7002500b16659d73a3e415dfc3286bf8fee575ddc0ef3e6eef9505912b264644cecae2d0368668a5624ab70ae7a488178ff81d41e8c4e0f1b058f0d5e5eca09cf130422285017e5fa8451c635277015f246a6cbda429d5fa753de667ea24b34c7c6ed32fd74a9706e7a65ee41ddcb1ec19e3abf4c37d6c16d77f29d22e4ea088975b9b418b645d43e19a9738809987bcb185e3df3b4839330a01a7c62010c993e48569a225ac133ae44fe5270431128f74670ed7baf3f303d65377c4bbc7f82076cdfacdc1ed6000800e900ac1414bb000005006e000000000008000800", @ANYRES32, @ANYBLOB="0c00018008000600", @ANYRES32, @ANYBLOB="0c000280050023000000000008000500", @ANYRES32=r2], 0x318}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000801}, 0x40) 2.603694059s ago: executing program 2 (id=425): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in6=@empty}}, 0x0) ioctl$XFS_IOC_COMMIT_RANGE(r1, 0x40585883, &(0x7f00000001c0)={r0, 0x0, 0x8001, 0x2b, 0x0, 0x4, [0x4800000000000, 0x2, 0x5, 0x3, 0x8000000000000000]}) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@allocspi={0x104, 0x16, 0x4, 0x70bd2c, 0x25dfdbfc, {{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@multicast2, 0x4e20, 0x1, 0x4e23, 0x0, 0xa, 0x30, 0x40, 0x0, 0x0, r2}, {@in6=@mcast1, 0x4d4, 0x6c}, @in6=@remote, {0x7, 0x6e, 0x2, 0xc, 0x7fffffff, 0x7, 0x7d3, 0x80000001}, {0x6d, 0x10, 0x0, 0x80000000}, {0x10001, 0x5, 0x7}, 0x2, 0x3502, 0x2, 0x3, 0x5, 0x60}, 0x10000, 0x100}, [@iptfs_dont_frag={0x4}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xffffffff}]}, 0x104}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) unshare(0x2c020400) msgsnd(0x0, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x2000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x61, 0x0, 0x2}, {0x4}, {0x3, 0xfd}, {0x0, 0x0, 0x0, 0x10000000}, {}, {0x0, 0x0, 0xf8}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0xfffffffc}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x9, 0x0, 0x0) fsopen(0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) 2.603535282s ago: executing program 4 (id=426): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x47b, 0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r4, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r4, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, 0x0, 0x0) 2.563706413s ago: executing program 1 (id=427): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='freezer.parent_freezing\x00', 0x0, 0x0) readv(r1, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1) 1.862396516s ago: executing program 4 (id=428): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fd", 0x117}], 0x1}}], 0x1, 0x2090) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000180)="228b0a3652", 0x5}, {&(0x7f0000000200)="175c15194fad5248c52ac1fc08d8399adf0d297ac3d2a1aa16f11eb8b8d820024c580e0de604fdbaed2ef90756c8be23ba639df0a47831c2d918315bfcf25597e99e8af1058c3fc9a3ff26a444a61320cc32641c81b3835e48fad535a4", 0x5d}, {&(0x7f0000000440)="5fe22bb7bb83f3dce8fa869159ca63aa7fa342c010b43bebd16fd340b362aa61a8cc38e0389b6132aabbca1ba3cdf1205328a48fbe94f750a863619b1e8ec98b60faed078bb15658d50686d5c5b354b08f67723e19676fa7c6386c16af2425b3f00d", 0x62}, {&(0x7f0000000780)="fb182126dae81521ece692032aaf33f601510a53da0a3320f4ff08c6f2b8cc70e49fe8024309b9acada20b8b771c5e4b312b52eb77a341203c77ffcd21d53887633fdd199c3b94dd33828fc6ec389e4eedae3a1d66acc604c6319986b5484dc58b64c795072e6c7e873ae398a493b5e665414c7d195a47fc460a3860c499d788ef1112fe4a90c696350f00000000000000c602c8f5afeb4de3350186315190c10261f4599ffc530c730bd7e1ce934f465d5ab0f714fc7b979e894f1a8bb9e6cfd23c9566b720428d595b8b968b4dd46bc959b9b5424d459e0d4f1860efeebc7526d68b73", 0xe4}], 0x4) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f798032ed4237ad618305d0bffb28dac3b13bd1", 0x40d) 1.832816822s ago: executing program 2 (id=429): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_emit_ethernet(0x66, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r3 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r3, 0xffffffffffffffff, 0x5b) read$watch_queue(r0, &(0x7f00000002c0)=""/1, 0x1) keyctl$revoke(0x3, r3) ioctl$OCFS2_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046f01, &(0x7f0000000200)=0x1) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fsopen(&(0x7f0000000000)='nfs4\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000002140)=ANY=[]) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000d80)) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(r4, r4) write$vhost_msg_v2(r5, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0x74, 0x0, 0x1, 0x2}}, 0x48) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=n', 0x31) 1.327434174s ago: executing program 1 (id=430): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r0, 0x32b, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24000800}, 0x8000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000006000)={&(0x7f0000005fc0)={0x20, 0x0, 0x305, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004}, 0x8800) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0xa0102}, 0xc, &(0x7f0000000300)={&(0x7f0000000800)=ANY=[@ANYBLOB="00000300804f19722be08e3d0e963db2507a04003e4f7026a49a5bbf90b2b5a4fa31bcfc90c7f8a6d6a3e99bcd1924f1c5fca28a5404f59774f93733", @ANYRES16, @ANYBLOB="00042abd7000fedbdf250100000008003a000600000005002a0001000000"], 0x24}, 0x1, 0x0, 0x0, 0x2c00c055}, 0x8000) 1.300333854s ago: executing program 0 (id=431): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000140)={0x11, 0x63dcbf62d8600606, 0x0, 0x1, 0xb, 0x6, @local}, 0x14) bind$packet(r1, &(0x7f00000001c0)={0x11, 0x4, 0x0, 0x1, 0x49}, 0x14) syz_emit_ethernet(0x11, &(0x7f0000000680)=ANY=[@ANYBLOB="aa0000000000000080a2aa0d0606"], 0x0) 1.279844735s ago: executing program 4 (id=432): sendmsg$inet(0xffffffffffffffff, 0x0, 0x2400c804) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x6, 'veth0_virt_wifi\x00', {0x3b}, 0x26}) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 848.118767ms ago: executing program 1 (id=433): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00'}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x10) 709.546077ms ago: executing program 0 (id=434): set_mempolicy(0x3, &(0x7f0000000700)=0x2, 0x3) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000080)=ANY=[], 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'syztnl0\x00', 0x0}) ioctl$EVIOCRMFF(r0, 0xc0085504, &(0x7f0000000040)=0x18) 496.779883ms ago: executing program 1 (id=435): ioctl$VIDIOC_G_SELECTION(0xffffffffffffffff, 0xc040565e, &(0x7f00000001c0)={0x6, 0x102, 0x4, {0x0, 0x8, 0x52, 0xd363}}) 0s ago: executing program 1 (id=436): kexec_load(0x3, 0x0, 0x0, 0x0) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) fsopen(0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x2, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.45' (ED25519) to the list of known hosts. [ 91.552626][ T5570] cgroup: Unknown subsys name 'net' [ 91.796367][ T5570] cgroup: Unknown subsys name 'cpuset' [ 91.869009][ T5570] cgroup: Unknown subsys name 'rlimit' [ 92.007499][ T1704] cfg80211: failed to load regulatory.db Setting up swapspace version 1, size = 127995904 bytes [ 93.783386][ T5570] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.405414][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.423641][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.432619][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.436372][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.437540][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.463835][ T4899] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.493810][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.499492][ T4899] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.503117][ T4899] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.545134][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.557405][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.566112][ T5600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.586298][ T5600] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.587520][ T5600] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 96.598122][ T5600] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.614328][ T5600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.614773][ T5600] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.615669][ T5600] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.644369][ T5597] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.661985][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.713072][ T4899] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 96.736425][ T5593] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 96.737809][ T5593] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 96.791635][ T4899] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 96.797351][ T4899] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 98.559311][ T4899] Bluetooth: hci1: command tx timeout [ 98.718655][ T4899] Bluetooth: hci2: command tx timeout [ 98.799660][ T4899] Bluetooth: hci0: command tx timeout [ 98.799670][ T5600] Bluetooth: hci3: command tx timeout [ 98.878298][ T4899] Bluetooth: hci4: command tx timeout [ 99.325110][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.325933][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.326090][ T5591] bridge_slave_0: entered allmulticast mode [ 99.339687][ T5591] bridge_slave_0: entered promiscuous mode [ 99.372156][ T5589] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.372263][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.372373][ T5589] bridge_slave_0: entered allmulticast mode [ 99.374241][ T5589] bridge_slave_0: entered promiscuous mode [ 99.417610][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.417712][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.418605][ T5591] bridge_slave_1: entered allmulticast mode [ 99.422206][ T5591] bridge_slave_1: entered promiscuous mode [ 99.459876][ T5589] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.460006][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.460160][ T5589] bridge_slave_1: entered allmulticast mode [ 99.462178][ T5589] bridge_slave_1: entered promiscuous mode [ 99.520826][ T5588] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.520927][ T5588] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.521038][ T5588] bridge_slave_0: entered allmulticast mode [ 99.522734][ T5588] bridge_slave_0: entered promiscuous mode [ 99.599674][ T5588] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.599791][ T5588] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.599942][ T5588] bridge_slave_1: entered allmulticast mode [ 99.602064][ T5588] bridge_slave_1: entered promiscuous mode [ 99.640767][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.640898][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.641072][ T5594] bridge_slave_0: entered allmulticast mode [ 99.643772][ T5594] bridge_slave_0: entered promiscuous mode [ 99.685125][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.709004][ T5589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.709262][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.709405][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.711215][ T5594] bridge_slave_1: entered allmulticast mode [ 99.713750][ T5594] bridge_slave_1: entered promiscuous mode [ 99.715372][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.715452][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.715777][ T5590] bridge_slave_0: entered allmulticast mode [ 99.717507][ T5590] bridge_slave_0: entered promiscuous mode [ 99.782983][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.806503][ T5589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.831395][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.831517][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.831633][ T5590] bridge_slave_1: entered allmulticast mode [ 99.835186][ T5590] bridge_slave_1: entered promiscuous mode [ 99.880834][ T5588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.946891][ T5588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.971816][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.996010][ T5591] team0: Port device team_slave_0 added [ 100.016793][ T5589] team0: Port device team_slave_0 added [ 100.025758][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.037882][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.049490][ T5591] team0: Port device team_slave_1 added [ 100.069042][ T5589] team0: Port device team_slave_1 added [ 100.090775][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.114274][ T5588] team0: Port device team_slave_0 added [ 100.186497][ T5588] team0: Port device team_slave_1 added [ 100.212716][ T5594] team0: Port device team_slave_0 added [ 100.233237][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.233255][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.233292][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.284082][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.284096][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.284115][ T5589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.286747][ T5594] team0: Port device team_slave_1 added [ 100.291469][ T5590] team0: Port device team_slave_0 added [ 100.293295][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.293358][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.293442][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.389784][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.389802][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.389828][ T5589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.454883][ T5590] team0: Port device team_slave_1 added [ 100.469836][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.469848][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.469865][ T5588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.541678][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.541693][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.541713][ T5588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.542780][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.542791][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.542809][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.642619][ T4899] Bluetooth: hci1: command tx timeout [ 100.645821][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.645833][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.645860][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.707731][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.707746][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.707783][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.798386][ T4899] Bluetooth: hci2: command tx timeout [ 100.878377][ T4899] Bluetooth: hci0: command tx timeout [ 100.878395][ T5600] Bluetooth: hci3: command tx timeout [ 100.958401][ T5600] Bluetooth: hci4: command tx timeout [ 101.149990][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.150005][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.150024][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.214389][ T5591] hsr_slave_0: entered promiscuous mode [ 101.215806][ T5591] hsr_slave_1: entered promiscuous mode [ 101.253285][ T5589] hsr_slave_0: entered promiscuous mode [ 101.254209][ T5589] hsr_slave_1: entered promiscuous mode [ 101.254960][ T5589] debugfs: 'hsr0' already exists in 'hsr' [ 101.255045][ T5589] Cannot create hsr debugfs directory [ 101.329356][ T5588] hsr_slave_0: entered promiscuous mode [ 101.330411][ T5588] hsr_slave_1: entered promiscuous mode [ 101.331115][ T5588] debugfs: 'hsr0' already exists in 'hsr' [ 101.331134][ T5588] Cannot create hsr debugfs directory [ 101.414617][ T5594] hsr_slave_0: entered promiscuous mode [ 101.415446][ T5594] hsr_slave_1: entered promiscuous mode [ 101.416111][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 101.416130][ T5594] Cannot create hsr debugfs directory [ 101.535882][ T5590] hsr_slave_0: entered promiscuous mode [ 101.536859][ T5590] hsr_slave_1: entered promiscuous mode [ 101.537531][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 101.537558][ T5590] Cannot create hsr debugfs directory [ 102.416840][ T5591] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 102.482379][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.492257][ T5591] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 102.532656][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.535771][ T5591] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 102.583210][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.606676][ T5591] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 102.632831][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.718392][ T5600] Bluetooth: hci1: command tx timeout [ 102.768150][ T5588] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.803667][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.822002][ T5588] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.862380][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.865924][ T5588] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.880193][ T5600] Bluetooth: hci2: command tx timeout [ 102.892216][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.918884][ T5588] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.951664][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.959835][ T5600] Bluetooth: hci0: command tx timeout [ 102.970958][ T5600] Bluetooth: hci3: command tx timeout [ 103.038395][ T5600] Bluetooth: hci4: command tx timeout [ 103.110779][ T5594] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 103.142268][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.161950][ T5594] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 103.202840][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.207327][ T5594] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 103.245729][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.273731][ T5594] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 103.312624][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.487139][ T5590] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 103.519797][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.529572][ T5590] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 103.572394][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.593934][ T5590] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.613003][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.639464][ T5590] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.683402][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.712556][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.829437][ T5589] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 103.863270][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.881546][ T5589] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 103.913357][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.928265][ T5589] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 103.963096][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.965362][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.970756][ T5589] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.013300][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.061358][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.061538][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.109743][ T5588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.150963][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.152148][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.257438][ T5588] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.301475][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.301593][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.357722][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.376651][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.376735][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.500315][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.563454][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.563679][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.584302][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.647575][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.647702][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.786620][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.798371][ T5600] Bluetooth: hci1: command tx timeout [ 104.849708][ T5589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.886743][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.886877][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.958899][ T5600] Bluetooth: hci2: command tx timeout [ 104.962942][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.963096][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.038330][ T5600] Bluetooth: hci0: command tx timeout [ 105.052198][ T5600] Bluetooth: hci3: command tx timeout [ 105.101292][ T5589] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.128886][ T5600] Bluetooth: hci4: command tx timeout [ 105.155478][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.160385][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.219608][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.222372][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.941159][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.226680][ T5591] veth0_vlan: entered promiscuous mode [ 106.269669][ T5588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.316335][ T5591] veth1_vlan: entered promiscuous mode [ 106.523711][ T5591] veth0_macvtap: entered promiscuous mode [ 106.641787][ T5591] veth1_macvtap: entered promiscuous mode [ 106.722210][ T5588] veth0_vlan: entered promiscuous mode [ 106.760599][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.786751][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.796453][ T5588] veth1_vlan: entered promiscuous mode [ 106.810378][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.847799][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.206604][ T5588] veth0_macvtap: entered promiscuous mode [ 107.292000][ T5589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.368606][ T5588] veth1_macvtap: entered promiscuous mode [ 107.461139][ T5590] veth0_vlan: entered promiscuous mode [ 107.504366][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.504388][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.554876][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.585251][ T5590] veth1_vlan: entered promiscuous mode [ 107.621057][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.727680][ T5594] veth0_vlan: entered promiscuous mode [ 107.735199][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.735218][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.794404][ T5589] veth0_vlan: entered promiscuous mode [ 107.865343][ T5594] veth1_vlan: entered promiscuous mode [ 107.970876][ T5589] veth1_vlan: entered promiscuous mode [ 108.046509][ T5591] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 108.083634][ T5590] veth0_macvtap: entered promiscuous mode [ 108.231893][ T5590] veth1_macvtap: entered promiscuous mode [ 108.561102][ T980] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.561124][ T980] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.348531][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.410618][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.557711][ T5780] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6'. [ 109.576530][ T5594] veth0_macvtap: entered promiscuous mode [ 109.692047][ T5782] netlink: 'syz.1.7': attribute type 4 has an invalid length. [ 109.742093][ T5594] veth1_macvtap: entered promiscuous mode [ 109.760144][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.760165][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.843341][ T5589] veth0_macvtap: entered promiscuous mode [ 109.921217][ T5589] veth1_macvtap: entered promiscuous mode [ 110.142020][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.324451][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.342971][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.490205][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.595800][ T5793] netlink: 56 bytes leftover after parsing attributes in process `syz.1.10'. [ 110.635259][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.635281][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.011965][ T5735] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 111.068453][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.068476][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.220338][ T5735] usb 1-1: Using ep0 maxpacket: 32 [ 111.252333][ T5735] usb 1-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 111.289051][ T5735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.572772][ T5735] usb 1-1: config 0 descriptor?? [ 112.212550][ T5735] as10x_usb: device has been detected [ 112.215792][ T5735] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 112.295523][ T5735] usb 1-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 112.419490][ T5803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13'. [ 112.648099][ T5735] as10x_usb: error during firmware upload part1 [ 112.653830][ T5735] Registered device nBox DVB-T Dongle [ 112.767535][ T5735] usb 1-1: USB disconnect, device number 2 [ 112.818861][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.818883][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.088840][ T162] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.090457][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.133549][ T5735] Unregistered device nBox DVB-T Dongle [ 113.136116][ T5735] as10x_usb: device has been disconnected [ 113.302784][ T5812] netlink: 'syz.1.14': attribute type 4 has an invalid length. [ 113.317678][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.317700][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.560780][ T5816] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 113.777906][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.777930][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.957601][ T4278] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.957626][ T4278] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.023620][ T162] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.037031][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.084113][ T95] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.084950][ T95] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.481944][ T95] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.486185][ T980] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.010839][ T95] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.060718][ T95] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.242959][ T95] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.654944][ T1161] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.655478][ T1161] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.835067][ T5831] netlink: 56 bytes leftover after parsing attributes in process `syz.0.20'. [ 115.843303][ T57] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.906005][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.906224][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.906425][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.906675][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.013881][ T5834] ======================================================= [ 116.013881][ T5834] WARNING: The mand mount option has been deprecated and [ 116.013881][ T5834] and is ignored by this kernel. Remove the mand [ 116.013881][ T5834] option from the mount to silence this warning. [ 116.013881][ T5834] ======================================================= [ 116.017138][ T5834] overlayfs: missing 'workdir' [ 116.123755][ T95] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.223439][ T5843] netlink: 'syz.0.23': attribute type 4 has an invalid length. [ 116.617900][ T5851] Zero length message leads to an empty skb [ 117.024606][ T4278] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.349673][ T5885] netlink: 56 bytes leftover after parsing attributes in process `syz.4.35'. [ 120.699103][ T5892] netlink: 'syz.2.37': attribute type 4 has an invalid length. [ 122.887223][ T5911] syz.3.44 uses obsolete (PF_INET,SOCK_PACKET) [ 122.984138][ T5913] tmpfs: Unsupported parameter 'huge' [ 123.298007][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 123.400509][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 123.431734][ T5921] netlink: 56 bytes leftover after parsing attributes in process `syz.0.49'. [ 123.458339][ T5735] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 123.660813][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 123.663638][ T5735] usb 5-1: unable to get BOS descriptor or descriptor too short [ 123.664383][ T5735] usb 5-1: not running at top speed; connect to a high speed hub [ 123.664422][ T5735] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 123.665908][ T5735] usb 5-1: config 199 has an invalid interface number: 169 but max is 1 [ 123.665933][ T5735] usb 5-1: config 199 has an invalid interface number: 102 but max is 1 [ 123.665955][ T5735] usb 5-1: config 199 has no interface number 0 [ 123.665972][ T5735] usb 5-1: config 199 has no interface number 1 [ 123.666017][ T5735] usb 5-1: config 199 interface 169 has no altsetting 0 [ 123.666037][ T5735] usb 5-1: config 199 interface 102 has no altsetting 0 [ 123.718350][ T5845] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 123.801125][ T5735] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.801155][ T5735] usb 5-1: Product: syz [ 123.801170][ T5735] usb 5-1: Manufacturer: syz [ 123.801185][ T5735] usb 5-1: SerialNumber: syz [ 123.851669][ T5911] ceph: No mds server is up or the cluster is laggy [ 123.918611][ T5845] usb 3-1: Using ep0 maxpacket: 32 [ 123.923811][ T5845] usb 3-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 123.928815][ T5845] usb 3-1: config 0 has an invalid interface number: 119 but max is 0 [ 123.928842][ T5845] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 123.928863][ T5845] usb 3-1: config 0 has no interface number 0 [ 123.929001][ T5845] usb 3-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 123.957175][ T5845] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.957203][ T5845] usb 3-1: Product: syz [ 123.957219][ T5845] usb 3-1: Manufacturer: syz [ 123.957260][ T5845] usb 3-1: SerialNumber: syz [ 124.026247][ T5923] netlink: 'syz.0.50': attribute type 4 has an invalid length. [ 124.112587][ T5845] usb 3-1: config 0 descriptor?? [ 124.167372][ T5845] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.119/input/input5 [ 124.232551][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 124.451893][ T5924] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 124.468599][ T5924] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.635637][ T5924] warning: `syz.2.47' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 124.937494][ T5694] usb 3-1: USB disconnect, device number 2 [ 125.341306][ T5735] usb_ehset_test 5-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 125.397891][ T5735] usb_ehset_test 5-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 125.459617][ T5735] usb 5-1: USB disconnect, device number 2 [ 127.377138][ T5956] netlink: 48 bytes leftover after parsing attributes in process `syz.1.59'. [ 127.476375][ T5958] netlink: 'syz.1.61': attribute type 4 has an invalid length. [ 127.662677][ T5961] netlink: 56 bytes leftover after parsing attributes in process `syz.3.60'. [ 127.889772][ T5964] FAULT_INJECTION: forcing a failure. [ 127.889772][ T5964] name fail_futex, interval 1, probability 0, space 0, times 1 [ 127.889838][ T5964] CPU: 0 UID: 0 PID: 5964 Comm: syz.1.62 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 127.889865][ T5964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.889887][ T5964] Call Trace: [ 127.889896][ T5964] [ 127.889906][ T5964] dump_stack_lvl+0xe8/0x150 [ 127.889965][ T5964] should_fail_ex+0x46b/0x600 [ 127.890001][ T5964] get_futex_key+0x1b4/0x1580 [ 127.890039][ T5964] ? __pfx_futex_wake_mark+0x10/0x10 [ 127.890072][ T5964] ? __pfx_get_futex_key+0x10/0x10 [ 127.890106][ T5964] ? lock_acquire+0x115/0x350 [ 127.890141][ T5964] futex_wake+0x119/0x600 [ 127.890165][ T5964] ? __fget_files+0x2a/0x420 [ 127.890193][ T5964] ? __pfx_futex_wake+0x10/0x10 [ 127.890230][ T5964] ? __sys_sendto+0x240/0x5d0 [ 127.890266][ T5964] do_futex+0x458/0x4e0 [ 127.890294][ T5964] ? __pfx_do_futex+0x10/0x10 [ 127.890324][ T5964] __se_sys_futex+0x3a8/0x450 [ 127.890352][ T5964] ? __pfx___se_sys_futex+0x10/0x10 [ 127.890374][ T5964] ? rcu_is_watching+0x16/0xb0 [ 127.890413][ T5964] ? __x64_sys_futex+0x21/0xf0 [ 127.890437][ T5964] do_syscall_64+0x166/0x520 [ 127.890459][ T5964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.890482][ T5964] ? clear_bhb_loop+0x70/0xc0 [ 127.890510][ T5964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 127.890537][ T5964] RIP: 0033:0x7f161ae9e159 [ 127.890573][ T5964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.890592][ T5964] RSP: 002b:00007f16190f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 127.890622][ T5964] RAX: ffffffffffffffda RBX: 00007f161b125fa8 RCX: 00007f161ae9e159 [ 127.890639][ T5964] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f161b125fac [ 127.890654][ T5964] RBP: 00007f161b125fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 127.890670][ T5964] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 127.890685][ T5964] R13: 00007f161b126038 R14: 00007ffd48d6b070 R15: 00007ffd48d6b158 [ 127.890719][ T5964] [ 128.611277][ T5976] tmpfs: Unsupported parameter 'huge' [ 128.968282][ T5701] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 129.098292][ T5694] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 129.126232][ T5701] usb 2-1: unable to get BOS descriptor or descriptor too short [ 129.126907][ T5701] usb 2-1: not running at top speed; connect to a high speed hub [ 129.126944][ T5701] usb 2-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 129.161867][ T5701] usb 2-1: config 199 has an invalid interface number: 169 but max is 1 [ 129.161892][ T5701] usb 2-1: config 199 has an invalid interface number: 102 but max is 1 [ 129.161911][ T5701] usb 2-1: config 199 has no interface number 0 [ 129.161927][ T5701] usb 2-1: config 199 has no interface number 1 [ 129.161967][ T5701] usb 2-1: config 199 interface 169 has no altsetting 0 [ 129.161983][ T5701] usb 2-1: config 199 interface 102 has no altsetting 0 [ 129.182871][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.182899][ T5701] usb 2-1: Product: syz [ 129.182916][ T5701] usb 2-1: Manufacturer: syz [ 129.182932][ T5701] usb 2-1: SerialNumber: syz [ 129.282934][ T5694] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 129.285579][ T5694] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.328332][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.328362][ T5694] usb 3-1: SerialNumber: ࠌ [ 131.170635][ T5701] usb_ehset_test 2-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 131.249890][ T5701] usb_ehset_test 2-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 131.324060][ T5701] usb 2-1: USB disconnect, device number 2 [ 131.417675][ T5998] netlink: 'syz.0.72': attribute type 4 has an invalid length. [ 133.992287][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.992398][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.027854][ T5694] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 134.271996][ T6022] FAULT_INJECTION: forcing a failure. [ 134.271996][ T6022] name failslab, interval 1, probability 0, space 0, times 1 [ 134.272035][ T6022] CPU: 1 UID: 0 PID: 6022 Comm: syz.3.81 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 134.272058][ T6022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.272071][ T6022] Call Trace: [ 134.272079][ T6022] [ 134.272087][ T6022] dump_stack_lvl+0xe8/0x150 [ 134.272122][ T6022] should_fail_ex+0x46b/0x600 [ 134.272157][ T6022] should_failslab+0xa8/0x100 [ 134.272193][ T6022] __kmalloc_cache_noprof+0xa1/0x680 [ 134.272222][ T6022] ? snd_pcm_hw_param_near+0x80/0x4d0 [ 134.272246][ T6022] ? snd_pcm_hw_param_near+0x80/0x4d0 [ 134.272279][ T6022] snd_pcm_hw_param_near+0x80/0x4d0 [ 134.272313][ T6022] snd_pcm_oss_change_params_locked+0x1e5e/0x3c80 [ 134.272375][ T6022] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 134.272403][ T6022] ? do_raw_spin_lock+0x12b/0x2f0 [ 134.272452][ T6022] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 134.272492][ T6022] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 134.272519][ T6022] ? snd_pcm_oss_write+0x207/0xb40 [ 134.272549][ T6022] snd_pcm_oss_write+0x274/0xb40 [ 134.272590][ T6022] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 134.272615][ T6022] vfs_write+0x29f/0xbb0 [ 134.272647][ T6022] ? __pfx_vfs_write+0x10/0x10 [ 134.272673][ T6022] ? __fget_files+0x2a/0x420 [ 134.272699][ T6022] ? __fget_files+0x2a/0x420 [ 134.272721][ T6022] ? __fget_files+0x3a8/0x420 [ 134.272743][ T6022] ? __fget_files+0x2a/0x420 [ 134.272772][ T6022] ksys_write+0x156/0x270 [ 134.272808][ T6022] ? __pfx_ksys_write+0x10/0x10 [ 134.272843][ T6022] do_syscall_64+0x166/0x520 [ 134.272863][ T6022] ? trace_irq_disable+0x3b/0x140 [ 134.272889][ T6022] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.272911][ T6022] ? clear_bhb_loop+0x70/0xc0 [ 134.272937][ T6022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.272957][ T6022] RIP: 0033:0x7f218ce2e159 [ 134.272977][ T6022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.272995][ T6022] RSP: 002b:00007f218b086028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 134.273018][ T6022] RAX: ffffffffffffffda RBX: 00007f218d0b5fa0 RCX: 00007f218ce2e159 [ 134.273033][ T6022] RDX: 0000000000088020 RSI: 0000200000002000 RDI: 0000000000000004 [ 134.273046][ T6022] RBP: 00007f218cec506b R08: 0000000000000000 R09: 0000000000000000 [ 134.273059][ T6022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.273071][ T6022] R13: 00007f218d0b6038 R14: 00007f218d0b5fa0 R15: 00007fff307ef708 [ 134.273105][ T6022] [ 134.317649][ T6020] FAULT_INJECTION: forcing a failure. [ 134.317649][ T6020] name fail_futex, interval 1, probability 0, space 0, times 0 [ 134.317726][ T6020] CPU: 1 UID: 0 PID: 6020 Comm: syz.1.76 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 134.317792][ T6020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.317832][ T6020] Call Trace: [ 134.317854][ T6020] [ 134.317883][ T6020] dump_stack_lvl+0xe8/0x150 [ 134.317984][ T6020] should_fail_ex+0x46b/0x600 [ 134.318089][ T6020] get_futex_key+0x1b4/0x1580 [ 134.318157][ T6020] ? __pfx_futex_wake_mark+0x10/0x10 [ 134.318193][ T6020] ? __pfx_get_futex_key+0x10/0x10 [ 134.318227][ T6020] ? lock_acquire+0x115/0x350 [ 134.318308][ T6020] futex_wake+0x119/0x600 [ 134.318371][ T6020] ? __fget_files+0x2a/0x420 [ 134.318455][ T6020] ? __pfx_futex_wake+0x10/0x10 [ 134.318549][ T6020] ? __sys_sendto+0x240/0x5d0 [ 134.318645][ T6020] do_futex+0x458/0x4e0 [ 134.318713][ T6020] ? __pfx_do_futex+0x10/0x10 [ 134.318796][ T6020] __se_sys_futex+0x3a8/0x450 [ 134.318871][ T6020] ? __pfx___se_sys_futex+0x10/0x10 [ 134.318938][ T6020] ? rcu_is_watching+0x16/0xb0 [ 134.319042][ T6020] ? __x64_sys_futex+0x21/0xf0 [ 134.319114][ T6020] do_syscall_64+0x166/0x520 [ 134.319166][ T6020] ? trace_irq_disable+0x3b/0x140 [ 134.319237][ T6020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.319268][ T6020] ? clear_bhb_loop+0x70/0xc0 [ 134.319337][ T6020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.319360][ T6020] RIP: 0033:0x7f161ae9e159 [ 134.319403][ T6020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.319471][ T6020] RSP: 002b:00007f16190f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 134.319546][ T6020] RAX: ffffffffffffffda RBX: 00007f161b125fa8 RCX: 00007f161ae9e159 [ 134.319589][ T6020] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f161b125fac [ 134.319628][ T6020] RBP: 00007f161b125fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 134.319668][ T6020] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 134.319688][ T6020] R13: 00007f161b126038 R14: 00007ffd48d6b070 R15: 00007ffd48d6b158 [ 134.319778][ T6020] [ 134.947637][ T6029] netlink: 'syz.2.83': attribute type 4 has an invalid length. [ 135.018005][ T6031] netlink: 48 bytes leftover after parsing attributes in process `syz.1.84'. [ 135.267019][ T6025] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 135.778265][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 135.954137][ T10] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 135.957722][ T10] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.010862][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.010893][ T10] usb 2-1: SerialNumber: ࠌ [ 136.083551][ T5694] usb 3-1: USB disconnect, device number 3 [ 136.098307][ T5702] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 137.710998][ T5787] udevd[5787]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 137.781832][ T5702] usb 4-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice= 0.00 [ 137.803398][ T5702] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.586703][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 140.597756][ T5702] usb 4-1: can't set config #1, error -71 [ 140.620864][ T5702] usb 4-1: USB disconnect, device number 2 [ 140.928186][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.948194][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.958183][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.968183][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.978181][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.988183][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.998178][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 141.008188][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 141.018178][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 141.028181][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 143.145393][ T10] usb 2-1: USB disconnect, device number 3 [ 143.176172][ T6070] FAULT_INJECTION: forcing a failure. [ 143.176172][ T6070] name failslab, interval 1, probability 0, space 0, times 0 [ 143.176209][ T6070] CPU: 1 UID: 0 PID: 6070 Comm: syz.1.95 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 143.176235][ T6070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.176249][ T6070] Call Trace: [ 143.176258][ T6070] [ 143.176267][ T6070] dump_stack_lvl+0xe8/0x150 [ 143.176306][ T6070] should_fail_ex+0x46b/0x600 [ 143.176342][ T6070] should_failslab+0xa8/0x100 [ 143.176379][ T6070] __kmalloc_noprof+0xfb/0x790 [ 143.176409][ T6070] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 143.176431][ T6070] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 143.176460][ T6070] snd_pcm_hw_refine+0xa18/0x17d0 [ 143.176518][ T6070] ? __pfx_snd_pcm_hw_refine+0x10/0x10 [ 143.176578][ T6070] ? __kmalloc_cache_noprof+0x3d5/0x680 [ 143.176610][ T6070] ? snd_pcm_hw_param_near+0x80/0x4d0 [ 143.176638][ T6070] ? snd_pcm_hw_param_near+0x80/0x4d0 [ 143.176674][ T6070] snd_pcm_hw_param_near+0x108/0x4d0 [ 143.176712][ T6070] snd_pcm_oss_change_params_locked+0x1e07/0x3c80 [ 143.176759][ T6070] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 143.176782][ T6070] ? do_raw_spin_lock+0x12b/0x2f0 [ 143.176816][ T6070] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 143.176878][ T6070] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 143.176903][ T6070] ? snd_pcm_oss_write+0x207/0xb40 [ 143.176932][ T6070] snd_pcm_oss_write+0x274/0xb40 [ 143.176972][ T6070] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 143.176999][ T6070] vfs_write+0x29f/0xbb0 [ 143.177034][ T6070] ? __pfx_vfs_write+0x10/0x10 [ 143.177060][ T6070] ? __fget_files+0x2a/0x420 [ 143.177096][ T6070] ? __fget_files+0x2a/0x420 [ 143.177117][ T6070] ? __fget_files+0x3a8/0x420 [ 143.177138][ T6070] ? __fget_files+0x2a/0x420 [ 143.177170][ T6070] ksys_write+0x156/0x270 [ 143.177207][ T6070] ? __pfx_ksys_write+0x10/0x10 [ 143.177247][ T6070] do_syscall_64+0x166/0x520 [ 143.177266][ T6070] ? trace_irq_disable+0x3b/0x140 [ 143.177290][ T6070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.177312][ T6070] ? clear_bhb_loop+0x70/0xc0 [ 143.177342][ T6070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.177364][ T6070] RIP: 0033:0x7f161ae9e159 [ 143.177386][ T6070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.177406][ T6070] RSP: 002b:00007f16190f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.177431][ T6070] RAX: ffffffffffffffda RBX: 00007f161b125fa0 RCX: 00007f161ae9e159 [ 143.177448][ T6070] RDX: 0000000000088020 RSI: 0000200000002000 RDI: 0000000000000004 [ 143.177463][ T6070] RBP: 00007f161af3506b R08: 0000000000000000 R09: 0000000000000000 [ 143.177478][ T6070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.177490][ T6070] R13: 00007f161b126038 R14: 00007f161b125fa0 R15: 00007ffd48d6b158 [ 143.177523][ T6070] [ 143.568883][ T6075] netlink: 'syz.4.97': attribute type 4 has an invalid length. [ 143.642553][ T5934] udevd[5934]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 144.010959][ T6081] FAULT_INJECTION: forcing a failure. [ 144.010959][ T6081] name failslab, interval 1, probability 0, space 0, times 0 [ 144.013214][ T6081] CPU: 0 UID: 0 PID: 6081 Comm: syz.4.101 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 144.013245][ T6081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 144.013260][ T6081] Call Trace: [ 144.013269][ T6081] [ 144.013279][ T6081] dump_stack_lvl+0xe8/0x150 [ 144.013321][ T6081] should_fail_ex+0x46b/0x600 [ 144.013360][ T6081] should_failslab+0xa8/0x100 [ 144.013397][ T6081] ? __anon_vma_prepare+0x10e/0x4d0 [ 144.013427][ T6081] kmem_cache_alloc_noprof+0x9e/0x690 [ 144.013457][ T6081] ? __anon_vma_prepare+0xc3/0x4d0 [ 144.013486][ T6081] ? __anon_vma_prepare+0x10e/0x4d0 [ 144.013523][ T6081] __anon_vma_prepare+0x10e/0x4d0 [ 144.013567][ T6081] do_pte_missing+0x1d2a/0x28f0 [ 144.013619][ T6081] handle_mm_fault+0xf64/0x28c0 [ 144.013655][ T6081] ? handle_mm_fault+0xeb/0x28c0 [ 144.013696][ T6081] ? __pfx_handle_mm_fault+0x10/0x10 [ 144.013723][ T6081] ? lock_vma_under_rcu+0x45a/0x500 [ 144.013786][ T6081] do_user_addr_fault+0xa4f/0x1340 [ 144.013823][ T6081] ? trace_page_fault_user+0x84/0x1e0 [ 144.013852][ T6081] exc_page_fault+0x6a/0xc0 [ 144.013902][ T6081] asm_exc_page_fault+0x26/0x30 [ 144.013925][ T6081] RIP: 0033:0x7f552cfd0082 [ 144.013946][ T6081] Code: 8d 15 f5 19 0f 00 48 89 ee 48 89 df e8 87 f2 03 00 48 8b 05 38 2d 29 00 48 83 e8 01 48 39 e8 0f 82 b3 00 00 00 66 0f 6f 0c 24 <4c> 89 6b 20 0f 11 4b 10 48 83 c4 18 48 89 d8 5b 5d 41 5c 41 5d 41 [ 144.013964][ T6081] RSP: 002b:00007f552b264d20 EFLAGS: 00010286 [ 144.013985][ T6081] RAX: ffffffffffffffff RBX: 00007f5524000000 RCX: 00007f552d00df57 [ 144.014002][ T6081] RDX: 00007f552d0c1a53 RSI: 0000000000021000 RDI: 00007f5524000000 [ 144.014018][ T6081] RBP: 0000000000021000 R08: 00000000ffffffff R09: 0000000000000000 [ 144.014032][ T6081] R10: 0000000000000022 R11: 0000000000000217 R12: 0000000004000000 [ 144.014046][ T6081] R13: 0000000000001000 R14: 00007f5528000000 R15: 0000000000dba000 [ 144.014081][ T6081] [ 144.014318][ T6081] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 147.524087][ T5702] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 147.634477][ T6107] netlink: 'syz.0.108': attribute type 10 has an invalid length. [ 147.687846][ T6107] syz_tun: entered promiscuous mode [ 147.732215][ T5702] usb 3-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 147.734066][ T5702] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 147.781560][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.781582][ T5702] usb 3-1: SerialNumber: ࠌ [ 147.791264][ T5316] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 148.446285][ T5702] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 148.471959][ T6114] netlink: 'syz.4.111': attribute type 4 has an invalid length. [ 149.545486][ T5702] usb 3-1: USB disconnect, device number 4 [ 149.743002][ T6107] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 149.994249][ T6125] FAULT_INJECTION: forcing a failure. [ 149.994249][ T6125] name failslab, interval 1, probability 0, space 0, times 0 [ 149.994285][ T6125] CPU: 1 UID: 0 PID: 6125 Comm: syz.1.113 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 149.994310][ T6125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 149.994322][ T6125] Call Trace: [ 149.994330][ T6125] [ 149.994339][ T6125] dump_stack_lvl+0xe8/0x150 [ 149.994375][ T6125] should_fail_ex+0x46b/0x600 [ 149.994413][ T6125] should_failslab+0xa8/0x100 [ 149.994448][ T6125] __kmalloc_noprof+0xfb/0x790 [ 149.994477][ T6125] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 149.994497][ T6125] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 149.994524][ T6125] snd_pcm_hw_refine+0xa18/0x17d0 [ 149.994580][ T6125] ? __pfx_snd_pcm_hw_refine+0x10/0x10 [ 149.994644][ T6125] snd_pcm_hw_param_first+0x3ab/0xb10 [ 149.994680][ T6125] snd_pcm_hw_param_near+0x434/0x4d0 [ 149.994713][ T6125] snd_pcm_oss_change_params_locked+0x1e07/0x3c80 [ 149.994765][ T6125] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 149.994790][ T6125] ? do_raw_spin_lock+0x12b/0x2f0 [ 149.994822][ T6125] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 149.994857][ T6125] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 149.994882][ T6125] ? snd_pcm_oss_write+0x207/0xb40 [ 149.994909][ T6125] snd_pcm_oss_write+0x274/0xb40 [ 149.994947][ T6125] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 149.994971][ T6125] vfs_write+0x29f/0xbb0 [ 149.995002][ T6125] ? __pfx_vfs_write+0x10/0x10 [ 149.995027][ T6125] ? __fget_files+0x2a/0x420 [ 149.995051][ T6125] ? __fget_files+0x2a/0x420 [ 149.995071][ T6125] ? __fget_files+0x3a8/0x420 [ 149.995090][ T6125] ? __fget_files+0x2a/0x420 [ 149.995118][ T6125] ksys_write+0x156/0x270 [ 149.995144][ T6125] ? __pfx_ksys_write+0x10/0x10 [ 149.995177][ T6125] do_syscall_64+0x166/0x520 [ 149.995194][ T6125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.995214][ T6125] ? clear_bhb_loop+0x70/0xc0 [ 149.995237][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.995256][ T6125] RIP: 0033:0x7f161ae9e159 [ 149.995274][ T6125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.995291][ T6125] RSP: 002b:00007f16190f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 149.995311][ T6125] RAX: ffffffffffffffda RBX: 00007f161b125fa0 RCX: 00007f161ae9e159 [ 149.995326][ T6125] RDX: 0000000000088020 RSI: 0000200000002000 RDI: 0000000000000004 [ 149.995338][ T6125] RBP: 00007f161af3506b R08: 0000000000000000 R09: 0000000000000000 [ 149.995350][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 149.995361][ T6125] R13: 00007f161b126038 R14: 00007f161b125fa0 R15: 00007ffd48d6b158 [ 149.995388][ T6125] [ 150.059350][ T5787] udevd[5787]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 150.789378][ T6136] FAULT_INJECTION: forcing a failure. [ 150.789378][ T6136] name failslab, interval 1, probability 0, space 0, times 0 [ 150.789416][ T6136] CPU: 0 UID: 0 PID: 6136 Comm: syz.0.116 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 150.789440][ T6136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.789453][ T6136] Call Trace: [ 150.789461][ T6136] [ 150.789470][ T6136] dump_stack_lvl+0xe8/0x150 [ 150.789506][ T6136] should_fail_ex+0x46b/0x600 [ 150.789539][ T6136] should_failslab+0xa8/0x100 [ 150.789572][ T6136] ? __anon_vma_prepare+0x10e/0x4d0 [ 150.789601][ T6136] kmem_cache_alloc_noprof+0x9e/0x690 [ 150.789628][ T6136] ? __anon_vma_prepare+0xc3/0x4d0 [ 150.789653][ T6136] ? __anon_vma_prepare+0x10e/0x4d0 [ 150.789685][ T6136] __anon_vma_prepare+0x10e/0x4d0 [ 150.789734][ T6136] do_pte_missing+0x1d2a/0x28f0 [ 150.789769][ T6136] ? rt_spin_unlock+0x165/0x200 [ 150.789814][ T6136] ? __pmd_alloc+0x41b/0x5e0 [ 150.789844][ T6136] handle_mm_fault+0xf64/0x28c0 [ 150.789880][ T6136] ? handle_mm_fault+0xeb/0x28c0 [ 150.789927][ T6136] ? __pfx_handle_mm_fault+0x10/0x10 [ 150.789952][ T6136] ? lock_vma_under_rcu+0x45a/0x500 [ 150.790010][ T6136] do_user_addr_fault+0xa4f/0x1340 [ 150.790044][ T6136] ? trace_page_fault_user+0x84/0x1e0 [ 150.790070][ T6136] exc_page_fault+0x6a/0xc0 [ 150.790102][ T6136] asm_exc_page_fault+0x26/0x30 [ 150.790124][ T6136] RIP: 0033:0x7f2882760082 [ 150.790143][ T6136] Code: 8d 15 f5 19 0f 00 48 89 ee 48 89 df e8 87 f2 03 00 48 8b 05 38 2d 29 00 48 83 e8 01 48 39 e8 0f 82 b3 00 00 00 66 0f 6f 0c 24 <4c> 89 6b 20 0f 11 4b 10 48 83 c4 18 48 89 d8 5b 5d 41 5c 41 5d 41 [ 150.790161][ T6136] RSP: 002b:00007f28809f4d20 EFLAGS: 00010286 [ 150.790180][ T6136] RAX: ffffffffffffffff RBX: 00007f287c000000 RCX: 00007f288279df57 [ 150.790197][ T6136] RDX: 00007f2882851a53 RSI: 0000000000021000 RDI: 00007f287c000000 [ 150.790211][ T6136] RBP: 0000000000021000 R08: 00000000ffffffff R09: 0000000000000000 [ 150.790225][ T6136] R10: 0000000000000022 R11: 0000000000000217 R12: 0000000004000000 [ 150.790239][ T6136] R13: 0000000000001000 R14: 00007f2880000000 R15: 000000000362a000 [ 150.790271][ T6136] [ 150.790388][ T6136] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 151.081849][ T5316] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 153.438205][ T6130] ceph: No mds server is up or the cluster is laggy [ 153.469917][ T5316] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 153.948366][ T5316] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 153.979126][ T6156] netlink: 'syz.1.124': attribute type 4 has an invalid length. [ 154.040071][ T6158] FAULT_INJECTION: forcing a failure. [ 154.040071][ T6158] name failslab, interval 1, probability 0, space 0, times 0 [ 154.040110][ T6158] CPU: 0 UID: 0 PID: 6158 Comm: syz.4.125 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 154.040136][ T6158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 154.040150][ T6158] Call Trace: [ 154.040158][ T6158] [ 154.040169][ T6158] dump_stack_lvl+0xe8/0x150 [ 154.040206][ T6158] should_fail_ex+0x46b/0x600 [ 154.040251][ T6158] should_failslab+0xa8/0x100 [ 154.040287][ T6158] ? do_getname+0x2e/0x250 [ 154.040320][ T6158] kmem_cache_alloc_noprof+0x9e/0x690 [ 154.040350][ T6158] ? do_getname+0x2e/0x250 [ 154.040389][ T6158] do_getname+0x2e/0x250 [ 154.040420][ T6158] ? getname_flags+0x11/0x20 [ 154.040456][ T6158] do_sys_openat2+0xcc/0x200 [ 154.040489][ T6158] ? __se_sys_futex+0x3a8/0x450 [ 154.040516][ T6158] ? __pfx_do_sys_openat2+0x10/0x10 [ 154.040555][ T6158] ? rcu_is_watching+0x16/0xb0 [ 154.040595][ T6158] __x64_sys_openat+0x138/0x170 [ 154.040636][ T6158] do_syscall_64+0x166/0x520 [ 154.040657][ T6158] ? trace_irq_disable+0x3b/0x140 [ 154.040685][ T6158] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.040708][ T6158] ? clear_bhb_loop+0x70/0xc0 [ 154.040735][ T6158] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.040759][ T6158] RIP: 0033:0x7f552d00e159 [ 154.040778][ T6158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 154.040797][ T6158] RSP: 002b:00007f552b266028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 154.040821][ T6158] RAX: ffffffffffffffda RBX: 00007f552d295fa0 RCX: 00007f552d00e159 [ 154.040837][ T6158] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 154.040853][ T6158] RBP: 00007f552d0a506b R08: 0000000000000000 R09: 0000000000000000 [ 154.040867][ T6158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 154.040880][ T6158] R13: 00007f552d296038 R14: 00007f552d295fa0 R15: 00007ffd68dd6608 [ 154.040913][ T6158] [ 154.198359][ T5316] usb 1-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 154.244951][ T5316] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 154.245014][ T5316] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.359803][ T37] audit: type=1326 audit(1790055240.293:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.359858][ T37] audit: type=1326 audit(1790055240.303:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.522371][ T37] audit: type=1326 audit(1790055240.463:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.522427][ T37] audit: type=1326 audit(1790055240.463:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.584028][ T37] audit: type=1326 audit(1790055240.523:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.584162][ T37] audit: type=1326 audit(1790055240.523:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.584268][ T37] audit: type=1326 audit(1790055240.523:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.604884][ T37] audit: type=1326 audit(1790055240.543:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.735260][ T37] audit: type=1326 audit(1790055240.553:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 154.735329][ T37] audit: type=1326 audit(1790055240.673:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6159 comm="syz.2.127" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f371c55e159 code=0x7ffc0000 [ 155.738298][ T68] IPVS: starting estimator thread 0... [ 156.139884][ T6175] IPVS: using max 9 ests per chain, 21600 per kthread [ 156.382823][ T6182] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 156.597191][ T5756] usb 1-1: USB disconnect, device number 3 [ 156.918402][ T5316] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 157.150130][ T5316] usb 3-1: unable to get BOS descriptor or descriptor too short [ 157.150907][ T5316] usb 3-1: not running at top speed; connect to a high speed hub [ 157.150946][ T5316] usb 3-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 157.152711][ T5316] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 157.152813][ T5316] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 157.156026][ T5316] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.156056][ T5316] usb 3-1: Product: syz [ 157.156066][ T5316] usb 3-1: Manufacturer: syz [ 157.156077][ T5316] usb 3-1: SerialNumber: syz [ 157.661941][ T6202] netlink: 'syz.0.138': attribute type 4 has an invalid length. [ 157.702015][ T5702] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 157.868566][ T6209] FAULT_INJECTION: forcing a failure. [ 157.868566][ T6209] name failslab, interval 1, probability 0, space 0, times 0 [ 157.868605][ T6209] CPU: 1 UID: 0 PID: 6209 Comm: syz.1.139 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 157.868633][ T6209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 157.868647][ T6209] Call Trace: [ 157.868656][ T6209] [ 157.868669][ T6209] dump_stack_lvl+0xe8/0x150 [ 157.868708][ T6209] should_fail_ex+0x46b/0x600 [ 157.868746][ T6209] should_failslab+0xa8/0x100 [ 157.868783][ T6209] ? do_getname+0x2e/0x250 [ 157.868816][ T6209] kmem_cache_alloc_noprof+0x9e/0x690 [ 157.868848][ T6209] ? do_getname+0x2e/0x250 [ 157.868890][ T6209] do_getname+0x2e/0x250 [ 157.868922][ T6209] ? getname_flags+0x11/0x20 [ 157.868959][ T6209] do_sys_openat2+0xcc/0x200 [ 157.869020][ T6209] ? __se_sys_futex+0x3a8/0x450 [ 157.869045][ T6209] ? __pfx_do_sys_openat2+0x10/0x10 [ 157.869086][ T6209] ? rcu_is_watching+0x16/0xb0 [ 157.869141][ T6209] __x64_sys_openat+0x138/0x170 [ 157.869179][ T6209] do_syscall_64+0x166/0x520 [ 157.869199][ T6209] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.869221][ T6209] ? clear_bhb_loop+0x70/0xc0 [ 157.869246][ T6209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.869268][ T6209] RIP: 0033:0x7f161ae9e159 [ 157.869288][ T6209] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.869315][ T6209] RSP: 002b:00007f16190f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 157.869337][ T6209] RAX: ffffffffffffffda RBX: 00007f161b125fa0 RCX: 00007f161ae9e159 [ 157.869353][ T6209] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 157.869368][ T6209] RBP: 00007f161af3506b R08: 0000000000000000 R09: 0000000000000000 [ 157.869381][ T6209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 157.869394][ T6209] R13: 00007f161b126038 R14: 00007f161b125fa0 R15: 00007ffd48d6b158 [ 157.869425][ T6209] [ 158.009291][ T5702] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 158.468908][ T6200] ceph: No mds server is up or the cluster is laggy [ 159.399801][ T5702] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 159.580069][ T6056] IPVS: starting estimator thread 0... [ 159.668311][ T6219] IPVS: using max 8 ests per chain, 19200 per kthread [ 160.243807][ T5316] usb 3-1: 1:1 : no or invalid class specific endpoint descriptor [ 160.243853][ T5316] usb 3-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 160.243875][ T5316] usb 3-1: found format II with max.bitrate = 512, frame size=4095 [ 160.244019][ T5316] usb 3-1: 1:1 : no or invalid class specific endpoint descriptor [ 160.244039][ T5316] usb 3-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 160.244060][ T5316] usb 3-1: found format II with max.bitrate = 512, frame size=4095 [ 160.366510][ T5316] usb 3-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 160.990742][ T6239] netlink: 'syz.0.150': attribute type 4 has an invalid length. [ 161.268316][ T6245] FAULT_INJECTION: forcing a failure. [ 161.268316][ T6245] name failslab, interval 1, probability 0, space 0, times 0 [ 161.268356][ T6245] CPU: 0 UID: 0 PID: 6245 Comm: syz.0.152 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 161.268384][ T6245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 161.268398][ T6245] Call Trace: [ 161.268407][ T6245] [ 161.268417][ T6245] dump_stack_lvl+0xe8/0x150 [ 161.268457][ T6245] should_fail_ex+0x46b/0x600 [ 161.268496][ T6245] should_failslab+0xa8/0x100 [ 161.268534][ T6245] ? do_getname+0x2e/0x250 [ 161.268570][ T6245] kmem_cache_alloc_noprof+0x9e/0x690 [ 161.268603][ T6245] ? do_getname+0x2e/0x250 [ 161.268646][ T6245] do_getname+0x2e/0x250 [ 161.268680][ T6245] ? getname_flags+0x11/0x20 [ 161.268717][ T6245] do_sys_openat2+0xcc/0x200 [ 161.268753][ T6245] ? __se_sys_futex+0x3a8/0x450 [ 161.268779][ T6245] ? __pfx_do_sys_openat2+0x10/0x10 [ 161.268824][ T6245] ? rcu_is_watching+0x16/0xb0 [ 161.268866][ T6245] __x64_sys_openat+0x138/0x170 [ 161.268908][ T6245] do_syscall_64+0x166/0x520 [ 161.268931][ T6245] ? trace_irq_disable+0x3b/0x140 [ 161.268962][ T6245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.268996][ T6245] ? clear_bhb_loop+0x70/0xc0 [ 161.269026][ T6245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.269050][ T6245] RIP: 0033:0x7f288279e159 [ 161.269086][ T6245] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.269106][ T6245] RSP: 002b:00007f28809f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 161.269130][ T6245] RAX: ffffffffffffffda RBX: 00007f2882a25fa0 RCX: 00007f288279e159 [ 161.269157][ T6245] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 161.269171][ T6245] RBP: 00007f288283506b R08: 0000000000000000 R09: 0000000000000000 [ 161.269184][ T6245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.269196][ T6245] R13: 00007f2882a26038 R14: 00007f2882a25fa0 R15: 00007ffce5d69bb8 [ 161.269226][ T6245] [ 161.394287][ T6241] IPVS: set_ctl: invalid protocol: 135 127.0.0.1:20003 [ 161.468308][ T6053] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 161.649391][ T6053] usb 5-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 0.00 [ 161.657658][ T6053] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.657714][ T6053] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 161.668287][ T6053] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 161.668318][ T6053] usb 5-1: Product: syz [ 161.668334][ T6053] usb 5-1: Manufacturer: syz [ 162.127895][ T5316] usb 3-1: USB disconnect, device number 5 [ 163.294763][ T10] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 163.576067][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 163.727389][ T9] usb 5-1: USB disconnect, device number 3 [ 164.011438][ T6255] ceph: No mds server is up or the cluster is laggy [ 164.216645][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 167.442145][ T6280] netlink: 'syz.2.162': attribute type 4 has an invalid length. [ 167.537971][ T5806] udevd[5806]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 169.390964][ T6300] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 173.990489][ T6336] process 'syz.0.177' launched '/dev/fd/9' with NULL argv: empty string added [ 175.729408][ T6353] netlink: 60 bytes leftover after parsing attributes in process `syz.0.183'. [ 175.804309][ T6363] netlink: 'syz.0.183': attribute type 183 has an invalid length. [ 175.804332][ T6363] netlink: 8 bytes leftover after parsing attributes in process `syz.0.183'. [ 180.568670][ T95] IPVS: starting estimator thread 0... [ 180.678415][ T6398] IPVS: using max 10 ests per chain, 24000 per kthread [ 181.636621][ T6419] netlink: 'syz.4.204': attribute type 10 has an invalid length. [ 181.724238][ T6419] syz_tun: entered promiscuous mode [ 181.904622][ T6419] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 182.107839][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 182.135053][ T10] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 182.443544][ T9] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 182.904286][ T6431] ceph: No mds server is up or the cluster is laggy [ 182.950013][ T10] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 183.782564][ T6460] netlink: 'syz.1.217': attribute type 10 has an invalid length. [ 183.834910][ T6460] syz_tun: entered promiscuous mode [ 184.857531][ T6460] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 185.046441][ T996] IPVS: starting estimator thread 0... [ 185.139001][ T6482] IPVS: using max 10 ests per chain, 24000 per kthread [ 188.489339][ T6479] 8021q: adding VLAN 0 to HW filter on device bond1 [ 188.547935][ T6480] macvtap1: entered allmulticast mode [ 188.653799][ T6483] bond1: (slave sit1): refused to change device type [ 188.931355][ T6506] FAULT_INJECTION: forcing a failure. [ 188.931355][ T6506] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 188.931408][ T6506] CPU: 1 UID: 0 PID: 6506 Comm: syz.3.230 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 188.931435][ T6506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 188.931448][ T6506] Call Trace: [ 188.931457][ T6506] [ 188.931466][ T6506] dump_stack_lvl+0xe8/0x150 [ 188.931506][ T6506] should_fail_ex+0x46b/0x600 [ 188.931542][ T6506] strncpy_from_user+0x36/0x2c0 [ 188.931574][ T6506] do_getname+0x77/0x250 [ 188.931612][ T6506] do_sys_openat2+0xcc/0x200 [ 188.931650][ T6506] ? __se_sys_futex+0x3a8/0x450 [ 188.931674][ T6506] ? __pfx_do_sys_openat2+0x10/0x10 [ 188.931715][ T6506] ? rcu_is_watching+0x16/0xb0 [ 188.931753][ T6506] __x64_sys_openat+0x138/0x170 [ 188.931793][ T6506] do_syscall_64+0x166/0x520 [ 188.931814][ T6506] ? trace_irq_disable+0x3b/0x140 [ 188.931843][ T6506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.931866][ T6506] ? clear_bhb_loop+0x70/0xc0 [ 188.931893][ T6506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 188.931916][ T6506] RIP: 0033:0x7f218ce2e159 [ 188.931937][ T6506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.931956][ T6506] RSP: 002b:00007f218b086028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 188.931980][ T6506] RAX: ffffffffffffffda RBX: 00007f218d0b5fa0 RCX: 00007f218ce2e159 [ 188.931997][ T6506] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 188.932031][ T6506] RBP: 00007f218cec506b R08: 0000000000000000 R09: 0000000000000000 [ 188.932046][ T6506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.932059][ T6506] R13: 00007f218d0b6038 R14: 00007f218d0b5fa0 R15: 00007fff307ef708 [ 188.932093][ T6506] [ 189.193472][ T6510] batman_adv: batadv0: Adding interface: syzkaller0 [ 189.193492][ T6510] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 189.193527][ T6510] batman_adv: batadv0: Interface activated: syzkaller0 [ 189.297395][ T6508] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 189.525507][ T6516] netlink: 'syz.0.234': attribute type 4 has an invalid length. [ 189.554318][ T6508] batman_adv: batadv0: Removing interface: syzkaller0 [ 191.264708][ T6537] netlink: 'syz.0.237': attribute type 10 has an invalid length. [ 192.998446][ T6550] FAULT_INJECTION: forcing a failure. [ 192.998446][ T6550] name fail_futex, interval 1, probability 0, space 0, times 0 [ 192.998487][ T6550] CPU: 0 UID: 0 PID: 6550 Comm: syz.4.241 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 192.998514][ T6550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 192.998528][ T6550] Call Trace: [ 192.998537][ T6550] [ 192.998547][ T6550] dump_stack_lvl+0xe8/0x150 [ 192.998586][ T6550] should_fail_ex+0x46b/0x600 [ 192.998616][ T6550] get_futex_key+0x1b4/0x1580 [ 192.998650][ T6550] ? __pfx_futex_wake_mark+0x10/0x10 [ 192.998681][ T6550] ? __pfx_get_futex_key+0x10/0x10 [ 192.998713][ T6550] ? lock_acquire+0x115/0x350 [ 192.998749][ T6550] futex_wake+0x119/0x600 [ 192.998773][ T6550] ? __fget_files+0x2a/0x420 [ 192.998801][ T6550] ? __pfx_futex_wake+0x10/0x10 [ 192.998836][ T6550] ? __sys_sendto+0x240/0x5d0 [ 192.998870][ T6550] do_futex+0x458/0x4e0 [ 192.998896][ T6550] ? __pfx_do_futex+0x10/0x10 [ 192.998926][ T6550] __se_sys_futex+0x3a8/0x450 [ 192.998954][ T6550] ? __pfx___se_sys_futex+0x10/0x10 [ 192.998975][ T6550] ? rcu_is_watching+0x16/0xb0 [ 192.999015][ T6550] ? __x64_sys_futex+0x21/0xf0 [ 192.999039][ T6550] do_syscall_64+0x166/0x520 [ 192.999060][ T6550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.999089][ T6550] ? clear_bhb_loop+0x70/0xc0 [ 192.999117][ T6550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.999139][ T6550] RIP: 0033:0x7f552d00e159 [ 192.999183][ T6550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.999201][ T6550] RSP: 002b:00007f552b2660e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 192.999224][ T6550] RAX: ffffffffffffffda RBX: 00007f552d295fa8 RCX: 00007f552d00e159 [ 192.999241][ T6550] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f552d295fac [ 192.999255][ T6550] RBP: 00007f552d295fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 192.999270][ T6550] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 192.999284][ T6550] R13: 00007f552d296038 R14: 00007ffd68dd6520 R15: 00007ffd68dd6608 [ 192.999315][ T6550] [ 193.620898][ T6558] FAULT_INJECTION: forcing a failure. [ 193.620898][ T6558] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 193.620936][ T6558] CPU: 1 UID: 0 PID: 6558 Comm: syz.1.243 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 193.620960][ T6558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 193.620973][ T6558] Call Trace: [ 193.620981][ T6558] [ 193.620990][ T6558] dump_stack_lvl+0xe8/0x150 [ 193.621031][ T6558] should_fail_ex+0x46b/0x600 [ 193.621066][ T6558] strncpy_from_user+0x36/0x2c0 [ 193.621096][ T6558] do_getname+0x77/0x250 [ 193.621132][ T6558] do_sys_openat2+0xcc/0x200 [ 193.621164][ T6558] ? __se_sys_futex+0x3a8/0x450 [ 193.621278][ T6558] ? __pfx_do_sys_openat2+0x10/0x10 [ 193.621319][ T6558] ? rcu_is_watching+0x16/0xb0 [ 193.621356][ T6558] __x64_sys_openat+0x138/0x170 [ 193.621392][ T6558] do_syscall_64+0x166/0x520 [ 193.621412][ T6558] ? trace_irq_disable+0x3b/0x140 [ 193.621438][ T6558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.621459][ T6558] ? clear_bhb_loop+0x70/0xc0 [ 193.621485][ T6558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.621506][ T6558] RIP: 0033:0x7f161ae9e159 [ 193.621526][ T6558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.621554][ T6558] RSP: 002b:00007f16190f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 193.621577][ T6558] RAX: ffffffffffffffda RBX: 00007f161b125fa0 RCX: 00007f161ae9e159 [ 193.621593][ T6558] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 193.621608][ T6558] RBP: 00007f161af3506b R08: 0000000000000000 R09: 0000000000000000 [ 193.621622][ T6558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 193.621635][ T6558] R13: 00007f161b126038 R14: 00007f161b125fa0 R15: 00007ffd48d6b158 [ 193.621667][ T6558] [ 194.401414][ T6569] netlink: 'syz.1.247': attribute type 4 has an invalid length. [ 194.419033][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.419105][ T1332] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.010986][ T6588] FAULT_INJECTION: forcing a failure. [ 196.010986][ T6588] name failslab, interval 1, probability 0, space 0, times 0 [ 196.011020][ T6588] CPU: 0 UID: 0 PID: 6588 Comm: syz.2.257 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 196.011038][ T6588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 196.011048][ T6588] Call Trace: [ 196.011054][ T6588] [ 196.011061][ T6588] dump_stack_lvl+0xe8/0x150 [ 196.011088][ T6588] should_fail_ex+0x46b/0x600 [ 196.011113][ T6588] should_failslab+0xa8/0x100 [ 196.011137][ T6588] ? do_getname+0x2e/0x250 [ 196.011161][ T6588] kmem_cache_alloc_noprof+0x9e/0x690 [ 196.011182][ T6588] ? do_getname+0x2e/0x250 [ 196.011210][ T6588] do_getname+0x2e/0x250 [ 196.011232][ T6588] ? getname_flags+0x11/0x20 [ 196.011257][ T6588] do_sys_openat2+0xcc/0x200 [ 196.011280][ T6588] ? __se_sys_futex+0x3a8/0x450 [ 196.011296][ T6588] ? __pfx_do_sys_openat2+0x10/0x10 [ 196.011324][ T6588] ? rcu_is_watching+0x16/0xb0 [ 196.011351][ T6588] __x64_sys_openat+0x138/0x170 [ 196.011379][ T6588] do_syscall_64+0x166/0x520 [ 196.011393][ T6588] ? trace_irq_disable+0x3b/0x140 [ 196.011413][ T6588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.011429][ T6588] ? clear_bhb_loop+0x70/0xc0 [ 196.011466][ T6588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 196.011482][ T6588] RIP: 0033:0x7f371c55e159 [ 196.011497][ T6588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 196.011510][ T6588] RSP: 002b:00007f371a7b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 196.011530][ T6588] RAX: ffffffffffffffda RBX: 00007f371c7e5fa0 RCX: 00007f371c55e159 [ 196.011543][ T6588] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 196.011554][ T6588] RBP: 00007f371c5f506b R08: 0000000000000000 R09: 0000000000000000 [ 196.011564][ T6588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 196.011574][ T6588] R13: 00007f371c7e6038 R14: 00007f371c7e5fa0 R15: 00007ffcb671a258 [ 196.011598][ T6588] [ 196.267042][ T6592] overlayfs: overlapping lowerdir path [ 199.052672][ T6596] netlink: 'syz.3.258': attribute type 10 has an invalid length. [ 199.109984][ T6605] netlink: 'syz.4.262': attribute type 4 has an invalid length. [ 199.265064][ T6596] syz_tun: entered promiscuous mode [ 201.221271][ T6596] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 201.785463][ T6630] FAULT_INJECTION: forcing a failure. [ 201.785463][ T6630] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.785501][ T6630] CPU: 0 UID: 0 PID: 6630 Comm: syz.3.271 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 201.785524][ T6630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 201.785536][ T6630] Call Trace: [ 201.785545][ T6630] [ 201.785554][ T6630] dump_stack_lvl+0xe8/0x150 [ 201.785601][ T6630] should_fail_ex+0x46b/0x600 [ 201.785635][ T6630] strncpy_from_user+0x36/0x2c0 [ 201.785665][ T6630] do_getname+0x77/0x250 [ 201.785702][ T6630] do_sys_openat2+0xcc/0x200 [ 201.785734][ T6630] ? __se_sys_futex+0x3a8/0x450 [ 201.785757][ T6630] ? __pfx_do_sys_openat2+0x10/0x10 [ 201.785796][ T6630] ? rcu_is_watching+0x16/0xb0 [ 201.785832][ T6630] __x64_sys_openat+0x138/0x170 [ 201.785870][ T6630] do_syscall_64+0x166/0x520 [ 201.785889][ T6630] ? trace_irq_disable+0x3b/0x140 [ 201.785916][ T6630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.785938][ T6630] ? clear_bhb_loop+0x70/0xc0 [ 201.785964][ T6630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 201.785985][ T6630] RIP: 0033:0x7f218ce2e159 [ 201.786004][ T6630] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 201.786026][ T6630] RSP: 002b:00007f218b086028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 201.786048][ T6630] RAX: ffffffffffffffda RBX: 00007f218d0b5fa0 RCX: 00007f218ce2e159 [ 201.786064][ T6630] RDX: 0000000000088a01 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 201.786078][ T6630] RBP: 00007f218cec506b R08: 0000000000000000 R09: 0000000000000000 [ 201.786091][ T6630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.786104][ T6630] R13: 00007f218d0b6038 R14: 00007f218d0b5fa0 R15: 00007fff307ef708 [ 201.786135][ T6630] [ 205.699195][ T6657] netlink: 'syz.3.281': attribute type 10 has an invalid length. [ 207.259926][ T6679] netlink: 'syz.1.276': attribute type 4 has an invalid length. [ 211.297892][ T6713] netlink: 'syz.0.297': attribute type 10 has an invalid length. [ 211.765869][ T6728] netlink: 8 bytes leftover after parsing attributes in process `syz.2.298'. [ 211.765893][ T6728] tipc: Started in network mode [ 211.765917][ T6728] tipc: Node identity 805e0004, cluster identity 4711 [ 211.765929][ T6728] tipc: Node number set to 2153644036 [ 212.143441][ T6737] netlink: 128 bytes leftover after parsing attributes in process `syz.4.301'. [ 216.555251][ T6772] netlink: 128 bytes leftover after parsing attributes in process `syz.0.314'. [ 218.544607][ T6774] netlink: 'syz.4.313': attribute type 10 has an invalid length. [ 219.497227][ T6790] veth0_to_bridge: entered promiscuous mode [ 219.546615][ T6790] vlan2: entered promiscuous mode [ 221.543014][ T6814] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 221.543047][ T6814] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 221.723121][ T6814] vhci_hcd vhci_hcd.0: Device attached [ 222.088063][ T6795] Bluetooth: hci1: command 0x0406 tx timeout [ 222.088106][ T6795] Bluetooth: hci3: command 0x0406 tx timeout [ 222.109452][ T6795] Bluetooth: hci2: command 0x0406 tx timeout [ 222.109482][ T6795] Bluetooth: hci4: command 0x0406 tx timeout [ 222.109509][ T6795] Bluetooth: hci0: command 0x0406 tx timeout [ 222.316529][ T9] usb 36-1: SetAddress Request (2) to port 0 [ 222.392588][ T9] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 222.917340][ T6830] usb usb8: usbfs: process 6830 (syz.3.330) did not claim interface 0 before use [ 223.008436][ T6831] netlink: 'syz.2.329': attribute type 10 has an invalid length. [ 223.098287][ T6831] syz_tun: entered promiscuous mode [ 223.170040][ T6831] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 224.898681][ T6816] vhci_hcd: connection reset by peer [ 224.959127][ T44] vhci_hcd vhci_hcd.1: stop threads [ 224.981306][ T44] vhci_hcd vhci_hcd.1: release socket [ 225.017712][ T44] vhci_hcd vhci_hcd.1: disconnect device [ 226.445652][ T6882] netlink: 'syz.0.345': attribute type 10 has an invalid length. [ 227.599228][ T9] usb 36-1: device descriptor read/8, error -110 [ 227.602724][ T37] kauditd_printk_skb: 25 callbacks suppressed [ 227.602737][ T37] audit: type=1326 audit(1790055313.543:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6875 comm="syz.4.341" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f552d00e159 code=0x0 [ 228.287451][ T9] usb usb36-port1: attempt power cycle [ 228.891161][ T9] usb usb36-port1: unable to enumerate USB device [ 230.179952][ T6937] netlink: 'syz.0.362': attribute type 10 has an invalid length. [ 233.498491][ T5316] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 233.651782][ T5316] usb 4-1: Using ep0 maxpacket: 32 [ 233.654056][ T5316] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 233.656976][ T5316] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 233.656994][ T5316] usb 4-1: config 0 has no interfaces? [ 233.709463][ T5316] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.709484][ T5316] usb 4-1: Product: syz [ 233.709494][ T5316] usb 4-1: Manufacturer: syz [ 233.709505][ T5316] usb 4-1: SerialNumber: syz [ 233.755789][ T5316] usb 4-1: config 0 descriptor?? [ 233.788375][ T5694] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 233.935016][ T6984] netlink: 'syz.0.382': attribute type 10 has an invalid length. [ 233.941427][ T5694] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 233.953062][ T5694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.996347][ T5694] usb 2-1: config 0 descriptor?? [ 234.161676][ T6990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.215259][ T6990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.480137][ T5694] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 235.190430][ T5735] usb 4-1: USB disconnect, device number 3 [ 235.680893][ T5694] [drm:udl_init] *ERROR* Selecting channel failed [ 236.239256][ T6053] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 236.419210][ T6053] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 236.422230][ T6053] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 236.422266][ T6053] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 236.422306][ T6053] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.570988][ T7003] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 236.626736][ T5694] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 1 [ 236.626763][ T5694] [drm] Initialized udl on minor 1 [ 236.717370][ T6053] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 237.128054][ T5694] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 237.393841][ T5694] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 239.401344][ T5694] usb 2-1: USB disconnect, device number 5 [ 239.894231][ T6053] usb 3-1: USB disconnect, device number 6 [ 240.373705][ T7029] netlink: 'syz.2.393': attribute type 10 has an invalid length. [ 242.062946][ T7042] input: syz1 as /devices/virtual/input/input6 [ 242.957508][ T7053] batman_adv: batadv0: Adding interface: syzkaller0 [ 242.957531][ T7053] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 242.998259][ T7053] batman_adv: batadv0: Interface activated: syzkaller0 [ 243.609993][ T7051] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 243.845848][ T68] IPVS: starting estimator thread 0... [ 243.928372][ T7068] IPVS: using max 12 ests per chain, 28800 per kthread [ 244.794510][ T7051] batman_adv: batadv0: Removing interface: syzkaller0 [ 244.968281][ T5845] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 245.120640][ T5845] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 245.121600][ T5845] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 245.124106][ T5845] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.124121][ T5845] usb 2-1: Product: syz [ 245.124130][ T5845] usb 2-1: Manufacturer: syz [ 245.124139][ T5845] usb 2-1: SerialNumber: syz [ 245.283503][ T5845] usb 2-1: 1:1 : unsupported format bits 0x20000 [ 246.986573][ T5845] usb 2-1: 2:1 : no or invalid class specific endpoint descriptor [ 246.986603][ T5845] usb 2-1: 2:1 : unsupported format bits 0x20000 [ 247.436100][ T5845] usb 2-1: USB disconnect, device number 6 [ 247.594835][ T5933] udevd[5933]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 248.904963][ T7097] netlink: 60 bytes leftover after parsing attributes in process `syz.3.414'. [ 248.988634][ T7109] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 249.860611][ T7125] netlink: 'syz.0.424': attribute type 2 has an invalid length. [ 249.860635][ T7125] netlink: 40 bytes leftover after parsing attributes in process `syz.0.424'. [ 249.997518][ T7131] netlink: 'syz.0.424': attribute type 2 has an invalid length. [ 249.997540][ T7131] netlink: 40 bytes leftover after parsing attributes in process `syz.0.424'. [ 250.737348][ T7125] : entered promiscuous mode [ 252.431736][ T37] audit: type=1326 audit(1790055338.373:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.431775][ T37] audit: type=1326 audit(1790055338.373:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.435460][ T37] audit: type=1326 audit(1790055338.373:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.435496][ T37] audit: type=1326 audit(1790055338.373:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.440622][ T37] audit: type=1326 audit(1790055338.383:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.440754][ T37] audit: type=1326 audit(1790055338.383:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.447018][ T37] audit: type=1326 audit(1790055338.383:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=446 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.447165][ T37] audit: type=1326 audit(1790055338.383:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.449992][ T37] audit: type=1326 audit(1790055338.383:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7159 comm="syz.1.436" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f161ae9e159 code=0x7ffc0000 [ 252.697704][ T7146] [ 252.700078][ T7146] ====================================================== [ 252.707121][ T7146] WARNING: possible circular locking dependency detected [ 252.714151][ T7146] syzkaller #0 Tainted: G L [ 252.720150][ T7146] ------------------------------------------------------ [ 252.727163][ T7146] syz.4.432/7146 is trying to acquire lock: [ 252.733050][ T7146] ffff88803d900cf0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0x101/0xd70 [ 252.744551][ T7146] [ 252.744551][ T7146] but task is already holding lock: [ 252.751913][ T7146] ffff88803d9021d8 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x22f/0x580 [ 252.760888][ T7146] [ 252.760888][ T7146] which lock already depends on the new lock. [ 252.760888][ T7146] [ 252.771284][ T7146] [ 252.771284][ T7146] the existing dependency chain (in reverse order) is: [ 252.780315][ T7146] [ 252.780315][ T7146] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 252.788072][ T7146] lock_sock_nested+0x41/0x130 [ 252.793405][ T7146] smc_listen_out+0xd4/0x3d0 [ 252.798526][ T7146] smc_listen_work+0x81d/0x1410 [ 252.803933][ T7146] process_scheduled_works+0xc3d/0x1630 [ 252.810016][ T7146] worker_thread+0xa47/0xfb0 [ 252.815133][ T7146] kthread+0x38b/0x470 [ 252.819718][ T7146] ret_from_fork+0x514/0xb70 [ 252.824824][ T7146] ret_from_fork_asm+0x1a/0x30 [ 252.830108][ T7146] [ 252.830108][ T7146] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 252.840277][ T7146] __lock_acquire+0x164c/0x2de0 [ 252.845676][ T7146] lock_acquire+0x115/0x350 [ 252.850710][ T7146] __flush_work+0x6c5/0xd70 [ 252.855839][ T7146] __cancel_work_sync+0xbf/0x110 [ 252.861304][ T7146] smc_clcsock_release+0x60/0xf0 [ 252.866776][ T7146] __smc_release+0x662/0x7d0 [ 252.871887][ T7146] smc_close_non_accepted+0xd5/0x1f0 [ 252.877693][ T7146] smc_close_active+0xb59/0xf50 [ 252.883066][ T7146] __smc_release+0x9e/0x7d0 [ 252.888109][ T7146] smc_release+0x2cd/0x580 [ 252.893078][ T7146] __sock_release+0xa0/0x1f0 [ 252.898188][ T7146] sock_close+0x1c/0x30 [ 252.902877][ T7146] __fput+0x42a/0xa80 [ 252.907377][ T7146] task_work_run+0x1d9/0x270 [ 252.912490][ T7146] exit_to_user_mode_loop+0x204/0x770 [ 252.918388][ T7146] do_syscall_64+0x328/0x520 [ 252.923495][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.929902][ T7146] [ 252.929902][ T7146] other info that might help us debug this: [ 252.929902][ T7146] [ 252.940121][ T7146] Possible unsafe locking scenario: [ 252.940121][ T7146] [ 252.947563][ T7146] CPU0 CPU1 [ 252.952921][ T7146] ---- ---- [ 252.958286][ T7146] lock(sk_lock-AF_SMC/1); [ 252.962819][ T7146] lock((work_completion)(&new_smc->smc_listen_work)); [ 252.972267][ T7146] lock(sk_lock-AF_SMC/1); [ 252.979298][ T7146] lock((work_completion)(&new_smc->smc_listen_work)); [ 252.986251][ T7146] [ 252.986251][ T7146] *** DEADLOCK *** [ 252.986251][ T7146] [ 252.994389][ T7146] locks held by syz.4.432/7146: 3, last CPU#1: [ 253.000532][ T7146] #0: ffff88803b940978 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 253.011069][ T7146] #1: ffff88803d9021d8 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x22f/0x580 [ 253.020560][ T7146] #2: ffffffff8e1c3cc0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x101/0xd70 [ 253.029787][ T7146] [ 253.029787][ T7146] stack backtrace: [ 253.035669][ T7146] CPU: 1 UID: 0 PID: 7146 Comm: syz.4.432 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 253.046949][ T7146] Tainted: [L]=SOFTLOCKUP [ 253.051266][ T7146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.061328][ T7146] Call Trace: [ 253.064605][ T7146] [ 253.067530][ T7146] dump_stack_lvl+0xe8/0x150 [ 253.072129][ T7146] print_circular_bug+0x2e2/0x300 [ 253.077167][ T7146] check_noncircular+0x12f/0x150 [ 253.082118][ T7146] __lock_acquire+0x164c/0x2de0 [ 253.086979][ T7146] ? do_raw_spin_unlock+0xf5/0x200 [ 253.092085][ T7146] lock_acquire+0x115/0x350 [ 253.096598][ T7146] ? __flush_work+0x101/0xd70 [ 253.101292][ T7146] ? __flush_work+0x101/0xd70 [ 253.106000][ T7146] __flush_work+0x6c5/0xd70 [ 253.110594][ T7146] ? __flush_work+0x101/0xd70 [ 253.115288][ T7146] ? __flush_work+0x101/0xd70 [ 253.119965][ T7146] ? __pfx___flush_work+0x10/0x10 [ 253.125007][ T7146] ? __pfx_wq_barrier_func+0x10/0x10 [ 253.130320][ T7146] ? __cancel_work_sync+0x5c/0x110 [ 253.135445][ T7146] __cancel_work_sync+0xbf/0x110 [ 253.140402][ T7146] smc_clcsock_release+0x60/0xf0 [ 253.145354][ T7146] __smc_release+0x662/0x7d0 [ 253.149950][ T7146] smc_close_non_accepted+0xd5/0x1f0 [ 253.155255][ T7146] smc_close_active+0xb59/0xf50 [ 253.160290][ T7146] ? __pfx_sock_def_readable+0x10/0x10 [ 253.165750][ T7146] ? smc_close_active+0x3ed/0xf50 [ 253.170772][ T7146] __smc_release+0x9e/0x7d0 [ 253.175287][ T7146] ? lockdep_hardirqs_on+0x7b/0x110 [ 253.180496][ T7146] smc_release+0x2cd/0x580 [ 253.185009][ T7146] __sock_release+0xa0/0x1f0 [ 253.189617][ T7146] ? __pfx_sock_close+0x10/0x10 [ 253.194488][ T7146] sock_close+0x1c/0x30 [ 253.198646][ T7146] __fput+0x42a/0xa80 [ 253.202633][ T7146] task_work_run+0x1d9/0x270 [ 253.207221][ T7146] ? __pfx_task_work_run+0x10/0x10 [ 253.212334][ T7146] exit_to_user_mode_loop+0x204/0x770 [ 253.217719][ T7146] ? rcu_is_watching+0x16/0xb0 [ 253.222486][ T7146] do_syscall_64+0x328/0x520 [ 253.227087][ T7146] ? trace_irq_disable+0x3b/0x140 [ 253.232130][ T7146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.238205][ T7146] ? clear_bhb_loop+0x70/0xc0 [ 253.242882][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.248791][ T7146] RIP: 0033:0x7f552d00e159 [ 253.253206][ T7146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.272811][ T7146] RSP: 002b:00007ffd68dd6768 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 253.281222][ T7146] RAX: 0000000000000000 RBX: 00007f552d297da0 RCX: 00007f552d00e159 [ 253.289227][ T7146] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 253.297207][ T7146] RBP: 00007f552d297da0 R08: 00007f552d296038 R09: 0000000000000000 [ 253.305184][ T7146] R10: 00000000003fc988 R11: 0000000000000246 R12: 000000000003d6b8 [ 253.313151][ T7146] R13: 00007f552d295fac R14: 000000000003d3eb R15: 00007ffd68dd6870 [ 253.321126][ T7146] [ 253.327198][ T7142] nvme nvme0: failed to connect socket: -512 [ 255.839305][ T1332] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.839355][ T1332] ieee802154 phy1 wpan1: encryption failed: -22