last executing test programs: 20.006258682s ago: executing program 2 (id=1821): write$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffffff, 0x0, 0x0) mmap$auto(0x0, 0x2020009, 0x6, 0xf8, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) mmap$auto(0x0, 0x6, 0x2, 0x40eb2, 0xffffffffffffffff, 0x308000000000) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) move_pages$auto(0x0, 0x1002, 0x0, 0x0, 0x0, 0x2) madvise$auto(0x0, 0xffffffffffff0005, 0x19) write$auto(0xffffffffffffffff, 0x0, 0x8000007f) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mtdblock0\x00', 0x14f602, 0x0) r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ram8\x00', 0x16fa02, 0x0) sendfile$auto(0x3, r0, 0x0, 0x400000000006) writev$auto(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040), 0xc4}, 0x9) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0xe0301, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ttyS0\x00', 0x480000, 0x0) 19.762800546s ago: executing program 2 (id=1824): openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snd/midiC2D0\x00', 0x80102, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) rt_sigprocmask$auto(0x0, &(0x7f0000000000)={0xfffffffffffffe01}, 0x0, 0x8) rt_sigtimedwait$auto(&(0x7f0000000040)={0xfffffffffffffbff}, 0x0, 0x0, 0x8) read$auto(0x3, 0x0, 0x80) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop2\x00', 0x101080, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2, 0x0) r0 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) set_mempolicy_home_node$auto(0x600000, 0xffffffffffffffff, 0x0, 0x0) mknod$auto(0x0, 0x20e9, 0x103) preadv2$auto(0x3, &(0x7f0000001000)={0x0, 0xfff5}, 0x5, 0xffffffffffffffff, 0x7, 0x2e) mmap$auto(0x2, 0x4000000000020009, 0x4000000000df, 0x40000000000eb1, r0, 0x8000) migrate_pages$auto(0x0, 0x8, 0x0, 0x0) mmap$auto(0x0, 0x3fffff, 0x7, 0x11, 0xdd, 0x0) ioctl$auto(0xffffffffffffffff, 0x8982, 0x1) close_range$auto(0x2, 0xa, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f0000000040), 0xffffffffffffffff) mmap$auto(0x0, 0x9, 0xdf, 0x109b72, r1, 0x8000) read$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffffff, 0x0, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bpf$auto(0x5, &(0x7f0000000100)=@task_fd_query={0x2, 0x2, 0x4, 0x0, 0x85, 0x7, 0x9, 0x6, 0x8001}, 0x101) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r2 = socket(0x2, 0x2, 0x0) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) connect$auto(0x3, &(0x7f00000018c0)=@l2tp={0x2, 0x0, @multicast1}, 0x55) sendmmsg$auto(r2, 0x0, 0x3, 0x400000) openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x61c0, 0x0) openat$auto_vhost_net_fops_net(0xffffffffffffff9c, &(0x7f00000000c0), 0x302, 0x0) 19.467904045s ago: executing program 2 (id=1827): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x24040840}, 0x94) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082dbd7000fedbdf250300000008000400b70a0000060007000080000008000200", @ANYRES32, @ANYBLOB="0a0005000180c200000e00000a0001000180c200000e00000a0001"], 0x68}, 0x1, 0x0, 0x0, 0x40080}, 0x40) r0 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="f2000000", @ANYBLOB='O'], 0x1ac}, 0x1, 0x0, 0x0, 0x24040840}, 0x94) setresuid$auto(0x0, 0x7, 0x8080) r1 = socket(0x10, 0x3, 0x6) bind$auto(r1, &(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x25dfdbfc, 0x8}, 0x6a) sendmmsg$auto(r0, &(0x7f0000000200)={{0x0, 0xc20f0000, &(0x7f0000000100)={0x0, 0xfc2}, 0x2, 0x0, 0x7, 0xa505}, 0x800}, 0x7, 0x4008) 19.242231206s ago: executing program 2 (id=1828): set_mempolicy$auto(0x6, &(0x7f0000000080)=0x3, 0x21) mmap$auto(0x0, 0x4005, 0xb, 0x40eb2, 0x401, 0x300000000000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptya1\x00', 0x270b42, 0x0) mmap$auto(0x0, 0x24020009, 0xdf, 0xeb1, 0x401, 0x8000) socket(0x29, 0x1, 0xbcd) socket(0x10, 0x2, 0xf) bpf$auto(0x0, 0x0, 0x210) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x1ac}, 0x1, 0x0, 0x0, 0x4004810}, 0x800) close_range$auto(0x2, 0x8, 0x0) io_uring_setup$auto(0x6, 0x0) r0 = socket(0xa, 0x1, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_NETDEV_CMD_NAPI_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES64=r0, @ANYRES8, @ANYRES32=r0], 0x14}, 0x1, 0x0, 0x0, 0x20008040}, 0x20000004) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f00000001c0)=@in={0x2, 0x0, @dev}, 0x54) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x4, &(0x7f00000002c0)={0x0, 0xffeb}, 0x1, 0x0, 0x5, 0x7}, 0x8}, 0xffffffff, 0xb00) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto(0x3, 0x5420, 0x38) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) mbind$auto(0x0, 0x100000004, 0x100000000, 0x0, 0x6, 0x2) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000480)='/sys/devices/platform/dummy_hcd.7/usb8/power/wakeup_expire_count\x00', 0xa0440, 0x0) r3 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nbd14\x00', 0x22c0, 0x0) ioctl$auto_BLKCLOSEZONE(r3, 0x40101287, 0x0) fcntl$auto_F_SETPIPE_SZ(r2, 0x407, 0x869) mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb1, 0x40000000000a1, 0x8000) io_uring_setup$auto(0x1, 0x0) socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) 18.96700885s ago: executing program 2 (id=1831): recvmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0xffffffff, 0x0) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x89b0, &(0x7f0000000140)={'bridge0\x00', 0x0}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000) close_range$auto(0x0, 0x5, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x101202, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000840)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5a1d2a1772eae57526e7543df28252fe5c3560407fe7035ce5b999867c144cddf1ad1bb02182f223c0c2cb68e793f1c284fba290d4", @ANYRESOCT=r1, @ANYBLOB="51743461bc7e0da4a1548b745b7f52a0a6fcbcef243d50e875904b13870757aec924599f3682090f5e6b0c22943326913eedfec2a03e2906a238a5113858d5b2522598c3906c5be94578fbf4b477fcfb8b61bae7ca32a8c99c23fcedc47b6acb89f622ddedc122ce9615fa8ac652e8b385cf1cd881984c64696a4ca533e92f38c89c2e745d99ef7d1aadedc3c728d4ee7b72d02b0e311f79b4a38bcceb30bc6c5ab552046e0731c2875620918a59705d068d1be4369e9b7506c3d5c58997e7835e807d9f42adf907b64cef0c4eb2f7010dd520ae685626f667f1a1a21365c89754f959afa8470016f23e477db3832acbb97cd13d499409", @ANYRES32=r5, @ANYRESHEX, @ANYRES64=r4, @ANYRES16=r3, @ANYRESHEX=r2, @ANYRESHEX], 0x1c}, 0x1, 0x0, 0x0, 0x4008800}, 0x4002c800) stat$auto(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x2, 0x0, 0xf661, 0x0, 0xee00, 0xee00, 0x0, 0xbcd, 0x6c, 0x8, 0x261, 0x5, 0x7fffffff, 0x7, 0x9, 0x8000, 0x144}) ioctl$auto_XFS_IOC_SWAPEXT(0xffffffffffffffff, 0xc0c0586d, &(0x7f0000000080)={0xd, @raw=0x7fffffffffffffff, @raw=0x7fffffff, 0x3, 0x7, '\x00', {0x5, 0x3, 0x0, 0xffffffffffffffff, r6, 0x0, 0x1000, 0x7ff, {0x4, 0x100}, {0x1133, 0x40}, {0x2, 0xc431}, 0xa00, 0x3ae0, 0x4, 0x8, 0xe, 0x0, 0x3, 0xf, 0x8, 0x2, '\x00', 0x7, 0x0, 0x1816, 0x4}}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xc, 0x800008000) sysfs$auto(0x2, 0x46, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @loopback}, 0x6a) r7 = socket(0x2, 0x5, 0x0) renameat$auto(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000340)='./file0\x00') sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{0x0, 0x10, 0x0, 0x7, 0x0, 0xc004, 0xb}, 0xfff}, 0x5, 0x311) sendmmsg$auto(r7, &(0x7f0000000400)={{&(0x7f00000001c0)="3618b3d64640c945ddf86a720bf2461e82a4aadefe61234ec678cd3c3eac36e3eaa0a36e7777ac174014b4d57e5f3d761faf4cf4920542685b916aa5aea6b5f2c84a2db4", 0x3fc, &(0x7f00000000c0)={0x0, 0xfffffffffffff1b9}, 0x0, 0x0, 0x8000000000000001, 0xb}, 0x8}, 0x10001, 0xfffffff5) sendmsg$auto_NL80211_CMD_GET_COALESCE(r3, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x66) ioctl$auto_SG_GET_RESERVED_SIZE(r2, 0x4c04, 0x0) r8 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/fail-nth\x00', 0x400042, 0x0) r9 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1\x00', 0x80402, 0x0) ioctl$auto_SNDCTL_DSP_GETOPTR(r9, 0x800c5012, &(0x7f00000000c0)) write$auto(r8, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k\x89\xe8^\x98#\x86\x92\x86w\xa1\x05\x9b\xad}yX\xc5\xc0\x1c\xd1\xd9\x9e\x91\b\xfc=\x18\xf9E\b\xa3Rgu\xf5L\x1d\xf8\ny', 0x401) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r10 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r10, 0x80085502, 0x0) 3.608664988s ago: executing program 1 (id=1894): r0 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/bus/usb/038/001\x00', 0x201, 0x0) ioctl$auto_USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) socket(0xa, 0x3, 0x3b) r1 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x20082, 0x0) open(0x0, 0x8600, 0xe6) mmap$auto(0xfffffffffffffffa, 0x6bcb, 0xdf, 0xebe, r0, 0x4) socketpair$auto(0x1e, 0x6, 0x8, 0x0) r2 = socket(0x2c, 0x3, 0x0) sendmsg$auto_NETDEV_CMD_DEV_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x204c000}, 0x40854) kexec_load$auto(0xffffffff, 0x2, &(0x7f0000000080)={@buf=0x0, 0x51b60c00, 0x8000, 0x403000}, 0x4) kexec_load$auto(0xff, 0xd, 0x0, 0x2) getsockopt$auto(r2, 0x11b, 0x8, 0x0, 0x0) r3 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) getdents64$auto(0xffffffffffffffff, 0x0, 0x7f) read$auto(r3, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xedKW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1\x1f\xf7uw\a\xd0\x83{_>/\xff', 0x100000001) write$auto(r1, &(0x7f0000000040)='S\x00\x00\x00\xfe\xff\xff\xff', 0x8587) 3.355631214s ago: executing program 1 (id=1895): r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) sendmmsg$auto(r0, 0x0, 0x4, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x18dd01, 0x0) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) process_vm_readv$auto(0x0, 0x0, 0x1, 0x0, 0x6, 0x0) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) madvise$auto(0x0, 0x1010001, 0x100000003) madvise$auto(0x1000, 0x400050, 0x9) openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0) r1 = io_uring_setup$auto(0x1, 0x0) futex$auto(&(0x7f0000000080)=0x1, 0xb, 0x1, 0x0, 0x0, 0xfffffffa) futex$auto(&(0x7f0000000080)=0xfffffffa, 0xc, 0x1, 0x0, 0x0, 0xfffffffa) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f0000000780)=@link_create={@map_fd=r1, @target_ifindex, 0xfffffff7, 0x9c, @uprobe_multi={0xbb63, 0x7fffffffffffffff, 0x2, 0xfffffffffffffffb, 0x1d34, 0x1}}, 0x9f) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x2d00, 0x0) read$auto_tracing_buffers_fops_trace(r2, &(0x7f00000000c0)=""/194, 0xc2) recvmmsg$auto(0x3, 0x0, 0x10000, 0x4ff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_TIPC_NL_MEDIA_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="010729bd7800fddb03000b000800"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x10) 2.392912387s ago: executing program 1 (id=1899): r0 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x8f3b7a51b80ebd01, 0x0) r1 = socket(0x2, 0x5, 0x0) mmap$auto(0x3, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) read$auto_proc_iter_file_ops_compat_inode(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000000280), r2) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001980)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="1b0026bd7000fddbdf2503000080040008000c00038008000c800400018012000100898771f1c19f17790485908286dd000004000280"], 0x3c}, 0x1, 0x0, 0x0, 0x50}, 0xc800) r4 = socket(0x10, 0x2, 0x0) sendmmsg$auto(r4, &(0x7f0000000200)={{0x0, 0xfffffffe, &(0x7f0000000100)={&(0x7f0000000080), 0xfc2}, 0x2, &(0x7f0000000340), 0x7, 0xa505}, 0x800}, 0x7, 0xffffffff) r5 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$auto_NL80211_CMD_ADD_TX_TS(r4, &(0x7f0000000740)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000400)=ANY=[@ANYBLOB="98c0efb10f08f2411ef9a5fc606d9f620e2b187dd5f876475f5cbc8a309a84ff51eb137abcb4b2e558717370c7455d02f5743064a44d07bdb953693de3f31182eddd6b8f49734995ef44ef1544900e6e09880a137a6cef81a83169844c85686db0f2b987f03f158cde46b265ae1d2cdb4c9a31cfe3a90151", @ANYRES16=r5, @ANYBLOB="040029bd7000ffdbdf2569000000"], 0x14}, 0x1, 0x0, 0x0, 0x24048000}, 0x4) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), 0xffffffffffffffff) statx$auto(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x5, 0x10001, 0x0) sendmsg$auto_NL802154_CMD_DEL_SEC_KEY(r4, 0x0, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0x4) socket(0x10, 0x3, 0x6) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r6 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0020000", @ANYRES16=r6, @ANYBLOB="01002dbd7000fedbdf2505000000da0203800800c000e000000204002a000400110008002e00", @ANYRES32, @ANYBLOB="d152e64e22695352dd73864415aa8a78c65e6ab75200000000000000007d0800cdd9690cac4138553ecfbb1b32"], 0x2f0}, 0x1, 0x0, 0x0, 0x80f4}, 0x811) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0x7}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) listen$auto(r1, 0x4e35512e) shutdown$auto(r1, 0x0) write$auto_proc_reg_file_ops_compat_inode(r0, &(0x7f0000000040), 0x0) mmap$auto(0x0, 0x8, 0xe2, 0xeb1, 0x69a5, 0xa800000000000000) sysfs$auto(0x2, 0x100000000000033, 0x0) r7 = fsopen$auto(0x0, 0x1) fsconfig$auto(r7, 0x8, 0x0, 0x0, 0x0) 2.324110128s ago: executing program 3 (id=1901): r0 = fsopen$auto(0x0, 0x1) fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0) process_madvise$auto_MADV_PAGEOUT(r0, &(0x7f0000000180)={&(0x7f00000000c0)="6bc435df379d38af2070e83ab820b0b15150be99d3063202de267667bb5fa15ce74ac0fb440ea2015d190f8ebd6e6427cb9a59d3cad3d2819c4e21caabd133d6cccdbae60f4ae89d62159cdb0cd02b6c24f2f4b16912ffec395de0e2a131d6047ed554bff8eed5782198b7615f59bd171d433765771e3ebe9ba010b66a31cb92dc09aab37592b5f66bbc92184733254768720007c7d6097032cea9fe5d18b38b4598956717fe92912375382c9e061b42", 0x3}, 0x1, 0x15, 0x5) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) select$auto(0x500000, 0x0, &(0x7f0000000240)={[0x8, 0x200000000006, 0x800000004, 0x8000, 0x0, 0x80000008, 0x7, 0x6, 0x8fc, 0xb80, 0x100000e34d, 0x4009, 0x8000, 0xfffffffffffff954, 0xfffffffffffffef8, 0x4]}, 0x0, &(0x7f0000000080)={0x1, 0x401}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/ns_last_pid\x00', 0x88642, 0x0) read$auto_proc_sys_file_operations_proc_sysctl(r1, 0x0, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) write$auto(0xffffffffffffffff, &(0x7f0000000180)='7\x00\xe6\xeaA\r\nW\xa6&\xff\xff\f\x00\x00\x00\xff\x00\x00\x00\x00\x00\x1f\xde\x00\x00\x00\x00\x00\x00\x00', 0x9) set_mempolicy$auto(0x6, 0x0, 0x9) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0xe01, 0x0) fadvise64$auto_POSIX_FADV_DONTNEED(0xffffffffffffffff, 0x10, 0x8, 0x4) setresgid$auto(0xffffffffffffffff, 0xee00, 0x0) r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r2, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2T\xc0\x1d\xa4\x10r\xc4\xa2\xb1y\t\x05\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xed\rW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1', 0x100000001) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/tracing/events/vmalloc/filter\x00', 0x2, 0x0) ioctl$auto_TUNSETCARRIER(r0, 0x400454e2, 0x0) socket(0x3, 0x805, 0x4) r3 = socket(0x2a, 0x2, 0x1) r4 = memfd_create$auto(&(0x7f0000000300)='/sys/kernel/debug/x86/boot_params/data\x00\"F\xb6\xcd\x06\xd6\x97\\L\xe1\xb2\xee\xb8\x8e\xd6O\xa1j\x90w\xc7\x94\xb7yi\x01&\x04b/\xaa\xfb#s\xc4\xa3\xa7\xacj\xc6\x8e\xf4L\x9a\xf8\xcc\xdcy\x9f\x93\xbc\xf6\xc8\xdb\x05w,|B\xfc\x04\x97\xd3\x0f\x8b\x81\xe8\xbc\x81\x0e\xd7o\xd2\xcd\x18z\xc2\xb7|\xe1\xa6\x9a~\x96\x10rnLnt\xdb\xdb-\x1b\x99\xd4\xed;\xf8\x13a\r\xf2\a\x85%\xef\xa7\x7f#\x96\xf2S\xb0\xf1Hq\x0f;\x83\xb7\x0fz\x9dN\xc9\x1e\x15r\x97|\xbfE\xce\"', 0x4) fallocate$auto(r4, 0x0, 0x9, 0x4cbd5d) connect$auto(r3, &(0x7f0000000140)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x57) 1.989570546s ago: executing program 0 (id=1902): prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) unshare$auto(0x40000080) ioctl$auto_RNDADDENTROPY2(0xffffffffffffffff, 0x40085203, &(0x7f0000000440)=[0xfff, 0xedc0]) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) r0 = openat$auto_ftrace_event_format_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/tracing/events/vmalloc/purge_vmap_area_lazy/format\x00', 0x40, 0x0) pread64$auto(r0, 0x0, 0x3, 0xfdd) mmap$auto(0x9, 0x5, 0x6, 0xeb1, 0xffffffffffffffff, 0x8000) mmap$auto(0x2000, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) mlockall$auto(0x800000000000005) ioctl$auto_SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000100)="000004") r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000000), r1) setsockopt$auto(0xffffffffffffffff, 0x0, 0x27, 0x0, 0xc) socket(0x2a, 0x2, 0x1) sendfile$auto(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) io_setup$auto(0xffff, &(0x7f0000000580)) io_setup$auto(0xa, 0x0) mmap$auto(0x0, 0x200004, 0x4000000000e3, 0x40eb2, 0xd, 0x300000000000) r2 = openat$auto_proc_pid_maps_operations_internal(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/maps\x00', 0x40302, 0x0) ioctl$auto_PROCMAP_QUERY(r2, 0xc0686611, &(0x7f0000000080)={0x68, 0x34, 0x7fff, 0x5, 0x80000000009, 0x1, 0x9, 0x5, 0x5, 0x7f93, 0xfffffffe, 0x7ffffffd, 0x7ff, 0x7, 0x9}) 1.943863161s ago: executing program 3 (id=1903): recvmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0xffffffff, 0x0) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x89b0, &(0x7f0000000140)={'bridge0\x00', 0x0}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000) close_range$auto(0x0, 0x5, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x101202, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000840)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5a1d2a1772eae57526e7543df28252fe5c3560407fe7035ce5b999867c144cddf1ad1bb02182f223c0c2cb68e793f1c284fba290d4", @ANYRESOCT=r1, @ANYBLOB="51743461bc7e0da4a1548b745b7f52a0a6fcbcef243d50e875904b13870757aec924599f3682090f5e6b0c22943326913eedfec2a03e2906a238a5113858d5b2522598c3906c5be94578fbf4b477fcfb8b61bae7ca32a8c99c23fcedc47b6acb89f622ddedc122ce9615fa8ac652e8b385cf1cd881984c64696a4ca533e92f38c89c2e745d99ef7d1aadedc3c728d4ee7b72d02b0e311f79b4a38bcceb30bc6c5ab552046e0731c2875620918a59705d068d1be4369e9b7506c3d5c58997e7835e807d9f42adf907b64cef0c4eb2f7010dd520ae685626f667f1a1a21365c89754f959afa8470016f23e477db3832acbb97cd13d499409", @ANYRES32=r5, @ANYRESHEX, @ANYRES64=r4, @ANYRES16=r3, @ANYRESHEX=r2, @ANYRESHEX], 0x1c}, 0x1, 0x0, 0x0, 0x4008800}, 0x4002c800) stat$auto(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x2, 0x0, 0xf661, 0x0, 0xee00, 0xee00, 0x0, 0xbcd, 0x6c, 0x8, 0x261, 0x5, 0x7fffffff, 0x7, 0x9, 0x8000, 0x144}) ioctl$auto_XFS_IOC_SWAPEXT(0xffffffffffffffff, 0xc0c0586d, &(0x7f0000000080)={0xd, @raw=0x7fffffffffffffff, @raw=0x7fffffff, 0x3, 0x7, '\x00', {0x5, 0x3, 0x0, 0xffffffffffffffff, r6, 0x0, 0x1000, 0x7ff, {0x4, 0x100}, {0x1133, 0x40}, {0x2, 0xc431}, 0xa00, 0x3ae0, 0x4, 0x8, 0xe, 0x0, 0x3, 0xf, 0x8, 0x2, '\x00', 0x7, 0x0, 0x1816, 0x4}}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xc, 0x800008000) sysfs$auto(0x2, 0x46, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @loopback}, 0x6a) r7 = socket(0x2, 0x5, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x7965dae200b7d1b3, 0x10) renameat$auto(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', r8, &(0x7f0000000340)='./file0\x00') sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{0x0, 0x10, 0x0, 0x7, 0x0, 0xc004, 0xb}, 0xfff}, 0x5, 0x311) sendmmsg$auto(r7, &(0x7f0000000400)={{&(0x7f00000001c0)="3618b3d64640c945ddf86a720bf2461e82a4aadefe61234ec678cd3c3eac36e3eaa0a36e7777ac174014b4d57e5f3d761faf4cf4920542685b916aa5aea6b5f2c84a2db4", 0x3fc, &(0x7f00000000c0)={0x0, 0xfffffffffffff1b9}, 0x0, 0x0, 0x8000000000000001, 0xb}, 0x8}, 0x10001, 0xfffffff5) sendmsg$auto_NL80211_CMD_GET_COALESCE(r3, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x66) ioctl$auto_SG_GET_RESERVED_SIZE(r2, 0x4c04, 0x0) r9 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/fail-nth\x00', 0x400042, 0x0) r10 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1\x00', 0x80402, 0x0) ioctl$auto_SNDCTL_DSP_GETOPTR(r10, 0x800c5012, &(0x7f00000000c0)) write$auto(r9, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k\x89\xe8^\x98#\x86\x92\x86w\xa1\x05\x9b\xad}yX\xc5\xc0\x1c\xd1\xd9\x9e\x91\b\xfc=\x18\xf9E\b\xa3Rgu\xf5L\x1d\xf8\ny', 0x401) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(0xffffffffffffffff, 0x80085502, 0x0) 1.942764291s ago: executing program 1 (id=1910): r0 = fsopen$auto(0x0, 0x1) fsconfig$auto(r0, 0x8, 0x0, 0x0, 0x0) process_madvise$auto_MADV_PAGEOUT(r0, &(0x7f0000000180)={&(0x7f00000000c0)="6bc435df379d38af2070e83ab820b0b15150be99d3063202de267667bb5fa15ce74ac0fb440ea2015d190f8ebd6e6427cb9a59d3cad3d2819c4e21caabd133d6cccdbae60f4ae89d62159cdb0cd02b6c24f2f4b16912ffec395de0e2a131d6047ed554bff8eed5782198b7615f59bd171d433765771e3ebe9ba010b66a31cb92dc09aab37592b5f66bbc92184733254768720007c7d6097032cea9fe5d18b38b4598956717fe92912375382c9e061b42", 0x3}, 0x1, 0x15, 0x5) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) select$auto(0x500000, 0x0, &(0x7f0000000240)={[0x8, 0x200000000006, 0x800000004, 0x8000, 0x0, 0x80000008, 0x7, 0x6, 0x8fc, 0xb80, 0x100000e34d, 0x4009, 0x8000, 0xfffffffffffff954, 0xfffffffffffffef8, 0x4]}, 0x0, &(0x7f0000000080)={0x1, 0x401}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/kernel/ns_last_pid\x00', 0x88642, 0x0) read$auto_proc_sys_file_operations_proc_sysctl(r1, 0x0, 0x0) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x4, 0x0, 0x9a6, 0x6) write$auto(0xffffffffffffffff, &(0x7f0000000180)='7\x00\xe6\xeaA\r\nW\xa6&\xff\xff\f\x00\x00\x00\xff\x00\x00\x00\x00\x00\x1f\xde\x00\x00\x00\x00\x00\x00\x00', 0x9) set_mempolicy$auto(0x6, 0x0, 0x9) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0xe01, 0x0) fadvise64$auto_POSIX_FADV_DONTNEED(0xffffffffffffffff, 0x10, 0x8, 0x4) setresgid$auto(0xffffffffffffffff, 0xee00, 0x0) r2 = openat$auto_tomoyo_operations_securityfs_if(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/security/tomoyo/domain_policy\x00', 0x40802, 0x0) read$auto(r2, &(0x7f00000002c0)='N\xd5\f\xb9GC*(,\x00\xc4bAL\xa3`\xb1\xf2T\xc0\x1d\xa4\x10r\xc4\xa2\xb1y\t\x05\xe7\xc04b$\x99.\xb4\xcc\xc0%\xaa\xd3\xd5\xef\xa4\xd35u\xc0\xa6\r\xcaJ\x11\xaf\x93\xde\xc3|\x17\x96\xd1\x15g\x10\x1ai1(=!\xf1\xe8\xe4\xcdm\xed\rW\xe7\xfbL\\\xf2sj(\v\xcd\xe5\x02B\x81ss\xdd\x8199\xa5\x1e\xb0A\xa3\xcbj7\xe9\xc9L\xcc\xc6\xa4\xaf%\xba\xda\xee\xd8%:bXj\xd5[UG\x8a\x8ab\x9a\x18\xe8K\xafU\x8d\xb1\f~\xaa\xab(\x86(\xf9\b\xf7$%\xf2\x11\xa4\x9bj\xc1)\n\x1ft\xb6\xaf\xe2\xd4\x95\xa3\xe1', 0x100000001) openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/tracing/events/vmalloc/filter\x00', 0x2, 0x0) ioctl$auto_TUNSETCARRIER(r0, 0x400454e2, 0x0) socket(0x3, 0x805, 0x4) r3 = socket(0x2a, 0x2, 0x1) fallocate$auto(0xffffffffffffffff, 0x0, 0x9, 0x4cbd5d) bind$auto(r3, &(0x7f0000000080)=@rc={0x1f, @none, 0x48}, 0x6c) connect$auto(r3, &(0x7f0000000140)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x57) 1.822574284s ago: executing program 2 (id=1836): openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x182b02, 0x0) r0 = syz_genetlink_get_family_id$auto_ipvs(&(0x7f00000009c0), 0xffffffffffffffff) unshare$auto(0x40000080) writev$auto(0x3, &(0x7f0000000100)={&(0x7f0000000040), 0x7111}, 0x8) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) settimeofday$auto(0x0, &(0x7f0000000300)={0x528d767b, 0x9}) r1 = socket(0xa, 0x3, 0x73) setsockopt$auto(0x400000000000003, 0xff, 0x24, 0x0, 0xfff) mmap$auto(0x0, 0x40009, 0x3, 0x9b72, 0xffffffffffffffff, 0x28000) madvise$auto(0x1100, 0xffffffffffff0001, 0x15) sendmsg$auto_IPVS_CMD_NEW_DEST(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r0, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) getpid() clone$auto(0x8, 0x0, 0x0, 0x0, 0x3) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dmmidi2\x00', 0x600100, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) ioctl$auto_FS_IOC_SETFLAGS2(0xffffffffffffffff, 0x40086602, 0x0) mmap$auto(0x0, 0x400005, 0xe2, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x400a00, 0x0) write$auto(0xffffffffffffffff, &(0x7f0000000180)='u\xd76\xe9\x91P~M7\x7f\xb4\x86\x04|\x03\xd6a\x00\t\x00\x00\x00\x10\xf8\xbc\x84\xccx\xd8\xe3\xbf\xf9\\\xcb\xf6:\x9d\xe0\xb2BH^~+\xfb\xf6\x91\x1e\xa0\x8e>.\x8b\xd6\xb1\xae\x8eb\x94R\\\xfd\xdf\xfeQ4v\x7f\x925\xcb\xc7\x8f\xf7\xa2Y\xeb\xcc\xa5\xf2w^\x1e\xe36S7\xaf{N\xff\xcf\x92P@0x0}) sendmsg$auto_BATADV_CMD_TP_METER(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="3b3d2abd7000fddbdf250304000008000300", @ANYRES32=r5, @ANYBLOB='\n\x00\t'], 0x28}}, 0x80) sendmsg$auto_BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, r3, 0x1, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_BYTES={0xc, 0xc, 0x8000000000000000}]}, 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x4000) process_vm_readv$auto(r0, &(0x7f0000000080)={0x0, 0x400000001003}, 0x40000000001, &(0x7f0000000180)={&(0x7f0000000000)="04bda6366d3e2284a107dd6c597ddd5f7efc1c26bfd408864e72b691fb08e272eb3e8306f9d9aec0ac5ea477b274c9c7dfb9f86d160772ace38736381bf6d687e31c5e5210dfc6a61270674a34ce0cd25be1ca9b09d50cde3c8e358c4a4068f6cc1589d44c69cc9b2d8de13e4c54432ac70b957a6edd71e72c24", 0x4000}, 0xa, 0xfffffffffffffffd) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000080)={{@inferred, 0x5, 0xfffff7bb, 0x3f, "984e784f697ebcc300fcffffffceca91a73e9e0323765da4403cab6800", @raw=0x7}, 0x200000, 0x614de47c, 0x4, @inferred=r0, @reserved="faea1caed238011ac8fbfd46cf64fa977204c41993b2f1204b8c40d4f117c2cb645ede07d127fe91bcc536c3544120b8495a3a548be253bcaaf808ea0012e03583e3c5e5a9e122e43aa0553485f44d3c1f76185f6f3a3a6a6296b1d28315e7a7b55c19814a5ca9a9beb17832ca8ae150c3a0c5a7c39919d7f94c2458071e52ff", "b210e8ae72f3052d09004297cc39fbd4fe51f972eb62ed41cec2ea5c5e45264907d818e9711e2b57cd159b796ab9e6c81a2f47680e3d2a7f677dccfd260d82fe"}) 1.263940835s ago: executing program 1 (id=1906): openat$auto_evdev_fops_evdev(0xffffffffffffff9c, &(0x7f0000000100)='/dev/input/event1\x00', 0x34d802, 0x0) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0) close_range$auto(0x2, r0, 0x0) r1 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000080), 0x88000, 0x0) mmap$auto(0x0, 0x420009, 0xdf, 0xeb1, 0x401, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x2) io_uring_setup$auto(0x2, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ttyS2\x00', 0x101c81, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mlock$auto(0x800, 0x85fc) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0x3, 0x4) ioctl$auto_TIOCSETD2(r2, 0x5423, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$auto(0xc01, 0x1, 0x6d, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS2\x00', 0x101f81, 0x0) ioctl$auto_TIOCSETD2(r3, 0x5423, 0x0) ioctl$auto_TIOCVHANGUP2(r2, 0x5437, 0x0) ioctl$auto_KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r1) ioctl$auto_KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000000040)={0x7, 0x0, [{0x40000023, 0x2, 0x6}]}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$auto_wireguard(&(0x7f0000000040), r4) sendmsg$auto_WG_CMD_SET_DEVICE(r4, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002880)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd700003dcdf25010000000800050001000000140002007767300000000000000000000000000022cda33a8c785d168923573f"], 0x30}}, 0xc0) socket(0x2b, 0xa, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) socket(0x22, 0x3, 0x0) r6 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_SMC_NETLINK_DISABLE_SEID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6], 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x810) 1.075531667s ago: executing program 0 (id=1907): r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) sendmmsg$auto(r0, 0x0, 0x4, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x18dd01, 0x0) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) process_vm_readv$auto(0x0, 0x0, 0x1, 0x0, 0x6, 0x0) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) madvise$auto(0x0, 0x1010001, 0x100000003) madvise$auto(0x1000, 0x400050, 0x9) openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0) r1 = io_uring_setup$auto(0x1, 0x0) futex$auto(&(0x7f0000000080)=0x1, 0xb, 0x1, 0x0, 0x0, 0xfffffffa) futex$auto(&(0x7f0000000080)=0xfffffffa, 0xc, 0x1, 0x0, 0x0, 0xfffffffa) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f0000000780)=@link_create={@map_fd=r1, @target_ifindex, 0xfffffff7, 0x9c, @uprobe_multi={0xbb63, 0x7fffffffffffffff, 0x2, 0xfffffffffffffffb, 0x1d34, 0x1}}, 0x9f) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$auto_tracing_buffers_fops_trace(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/tracing/per_cpu/cpu1/trace_pipe_raw\x00', 0x2d00, 0x0) read$auto_tracing_buffers_fops_trace(r2, &(0x7f00000000c0)=""/194, 0xc2) recvmmsg$auto(0x3, 0x0, 0x10000, 0x4ff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_TIPC_NL_MEDIA_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="010729bd7800fddb03000b000800"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x10) 958.830874ms ago: executing program 3 (id=1908): recvmmsg$auto(0xffffffffffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000) r0 = openat$auto_bch_chardev_fops_chardev(0xffffffffffffff9c, &(0x7f0000000080), 0x52000, 0x0) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x22a02, 0x0) write$auto(r1, &(0x7f0000000140)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7\xe6\x04\x8c\x83k', 0x1000000007e) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) r3 = ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$auto_KVM_GET_MSRS(r3, 0x4068aea3, &(0x7f0000000040)={0xbc}) setsockopt$auto_SO_ERROR(r1, 0x7ff, 0x4, 0x0, 0x7f) close_range$auto(r0, r1, 0x5) openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(r2, &(0x7f0000000180)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k.\xe8^\x98#\x86\x92\x86w\xa1\x05\x9b\xad}yX\xc5\xc0\x1c\xd1\xd9\x9e\x91\b\xfc=\x18\xf9E\b\xa3Rgu\xf5L\x1d\xf8\ny\b\v\xc9`\xc9\xc3\xc8\xd0\x1f:\xfcC\xda\xae0\xa8D\xd2\x8c(\x02\xc5\xfd\x19i\x97P\xc7\xe5\xc0UZ\xfb\\V\x81\x85\xe3\xa7\x8a\xeez$\xb3\xd6EJ<\xb2\x9dS\x1b\xe9\xd7<\x1a\x04~<\x9e\xba\xbb\xbf\xa6i\x06\x18\x1eW\x9cM\xdbvJ\xe3\xcd\xe8(8K\x95_\x9b\x9a\v \xcf\xb0\x87!\xa5h\x8c]\xaa\x8d\xfa{c@\xc6}P\xfaA\xdb/n\xbd\xd5\xcd\xf9\x818\xb6\xdd\x94\xe5t\xea\x14B\xaa)\x1a\xf1\xe4\x19\xaf\x8b\xa2\xae\x05\xb3\xb8\xe3=\x12\x85@}-\xadu\f\x13_\xe1J\xe8ObRS\x84[\xac\xab`\xbeU\xaf\x13\xf3\x86\xf2\x95\xcc\x84\xe1', 0x8000000000000000) pwrite64$auto(0xc8, 0x0, 0xfdef, 0x2) 898.421225ms ago: executing program 1 (id=1909): mmap$auto(0x0, 0x4020005, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_v4l2_fops_v4l2_dev(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/v4l-touch8\x00', 0x80f00, 0x0) unshare$auto(0x40000080) write$auto(0xca, 0x0, 0x7d) r1 = openat$auto_tracing_saved_cmdlines_fops_trace(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/tracing/saved_cmdlines\x00', 0x143382, 0x0) socket(0x10, 0x2, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) socket(0xa, 0x5, 0x0) r2 = socket(0xa, 0x1, 0x84) getsockopt$auto(r2, 0x84, 0x10, 0x0, &(0x7f0000000000)=0x7ffe) bpf$auto_BPF_OBJ_GET(0x7, &(0x7f0000000280)=@query={@target_fd=r1, 0x7, 0x0, 0x6c6f9df, 0xb0ef, @prog_cnt=0x1, 0x0, 0x8001, 0xd, 0x8, 0x2}, 0xfffffff9) r3 = openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000400), 0x189002, 0x0) ioctl$auto_PPPIOCSMRU(r3, 0xc004743e, 0x0) ioctl$auto_PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000040)={0x6, 0x0}) ioctl$auto_PPPIOCSPASS(r3, 0x40107447, &(0x7f00000000c0)={0x9, &(0x7f0000000000)={0x28, 0xf3, 0xb0, @raw=0x6}}) preadv$auto(r1, &(0x7f0000000140)={0x0, 0x3}, 0x5, 0x1ff, 0x81) ioctl$auto(r0, 0x5646, r0) madvise$auto(0x0, 0xffffffffffff0005, 0x17) recvmmsg$auto(0xffffffffffffffff, &(0x7f0000000100)={{0x0, 0x4, &(0x7f0000000080)={&(0x7f0000000040), 0xcb}, 0x3, 0x0, 0x80000000, 0x6}, 0x9}, 0x7, 0x6, 0x0) madvise$auto(0x0, 0xffffffffffff0001, 0x15) mmap$auto(0x0, 0x400007, 0xdf, 0x9b72, 0xffffffffffffffff, 0x0) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) setsockopt$auto(0x3, 0x10, 0x3e, 0x0, 0x9) read$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffffff, &(0x7f0000003f40)=""/156, 0x9c) sendmsg$auto_OVS_DP_CMD_NEW(0xffffffffffffffff, 0x0, 0x80) mmap$auto(0x0, 0x4020009, 0x6, 0xeb1, 0x401, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r4 = socket(0x2, 0x1, 0x106) getsockopt$auto(r4, 0x0, 0x33, 0xfffffffffffffffe, 0x0) syz_genetlink_get_family_id$auto_mac80211_hwsim(&(0x7f0000000040), 0xffffffffffffffff) 678.443405ms ago: executing program 0 (id=1911): sendmmsg$auto(0xffffffffffffffff, 0x0, 0x5, 0x20000000) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket(0x29, 0x2, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) sendmmsg$auto(0x3, &(0x7f0000000080)={{0x0, 0x2, &(0x7f00000002c0)={0x0, 0xc4}, 0x1, 0x0, 0x0, 0x9}, 0x7}, 0x3, 0x0) r1 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200", @ANYBLOB="5de1"], 0x1ac}}, 0x40000) recvmmsg$auto(r1, &(0x7f0000000040)={{0x0, 0x5, 0x0, 0x5, 0x0, 0x200002, 0x13}, 0x803}, 0xfffffff9, 0x10, 0x0) ioctl$auto(r0, 0x8910, 0x24) openat$auto_fuse_dev_operations_fuse_i(0xffffffffffffff9c, 0x0, 0x20a00, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0xffffffffffffffff, 0x8000) r2 = openat$auto_ubi_ctrl_cdev_operations_ubi(0xffffffffffffff9c, &(0x7f0000000180), 0x40900, 0x0) ioctl$auto_UBI_IOCATT(r2, 0x40186f40, 0x0) ioctl$auto_UBI_IOCDET(r2, 0x40046f41, 0x0) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) mmap$auto(0x0, 0x4020009, 0xdf, 0x40000eb1, 0x401, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$auto_dma_heap_fops_dma_heap(0xffffffffffffff9c, &(0x7f00000002c0), 0x40000, 0x0) r4 = syz_genetlink_get_family_id$auto_ovs_packet(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$auto_OVS_PACKET_CMD_EXECUTE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x38, r4, 0x1b, 0x74bd26, 0x25dfdbfd, {}, [@OVS_PACKET_ATTR_ACTIONS={0xc, 0x3, 0x0, 0x1, [@nested={0x8, 0x6, 0x0, 0x1, [@nested={0x4}]}]}, @OVS_PACKET_ATTR_PACKET={0x12, 0x1, "898771f1c19f17790485908286dd"}, @OVS_PACKET_ATTR_KEY={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004040}, 0xc800) clone$auto(0x100000008, 0x9, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4000006) clone$auto(0x1, 0x1, 0x0, 0x0, 0x2) 560.762443ms ago: executing program 3 (id=1912): r0 = socket(0x2, 0x5, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @remote}, 0x6a) sendmmsg$auto(r0, 0x0, 0x4, 0x5) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x18dd01, 0x0) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000002740), 0xffffffffffffffff) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) process_vm_readv$auto(0x0, 0x0, 0x1, 0x0, 0x6, 0x0) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) ioctl$auto_BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) madvise$auto(0x0, 0x1010001, 0x100000003) madvise$auto(0x1000, 0x400050, 0x9) openat$auto_tracing_err_log_fops_trace(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/tracing/error_log\x00', 0xb01, 0x0) r1 = io_uring_setup$auto(0x1, 0x0) futex$auto(&(0x7f0000000080)=0x1, 0xb, 0x1, 0x0, 0x0, 0xfffffffa) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$auto(0x0, &(0x7f0000000780)=@link_create={@map_fd=r1, @target_ifindex, 0xfffffff7, 0x9c, @uprobe_multi={0xbb63, 0x7fffffffffffffff, 0x2, 0xfffffffffffffffb, 0x1d34, 0x1}}, 0x9f) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) read$auto_tracing_buffers_fops_trace(0xffffffffffffffff, &(0x7f00000000c0)=""/194, 0xc2) recvmmsg$auto(0x3, 0x0, 0x10000, 0x4ff, 0x0) 390.979372ms ago: executing program 0 (id=1913): recvmmsg$auto(0xffffffffffffffff, 0x0, 0x0, 0xffffffff, 0x0) mmap$auto(0x0, 0x2020009, 0x2, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x89b0, &(0x7f0000000140)={'bridge0\x00', 0x0}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x40000008000) close_range$auto(0x0, 0x5, 0x0) r2 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop6\x00', 0x101202, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000840)={'wlan1\x00', 0x0}) sendmsg$auto_NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5a1d2a1772eae57526e7543df28252fe5c3560407fe7035ce5b999867c144cddf1ad1bb02182f223c0c2cb68e793f1c284fba290d4", @ANYRESOCT=r1, @ANYBLOB="51743461bc7e0da4a1548b745b7f52a0a6fcbcef243d50e875904b13870757aec924599f3682090f5e6b0c22943326913eedfec2a03e2906a238a5113858d5b2522598c3906c5be94578fbf4b477fcfb8b61bae7ca32a8c99c23fcedc47b6acb89f622ddedc122ce9615fa8ac652e8b385cf1cd881984c64696a4ca533e92f38c89c2e745d99ef7d1aadedc3c728d4ee7b72d02b0e311f79b4a38bcceb30bc6c5ab552046e0731c2875620918a59705d068d1be4369e9b7506c3d5c58997e7835e807d9f42adf907b64cef0c4eb2f7010dd520ae685626f667f1a1a21365c89754f959afa8470016f23e477db3832acbb97cd13d499409", @ANYRES32=r5, @ANYRESHEX, @ANYRES64=r4, @ANYRES16=r3, @ANYRESHEX=r2, @ANYRESHEX], 0x1c}, 0x1, 0x0, 0x0, 0x4008800}, 0x4002c800) stat$auto(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x2, 0x0, 0xf661, 0x0, 0xee00, 0xee00, 0x0, 0xbcd, 0x6c, 0x8, 0x261, 0x5, 0x7fffffff, 0x7, 0x9, 0x8000, 0x144}) ioctl$auto_XFS_IOC_SWAPEXT(0xffffffffffffffff, 0xc0c0586d, &(0x7f0000000080)={0xd, @raw=0x7fffffffffffffff, @raw=0x7fffffff, 0x3, 0x7, '\x00', {0x5, 0x3, 0x0, 0xffffffffffffffff, r6, 0x0, 0x1000, 0x7ff, {0x4, 0x100}, {0x1133, 0x40}, {0x2, 0xc431}, 0xa00, 0x3ae0, 0x4, 0x8, 0xe, 0x0, 0x3, 0xf, 0x8, 0x2, '\x00', 0x7, 0x0, 0x1816, 0x4}}) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xc, 0x800008000) sysfs$auto(0x2, 0x46, 0x0) r7 = socket(0x2, 0x5, 0x0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x7965dae200b7d1b3, 0x10) renameat$auto(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', r8, &(0x7f0000000340)='./file0\x00') sendmmsg$auto(0xffffffffffffffff, &(0x7f0000000140)={{0x0, 0x10, 0x0, 0x7, 0x0, 0xc004, 0xb}, 0xfff}, 0x5, 0x311) sendmmsg$auto(r7, &(0x7f0000000400)={{&(0x7f00000001c0)="3618b3d64640c945ddf86a720bf2461e82a4aadefe61234ec678cd3c3eac36e3eaa0a36e7777ac174014b4d57e5f3d761faf4cf4920542685b916aa5aea6b5f2c84a2db4", 0x3fc, &(0x7f00000000c0)={0x0, 0xfffffffffffff1b9}, 0x0, 0x0, 0x8000000000000001, 0xb}, 0x8}, 0x10001, 0xfffffff5) sendmsg$auto_NL80211_CMD_GET_COALESCE(r3, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x66) ioctl$auto_SG_GET_RESERVED_SIZE(r2, 0x4c04, 0x0) r9 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/fail-nth\x00', 0x400042, 0x0) r10 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1\x00', 0x80402, 0x0) ioctl$auto_SNDCTL_DSP_GETOPTR(r10, 0x800c5012, &(0x7f00000000c0)) write$auto(r9, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k\x89\xe8^\x98#\x86\x92\x86w\xa1\x05\x9b\xad}yX\xc5\xc0\x1c\xd1\xd9\x9e\x91\b\xfc=\x18\xf9E\b\xa3Rgu\xf5L\x1d\xf8\ny', 0x401) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r11 = openat$auto_raw_fops_raw_gadget(0xffffffffffffff9c, &(0x7f0000000000), 0x123000, 0x0) ioctl$auto_USB_RAW_IOCTL_EVENT_FETCH(r11, 0x80085502, 0x0) 213.11969ms ago: executing program 3 (id=1914): r0 = syz_genetlink_get_family_id$auto_l2tp(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$auto_L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="46de23b20d56033a4fbfb89d409819dd7f546830bedb4c0a3c00000071a93beb54c453e002607971016a497284a52ecccc97d51d7632d738202ab348f28d1a880ef975cebb022747c13b4dbaaba55a1caa44e04373d120143e629a7d606547983a60cb30e86963b1dc6d0f6109a44879962b34c7956877eb3dcd5b04b9550cf39f77bb5f5333e2a63df9985a744fcf49b25c595c8aa8e30c6a5d02c921c90195d9adde0ffaba05b739ffce2866ba31910da2ad2f", @ANYRES16=r0, @ANYBLOB="01002dbd7000f9dbdf250100000008000a00080000000500070058000000080011000300000006000200010000000800180003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x40080) r1 = openat$auto_snd_seq_f_ops_seq_clientmgr(0xffffffffffffff9c, &(0x7f00000011c0), 0xa2741, 0x0) write$auto_snd_seq_f_ops_seq_clientmgr(r1, &(0x7f00000004c0), 0x0) mprotect$auto(0xa0000000000, 0x2, 0x9) mmap$auto(0x0, 0x8, 0x6, 0xeb1, r1, 0x8000) bpf$auto(0x0, &(0x7f0000000000)=@batch={0xfffffffffffffffb, 0x7, 0x4547, 0x7f, 0xfff, r1, 0xa, 0x6}, 0xd1) r2 = socket(0x10, 0x2, 0x0) sendmsg$auto_NL80211_CMD_GET_REG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYBLOB="1200"], 0x1ac}}, 0x40000) timer_gettime$auto(0x0, 0x0) recvmmsg$auto(r2, &(0x7f0000000040)={{0x0, 0x5, 0x0, 0x5, 0x0, 0x200002, 0x13}, 0x803}, 0xfffffff9, 0x10, 0x0) r3 = openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bus/usb/037/001\x00', 0x20882, 0x0) ioctl$auto_USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000180)={0x2, 0x8, 0x4ba, 0x2006, 0xfff, 0x6, 0x0}) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/tty0\x00', 0x102, 0x0) mmap$auto(0x0, 0x128009, 0xdf, 0xeb1, 0x401, 0x8000) pwrite64$auto(0xc8, 0x0, 0xfded, 0x4) sendmsg$auto_ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, 0x0, 0x2004c012) openat$auto_iommufd_fops_main(0xffffffffffffff9c, &(0x7f00000000c0), 0x60005, 0x0) r4 = socket(0xa, 0x3, 0x5) sendmmsg$auto(r4, 0x0, 0x3b8b, 0x800) close_range$auto(0x2, 0xa, 0xf5ff) socket(0x10, 0x2, 0x0) socket(0x2, 0x2, 0x0) bind$auto(0x3, &(0x7f0000000100)=@in={0x2, 0x3, @empty}, 0x6a) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x50) recvmmsg$auto(0x3, 0x0, 0x10000, 0x700, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, 0x0, 0x20000, 0x0) select$auto(0x4, 0x0, 0x0, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) 0s ago: executing program 0 (id=1915): openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f0000002dc0)='/dev/adsp1\x00', 0x2401, 0x0) openat$auto_sw_sync_debugfs_fops_sync_debug(0xffffffffffffff9c, &(0x7f0000000000), 0x2e4841, 0x0) r0 = socket(0x10, 0x2, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/wakeup_count\x00', 0xc0082, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r2 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) read$auto(r2, 0x0, 0x20) mprotect$auto(0x1ffffffff000, 0x100004, 0x6) r3 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x140082, 0x0) writev$auto(r3, &(0x7f0000000200)={0x0, 0x7}, 0x3) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) sysfs$auto(0x2, 0xe, 0x0) lsm_list_modules$auto(0x0, 0x0, 0x0) r4 = openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, &(0x7f0000000280), 0x141182, 0x0) ioctl$auto_dvb_demux_fops_dmxdev(r4, 0x403c6f2b, 0x0) pidfd_send_signal$auto_PIDFD_SELF_THREAD(0xffffffffffffd8f0, 0x11, 0x0, 0x0) mmap$auto(0x0, 0x40009, 0xa, 0x9b72, 0x2, 0x28000) io_uring_setup$auto(0xa, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) setsockopt$auto(r0, 0x82, 0x40d, 0x0, 0x28) mlockall$auto(0x1) mprotect$auto(0x1ffffffff000, 0x100004, 0x6) write$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f00000002c0)="d0a009", 0x3) bpf$auto(0x0, &(0x7f00000001c0)=@bpf_attr_0={0x1, 0xb9, 0xf, 0x7, 0x400004, 0xffffffffffffffff, 0xe7b, "00000000000000e3ffffffffffffff00", 0x0, 0xffffffffffffffff, 0x5, 0x7, 0xe5, 0x3, 0xffffffffffffffff, 0xffffffffffffffff}, 0x10) read$auto(r5, &(0x7f0000000080)='\x00', 0x5) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) sendmsg$auto_OVS_CT_LIMIT_CMD_GET(0xffffffffffffffff, 0x0, 0x20000000) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram5\x00', 0x2000, 0x0) kernel console output (not intermixed with test programs): _aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 426.931858][T13809] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1004'. [ 427.231629][T13812] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1005'. [ 428.507040][T13937] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(5) [ 429.109195][T13948] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 429.643135][T14063] ubi0: attaching mtd0 [ 429.660635][T14063] ubi0: scanning is finished [ 429.826677][T14063] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 429.875149][T14063] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 429.905036][T14063] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 429.935963][T14063] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 429.968719][T14063] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 430.006364][T14063] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 430.036479][T14063] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 430.095022][T14063] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 430.166981][T14130] ubi0: background thread "ubi_bgt0d" started, PID 14130 [ 430.175422][T14064] ubi0: detaching mtd0 [ 430.226233][T14064] ubi0: mtd0 is detached [ 430.548272][T14179] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 430.661617][T14143] Invalid ELF header magic: != ELF [ 430.685379][T14180] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1021'. [ 430.753794][T14143] syz_tun: tun_chr_ioctl cmd 1074025678 [ 430.797599][T14143] syz_tun: group set to 23693 [ 431.708014][T14411] ubi0: attaching mtd0 [ 431.742908][T14411] ubi0: scanning is finished [ 432.013729][T14411] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 432.103848][T14414] zswap: compressor not available [ 432.124610][T14411] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 432.262627][T14411] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 432.357211][T14411] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 432.373846][T14525] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 432.478448][T14411] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 432.605203][T14411] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 432.653525][T14411] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 432.706798][T14411] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 432.736745][T14534] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1035'. [ 432.764322][T14413] ubi0: detaching mtd0 [ 432.768460][T14425] ubi0: background thread "ubi_bgt0d" started, PID 14425 [ 432.812449][T14413] ubi0: mtd0 is detached [ 433.882207][T14653] Process accounting paused [ 434.600132][T14674] ubi0: attaching mtd0 [ 434.630693][T14674] ubi0: scanning is finished [ 434.849986][T14674] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 434.900678][T14674] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 434.948124][T14674] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 434.989299][T14674] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 435.036261][T14674] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 435.075278][T14674] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 435.119258][T14674] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 435.180827][T14674] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 435.244996][T14676] ubi0: detaching mtd0 [ 435.249171][T14779] ubi0: background thread "ubi_bgt0d" started, PID 14779 [ 435.312579][T14676] ubi0: mtd0 is detached [ 435.523972][T14783] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 436.637553][T14987] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1054'. [ 436.658728][T14985] ubi0: attaching mtd0 [ 436.674887][T14985] ubi0: scanning is finished [ 436.846087][T14985] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 436.920194][T14985] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 437.002172][T14985] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 437.120727][T14985] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 437.261712][T14985] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 437.350656][T14985] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 437.464964][T14985] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 437.586033][T14985] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 437.723811][T15063] ubi0: background thread "ubi_bgt0d" started, PID 15063 [ 437.739380][T15014] ubi0: detaching mtd0 [ 437.949836][T15122] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 438.041754][T15014] ubi0: mtd0 is detached [ 438.521776][T15127] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 440.109488][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.119172][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.297609][T15351] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 440.502317][T15358] ubi0: attaching mtd0 [ 440.572391][T15358] ubi0: scanning is finished [ 440.831869][T15358] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 440.882594][T15358] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 440.928883][T15358] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 440.973226][T15358] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 441.017235][T15358] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 441.053239][T15358] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 441.096520][T15358] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 441.153923][T15358] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 441.224753][T15513] ubi0: background thread "ubi_bgt0d" started, PID 15513 [ 441.834731][T15684] FAULT_INJECTION: forcing a failure. [ 441.834731][T15684] name failslab, interval 1, probability 0, space 0, times 0 [ 441.891134][T15684] CPU: 0 UID: 0 PID: 15684 Comm: syz.1.1077 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.891177][T15684] Tainted: [L]=SOFTLOCKUP [ 441.891182][T15684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 441.891192][T15684] Call Trace: [ 441.891197][T15684] [ 441.891204][T15684] dump_stack_lvl+0x100/0x190 [ 441.891226][T15684] should_fail_ex.cold+0x5/0xa [ 441.891245][T15684] ? sk_prot_alloc+0x10b/0x2a0 [ 441.891266][T15684] should_failslab+0xc2/0x120 [ 441.891284][T15684] __kmalloc_noprof+0xe0/0x850 [ 441.891302][T15684] sk_prot_alloc+0x10b/0x2a0 [ 441.891324][T15684] sk_alloc+0x36/0xe80 [ 441.891341][T15684] __netlink_create+0x5e/0x2c0 [ 441.891359][T15684] ? __wake_up+0x3f/0x60 [ 441.891404][T15684] netlink_create+0x29b/0x610 [ 441.891427][T15684] ? __pfx_genl_bind+0x10/0x10 [ 441.891448][T15684] ? __pfx_genl_unbind+0x10/0x10 [ 441.891468][T15684] ? __pfx_genl_release+0x10/0x10 [ 441.891484][T15684] __sock_create+0x339/0x860 [ 441.891511][T15684] __sys_socket+0x14d/0x260 [ 441.891533][T15684] ? __pfx___sys_socket+0x10/0x10 [ 441.891560][T15684] __x64_sys_socket+0x72/0xb0 [ 441.891581][T15684] ? lockdep_hardirqs_on+0x78/0x100 [ 441.891605][T15684] do_syscall_64+0x10b/0xf80 [ 441.891626][T15684] ? clear_bhb_loop+0x40/0x90 [ 441.891644][T15684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.891662][T15684] RIP: 0033:0x7f088539ce59 [ 441.891675][T15684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.891689][T15684] RSP: 002b:00007f088616f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 441.891704][T15684] RAX: ffffffffffffffda RBX: 00007f0885615fa0 RCX: 00007f088539ce59 [ 441.891714][T15684] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 441.891724][T15684] RBP: 00007f0885432d6f R08: 0000000000000000 R09: 0000000000000000 [ 441.891733][T15684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 441.891742][T15684] R13: 00007f0885616038 R14: 00007f0885615fa0 R15: 00007ffe65ed1798 [ 441.891762][T15684] [ 442.521463][T15710] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 442.742484][T15732] ubi: mtd0 is already attached to ubi0 [ 442.761882][T15732] ubi0: detaching mtd0 [ 442.991343][T15732] ubi0: mtd0 is detached [ 443.624639][T15995] netlink: 2532 bytes leftover after parsing attributes in process `syz.3.1081'. [ 444.391767][T16328] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 444.421296][T16245] syz_tun: tun_chr_ioctl cmd 1074025673 [ 444.511981][T16328] CIFS mount error: No usable UNC path provided in device string! [ 444.511981][T16328] [ 444.554604][T16328] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 444.961714][T16436] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 446.424851][T16955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1097'. [ 446.529439][T16959] netlink: 'syz.0.1097': attribute type 64 has an invalid length. [ 446.628885][T16959] netlink: 74 bytes leftover after parsing attributes in process `syz.0.1097'. [ 448.074384][ T50] Bluetooth: hci3: unexpected event 0x03 length: 123 > 11 [ 448.562763][T17401] FAULT_INJECTION: forcing a failure. [ 448.562763][T17401] name failslab, interval 1, probability 0, space 0, times 0 [ 448.762415][T17401] CPU: 0 UID: 0 PID: 17401 Comm: syz.0.1111 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.762442][T17401] Tainted: [L]=SOFTLOCKUP [ 448.762448][T17401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 448.762457][T17401] Call Trace: [ 448.762462][T17401] [ 448.762470][T17401] dump_stack_lvl+0x100/0x190 [ 448.762492][T17401] should_fail_ex.cold+0x5/0xa [ 448.762512][T17401] ? iovec_from_user+0x8d/0x140 [ 448.762530][T17401] should_failslab+0xc2/0x120 [ 448.762549][T17401] __kmalloc_noprof+0xe0/0x850 [ 448.762563][T17401] ? futex_hash+0x2ad/0x370 [ 448.762580][T17401] iovec_from_user+0x8d/0x140 [ 448.762604][T17401] process_vm_rw+0x1e5/0x2d0 [ 448.762624][T17401] ? __pfx_process_vm_rw+0x10/0x10 [ 448.762643][T17401] ? ksys_write+0x190/0x250 [ 448.762676][T17401] ? xfd_validate_state+0x129/0x190 [ 448.762716][T17401] ? __task_pid_nr_ns+0x1ca/0x510 [ 448.762744][T17401] __x64_sys_process_vm_readv+0xe2/0x1c0 [ 448.762762][T17401] ? do_syscall_64+0x90/0xf80 [ 448.762785][T17401] ? lockdep_hardirqs_on+0x78/0x100 [ 448.762806][T17401] do_syscall_64+0x10b/0xf80 [ 448.762827][T17401] ? clear_bhb_loop+0x40/0x90 [ 448.762845][T17401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.762860][T17401] RIP: 0033:0x7fb39c19ce59 [ 448.762874][T17401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.762888][T17401] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000136 [ 448.762904][T17401] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 448.762913][T17401] RDX: 0000040000000001 RSI: 0000200000000080 RDI: 000000000000041b [ 448.762922][T17401] RBP: 00007fb39c232d6f R08: 000000000000000a R09: 0000000000000000 [ 448.762931][T17401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.762940][T17401] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 448.762959][T17401] [ 450.197194][T17821] ubi0: attaching mtd0 [ 450.218737][T17821] ubi0: scanning is finished [ 450.453530][T17821] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 450.517982][T17821] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 450.614791][T17821] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 450.703974][T17821] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 450.876914][T17821] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 450.999951][T17938] FAULT_INJECTION: forcing a failure. [ 450.999951][T17938] name failslab, interval 1, probability 0, space 0, times 0 [ 451.058897][T17821] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 451.091473][T17938] CPU: 0 UID: 0 PID: 17938 Comm: syz.2.1120 Tainted: G L syzkaller #0 PREEMPT(full) [ 451.091502][T17938] Tainted: [L]=SOFTLOCKUP [ 451.091507][T17938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 451.091517][T17938] Call Trace: [ 451.091522][T17938] [ 451.091528][T17938] dump_stack_lvl+0x100/0x190 [ 451.091553][T17938] should_fail_ex.cold+0x5/0xa [ 451.091574][T17938] should_failslab+0xc2/0x120 [ 451.091595][T17938] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 451.091618][T17938] ? skb_clone+0x190/0x400 [ 451.091641][T17938] skb_clone+0x190/0x400 [ 451.091659][T17938] netlink_deliver_tap+0xaed/0xcc0 [ 451.091686][T17938] netlink_unicast+0x6a5/0x850 [ 451.091713][T17938] ? __pfx_netlink_unicast+0x10/0x10 [ 451.091734][T17938] ? genl_rcv_msg+0x4be/0x800 [ 451.091753][T17938] netlink_ack+0x655/0xb80 [ 451.091780][T17938] netlink_rcv_skb+0x333/0x420 [ 451.091801][T17938] ? __pfx_genl_rcv_msg+0x10/0x10 [ 451.091817][T17938] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 451.091846][T17938] ? netlink_deliver_tap+0x1ae/0xcc0 [ 451.091869][T17938] genl_rcv+0x28/0x40 [ 451.091890][T17938] netlink_unicast+0x585/0x850 [ 451.091914][T17938] ? __pfx_netlink_unicast+0x10/0x10 [ 451.091940][T17938] netlink_sendmsg+0x8b0/0xda0 [ 451.091965][T17938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 451.091988][T17938] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 451.092016][T17938] __sys_sendto+0x468/0x4b0 [ 451.092032][T17938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 451.092054][T17938] ? __pfx___sys_sendto+0x10/0x10 [ 451.092085][T17938] ? xfd_validate_state+0x129/0x190 [ 451.092102][T17938] ? ksys_write+0x1ac/0x250 [ 451.092124][T17938] __x64_sys_sendto+0xe0/0x1c0 [ 451.092139][T17938] ? do_syscall_64+0x90/0xf80 [ 451.092162][T17938] ? lockdep_hardirqs_on+0x78/0x100 [ 451.092184][T17938] do_syscall_64+0x10b/0xf80 [ 451.092205][T17938] ? clear_bhb_loop+0x40/0x90 [ 451.092223][T17938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.092239][T17938] RIP: 0033:0x7f4a3fb5d68e [ 451.092278][T17938] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 451.092294][T17938] RSP: 002b:00007f4a40b1ce88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 451.092310][T17938] RAX: ffffffffffffffda RBX: 00007f4a40b1e6c0 RCX: 00007f4a3fb5d68e [ 451.092320][T17938] RDX: 0000000000000020 RSI: 00007f4a40b1d000 RDI: 0000000000000005 [ 451.092329][T17938] RBP: 0000000000000000 R08: 00007f4a40b1cf04 R09: 000000000000000c [ 451.092338][T17938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 451.092347][T17938] R13: 00007f4a40b1cf58 R14: 00007f4a40b1d000 R15: 0000000000000000 [ 451.092367][T17938] [ 451.707343][T17821] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 451.848533][T17821] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 451.970569][T17871] ubi0: detaching mtd0 [ 452.112303][T17871] ubi0: mtd0 is detached [ 452.152603][T17919] ubi0: attaching mtd0 [ 452.184277][T17919] ubi0: scanning is finished [ 452.890224][T17919] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 452.974825][T17919] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 453.052018][T17919] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 453.132453][T17919] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 453.213260][T17919] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 453.287520][T17919] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 453.375086][T17919] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 453.489771][T17919] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 453.568815][T18157] ubi0: background thread "ubi_bgt0d" started, PID 18157 [ 453.576262][T17922] ubi0: detaching mtd0 [ 453.639815][T17922] ubi0: mtd0 is detached [ 454.039770][T18350] ubi0: attaching mtd0 [ 454.097491][T18350] ubi0: scanning is finished [ 454.665894][T18350] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 454.870649][T18350] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 455.035592][T18350] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 455.210097][T18350] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 455.492441][T18350] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 455.675132][T18350] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 455.905713][T18350] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 456.156650][T18350] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 456.337413][T18354] ubi0: detaching mtd0 [ 456.341550][T18578] ubi0: background thread "ubi_bgt0d" started, PID 18578 [ 456.423268][T18354] ubi0: mtd0 is detached [ 456.572088][T18990] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 457.121781][T19104] netlink: 208 bytes leftover after parsing attributes in process `syz.3.1141'. [ 457.253167][T19104] FAULT_INJECTION: forcing a failure. [ 457.253167][T19104] name failslab, interval 1, probability 0, space 0, times 0 [ 457.453000][T19104] CPU: 0 UID: 0 PID: 19104 Comm: syz.3.1141 Tainted: G L syzkaller #0 PREEMPT(full) [ 457.453027][T19104] Tainted: [L]=SOFTLOCKUP [ 457.453033][T19104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 457.453043][T19104] Call Trace: [ 457.453048][T19104] [ 457.453055][T19104] dump_stack_lvl+0x100/0x190 [ 457.453080][T19104] should_fail_ex.cold+0x5/0xa [ 457.453101][T19104] should_failslab+0xc2/0x120 [ 457.453120][T19104] __kmalloc_cache_node_noprof+0x7d/0x770 [ 457.453139][T19104] ? __alloc_workqueue+0x711/0x1980 [ 457.453160][T19104] ? lockdep_init_map_type+0x5c/0x250 [ 457.453183][T19104] __alloc_workqueue+0x711/0x1980 [ 457.453210][T19104] alloc_workqueue_noprof+0xc7/0x130 [ 457.453232][T19104] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 457.453254][T19104] ? trace_kmalloc+0xe3/0x110 [ 457.453272][T19104] ? __kasan_kmalloc+0xaa/0xb0 [ 457.453292][T19104] ieee80211_register_hw+0x2148/0x4570 [ 457.453392][T19104] ? mark_held_locks+0x1/0x70 [ 457.453412][T19104] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 457.453427][T19104] ? __pfx___debug_object_init+0x10/0x10 [ 457.453502][T19104] ? find_held_lock+0x2b/0x80 [ 457.453523][T19104] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 457.453548][T19104] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 457.453623][T19104] ? __hrtimer_setup+0x208/0x330 [ 457.453643][T19104] mac80211_hwsim_new_radio+0x2a01/0x5aa0 [ 457.453674][T19104] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 457.453696][T19104] hwsim_new_radio_nl+0xc5f/0x1370 [ 457.453722][T19104] ? rcu_is_watching+0x12/0xc0 [ 457.453741][T19104] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 457.453765][T19104] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 457.453791][T19104] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 457.453820][T19104] genl_family_rcv_msg_doit+0x214/0x300 [ 457.453837][T19104] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 457.453852][T19104] ? genl_get_cmd+0x3e7/0x760 [ 457.453879][T19104] ? bpf_lsm_capable+0x9/0x10 [ 457.453904][T19104] ? security_capable+0x80/0x260 [ 457.453968][T19104] ? ns_capable+0xd2/0xf0 [ 457.453989][T19104] genl_rcv_msg+0x560/0x800 [ 457.454006][T19104] ? __pfx_genl_rcv_msg+0x10/0x10 [ 457.454022][T19104] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 457.454046][T19104] netlink_rcv_skb+0x159/0x420 [ 457.454067][T19104] ? __pfx_genl_rcv_msg+0x10/0x10 [ 457.454083][T19104] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 457.454112][T19104] ? netlink_deliver_tap+0x1ae/0xcc0 [ 457.454135][T19104] genl_rcv+0x28/0x40 [ 457.454156][T19104] netlink_unicast+0x585/0x850 [ 457.454181][T19104] ? __pfx_netlink_unicast+0x10/0x10 [ 457.454207][T19104] netlink_sendmsg+0x8b0/0xda0 [ 457.454232][T19104] ? __pfx_netlink_sendmsg+0x10/0x10 [ 457.454252][T19104] ? __import_iovec+0x1d2/0x640 [ 457.454270][T19104] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 457.454296][T19104] ____sys_sendmsg+0x9e1/0xb70 [ 457.454317][T19104] ? __pfx_netlink_sendmsg+0x10/0x10 [ 457.454340][T19104] ? __pfx_____sys_sendmsg+0x10/0x10 [ 457.454366][T19104] ? __pfx_futex_wake_mark+0x10/0x10 [ 457.454389][T19104] ___sys_sendmsg+0x190/0x1e0 [ 457.454413][T19104] ? __pfx____sys_sendmsg+0x10/0x10 [ 457.454457][T19104] __sys_sendmsg+0x170/0x220 [ 457.454475][T19104] ? __pfx___sys_sendmsg+0x10/0x10 [ 457.454493][T19104] ? __x64_sys_futex+0x34f/0x4d0 [ 457.454516][T19104] ? rcu_is_watching+0x12/0xc0 [ 457.454536][T19104] do_syscall_64+0x10b/0xf80 [ 457.454559][T19104] ? clear_bhb_loop+0x40/0x90 [ 457.454578][T19104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.454594][T19104] RIP: 0033:0x7f799fd9ce59 [ 457.454608][T19104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 457.454622][T19104] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 457.454638][T19104] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 457.454649][T19104] RDX: 0000000004048000 RSI: 0000200000004240 RDI: 0000000000000006 [ 457.454658][T19104] RBP: 00007f799fe32d6f R08: 0000000000000000 R09: 0000000000000000 [ 457.454667][T19104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 457.454676][T19104] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 457.454696][T19104] [ 458.720444][T19316] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 458.937566][T19385] FAULT_INJECTION: forcing a failure. [ 458.937566][T19385] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 459.012712][T19385] CPU: 0 UID: 0 PID: 19385 Comm: syz.1.1146 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.012739][T19385] Tainted: [L]=SOFTLOCKUP [ 459.012745][T19385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 459.012754][T19385] Call Trace: [ 459.012759][T19385] [ 459.012766][T19385] dump_stack_lvl+0x100/0x190 [ 459.012788][T19385] should_fail_ex.cold+0x5/0xa [ 459.012809][T19385] _copy_to_iter+0x1f3/0x1720 [ 459.012828][T19385] ? show_sb_opts+0xb4/0xf0 [ 459.012875][T19385] ? __pfx__copy_to_iter+0x10/0x10 [ 459.012890][T19385] ? __up_read+0x2c1/0x6e0 [ 459.012908][T19385] ? __pfx___up_read+0x10/0x10 [ 459.012924][T19385] ? seq_read_iter+0xd33/0x1270 [ 459.012940][T19385] ? seq_read_iter+0xd33/0x1270 [ 459.012960][T19385] seq_read_iter+0xdab/0x1270 [ 459.012983][T19385] ? __pfx_seq_read_iter+0x10/0x10 [ 459.013000][T19385] vfs_read+0x825/0xb30 [ 459.013019][T19385] ? __pfx_vfs_read+0x10/0x10 [ 459.013050][T19385] ksys_read+0x12a/0x250 [ 459.013067][T19385] ? __pfx_ksys_read+0x10/0x10 [ 459.013085][T19385] ? rcu_is_watching+0x12/0xc0 [ 459.013105][T19385] do_syscall_64+0x10b/0xf80 [ 459.013128][T19385] ? clear_bhb_loop+0x40/0x90 [ 459.013146][T19385] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.013162][T19385] RIP: 0033:0x7f088539ce59 [ 459.013175][T19385] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 459.013189][T19385] RSP: 002b:00007f08835d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 459.013204][T19385] RAX: ffffffffffffffda RBX: 00007f0885616180 RCX: 00007f088539ce59 [ 459.013214][T19385] RDX: 0000000000001036 RSI: 0000200000000040 RDI: 0000000000000003 [ 459.013223][T19385] RBP: 00007f0885432d6f R08: 0000000000000000 R09: 0000000000000000 [ 459.013233][T19385] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 459.013242][T19385] R13: 00007f0885616218 R14: 00007f0885616180 R15: 00007ffe65ed1798 [ 459.013262][T19385] [ 460.003164][T19435] ubi0: attaching mtd0 [ 460.019736][T19435] ubi0: scanning is finished [ 460.254373][T19435] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 460.380029][T19435] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 460.522849][T19552] block nbd0: Unsupported socket: should be TCP or UNIX. [ 460.570359][T19435] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 460.701035][T19435] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 460.824524][T19435] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 460.946286][T19435] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 461.026458][T19435] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 461.121728][T19435] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 461.214028][T19545] ubi0: background thread "ubi_bgt0d" started, PID 19545 [ 461.226520][T19495] ubi0: detaching mtd0 [ 461.285157][T19495] ubi0: mtd0 is detached [ 461.613592][T19703] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1154'. [ 461.658182][T19703] veth1_macvtap: left promiscuous mode [ 461.685955][T19703] macsec0: entered promiscuous mode [ 461.707139][T19703] macsec0: entered allmulticast mode [ 461.975163][T19762] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 462.540933][T19875] FAULT_INJECTION: forcing a failure. [ 462.540933][T19875] name failslab, interval 1, probability 0, space 0, times 0 [ 462.770675][T19879] zswap: compressor not available [ 462.778477][T19875] CPU: 0 UID: 5 PID: 19875 Comm: syz.1.1160 Tainted: G L syzkaller #0 PREEMPT(full) [ 462.778503][T19875] Tainted: [L]=SOFTLOCKUP [ 462.778509][T19875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 462.778518][T19875] Call Trace: [ 462.778523][T19875] [ 462.778531][T19875] dump_stack_lvl+0x100/0x190 [ 462.778554][T19875] should_fail_ex.cold+0x5/0xa [ 462.778574][T19875] ? sk_prot_alloc+0x10b/0x2a0 [ 462.778594][T19875] should_failslab+0xc2/0x120 [ 462.778613][T19875] __kmalloc_noprof+0xe0/0x850 [ 462.778626][T19875] ? security_inode_alloc+0xcf/0x2c0 [ 462.778711][T19875] sk_prot_alloc+0x10b/0x2a0 [ 462.778733][T19875] sk_alloc+0x36/0xe80 [ 462.778751][T19875] __netlink_create+0x5e/0x2c0 [ 462.778771][T19875] __netlink_kernel_create+0xed/0x750 [ 462.778794][T19875] ? __pfx___netlink_kernel_create+0x10/0x10 [ 462.778822][T19875] fib_net_init+0x26d/0x3f0 [ 462.778884][T19875] ? is_module_address+0x69/0xf0 [ 462.778900][T19875] ? __pfx_fib_net_init+0x10/0x10 [ 462.778922][T19875] ? timer_init_key+0x155/0x330 [ 462.778944][T19875] ? __pfx_nl_fib_input+0x10/0x10 [ 462.778968][T19875] ? devinet_init_net+0x56c/0x8d0 [ 462.779014][T19875] ? __pfx_fib_net_init+0x10/0x10 [ 462.779034][T19875] ops_init+0x1e2/0x5f0 [ 462.779079][T19875] setup_net+0x118/0x3a0 [ 462.779098][T19875] ? __pfx_setup_net+0x10/0x10 [ 462.779116][T19875] ? mutex_init_lockdep+0xf1/0x120 [ 462.779137][T19875] copy_net_ns+0x46f/0x7c0 [ 462.779159][T19875] create_new_namespaces+0x3ea/0xac0 [ 462.779184][T19875] unshare_nsproxy_namespaces+0xf2/0x220 [ 462.779205][T19875] ksys_unshare+0x438/0xab0 [ 462.779228][T19875] ? __pfx_ksys_unshare+0x10/0x10 [ 462.779249][T19875] ? xfd_validate_state+0x129/0x190 [ 462.779271][T19875] __x64_sys_unshare+0x31/0x40 [ 462.779292][T19875] do_syscall_64+0x10b/0xf80 [ 462.779321][T19875] ? clear_bhb_loop+0x40/0x90 [ 462.779341][T19875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.779357][T19875] RIP: 0033:0x7f088539ce59 [ 462.779371][T19875] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.779386][T19875] RSP: 002b:00007f088616f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 462.779401][T19875] RAX: ffffffffffffffda RBX: 00007f0885615fa0 RCX: 00007f088539ce59 [ 462.779411][T19875] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 [ 462.779421][T19875] RBP: 00007f0885432d6f R08: 0000000000000000 R09: 0000000000000000 [ 462.779430][T19875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 462.779439][T19875] R13: 00007f0885616038 R14: 00007f0885615fa0 R15: 00007ffe65ed1798 [ 462.779459][T19875] [ 463.930084][T19984] Process accounting resumed [ 465.190923][T20412] ubi0: attaching mtd0 [ 465.213569][T20412] ubi0: scanning is finished [ 465.341368][T20412] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 465.383742][T20412] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 465.425183][T20412] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 465.465939][T20412] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 465.518194][T20412] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 465.566002][T20412] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 465.606443][T20412] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 465.665646][T20412] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 465.720700][T20469] ubi0: background thread "ubi_bgt0d" started, PID 20469 [ 465.900512][T20624] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 466.840728][T20745] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1181'. [ 467.102890][T20862] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 468.379759][T21177] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 469.281345][ T50] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 470.526477][T21620] ubi: mtd0 is already attached to ubi0 [ 470.550640][T21622] ubi: mtd0 is already attached to ubi0 [ 470.566113][T21620] ubi0: detaching mtd0 [ 470.584622][T21620] ubi0: mtd0 is detached [ 471.297530][T21781] netlink: 338 bytes leftover after parsing attributes in process `syz.1.1209'. [ 471.324682][ T5625] Bluetooth: hci0: command 0x0406 tx timeout [ 471.355413][T21841] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1209'. [ 471.394533][ T50] Bluetooth: hci3: unexpected subevent 0x01 length: 123 > 18 [ 471.416287][ T50] Bluetooth: hci3: unexpected event 0x05 length: 6 > 4 [ 472.001405][T21960] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1213'. [ 472.909874][T22193] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1218'. [ 473.406721][ T50] Bluetooth: hci3: command tx timeout [ 473.412152][ T5637] Bluetooth: hci0: command 0x0406 tx timeout [ 473.767290][T22412] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 474.020333][T22419] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1225'. [ 474.696289][T22440] ubi0: attaching mtd0 [ 474.725764][T22440] ubi0: scanning is finished [ 475.057175][T22440] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 475.230715][T22440] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 475.412669][T22440] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 475.632700][T22440] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 475.860630][T22440] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 476.086643][T22440] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 476.233923][T22440] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 476.386896][T22440] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 476.523428][T22642] ubi0: background thread "ubi_bgt0d" started, PID 22642 [ 476.532659][T22471] ubi0: detaching mtd0 [ 476.641720][T22471] ubi0: mtd0 is detached [ 476.695036][T22869] ubi0: attaching mtd0 [ 476.705552][T22869] ubi0: scanning is finished [ 476.869381][T22869] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 477.385771][T23095] ubi0: attaching mtd0 [ 477.414056][T23095] ubi0: scanning is finished [ 477.622771][T23095] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 477.667369][T23095] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 477.706742][T23095] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 477.763653][T23095] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 477.805707][T23095] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 477.835333][T23095] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 477.873110][T23095] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 477.926300][T23095] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 477.982980][T23098] ubi0: detaching mtd0 [ 477.987444][T23215] ubi0: background thread "ubi_bgt0d" started, PID 23215 [ 478.064427][T23098] ubi0: mtd0 is detached [ 478.419475][ T30] audit: type=1804 audit(4294967406.002:11): pid=23516 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1249" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 479.242570][T23733] ubi0: attaching mtd0 [ 479.263782][T23733] ubi0: scanning is finished [ 479.419246][T23733] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 479.503803][T23733] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 479.588089][T23733] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 479.712868][T23733] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 479.831043][T23733] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 480.000273][T23733] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 480.116543][T23733] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1374467780 [ 480.203089][T24148] FAULT_INJECTION: forcing a failure. [ 480.203089][T24148] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 480.225073][T23733] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 480.315537][T23838] ubi0: background thread "ubi_bgt0d" started, PID 23838 [ 480.325513][T23734] ubi0: detaching mtd0 [ 480.337730][T24148] CPU: 0 UID: 0 PID: 24148 Comm: syz.0.1261 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.337754][T24148] Tainted: [L]=SOFTLOCKUP [ 480.337759][T24148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 480.337768][T24148] Call Trace: [ 480.337773][T24148] [ 480.337779][T24148] dump_stack_lvl+0x100/0x190 [ 480.337799][T24148] should_fail_ex.cold+0x5/0xa [ 480.337818][T24148] _copy_from_iter+0x1f4/0x1690 [ 480.337839][T24148] ? __pfx__copy_from_iter+0x10/0x10 [ 480.337858][T24148] ? __pfx___might_resched+0x10/0x10 [ 480.337875][T24148] ? kfree+0x1dd/0x6c0 [ 480.337898][T24148] file_tty_write.isra.0+0x45b/0x890 [ 480.337928][T24148] redirected_tty_write+0xd4/0x120 [ 480.337951][T24148] vfs_write+0x6ac/0x1070 [ 480.337968][T24148] ? __pfx_redirected_tty_write+0x10/0x10 [ 480.337992][T24148] ? __pfx_vfs_write+0x10/0x10 [ 480.338007][T24148] ? find_held_lock+0x2b/0x80 [ 480.338038][T24148] ksys_write+0x12a/0x250 [ 480.338054][T24148] ? __pfx_ksys_write+0x10/0x10 [ 480.338073][T24148] ? rcu_is_watching+0x12/0xc0 [ 480.338092][T24148] do_syscall_64+0x10b/0xf80 [ 480.338115][T24148] ? clear_bhb_loop+0x40/0x90 [ 480.338133][T24148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.338148][T24148] RIP: 0033:0x7fb39c19ce59 [ 480.338160][T24148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 480.338173][T24148] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 480.338187][T24148] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 480.338197][T24148] RDX: 000000000000fdef RSI: 0000200000000000 RDI: 0000000000000003 [ 480.338206][T24148] RBP: 00007fb39cf72090 R08: 0000000000000000 R09: 0000000000000000 [ 480.338214][T24148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 480.338222][T24148] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 480.338241][T24148] [ 480.390813][T23734] ubi0: mtd0 is detached [ 481.264248][ T30] audit: type=1804 audit(4294967408.851:12): pid=24256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1265" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 481.672952][T24259] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 483.424251][T24284] ubi0: attaching mtd0 [ 483.530218][T24284] ubi0: scanning is finished [ 483.876412][T24284] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 483.926204][T24297] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 484.025572][T24284] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 484.193018][T24284] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 484.293233][T24284] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 484.354921][T24284] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 484.401552][T24284] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 484.450601][T24284] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 484.510669][T24284] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 484.577781][T24298] ubi0: background thread "ubi_bgt0d" started, PID 24298 [ 484.587301][T24285] ubi0: detaching mtd0 [ 484.695363][T24285] ubi0: mtd0 is detached [ 484.753293][T24302] ubi0: attaching mtd0 [ 484.769306][T24302] ubi0: scanning is finished [ 484.832739][T24302] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 484.868520][T24302] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 484.904361][T24302] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 484.933957][T24302] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 484.964172][T24302] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 485.003088][T24302] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 485.033220][T24302] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 485.074782][T24302] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 485.126765][T24407] ubi0: background thread "ubi_bgt0d" started, PID 24407 [ 485.358424][T24410] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 485.525105][T24410] FAULT_INJECTION: forcing a failure. [ 485.525105][T24410] name failslab, interval 1, probability 0, space 0, times 0 [ 485.728652][T24410] CPU: 0 UID: 0 PID: 24410 Comm: syz.1.1280 Tainted: G L syzkaller #0 PREEMPT(full) [ 485.728679][T24410] Tainted: [L]=SOFTLOCKUP [ 485.728684][T24410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 485.728694][T24410] Call Trace: [ 485.728706][T24410] [ 485.728713][T24410] dump_stack_lvl+0x100/0x190 [ 485.728736][T24410] should_fail_ex.cold+0x5/0xa [ 485.728757][T24410] should_failslab+0xc2/0x120 [ 485.728775][T24410] __kmalloc_cache_noprof+0x7a/0x6f0 [ 485.728797][T24410] ? vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 485.728906][T24410] vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 485.728926][T24410] vidtv_mux_create_pid_ctx_once+0xe6/0x140 [ 485.728944][T24410] vidtv_mux_init+0x748/0xbf0 [ 485.728976][T24410] vidtv_start_feed+0x34e/0x500 [ 485.729018][T24410] ? __pfx_vidtv_start_feed+0x10/0x10 [ 485.729039][T24410] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 485.729069][T24410] dmx_section_feed_start_filtering+0x3a8/0x660 [ 485.729150][T24410] dvb_dmxdev_filter_start+0x767/0xdd0 [ 485.729176][T24410] dvb_demux_do_ioctl+0xe64/0x1200 [ 485.729202][T24410] dvb_usercopy+0x167/0x340 [ 485.729218][T24410] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 485.729238][T24410] ? __pfx_dvb_usercopy+0x10/0x10 [ 485.729261][T24410] ? __fget_files+0x21f/0x3d0 [ 485.729283][T24410] dvb_demux_ioctl+0x29/0x40 [ 485.729299][T24410] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 485.729315][T24410] __x64_sys_ioctl+0x18e/0x210 [ 485.729332][T24410] do_syscall_64+0x10b/0xf80 [ 485.729355][T24410] ? clear_bhb_loop+0x40/0x90 [ 485.729375][T24410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.729391][T24410] RIP: 0033:0x7f088539ce59 [ 485.729404][T24410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.729419][T24410] RSP: 002b:00007f088616f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 485.729433][T24410] RAX: ffffffffffffffda RBX: 00007f0885615fa0 RCX: 00007f088539ce59 [ 485.729444][T24410] RDX: 0000000000000000 RSI: 00000000403c6f2b RDI: 0000000000000008 [ 485.729453][T24410] RBP: 00007f0885432d6f R08: 0000000000000000 R09: 0000000000000000 [ 485.729463][T24410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 485.729472][T24410] R13: 00007f0885616038 R14: 00007f0885615fa0 R15: 00007ffe65ed1798 [ 485.729493][T24410] [ 488.635247][ T30] audit: type=1804 audit(4294967416.216:13): pid=24845 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1289" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 488.787676][ T30] audit: type=1800 audit(4294967416.256:14): pid=24638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1295" name="lu_gp_id" dev="configfs" ino=32938 res=0 errno=0 [ 489.212429][T25056] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1292'. [ 489.784252][T25050] cgroup: fork rejected by pids controller in /syz0 [ 490.080178][T25309] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1300'. [ 491.007008][T25588] netlink: 'syz.3.1307': attribute type 33 has an invalid length. [ 492.180886][T25981] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 492.366974][T26017] ubi: mtd0 is already attached to ubi0 [ 492.401429][T26017] ubi0: detaching mtd0 [ 492.438153][T26017] ubi0: mtd0 is detached [ 492.699063][T26122] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 492.727823][T26124] ubi0: attaching mtd0 [ 492.757270][T26124] ubi0: scanning is finished [ 492.767407][T26018] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 492.912188][T26222] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1323'. [ 493.004331][T26124] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 493.047058][T26124] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 493.100737][T26124] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 493.161724][T26124] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 493.207291][T26124] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 493.239199][T26124] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 493.302086][T26124] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 493.355210][T26124] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 493.426135][T26233] ubi0: background thread "ubi_bgt0d" started, PID 26233 [ 493.742084][T26222] [U] v [ 494.058237][T26448] Process accounting paused [ 494.607812][T26666] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 495.398056][T27079] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1339'. [ 496.769789][ T30] audit: type=1804 audit(4294967424.341:15): pid=27705 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1349" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 497.158080][T28022] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 497.759709][T28339] netlink: 350 bytes leftover after parsing attributes in process `syz.0.1360'. [ 497.783298][T28341] syz_tun: tun_chr_ioctl cmd 1074025675 [ 497.802495][T28341] syz_tun: persist enabled [ 497.814696][T28341] FAULT_INJECTION: forcing a failure. [ 497.814696][T28341] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 497.861850][T28341] CPU: 0 UID: 0 PID: 28341 Comm: syz.2.1361 Tainted: G L syzkaller #0 PREEMPT(full) [ 497.861875][T28341] Tainted: [L]=SOFTLOCKUP [ 497.861879][T28341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 497.861888][T28341] Call Trace: [ 497.861893][T28341] [ 497.861898][T28341] dump_stack_lvl+0x100/0x190 [ 497.861920][T28341] should_fail_ex.cold+0x5/0xa [ 497.861940][T28341] _copy_from_user+0x2e/0xd0 [ 497.861956][T28341] kstrtouint_from_user+0xd6/0x1d0 [ 497.861975][T28341] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 497.861993][T28341] ? __lock_acquire+0x4a5/0x2630 [ 497.862012][T28341] ? lock_acquire+0x1b1/0x370 [ 497.862028][T28341] proc_fail_nth_write+0x83/0x220 [ 497.862052][T28341] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 497.862080][T28341] vfs_write+0x2aa/0x1070 [ 497.862098][T28341] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 497.862122][T28341] ? __pfx_vfs_write+0x10/0x10 [ 497.862138][T28341] ? __fget_files+0x215/0x3d0 [ 497.862159][T28341] ? __fget_files+0x21f/0x3d0 [ 497.862181][T28341] ksys_write+0x12a/0x250 [ 497.862197][T28341] ? __pfx_ksys_write+0x10/0x10 [ 497.862215][T28341] ? rcu_is_watching+0x12/0xc0 [ 497.862235][T28341] do_syscall_64+0x10b/0xf80 [ 497.862258][T28341] ? clear_bhb_loop+0x40/0x90 [ 497.862275][T28341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.862290][T28341] RIP: 0033:0x7f4a3fb5d68e [ 497.862302][T28341] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 497.862316][T28341] RSP: 002b:00007f4a40b1dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 497.862330][T28341] RAX: ffffffffffffffda RBX: 00007f4a40b1e6c0 RCX: 00007f4a3fb5d68e [ 497.862340][T28341] RDX: 0000000000000001 RSI: 00007f4a40b1e0a0 RDI: 0000000000000003 [ 497.862348][T28341] RBP: 00007f4a40b1e090 R08: 0000000000000000 R09: 0000000000000000 [ 497.862357][T28341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.862365][T28341] R13: 00007f4a3fe16038 R14: 00007f4a3fe15fa0 R15: 00007fff55c05038 [ 497.862386][T28341] [ 498.194716][T28345] ubi: mtd0 is already attached to ubi0 [ 498.201288][T28345] ubi0: detaching mtd0 [ 498.420914][T28345] ubi0: mtd0 is detached [ 499.483293][T28675] ubi0: attaching mtd0 [ 499.499114][T28675] ubi0: scanning is finished [ 499.530281][T28676] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1369'. [ 499.599166][T28675] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 499.626886][T28675] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 499.683565][T28675] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 499.743378][T28675] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 499.781301][T28675] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 499.813322][T28675] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 499.847127][T28675] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 499.862764][T28786] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1374'. [ 499.895344][T28675] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 499.936731][T28677] ubi0: detaching mtd0 [ 499.941347][T28682] ubi0: background thread "ubi_bgt0d" started, PID 28682 [ 499.984720][T28677] ubi0: mtd0 is detached [ 500.315407][T28979] FAULT_INJECTION: forcing a failure. [ 500.315407][T28979] name failslab, interval 1, probability 0, space 0, times 0 [ 500.415754][T28979] CPU: 0 UID: 0 PID: 28979 Comm: syz.0.1375 Tainted: G L syzkaller #0 PREEMPT(full) [ 500.415783][T28979] Tainted: [L]=SOFTLOCKUP [ 500.415789][T28979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 500.415798][T28979] Call Trace: [ 500.415803][T28979] [ 500.415809][T28979] dump_stack_lvl+0x100/0x190 [ 500.415832][T28979] should_fail_ex.cold+0x5/0xa [ 500.415851][T28979] should_failslab+0xc2/0x120 [ 500.415870][T28979] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 500.415893][T28979] ? prepare_creds+0x2c/0x950 [ 500.415910][T28979] ? from_kuid_munged+0xaa/0x130 [ 500.415935][T28979] prepare_creds+0x2c/0x950 [ 500.415952][T28979] __sys_setfsuid+0xda/0x380 [ 500.415974][T28979] do_syscall_64+0x10b/0xf80 [ 500.415996][T28979] ? clear_bhb_loop+0x40/0x90 [ 500.416014][T28979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.416030][T28979] RIP: 0033:0x7fb39c19ce59 [ 500.416043][T28979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.416057][T28979] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 000000000000007a [ 500.416072][T28979] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 500.416082][T28979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000ee01 [ 500.416091][T28979] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 500.416099][T28979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 500.416108][T28979] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 500.416127][T28979] [ 500.590911][T28993] input: jJǸ-¶š9ã%vø“û¨lÐQ  J86Ö‘ as /devices/virtual/input/input71 [ 501.585158][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.592254][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.842727][T29301] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1377'. [ 503.779440][T29518] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1388'. [ 504.019086][T29521] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 504.452093][T29628] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 505.062319][T29839] ubi0: attaching mtd0 [ 505.073197][T29839] ubi0: scanning is finished [ 505.189697][T29839] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 505.216761][T29839] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 505.242506][T29839] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 505.268376][T29839] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 505.293747][T29839] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 505.317798][T29839] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 505.344302][T29839] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 505.384922][T29839] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 505.437942][T29917] ubi0: background thread "ubi_bgt0d" started, PID 29917 [ 505.619240][T29944] netlink: 29 bytes leftover after parsing attributes in process `syz.1.1395'. [ 505.839882][T29944] bonding: no command found in bonding_masters - use +ifname or -ifname [ 505.887299][T30053] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1398'. [ 506.214762][T30159] FAULT_INJECTION: forcing a failure. [ 506.214762][T30159] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 506.281351][T30159] CPU: 0 UID: 0 PID: 30159 Comm: syz.0.1401 Tainted: G L syzkaller #0 PREEMPT(full) [ 506.281376][T30159] Tainted: [L]=SOFTLOCKUP [ 506.281381][T30159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 506.281390][T30159] Call Trace: [ 506.281395][T30159] [ 506.281400][T30159] dump_stack_lvl+0x100/0x190 [ 506.281422][T30159] should_fail_ex.cold+0x5/0xa [ 506.281438][T30159] ? prepare_alloc_pages+0x16d/0x5f0 [ 506.281459][T30159] should_fail_alloc_page+0xeb/0x140 [ 506.281477][T30159] prepare_alloc_pages+0x1f0/0x5f0 [ 506.281495][T30159] ? kernel_text_address+0x8d/0x100 [ 506.281513][T30159] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 506.281543][T30159] ? copy_splice_read+0x1a3/0xb90 [ 506.281561][T30159] ? stack_trace_save+0x8e/0xc0 [ 506.281581][T30159] ? __pfx_stack_trace_save+0x10/0x10 [ 506.281601][T30159] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 506.281627][T30159] ? copy_splice_read+0x1a3/0xb90 [ 506.281644][T30159] ? kasan_save_stack+0x3f/0x50 [ 506.281658][T30159] ? kasan_save_stack+0x30/0x50 [ 506.281670][T30159] ? kasan_save_track+0x14/0x30 [ 506.281683][T30159] ? __kasan_kmalloc+0xaa/0xb0 [ 506.281696][T30159] ? __kmalloc_noprof+0x301/0x850 [ 506.281708][T30159] ? copy_splice_read+0x1a3/0xb90 [ 506.281727][T30159] ? do_syscall_64+0x10b/0xf80 [ 506.281749][T30159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.281773][T30159] alloc_pages_bulk_noprof+0x657/0x1390 [ 506.281794][T30159] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 506.281813][T30159] ? __kmalloc_noprof+0x320/0x850 [ 506.281830][T30159] copy_splice_read+0x1e1/0xb90 [ 506.281852][T30159] ? __pfx_copy_splice_read+0x10/0x10 [ 506.281871][T30159] ? look_up_lock_class+0x64/0x120 [ 506.281896][T30159] ? lockdep_init_map_type+0x5c/0x250 [ 506.281912][T30159] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 506.281930][T30159] ? __pfx_copy_splice_read+0x10/0x10 [ 506.281948][T30159] do_splice_read+0x285/0x370 [ 506.281967][T30159] splice_direct_to_actor+0x2a1/0xa30 [ 506.281987][T30159] ? __pfx_direct_splice_actor+0x10/0x10 [ 506.282008][T30159] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 506.282035][T30159] do_splice_direct+0x174/0x240 [ 506.282054][T30159] ? __pfx_do_splice_direct+0x10/0x10 [ 506.282080][T30159] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 506.282100][T30159] ? rw_verify_area+0xce/0x6d0 [ 506.282116][T30159] do_sendfile+0xadc/0xe20 [ 506.282136][T30159] ? __pfx_do_sendfile+0x10/0x10 [ 506.282152][T30159] ? __fget_files+0x21f/0x3d0 [ 506.282174][T30159] __x64_sys_sendfile64+0x1d8/0x220 [ 506.282194][T30159] ? ksys_write+0x1ac/0x250 [ 506.282210][T30159] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 506.282231][T30159] ? rcu_is_watching+0x12/0xc0 [ 506.282250][T30159] do_syscall_64+0x10b/0xf80 [ 506.282271][T30159] ? clear_bhb_loop+0x40/0x90 [ 506.282289][T30159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.282303][T30159] RIP: 0033:0x7fb39c19ce59 [ 506.282315][T30159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.282329][T30159] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 506.282343][T30159] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 506.282353][T30159] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003 [ 506.282361][T30159] RBP: 00007fb39cf72090 R08: 0000000000000000 R09: 0000000000000000 [ 506.282369][T30159] R10: 0000000000002001 R11: 0000000000000246 R12: 0000000000000001 [ 506.282378][T30159] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 506.282396][T30159] [ 506.672372][T30162] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1402'. [ 506.778247][T30167] netlink: 186 bytes leftover after parsing attributes in process `syz.0.1404'. [ 506.815642][T30170] FAULT_INJECTION: forcing a failure. [ 506.815642][T30170] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 506.828749][T30170] CPU: 0 UID: 0 PID: 30170 Comm: syz.0.1405 Tainted: G L syzkaller #0 PREEMPT(full) [ 506.828772][T30170] Tainted: [L]=SOFTLOCKUP [ 506.828777][T30170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 506.828785][T30170] Call Trace: [ 506.828790][T30170] [ 506.828796][T30170] dump_stack_lvl+0x100/0x190 [ 506.828817][T30170] should_fail_ex.cold+0x5/0xa [ 506.828835][T30170] _copy_from_iter+0x1f4/0x1690 [ 506.828854][T30170] ? __asan_memset+0x23/0x50 [ 506.828876][T30170] ? __pfx__copy_from_iter+0x10/0x10 [ 506.828891][T30170] ? __pfx___alloc_skb+0x10/0x10 [ 506.828914][T30170] netlink_sendmsg+0x808/0xda0 [ 506.828939][T30170] ? __pfx_netlink_sendmsg+0x10/0x10 [ 506.828959][T30170] ? __import_iovec+0x1d2/0x640 [ 506.828975][T30170] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 506.829001][T30170] ____sys_sendmsg+0x9e1/0xb70 [ 506.829026][T30170] ? __pfx_netlink_sendmsg+0x10/0x10 [ 506.829049][T30170] ? __pfx_____sys_sendmsg+0x10/0x10 [ 506.829077][T30170] ___sys_sendmsg+0x190/0x1e0 [ 506.829100][T30170] ? __pfx____sys_sendmsg+0x10/0x10 [ 506.829142][T30170] __sys_sendmsg+0x170/0x220 [ 506.829159][T30170] ? __pfx___sys_sendmsg+0x10/0x10 [ 506.829183][T30170] ? rcu_is_watching+0x12/0xc0 [ 506.829203][T30170] do_syscall_64+0x10b/0xf80 [ 506.829226][T30170] ? clear_bhb_loop+0x40/0x90 [ 506.829243][T30170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.829258][T30170] RIP: 0033:0x7fb39c19ce59 [ 506.829270][T30170] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.829284][T30170] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 506.829298][T30170] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 506.829307][T30170] RDX: 0000000064004890 RSI: 0000200000000000 RDI: 0000000000000003 [ 506.829316][T30170] RBP: 00007fb39cf72090 R08: 0000000000000000 R09: 0000000000000000 [ 506.829324][T30170] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.829332][T30170] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 506.829350][T30170] [ 507.434461][T30160] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 507.589893][T30276] ubi: mtd0 is already attached to ubi0 [ 507.611480][T30276] ubi0: detaching mtd0 [ 507.633877][T30276] ubi0: mtd0 is detached [ 507.866754][T30372] syz_tun: tun_chr_ioctl cmd 1074025673 [ 507.943021][T30462] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1410'. [ 509.029498][T30701] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1416'. [ 509.072545][T30703] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 509.234453][T30808] FAULT_INJECTION: forcing a failure. [ 509.234453][T30808] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.291849][T30808] CPU: 0 UID: 0 PID: 30808 Comm: syz.1.1419 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.291874][T30808] Tainted: [L]=SOFTLOCKUP [ 509.291879][T30808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 509.291888][T30808] Call Trace: [ 509.291893][T30808] [ 509.291898][T30808] dump_stack_lvl+0x100/0x190 [ 509.291920][T30808] should_fail_ex.cold+0x5/0xa [ 509.291938][T30808] _copy_to_user+0x32/0xd0 [ 509.291958][T30808] simple_read_from_buffer+0xcb/0x170 [ 509.291978][T30808] proc_fail_nth_read+0x1af/0x230 [ 509.292001][T30808] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 509.292025][T30808] ? rw_verify_area+0xce/0x6d0 [ 509.292040][T30808] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 509.292062][T30808] vfs_read+0x1e4/0xb30 [ 509.292080][T30808] ? __pfx_vfs_read+0x10/0x10 [ 509.292096][T30808] ? __fget_files+0x215/0x3d0 [ 509.292117][T30808] ? __fget_files+0x21f/0x3d0 [ 509.292138][T30808] ksys_read+0x12a/0x250 [ 509.292154][T30808] ? __pfx_ksys_read+0x10/0x10 [ 509.292172][T30808] ? rcu_is_watching+0x12/0xc0 [ 509.292193][T30808] do_syscall_64+0x10b/0xf80 [ 509.292216][T30808] ? clear_bhb_loop+0x40/0x90 [ 509.292234][T30808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.292249][T30808] RIP: 0033:0x7f088535d68e [ 509.292261][T30808] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 509.292274][T30808] RSP: 002b:00007f088616efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 509.292288][T30808] RAX: ffffffffffffffda RBX: 00007f088616f6c0 RCX: 00007f088535d68e [ 509.292298][T30808] RDX: 000000000000000f RSI: 00007f088616f0a0 RDI: 0000000000000004 [ 509.292306][T30808] RBP: 00007f088616f090 R08: 0000000000000000 R09: 0000000000000000 [ 509.292315][T30808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.292323][T30808] R13: 00007f0885616038 R14: 00007f0885615fa0 R15: 00007ffe65ed1798 [ 509.292342][T30808] [ 510.291920][T31027] sctp: [Deprecated]: syz.3.1426 (pid 31027) Use of struct sctp_assoc_value in delayed_ack socket option. [ 510.291920][T31027] Use struct sctp_sack_info instead [ 510.340512][T31032] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1425'. [ 510.432741][T31064] nbd: couldn't find a device at index 2542 [ 510.504412][T31136] FAULT_INJECTION: forcing a failure. [ 510.504412][T31136] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.538302][T31136] CPU: 0 UID: 0 PID: 31136 Comm: syz.3.1428 Tainted: G L syzkaller #0 PREEMPT(full) [ 510.538327][T31136] Tainted: [L]=SOFTLOCKUP [ 510.538332][T31136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 510.538341][T31136] Call Trace: [ 510.538345][T31136] [ 510.538351][T31136] dump_stack_lvl+0x100/0x190 [ 510.538372][T31136] should_fail_ex.cold+0x5/0xa [ 510.538391][T31136] _copy_from_iter+0x1f4/0x1690 [ 510.538412][T31136] ? __asan_memset+0x23/0x50 [ 510.538435][T31136] ? __pfx__copy_from_iter+0x10/0x10 [ 510.538449][T31136] ? __pfx___alloc_skb+0x10/0x10 [ 510.538465][T31136] ? __pfx___might_resched+0x10/0x10 [ 510.538482][T31136] ? __lock_acquire+0x4a5/0x2630 [ 510.538500][T31136] netlink_sendmsg+0x808/0xda0 [ 510.538527][T31136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.538546][T31136] ? __import_iovec+0x1d2/0x640 [ 510.538563][T31136] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 510.538588][T31136] ____sys_sendmsg+0x9e1/0xb70 [ 510.538609][T31136] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.538631][T31136] ? __pfx_____sys_sendmsg+0x10/0x10 [ 510.538659][T31136] ___sys_sendmsg+0x190/0x1e0 [ 510.538682][T31136] ? __pfx____sys_sendmsg+0x10/0x10 [ 510.538729][T31136] __sys_sendmsg+0x170/0x220 [ 510.538746][T31136] ? __pfx___sys_sendmsg+0x10/0x10 [ 510.538770][T31136] ? rcu_is_watching+0x12/0xc0 [ 510.538790][T31136] do_syscall_64+0x10b/0xf80 [ 510.538812][T31136] ? clear_bhb_loop+0x40/0x90 [ 510.538829][T31136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.538844][T31136] RIP: 0033:0x7f799fd9ce59 [ 510.538856][T31136] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 510.538870][T31136] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 510.538884][T31136] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 510.538894][T31136] RDX: 0000000000000000 RSI: 00002000000008c0 RDI: 0000000000000003 [ 510.538902][T31136] RBP: 00007f79a0ca8090 R08: 0000000000000000 R09: 0000000000000000 [ 510.538911][T31136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.538919][T31136] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 510.538937][T31136] [ 511.882879][T31250] QAT: failed to copy from user cfg_data. [ 512.775391][T31456] netlink: 186 bytes leftover after parsing attributes in process `syz.0.1434'. [ 513.316918][T31566] FAULT_INJECTION: forcing a failure. [ 513.316918][T31566] name failslab, interval 1, probability 0, space 0, times 0 [ 513.385172][T31566] CPU: 0 UID: 0 PID: 31566 Comm: syz.0.1438 Tainted: G L syzkaller #0 PREEMPT(full) [ 513.385198][T31566] Tainted: [L]=SOFTLOCKUP [ 513.385204][T31566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 513.385213][T31566] Call Trace: [ 513.385218][T31566] [ 513.385224][T31566] dump_stack_lvl+0x100/0x190 [ 513.385247][T31566] should_fail_ex.cold+0x5/0xa [ 513.385268][T31566] should_failslab+0xc2/0x120 [ 513.385286][T31566] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 513.385311][T31566] ? alloc_inode+0x183/0x250 [ 513.385332][T31566] ? do_futex+0x192/0x350 [ 513.385351][T31566] alloc_inode+0x183/0x250 [ 513.385374][T31566] create_pipe_files+0x4c/0x970 [ 513.385403][T31566] do_pipe2+0xbd/0x1e0 [ 513.385423][T31566] ? __pfx_do_pipe2+0x10/0x10 [ 513.385442][T31566] ? xfd_validate_state+0x129/0x190 [ 513.385462][T31566] ? syscall_user_dispatch+0x76/0x130 [ 513.385481][T31566] __x64_sys_pipe+0x33/0x50 [ 513.385501][T31566] do_syscall_64+0x10b/0xf80 [ 513.385523][T31566] ? clear_bhb_loop+0x40/0x90 [ 513.385541][T31566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.385556][T31566] RIP: 0033:0x7fb39c19ce59 [ 513.385569][T31566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.385583][T31566] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016 [ 513.385598][T31566] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 513.385608][T31566] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 513.385616][T31566] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 513.385625][T31566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 513.385633][T31566] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 513.385652][T31566] [ 513.701678][ T30] audit: type=1804 audit(4294967441.261:16): pid=31671 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1440" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 513.728645][T31566] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 513.866691][T31773] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1441'. [ 514.086430][T31876] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 514.948117][ T30] audit: type=1804 audit(4294967442.510:17): pid=32126 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1449" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 515.250971][T32310] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 515.939822][ T5625] Bluetooth: hci0: unexpected event 0x1c length: 725 > 5 [ 516.007144][T32725] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 516.077245][T32732] FAULT_INJECTION: forcing a failure. [ 516.077245][T32732] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 516.178996][T32732] CPU: 0 UID: 0 PID: 32732 Comm: syz.0.1458 Tainted: G L syzkaller #0 PREEMPT(full) [ 516.179023][T32732] Tainted: [L]=SOFTLOCKUP [ 516.179029][T32732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 516.179039][T32732] Call Trace: [ 516.179043][T32732] [ 516.179049][T32732] dump_stack_lvl+0x100/0x190 [ 516.179074][T32732] should_fail_ex.cold+0x5/0xa [ 516.179091][T32732] ? prepare_alloc_pages+0x16d/0x5f0 [ 516.179114][T32732] should_fail_alloc_page+0xeb/0x140 [ 516.179133][T32732] prepare_alloc_pages+0x1f0/0x5f0 [ 516.179183][T32732] __alloc_frozen_pages_noprof+0x19a/0x2bc0 [ 516.179213][T32732] ? __lock_acquire+0x4a5/0x2630 [ 516.179227][T32732] ? css_rstat_updated+0x1ce/0x5a0 [ 516.179252][T32732] ? __pfx_css_rstat_updated+0x10/0x10 [ 516.179276][T32732] ? xas_create+0x1f4/0x14e0 [ 516.179360][T32732] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 516.179388][T32732] ? rcu_is_watching+0x12/0xc0 [ 516.179407][T32732] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 516.179431][T32732] ? find_held_lock+0x2b/0x80 [ 516.179455][T32732] ? __lock_acquire+0x4a5/0x2630 [ 516.179469][T32732] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 516.179492][T32732] ? policy_nodemask+0xed/0x4f0 [ 516.179511][T32732] alloc_pages_mpol+0x1fb/0x540 [ 516.179529][T32732] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 516.179547][T32732] ? filemap_get_entry+0x22d/0x450 [ 516.179562][T32732] ? filemap_get_entry+0x22d/0x450 [ 516.179579][T32732] folio_alloc_noprof+0x22/0x250 [ 516.179600][T32732] filemap_alloc_folio_noprof.part.0+0x377/0x450 [ 516.179623][T32732] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 516.179649][T32732] __filemap_get_folio_mpol+0x6a4/0xe70 [ 516.179669][T32732] ioctx_alloc+0x7e1/0x21a0 [ 516.179698][T32732] ? __pfx_ioctx_alloc+0x10/0x10 [ 516.179724][T32732] __x64_sys_io_setup+0xc9/0x220 [ 516.179746][T32732] do_syscall_64+0x10b/0xf80 [ 516.179767][T32732] ? clear_bhb_loop+0x40/0x90 [ 516.179785][T32732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.179801][T32732] RIP: 0033:0x7fb39c19ce59 [ 516.179814][T32732] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 516.179829][T32732] RSP: 002b:00007fb39a3f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 516.179844][T32732] RAX: ffffffffffffffda RBX: 00007fb39c416090 RCX: 00007fb39c19ce59 [ 516.179855][T32732] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 000000000000ffff [ 516.179864][T32732] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 516.179873][T32732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 516.179882][T32732] R13: 00007fb39c416128 R14: 00007fb39c416090 R15: 00007ffc6c074b68 [ 516.179902][T32732] [ 516.569705][ T450] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 516.668707][ T457] netlink: 7 bytes leftover after parsing attributes in process `syz.1.1464'. [ 516.694569][ T457] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 516.701524][ T457] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 516.709266][ T457] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 516.715420][ T457] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 516.949104][ T581] ubi0: attaching mtd0 [ 516.978968][ T581] ubi0: scanning is finished [ 517.114804][ T581] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 517.626069][ T818] ubi0: attaching mtd0 [ 517.655803][ T818] ubi0: scanning is finished [ 517.877971][ T818] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 517.926644][ T818] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 517.961846][ T818] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 517.993568][ T818] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 518.027396][ T818] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 518.057320][ T818] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 518.091905][ T818] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 518.137461][ T818] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 518.149517][ T1021] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 518.171885][ T1016] ubi0: background thread "ubi_bgt0d" started, PID 1016 [ 518.492409][ T1141] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 518.541688][ T1143] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1474'. [ 518.794331][ T50] Bluetooth: hci3: command 0x0c1a tx timeout [ 518.800678][ T5625] Bluetooth: hci2: command 0x0406 tx timeout [ 518.806714][ T5637] Bluetooth: hci1: command 0x0406 tx timeout [ 518.812920][ T5625] Bluetooth: hci0: command 0x0406 tx timeout [ 518.948452][ T1260] ubi: mtd0 is already attached to ubi0 [ 518.970330][ T1260] ubi0: detaching mtd0 [ 518.991434][ T1260] ubi0: mtd0 is detached [ 519.789424][ T1780] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 520.048168][ T1782] zswap: compressor not available [ 520.149985][ T1890] block2mtd: illegal erase size [ 520.437059][ T2102] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1491'. [ 520.922950][ T30] audit: type=1804 audit(4294967448.486:18): pid=2288 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1495" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 521.093373][ T2419] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1496'. [ 522.312333][ T2935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.322063][ T30] audit: type=1804 audit(4294967449.875:19): pid=2937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1506" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 522.390306][ T2935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.533934][ T3141] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1507'. [ 523.360790][ T3474] ubi0: attaching mtd0 [ 523.382221][ T3474] ubi0: scanning is finished [ 523.545887][ T3474] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 523.647163][ T3474] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 523.733091][ T3474] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 523.826207][ T3474] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 523.954698][ T3474] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 524.076116][ T3474] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 524.145142][ T3691] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 524.224056][ T3474] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 524.235205][ T3689] Process accounting resumed [ 524.325903][ T3700] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1519'. [ 524.340226][ T3474] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 524.433296][ T3628] ubi0: background thread "ubi_bgt0d" started, PID 3628 [ 524.443202][ T3495] ubi0: detaching mtd0 [ 524.509419][ T3495] ubi0: mtd0 is detached [ 525.066073][ T4168] syz_tun: tun_chr_ioctl cmd 1074025673 [ 525.762376][ T4524] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1531'. [ 525.892471][ T4626] ubi0: attaching mtd0 [ 525.943692][ T4626] ubi0: scanning is finished [ 526.423316][ T4626] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 526.544629][ T4626] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 526.651298][ T4626] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 526.728994][ T4626] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 526.823828][ T4626] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 526.931345][ T4626] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 527.038133][ T4626] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 527.186767][ T4626] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 527.296347][ T5013] ubi0: background thread "ubi_bgt0d" started, PID 5013 [ 527.573501][ T5487] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1543'. [ 528.758367][ T6247] ubi: mtd0 is already attached to ubi0 [ 528.794588][ T6247] ubi0: detaching mtd0 [ 528.834651][ T6247] ubi0: mtd0 is detached [ 529.406312][ T6546] FAULT_INJECTION: forcing a failure. [ 529.406312][ T6546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 529.419812][ T6550] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1554'. [ 529.469996][ T6546] CPU: 0 UID: 0 PID: 6546 Comm: syz.3.1555 Tainted: G L syzkaller #0 PREEMPT(full) [ 529.470023][ T6546] Tainted: [L]=SOFTLOCKUP [ 529.470028][ T6546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 529.470037][ T6546] Call Trace: [ 529.470042][ T6546] [ 529.470047][ T6546] dump_stack_lvl+0x100/0x190 [ 529.470069][ T6546] should_fail_ex.cold+0x5/0xa [ 529.470087][ T6546] _copy_from_user+0x2e/0xd0 [ 529.470103][ T6546] get_itimerspec64+0x97/0x2f0 [ 529.470126][ T6546] ? __mutex_unlock_slowpath+0x15d/0x8a0 [ 529.470150][ T6546] ? __pfx_get_itimerspec64+0x10/0x10 [ 529.470172][ T6546] ? __fget_files+0x215/0x3d0 [ 529.470189][ T6546] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 529.470215][ T6546] __x64_sys_timerfd_settime+0x15f/0x280 [ 529.470231][ T6546] ? __pfx___x64_sys_timerfd_settime+0x10/0x10 [ 529.470249][ T6546] ? ksys_write+0x1ac/0x250 [ 529.470268][ T6546] ? rcu_is_watching+0x12/0xc0 [ 529.470288][ T6546] do_syscall_64+0x10b/0xf80 [ 529.470309][ T6546] ? clear_bhb_loop+0x40/0x90 [ 529.470327][ T6546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.470341][ T6546] RIP: 0033:0x7f799fd9ce59 [ 529.470353][ T6546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.470366][ T6546] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 000000000000011e [ 529.470381][ T6546] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 529.470390][ T6546] RDX: 0000200000000040 RSI: 0000000000000003 RDI: 0000000000000003 [ 529.470398][ T6546] RBP: 00007f79a0ca8090 R08: 0000000000000000 R09: 0000000000000000 [ 529.470407][ T6546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.470415][ T6546] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 529.470432][ T6546] [ 530.197199][ T6646] [U] ^R [ 530.230827][ T30] audit: type=1804 audit(4294967457.770:20): pid=6643 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1557" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 530.722412][ T6992] ubi0: attaching mtd0 [ 530.742090][ T6992] ubi0: scanning is finished [ 530.901601][ T6992] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 530.927995][ T6992] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 530.966434][ T6992] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 531.005352][ T6992] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 531.049284][ T6992] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 531.089900][ T6992] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 531.137688][ T6992] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 531.190418][ T6992] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 531.249687][ T7094] ubi0: background thread "ubi_bgt0d" started, PID 7094 [ 532.353266][ T7528] ubi: mtd0 is already attached to ubi0 [ 532.377817][ T7528] ubi0: detaching mtd0 [ 532.403301][ T7528] ubi0: mtd0 is detached [ 532.417292][ T7559] syz_tun: tun_chr_ioctl cmd 1074025673 [ 533.165137][ T30] audit: type=1804 audit(4294967460.719:21): pid=7957 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1578" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 533.440257][ T8116] ubi0: attaching mtd0 [ 533.460384][ T8116] ubi0: scanning is finished [ 533.665062][ T8116] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 533.701994][ T8116] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 533.736951][ T8116] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 533.784669][ T8116] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 533.836161][ T8116] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 533.848617][ T8277] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 533.884605][ T8116] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 533.932390][ T8116] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 533.983287][ T8116] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 534.036635][ T8274] ubi0: background thread "ubi_bgt0d" started, PID 8274 [ 535.126166][ T8970] ubi: mtd0 is already attached to ubi0 [ 535.193899][ T8974] ubi0: detaching mtd0 [ 535.226197][ T8972] vivid-007: ================= START STATUS ================= [ 535.271487][ T8972] vivid-007: Generate PTS: true [ 535.298128][ T8974] ubi0: mtd0 is detached [ 535.312026][ T8972] vivid-007: Generate SCR: true [ 535.347878][ T8972] tpg source WxH: 320x240 (Y'CbCr) [ 535.383560][ T8972] tpg field: 1 [ 535.417016][ T8972] tpg crop: (0,0)/320x240 [ 535.442362][ T8972] tpg compose: (0,0)/320x240 [ 535.478985][ T8972] tpg colorspace: 8 [ 535.488240][ T8972] tpg transfer function: 0/0 [ 535.519097][ T8972] tpg Y'CbCr encoding: 0/0 [ 535.550708][ T8972] tpg quantization: 0/0 [ 535.567766][ T8972] tpg RGB range: 0/2 [ 535.601578][ T8972] vivid-007: ================== END STATUS ================== [ 535.701564][ T9175] FAULT_INJECTION: forcing a failure. [ 535.701564][ T9175] name failslab, interval 1, probability 0, space 0, times 0 [ 535.755562][ T9175] CPU: 0 UID: 0 PID: 9175 Comm: syz.0.1601 Tainted: G L syzkaller #0 PREEMPT(full) [ 535.755587][ T9175] Tainted: [L]=SOFTLOCKUP [ 535.755593][ T9175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 535.755603][ T9175] Call Trace: [ 535.755608][ T9175] [ 535.755614][ T9175] dump_stack_lvl+0x100/0x190 [ 535.755636][ T9175] should_fail_ex.cold+0x5/0xa [ 535.755656][ T9175] should_failslab+0xc2/0x120 [ 535.755675][ T9175] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 535.755700][ T9175] ? security_inode_alloc+0x3b/0x2c0 [ 535.755715][ T9175] ? lockdep_init_map_type+0x5c/0x250 [ 535.755733][ T9175] security_inode_alloc+0x3b/0x2c0 [ 535.755748][ T9175] inode_init_always_gfp+0xcc0/0x1000 [ 535.755771][ T9175] alloc_inode+0x8e/0x250 [ 535.755795][ T9175] new_inode+0x22/0x1c0 [ 535.755819][ T9175] hugetlbfs_get_inode+0x39a/0x700 [ 535.755869][ T9175] ? do_raw_spin_lock+0x128/0x260 [ 535.755889][ T9175] hugetlb_file_setup+0x15b/0x5b0 [ 535.755915][ T9175] memfd_alloc_file+0xc2/0x610 [ 535.755937][ T9175] ? _raw_spin_unlock+0x28/0x50 [ 535.756006][ T9175] ? __pfx_memfd_alloc_file+0x10/0x10 [ 535.756035][ T9175] __do_sys_memfd_create+0x236/0x3d0 [ 535.756062][ T9175] do_syscall_64+0x10b/0xf80 [ 535.756084][ T9175] ? clear_bhb_loop+0x40/0x90 [ 535.756102][ T9175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.756117][ T9175] RIP: 0033:0x7fb39c19ce59 [ 535.756131][ T9175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.756145][ T9175] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 535.756160][ T9175] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 535.756170][ T9175] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000040 [ 535.756179][ T9175] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 535.756188][ T9175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 535.756197][ T9175] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 535.756216][ T9175] [ 536.834979][ T9507] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1606'. [ 536.931315][ T9510] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 537.444816][ T9922] ubi0: attaching mtd0 [ 537.472735][ T9922] ubi0: scanning is finished [ 537.709193][ T9922] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 537.750838][ T9922] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 537.793336][ T9922] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 537.841522][ T9922] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 537.884654][ T9922] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 537.928914][ T9922] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 537.973780][ T9922] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 538.030687][ T9922] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 538.120075][T10124] ubi0: background thread "ubi_bgt0d" started, PID 10124 [ 538.502114][ T30] audit: type=1804 audit(4294967466.055:22): pid=10332 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1613" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 539.049355][T10657] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 539.312641][ T30] audit: type=1804 audit(4294967466.865:23): pid=10660 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1621" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 539.611080][T10877] ubi: mtd0 is already attached to ubi0 [ 539.638898][T10877] ubi0: detaching mtd0 [ 539.671120][T10877] ubi0: mtd0 is detached [ 539.771927][T10663] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 540.345991][T11497] FAULT_INJECTION: forcing a failure. [ 540.345991][T11497] name failslab, interval 1, probability 0, space 0, times 0 [ 540.428272][T11499] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 540.437798][T11497] CPU: 0 UID: 0 PID: 11497 Comm: syz.3.1632 Tainted: G L syzkaller #0 PREEMPT(full) [ 540.437824][T11497] Tainted: [L]=SOFTLOCKUP [ 540.437829][T11497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 540.437839][T11497] Call Trace: [ 540.437849][T11497] [ 540.437856][T11497] dump_stack_lvl+0x100/0x190 [ 540.437878][T11497] should_fail_ex.cold+0x5/0xa [ 540.437898][T11497] should_failslab+0xc2/0x120 [ 540.437916][T11497] kmem_cache_alloc_lru_noprof+0x80/0x6e0 [ 540.437940][T11497] ? hugetlbfs_alloc_inode+0x8c/0x1d0 [ 540.437966][T11497] hugetlbfs_alloc_inode+0x8c/0x1d0 [ 540.437986][T11497] ? __pfx_hugetlbfs_alloc_inode+0x10/0x10 [ 540.438007][T11497] alloc_inode+0x68/0x250 [ 540.438030][T11497] new_inode+0x22/0x1c0 [ 540.438054][T11497] hugetlbfs_get_inode+0x39a/0x700 [ 540.438075][T11497] ? do_raw_spin_lock+0x128/0x260 [ 540.438094][T11497] hugetlb_file_setup+0x15b/0x5b0 [ 540.438117][T11497] memfd_alloc_file+0xc2/0x610 [ 540.438140][T11497] ? _raw_spin_unlock+0x28/0x50 [ 540.438161][T11497] ? __pfx_memfd_alloc_file+0x10/0x10 [ 540.438189][T11497] __do_sys_memfd_create+0x236/0x3d0 [ 540.438213][T11497] do_syscall_64+0x10b/0xf80 [ 540.438235][T11497] ? clear_bhb_loop+0x40/0x90 [ 540.438253][T11497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.438268][T11497] RIP: 0033:0x7f799fd9ce59 [ 540.438282][T11497] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.438296][T11497] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 540.438312][T11497] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 540.438322][T11497] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000180 [ 540.438330][T11497] RBP: 00007f799fe32d6f R08: 0000000000000000 R09: 0000000000000000 [ 540.438339][T11497] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 540.438348][T11497] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 540.438368][T11497] [ 543.227110][T12765] FAULT_INJECTION: forcing a failure. [ 543.227110][T12765] name failslab, interval 1, probability 0, space 0, times 0 [ 543.313815][T12765] CPU: 0 UID: 0 PID: 12765 Comm: syz.0.1658 Tainted: G L syzkaller #0 PREEMPT(full) [ 543.313841][T12765] Tainted: [L]=SOFTLOCKUP [ 543.313847][T12765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 543.313856][T12765] Call Trace: [ 543.313861][T12765] [ 543.313868][T12765] dump_stack_lvl+0x100/0x190 [ 543.313890][T12765] should_fail_ex.cold+0x5/0xa [ 543.313910][T12765] ? tomoyo_realpath_from_path+0xb6/0x690 [ 543.314007][T12765] should_failslab+0xc2/0x120 [ 543.314027][T12765] __kmalloc_noprof+0xe0/0x850 [ 543.314040][T12765] ? kfree+0x1dd/0x6c0 [ 543.314064][T12765] tomoyo_realpath_from_path+0xb6/0x690 [ 543.314088][T12765] tomoyo_check_open_permission+0x2af/0x3c0 [ 543.314106][T12765] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 543.314129][T12765] ? hook_file_open+0x24e/0x7a0 [ 543.314192][T12765] ? path_get+0x61/0x80 [ 543.314216][T12765] tomoyo_file_open+0x6b/0x90 [ 543.314238][T12765] security_file_open+0xb5/0x1e0 [ 543.314257][T12765] do_dentry_open+0x5aa/0x1660 [ 543.314277][T12765] ? security_inode_permission+0xbf/0x250 [ 543.314297][T12765] vfs_open+0x82/0x3f0 [ 543.314321][T12765] path_openat+0x208c/0x31a0 [ 543.314345][T12765] ? __pfx_path_openat+0x10/0x10 [ 543.314371][T12765] do_file_open+0x20e/0x430 [ 543.314391][T12765] ? __pfx_do_file_open+0x10/0x10 [ 543.314423][T12765] ? alloc_fd+0x476/0x790 [ 543.314443][T12765] ? do_getname+0x191/0x390 [ 543.314466][T12765] do_sys_openat2+0x10d/0x1e0 [ 543.314488][T12765] ? __pfx_do_sys_openat2+0x10/0x10 [ 543.314517][T12765] __x64_sys_openat+0x12d/0x210 [ 543.314540][T12765] ? __pfx___x64_sys_openat+0x10/0x10 [ 543.314569][T12765] ? ksys_write+0x1ac/0x250 [ 543.314589][T12765] ? rcu_is_watching+0x12/0xc0 [ 543.314611][T12765] do_syscall_64+0x10b/0xf80 [ 543.314633][T12765] ? clear_bhb_loop+0x40/0x90 [ 543.314652][T12765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.314668][T12765] RIP: 0033:0x7fb39c19ce59 [ 543.314682][T12765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.314697][T12765] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 543.314712][T12765] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 543.314723][T12765] RDX: 0000000000000000 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 543.314732][T12765] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 543.314741][T12765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 543.314751][T12765] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 543.314770][T12765] [ 543.314777][T12765] ERROR: Out of memory at tomoyo_realpath_from_path. [ 543.614741][T12773] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 545.442767][T13915] ubi0: attaching mtd0 [ 545.465327][T13915] ubi0: scanning is finished [ 545.678982][T13987] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 545.753101][T13915] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 545.797941][T13915] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 545.838693][T13915] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 545.883863][T13915] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 545.931039][T13915] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 545.978771][T13915] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 545.993866][T14243] syz_tun: tun_chr_ioctl cmd 1074025673 [ 546.023873][T13915] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 546.072385][T13915] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 546.128569][T14134] ubi0: background thread "ubi_bgt0d" started, PID 14134 [ 546.138876][T14265] ubi: mtd0 is already attached to ubi0 [ 546.996754][T14866] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 548.147848][T15495] FAULT_INJECTION: forcing a failure. [ 548.147848][T15495] name failslab, interval 1, probability 0, space 0, times 0 [ 548.220213][T15495] CPU: 0 UID: 0 PID: 15495 Comm: syz.2.1703 Tainted: G L syzkaller #0 PREEMPT(full) [ 548.220240][T15495] Tainted: [L]=SOFTLOCKUP [ 548.220245][T15495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 548.220254][T15495] Call Trace: [ 548.220260][T15495] [ 548.220267][T15495] dump_stack_lvl+0x100/0x190 [ 548.220289][T15495] should_fail_ex.cold+0x5/0xa [ 548.220308][T15495] should_failslab+0xc2/0x120 [ 548.220327][T15495] __kmalloc_cache_noprof+0x7a/0x6f0 [ 548.220348][T15495] ? snd_seq_oss_writeq_new+0xb5/0x2b0 [ 548.220466][T15495] snd_seq_oss_writeq_new+0xb5/0x2b0 [ 548.220484][T15495] ? __pfx_snd_seq_oss_writeq_new+0x10/0x10 [ 548.220508][T15495] ? __raw_spin_lock_init+0x3a/0x110 [ 548.220530][T15495] snd_seq_oss_open+0x7bc/0xa10 [ 548.220577][T15495] odev_open+0x6f/0x90 [ 548.220601][T15495] ? __pfx_odev_open+0x10/0x10 [ 548.220620][T15495] soundcore_open+0x2e3/0x5a0 [ 548.220670][T15495] ? __pfx_soundcore_open+0x10/0x10 [ 548.220690][T15495] chrdev_open+0x234/0x6a0 [ 548.220710][T15495] ? __pfx_apparmor_file_open+0x10/0x10 [ 548.220735][T15495] ? __pfx_chrdev_open+0x10/0x10 [ 548.220754][T15495] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 548.220778][T15495] do_dentry_open+0x6d8/0x1660 [ 548.220798][T15495] ? __pfx_chrdev_open+0x10/0x10 [ 548.220821][T15495] vfs_open+0x82/0x3f0 [ 548.220844][T15495] path_openat+0x208c/0x31a0 [ 548.220869][T15495] ? __pfx_path_openat+0x10/0x10 [ 548.220894][T15495] do_file_open+0x20e/0x430 [ 548.220914][T15495] ? __pfx_do_file_open+0x10/0x10 [ 548.220946][T15495] ? alloc_fd+0x476/0x790 [ 548.220966][T15495] ? do_getname+0x191/0x390 [ 548.220989][T15495] do_sys_openat2+0x10d/0x1e0 [ 548.221011][T15495] ? __pfx_do_sys_openat2+0x10/0x10 [ 548.221040][T15495] __x64_sys_openat+0x12d/0x210 [ 548.221070][T15495] ? __pfx___x64_sys_openat+0x10/0x10 [ 548.221097][T15495] ? rcu_is_watching+0x12/0xc0 [ 548.221119][T15495] do_syscall_64+0x10b/0xf80 [ 548.221142][T15495] ? clear_bhb_loop+0x40/0x90 [ 548.221161][T15495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.221177][T15495] RIP: 0033:0x7f4a3fb9ce59 [ 548.221191][T15495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.221205][T15495] RSP: 002b:00007f4a40b1e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 548.221221][T15495] RAX: ffffffffffffffda RBX: 00007f4a3fe15fa0 RCX: 00007f4a3fb9ce59 [ 548.221232][T15495] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 548.221242][T15495] RBP: 00007f4a3fc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 548.221252][T15495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 548.221260][T15495] R13: 00007f4a3fe16038 R14: 00007f4a3fe15fa0 R15: 00007fff55c05038 [ 548.221280][T15495] [ 548.520364][T15502] usb usb35: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 548.833475][T15793] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1708'. [ 549.305254][T16118] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1711'. [ 549.330240][T16118] veth1_macvtap: left promiscuous mode [ 549.340144][T16118] macsec0: entered promiscuous mode [ 549.349573][T16118] macsec0: entered allmulticast mode [ 549.548135][T16121] usb usb35: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 549.607961][T16121] FAULT_INJECTION: forcing a failure. [ 549.607961][T16121] name failslab, interval 1, probability 0, space 0, times 0 [ 549.678941][T16121] CPU: 0 UID: 0 PID: 16121 Comm: syz.3.1712 Tainted: G L syzkaller #0 PREEMPT(full) [ 549.678982][T16121] Tainted: [L]=SOFTLOCKUP [ 549.678987][T16121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 549.678995][T16121] Call Trace: [ 549.679001][T16121] [ 549.679006][T16121] dump_stack_lvl+0x100/0x190 [ 549.679030][T16121] should_fail_ex.cold+0x5/0xa [ 549.679050][T16121] should_failslab+0xc2/0x120 [ 549.679067][T16121] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 549.679090][T16121] ? security_file_alloc+0x34/0x2c0 [ 549.679107][T16121] ? trace_kmem_cache_alloc+0xd5/0x100 [ 549.679127][T16121] security_file_alloc+0x34/0x2c0 [ 549.679144][T16121] init_file+0x95/0x480 [ 549.679165][T16121] alloc_empty_file+0x79/0x1c0 [ 549.679187][T16121] path_openat+0xe8/0x31a0 [ 549.679204][T16121] ? kasan_save_stack+0x3f/0x50 [ 549.679218][T16121] ? kasan_save_stack+0x30/0x50 [ 549.679231][T16121] ? kasan_save_track+0x14/0x30 [ 549.679244][T16121] ? __kasan_slab_alloc+0x89/0x90 [ 549.679258][T16121] ? kmem_cache_alloc_noprof+0x241/0x6e0 [ 549.679280][T16121] ? do_getname+0x35/0x390 [ 549.679300][T16121] ? do_sys_openat2+0xc5/0x1e0 [ 549.679321][T16121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.679338][T16121] ? __pfx_path_openat+0x10/0x10 [ 549.679362][T16121] do_file_open+0x20e/0x430 [ 549.679381][T16121] ? __pfx_do_file_open+0x10/0x10 [ 549.679412][T16121] ? alloc_fd+0x476/0x790 [ 549.679431][T16121] ? do_getname+0x191/0x390 [ 549.679453][T16121] do_sys_openat2+0x10d/0x1e0 [ 549.679475][T16121] ? __pfx_do_sys_openat2+0x10/0x10 [ 549.679498][T16121] ? __sys_sendmsg+0x18f/0x220 [ 549.679519][T16121] __x64_sys_openat+0x12d/0x210 [ 549.679541][T16121] ? __pfx___x64_sys_openat+0x10/0x10 [ 549.679563][T16121] ? ksys_write+0x1ac/0x250 [ 549.679581][T16121] ? rcu_is_watching+0x12/0xc0 [ 549.679601][T16121] do_syscall_64+0x10b/0xf80 [ 549.679623][T16121] ? clear_bhb_loop+0x40/0x90 [ 549.679641][T16121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.679655][T16121] RIP: 0033:0x7f799fd9ce59 [ 549.679667][T16121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.679680][T16121] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 549.679694][T16121] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 549.679704][T16121] RDX: 0000000000000080 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 549.679713][T16121] RBP: 00007f79a0ca8090 R08: 0000000000000000 R09: 0000000000000000 [ 549.679721][T16121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 549.679729][T16121] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 549.679747][T16121] [ 550.089445][T16331] FAULT_INJECTION: forcing a failure. [ 550.089445][T16331] name fail_futex, interval 1, probability 0, space 0, times 0 [ 550.102356][T16331] CPU: 0 UID: 0 PID: 16331 Comm: syz.0.1716 Tainted: G L syzkaller #0 PREEMPT(full) [ 550.102380][T16331] Tainted: [L]=SOFTLOCKUP [ 550.102386][T16331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 550.102395][T16331] Call Trace: [ 550.102401][T16331] [ 550.102406][T16331] dump_stack_lvl+0x100/0x190 [ 550.102428][T16331] should_fail_ex.cold+0x5/0xa [ 550.102448][T16331] get_futex_key+0x1d2/0x1510 [ 550.102466][T16331] ? __pfx_get_futex_key+0x10/0x10 [ 550.102481][T16331] ? find_held_lock+0x2b/0x80 [ 550.102500][T16331] ? futex_wake+0x456/0x530 [ 550.102523][T16331] futex_wake+0xea/0x530 [ 550.102544][T16331] ? __pfx_futex_wake+0x10/0x10 [ 550.102566][T16331] ? ksys_write+0x190/0x250 [ 550.102587][T16331] do_futex+0x32b/0x350 [ 550.102603][T16331] ? __pfx_do_futex+0x10/0x10 [ 550.102624][T16331] __x64_sys_futex+0x34f/0x4d0 [ 550.102643][T16331] ? __pfx___x64_sys_futex+0x10/0x10 [ 550.102658][T16331] ? __task_pid_nr_ns+0x1ca/0x510 [ 550.102686][T16331] ? rcu_is_watching+0x12/0xc0 [ 550.102706][T16331] do_syscall_64+0x10b/0xf80 [ 550.102729][T16331] ? clear_bhb_loop+0x40/0x90 [ 550.102747][T16331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.102762][T16331] RIP: 0033:0x7fb39c19ce59 [ 550.102775][T16331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.102790][T16331] RSP: 002b:00007fb39cf720e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 550.102804][T16331] RAX: ffffffffffffffda RBX: 00007fb39c415fa8 RCX: 00007fb39c19ce59 [ 550.102814][T16331] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb39c415fac [ 550.102823][T16331] RBP: 00007fb39c415fa0 R08: 0000000000000001 R09: 0000000000000000 [ 550.102832][T16331] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 550.102840][T16331] R13: 00007fb39c416038 R14: 00007ffc6c074a80 R15: 00007ffc6c074b68 [ 550.102874][T16331] [ 550.616499][T16360] ubi: mtd0 is already attached to ubi0 [ 550.622587][T16360] ubi0: detaching mtd0 [ 550.660863][T16360] ubi0: mtd0 is detached [ 550.699499][T16372] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1722'. [ 552.057138][T17372] netlink: 342 bytes leftover after parsing attributes in process `syz.2.1734'. [ 552.164321][T17375] ubi0: attaching mtd0 [ 552.187373][T17375] ubi0: scanning is finished [ 552.388139][T17375] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 552.432241][T17375] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 552.470209][T17375] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 552.511655][T17375] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 552.558309][T17375] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 552.586105][T17375] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 552.630188][T17375] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 552.684706][T17375] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 552.750043][T17579] ubi0: background thread "ubi_bgt0d" started, PID 17579 [ 552.951478][ T30] audit: type=1800 audit(4294967480.497:24): pid=17687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1738" name="features" dev="configfs" ino=40572 res=0 errno=0 [ 553.351706][T17817] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 553.676701][T17821] cgroup: fork rejected by pids controller in /syz1 [ 553.749307][T18098] ubi: mtd0 is already attached to ubi0 [ 553.783364][T18098] ubi0: detaching mtd0 [ 553.824757][T18098] ubi0: mtd0 is detached [ 553.943995][T18269] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1748'. [ 554.163705][T18441] netlink: 'syz.2.1750': attribute type 11 has an invalid length. [ 554.452144][T18441] Process accounting paused [ 554.673819][T18822] netlink: 208 bytes leftover after parsing attributes in process `syz.3.1756'. [ 554.718961][T18822] FAULT_INJECTION: forcing a failure. [ 554.718961][T18822] name failslab, interval 1, probability 0, space 0, times 0 [ 554.794985][T18822] CPU: 0 UID: 0 PID: 18822 Comm: syz.3.1756 Tainted: G L syzkaller #0 PREEMPT(full) [ 554.795011][T18822] Tainted: [L]=SOFTLOCKUP [ 554.795016][T18822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 554.795028][T18822] Call Trace: [ 554.795033][T18822] [ 554.795039][T18822] dump_stack_lvl+0x100/0x190 [ 554.795061][T18822] should_fail_ex.cold+0x5/0xa [ 554.795082][T18822] should_failslab+0xc2/0x120 [ 554.795100][T18822] __kmalloc_node_track_caller_noprof+0xe3/0x850 [ 554.795116][T18822] ? kasprintf+0xc7/0x100 [ 554.795206][T18822] ? __lock_acquire+0x4a5/0x2630 [ 554.795224][T18822] kvasprintf+0xbc/0x150 [ 554.795240][T18822] ? __pfx_kvasprintf+0x10/0x10 [ 554.795263][T18822] kasprintf+0xc7/0x100 [ 554.795279][T18822] ? __pfx_kasprintf+0x10/0x10 [ 554.795296][T18822] ? __is_module_percpu_address+0x1c2/0x430 [ 554.795325][T18822] wq_init_lockdep+0x3f/0xe0 [ 554.795348][T18822] alloc_workqueue_noprof+0xdc/0x130 [ 554.795369][T18822] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 554.795391][T18822] ? trace_kmalloc+0xe3/0x110 [ 554.795409][T18822] ? __kasan_kmalloc+0xaa/0xb0 [ 554.795429][T18822] ieee80211_register_hw+0x2148/0x4570 [ 554.795457][T18822] ? mark_held_locks+0x1/0x70 [ 554.795477][T18822] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 554.795492][T18822] ? __pfx___debug_object_init+0x10/0x10 [ 554.795520][T18822] ? find_held_lock+0x2b/0x80 [ 554.795541][T18822] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 554.795563][T18822] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 554.795585][T18822] ? __hrtimer_setup+0x208/0x330 [ 554.795604][T18822] mac80211_hwsim_new_radio+0x2a01/0x5aa0 [ 554.795634][T18822] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 554.795657][T18822] hwsim_new_radio_nl+0xc5f/0x1370 [ 554.795674][T18822] ? rcu_is_watching+0x12/0xc0 [ 554.795693][T18822] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 554.795715][T18822] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1e5/0x2f0 [ 554.795740][T18822] ? genl_family_rcv_msg_attrs_parse.isra.0+0x1ef/0x2f0 [ 554.795769][T18822] genl_family_rcv_msg_doit+0x214/0x300 [ 554.795786][T18822] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 554.795800][T18822] ? genl_get_cmd+0x3e7/0x760 [ 554.795827][T18822] ? bpf_lsm_capable+0x9/0x10 [ 554.795844][T18822] ? security_capable+0x80/0x260 [ 554.795867][T18822] ? ns_capable+0xd2/0xf0 [ 554.795886][T18822] genl_rcv_msg+0x560/0x800 [ 554.795903][T18822] ? __pfx_genl_rcv_msg+0x10/0x10 [ 554.795918][T18822] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 554.795941][T18822] netlink_rcv_skb+0x159/0x420 [ 554.795963][T18822] ? __pfx_genl_rcv_msg+0x10/0x10 [ 554.795978][T18822] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 554.796007][T18822] ? netlink_deliver_tap+0x1ae/0xcc0 [ 554.796030][T18822] genl_rcv+0x28/0x40 [ 554.796052][T18822] netlink_unicast+0x585/0x850 [ 554.796076][T18822] ? __pfx_netlink_unicast+0x10/0x10 [ 554.796102][T18822] netlink_sendmsg+0x8b0/0xda0 [ 554.796127][T18822] ? __pfx_netlink_sendmsg+0x10/0x10 [ 554.796147][T18822] ? __import_iovec+0x1d2/0x640 [ 554.796165][T18822] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 554.796191][T18822] ____sys_sendmsg+0x9e1/0xb70 [ 554.796212][T18822] ? __pfx_netlink_sendmsg+0x10/0x10 [ 554.796235][T18822] ? __pfx_____sys_sendmsg+0x10/0x10 [ 554.796260][T18822] ? __pfx_futex_wake_mark+0x10/0x10 [ 554.796282][T18822] ___sys_sendmsg+0x190/0x1e0 [ 554.796306][T18822] ? __pfx____sys_sendmsg+0x10/0x10 [ 554.796351][T18822] __sys_sendmsg+0x170/0x220 [ 554.796369][T18822] ? __pfx___sys_sendmsg+0x10/0x10 [ 554.796385][T18822] ? __x64_sys_futex+0x34f/0x4d0 [ 554.796409][T18822] ? rcu_is_watching+0x12/0xc0 [ 554.796428][T18822] do_syscall_64+0x10b/0xf80 [ 554.796457][T18822] ? clear_bhb_loop+0x40/0x90 [ 554.796476][T18822] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.796492][T18822] RIP: 0033:0x7f799fd9ce59 [ 554.796505][T18822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.796519][T18822] RSP: 002b:00007f79a0ca8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 554.796534][T18822] RAX: ffffffffffffffda RBX: 00007f79a0015fa0 RCX: 00007f799fd9ce59 [ 554.796544][T18822] RDX: 0000000004048000 RSI: 0000200000004240 RDI: 0000000000000006 [ 554.796553][T18822] RBP: 00007f799fe32d6f R08: 0000000000000000 R09: 0000000000000000 [ 554.796562][T18822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 554.796571][T18822] R13: 00007f79a0016038 R14: 00007f79a0015fa0 R15: 00007ffcee959038 [ 554.796592][T18822] [ 555.693591][T18835] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 556.223572][T19037] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 556.368940][T19142] netlink: 342 bytes leftover after parsing attributes in process `syz.1.1761'. [ 556.686611][T19218] [U] ^R [ 557.031625][T19664] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 557.156426][T19668] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1771'. [ 558.153298][T20298] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1782'. [ 558.168260][T20296] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 558.256863][T20299] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 558.875045][ T30] audit: type=1800 audit(4294967486.413:25): pid=20720 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1790" name="discovery_nqn" dev="configfs" ino=41290 res=0 errno=0 [ 559.070493][T20734] syz_tun: tun_chr_ioctl cmd 2147767521 [ 559.671664][T21242] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1797'. [ 559.899167][T21380] netlink: NAT attribute type 0 has unexpected length (4 != 0) [ 559.912140][T21446] FAULT_INJECTION: forcing a failure. [ 559.912140][T21446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.964721][T21446] CPU: 0 UID: 0 PID: 21446 Comm: syz.2.1801 Tainted: G L syzkaller #0 PREEMPT(full) [ 559.964745][T21446] Tainted: [L]=SOFTLOCKUP [ 559.964750][T21446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 559.964759][T21446] Call Trace: [ 559.964764][T21446] [ 559.964770][T21446] dump_stack_lvl+0x100/0x190 [ 559.964790][T21446] should_fail_ex.cold+0x5/0xa [ 559.964810][T21446] _copy_from_iter+0x1f4/0x1690 [ 559.964828][T21446] ? __asan_memset+0x23/0x50 [ 559.964851][T21446] ? __pfx__copy_from_iter+0x10/0x10 [ 559.964865][T21446] ? __pfx___alloc_skb+0x10/0x10 [ 559.964888][T21446] netlink_sendmsg+0x808/0xda0 [ 559.964914][T21446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.964934][T21446] ? __import_iovec+0x1d2/0x640 [ 559.964956][T21446] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 559.964981][T21446] ____sys_sendmsg+0x9e1/0xb70 [ 559.965002][T21446] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.965024][T21446] ? __pfx_____sys_sendmsg+0x10/0x10 [ 559.965053][T21446] ___sys_sendmsg+0x190/0x1e0 [ 559.965076][T21446] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.965117][T21446] __sys_sendmsg+0x170/0x220 [ 559.965135][T21446] ? __pfx___sys_sendmsg+0x10/0x10 [ 559.965159][T21446] ? rcu_is_watching+0x12/0xc0 [ 559.965179][T21446] do_syscall_64+0x10b/0xf80 [ 559.965201][T21446] ? clear_bhb_loop+0x40/0x90 [ 559.965218][T21446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.965233][T21446] RIP: 0033:0x7f4a3fb9ce59 [ 559.965245][T21446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.965259][T21446] RSP: 002b:00007f4a40b1e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.965273][T21446] RAX: ffffffffffffffda RBX: 00007f4a3fe15fa0 RCX: 00007f4a3fb9ce59 [ 559.965282][T21446] RDX: 000000000400c880 RSI: 0000200000000000 RDI: 0000000000000003 [ 559.965291][T21446] RBP: 00007f4a40b1e090 R08: 0000000000000000 R09: 0000000000000000 [ 559.965299][T21446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.965307][T21446] R13: 00007f4a3fe16038 R14: 00007f4a3fe15fa0 R15: 00007fff55c05038 [ 559.965325][T21446] [ 560.241041][T21529] openvswitch: netlink: Flow key attribute not present in set flow. [ 560.842513][ T30] audit: type=1804 audit(4294967488.382:26): pid=21677 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1808" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 561.577626][T22344] bonding: no command found in bonding_masters - use +ifname or -ifname [ 563.064084][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.075202][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.137882][ T1256] Bluetooth: hci1: unexpected subevent 0x01 length: 123 > 18 [ 563.171161][ T1256] Bluetooth: hci1: unexpected event 0x05 length: 6 > 4 [ 563.448494][ T30] audit: type=1804 audit(4294967490.980:27): pid=23380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1832" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 563.604362][ T30] audit: type=1804 audit(4294967491.020:28): pid=23419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1833" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 563.775969][T23647] syz_tun: tun_chr_ioctl cmd 1074025673 [ 563.829337][ T30] audit: type=1804 audit(4294967491.360:29): pid=23609 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1834" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 564.149831][ T4944] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 564.161617][ T4944] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 564.174168][ T4944] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 564.185330][ T4944] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 564.194108][ T4944] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 564.359186][ T4944] Bluetooth: hci0: unexpected subevent 0x01 length: 123 > 18 [ 564.388875][ T1256] Bluetooth: hci0: unexpected event 0x04 length: 6 < 10 [ 565.222191][ T1256] Bluetooth: hci1: command tx timeout [ 566.262752][ T1256] Bluetooth: hci4: command tx timeout [ 566.422988][ T4944] Bluetooth: hci0: command 0x0406 tx timeout [ 566.821071][T24600] ubi0: attaching mtd0 [ 566.840239][T24600] ubi0: scanning is finished [ 567.152343][T24600] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 567.203130][T24600] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 567.255149][T24600] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 567.270677][T23851] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.296978][T24600] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 567.311689][T23851] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.345417][T24600] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 567.359789][T23851] bridge_slave_0: entered allmulticast mode [ 567.390956][T24600] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 567.401734][T23851] bridge_slave_0: entered promiscuous mode [ 567.439100][T24600] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 567.552393][T24600] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 567.639398][T24706] ubi0: background thread "ubi_bgt0d" started, PID 24706 [ 567.694444][T23851] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.762839][T23851] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.844242][T23851] bridge_slave_1: entered allmulticast mode [ 567.898785][T23851] bridge_slave_1: entered promiscuous mode [ 568.194546][T23851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 568.270749][T23851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.345064][ T4944] Bluetooth: hci4: command tx timeout [ 568.508346][ T4944] Bluetooth: hci0: command 0x0406 tx timeout [ 568.549544][T25076] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1854'. [ 568.611061][ T8800] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.648305][T23851] team0: Port device team_slave_0 added [ 568.683686][T23851] team0: Port device team_slave_1 added [ 568.856679][ T8800] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.915398][T25265] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1856'. [ 568.939208][T23851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 568.947534][T23851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 568.988894][T23851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 569.031265][T23851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 569.063565][T23851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 569.108986][T25335] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 569.135486][T23851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 569.242297][ T8800] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.461465][ T8800] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 569.496952][T23851] hsr_slave_0: entered promiscuous mode [ 569.511241][T23851] hsr_slave_1: entered promiscuous mode [ 569.523813][T23851] debugfs: 'hsr0' already exists in 'hsr' [ 569.531716][T23851] Cannot create hsr debugfs directory [ 569.548924][T25406] syz_tun: tun_chr_ioctl cmd 1074025673 [ 569.767552][T25448] ubi: mtd0 is already attached to ubi0 [ 569.794603][T25448] ubi0: detaching mtd0 [ 569.819474][T25448] ubi0: mtd0 is detached [ 570.425213][ T1256] Bluetooth: hci4: command tx timeout [ 570.458680][ T8800] bridge_slave_1: left allmulticast mode [ 570.467234][T25661] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 570.487339][ T8800] bridge_slave_1: left promiscuous mode [ 570.534451][ T8800] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.612020][ T8800] bridge_slave_0: left allmulticast mode [ 570.645883][ T8800] bridge_slave_0: left promiscuous mode [ 570.681571][ T8800] bridge0: port 1(bridge_slave_0) entered disabled state [ 570.967605][T25877] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1869'. [ 571.393129][ T8800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 571.442590][ T8800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 571.484074][ T8800] bond0 (unregistering): Released all slaves [ 571.496581][T26189] ubi0: attaching mtd0 [ 571.520919][T26189] ubi0: scanning is finished [ 571.657335][ T5289] 8021q: adding VLAN 0 to HW filter on device eth1 [ 571.773013][T26189] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 571.812215][T26189] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 571.859726][T26189] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 571.901453][T26189] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 571.940267][T26189] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 571.981039][T26189] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 572.031094][T26189] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1374467780 [ 572.099536][T26189] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 572.163691][T26293] ubi0: background thread "ubi_bgt0d" started, PID 26293 [ 572.506701][ T1256] Bluetooth: hci4: command tx timeout [ 572.823569][T26513] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 573.197600][ T8800] hsr_slave_0: left promiscuous mode [ 573.219213][ T8800] hsr_slave_1: left promiscuous mode [ 573.243830][ T8800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 573.278843][ T8800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 573.329889][ T8800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 573.375631][ T8800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 573.646366][ T8800] veth0_macvtap: left promiscuous mode [ 573.811074][ T8800] veth1_vlan: left promiscuous mode [ 573.983340][ T8800] veth0_vlan: left promiscuous mode [ 574.413804][T26724] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1878'. [ 574.824823][ T8800] team0 (unregistering): Port device team_slave_1 removed [ 574.859980][ T8800] team0 (unregistering): Port device team_slave_0 removed [ 575.654463][T23851] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 575.696887][T23851] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 575.723504][T23851] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 575.770758][T23851] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 575.811177][T23851] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 575.859574][T23851] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 575.907737][T23851] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 575.957899][T23851] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 575.977783][T26938] ubi: mtd0 is already attached to ubi0 [ 576.009917][T26938] ubi0: detaching mtd0 [ 576.036788][T26938] ubi0: mtd0 is detached [ 576.312370][T27049] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1882'. [ 576.790162][T23851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 576.854440][T23851] 8021q: adding VLAN 0 to HW filter on device team0 [ 576.919782][ T8826] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.926905][ T8826] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.045946][ T8826] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.053103][ T8826] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.511285][T27477] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 578.506032][T28037] netlink: 342 bytes leftover after parsing attributes in process `syz.0.1893'. [ 578.923774][T23851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 579.204767][T23851] veth0_vlan: entered promiscuous mode [ 579.237245][ T30] audit: type=1804 audit(4294967506.760:30): pid=28218 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.1895" name="/newroot/sys/kernel/debug/tracing/error_log" dev="tracefs" ino=1959 res=1 errno=0 [ 579.286212][T23851] veth1_vlan: entered promiscuous mode [ 579.398228][T23851] veth0_macvtap: entered promiscuous mode [ 579.475208][T23851] veth1_macvtap: entered promiscuous mode [ 579.587035][T23851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 579.639294][T23851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 579.660078][ T8829] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.685543][ T8829] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.749911][ T8829] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.788274][ T8829] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.016827][ T8826] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 580.063535][ T8826] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 580.148352][ T8826] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 580.196155][ T8826] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 580.683706][T28971] netlink: 342 bytes leftover after parsing attributes in process `syz.3.1904'. [ 580.922539][T29093] netlink: 'syz.0.1905': attribute type 33 has an invalid length. [ 581.514821][T29334] vivid-008: ================= START STATUS ================= [ 581.565806][T29334] vivid-008: ================== END STATUS ================== [ 582.250073][T29864] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 582.329660][T29864] FAULT_INJECTION: forcing a failure. [ 582.329660][T29864] name failslab, interval 1, probability 0, space 0, times 0 [ 582.391284][T29864] CPU: 0 UID: 0 PID: 29864 Comm: syz.0.1915 Tainted: G L syzkaller #0 PREEMPT(full) [ 582.391311][T29864] Tainted: [L]=SOFTLOCKUP [ 582.391316][T29864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 582.391326][T29864] Call Trace: [ 582.391332][T29864] [ 582.391338][T29864] dump_stack_lvl+0x100/0x190 [ 582.391366][T29864] should_fail_ex.cold+0x5/0xa [ 582.391387][T29864] should_failslab+0xc2/0x120 [ 582.391408][T29864] __kmalloc_cache_noprof+0x7a/0x6f0 [ 582.391429][T29864] ? vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 582.391453][T29864] vidtv_mux_create_pid_ctx_once.part.0+0x49/0x200 [ 582.391472][T29864] vidtv_mux_init+0x8a6/0xbf0 [ 582.391490][T29864] vidtv_start_feed+0x34e/0x500 [ 582.391510][T29864] ? __pfx_vidtv_start_feed+0x10/0x10 [ 582.391529][T29864] ? __pfx_vidtv_bridge_on_new_pkts_avail+0x10/0x10 [ 582.391559][T29864] dmx_section_feed_start_filtering+0x3a8/0x660 [ 582.391588][T29864] dvb_dmxdev_filter_start+0x767/0xdd0 [ 582.391613][T29864] dvb_demux_do_ioctl+0xe64/0x1200 [ 582.391637][T29864] dvb_usercopy+0x167/0x340 [ 582.391652][T29864] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 582.391671][T29864] ? __pfx_dvb_usercopy+0x10/0x10 [ 582.391695][T29864] ? __fget_files+0x21f/0x3d0 [ 582.391717][T29864] dvb_demux_ioctl+0x29/0x40 [ 582.391733][T29864] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 582.391750][T29864] __x64_sys_ioctl+0x18e/0x210 [ 582.391767][T29864] do_syscall_64+0x10b/0xf80 [ 582.391790][T29864] ? clear_bhb_loop+0x40/0x90 [ 582.391808][T29864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.391824][T29864] RIP: 0033:0x7fb39c19ce59 [ 582.391837][T29864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.391852][T29864] RSP: 002b:00007fb39cf72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 582.391867][T29864] RAX: ffffffffffffffda RBX: 00007fb39c415fa0 RCX: 00007fb39c19ce59 [ 582.391884][T29864] RDX: 0000000000000000 RSI: 00000000403c6f2b RDI: 0000000000000008 [ 582.391894][T29864] RBP: 00007fb39c232d6f R08: 0000000000000000 R09: 0000000000000000 [ 582.391903][T29864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 582.391912][T29864] R13: 00007fb39c416038 R14: 00007fb39c415fa0 R15: 00007ffc6c074b68 [ 582.391932][T29864] [ 582.906447][ T995] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 582.918353][ T995] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 582.926749][ T995] CPU: 0 UID: 0 PID: 995 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 582.937574][ T995] Tainted: [L]=SOFTLOCKUP [ 582.941873][ T995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 582.951906][ T995] Workqueue: events vidtv_mux_tick [ 582.957002][ T995] RIP: 0010:vidtv_psi_ts_psi_write_into+0x4bb/0xb40 [ 582.963594][ T995] Code: 9b 26 d6 f9 4d 8d 65 20 4c 89 e0 48 c1 e8 03 80 3c 18 00 0f 85 fe 04 00 00 49 8b 45 20 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 <0f> b6 14 1a 38 ca 7f 08 84 d2 0f 85 c6 04 00 00 0f b6 10 48 8b 7c [ 582.983178][ T995] RSP: 0018:ffffc900053573f0 EFLAGS: 00010202 [ 582.989230][ T995] RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000002 [ 582.997176][ T995] RDX: 0000000000000000 RSI: ffffffff8831e445 RDI: ffff888028c39ec0 [ 583.005126][ T995] RBP: 0000000000000008 R08: 0000000000000005 R09: 0000000000000000 [ 583.013073][ T995] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90005357690 [ 583.021024][ T995] R13: ffffc90005357670 R14: 0000000000000178 R15: 0000000000000000 [ 583.028981][ T995] FS: 0000000000000000(0000) GS:ffff888124374000(0000) knlGS:0000000000000000 [ 583.037900][ T995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 583.044468][ T995] CR2: 0000001b344bbff8 CR3: 000000007893e000 CR4: 00000000003526f0 [ 583.052427][ T995] Call Trace: [ 583.055691][ T995] [ 583.058606][ T995] ? __pfx_vidtv_psi_ts_psi_write_into+0x10/0x10 [ 583.064923][ T995] vidtv_psi_pmt_write_into+0x3b2/0xa70 [ 583.070455][ T995] ? __pfx_vidtv_psi_pmt_write_into+0x10/0x10 [ 583.076509][ T995] ? vidtv_psi_pat_write_into+0x56a/0x690 [ 583.082214][ T995] ? __pfx_vidtv_psi_pat_write_into+0x10/0x10 [ 583.088270][ T995] ? unwind_next_frame+0x3be/0x2090 [ 583.093481][ T995] ? unwind_next_frame+0x3be/0x2090 [ 583.098664][ T995] ? unwind_next_frame+0x3c8/0x2090 [ 583.103847][ T995] ? ret_from_fork_asm+0x1a/0x30 [ 583.108781][ T995] vidtv_mux_push_si+0x932/0xe80 [ 583.113788][ T995] ? __pfx_vidtv_mux_push_si+0x10/0x10 [ 583.119224][ T995] ? kfree_skbmem+0x19a/0x210 [ 583.123890][ T995] ? __lock_acquire+0x4a5/0x2630 [ 583.128807][ T995] ? vidtv_memset+0x50/0x90 [ 583.133293][ T995] ? vidtv_ts_pcr_write_into+0x45b/0x650 [ 583.138909][ T995] ? debug_object_activate+0x331/0x490 [ 583.144357][ T995] ? debug_object_activate+0x331/0x490 [ 583.149803][ T995] vidtv_mux_tick+0xe93/0x1460 [ 583.154545][ T995] ? __lock_acquire+0x4a5/0x2630 [ 583.159464][ T995] ? __pfx_vidtv_mux_tick+0x10/0x10 [ 583.164652][ T995] ? __lock_acquire+0x4a5/0x2630 [ 583.169582][ T995] ? do_raw_spin_unlock+0x145/0x1e0 [ 583.174766][ T995] ? debug_object_deactivate+0x2e4/0x3b0 [ 583.180395][ T995] ? rcu_is_watching+0x12/0xc0 [ 583.185159][ T995] process_one_work+0xa0e/0x1980 [ 583.190095][ T995] ? __pfx_process_one_work+0x10/0x10 [ 583.195455][ T995] ? __pfx_vidtv_mux_tick+0x10/0x10 [ 583.200637][ T995] worker_thread+0x5ef/0xe50 [ 583.205214][ T995] ? __pfx_worker_thread+0x10/0x10 [ 583.210313][ T995] ? kthread+0x13a/0x450 [ 583.214536][ T995] ? __pfx_worker_thread+0x10/0x10 [ 583.219627][ T995] kthread+0x370/0x450 [ 583.223675][ T995] ? __pfx_kthread+0x10/0x10 [ 583.228252][ T995] ret_from_fork+0x72b/0xd50 [ 583.232827][ T995] ? __pfx_ret_from_fork+0x10/0x10 [ 583.237917][ T995] ? __switch_to+0x800/0x1100 [ 583.242576][ T995] ? __switch_to_asm+0x39/0x70 [ 583.247322][ T995] ? __pfx_kthread+0x10/0x10 [ 583.251889][ T995] ret_from_fork_asm+0x1a/0x30 [ 583.256637][ T995] [ 583.259633][ T995] Modules linked in: [ 583.264689][ T995] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 584.689887][ T995] RIP: 0010:vidtv_psi_ts_psi_write_into+0x4bb/0xb40 [ 584.727788][ T995] Code: 9b 26 d6 f9 4d 8d 65 20 4c 89 e0 48 c1 e8 03 80 3c 18 00 0f 85 fe 04 00 00 49 8b 45 20 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 <0f> b6 14 1a 38 ca 7f 08 84 d2 0f 85 c6 04 00 00 0f b6 10 48 8b 7c [ 584.860117][ T995] RSP: 0018:ffffc900053573f0 EFLAGS: 00010202 [ 584.898375][ T995] RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000002 [ 584.967222][ T995] RDX: 0000000000000000 RSI: ffffffff8831e445 RDI: ffff888028c39ec0 [ 585.025548][ T995] RBP: 0000000000000008 R08: 0000000000000005 R09: 0000000000000000 [ 585.075960][ T995] R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90005357690 [ 585.139116][ T995] R13: ffffc90005357670 R14: 0000000000000178 R15: 0000000000000000 [ 585.180939][ T995] FS: 0000000000000000(0000) GS:ffff888124374000(0000) knlGS:0000000000000000 [ 585.239110][ T995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 585.281001][ T995] CR2: 000055b598853ee8 CR3: 00000000275fa000 CR4: 00000000003526f0 [ 585.338527][ T995] Kernel panic - not syncing: Fatal exception [ 585.344653][ T995] Kernel Offset: disabled [ 585.348957][ T995] Rebooting in 86400 seconds..