last executing test programs: 3m21.556799709s ago: executing program 0 (id=256): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000140)) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000000400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/3, 0x3}, 0x53}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) sendmsg$NL80211_CMD_TDLS_OPER(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$packet(0x11, 0x2, 0x300) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40440d9) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5800000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e6576650000200002801400070000000000000000000000000000000001050004000100000008000a00", @ANYRES32=r6], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x90}}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}}, 0x0) 3m15.682498735s ago: executing program 0 (id=266): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, 0x0, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 3m14.23463038s ago: executing program 0 (id=267): ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000240)=0x200b8) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x1, 0x0, 0x4}}, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x0, 0x0, 0x38, 0x800, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x64010101, @local, {[@cipso={0x86, 0x6, 0x5}]}}, @time_exceeded={0x80, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @loopback, @loopback}}}}}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) migrate_pages(0x0, 0x5, &(0x7f0000000040)=0x9, &(0x7f0000000080)=0x272) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl711\x00', [0x100, 0x80000000, 0x2, 0x10, 0xe, 0x5, 0x79, 0xfffffff8, 0x80008, 0x0, 0x7, 0x1, 0x7, 0x2, 0x0, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x489, 0x4, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0x6, 0xffffffff, 0xfffffff8]}) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) setresgid(0x0, 0xee00, 0x0) r3 = syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x10000000) pread64(r0, 0x0, 0x0, 0x2f6) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 3m13.274223345s ago: executing program 0 (id=271): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_open_dev$sndctrl(&(0x7f0000000580), 0xc290, 0x40) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r5 = openat$cgroup_procs(r3, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f0000000300), 0x12) sendfile(r4, r4, 0x0, 0x10001) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000440)={@in6={{0xa, 0x4e23, 0x9, @empty, 0xa}}, 0x0, 0x0, 0x49, 0x0, "c00866fdc25aca6c451dbae34eeb6cc3904fddf83259e584824efe263c8eef3e3a2f4a231e46f2e5d0c491fd99bb68ec8293d502fcfeafa0dec2fac1fd9b716c8a628631f326f2d8d5f495dec117c4d8"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000000)={@in6={{0xa, 0x4e22, 0x9, @local, 0x7}}, 0x0, 0x0, 0x15, 0x0, "a30b3b28ca4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000000000033035551502f07b4001a00000000000000efffffff00"}, 0xd8) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0xfffffffc, 0x5, 0x0, 'queue0\x00', 0x10000}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 3m11.589416886s ago: executing program 0 (id=273): mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYRES32=0x0, @ANYBLOB="20100000000004001400030076214d68305f766972745f7769"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, 0x0) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) lseek(r6, 0x186a0, 0x0) 3m7.440125819s ago: executing program 0 (id=278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) dup(0xffffffffffffffff) dup(0xffffffffffffffff) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)={0x30, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x3, 0x3}]}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000840)={r4, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f00000008c0)={[{@rodir}, {@numtail}, {@numtail}, {@shortname_lower}, {@shortname_lower}, {@utf8}, {@numtail}, {@utf8no}, {@numtail}, {@fat=@tz_utc}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@numtail}, {@utf8no}, {@iocharset={'iocharset', 0x3d, 'maccyrillic'}}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r8, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) 2m49.321591389s ago: executing program 32 (id=278): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) dup(0xffffffffffffffff) dup(0xffffffffffffffff) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)={0x30, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x3, 0x3}]}, @NL80211_TXRATE_LEGACY={0x4}]}]}]}, 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000840)={r4, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f00000008c0)={[{@rodir}, {@numtail}, {@numtail}, {@shortname_lower}, {@shortname_lower}, {@utf8}, {@numtail}, {@utf8no}, {@numtail}, {@fat=@tz_utc}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@numtail}, {@utf8no}, {@iocharset={'iocharset', 0x3d, 'maccyrillic'}}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r8, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) 28.211621611s ago: executing program 3 (id=510): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 21.475703047s ago: executing program 2 (id=520): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x7) connect$inet6(r1, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x4) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x0, 0x34}, 0xffffffffffffffa5) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000280), 0x200, 0x102) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000100)={0x1, 0x0, 0x3, 0xfffffffc, 0x326, 0x89e, 0x1}) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r3, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000280)='./cgroup\x00', &(0x7f00000002c0)='xfs\x00', 0x2a18005, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x200, 0x807c2, 0x41414770, 0x32314152, 0x425, 0x10004, 0x3, 0x2, 0xfeedcafe, 0x3, 0x2, 0x1}}) 19.439667768s ago: executing program 1 (id=522): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 17.779646199s ago: executing program 2 (id=523): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x1000, 0x2000, &(0x7f0000010000/0x2000)=nil}) ioctl(r1, 0x4038ae7a, &(0x7f0000000900)="000000000100"/56) ioctl(r1, 0x4048aec9, &(0x7f0000000a00)="00000000000000000100"/72) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/drivers/ata_generic/new_id\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000240)='3\x00', 0x2) ioctl(r1, 0x4048aec9, &(0x7f0000000600)="01000000000000000100"/72) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/ata_generic/new_id\x00', 0x0) r4 = socket$unix(0x1, 0x1, 0x0) connect(r4, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='gadgetfs\x00', 0x41, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@redirect_dir_nofollow}, {@nfs_export_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) ioctl(r2, 0x4048aecb, &(0x7f0000000700)='\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00'/72) munmap(&(0x7f0000011000/0x1000)=nil, 0x1000) ioctl(r1, 0x400caed0, &(0x7f0000000800)="0100"/12) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 15.895346706s ago: executing program 4 (id=524): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x31) mount(0x0, 0x0, &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000007000000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='10 1 1\x00', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='1\x00', 0x2) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000900)=ANY=[@ANYBLOB="3800000012000100010000000000000000000000000000000000000000000000100003006e657464657673696d31300008001d0001000000"], 0x38}}, 0x0) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000240)=@generic={0x0, r1}, 0x18) 15.089828526s ago: executing program 1 (id=525): add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000f40), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) openat(0xffffffffffffff9c, 0x0, 0x442, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000100)={0xf0f016, 0x2}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x44, r6, 0x1, 0x0, 0x0, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xf, 0xa9, @name2}]}, 0x44}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8923, &(0x7f00000000c0)={'dummy0\x00', @random="0134014030d9"}) 15.010122758s ago: executing program 3 (id=526): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$kcm(0x11, 0x3, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000001440)='./file0\x00', 0x80040, 0x54) fsetxattr$system_posix_acl(r5, &(0x7f00000001c0)='system.posix_acl_access\x00', &(0x7f00000004c0)={{}, {}, [{0x2, 0x3}], {}, [], {0x10, 0x3}, {0x20, 0x1}}, 0x2c, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x289c2, 0x1) fcntl$setlease(r6, 0x400, 0x1) fremovexattr(r6, &(0x7f0000000040)=@known='system.posix_acl_default\x00') getxattr(&(0x7f0000002a80)='./file0\x00', &(0x7f0000002ac0)=@known='system.posix_acl_access\x00', 0x0, 0x0) sendmmsg$inet_sctp(r1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback={0x0, 0xac14140a}, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0xc000) 13.815865597s ago: executing program 4 (id=527): r0 = socket$can_raw(0x1d, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="12000000060000000400"], 0x50) socket$netlink(0x10, 0x3, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x92}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setpriority(0x1, r1, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet(0x2, 0x3, 0x7f) bind$inet(r6, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r6, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) write$binfmt_elf64(r5, &(0x7f0000000100)=ANY=[@ANYBLOB="7f"], 0x78) socket$tipc(0x1e, 0x2, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r4, 0x0, r6, 0x0, 0x8000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0xd, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xff000000}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x6, 0x0, 0xb}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xc, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x4}}], {{0x7, 0x1, 0x3, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) dup2(r0, 0xffffffffffffffff) 13.74372275s ago: executing program 1 (id=528): sched_setscheduler(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPERTY(0xffffffffffffffff, 0xc04064aa, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f0000000000)='btrfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") syz_mount_image$vfat(&(0x7f00000024c0), &(0x7f00000001c0)='./bus\x00', 0x204b82f, 0x0, 0x3, 0x0, &(0x7f0000000240)) chdir(0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000340)=@v1={0x0, @aes128, 0x3, @desc2}) syz_mount_image$ext4(0x0, &(0x7f00000000c0)='./bus/file0\x00', 0x80008, 0x0, 0x0, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) sendmsg$nl_route(r0, 0x0, 0x4000000) r4 = socket(0x40000000015, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x2720, 0x0, &(0x7f0000000040)) 12.336463274s ago: executing program 4 (id=529): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef91", 0x12) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) r4 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$reject(0x13, r4, 0xd59, 0x1, r4) keyctl$revoke(0x3, r4) 12.264546446s ago: executing program 3 (id=530): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911040000000000000003c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62458c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f00000025c0)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}, {&(0x7f00000006c0)="97b13f5cf9f584c87e0e637d2ff483a311bb412cb3b03c3d9e97e435f2fceb58ff0402ed7b96244b43386c222917662028d7a01206a1990722ccef1d8f39f7c8ae242e58359217b1c6161ea741445cf16b0c48eb18a6c72174dfb7cd1bd0f409dad5a432bed4afb470da3656dd30d70769e229dc91037321d618e1eff4a176ea46d5cd4d5da97f80356e46d9e8166bf2d97210b631654ece218a2a204a1786ab5a60a881a7a294cd2f92438350e6e3ec4439ebe06133ff65b1e32b809ba0482783", 0xc1}, {&(0x7f00000007c0)="75c37714a0bada8343bceb64ccb6d95a2a37b020e0bf1f6a1de4584223a2f285aaca30a9554cd5cdc1659cb9fec462cc5c2220a7cd891ec3bad99fe3c06e15a109ec0fdb6aeeee5ef8e4bfc28e17984a3860b907d549492d47a447782b7357ea72f4b2c26512a6a33c0247b730a6182ea5a99aee25fcee07f9cb0a80595cd5f744fa6898fdffda5b34b19474b8e853467329e4aea36cfd0e00735d37beb0f895c5688259a8935194eefd3a96d55707", 0xaf}, {&(0x7f0000000b00)="1b080b7a30aec939ce8e26e0cbbe37fc064ceef965fd5e3b6739c966492dbdf71c04423d8a403e56dfd224e4e55918a5e31e683fec5cc9460882a0d1628d02d51a8da997073f856e2cd00586c6e8c89c71cf8be6121b0b3a85d597a1afb0cc311f30cc26183c8e594ce5ff62661c9e32cbc9dd9a72985e9857f3bddb52382b6c27ca85d5774cf17b92e2d2097f12a8687e70f90d46381a47706a9124a2cf61b84f26aae22fd4da84ae35b93f7be9fdfdfbf33c59f5c657e9f7e81b81b786082f88af4de07808ff3c954bae", 0xcb}], 0x8, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r4, &(0x7f0000001140)={0x0, 0x2, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1}, 0x40000100) mprotect(&(0x7f00004e2000/0x4000)=nil, 0x4000, 0x3) 11.667367451s ago: executing program 2 (id=531): mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x801}, 0x4000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r2, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000000000", 0x51}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, 0x0, 0x80) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) lseek(r3, 0x249f0, 0x0) socket$key(0xf, 0x3, 0x2) 10.258445286s ago: executing program 3 (id=532): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000180)={0xffffffffffffffff, r2}) sendmmsg$inet(r3, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000340)}}], 0x1, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) close(r3) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16) ppoll(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r1}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}, 0x0, 0x2d}) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1}, &(0x7f0000000240)=""/186, 0xba, &(0x7f0000000440)={0x0, &(0x7f00000003c0)="a72f976605f2c4f756fda55f7fbb8ae19a80bc96c1c7c487736029646cce7944d346c750dc2eeafc1ac58789b5f2755f23", 0x31}) 10.135674789s ago: executing program 4 (id=533): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 10.128317309s ago: executing program 1 (id=534): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) 6.771090162s ago: executing program 4 (id=535): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x7e) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x78, 0x802) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0x3}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x3, 0x12, r1, 0x100000000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x2000800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xe0}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x1}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0x50}, {0x7, 0x1, 0xb, 0x2, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r5}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.612172397s ago: executing program 2 (id=536): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, 0x0) r1 = syz_usb_connect$cdc_ncm(0x6, 0x6e, &(0x7f0000000480)=ANY=[], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$getregset(0x420e, r3, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x140}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000380)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e22, @loopback}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x5}) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, 0x0) memfd_create(&(0x7f0000000280)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\x8b\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\x1c)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x0, 0xa}, @l2cap_cid_signaling={{0x6}, [@l2cap_cmd_rej_unk={{0x1, 0x8, 0x2}, {0x46d}}]}}, 0xf) syz_usb_connect$cdc_ncm(0x2, 0x79, &(0x7f0000000400)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x67, 0x2, 0x1, 0x0, 0xd0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "bbc0274f8e24"}, {0x5, 0x24, 0x0, 0x47}, {0xd, 0x24, 0xf, 0x1, 0x7ff, 0x2, 0x8, 0xa}, {0x6, 0x24, 0x1a, 0x5, 0xdd34065dbf1ec8f7}, [@call_mgmt={0x5, 0x24, 0x1, 0x1}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x1, 0xa2, 0x7f}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x7, 0xc, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x9, 0xea, 0x8}}}}}}}]}}, &(0x7f0000000a00)={0xa, &(0x7f00000004c0)={0xa, 0x6, 0x200, 0x80, 0x49, 0x3, 0x40, 0x2}, 0x34, &(0x7f0000000a80)=ANY=[@ANYBLOB="050f34000314100402cd2fd5a6f7e818bf9537b9dece5164fa1410047541a2ffabec8ca6dadcdb2aa2a4cb5b9f07100204be6f65439d68c2b996147fcb11867f099b1d4b4b8c6435a2505fdfdedb22fa05f65dec9f5f329e276f9c72ab05bf9972f9d942f45bd59d5639281ee239056b6bb1f94d9e4200001e4d290a966b2e7b2f1fe6470401c60f348c6b752b919e5b3ebadd3489ca2e4f386ac20738ff81a1ffc2fab66ea835455bfca96ae1c56482df6efed34ee358c58832453fd7879fb140f0a2ea68877c185c3f67424f184272929c98466a4ab8f9fcaf31eefd4955ec4d7c640ff3f8b5f5108b563535bd8a92b6e1c0d4b76e3f40a7cd1eeb06741fbb5483674fd9eebe40d732c077dfabd633f466de321ca577f4dca0df1539d47bf024ae639defcf035a090d242a68deb33e2c178d0f7ac17dcd58a00061dfbd40d0d84aa45e5fceeac57ce10dcca83b023aa5318fa3e321528e3f5c76755a08f93596e42f"], 0x7, [{0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x4001}}, {0xb5, &(0x7f00000008c0)=ANY=[@ANYBLOB="b5030746bef559993edf65f7e6b84f88ffb8941fab43c66b1cf16a634e74ddf428ebdf52a239c4cc14c613ee47677d45d6c4fcc5613e6aff88a48244673dcdbe4d21081aaa4f6e97e56a87cb1a71d142c0cce1828ba75eb0035f0492005a2d78d95db1e75d1a46470ca42be27b31c4adea4a258c2cea426dede836614016a746cfe2dfea9c0f8be1c2e383387d08396e2721259bf1ad60018506327a5f1e17616aec5d91b01375f5834e9452f0501101f809a91cc0c8c15c"]}, {0x2, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00']}, {0xb1, &(0x7f0000000680)=@string={0xb1, 0x3, "1f6f34f4590de52266228f060731d4ca3f45d573b4ac0b16e01c6607a59176dde2cae97af6e1d99664e17460829b082d584969a437883fb1faa8a922c9ab6a5601048c3be1e2a5c8b96bfa6b5b8ec20c1db7ef18cd5a0193c173b0643a7b6f64aa0c9537b190450a7ee8e456dfe5115841bb3317e04f187a676d5cbd29abc7fbc2ba9957ae1ccf44dbb7300d5b36b62e299e889b0aa1ea8442e41ba0fe76344fd632e6924ff02ee59aa2a707958bce"}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x4ff}}, {0xc9, &(0x7f0000000740)=ANY=[@ANYBLOB="c9036dc2abbe17230433b476da4536a8dfe32a82f1e8ea14f252280be2f8ab65e41dd490c109d340cde89a74bde9acc4900b1103d8fbefa1a49481b9119f970b8eeffe4f577e886694a0d4f423d84722f916589a4a0fde9671f74f730dc200cb77f0369a5ce409d10f09046a7b73ab791c57f877a9ff739d2b3e8be38f067eb817ad8559981e43e540008d3cc27d5999319523bc679f090847ca3dbdd52f5454af86602a5a6ab7889cb0d12a8fa2156c905e81b1322705c45b8ed4fb4e9e5cf2b007aab882c4586a22"]}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x180c}}]}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) 6.45965633s ago: executing program 3 (id=537): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={0x0, 0x40}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=0x0], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_emit_ethernet(0xb6, &(0x7f00000003c0)={@broadcast, @multicast, @val={@val={0x88a8, 0x0, 0x0, 0x2}, {0x8100, 0x0, 0x0, 0x1}}, {@ipv6={0x86dd, @tipc_packet={0x0, 0x6, "4461aa", 0x78, 0x6, 0x1, @ipv4={'\x00', '\xff\xff', @multicast2}, @private2, {[@hopopts={0xff}, @fragment={0xae, 0x0, 0x81, 0x0, 0x0, 0x4, 0x68}, @srh={0x2c, 0x6, 0x4, 0x3, 0x2, 0x20, 0x2, [@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @routing={0x2c, 0x2, 0x2, 0x2, 0x0, [@private0]}], @payload_conn={{{0x18, 0x0, 0x0, 0x1, 0x0, 0x6, 0x2, 0x2, 0x7, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x8, 0x0, 0x4e21, 0x4e24}}}}}}}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, 0x0}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000010900010073797a30000000000800034000000001140000001100010000000000000000000000000a"], 0x64}}, 0x4000000) sendmsg$NFT_MSG_GETOBJ(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x24040808) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x7a, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00\x00\b', 0x44, 0x2f, 0x1, @remote, @private1, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}, {}, {0x8, 0x88be, 0xfffffffd, {{0x0, 0x1, 0x6, 0x0, 0x0, 0x0, 0x0, 0x20}}}, {0x8, 0x22eb, 0x4, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x2, {0xfffdfff8, 0xfffe}}}}}}}}}, 0x0) 3.65683336s ago: executing program 1 (id=538): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e1f, 0x3, 'lc\x00', 0x4, 0x81, 0x5}, {@rand_addr=0x64010102, 0x4e26, 0x0, 0xcb, 0x12d60, 0x9}}, 0x44) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000380)={{0x84, @broadcast, 0x4e20, 0x3, 'sh\x00', 0x0, 0x60000000, 0xc}, {@rand_addr=0x64010102, 0x4e26, 0x12002, 0x3, 0x8001, 0x1}}, 0x44) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x88901, 0x0) ioctl$SNDCTL_SEQ_THRESHOLD(r4, 0x4004510d, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="050027bd7000000000000600000008000300", @ANYRES32=r7, @ANYRES64=r0, @ANYRES16=r7], 0x24}, 0x1, 0x0, 0x0, 0x20040091}, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) connect$inet(r5, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) 1.654539659s ago: executing program 4 (id=539): socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x12, 0x5, &(0x7f0000000b40)=ANY=[@ANYBLOB="18000000040000000000"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, 0x9}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@deltclass={0x24, 0x29, 0x8, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0xffff}, {0xffe0, 0xfff3}, {0x3, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xc6da5938055fa6f8, 0x48a21}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x203}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x4c}, 0x1, 0x200000000000000, 0x0, 0x240400d5}, 0x2000c000) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@float={0x1, 0x0, 0x0, 0x10, 0xc}, @const={0x0, 0x0, 0x0, 0xb}, @volatile={0x0, 0x0, 0x0, 0x9, 0x2}]}}, 0x0, 0x3e}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000001c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x6, '\x00', 0x0, r6, 0x1, 0x5}, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 1.447690254s ago: executing program 2 (id=540): r0 = syz_io_uring_setup(0x31c5, &(0x7f0000000140)={0x0, 0xd73c, 0x10000, 0x1, 0x135}, &(0x7f00000001c0), &(0x7f00000003c0), &(0x7f0000000000)) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0x20, 0x27, 0x2, 0x0, 0x0, r0}, &(0x7f00000002c0), &(0x7f0000000000), 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x40002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key$keyring(&(0x7f0000000340), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x11, 0x8100}, 0x14) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000400)=0x11) ioctl$TCSETS(r2, 0x5402, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000340)={0x2b}, 0x8) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) readahead(0xffffffffffffffff, 0x8, 0x1) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 1.447346524s ago: executing program 3 (id=541): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, 0x0, 0x8040) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) syz_open_procfs(0x0, &(0x7f0000000100)='map_files\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r4, 0x0, 0x0, 0x810) 230.590205ms ago: executing program 2 (id=542): times(0xfffffffffffffffe) syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) setns(0xc9, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000200), 0x4) bind$rds(r1, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000240), 0x4) bind$rds(r2, &(0x7f0000000440)={0x2, 0x4e22, @loopback}, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) exit(0x1ff) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x13, &(0x7f0000001bc0), 0x2) connect$rds(r1, &(0x7f0000000500)={0x2, 0x4e22, @loopback}, 0x10) sendto(r1, &(0x7f0000000600)='hello world', 0xb, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x7, 0x8, 0x1014}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) 0s ago: executing program 1 (id=543): mkdir(&(0x7f0000000140)='./file1\x00', 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={0x0, 0x138}}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x8050) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) r3 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) kernel console output (not intermixed with test programs): +0x3fa/0xc40 [ 159.252403][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 159.257387][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 159.262699][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 159.269032][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 159.274235][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 159.279892][ T5786] ? hci_le_meta_evt+0x2b9/0x560 [ 159.284933][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 159.289632][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 159.295204][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 159.301282][ T5786] hci_event_packet+0x7b4/0x1280 [ 159.306230][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 159.311875][ T5786] ? bis_list+0x290/0x290 [ 159.316217][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 159.321335][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 159.326632][ T5786] hci_rx_work+0x43a/0xd60 [ 159.331237][ T5786] ? process_scheduled_works+0x975/0x1600 [ 159.336969][ T5786] process_scheduled_works+0xa60/0x1600 [ 159.342573][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 159.348421][ T5786] ? assign_work+0x3cc/0x5d0 [ 159.353469][ T5786] worker_thread+0xa5e/0xfe0 [ 159.358082][ T5786] kthread+0x2fa/0x390 [ 159.362158][ T5786] ? pr_cont_work+0x550/0x550 [ 159.366852][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 159.371643][ T5786] ret_from_fork+0x48/0x80 [ 159.376168][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 159.380865][ T5786] ret_from_fork_asm+0x11/0x20 [ 159.385650][ T5786] [ 159.559795][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 159.575510][ T5786] Bluetooth: hci3: failed to register connection device [ 159.581683][ T5085] Bluetooth: hci0: command tx timeout [ 160.457989][ T6663] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd3": -EINTR [ 162.015059][ T5085] Bluetooth: hci3: command tx timeout [ 162.230275][ T6686] Zero length message leads to an empty skb [ 164.913102][ T6701] loop3: detected capacity change from 0 to 128 [ 165.404334][ T6701] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 165.444493][ T6701] ext4 filesystem being mounted at /37/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 165.509338][ T6708] netlink: 4 bytes leftover after parsing attributes in process `syz.1.160'. [ 166.022195][ T6710] loop2: detected capacity change from 0 to 512 [ 166.111957][ T6710] EXT4-fs: Ignoring removed nomblk_io_submit option [ 166.141584][ T6710] ext4: Unknown parameter 'fscontext' [ 166.290667][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 166.769228][ T6717] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 167.103142][ T6719] netlink: 'syz.1.162': attribute type 1 has an invalid length. [ 167.424349][ T5774] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 167.835667][ T6725] loop2: detected capacity change from 0 to 128 [ 168.102372][ T6725] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 168.398834][ T6725] ext4 filesystem being mounted at /43/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 169.247198][ T6735] loop3: detected capacity change from 0 to 16 [ 169.262779][ T6735] erofs: Unknown parameter '€' [ 169.466097][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 169.922043][ T5766] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 171.349440][ T5775] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 173.339686][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 173.349320][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 173.356909][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.367077][ T5786] Workqueue: hci1 hci_rx_work [ 173.371798][ T5786] Call Trace: [ 173.375095][ T5786] [ 173.378058][ T5786] dump_stack_lvl+0x18c/0x250 [ 173.381268][ T6761] IPVS: wrr: SCTP 172.20.20.187:0 - no destination available [ 173.382755][ T5786] ? show_regs_print_info+0x20/0x20 [ 173.395354][ T5786] ? load_image+0x420/0x420 [ 173.399937][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 173.401884][ T173] IPVS: starting estimator thread 0... [ 173.405063][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 173.415700][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 173.420679][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 173.425917][ T5786] kobject_add_internal+0x617/0xc90 [ 173.431133][ T5786] kobject_add+0x164/0x240 [ 173.435561][ T5786] ? kobject_init+0x1d0/0x1d0 [ 173.440406][ T5786] ? get_device_parent+0x366/0x390 [ 173.445619][ T5786] device_add+0x3fa/0xc40 [ 173.449960][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 173.454990][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 173.460282][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 173.466530][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 173.472183][ T5786] ? mutex_unlock+0x10/0x10 [ 173.476883][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 173.481567][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 173.487123][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 173.493412][ T5786] hci_event_packet+0x7b4/0x1280 [ 173.498417][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 173.503456][ T5786] ? lock_chain_count+0x20/0x20 [ 173.508343][ T5786] ? bis_list+0x290/0x290 [ 173.512688][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 173.517899][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 173.523132][ T5786] hci_rx_work+0x43a/0xd60 [ 173.527571][ T5786] ? process_scheduled_works+0x975/0x1600 [ 173.533480][ T5786] process_scheduled_works+0xa60/0x1600 [ 173.539051][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 173.544519][ T5786] ? assign_work+0x3cc/0x5d0 [ 173.549124][ T5786] worker_thread+0xa5e/0xfe0 [ 173.553747][ T5786] kthread+0x2fa/0x390 [ 173.558453][ T5786] ? pr_cont_work+0x550/0x550 [ 173.563150][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 173.567749][ T5786] ret_from_fork+0x48/0x80 [ 173.572346][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 173.576952][ T5786] ret_from_fork_asm+0x11/0x20 [ 173.581734][ T5786] [ 173.588197][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 173.602420][ T5786] Bluetooth: hci1: failed to register connection device [ 173.657855][ T6761] sctp: [Deprecated]: syz.2.172 (pid 6761) Use of int in max_burst socket option. [ 173.657855][ T6761] Use struct sctp_assoc_value instead [ 173.681848][ T6762] IPVS: using max 25 ests per chain, 60000 per kthread [ 173.708691][ T5085] Bluetooth: hci2: link tx timeout [ 173.714472][ T5085] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.722363][ T5085] Bluetooth: hci2: link tx timeout [ 173.733720][ T5786] Bluetooth: hci2: link tx timeout [ 173.741205][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.749770][ T5786] Bluetooth: hci2: link tx timeout [ 173.755301][ T5786] Bluetooth: hci2: link tx timeout [ 173.761143][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.769854][ T5786] Bluetooth: hci2: link tx timeout [ 173.815829][ T5786] Bluetooth: hci2: link tx timeout [ 173.821438][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.834587][ T5786] Bluetooth: hci2: link tx timeout [ 173.839845][ T5786] Bluetooth: hci2: link tx timeout [ 173.850013][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.860108][ T5786] Bluetooth: hci2: link tx timeout [ 173.865490][ T5786] Bluetooth: hci2: link tx timeout [ 173.873264][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.882068][ T5786] Bluetooth: hci2: link tx timeout [ 173.887308][ T5786] Bluetooth: hci2: link tx timeout [ 173.894287][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.906711][ T5786] Bluetooth: hci2: link tx timeout [ 173.913857][ T5786] Bluetooth: hci2: link tx timeout [ 173.919256][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.928244][ T5786] Bluetooth: hci2: link tx timeout [ 173.935401][ T5786] Bluetooth: hci2: link tx timeout [ 173.940631][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.949682][ T5786] Bluetooth: hci2: link tx timeout [ 173.959056][ T5786] Bluetooth: hci2: link tx timeout [ 173.966673][ T5786] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 173.975370][ T5786] Bluetooth: hci2: link tx timeout [ 174.325588][ T6767] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd0": -EINTR [ 174.435943][ T6774] loop1: detected capacity change from 0 to 128 [ 174.473472][ T6774] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 174.493434][ T6774] ext4 filesystem being mounted at /39/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 174.910728][ T6781] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 175.823014][ T5786] Bluetooth: hci1: command tx timeout [ 175.826624][ T5773] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 176.013960][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 176.296484][ T6791] loop3: detected capacity change from 0 to 1024 [ 176.308016][ T6791] EXT4-fs: Ignoring removed mblk_io_submit option [ 176.314855][ T6791] EXT4-fs: inline encryption not supported [ 176.715449][ T6791] EXT4-fs (loop3): can't mount with data_err=abort, fs mounted w/o journal [ 176.897668][ T6780] Process accounting resumed [ 176.976704][ T28] audit: type=1326 audit(1786178066.264:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6782 comm="syz.3.168" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd763d9e0d9 code=0x7fc00000 [ 178.072280][ T6807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.179'. [ 178.087201][ T6807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.179'. [ 178.097362][ T6807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.179'. [ 178.108301][ T6807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.179'. [ 178.914066][ T6810] loop2: detected capacity change from 0 to 16 [ 178.929320][ T6810] erofs: Unknown parameter '€' [ 180.484745][ T6818] syz.0.181: attempt to access beyond end of device [ 180.484745][ T6818] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 181.270345][ T6833] loop0: detected capacity change from 0 to 128 [ 181.359939][ T6833] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 181.446973][ T6833] ext4 filesystem being mounted at /51/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 181.601216][ T6841] loop3: detected capacity change from 0 to 128 [ 181.633019][ T6841] FAT-fs (loop3): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 181.833850][ T5766] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 182.266269][ T6842] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 182.310469][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 183.029565][ T5776] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 185.353845][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 185.810621][ T6868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.191'. [ 185.935490][ T6872] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 185.944423][ T6872] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 185.953938][ T6872] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 186.112882][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 188.043181][ T6878] workqueue: Failed to create a rescuer kthread for wq "xfs-conv/nbd0": -EINTR [ 188.595492][ T6892] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.638109][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 188.694213][ T6893] netlink: 830 bytes leftover after parsing attributes in process `syz.2.197'. [ 189.726076][ T6901] comedi comedi1: pcl812: I/O port conflict (0x100,16) [ 190.850330][ T6907] netlink: 8 bytes leftover after parsing attributes in process `syz.2.199'. [ 190.926699][ T6909] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 190.935105][ T6909] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 190.943843][ T6909] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 192.938568][ T28] audit: type=1326 audit(1786178080.925:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6908 comm="syz.0.200" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7ef0f9e0d9 code=0x0 [ 193.105716][ T6921] netlink: 8 bytes leftover after parsing attributes in process `syz.2.203'. [ 193.183055][ T6922] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 193.191586][ T6922] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 193.200098][ T6922] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 193.248169][ T6920] loop3: detected capacity change from 0 to 128 [ 193.619792][ T6920] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 193.805690][ T6920] ext4 filesystem being mounted at /48/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 194.398275][ T6933] syz.0.204: attempt to access beyond end of device [ 194.398275][ T6933] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 195.405409][ T6949] syz.2.206: attempt to access beyond end of device [ 195.405409][ T6949] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 196.343468][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 196.448857][ T5774] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 197.654613][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 198.284141][ T6970] loop0: detected capacity change from 0 to 16 [ 198.296532][ T6970] erofs: Unknown parameter '€' [ 198.814296][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 199.072938][ T5764] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 199.713100][ T6974] loop2: detected capacity change from 0 to 1024 [ 199.720588][ T6974] EXT4-fs: Ignoring removed mblk_io_submit option [ 199.727178][ T6974] EXT4-fs: inline encryption not supported [ 199.838078][ T6981] netlink: 8 bytes leftover after parsing attributes in process `syz.1.212'. [ 199.902909][ T6974] EXT4-fs (loop2): can't mount with data_err=abort, fs mounted w/o journal [ 199.925953][ T6985] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 199.934595][ T6985] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 199.943168][ T6985] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 199.990023][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 200.034014][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.429169][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 201.524567][ T6989] syz.3.214: attempt to access beyond end of device [ 201.524567][ T6989] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 201.589469][ T28] audit: type=1326 audit(1786178088.999:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6971 comm="syz.2.211" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe07799e0d9 code=0x7fc00000 [ 202.031607][ T7000] syz.1.215: attempt to access beyond end of device [ 202.031607][ T7000] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 203.109714][ T5781] Bluetooth: hci0: command 0x0406 tx timeout [ 203.115848][ T5779] Bluetooth: hci1: command 0x0406 tx timeout [ 203.122056][ T5779] Bluetooth: hci3: command 0x0406 tx timeout [ 203.367324][ T5783] Bluetooth: hci2: command 0x0406 tx timeout [ 205.651617][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 205.661601][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 205.669273][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 205.679371][ T5786] Workqueue: hci1 hci_rx_work [ 205.684065][ T5786] Call Trace: [ 205.687430][ T5786] [ 205.690446][ T5786] dump_stack_lvl+0x18c/0x250 [ 205.695154][ T5786] ? show_regs_print_info+0x20/0x20 [ 205.700360][ T5786] ? load_image+0x420/0x420 [ 205.704903][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 205.710037][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 205.715096][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 205.719793][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 205.725009][ T5786] kobject_add_internal+0x617/0xc90 [ 205.730226][ T5786] kobject_add+0x164/0x240 [ 205.734649][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 205.740149][ T5786] ? kobject_init+0x1d0/0x1d0 [ 205.744931][ T5786] ? get_device_parent+0x366/0x390 [ 205.750049][ T5786] device_add+0x3fa/0xc40 [ 205.754569][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 205.759960][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 205.765377][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 205.771908][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 205.777572][ T5786] ? mutex_unlock+0x10/0x10 [ 205.782101][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 205.786811][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 205.792469][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 205.798645][ T5786] hci_event_packet+0x7b4/0x1280 [ 205.803771][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 205.809441][ T5786] ? bis_list+0x290/0x290 [ 205.813800][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 205.819011][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 205.824215][ T5786] hci_rx_work+0x43a/0xd60 [ 205.828638][ T5786] ? process_scheduled_works+0x975/0x1600 [ 205.834364][ T5786] process_scheduled_works+0xa60/0x1600 [ 205.839944][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 205.845450][ T5786] ? assign_work+0x3cc/0x5d0 [ 205.850051][ T5786] worker_thread+0xa5e/0xfe0 [ 205.854670][ T5786] kthread+0x2fa/0x390 [ 205.858738][ T5786] ? pr_cont_work+0x550/0x550 [ 205.863424][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 205.868107][ T5786] ret_from_fork+0x48/0x80 [ 205.872564][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 205.877156][ T5786] ret_from_fork_asm+0x11/0x20 [ 205.882025][ T5786] [ 205.896580][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 205.896764][ T5786] Bluetooth: hci1: failed to register connection device [ 206.326054][ T7030] No such timeout policy "syz1" [ 207.651169][ T7041] netlink: 8 bytes leftover after parsing attributes in process `syz.3.224'. [ 207.682696][ T7047] netlink: 8 bytes leftover after parsing attributes in process `syz.0.213'. [ 207.743482][ T7048] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 207.751969][ T7048] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 207.761345][ T7048] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 208.134929][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 208.530949][ T7050] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd1": -EINTR [ 213.411736][ T7073] Bluetooth: hci0: unsupported parameter 255 [ 213.429008][ T7073] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 213.654229][ T7077] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 214.306372][ T7076] No such timeout policy "syz1" [ 216.807139][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 216.816802][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 216.824353][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 216.834420][ T5786] Workqueue: hci1 hci_rx_work [ 216.839130][ T5786] Call Trace: [ 216.842408][ T5786] [ 216.845335][ T5786] dump_stack_lvl+0x18c/0x250 [ 216.850075][ T5786] ? show_regs_print_info+0x20/0x20 [ 216.855285][ T5786] ? load_image+0x420/0x420 [ 216.859941][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 216.865192][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 216.870236][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 216.874917][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 216.880114][ T5786] kobject_add_internal+0x617/0xc90 [ 216.885317][ T5786] kobject_add+0x164/0x240 [ 216.889757][ T5786] ? kobject_init+0x1d0/0x1d0 [ 216.894478][ T5786] ? get_device_parent+0x366/0x390 [ 216.899770][ T5786] device_add+0x3fa/0xc40 [ 216.904195][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 216.909139][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 216.914457][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 216.920988][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 216.926643][ T5786] ? mutex_unlock+0x10/0x10 [ 216.931215][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 216.935896][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 216.941463][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 216.947552][ T5786] hci_event_packet+0x7b4/0x1280 [ 216.952553][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 216.958202][ T5786] ? bis_list+0x290/0x290 [ 216.962543][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 216.967679][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 216.972965][ T5786] hci_rx_work+0x43a/0xd60 [ 216.977495][ T5786] ? process_scheduled_works+0x975/0x1600 [ 216.983224][ T5786] process_scheduled_works+0xa60/0x1600 [ 216.988984][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 216.994461][ T5786] ? assign_work+0x3cc/0x5d0 [ 216.999087][ T5786] worker_thread+0xa5e/0xfe0 [ 217.003712][ T5786] kthread+0x2fa/0x390 [ 217.007786][ T5786] ? pr_cont_work+0x550/0x550 [ 217.012489][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 217.017089][ T5786] ret_from_fork+0x48/0x80 [ 217.021656][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 217.026273][ T5786] ret_from_fork_asm+0x11/0x20 [ 217.031048][ T5786] [ 217.038118][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 217.052578][ T5786] Bluetooth: hci1: failed to register connection device [ 217.079807][ T7089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.235'. [ 217.170640][ T7091] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 217.179092][ T7091] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 217.188449][ T7091] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 219.025727][ T7097] netlink: 8 bytes leftover after parsing attributes in process `syz.0.236'. [ 219.097835][ T7100] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 219.106387][ T7100] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 219.115028][ T7100] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 219.232682][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 220.738998][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 220.992969][ T7107] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd1": -EINTR [ 221.115538][ T7114] netlink: 12 bytes leftover after parsing attributes in process `syz.3.239'. [ 222.624877][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 223.069139][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 223.991104][ T7116] loop0: detected capacity change from 0 to 4096 [ 226.499733][ T7116] ntfs3: loop0: Failed to read $AttrDef (-4). [ 227.675365][ T7137] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 227.702483][ T7137] cramfs: wrong magic [ 228.666143][ T7140] netlink: 4 bytes leftover after parsing attributes in process `syz.0.245'. [ 229.484173][ T7137] netlink: 88 bytes leftover after parsing attributes in process `syz.1.246'. [ 230.501892][ T7155] No such timeout policy "syz1" [ 232.183370][ T28] audit: type=1800 audit(1786178117.224:12): pid=7162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.251" name="in_ports" dev="configfs" ino=10237 res=0 errno=0 [ 233.073364][ T23] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 233.252265][ T7186] netlink: 8 bytes leftover after parsing attributes in process `syz.2.257'. [ 233.357297][ T7187] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 233.366599][ T7187] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 233.375115][ T7187] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 233.723802][ T23] usb 1-1: Dual-Role OTG device on HNP port [ 234.301536][ T7189] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 234.310743][ T23] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 234.320553][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.794633][ T7180] netlink: 'syz.0.256': attribute type 1 has an invalid length. [ 234.868836][ T7180] 8021q: adding VLAN 0 to HW filter on device bond1 [ 234.914229][ T23] gspca_main: spca501-2.14.0 probing 0000:0000 [ 236.017497][ T23] gspca_spca501: reg write: error -32 [ 236.037936][ T23] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 236.089266][ T23] spca501: probe of 1-1:1.0 failed with error -22 [ 236.099289][ T7180] bond1: (slave geneve2): making interface the new active one [ 236.112108][ T23] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 236.130933][ T7180] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 236.173692][ T7203] No such timeout policy "syz1" [ 236.523046][ T7210] netlink: 'syz.3.262': attribute type 12 has an invalid length. [ 237.343213][ T7210] netlink: 4 bytes leftover after parsing attributes in process `syz.3.262'. [ 237.404981][ T7215] netlink: 24 bytes leftover after parsing attributes in process `syz.2.263'. [ 238.986335][ T7221] netlink: 8 bytes leftover after parsing attributes in process `syz.0.266'. [ 239.075510][ T7222] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 239.083975][ T7222] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 239.092589][ T7222] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 241.219562][ T7234] file system registered [ 241.650984][ T7243] syz.2.269 uses obsolete (PF_INET,SOCK_PACKET) [ 242.991757][ T5773] ffs_data_put(): freeing [ 243.233132][ T7253] loop1: detected capacity change from 0 to 128 [ 243.243944][ T7250] netlink: 20 bytes leftover after parsing attributes in process `syz.0.273'. [ 243.252547][ T7253] FAT-fs (loop1): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 245.417015][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 245.538806][ T7250] team0 (unregistering): Port device team_slave_0 removed [ 246.028875][ T7250] team0 (unregistering): Port device team_slave_1 removed [ 246.697094][ T7255] veth1_macvtap: left promiscuous mode [ 247.257645][ T7281] 9pnet_virtio: no channels available for device syz [ 247.671735][ T5786] Bluetooth: hci2: command 0x0406 tx timeout [ 247.692951][ T7294] syz.2.281: attempt to access beyond end of device [ 247.692951][ T7294] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 248.594731][ T7307] loop0: detected capacity change from 0 to 256 [ 249.944067][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 250.264681][ T7323] netlink: 12 bytes leftover after parsing attributes in process `syz.2.284'. [ 251.017880][ T7325] loop1: detected capacity change from 0 to 2048 [ 251.056937][ T7325] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 251.726450][ T7331] netlink: 'syz.2.287': attribute type 12 has an invalid length. [ 252.086131][ T28] audit: type=1800 audit(1786178135.595:13): pid=7325 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.285" name="bus" dev="loop1" ino=1367 res=0 errno=0 [ 252.554758][ T7331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.287'. [ 253.334007][ T7341] capability: warning: `syz.1.289' uses 32-bit capabilities (legacy support in use) [ 254.281846][ C1] hrtimer: interrupt took 43478 ns [ 254.907114][ T7362] syz.1.292: attempt to access beyond end of device [ 254.907114][ T7362] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 254.953969][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 255.875583][ T7379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.295'. [ 255.929754][ T7373] syz.3.293: attempt to access beyond end of device [ 255.929754][ T7373] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 255.963430][ T7382] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 255.971946][ T7382] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 255.980575][ T7382] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 256.981375][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 257.431424][ T7391] netlink: 4 bytes leftover after parsing attributes in process `syz.1.296'. [ 257.496489][ T7392] loop1: detected capacity change from 0 to 256 [ 258.472671][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 258.485464][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 258.493151][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.503222][ T5786] Workqueue: hci0 hci_rx_work [ 258.507998][ T5786] Call Trace: [ 258.511278][ T5786] [ 258.514209][ T5786] dump_stack_lvl+0x18c/0x250 [ 258.518891][ T5786] ? show_regs_print_info+0x20/0x20 [ 258.524254][ T5786] ? load_image+0x420/0x420 [ 258.528775][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 258.533887][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 258.538915][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 258.543595][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 258.548804][ T5786] kobject_add_internal+0x617/0xc90 [ 258.554030][ T5786] kobject_add+0x164/0x240 [ 258.558457][ T5786] ? kobject_init+0x1d0/0x1d0 [ 258.563229][ T5786] ? get_device_parent+0x366/0x390 [ 258.568348][ T5786] device_add+0x3fa/0xc40 [ 258.572676][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 258.577618][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 258.582914][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 258.589167][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 258.594812][ T5786] ? mutex_unlock+0x10/0x10 [ 258.599317][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 258.603992][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 258.609544][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 258.615614][ T5786] hci_event_packet+0x7b4/0x1280 [ 258.620562][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 258.625685][ T5786] ? lock_chain_count+0x20/0x20 [ 258.630626][ T5786] ? bis_list+0x290/0x290 [ 258.634957][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 258.640291][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 258.645511][ T5786] hci_rx_work+0x43a/0xd60 [ 258.650046][ T5786] ? process_scheduled_works+0x975/0x1600 [ 258.655781][ T5786] process_scheduled_works+0xa60/0x1600 [ 258.661347][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 258.666812][ T5786] ? assign_work+0x3cc/0x5d0 [ 258.671405][ T5786] worker_thread+0xa5e/0xfe0 [ 258.676017][ T5786] kthread+0x2fa/0x390 [ 258.680088][ T5786] ? pr_cont_work+0x550/0x550 [ 258.684769][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 258.689356][ T5786] ret_from_fork+0x48/0x80 [ 258.693782][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 258.698388][ T5786] ret_from_fork_asm+0x11/0x20 [ 258.703166][ T5786] [ 258.958154][ T5786] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 259.104381][ T5786] Bluetooth: hci0: failed to register connection device [ 261.380736][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 265.329464][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 265.336075][ T7425] syz.2.304: attempt to access beyond end of device [ 265.336075][ T7425] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 266.754685][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 266.767420][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 267.828656][ T5786] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 267.845578][ T5786] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 267.854778][ T5786] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 267.874683][ T5786] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 267.889317][ T5786] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 267.896997][ T5786] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 268.365090][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 268.376216][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 268.383638][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.394245][ T51] Workqueue: hci1 hci_rx_work [ 268.399069][ T51] Call Trace: [ 268.402390][ T51] [ 268.405458][ T51] dump_stack_lvl+0x18c/0x250 [ 268.410179][ T51] ? show_regs_print_info+0x20/0x20 [ 268.415413][ T51] ? load_image+0x420/0x420 [ 268.419966][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 268.425108][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 268.430159][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 268.434871][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 268.440118][ T51] kobject_add_internal+0x617/0xc90 [ 268.445375][ T51] kobject_add+0x164/0x240 [ 268.449922][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 268.455382][ T51] ? kobject_init+0x1d0/0x1d0 [ 268.460097][ T51] ? get_device_parent+0x366/0x390 [ 268.465234][ T51] device_add+0x3fa/0xc40 [ 268.469573][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 268.474533][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 268.480287][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 268.486540][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 268.492181][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 268.497406][ T51] ? skb_pull_data+0xf0/0x1f0 [ 268.502157][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 268.507761][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 268.513963][ T51] hci_event_packet+0x7b4/0x1280 [ 268.518907][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 268.524549][ T51] ? bis_list+0x290/0x290 [ 268.528902][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 268.534136][ T51] hci_rx_work+0x43a/0xd60 [ 268.538662][ T51] ? process_scheduled_works+0x975/0x1600 [ 268.544417][ T51] process_scheduled_works+0xa60/0x1600 [ 268.550197][ T51] ? worker_attach_to_pool+0x370/0x370 [ 268.555682][ T51] ? assign_work+0x3cc/0x5d0 [ 268.560297][ T51] worker_thread+0xa5e/0xfe0 [ 268.564930][ T51] kthread+0x2fa/0x390 [ 268.569025][ T51] ? pr_cont_work+0x550/0x550 [ 268.573750][ T51] ? kthread_blkcg+0xd0/0xd0 [ 268.578376][ T51] ret_from_fork+0x48/0x80 [ 268.582824][ T51] ? kthread_blkcg+0xd0/0xd0 [ 268.587568][ T51] ret_from_fork_asm+0x11/0x20 [ 268.592355][ T51] [ 268.600279][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 268.614960][ T51] Bluetooth: hci1: failed to register connection device [ 269.137711][ T7442] chnl_net:caif_netlink_parms(): no params data found [ 270.138411][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 270.144536][ T5786] Bluetooth: hci4: command tx timeout [ 270.404810][ T7442] bridge0: port 1(bridge_slave_0) entered blocking state [ 270.421101][ T7442] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.630497][ T5776] syz-executor (5776) used greatest stack depth: 20776 bytes left [ 270.639490][ T7442] bridge_slave_0: entered allmulticast mode [ 270.674412][ T7442] bridge_slave_0: entered promiscuous mode [ 270.704365][ T7442] bridge0: port 2(bridge_slave_1) entered blocking state [ 270.711595][ T7442] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.718930][ T7442] bridge_slave_1: entered allmulticast mode [ 270.726382][ T7442] bridge_slave_1: entered promiscuous mode [ 270.824033][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 271.430076][ T1322] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.458423][ T7475] netlink: 'syz.1.313': attribute type 12 has an invalid length. [ 271.476187][ T7442] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 271.498118][ T7475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.313'. [ 271.512943][ T7442] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 271.651365][ T7442] team0: Port device team_slave_0 added [ 271.679219][ T1322] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.878970][ T7442] team0: Port device team_slave_1 added [ 272.398473][ T51] Bluetooth: hci4: command tx timeout [ 272.440804][ T1322] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.480581][ T7442] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 272.487592][ T7442] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 272.529817][ T7442] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 272.546456][ T7442] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 272.553466][ T7442] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 272.604913][ T7442] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 272.702660][ T7490] netlink: 24 bytes leftover after parsing attributes in process `syz.3.315'. [ 273.690001][ T1322] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.710148][ T7488] netlink: 20 bytes leftover after parsing attributes in process `syz.2.323'. [ 274.427691][ T7488] team0 (unregistering): Port device team_slave_0 removed [ 274.449711][ T7498] syz.1.316: attempt to access beyond end of device [ 274.449711][ T7498] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 274.478029][ T7488] team0 (unregistering): Port device team_slave_1 removed [ 274.636367][ T51] Bluetooth: hci4: command tx timeout [ 275.013655][ T7442] hsr_slave_0: entered promiscuous mode [ 276.067668][ T7442] hsr_slave_1: entered promiscuous mode [ 276.452335][ T7514] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd1": -EINTR [ 276.484860][ T7442] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 276.493086][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 276.494270][ T7442] Cannot create hsr debugfs directory [ 276.504911][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 276.523813][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 276.533984][ T51] Workqueue: hci3 hci_rx_work [ 276.538732][ T51] Call Trace: [ 276.542092][ T51] [ 276.545050][ T51] dump_stack_lvl+0x18c/0x250 [ 276.549736][ T51] ? show_regs_print_info+0x20/0x20 [ 276.554938][ T51] ? load_image+0x420/0x420 [ 276.559480][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 276.564735][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 276.569860][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 276.574659][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 276.579865][ T51] kobject_add_internal+0x617/0xc90 [ 276.585167][ T51] kobject_add+0x164/0x240 [ 276.589681][ T51] ? kobject_init+0x1d0/0x1d0 [ 276.594367][ T51] ? get_device_parent+0x366/0x390 [ 276.599483][ T51] device_add+0x3fa/0xc40 [ 276.603820][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 276.608969][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 276.614355][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 276.620636][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 276.626385][ T51] ? mutex_unlock+0x10/0x10 [ 276.630946][ T51] ? skb_pull_data+0xf0/0x1f0 [ 276.635653][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 276.641301][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 276.647476][ T51] hci_event_packet+0x7b4/0x1280 [ 276.652429][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 276.657493][ T51] ? lock_chain_count+0x20/0x20 [ 276.662348][ T51] ? bis_list+0x290/0x290 [ 276.666701][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 276.671910][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 276.677151][ T51] hci_rx_work+0x43a/0xd60 [ 276.681600][ T51] ? process_scheduled_works+0x975/0x1600 [ 276.687341][ T51] process_scheduled_works+0xa60/0x1600 [ 276.693024][ T51] ? worker_attach_to_pool+0x370/0x370 [ 276.698784][ T51] ? assign_work+0x3cc/0x5d0 [ 276.703384][ T51] worker_thread+0xa5e/0xfe0 [ 276.708011][ T51] kthread+0x2fa/0x390 [ 276.712110][ T51] ? pr_cont_work+0x550/0x550 [ 276.716834][ T51] ? kthread_blkcg+0xd0/0xd0 [ 276.721432][ T51] ret_from_fork+0x48/0x80 [ 276.725883][ T51] ? kthread_blkcg+0xd0/0xd0 [ 276.730479][ T51] ret_from_fork_asm+0x11/0x20 [ 276.735261][ T51] [ 276.748845][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 276.763625][ T51] Bluetooth: hci3: failed to register connection device [ 276.801744][ T7524] loop3: detected capacity change from 0 to 256 [ 276.889659][ T5786] Bluetooth: hci4: command tx timeout [ 276.911584][ T7524] FAT-fs (loop3): Unrecognized mount option "shortnameepage=862" or missing value [ 278.013003][ T7533] 9pnet_fd: Insufficient options for proto=fd [ 279.046703][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 280.779503][ T7442] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 280.875682][ T7442] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 281.864543][ T7442] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 281.978555][ T7561] syz.3.328: attempt to access beyond end of device [ 281.978555][ T7561] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 282.557751][ T7442] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 282.664481][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 282.677354][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 282.684956][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 282.695565][ T5786] Workqueue: hci3 hci_rx_work [ 282.700461][ T5786] Call Trace: [ 282.703770][ T5786] [ 282.706727][ T5786] dump_stack_lvl+0x18c/0x250 [ 282.711425][ T5786] ? show_regs_print_info+0x20/0x20 [ 282.719498][ T5786] ? load_image+0x420/0x420 [ 282.724133][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 282.729283][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 282.734345][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 282.739051][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 282.744287][ T5786] kobject_add_internal+0x617/0xc90 [ 282.749509][ T5786] kobject_add+0x164/0x240 [ 282.754121][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 282.759507][ T5786] ? kobject_init+0x1d0/0x1d0 [ 282.764215][ T5786] ? get_device_parent+0x366/0x390 [ 282.769359][ T5786] device_add+0x3fa/0xc40 [ 282.773700][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 282.778681][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 282.784007][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 282.790507][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 282.796177][ T5786] ? mutex_unlock+0x10/0x10 [ 282.800824][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 282.805606][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 282.811198][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 282.817324][ T5786] hci_event_packet+0x7b4/0x1280 [ 282.822378][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 282.828066][ T5786] ? bis_list+0x290/0x290 [ 282.832490][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 282.837753][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 282.843083][ T5786] hci_rx_work+0x43a/0xd60 [ 282.847536][ T5786] ? process_scheduled_works+0x975/0x1600 [ 282.853300][ T5786] process_scheduled_works+0xa60/0x1600 [ 282.858931][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 282.864528][ T5786] ? assign_work+0x3cc/0x5d0 [ 282.869154][ T5786] worker_thread+0xa5e/0xfe0 [ 282.873785][ T5786] kthread+0x2fa/0x390 [ 282.877865][ T5786] ? pr_cont_work+0x550/0x550 [ 282.882695][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 282.887328][ T5786] ret_from_fork+0x48/0x80 [ 282.891769][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 282.896385][ T5786] ret_from_fork_asm+0x11/0x20 [ 282.901205][ T5786] [ 282.916282][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 282.985380][ T5786] Bluetooth: hci3: failed to register connection device [ 283.098233][ T7580] No such timeout policy "syz1" [ 284.547618][ T7442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 284.711028][ T7597] netlink: 24 bytes leftover after parsing attributes in process `syz.1.327'. [ 285.213174][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 285.719325][ T7442] 8021q: adding VLAN 0 to HW filter on device team0 [ 285.805006][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.812194][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 285.894701][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.901982][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.633220][ T7605] netlink: 20 bytes leftover after parsing attributes in process `syz.3.335'. [ 287.596363][ T7605] team0 (unregistering): Port device team_slave_0 removed [ 287.949987][ T7605] team0 (unregistering): Port device team_slave_1 removed [ 290.540714][ T1322] hsr_slave_0: left promiscuous mode [ 290.605504][ T1322] hsr_slave_1: left promiscuous mode [ 290.712722][ T1322] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 290.797757][ T1322] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 290.986427][ T1322] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 291.083913][ T1322] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 291.501091][ T7639] mmap: syz.1.340 (7639) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 291.580444][ T1322] bridge_slave_1: left allmulticast mode [ 291.586682][ T1322] bridge_slave_1: left promiscuous mode [ 291.594607][ T1322] bridge0: port 2(bridge_slave_1) entered disabled state [ 291.850940][ T1322] bridge_slave_0: left allmulticast mode [ 291.858584][ T1322] bridge_slave_0: left promiscuous mode [ 291.887611][ T1322] bridge0: port 1(bridge_slave_0) entered disabled state [ 291.919511][ T7635] syz.2.339: attempt to access beyond end of device [ 291.919511][ T7635] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 291.951387][ T1322] veth1_macvtap: left promiscuous mode [ 292.017033][ T1322] veth0_macvtap: left promiscuous mode [ 292.023688][ T1322] veth1_vlan: left promiscuous mode [ 292.029556][ T1322] veth0_vlan: left promiscuous mode [ 292.417764][ T7657] ALSA: mixer_oss: invalid OSS volume '' [ 292.729093][ T1322] bond1 (unregistering): (slave geneve2): Releasing active interface [ 293.249735][ T1322] bond1 (unregistering): Released all slaves [ 293.820886][ T1322] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 293.866016][ T1322] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 294.192212][ T1322] bond0 (unregistering): Released all slaves [ 294.305951][ T7649] netlink: 'syz.3.342': attribute type 11 has an invalid length. [ 294.322118][ T7649] netlink: 44 bytes leftover after parsing attributes in process `syz.3.342'. [ 294.407836][ T7654] netlink: 8 bytes leftover after parsing attributes in process `syz.2.343'. [ 294.433468][ T7655] ip6erspan0: entered allmulticast mode [ 294.755035][ T7663] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.955487][ T7672] No such timeout policy "syz1" [ 296.816772][ T7685] damon-dbgfs: DAMON debugfs interface is deprecated, so users should move to DAMON_SYSFS. If you cannot, please report your usecase to damon@lists.linux.dev and linux-mm@kvack.org. [ 298.058130][ T7442] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.087686][ T7694] syz.1.350: attempt to access beyond end of device [ 298.087686][ T7694] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 298.231169][ T7710] loop3: detected capacity change from 0 to 2048 [ 298.362747][ T7710] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 298.437137][ T1322] IPVS: stop unused estimator thread 0... [ 298.521153][ T28] audit: type=1800 audit(1786178178.427:14): pid=7710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.352" name="bus" dev="loop3" ino=1367 res=0 errno=0 [ 299.175302][ T7719] loop2: detected capacity change from 0 to 8 [ 299.224810][ T7719] SQUASHFS error: lzo decompression failed, data probably corrupt [ 299.233126][ T7719] SQUASHFS error: Failed to read block 0x91: -5 [ 299.239449][ T7719] SQUASHFS error: Unable to read metadata cache entry [8f] [ 299.246666][ T7719] SQUASHFS error: Unable to read inode 0x11f [ 300.594756][ T5764] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 300.802588][ T7733] loop2: detected capacity change from 0 to 512 [ 300.810923][ T7733] EXT4-fs: Ignoring removed nomblk_io_submit option [ 300.817704][ T7733] ext4: Unknown parameter 'fscontext' [ 300.909613][ T7736] syz.1.353: attempt to access beyond end of device [ 300.909613][ T7736] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 301.338260][ T51] Bluetooth: hci3: unexpected event for opcode 0x2027 [ 303.315659][ T7442] veth0_vlan: entered promiscuous mode [ 303.325529][ T7757] No such timeout policy "syz1" [ 303.404099][ T7758] syz.2.358 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 303.420021][ T7758] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 304.318323][ T7442] veth1_vlan: entered promiscuous mode [ 304.394398][ T7442] veth0_macvtap: entered promiscuous mode [ 304.409982][ T7442] veth1_macvtap: entered promiscuous mode [ 305.325349][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 305.376344][ T7767] syz.2.360: attempt to access beyond end of device [ 305.376344][ T7767] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 305.389850][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 305.473425][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 305.527333][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 305.547324][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 305.558335][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 305.754850][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 305.766279][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 305.776409][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 305.787050][ T51] Workqueue: hci1 hci_rx_work [ 305.792320][ T51] Call Trace: [ 305.795624][ T51] [ 305.798577][ T51] dump_stack_lvl+0x18c/0x250 [ 305.803306][ T51] ? show_regs_print_info+0x20/0x20 [ 305.808721][ T51] ? load_image+0x420/0x420 [ 305.813555][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 305.818797][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 305.824465][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 305.829279][ T51] ? kobject_add_internal+0x602/0xc90 [ 305.834697][ T51] kobject_add_internal+0x617/0xc90 [ 305.839943][ T51] kobject_add+0x164/0x240 [ 305.844403][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 305.849980][ T51] ? kobject_init+0x1d0/0x1d0 [ 305.854792][ T51] ? get_device_parent+0x366/0x390 [ 305.860023][ T51] device_add+0x3fa/0xc40 [ 305.864406][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 305.869382][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 305.874737][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 305.881101][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 305.886859][ T51] ? mutex_unlock+0x10/0x10 [ 305.891677][ T51] ? skb_pull_data+0xf0/0x1f0 [ 305.896756][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 305.902389][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 305.908483][ T51] hci_event_packet+0x7b4/0x1280 [ 305.913459][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 305.919289][ T51] ? lock_chain_count+0x20/0x20 [ 305.924165][ T51] ? bis_list+0x290/0x290 [ 305.928538][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 305.934118][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 305.939349][ T51] hci_rx_work+0x43a/0xd60 [ 305.943803][ T51] ? process_scheduled_works+0x975/0x1600 [ 305.949668][ T51] process_scheduled_works+0xa60/0x1600 [ 305.955357][ T51] ? worker_attach_to_pool+0x370/0x370 [ 305.961035][ T51] ? assign_work+0x3cc/0x5d0 [ 305.965653][ T51] worker_thread+0xa5e/0xfe0 [ 305.970296][ T51] kthread+0x2fa/0x390 [ 305.974379][ T51] ? pr_cont_work+0x550/0x550 [ 305.979086][ T51] ? kthread_blkcg+0xd0/0xd0 [ 305.983699][ T51] ret_from_fork+0x48/0x80 [ 305.988247][ T51] ? kthread_blkcg+0xd0/0xd0 [ 305.992882][ T51] ret_from_fork_asm+0x11/0x20 [ 305.997698][ T51] [ 306.105847][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 306.260401][ T51] Bluetooth: hci1: failed to register connection device [ 306.586517][ T7442] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 306.782014][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 306.834496][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 306.855739][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 306.870649][ T7793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.364'. [ 306.899997][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 308.519192][ T7442] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 308.535716][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 309.487541][ T7801] loop3: detected capacity change from 0 to 32768 [ 309.497952][ T7442] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 309.525119][ T7442] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 309.587041][ T7796] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 309.595906][ T7796] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 309.602340][ T7442] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.614272][ T7796] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 309.620939][ T7442] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.653946][ T7442] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.671825][ T7442] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.708029][ T7801] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 309.892732][ T7801] XFS (loop3): Ending clean mount [ 309.930570][ T7801] XFS (loop3): Quotacheck needed: Please wait. [ 310.005660][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.084395][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.378641][ T7801] XFS (loop3): Quotacheck: Done. [ 311.042993][ T28] audit: type=1800 audit(1786178189.712:15): pid=7829 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.365" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop3" ino=4429 res=0 errno=0 [ 311.082999][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.092671][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.538550][ T7820] syz.1.366: attempt to access beyond end of device [ 311.538550][ T7820] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 311.680822][ T5774] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 311.990621][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 311.997146][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.007007][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.022283][ T7842] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 312.041026][ T7842] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 312.089427][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.099195][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.107887][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.115580][ T7842] wlan0 speed is unknown, defaulting to 1000 [ 312.292438][ T7842] xt_TPROXY: Can be used only with -p tcp or -p udp [ 312.603276][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 312.654237][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 312.661948][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 312.672122][ T5786] Workqueue: hci3 hci_rx_work [ 312.676850][ T5786] Call Trace: [ 312.680154][ T5786] [ 312.683105][ T5786] dump_stack_lvl+0x18c/0x250 [ 312.687907][ T5786] ? show_regs_print_info+0x20/0x20 [ 312.693138][ T5786] ? load_image+0x420/0x420 [ 312.697784][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 312.702923][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 312.708117][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 312.712908][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 312.718124][ T5786] kobject_add_internal+0x617/0xc90 [ 312.723338][ T5786] kobject_add+0x164/0x240 [ 312.727866][ T5786] ? kobject_init+0x1d0/0x1d0 [ 312.732578][ T5786] ? get_device_parent+0x366/0x390 [ 312.737704][ T5786] device_add+0x3fa/0xc40 [ 312.742044][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 312.747005][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 312.752331][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 312.758688][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 312.764382][ T5786] ? mutex_unlock+0x10/0x10 [ 312.768946][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 312.773675][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 312.779298][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 312.785418][ T5786] hci_event_packet+0x7b4/0x1280 [ 312.790379][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 312.795578][ T5786] ? lock_chain_count+0x20/0x20 [ 312.800430][ T5786] ? bis_list+0x290/0x290 [ 312.804793][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 312.810101][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 312.815310][ T5786] hci_rx_work+0x43a/0xd60 [ 312.819929][ T5786] ? process_scheduled_works+0x975/0x1600 [ 312.826229][ T5786] process_scheduled_works+0xa60/0x1600 [ 312.831921][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 312.837411][ T5786] ? assign_work+0x3cc/0x5d0 [ 312.842025][ T5786] worker_thread+0xa5e/0xfe0 [ 312.846645][ T5786] kthread+0x2fa/0x390 [ 312.850713][ T5786] ? pr_cont_work+0x550/0x550 [ 312.855401][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 312.859998][ T5786] ret_from_fork+0x48/0x80 [ 312.864420][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 312.869028][ T5786] ret_from_fork_asm+0x11/0x20 [ 312.873863][ T5786] [ 312.920761][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 312.936260][ T5786] Bluetooth: hci3: failed to register connection device [ 313.205755][ T7848] netlink: 8 bytes leftover after parsing attributes in process `syz.4.306'. [ 313.673648][ T7852] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 313.682254][ T7852] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 313.691190][ T7852] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 315.147564][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 315.509754][ T28] audit: type=1107 audit(1786178194.113:16): pid=7866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='f‹lPH]‰€x»ôµî®@' [ 315.706374][ T7877] syz.1.371: attempt to access beyond end of device [ 315.706374][ T7877] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 316.070218][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 316.091039][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 316.098910][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 316.109259][ T5786] Workqueue: hci3 hci_rx_work [ 316.113991][ T5786] Call Trace: [ 316.117337][ T5786] [ 316.120337][ T5786] dump_stack_lvl+0x18c/0x250 [ 316.125400][ T5786] ? show_regs_print_info+0x20/0x20 [ 316.130664][ T5786] ? load_image+0x420/0x420 [ 316.135196][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 316.140354][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 316.145496][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 316.150282][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 316.155785][ T5786] kobject_add_internal+0x617/0xc90 [ 316.161005][ T5786] kobject_add+0x164/0x240 [ 316.165444][ T5786] ? kobject_init+0x1d0/0x1d0 [ 316.170145][ T5786] ? get_device_parent+0x366/0x390 [ 316.175370][ T5786] device_add+0x3fa/0xc40 [ 316.179842][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 316.184827][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 316.190155][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 316.196584][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 316.202251][ T5786] ? mutex_unlock+0x10/0x10 [ 316.206806][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 316.211611][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 316.217257][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 316.223461][ T5786] hci_event_packet+0x7b4/0x1280 [ 316.228423][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 316.234083][ T5786] ? bis_list+0x290/0x290 [ 316.238596][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 316.244069][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 316.249280][ T5786] hci_rx_work+0x43a/0xd60 [ 316.253700][ T5786] ? process_scheduled_works+0x975/0x1600 [ 316.259531][ T5786] process_scheduled_works+0xa60/0x1600 [ 316.265102][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 316.270568][ T5786] ? assign_work+0x3cc/0x5d0 [ 316.275184][ T5786] worker_thread+0xa5e/0xfe0 [ 316.279797][ T5786] kthread+0x2fa/0x390 [ 316.283869][ T5786] ? pr_cont_work+0x550/0x550 [ 316.288947][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 316.293659][ T5786] ret_from_fork+0x48/0x80 [ 316.298276][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 316.303791][ T5786] ret_from_fork_asm+0x11/0x20 [ 316.309391][ T5786] [ 316.537225][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 316.555089][ T5786] Bluetooth: hci3: failed to register connection device [ 317.671296][ T7910] netlink: 20 bytes leftover after parsing attributes in process `syz.4.377'. [ 318.766682][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 319.335727][ T7915] loop4: detected capacity change from 0 to 1024 [ 319.783814][ T7915] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 319.851062][ T6086] Bluetooth: (null): Invalid header checksum [ 319.887093][ T7920] Console: switching to colour VGA+ 80x25 [ 319.915583][ T6086] Bluetooth: (null): Invalid header checksum [ 319.942522][ T7847] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 320.453249][ T7924] 9pnet_fd: Insufficient options for proto=fd [ 321.238652][ T12] Bluetooth: (null): Invalid header checksum [ 321.239903][ T12] Bluetooth: (null): Invalid header checksum [ 321.239973][ T12] Bluetooth: (null): Invalid header checksum [ 321.240034][ T12] Bluetooth: (null): Invalid header checksum [ 321.240096][ T12] Bluetooth: (null): Invalid header checksum [ 321.240180][ T12] Bluetooth: (null): Invalid header checksum [ 321.240341][ T12] Bluetooth: (null): Invalid header checksum [ 321.240413][ T12] Bluetooth: (null): Invalid header checksum [ 321.240486][ T12] Bluetooth: (null): Invalid header checksum [ 321.240551][ T12] Bluetooth: (null): Invalid header checksum [ 321.240627][ T12] Bluetooth: (null): Invalid header checksum [ 321.434974][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 321.435070][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 321.435092][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 321.435105][ T51] Workqueue: hci1 hci_rx_work [ 321.435131][ T51] Call Trace: [ 321.435139][ T51] [ 321.435147][ T51] dump_stack_lvl+0x18c/0x250 [ 321.435174][ T51] ? show_regs_print_info+0x20/0x20 [ 321.435196][ T51] ? load_image+0x420/0x420 [ 321.435235][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 321.435256][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 321.435280][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 321.435304][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 321.435334][ T51] kobject_add_internal+0x617/0xc90 [ 321.435367][ T51] kobject_add+0x164/0x240 [ 321.435391][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 321.435417][ T51] ? kobject_init+0x1d0/0x1d0 [ 321.435446][ T51] ? get_device_parent+0x366/0x390 [ 321.435474][ T51] device_add+0x3fa/0xc40 [ 321.435499][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 321.435526][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 321.435555][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 321.435581][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 321.435608][ T51] ? mutex_unlock+0x10/0x10 [ 321.435630][ T51] ? skb_pull_data+0xf0/0x1f0 [ 321.435657][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 321.435685][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 321.435710][ T51] hci_event_packet+0x7b4/0x1280 [ 321.435739][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 321.435765][ T51] ? bis_list+0x290/0x290 [ 321.435792][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 321.435828][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 321.435854][ T51] hci_rx_work+0x43a/0xd60 [ 321.435885][ T51] ? process_scheduled_works+0x975/0x1600 [ 321.435918][ T51] process_scheduled_works+0xa60/0x1600 [ 321.435972][ T51] ? worker_attach_to_pool+0x370/0x370 [ 321.436004][ T51] ? assign_work+0x3cc/0x5d0 [ 321.436034][ T51] worker_thread+0xa5e/0xfe0 [ 321.436086][ T51] kthread+0x2fa/0x390 [ 321.436125][ T51] ? pr_cont_work+0x550/0x550 [ 321.436150][ T51] ? kthread_blkcg+0xd0/0xd0 [ 321.436170][ T51] ret_from_fork+0x48/0x80 [ 321.436194][ T51] ? kthread_blkcg+0xd0/0xd0 [ 321.436225][ T51] ret_from_fork_asm+0x11/0x20 [ 321.436270][ T51] [ 321.436509][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 321.436713][ T51] Bluetooth: hci1: failed to register connection device [ 322.329207][ T5786] Bluetooth: hci4: link tx timeout [ 322.329509][ T5786] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.366165][ T51] Bluetooth: hci4: link tx timeout [ 322.366219][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.367349][ T51] Bluetooth: hci4: link tx timeout [ 322.367366][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.368582][ T51] Bluetooth: hci4: link tx timeout [ 322.368597][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.386481][ T51] Bluetooth: hci4: link tx timeout [ 322.386501][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.400330][ T51] Bluetooth: hci4: link tx timeout [ 322.400351][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.419100][ T51] Bluetooth: hci4: link tx timeout [ 322.419122][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.419497][ T51] Bluetooth: hci4: link tx timeout [ 322.419509][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.419798][ T51] Bluetooth: hci4: link tx timeout [ 322.419810][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.420224][ T51] Bluetooth: hci4: link tx timeout [ 322.420236][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.420416][ T51] Bluetooth: hci4: link tx timeout [ 322.420428][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.420647][ T51] Bluetooth: hci4: link tx timeout [ 322.420659][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.420977][ T51] Bluetooth: hci4: link tx timeout [ 322.420989][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.421118][ T51] Bluetooth: hci4: link tx timeout [ 322.421129][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.421412][ T51] Bluetooth: hci4: link tx timeout [ 322.421464][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.421745][ T51] Bluetooth: hci4: link tx timeout [ 322.421757][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.421878][ T51] Bluetooth: hci4: link tx timeout [ 322.421889][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.422085][ T51] Bluetooth: hci4: link tx timeout [ 322.422097][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.422224][ T51] Bluetooth: hci4: link tx timeout [ 322.422235][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.422362][ T51] Bluetooth: hci4: link tx timeout [ 322.422372][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.422626][ T51] Bluetooth: hci4: link tx timeout [ 322.422637][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.422803][ T51] Bluetooth: hci4: link tx timeout [ 322.422814][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.423013][ T51] Bluetooth: hci4: link tx timeout [ 322.423024][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.468855][ T51] Bluetooth: hci4: link tx timeout [ 322.468875][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.495848][ T51] Bluetooth: hci4: link tx timeout [ 322.495867][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.506036][ T51] Bluetooth: hci4: link tx timeout [ 322.506056][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.515753][ T51] Bluetooth: hci4: link tx timeout [ 322.515769][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.516267][ T51] Bluetooth: hci4: link tx timeout [ 322.516281][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.549139][ T51] Bluetooth: hci4: link tx timeout [ 322.549160][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.549305][ T51] Bluetooth: hci4: link tx timeout [ 322.549317][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.549613][ T51] Bluetooth: hci4: link tx timeout [ 322.549625][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.549926][ T51] Bluetooth: hci4: link tx timeout [ 322.549938][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 322.651287][ T7947] syz.1.383: attempt to access beyond end of device [ 322.651287][ T7947] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 323.491338][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 323.491427][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 323.491447][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.491461][ T51] Workqueue: hci1 hci_rx_work [ 323.491492][ T51] Call Trace: [ 323.491500][ T51] [ 323.491509][ T51] dump_stack_lvl+0x18c/0x250 [ 323.491538][ T51] ? show_regs_print_info+0x20/0x20 [ 323.491566][ T51] ? load_image+0x420/0x420 [ 323.491608][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 323.491630][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 323.491653][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 323.491680][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 323.491709][ T51] kobject_add_internal+0x617/0xc90 [ 323.491736][ T51] kobject_add+0x164/0x240 [ 323.491766][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 323.491796][ T51] ? kobject_init+0x1d0/0x1d0 [ 323.491832][ T51] ? get_device_parent+0x366/0x390 [ 323.491859][ T51] device_add+0x3fa/0xc40 [ 323.491884][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 323.491911][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 323.491943][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 323.491971][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 323.491998][ T51] ? mutex_unlock+0x10/0x10 [ 323.492020][ T51] ? skb_pull_data+0xf0/0x1f0 [ 323.492047][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 323.492074][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 323.492100][ T51] hci_event_packet+0x7b4/0x1280 [ 323.492128][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 323.492158][ T51] ? bis_list+0x290/0x290 [ 323.492182][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 323.492209][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 323.492235][ T51] hci_rx_work+0x43a/0xd60 [ 323.492256][ T51] ? process_scheduled_works+0x975/0x1600 [ 323.492281][ T51] process_scheduled_works+0xa60/0x1600 [ 323.492331][ T51] ? worker_attach_to_pool+0x370/0x370 [ 323.492362][ T51] ? assign_work+0x3cc/0x5d0 [ 323.492392][ T51] worker_thread+0xa5e/0xfe0 [ 323.492450][ T51] kthread+0x2fa/0x390 [ 323.492468][ T51] ? pr_cont_work+0x550/0x550 [ 323.492492][ T51] ? kthread_blkcg+0xd0/0xd0 [ 323.492512][ T51] ret_from_fork+0x48/0x80 [ 323.492533][ T51] ? kthread_blkcg+0xd0/0xd0 [ 323.492553][ T51] ret_from_fork_asm+0x11/0x20 [ 323.492599][ T51] [ 323.500237][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 323.500466][ T51] Bluetooth: hci1: failed to register connection device [ 323.621892][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 324.554301][ T7971] ..@ÿ: renamed from bond_slave_0 (while UP) [ 324.579271][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 324.647142][ T7976] loop1: detected capacity change from 0 to 16 [ 324.652768][ T7976] erofs: Unknown parameter 'pim6reg0' [ 324.870591][ T7927] tty tty1: ldisc open failed (-12), clearing slot 0 [ 325.919693][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 327.729771][ T8007] loop4: detected capacity change from 0 to 64 [ 327.897788][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 327.907833][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 327.915418][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 327.925525][ T5786] Workqueue: hci0 hci_rx_work [ 327.930243][ T5786] Call Trace: [ 327.933550][ T5786] [ 327.936508][ T5786] dump_stack_lvl+0x18c/0x250 [ 327.941222][ T5786] ? show_regs_print_info+0x20/0x20 [ 327.946456][ T5786] ? load_image+0x420/0x420 [ 327.951026][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 327.956266][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 327.961450][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 327.966182][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 327.971585][ T5786] kobject_add_internal+0x617/0xc90 [ 327.976826][ T5786] kobject_add+0x164/0x240 [ 327.981374][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 327.986820][ T5786] ? kobject_init+0x1d0/0x1d0 [ 327.991511][ T5786] ? get_device_parent+0x366/0x390 [ 327.996623][ T5786] device_add+0x3fa/0xc40 [ 328.000959][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 328.006049][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 328.011825][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 328.018263][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 328.023926][ T5786] ? mutex_unlock+0x10/0x10 [ 328.028453][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 328.033236][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 328.038810][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 328.044915][ T5786] hci_event_packet+0x7b4/0x1280 [ 328.049886][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 328.055644][ T5786] ? bis_list+0x290/0x290 [ 328.060039][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 328.065290][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 328.070595][ T5786] hci_rx_work+0x43a/0xd60 [ 328.075034][ T5786] ? process_scheduled_works+0x975/0x1600 [ 328.080951][ T5786] process_scheduled_works+0xa60/0x1600 [ 328.086563][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 328.092153][ T5786] ? assign_work+0x3cc/0x5d0 [ 328.096791][ T5786] worker_thread+0xa5e/0xfe0 [ 328.101435][ T5786] kthread+0x2fa/0x390 [ 328.105513][ T5786] ? pr_cont_work+0x550/0x550 [ 328.110193][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 328.114805][ T5786] ret_from_fork+0x48/0x80 [ 328.119327][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 328.123930][ T5786] ret_from_fork_asm+0x11/0x20 [ 328.128852][ T5786] [ 328.146906][ T5786] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 328.173318][ T5786] Bluetooth: hci0: failed to register connection device [ 328.645315][ T8015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.392'. [ 328.743866][ T8020] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 328.752280][ T8020] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 328.761021][ T8020] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 329.327266][ T8024] pim6reg: entered allmulticast mode [ 330.618482][ T5786] Bluetooth: hci0: command 0x0406 tx timeout [ 333.167317][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 333.176662][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 333.228557][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 333.238620][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 333.246454][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 333.257670][ T5786] Workqueue: hci3 hci_rx_work [ 333.262545][ T5786] Call Trace: [ 333.265940][ T5786] [ 333.268892][ T5786] dump_stack_lvl+0x18c/0x250 [ 333.273730][ T5786] ? show_regs_print_info+0x20/0x20 [ 333.278957][ T5786] ? load_image+0x420/0x420 [ 333.283486][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 333.288606][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 333.294242][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 333.298923][ T5786] ? kobject_add_internal+0x602/0xc90 [ 333.304329][ T5786] kobject_add_internal+0x617/0xc90 [ 333.309631][ T5786] kobject_add+0x164/0x240 [ 333.314054][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 333.319621][ T5786] ? kobject_init+0x1d0/0x1d0 [ 333.324399][ T5786] ? get_device_parent+0x366/0x390 [ 333.329521][ T5786] device_add+0x3fa/0xc40 [ 333.334125][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 333.339275][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 333.344577][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 333.350915][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 333.356644][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 333.361985][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 333.366765][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 333.372319][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 333.378505][ T5786] hci_event_packet+0x7b4/0x1280 [ 333.383561][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 333.389211][ T5786] ? bis_list+0x290/0x290 [ 333.393553][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 333.398674][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 333.403987][ T5786] hci_rx_work+0x43a/0xd60 [ 333.408429][ T5786] ? process_scheduled_works+0x975/0x1600 [ 333.414179][ T5786] process_scheduled_works+0xa60/0x1600 [ 333.419751][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 333.425222][ T5786] ? assign_work+0x3cc/0x5d0 [ 333.429818][ T5786] worker_thread+0xa5e/0xfe0 [ 333.434438][ T5786] kthread+0x2fa/0x390 [ 333.438532][ T5786] ? pr_cont_work+0x550/0x550 [ 333.443539][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 333.448227][ T5786] ret_from_fork+0x48/0x80 [ 333.452664][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 333.457262][ T5786] ret_from_fork_asm+0x11/0x20 [ 333.462175][ T5786] [ 333.467254][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 333.481908][ T5786] Bluetooth: hci3: failed to register connection device [ 334.344992][ T8058] loop1: detected capacity change from 0 to 128 [ 336.355449][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 337.613759][ T8081] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd3": -EINTR [ 339.440352][ T8101] netlink: 8 bytes leftover after parsing attributes in process `syz.3.409'. [ 340.801983][ T8114] loop2: detected capacity change from 0 to 512 [ 340.837565][ T8114] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 340.852002][ T8114] EXT4-fs error (device loop2): ext4_get_journal_inode:5820: comm syz.2.411: inode #1792: comm syz.2.411: iget: illegal inode # [ 340.879953][ T8114] EXT4-fs (loop2): Remounting filesystem read-only [ 340.886818][ T8114] EXT4-fs (loop2): no journal found [ 340.892085][ T8114] EXT4-fs (loop2): can't get journal size [ 340.918627][ T8114] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 340.941551][ T8114] EXT4-fs (loop2): failed to initialize system zone (-22) [ 340.951047][ T8114] EXT4-fs (loop2): mount failed [ 341.448451][ T8101] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 341.738422][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 341.748945][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 341.756526][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 341.766591][ T5786] Workqueue: hci1 hci_rx_work [ 341.771300][ T5786] Call Trace: [ 341.774627][ T5786] [ 341.777580][ T5786] dump_stack_lvl+0x18c/0x250 [ 341.782368][ T5786] ? show_regs_print_info+0x20/0x20 [ 341.787594][ T5786] ? load_image+0x420/0x420 [ 341.792143][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 341.797300][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 341.802697][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 341.807390][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 341.812810][ T5786] kobject_add_internal+0x617/0xc90 [ 341.818132][ T5786] kobject_add+0x164/0x240 [ 341.822577][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 341.827977][ T5786] ? kobject_init+0x1d0/0x1d0 [ 341.832751][ T5786] ? get_device_parent+0x366/0x390 [ 341.837882][ T5786] device_add+0x3fa/0xc40 [ 341.842211][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 341.847153][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 341.852456][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 341.859050][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 341.864721][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 341.869929][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 341.874631][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 341.880317][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 341.886569][ T5786] hci_event_packet+0x7b4/0x1280 [ 341.891538][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 341.896693][ T5786] ? lock_chain_count+0x20/0x20 [ 341.901833][ T5786] ? bis_list+0x290/0x290 [ 341.906379][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 341.911967][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 341.917192][ T5786] hci_rx_work+0x43a/0xd60 [ 341.921739][ T5786] ? process_scheduled_works+0x975/0x1600 [ 341.927476][ T5786] process_scheduled_works+0xa60/0x1600 [ 341.933219][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 341.938709][ T5786] ? assign_work+0x3cc/0x5d0 [ 341.943489][ T5786] worker_thread+0xa5e/0xfe0 [ 341.948094][ T5786] kthread+0x2fa/0x390 [ 341.952177][ T5786] ? pr_cont_work+0x550/0x550 [ 341.956899][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 341.962291][ T5786] ret_from_fork+0x48/0x80 [ 341.966715][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 341.971355][ T5786] ret_from_fork_asm+0x11/0x20 [ 341.976244][ T5786] [ 341.987508][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 342.002534][ T8101] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 342.011497][ T8101] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 342.047082][ T5786] Bluetooth: hci1: failed to register connection device [ 342.463218][ T5764] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 343.628019][ T8129] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd2": -EINTR [ 344.260015][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 345.703702][ T8144] vivid-003: kernel_thread() failed [ 346.540386][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 346.550714][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 346.558500][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 346.568779][ T51] Workqueue: hci1 hci_rx_work [ 346.573478][ T51] Call Trace: [ 346.576768][ T51] [ 346.579998][ T51] dump_stack_lvl+0x18c/0x250 [ 346.585049][ T51] ? show_regs_print_info+0x20/0x20 [ 346.590266][ T51] ? load_image+0x420/0x420 [ 346.595418][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 346.600664][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 346.605985][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 346.610802][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 346.616209][ T51] kobject_add_internal+0x617/0xc90 [ 346.621640][ T51] kobject_add+0x164/0x240 [ 346.626894][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 346.632466][ T51] ? kobject_init+0x1d0/0x1d0 [ 346.637514][ T51] ? get_device_parent+0x366/0x390 [ 346.642643][ T51] device_add+0x3fa/0xc40 [ 346.647086][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 346.652050][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 346.657392][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 346.663781][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 346.669431][ T51] ? mutex_unlock+0x10/0x10 [ 346.673965][ T51] ? skb_pull_data+0xf0/0x1f0 [ 346.678664][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 346.684313][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 346.690438][ T51] hci_event_packet+0x7b4/0x1280 [ 346.695602][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 346.701356][ T51] ? bis_list+0x290/0x290 [ 346.705749][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 346.710892][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 346.716196][ T51] hci_rx_work+0x43a/0xd60 [ 346.720648][ T51] ? process_scheduled_works+0x975/0x1600 [ 346.726413][ T51] process_scheduled_works+0xa60/0x1600 [ 346.732165][ T51] ? worker_attach_to_pool+0x370/0x370 [ 346.737670][ T51] ? assign_work+0x3cc/0x5d0 [ 346.742573][ T51] worker_thread+0xa5e/0xfe0 [ 346.747318][ T51] kthread+0x2fa/0x390 [ 346.751525][ T51] ? pr_cont_work+0x550/0x550 [ 346.756222][ T51] ? kthread_blkcg+0xd0/0xd0 [ 346.760824][ T51] ret_from_fork+0x48/0x80 [ 346.765263][ T51] ? kthread_blkcg+0xd0/0xd0 [ 346.769884][ T51] ret_from_fork_asm+0x11/0x20 [ 346.774668][ T51] [ 346.786543][ T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 346.837081][ T51] Bluetooth: hci1: failed to register connection device [ 348.610267][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 348.620049][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 348.627756][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 348.638036][ T5786] Workqueue: hci3 hci_rx_work [ 348.642776][ T5786] Call Trace: [ 348.646064][ T5786] [ 348.649007][ T5786] dump_stack_lvl+0x18c/0x250 [ 348.653784][ T5786] ? show_regs_print_info+0x20/0x20 [ 348.659008][ T5786] ? load_image+0x420/0x420 [ 348.663559][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 348.669069][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 348.674301][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 348.679361][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 348.684617][ T5786] kobject_add_internal+0x617/0xc90 [ 348.689934][ T5786] kobject_add+0x164/0x240 [ 348.695273][ T5786] ? kobject_init+0x1d0/0x1d0 [ 348.699991][ T5786] ? get_device_parent+0x366/0x390 [ 348.705411][ T5786] device_add+0x3fa/0xc40 [ 348.710065][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 348.716013][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 348.721363][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 348.727621][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 348.733294][ T5786] ? mutex_unlock+0x10/0x10 [ 348.737830][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 348.742516][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 348.748635][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 348.754804][ T5786] hci_event_packet+0x7b4/0x1280 [ 348.759751][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 348.765044][ T5786] ? lock_chain_count+0x20/0x20 [ 348.770123][ T5786] ? bis_list+0x290/0x290 [ 348.774494][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 348.779824][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 348.785328][ T5786] hci_rx_work+0x43a/0xd60 [ 348.789762][ T5786] ? process_scheduled_works+0x975/0x1600 [ 348.795494][ T5786] process_scheduled_works+0xa60/0x1600 [ 348.801343][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 348.806822][ T5786] ? assign_work+0x3cc/0x5d0 [ 348.811441][ T5786] worker_thread+0xa5e/0xfe0 [ 348.816158][ T5786] kthread+0x2fa/0x390 [ 348.820324][ T5786] ? pr_cont_work+0x550/0x550 [ 348.825026][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 348.829614][ T5786] ret_from_fork+0x48/0x80 [ 348.834666][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 348.839294][ T5786] ret_from_fork_asm+0x11/0x20 [ 348.844144][ T5786] [ 348.850096][ T5786] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 348.864718][ T5786] Bluetooth: hci3: failed to register connection device [ 349.106083][ T8179] befs: (nbd3): No write support. Marking filesystem read-only [ 349.130666][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 349.247383][ T8179] syz.3.423: attempt to access beyond end of device [ 349.247383][ T8179] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 350.086101][ T8188] syz.4.425: attempt to access beyond end of device [ 350.086101][ T8188] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 350.172052][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 350.191618][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 350.199466][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 350.210127][ T5786] Workqueue: hci1 hci_rx_work [ 350.214891][ T5786] Call Trace: [ 350.218177][ T5786] [ 350.221143][ T5786] dump_stack_lvl+0x18c/0x250 [ 350.226285][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 350.231963][ T5786] ? show_regs_print_info+0x20/0x20 [ 350.237225][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 350.242907][ T5786] ? dump_stack+0x9/0x20 [ 350.247176][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 350.252309][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 350.257351][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 350.262043][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 350.267273][ T5786] kobject_add_internal+0x617/0xc90 [ 350.272797][ T5786] kobject_add+0x164/0x240 [ 350.277299][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 350.283686][ T5786] ? kobject_init+0x1d0/0x1d0 [ 350.288751][ T5786] ? get_device_parent+0x366/0x390 [ 350.293909][ T5786] device_add+0x3fa/0xc40 [ 350.298264][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 350.303497][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 350.308843][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 350.315312][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 350.320984][ T5786] ? mutex_unlock+0x10/0x10 [ 350.325527][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 350.330241][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 350.335832][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 350.341964][ T5786] hci_event_packet+0x7b4/0x1280 [ 350.346942][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 350.352706][ T5786] ? bis_list+0x290/0x290 [ 350.357094][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 350.362252][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 350.367582][ T5786] hci_rx_work+0x43a/0xd60 [ 350.373700][ T5786] ? process_scheduled_works+0x975/0x1600 [ 350.379538][ T5786] process_scheduled_works+0xa60/0x1600 [ 350.385139][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 350.390645][ T5786] ? assign_work+0x3cc/0x5d0 [ 350.395264][ T5786] worker_thread+0xa5e/0xfe0 [ 350.399910][ T5786] kthread+0x2fa/0x390 [ 350.404199][ T5786] ? pr_cont_work+0x550/0x550 [ 350.408898][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 350.413545][ T5786] ret_from_fork+0x48/0x80 [ 350.418006][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 350.422734][ T5786] ret_from_fork_asm+0x11/0x20 [ 350.427552][ T5786] [ 350.446844][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 350.462309][ T5786] Bluetooth: hci1: failed to register connection device [ 351.106474][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 351.344295][ T8207] loop2: detected capacity change from 0 to 256 [ 351.354071][ T8207] exfat: Deprecated parameter 'utf8' [ 352.186779][ T8207] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe3865569, utbl_chksum : 0xe619d30d) [ 352.671226][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 355.111255][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 355.120942][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 355.128437][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.138704][ T51] Workqueue: hci3 hci_rx_work [ 355.143696][ T51] Call Trace: [ 355.147081][ T51] [ 355.150032][ T51] dump_stack_lvl+0x18c/0x250 [ 355.154783][ T51] ? show_regs_print_info+0x20/0x20 [ 355.160021][ T51] ? load_image+0x420/0x420 [ 355.164584][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 355.169754][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 355.175511][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 355.180194][ T51] ? kobject_add_internal+0x602/0xc90 [ 355.185650][ T51] kobject_add_internal+0x617/0xc90 [ 355.190864][ T51] kobject_add+0x164/0x240 [ 355.195322][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 355.201007][ T51] ? kobject_init+0x1d0/0x1d0 [ 355.205690][ T51] ? get_device_parent+0x366/0x390 [ 355.210853][ T51] device_add+0x3fa/0xc40 [ 355.215191][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 355.220302][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 355.225635][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 355.231876][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 355.237589][ T51] ? mutex_unlock+0x10/0x10 [ 355.242099][ T51] ? skb_pull_data+0xf0/0x1f0 [ 355.246940][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 355.252500][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 355.258593][ T51] hci_event_packet+0x7b4/0x1280 [ 355.263567][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 355.269407][ T51] ? bis_list+0x290/0x290 [ 355.273762][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 355.278937][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 355.284257][ T51] hci_rx_work+0x43a/0xd60 [ 355.288795][ T51] ? process_scheduled_works+0x975/0x1600 [ 355.294591][ T51] process_scheduled_works+0xa60/0x1600 [ 355.300192][ T51] ? worker_attach_to_pool+0x370/0x370 [ 355.305692][ T51] ? assign_work+0x3cc/0x5d0 [ 355.310299][ T51] worker_thread+0xa5e/0xfe0 [ 355.314963][ T51] kthread+0x2fa/0x390 [ 355.319054][ T51] ? pr_cont_work+0x550/0x550 [ 355.323792][ T51] ? kthread_blkcg+0xd0/0xd0 [ 355.328423][ T51] ret_from_fork+0x48/0x80 [ 355.332985][ T51] ? kthread_blkcg+0xd0/0xd0 [ 355.337583][ T51] ret_from_fork_asm+0x11/0x20 [ 355.342359][ T51] [ 355.360104][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 355.375285][ T51] Bluetooth: hci3: failed to register connection device [ 355.735659][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 355.745720][ T5786] CPU: 1 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 355.753300][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.763564][ T5786] Workqueue: hci1 hci_rx_work [ 355.770021][ T5786] Call Trace: [ 355.773322][ T5786] [ 355.776365][ T5786] dump_stack_lvl+0x18c/0x250 [ 355.781083][ T5786] ? show_regs_print_info+0x20/0x20 [ 355.786498][ T5786] ? load_image+0x420/0x420 [ 355.791325][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 355.796580][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 355.801679][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 355.806398][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 355.811811][ T5786] kobject_add_internal+0x617/0xc90 [ 355.817156][ T5786] kobject_add+0x164/0x240 [ 355.821610][ T5786] ? kobject_init+0x1d0/0x1d0 [ 355.826356][ T5786] ? get_device_parent+0x366/0x390 [ 355.831590][ T5786] device_add+0x3fa/0xc40 [ 355.836019][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 355.841201][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 355.846861][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 355.853232][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 355.859090][ T5786] ? mutex_unlock+0x10/0x10 [ 355.863619][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 355.868413][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 355.874145][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 355.880231][ T5786] hci_event_packet+0x7b4/0x1280 [ 355.885190][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 355.890867][ T5786] ? bis_list+0x290/0x290 [ 355.895497][ T5786] ? kcov_remote_start+0x1b5/0x7e0 [ 355.901027][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 355.906360][ T5786] hci_rx_work+0x43a/0xd60 [ 355.911658][ T5786] ? process_scheduled_works+0x975/0x1600 [ 355.917451][ T5786] process_scheduled_works+0xa60/0x1600 [ 355.923146][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 355.928681][ T5786] ? assign_work+0x3cc/0x5d0 [ 355.933317][ T5786] worker_thread+0xa5e/0xfe0 [ 355.937948][ T5786] kthread+0x2fa/0x390 [ 355.942113][ T5786] ? pr_cont_work+0x550/0x550 [ 355.946991][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 355.951601][ T5786] ret_from_fork+0x48/0x80 [ 355.956038][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 355.961354][ T5786] ret_from_fork_asm+0x11/0x20 [ 355.966335][ T5786] [ 355.983567][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 355.998586][ T5786] Bluetooth: hci1: failed to register connection device [ 357.648156][ T8262] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5775] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[8262] [ 357.991898][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 358.313593][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 358.492833][ T8263] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 358.501315][ T8263] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 358.510164][ T8263] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 359.365286][ T8264] syz.1.438: attempt to access beyond end of device [ 359.365286][ T8264] nbd1: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 361.596542][ T8281] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd2": -EINTR [ 361.978752][ T8297] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 362.614523][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 362.624388][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 362.631785][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 362.641947][ T51] Workqueue: hci3 hci_rx_work [ 362.646640][ T51] Call Trace: [ 362.649920][ T51] [ 362.652889][ T51] dump_stack_lvl+0x18c/0x250 [ 362.657584][ T51] ? show_regs_print_info+0x20/0x20 [ 362.662873][ T51] ? load_image+0x420/0x420 [ 362.667399][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 362.672520][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 362.677553][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 362.682244][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 362.687475][ T51] kobject_add_internal+0x617/0xc90 [ 362.692696][ T51] kobject_add+0x164/0x240 [ 362.697266][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 362.702658][ T51] ? kobject_init+0x1d0/0x1d0 [ 362.707626][ T51] ? get_device_parent+0x366/0x390 [ 362.712742][ T51] device_add+0x3fa/0xc40 [ 362.717075][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 362.722032][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 362.727334][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 362.733591][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 362.739354][ T51] ? mutex_unlock+0x10/0x10 [ 362.743877][ T51] ? skb_pull_data+0xf0/0x1f0 [ 362.748571][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 362.754134][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 362.760249][ T51] hci_event_packet+0x7b4/0x1280 [ 362.765203][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 362.770849][ T51] ? bis_list+0x290/0x290 [ 362.775630][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 362.781270][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 362.786564][ T51] hci_rx_work+0x43a/0xd60 [ 362.791034][ T51] ? process_scheduled_works+0x975/0x1600 [ 362.796768][ T51] process_scheduled_works+0xa60/0x1600 [ 362.802376][ T51] ? worker_attach_to_pool+0x370/0x370 [ 362.807874][ T51] ? assign_work+0x3cc/0x5d0 [ 362.812563][ T51] worker_thread+0xa5e/0xfe0 [ 362.817265][ T51] kthread+0x2fa/0x390 [ 362.821335][ T51] ? pr_cont_work+0x550/0x550 [ 362.826028][ T51] ? kthread_blkcg+0xd0/0xd0 [ 362.830627][ T51] ret_from_fork+0x48/0x80 [ 362.835098][ T51] ? kthread_blkcg+0xd0/0xd0 [ 362.839702][ T51] ret_from_fork_asm+0x11/0x20 [ 362.844483][ T51] [ 362.871268][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 362.886783][ T51] Bluetooth: hci3: failed to register connection device [ 363.739647][ T8313] ieee802154 phy0 wpan0: encryption failed: -22 [ 364.789815][ T8313] tipc: Started in network mode [ 364.874666][ T8313] tipc: Node identity ac14140f, cluster identity 4711 [ 364.987664][ T8313] tipc: New replicast peer: 255.255.255.255 [ 364.996873][ T8313] tipc: Enabled bearer , priority 10 [ 365.066711][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 366.465990][ T9] tipc: Node number set to 2886997007 [ 366.683307][ T8342] syz.4.453: attempt to access beyond end of device [ 366.683307][ T8342] nbd4: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 367.503794][ T8356] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd2": -EINTR [ 369.704541][ T8375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.444'. [ 371.048225][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 372.379662][ T8391] loop1: detected capacity change from 0 to 32768 [ 373.432351][ T5912] read_mapping_page failed! [ 373.508611][ T5912] ERROR: (device loop1): txCommit: [ 373.508611][ T5912] [ 373.679832][ T5912] jfs_write_inode: jfs_commit_inode failed! [ 375.558182][ T8411] loop2: detected capacity change from 0 to 512 [ 375.580244][ T8411] EXT4-fs: Ignoring removed nomblk_io_submit option [ 375.587250][ T8411] ext4: Unknown parameter 'fscontext' [ 375.965054][ T8417] loop2: detected capacity change from 0 to 2048 [ 376.727244][ T51] Bluetooth: hci4: link tx timeout [ 376.738689][ T51] Bluetooth: hci4: link tx timeout [ 376.756897][ T51] Bluetooth: hci4: link tx timeout [ 376.776364][ T51] Bluetooth: hci4: link tx timeout [ 376.917281][ T51] Bluetooth: hci3: unexpected event for opcode 0x2027 [ 377.291767][ T8418] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nbd1": -EINTR [ 378.009917][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 378.046990][ T51] CPU: 0 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 378.054435][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 378.064526][ T51] Workqueue: hci3 hci_rx_work [ 378.069243][ T51] Call Trace: [ 378.072548][ T51] [ 378.075513][ T51] dump_stack_lvl+0x18c/0x250 [ 378.080235][ T51] ? show_regs_print_info+0x20/0x20 [ 378.085464][ T51] ? load_image+0x420/0x420 [ 378.090030][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 378.095181][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 378.100237][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 378.104949][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 378.110193][ T51] kobject_add_internal+0x617/0xc90 [ 378.115443][ T51] kobject_add+0x164/0x240 [ 378.119902][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 378.125314][ T51] ? kobject_init+0x1d0/0x1d0 [ 378.130143][ T51] ? get_device_parent+0x366/0x390 [ 378.135392][ T51] device_add+0x3fa/0xc40 [ 378.139768][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 378.144751][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 378.150102][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 378.156418][ T51] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 378.162204][ T51] ? mutex_unlock+0x10/0x10 [ 378.166781][ T51] ? skb_pull_data+0xf0/0x1f0 [ 378.171595][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 378.177374][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 378.183580][ T51] hci_event_packet+0x7b4/0x1280 [ 378.188910][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 378.195197][ T51] ? lock_chain_count+0x20/0x20 [ 378.200378][ T51] ? bis_list+0x290/0x290 [ 378.204861][ T51] ? lockdep_hardirqs_on+0x98/0x150 [ 378.210278][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 378.215614][ T51] hci_rx_work+0x43a/0xd60 [ 378.220174][ T51] ? process_scheduled_works+0x975/0x1600 [ 378.226129][ T51] process_scheduled_works+0xa60/0x1600 [ 378.232206][ T51] ? worker_attach_to_pool+0x370/0x370 [ 378.237912][ T51] ? assign_work+0x3cc/0x5d0 [ 378.243341][ T51] worker_thread+0xa5e/0xfe0 [ 378.248271][ T51] kthread+0x2fa/0x390 [ 378.253189][ T51] ? pr_cont_work+0x550/0x550 [ 378.257906][ T51] ? kthread_blkcg+0xd0/0xd0 [ 378.262571][ T51] ret_from_fork+0x48/0x80 [ 378.267039][ T51] ? kthread_blkcg+0xd0/0xd0 [ 378.271676][ T51] ret_from_fork_asm+0x11/0x20 [ 378.276508][ T51] [ 378.279723][ C0] vkms_vblank_simulate: vblank timer overrun [ 378.404254][ T51] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 378.442868][ T51] Bluetooth: hci3: failed to register connection device [ 380.315780][ T8436] hub 8-0:1.0: USB hub found [ 380.323260][ T8436] hub 8-0:1.0: 1 port detected [ 380.331215][ T8442] sock: sock_timestamping_bind_phc: sock not bind to device [ 380.366400][ T8442] zram0: detected capacity change from 0 to 8 [ 380.672091][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 382.534834][ T8465] IPVS: set_ctl: invalid protocol: 58 224.0.0.2:0 [ 384.943579][ T5786] Bluetooth: hci4: adv larger than maximum supported [ 384.944372][ T5786] Bluetooth: hci4: Malformed LE Event: 0x0d [ 386.502728][ T5786] Bluetooth: hci4: link tx timeout [ 386.507932][ T5786] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 386.516266][ T5786] Bluetooth: hci4: link tx timeout [ 386.545423][ T8493] syz.2.477: attempt to access beyond end of device [ 386.545423][ T8493] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 388.366384][ T8523] CIFS: Attempting to mount //127.0.0.1/share [ 388.746049][ T5786] Bluetooth: hci4: command 0x0406 tx timeout [ 390.339485][ T8535] Mass Storage Function, version: 2009/09/11 [ 390.346345][ T8535] LUN: removable file: (no medium) [ 390.388538][ T8535] LUN: removable file: (no medium) [ 392.215360][ T8523] CIFS: VFS: Error connecting to socket. Aborting operation. [ 392.247018][ T8523] CIFS: VFS: cifs_mount failed w/return code = -4 [ 392.259998][ T8541] loop1: detected capacity change from 0 to 512 [ 392.392286][ T8541] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 392.405190][ T8541] ext4 filesystem being mounted at /118/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 392.776968][ T8552] bridge0: port 2(syz_tun) entered blocking state [ 392.784256][ T8552] bridge0: port 2(syz_tun) entered disabled state [ 392.795635][ T8552] syz_tun: entered allmulticast mode [ 392.810922][ T8552] syz_tun: entered promiscuous mode [ 392.819309][ T8552] bridge0: port 2(syz_tun) entered blocking state [ 392.827682][ T8552] bridge0: port 2(syz_tun) entered forwarding state [ 394.817206][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 396.411767][ T8581] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd3": -EINTR [ 396.431025][ T8576] workqueue: Failed to create a rescuer kthread for wq "xfs-conv/nbd1": -EINTR [ 396.947130][ T8592] loop1: detected capacity change from 0 to 512 [ 396.980586][ T8595] loop3: detected capacity change from 0 to 4096 [ 397.006983][ T8595] ntfs: (device loop3): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel. [ 397.045164][ T8595] ntfs: (device loop3): read_ntfs_boot_sector(): Hot-fix: Recovering invalid primary boot sector from backup copy. [ 397.276449][ T8597] syz.2.494: attempt to access beyond end of device [ 397.276449][ T8597] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 397.571276][ T8595] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 397.591116][ T8595] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 397.662882][ T8592] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 1 overlaps superblock [ 397.717796][ T8595] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 397.879495][ T8592] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 1 overlaps superblock [ 397.903847][ T8595] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x0, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 398.198782][ T8592] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 398.209617][ T8595] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 398.218092][ T5786] Bluetooth: hci4: command 0x0406 tx timeout [ 398.219415][ T8592] [EXT4 FS bs=4096, gc=2, bpg=35, ipg=32, mo=e040e01c, mo2=0000] [ 398.227013][ T8595] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x0 because its location on disk could not be determined even after retrying (error code -5). [ 398.280642][ T8595] ntfs: (device loop3): ntfs_mapping_pairs_decompress(): Corrupt attribute. [ 398.289873][ T8595] ntfs: (device loop3): ntfs_read_block(): Failed to read from inode 0xa, attribute type 0x80, vcn 0x1, offset 0x200 because its location on disk could not be determined even after retrying (error code -5). [ 398.315167][ T8592] EXT4-fs (loop1): failed to initialize system zone (-117) [ 398.393328][ T8592] EXT4-fs (loop1): mount failed [ 398.539061][ T8595] ntfs: volume version 3.1. [ 399.861467][ T1282] ieee802154 phy0 wpan0: encryption failed: -22 [ 399.868229][ T1282] ieee802154 phy1 wpan1: encryption failed: -22 [ 399.909346][ T8624] netlink: 8 bytes leftover after parsing attributes in process `syz.4.487'. [ 400.001739][ T8633] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 400.011566][ T8633] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 400.020538][ T8633] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 400.698333][ T5786] Bluetooth: hci4: command 0x0406 tx timeout [ 400.946962][ T8641] loop2: detected capacity change from 0 to 256 [ 401.043826][ T8641] exFAT-fs (loop2): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 401.886283][ T8650] loop4: detected capacity change from 0 to 512 [ 402.509635][ T8650] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 404.239789][ T8668] Cannot find map_set index 135 as target [ 405.898927][ T8650] syz.4.502 (8650) used greatest stack depth: 20624 bytes left [ 406.810728][ T8682] syz.2.507: attempt to access beyond end of device [ 406.810728][ T8682] nbd2: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 408.757471][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 408.783426][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 408.792878][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 408.803518][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 408.814742][ T5786] Workqueue: hci1 hci_rx_work [ 408.819687][ T5786] Call Trace: [ 408.823080][ T5786] [ 408.826213][ T5786] dump_stack_lvl+0x18c/0x250 [ 408.832764][ T5786] ? show_regs_print_info+0x20/0x20 [ 408.838366][ T5786] ? load_image+0x420/0x420 [ 408.842896][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 408.848201][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 408.854163][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 408.859558][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 408.864991][ T5786] kobject_add_internal+0x617/0xc90 [ 408.870296][ T5786] kobject_add+0x164/0x240 [ 408.874847][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 408.881104][ T5786] ? kobject_init+0x1d0/0x1d0 [ 408.886016][ T5786] ? get_device_parent+0x366/0x390 [ 408.891191][ T5786] device_add+0x3fa/0xc40 [ 408.895567][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 408.900843][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 408.906437][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 408.913001][ T5786] ? lockdep_hardirqs_on+0x98/0x150 [ 408.918481][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 408.924506][ T5786] ? hci_le_meta_evt+0x269/0x560 [ 408.934533][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 408.939606][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 408.946006][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 408.953960][ T5786] hci_event_packet+0x7b4/0x1280 [ 408.959554][ T5786] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 408.965577][ T5786] ? bis_list+0x290/0x290 [ 408.970232][ T5786] hci_rx_work+0x43a/0xd60 [ 408.974827][ T5786] ? process_scheduled_works+0x975/0x1600 [ 408.980600][ T5786] process_scheduled_works+0xa60/0x1600 [ 408.986521][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 408.992029][ T5786] ? assign_work+0x3cc/0x5d0 [ 408.997933][ T5786] worker_thread+0xa5e/0xfe0 [ 409.002973][ T5786] kthread+0x2fa/0x390 [ 409.007159][ T5786] ? pr_cont_work+0x550/0x550 [ 409.011948][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 409.016807][ T5786] ret_from_fork+0x48/0x80 [ 409.021353][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 409.026324][ T5786] ret_from_fork_asm+0x11/0x20 [ 409.031319][ T5786] [ 409.107040][ T5786] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 409.139366][ T5786] Bluetooth: hci1: failed to register connection device [ 409.148078][ T8702] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 409.156687][ T8702] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 409.165866][ T8702] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 410.570040][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 410.570056][ T28] audit: type=1800 audit(1786178281.705:17): pid=8716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.515" name="idProduct" dev="configfs" ino=15025 res=0 errno=0 [ 410.754099][ T28] audit: type=1800 audit(1786178281.714:18): pid=8716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.515" name="ep_name" dev="configfs" ino=15029 res=0 errno=0 [ 410.776343][ T28] audit: type=1800 audit(1786178281.714:19): pid=8716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.515" name="direction" dev="configfs" ino=15030 res=0 errno=0 [ 411.305439][ T28] audit: type=1800 audit(1786178281.714:20): pid=8716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.515" name="name" dev="configfs" ino=15031 res=0 errno=0 [ 411.371897][ T5786] Bluetooth: hci1: command 0x0406 tx timeout [ 411.533415][ T8725] netlink: 16 bytes leftover after parsing attributes in process `syz.1.516'. [ 412.331137][ T8728] loop2: detected capacity change from 0 to 128 [ 412.385026][ T8728] FAT-fs (loop2): Unrecognized mount option "fmask=0000000000000000ã¥3Oošjnonumtail=0" or missing value [ 412.862136][ T8730] netlink: 48 bytes leftover after parsing attributes in process `syz.4.517'. [ 414.919318][ T5786] Bluetooth: hci4: command 0x0406 tx timeout [ 415.796785][ T5786] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 415.811650][ T5786] CPU: 0 PID: 5786 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 415.819548][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 415.829815][ T5786] Workqueue: hci4 hci_rx_work [ 415.834625][ T5786] Call Trace: [ 415.837926][ T5786] [ 415.840884][ T5786] dump_stack_lvl+0x18c/0x250 [ 415.845692][ T5786] ? show_regs_print_info+0x20/0x20 [ 415.851144][ T5786] ? load_image+0x420/0x420 [ 415.855840][ T5786] sysfs_create_dir_ns+0x26e/0x2a0 [ 415.861621][ T5786] ? __lock_acquire+0x7d80/0x7d80 [ 415.866689][ T5786] ? sysfs_warn_dup+0xa0/0xa0 [ 415.871405][ T5786] ? do_raw_spin_unlock+0x121/0x230 [ 415.876991][ T5786] kobject_add_internal+0x617/0xc90 [ 415.882411][ T5786] kobject_add+0x164/0x240 [ 415.886865][ T5786] ? preempt_schedule_thunk+0x1a/0x30 [ 415.892377][ T5786] ? kobject_init+0x1d0/0x1d0 [ 415.897217][ T5786] ? get_device_parent+0x366/0x390 [ 415.902560][ T5786] device_add+0x3fa/0xc40 [ 415.907733][ T5786] hci_conn_add_sysfs+0xd5/0x1e0 [ 415.912734][ T5786] le_conn_complete_evt+0xe9f/0x1480 [ 415.918389][ T5786] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 415.924937][ T5786] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 415.930697][ T5786] ? mutex_unlock+0x10/0x10 [ 415.935236][ T5786] ? skb_pull_data+0xf0/0x1f0 [ 415.939952][ T5786] hci_le_conn_complete_evt+0x187/0x440 [ 415.945920][ T5786] ? hci_remote_host_features_evt+0x150/0x150 [ 415.952210][ T5786] hci_event_packet+0x7b4/0x1280 [ 415.957283][ T5786] ? bis_list+0x290/0x290 [ 415.961656][ T5786] ? kasan_check_range+0x89/0x290 [ 415.966955][ T5786] ? hci_send_to_monitor+0xd7/0x4f0 [ 415.972188][ T5786] hci_rx_work+0x43a/0xd60 [ 415.976674][ T5786] ? process_scheduled_works+0x975/0x1600 [ 415.982448][ T5786] process_scheduled_works+0xa60/0x1600 [ 415.988297][ T5786] ? worker_attach_to_pool+0x370/0x370 [ 415.993840][ T5786] ? assign_work+0x3cc/0x5d0 [ 415.998643][ T5786] worker_thread+0xa5e/0xfe0 [ 416.003310][ T5786] kthread+0x2fa/0x390 [ 416.007938][ T5786] ? pr_cont_work+0x550/0x550 [ 416.012698][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 416.017771][ T5786] ret_from_fork+0x48/0x80 [ 416.022324][ T5786] ? kthread_blkcg+0xd0/0xd0 [ 416.027036][ T5786] ret_from_fork_asm+0x11/0x20 [ 416.032456][ T5786] [ 416.128037][ T5786] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 416.156052][ T5786] Bluetooth: hci4: failed to register connection device [ 416.238458][ T8753] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/nbd2": -EINTR [ 416.317794][ T8766] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 416.336070][ T8766] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 416.345735][ T8766] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 416.776761][ T8774] netlink: 8 bytes leftover after parsing attributes in process `syz.3.510'. [ 418.541776][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 419.843449][ T8787] @0Ù: renamed from dummy0 (while UP) [ 420.728346][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 420.762366][ T8781] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 421.899675][ T8797] loop1: detected capacity change from 0 to 512 [ 421.944875][ T8797] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 422.003603][ T8797] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 422.061300][ T8797] EXT4-fs error (device loop1): ext4_orphan_get:1430: comm syz.1.528: bad orphan inode 131083 [ 422.086949][ T8797] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 422.360252][ T8809] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 13: comm syz.1.528: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 424.552796][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 426.386792][ T8825] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 426.395410][ T8825] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 426.404097][ T8825] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 427.128724][ T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 427.139351][ T51] CPU: 1 PID: 51 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 427.147666][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 427.158451][ T51] Workqueue: hci0 hci_rx_work [ 427.163574][ T51] Call Trace: [ 427.167014][ T51] [ 427.171820][ T51] dump_stack_lvl+0x18c/0x250 [ 427.176927][ T51] ? show_regs_print_info+0x20/0x20 [ 427.182763][ T51] ? load_image+0x420/0x420 [ 427.188689][ T51] sysfs_create_dir_ns+0x26e/0x2a0 [ 427.194461][ T51] ? __lock_acquire+0x7d80/0x7d80 [ 427.200642][ T51] ? sysfs_warn_dup+0xa0/0xa0 [ 427.207654][ T51] ? do_raw_spin_unlock+0x121/0x230 [ 427.213757][ T51] kobject_add_internal+0x617/0xc90 [ 427.220072][ T51] kobject_add+0x164/0x240 [ 427.225160][ T51] ? preempt_schedule_thunk+0x1a/0x30 [ 427.231561][ T51] ? kobject_init+0x1d0/0x1d0 [ 427.237337][ T51] ? get_device_parent+0x366/0x390 [ 427.243143][ T51] device_add+0x3fa/0xc40 [ 427.248546][ T51] hci_conn_add_sysfs+0xd5/0x1e0 [ 427.254495][ T51] le_conn_complete_evt+0xe9f/0x1480 [ 427.260381][ T51] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 427.267084][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 427.273482][ T51] hci_le_conn_complete_evt+0x187/0x440 [ 427.283428][ T51] ? hci_remote_host_features_evt+0x150/0x150 [ 427.291608][ T51] hci_event_packet+0x7b4/0x1280 [ 427.297315][ T51] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 427.303605][ T51] ? bis_list+0x290/0x290 [ 427.309024][ T51] ? kcov_remote_start+0x1b5/0x7e0 [ 427.315221][ T51] ? hci_send_to_monitor+0xd7/0x4f0 [ 427.320701][ T51] hci_rx_work+0x43a/0xd60 [ 427.326772][ T51] ? process_scheduled_works+0x975/0x1600 [ 427.333644][ T51] process_scheduled_works+0xa60/0x1600 [ 427.339504][ T51] ? worker_attach_to_pool+0x370/0x370 [ 427.345703][ T51] ? assign_work+0x3cc/0x5d0 [ 427.351970][ T51] worker_thread+0xa5e/0xfe0 [ 427.357264][ T51] kthread+0x2fa/0x390 [ 427.362130][ T51] ? pr_cont_work+0x550/0x550 [ 427.367092][ T51] ? kthread_blkcg+0xd0/0xd0 [ 427.372462][ T51] ret_from_fork+0x48/0x80 [ 427.377369][ T51] ? kthread_blkcg+0xd0/0xd0 [ 427.382609][ T51] ret_from_fork_asm+0x11/0x20 [ 427.387480][ T51] [ 427.392548][ T51] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 427.435550][ T51] Bluetooth: hci0: failed to register connection device [ 428.067140][ T8835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.534'. [ 428.137292][ T8837] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 428.146455][ T8837] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 428.155966][ T8837] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 429.658710][ T5786] Bluetooth: hci0: command 0x0406 tx timeout [ 431.116063][ T8849] netlink: 4 bytes leftover after parsing attributes in process `syz.3.537'. [ 433.803259][ T8858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.538'. [ 433.830214][ T8864] can0: slcan on ttyS3. [ 433.961659][ T5785] IPVS: starting estimator thread 0... [ 434.080390][ T8861] IPVS: using max 29 ests per chain, 69600 per kthread [ 434.201955][ T8856] can0 (unregistered): slcan off ttyS3. [ 434.742624][ T6503] [ 434.745011][ T6503] ============================================ [ 434.756921][ T6503] WARNING: possible recursive locking detected [ 434.766737][ T6503] syzkaller #0 Not tainted [ 434.773963][ T6503] -------------------------------------------- [ 434.782329][ T6503] kworker/0:5/6503 is trying to acquire lock: [ 434.789541][ T6503] ffff88802c21c130 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 [ 434.800002][ T6503] [ 434.800002][ T6503] but task is already holding lock: [ 434.807544][ T6503] ffff88807a6b1930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 [ 434.818560][ T6503] [ 434.818560][ T6503] other info that might help us debug this: [ 434.826742][ T6503] Possible unsafe locking scenario: [ 434.826742][ T6503] [ 434.834373][ T6503] CPU0 [ 434.837675][ T6503] ---- [ 434.840959][ T6503] lock(&grp->list_lock); [ 434.841781][ T8883] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 434.845385][ T6503] lock(&grp->list_lock); [ 434.854126][ T8883] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 434.858423][ T6503] [ 434.858423][ T6503] *** DEADLOCK *** [ 434.858423][ T6503] [ 434.867548][ T8883] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 434.876660][ T6503] May be due to missing lock nesting notation [ 434.876660][ T6503] [ 434.876672][ T6503] 3 locks held by kworker/0:5/6503: [ 434.876685][ T6503] #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 434.876735][ T6503] #1: ffffc90004e3fd00 ((work_completion)(&runtime->event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 434.876780][ T6503] #2: ffff88807a6b1930 (&grp->list_lock){.+.+}-{2:2}, at: snd_seq_deliver_event+0x248/0x970 [ 434.876827][ T6503] [ 434.876827][ T6503] stack backtrace: [ 434.876834][ T6503] CPU: 0 PID: 6503 Comm: kworker/0:5 Not tainted syzkaller #0 [ 434.876849][ T6503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 434.876860][ T6503] Workqueue: events snd_rawmidi_input_event_work [ 434.972540][ T6503] Call Trace: [ 434.976176][ T6503] [ 434.979295][ T6503] dump_stack_lvl+0x18c/0x250 [ 434.984249][ T6503] ? show_regs_print_info+0x20/0x20 [ 434.989474][ T6503] ? print_deadlock_bug+0x435/0x5d0 [ 434.994695][ T6503] __lock_acquire+0x6809/0x7d80 [ 434.999581][ T6503] ? verify_lock_unused+0x140/0x140 [ 435.004992][ T6503] ? verify_lock_unused+0x140/0x140 [ 435.010213][ T6503] ? verify_lock_unused+0x140/0x140 [ 435.015505][ T6503] ? __rwlock_init+0x150/0x150 [ 435.020347][ T6503] lock_acquire+0x19e/0x420 [ 435.024919][ T6503] ? snd_seq_deliver_event+0x248/0x970 [ 435.030479][ T6503] ? __lock_acquire+0x7d80/0x7d80 [ 435.035634][ T6503] ? read_lock_is_recursive+0x20/0x20 [ 435.041023][ T6503] ? mark_lock+0x94/0x320 [ 435.046076][ T6503] ? do_raw_read_unlock+0x3d/0x80 [ 435.051382][ T6503] ? snd_seq_deliver_event+0x220/0x970 [ 435.056964][ T6503] _raw_read_lock+0x36/0x50 [ 435.061910][ T6503] ? snd_seq_deliver_event+0x248/0x970 [ 435.067661][ T6503] snd_seq_deliver_event+0x248/0x970 [ 435.073086][ T6503] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 435.079180][ T6503] ? snd_seq_dispatch_event+0x4f0/0x4f0 [ 435.085431][ T6503] ? client_use_ptr+0xa9/0xaa0 [ 435.090559][ T6503] ? snd_seq_kernel_client_dispatch+0x17a/0x2f0 [ 435.096909][ T6503] snd_seq_kernel_client_dispatch+0x201/0x2f0 [ 435.103106][ T6503] snd_seq_control_queue+0x886/0x1060 [ 435.108676][ T6503] ? snd_seq_queue_remove_cells+0x2e0/0x2e0 [ 435.115446][ T6503] ? mark_lock+0x94/0x320 [ 435.119806][ T6503] ? snd_seq_port_use_ptr+0x101/0x130 [ 435.125219][ T6503] ? __lock_acquire+0x7d80/0x7d80 [ 435.130267][ T6503] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 435.136300][ T6503] ? _raw_spin_unlock+0x40/0x40 [ 435.141185][ T6503] ? verify_lock_unused+0x140/0x140 [ 435.146396][ T6503] ? do_raw_read_unlock+0x3d/0x80 [ 435.151432][ T6503] ? _raw_read_unlock+0x28/0x40 [ 435.156626][ T6503] ? snd_seq_port_use_ptr+0x101/0x130 [ 435.164545][ T6503] snd_seq_deliver_single_event+0x5a3/0xbc0 [ 435.170984][ T6503] ? snd_seq_system_notify+0x170/0x170 [ 435.176452][ T6503] ? snd_sequencer_device_done+0x30/0x30 [ 435.182435][ T6503] ? mark_lock+0x94/0x320 [ 435.186912][ T6503] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 435.193237][ T6503] ? __lock_acquire+0x7d80/0x7d80 [ 435.198475][ T6503] snd_seq_deliver_event+0x270/0x970 [ 435.204591][ T6503] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 435.210766][ T6503] ? snd_seq_dispatch_event+0x4f0/0x4f0 [ 435.216683][ T6503] ? client_use_ptr+0xa9/0xaa0 [ 435.221822][ T6503] ? snd_seq_kernel_client_dispatch+0x17a/0x2f0 [ 435.228229][ T6503] snd_seq_kernel_client_dispatch+0x201/0x2f0 [ 435.236598][ T6503] snd_seq_oss_timer_start+0x337/0x570 [ 435.244016][ T6503] ? snd_seq_oss_process_timer_event+0x3e0/0x3e0 [ 435.250405][ T6503] ? snd_seq_oss_readq_put_event+0x161/0x250 [ 435.256486][ T6503] ? snd_seq_oss_readq_put_timestamp+0x137/0x1a0 [ 435.263552][ T6503] ? snd_seq_oss_readq_poll+0xb0/0xb0 [ 435.270485][ T6503] snd_seq_oss_midi_input+0x34d/0x9b0 [ 435.276088][ T6503] ? snd_seq_port_use_ptr+0x101/0x130 [ 435.283481][ T6503] ? snd_seq_oss_midi_get_addr+0x260/0x260 [ 435.289451][ T6503] ? do_raw_read_unlock+0x3d/0x80 [ 435.295011][ T6503] ? _raw_read_unlock+0x28/0x40 [ 435.300152][ T6503] ? snd_seq_port_use_ptr+0x101/0x130 [ 435.306263][ T6503] snd_seq_deliver_single_event+0x5a3/0xbc0 [ 435.312179][ T6503] ? snd_seq_oss_process_event+0x2a30/0x2a30 [ 435.318196][ T6503] ? snd_sequencer_device_done+0x30/0x30 [ 435.323832][ T6503] ? mark_lock+0x94/0x320 [ 435.328251][ T6503] ? do_raw_read_unlock+0x3d/0x80 [ 435.333285][ T6503] snd_seq_deliver_event+0x502/0x970 [ 435.339112][ T6503] ? snd_seq_dispatch_event+0x4f0/0x4f0 [ 435.344777][ T6503] ? client_use_ptr+0xa9/0xaa0 [ 435.349561][ T6503] ? snd_seq_kernel_client_dispatch+0x17a/0x2f0 [ 435.355855][ T6503] snd_seq_kernel_client_dispatch+0x201/0x2f0 [ 435.361998][ T6503] snd_midi_input_event+0x2b2/0x3f0 [ 435.367312][ T6503] ? event_process_midi+0x4a0/0x4a0 [ 435.372675][ T6503] ? _raw_spin_unlock_irq+0x23/0x50 [ 435.378320][ T6503] ? process_scheduled_works+0x975/0x1600 [ 435.384543][ T6503] ? process_scheduled_works+0x975/0x1600 [ 435.390565][ T6503] process_scheduled_works+0xa60/0x1600 [ 435.396749][ T6503] ? worker_attach_to_pool+0x370/0x370 [ 435.403782][ T6503] ? assign_work+0x3cc/0x5d0 [ 435.408753][ T6503] worker_thread+0xa5e/0xfe0 [ 435.413576][ T6503] ? _raw_spin_unlock+0x40/0x40 [ 435.418549][ T6503] ? __kthread_parkme+0x71/0x1c0 [ 435.424474][ T6503] kthread+0x2fa/0x390 [ 435.428567][ T6503] ? pr_cont_work+0x550/0x550 [ 435.433376][ T6503] ? kthread_blkcg+0xd0/0xd0 [ 435.438347][ T6503] ret_from_fork+0x48/0x80 [ 435.442885][ T6503] ? kthread_blkcg+0xd0/0xd0 [ 435.447673][ T6503] ret_from_fork_asm+0x11/0x20 [ 435.452449][ T6503] [ 436.076028][ T8892] vlan2: entered allmulticast mode [ 436.082039][ T8892] veth0_vlan: entered allmulticast mode [ 436.220619][ T8892] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 436.229920][ T8892] caif:caif_disconnect_client(): nothing to disconnect [ 436.242506][ T8892] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 436.251680][ T8892] chnl_net:chnl_net_open(): state disconnected [ 436.257989][ T8892] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.