last executing test programs: 1.079041755s ago: executing program 3 (id=4): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000140)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x17, 0x5, 0x57e, 0x306, 0x0, 0x0, "05010905a10105091901290815002501950875018102c0"}}, 0x12f) 601.373491ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000700)='rd_pages=1024\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000900)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/target/usb_gadget/naa.1234567890\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000500)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/target/usb_gadget/naa.1234567890/tpgt_1/lun/lun_0/virtual_device\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./config/target/usb_gadget/naa.1234567890/tpgt_1/nexus\x00', 0x2, 0x0) write(r2, &(0x7f0000001800)='naa.1234567890\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000001900)='./config/target/usb_gadget/naa.1234567890/tpgt_1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000001a00)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000001b00)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000001c00)='dummy_udc.0\x00', 0xb) 317.753077ms ago: executing program 2 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./nfsd\x00', &(0x7f0000000b00)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./rpc_pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./rpc_pipefs\x00', &(0x7f0000000400)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000d00)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000f00)='tcp 2049\n', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd/threads\x00', 0x2, 0x0) r4 = syz_io_uring_setup(0x10, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x10, 0x0, @fd=r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000110)='8\n', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r4, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000500)={0x2}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipefs/nfsd/cld\x00', 0x2, 0x0) read(r8, &(0x7f0000001000)=""/1034, 0x40a) write(r8, &(0x7f0000001000)='\x00'/1034, 0x40a) nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt\x00', 0x1ff) mount(&(0x7f0000000700)=@filename='127.0.0.1:/\x00', &(0x7f0000000600)='./mnt\x00', &(0x7f0000000800)='nfs4\x00', 0x0, &(0x7f0000000900)='clientaddr=127.0.0.1,addr=127.0.0.1\x00') (async) nanosleep(&(0x7f0000000500)={0x1}, 0x0) 0s ago: executing program 1 (id=2): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000003140500000000000000000009000200727865300000000008004100727865000a0033007665746830000000"], 0x30}}, 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000500)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000600)={0x7, 0x8, 0xfa00, {r2, 0x1}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000800)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000900)={0x15, 0x110, 0xfa00, {r3, 0x3e8, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}}}, 0x118) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000a00)={0xc, 0x8, 0xfa00, {&(0x7f0000000b00)}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000c00)={0x4, 0x8, 0xfa00, {r3, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000d00)={0xc, 0x8, 0xfa00, {&(0x7f0000000e00)}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000f00)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x1, 0x1, 0x0, 0x7, 0x7, 0x1}, r3}}, 0x120) nanosleep(&(0x7f0000001000)={0x5}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.126' (ED25519) to the list of known hosts. [ 80.337685][ T5597] cgroup: Unknown subsys name 'net' [ 80.447224][ T5597] cgroup: Unknown subsys name 'cpuset' [ 80.455913][ T5597] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.034741][ T5597] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.067837][ T976] cfg80211: failed to load regulatory.db [ 86.943552][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.952229][ T5617] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.963046][ T5617] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.971182][ T5617] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.980320][ T5617] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.136384][ T5617] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.145844][ T5617] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.154425][ T5617] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.180006][ T5626] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.181865][ T5626] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.182537][ T5626] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.183885][ T5626] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.186005][ T4925] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.186448][ T4925] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.187550][ T4925] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.188741][ T4925] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.189411][ T4925] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.211075][ T5629] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.227131][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.243487][ T5631] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.246696][ T5631] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 87.253777][ T5631] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 87.259639][ T5631] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 87.288640][ T5617] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 87.303038][ T5617] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 87.348771][ T5617] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 87.357219][ T5617] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 87.357830][ T5617] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 87.375170][ T5617] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 87.383250][ T5617] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 89.024225][ T5617] Bluetooth: hci0: command tx timeout [ 89.262899][ T5629] Bluetooth: hci1: command tx timeout [ 89.268805][ T5617] Bluetooth: hci3: command tx timeout [ 89.353126][ T5629] Bluetooth: hci2: command tx timeout [ 89.358875][ T5617] Bluetooth: hci4: command tx timeout [ 89.423088][ T5617] Bluetooth: hci5: command tx timeout [ 89.613504][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.613704][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.613863][ T5616] bridge_slave_0: entered allmulticast mode [ 89.617363][ T5616] bridge_slave_0: entered promiscuous mode [ 89.690608][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.690756][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.690897][ T5616] bridge_slave_1: entered allmulticast mode [ 89.693057][ T5616] bridge_slave_1: entered promiscuous mode [ 89.712277][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.712390][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.712524][ T5624] bridge_slave_0: entered allmulticast mode [ 89.715241][ T5624] bridge_slave_0: entered promiscuous mode [ 89.789853][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.790068][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.790206][ T5624] bridge_slave_1: entered allmulticast mode [ 89.792204][ T5624] bridge_slave_1: entered promiscuous mode [ 89.819390][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.819594][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.820034][ T5625] bridge_slave_0: entered allmulticast mode [ 89.822048][ T5625] bridge_slave_0: entered promiscuous mode [ 89.880841][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.891237][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.891403][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.891555][ T5625] bridge_slave_1: entered allmulticast mode [ 89.893683][ T5625] bridge_slave_1: entered promiscuous mode [ 89.928680][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.932946][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.958414][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.958548][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.959044][ T5628] bridge_slave_0: entered allmulticast mode [ 89.961163][ T5628] bridge_slave_0: entered promiscuous mode [ 89.984643][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.024197][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.024328][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.024484][ T5628] bridge_slave_1: entered allmulticast mode [ 90.027114][ T5628] bridge_slave_1: entered promiscuous mode [ 90.029332][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.029441][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.029579][ T5635] bridge_slave_0: entered allmulticast mode [ 90.032271][ T5635] bridge_slave_0: entered promiscuous mode [ 90.097303][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.112321][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.112535][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.113024][ T5635] bridge_slave_1: entered allmulticast mode [ 90.115108][ T5635] bridge_slave_1: entered promiscuous mode [ 90.120506][ T5624] team0: Port device team_slave_0 added [ 90.124534][ T5624] team0: Port device team_slave_1 added [ 90.128415][ T5616] team0: Port device team_slave_0 added [ 90.128622][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.128731][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.128871][ T5621] bridge_slave_0: entered allmulticast mode [ 90.131867][ T5621] bridge_slave_0: entered promiscuous mode [ 90.135986][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.136095][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.136576][ T5621] bridge_slave_1: entered allmulticast mode [ 90.138642][ T5621] bridge_slave_1: entered promiscuous mode [ 90.143538][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.220219][ T5616] team0: Port device team_slave_1 added [ 90.248964][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.303960][ T5625] team0: Port device team_slave_0 added [ 90.308834][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.312402][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.316043][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.316060][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.316090][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.338727][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.341995][ T5625] team0: Port device team_slave_1 added [ 90.361268][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.362014][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.362036][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.362067][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.379640][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.379659][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.379688][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.387589][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.470559][ T5635] team0: Port device team_slave_0 added [ 90.471684][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.471700][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.471731][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.539707][ T5628] team0: Port device team_slave_0 added [ 90.548172][ T5635] team0: Port device team_slave_1 added [ 90.554233][ T5621] team0: Port device team_slave_0 added [ 90.571385][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.571416][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.572039][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.576458][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.576474][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.576503][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.580078][ T5628] team0: Port device team_slave_1 added [ 90.673483][ T5621] team0: Port device team_slave_1 added [ 90.727416][ T5624] hsr_slave_0: entered promiscuous mode [ 90.728706][ T5624] hsr_slave_1: entered promiscuous mode [ 90.730705][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.730721][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.730751][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.759131][ T5616] hsr_slave_0: entered promiscuous mode [ 90.760303][ T5616] hsr_slave_1: entered promiscuous mode [ 90.761153][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 90.761242][ T5616] Cannot create hsr debugfs directory [ 90.784775][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.784797][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.784829][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.790004][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.790021][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.790051][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.792024][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.792040][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.792070][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.800351][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.800370][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.800400][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.867525][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.867547][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.867579][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.995346][ T5625] hsr_slave_0: entered promiscuous mode [ 91.003786][ T5625] hsr_slave_1: entered promiscuous mode [ 91.004685][ T5625] debugfs: 'hsr0' already exists in 'hsr' [ 91.004707][ T5625] Cannot create hsr debugfs directory [ 91.102899][ T5617] Bluetooth: hci0: command tx timeout [ 91.122425][ T5635] hsr_slave_0: entered promiscuous mode [ 91.123816][ T5635] hsr_slave_1: entered promiscuous mode [ 91.124727][ T5635] debugfs: 'hsr0' already exists in 'hsr' [ 91.124749][ T5635] Cannot create hsr debugfs directory [ 91.202028][ T5621] hsr_slave_0: entered promiscuous mode [ 91.203456][ T5621] hsr_slave_1: entered promiscuous mode [ 91.204331][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 91.204351][ T5621] Cannot create hsr debugfs directory [ 91.243354][ T5628] hsr_slave_0: entered promiscuous mode [ 91.244449][ T5628] hsr_slave_1: entered promiscuous mode [ 91.245359][ T5628] debugfs: 'hsr0' already exists in 'hsr' [ 91.245381][ T5628] Cannot create hsr debugfs directory [ 91.343144][ T5629] Bluetooth: hci1: command tx timeout [ 91.343259][ T5617] Bluetooth: hci3: command tx timeout [ 91.424215][ T5629] Bluetooth: hci2: command tx timeout [ 91.424501][ T5617] Bluetooth: hci4: command tx timeout [ 91.502865][ T5617] Bluetooth: hci5: command tx timeout [ 91.897969][ T5624] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.912469][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 91.917121][ T5624] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 91.929352][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 91.931469][ T5624] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 91.941243][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 91.942466][ T5624] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.947878][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.029745][ T5628] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.040978][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.049900][ T5628] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.061083][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.063439][ T5628] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.072020][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.091824][ T5628] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 92.104443][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.185684][ T5616] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.196563][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.198869][ T5616] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.207110][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.208457][ T5616] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.215918][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.233293][ T5616] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.244292][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.351792][ T5625] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 92.363718][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.367404][ T5625] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 92.375380][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.388985][ T5625] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 92.399436][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.422231][ T5625] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 92.434440][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.469367][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.527412][ T5635] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.538311][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.539282][ T5635] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.549538][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.577457][ T5635] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.588479][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.611686][ T5635] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.621700][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.640002][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.709605][ T991] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.710039][ T991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.745780][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.754776][ T5621] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.767086][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 92.768038][ T5621] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.777307][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 92.796671][ T5621] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.807100][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 92.819366][ T995] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.819496][ T995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.840882][ T5621] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.850736][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 92.938171][ T5628] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.987346][ T991] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.987474][ T991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.017203][ T991] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.017338][ T991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.047250][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.171484][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.184314][ T5617] Bluetooth: hci0: command tx timeout [ 93.189331][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.237570][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.237701][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.276560][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.306911][ T5625] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.318593][ T991] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.318780][ T991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.353357][ T991] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.353489][ T991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.369697][ T991] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.369823][ T991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.391804][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.433222][ T5629] Bluetooth: hci1: command tx timeout [ 93.433341][ T5617] Bluetooth: hci3: command tx timeout [ 93.452599][ T991] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.452833][ T991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.497169][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.506143][ T991] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.506278][ T991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.515194][ T5629] Bluetooth: hci2: command tx timeout [ 93.515284][ T5617] Bluetooth: hci4: command tx timeout [ 93.576327][ T5616] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 93.597006][ T5617] Bluetooth: hci5: command tx timeout [ 93.707084][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.755951][ T995] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.756090][ T995] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.813624][ T995] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.813759][ T995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.480438][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.751912][ T5624] veth0_vlan: entered promiscuous mode [ 94.812867][ T5624] veth1_vlan: entered promiscuous mode [ 94.831808][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.996197][ T5624] veth0_macvtap: entered promiscuous mode [ 95.060674][ T5624] veth1_macvtap: entered promiscuous mode [ 95.151183][ T5628] veth0_vlan: entered promiscuous mode [ 95.177899][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.219206][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.253926][ T5628] veth1_vlan: entered promiscuous mode [ 95.263244][ T5617] Bluetooth: hci0: command tx timeout [ 95.267826][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.334965][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.357040][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.357256][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.357305][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.357346][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.503688][ T5629] Bluetooth: hci1: command tx timeout [ 95.503867][ T5617] Bluetooth: hci3: command tx timeout [ 95.583078][ T5629] Bluetooth: hci2: command tx timeout [ 95.583156][ T5617] Bluetooth: hci4: command tx timeout [ 95.591351][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.612229][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.621756][ T5628] veth0_macvtap: entered promiscuous mode [ 95.656900][ T134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.656953][ T134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.673400][ T5617] Bluetooth: hci5: command tx timeout [ 95.689942][ T5616] veth0_vlan: entered promiscuous mode [ 95.698035][ T5628] veth1_macvtap: entered promiscuous mode [ 95.830972][ T5616] veth1_vlan: entered promiscuous mode [ 95.838975][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.846328][ T134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.846349][ T134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.885975][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.068317][ T5624] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 96.073068][ T5635] veth0_vlan: entered promiscuous mode [ 96.099357][ T343] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.099459][ T343] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.099529][ T343] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.163143][ T5616] veth0_macvtap: entered promiscuous mode [ 96.184604][ T5635] veth1_vlan: entered promiscuous mode [ 96.206860][ T5616] veth1_macvtap: entered promiscuous mode [ 96.310495][ T25] wiimote 0005:057E:0306.0001: hidraw0: BLUETOOTH HID v0.00 Gamepad [syz0] on syz0 [ 96.311682][ T25] wiimote 0005:057E:0306.0001: New device registered [ 96.325700][ T5841] wiimote 0005:057E:0306.0001: Device removed [ 96.356018][ T995] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.356373][ T995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.368113][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.413466][ T995] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.435425][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.445300][ T5635] veth0_macvtap: entered promiscuous mode [ 96.460133][ T5843] fido_id[5843]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 96.509725][ T5635] veth1_macvtap: entered promiscuous mode [ 96.514052][ T5625] veth0_vlan: entered promiscuous mode [ 96.529887][ T134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.538900][ T134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.567235][ T5625] veth1_vlan: entered promiscuous mode [ 96.618793][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.675661][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.732820][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.746569][ T5621] veth0_vlan: entered promiscuous mode [ 96.764049][ T995] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766007][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766056][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766100][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766143][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766186][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.766228][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.772993][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.773014][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.856645][ T5621] veth1_vlan: entered promiscuous mode [ 96.868057][ T31] audit: type=1800 audit(1788450387.395:2): pid=5846 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3" name="enable" dev="configfs" ino=8885 res=0 errno=0 [ 96.877952][ T5846] Config c/1 of g1 needs at least one function. [ 96.878172][ T5846] udc dummy_udc.0: failed to start g1: -22 [ 96.878197][ T5846] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 96.880678][ T5846] UDC core: g1: couldn't find an available UDC or it's busy [ 96.920225][ T31] audit: type=1800 audit(1788450387.395:3): pid=5846 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3" name="UDC" dev="configfs" ino=8900 res=0 errno=0 [ 96.937830][ T5625] veth0_macvtap: entered promiscuous mode [ 96.981772][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.981819][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.010654][ T5625] veth1_macvtap: entered promiscuous mode [ 97.118430][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.124187][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.203449][ T5621] veth0_macvtap: entered promiscuous mode [ 97.228215][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.243466][ T5621] veth1_macvtap: entered promiscuous mode [ 97.261902][ T995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.261947][ T995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.290788][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.337041][ T5849] ================================================================== [ 97.337066][ T5849] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x6a/0x130 [ 97.337101][ T5849] Read of size 8 at addr ffffc90004a37930 by task syz.2.7/5849 [ 97.337121][ T5849] [ 97.337133][ T5849] CPU: 1 UID: 0 PID: 5849 Comm: syz.2.7 Not tainted syzkaller #0 PREEMPT(full) [ 97.337160][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 97.337175][ T5849] Call Trace: [ 97.337185][ T5849] [ 97.337195][ T5849] dump_stack_lvl+0xe8/0x150 [ 97.337233][ T5849] print_address_description+0x55/0x1e0 [ 97.337268][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 97.337294][ T5849] print_report+0x58/0x70 [ 97.337326][ T5849] kasan_report+0x117/0x150 [ 97.337359][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 97.337392][ T5849] __list_add_valid_or_report+0x6a/0x130 [ 97.337421][ T5849] rpc_queue_upcall+0x86/0x320 [ 97.337462][ T5849] nfsd4_cld_tracking_init+0xd85/0x13a0 [ 97.337520][ T5849] ? __pfx_nfsd4_cld_tracking_init+0x10/0x10 [ 97.337560][ T5849] ? net_generic+0x1e/0x240 [ 97.337598][ T5849] ? net_generic+0x1e/0x240 [ 97.337631][ T5849] ? net_generic+0x1e/0x240 [ 97.337663][ T5849] ? net_generic+0x1e/0x240 [ 97.337697][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 97.337731][ T5849] nfsd4_client_tracking_init+0xca/0x1c0 [ 97.337769][ T5849] nfs4_state_start_net+0xc95/0x1180 [ 97.337804][ T5849] nfsd_svc+0x481/0x710 [ 97.337832][ T5849] write_threads+0x434/0x610 [ 97.337865][ T5849] ? __pfx_write_threads+0x10/0x10 [ 97.337900][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 97.337937][ T5849] ? _copy_from_user+0x94/0xb0 [ 97.337964][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 97.337994][ T5849] ? simple_transaction_get+0x12d/0x160 [ 97.338031][ T5849] nfsctl_transaction_write+0x10f/0x160 [ 97.338063][ T5849] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 97.338095][ T5849] vfs_write+0x296/0xba0 [ 97.338136][ T5849] ? __pfx_vfs_write+0x10/0x10 [ 97.338173][ T5849] ? __fget_files+0x2a/0x420 [ 97.338210][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 97.338240][ T5849] ? __fget_files+0x3a2/0x420 [ 97.338272][ T5849] ? __fget_files+0x2a/0x420 [ 97.338307][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 97.338340][ T5849] ksys_write+0x150/0x270 [ 97.338378][ T5849] ? __pfx_ksys_write+0x10/0x10 [ 97.338421][ T5849] do_syscall_64+0x166/0x520 [ 97.338459][ T5849] ? trace_irq_disable+0x3b/0x140 [ 97.338485][ T5849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.338520][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.338546][ T5849] RIP: 0033:0x7fa99159e159 [ 97.338568][ T5849] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.338589][ T5849] RSP: 002b:00007fa99252c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 97.338616][ T5849] RAX: ffffffffffffffda RBX: 00007fa991826090 RCX: 00007fa99159e159 [ 97.338636][ T5849] RDX: 0000000000000002 RSI: 0000200000000100 RDI: 0000000000000005 [ 97.338652][ T5849] RBP: 00007fa991635024 R08: 0000000000000000 R09: 0000000000000000 [ 97.338669][ T5849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.338685][ T5849] R13: 00007fa991826128 R14: 00007fa991826090 R15: 00007ffe62e24e68 [ 97.338714][ T5849] [ 97.338724][ T5849] [ 97.338730][ T5849] The buggy address belongs to stack of task syz.2.7/5849 [ 97.338744][ T5849] and is located at offset 112 in frame: [ 97.338755][ T5849] nfsd4_cld_tracking_init+0x0/0x13a0 [ 97.338790][ T5849] [ 97.338796][ T5849] This frame has 2 objects: [ 97.338809][ T5849] [32, 80) 'msg.i.i.i50' [ 97.338822][ T5849] [112, 160) 'msg.i.i.i' [ 97.338836][ T5849] [ 97.338843][ T5849] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90004a30000 allocated at copy_process+0x820/0x43e0 [ 97.338896][ T5849] The buggy address belongs to the physical page: [ 97.338907][ T5849] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x331c7 [ 97.338928][ T5849] memcg:ffff88802554e902 [ 97.338939][ T5849] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 97.338969][ T5849] raw: 00fff00000000000 0000000000000000 ffffea0000cc71c8 0000000000000000 [ 97.338991][ T5849] raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88802554e902 [ 97.339005][ T5849] page dumped because: kasan: bad access detected [ 97.339016][ T5849] page_owner tracks the page as allocated [ 97.339025][ T5849] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5847, tgid 5847 (syz.2.7), ts 97132089071 [ 97.339062][ T5849] post_alloc_hook+0x1f9/0x250 [ 97.339097][ T5849] get_page_from_freelist+0x2209/0x2280 [ 97.339120][ T5849] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 97.339144][ T5849] alloc_pages_mpol+0x21e/0x390 [ 97.339171][ T5849] alloc_pages_noprof+0xb1/0x2b0 [ 97.339199][ T5849] __vmalloc_node_range_noprof+0x6e5/0x1540 [ 97.339234][ T5849] __vmalloc_node_noprof+0xc2/0x100 [ 97.339266][ T5849] dup_task_struct+0x2c6/0xa00 [ 97.339297][ T5849] copy_process+0x820/0x43e0 [ 97.339326][ T5849] kernel_clone+0x2d7/0x940 [ 97.339357][ T5849] __se_sys_clone3+0x33c/0x360 [ 97.339390][ T5849] do_syscall_64+0x166/0x520 [ 97.339425][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.339448][ T5849] page last free pid 5621 tgid 5621 ts 97128856679 stack trace: [ 97.339465][ T5849] __free_frozen_pages+0xc93/0xd90 [ 97.339500][ T5849] __slab_free+0x274/0x2c0 [ 97.339526][ T5849] qlist_free_all+0x99/0x100 [ 97.339546][ T5849] kasan_quarantine_reduce+0x148/0x160 [ 97.339584][ T5849] __kasan_slab_alloc+0x22/0x80 [ 97.339608][ T5849] kmem_cache_alloc_node_noprof+0x354/0x610 [ 97.339643][ T5849] __alloc_skb+0x1db/0x7a0 [ 97.339679][ T5849] netlink_sendmsg+0x5d4/0xb40 [ 97.339708][ T5849] sock_sendmsg_nosec+0x13a/0x180 [ 97.339739][ T5849] __sys_sendto+0x408/0x5a0 [ 97.339776][ T5849] __x64_sys_sendto+0xde/0x100 [ 97.339796][ T5849] do_syscall_64+0x166/0x520 [ 97.339831][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.339856][ T5849] [ 97.339862][ T5849] Memory state around the buggy address: [ 97.339875][ T5849] ffffc90004a37800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.339893][ T5849] ffffc90004a37880: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 97.339910][ T5849] >ffffc90004a37900: 00 00 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 [ 97.339923][ T5849] ^ [ 97.339936][ T5849] ffffc90004a37980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.339954][ T5849] ffffc90004a37a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.339967][ T5849] ================================================================== [ 97.340026][ T5849] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 97.996671][ T5849] CPU: 1 UID: 0 PID: 5849 Comm: syz.2.7 Not tainted syzkaller #0 PREEMPT(full) [ 98.005704][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 98.015767][ T5849] Call Trace: [ 98.019059][ T5849] [ 98.021993][ T5849] vpanic+0x56d/0xa60 [ 98.026006][ T5849] ? rcu_is_watching+0x16/0xb0 [ 98.030794][ T5849] ? __pfx_vpanic+0x10/0x10 [ 98.035321][ T5849] panic+0xc5/0xd0 [ 98.039047][ T5849] ? __pfx_panic+0x10/0x10 [ 98.043471][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 98.049273][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 98.055077][ T5849] check_panic_on_warn+0x89/0xb0 [ 98.060010][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 98.065826][ T5849] end_report+0x73/0x170 [ 98.070108][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 98.075911][ T5849] kasan_report+0x128/0x150 [ 98.080431][ T5849] ? __list_add_valid_or_report+0x6a/0x130 [ 98.086254][ T5849] __list_add_valid_or_report+0x6a/0x130 [ 98.091909][ T5849] rpc_queue_upcall+0x86/0x320 [ 98.096679][ T5849] nfsd4_cld_tracking_init+0xd85/0x13a0 [ 98.102238][ T5849] ? __pfx_nfsd4_cld_tracking_init+0x10/0x10 [ 98.108230][ T5849] ? net_generic+0x1e/0x240 [ 98.112739][ T5849] ? net_generic+0x1e/0x240 [ 98.117263][ T5849] ? net_generic+0x1e/0x240 [ 98.121792][ T5849] ? net_generic+0x1e/0x240 [ 98.126295][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.131927][ T5849] nfsd4_client_tracking_init+0xca/0x1c0 [ 98.137578][ T5849] nfs4_state_start_net+0xc95/0x1180 [ 98.142868][ T5849] nfsd_svc+0x481/0x710 [ 98.147034][ T5849] write_threads+0x434/0x610 [ 98.151647][ T5849] ? __pfx_write_threads+0x10/0x10 [ 98.156761][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.162396][ T5849] ? _copy_from_user+0x94/0xb0 [ 98.167154][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.172817][ T5849] ? simple_transaction_get+0x12d/0x160 [ 98.178384][ T5849] nfsctl_transaction_write+0x10f/0x160 [ 98.183949][ T5849] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 98.190038][ T5849] vfs_write+0x296/0xba0 [ 98.194308][ T5849] ? __pfx_vfs_write+0x10/0x10 [ 98.199123][ T5849] ? __fget_files+0x2a/0x420 [ 98.203712][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.209337][ T5849] ? __fget_files+0x3a2/0x420 [ 98.214013][ T5849] ? __fget_files+0x2a/0x420 [ 98.218599][ T5849] ? srso_alias_return_thunk+0x5/0xfbef5 [ 98.224227][ T5849] ksys_write+0x150/0x270 [ 98.228574][ T5849] ? __pfx_ksys_write+0x10/0x10 [ 98.233427][ T5849] do_syscall_64+0x166/0x520 [ 98.238026][ T5849] ? trace_irq_disable+0x3b/0x140 [ 98.243040][ T5849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.249112][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.254994][ T5849] RIP: 0033:0x7fa99159e159 [ 98.259400][ T5849] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 98.278994][ T5849] RSP: 002b:00007fa99252c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 98.287423][ T5849] RAX: ffffffffffffffda RBX: 00007fa991826090 RCX: 00007fa99159e159 [ 98.295383][ T5849] RDX: 0000000000000002 RSI: 0000200000000100 RDI: 0000000000000005 [ 98.303345][ T5849] RBP: 00007fa991635024 R08: 0000000000000000 R09: 0000000000000000 [ 98.311341][ T5849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 98.319298][ T5849] R13: 00007fa991826128 R14: 00007fa991826090 R15: 00007ffe62e24e68 [ 98.327268][ T5849] [ 98.330511][ T5849] Kernel Offset: disabled [ 98.334843][ T5849] Rebooting in 86400 seconds..