last executing test programs: 7.738209887s ago: executing program 1 (id=422): socket$can_bcm(0x1d, 0x2, 0x2) 7.737444839s ago: executing program 1 (id=425): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user', 0x2, 0x0) 7.6542074s ago: executing program 1 (id=428): rt_sigreturn() 5.390350507s ago: executing program 2 (id=585): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vndbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vndbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vndbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vndbinder', 0x800, 0x0) 5.389794947s ago: executing program 2 (id=588): sync() 5.181662104s ago: executing program 1 (id=597): tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 5.181572879s ago: executing program 0 (id=598): setuid(0x0) 5.181219554s ago: executing program 0 (id=601): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0', 0x800, 0x0) 4.894181991s ago: executing program 3 (id=620): clock_nanosleep(0x0, 0x0, &(0x7f0000000000), 0x0) 4.882612375s ago: executing program 3 (id=622): socket$rxrpc(0x21, 0x2, 0x0) 4.857927406s ago: executing program 0 (id=623): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp1', 0x800, 0x0) 4.857792743s ago: executing program 4 (id=624): setresuid(0x0, 0x0, 0x0) 4.794315392s ago: executing program 4 (id=625): rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0) 4.794010484s ago: executing program 3 (id=626): fchdir(0xffffffffffffffff) 3.874508386s ago: executing program 1 (id=631): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2.986458094s ago: executing program 0 (id=627): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2.722285887s ago: executing program 4 (id=630): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2.55593573s ago: executing program 2 (id=628): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2.492273816s ago: executing program 1 (id=632): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/direct', 0x2, 0x0) 1.775169393s ago: executing program 3 (id=633): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.767816766s ago: executing program 0 (id=634): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.205008761s ago: executing program 4 (id=635): open_tree(0xffffffffffffffff, &(0x7f0000000000), 0x0) 1.118245183s ago: executing program 4 (id=640): socket$nl_rdma(0x10, 0x3, 0x14) 1.115638418s ago: executing program 2 (id=637): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 804.708975ms ago: executing program 3 (id=639): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 499.628411ms ago: executing program 0 (id=638): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 275.370939ms ago: executing program 2 (id=642): syz_open_dev$midi(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$midi(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$midi(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$midi(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$midi(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$midi(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$midi(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$midi(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$midi(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$midi(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$midi(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$midi(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$midi(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$midi(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$midi(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$midi(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$midi(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$midi(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$midi(&(0x7f0000000500), 0x4, 0x800) 234.829357ms ago: executing program 2 (id=645): rseq(&(0x7f0000000000), 0x0, 0x0, 0x0) 100.897508ms ago: executing program 4 (id=641): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=643): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.9' (ED25519) to the list of known hosts. [ 73.166807][ T5604] cgroup: Unknown subsys name 'net' [ 73.261424][ T5604] cgroup: Unknown subsys name 'cpuset' [ 73.271642][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.705686][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.009019][ T5943] mmap: syz.2.303 (5943) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 85.401752][ T6285] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 86.411650][ T6311] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.413782][ T6311] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.422926][ T6311] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.440622][ T6311] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.455008][ T6311] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.098425][ T43] cfg80211: failed to load regulatory.db [ 89.384380][ T4945] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI [ 89.397188][ T4945] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 89.406743][ T4945] CPU: 0 UID: 0 PID: 4945 Comm: jbd2/sda1-8 Not tainted syzkaller #0 PREEMPT(full) [ 89.418050][ T4945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.432016][ T4945] RIP: 0010:__bh_submit+0x22d/0x8d0 [ 89.437863][ T4945] Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 26 f6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 04 f6 d7 ff 4d 8b 3f 4c 89 fe 48 [ 89.460957][ T4945] RSP: 0018:ffffc9001016f868 EFLAGS: 00010202 [ 89.467503][ T4945] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b96ff9 [ 89.476403][ T4945] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888075a7a660 [ 89.485054][ T4945] RBP: 0000000000009801 R08: ffff888075a7a6bf R09: 1ffff1100eb4f4d7 [ 89.494844][ T4945] R10: dffffc0000000000 R11: ffffed100eb4f4d8 R12: dffffc0000000000 [ 89.503526][ T4945] R13: ffff888075a7a640 R14: ffff8880123a17e0 R15: 0000000000000008 [ 89.512214][ T4945] FS: 0000000000000000(0000) GS:ffff888124ccb000(0000) knlGS:0000000000000000 [ 89.522531][ T4945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.529819][ T4945] CR2: 00007fe1ee627da0 CR3: 0000000074fa8000 CR4: 00000000003526f0 [ 89.539080][ T4945] Call Trace: [ 89.542472][ T4945] [ 89.546479][ T4945] ? __pfx_journal_end_buffer_io_sync+0x10/0x10 [ 89.553197][ T4945] jbd2_journal_commit_transaction+0x22a9/0x5cd0 [ 89.561293][ T4945] ? __pfx_jbd2_journal_commit_transaction+0x10/0x10 [ 89.569243][ T4945] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 89.575982][ T4945] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 89.583044][ T4945] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 89.589196][ T4945] ? __timer_delete_sync+0x4a7/0x520 [ 89.595253][ T4945] kjournald2+0x3bc/0x750 [ 89.600488][ T4945] ? __pfx_kjournald2+0x10/0x10 [ 89.605540][ T4945] ? __pfx_autoremove_wake_function+0x10/0x10 [ 89.612146][ T4945] ? __kthread_parkme+0x71/0x1f0 [ 89.619283][ T4945] ? __kthread_parkme+0x199/0x1f0 [ 89.624608][ T4945] kthread+0x38b/0x480 [ 89.629465][ T4945] ? __pfx_kjournald2+0x10/0x10 [ 89.634418][ T4945] ? __pfx_kthread+0x10/0x10 [ 89.639813][ T4945] ret_from_fork+0x514/0xb70 [ 89.645471][ T4945] ? __pfx_ret_from_fork+0x10/0x10 [ 89.651376][ T4945] ? __switch_to+0xc89/0x1420 [ 89.656283][ T4945] ? __pfx_kthread+0x10/0x10 [ 89.661172][ T4945] ret_from_fork_asm+0x1a/0x30 [ 89.666322][ T4945] [ 89.669568][ T4945] Modules linked in: [ 89.674021][ T4945] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 89.759124][ T4945] RIP: 0010:__bh_submit+0x22d/0x8d0 [ 89.765706][ T4945] Code: c1 e8 03 48 89 44 24 18 42 80 3c 20 00 74 08 48 89 df e8 26 f6 d7 ff 48 89 5c 24 28 48 8b 1b 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 04 f6 d7 ff 4d 8b 3f 4c 89 fe 48 [ 89.787805][ T4945] RSP: 0018:ffffc9001016f868 EFLAGS: 00010202 [ 89.794077][ T4945] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff84b96ff9 [ 89.804309][ T4945] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888075a7a660 [ 89.812890][ T4945] RBP: 0000000000009801 R08: ffff888075a7a6bf R09: 1ffff1100eb4f4d7 [ 89.821905][ T4945] R10: dffffc0000000000 R11: ffffed100eb4f4d8 R12: dffffc0000000000 [ 89.832303][ T4945] R13: ffff888075a7a640 R14: ffff8880123a17e0 R15: 0000000000000008 [ 89.832348][ T4945] FS: 0000000000000000(0000) GS:ffff888124dcb000(0000) knlGS:0000000000000000 [ 89.832364][ T4945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.832378][ T4945] CR2: 00007f87c696cf80 CR3: 000000000eb48000 CR4: 00000000003526f0 [ 89.832399][ T4945] Kernel panic - not syncing: Fatal exception [ 89.878662][ T4945] Kernel Offset: disabled [ 89.883046][ T4945] Rebooting in 86400 seconds..